Thomas Demongeot
email: thomas.demongeot@dga.defense.gouv.fr

Eric Totel

Valerie Viet

Triem Tong

Yves Le Traon
email: yves.letraon@uni.lu

Preventing data leakage in service orchestration

Web Services are currently the base of a lot a ecommerce applications. Nevertheless, clients often use these services without knowing anything about their internals. Moreover, they have no clue about the use of their personal data inside the global applications. In this paper, we offer the opportunity to the user to specify constraints on the use of its personal data. To ensure the privacy of data at runtime, we define a distributed security policy model. This policy is configured at runtime by the user of the BPEL program. This policy is enforced within a BPEL interpreter, and ensures that no information flow can be produced from the user data to unauthorized services. However, the dynamic aspects of web services lead to situations where the policy prohibits the nominal operation of orchestration (e.g., when using a service that is unknown by the user). To solve this problem, we propose to let user to dynamically permit exceptional unauthorized flows. In order to make decision, the user is provided with all information necessary for decisionmaking. We also present an implementation inside the Orchestra BPEL interpreter. As far as we know this implementation is the first information flow monitor for web services that is also enduser configurable.

I. INTRODUCTION

Web services were originally designed as a set of reusable services freely available to everyone. Service-orientation eventually offers an elegant way to build new services composed of existing ones using the notion of orchestration. On one hand, since services are based on encapsulation, the client does not need to understand how a service works. On the other hand, this lack of information also means that the client does not know how his data are used and by who. Currently, most of the efforts in web service security focus on the confidentiality of the information at communication protocol level, but do not solve the problem of how to make a specific service orchestration trustworthy for the clients. Even if the service orchestration provider is trustworthy, it has no technical solution to guarantee a specific client that it satisfies his expectations in terms of data protection. User data protection in a service orchestration is thus crucial, and requires two basic bricks. First, that expectations of the client must be expressed, which implies some security policy language is available. In this paper, we propose such an elementary data protection policy configurable by the user of the service. Second, the technical support for checking the client's data protection policy must be embedded in the orchestration interpreter. In this paper, we propose checking at runtime whether the data protection policy is satisfied with a prototype tool called OrchestraFlow. This tool extends a BPEL (Business Process Execution Language) [START_REF] Oasis | Web services business process execution language version 2.0[END_REF] interpretation engine, BPEL being the standard language for programming an orchestration of web services. BPEL is a relatively simple language that describes the sequences of service calls necessary to properly achieve a composite service. A BPEL program is a web service written in BPEL executed by a BPEL interpreter. A BPEL program can invoke other web services, thus it defines the orchestration of web services. BPEL program may receive information from users, and use these data to provide information to the invoked services. Therefore, the BPEL program produces information flows from the user data to the used services. The problem is whether these information flows are legal according to the user privacy policy. OrchestraFlow takes the data protection policies of the service users as inputs and checks whether there is a risk of information leakage at runtime w.r.t. the policy. Instead of a static analysis of the BPEL program, a dynamic analysis has been chosen in order to be able to handle dynamic function discovery and dynamic update of the security policy. Before describing this solution, we present a state of the art on dynamic information flow tracking (Section II). We define a security policy that specifies legal information flows. We define what properties it can provide (Section III) and how to verify the policy (Section IV). Section V presents how to dynamically update the security policy. Finally we describe our implementation called OrchestraFlow (Section VI). Finally, we conclude and expose future work in Section VII.

II. PROBLEM STATEMENT AND RELATED WORK

A web service orchestration consists in the execution of a set of services that manipulate and transform data. These data are injected by other services or by the users. In a BPEL program these data are protected at different levels. At message level WS-Security [START_REF]Web services security: Soap message security 1.1[END_REF] aims at providing security for exchanging SOAP messages. Besides security architecture, there exist XML-based languages such as SAML (Security Assertion Markup Language) [START_REF]Assertions and protocols for the oasis security assertion markup language (saml) v2.0[END_REF] and XACML (eXtensible Access Control Markup Language) [START_REF]extensible access control markup language (xacml) version 2.0[END_REF] that allow specifying access control rules for accessing data or services. However there is no access control on the data once they have left their original container. Using XACML we can specify that a user or a service can access some data but once these data are accessed by a service there is no control on their propagation. In this article we aim at providing a better security level by offering both a context-adaptative security policy driven by users and a dynamic enforcement mechanism of the security policy. The services are not necessarily known before the execution as they can be discovered at runtime, after a search in a directory of services for example. Thus we don't know before the execution which services are called. Due to this particular feature we believe that a precise security mechanism depends on the context of the execution and has to be adjustable at run-time.

In our approach, the security policy will be defined by users and can be updated at run-time, for instance when services are discovered. The security policy enforced at runtime relies on information flow tracking mechanisms that permit detecting user data leakage inside a BPEL interpreter.

The area of information flow tracking has been well-studied during the last decade. The basic idea of information flow tracking is that sensible data are marked with an identifier sometimes called a taint, a label, a tag or a mark. The marks are propagated along the flow to taint objects in the system. The propagation can be either dynamically observed or statically analysed. Several researches have helped to strengthen the control of data privacy in BPEL programs, particularly by statically controlling data flows. In [?] BPEL is considered as the description of a distributed collaborative system with a multi-level security policy. This policy ensures that data from Web Services are used properly, it lacks flexibility and does not manage dynamic adaptation. [?] and [?] proposed type systems in order to guarantee non-interference property in dynamic service composition. But the method proposed by [?] needs to analyse each service involved in the orchestration and does not support complex orchestration. In [?] each service involved in the orchestration need to produce a contract describing its internal behaviour and the authors proposed a framework to analyse service orchestration. In [?], the authors propose an XML schema for specifying an employment policy of available Web-Services statically verified in BPEL programs. In both cases, security policies are defined by the host of BPEL and do not specify a security policy for each user. Moreover, the verification of information flows is done statically: it is impossible to address the problem of dynamic discovery of services. In [START_REF] Myers | A decentralized model for information flow control[END_REF] and [START_REF] Myers | Complete, safe information flow with decentralized labels[END_REF] Myers and Liskov propose more expressive marks (which are called labels). A label attached to a value denote both owners and readers of this value. An owner decides which principals can access his data, these principals are the readers. In [START_REF] Myers | Jflow: Pratical mostly-static information flow control[END_REF] Myers presents Jif, where labels are used to annotate data items in a Java program. Jif checks at compile time, in a manner similar to type checking, if all the executions of annotated programs verify the information flow policy. In their approach, the information flow policy consists of the definition of the readers by the owner. This policy is defined before the analysis and can be updated by relabelling data. Their model authorises only two relabelling rules: restriction and declassification. Data can only be relabelled from L 1 to L 2 if L 2 is more restrictive than L 1 intuitively if it removes readers, adds owners, or both. A datum is declassified when it is relabelled to a label containing more readers for an owner o or when a owner o is removed. A declassification process is allowed only when the process acts for o. In [START_REF] Hiet | Policy-based intrusion detection in web applications by monitoring java information flows[END_REF], [START_REF] Viet Triem | Specifying and enforcing a fine-grained information flow policy: Model and experiments[END_REF] the authors explicitly distinguish information from containers and thus propose to mark containers of information with two tags reflecting both the origins of the value and the security policy attached to the container. More precisely sensible data are associated to a numerical identifier and an information flow policy specifies how combinations of these identified data can flow in information containers. The model of marks presented in [START_REF] Viet Triem | Specifying and enforcing a fine-grained information flow policy: Model and experiments[END_REF] can be either implemented at system level or at program level. In [START_REF] Hiet | Policy-based intrusion detection in web applications by monitoring java information flows[END_REF] information flows are tracked at run-time allowing us to check if the current execution is correct with regard to the definition of the policy. The policy is completely defined at the initialisation and can be either deduced from an interpretation of access control rights or manually defined. The policy can be updated at run-time simply by changing the tags. In [START_REF] Viet Triem | Specifying and enforcing a fine-grained information flow policy: Model and experiments[END_REF] the authors explain how to perform a modification of the policy by changing tag value but not how, why or when to perform such a modification. We propose to adapt these previous models in the particular context of web services. We aim to observe information flows inside an orchestration of web services in order to ensure the user's data protection. We adopt a dynamic observation of these flows since in a context of web services we will dynamically discover the environment. As in [START_REF] Hiet | Policy-based intrusion detection in web applications by monitoring java information flows[END_REF], [START_REF] Viet Triem | Specifying and enforcing a fine-grained information flow policy: Model and experiments[END_REF] we explicitly identify user's data with numerical identifier. As Myers and Liskov in [START_REF] Myers | A decentralized model for information flow control[END_REF] and [START_REF] Myers | Complete, safe information flow with decentralized labels[END_REF] the security policy will specify owners and readers of the identified information items. In other words a user defines which services can access his information items. The description of all readers could be difficult for uninformed users. To solve this problem we propose to dynamically update the security policy when services are discovered. Our tool interacts with the users to adapt or complete the security policy when required.

III. PRIVACY SECURITY POLICY

A piece of information is a data item, a value such as a string, or an integer. A piece of information is provided to a web service orchestration through a call to this service. This piece of information is manipulated by the orchestration and the services it invoked and mixed with other pieces of information. In this work, we consider that sensitive information and in particular user private data have to be monitored in order to protect where these information data items flow. For that purpose we reuse the notion of atomic information first introduced in [START_REF] Viet Triem | Specifying and enforcing a fine-grained information flow policy: Model and experiments[END_REF] to identify sensitive or private information. Any piece of information handled in the system is either atomic or obtained after treatments (like calculus) on one or more atomic information. Here any non-atomic information is the compound of one or more atomic information. For example, if x and y are atomic information, 2 × x, x + y, . . . are compound information, the first non-atomic information results from the use of x, the second results from the use of x and y. Let us consider an e-shop service as a example of service. In this example, atomic information items are provided by the client : the chosen product, bank details and client email address. These atomic data items are used to compute all information items handled by the complete system, such as the total amount of the transactions, the confirmation of payment, final product delivery notification,. . . In a web service orchestration, the information is located in logical containers of information like the variables manipulated by services. The operations performed by programs or services will generate information flows between variables and consequently information will be mixed and/or will move from one variable to another. In this work we want to prevent private or sensitive information to be accessed by a non-authorized service, i.e., we want to ensure that sensitive information flows only into variables readable by authorized services. The security policy allows the user to specify which services are authorized to manipulate each atomic information (and by composition for all the compound information). For that purpose we first determine an owner for each atomic information (usually the service/user that provides it to the system). The owner is responsible for statically (at the start of the service invocation) or dynamically (during the execution of the service orchestration) determining the set of services that can access this information. These services will be called information readers. A service is allowed to read an atomic information only when it appears in the set of legal readers for this atomic information. The rest of the policy is determined by composition. When an information is derived from several atomic information items, the owner of this compound information is the set of all owners of atomic information. The readers of this compound information are all the services that are also readers of each atomic information from which it derives. This security policy can be seen as an information flow policy: a flow of information i (atomic or compound) to a container belonging to a service s is legal if and only if the service s has the right of access to information i, i.e., if s is a reader of i. More formally we use the following notations: Information: I = {i 1 , ..., i n } is the set of atomic information of the system. Information derived from several atomic information in i j , . . . , i k is denoted by i j ⊕ . . . ⊕ i k Services: S = {s 1 , ..s m } is the set of services of the system. Owners of information i are services that we denote owner(i) ⊆ S. They are defined as follows:

• If i is an atomic information then its owner is the service that injected it into the system.

• If i is a compound information, i.e., i = i j ⊕ . . . ⊕ i k then owner(i) = owner(i j ) ∪ . . . ∪ owner(i k ) (1)
Readers of an information i are services defined by the owners of i which we denote readers(i) ⊆ S. Readers are defined as follows:

• if i is an atomic information, readers of i are the readers allowed by the service which injected it into the system;

• if i = i j ⊕ . . . ⊕ i k then readers(i) = readers(i j ) ∩ . . . ∩ readers(i k ) (2)
The security policy defines allowed readers for atomic information, rules of composition ( 1) and ( 2) define, by composition, readers of compound information. The policy is defined by the owners of information, since an owner determines the readers that are allowed to read its atomic information. A call to a service that brings information is legal only if the service called is a reader for this information. In the same way, a response from a service is only authorized if the caller is a legal reader for the received information. The policy can be updated at any time by adding or removing a reader from the set of readers of information. An owner is responsible for removing readers from its own atomic information. When an information is compound, the several owners have to agree for any modification.

IV. DYNAMIC CHECKING OF THE SECURITY POLICY

In this work, the security policy is enforced through metadata or simply labels put on every container of information: which means on every variable in a BPEL program. As it has been proposed by Myers in [START_REF] Myers | A decentralized model for information flow control[END_REF] a label of a variable denotes the owners and the legal readers of its content. In order to follow the origin of information flow, we add to each variable the list of initial information used to produce the content of this variable. The value of a label is initialized as empty and is first modified when a new item is injected into the web service through a call to this service. At this moment, the injected information is considered atomic, its owner is the caller. The caller also defines the allowed readers for this new item and consequently the new value of the label. The label is further modified at each operation on the variable that modifies the content of the variable. Labels are modified to reflect owners and readers attached to the information contained in the variable. When a service calls another service or makes a response to another service, a verifier checks if the resulting flow is legal with respect to the current security policy. More precisely the verifier checks if the recipient of the flow appears as a reader in the label of the item sent. In the following, we formally define how labels are defined and modified. As stated before, a label is meta-data attached to each container and describes owners and readers of information currently located in the container. If c is a container its security label is of the form L c = {i 1 : s α s α1 , ..., s αn ; ...; i j : s β s β1 , ..., s βm } Such a label means that information i contained in c is based on information i 1 , ..., i j . Information i 1 is owned by owners(i 1 ) = s α which authorizes readers s α1 , ..., s αn . Depending on this label the readers allowed to access the information located in c are those authorized by all the owners, i.e., readers(c) = {{s α1 , ..., s αn } ∩ ... ∩ {s β1 , ..., s βm }}. By abusing the notation we may use owners(L c ) or readers(L c ) to express the owners/readers of a container c labeled by L c .

Let us consider a service s 1 injecting an item of information i in another service s 2 by calling s 2 using a variable v. The service s 1 is considered to be the owner of the atomic information i now located in the variable v of s 2 . The variable v is the container of i and its label is on the form {s 1 s α1 , . . . , s αn } where s α1 , . . . , s αn are the readers of i allowed by s 1 . In practical terms if the service s 1 is executed by a user, this user will be asked to define the services allowed as readers of its own information.

When a service is called, it makes some internal computation before sending a response. These internal computations induce information flows and modify the content of information containers. Since a label attached to a container describes the security policy of its current content, it has to be updated at each observation of an information flow towards the container.

From a general point of view, we consider a set of containers c j , ..., c k labeled by L j , ..., L k if we observe an information flow from the containers c j , ..., c k to another container c, then we update the label of c which is now the union of labels attached to c j , ..., c k . Like Myers, we use the notation L j . . . L k to denote the union of labels. The precise definition of is given below. This new label means that the owner of the content of c is now the union of owners of content located in c j , ..., c k and the readers are those commonly allowed by these owners. The new label should also reflect that information contained in c depends on information from c j , ..., c k , i.e., the label should reflect the information history.

Labels for Derived Values (Definition of L 1 L 2 ):

owners(L 1 L 2 ) = owners(L 1 ) ∪ owners(L 2 ) readers(L 1 L 2 ) = readers(L 1 ) ∩ readers(L 2 ) history(L 1 L 2 ) = history(L 1 ) ∪ history(L 2 )
There is an example with three containers c 1 , c 2 and c 3 , respectively labeled by :

• L c1 : {i 1 : s 1 s 5 , s 6 ; i 2 : s 1 s 5 , s 6 } • L c2 : {i 1 : s 1 s 5 , s 6 ; i 3 : s 2 s 6 , s 7 } • L c3 : {i 4 : s 3 s 4 , s 7 }

We consider an information flow from c 1 and c 2 to c 3 . This flow modifies the content of c 3 which is now a value derived from those located in c 1 and c 2 . The label L c3 is updated to L c1 L c2 , i.e. {i 1 : s 1 s 5 , s 6 ; i 2 : s 1 s 5 , s 6 ; i 3 : s 2 s 6 , s 7 } and means that

owners(c 3 ) = owners(c 1 ) ∪ owners(c 2 ) = {s 1 } ∪ {s 1 , s 2 } = {s 1 , s 2 } readers(c 3 ) = readers(c 1 ) ∩ readers(c 2 ) = {{s 5 , s 6 } ∩ {s 5 , s 6 }} ∩ {{s 5 , s 6 } ∩ {s 6 , s 7 }} = {s 6 } history(c 3 ) = history(c 1 ) ∪ history(c 2 ) = {i 1 , i 2 } ∪ {i 1 , i 3 } = {i 1 , i 2 , i 3 }
The definition of the security policy is carried out via the propagation of the labels attached to the containers of information. When a service performs a response using a variable c this response will be authorized according to the security policy if the recipient appears as a reader in L c . From a practical point of view, in our work the security policy is propagated through the labels at runtime in a modified BPEL interpreter. The legality of a call to a service or a response from a service is checked just before the call / response.

V. DYNAMIC UPDATE OF THE SECURITY POLICY

Let us consider a BPEL program performing a call of a service s (or similarly a response to a service s) using data d having a label on the form L d = {i 1 : s 1 s 11 , ..., s 1n ; ...; i j : s j s j1 , ..., s jm }

We have to verify if this call is legal with regard to the security policy before performing the call. By definition of the security policy this call is legal if and only if the service s is an authorised reader for the data d. To check this legality we only need to verify if s appears as a reader in the label attached to d, i.e., if s ∈ {s 11 , ..., s 1n , . . . s j1 , . . . s jm }. If s is an authorized reader then the BPEL program performs the call. Otherwise we ask owners of s to confirm if the call must be authorized anyway. Indeed, since services can be dynamically discovered we can not decide if the call is really forbidden or if the owners have not completely defined the security policy.

We use a dedicated service to ask all owners (s 1 , . . . , s j ) if they authorize or not sending a compound information d computed using their atomic information resp. i 1 , . . . , i j .

More precisely the BPEL interpreter calls a dedicated service to contact the information owners. This service is an exception to the security policy, we consider that this particular service is a reader for any atomic information. In future work we plan to protect this dedicated service: for instance we plan to encrypt the data sent to/by this service. This service is used to ask every owner s k of atomic information i k if they accept to modify the policy of i k . The service thus uses a request composed of four parts:

• the initial information i k that was used to compute the value d ; • the value d if the owner is an authorized reader of d, this part is empty otherwise; • the service s ;

• if the information actually sent to the service depends explicitly or implicitly on the initial information. For each owner, this call may have three possible responses:

• (refusal) the owner refuses to modify the security policy.

• (temporary exception) the owner accepts the update of the security policy only for this call/response of service. • (agreement) the owner accepts the update of the security policy until the end of the execution of the BPEL program. In this case the label of the variable is modified. If at least one owner refuses the modification, the service call (or the response) is not performed. If all the owners accept the modification but at least one of them authorises only a temporary exception then the call (or the response) is performed and the label attached to d remains the same. Finally when all the owners accept the modification, the label is modified: s is added as reader for d.

VI. ORCHESTRAFLOW : A DYNAMIC MONITOR FOR BPEL

In this section we present OrchestraFlow which implements the model detailed in the previous sections as a patch for the BPEL interpreter Orchestra. OrchestraFlow taints variables of a BPEL program using labels as detailed before, the implementation of labels is presented in this section. A label is updated at each modification of the content of the variable. In a BPEL program this content is directly modified by operations involving the variable. Thus we have modified the original Orchestra interpreter to observe information flows made by a BPEL program and to consequently update the labels of the involved variables.

A BPEL program takes as inputs messages coming from other web services. Because all messages are in XML format, we modify the XML inputs in order to add our security label. We modified all XML primitive types by adding an optional label attribute where authorized readers are represented by an URI (adress of Web Services) separated by a semi-colon. If the label attribute is used with an empty string then no service is allowed to access that data. If the label attribute is not used, all services are allowed to access that data.

In order to allow dynamic updates of the security policy, each user of a BPEL program uses a client side security service. The security service is a simple web-service that runs on the computer of the client. This service receives all requests to update the security policy defined in the BPEL program.

If the sender is another web service which does not execute OrchestraFlow, then we consider the variable as a new atomic information without label (meaning that all services are legal readers). Applying this property allows us to be compatible with existing BPEL interpreters that do not carry out our protection mechanisms.

In OrchestraFlow, a label is therefore a list of triple on the form (initial information ; owner ; list of readers authorized for this owner). In BPEL, a variable is represented via a XML tree structure that can be composed of leafs (simple elementary values) or nodes (complex variables composed of several elementary values). In order to store the labels attached to each variable, the tree structure is duplicated and filled up with the labels of the elements composing the variable.

Each variable has its own label stored on a duplicated tree structure. After the initial information, the first URI of a label represents the owner of the data, and the following URIs, separated by a semi-colon, represent the authorized readers of this data.

The label of a variable is updated at each observation of an information flow. As defined early by D. Denning in [START_REF] Denning | Certification of programs for secure information flow[END_REF], Information flows from object x to object y, whenever information stored in x is transferred to, or used to derive information transferred to, object y. Here we distinguish implicit or explicit information flow. An implicit information flow signals information through the control structure of a program [START_REF] Sabelfeld | Language-based information-flow security[END_REF]. The reader will find a complete survey on this subject in [START_REF] Sabelfeld | Language-based information-flow security[END_REF]. First we focus on explicit information flows between variables which are transfers of information induced by operations made by the program involving these variables. Among them Assign, Invoke, Receive, Reply induce explicit information flows. OrchestraFlow extends Orchestra in order to update concerned labels at each call of one of the mentioned operations.

Explicit information flows are mostly induced by assignments and communication with services.

An assignment: copies the value of the expression e in x. After the execution of the assignment the information contained in x depends now on every information contained in e. In this case, we must ensure that the label of x after the execution of the assignment reflects the policy of the information contained in e. When e is simply a single BPEL variable then value of label of x is updated to the value of the label of e. In other words, if an assignement copies the value of e in x then OrchestraFlow propagates the value of the label L e in L x . More generally an expression e in a BPEL program could be a part of a BPEL variable or a more complex expression written in an external language. OrchestraFlow uses, like Orchestra, XPath 1.0 as expression language. For each XPath expression we calculate the resulting label from information contained in the XPath expression according to the definition IV.

Communication between Services: Three BPEL functions allow communications with external services : invoke, receive and reply. The first, invoke, provides synchronous communications with services, i.e., in the same function data are sent to the service and a response is received. In order to allow asynchronous communication with services, we use the same function invoke with the second function receive which allows the asynchronous reception of the response of the service called with the invoke function.

These communication primitives produce information flows from the caller to the receiver. It is thus necessary to update the labels of the sent messages (case of invoke) or the labels of the variables assigned at the reception of a message (case of a receive) by performing the union of the labels of the data involved.

For example, by using an invoke function, the service my service is called with the variable e as input parameter. The result of this service will be stored in the variable x. The variable x after executing the service depends both on the information returned by the called service (my service) but also on information contained in the variable e. Indeed there are flows from e and the return of my service. The security label of x after the execution of the invocation of my service is computed according to the definition IV.

In the same way we propagate labels in OrchestraFlow during an asynchronous service call with the functions invoke and receive.

The second type of information flow that can be created by the language is of implicit type. It is what happens for example during conditional operations and loops. In these cases, data manipulated within the structure of the loop or conditional depend on the variables used in the conditional statement of the condition or the loop. Loops and conditionals are treated in the same way. All operations performed inside the conditional or the loop are implicitly dependent on the value of the condition c. In the case of assignments in a conditional, the value of the variable x receiving the expression e also depends on the value of c. There is a flow from c to x. The label of x is computed from the labels of e and c according to the definition IV. In the case of service invocations in a conditional, if a service call is performed there is an implicit information flow from c to the service call since it is done according to the value of c. We must, at the time of the service call, ensure that it is also authorized by the security policy associated with c. In OrchestraFlow we modified the ScopeRuntime class in order to add a stack which contains labels of conditional or while condition. When a conditional starts, a label is added to this stack. At the end of this conditional the label is removed. During the execution of an explicit flow the computation of the new label takes care of both the labels of the expression considered in the explicit flow and the resulting label of the implicit flow stack. The legality of the information flow is checked when a service tries to send information to an other service. Two functions send data to external services: invoke and reply. When one of these functions is called, we verify that the service call complies with the security policy, i.e., the recipient service belongs to the authorized readers of the data. More formally, when a service uses invoke or reply with output variable m towards a service s OrchestraFlow checks if s ∈ reader(m) as defined in definition IV. In order to prevent implicit information flow, a second verification must be done. The service call should be authorized by the resulting label of the implicit flow stack.

When an illegal flow is detected, it is necessary to ask the information owner if he accepts or not to update the security policy. In Section V we presented information sent by the BPEL interpreter to the owner and the possible answers of the owner. To implement this functionality in OrchestraFlow we decided to delegate to each owner to implement their own security service. This is a web service respecting a WSDL file describing the interface. This interface is common to all security services enabling OrchestraFlow to interact in the same way with all the security services. So when OrchestraFlow detects an illegal information flow, it makes a call to the web security service of the owner of that information (the address of the security service is sent with the security policy information at the beginning of the BPEL program execution).

VII. CONCLUSION

The goal of our work is to give the user of a web service the ability to restrain the use of his data by services he was never heard of. At the time of a service call, he is able to define which user data can be accessed by which web services. This property is guaranteed by a distributed security policy that defines which data can be accessed by which service. Using the security model defined by Myers et al. as a basis, our contribution consists in applying this type of security policy to Web Services and to dynamically define what are the variables in an orchestration of Web Services (written in a BPEL program) that are influenced by the user inputs. For this purpose, we follow the information flows that are produced by the various operations available in the BPEL interpreter. When flows are produced between variables, we update the labels attached to these variables to reflect the services that can read the data items. Thus, we can detect implicit or explicit data leakage and ensure the privacy of the user data. This approach proved to be feasible and lead to the implementation of the mechanisms inside the Orchestra BPEL interpreter. However such an approach usually requires that the user knows all services involved in the orchestration. That is why we proposed a mechanism to dynamically update or build the security policy and principles for integrating this mechanism in OrchestraFlow. In particular, we defined a security mechanism in order to allow updates of an information flow security policy by the user of a BPEL program.


Nachbaur Aude
email: a.nachbaur@brgm.fr

Rohmer Jérémy

Managing expert-information uncertainties for assessing collapse susceptibility of abandoned underground structures

Keywords: Cavities, Susceptibility assessment, Regional scale, Expert judgement, Weight of Evidence, Fuzzy set

Assessing the collapse susceptibility of abandoned cavities at a regional scale is associated with large uncertainties that are mainly related to the very nature of the phenomena, but also to the difficulty in collecting exhaustive information at such a scale on often "forgotten" structures. In this context, the expert's role is essential, because he is able to synthesize the information resulting from the inventory and from the commonly imprecise, if not vague, criteria on the basis of his experience and his knowledge of the regional geological and historical and economic context. In this article, we propose mathematical tools for representing and processing this information in order to give flexibility to this step and manage the uncertainty inherent in the expert's information. The first tool, based on the weight of evidence theory, is for managing the uncertainty due to the heterogeneous spatial distribution of the data, whereas the second tool, based on the fuzzy set theory, is for managing the imprecision and incompleteness of available data, which hinder the definition of the class boundaries of the quantitative decision criteria. Based on an appropriate representation of the uncertainty sources (related to the input data and to the expert diagnostic), we then propose a methodology that integrates the uncertainty in the final output of the collapse susceptibility assessment and provides a confidence indicator useful within the decision-making process. The proposed methodology is applied to the Arras territory in the North of France, where abandoned chalk pits (dating back to the Roman ages) and war saps (i.e. covered trenches) located in the vicinity of the First World War front lines both raise difficulties for urban planning

Introduction

The Earth's subsurface has, throughout history, been intensively worked not only for extracting material, as testified by the vast number of quarries and marl pits, but also for various other reasons resulting in underground structures as varied as war saps (covered frontline trenches), underground shelters, troglodyte dwellings, etc. [START_REF] Lcpc | Evaluation des aléas liés aux cavités souterraines[END_REF]. In addition to these anthropogenic structures are the « natural » cavities such as the karsts in limestone environments. The existence of most of these underground cavities, classified as « abandoned », is unknown whereas voids can extend several tens of metres. It is estimated that France contains more than 500 000 of such underground structures whose partial or total ruin can have considerable socio-economic consequences for the community [START_REF] Van Den Eeckhaut | Sinkhole formation above underground limestone quarries: A case study in South Limburg (Belgium)[END_REF][START_REF] Gutiérrez | Identification, prediction and mitigation of sinkhole hazards in evaporite karst areas[END_REF]. For example, in the French region of Picardy alone, more than 300 constructions were damaged through cavity collapse following the winter rains of 2000-2001[START_REF] Bouchut | Recensement et analyse des mouvements de terrain survenus en 2000-2001 dans les arrondissements de Montdidier (Somme) et de Clermont[END_REF]. These events can be sufficiently violent to cause human loss. Thus, in 1961, the collapse of an underground chalk quarry in the Paris suburb of Clamart caused the destruction of 20 buildings with the death of 21 people [START_REF] Josien | Diagnostic et caractérisation des aléas[END_REF]. In France, cartographic tools known as Risk Prevention Plans (RPP), have been developed at municipal scale for determining cavity-associated risks (MATE, 1999). However, faced with both the number and the diversity of such abandoned cavities, the authorities require decision-aid tools to be able to rank the risks at spatially larger scales (such as grouped-municipality, if not regional scale) and manage the resultant uncertainties [START_REF] Waltham | Sinkholes and Subsidence: Karst and Cavernous Rocks in Engineering and Construction[END_REF]. The present study puts forward a methodology in answer to these expectations. Contrary to other natural phenomena, no single random variable can be identified for the overall measurement of the dreaded event, i.e. cavity collapse. In most cases, the studied underground structures are not accessible, which eliminates the use of a systematic deterministic approach. The particularity of mining cavities is the precision often provided by the existence and knowledge of mine plans and geometric parameters, even when incomplete. In the general case, we are concerned with limited and non-exhaustive input data, seldom supported by geometric and mechanical parameters. Being given the specificity of the studied natural phenomenon, the only predictive models that can be established consist in expressing the spatial probability of a surface instabilities appearance, known as "susceptibility". Two approaches can be commonly proposed in the view to assess the level of susceptibility: the one being based on empirical methods and the second one on the quantification of this levelby means of mathematical and statistical tools. In both cases, we have to be deal with with multiple and locally highly variable, controlling factors mainly based mainly on the judgement and information of an expert panel.

Where purely empirical methods are concerned, in France, methodological guides has been produced for assessing underground-cavity susceptibility in general [START_REF] Lcpc | Evaluation des aléas liés aux cavités souterraines[END_REF] or dedicated, for example, for the marl-pits of Upper Normandy [START_REF] Lcpc | Les marnières de Haute-Normandie. Méthodologies d'étude et de prévention[END_REF] or for mining cavities [START_REF] Ineris | L'élaboration des Plans de Prévention des Risques Miniers. Guide méthodologique -volet technique relatif à l'évaluation de l'aléa[END_REF]. These guides develop a phenomenological approach based on analysing the rupture mechanisms and generally resulting in a qualitative spatial ranking of the susceptibility based on a weighting adjusted by experts. The application of a scoring and classification procedure has been commonly applied for ranking the collapse susceptibility of karstic cavities [START_REF] Forth | Hazard mapping of karst along the coast of the Algarve, Portugal[END_REF][START_REF] Kaufmann | Geohazard map of cover-collapse sinkholes in the "Tournaisis" area southern Belgium[END_REF][START_REF] Zhou | Application of matrix analysis in delineating sinkhole risk areas along highway (I-70 near Frederick, Maryland)[END_REF][START_REF] Cooper | The GIS approach to evaporite-karst geohazards in Great Britain[END_REF][START_REF] Guerrero | A sinkhole susceptibility zonation based on paleokarst analysis along a stretch of the Madrid-Barcelona high-speed railway built over gypsumand salt-bearing evaporites (NE Spain)[END_REF]). One major limitation of such an approach is the choice of the weightings, which is highly dependent on expert judgements (i.e. subjectivity), hence widely varying from one expert to another. To compensate for this shortcoming, a large variety of rigorous mathematical and statistical tools have been introduced enabling one to quantify the probability between empirically established relationships without introducing expert subjectivity. Thus, [START_REF] White | Geomorphology and hydrology of karst terrains[END_REF] used the nearest neighbour analysis to interpret the spatial distribution of sinkholes, [START_REF] Mancini | GIS-based assessment of risk due to salt mining activities at Tuzla (Bosnia and Herzegovina)[END_REF] used a multicriteria decision analysis to combine several quantitative hazard factors controlling the subsidence of a salt mine in order to score the hazard. [START_REF] Gao | A mathematical model for a sinkhole probability map in Fillmore County, Minnesota[END_REF] and [START_REF] Bruno | Development and morphometry of sinkholes in coastal plains of Apulia, southern Italy. Preliminary sinkhole susceptibility assessment[END_REF] used a decision tree, [START_REF] Lamelas | Doline probability map using logistic regression and GIS technology in the central Ebro Basin (Spain)[END_REF] chose logistic regression. Applying several karst susceptibility assessment methodologies to the Ebro Valley, [START_REF] Galve | Evaluating and comparing methods of sinkhole susceptibility mapping in the Ebro Valley evaporite karst (NE Spain)[END_REF] noted that models derived from the nearest neighbour distance and sinkhole density were more reliable than the probabilistic or heuristic methods. These tool types, however, are only based on the initial collection of data and thus favour the best informed sectors so that the susceptibility assessment might result in outlining the sectors where the information on the cavities is available. Thus, a major limitation of these approaches is that they are unsuited to an inventory that is known to be scarce and incomplete. The quality and precision of these approaches rest in fact on the exhaustiveness of the inventory, the realization of which is limited notably by the size of the study area. Introduction of the expert's subjectivity because of his knowledge of the regional context is thus essential in order to fill the gaps of the data-gathering phase. Overlapping these methodological approaches and in the view to overcome the usual limitations encountered within commonly-used collapse susceptibility assessments of underground structures, an alternative is proposed in this article fulfilling the following requirements: (1) providing a useful tool for decision-makers and regional planning managers; (2) being flexible and adaptable to all kinds of cavity and specific local conditions; (3) enabling to take into account expert judgements of all types (geological, geographical, historical, engineering, etc.) whilst introducing analytical tools that control the weight of expert's subjectivity; (4) enabling to use existing punctual data collection while, at the same time, overcome any deficiency and/or lack of this collection. The present article is organized as follows. In a first section, the general principles adopted for collapse susceptibility assessment of abandoned underground structures is described. In a second section, we shall see the adopted mathematical tools developed to manage the multiple uncertainty sources associated with the assessment. We shall also see that these tools depend on the nature of the criteria used. They are adapted either from the "weight-of-evidence" approach, which has been widely used in the field of mineral exploration [START_REF] Bonham-Carter | Geographic information systems for geoscientists: modelling with GIS[END_REF] and further applied for geohazard assessment, or from the "fuzzy set" theory [START_REF] Zadeh | Fuzzy Sets[END_REF] to deal with imprecision and incompleteness of available data. Based on an appropriate representation of the uncertainty sources, we then propose a methodology that integrate the uncertainty in the final output of the collapse susceptibility assessment and synthesize a confidence indicator useful within the decision-making process to assess the sensitivity of the results to the inputs. Finally, the use of the proposed methodology is illustrated for the Arras region of Northern France (section 4).

Methodology for assessing collapse susceptibility

Definition of susceptibility

The susceptibility of a surface disturbance (i.e. ground instability) measures the spatial probability of its appearance at the surface, without any reference to a temporal frequency associated with the hazard [START_REF] Galve | Evaluating and comparing methods of sinkhole susceptibility mapping in the Ebro Valley evaporite karst (NE Spain)[END_REF]. This susceptibility level is a decision indicator for the decision maker, and is here assessed quantitatively as an "index". From a practical point of view, the Collapse Susceptibility (CS), i.e. the susceptibility of a collapse appearing at the surface, is commonly estimated as the crossing of two separate susceptibility values, i.e. the Presence Susceptibility (PS) and the Rupture Susceptibility (RS), because regarding the large spatial scale considered, each of these susceptibility values can be assessed from independent controlling factors (see discussion in section 4). The first term PS corresponds to the susceptibility of cavities being present, whereas the second term RS corresponds to the susceptibility of the overlying ground (overburden) rupturing provided that a cavity is actually present. Thus, the latter susceptibility of the rupture process of the overburden is assessed in a "worst-case" situation because the presence of a cavity, i.e. the presence of void, is an additional factor increasing the ground rupture tendency.

From a mathematical point of view, the operation consisting in merely multiplying both susceptibilities to obtain the final collapse susceptibility implies that the two considered events are independent. This can be justified by the application of the Bayes theorem (see eq. ( 1)) considering that the presence of a cavity given the occurrence of a collapse event can be considered "certain" (i.e. the susceptibility is one). As an illustration, let us consider a voluminous cavity below a massive resistant granitic overburden will present no surface risk. Conversely, a thin fractured and weathered limestone cover will not contain the propagation of instability, provided that a cavity can exist at the same place. Notice that although we focused here on brittle deformations that are the more damaging for the surface, such an approach could also be applied to plastic deformations that control ground instabilities such as settlement or subsidence.

2.2.

Principles of the methodology The study area is divided into homogeneous sectors for each of which one calculates a susceptibility index. The desired susceptibility index (here, that of the collapse susceptibility, CS) derives from two susceptibility values (here PS and RS) assessed in parallel as outlined in Fig. 1. The calculation of each value is a three-step process involving:

-Step 1: an inventory of existing data and a collection of information (geological and historicoeconomic) on the local context. This step is described in section 2.2.1.; -Step 2: a list of relevant controlling factors (i.e. criteria) identified by experts from Step 1, the expertise being the central aspect of the method. This step is described in section 2.2.2 and the key role of expertise is further discussed in section 2.3.;

-Step 3: a specific susceptibility map for each identified criterion starting from a quantitative index (for which the calculation method is described in section 3 and illustrated in section 4.3.). Such an approach is easily integrated into a GIS (Geographic Information System) and the final collapse susceptibility map is then calculated by crossing the presence and rupture susceptibility maps, each of them resulting from independent step 1, 2 and 3.

[Fig. 1 about here] It should be noted that a specific susceptibility map is assessed for each cavity type. The characteristics of the disturbance expected at the surface and the controlling factors are notably highly dependent on the characteristics of the cavities (geological nature, dimension, location, depth, etc.), which vary greatly according to their type. To assess an overall susceptibility, regardless of cavity type, would be senseless.

Step 1: Data collection

The data collection step aims at gathering the local information in general (geological, historico-economic…) and especially, the inventoried punctual data. More precisely, it requires two distinct inventories for each type of cavity: an inventory of the existing cavities and an inventory of the associated surface disturbances. The two inventories do not necessarily have to be balanced in terms of number. In some French Departments, such as Paris or Gironde (southern France), quarry plans enable the compilation of very exhaustive cavity inventories, whereas in other regions, such as Picardy, Normandy (northern France), etc., one finds a large amount of surface disturbances but little information on the marl pits. The inventories must be sufficiently supplied so as to be, according to the expert's opinion, representative of the state of both cavities and collapses, in the studied area. It should be noted, however, that an inventory considered as non-representative of the considered situation should be completed with data of similar neighbouring areas and thus increase the representativeness of the highlighted spatial correlations. Surface disturbances related to the presence of an underground cavity can be of varied types such as generalized collapse, sinkhole, subsidence, settlement, etc. While deciding focusing on "collapse" phenomenon, the inventory should gather, so far as possible, the ground instabilities connected to such brittle deformation (i.e. collapse, sinkhole…). In this article, these specific types of ground instabilities are assigned to the generic term "disturbances".

2.2.2.

Step 2: Controlling factor (i.e. criterion) identification Two kinds of controlling criteria have to be identified for each cavity type : those that justify the spatial distribution of the cavities within the study area (e.g. geological nature, depth of the workable formations, etc.) and those that justify the collapses distribution (e.g. thickness of the cover rock, variation in groundwater level, nature of the overburden, etc.). Actually, it is considered that future disturbances will occur under similar conditions to past disturbances. These controlling factors can be classified into two types: « qualitative » when concerning qualitative indications (lithological type, historical sectoring, etc.) and « quantitative » when they can be associated with a measurable order (depth, distance, resistance, etc.). It should be noted that the process of identifying the appropriate criteria is beyond the scope of the present article, which focuses on managing the expert information and the associated uncertainty once the controlling factors have been defined.

2.3.

Key role of the expertise Integrating the uncertainties helps improving the risk management [START_REF] Merad | Use of multi-criteria decision-aids for risk zoning and management of large areas subjected to mining-induced hazards[END_REF]. In situations where a great deal of data are available, such as when dealing with industrial risk assessment or car accidents, a commonly used methodology for representing uncertainty is based on probabilistic tools (e.g. [START_REF] Baudrit | Practical representations of incomplete probabilistic knowledge[END_REF]. In many cases and for many risk sources, however, particularly in the field of georisks (e.g. [START_REF] Karimi | Risk assessment system of natural hazards: A new approach based on fuzzy probability Fuzzy Sets and Systems[END_REF][START_REF] Cauvin | Dealing with uncertainties in the context of post mining hazard evaluation[END_REF]& 2009), the data available for hazard assessment can be particularly scarce and is often associated with imprecision and incompleteness due to spatial and financial constraints. Such uncertainties are usually named "epistemic", because they are knowledge-based in contrast to aleatoric uncertainties, which are inherent to the considered physical process [START_REF] Ellingwood | Quantifying and communicating uncertainty in seismic risk assessment[END_REF]. In these cases, it is difficult to use common mathematical tools for the uncertainty representation [START_REF] Helton | Guest Editorial: Alternative representations of epistemic uncertainty[END_REF][START_REF] Baudrit | Practical representations of incomplete probabilistic knowledge[END_REF]. It is in this context that the expert's role is essential. At the core of the method (Fig. 1), the expert, on the basis of his experience and his regional knowledge, synthesizes and interprets the commonly imprecise, if not vague, information obtained from the inventory and the geological and historicaleconomic contexts. As several authors have already pointed out relative to all types of underground structure [START_REF] Upchurch | Evaluation of data for sinkhole-development risk models[END_REF][START_REF] Benson | Assessing the risk of karst subsidence and collapse[END_REF][START_REF] Hubbard | Use of regional sinkhole mapping for sinkhole susceptibility maps[END_REF][START_REF] Brinkmann | Sinkhole distribution in a rapidly developing urban environment: Hillsborough County, Tampa Bay Area, Florida[END_REF], the essential aspect of the expertise is the identification of the theoretical controlling factors regulating the occurrence of the disturbances, i.e. the equivalent of the step 2 of the methodology. We propose introducing analytical tools that enhance the expertise process while managing several forms of epistemic uncertainty. It is a question of integrating two of the four types of uncertainty that, according to [START_REF] Cauvin | Dealing with uncertainties in the context of post mining hazard evaluation[END_REF], mar the risk analysis procedures: the "expert uncertainty" and the "input data uncertainty". More precisely, we propose to address the following types of uncertainties :

-UNC 1: non-exhaustiveness and heterogeneity in the spatial distribution of the inventory data ("data uncertainty"); -UNC 2: imprecision of the cavity and collapse inventoried data (poor location, information lacking, etc.) ("data uncertainty"); Both of these "data uncertainties" are making up the initial knowledge of the studied geological phenomenon, which complicated the analysis. We will take into account two other sources of uncertainty, linked to the analysis the experts lead from the analysis of this inventoried data:

-UNC 3: uncertainty associated to the expert analysis and interpretation ("expert diagnostic uncertainty"); -UNC 4: imprecision or variability of the cartographic data related to each criterion on the basis of which the index is fixed ("cartographic data uncertainty"). It is important to note that we do not question the basic hypothesis on which the method is based, namely that there is a correlation between the geological event and the identified criterion. These more general sources of uncertainty, which are not taken into account, correspond to the uncertainties identified by [START_REF] Cauvin | Dealing with uncertainties in the context of post mining hazard evaluation[END_REF] such as the "resources"-type uncertainty related to poor knowledge of the phenomenon.

Managing expert uncertainty (Step 3)

In this section, we propose mathematical tools for representing and processing with flexibility the expert information while managing the different kinds of associated uncertainty.

Addressing UNC 1: use of a density function

A specific tool has been developed to quantify the level of susceptibility associated with qualitative controlling factors, e.g. geological nature of the substratum, historical area, etc. In a classical approach, the relationship between the spatial distribution of the cavities (or of the surface ground disturbances related to a cavity) and information of qualitative nature (e.g. the geological nature of the substratum) would be assessed by assigning a weight to each geological formation, reflecting the expert knowledge on each formation (historical presence of quarries, qualitative estimates of rock strength, etc.). The major limitation of such an approach resides in the quantification of these weights and as an alternative, we propose a data-driven method based on the "weight of evidence" approach. This approach was originally developed for mineral exploration activities (for instance in the field of gold mineralization research, [START_REF] Bonham-Carter | Geographic information systems for geoscientists: modelling with GIS[END_REF] and recently used in the field of landslide hazard assessment to quantify landslide triggering susceptibility [START_REF] Rezaei Moghaddam | Mapping susceptibility landslide by using the weight-of-evidence model: a case study in Merek Valley, Iran[END_REF][START_REF] Neuhäuser | Landslide susceptibility assessment using "weights-of-evidence" applied to a study area at the Jurassic escarpment (SW-Germany)[END_REF][START_REF] Barbieri | The weight of evidence statistical method in landslide susceptibility mapping of the Rio Pardu Valley (Sardinia, Italy)[END_REF]) and begins to be used for assessment of ground subsidence susceptibility related to abandoned mines (Oh and Lee, 2010). The attractive feature of this method is its flexibility when, for example, geotechnical or hydrogeological data are unavailable at the regional scale [START_REF] Rezaei Moghaddam | Mapping susceptibility landslide by using the weight-of-evidence model: a case study in Merek Valley, Iran[END_REF][START_REF] Neuhäuser | Landslide susceptibility assessment using "weights-of-evidence" applied to a study area at the Jurassic escarpment (SW-Germany)[END_REF]. Formally, the "weight of evidence" approach is based on the statistical Bayesian paradigm using the concept of prior and posterior probability. For illustrative purposes, let us consider the qualitative factor "geological nature of the formation" usually used to explain the presence susceptibility assessment of abandoned cavities. We define the event E as the one referring to this geological factor ; the associated probability is denoted p(E). Similarly, the event G refers to the presence of cavity which probability of occurrence is denoted p(G).

The probability ) ( E G P

of the a posteriori outcome of G given E reads after the Bayes theorem as follows:

) ( ) ( ). ( ) ( E p G p G E p E G P = (1)
Defining the "odd" as

) ( ) ( ) ( G p G p G = θ
, the weight of evidence W can be expressed as follows:

W G G E p G E p G E G + = + = )) ( log( ) ) ( ) ( log( )) ( log( )) ( log( θ θ θ (2)
The weight W is directly proportional to the influence that the controlling factor E has on the presence of the underground cavity G, hence measuring the modification brought by the outcome of the event E on the probability p(G) of an a priori outcome of the event G. In the landslide case, [START_REF] Barbieri | The weight of evidence statistical method in landslide susceptibility mapping of the Rio Pardu Valley (Sardinia, Italy)[END_REF] assess W considering the area affected by landslide phenomena in the considered class (i.e. in the considered geological formation), the total area affected by landslide, the total area of the considered class and the total area of the studied zone. We adapt this approach for cavities: since the area covered by these structures (or the area of the ground disturbances generated by such structures) can be neglected compared to the large area of the studied zone (regional spatial scale), the quantity of interest describing the underground structure is simply the number of inventoried cavities. Let us divide the space Ω into spatial units ω i, following the outcome of one qualitative criterion (in the considered case, the geological nature of the substratum), as depicted in Fig. 2A. Defining i a ω as the area of the considered class and i n ω as the number of cavities in this class, A Ω and N Ω correspond to the total area and the total number of cavities of the whole studied space Ω. The weight of evidence i W ω associated to the spatial unit ω i reads as follows:

Ω Ω Ω Ω = = = ≈ ∑ ∑ A a N n D A a N n W i i i i i i i i ω ω ω ω ω ω & ) log( ) / / log( (3)
Noteworthy, such an approach can be easily adapted to the event E "overburden rupture" from the outcome of event G, presence of surface disturbances. In practice, each identified qualitative criterion (i.e. controlling factor) leads to a space partition and a definition of a density function D Ω which is thus "stepped", constant and equal to i D ω in each spatial unit.

We shall illustrate our case by focussing on the event G : "presence of quarries in the Loiret Department of France". In this case, the spatial units associated to the criterion "lithological nature of the substratum" (occurrence factor E), are shown on Fig. 2B. Each geological unit is associated with a single index tied in to the observed data (and not only on an expert judgement) using the density function allowing to manage the heterogeneity of the data spatial distribution within the units by extending the localized inventoried information. Thus, the commune of Ingrannes, without any known cavity, will be assigned, considering this criterion, the same index as the city of Orléans located in the same spatial unit corresponding to the geological formation of "Pithiviers" Limestone, and for which a detailed inventory is available (Fig. 2B). Though this approach allows to define rigorously and objectively quantitative index assigned to qualitative spatially-distributed controlling factors, the key aspect resides in ensuring that the inventory of the collected data (number of underground structures, number of ground disturbances) is representative as outlined in [START_REF] Billa | Predicting gold-rich epithermal and porphyry systems in the central Andes with a continental-scale metallogenic GIS[END_REF].

[Fig. 2 about here] 3.2. Addressing UNC 2: use of a membership function A specific tool has been developed to quantify the level of susceptibility associated with quantitative controlling factors, e.g. thickness of the overburden, depth of the water table, etc. The fuzzy logic (e.g. [START_REF] Ross | Fuzzy Logic with Engineering Applications[END_REF] based on the fuzzy set theory (first introduced by Zadeh, 1965) is particularly suited for formalizing empirical and intuitive reasoning which the experts may establish from a few vague data. In particular, it enables one to manage the so-called "threshold effects" generally introduced at the class limit level. These features make the methodology, which was brought to rock mechanics by [START_REF] Brown | A Fuzzy Safety Measure[END_REF], particularly well suited for geotechnical problems (e.g. [START_REF] Elshayeb | Overcoming Uncertainties in Risk Analysis: Trade-Offs among Methods of Uncertainty Analysis[END_REF]. Recently, [START_REF] Saboya | Assessment of failure susceptibility of soil slopes using fuzzy logic[END_REF] and [START_REF] Kanungo | A comparative study of conventional, ANN black box, fuzzy and combine neural and fuzzy weighting procedures for landslide susceptibility zonation in Darjeeling Himalayas[END_REF] both used fuzzy logic for assessing landslide susceptibility. Let us consider the concept of membership function, which defines how each element x of the input space X (also named "universe of discourse") is mapped to a degree of membership (denoted µ). Under the classical theory of Boolean logic, the membership function of a set A is simply defined as a binary function that takes the value µ(x)=1 if the element belongs to A and the value µ(x)=0, otherwise. In Fig. 3A, the set A is graphically represented by a clearly defined boundary. However, faced with information tainted by uncertainty, it may be difficult (or impossible) to accurately define the location of this boundary. In this context, the fuzzy set theory introduces the concept of a set without a crisp, hence clearly defined, boundary. Such a set à can contain elements with only a partial degree of membership (scaled between 0 and 1) as defined by equation 5.

[ ] { }

X A A x x x A X A A ⊂ ∈ = → ; / ) ( , ~1 . 0 : μ µ (5)
Graphically, the boundary of the fuzzy set à is a progressive boundary (Fig. 3B), so that the element x 2 depicted in Fig. 3B is located in the "fuzzy" zone between the so-called "certain" boundaries (boundaries respectively assigned to µ=0 and µ=1) and is associated with a 66 % degree of membership, whereas under the classic Boolean theory, it is entirely excluded from unit A (Fig. 3A).

[Fig. 3 about here] Considering cavities, the fuzzy set theory is used to quantify the influence of each quantitative criterion for both dreaded geological events "presence of an underground cavity" and "overburden rupture". Let us consider the criterion "depth of the worked geological formation", frequently used to justify the presence of a quarry. In this case, the input space (i.e. universe of discourse) is all potential depths of the worked geological formation. On the basis of the collected data (Fig. 4.A.), as well as of regional knowledge of the context (both geological and historical), the expert could, for instance, state that "in this type of geological formation, I am certain that there are quarries at less than 15 m depth and that, for technical mining conditions, no quarry could be present below 50 m". The fuzzy set à is here defined as the depths to which one may encounter quarries, accompanied by a degree of membership measuring their influence on the event "presence of a cavity". Taking the above example, Fig. 4.B. shows that the depths within the 0-15m interval (Zone I) are characterized by the maximum degree of membership. Below this depth, in the 15-50m interval (Zone II of Fig. 4.B.), the degree of membership decreases until below 50m depth (Zone III, Fig. 4.B.), where the expert estimates that the presence of a quarry is not possible, which correspond to a null degree of membership. Under the traditional approach, if the threshold is fixed at 15 m, a cavity located at 16 m is automatically and unfavourably placed in the same class as that located at 50 m. The entire sense of the "membership function" is thus that it frees one from data insufficiency [START_REF] Ercanoglu | Use of fuzzy relations to produce landslide susceptibility map of a landslide prone area (West Black Sea Region, Turkey)[END_REF]. Here the proposed transition is linear (Zone II), but the expert could assume a nonlinear curve. For instance, if the expert has knowledge (or observations) indicating that while values located within zone II are possible, they are nevertheless very unlikely, convex functions can be used [START_REF] Baudrit | Joint propagation of variability and imprecision in assessing the risk of groundwater contamination[END_REF]. Note that the membership function joins the type of continuous function defined by [START_REF] Thierry | 3D geological modelling at urban scale and mapping of ground movement susceptibility from gypsum dissolution: the Paris example (France)[END_REF] to assess gypsum dissolution collapse susceptibility from observations.

[Fig. 4 about here]

Addressing UNC 3: sensitivity to the experts' choice

The membership function provides flexibility in the definition of the class of the controlling factors by introducing the notion of gradual membership. This function reflects the judgment of a single expert by means of thresholds defining the different zones of varying degrees of membership (Fig. 4.B.), which can vary from one expert to another. To refine the uncertainty representation provided by the membership function, different expert judgements should then be taken into account i.e. a multiple of sources of information. Noteworthy, such an approach is similar when observing a given physical phenomenon, which often relies on a variety of observational techniques to build confidence in the physical process evidence. A variety of methods exist to synthesize the variability of the judgements provided by the expert panel ; we choose to summarize it by a pair of membership functions, respectively corresponding to a "pessimistic" and an "optimistic" distribution (respectively red and blue distribution, Fig. 5). The uncertainty that the experts associate to their diagnosis is quantifiable by the difference between the results obtained by the two functions. For the case depicted in Fig. 5, the experts are certain of their diagnosis above 50m depth and below 15m depth, but between these two values, the degree of membership is accompanied by an uncertainty represented by a range of values, which is maximal here at 35m depth. To facilitate the decision-making process, it is proposed to compute a single susceptibility index as a weighed average of both membership functions (optimistic and pessimistic) based on the approach of [START_REF] Hurwicz | Optimality Criteria for Decision Making under Ignorance[END_REF] in the field of decision-making under ignorance. The choice of the weights is subjective and reflects the attitude of the decision-maker with respect to risk [START_REF] Baudrit | Joint propagation of variability and imprecision in assessing the risk of groundwater contamination[END_REF]. For instance, a weight of 0 % corresponds to a situation of complete aversion to risk and the pessimistic bound is privileged. In this study, we choose a weight of 50% between the optimistic and the pessimistic view so that each quantitative criterion at any point of the studied territory is assigned a "medium" susceptibility assessment accompanied by a variation range related to the uncertainty of the expert's judgement.

[Fig. 5 about here]

Addressing UNC 4: integrate the cartographic data imprecision

The value of the susceptibility index closely depends on the quality of the cartographic data associated with the identified criteria, i.e. the inputs of the membership function at each given location of the territory. In geostatistics, the kriging variance supplies, for example, an estimate of the precision of the map displayed [START_REF] Chilès | Geostatistics: modelling spatial uncertainty[END_REF]. In the absence of a local estimate like this, the imprecision can also be given in a uniform fashion over the studied domain (i.e. 'the precision of the measurement of the depth of the substratum is accurate to within 3 metres'). This information enable to defer the effect of the measurement imprecision (whether uniform or variable) on the final susceptibility index at each point (or at some only) of the studied territory. Figure 6 shows the influence that an imprecision of ± 3 m on the depth, could involve on the degree of membership at a given location (UNC4), integrating also the uncertainty the expert associate to their diagnosis at each depth (UNC3). Although the final value will be estimated by a single index (that worth 0.5 at a depth of 30 m in the example illustrated in Fig. 6), the global uncertainty introduces the potential range for the degrees of membership integrating UNC 3 and UNC 4 (e.g. the degree of membership at a depth of 30 m could actually range between 0.10 and 0.75, Fig. 6). The weight of the input data imprecision in the value of the overall confidence indicator is useful for risk management purpose.

[Fig. 6 about here]

Mapping of collapse susceptibility incorporating uncertainty

The objective of this section is twofold: 1) describe the methodology to compute the final collapse susceptibility map and the information on uncertainty to support decision-making ; 2) discuss the results in particular considering the applicability of other commonly-used approaches, the deterministic and the statistical (probabilistic) approaches, which do not have the shortcomings of any method based on the contribution of an expert. In this view, the Arras territory located in the North of France is used as an illustrative case.

Context of Arras territory

The Arras territory (Fig. 7) corresponds to a grouped-municipality of 20 towns (43 000 inhabitants) covering a total area of 170 km². Considering the geological setting, the substratum is composed of a chalky geological formation (Coniacian, Upper Cretaceous) overlain by a Quaternary cover of silt and loess over the whole region (Fig. 7). The cavities risk collapsing is a major concern for the territory management.Two types of underground structures more particularly raising difficulties: -Underground quarries of phosphated chalk (i.e. Chalkpits), date back to the Roman times for the first underground workings. In addition to the use of lime as an amendment, nodular chalk was used in abundance as dimension stone during the 16th and 17th centuries. Worked in so-called "catiches" i.e. corresponding to bottle-shaped underground mining galleries or by room and pillar, they are specifically adapted for construction and represent most of the inventoried cavities. In addition, each Arras village is likely to present a few "refuge"-type cavities (commonly below churches, monasteries, convents, castles, etc.), some of which used and/or modified pre-existing underground quarries [START_REF] Barchi | Cartographie préliminaire de l'aléa "mouvements de terrain liés à la présence de cavités souterraines, suite à de fortes pluviosités[END_REF]. This feature derives from the Arras wars in the middle Ages;

-First World War saps (i.e. covered trenches) are military underground structures dating back to the First World War (1914War ( -1918) ) and generally consist of a trench and an inclined gallery that leads to an underground room, enabling the army troops to take shelter or try and penetrate the enemy lines [START_REF] Lcpc | Les marnières de Haute-Normandie. Méthodologies d'étude et de prévention[END_REF]. The network of wartime trenches is generally marked by underground shelters (every 20 to approximately 50 m), which were very partially filled in after the war. The wall rock of these cavities was situated, when possible, in the chalk formation to achieve a better drainage whereas the roof generally reached the silt formation [START_REF] Poitout | Origine et traitement des fontis survenus sur le plateau picard le long de l LGV Nord[END_REF].

[Fig. 7 about here]

The cavity inventory was primarily based on the French national public database (http://www.bdcavite.net/), which collects all the "known" underground structures at the national scale and aims at informing citizens, hence contributing to the natural hazards prevention policy led by French authorities so that a total number of 300 underground quarries were identified and localized in the studied territory (outlined in Fig. 7 by a yellow star-type marker). The inventory of the war saps (outlined in Fig. 7 by a linear black symbol) was mostly based on military maps compiled by the Military Staff Office which locate the French and German trenches and so, the positions of the saps in the studied territory. Some sectors like the Canadian National Vimy Memorial Site are very well documented, but in general, availability of this information from archival sources remains, however, patchy [START_REF] Hutchinson | Geomechanics stability assessment of World War I military excavations at the Canadian National Vimy Memorial Site, France[END_REF]. The collapse inventory was, however, relatively scarce with 48 collapse events reported in the existing national database (http://www.bdmvt.net/). Hence, the Arras territory presents numerous old mining structures of small to moderate dimensions in a context characterized by an a priori "simple" geological setting, but by a complex historical background. Some of these cavities have been abandoned several decades or centuries ago so that a large number of them have been lost from the collective memory (in relation with memory loss syndrome well known in the field of mine closure, ISRM, 2008) i.e. a majority of these cavities have not necessarily been localized yet. Recently, the intense rainfall events of winter 2001-2002 were followed by numerous surface damages and sinkholes. These collapse events were primarily associated to "forget" underground structures, which would not have been discovered without the occurrence of these meteorological events. The regional authorities urgently prescribed 27 Risk Prevention Plans (RPP), but without any other means of ranking the priority than choosing the towns that were already affected by collapses. For future prescription of RPP, the local authorities advocated the development of a methodology to set priorities under budget constraints, in particular regarding new data collection, with a particular care paid to the treatment of regions with very scarce data.

Susceptibility assessment and discussion

The susceptibility assessment can be based on deterministic methods, which apply principles such as limit equilibrium and finite element techniques. [START_REF] Cauvin | Modeling Uncertainties in Mining Pillar Stability Analysis[END_REF] provides an illustration of such an approach applied in the field of post-mining hazard assessments. These models require standard rock mass characterization such as rock strength, fracture network description, groundwater pressures, but also the description of cavity geometry, excavation and support techniques. The latter data are seldom available for the considered underground structures of the Arras territory as they were mostly constructed in a "handcrafted" manner and restricted to the underground structures accessible for inspection. Applying a deterministic approach based on a geomechanics stability assessment as the one carried out at the Vimy Memorial Site [START_REF] Hutchinson | Geomechanics stability assessment of World War I military excavations at the Canadian National Vimy Memorial Site, France[END_REF] would have then been tedious and the generalization to the whole sector would have been questionable. Noteworthy the area of the site studied by Hutchinson and co-authors reaching 0.91 km² to be compared to the 170 km² of the whole studied territory. Hence, the inherent nature of types of underground structures eliminated a systematic deterministic approach. In this context, pertinent controlling factors were then defined (Table 1) by a panel of local experts (geologists, hydrogeologists, historians, etc.), backed up by the spatial distribution of the recorded cavities and ground instabilities (step 2 of the methodology, see section 2.2). Note that the analysis (presence and rupture controlling factors identification) was carried out independently for each cavity type.

[Table 1 about here]

An alternative objective way of developing susceptibility mapping is by correlating statistically the identified set of factors explaining the presence of the considered cavities and the rupture process from the recorded past observations (cavity and collapse inventoried). This can be achieved by means, for instance of multi-variant regression analysis with the use of GIS. An example of such an application is provided by [START_REF] Galve | Development and validation of sinkhole susceptibility models in mantled karst settings. A case study from the Ebro valley evaporite karst (NE Spain)[END_REF] In the context of the Arras territory, the application of a pure statistical approach (also named probabilistic) was liable to result in very coarse and even misleading correlations, because the historical inventory was scarce especially for the collapse inventory (with only 48 events recorded within a region of 170 km²), not to mention information of poor quality, e.g. on the origin of the disturbance and on the cavity at stake, which rarely adequately filled in database. Faced with incomplete information, the apparent statistical fit may have provided a false sense of accuracy, because the statistical correlations and the results in terms of susceptibility outcomes were highly sensitive to small changes in the distribution of inventoried cavities or recorded past events. This was shown through cross-validation procedures (denoted as "random validation" in [START_REF] Galve | Development and validation of sinkhole susceptibility models in mantled karst settings. A case study from the Ebro valley evaporite karst (NE Spain)[END_REF]) consisting in: (1) randomly partitioning the original set of observations into two subsets (e.g. the first one composed of 90 % of the original observations and the second one of 10 %); (2) performing the susceptibility assessment using the first subset and (3) validating the analysis on the second one. In this manner, we showed that the susceptibility of regions where collapse events were actually observed (corresponding to the second subset) changed from high to low values. Hence, in the context of Arras territory, the application of "pure" statistical correlations would have been of doubtful validity, particularly when used for extrapolation in zones with no data. An alternative was then proposed relying on the statistical analysis of available data regarding factors viewed as relevant and prominent given the local context (see Table 1), but tempered by experts' judgments to compensate for lack of observations. Such an approach required adequate mathematical processing tools (described in section 3) to deal with the shortcomings of traditional scoring systems based on experts' judgments (as outlined in the introduction). The studied sector is then decomposed into spatial grid of elements. The choice of the spatial extent of the grid is based on the the cartographic support precision related to each criterion. Thus, the Arras territory was divided into 2 km grids, because the criteria were mapped based on 1: 50 000 geological maps, on kriging-based procedures using a very few boreholes available in the region (hence associated with a large kriging-variance) and on historical data on the front lign location (also associated with imprecision). Each controlling factor was then associated with a susceptibility index calculated at each element of the spatial grid (Step 3 of the methodology, see section 2.2). The index was calculated using one or other of the previously defined tools, according to whether the associated criterion was categorized as "qualitative" or "quantitative".

Final outputs and use for decision-making

To compute the final susceptibility map, a common method would simply consist in adding up the indices, each of them level-headed by empirical weights attributed to each controlling factors [START_REF] Forth | Hazard mapping of karst along the coast of the Algarve, Portugal[END_REF]Sanchez et al., 2007). Another approach relies on mathematical optimization (e.g. [START_REF] Soriano | Alluvial dolines in the central Ebro basin, Spain: a spatial and developmental hazard analysis[END_REF], which has no physical significance in our case and requires a large amount of data. Due to the difference natures of each controlling factors (i.e. the mathematical form of their representation), we propose an alternative procedure for the combination of all indices:

each qualitative criterion is given the same significance by introducing no weighting, and is considered to have a priori, the same role in the distribution of cavities or disturbances. Thus, when there are several qualitative criteria, the indices given by the density functions (value of same dimension, scaled between 0 and 1) are simply added together. The importance of one criterion compared to another is implicitly contained in the spatial distribution of the input sample and thus in the values calculated by the density function: the more discriminating a criterion is, the greater the influence of the associated index will be in the overall value; to combine the indices of the membership functions (when there are several quantitative criteria), one uses fuzzy logic aggregation tools ("MAX" operator), i.e. the upper envelope of the intersection of all these functions. This procedure enables one to incorporate information without compensating for the criteria, emphasizing locally the most characteristic parameter of the susceptibility [START_REF] Ercanoglu | Use of fuzzy relations to produce landslide susceptibility map of a landslide prone area (West Black Sea Region, Turkey)[END_REF]). finally, the presence or rupture susceptibility (PS or RS) results from the product of the two preceding terms. Since the value given by the membership function varies from 0 to 1, the membership function thus operates as a filter on the density functions results.

The flowchart in Fig. 8 illustrates the mathematical aggregation operators for assessing the rupture susceptibly (RS) of the chalkpits in the Arras region.

[Fig. 8 about here]

The final output (Fig. 9C) is a susceptibility map resulting from the crossing of a presence susceptibility (PS) map (Fig. 9A) and a rupture susceptibility (RS) map (Fig. 9B). As a result, the four riskiest sectors are clearly outlined in the studied territory (red cell in Fig. 9C). Noteworhty these identified sectors do not automatically correspond to the more documented area. On the basis of the three independent maps (PS, RS and CS), the decision maker is provided with the whole information whether it would be on the presence susceptibility, on the rupture susceptibility or on the final output in terms of collapse susceptibility. This allows a better understanding of the factors controlling the risk and so a better communication about it. On this basis, the natural hazard prevention policy can be adapted, for instance, either focusing on the means to improve the localisation of cavities or on the better understanding of the rupture mechanics.

[Fig. 9 about here]

For illustrative purposes, let us consider the "c" town located in a zone where the presence susceptibility is qualified as "moderate to high" (Fig. 9A), whereas the rupture susceptibility is relatively low (Fig. 9B). The analysis shows that this sector is not concerned by collapsing, since the cavities present in this zone would tend to be stable (Fig. 9C). However, the first map (Fig. 9A) confirms that chalkpits may exist in this sector, which could become a new constraint to be taken into account for further underground projects.

Studying the sensitivity of these results to changes in the input values of the methodology, provides additional information on corresponds the uncertainty source UNC3 (uncertainty that the experts associate to their diagnosis, see section 3.3) and UNC4 (cartographic data imprecision, see section 3.4) to support decision-making.. In this view, the collapse susceptibility mapping (Fig 9C) is associated with a confidence indicator (Fig 9D) calculated as the maximum value of this indicator associated to each individual criterion. Thus, at any point of the studied territory, the decision maker is provided with useful guidelines for risk management, but also for risk communication (e.g. [START_REF] Ellingwood | Quantifying and communicating uncertainty in seismic risk assessment[END_REF]:

(1) an estimate of the absolute uncertainty associated to the susceptibility index (i.e. a range of values for this index). As an illustration, let us consider the "b" town, which is situated in a "moderate" collapse susceptibility zone (Fig. 9C). Fig. 9D indicates that this result is associated with a low level of confidence, hence should be considered cautiously, and the analysis should be completed with further investigations or additional collection of data to reduce uncertainty locally. On the contrary, the "low" collapse susceptibility zone concerning the "a" town (Fig. 9D) is more reliable as outlined in Fig. 9D ; (2) the percentage of the uncertainty stemming either from the uncertainty in PS RS as depicted in the percentage indicated in Fig. 9D. For instance, unlike its surroundings, the level of confidence at the "d" town is low and mainly results from the uncertainty on on the rupture susceptibility (at 80 %), which is related to the choice of the thresholds for the definition of the membership function.

Concluding remarks and discussion

Assessing the collapse susceptibility of abandoned cavities at a regional scale is associated with large uncertainties that are mainly related to the very nature of the phenomena, but also to the difficulty in collecting exhaustive information at such a scale on often "forgotten" structures. In this context, the expert's role is essential, because he is able to synthesize the information resulting from the inventory and from the commonly imprecise, if not vague, criteria on the basis of his experience and his knowledge of the regional geological and historical and economic context. We have developed two tools for processing this information in order to give flexibility to this step and manage the uncertainty inherent in the expert's information. One tool, based on the "weight of evidence" theory [START_REF] Bonham-Carter | Geographic information systems for geoscientists: modelling with GIS[END_REF], is for managing the uncertainty due to the heterogeneous spatial distribution of the data. The second tool, based on the fuzzy set theory [START_REF] Zadeh | Fuzzy Sets[END_REF], is for managing the uncertainty on the univocal definition of the class boundaries of the decision criteria.

It should be noted that the method does not a priori fix the criteria for assessing the collapse susceptibility of underground structures in general, but offers management tools once the most relevant of these have been identified. The quality of the obtained results depends entirely on the relevance of the selected criteria and thus on the understanding of the phenomena [START_REF] Upchurch | Evaluation of data for sinkhole-development risk models[END_REF][START_REF] Benson | Assessing the risk of karst subsidence and collapse[END_REF][START_REF] Hubbard | Use of regional sinkhole mapping for sinkhole susceptibility maps[END_REF][START_REF] Brinkmann | Sinkhole distribution in a rapidly developing urban environment: Hillsborough County, Tampa Bay Area, Florida[END_REF]. Although the method endeavours to control and limit the subjectivity of expert judgement, the expertise is still the central point. Its role is mainly in selecting the susceptibility criteria that must be independent, relevant and exhaustive to account for the phenomena. It would be wrong and "dangerous" to limit oneself to the most obvious criteria and ignore more complex criteria that also have a role in justifying the observed spatial distribution. The expert must also ensure that he draws up inventories that are sufficiently representative of the existing situation so as not to distort the construction of the tools.

Starting from the expert judgement, the developed method ends with a quantitative assessment of the susceptibility levels thanks to two mathematical tools that make it possible to determine the best weight reflecting the influence of each controlling criterion. It differs from the traditionally used approaches by: -dealing with all types of criteria, knowing that density functions make it possible to extend qualitative information, while being strict concerning the weight allotted to the spatial units and freeing oneself of a subjective theoretical weighting; -limiting the threshold effects classically introduced by the expert's judgement; -freeing oneself of the spatial distribution heterogeneity of the initially existing punctual information: the analysis no longer favours the best documented sectors; -limiting the weightings and compensatory effect when combining the criteria;

-measuring the risk taken by the expert in his analysis, which allows him to remain prudent in the resulting diagnosis; This task implies assessing the expert's "reliability", aggregating the judgements provided by the expert panel and synthesizing them for practical use in decision-making process. The latter taskmay be tedious, especially when information is conflicting (e.g. [START_REF] Destercke | Methods for the evaluation and synthesis ofmultiple sources of information applied to nuclear computer codes[END_REF] and constitutes a perspective for further works.

Using the final cartographic results, territorial managers can quantify the issues affected by the collapse of each type of cavity and thus rank what they are likely to accept or reduce while integrating the uncertainty of the expert's diagnosis. The proposed maps enable them to access the information sources and have access to the technical arguments. The increased perspectives thus facilitate the acceptance of the hazard by the decision-maker and respond to planning and risk management requirements on a regional scale. Example of the chalkpits, in the Arras region.

Fig. 9. Combination of the susceptibility of presence PS (Fig. 9A) of cavities and of the rupture susceptibility RS (Fig. 9B). The result constitutes the collapse susceptibility map of chalkpits in the Arras territory (Fig. 9C) combined with the mapping of confidence indicator.

FIGURE CAPTIONS Fig. 1 .

 CAPTIONS1 FIGURE CAPTIONS

Fig. 2 .

 2 Fig.2. Generic example of the application of the modified "weight of evidence" to take into account qualitative criteria. 2A: theoretical spatial units; 2B: spatial units applied to a geological criterion controlling the presence of quarries in the Loiret Department of France.

Fig. 4 .Fig. 5 .

 45 Fig. 4. Method of constructing the membership function relative to quantitative criteria: depth of the exploited geological formation.

Fig. 8 .

 8 Fig. 8. Mathematical aggregation operations for calculating the rupture susceptibility index (RS). Example of the chalkpits, in the Arras region.

Acknowledgements

This work was financially supported by the French Environment Ministry and the BRGM and through the 'Barnier funds' allotted by the Pas-de-Calais (62) and Loiret (45) prefectures. The development of this project involved many BRGM specialists, all gratefully acknowledged. Particular thanks to Gilles Grandjean, Denis Moiriat, Thierry Winter, Mélanie Fontaine, Carole Lembezat. The authors would like to thank the grouped municipalities of Orléans and Arras for providing data on the study areas and the SDICS (Regional Department of Underground Quarry Inspection) for handing the military maps.