A Structured Resilience Assessment Cycle and Its Agentic Implementation: The A-RAS System for Electrical Infrastructure

Abstract

The resilience of electrical grid infrastructures is increasingly challenged by high penetration of renewables, climate-induced stress events, and complex interdependencies between assets and control systems. This paper proposes a structured Resilience Assessment Cycle (RAC) and operationalizes it through a novel LLM-orchestrated Agentic Resilience Assessment System (A-RAS) for quantitative assessment of resilience to extreme weather events. RAC defines a structured assessment process linking disturbance characterization, operational-state evaluation, resilience quantification, and interpretation of the resulting system response. A-RAS implements this process through coordinated numerical engines and agentic components. First, an anomaly detection engine applies a residual-based Exponentially Weighted Moving Average scheme (OpS-EWMA) to identify incipient operational shifts in heterogeneous equipment from SCADA time series. Second, a labeling and diagnostic engine employs a retrieval-augmented RAG-LLM pipeline to generate structured diagnostic explanations and, in a subsequent step, assign operational state labels using a dual-scoring mechanism that combines two independent “votes”: a quantitative score derived from data-driven anomaly severity and a qualitative score derived from LLM-based semantic assessment. Third, a resilience assessment agent integrates (i) a module that detect extreme weather event windows and (ii) a module that computes a dual-output resilience vector—a service-performance deficit and a residual health-state deficit—derived from the temporal evolution of system performance and asset condition over the defined assessment horizon. Finally, a core orchestration agent manages data flow and task delegation, enabling automated, end-to-end resilience assessment. In contrast to existing approaches that represent equipment condition as a binary—functional or failed—the proposed methodology explicitly integrates the heterogeneity and temporal evolution of operating states. By accounting for intermediate health conditions, it addresses a key limitation of prevailing metrics: their limited ability to explain observed system behavior during stress events. The feasibility and practical value of the approach are demonstrated on a real operational wind power plant, showing that resilience trajectories can be traced to residual health deficits and the contributing equipment. As an initial implementation validated on a single site and hazard class, RAC and A-RAS provide a structured and extensible foundation intended to be generalized across additional assets, hazards, and operational contexts in future work.

1. Introduction

Electrical power systems are undergoing substantial transformation owing to decarbonization, increasing penetration of renewable energy sources, and growing exposure to climate-induced stressors. These developments increase both operational complexity and the potential for disturbances to propagate across interconnected assets and control systems. The established reliability paradigm—primarily concerned with maintaining service under expected operating conditions—is therefore increasingly complemented by the broader concept of resilience. Resilience characterizes the ability of a power system to withstand, adapt to, and recover from high-impact, low-probability (HILP) events, including natural hazards, cyber-physical disruptions, and disturbances affecting interconnected infrastructures. Its quantitative assessment requires disturbance characteristics (type and intensity) to be related to the magnitude and duration of performance degradation and to the subsequent recovery trajectory. Such assessments support the prioritization of mitigation measures, operational interventions, and infrastructure investments intended to improve system resilience.

Despite extensive research on resilience enhancement, resilience quantification remains methodologically fragmented. Existing approaches employ aggregated functionality curves, hazard-specific fragility models, reliability-derived surrogates, probabilistic simulations, and indicator-based formulations, often with limited comparability across studies. Recent reviews identify persistent ambiguity in resilience definitions and a lack of universally accepted and operationally deployable metrics [1], while the IEEE PES Task Force emphasizes that resilience quantification should remain transparent, comprehensible, and reproducible [2]. Beyond metric selection, assessment studies differ in how they characterize disturbances, define system boundaries, select performance variables, determine recovery criteria, evaluate consequences, and translate results into resilience-enhancement decisions. These differences motivate a structured assessment cycle that organizes the principal stages of resilience evaluation without prescribing a single universal metric.

A second limitation concerns the representation of equipment condition. Many system-level resilience assessments treat component condition implicitly through availability assumptions, fixed degradation parameters, or hazard-based fragility models rather than through operational health states derived from condition-monitoring data. However, condition monitoring is increasingly recognized as an enabler of infrastructure robustness and resilience, particularly in environments where access and repair are constrained [3]. Health-informed planning studies further show that incorporating probabilistic asset-health indices can materially affect intervention priorities and system-level outcomes [4]. These findings indicate that asset condition should be represented explicitly when resilience is evaluated at the event scale.

This limitation is important because HILP events affect assets in a state-dependent manner. Equipment exhibiting degradation or incipient anomalies may retain sufficient functionality under normal conditions while possessing reduced margins to withstand disturbance-related loading. Performance-only metrics may therefore indicate service restoration even when equipment condition remains degraded and the system retains elevated post-event vulnerability. Addressing this limitation requires state-aware, or health-conditioned, resilience assessment in which service-performance trajectories are interpreted jointly with evolving operational evidence obtained from SCADA measurements, alarms, maintenance records, inspections, and weather data.

Artificial intelligence provides several mechanisms for operationalizing such assessments. Machine-learning methods support failure prediction and disturbance-response analysis [5,6], while digital-twin-assisted forecasting can improve situational awareness and the early identification of abnormal conditions [7]. AI-based methods have also been proposed to address limitations in resilience modeling and evaluation [8]. More recently, generative AI and large language models have been investigated for energy-system anomaly interpretation, equipment diagnostics, grid analysis, and tool orchestration. Representative studies include real-time anomaly-detection methods [9], hierarchical asset-health diagnostic architectures [10], and agentic systems for detecting and remediating grid violations [11]. Surveys further identify applications in power-system control, forecasting, demand response, voltage regulation, reliability analysis, maintenance evaluation, and optimization [12]. These developments demonstrate the expanding scope of AI-enabled energy applications, but the individual methods generally address isolated analytical or operational tasks rather than an integrated resilience-assessment process.

To address these methodological and implementation gaps, this paper pursues two related objectives. First, it proposes a structured Resilience Assessment Cycle (RAC) that organizes resilience evaluation as an iterative and technology-independent process. Second, it introduces the Agentic Resilience Assessment System (A-RAS) as an initial computational implementation of the event-scale analytical stages of the RAC. A-RAS combines deterministic numerical engines with LLM-assisted diagnostic interpretation and workflow orchestration to connect disturbance characterization, operational-state estimation, service-performance evaluation, and resilience quantification within a traceable process. The implementation is designed to preserve the reproducibility of numerical analyses while enabling operational evidence and intermediate results to be interpreted through a consistent semantic layer.

To position A-RAS relative to adjacent research areas,

Table 1. Capability coverage of representative anomaly-detection, diagnostic, agentic, and resilience assessment approaches in energy and power-system applications, positioned against the proposed RAS framework. Symbols denote the extent to which each capability is demonstrated in the cited work, not its quality; definitions are given in the notes below.

Approach	Domain & Primary Objective	AD	DX	HL	LLM Role	Architecture	SP	RES	REC	Direct Comparability
Classical SPC (MF): Shewhart, CUSUM, EWMA, PCA-T2	Process/equipment monitoring; control-limit breach detection	●	○	○	—	Statistical pipeline	○	○	○	No—detection layer only; no resilience or health output
ML/DL detectors—autoencoders, LSTM-VAE, TCN, GAN; [9]	Energy-system anomaly/cyber-threat detection	●	◐	○	—	Learned model pipeline	○	○	○	No—high-accuracy detection; black-box, no health or resilience layer
RAG-enhanced LLM diagnostic assistants (MF)	Post hoc explanation of alarms/detected faults	○	●	○	Explanation, grounding	LLM + retrieval pipeline	○	○	○	No—explanation only; detection decoupled, no quantification
Grid-Agent [11]	Autonomous detection & remediation of grid violations (control)	◐	○	○	Planning, validation, control	Autonomous multi-agent	◐	○	◐	No—control-oriented; violation remediation, not condition-based resilience
GridMind [13]	Conversational power-system analysis (AC-OPF, N-1)	○	○	○	Orchestration of solvers, NL interface	Multi-agent + deterministic solvers	◐	○	○	No—analysis interface; no SCADA condition monitoring
PowerChain [14]	Verifiable automation of distribution-grid analyses	○	○	○	Workflow composition + verification	Agentic orchestration + verifier	◐	○	○	No—workflow automation; no health or resilience metric
PowerDAG [15]	Reliable agentic orchestration; benchmarks LangChain/CrewAI/ReAct	○	○	○	Tool orchestration, JIT supervision	DAG orchestration	○	○	○	Partial—orchestration only. The one defensible comparator, and only for orchestration reliability, not diagnostics
X-GridAgent [16]	LLM-assisted power-grid analysis	○	○	○	Reasoning, task assistance	Agentic AI system	◐	○	○	No—analysis assistance; no condition or resilience layer
Resilience metrics—ΦΛEΠ; area-/probabilistic-based (MF)	Quantify performance loss & recovery under HILP events	—	○	○	—	Analytical/simulation	●	●	●	Partial—the service-side benchmark. Assumes binary component states; no condition awareness
Health-informed planning [4]	Asset health indices in planning/CBM as resilience enabler	◐	◐	●	—	Probabilistic/planning models	◐	◐	○	Partial—the health-side benchmark. Planning horizon, not event-scale dual output
A-RAS (RAC implementation)	Event-scale, health-conditioned resilience assessment for wind fleets	●	●	●	Diagnostic reasoning, retrieval, synthesis	LLM-augmented agentic workflow	●	●	●	No existing framework spans all seven dimensions

Table notes and definitions: Coverage symbols. ● Full—the capability is a stated objective of the work and is demonstrated. ◐ Partial—the capability is present but subordinate, implicit, or demonstrated only in restricted form. ○ Not demonstrated—not addressed in the cited work (this is a scope statement, not a criticism). — Not applicable—the capability is outside the method’s frame of reference. Capability columns. AD = time-series anomaly detection. DX = equipment- or component-level diagnostic/root-cause inference. HL = prognostic or health-state assessment (quantified asset condition). SP = service-performance assessment (delivered function against an expected reference). RES = resilience quantification. REC = recovery quantification (restoration trajectory or time-to-recover). Architecture terminology follows the workflow/agent distinction of Anthropic [17] and the agentic-AI taxonomy of [18]: workflows orchestrate LLMs and tools along predefined code paths, whereas autonomous agents dynamically direct their own processes and tool selection. The proposed system is deliberately the former. Approach column. MF denotes method family; these rows represent classes of approaches rather than individual implementations or publications.

compares representative approaches across seven capabilities required by the proposed implementation: time-series anomaly detection, component-level diagnostic inference, health-state assessment, service-performance assessment, resilience quantification, recovery quantification, and LLM-supported interpretation or orchestration.

Table 1 identifies four complementary but largely disconnected research strands. Statistical and machine-learning methods provide mature anomaly-detection capabilities but generally do not produce equipment-level diagnoses, health-state indicators, or resilience outputs. LLM-based diagnostic assistants generate interpretable explanations but are commonly decoupled from signal-level detection and quantitative system assessment. Agentic grid systems coordinate solvers, analysis tools, or control actions, but primarily target network analysis and violation remediation rather than condition-based assessment of physical assets. Finally, established resilience methods quantify performance loss and recovery, whereas health-informed approaches typically evaluate asset condition over planning horizons rather than within event-scale recovery analysis. Among the reviewed approaches, none integrates the complete sequence from operational time-series analysis and component-level interpretation to health-conditioned service assessment and explicit recovery quantification. A-RAS is designed to connect these capabilities within a single traceable workflow.

Each strand therefore addresses a subset of the problem. What Table 1 makes visible is that no reviewed framework spans the full chain from time-series anomaly detection, through component-level diagnostic inference and health-state quantification, to service-performance evaluation and resilience quantification with explicit recovery assessment. The present work integrates these elements within a single orchestrated methodology and pairs a service-resilience indicator with an equipment-health indicator, so that the resilience result reports not only how much performance was lost and recovered, but which assets account for it and how.

This study presents an initial formulation of the RAC and an initial implementation of its event-scale analytical stages through A-RAS. The objective is not to establish a universal resilience metric or a fully autonomous decision system, but to demonstrate a reproducible assessment process, evaluate the feasibility of incorporating evolving equipment condition into resilience quantification, and establish an extensible basis for subsequent methodological development. Within this scope, the main contributions are fourfold:

• A structured Resilience Assessment Cycle. The RAC defines a structured, iterative, and technology-independent process encompassing disturbance characterization, definition of resilience objectives and system boundaries, selection of performance variables and analytical methods, resilience quantification, consequence interpretation, and identification of resilience-enhancement measures;
• An agentic implementation of the RAC through A-RAS. A-RAS operationalizes the event-scale analytical stages of the RAC through a graph-orchestrated, LLM-augmented workflow coordinating deterministic engines for extreme-event detection, anomaly assessment, diagnostic interpretation, and resilience quantification;
• A health-conditioned dual-output resilience formulation. The formulation combines the service-performance trajectory $Q(t)$ and asset-health trajectory $H(t)$ to produce $\overrightarrow{R}=(R_{svc}, R_{hlth})$, thereby separately quantifying service-performance deficit and residual health-state deficit;
• An operational feasibility demonstration. The integrated approach is evaluated using operational wind-farm data under extreme-wind conditions, demonstrating that service restoration and asset-health recovery may occur on different timescales and that residual health deficits can be traced to contributing turbines, components, and sensor deviations.

The remainder of the paper is organized as follows. Section 2 reviews resilience concepts, metrics, and methodological gaps, derives the proposed RAC and examines agentic AI as an implementation mechanism for resilience assessment. Section 3 presents A-RAS methodology, including its architecture, analytical engines, orchestration logic, and health-conditioned dual-output formulation. Section 4 evaluates the integrated approach using operational wind-farm data, demonstrating the capabilities summarized in Table 1 and discussing the principal findings and limitations. Section 5 concludes the paper by summarizing the main contributions, asset-management implications, and directions for extending the RAC and A-RAS across additional assets, hazards, and operational contexts.

2. Literature Review

2.1. Power System Resilience: Paradigms, Metrics, and the Operational Gap

2.1.1. From Reliability to Resilience

Electric power networks have long been designed under the paradigm of reliability—the probability that systems perform as intended under expected conditions for a specific period of time. Reliability engineering focuses on mean-time-to-failure, reserve margins and redundancy to meet routine load patterns and probable disturbances. Conventional reliability indices such as SAIFI, SAIDI, and ASAI quantify interruption frequency and duration under routine faults and credible contingencies [19,20]. This paradigm is primarily intended for statistically characterized and relatively localized contingencies and therefore has limited capacity to represent interdependent, geographically dispersed, and statistically non-stationary disturbance events. However, the exposure of power systems to HILP events—including climate-induced extreme weather, geomagnetic disturbances, cyber-physical attacks, pandemics, and cascading infrastructure interdependencies—often produces correlated, multi-component failures and non-linear cascading effects that cannot be adequately captured by steady-state reliability metrics. Risk management approaches have attempted to absorb resilience into conventional reliability frameworks by defining “non-resilience” as the risk of failing to maintain critical functionality [21]. However, they typically evaluate components in isolation, overlook systemic interdependencies and lack indicators of absorptive capacity and recovery speed. A resilient distribution system thus requires more than redundancy—it must incorporate metrics, design hardening, preparedness, response and recovery capacity, and explicit analysis of interconnections between subsystems [8].

The conceptual shift toward resilience emerged in infrastructure research in the early 2000s. A foundational milestone was the “resilience triangle” introduced by the Multidisciplinary Center for Earthquake Engineering Research (MCEER), which represented performance degradation and restoration as a triangular area between baseline and reduced functionality [22]. This visualization highlighted that resilience depends not only on the magnitude of performance loss but also on recovery time. Panteli and Mancarella extended this to the resilience trapezoid, adding a plateau at minimum performance and highlighting the phases of disturbance progression, degraded state and restoration [23]. In these models, resilience is measured by the area under the performance curve, the depth of the nadir and the time required to recover. More recent work frames resilience as a dynamic function with four components—preparation and planning, withstanding capacity, recovery speed and adaptation [24]. The principal contributing factors to resilience are defined [25] as follows and provide a useful analytical vocabulary for distinguishing the system properties and temporal phases that resilience assessments seek to represent:

• Robustness: The ability of a critical infrastructure system (CIS) to withstand a given level of disruption and maintain its core functionality without significant performance degradation. It reflects the residual performance immediately after impact and is closely related to concepts such as resistance, stability, and survivability;
• Recoverability: The capability of a CIS to restore its functionality and operational capacity following a disruption, within available resources and operational constraints. It emphasizes the effectiveness of recovery actions, although some definitions focus primarily on speed rather than resource dependency;
• Rapidity: The rate at which a CIS regains an acceptable level of performance after disruption. It corresponds to the slope of the recovery trajectory and is commonly interpreted as the recovery rate over time;
• Absorptive Capacity: The inherent ability of a CIS to internally absorb and mitigate the adverse effects of disruptive events without external intervention. It includes proactive design measures and preparedness strategies that reduce immediate performance loss and limit cascading impacts;
• Adaptive Capacity: The extent to which a CIS can reorganize, reconfigure, or implement temporary non-standard actions during and immediately after disruption to prevent system collapse and sustain partial functionality before permanent restoration measures are deployed;
• Restorative Capacity: The ability of a CIS to permanently repair damage and fully reinstate performance levels after disruption. It depends on resource availability, logistical support, and financial capacity, and typically involves higher costs than adaptive measures.

Each of these contributing factors can be operationalized through quantitative indicators that collectively support resilience assessment and benchmarking. Collectively, these attributes support the evaluation of system performance across disturbance phases and the identification of structural and operational vulnerabilities. The resulting assessment provides an analytical basis for selecting resilience-enhancement measures, which may be broadly classified as planning or operational interventions. Planning measures relate to the physical hardening of system components to higher standards and aim to reduce the impact of disruptive events by decreasing the magnitude of performance degradation. Operational measures, in contrast, leverage smart grid technologies that enable operators to implement corrective actions within minutes of a disturbance, thereby shortening restoration time and improving recovery trajectories [26]. These strategies include vegetation management, undergrounding overhead lines, modular microgrid architectures and coordinated disaster-response plans [27]. For instance, resilience assessment techniques addressing risks such as black sky events have been systematically reviewed. Short- and long-term resilience strategies, including decentralization through microgrids, have been analyzed in the context of grid modernization [28]. Likewise, distributed energy systems have been emphasized as a key resilience-enhancing strategy that strengthens local autonomy and system flexibility [29]. While these concepts describe what a resilient system should be capable of doing, their practical use depends on translating them into measurable variables, performance functions, recovery criteria, and decision-relevant indicators.

2.1.2. Quantifying Resilience: The Metric Landscape

Numerous assessment frameworks have been proposed to operationalize resilience. These approaches are generally classified as qualitative or quantitative (Figure 1). Qualitative approaches focus on conceptual frameworks addressing system stress, adaptive capacity, fuel supply chain, and organizational interactions. They do not rely on explicit numerical descriptors and are typically divided into two categories: (i) conceptual frameworks that provide best practices and theoretical interpretations of resilience without quantitative outputs, and (ii) semi-quantitative index-based approaches grounded in expert judgment across different phases or attributes of resilience [30]. In contrast, quantitative approaches describe resilience using deterministic or probabilistic formulations that explicitly incorporate system performance over time. These models may be static or dynamic, but they share a common principle: resilience is quantified through the temporal evolution of a performance function before, during, and after a disturbance [31].

Quantitative resilience modeling can be grouped into three principal categories. Index-based approaches combine multiple indicators into composite measures intended to represent broader resilience characteristics. General resilience approaches provide dimensionless metrics through deterministic or probabilistic performance formulations that may be transferable across domains. These methods typically compare system performance levels before and after disruption, often using normalized indicators. Recent developments increasingly incorporate stochastic representations to account for aleatory and epistemic uncertainties. Structural modeling approaches rely on domain-specific representations of system components and their interdependencies. In such models, resilience is inferred from structural, topological, simulation-based (dynamic), optimization-based, probabilistic or fuzzy-logic-based analyses tailored to the infrastructure under study.

Across these approaches, resilience metrics fundamentally depend on a performance function $F(t)$. Whether expressed as an index, an area-based metric, or derived from structured simulations, resilience quantification relies on system performance trajectories (e.g., energy not supplied (ENS), expected demand not served (EDNS), loss of load probability (LOLP)). These formulations evaluate deviations from nominal performance over time and capture key attributes such as performance loss magnitude, nadir depth, and recovery duration within a unified analytical framework [32].

Table 2. Representative quantitative resilience formulations, performance variables, and metrics in power-system and infrastructure applications.

Reference	Objective and Type of Disturbance	Variable(s) to Be Quantified	Objective Function/Resilience Curve	Resilience Metric/Index	Type of Quantitative Approach
[33]	Assess the resilience of interdependent infrastructures to external disturbances	$R$: Robustness ${RAPI}_{DP}$: Rapidity—disturbance phase ${RAPI}_{RP}$: Rapidity—restoration phase $TAPL$: Time-Averaged Performance Loss $RA$: Recovery Ability	$F\left(t\right)=MOP(t)$ Performance measure	$R\left(t\right)=R\times {\displaystyle \frac{{RAPI}_{RP}}{{RAPI}_{DP}}}\times {(TAPL)}^{-1}\times RA$	Structural Model—Simulation
[34]	Operational resilience assessment of complex and interdependent power grids under natural disasters and critical contingencies	$N_l$: Number of customers connected to line l $d$: Customers reconnected through manual restoration procedures $\delta$: Indicator of the system’s local operational state	$F\left(t\right)=QoS\left(t\right)= N_l-{\displaystyle \sum _{j=1}^m}{d}_j{\delta }_j(t)$ Quality of service level	$R\left(t\right)={\displaystyle \frac{1}{{\int }_{t_0}^{t_0+T_{RE}}[1-Qos(t)]dt}}$	Structural Model—Simulation
[35]	Availability-based resilience metric from a reliability engineering perspective under external disturbances	$A_1$: Steady-state availability $A_2$: Availability in the transient state after the shock $A_2$: Steady-state availability after the shock	$\mathrm{F}(\mathrm{t})=\mathrm{A}(\mathrm{t})=(A_1,A_2,A_3$) Availability based on prior probabilities of common-cause failures and corresponding component repair rates	$R(t)={\displaystyle \frac{A_1}{n\times \mathrm{l}\mathrm{n}(t_1)}}{\sum }_{i=1}^n{\displaystyle \frac{A_2^i{A}_3^i}{\mathrm{l}\mathrm{n}(t_3^i-t_2^i)}}$	General Measures—Probabilistic Approach
[36]	Operational resilience assessment of electrical distribution networks	$L$: Nonlinear load-loss function $t$: Total time required for the system to recover to an acceptable performance level	$F\left(l\right)=0.5\times (L(I)t(I))$	$R\left(t\right)={\displaystyle \frac{{\int }_{U(I)\ge {VaR}_{\propto }}F(I)p(I)dI}{(1-\propto )}}$	General Measures—Probabilistic Approach
[37]	Resilience assessment of a distribution system under hurricane events	$P(Nh)$: Probability of $Nh$ cyclonic events $P{d}_k$: Percentage of nominal active power demand for load type k $P_{PV}$: Photovoltaic generation $P_{avail}$: Available active power $P_{req}$: Total required active power to supply all loads	$F(t)={\displaystyle \frac{{\int }_0^T{P}_{avail}(Nh,P{d}_k\left(t\right),P_{PV}\left(t\right)) dt}{{\int }_0^T{P}_{req}\left(P{d}_k\left(t\right),P_{PV}\left(t\right)\right) dt}}$	$R\left(t\right)={\displaystyle \sum _{Nh=1}^{NH}}P(Nh)\times E\left[F(t)\right]$	General Measures—Probabilistic Approach
[38,39]	Quantification of operational and infrastructure resilience levels under severe windstorms	$\Phi$: Slope of degradation during the event $\Lambda$: Resilience degradation level ${\rm E}$: Duration during which the network remains in a degraded state after the disturbance $\Pi$: Slopes of recovery curves (operational and infrastructure)	$F\left(t\right)=MOPN(t)$ Normalized performance measure	$R\left(t\right)=(\Phi ,\Lambda ,{\rm E},\Pi )$	Indicator-Based Measures
[40,41]	Resilience evaluation of cyber-physical power systems under typhoon events	$R(t)$: Power supply level under normal operation ($R_{Pnormal}$) or under disaster conditions ($R_{Pdisaster}$)	$F\left(t\right)= {\displaystyle \frac{R_{Pdisaster}(t)}{R_{Pnormal}(t)}}$ Electric power supply level	$R_{EI}(t)=E\left({\displaystyle \frac{{\int }_{t_o}^{t_4}{R}_{Pdisaster}dt}{{\int }_{t_o}^{t_4}{R}_{Pnormal}dt+{\int }_{t_4}^{t_5}({R_{Pnormal}-R}_{Pdisaster})dt}}\right)$	Deterministic Approach
[42]	Optimization of equipment repair sequencing by minimizing the resilience index under earthquake scenarios	$E_0$: Total power distributed through outgoing terminals $E_1$: Total power collected through incoming terminals $E_T$: Total transformer loading capacity	$F =\mathrm{m}\mathrm{i}\mathrm{n}(E_1,E_T,E_0)$ Total power level	$R(t)={\int }_0^{t_0}\left(F_0-F(t)\right)dt$	Structural Model—Topology-Based
[43]	Resilience assessment of transportation systems under extreme rainfall events	$V$: Average traffic/load flow during an extreme event	$F\left(t\right)={\displaystyle \frac{V_t}{V_0}}\times 100\%$ Traffic/load level	$R(t)={\displaystyle \frac{{\int }_{t_0}^{t}F\left(t\right)dt}{F(t_0)\times (t-t_0)}}$	General Measures—Deterministic Approach
[44]	Measurement of resilience in electrical distribution networks	$T_U$: Up time—operational time $T_D$: Down time—downtime	$F\left(t\right)=R(t)$ Power supply base resilience	$R\left(t\right)={\displaystyle \frac{{\displaystyle {\sum }_{i=1}^N}{T}_{U,i}}{{\displaystyle {\sum }_{i=i}^N}{T}_{U,i}+T_{D,i}}}$	General Measures—Deterministic Approach

summarizes representative quantitative approaches to illustrate how disturbance definitions, performance variables, objective functions, and resulting resilience indicators differ across applications. The purpose is to identify the methodological decisions that must be made explicitly in a reproducible Resilience Assessment Cycle. Structural models derive resilience indices from restoration rapidity (RAPI), time-averaged performance loss (TAPL) and recovery ability (RA), while probabilistic approaches employ availability models, loss distributions and load-loss functions to compute expected resilience. Indicator-based measures capture degradation slopes, duration of degraded states and recovery gradients. Deterministic approaches evaluate resilience of cyber-physical systems by integrating operational curves during normal and disturbed conditions. The table highlights the diversity of formulations and underscores the dependence of resilience estimates on modeling assumptions.

Table 2 shows that resilience values are not determined by disturbance data alone. They depend on a sequence of methodological choices, including the system boundary, disturbance representation, reference condition, selected performance variable, assessment horizon, recovery criterion, objective function, and aggregation procedure. Consequently, comparability requires transparency not only in the final metric but also in the assessment process that produces it.

Recent studies have further connected resilience quantification to recurrent-hazard behavior and restoration decision-making. Multimodal performance trajectories under recurrent and overlapping hazards can be segmented according to changing performance trends, enabling resilience metrics to distinguish degradation, recovery, and steady operating stages and to support the identification of critical network elements and protection priorities [45]. Resilience assessment has also been coupled directly with restoration optimization through the determination of maintenance thresholds and restoration policies under recurrent dependent hazards and different risk preferences [46].

Despite the proliferation of metrics, a persistent gap remains between micro-level asset condition and macro-level system resilience. Most models represent components using discrete functional or failed states, predefined fragility relationships or fixed failure and/or degradation rates, with limited representation of intermediate operational conditions [47]. Such abstractions may conceal degradation that affects disturbance tolerance or recovery without causing immediate loss of service. This issue is particularly relevant to distributed energy resources and other monitored assets that may continue operating while exhibiting thermal, mechanical, electrical, or control-related anomalies. When these micro-states persist across multiple units, they may influence micro-states, and thus system robustness and post-event recovery, even when conventional availability indicators suggest that service has been restored. Condition-monitoring data and data-driven health indicators therefore offer a potential means of linking evolving equipment condition to event-scale resilience assessment [48].

Asset health represents one underdeveloped dimension of resilience assessment, but it is not the only one. Modern power systems also depend on interactions among physical infrastructure, control and communication systems, organizations, markets, and human decision processes. The following subsection therefore broadens the analysis from metric formulation and equipment condition to multidimensional and interdependent resilience modeling.

2.1.3. Integrated and Multidimensional Approaches

Modern electric grids are not monolithic infrastructures, but complex socio-technical systems composed of interacting subsystems—generation units, transmission networks, distribution feeders, control platforms, markets, and human operators. Such systems exhibit non-linearity, emergent behavior, and sensitivity to initial conditions. When semi-autonomous subsystems cooperate toward a shared objective while retaining operational independence, the resulting structure corresponds to a system of systems (SoS) [49]. Power infrastructures further display characteristics of complex adaptive systems (CASes), where heterogeneous agents interact locally, adapt to disturbances, and self-organize to preserve functionality [50]. These adaptive interactions generate aggregated behaviors that cannot be inferred from isolated component analysis alone [51]. This intrinsic complexity provides the theoretical basis for multidimensional resilience assessment and has two methodological implications: system boundaries and interdependencies must be defined explicitly, and the selected indicators must remain interpretable across multiple levels of analysis.

Recent studies converge on three requirements for multidimensional resilience assessment, reflecting a transition from single-dimension approaches toward integrated, multi-layer assessment frameworks. First, interactions among subsystems and resilience dimensions must be represented explicitly rather than reduced to isolated indicators [44,52]. Second, the contribution of critical components to system-level behavior and enhancement outcomes must remain traceable [53,54]. Third, the assessment boundary may need to include dependencies among infrastructure and societal systems, particularly when supply capacity and societal demand jointly influence recovery [55,56]. Collectively, these studies shift the unit of analysis from individual resilience attributes toward relationships among components, subsystems, dimensions, and decision levels.

Persistent variation in resilience definitions, dimensions, and assessment procedures has motivated the development of structured initiatives such as the European Commission-supported SmartResilience project and its “Resilience Cube” concept [57]. This framework (Figure 2) enables a quantitative assessment of resilience by aggregating expert judgment, measured data, and Big Data across resilience phases (anticipate, absorb, recover) and dimensions (technical, organizational, societal). However, despite these advances, many composite indicators still rely on aggregation schemes that may inadequately represent the dynamic, non-linear coupling between resilience dimensions. By separating physical, organizational, and societal layers for tractability, such approaches risk overlooking cross-couplings and cascading mechanisms inherent to complex adaptive systems.

Recent large-scale events illustrate this complexity. The North American winter storms of 2021 highlighted how interdependence between power, natural gas and transportation systems can exacerbate outages. Cascading failures in Texas occurred because gas supply disruptions and generator freezing co-occurred with high electric demand [58]. Similarly, hurricane-induced outages combine wind loading on transmission towers, flooding of substations and vegetation impacts [59]. These examples underscore that resilience assessment must consider not only the electrical network but also the broader socio-technical context.

Overall, the literature increasingly supports integrated, multi-layer, and interdependent frameworks that move beyond static, single-dimension metrics. Comprehensive resilience assessments may need to represent technical, operational, cyber, organizational, economic, and societal dimensions, depending on the system boundary and decision objective. However, not every assessment must quantify all dimensions simultaneously. A structured methodology should instead require assessors to define the relevant dimensions explicitly, justify their inclusion or exclusion, and document how interactions among them are represented.

2.1.4. Synthesis and Research Gaps

The preceding review identifies four recurring methodological issues. First, resilience assessments differ substantially in their definitions, system boundaries, disturbance representations, performance variables, and recovery criteria. Second, the final resilience value depends on a sequence of modeling choices that is not always reported transparently. Third, many event-scale formulations represent component condition through simplified functional states and therefore provide limited visibility into residual asset degradation. Fourth, assessment results are not always connected systematically to consequence evaluation and resilience-enhancement decisions. These findings motivate the proposed Resilience Assessment Cycle (RAC) shown in Figure 3. The RAC organizes resilience evaluation as a structured, iterative, and technology-independent decision process rather than as the isolated computation of a metric.

The cycle begins by defining the resilience objective, system boundary, disturbance type, and relevant hazard characteristics. An analytical approach—simulation, probabilistic, optimization, or data-driven—is then selected according to the decision context, available data, uncertainty, and required level of representation. Appropriate system-performance variables—such as connectivity, availability, and degradation rate—are defined and incorporated into an objective function or assessment model that captures degradation and recovery over the selected horizon. One or more resilience metrics are subsequently computed and interpreted relative to the disturbance level and the relevant technical, operational, organizational, economic, or societal dimensions. Historical and simulated events may then be used to assess consequences, compare scenarios, and identify mitigation measures or investment priorities. The outcomes of this decision stage update system knowledge, model assumptions, and resilience objectives, thereby initiating the next assessment cycle. The RAC formalizes the sequence of methodological decisions, the information exchanged between stages, and the requirement to document assumptions, intermediate outputs, and feedback relationships. This distinction preserves application-specific flexibility while improving transparency, reproducibility, and comparability.

The resilience literature has expanded considerably over the past decade. Nevertheless, the research gaps and limitations identified across existing studies remain dispersed and often broadly formulated, making it difficult to delineate precise methodological directions. The review supports three principal research gaps addressed at different levels by the present work. The first is a process-structure gap: resilience studies employ diverse metrics and models, but the methodological sequence linking disturbance definition, performance representation, metric computation, consequence analysis, and enhancement decisions is not consistently formalized. The RAC addresses this gap by defining a common assessment process without imposing a single analytical technique. The second is an event-scale condition-integration gap: asset-health information is increasingly used in condition monitoring and long-term planning, but it remains weakly integrated with service-performance and recovery assessment during specific disturbance events. The third is an operationalization gap: existing anomaly-detection, diagnostic, resilience, and agentic approaches generally address separate stages of the assessment chain rather than providing an end-to-end, traceable implementation. A-RAS is introduced as an initial implementation addressing the second and third gaps within the broader structure defined by the RAC. The current implementation introduces a health-conditioned dual-output formulation. Consistent with the time-dependent logic of the RAC, the two resilience outputs are derived from trajectories that describe the evolution of service performance and asset health during disturbance and recovery. The outputs summarize these trajectories while preserving their separate physical interpretations. A-RAS should therefore be interpreted as a deliberately scoped initial implementation of selected event-scale RAC stages. It operationalizes extreme-event detection, operational-state estimation, diagnostic interpretation, service-performance assessment, and resilience quantification. The broader RAC stages associated with comprehensive consequence modeling, mitigation optimization, investment prioritization, and cross-dimensional analysis are not implemented in the present study. The following section examines agentic AI as the implementation mechanism used to coordinate these analytical stages.

2.2. Agentic AI as an Implementation Mechanism for Resilience Assessment

The RAC defines the methodological stages required for structured resilience assessment but does not prescribe a particular computational architecture. Operationalizing its event-scale stages requires coordinating heterogeneous data sources and analytical functions, including extreme-event detection, time-series anomaly assessment, diagnostic interpretation, service-performance modeling, and resilience quantification. Agentic AI is relevant in this context because it enables high-level objectives to be decomposed into interconnected tasks and assigned to specialized tools or modules while preserving a shared execution context. Unlike conventional task-specific models, agentic systems are designed to coordinate multi-step processes, interact with users, and adapt task execution according to the available information and operational objective [60,61].

Goal-oriented and modular architectures are particularly suitable for resilience assessment because the underlying analytical functions differ in their data requirements, computational logic, and validation procedures [62]. Modularity allows event-detection methods, condition-monitoring models, diagnostic engines, and resilience metrics to be developed, evaluated, and replaced independently. A supervisory orchestration layer can then manage execution order, parameter exchange, intermediate artifacts, and output synthesis. This separation is important in industrial applications because numerical calculations should remain reproducible and independently verifiable, whereas language models are better suited to parameter interpretation, contextual reasoning, evidence retrieval, and natural-language interaction.

Contemporary LLM-based systems implement several orchestration mechanisms. Prompt chaining organizes predefined sequences of model and tool invocations [63,64]. Multi-agent and role-based approaches assign specialized responsibilities to interacting agents [65,66]. Function-composition architectures allow language models to select and invoke executable tools [67], while retrieval-augmented generation provides access to external manuals, maintenance records, and engineering knowledge required for evidence-grounded interpretation [68]. These mechanisms demonstrate the potential of LLMs to coordinate heterogeneous analytical resources, but they also introduce probabilistic behavior, variable reasoning paths, and potential tool-selection errors.

For this reason, A-RAS deliberately adopts a predefined, graph-orchestrated workflow rather than a fully autonomous agentic architecture. The LLM supports natural-language interaction, parameter extraction, task delegation, contextual retrieval, and narrative synthesis, while anomaly detection, event segmentation, and resilience-score calculation remain deterministic numerical operations. Workflow routing is explicitly defined, execution states and intermediate artifacts are retained, and user validation is required when critical parameters are missing or inferred. This design prioritizes reliability, traceability, explainability, reproducibility, and human oversight—properties required for industrial asset-management applications. Its principal limitation is reduced autonomy: the system does not independently modify its objectives, optimize task sequences, or learn orchestration policies over time. Nevertheless, this bounded architecture represents a deliberate engineering decision consistent with the present maturity of LLM-based tools. It provides a robust implementation of selected RAC stages while preserving a pathway toward progressively more autonomous orchestration as validation methods, safety controls, and agent reliability improve.

3. Methodology—A-RAS Implementation of RAC

3.1. A-RAS Architecture

Building on the RAC and the bounded orchestration rationale established in Section 2 and Section 3, this section presents A-RAS as a deliberately scoped implementation of selected event-scale RAC stages. The system operationalizes extreme-event detection, operational-state estimation, diagnostic interpretation, service-performance assessment, and dual-output resilience quantification. Its methodological contribution lies in coupling anomaly-aware asset-condition information with reproducible resilience calculations within a graph-orchestrated, LLM-augmented architecture.

Table 3. Mapping between the Resilience Assessment Cycle and the current A-RAS implementation.

#	RAC Stage	A-RAS Implementation	Status
1	Define resilience objective, system boundary, and disturbance	Natural-language request identifies site, period, hazard variable, event threshold, and objective; boundaries are user-defined, not autonomously selected.	Partial
2	Select the quantitative assessment approach	Applies extreme-event segmentation, OpS-EWMA monitoring, and the dual-output formulation; alternative methods integrate modularly but are not dynamically selected.	Partial
3a	Define system-performance and condition variables	$Q\left(t\right)$(service performance), $H\left(t\right)$(asset health), and the meteorological disturbance variable.	Full
3b	Define objective function/assessment model	Deterministic modules for service-performance deficit, residual health-state deficit and event severity.	Full
4a	Compute and report resilience metrics	Produces $\overrightarrow{R}=(R_{svc}., R_{hlth})$, event severity $S$, trajectories, parameters, and recovery artifacts.	Full
4b	Interpret metrics vs. disturbance level and dimensions	Evaluates hazard severity, service impact, asset-health response, and equipment traceability; cyber, organizational, economic, and societal dimensions are not quantified.	Partial
5a	Analyze historical/simulated events and consequences	Historical events evaluated; assumption-based sensitivity scenarios supported; causal consequence simulation not implemented.	Partial
5b	Select mitigation strategies or investments	Provides diagnostic and resilience evidence but does not optimize or prescribe interventions.	Not implemented
6	Feed results into the next assessment cycle	Configurations, artifacts, outputs, and audit logs are stored; automated updating of models, objectives, or policies is not implemented.	Partial

maps each stage of the RAC onto its A-RAS implementation and states the current implementation status, distinguishing stages that are fully operationalized from those that are partially implemented or remain conceptual within the present scope.

At the top level, A-RAS comprises four coordinated functional blocks (Figure 4): the Core Orchestration Agent, the Anomaly Detection Engine, the Diagnostics and Labeling Engine, and the Resilience Assessment Agent. The latter composes two deterministic numerical modules: the Extreme-Event Detection Engine and the Resilience-Score Calculation Engine. The Core Orchestration Agent manages execution order, workflow state, task routing, configuration data, asset and topology information, run metadata, model-registry entries, and audit logs. It also coordinates the exchange of intermediate artifacts, including the OpS-Matrix, OpS-Vector, detected-event records, and final resilience outputs.

A-RAS explicitly separates LLM-supported orchestration and contextual interpretation from deterministic analytical computation. Numerical engines perform anomaly detection, event segmentation, and resilience-score calculation, whereas LLM components support natural-language interaction, parameter interpretation, diagnostic reasoning, contextual retrieval, task delegation, and narrative synthesis. Operational data are accessed through a time-series database, contextual engineering evidence is retrieved through a knowledge database or RAG index (manuals, failure modes, CMMS logs), and configuration and execution records are maintained in a relational database. This separation supports extensibility, reproducibility, and operational transparency and provides an architectural basis for future near-real-time deployment.

The Anomaly Detection Engine and Diagnostics and Labeling Engine reuse methods introduced and validated in the authors’ previous work. Their mathematical definitions are summarized here, and complete implementation details, design choices, and the original performance evaluation of these methods are reported in [10].

3.2. Anomaly Detection Agent: Quantitative Foundation

The Anomaly Detection Engine implements a fleet-normalized residual EWMA control chart to identify operational-state shifts across homogeneous equipment groups without component-specific model training. For each sensor $x_i(t)$ measured on unit $i$ within a cohort of $N$ comparable units, a residual is computed against the fleet reference to attenuate common environmental/operational variability:

$${\mathrm{\Delta }}_{x_i}\left(t\right)=x_i\left(t\right)-{\displaystyle \frac{1}{N-1}}{\displaystyle \sum _{k,k\ne i}^N}{x}_k\left(t\right)$$

(1)

This residual is then monitored using an EWMA recursion:

$$Z_i\left(t\right)=\left\{\begin{array}{c}{Z}_0, t=0\\ \lambda .{\mathrm{\Delta }}_{x_i}\left(t\right) +\left(1-\lambda \right). Z_i\left(t-1\right), t>0\end{array}\right.$$

(2)

where $Z_0$ denotes the process target or expected value of $\overline{{\mathrm{\Delta }}_{x_i}}$, $Z_i$ is the EWMA statistic, ${\mathrm{\Delta }}_{x_i}$ is the residual process, and $\lambda \in [0,1]$ is the EWMA smoothing parameter controlling the influence of recent observations. Control limits are defined from the residual distribution statistics:

$$C{L}_i \cong {\mu }_{\mathrm{\Delta }\overline{X_i}}\pm k {\sigma }_{\mathrm{\Delta }\overline{X_i}}\sqrt{{\displaystyle \frac{\lambda }{\left(2-\lambda \right)}}}$$

(3)

where ${\mu }_{\mathrm{\Delta }{\overline{X}}_i}$ and ${\sigma }_{\mathrm{\Delta }{\overline{X}}_i}$ are respectively the mean and standard deviation of the residual distribution of ${\mathrm{\Delta }}_{x_i}$ and $k$ the control-limit width parameter. To improve anomaly detection robustness, the engine resamples the EWMA statistic and its threshold at interval $\delta t$ (e.g., daily, weekly, etc.). A component i is flagged as deviating when ${\overline{Z}}_i\left(t\right)\ge {\overline{UCL}}_i(t)$ and the fleet state (component $i$ of equipment $j$) is summarized in a binary OpS-Matrix:

$${OpS}_{i,j}\left(t\right)=\left\{\begin{array}{c}0, {\overline{Z}}_{i,j}\left(t\right)-{\overline{UCL}}_{i,j}(t)<0\\ 1, {\overline{Z}}_{i,j}\left(t\right)-{\overline{UCL}}_{i,j}(t)\ge 0\end{array}\right.$$

(4)

In the published evaluation, the residual EWMA module operated with a single global smoothing and control-limit width parameter $(\lambda , k)$, tuned to ensure consistent performance across wind turbine components without per-sensor calibration and achieved strong end-to-end detection performance (OpS-EWMA: Accuracy 94%, Precision 93%, Recall 83%, F1 88%) [10]. Although adaptive and model-based tuning strategies exist, parameter optimization is outside the scope of the present study.

3.3. Diagnostics and Labeling Engine: Interpretive Layer

The Diagnostics and Labeling Engine converts detected deviations into interpretable fault hypotheses and structured operational-state labels using a hierarchical, retrieval-augmented LLM workflow coupled to a transparent scoring layer. The diagnostic reasoning is implemented as a two-phase prompting architecture: Phase I produces component-level explanations from an anomaly event packet; Phase II aggregates Phase I outputs to synthesize equipment-level diagnoses. Each phase uses a consistent prompt structure composed of a system role definition, a user payload, and contextual data injected through retrieval-augmented generation (RAG). RAG is implemented with a document ingestion and retrieval pipeline: manuals, maintenance logs, and fault databases are loaded and chunked, embedded, and indexed in a FAISS vector store; at runtime, the anomaly description is embedded and used to retrieve the most relevant passages, which are appended to the user prompt. In addition, a structured metadata payload is passed to the model, including time since detection, sensor tag, turbine manufacturer/model/age, affected component, deviation versus site averages, and operating context (weekly aggregates, wind speed). Phase II explicitly combines equipment-level retrieved context with the set of component-level explanations to produce a consolidated equipment diagnosis. LLM-supported diagnostics remain vulnerable to hallucination, incomplete retrieval, and semantic misclassification. A-RAS mitigates these risks by grounding outputs in retrieved engineering evidence and structured metadata, enforcing predefined schemas and provenance links, combining semantic judgments with independent statistical severity scores, retaining deterministic event and resilience calculations, and requiring user validation for critical parameters. These safeguards reduce but do not eliminate uncertainty; diagnostic outputs remain advisory and depend on corpus quality.

For labeling, the engine forms an OpS-Vector of criticality labels $\overrightarrow{{\mathrm{V}}_{\mathrm{O}\mathrm{p}\mathrm{S}}}=\left( C_{s_0} \dots , C_{s_N}\right)$ by fusing a statistical severity index and a semantic severity index. The statistical score $I_{stat}$ combines standardized EWMA residual magnitude and persistence, while the semantic score $I_{semantic}$ is derived from the LLM output via a keyword ontology. The final label score is computed as

$$\begin{gathered} C_{s_j}=I_{sta{t}_j}+I_{{semantic}_j}={\lambda }_1.R_j+{\lambda }_2.N_{C{L}_j}+{\lambda }_3.\left(S_j+W_j\right), \\ where {\displaystyle \sum _{k=1}^3}{\lambda }_k=1, C_{s_j}\in \left[0, 1\right] \end{gathered}$$

(5)

where ${\lambda }_1$ and ${\lambda }_2$ are weighting coefficients balancing the contribution of relative residual magnitude vs. control-limit violations, and ${\lambda }_3$ is a weight controlling the contribution of semantic evidence. $R_j\in \left[0, 1\right]$ denotes the aggregated residual ratio for equipment $j$, and $N_{C{L}_j}\in \left[0, 1\right]$ represents normalized run-length index for equipment $j$. $S_j$ is a severity score derived from diagnostic keywords (urgent action required ${\displaystyle \frac{1}{2}}$, critical fault ${\displaystyle \frac{1}{3}}$, Warning ${\displaystyle \frac{1}{6}}$), and $W_j$ represents contextual evidence derived from historical cases and manufacturer documentation (manufacturer warnings ${\displaystyle \frac{1}{2}}$, historical failures ${\displaystyle \frac{1}{3}}$, best-practice reference ${\displaystyle \frac{1}{6}}$). The evaluation presented in our earlier study demonstrated that augmenting the decision layer with RAG-LLM reasoning improved overall operational performance (OpS-EWMA-LLM: Accuracy 97%, Precision 96%, Recall 93%, F1 95%), primarily through enhanced semantic discrimination that increased precision while simultaneously improving recall compared with the statistical baseline [10]. This prior comparison isolates the incremental contribution of the RAG-LLM semantic layer relative to the numerical OpS-EWMA baseline; the present study therefore reuses the validated diagnostic configuration.

3.4. Resilience Assessment Agent

The Resilience Assessment Agent orchestrates the end-to-end evaluation by coupling the Extreme-Event Detection Engine with the Resilience-Score Calculation Engine. For each detected event window, it retrieves the corresponding operational performance trajectory and constructs the expected baseline required for normalization. It then computes the dual-output resilience vector $\overrightarrow{R}=(R_{svc}, R_{hlth})$ and event severity score $S$. The two vector components represent a service-performance deficit and a residual health-state deficit, respectively, while $S$ provides a hazard-intensity proxy. All outputs are returned with their parameters, thresholds, intermediate trajectories, and execution metadata as reproducible artifacts suitable for batch assessment and future near-real-time deployment.

3.4.1. Extreme-Event Detection Engine

The Extreme-Event Detection Engine ingests meteorological time-series data (from on-site met mast), requiring at minimum site identifiers, timestamps, and one or more weather metrics. It performs data validation (required columns, time zone handling), optional enrichment with site metadata, and sampling-frequency inference. Given a user-defined configuration (metric, threshold strategy, minimum duration, gap tolerance, and missing-data constraints), detection is carried out per site by computing an “extreme” Boolean mask using one of three strategies: (i) an absolute threshold, where metric values exceed a fixed limit; (ii) a site-specific percentile threshold computed from the local empirical distribution; or (iii) a seasonal percentile threshold computed within calendar strata (e.g., month/season) to account for seasonality. Contiguous extreme samples are then grouped into candidate segments, short non-extreme gaps are optionally bridged (gap tolerance), and segments are filtered by minimum event duration $T=t_e-t_0$ (event window [$t_0,t_e$]) and by maximum allowed fraction of missing observations. For each retained event, summary statistics (e.g., peak, mean, high quantiles) and a severity score S are computed:

$$S={\displaystyle \frac{1}{T}} {\displaystyle \sum _{t=t_0}^{t_e}}\max \left(0, x_t-\mu \right).∆t$$

(6)

where $x_t$ is the selected meteorological metric, $\mu$ is the detection threshold (absolute/site-percentile/seasonal-percentile), and $∆t$ is the sampling interval. This score represents the mean exceedance above the detection threshold over the event window, enabling consistent ranking across sites and sampling rates. The primary outputs are an events table (json/csv) (event start/end, duration, site, metric, and statistics).

3.4.2. Resilience-Score Calculation Engine

Resilience is assessed through a dual-output perspective that separates service resilience from asset-state recovery. Service resilience quantifies the ability of the system to maintain and restore delivered function during an extreme event (e.g., power delivery relative to an expected reference), whereas the state-aware indicator characterizes recovery of the underlying asset condition after the service appears restored. This separation avoids imposing an arbitrary weighting between heterogeneous recovery notions and allows stakeholders to interpret and, if needed, combine indicators according to their operational priorities and risk appetite.

Let $y(t)$ denote the delivered service (e.g., power or energy rate) and $y_{ref}(t)$ the expected counterfactual baseline under comparable conditions. We define the normalized service performance (percentage of available capacity) as

$$Q\left(t\right)={\displaystyle \frac{y\left(t\right)}{y_{ref}\left(t\right)}} \in \left[0, 1\right]$$

(7)

The reference model and any excluded periods are application-specific and must be documented as part of the RAC assessment configuration. Only exogenous conditions explicitly defined as outside the assessment scope may be handled either by excluding their effects from $y(t)$ or by incorporating them into the reference trajectory $y_{ref}(t)$ (e.g., environmental curtailment); service losses associated with event-induced protection, control responses, unavailability, or delayed recovery remain represented in $Q\left(t\right)$.

Given an event start time $t_0$ identified by the event segmentation module, the service recovery time $t_{svc}$ is defined as the earliest time after $t_0$ for which $Q\left(t\right)$ returns to a tolerance band and remains there for $k_{rec}$ consecutive samples:

$$t_{svc}=inf\left\{t\ge t_0:Q\left(\tau \right)\ge 1-{\epsilon }_{svc} \forall \tau \in \left[t, t+k_{rec}∆t\right]\right\}$$

(8)

where ${\epsilon }_{svc}$ is derived from the empirical deviation of normalized service performance under normal operating conditions. The persistence parameter $k_{rec}$ is application-specific. The service-performance deficit is computed as the normalized area between full performance and the observed service trajectory over the disturbance-to-recovery interval $[t_0, t_{svc}]$:

$$R_{svc}={\displaystyle \frac{1}{t_{svc}-t_0}} {\int }_{t_0}^{t_{svc}}[1-Q\left(t\right)]dt$$

(9)

Thus, $R_{svc}=0$ indicates no measured service-performance deficit over the interval, while larger values indicate greater or more persistent service degradation.

In parallel, let $H\left(t\right)\in [0, 1]$ denote the health index derived from the OpS-Vector produced upstream by the anomaly detection and diagnostic inference, defined as

$$H\left(t\right)=1-{\displaystyle \frac{1}{N}}{\displaystyle \sum _{j=0}^N}{C}_{s_j}\left(t\right)$$

(10)

where $C_{s_j}$ is the equipment-level criticality score of comparable unit $j$ at time $t$, and $N$ is the number of comparable units included in the health aggregation, consistent with the comparable-unit definition used in Equation (1). The health recovery time $t_{hlth}$ is defined analogously using a minimum acceptable health threshold $H_{min}$ and persistence $k_{rec}$:

$$t_{hlth}=inf\left\{t\ge t_0:H\left(\tau \right)\ge H_{min} \forall \tau \in \left[t, t+k_{rec}∆t\right]\right\}$$

(11)

where $H_{min}\in \left[0, 1\right]$ is the minimum acceptable health threshold used to determine recovery. It is calibrated from a documented pre-event or in-control health distribution and is independent of the service-performance trajectory $Q\left(t\right)$.

$$R_{hlth}={\displaystyle \frac{D_{latent}}{T_{max}}} \in \left[0, 1\right] with D_{latent}=\mathrm{m}\mathrm{a}\mathrm{x}(0, t_{htlh}-t_{svc})$$

(12)

Clipped to $\left[0, 1\right]$, $T_{max}={\mathrm{m}\mathrm{a}\mathrm{x}(t}_{end}, t_{htlh})- t_0$ denotes the event-specific assessment horizon measured from event onset $t_0$ to the latter of the predefined analysis endpoint $t_{end}$ and the observed health-recovery time $t_{htlh}$. This assessment interval is distinct from the pre-event windows used for calibration. In most scenarios $t_{htlh}=t_{end}$. $R_{hlth}$ penalises latent degradation that persists after service is restored. $D_{latent}$ represents the duration for which the health index remains below $H_{min}$ even though $Q\left(t\right)$ has already returned to its tolerance band. The normalized component therefore measures the duration of the residual post-service health deficit relative to the assessment horizon; it does not encode the magnitude of that deficit in the scalar $R_{hlth}$. The magnitude of the underlying health degradation remains represented in the $H\left(t\right)$ trajectory and can be traced through the upstream OpS-Vector, equipment criticality scores, and component-level deviations. A complementary magnitude- or area-based health-deficit indicator could be incorporated in future extensions, particularly once the health scale has been calibrated consistently across multiple assets and sites. A value of $R_{hlth}=0$ indicates that no detected health deficit persists beyond service recovery; in such cases, any resilience loss reflected by $R_{svc}$ is primarily attributable to the system’s structural robustness (e.g., equipment derating or shutdown). Conversely, $R_{hlth}>0$ indicates residual degradation that can be traced through the upstream OpS-Vector to the contributing equipment. The overall resilience output is the dual-output vector $\overrightarrow{R}= \left(R_{svc},R_{hlth}\right)\in {\left[0, 1\right]}^2,$ which jointly characterizes functional performance recovery and asset-state recovery. Under the selected service variable, health indicator, thresholds, and assessment horizon, $\overrightarrow{R}=(0,0)$ indicates the absence of both a measured service-performance deficit and a residual post-service health deficit. Operational and maintenance strategies may therefore be evaluated according to their ability to reduce both components. Although $R_{svc}$ and $R_{hlth}$ are normalized, their numerical values are not intended as universal resilience grades. $R_{svc}$ is conditional on the selected service reference, recovery tolerance, and evaluation interval, whereas $R_{hlth}$ is conditional on the health-recovery threshold and assessment horizon $T_{max}$. Comparisons across sites or asset populations therefore require harmonized definitions and calibration of these quantities, particularly when different asset types or operating contexts are considered.

The Resilience-Score Calculation Engine is implemented as a deterministic numerical engine that transforms event boundaries, service references, and health trajectories into reproducible resilience outputs. Given (i) the event time window $[t_0, t_{end}]$, (ii) the delivered service trajectory $y(t)$, (iii) the reference trajectory $y_{ref}(t)$, and (iv) the asset-health trajectory $H(t)$, the engine constructs $Q(t)$, computes the area-based service-performance deficit $R_{svc}$, and evaluates post-service residual health duration to obtain $R_{hlth}$. It returns a traceable artifact bundle containing the trajectories, scalar outputs, recovery times, censoring flags, thresholds $({\epsilon }_{svc}, H_{min})$, persistence requirement $k$, sampling interval $∆t$, reference-model configuration, and normalization choices. Because these calculations are rule-based and parameterized, they remain independent of language-model reasoning and can be executed consistently in batch mode, while providing a basis for future near-real-time operation. LLM components are confined to orchestration, parameter elicitation, contextual interpretation, and narrative synthesis rather than metric computation.

3.5. Core Orchestration Agent

Finally, the Orchestration Agent serves as the process manager. Its role is to coordinate the end-to-end execution of the resilience assessment workflow by decomposing the user-defined objective into sequential analytical stages, routing tasks to the appropriate module, and maintaining consistency of the shared execution state. This design follows the supervisor/hierarchical orchestration logic commonly described in recent agentic AI literature, where a central controller manages planning, delegation, execution, and reporting across specialized components [69]. In the present implementation, the orchestration layer is implemented as a stateful directed workflow graph using LangGraph, in which each node corresponds to one specialized component of the pipeline: the Anomaly Detection Engine, the Diagnostics and Labeling Engine, and the Resilience Assessment Agent. The orchestrator maintains a global-state object containing the user request, selected assets, analysis period, thresholds, intermediate artifacts, and final outputs. This state is updated after each node execution and passed to the next stage to ensure traceable and reproducible workflow progression.

At the current development stage, no autonomous decision-making policy has been implemented. In particular, the Orchestration Agent does not use reinforcement learning or adaptive scheduling to optimize task ordering or resource allocation over time. Instead, workflow routing is rule-based, and the user is required to validate default parameters or provide missing inputs at each critical stage through natural-language interaction with the model. This human-validated configuration strategy is consistent with recent calls for meaningful human oversight, transparent state reporting, and collaborative control in agentic AI systems operating in complex workflows [70].

The following section evaluates this scoped implementation using operational wind-farm data and examines whether the workflow can detect extreme events, generate traceable operational-state information, compute the dual-output resilience vector, and identify the equipment contributing to residual health deficits.

4. Use Case

4.1. Validation Objective and Scope

The use case evaluates the capacity of the proposed A-RAS to characterize wind-farm behavior during operationally credible extreme-wind disturbances. The validation is organized around four objectives: (i) detection and characterization of extreme-wind events; (ii) identifying operational-state deviations and generating component and equipment-level diagnostic interpretations; (iii) jointly quantifying service-performance deficit and residual health-state deficit through $\overrightarrow{R}= {(R}_{svc}, R_{hlth})$, while tracing the health component to the contributing equipment; and (iv) demonstrating natural-language orchestration, parameter extraction, artifact reuse, and procedural traceability through the Core Orchestration Agent. Together, these objectives cover the capability dimensions assessed in Table 1 (AD/DX, HL, SP/RES/REC), as well as the orchestration logic of A-RAS (full chain—which no reviewed framework spans—can be executed end-to-end on real operational data). Consistent with the first-version positioning of this work, the use case is a feasibility and practical-value demonstration rather than an exhaustive validation: it covers a single site and a single hazard class. More comprehensive validation scenarios, spanning additional sites, hazards, and asset classes, are currently under development and will be reported in future work.

4.2. Experimental Setup

The study used three years of operational data, from 1 January 2023 to 31 December 2025, from an anonymized 100 MW onshore wind farm, hereafter referred to as Site A, comprising 50 turbines that had been in service for more than 10 years. The 10 min SCADA dataset included active power, wind speed, ambient temperature, nacelle direction, pitch angle, rotor speed, generator speed, and component temperatures. Twelve temperature channels representing five component groups were used to construct critical operational states. Temperature-data coverage was 94.43% over the full period (96.93% in 2023, 95.97% in 2024, and 90.41% in 2025), while fleet time-based gross availability exceeded 93%. Missing observations in the retained sensor time series were preprocessed independently for each turbine–sensor series using forward-fill followed by backward-fill propagation before calculation of the OpS-EWMA.

The expected service baseline $y_{ref}$ was derived from the manufacturer power curve using air-density correction consistent with IEC 61400-12-1, using 0.5 m/s bins according to the applicable operating mode:

$$v_{cor}\left(t\right)=v_{exp}\left(t\right). {\left({\displaystyle \frac{{\rho }_{site}}{{\rho }_{ref}}}\right)}^{{\displaystyle \frac{1}{3}}}$$

(13)

where $v_{exp}$ measured wind speed at the site (average of all wind turbines every 10 min), ${\rho }_{site}$ is actual air density at the site, and ${\rho }_{ref}$ is the reference air density from manufacturer. Periods affected by external power constraints were identified using a site-level curtailment event table. No explicit correction was applied for turbulence intensity, yaw misalignment, or wake effects. To assess the resulting baseline uncertainty, the manufacturer curve was compared with empirical site baselines. The frequency-weighted mean deviation from the contractual reference was −2.9%, with a cross-model standard deviation of 2.0%. The complete comparison is provided in Appendix A.4. These effects therefore remain residual sources of uncertainty in the normalized service-performance trajectory $Q\left(t\right)$.

The anomaly-detection engine used the following OpS-EWMA configuration: smoothing parameter $\lambda =0.7$, control-limit width $k=3.0$, 60 min aggregation, and a three-sample rolling filter. Calibration targeted an in-control average run length ARL₀ = 500—corresponding to a nominal false-alarm probability of approximately of 2 × 10⁻³ per evaluated sample from the Lucas–Saccucci ARL table [71]—while preserving sensitivity to the gradual thermal drift characteristic of incipient component degradation. The relatively high smoothing factor weights recent observations more strongly, favoring earlier detection of sustained shifts at the cost of slightly higher statistical variance, whereas $k$ retains the conventional three-sigma control width. The diagnostic fusion weights were ${\lambda }_1={\lambda }_2={\displaystyle \frac{1}{4}}$ and ${\lambda }_3={\displaystyle \frac{1}{2}}$ (as established in the previously validated configuration reported in [10]). The retrieval corpus was restricted to monthly operation and maintenance reports and internal thermal-deviation analyses; turbine-level work orders and FMEA records were unavailable. The monthly operating reports available to the system contained high-level site-performance and major-maintenance information but no turbine-level anomaly labels, root-cause annotations, or diagnostic tags. No temperature-deviation or anomaly reports corresponding to the analyzed extreme-event months were available to the RAG module. Some information contained in the O&M reports may have been documented after the corresponding event occurred; a limited degree of temporal information leakage therefore cannot be excluded. Eliminating this possibility completely would require strict temporal separation between the evidence available at the time of each event and subsequently generated operational documentation.

An expert-adjudicated reference dataset was constructed independently of the A-RAS outputs. An asset-performance engineering team reviewed the complete three-year, 10 min SCADA history of all 50 turbines across the five monitored component groups and identified abnormal operating behavior. The identified conditions were subsequently cross-checked against available O&M reports, reported downtime, component replacements, and documented site activities. The resulting labels were then associated with the extreme-event windows and used as the reference for comparison with A-RAS.

The hourly health index H(t) was aggregated from component-level OpS-Vector outputs (Equation (10)). The service-recovery tolerance was estimated using the following formula:

$${\epsilon }_{svc}=\min \left(1-mean\left(Q_{pre}\right), {\epsilon }_{max}\right)$$

(14)

where $Q_{pre}$ denotes the normalized service-performance observations during the 48 h pre-event baseline. The quantity $1-mean\left(Q_{pre}\right)$ represents the mean pre-event service deficit, and the upper cap of ${\epsilon }_{max}=0.1$ is the maximum service-performance deficit accepted for Site A. It fixes a minimum acceptable normalized performance ${Q_{min}=1-\epsilon }_{max}=0.90$ below which recovery is never credited—equivalent, on an installed-capacity basis, to no more than five of the site’s fifty equally rated turbines being simultaneously unavailable for any operational cause (maintenance, protection actions, braking, or another operational cause) —while the min operator makes the effective requirement correspondingly stricter whenever the pre-event baseline is healthier than this floor. In other applications, ${\epsilon }_{max}$ may be replaced by a site-specific contractual or operational performance requirement established by the asset owner, operator, off-taker, or utility. The health-recovery threshold $H_{min}$ was derived from the pre-event hourly health baseline, as defined in the methodology (maximum observed prior event). This defines recovery as a return to the best asset condition demonstrably attained by the fleet immediately before the disturbance, yielding an event-specific, self-calibrating reference that avoids an arbitrary fixed threshold and adapts to the baseline condition of the turbine population under analysis.

An extreme-wind event was defined at site level as a period in which the 10 min fleet-mean wind speed exceeded 25 m/s for at least 60 min. Non-extreme gaps of up to 90 min were bridged to avoid splitting a continuous episode. Each analysis window began 2 h before event onset and extended through the health-recovery period. The 60 min minimum duration is an analytical inclusion criterion consistent with the hourly resolution of the health index $H\left(t\right)$ rather than a meteorological definition of a windstorm. Shorter threshold exceedances are excluded from resilience quantification in this study. The complete three-year wind-speed history is provided in Appendix A.2. A compact sensitivity analysis of the event-segmentation and recovery parameters is provided in Appendix A.3, including variations in wind-speed threshold, minimum event duration, gap tolerance, pre-event reference window, service-recovery tolerance, and health-recovery threshold. To consolidate the implementation settings used in the case study, Appendix A.6 contains a summary table of the parameters used.

4.3. Extreme-Wind Event Set

The detector identified five events: three in 2023 and two in 2025. Examination of the complete three-year wind-speed record (Appendix A.2) identified sixteen additional threshold-exceedance episodes—four in 2023, six in 2024, and six in 2025—but none satisfied the 60 min minimum-duration criterion. Consequently, no qualifying event was retained in 2024. Event durations ranged from 70 to 410 min, and maximum fleet-level wind speeds ranged from 26.7 to 31.3 m/s.

Table 4. Detected site-level extreme-wind events, event-severity scores, dual A-RAS outputs, and end-to-end workflow runtimes. Wind-speed statistics are calculated from the 10 min fleet-mean series.

Event	Start	End	Duration (min)	Mean (m/s)	Maximum (m/s)	P95 (m/s)	Peak Timestamp	Severity	$\overrightarrow{\mathit{R}}$ Score	Runtime (s)
1	14 February 2023 10:50	14 February 2023 14:40	240	26.2	28.7	27.9	14 February 2023 12:30	1.4	(0.35; 0.58)	11.37
2	26 February 2023 19:40	26 February 2023 21:20	110	27.3	30.7	30.1	26 February 2023 21:10	2.4	(0.33; 0.69)	8.65
3	31 March 2023 14:10	31 March 2023 15:10	70	26.4	27.6	27.5	31 March 2023 14:50	1.4	(0.36; 0.35)	8.59
4	4 March 2025 17:40	5 March 2025 00:20	410	25.3	28.6	28.0	4 March 2025 23:30	0.9	(0.72; 0.38)	10.79
5	14 March 2025 13:10	14 March 2025 16:50	230	27.2	31.3	30.8	14 March 2025 15:00	2.2	(0.45; 0.45)	12.74

reports the meteorological characteristics, dual resilience outputs, and end-to-end workflow runtime. The differing orderings of the event-severity score $S$, service-performance deficit $R_{svc}$ and residual health-state deficit $R_{hlth}$ across events support their separate reports. Event 4 had the lowest hazard-severity score ($S=0.9$) but the highest service-performance deficit ($R_{svc}=0.72$). Conversely, Event 2 had the highest severity score ($S=2.4$), the lowest service-performance deficit ($R_{svc}=0.33$), and the highest residual health-state deficit ($R_{hlth}=0.69$). Thus, within this six-event sample, hazard intensity, service impact, and residual equipment-state degradation were not monotonically aligned. These observations support the separate interpretation of the three outputs but do not establish statistical independence among them. Mean end-to-end runtime was 10.4 s per event, with a population standard deviation of 1.83 s across the six events, using Claude Sonnet 4.5 through AWS Bedrock. Computation scales primarily with the number of turbines, monitored channels, and samples in each analysis window, whereas LLM-related latency and cost depend mainly on the number of flagged component-level anomalies and retrieved context. Larger fleets could therefore be processed through batched numerical execution and parallel diagnostic calls. These results are indicative of the present configuration only; latency, token cost, and throughput for larger fleets, alternative model backends, and near-real-time operation remain subjects for future benchmarking.

4.4. Natural-Language Orchestration, Explainability and Traceability

Users interact with the Core Orchestration Agent through natural-language queries. The agent extracts parameters, applies documented defaults when inputs are omitted, delegates deterministic analyses, and stores requests, configurations, intermediate artifacts, and outputs. Follow-up queries can retrieve the assumptions, parameter values, module sequences, OpS-Matrix and OpS-Vector results, recovery thresholds, and deterministic decision rules associated with a completed run. In this context, explainability refers primarily to procedural traceability and evidence provenance rather.

Table 5. Representative user queries, agent workflows, and generated output.

Question	Agent Workflow	Generated Output
Q1. Identify extreme wind events at Site A from January 2023 to December 2025 using fleet-mean wind speed and an absolute threshold above 25 m/s.	W1. The Core Agent routes the request to the Resilience Agent and Extreme-Event Detection Engine; extracts the site, period, metric, threshold, and threshold type; and applies the default 60 min duration and 120 min gap tolerance because they were omitted.	A1. Six events are identified: three in 2023 and three in 2025. Table 4 reports their timing and meteorological characteristics.
Q2. For Event 3, the shortest event, identify turbine anomalies and generate diagnostics using data from two days before to two days after event onset.	W2. The Core Agent resolves the event window from the preceding result, retrieves SCADA data, executes OpS-EWMA with the documented defaults, and passes the deviations and retrieved evidence to the Diagnostics and Labeling Engine.	A2. Nineteen turbines are flagged and 29 component-level anomaly records. Table 6 presents the consolidated diagnostic outputs.
Q3. Quantify the dual-output resilience vector for Site A during Event 3.	W3. The Core Orchestration Agent reuses the detected-event and anomaly outputs, retrieves the required the csv file containing service and health data, and invokes the Resilience Assessment Agent to construct $Q\left(t\right)$, $H\left(t\right)$, recovery times, dual output, and associated visualization. Parameters and artifacts are stored in the results directory.	A3. The dual score is $\overrightarrow{R}=(0.3647,0.3506)$. Figure 5 presents the resilience trajectories.

summarizes three executed query–workflow–output traces retained from the validation runs. The wording of each generated output has been condensed for presentation, while the underlying configurations and artifacts correspond to the reported analyses.

Table 5 demonstrates natural-language interaction, orchestration, parameter extraction, default handling, output reuse, and traceability. Each response can be regenerated from stored artifacts, and the Core Agent can identify the modules and parameters that produced it. A future enhancement will present all extracted and inferred parameters for user confirmation before any analytical function or API call is initiated. This human-validation gate would strengthen transparency, control, reproducibility, and confidence without altering the deterministic calculations.

4.5. Detailed Assessment of Event 3

Event 3, selected as the representative detailed case, lasted 70 min, with a mean wind speed of 26.4 m/s and a maximum of 27.6 m/s. Protection and control actions coincided with a reduction of approximately 90% in weather-adjusted available output capacity. As shown in Figure 5, service performance returned to its tolerance band approximately 3 h 20 min after event onset, whereas the health index remained below its recovery threshold for a further 7 h 50 min. Figure 5 presents the observed trajectories $Q\left(t\right)$ and $H\left(t\right)$, from which the scalar dual output $\overrightarrow{R}=(0.36, 0.35)$ was derived. The trajectories are not themselves the final resilience output; rather, they retain the temporal information summarized by $R_{svc}$ and $R_{hlth}$. Their differing recovery times constitute the principal validation result for Event 3 and illustrate the core rationale of the dual-output formulation: $Q\left(t\right)$ indicated functional restoration, while $H\left(t\right)$ retained the residual asset-condition deficit, and the upstream OpS-Vector identified the contributing turbines and components.

The two dashed $Q\left(t\right)$ trajectories in Figure 5 provide assumption-based sensitivity envelopes. The adverse envelope assumes extended unavailability of the affected components and yields $\overrightarrow{R}\approx (0.6, 0.35)$; the favorable curve assumes earlier intervention and no residual health deficit, yielding $\overrightarrow{R}\approx (0.15, 0)$. The dashed trajectories are assumption-based sensitivity scenarios rather than empirically observed or causally estimated counterfactuals. They are not used as validation evidence for intervention effectiveness. Their purpose is limited to illustrating the mathematical sensitivity of the dual output to assumed changes in service-recovery timing and residual health duration.

Five turbines were unavailable during the assessment window. Turbines 5 and 9 were already offline for maintenance before event onset, which explains the pre-event service deficit. Turbines 7, 11, and 45 developed hydraulic oil system overheating temperature during the event and subsequently shut down. The workflow flagged 19 turbines (38% of the fleet) for diagnostic review. Expert adjudication retained 26 detections as credible component anomalies or sensor faults and rejected three gearbox-oil flags (Turbines 31, 39, and 40) as false positives. Four additional isolated nacelle-temperature outliers were identified retrospectively as low-severity false negatives because no corroborating component deviation was present; the remaining 27 turbines showed no relevant thermal anomaly.

Figure 6 summarizes the 29 component-level deviations associated with the 19 flagged turbines: six transformer, six hydraulic-system, six gearbox, six generator and five nacelle deviation. Counts exceed the number of affected turbines because a turbine may exhibit deviations in multiple components. The largest reported relative deviations included +14.6 °C on transformer low-voltage level-2 channels and a sustained +18.0 °C hydraulic-oil deviation with a peak differential of +25.9 °C. Most detected conditions remained below the conventional absolute warning thresholds of 70 °C for gearbox oil, 55 °C for hydraulic oil, and 110 °C for transformer level-2 temperature. Only two cases generated conventional operator notifications, whereas A-RAS retained persistent sub-alarm deviations for diagnostic assessment. Figure 6 thus shows that the health deficit underlying $R_{hlth}$ was not produced by a few threshold-crossing alarms but by a distributed pattern of low-severity thermal drift that conventional alarm-based monitoring would not have surfaced—the operational gap the diagnostic layer is designed to close.

Table 6 presents the turbine-level diagnostic outputs, including affected sensors, standardized equipment-level statements, diagnostic keywords, adjudicated labels, and criticality scores. The table demonstrates the intended interpretability of the workflow: each health deficit can be traced from the fleet-level $R_{hlth}$ value to a specific turbine, sensor deviation, component-level interpretation, and criticality score. This capability substantiates the explainability claim of A-RAS—defined here as procedural traceability and evidence provenance—by showing that an aggregate resilience figure can be decomposed, without re-computation, into the asset-level evidence that produced it.

Table 6. Turbine-level diagnostic outputs for the 19 turbines flagged during Event 3. Sensor values are deviations from the corresponding site reference unless an absolute peak is explicitly stated. TP and FP denote classification relative to the expert adjudication operational reference; criticality scores are normalized to [0, 1].

Turbine ID	# Affected Components	Sensors	Description—Diagnostic Equipment Level	Keywords	Prediction vs. Actual	Critical Score [0, 1]
34	3	Generator L1/L2: +10.3 °C Nacelle: +2.6 °C	Generator drive-end bearing degradation causing winding overheating and secondary nacelle thermal loading from insufficient heat dissipation.	generator drive-end bearing degradation, stator winding overheating, nacelle thermal loading, insufficient heat dissipation, cooling-system limitation, thermal propagation, sustained temperature elevation	TP	0.60
48	3	Generator L1: +9.8 °C Generator L2: +9.8 °C Nacelle: +2.2 °C	Generator drive-end bearing degradation with symmetric winding overheating, compounded by reduced nacelle cooling and ventilation performance.	generator drive-end bearing degradation, symmetric winding overheating, nacelle cooling degradation, ventilation restriction, filter blockage, fan wear, thermal propagation, sustained temperature elevation	TP	0.60
22	2	Generator L1: +7.6 °C Generator L2: +7.4 °C	Generator bearing thermal degradation causing sustained L1 and L2 winding overheating near the established high-temperature operating limit.	generator bearing thermal degradation, stator winding overheating, L1/L2 thermal symmetry, high-temperature operation, accelerated bearing wear, insulation thermal stress, sustained temperature elevation	TP	0.60
36	1	Transformer LV L2: +14.6 °C	Transformer low-voltage L2 winding thermal overload caused by degraded oil circulation and localized phase current imbalance.	transformer LV L2 winding overheating, oil-circulation degradation, cooling-pump degradation, phase-current imbalance, localized thermal overload, insulation aging, transformer thermal fault	TP	0.57
44	1	Transformer LV L2: +14.6 °C	Severe transformer low-voltage L2 winding thermal overload caused by degraded oil circulation and localized phase current imbalance.	severe transformer LV L2 winding overheating, oil-circulation degradation, phase-current imbalance, localized thermal overload, winding-insulation degradation, transformer thermal fault	TP	0.54
49	2	Gearbox oil peak: 58 °C Transformer L2 peak: 96 °C	Mild concurrent transformer L2 winding and gearbox oil thermal elevation remaining within noncritical component operating limits.	transformer L2 thermal elevation, gearbox oil heating, mild thermal anomaly, noncritical operating range, concurrent subsystem anomaly, drivetrain thermal monitoring	TP	0.53
18	2	Gearbox oil: +2.5 °C Hydraulic oil: +2.6 °C	Combined gearbox and hydraulic oil overheating from restricted coolant circulation and degraded nacelle heat-exchanger performance.	gearbox oil overheating, hydraulic oil overheating, common cooling-system degradation, restricted coolant circulation, heat-exchanger fouling, nacelle cooling inefficiency, thermal-management failure	TP	0.53
6	1	Transformer LV L2: +10.6 °C	Transformer low-voltage L2 winding thermal overload producing localized phase stress and progressive winding insulation degradation.	transformer LV L2 winding overheating, localized phase thermal stress, winding-insulation degradation, sustained temperature elevation, transformer thermal fault	TP	0.52
19	2	Gearbox oil: +2.7 °C Transformer LV L2: +11.9 °C	Independent transformer L2 winding thermal overload and gearbox oil cooling degradation occurring concurrently across electrical and drivetrain systems.	transformer LV L2 winding overheating, gearbox oil overheating, oil-cooling degradation, cooler fouling, nacelle ventilation restriction, phase-load imbalance, concurrent independent anomalies	TP	0.52
15	1	Transformer LV L2: +8.0 °C	Transformer low-voltage L2 winding thermal overload caused by degraded oil cooling and localized phase-current imbalance stress.	transformer LV L2 winding overheating, oil-cooling degradation, circulation restriction, phase-current imbalance, localized thermal overload, winding-insulation stress	TP	0.52
1	1	Hydraulic oil: +3.1 °C	Hydraulic oil temperature sensor bias producing a persistent positive offset without corroborating subsystem thermal degradation.	hydraulic oil temperature sensor bias, positive temperature offset, sensor drift, calibration error, measurement-channel anomaly, isolated apparent overheating, no corroborated thermal degradation	TP	0.50
30	2	Hydraulic oil: +1.8 °C sustained Peak differential: +25.9 °C Nacelle: +5.0 °C	Hydraulic cooling-circuit restriction and heat-exchanger fouling causing severe oil overheating, intensified by internal leakage and elevated pump duty.	hydraulic oil overheating, heat-exchanger fouling, coolant-flow restriction, internal hydraulic leakage, elevated pump duty cycle, hydraulic cooling-circuit degradation, severe thermal anomaly	TP	0.50
11	1	Hydraulic oil: approximately +5.0 °C	Isolated hydraulic oil cooling-circuit degradation causing moderate thermal elevation without broader pitch, yaw, or braking system involvement.	hydraulic oil overheating, localized cooling-circuit degradation, moderate thermal elevation, no pressure deviation, pitch system unaffected, yaw system unaffected, brake system unaffected	TP	0.49
45	1	Hydraulic oil: approximately +5.0 °C	Isolated hydraulic oil cooling-circuit degradation causing moderate thermal elevation without broader pitch, yaw, or braking system involvement.	hydraulic oil overheating, localized cooling-circuit degradation, moderate thermal elevation, no pressure deviation, pitch system unaffected, yaw system unaffected, brake system unaffected	TP	0.49
7	2	Hydraulic oil: approximately +5.0 °C Nacelle sensor: +10.0 °C	Hydraulic oil cooling-circuit degradation with concurrent persistent positive bias in the nacelle temperature sensor measurement channel.	hydraulic oil cooling degradation, nacelle temperature sensor bias, positive measurement offset, sensor drift, localized hydraulic overheating, measurement-channel anomaly, no cascading failure	TP	0.49
20	1	Nacelle: +1.9 °C	Persistent positive bias in the nacelle temperature sensor producing isolated apparent overheating without corroborated thermal degradation.	nacelle temperature sensor bias, positive measurement offset, sensor drift, calibration error, isolated apparent overheating, duplicate anomaly reporting, no corroborated thermal degradation	TP	0.42
31	1	Gearbox oil: +2.8 °C	Normal gearbox oil temperature variability without evidence of active cooling, lubrication, bearing, or drivetrain degradation.	normal gearbox oil variability, minor positive deviation, no cooling degradation, no lubrication degradation, no bearing degradation, no drivetrain fault, false-positive anomaly	FP	0.42
39	1	Gearbox oil: +1.9 °C	Normal gearbox oil temperature variability without evidence of active cooling, lubrication, bearing, or drivetrain degradation.	normal gearbox oil variability, minor positive deviation, no cooling degradation, no lubrication degradation, no bearing degradation, no drivetrain fault, false-positive anomaly	FP	0.42
40	1	Gearbox oil: +1.8 °C	Normal gearbox oil temperature variability without evidence of active cooling, lubrication, bearing, or drivetrain degradation.	normal gearbox oil variability, minor positive deviation, no cooling degradation, no lubrication degradation, no bearing degradation, no drivetrain fault, false-positive anomaly	FP	0.42

Table 6. Turbine-level diagnostic outputs for the 19 turbines flagged during Event 3. Sensor values are deviations from the corresponding site reference unless an absolute peak is explicitly stated. TP and FP denote classification relative to the expert adjudication operational reference; criticality scores are normalized to [0, 1].

Turbine ID	# Affected Components	Sensors	Description—Diagnostic Equipment Level	Keywords	Prediction vs. Actual	Critical Score [0, 1]
34	3	Generator L1/L2: +10.3 °C Nacelle: +2.6 °C	Generator drive-end bearing degradation causing winding overheating and secondary nacelle thermal loading from insufficient heat dissipation.	generator drive-end bearing degradation, stator winding overheating, nacelle thermal loading, insufficient heat dissipation, cooling-system limitation, thermal propagation, sustained temperature elevation	TP	0.60
48	3	Generator L1: +9.8 °C Generator L2: +9.8 °C Nacelle: +2.2 °C	Generator drive-end bearing degradation with symmetric winding overheating, compounded by reduced nacelle cooling and ventilation performance.	generator drive-end bearing degradation, symmetric winding overheating, nacelle cooling degradation, ventilation restriction, filter blockage, fan wear, thermal propagation, sustained temperature elevation	TP	0.60
22	2	Generator L1: +7.6 °C Generator L2: +7.4 °C	Generator bearing thermal degradation causing sustained L1 and L2 winding overheating near the established high-temperature operating limit.	generator bearing thermal degradation, stator winding overheating, L1/L2 thermal symmetry, high-temperature operation, accelerated bearing wear, insulation thermal stress, sustained temperature elevation	TP	0.60
36	1	Transformer LV L2: +14.6 °C	Transformer low-voltage L2 winding thermal overload caused by degraded oil circulation and localized phase current imbalance.	transformer LV L2 winding overheating, oil-circulation degradation, cooling-pump degradation, phase-current imbalance, localized thermal overload, insulation aging, transformer thermal fault	TP	0.57
44	1	Transformer LV L2: +14.6 °C	Severe transformer low-voltage L2 winding thermal overload caused by degraded oil circulation and localized phase current imbalance.	severe transformer LV L2 winding overheating, oil-circulation degradation, phase-current imbalance, localized thermal overload, winding-insulation degradation, transformer thermal fault	TP	0.54
49	2	Gearbox oil peak: 58 °C Transformer L2 peak: 96 °C	Mild concurrent transformer L2 winding and gearbox oil thermal elevation remaining within noncritical component operating limits.	transformer L2 thermal elevation, gearbox oil heating, mild thermal anomaly, noncritical operating range, concurrent subsystem anomaly, drivetrain thermal monitoring	TP	0.53
18	2	Gearbox oil: +2.5 °C Hydraulic oil: +2.6 °C	Combined gearbox and hydraulic oil overheating from restricted coolant circulation and degraded nacelle heat-exchanger performance.	gearbox oil overheating, hydraulic oil overheating, common cooling-system degradation, restricted coolant circulation, heat-exchanger fouling, nacelle cooling inefficiency, thermal-management failure	TP	0.53
6	1	Transformer LV L2: +10.6 °C	Transformer low-voltage L2 winding thermal overload producing localized phase stress and progressive winding insulation degradation.	transformer LV L2 winding overheating, localized phase thermal stress, winding-insulation degradation, sustained temperature elevation, transformer thermal fault	TP	0.52
19	2	Gearbox oil: +2.7 °C Transformer LV L2: +11.9 °C	Independent transformer L2 winding thermal overload and gearbox oil cooling degradation occurring concurrently across electrical and drivetrain systems.	transformer LV L2 winding overheating, gearbox oil overheating, oil-cooling degradation, cooler fouling, nacelle ventilation restriction, phase-load imbalance, concurrent independent anomalies	TP	0.52
15	1	Transformer LV L2: +8.0 °C	Transformer low-voltage L2 winding thermal overload caused by degraded oil cooling and localized phase-current imbalance stress.	transformer LV L2 winding overheating, oil-cooling degradation, circulation restriction, phase-current imbalance, localized thermal overload, winding-insulation stress	TP	0.52
1	1	Hydraulic oil: +3.1 °C	Hydraulic oil temperature sensor bias producing a persistent positive offset without corroborating subsystem thermal degradation.	hydraulic oil temperature sensor bias, positive temperature offset, sensor drift, calibration error, measurement-channel anomaly, isolated apparent overheating, no corroborated thermal degradation	TP	0.50
30	2	Hydraulic oil: +1.8 °C sustained Peak differential: +25.9 °C Nacelle: +5.0 °C	Hydraulic cooling-circuit restriction and heat-exchanger fouling causing severe oil overheating, intensified by internal leakage and elevated pump duty.	hydraulic oil overheating, heat-exchanger fouling, coolant-flow restriction, internal hydraulic leakage, elevated pump duty cycle, hydraulic cooling-circuit degradation, severe thermal anomaly	TP	0.50
11	1	Hydraulic oil: approximately +5.0 °C	Isolated hydraulic oil cooling-circuit degradation causing moderate thermal elevation without broader pitch, yaw, or braking system involvement.	hydraulic oil overheating, localized cooling-circuit degradation, moderate thermal elevation, no pressure deviation, pitch system unaffected, yaw system unaffected, brake system unaffected	TP	0.49
45	1	Hydraulic oil: approximately +5.0 °C	Isolated hydraulic oil cooling-circuit degradation causing moderate thermal elevation without broader pitch, yaw, or braking system involvement.	hydraulic oil overheating, localized cooling-circuit degradation, moderate thermal elevation, no pressure deviation, pitch system unaffected, yaw system unaffected, brake system unaffected	TP	0.49
7	2	Hydraulic oil: approximately +5.0 °C Nacelle sensor: +10.0 °C	Hydraulic oil cooling-circuit degradation with concurrent persistent positive bias in the nacelle temperature sensor measurement channel.	hydraulic oil cooling degradation, nacelle temperature sensor bias, positive measurement offset, sensor drift, localized hydraulic overheating, measurement-channel anomaly, no cascading failure	TP	0.49
20	1	Nacelle: +1.9 °C	Persistent positive bias in the nacelle temperature sensor producing isolated apparent overheating without corroborated thermal degradation.	nacelle temperature sensor bias, positive measurement offset, sensor drift, calibration error, isolated apparent overheating, duplicate anomaly reporting, no corroborated thermal degradation	TP	0.42
31	1	Gearbox oil: +2.8 °C	Normal gearbox oil temperature variability without evidence of active cooling, lubrication, bearing, or drivetrain degradation.	normal gearbox oil variability, minor positive deviation, no cooling degradation, no lubrication degradation, no bearing degradation, no drivetrain fault, false-positive anomaly	FP	0.42
39	1	Gearbox oil: +1.9 °C	Normal gearbox oil temperature variability without evidence of active cooling, lubrication, bearing, or drivetrain degradation.	normal gearbox oil variability, minor positive deviation, no cooling degradation, no lubrication degradation, no bearing degradation, no drivetrain fault, false-positive anomaly	FP	0.42
40	1	Gearbox oil: +1.8 °C	Normal gearbox oil temperature variability without evidence of active cooling, lubrication, bearing, or drivetrain degradation.	normal gearbox oil variability, minor positive deviation, no cooling degradation, no lubrication degradation, no bearing degradation, no drivetrain fault, false-positive anomaly	FP	0.42

The expert reference comprised 250 turbine–component evaluation units (50 turbines × five component groups), including 221 normal and 29 abnormal cases. A-RAS classified 217 of the 221 normal cases and 26 of the 29 abnormal cases correctly, with four normal cases classified as abnormal and three abnormal cases classified as normal. Using the observation-level labeling protocol established in [10], in which normal behavior is the positive class, this corresponds to an overall agreement of 0.972, Precision of 0.986, Recall of 0.982, and F1 score of 0.984. Because abnormal behavior is the operationally relevant minority class, the corresponding abnormal-class Precision, Recall, and F1 scores are 0.867, 0.897, and 0.881, respectively. As described in Section 4.2, these labels were established through expert adjudication independently of the A-RAS outputs. These metrics therefore quantify agreement in deviation detection and operational-state classification relative to the expert reference rather than root-cause diagnostic accuracy. Because turbine-level work orders and confirmed failure outcomes were unavailable, these labels represent an operational expert reference rather than maintenance-confirmed ground truth; diagnostic results should therefore be interpreted as expert-supported assessments rather than confirmed root-cause diagnoses.

4.6. Cross-Event Findings and Limitations

Across the five events, residual health recovery consistently extended beyond service restoration, and the recurrent deviations primarily involved hydraulic-oil, gearbox-oil, and transformer-temperature channels. The complete event-level trajectories and diagnostic counts are provided in Appendix A.5. These results support within-site cross-event repeatability under extreme-wind conditions but do not establish transferability across sites, asset classes, or hazard types. From an asset-management perspective, earlier visibility of these component states could support targeted post-event inspection and pre-event preparation, including checks of oil condition, cooling-system cleanliness, and valve operation. These actions represent potential operational uses of the outputs. Also, these findings complement recent work linking recurrent-hazard resilience assessment to the identification of critical network elements and prioritization of protection actions [45], and to risk-informed restoration-policy optimization under recurrent dependent hazards [46]. The consequence-analysis and resilience-enhancement stages of the RAC provide the methodological location for integrating such downstream optimization.

A distinction should be drawn between the elements of this work that are methodologically general and those that are specific to the present evaluation. The RAC process structure, the LLM-augmented graph-orchestrated architecture, and the health-conditioned dual-output formulation $\overrightarrow{R}= {(R}_{svc}, R_{hlth})$ are defined independently of any asset class or hazard and are, by construction, transferable: applying them to a new context requires redefining the service reference $y_{ref}\left(t\right),$ the health index $H(t)$, and their associated thresholds, but not altering the assessment logic. In contrast, the reported numerical results—the specific parameter and threshold values, the magnitude of the service-to-health recovery lag, the detected events, and the diagnostic performance figures—are conditional on Site A, the extreme-wind hazard class, and the available data, and should not be read as representative of overall performance across other hazards, or asset types.

The validation is subject to three principal limitations. First, it covers one wind farm and one hazard class. Second, the restricted RAG corpus and absence of turbine-level work orders and FMEA records limited fault confirmation, root-cause verification and the generation of evidence-supported maintenance recommendations. Third, the sensitivity trajectories are scenario-based rather than causal counterfactual estimates. Fourth, orchestration was demonstrated through representative end-to-end workflows but was not subjected to systematic diagnostic robustness testing under repeated execution, prompt variation, alternative LLM backends, missing tools, tool-execution failures, or adversarial inputs. Within these boundaries, the use case demonstrates that the selected A-RAS stages—event detection, component-level diagnosis, dual-output quantification, and equipment-level traceability—can be executed end-to-end on real operational data. More comprehensive validation scenarios—additional wind farms, other hazard classes, and other asset types—are under development, and future use cases will specifically assess the scalability, robustness, and generalizability of A-RAS.

5. Conclusions

This study addressed three interconnected limitations in current resilience-assessment practice: the absence of a consistently structured assessment process, the limited integration of evolving asset condition into event-scale resilience evaluation, and the fragmentation of anomaly detection, diagnostics, resilience quantification, and workflow orchestration across separate analytical approaches. To address these gaps, the paper formalized the Resilience Assessment Cycle (RAC) as a technology-independent, iterative process linking disturbance characterization, analytical-model selection, performance representation, resilience quantification, consequence interpretation, and resilience-enhancement decisions. The RAC formalizes the sequence of methodological decisions, information exchanges, assumptions, and intermediate outputs required to improve transparency, reproducibility, and comparability.

The Agentic Resilience Assessment System (A-RAS) was developed as an initial implementation of selected event-scale RAC stages. Its graph-orchestrated architecture deliberately separates probabilistic LLM-supported functions from deterministic numerical computation. The Core Orchestration Agent manages natural-language interaction, parameter extraction, task delegation, contextual retrieval, artifact reuse, and procedural traceability, while numerical engines perform extreme-event detection, anomaly assessment, and resilience calculation. This bounded design prioritizes reliability, explainability, reproducibility, human oversight, and auditability over unconstrained autonomy. Importantly, validation across additional sites, asset classes, and hazard types is required before cross-domain transferability can be established; no such transferability is claimed in the present work.

The implications for asset management are twofold. Retrospectively, repeated execution of the workflow across a fleet’s disturbance history can establish a structured knowledge base of health-conditioned event responses. Such a record can reveal recurrent component vulnerabilities, distinguish service restoration from residual asset degradation, and support the preparation of inspection, maintenance, and contingency strategies for future events. Prospectively, because the resilience outputs are updated from the evolving service-performance and asset-health trajectories, the same architecture could support near-real-time prioritization during an unfolding disturbance. Assets could be ranked using event severity, current operational state, and residual health information, thereby helping operators focus attention on equipment presenting the most consequential combination of service impact and condition degradation.

Future research will extend the RAC and A-RAS along complementary methodological, analytical, and deployment directions. This includes validation across additional sites, asset classes, and hazards such as icing, lightning, and cyber-physical disturbances; integration and comparative benchmarking of area-based, probabilistic, and health-informed resilience indicators; incorporation of alternative anomaly-detection and health-index methods within a model-agnostic evaluation environment; and investigate coupling A-RAS outputs with restoration-policy and maintenance-resource optimization to operationalize the downstream consequence and resilience-enhancement stages of the RAC. Further work will systematically assess diagnostic quality and orchestration robustness under repeated execution, prompt variation, alternative LLM backends, missing data, tool failures, and alternative routing strategies. Progressively increased autonomy, specialized model-of-experts routing, near-real-time deployment, and an open-source implementation will also be investigated under explicit safety and human-validation constraints. The present study does not attempt an exhaustive review of all agentic architectures and orchestration strategies applicable to resilience assessment; such a comparison requires a dedicated investigation.

By supporting more transparent condition-informed assessment, the proposed approach is relevant to SDG 7 through improved renewable-energy availability, SDG 9 through resilient and digitally enabled infrastructure management, SDG 12 through more informed maintenance and asset-life decisions, and SDG 13 through improved preparedness for climate-induced disturbances. RAC and A-RAS therefore provide a reproducible foundation for advancing agent-assisted resilience assessment from isolated analytical functions toward integrated, auditable, and progressively extensible decision-support workflows.