Mohamed-Habib Mazouni
email: mohamed-habib.mazouni@inrets.fr

Dominique Bied-Charreton
email: dominique.bied-charreton@inrets.fr

Jean-François Aubry
email: jean-francois.aubry@isi.u-nancy.fr

Proposal of a generic methodology to harmonize Preliminary Hazard Analyses for guided transport

Keywords: Safety, Dependability, Risk, PHA, Guided transport, Control systems

This communication addresses the "Safety, Reliability & Quality Assurance" topic. It is located very clearly in the field of land guided transport (interurban train, HST, subway, tram). The land guided transport systems are mainly composed of four material classes: the infrastructure, the rolling stock, the energy supply chain and all of the signaling and control systems. This paper deals with different methodologies used to analyze and demonstrate the safety of a control system, but it more especially deals with the Preliminary Hazard Analysis (PHA), which is usually used first and very early in the Safety Management System.

Introduction

The safety demonstration of the transport system can be achieved through a total Preliminary Hazard Analysis (PHA), but especially through the development of files for the specific safety of each subsystem and through the examination of their interfaces. The control systems such as indication, speed control, or automatic piloting have as a task to manage major risks which can induce disasters (collision or derailment).

For a very long time, the engineers who have been working on the design, the homologation or the evaluation of this equipment, have worked in a context where the used methods are very strictly formalized, and where the safety files are structured complying with quality plans that are the bases of the project management. This tendency in the field of indication has increased with the emergence of data processing to manage critical functions. From the middle of the eighties, the equipment became more and more complex, and so the need for rigor and formalization has increased. In this field, control is more advanced than the other transport system components. This set of safety and fault avoidance demonstration steps led to the drafting of European standards NF EN related to the RAMS aspects of the railway applications [19], their software [20] , their hardware [21] and their environment.

These standards translate a broad consensus in the profession of guided transport and constitute a set of guidelines and credible references concerning safety and availability.

PHA quotation in the French regulation [17]

The Safety File (SF), enriched throughout the project, tends to show that the identified risks in the Preliminary Safety File (PSF) are covered and controlled.

The Decree No. 2000-286 of March 30, 2000 related to the safety of the national railway network stipulates that the PSF considers the technical and functional data as well as the objectives of safety stated with the Definition File (DF).

In the decree of January 8, 2002, adopted to enforce the decree No. 2000-286 of March 30, 2000 related to the safety of the national railway network, the output documents which must provide a PHA are specified as follow:

• The functional description of the system, • The identification of hazardous events, • The evaluation and classification of the associated risks, • The proposition of prevention and protection measurements, • The allowance of safety objectives.

The PSF comprises a document containing the results of the PHA, while the SF contains the conclusions of the safety studies carried out and the certificate that the PHA identified risks are considered and reduced sufficiently to be acceptable.

PHA quotation in the standards

"The PHA is a technique to identify and to analyze the hazard frequency, which can be used during the upstream phases of the design to identify the hazards and to evaluate their criticality" [START_REF]Dependability management[END_REF], [START_REF]ISO/CEI Guide 51, Safety aspects -Guidelines for their inclusion in standards[END_REF], [START_REF] Mazouni | Méthode et formalisme de base pour l'Analyse Préliminaire des Risques appliquée dans le transport ferroviaire[END_REF].

IEC 300-3-9 standard relating to the management of the dependability and more precisely the 3rd part presents a risk generic analysis process, including six steps which can be associated to the PHA [START_REF] Mazouni | Méthode et formalisme de base pour l'Analyse Préliminaire des Risques appliquée dans le transport ferroviaire[END_REF]:

• The specification of the applicability, • The identification of the hazards and the initial evaluation of the consequences, • The risk assessment,

• The checking,

• The documentation, • The progressive updating as the project develops.

We may conclude that the French national regulation indicates the documents that a PHA should provide without specifying how it should be approached, whereas standard IEC 300-3-9 recommends an analysis process containing several stages but without addressing more precision on the PHA output documents to be provided.

The PHA as it is considered by NF EN 50126 standard

The French and European railway standard NF EN 50126 proposes a 14 phases life cycle. Each phase contains many tasks linked with the Dependability (Reliability, Availability, and Maintainability) or with the safety. Of course, we will be interested more particularly in this second category. The first phase consists in collecting data on reliability, availability and safety relating to similar systems previously brought into service.

Once phase 2 is completed, the mission profile, the description and the various constraints resulting from the system environment are supposed to be known. During this phase, the RAMS team must undertake the "hazardous situations preliminary analysis".

NF EN 50126 standard has the advantage of positioning very well this type of analysis in the system life cycle. Indeed, this stage is located in phase 3, before the specification of system requirements. It must according to the standard, be carried out after a description of the system and a good knowledge of its environment.

PHA results are presented according to a table with two main columns:

• Hazard investigation : initial events, hazardous situations, final hazardous event, • Risk management: methods of covering and control.

These are precisely the processes of risk management which will then make it possible (beyond phase 4 of the life cycle according to the standard) to specify the system safety requirements, and to define the safety acceptance criteria. The table of PHA often comprises another column which appoints the actor(s) responsible of each hazardous situation management actions: traveling material, infrastructure, energy supply chain, control, operation or maintenance. Thus, we ensure traceability in the assignment of the responsibilities between the various groups and between the various subcontractors.

The recommendations of the French/European railway standard NF EN 50126 lead to a Preliminary Analysis, since the system is still slightly or badly known. At this stage of the life cycle, PHA is an opportunity to write the specifications of the functional requirements and of the whole system safety aspects.

PHA methodology 4.1 Objectives of PHA

The Preliminary Hazard Analysis was developed at the beginning of the sixties in the aeronautical and military fields. Since then, it has been used in many other industries [START_REF] Villemeur | Sûreté de fonctionnement des systèmes industriels[END_REF], [START_REF][END_REF].

PHA aims at identifying the various hazardous elements present in the studied system. Then, every element will be studied in order to know how it could lead to an incident or to a more or less serious accident, further to an event causing a potentially hazardous situation.

But term "PHA" also is used by some manufacturers in quite different cases than those quoted by the above mentioned standard. Indeed, the objectives of the manufacturer can be to [START_REF]Functional safety -safety instrumented systems for the process industry sector[END_REF], [18]:

• Classify the functions according to their severity, then to be able to process them according to their SIL (Safety Integrity Level), • Define the system specifications, • Refine the hazard covering methods.

The PHA is then carried out on a functional modeling of the equipment to be developed, for which we seek to define with precision the safety requirements.

The various actors involved in the development and the acceptance of a system (project superintendents, customers, appraisers and administrations) still have currently a problem of vocabulary divergence, which slows down the safety methods harmonization [START_REF]A guide to Risk Assessment and Risk Management for Environmental protection, Her Majesty's Stationery Office[END_REF], [START_REF]Medical devices -Application of risk management to medical devices[END_REF], [START_REF] Mazouni | Méthode et formalisme de base pour l'Analyse Préliminaire des Risques appliquée dans le transport ferroviaire[END_REF].

The principles of causality of the accident scenarios

The preliminary knowledge of the accident concept, its causality mechanisms and its materialization process, guarantees a better identification of the accidents scenarios in order to implement the defensive barriers in a strategic and effective way, so that this materialization will be avoided, its impact reduced or its repetition frequency limited.

The undesirable phenomena can be Accidents or Incidents (macroscopic approach) or Failures or Faults of subsystem components (microscopic approach).

Theoretically, the causes and effects sets are nonrestrictive. Nevertheless, in practice, we consider representative sets containing the most credible elements.

The causal approach is a way to say that nothing is due to chance, and that behind any effect there is at least a possible cause. Indeed, the cause/effect relations can be explored via a link-up Hazardous Event (HEv) in two ways :

• The inductive causal approach: it is the direct approach, starting from some knowledge on the causes and seeking to predict the corresponding effects, • The deductive causal approach: it is the opposite approach, starting from some knowledge on the consequences and trying to identify the origins of the corresponding causes.

Is the PHA an Inductive or a deductive analysis?

The viewpoints diverge both on the PHA terms, concepts and methodology: "It is (the PHA) traditional inductive approach", quoted by Prof A. Laurent, CNRS-LSGC (sécurité des procédés chimiques, p 367, May 2003) [START_REF] Laurant | Sécurité des procédés chimiques[END_REF], "It is (the PHA) deductive analysis", quoted by Prof A. Heurtel, CNRS -IN2P3/LAL (La gestion des risques techniques et des risques de management, p 14, December 2003) [START_REF] Heurtel | La gestion des risques techniques et des risques de management[END_REF].

The quality and the quantity of relevant knowledge are determining factors in the choice that will be related to the analysis approach: inductive or deductive.

If this knowledge primarily relates to the consequences, we can thus proceed by deduction in order to identify the possible causes. The mechanisms of learning feedback are largely used in this approach which also seems in perfect harmony with the exercise of accidents reconstitution.

The opposite approach requires a good knowledge of the causes likely to be precursors for undesirable phenomenon materialization. At this stage, we try to release the possible consequences relating to given causes set. This approach thus consists in extracting the various possible accident scenarios.

Hazard Identification

This phase can be based on the learning feedback to draw up the preliminary list of hazards.

Textual analysis

This analysis corresponds to a census of the technical provisions guaranteeing safety. These provisions can be classified either by subsystem or by hazard.

PHA results presentation

The deductive preliminary analysis aims at highlighting:

• The list of the hazardous events precursors of potential accident, • The risk reduction measurements, • The allowance of the responsibilities to various intervenors, • The covering of the risks through an a posteriori assessment of severity and frequency. • 5: The causes can be external dysfunctions or operational problems, • 10: A responsibility assignment for the taken measurements application.

HEvE

Causes Effects

Deductive reasoning:

We know effects We learn about causes

Inductive reasoning:

We know the causes We learn about effects 5.2 PHA Methodology at the RATP

The identification of the causes and the origins of the hazardous events

The analysis continues according to a deductive approach in order to try to identify the causes and the origins of the hazardous events at this stage.

The proposal of risk reduction measurements

The allowance of measurements to control risks is done according to the evaluation of the consequences related to each hazardous event. The precision of the actors concerned with these measurements is an organizational aspect aiming at defining clearly the responsibilities and to make official the follow-up of the risks.

PHA results presentation

A proposal of a generic and harmonized PHA methodology 6.1 Development of the Potential Accidents tree

This phase is mainly based on the learning feedback to determine the potential accidents list, and then we try to detect the corresponding hazardous events by a deduction reasoning. The results are put in an analysis elementary table having the following form:

Hazard study

To identify the hazardous elements (VTE: Vulnerable Target Entities, HSE: Hazards Supplier Entities) and the resulting hazardous situations, the analyst is guided by the elementary checklists of Potential Accidents (Potential Accidents Tree). These checklists are specific to the concerned study field. As its name indicates, this method is not intended to process the materialization of accident scenarios in details, but rather to highlight the various possible problems encountered during the life cycle of the studied system. VTEs: targets could be threatened as a result of the PA materialization.

First Phase: Deductive Identification of the HSE and VTEs

• 1,2: revealed further to the development phase of the accident scenarios tree, • 3,4: The possible causes of the hazardous event:

the lists of the hazardous situation and of the initial events precursors of the hazardous event, • 5: The involved element in the hazardous event apparition: human factor, rail, infrastructure, signaling or control systems, etc. From each HSE identified in the first phase, we develop the different ways inducing an hazardous event. We suppose that the apparition of an Initial Event stimulate the HSE that immediately become generator of a hazardous situation considered as a precursor of an hazardous event.

Second phase: Inductive identification of accident scenarios

Risk calculation

The risk calculation covers the following four steps:

• The determination of the possible mishaps for the exposed VTEs, • The assessment of severity, • The assessment of the probability of occurrence of a hazardous event, • The risk calculation as a combination between Exposure, Occurrence and Severity.

Risk management

In order to reduce or eliminate the risks that have been evaluated as unacceptable, the following categories of measurements can be implemented:

• Pro-active measurements: the elimination of the structural causes (Hazard Supplier Entities) of a hazardous event.

• Preventive measurements: the prevention of the direct causes of a hazardous event and the reduction of its effects. • Protective measurements: the minimization of hazardous event consequences on the vulnerable targets.

Another type of measurements can be considered, it concerns the aftercare going back to the original situation before a hazardous event apparition.

Risk management can be approached from different angles. It can be considered as the gateway that an organization have to go over to meet its responsibilities for safety. On the other hand it can be considered as the process which demonstrates that a studied system satisfies its overall requirements for safety [START_REF] El-Koursi | SAMNET synthesis report: safety and interoperability[END_REF], [START_REF] Tordai | Report D.1.2.3: Common Safety Targets and Common Safety Indicators[END_REF]. • 9: The risk reduction measurements: Measurement "Wording", its "Type" (pro-active, preventive...), the "team" and its "Manager" appointed to apply the required control actions (allowance of the responsibilities to various intervenors).

The "Desirable gain" box is added to assess the margin of risk reduction, which should be obtained further to the taken measurements implementation. This step is covered through an a posteriori assessment of severity and frequency, • 10: final "decision": to disapprove or to agree the risk reduction actions (step 9).

Conclusion

The paper is not intended to be a complete talk about all the methods of safety specification, validation and demonstration in the field of control systems equipped land transports. It first intends to show the place of PHA, which is the starting point of all of the safety activities, and which then enables to specify safety requirements while complying with previously defined specifications.

The practice of PHA is perceived in various ways by the manufacturers of guided transport systems or Control systems.

It should initially be noticed that in the majority of the cases, PHAs are Hazard analyses, because we consider the severity of accidents, but not their occurrence frequencies; thus we should speak about Preliminary Hazard Analysis and not Preliminary Risk Analysis "Analyse Préliminaire de risques (APR)" which is the term used by the French specialists.

The PHA thus provides the risks covering directives. These processes are at this stage written in very general terms: constructive provisions, periodic tests in maintenance, operation procedures, calculation note, etc. To be able to write the System Requirements Specifications (SRS), which is the higher level specification document, it is necessary to refine its general provisions in terms of lower level criteria.

The proposed methodology is an interesting framework for the definition of a PHA generic methodology which would comply with the regulation measurements, with the standards recommendation and above all in harmony with various industrial contexts (ALSTOM, RATP, Siemens Transportation Systems, etc.).

Up to date, we are working on the specification of an Interactive System of Decision-Making Aid for drafting, editing and checking the PHA output documents.

[

Figure 1 .

 1 Figure 1. Inductive and deductive causal reasoning loop

Table 1

 1

			. ALSTOM prototype of a PHA results
				presentation
	1	2	3	4		5	6
	Potential	No. Phase Hazardous	Causes	Consequ-
	accident			event
							Consequences
	7		8	9	10	11	12	13
	-ences		Measurements taken	Risk assessment
	Severity Wording Type Resp. Sev. Freq. Accept.

Table 2 .

 2 RATP prototype of a PHA results presentation

	• 1.2: Revealed further to the development phase
	of the tree hazards,
	• 3: Place: in station, in line, etc,
	• 4: The possible cause of the hazardous event,
	• 5: The involved element in the hazardous event:
	railway, infrastructure, signals, etc,
	• 6: The severity classes of hazardous events are
	derived from the criticality matrix proposed by
	NF EN 50126 standard.

Table 3 .

 3 Potential Accidents Tree

	Potential accident	Hazardous event
	1. collision 1.1 with	1.1.1 Too long stopping distance
	obstacles
		.......

Table 4 .

 4 HSE and VTE investigation phase

	1	2	3	4	5
	Potential	Hazardous	Hazardous	Initial	HSE,
	Accident	Event	Situation	Event	VTEs
	PA: Potential Accident,
	HEv: the Hazardous Event(s) causing this PA,
	HS: The corresponding Hazardous Situation,
	IEv: Initial Event announcing the HS,
	HSE: Hazardous Supplier Entity (ies) that is (are) the
	principal(s) generator(s) of the HS after the IEv
	emergence,

Table 5 .

 5 Accident scenarios investigation phase

	1	2	3	4
		Accident scenarios
	Hazard	Initial	Hazardous	Hazardous
	Supplier	Event	Situation	Event
	Entity
	• 1,2,3,4: Development of the accident scenarios
	causality. The causes can be external
	dysfunctions, operational problems or due to
	human factor.

Table 5 .

 5 Risk assessment presentation

	5	6	7	8
		Assessment
	Mishaps	Severity	Occurrence	Risk
	• 5: Mishaps: human death or injury, system or
	service loss or environmental damage,
	• 6,7: The classification of severity and hazardous
	events occurrence are derived from the criticality
	matrix proposed by NF EN 50126 standard,
	• 8: Risk classification.

Table 6 .

 6 Risk control policy

	9		10
	Risk Management	Decision
	Risk Reduction	Desirable
		gains	Word. Motive Resp.
	Word. Type Tm. Man.

  18] NF EN ISO 12100,

				Safety of machinery,
	International	Organization	for	Standardization,
	November 2003.
	[19] NF EN 50126, Railway applications: the
	specification and demonstration of Reliability,
	Availability, Maintainability and safety (RAMS),
	AFNOR, December 1999.
	[20] NF	EN	50128,	Railway	Applications:
	Communications, Signaling And Processing Systems-
	Software For Railway Control And Protection Systems,
	AFNOR, July 2001.
	[21] NF	EN	50129,	Railway	applications:
	communication, signaling and processing system -safety
	related electronic systems for signaling, AFNOR, May
	2003.


Debraj Ray
email: debraj.ray@nyu.edu

Jean-Marie Baland
email: jean-marie.baland@fundp.ac.be

Olivier Dagnelie
email: olivier.dagnelie@fundp.ac.be

Inequality and Inefficiency in Joint Projects

Keywords: JEL Classification Numbers D02, H54, H0

A group of agents voluntarily participates in a joint project, in which efforts are not perfectly substitutable. The output is divided according to some given vector of shares. A share vector is unimprovable if no other share vector yields a higher sum of payoffs. When the elasticity of substitution across efforts is two or lower, only the perfectly equal share vector is unimprovable, and all other vectors can be improved via Lorenz domination. For higher elasticities of substitution, perfect equality is no longer unimprovable. Our results throw light on the connections between inequality and collective action.

A group of agents are engaged in a joint project, to which inputs are contributed on a voluntary basis. The output of the project is divided according to some given vector of shares. Define the social surplus generated by the joint activity to be the sum of net individual payoffs (output received minus effort cost). We ask the following question: how do share vectors compare in terms of the social surplus they generate?

Following Mancur Olson's seminal analysis, it is often argued that such projects work best when all the incentives to cooperate are concentrated in the hands of a single agent. Indeed, "the greater the interest in the collective good of any single member, the greater the likelihood that the member will get such a significant proportion of the total benefit from the collective good that he will gain from seeing that the good is provided, even if he has to pay all the cost himself." (Olson, 1965:34). Other authors have extended the Olson argument, arguing for this salubrious role of inequality in areas as varied as military alliances, cooperatives, cartel stability, or the use of a local commons (see, e.g., [START_REF] Sandler | Burden sharing, strategy and the design of NATO[END_REF], [START_REF] Sandler | Collective Action: Theory and Applications[END_REF], or [START_REF] Braverman | Promoting rural cooperatives in developing countries: the case of sub-Saharan Africa[END_REF], and, in sociology, [START_REF] Oliver | A theory of the critical mass. I. interdependence, group heterogeneity and the production of collective action[END_REF], [START_REF] Oliver | The paradox of group size and collective action: a theory of the critical mass[END_REF] or [START_REF] Heckathorn | Collective action and group heterogeneity: voluntary provision versus selective incentives[END_REF]). 1At the same time, it is well-known that this observation rests upon a specific set of assumptions. For instance, [START_REF] Hirshleifer | From weakest-link to best-shot: the voluntary provision of public goods[END_REF] shows with the help of some examples that Olson's conclusion is particularly dependent on individual contributions being perfect substitutes in the joint project. This assumption may be particularly cogent in the case of financial lobbying, where the effectiveness of lobbying is typically a function of the sum of monetary contributions. But in many (if not in most) other cases the perfectsubstitutes postulate is problematic. If we go to the opposite extreme and study a case in which individual resources are perfect complements, it is fairly trivial to see that the production of the common good (and indeed, the social surplus) is the highest if all agents have an equal interest in the good. 2These are extreme examples of substitution or complementarity. Many situations of common property resources and local public goods display intermediate degrees of substitution or complementarity across individual efforts. This is particularly true for the management of irrigation or watershed infrastructures, in which the proper maintenance of the scheme requires the stabilization of the rims (e.g. through the planting of soil-fixing grass) or the desilting of minor channels over the land of participating farm-ers. It is obvious that the maintenance effort of one farmer needs to be complemented by similar efforts elsewhere in the network for the entire system to function effectively. 3Similarly, in the fight against water or wind erosion, each farmer expends effort in the construction and maintenance of wind-breakers and terraces on his own plot. However, the end results are complementary to similar efforts made by the other farmers. The same is true for weed and pest control in agriculture, as weeds can spread quickly, so that efforts at removing them on an isolated parcel are bound to yield disappointing results relative to what could be achieved if a large number of cultivators were to weed their fields in a coordinated way. For the same reason, pest control does not make much sense as an isolated investment. As a last example, in fisheries, the preservation of the resource requires that fishermen abstain from operating in certain areas (e.g. mangrove areas) or during certain seasons, or from using certain techniques (cyanure or dynamite). Such preservation efforts by fishermen are complementary. The same argument applies to the choice of nets with large meshes to avoid catching immature fishes.

To our knowledge, nothing is known about the outcome of joint projects when the degree of complementarity between individual contributions takes on intermediate values. Suppose that we were to parametrically vary the elasticity of substitution across individual inputs. How does the relationship between share vectors and generated social surplus vary as elasticity moves from high to low? In particular, if we focus attention on share vectors that are best for social surplus, at what precise point does the argument for the efficacy of high inequality begin to fail?

In the model we study, there are n agents who contribute to a joint project. The output is divided according to some share vector λ ≡ (λ 1 , . . . , λ n ). Payoffs are just output received net of effort cost and social surplus is the distribution-neutral sum of payoffs. The production function is symmetric across individual contributions, and exhibits a constant elasticity of substitution. For each possible value of the elasticity of substitution, we attempt to describe the relationship between share vectors and the resulting social surplus. To this end, say that a share vector is improvable if there is another share vector with higher social surplus; otherwise, it is unimprovable.

We begin by showing (Proposition 1) that there is a threshold value of the elasticity of substition below every share vector not exhibiting perfect equality is improvable. Indeed, any Lorenz-improvement in the share vector always raises social surplus. This threshold value is an elasticity of two, and it is uniform over all CES production functions with diminishing returns to scale, and over all constant elasticities of effort supply.

[Note for comparison purposes that the Cobb-Douglas production function has elasticity of substitution equal to one, and so lies well in this range.] In particular, perfect equality of shares maximizes social surplus over all share vectors.

The proposition has two implications. First, perfect equality has good incentive properties "long before" the point of perfect complementarity is reached. To be sure, how "long" is "long before" will depend on a comparison of our predicted value with empirical estimates. Second -and perhaps of greater interest to the theorist -perfect equality becomes fully unimprovable in this range of values for the elasticity of substitution. (It isn't that -as is usual in many maximization contexts where the maximizer changes sensitively with respect to the parameters -the best λ comes closer and closer to perfect equality, finally attaining this configuration with the elasticity of substitution equal to zero.)

Next, Proposition 2 provides a converse. If the elasticity of substitution exceeds the threshold identified in the previous paragraph, then perfect equality is improvable, at least for a range of values of n. In this sense, the threshold of Proposition 1 is a "tight" description.

Thus an elasticity of substitution that exceeds two represents a zone in which there is some support for the Olson argument, but there are subtleties in obtaining a more precise description. Proposition 3 states that if a share vector exhibits four or more distinct values, then it is improvable, and there are local perturbations of that vector that exhibit higher social surplus. Indeed, this assertion is valid as long as the share vector has three or more distinct positive values. [That is, if an unimprovable share vector exhibits three distinct values, one of them must be zero.] Finally, even if a share vector exhibits just two positive values, it is improvable whenever the lower of the two positive values has more than one individual associated with it.

This proposition significantly narrows down the possible configurations, but it fails to describe the situation completely. Might all the possibilities left open by the proposition conceivably occur? For instance, it is certainly possible to have an unimprovable share vector with just one positive value and lots of zero values: this is the Olson case and will occur when the elasticity of substitution is infinitely high. It is also possible to have one (identical) positive value: this is the case of perfect equality. But is it possible to have an un improvable share vector with two positive values of the share at some solution, something that proposition 3 does not eliminate? We could not settle this question analytically, and turned to numerical simulations. As will be discussed at the end of the paper, it appears that the answer is in the affirmative.

All proofs are collected in an appendix. We view this short paper as a contribution to a longstanding debate on inequality and incentives (in which, to be sure, there are many dimensions). Our results are pertinent to issues such as land reform, the preservation of the local commons, the decentralized contribution to a local public good (e.g. the joint maintenance of an irrigation network) or the design of incentive schemes between partners cooperating in a joint project (such as the joint monitoring of a CEO by his shareholders).

It should also be noted that our paper does not deal with the question of mechanism design. It simply restricts the analysis to cases in which outputs are distributed according to exogenous, linear shares, and defines improvability or unimprovability fully within this context. We do this in part because such situations are of intrinsic interest. For instance, in the examples above, the distribution of output is often "naturally" determined by the corresponding distribution of productive assets. Thus in the case of joint fishing, the benefits enjoyed are typically proportional to the capacity of each fishing unit. Likewise, in the agricultural examples, a farmer's interest is proportional to the amount of land he cultivates under the scheme. Nevertheless, we briefly comment on this issue in Section 3.

Joint Production with Shares

A group of n agents engage in the joint production of a particular output. The agents are all identical except for their share in output. Let λ i be the share of agent i in Y , so that c i = λ i Y . We will use λ to stand for the entire vector of shares which add to unity;4 it reflects the inequality of access in the system as a whole.

The production of output Y is given by

Y = F (e) (1)
where e = (e 1 , ..., e n ) is a (nonnegative) vector of individual efforts.

Individual payoffs are simply given by c i -e i . The linearity in consumption is essential to our thinking in terms of output shares: it ensures that the joint output is fully transferable. The linearity in effort is essentially a normalization: convex disutilities can be folded into the production function by a renaming of variables. 5The implied game, then, is very simple: given the contributions e -i made by the others, i chooses e i to maximize her own payoff:

max e i λ i F (e i , e -i ) -e i .
(

) 2
An equilibrium is an effort vector e * with the property that for every i, e * i solves (2), given e * -i .

An effort vector e generates aggregate social surplus, given by

S ≡ F (e) - n i=1 e i . (3)
A share vector λ is improvable if for any social surplus generated by some equilibrium effort (under λ), there is another share vector and equilibrium (for that vector) with higher social surplus.

Social surplus, as defined, corresponds to the utilitarian criterion in which payoffs are simply added up across all agents. We focus on this criterion simply because a more egalitarian perspective would make the case for perfect equality even easier.

As discussed in the Introduction, we are particularly interested in the relationship between improvability of certain share vectors (such as perfect equality) and the degree of complementarity in production. To this end, we parameterize the production function by using a CES structure for the vector of efforts:

F (e) = n i=1 e 1-σ i α 1-σ (4)
where σ > 0 measures the degree of complementarity between individual efforts, and α ∈ (0, 1) is a scale parameter.

The elasticity of substitution corresponding to this formulation is, of course, just the reciprocal 1/σ.

By studying the interior first-order conditions to (2), it is easy enough to show that there is a unique equilibrium with the property that efforts are positive whenever shares are positive. In this equilibrium effort levels are given by

e * i = λ 1 σ i α 1 1-α   n j=1 λ 1-σ σ j   α+σ-1 (1-α)(1-σ) (5)
for all i. Indeed, this is the unique equilibrium -interior or not -as long as σ ∈ (0, 1). When σ ≥ 1, there is another equilibrium which involves e i = 0 for all i, which we ignore. 6Substituting these effort values into (3), we obtain a closed-form expression for the social surplus, given λ:

S * (λ) = α α 1-α   n j=1 λ 1-σ σ j   α+σ-1 (1-α)(1-σ)   n j=1 λ 1-σ σ j -α n j=1 λ 1 σ j   (6)
Thus improvability (or lack of it) reduces to the exercise of checking whether S * (λ) is at a maximum or not. By taking appropriate limits in the maximization exercise, it is possible to verify both the Olson intuition as well as the counterexamples in the case of perfect complementarities. [Alternatively, one may wish to work directly with the limits σ = 0 and σ = ∞, which is easy enough modulo the caveats expressed in footnote 6.]

The more challenging issue is to describe the surplus-maximizing λ for intermediate problems. Technically, the difficulties are manifested in the fact that the equilibrium surplus, as described in ( 6) is neither quasiconcave not quasiconvex in λ, but exhibits both these elements in different components. Complementarity in production favors quasiconcavity in (6), and therefore equal division, but the incentive effect identified by Olson manifests itself in the tendency for S * (λ) to be quasiconvex -which favors inequality.

A Threshold Degree of Complementarity

We first provide a threshold for the elasticity of substitution below which equality is conducive to efficiency.

PROPOSITION 1 If σ ≥ 1 2 , every unequal share vector is improvable, and indeed every Lorenzimprovement of that vector raises social surplus. In particular, perfect equality of shares is unimprovable.

This proposition states that as long as the elasticity of substitution between inputs is no more than two, Lorenz-improvements in the share vector are "efficiency-enhancing" in the sense of raising aggregate surplus. Whether two is a "mild" or "restrictive" threshold is, of course, an empirical matter. We make two remarks that may be relevant here. First, the Cobb-Douglas production function falls well inside the range described above. Second, to the extent that effort costs are convex, the relevant zone for our observation is broadened even further. To see this, suppose that the disutility of effort -call it d -is not linear in e but is an isoelastic convex function: d = e β , where β > 1. Rewrite the production function (4) so that it is now defined on the domain of disutilities. We see that

F (d) = n i=1 d 1-σ i α 1-σ (7)
where 1-σ ≡ (1-σ)/β and α/(1-σ) ≡ α/(1-σ). It is now easy to see that the threshold value of the elasticity of substitution is lowered below 2, so that perfect equality is even more likely to be the maximizer of social surplus. In the context of this model, therefore, Proposition 1 may be viewed, therefore, as making the least aggressive case for the equalization of shares.

While we do not make a formal argument, it is also intuitive that the identified threshold should be robust to all convex disutilities, not just the ones with constant elasticity. After all, if perfect equality is unimprovable for the case of linear costs, it should continue to stay that way when costs are convex, for this is an additional reason to keep efforts symmetric. 7When effort costs are linear, however, the bound described in Proposition 1 is tight. If σ fails this condition, there will be situations in which the result of Proposition 1 is overturned.

PROPOSITION 2 If σ < 1 2 , there exist population sizes for which perfect equality of shares is improvable.

The proposition is established by restricting attention to distributions such that if the shares are positive for more than one agent, they are identical. Call this the equal minority case. Notice (at some risk of semantic confusion) that perfect equality -as well as perfect inequality -belongs to the equal minority case. In the proof, we simply show that there are population sizes n for which an equal minority of m < n generates a higher social surplus than perfect equality.

The equal minority case is particularly tractable, because it significantly reduces the dimensionality of the problem. [All one needs to consider is the size of the equal minority.] The social surplus function described in (6) acquires a particularly elementary form:

S * (λ m ) = α α 1-α m b [m -α] , (8)
where b = ασ+σ-1 (1-α)(1-σ) . It is easy enough to describe the share vectors with highest surplus in this class; just maximize S * with respect to b. Then, by simply observing how b changes with σ, we would obtain a clean monotonicity result: as the degree of complementarity between individual efforts in the joint project increases, the number of agents receiving a positive share (under the surplus-maximizing vector) must also increase. Indeed, we would dwell at greater length on equal minorities if we could be sure that all unimprovable share vectors must come from this class. We will presently report the analytical progress we made on this problem, but several simulation exercises convinced us that the restriction to equal minorities would not be justifiable. In what follows, we first report on the analytical result, and then discuss the simulations. PROPOSITION 3 Every share vector with four or more distinct values (or three or more positive distinct values) is improvable. A share vector with two positive values is also improvable if there is more than one person endowed with the lower of the two positive values of the shares.

The proposition is intriguing. While restriction to the equal minority class may not be justified, an unimprovable share vector cannot be "too far" from this class. It can have some zeros, and it can have some positive values, but barring just one such positive share, all the other values must be the same. To be sure, when the number of individuals is small, this possibility represents a significant deviation from the equal-minority case.

This much can be obtained analytically. To obtain further insights, we turned to simulations. In the simulations, we vary n, the scale parameter α, and (of course) the complementarity parameter σ. Figure 1 is a useful accompaniment to the remarks that follow. This figure is drawn for various values of the scale parameter, but for values of σ no bigger than 0.5. This is because we already know what the unimprovable share vector is for σ > 0.5.

Four observations were obtained from the simulations.

(i) The area in the parameter space (α, σ) such that unimprovable share vectors come from the equal-minority class is "large". For numerous values of the parameters, equal sharing among a limited number of agents represents the least inefficient distribution of shares. [Recall that the zone σ > 0.5 also falls into this class, but is excluded from Figure 1.] (ii) There is a non-trivial area in the parameter space (α, σ) such that the unimprovable share vector must be constructed by distributing positive shares unequally, and that too between only two agents. This area is named "Unequal Pair" in Figure 1. The two shares tend to be more equal as the degree of complementarity increases, taking us back into the equal minority case at the upper edge of the Unequal Pair region. This is a sharp finding which challenges the intuitive asertion that conditional on shares being positive, they should generally be equal for unimprovability. The finding also suggests that Proposition 3 cannot be tightened much further.

(iii) It is true, however, that once the equal minority solution is unimprovable (with not all agents getting positive shares), it continues to be so when the number of agents is increased, keeping all other parameters the same. The Olson Case

m* = 3 m* = 4 m* ≥ 5 A Figure 1: UNIMPROVABLE SHARE VECTORS FROM SIMULATIONS
unimprovable for three agents, it is the case that (1/2, 1/2, 0, . . . , 0) is also unimprovable for more than three agents, under the same values of the scale and substitution parameters.

(iv) Finally, we consider simulations close to the "Olson limit" in which efforts are highly substitutable. How much substitutability one needs depends on the scale parameter, the actual threshold varying from σ 0.22 (for small values of α) to σ 0.35 (for values of α close to unity). Below these thresholds an unimprovable share distribution appears to correspond to perfect inequality, in which one agent obtains all the access. It is an intriguing question (but really a technical one) as to whether perfect inequality becomes unimprovable only "in the limit" as σ → 0 or before that limit is reached, at strictly positive values of σ.8 [As we have seen, the latter is the corresponding case with the perfect equality result.] The simulations (being approximate) cannot be expected to throw much light on this matter, but in any case do suggest that the Olson limit is for all intents and purposes reached when σ 0.2 or smaller.

As already noted, Figure 1 focusses on σ ∈ (0, 0.5) and α ∈ (0, 1). We distinguish between three main regions, divided by bold lines. In the upper left of the diagram, we find the area of the parameter values for which "Equal Minority" is applicable. At the bottom of the diagram, we find the "Olson Case" with perfect inequality in the distribution of shares. In the upper right, we find the "Unequal Pair" area. The bold lines intersect at Point A (corresponding to α = 2/3 and σ = 1/3), a borderline case in which any distribution of shares between two agents, with all others getting nothing, is unimprovable.

Nonlinear Shares and Mechanism Design

We have been careful not to cast our results as an exercise in surplus maximization. A share vector is given, and we simply ask whether such a vector is improvable or not by another share vector.

In principle, the absence of such improvability would not imply full efficiency with respect to all conceivable incentive schemes, only surplus maximization within a class of linear division rules. This is to be contrasted with existing literature on moral hazard in teams which studies the implementation of efficient outcomes (see, e.g., [START_REF] Holmstrom | Moral hazard in teams[END_REF], [START_REF] Legros | Efficiency in partnerships[END_REF], [START_REF] Legros | Efficient and nearly-efficient partnerships[END_REF], and [START_REF] Williams | Efficiency in partnership when the joint output is uncertain[END_REF]).

Sometimes (as in [START_REF] Holmstrom | Moral hazard in teams[END_REF]) this literature considers forcing contracts to generate efficiency, in which output is effectively destroyed unless the first-best is produced. Such contracts may be unrealistic on more than one count: they are not renegotiationproof, and there could be stochastic shocks to output that make it impossible to stipulate a particular target. However, if we restrict ourselves to differentiable sharing rules that exhaust output ex post, then no improvement is possible over linear sharing rules.

To see this, consider a variant of our model in which the production function is given by θF (e), where θ is some random variable with mean normalized to one. Let output be distributed using the increasing, differentiable family of reward functions c = {c i (y)} with product exhaustion ex post: n i=1 c i (y) = y for every y. Then the following observation is very easy to establish.

OBSERVATION 1 Suppose that the vector e is an equilibrium for the family c of increasing, differentiable reward functions. Then there exists a share vector λ with precisely the same equilibrium.

To prove this, observe that necessary conditions for e to be an equilibrium under c are given by

F i (e)c i (y) ≤ 1 (9)
for all i, with equality holding whenever e i > 0, where ŷ is equilibrium output. Define λ by λ i ≡ c i (ŷ) for all i, and note that i λ i = 1 by product exhaustion. We therefore have, using (9), that

λ i F i (e) ≤ 1
for all i, with equality holding whenever e i > 0. But now, given that each implied individual optimization problem is concave, we have sufficient conditions for an equilibrium under λ, and the proof is complete. This assertion is similar to the main result in [START_REF] Nandeibam | Sharing rules in teams[END_REF], who shows that a similar replacement can be made in a team problem. However, Nandeibam works with more general concave utilities and obtains a weaker result: the sufficiency of the broader class of all affine functions.9 Nandeibam's results would also not hold for the stochastic case, which it does here.

Indeed, for these very reasons, we do not assert that nonlinear incentive schemes play no role in a more general model. In a world in which individual utilities are strictly concave in consumption, nonlinear schemes may come into their own for reasons of risk-sharing. While it is not entirely obvious how such schemes would work in the problem at hand, a detailed analysis of such issues is beyond the scope of the current paper.

Summary and Discussion

We study the efficiency of collective action when the benefits of that action may be distributed in some given way among the members of the community. Mancur Olson's celebrated observation for collective activity is that unequally distributed benefits from that activity may be best from the viewpoint of aggregate social surplus.

The purpose of this paper is to study a model of joint activity in which all forms of substitution between the individual inputs can be considered, not just the extreme cases. This turns out to yield new insights. With a CES production function, we can describe a threshold value for the elasticity of substitution below which every unequal share vector is improvable, and indeed generates lower surplus than any other vector that Lorenz-dominates it. In particular, perfect equality is unimprovable. The required threshold is an elasticity of two. Whether this is low or high is an empirical question, but it certainly allows for sigificantly greater substitution than, say, the Cobb-Douglas production function.

While the particular threshold that we isolate depends on our assumption that the cost of effort provision is linear, the result holds a fortiori if costs are convex (and isoleastic). That is, the zone for which the assertions of the previous paragraph hold only expands.

The paper then studies the case in which the elasticity of substitution is "low"; i.e., below the threshold. While we are unable to fully describe unimprovable share vectors, we show that it can never exhibit four or more distinct values (of the shares). Indeed, if there are three distinct values, one of them must be zero. In addition, whenever there are two positive values, the lower of the two positive values cannot have more than one individual associated with it. This is a significant narrowing of the possibilities. Indeed, simulations support the analytical results, in the sense that all the possibilities left open by this proposition can occur for nondegenerate parametric specifications.

A reasonable bottom line is that our results are not very supportive of the efficiency of perfect inequality, even when we treat it as an approximation. Fairly low levels of complementarity appear to be sufficient to turn the tables in favor of perfect equality of shares, in the space of all possible share vectors. Even below this threshold, simulations reveal that the most efficient situations obtain for distributions where some of group of agents get positive, (and possibly unequal) shares in the benefits of the joint project, the remainder getting nothing. For perfect inequality to exhibit good efficiency properties, we need elasticities of substitution of around 3 or even higher, the exact value depending on the degree of returns to scale in joint production. CASE 1. σ ∈ ( 1 2 , 1). In this case it is easy to see that θ ∈ (0, 1) and that γ < 1. Using this information in (13), it follows right away that ∆ (x) < 0. CASE 2. σ > 1. In this case, θ < 0. Using part this information, we see from (13) that ∆

(x) < 0 if (θ -1) n j=1 λ θ j [1 -γ (1 -αλ j )] n j=1 λ θ j > α (θ + 1) x
or equivalently, if we can establish the inequality

n j=1 λ θ j [1 -γ (1 -αλ j )] n j=1 λ θ j < θ + 1 θ -1 αx = 1 1 -2σ αx (14)
However, notice that

n j=1 λ θ j [1 -γ (1 -αλ j )] n j=1 λ θ j ≤ 1 -γ (1 -α) = - α σ -1
where use is made of the fact that λ j ≤ 1 for each j. With ( 14), this means that it will suffice to establish the inequality

- α σ -1 < 1 1 -2σ αx
which follows from direct inspection, and brings the proof to its end.

Proof of Proposition 2. Recall the expression (8) for the social surplus in the equal minority case. Now define m * by the smallest integer such that

m * ≥ 1 -ασ -σ 1 -2σ
We will show that S * (λ m ) > S * (λ n ) for any n > m * , which proves that perfect equality is impossible when n exceeds m * . To this end, we pretend that m is a continuous variable in (8). It will suffice to show that the derivative of S(λ m ) with respect to m is negative for all m > m * . Differentiating S * (λ m ) with respect to m, we need to show that (b + 1) m -αb < 0 for all m > m * . Using the definition of b and m * , this is a matter of simple algebra.

Proof of Proposition 3. To prove this, recall ∆ (λ i ) from (11), and note the following:

LEMMA 1 Let λ be a share vector. If ∆ (λ i ) and ∆ (λ k ) are different for two positive values λ i and λ k in the share vector, then that share vector is improvable.

The proof of this lemma is trivial. Simply transfer shares from the one with lower ∆value to the one with the higher ∆-value. Since the shares in question are both positive, there is no constraint to doing this in any direction we please.

Given Lemma 1, our question boils down to this: for how many distinct and positive values of x can ∆(x) have the same value? Recall that ∆(x) is defined in (12); it may be written as ∆(x) θx θ-1 -C(λ)x θ where C(λ) ≡ α(θ + 1) n j=1 λ θ j n j=1 λ θ j [1 -γ(1 -αλ j )] > 0.

(15)

Now we make the following observation: for x ≥ 0, the function ∆(x) is "single-peaked" (though not necessarily concave11 ): first rising, then falling. We omit the proof, which involves routine computation.

The first part of the proof is now completed. Such a function can exhibit the same value for at most two distinct points in the domain.

To complete the proof, let a denote the smaller of the two positive values of the share. We will show that if two (or more) persons are given a, we can improve the surplus by transferring some share from one of them to the other. To this end, think of the share of these two individuals as variables w and y. "Initially", w = y = a. Holding all other shares constant, we may think of the aggregate surplus simply as a function S (w, y). For some > 0, we know from the mean value theorem for multivariate functions (see, e.g., Hoffman (1975, Section 8.4, Theorem 6)) that S (a + , a -) -S (a, a) = [S 1 ( ŵ, ŷ) -S 2 ( ŵ, ŷ)]

(16)

where subscripts denote the appropriate partial derivatives, and ŵ can be chosen to be strictly larger than ŷ.12 Now we know that S 1 ( ŵ, ŷ) θ ŵθ-1 -C ( ŵ, ŷ) ŵθ (17) and S 2 ( ŵ, ŷ) θŷ θ-1 -C ( ŵ, ŷ) ŷθ (18)

where C ( ŵ, ŷ) is exactly the same C(λ) as before (see ( 15)), but with only two of the share arguments kept explicit to remind the reader that ŵ and ŷ enter there as well.

Recall now that θz θ-1 -C (a, a) z θ is strictly increasing in z around z = a. It follows that the same is true of the slightly perturbed function θz θ-1 -C ( ŵ, ŷ) z θ around z = a. Using this information in ( 17) and ( 18); it is therefore easy to see that for > 0 but small enough, S 1 ( ŵ, ŷ) > S 2 ( ŵ, ŷ) .

Applying this inequality to (16), we may conclude that S (a + , a -) > S (a, a): surplus is increased by a small transfer between two persons with the same lower share, and the proof is complete.

We focus here on the inequality in the distribution of the shares in the joint output, as distinct from the distribution of income between agents (for more details, see[START_REF] Bergstrom | On the private provision of public goods[END_REF] and[START_REF] Warr | The private provision of a public good is independent of the distribution of income[END_REF]. It is also possible to study the effect of egalitarian attitudes on efficiency, as in[START_REF] Ray | Egalitarianism and incentives[END_REF].

[START_REF] Cornes | Dyke maintenance and other stories: some neglected types of public goods[END_REF] and[START_REF] Cornes | The Theory of Externalities, Public Goods and Club Goods[END_REF] also propose a number of examples under which "more equality" between the agents leads to a larger amount of public good produced, because individual contributions are partially complementary. See also[START_REF] Bliss | Dragon-slaying and ballroom dancing: the private supply of a public good[END_REF] andBaland and Platteau (1997, 2002)).[START_REF] Bardhan | Inequality and Collective Action[END_REF] explore a related issue where the public good to which agents voluntarily contribute is complementary to a private input agents own, but where voluntary contributions to the common good are perfect substitutes. Finally, a sister argument by Olson -that small groups are more effective than their larger counterparts -has been critically examined in Esteban and[START_REF] Ray | Collective action and the group size paradox[END_REF].

As a relevant aside, a number of empirical studies of irrigation schemes in developing countries conclude that higher inequality in landholdings (or farm income) tends to reduce the overall level of maintenance, even though it simultaneously induces larger agents to expend larger efforts (see[START_REF] Tang | Institutions and Collective Action: Self-Governance in Irrigation[END_REF],Dayton-Johnson (1998) and[START_REF] Bardhan | Irrigation and cooperation: an empirical analysis of 48 irrigation communities in South India[END_REF]).

It is easy to accommodate cases in which the shares sum to some constant different from unity; for instance, if there is a public-good component to the output. However, this would place some natural bounds on the extent of inequality in λ.

However, the CES assumption that we shall presently impose on F would require such effort disutilities to exhibit constant elasticity as well; see below.

Additional nonuniqueness is also possible at the very edges σ = 0 (perfect substitutability) and σ = ∞ (perfect complementarity). The former occurs when λ gives the largest share value to more than one person: there is a continuum of equilibria, but they all have the same social surplus. The latter case has a continuum with varying social surpluses: our equilibrium selection picks out the one with the largest surplus in this case.

A similar argument can also be made for strictly concave utilities of consumption.

The Inada conditions on the production function (for σ > 0) suggest that the latter should not be the case. But this is misleading: while a small effort input (evaluated at zero) has a high marginal effect on output, a small assignment of the share to generate that effort has a small marginal effect on the effort input. For instance, this is why equal minority solutions (with m < n) may dominate perfect equality.

In the present model, utilities are linear and transferable, and this allows for "supporting" reward functions that are linear with no fixed payments. In contrast,[START_REF] Nandeibam | Sharing rules in teams[END_REF] allows for concave, personspecific utility functions, but fixed payments will generally be needed in this extended environment. Hence there is a need for affine rather than linear functions, though Nandeibam does use the terminology "linear".

For instance, try θ > 2.

The reason for this is that it is possible to take ŵ ∈ (a, a + ) and ŷ ∈ (a -, a). While the statement of the theorem in[START_REF] Hoffman | Analysis in Euclidean Space[END_REF] does not make this clear, the proof -see the last two lines -does.

We thank an Editor and two anonymous referees for helpful comments. Ray acknowledges support from the National Science Foundation under grant number 0241070. This work was also supported by the PAI program of the Belgium Federal Government, as well as by the ARC program from the Communauté Franc ¸aise de Belgique.

Appendix

Proof of Proposition 1: Begin by rewriting equilibrium surplus S * (λ) as

where θ ≡ 1-σ σ , and

. Notice that γ is only well-defined if σ = 1, which we shall assume in what follows. A footnote deals with the Cobb-Douglas case separately. 10 Now compute the partial derivative of S * (λ) with respect to any one of the shares, say λ i . This derivative is given by

where (after some tedious computation) it can be seen that

Now we will show that whenever λ i < λ k , then ∆ (λ i ) > ∆ (λ k ). This would mean that a small transfer from the higher share to the lower share would raise total surplus, and complete the proof. Because the terms within curly brackets in (11) are unchanged in this comparison, it will suffice to show that the function

is strictly decreasing in x as x varies over [0, 1]. To this end, differentiate ∆ (x) to see that

It will suffice to show that this expression is strictly negative for x ∈ (0, 1). We distinguish between two cases. 10 The logarithmic case σ = 1 is just a Cobb-Douglas production function. In this case, it is easy to see

. This expression is concave in λ, which implies that an equalizing redistribution of shares among agents will always increase social surplus.