Ning Ge
email: ning.ge@enseeiht.fr

Marc Pantel
email: marc.pantel@enseeiht.fr

Time Properties Verification Framework for UML-MARTE Safety Critical Real-Time Systems

Keywords: Real-Time System, Time Property Verification, Model Transformation, UML, MARTE, Time Petri Net, Model Checking

Time properties are key requirements for the reliability of Safety Critical Real-Time Systems (RTS). UML and MARTE are standardized modelling languages widely accepted by industrial designers for the design of RTS using Model-Driven Engineering (MDE). However, formal verification at early phases of the system lifecycle for UML-MARTE models remains mainly an open issue. In this paper 1 , we present a time properties verification framework for UML-MARTE safety critical RTS. This framework relies on a propertydriven transformation from UML architecture and behaviour models to executable and verifiable models expressed with Time Petri Nets (TPN). Meanwhile, it translates the time properties into a set of property patterns, corresponding to TPN observers. The observer-based model checking approach is then performed on the produced TPN. This verification framework can assess time properties like upper bound for loops and buffers, Best/Worst-Case Response Time, Best/Worst-Case Execution Time, Best/Worst-Case Traversal Time, schedulability, and synchronization-related properties (synchronization, coincidence, exclusion, precedence, sub-occurrence, causality). In addition, it can verify some behavioural properties like absence of deadlock or dead branches. This framework is illustrated with a representative case study. This paper also provides experimental results and evaluates the method's performance.

Introduction

Safety Critical Real-Time Systems (RTS) have strong timing requirements concerning system's reliability. Model-Driven Engineering (MDE) allows verifying system's properties since the early phases of system lifecycle and iteratively improving the models according to the verification results. One important issue is how to assess the properties for semi-formal models. UML [START_REF]OMG Unified Modeling Language TM , Superstructure[END_REF] and its profile for modelling non-functional concerns, MARTE [START_REF]UML profile for MARTE: modeling and analysis of real-time embedded systems version 1[END_REF] are standardized modelling languages widely accepted by industrial designers for RTS. However, to our knowledge, no formal specification for the whole language is currently available. Thus, before verification, UML models must be transformed to executable and verifiable models, supported by state-of-the-art model checkers. Meanwhile, time properties must also be transformed to verifiable time assertions. A key issue in the use of model checkers is to avoid the combinatorial explosion of state space and to guarantee the verification method's performance. Combemale et al. have proposed in [START_REF] Combemale | A propertydriven approach to formal verification of process models[END_REF] to design Property-driven formal verification tools to handle many different kinds of properties for complex system models. The translation is thus dedicated to each kind of properties to improve verification performance. This work follows the same approach to design a time property verification toolset for UML-MARTE models of safety critical RTS.

This paper presents the resulting verification framework that can assess time properties like upper bounds for loops and buffers, Best/Worst-Case Response Time (B/WCRT), Best/Worst-Case Execution Time (B/WCET), Best/Worst-Case Traversal Time (B/WCTT), schedulability, and synchronization-related properties (synchronization, coincidence, exclusion, precedence, sub-occurrence, causality). In addition, it can verify some behavioural properties like absence of deadlock or dead branches. The framework relies on three steps.

Firstly, the property-driven transformation from UML-MARTE to Time Petri Nets (TPN). This method translates semi-formal UML models into executable TPN models for verification purpose. TPN [START_REF] Merlin | Recoverability of communication protocols-implications of a theoretical study[END_REF] is selected as the verification model, as it allows expressing and verifying time properties under both logical and chronometric time models. This framework uses the TINA toolset [START_REF] Berthomieu | The tool tina -construction of abstract state spaces for petri nets and time petri nets[END_REF] as model checker. in TPN are extended with a time constraint that controls the firing time. For example, transition T 1 is attached with time constraint [19,27]. When the token arrives at place P 1 , the local timer of T 1 starts. Between 19 and 27 time units, T 1 can be fired. This transformation covers UML architecture models (using the full Composite Structure Diagram) and behaviour models (using the full State Machine Diagram and a major subset of Activity Diagram). It is property-driven in order to limit the state space during model checking. Property-driven means that the transformation of some UML elements can be different depending on the assessed property; meanwhile the transformation does not conserve all the information in UML, but only those concerning the property verification. Another issue is raised from TPN theoretical limits. As model checking and reachability are undecidable in TPN when using stopwatch [START_REF] Berthomieu | Reachability problems and abstract state spaces for time petri nets with stopwatches[END_REF], the transformation method should avoid using stopwatches.

Secondly, the translation from time properties into time property patterns. Time properties are expressed using MARTE. These expressions cannot be directly verified by TPN model checker. The proposed method translates them into a set of verifiable property patterns, which are quantitative. Their values can be computed in our proposal by iterative use of the model checker relying on dichotomy search. The time property patterns are independent of both the user modelling language and the verification language, making the method reusable in other verification frameworks. To make our method practical for end users, we focus on the time properties at both the event and the task levels. For the synchronization-related properties, we introduce the concept of time tolerance, because two simultaneous events cannot be measured without errors in the real world. The related work CCSL [START_REF] André | Specification and verification of time requirements with ccsl and esterel[END_REF] focuses only on more symbolic time constraints at the event level without time tolerance.

Finally, the verification of time property patterns. The usual methods for verifying time properties in TPN rely mostly on LTL (Linear Time Logic), CTL (Computation Tree Logic) and µ-calculus. First, end users are not accustomed to their use. Second, these languages are not always powerful enough for some quantitative properties, in terms of both their semantic expressiveness and computation resource consummation. This issue is reduced by using the observerbased model checking. For one property pattern, an additional TPN structure extends the original TPN, then the reachability graph is generated using the highest abstraction. Complex LTL assertions become marking existence assertions, which can be cheaply computed. The observers do not change the original TPN's behaviour. This observer-based verification method relying on TPN is independent of the user modelling language, making it reusable.

This paper is structured as follows: Section 2 compares this proposal with the related works; Section 3 briefly presents the verification framework for UML-MARTE; Section 4 introduces a representative case study; Section 5 presents the property-driven transformation method from UML-MARTE models to the target TPN models; Section 6 proposes the time property translation method and the time property patterns verification method based on observers in TPN; Section 7 evaluates the proposed framework by verifying the time property in the case study and analyses the method's performance; Finally, comments on conclusion and further works are discussed in Section 8.

Related Works

Some works are also aimed to verify the properties in UML. The difference lies in the type of verification model and the capacity of the verification methods. Lilius and Paltor use the PROMELA language in [START_REF] Lilius | vuml: a tool for verifying uml models[END_REF] to specify UML models and exploit the SPIN model checker. This method did not involve LTL verification and the author thought SPIN is not the most efficient solution. André and Mallet use Esterel in [START_REF] André | Specification and verification of time requirements with ccsl and esterel[END_REF] as verification language. Although its time constraint specification language CCSL covers logical and chronometric constraint in UML, its verification approach only supports logical constraints so far to our understanding. Gagnon et al. translate UML diagrams into Maude language and verify deadlock property using LTL in [START_REF] Gagnon | Applying model checking to concurrent uml models[END_REF]. This work does not handle other time properties. In terms of performance, this work denotes that they still need to test this approach on larger examples. Knapp1 and Wuttke transform UML to a special class of timed automaton in [START_REF] Knapp | Model checking of uml 2.0 interactions[END_REF], then translate them to concrete programs for model checkers SPIN. It verifies the consistency between different system descriptions. This work does not concern the time aspect. Medina and Cuesta present in [START_REF] Medina | From composable design models to schedulability analysis with uml and the uml profile for marte[END_REF] MARTE2MAST, a tool that enables the extraction of schedulability analysis models and their direct analysis using MAST [START_REF] Gonzalez Harbour | Mast: Modeling and analysis suite for real time applications[END_REF]. It supports analysis by using simulation tool and static analysis techniques. It defines a complete package for system analysis including the scheduling algorithms. However, as the simulation is not exhaustive, it cannot prove the correctness in all possible cases. Shousha et al. describe in [START_REF] Shousha | A uml/marte model analysis method for uncovering scenarios leading to starvation and deadlocks in concurrent systems[END_REF] a search-based UML-MARTE model analysis method for starvation and deadlock detection. It uses genetic algorithms to search through the state space. As the genetic search method cannot ensure the building of the full state space including all the final states, this method cannot guarantee that the whole space will be exhaustively searched. It can detect errors but cannot prove their absence, which is a significant drawback for safety critical systems.

Petri Nets are powerful models for describing system behaviour and for verifying the properties. In [START_REF] Andrade | A methodology for mapping sysml activity diagram to time petri net for requirement validation of embedded real-time systems with energy constraints[END_REF] Andrade et al. map SysML Activity to ETPN (extended TPN with energy constraints) to estimate the energy consumption and the execution time of system. Compared with this work, the advantages of our work lie in 3 aspects: for the time property scope, we verify a large scope of time properties, while [START_REF] Andrade | A methodology for mapping sysml activity diagram to time petri net for requirement validation of embedded real-time systems with energy constraints[END_REF] covers only the execution time; for the transformation method, we propose the property-driven transformation method and consider both the architecture and the behaviour models, while [START_REF] Andrade | A methodology for mapping sysml activity diagram to time petri net for requirement validation of embedded real-time systems with energy constraints[END_REF] only considers the behaviour model; for the verification method, we propose a novel observer-based TPN verification method.

Overview of UML-MARTE Verification Framework

The objective of the UML-MARTE verification framework (Fig. 2) is to verify whether the design of UML-MARTE RTS Model satisfies the expected Time Property. The System Model consists of both Behaviour Model and Architectural Model. The former defines how the system will act and response to the outside world, while the latter describes the interconnection relation between sub-components of the system. In practice, the behaviour model is described

Case study

We use a classical asynchronous RTS model, IMA-based airborne system, to present the application of the proposed methods. According to the general asynchronous message-driven pattern, the sender will regularly distribute data to the two receivers through the communication networks that have transfer delays and jitters. The receivers will do some computation. Fig. 3 The AFDX only guarantees the communication delay upper bound, which means that the delay varies in [t min , t max ]. Thus, it is obvious that the computation of calculators A and B are coincident only if the time tolerance is superior to (t max -t min ), which is twice of the network jitter. In some cases, however, we need to design some supplementary protocol between the receivers to decrease the coincidence time window in order to get better system robustness.

The designer implements a naive protocol relying on the hand shake paradigm of Fig. 4, in which the two receivers are distinguished by respectively setting as active and passive modes (Fig. 5). The active one, after getting the data from the sender, sends an asynchronous notification to the passive one and automatically waits for a fixed time duration to launch its computation. The passive one will start its redundant computation once it gets the notification from its active master. As the notification message is also passed by the same AFDX network, the designer could wonder if this protocol really solves the tolerance-reduction requirement. By modifying the wait time of the active receiver and the network jitter, the designer can use the proposed methods to verify whether the computations are still coincident under the new protocol, and then refine his design according to the verification results. In this case study, we illustrate how our approach helps verifying time properties and assists the protocol designer with guaranteed correctness and performance. We present the principles of the UML transformation method and illustrate the transformation for a significant subset of UML elements of both the architecture and behaviour models. Due to page limits, the complete transformation rules for UML Activity Diagram can be consulted in [START_REF] Ge | Time properties dedicated transformation from umlmarte activity to time petri net[END_REF]. The description of the UML State Machine Diagram transformation will be submitted later on.

Principles

The transformation approach is property-driven, aiming to limit the state space of model checking. The approach respects the following 6 principles:

1. The framework verifies each time property in one state space generation. This means one transformation keeps only the information for one property to be verified. 2. The transformation of one UML element may be different according to the time property.

3. For some UML elements not influencing time properties, the target TPN semantics can be standardized and homogeneous for all the properties. 4. The transformation should guarantee the consistency between high-level and lower-level models. However, a correct transformation here does not imply a 100% semantic preservation, but rather to ensure the semantics necessary for the property verification are preserved through the transformation. 5. The target TPN models should ensure high performance verification, especially for large-scale asynchronous applications. 6. The patterns resulted from each element transformation should be easy to assemble. This may degrease the verification performance. But it can be compensated later by a model optimization phase that eliminates the elements irrelevant to the verification.

Architecture Model Transformation

The architecture parts in the model aim to connect the different parts to build a whole system, using communication media or shared resource. The transformation method aims to replace each component of the architecture part by its relevant behaviour part, respecting a correct instance-mapping, context-based naming and their connection relationship. In the Composite Structure Diagram (CSD) from the case study, the significant elements are Part, Port and Connector. The others remain important, but due to page limits, we only describe the mapping rules for Part and Port in this paper.

Part There are two patterns for Part: hierarchical and primitive (Fig. 6). The behaviour is described, for the former, by the Part's inner structure, and, for the later, by the Part's associated behaviour model. For the hierarchic pattern, the architecture model is considered as a tree-like structure, and the mapping approach is applied recursively. Port Port is used to connect outside structure and inner behaviour. MARTE Alloc::Allocated profile is used to map the logical PIN in behaviour model and the physical Port in architectural model. Port is transformed to an empty TPN place to represent a data buffer concept. In a bad designed system, data quantity may overfill the buffer size, it is thus important to detect this undesired property before doing the verification, as this may cause an undecidable boundedness problem in TPN verification. In order to avoid a non-terminating verification problem, a supplementary structure is added (Fig. 7). It ensures that if the buffer is overfilled, it will raise an overflow. The overflow is represented by an ever-large marking that cannot exist in normal system. As TINA can detect on-the-fly any marking exceeding the pre-set threshold and stop state graph generation at once, this transformation method guarantees that all verification will finally terminate.

No Explicit Inner Structure

Behaviour Model Transformation

A general transformation pattern is defined (see Fig. 8) to automate the assembly of the TPNs generated from the behaviour model. For all non-link elements in UML, the generated TPN must contain some C_IN transitions to connect with other predecessors in static model structure. In the same manner, some C_OUT places must exist to connect with its structural successors. The main elements in the UML Activity Diagram (AD) are related to control, action, resource, object, and connection. We present the transformation for OpaqueAction for system with single and multiple clocks (see later). An action is the fundamental unit of executable behaviour. It takes a set of inputs and converts them into a set of outputs. Depending on the abstraction level, an action could represent either a complex processing flow or a primitive one carrying out a computation. In UML-AD, there are 55 kinds of actions. Each kind covers a certain range of semantics for different usage. In order to focus on the core semantics related to time properties, we generalize the concept using the OpaqueAction.

Action Transformation Pattern

The transformation method is illustrated by Fig. In our study, we use strictly the physical time notion as the exact reference for both mono and multi-clock base system. As the method assumes each component has independent clock, the drawback is that it can be too strict for those devices that share a clock. We still decide to choose this abstraction paradigm, because in the verification viewpoint, this will only lead to a false-violation. It means that if a time property is satisfied under independent-clock hypothesis, it must be also satisfied in a shared-clock system. This sufficient but not necessary condition may only cause a performance tradeoff in practice, but never gives out a wrong verification result when property's proof is positive.

Mono-Clock Action

Translation and Verification of Time Property

The time properties should be translated into TPN-compatible analyzable formalism. In our case study, the property is the coincidence between two tasks. We illustrate the property translation and verification methods for this property. The translation for all the synchronization-related properties can be consulted in [START_REF] Ge | Verification of synchronization-related properties for uml-marte rtes models with a set of time constraints dedicated formal semantic[END_REF]. The verification of other properties will be presented in other papers.

Translation of Coincidence Property

Definition (Task Level Coincidence). Task X and Y are coincident if f. the n th occurrence of X occurs simultaneously with the n th occurrence of Y , n ∈ N. As shown in Fig. 10, the coincidence between two tasks is determinated by the coincidence between the Event start and the Event end of tasks. For the n th occurrence of task X and Y, if the two Event start are coincident and the two Event end are coincident within time tolerant δ, task X and Y are coincident. Formally, task coincidence is translated into the following 3 equivalent assertions.

X[i] X[i+1] Y[i] Y[i+1] Coincidence(X,Y, ) = true X Y X[i] X[i+1] Interleave Coincidence(X,Y, ) = false Y[i] Y[i+1]
Coincidence(X, Y, δ)

≡ ∀t ∈ R + : (|O(X t s ) -O(Y t s )| < 2) ∧ (|O(X t e ) -O(Y t e )| < 2) (1)
∀t ∈ R + : (|T (X t s ) -T (Y t s )| < δ) ∧ (|T (X t e ) -T (Y t e )| < δ) (2) ∀i ∈ N * : (T (X i e ) + δ < T (Y i+1 s )) ∧ (T (Y i e ) + δ < T (X i+1 s )) (3)
In the above assertions, X represents task; X a the inner event a of task X, particularly X s for start event, X e for end event; X i a the i th occurrence of inner event of task X; X t a the occurrence of X a which is the nearest (forward or backward) to the time instant t; T (X i a ) the occurring time instant of X i a ; T (X t a ) the occurring time instant of X t a ; O(X t a ) the occurrence count for X a at time t; and δ is the time tolerance for coincidence. There are 4 time property patterns in the assertions (Table 2). The task-level property is then represented by a set of event-level property patterns. To assess the time property, the observer pattern is added into the original TPN, and then the TINA model checker is used to verify the observer-dedicated LTL/CTL/Marking assertions for the TPN. As model checking significantly consumes time and memory resource, we use the following 2 approaches to ensure the verification performance.

-When doing the model checking, the TPN shall perform the highest possible abstraction to unfold the reachability graph. This high abstraction model should preserve the desired time property. The model-checking is on-the-fly. -Each assertion's verification is independent in terms of reachability graph generation, so a parallel computation is possible.

We choose one of the property patterns, |T (a t ) -T (b t )| < δ, to illustrate the verification method. The principle of deciding whether two events are always occurring in a given bound is to find out whether one could advance another by time δ.

An observer pattern (Fig. 11) is added in the original TPN. The middle transition will always instantly neutralize the tokens from the places Occ A and Occ B except when one token waits for a time longer than δ that leads to the firing of Pass transition. To guarantee the termination of model checking, the pattern is extended by adding a large overflow number on the tester's incoming arc. We use places tester A and tester B to detect this exception. In the generated reachability graph, it only requires to verify if tester A or tester B has marking. The assertion is:

♦(testerA = 1) ∨ ♦(testerB = 1)
Once it is known how to verify |T (a t ) -T (b t )| < δ, it is possible to change δ to compute a near optimal tolerance. If |T (a t ) -T (b t )| < δ + 1 is verified as true, but false for |T (a t ) -T (b t )| < δ, then the near optimal tolerance is δ + 1. In order to improve the computation efficiency, a dichotomy search is used to reduce the complexity from O(N ) to O(log N ). In the case study, the designer aims to design a protocol relying on our verification framework, and then evaluate the system performance. The designer alters the wait time of the active receiver and the jitter, selects the network average delay and computes the coincidence tolerance. The result is shown in Fig. 12. Different coloured lines represent the result with different jitters. The variation is regular and linear because the modelled system is conceptually simple without resource sharing. It is obvious that the best wait time of the protocol is 1600ms.

Then the user aims to evaluate this protocol by verifying the coincidence property. In the verification result (see Table 3), comparing the minimum co-incidence tolerance in original system and that in the protocol system, it is obvious that the protocol succeeds in decreasing the tolerance value. We can say the system is more robust than the original.

Verification Performance Analysis

The performance of model checking is a very important issue for the end user.

In this verification framework, we have used property-driven transformation, observer-based verification in highest abstraction mode and parallel computation methods to avoid the explosion of state space problem and to ensure a high performance. To validate the performance, we focus on two aspects: efficiency and scalability. The objective is to find out that within an acceptable time range for rapid system prototyping (less than 1 minute), the framework is able to verify the coincidence property of system with a scale of 2 senders, 2 routers, and 1-20 pairs of active-passive receivers which is representative of current avionics systems. The performance evaluation result (Fig. 13) shows both the efficiency and the scalability of the performance. The efficiency is shown by the verification's computation time. For a system with 20 pairs of receivers, the original reachability graph generation time is less than 1000ms on a common computer; the computation time proving that the property is true is less than 16000ms, and the computation time proving that the property is false is about 6000ms. It is straightforward that proving a property false needs less time than the truth proof, because once a violation is detected the checking terminates. The scalability is shown by the linear relation between the time-over-cost of verification and the system's scale. When the increasing ratio is constant, it guarantees that if the original system reachability graph could be generated, then all the verifications of its time properties using our framework will take an appropriate time.

Conclusion and Further Works

In this paper, we propose a time property verification framework for UML-MARTE safety critical RTS. This verification framework can assess time properties like upper bound for loops and buffers, B/WCRT, B/WCET, B/WCTT, schedulability and synchronization-related properties (synchronization, coincidence, exclusion, precedence, sub-occurrence, causality). In addition, it can verify some behavioural properties like the absence of deadlock or dead branches. We evaluate the framework with a representative case study focusing on the property of coincidence between two tasks. The verification result demonstrates this framework can not only verify the time properties, but also assist the system's design at early phases of the lifecycle. The performance test and analysis illustrate the efficiency and scalability of the framework. Due to page limits, we will present the other properties' verification in other contributions.

One contribution is the proposition of the property-driven transformation, time property translation and observer-based verification methods. The time property translation method is independent of both the design modelling language and the verification language; the observer-based verification method is independent of the design modelling language. This independence allows these methods to be integrated in other verification frameworks. Another contribution is the approaches for reducing the state space combinatorial explosion problem, including the property-driven transformation, the highest abstraction on-the-fly model checking, and the parallel computation.

In the future, we will focus on extending this framework. On the technical side, we will optimize the TPN models by finding some reducible structural patterns without influencing the property. On the methodological side, we will experiment with other kind of properties, like the functional property, to improve the Property-driven approach to DSML (Domain Specific Modelling Language) model verification that started in the TOPCASED project.

Fig. 1 Figure 1 .

 11 Figure 1. Time Petri Net Example

Figure 2 .

 2 Figure 2. UML-MARTE Model Checker

Figure 4 .Figure 5 .

 45 Figure 4. IMA-based Airborne System Architecture Model with Handshake Protocol

Figure 6 .

 6 Figure 6. CSD-Part

Figure 7 .

 7 Figure 7. CSD-Port

Figure 8 .

 8 Figure 8. General Transformation Pattern

9 .Figure 9 .

 99 Figure 9. UML Action Transformation to TPN

Figure 10 .

 10 Figure 10. Coincidence Property

Figure 11 .Figure 12 .

 1112 Figure 11. |T (a t ) -T (b t )| < δ Pattern TPN Observer

  Coincidence Property (ms) Performance Test Case (1-20 Receivers) Orignal COINCIDE(A,B,2)=false COINCIDE(A,B,4)=false COINCIDE(A,B,6)=false COINCIDE(A,B,8)=false COINCIDE(A,B,10)=false COINCIDE(A,B,20)=true COINCIDE(A,B,30)=true COINCIDE(A,B,40)=true

Figure 13 .

 13 Figure 13. Performance Evaluation

  presents the architecture model. The sender represents a data-collecting sensor. The router represents a virtual link of Avionics Full DupleX (AFDX). The two receivers represent two identical calculators that provide redundant control. The input data of computation is sent by the sender through the router.The elements from MARTE in Table1are used to describe time specification. The redundant controller design requires that the output of the two calculators must be available at the same time in each working cycle; otherwise, the servo

		Air data sensor : Sender
		<<Allocated>>in
		ADFX virtual link : Router
	<<Allocated>>sig	<<Allocated>>out_1	<<Allocated>>out_2	<<Allocated>>sig
	calculator A : Receiver			calculator B : Receiver
		Table 1. MARTE Profile Usage
	MARTE Profile		Time Specification
	GRM::ResourceUsage	task's execution time
	GRM::CommunicationMedia	communication delay
	Alloc::Allocated	mapping the soft data pin to the hard data port

<<Allocated>>output Figure 3. IMA-based Airborne Architecture Model of the corresponding actuator cannot correctly unify the redundant command.

In this case, we need to verify the coincidence of computation tasks between calculators A and B. As it is impossible to respect a strict simultaneous timing with an explicit local synchronisation, a time tolerance is defined. Once the two time instants fall into the same time window (size of window equals to tolerance), they are considered as coincident.

  Multi-Clock Action For multi-clock actions, the execution time is specified by the expected physical time. Before integrating this time into a multi-clock based system, first we need to translate the expected physical time into tick numbers. Then its real physical time can be deduced by associating the clock's drift. We use the same example as the previous one. Let clock A and B tick theoretically every 1 us, and their backward and forward drift are both 1%, therefore action A's tick number is [3400, 4700] and B's is [78.9, 463.5]. As tick number must be integer, a rounding strategy must be taken, without introducing unreasonable conversion error. In our study, we use the floor function for t min and ceiling function for t max . Therefore, we have A for [3400, 4700] and B for [78, 464] as tick numbers after the rounding.

For mono-clock actions, the execution time is directly used after a global normalization of the time units. For example, if action A takes [3.4 ms, 4.7 ms] and actions B [78.9 us, 463.5 us], the correspondent min time and max time on the TPN transition is [34000, 47000] and [789, 4635] respectively, with the common unit of 0.1 us.

Table 2 .

 2 Time Property Patterns Verification of Time Property Pattern |T (a t ) -T (b t )| < δ

	Time Property Pattern	Definition
	X i+k s		Representation of event X i+k s
	|O(X t a ) -O(Y t a )| < δ Occurrence difference between events X t a and Y t a
	|T (X t a ) -T (Y t a )| < δ	Relative Tmax between events X t a and Y t a
	T (X i e ) + δ < T (Y i+1 s	)	Relative Tmin between events X t a and Y t b
	6.2

Table 3 .

 3 Verification Result: Independence with Designed Hand shake Protocol (ms)

	Network Average Delay Network Jitter Time Window	Min Coincidence tolerance
				Original System Protocol System
	1600	100	200	685	617
	1600	300	600	1085	817
	1600	500	1000	1485	1017
	1600	700	1400	1885	1217
	1600	900	1800	2285	1417
	1600	1100	2200	2685	1617
	1600	1300	2600	3085	1817
	1600	1500	3000	3485	2017

This work was funded by the French ministries of Industry and Research and the Midi-Pyrénées regional authorities through the ITEA2 OPEES and FUI Projet P projects


Damien Besancenot
email: besancenot.damien@univ-paris13.fr

Delphine Dubart
email: dubart@essec.fr

Radu Vranceanu
email: vranceanu@essec.fr

The value of lies in a power-to-take game with imperfect information

Keywords: Ultimatum game, Taxation, Lies, Deception, Asymmetric information. JEL Classification: C91, D82, D83

Humans can lie strategically in order to leverage on their negotiation power. For instance, governments can claim that a "scapegoat" third party is responsible for reforms that impose higher costs on citizens, in order to make the pill sweeter. This paper analyzes such communication strategy within a variant of the ultimatum game. The first player gets an endowment, and the second player can impose a tax on it. The former can reject the allocation submitted by the tax-setter. A third party is then allowed to levy its own tax, and its intake is private information to the tax-setter. In a frameless experiment, 65% of the subjects in the tax-setter role overstate the tax levied by the third party in order to manipulate taxpayer's expectations and submit less advantageous offers; on average, for every additional currency unit of lie, measured by the gap between the claimed and the actual tax, they would reduce their offer by 0.43 currency units.

Introduction

Humans often lie strategically. For instance, governments sometimes need to impose restrictions, new taxes and costly reforms on citizens or groups of citizens. In turn, unpopular reforms can lead to tax evasion, political instability and social unrest, with dramatic consequences for both governments and citizens. In many cases such bitter medicine seems to be better accepted if the government can pretend that a third party shares the responsibility of the restrictions. If we watch back in time only to the period that followed the Asian 1995 crisis, international organizations such as the IMF or the European Union have often been called to play this "scapegoat" role. In some cases, it might pay for the government to set up a third party only to delegate it the right to collect some of the less popular taxes. It might then become interesting for the policymaker to claim that the most difficult reforms or taxes are imposed by the third party, while he is the true initiator. There are many examples in business or private life where strategic communication serves as a tool for leveraging negotiation power.

The ultimatum game [START_REF] Güth | An experimental analysis of the ultimatum bargaining[END_REF]) provides a natural framework for analyzing such interaction. In the standard experimental setup, the two players are referred by the intuitive nicknames Proposer and Responder. The former is endowed with an amount of money and must make an offer over how to divide this sum between them. The Responder can accept the offer, in which case the allocation is implemented as such, or reject it, in which case both players receive nothing. The subgame perfect Nash equilibrium with pure self-interest predicts that Responders should accept any positive amount. This result has been falsified by an impressive number of tests (Roth, 1995). As documented by [START_REF] Oosterbeek | Cultural differences in ultimatum game experiments: Evidence from a meta-analysis[END_REF] in a meta-analysis performed on 37 papers, Proposers offer in average no less than 40% of the pie; also, 16% of the offers are rejected. 1 These results have been interpreted as evidence in favor of a fairness concern specific to human beings [START_REF] Camerer | Behavioral Game Theory[END_REF].

In order to address the tax (costly reform) issue in a straightforward way, we develop a variant of the ultimatum game where the roles of players are inverted, i.e., a power-totake game, as referred to by [START_REF] Bosman | Emotional hazard in a power-to-take game[END_REF]. In the baseline scenario, at the outset of the game, the first player -we call him Receiver -gets an endowment.

Another player, called Sender, can tax him a part of this amount. At the end of the game, the first player can either accept this allocation, or reject it thus bringing payoffs of both players down to zero. We then introduce a third agent able to levy his own tax on Receiver, called Computer and played by the computer itself, which can be seen as the "scapegoat" international organization. In our game, there is no scope for cooperation between Computer and Sender.

The two human players -Receiver and Sender -have similar preferences, while Computer is a representation of external random factors beyond the reach of the former ones. Receiver knows the statistical distribution of Computer's moves, but does not know the actual amount taxed. Sender has full information about the move of the machine. He must send a message to Receiver, informing him about this amount, but htis message is unverifiable. At the time when Receiver must decide whether to accept or not the allocation, he will know the amount left in his hands after the successive interventions of the computer and Sender, and has the information sent by Sender about the amount taken by the computer. Sender's strategic advantage over Receiver is twofold: he moves first (after the computer) and has full information about his position in the game. Receiver's negotiation power stems from his ability to turn down the offer submitted by the Sender, at a cost for himself.2 Like 1 See [START_REF] Bearden | Ultimatum bargaining experiments: The state of the art, Available[END_REF] for an almost exhaustive survey of the litterature on this game. in a standard ultimatum game, we expect Receiver to reject "unfair" offers; knowing this, Sender should make offers that Receiver accepts. If we push forward the parallel with policy reforms, a government should be concerned by the political acceptance of any reform; if not, it may find out that people can reject, sometime in the street, any measure perceived as unfair.

The paper contributes to the growing experimental literature on lying and deception initiated by [START_REF] Gneezy | Deception: The role of consequences[END_REF]. He submits an interesting typology of lies with respect to players' payoffs. If the lie, defined as misrepresentation of reality, brings about an improvement in both players' well-being, we have a "Pareto white lie"; if Sender is worse-off but Receiver is better-off -we have "an altruistic white lie". If Sender is better-off while Receiver is worse-off, this is the typical "selfish lie", which [START_REF] Gneezy | Deception: The role of consequences[END_REF] acknowledges to be the most relevant category for many economic events. Taking stock from an Seder-Receiver experiment, he shows that a non negligible number of senders lie to reap some profit, even if this involve a loss for receivers (39% lied if the trade-off is 1$ to 1$: the proportion rises to 52% if the trade-off is 10$ to 10$); subjects' inclination to lie increases if they can get more from the lie, and decreases the more the others lose from it. In his analysis, gains are predetermined, and the individual can choose the "size" of the lie accordingly. Our analysis focuses on the reverse causality: we ask whether people who lie more, do so strategically, in order to increase their gain. Several other recent papers propose a deeper introspection in the aversion to lying or subjective lying costs (e.g., Lundquist, Ellingsen and Johannesson 2009;[START_REF] Erat | White lies, Forthcoming[END_REF]Hurkens and Kartick, 2009;[START_REF] Sánchez-Pagés | An experimental study of truth-telling in a senderreceiver game[END_REF][START_REF] Vanberg | Why do people keep their promises? An experimental test of two explanations[END_REF]Charness andDufwenberg, 2006, 2010;[START_REF] Hao | Honest lies[END_REF].

A first power-to-take game (they call it a demand ultimatum game) with imperfect infora menu of offers, and can submit them until the Responder acccepts one, or can stop the game and set the payoffs to zero. mation was analyzed by Mitzkewiz and Nagel (1993). An experiment closely related to ours -combining a standard ultimatum game with imperfect information with a message gamewas submitted by [START_REF] Croson | Cheap talk in bargaining experiments: Lying and threats in ultimatum games[END_REF]. In that paper, pairs of subjects play four times an ultimatum game with an outside option for responders if they reject proposers' offer, under various information treatments; more precisely, subjects have known and unknown information about the size of the pie and the outside option. In one unknown treatment, proposers know the size of the pie, actually one of four possible values, while responders know only that it can be anything between two given bounds (10 to 50), without a precise description of the statistical distribution (players are thus submitted to ambiguity). They also allow for players to submit messages between them, and use a dummy variable to record a misleading/true message. At difference with their study, in our experiment players have inverted roles and receivers know the exact statistical distribution of senders' endowment. Proposers' lies are measured by the difference between the claimed and the actual amount, not by a dummy variable.

The main research questions are:

• What are the communication strategies in this special variant of the ultimatum game?

• What is the (subjective) value of a rational lie? More precisely, for 1 euro of difference between the true and the communicated amount (1 euro lie), how much additional money do Senders aim to put in their pockets (in average)?

2 The Experiment

Design

We run four sessions in the interval from March to May 2011 (see Table 1). All sessions were performed at the Behavioral Research Lab of ESSEC Business School, with a total number of 44 participants. Subjects were recruited from the student population of the school, who answered to a call for paid decision experiments. The experimental design was presented via computer interface and all interactions were computerized. The program was written in z-Tree [START_REF] Fischbacher | z-Tree: Zurich toolbox for ready-made economic experiments[END_REF]. Each subject was assigned at random with a PC terminal. We make sure that no subject has participated more than once in this experiment. The whole procedure was common knowledge.

Players played the game here below [steps 1 to 6] for six rounds. In order to avoid repetition effects, the pairs of participants were randomly re-matched at each round; the roles (either Sender or Receiver) were also draw at random at the outset of each round.

The main steps are listed below:

Step 1. A the beginning of the party, Receiver (called Player 1) gets 100 experimental currency units (we call them "yens" and inform the students that the actual exchange rate will be 100 yens : 2 euro cash).

The two agents introduced before, Computer (played by the computer itself) and Sender (an anonymous human, called Player 2) will be allowed to withdraw, one after the other, some money from this budget. The Receiver will observe only the funds left at the end of the game.

Step 2. The computer takes a random amount Y ; The draw has a uniform distribution on the support [0; 50].

Step 3. Sender learns Y.

Step 4. He sends a message M to Receiver informing him about the amount Y. If M = Y, he tells the truth, if M 6 = Y, he lies. We will distinguish latter on between a self-interested, rational lie M > Y and an "irrational lie", M < Y.

Step 5. He (Sender) then takes for himself an amount Z (Z ∈ [0; 100 -Y ])

Step 6. Receiver gets the message M and observes the amount left in his hands: R = 100 -(Y + Z). He must decide whether to accept or reject the offer of the Sender. If he accepts, the amounts are due; if else, both players get nothing.

Table 1 presents the experience schedule. We run four sessions, two with a warm-up test, two without warming-up. In the warm-up test, the amount Y taken by the computer (at random in the interval [0, 50]) is public information. Since Y is known, the sender does not need to issue any message, he just has to decide on his tax Z, given the amount Y. Players play this game for six rounds, before moving to the basic imperfect information set-up (steps 1-6). At the end of the experiment, participants received the income of all periods. One virtual currency unit translated into 0.2 euros. In the "with warming-up" condition the experiment took about 60 minutes, and the average income was 14.36€. The average amounts (Z + Y ), 68.7 and respectively 62.2, are statistically different between the two conditions -with and without warm-up (t = 2, 86, p < 0.05), while the average Y drew by the computer is almost identical (24.5 vs. 24.1). As expected, whatever the design, accepted offers are in average better than rejected ones.

Basic statistics

Empirical communication strategies

If there is a cost of lying, some Senders might be tempted to overstate the amount taken by the Computer, in order to manipulate Receiver's expectations, and submit less generous offers. In other words, they would "hide behind the Computer's action" in order to implement a more self-interested action. This outcome can arise only if there are honest Senders, who will tell the truth. The very presence of these honest persons opens the door for others to misbehave (become liars). According to this basic logic, only two categories of persons should exist: honest persons and liars that exaggerate the amount deducted by the computer.

A surprise came with the existence of third category, the "irrational player", who understate the amount taken by the computer. By so doing, they not only bear the cost of lying (we will rule out the possibility of getting some pleasure from telling lies), but also make the Receiver believe that the "remaining pie" is larger than the actual pie; The sender should now tax a lower amount.

For each of the three observed empirical strategies we report in Table 3 the number of times it has occurred (n), the average absolute deviation and the relative deviation. The average absolute deviation is the average difference between the message and the actual amount taken by the computer. The relative deviation is the sum of the differences between the message and the true draw, over the sum of true draws. The Sender told the truth 11 times (15 times) in the "with warming-up" condition (respectively without warming-up).

The 12+8=20 irrational choices were made by only 13 players (who played the role of the Sender three times each). We cannot connect their behavior to the amount taken be the computer. Notice that of the 13 players making an irrational choice, 7 ended up by playing the rational lie or honesty strategy at the last round, and only 6 still played the irrational strategy. Probably these players had some difficulties in understanding the problem.

The (subjective) value of selfish lies

In order to get an indication of the consequences of lies on the amount taken by the Sender, we can run a regression on Z, the amount taken by Sender, of the amount taken by the computer Y and the difference between the message and the actual amount (M -Y ), for each observation k:

Model 1: Z k = C -aY k + b(M k -Y k ) + k (1)
Of course, observations collected for one individual over six rounds are not independent (they are independent only within one round), thus such a regression (with pooled data) should be seen only as a rough attempt to extract common coefficients.

The coefficient a indicates the response of the Sender to a one unit increase in the tax taken by the computer, independent of the communication strategy. The coefficient b measures the "pure" lie effect, i.e., what are the consequence on Z of a one unit lie, M -Y = 1, when controlling by for the size of the amount taken by the computer.

In order to detect the specific impact of the lies on Z for the two categories of liars (rational and irrational), we also create two dummy variables, DUMLIE that takes value 1 for M > Y and 0 if else, and DUMIR that takes the value of 1 for M < Y and 0 if else.

Model 2 allows to identify the specific impact on Z of each type of lie (selfish-rational and accidental-irrational).

Model 2:

Z k = C -aY k + ρDU M LIE * (M k -Y k ) + γDUMIR * (M k -Y k ) + k (2)
Like in model 1, the coefficient a indicates the response of the Sender to a one unit increase in the tax taken by the computer, independent of the communication strategy. The coefficient ρ indicates the pure effect of a selfish lies, and the coefficient γ measures the pure effect of an accidental lie. (*** statistical significant at 1%, ** statistical significant at 5%; ns -not significant)

A reading of the coefficient a indicates that for every additional yen taken by the Computer, all other things equal, Sender will reduce his own tax, but by less than one yen (between 0.238 and 0.529, depending on the model). Hence the total amount available to Receiver declines for every additional euro taken by the computer.

The undifferentiated effect of a lie (coefficient b) is positive in both experiments. When the Sender exaggerates the amount taken by the computer by 1 yen, he does so in order to tax 0.22 (respectively 0.38) more yens.

The effect is stronger in model 2, where we can isolate the impact of selfish lies: the coefficient ρ is large and statistically significant: for those Senders who choose the selfish lie strategy, for every additional currency unit of lie, they tax the Receiver an additional 0.43 units.

Conclusion

A government might be limited in his ability to tax or impose costly reforms by a popular rejection of what can be seen as an unfair distribution of wealth. However, citizens might accept higher taxes if some of them are levied by a third party, for instance a supranational organization. If such an external agent exists, a manipulating government might even claim that reforms are actually imposed by this organization while he would be the true initiator.

In order to analyze these complex strategies, this paper develops a power-to-take game (a variant of the ultimatum game): firstly one player receives an endowment, then another player can levy a tax on this amount. We show that, under perfect information, this special game leads to similar pie sharing strategies as the normal ultimatum game: those who submit the offer would keep for them no more than 60% of the pie.

The experiment carried out at the ESSEC Experimental Lab revealed three empirical communication strategies. The most frequent strategy (2/3 of the total interactions) is the selfish lie, where Sender overestimates (by about 50%) the amount taken by the computer.

A simple regression model shows that for every additional currency unit of lie, Sender will raise his intake by 0.43 currency units. Some players will tell the truth, and, some other will underestimate the amount taken by the computer. This latter strategy is hard to understand in this context.

In the framework of the tax tale, if only the tax-setter has complete information about the tax collected by the third party, he can use this information strategically. In particular, Sender (tax-setter) would inflate the actual amount levied by the computer, just in order to push down Receiver's (taxpayer) expectations about the amount left to be shared. This will allow the sender to submit a less advantageous offer for the receiver.

Step 3c: Player 1 must decide if he accepts or not the residual endowment:

• If he accepts it, both players receive the amounts defined above

• If he rejects it, both players receive 0.

Screen 3a: Instructions for Player 1

You are Player 1.

Step 0: At the beginning of the game, you receive a fixed amount of 100 Yens.

Step 1: The computer takes a random amount equals to Y Yens. Y is selected at random among all integers between 0 and 50. Each integer has the same probability (1/50) to be chosen.

Step 2: Player 2 takes an amount on your initial endowment (an integer between 0 and R=100-Y) At this step, Player 2 knows:

•

The amount Y taken by the computer

•

The message M that he will provide to you about the value of the amount taken by the computer.

Step 3: You observe:

• The value of S=100-Y-Z

•

The signal M provided to you by Player 2 about the amount Y taken by the computer. Player 2 can chose this message strategically.

Step 4: You decide if you accept or not the endowment S.

• If you accept, both players receive the amounts defined above.

• If you reject, both players receive 0.

Screen 3b: Instructions for Player 2

You are Player 2.

Step 0: At the beginning of the game, Player 1 receives a fixed amount of 100 Yens.

Step 1: The computer takes a random amount equal to Y Yens. Y is selected at random among all integers between 0 and 50. Each integer has the same probability (1/50) to be chosen.

Step 2: You receive the following information:

• The amount Y taken by the computer (This amount will not be known by Player 1 when he will make his decision)

•

The message M that he will send you about the amount taken by Computer.

You have to:

• Decide about the value M that you are going to communicate to Player 1 about the amount taken by the computer

• Take an amount Z on the endowment of the Player 1 (an integer between 1 and 100-Y)

Step 3: Player 1 receives the following information:

• The value of the amount left S=100-(Y+Z)

•

The message M that you provided about the amount Y taken by the computer.

He has to decide if he accepts or not the endowment S

• If he accepts it, you receive the amount Z and he receives the amount S.

• If he rejects it, both players receive 0.

Screen 4: Decision of Player 2

You are Player 2.

Player 1 has received 100 Yens.

Computer has taken an amount equal to Y Yens.

You can now take an amount Z on the residual endowment of Player 1.

You have to choose between all integers between 1 and R=100-Y.

At the end, Player 1 will decide if he accepts or rejects your offer. In this last case, gains of both Players will be zero.

You can now take an amount between 1 and R=(100-Y)= [R] Yens

To decide, you have the following information:

The amount taken by computer is Y=[Y] Yens

To decide, Player 1 will have the following information:

-The residual endowment after the two withdrawals (S=100-Y-Z)

-The amount M that you are going to communicate him about the amount taken by

Figures 1 Figure 1 :Figure 2 :Figure 3 :Figure 4 :

 11234 Figures 1 and 2 present the scatter diagram of Z with respect to Y . In the warming-up

  value of the amount taken by the Computer do you want to communicate to Player 1? M=[M] b/ Which amount do you want to take? Z=[Z] Screen 5: Decision of Player 1 You have received a fixed amount of 100 Yens. The computer has randomly taken an amount and Player 2 did the same. After these two withdrawals, your residual endowment is: S= [S] Yens. Player 2 indicates you that the amount taken by the computer was: [M] yens You have to decide if you accept this offer or not. If you reject it, both you and Player 2 will get nothing.. Please decide: You accept the offer/ You reject the offer. Screen 6a: Results Player 1

Table 1 .

 1 Experience schedule

	"With warming-up" condition	"Without warming-up" condition
	Session 1	Session 3	Session 2	Session 4
	N=10 subjects N=12 subjects N=10 subjects N=12 subjects
	March 2, 2011 April 29, 2011 April 6, 2011	May 18, 2011

Table 2 .

 2 Table 1 displays the basic average values. Average amount (Z + Y ) and ratio Z/(100 -Y )

		Overall sample	Accepted offers	Rejected offers
		Nb Z + Y	Z (100-Y )	Nb Z + Y	Z (100-Y )	Nb Z + Y	Z (100-Y )
	With warming-up	66 68.7	0.58	52 66.9	0.56	14 75.2	0.66
	Without warming-up 66 62.2	0.50	52 58.5	0.47	14 76.1	0.64

Table 3 :

 3 Av. abs. dev. Rel. dev. n Av. abs. dev. Rel. dev.

			With warming-up		Without warming-up
	TYPE Strategy n Liar M > Y 43	13.37	0.59 43	11.35	0.48
	Honest	M = Y 11	0	0 15	0	0
	Irrational	M < Y 12	-7.58	-0.25	8	-10.25	-0.28

Empirical strategies: Basic statistics

We notice that in both experiments, in 43 over 66 interactions (or 65%) the Sender has decided to overstate the amount taken by the computer. The selfish lie is therefore the preferred strategy.

This is different from the "reverse ultimatum game" by[START_REF] Gneezy | Bargainign under a deadline: evidence form the reverse ultimatum game[END_REF] where the Proposer has

Incentives:

In this experiment, you will be paid according to your performance in the game. Monetary payoffs are denominated in "Laboratory Yen". When calculating your take-home gain, the exchange rate is 50 Yens = 1 euro.

Game description:

You will be submitted to a decision problem, involving a partner chosen at random in the group and involving a random decision taken by the computer.

Individuals in the pair are referred to as Player 1 and Player 2, according to there role in the experiment.

Roles change at each round. At the beginning of each round, your new role will be indicated. Please be to careful to this indication.

Pairs are reset at each round. You will never play twice the same role in a game with the same player.

Screen 2: The basic sequence

Step 0: At the beginning of the game, Player 1 receives a fixed amount of 100 Yens.

Step 1: The computer takes a random amount equal to Y Yens. Y is selected at random among all integers between 0 and 50. Every integer has the same probability (1/50) to be chosen.

Step 2a: The amount Y is communicated to Player 2.

Step 2b: Player 2 can now take an amount equal to Z Yens (an integer between 0 and 100-Y).

At the end of these first steps, endowments are:

•

Player 1 : S Yens (with S is the residual amount of the initial endowment after the two withdrawals S=100-Y-Z)

Step 3a: Player 1 knows S (his endowment after the two withdrawals).

Step 3b: Depending on the treatment, an information more or less reliable is provided to Player 1 about the amount Y taken by the computer.


H Capa Santos

M Kratz
email: kratz@essec.edu.

F V Mosquera Muñoz

Prof Capa Holger
email: holger.capa@epn.edu.ec

Santos

Prof Marie Kratz

Alison Bougi
email: bougi@essec.edu

Modelling macroeconomic effects and expert judgements in operational risk : a Bayesian approach

Keywords: Basel II, Bayesian inference, Loss distribution approach, Macroeconomics dependence, Operational Risk, Quantitative Risk Management, Solvency 2

This work presents a contribution on operational risk under a general Bayesian context incorporating information on market risk profile, experts and operational losses, taking into account the general macroeconomic environment as well. It aims at estimating a characteristic parameter of the distributions of the sources, market risk profile, experts and operational losses, chosen here at a location parameter. It generalizes under more realistic conditions a study realized by Lambrigger, Shevchenko and Wüthrich, and analyses macroeconomic effects on operational risk. It appears that severities of operational losses are more related to the macroeconomics environment than usually assumed.

1

Introduction

The quantification of an operational risk capital charge under the regulatory standards Basel II and Solvency 2 is a challenging task; many financial institutions adopt a Loss Distribution Approach to estimate this risk capital charge (see eg, [Klugman et al.(2008)], [McNeil et al.(2005)]). Such approach requires combination of internal and external data, as well as expert opinions; indeed, this third component appeared recently as crucial. An interesting Bayesian scenario to estimate the parameters of the risk frequency and severity distributions has been proposed by Shevchenko and Wüthrich (see [START_REF] Shevchenko | [END_REF]]) based on internal and external data, then by Lambrigger et al. (see [START_REF] Lambrigger | [END_REF]], or [Lambrigger et al.(2008)] for an overwiew) when adding the expert opinion as a third component. They assumed an a priori market risk profile and various conditions such as the conditional independence given the market risk profile between the expert opinions and the internal observations. Here one aims to investigate other scenarios under more realistic conditions and taking into account the general macroeconomic environment. Indeed, if we refer to what recently happened at UBS or at Société Générale (with the Kerviel affaire), operational risks of this type might become rather serious during a financial crisis, hence showing some economic dependence. Therefore, using a more general Bayesian approach, we add in the prior modeling a hyper level representing the general macroeconomic environment. Moreover, this hierarchical extension helps increasing the robustness of the prior distribution (see [Robert(2007)] p. 143) and allows relating the a priori to any of the three main sources mentioned previously. Recall also that one of the reasons to adopt the Bayesian point of view, which is intrinsically conditional on a fixed number of observations, is to obtain estimators having good properties even with a fixed and maybe small sample size, and not only under asymptotic criteria (see [Robert(2007)], p. 48). It is rather important when considering operational losses, in (re)insurance companies or in banks. Indeed, the number of operations being limited in insurance companies (and even more in reinsurance companies), the number of operational losses is restricted, even if these losses are high on average. In banks, operations are quite numerous, which leads to a large number of small operational losses, but high operational losses are a few. Hence the need to have reliable estimators whatever the size of the operational loss sample is.

We will introduce our general Bayesian approach, with a prior variable U representing the general macroeconomic environment. Having a few information on this environment, we decided to chose it as an noninformative prior on the parameter. Nevertheless, the method would work as well with a specific a priori distribution as can be seen in the next section; it might be relevant when working in banking context, during a financial crisis. We will illustrate our general approach considering first when the a priori is related to the market risk profile. Then we will consider the point of view of the company and relate the a priori directly to the operational severities. Note that we will consider the same type of distributions as in [START_REF] Lambrigger | [END_REF] to enable fair comparisons. Nevertheless, our study will present one example only among the various examples developed in [START_REF] Lambrigger | [END_REF]], working with normal and lognormal distributions and choosing the parameter characterizing the distribution of the three sources as a location parameter, the main objective being to show how to generalize those previous works cited above and not to constitute a catalogue of examples. We will rather complete the study, looking at properties of the location estimator.

1 An a priori related to the market risk profile

Let us present our model. The main actors/sources of risk information of the model are respectively: -the operational losses (internal data) X = (X

i ; i = 1, • • • , k) of the concerning insti- tution; -the market risk profile Z; -the expert opinion Y = (Y j ; j = 1, • • • , n);
-an unknown parameter U that we introduce to take into account the general macroeconomic environment. This parameter might characterize the location or the shape parameter of the distributions of the three sources X, Y and Z, with a prior distribution denoted by π U . Here we will illustrate our method by choosing for instance U as the location parameter. Its noninformative prior distribution Π U is assumed to be uniform, hence a so called improper distribution but 'that should be preferred to vague proper priors such as a normal distribution with very large variance; it would give indeed a false sense of safety owing to properness, while lacking robustness in terms of influence on the resulting inference' (see [Berger(2000)]). Some information on the risk profile Z (that represents the location parameter) is provided as a benchmark for banks by the Basel committee, and as an index of the insurance market in the Solvency II standard formula by the EIOPA. We assume that the conditional distribution L(Z|U ) given U is known, with conditional expectation U :

E[Z | U ] = U . Note that it implies E[Z] = E[U ].
The operational losses X of the given company are described by internal data, and depend, as the operational risk profile h(X), on the parameter U but of course also on the market risk profile Z. This dependence can be translated through the location parameter of the conditional distribution L(X|U, Z) of X given Z and U in a simple way, when taking for instance a linear approximation of Z and U , namely αZ + (1 -α)U , α ∈ [0, 1[. The operational risk profile h(X) might be chosen as an unbiased estimator of the location parameter of the conditional distribution of X given Z and U , and satisfies E[h(X)] = E(Z) = E(U ). The conditional distribution of X given Z and U is also supposed to be known. Finally, we consider the expert opinion Y based on the knowledge of the market index Z but also, to be realistic, on the internal data X of the company; it is also influ-enced by the macroeconomic conditions, hence depends on the unknown parameter U as well. We suppose that Y has a known conditional distribution L(Y |X, Z, U ) given X, Z and U , with conditional expectation U . Using the same linear approximation to take this dependence into account, we ask for the conditional expectation of Y to satisfy

E[Y | X, Z, U ] = β 1 h(X) + β 2 Z + β 3 U, with β 3 = 0, β i ∈ [0, 1] : 3 i=1 β i = 1.
Since in general internal data are scarce, the aim is to use U , X, Z and Y to improve an estimation of the location parameter. Note that we introduced on purpose undefined parameters α and β i (with α = 1 and β 3 = 0, otherwise there is no point of introducing the r.v. U ), so that their choice is made by the user according to the information he has. Nevertheless, the behavior of the estimator does not modify strongly when changing those parameters.

Suppose that the conditional operational losses (X i |Z, U ) 1≤i≤k are i.i.d., the experts opinion (Y i |X, Z, U ) 1≤i≤n are i.i.d., with parent variables denoted by X|Z, U and Y |X, Z, U respectively. We will then consider as an example the following conditional distributions:

Z|U d ∼ N (U, σ 2 Z ) Y |X, Z, U d ∼ N (β 1 log X + β 2 Z + β 3 U, σ 2 Y ) and X|Z, U d ∼ LN (αZ + (1 -α)U, σ 2 X ) with density function f X|Z,U (x|z, u) = 1 xσ X √ 2π exp - 1 2σ 2 X log x -(αz + (1 -α)u) 2 for x > 0
where the variances σ 2 X , σ 2 Y and σ 2 Z are supposed to be known (or estimated on data when possible), 3

i=1 β i = 1 and log X = 1 n k i=1 log X i . Note that E[X|Z, U ] = exp{αZ + (1 -α)U + σ 2 X /2} and E[log X] = E(U ).
1.1 The posterior distribution and Bayes estimator of the location parameter

Theorem 1.1 The posterior distribution Π U |X,Y,Z is a Gaussian distribution N (μ, σ2 )
where the parameters satisfy

σ2 = 1 σ 2 Z + k(1 -α) 2 σ 2 X + nβ 2 3 σ 2 Y -1
(1)

and μ = ω X log X + ω Y Y + ω Z Z (2)
with credibility weights ω • given by

ω X = σ2 k(1 -α) σ 2 X - β 1 β 3 n σ 2 Y ; ω Y = σ2 β 3 n σ 2 Y ; ω Z = σ2 1 σ 2 Z - kα(1 -α) σ 2 X - β 2 β 3 n σ 2 Y .
The weights depend on various parameters which may help to get closer to µ even for small k. Their sum is one. Although data are often not so numerous, for completeness, note that as k → ∞, we have

ω X ∼ 1 1 -α ; ω Y ∼ 0 ; ω Z ∼ - α 1 -α
The variance σ2 is an increasing function of α and a decreasing function of β 3 and of the sample sizes k and n; it is then minimum, for fixed sample sizes, for α = 0 and β 3 = 1, which corresponds to conditional independence of the three actors X, Y , Z given U .

Notice that μ and σ2 do not depend on the parameter of the prior distribution Π U chosen as uniform (noninformative). If we would have chosen U as a normal r.v. N (m, σ 2 U ) , then we would have obtained that

Π U |X,Y,Z is a Gaussian distribution N (μ * , σ2 * ) with μ * = σ2 σ 2 U m + μ and σ2 * = 1 σ 2 U + 1 σ 2 Z + k(1 -α) 2 σ 2 X + nβ 2 3 σ 2 Y -1
This choice, or the choice of another specific a priori distribution, might be of relevance eg, when working in banking context during a financial crisis.

When considering a casi-noninformative prior distribution, U could be taken as a normal r.v. N (m, σ 2 U ) with a very large variance, which would lead to μ * =

σ2 σ 2 U m + μ ∼ σ 2 U →∞ μ and σ2 * = 1 σ 2 U + 1 σ 2 Z + k(1 -α) 2 σ 2 X + nβ 2 3 σ 2 Y -1 ∼ σ 2 U →∞ σ2
ie, with a close behavior to the one described in Theorem 1.1.

Proof of Theorem 1.1.

The proof relies on an application of the Bayes theorem that we recall for completeness. If f A|B denotes the conditional probability density function of the r.v. A given the r.v. B, the Bayes theorem provides the posterior density function

Π U |X,Y,Z of U given X, Y, Z as Π U |X,Y,Z (u) = cπ U (u)f Z|U (z|u)f X|Z,U (x|z, u)f Y |X,Z,U (y|x, z, u) (3)
with c some normalizing constant independent of u.

Let denote x = (x 1 , ..., x k ) and y = (y 1 , ..., y n ). Under our conditions, the posterior distribution (3) becomes

Π U |X,Y,Z (u|x, y, z) = C(x, y, z) π U (u) f Z|U (z|u) k i=1 f X i |Z,U (x i |z, u) n j=1 f Y j |X,Z,U (y j |x, z, u) = C(m, x, y, z) exp - 1 2 (z -u) 2 σ 2 Z + 1 σ 2 X k i=1 (log x i -αz -(1 -α)u) 2 + 1 σ 2 Y n j=1 (y j -β 1 log x -β 2 z -β 3 u) 2 = 1 √ 2πσ 2 exp - 1 2σ 2 (u -μ) 2
where σ2 and μ are given in ( 1) and ( 2) respectively, and where C is a normalizing function independent of u, that may change from line to line. 2

We can deduce from Theorem 1.1 the properties of the Bayes estimator μ.

Lemma 1.1 The Bayes estimator μ is an unbiased estimator of E(U ) with variance given by var(μ) = 2σ 2 , with σ2 defined in (1); it is then a consistent estimator of E(U ).

It appears that the variance of the estimator is linked to the parameters α and β 3 via the variance σ2 of the posterior distribution.

Proof of Lemma 1.1. The sum of the credibility weights being 1, μ is unbiased. Using that var(X 1 ) = E var(X 1 |X 2 ) + var E(X 1 |X 2 ) for any r.v. X 1 and X 2 , straightforward computations lead to the expression of the variance of μ. Finally, the consistency follows via the Bienaymé-Chebyshev inequality, since var(μ) goes to 0 as k → ∞ (for any α ∈ [0, 1)), σ2 being a decreasing function of k. 2

The following specific cases are also consequences of Theorem 1.1.

Corollary 1.1

1. If X and Y are conditionally independent given U and Z, then β 1 = 0, β 2 +β 3 = 1, and the credibility weights of (2) become

ω X = σ2 k(1 -α) σ 2 X ; ω Y = σ2 β 3 n σ 2 Y ; ω Z = σ2 1 σ 2 Z - kα(1 -α) σ 2 X - β 3 (1 -β 3 )n σ 2
Y with σ2 given in (1).

2. If we assume α = β 2 = 0 and

β 1 + β 3 = 1 (set β 3 = β), ie, when considering Z|U , X|U and Y |X, U , we obtain that Π U |X,Y,Z is N (μ, σ2 ) with μ = σ2 k σ 2 X - nβ(1 -β) σ 2 Y log X + nβ σ 2 Y Y + 1 σ 2 Z Z and σ2 = 1 σ 2 Z + k σ 2 X + nβ 2 σ 2 Y -1
where β ∈]0, 1].

If we add the assumption of conditional independence between X and Y given U , ie, for β = 1, then

μ = σ2 k σ 2 X log X + n σ 2 Y Y + 1 σ 2 Z Z and σ2 = 1 σ 2 Z + k σ 2 X + n σ 2 Y -1 (4)
Replacing the r.v. Z by a constant µ ext leads to the same Bayesian estimator μ of the location parameter as in [START_REF] Lambrigger | [END_REF]] (see Theorem 4.3, or Theorem 4.1 in [Lambrigger et al.(2008)]) and the same σ2 .

Practical application and discussion

We consider the same data as the ones in [Lambrigger et al.(2008)], Figure 2, to be able to draw a fair comparison with our result. The experts opinion is on average given by ȳ = 6, whereas the risk profile market by z = 2. Hence an estimate can be proposed from (2) in Theorem 1.1 as

μ = ω X log x + ω Y ȳ + ω Z z
where the weights ω • , given in Theorem 1.1, are functions of the parameters k (operational loss sample size), n (experts number), α ∈ [0, 1),

β i ∈ [0, 1] (i = 1, 2, 3, β 3 = 0, 3 i=1 β i = 1
), and of the known variances σ 2 X , σ 2 Y , σ 2 Z . We choose, as in [Lambrigger et al.(2008)], k varying up to K = 70, σ X = 4, σ Y = 3/2 and σ Z = 1. We consider one panel of dependent experts (with the corresponding standard deviation), id est we take n = 1. To check about the convergence of the Bayesian estimator to the location parameter, we simulate the operational loss data (x i ) i=1,...,k from a LN (4, σ 2 X ) distribution. We represent on a same graph four estimates of E(U ) computed in terms of the number k of operational loss data (with 1 ≤ k ≤ K = 70), respectively the Maximum Likelihood estimator (MLE) (given by μML Lambrigger et al. (LSW) estimator which corresponds to our estimator with α = 0 = β 1 = β 2 and β 3 = 1 (assuming in particular the conditional independence of X and Y ), the Shevchenko et al. (SW) estimator when having no experts (n = 0), and our estimator μ defined by (2) in Theorem 1.1. Various graphs have been obtained when choosing for our estimator the coefficients α and β i 's varying in [0, 1], with a grid of step 0.1, providing more or less comparable results; Figure 1 illustrates one of them where the conditional dependence appears clearly between the sources and is well distributed between them, with slightly more weight on U than Z (α = 0.3, β 1 = 0.3, β 2 = 0.2, β 3 = 0.5). We can notice, as in [Lambrigger et al.(2008)], the high volatility of the ML estimator for very small k whereas the three other estimators appear more stable. Among the Bayesian estimators, we can confirm (whether we assume the conditional independence of X and Y or not) what noticed Lambrigger et al., namely that including the experts opinion improves the quality of the estimator. Under the assumption of conditional independence, the Bayesian estimator with parameters α = 0 = β 1 = β 2 ; β 3 = 1 (denoted by LSW) behaves on this graph better for a very small number of data, whereas the general Bayesian estimator is closer to the true value for relatively small k and remains as such, presenting a behavior close to the one of the ML estimator whenever k is large (which is an advantage, even if we are not focusing on the behavior of the estimators as k becomes large). We can quantify this comparison using the mean square distance d = d(μ, µ) between the estimator and the true value µ = 4. This distance d is smaller when using our estimator than the LWS estimator, whenever k ≥ 25; eg, for k = 25 (ie, when summing from k = 25 to K(=70)), we obtained d = 0.0561 for the LWS estimator and d = 0.0387 for our estimator. Recall also that our model does not rely on the conditional independence of X and Y given Z.

k = 1 k k i=1 log X i ), the

Distribution of the risk market profile

It is important to understand how the company specific information in the Bayesian context modifies our view on the risk market profile Z. Indeed, it is interesting to know how to modify the criteria on the risk market profile given by the control organisms (following the Basel or Solvency rules) whenever another information is provided by some experts (scientific academics or consulting companies) and/or by the operational loss data of the company, and/or under a given macroeconomics environment. To measure this impact, we will compute the conditional distribution of the risk market profile Z given X, Y and U and compare it with the one of Z given U .

Let us compute the law L(Z|X, Y, U ) of Z given X, Y and U . We can write

f Z|X,Y,U (z|x, y, u) = f Z,X,Y |U (z, x, y|u) f Z,X,Y |U (z, x, y|u) dz
Using that

f X 1 (z)f X 2 (z) = 1 2π(γ 2 + σ 2 ) exp - (a -b) 2 2(γ 2 + σ 2 ) f X 3 (z) (5)
where

X 1 d ∼ N (a, σ 2 ) , X 2 d ∼ N (b, γ 2 ) and X 3 d ∼ N aγ 2 + bσ 2 γ 2 + σ 2 , γ 2 σ 2 γ 2 + σ 2 straightforward computations give f Z,X,Y |U (z, x, y|u) = n j=1 f Y j |Z,U,X (y j |z, u, x) k i=1 f X i |Z,U (x i |z, u)f Z|U (z|u) = C(u, x, y) exp - 1 2σ 2 (z -a) 2 exp 1 2σ 2 z (z -u) 2 = C(u, x, y) exp - 1 2γ 2 Z (z -m Z ) 2
where C(u, x, y) denotes some constant depending on u, x and y which may change from line to line, and where

m Z = aσ 2 Z -uσ 2 σ 2 Z -σ 2 ; γ 2 Z = σ 2 σ 2 Z σ 2 Z -σ 2 with a := σ 2 1 σ 2 Z - k α(1 -α) σ 2 X - nβ 2 β 3 σ 2 Y u + β 2 n σ 2 Y ȳ - nβ 1 β 2 σ 2 Y - αk σ 2 X log x and σ 2 := 1 σ 2 Z + kα 2 σ 2 X + nβ 2 2 σ 2 Y -1 (which satisfies σ 2 < σ 2 Z ).
We can then conclude to the following.

Proposition 1.1 The distribution of the market risk profile Z given the knowledge of the severity X, the expert opinion Y and the macroeconomic environment U , is a Gaussian distribution with mean M Z equal to a linear combination of U , Y and log X and with variance given in terms of the variances of X and Y :

Z|X, Y, U ∼ N M Z , γ 2 Z with M Z = γ 2 Z αk σ 2 X - nβ 1 β 2 σ 2 Y log X + β 2 n σ 2 Y Y - k α(1 -α) σ 2 X + nβ 2 β 3 σ 2 Y U (6)
and

γ 2 Z = kα 2 σ 2 X + nβ 2 2 σ 2 Y -1 (7)
Note that the conditional distribution of Z|X, Y, U does not depend on the parameter σ 2 Z . Although both conditional distributions of Z|U and Z|X, Y, U are normal, the parameters are quite different showing how the external risk market profile modifies for a given company. The variance γ 2 Z of Z|X, Y, U is a decreasing function in k, hence becomes soon or later smaller than the given variance σ 2 Z of Z|U . The two conditional expectations E[Z|U ] = U and E[Z|X, Y, U ] = M Z can not equal a.s., whatever is the choice of the coefficients α and β i , i = 1, 2, 3, but both are normal, with the same expectation E[M Z ] = E[U ] that can be estimated by μ given in (2). Let us revisit our numerical example developed in §1.2. Consider the same values of parameters, namely ȳ = 6, σ X = 4, σ Y = 3/2, σ Z = 1, n = 1, k varying up to K = 70, (x i ) i=1,...,k simulated from a LN (4, σ 2 X ) distribution, (α, β 1 , β 2 , β 3 ) = (0.3, 0.3, 0.2, 0.5), and choose eg, u = 4.5. We deduce a possible realization of M Z , given by

m Z = γ 2 Z αk σ 2 X - nβ 1 β 2 σ 2 Y log x + β 2 n σ 2 Y y - k α(1 -α) σ 2 X + nβ 2 β 3 σ 2 Y u with γ 2 Z = γ 2 Z (k) defined in (7), decreasing function in k. We represent it in Figure 2 below. Since Z|X, Y, U ∼ N M Z , γ 2 Z , let us represent also m Z ± γ Z .
α =0.3, β 1 =0.3, β 2 =0.2, β 3 =0.5 m z m Z +γ Z m Z -γ Z
2 An a priori related to the severity An alternative approach to handle our problem is to consider the point of view of the company and to relate the a priori directly to the severity of the operational loss, because of the few available data. Suppose for instance that the severity X is log-normally distributed LN (β X , σ 2 X ) and let us focus for instance on the position parameter β X , fixing the shape parameter σ 2 X . Then, following our approach, we introduce a position parameter U having a noninformative prior distribution Π U . As in the previous section, we choose Π U to be uniform. Suppose that the conditional operational losses (X i |U ) 1≤i≤k are i.i.d., the experts opinion (Y i |X, Z, U ) 1≤i≤n are i.i.d., with parent variables denoted by X|U and Y |X, Z, U respectively. Consider the following conditional distributions:

X|U d ∼ LN (U, σ 2 X ); Z|U, X d ∼ N (λlog(X) + (1 -λ)U, σ 2 Z ) with λ ∈ [0, 1); Y |X, Z, U d ∼ N (β 1 log X + β 2 Z + β 3 U, σ 2 Y ), with 3
i=1 β i = 1, β i ∈ [0, 1], β 3 = 0,
where the variances σ 2 X , σ 2 Y and σ 2 Z are supposed to be known or estimated on data when possible. Note that E[log(X)] = E(U ), E(Z) = E(U ), Z denoting the position parameter of the market risk profile, specific to the company, and that E(Y ) = E(U ).

The posterior distribution and Bayes estimator

The Bayes theorem and straightforward computations on Gaussian distributions provide the posterior density function

Π U |X,Y,Z of U given X, Y, Z as Π U |X,Y,Z (u) = Cπ U (u)f X|U (x|u)f Z|X,U (z|x, u)f Y |X,Z,U (y|x, z, u) = C π U (u) f Z|X,U (z|x, u) k i=1 f X|U (x i |u) n j=1 f Y |X,Z,U (y j |x, z, u) = 1 2πγ 2 exp - 1 2γ 2 (u -δγ 2 ) 2
with C some normalizing constant depending on x, y, u, and where

γ 2 = (1 -λ) 2 σ 2 Z + nβ 2 3 σ 2 Y + k σ 2 X -1 (8)
and

δ = nβ 3 σ 2 Y ȳ + 1 -λ σ 2 Z - nβ 2 β 3 σ 2 Y z + k σ 2 X - λ(1 -λ) σ 2 Z - nβ 1 β 3 σ 2 Y log x. (9)
We obtain the following result.

Theorem 2.1 The posterior distribution

Π U |X,Y,Z is a Gaussian distribution N (μ, γ 2 )
where the variance γ 2 is given in (8) and the mean μ satisfies

μ = ω X log X + ω Y Y + ω Z Z (10)
with the credibility weights ω . given by

ω X = γ 2 k σ 2 X - λ(1 -λ) σ 2 Z - nβ 1 β 3 σ 2 Y ; ω Y = γ 2 nβ 3 σ 2 Y ; ω Z = γ 2 1 -λ σ 2 Z - nβ 2 β 3 σ 2 Y
It can be checked, from Theorem 2.1, that the Bayes estimator μ is an unbiased and consistent estimator of E(U ). When looking at specific values of the parameters α and β i 's, we notice that assuming

λ = β 1 = β 2 = 0, β 3 = 1, ie, considering Z|U , X|U and Y |U , provides μ = γ2 k σ 2 X log X + n σ 2 Y Y + 1 σ 2 Z Z and γ 2 = 1 σ 2 Z + k σ 2 X + n σ 2 Y -1
which corresponds also to the LWS estimator proposed in [START_REF] Lambrigger | [END_REF]] when replacing the r.v. Z by a constant µ ext .

Considering the same frame as in our example developed in §1.2, let us see how this new Bayesian estimator μ of the location parameter E(U ) behaves.

Let ȳ = 6, z = 2, n = 1, σ X = 4, σ Y = 3/2 and σ Z = 1, k varying up to K = 70, (x i ) i=1,...,k simulated from a LN (4, σ 2 X ) distribution. We represent in Figure 3 above an estimate of μ defined in (10) with distributed parameters λ = 0.5, β 1 = 0.3, β 2 = 0.2 and β 3 = 0.5, an estimate of μ with specific parameters λ = β 1 = β 2 = 0 and β 3 = 1 corresponding for fixed Z to the LWS estimator (with the conditional independence assumption), and also the MLE. We see that the estimate of μ with 'non specific' parameters fits the best the underlying real value µ starting at very small k. As in the previous section, various graphs have been obtained when taking the parameters on a grid; they provide more or less the same behavior, with a convergence to µ from a small k. We chose to present one example with balanced parameters. Using the mean square distance d = d(μ, µ) between the estimator and the true value µ = 4, we obtain d = 0, 0560; 0, 0173; 0, 0082 whenever k ≥ 2; 9; 20 respectively, whereas we obtain d = 0, 0678; 0, 0377; 0, 0288 respectively for the LWS estimator, confirming the improvement when introducing the Bayesian estimator built with a general method.

We also notice that considering μ defined in (10) provides better results than the estimator μ defined in (2). It would mean that it is more relevant to relate the a priori, namely the macroeconomics environment, to the severities rather than to the risk profile. Intuitively this result corresponds to what has been seen in the market with the phenomenal operational losses of Société Générale during the financial crises and UBS during the sovereign debt crises. Let us compare in Figure 4 the estimates of μ and μ computed on the same sample (X i ) i=1,••• ,k , in the same frame, and for the α and β i 's previously selected. As already noticed, it appears clearly in Figure 4 that μ converges faster to µ, even for small values of k, than μ does.

The conditional distribution of the risk market profile

Let us now compute the law L(Z|X, Y, U ) of Z given X, Y and U , to measure the impact on the choice of the variable to which the a priori is directly related. We can write

f Z|X,Y,U (z|x, y, u) = f Y |X,U,Z (y|x, u, z)f Z|X,U (z|x, u) f Y |X,U,Z (y|x, u, z)f Z|X,U (z|x, u)dz
which involves only Gaussian distributions. We obtain, using (5),

f Z|X,Y,U (z|x, y, u) = 1 2πΓ 2 Z exp - 1 2Γ 2 Z (z -m * Z ) 2 where m * Z = nβ 2 σ 2 Z ȳ + (λσ 2 Y -nβ 1 β 2 σ 2 Z ) log x + ((1 -λ)σ 2 Y -nβ 2 β 3 σ 2 Z ) u σ 2 Y + nβ 2 2 σ 2 Z and Γ 2 Z = σ 2 Y σ 2 Z σ 2 Y + nβ 2 2 σ 2 Z
We can conclude to the following proposition, showing how the company specific information in the Bayesian context modifies the view on the risk market profile Z.

Proposition 2.1 The distribution of the market risk profile Z given the knowledge of the a priori parameter U and of both the severity distribution X and the expert opinion Y , is a Gaussian distribution with mean M * Z equal to a linear combination of U , Y and log X and with variance Γ 2 Z given in terms of the variance of X and Y :

Z|X, Y, U ∼ N M * Z , Γ 2 Z with M * Z = Γ 2 Z λ σ 2 Z - nβ 1 β 2 σ 2 Y log X + nβ 2 σ 2 Y Y + 1 -λ σ 2 Z - nβ 2 β 3 σ 2 Y U (11) satisfying E(M * Z ) = E(U ), and
Γ 2 Z = nβ 2 2 σ 2 Y + 1 σ 2 Z -1 (12)
Using the same sample (x i ) i=1,...,k (simulated from a LN (4, σ 2 X ) distribution) as in the previous section, let us represent in Figure 5 an estimate m * Z of M * Z with the values of λ and β i previously selected, and with the same values for the other parameters as in the previous section when considering m Z (ȳ = 6, σ X = 4, σ Y = 3/2, σ Z = 1, n = 1, u = 4.5). The conditional variance is independent of the size of the operational losses and worths Γ 2 Z = 0.98. Finally, we may compare the distribution of Z given X, Y, U when considering the a priori on the unknown parameter of a given family of distributions for the severities and for the risk profile, respectively. As can be seen in Figure 6 below, the behavior of m * Z appears much more stable than the one of m Z . It can be explained by the fact that m Z relies directly on the operational loss index k, whereas m * Z depends on k through the empirical mean log x only.

Conclusion

This paper shows how to include in the modeling of operational risk, macroeconomic effects and expert judgements through a Bayesian approach. Such an approach is chosen to obtain a good behavior of estimators even in the case of small sample of losses. To illustrate our approach, we assumed a uniform a priori distribution on a location parameter and considered normal or lognormal conditional distributions of the three factors, operational losses, market risk profile and experts opinion. It may be applied to a different parameter or with other types of distributions, although our choice appears reasonable in the insurance context where extreme operational losses have not been seen. It would be interesting to introduce a heavy tail distribution, for instance a Fréchet distribution, when treating operational losses in banks that have experienced extreme ones. This study has been developed when relating the a priori, namely the macroeconomics environment, first to the market risk profile, then to the operational losses. In both situations, our generalized estimator of the location parameter is given as a weighted average of the three mentioned factors. Properties of this estimator have been deduced and simulation performed to see how it behaves. It appears that introducing a hyper level in the prior modeling provides a quite competitive estimator when compared with the maximum likelihood estimator and the Lambrigger et al.'s one. The latter can be deduced as a particular case (under a strong independence condition) of our general estimator. Finally we notice also that relating the a priori to operational losses rather than to the market risk profile leads to a much more stable behavior close to the true value even when few data are available. So it seems that macroeconomics environment has a direct impact on the severities of operational losses. It would deserve further empirical investigation on the influence of macroeconomics on operational risk. It might be undertaken in some future work.

Figure 1 :

 1 Figure 1: Comparison of the various estimates of the location parameter µ (A priori related to the market risk profile)

Figure 2 :

 2 Figure 2: A realization m Z of the conditional expectation E[Z|X, Y, U ] of the risk profile Z for

Figure 3 :

 3 Figure 3: Comparison of the various estimates of the location parameter µ (A priori related to the severities)

Figure 4 :

 4 Figure 4: Comparison of estimates of μ and μ

Figure 5 :

 5 Figure 5: A realization m * Z of the conditional expectation E[Z|X, Y, U ] of the risk profile for

Figure 6 :

 6 Figure 6: Comparison of m Z and m * Z for

Acknowledgement. This work, in particular the implementation of the method on Matlab by Franklin V. Mosquera Muñoz (EPN Quito), was partially supported by the ESSEC Research Center (research project # 341-09). It has been carried out during the first author's stay at ESSEC Business School Paris and the second author's stay at the Escuela Politécnica Nacional Quito; the authors would like to thank both the institutions for hospitality and facilitating the research undertaken.


Minh Hoang Le

Olivier Cerdan
email: o.cerdan@brgm.fr

Stéphane Cordier
email: stephane.cordier@math.cnrs.fr

Carine Lucas
email: carine.lucas@univ-orleans.fr

Pierre Sochala
email: p.sochala@brgm.fr

Upscaling

Upscaling the influence of microtopography when modelling overland flow and soil erosion

published or not. The documents may come   L'archive ouverte pluridisciplinaire

In the context of a very shallow flow, the spatial distribution of the flow is highly influenced by the micro-topography. When the land is partly covered with water (due to the micro-topography), the local velocity of flow in local oriented depression may exceed the threshold for soil erosion on the contrary of their average value over a large grid. Nevertheless, explicit representation of the micro-topography in computational modelling requires a high spatial resolution of land surface which is not often available.

The prediction using a large grid can be improved by the calibration of friction coefficient but in many case, the result is unsatisfied. Some indicators are proposed to integrate these local surface variation into numerical computation of the shallow water esquation; for each cell, we use the proportion of wetted area as a microtopography indicator. For the case of erosion, the system is coupled to the sediment transport equations. In a such context, an additional equation describing the micro-topography evolution caused by erosion is introduced. Finally, the numerical scheme of Godunov-type for this model and their validations is presented.