Florent Morel
email: florent.morel@supergrid-institute.com

Joan Sau Bassols
email: joan.saubassols@supergrid-institute.com

Sellé Toure
email: selle.toure@gmail.com

Serge Poullain
email: serge.poullain@supergrid-institute.com

Frank Jacquier
email: frank.jacquier@supergrid-institute.com

Integration of power flow controllers in HVDC grids

Keywords:

High voltage direct current (HVDC) grids are seen as a key technology to integrate renewable power sources across long distances. They provide flexibility and redundancy to the system, but they also bring many challenges. Among them, the power flow control becomes a concern since the converter stations at each terminal can control the current at node level but not the currents circulating inside the mesh. The current distribution through the different DC conductors depends on the resistance relation between conductors. The installation of new converter stations, modifications of the grid configuration, N-1 contingencies, etc. can modify the current distribution leading to overloads in some conductors, while others are underused. Consequently, power curtailments or the installation of new conductors may be necessary. An alternative solution is to install medium voltage converters inserting voltages in series with the DC conductors, known as power flow controllers (PFC) or current flow controllers (CFC). Those devices allow to control the current distribution in the HVDC grid and they can be understood as the equivalent of flexible AC transmission systems (FACTS) for HVDC grids. In the literature, several converter topologies are suggested, which are validated via simulations or experimental testing of scaled-down prototypes. However, less attention is being put on how to integrate such a device into the HVDC grid: the type of busbar arrangement, the type of required switches, such as disconnectors, bypass switches, DC breakers, etc. Additionally, the busbar arrangement must allow the insertion, bypass and grounding of the PFC converter without interrupting the HVDC grid power transmission and ensuring minimal disturbances. This work discusses different DC busbar arrangements with PFC and selects a circuit providing good availability, moderate cost and allowing insertion, bypass and grounding of the PFC. Then, the sequence of switches to insert, bypass and ground the PFC is presented and validated using simulations. The simulation results show that the proposed circuit and sequences allow to smoothly insert, bypass and ground the PFC while the HVDC grid is in operation. The device does not cause any major disturbance to the HVDC grid and can smoothly control the current distribution between the different conductors. Finally, the requirements of the external switches of the PFC are also assessed by means of the simulations, identifying the opening voltage, current and time. This work outlines that the bypass switches of the PFC have requirements in between busbar transfer switches and line transfer switches, but much lower than DC breakers and also lower than other already implemented switches, such as the metallic return transfer breaker (MRTB). The other switches of the PFC busbar arrangement are expected to be in the range of DC disconnectors (excluding the necessary DC breakers according to the protection strategy of the HVDC grid). Thus, the realization of the busbar arrangement becomes technically feasible.

INTRODUCTION

High voltage direct current (HVDC) grids can facilitate the integration of distant renewable power sources. They can increase the flexibility and redundancy of the electrical system, but they also bring challenges regarding their operation and control [START_REF] Van Hertem | HVDC Grids: For Offshore and Supergrid of the Future[END_REF]. Since the founding works on HVDC grid feasibility, presented in Cigré technical brochure 533, much progress has been done. The first multi-terminal HVDC systems are in operation in China and other such systems are likely to be developed in Europe, probably in the North Sea to integrate the offshore wind power [START_REF] Amprion | Amprion connects climate protection by innovation[END_REF]. Also, the first meshed HVDC system has already been commissioned in China, the Zhangbei grid with initially 4-terminals, but to be upgraded with 3 more terminal stations in the following phases of the project [START_REF] Buigues | Present and future multiterminal HVDC systems: current status and forthcoming[END_REF].

Several evolutions for those HVDC projects are possible during their lifetime: new terminals can be added; new conductors (overhead lines or cables) can be also added (potentially changing the system configuration from radial to meshed); the system can also operate in N-1 configuration after a contingency, etc. In those cases, congestions can occur since the initial design and sizing of the system elements may not account for the evolutions and the corresponding increase in power transmission. In meshed HVDC systems, there is more than one path to transmit power from one terminal to another. The converter stations at the nodes can regulate the power flow at node level but they are not able to control independently the DC currents circulating inside the mesh, through the different DC conductors. The current distribution through those conductors depends on the conductor resistance relation [START_REF] Veilleux | Power flow analysis in multi-terminal HVDC grid[END_REF]. Then, a conductor between two terminals can become overloaded while other paths between the same terminals exist and are underused. Since this cannot be solved by the converter stations, power curtailments or the upgrade of the conductors with larger cross-sections may be required.

As an alternative approach, several papers in the literature proposed to use power electronic converters to manage the current distribution in HVDC meshed systems. These converters are named power flow controllers (PFC) or current flow controllers (CFC) and they can be seen as the equivalent of flexible AC transmission systems (FACTS) for DC grids [START_REF] Gomis-Bellmunt | Flexible Converters for Meshed HVDC Grids: From Flexible AC Transmission Systems (FACTS) to Flexible DC Grids[END_REF]. By inserting voltages in series with the conductors, the PFCs modify the current circulating through the conductors where they are connected. This way, additional degrees of freedom are provided to the transmission system operator (TSO) of the HVDC system. Among the proposed solutions, the most promising family of PFCs consists in DC/DC converters connected at a node of the grid, inserting voltages in series with two or more conductors. In the literature, several topologies have been presented with different levels of complexity and performance. Those PFCs are normally introduced with electric diagrams illustrating their control and operation, which are sometimes validated through simulations or in scaled-down prototypes tested in laboratory [START_REF] Barker | A current flow controller for use in HVDC grids[END_REF]. No full-power prototype has been built to the knowledge of the authors. However, some works have provided a preliminary sizing of a PFC, based on the converter specifications for certain case study [START_REF] Sau-Bassols | Methodology to obtain the specifications and perform the sizing of a power flow controller for meshed HVDC grids[END_REF]. The work in [START_REF] Sau-Bassols | Methodology to obtain the specifications and perform the sizing of a power flow controller for meshed HVDC grids[END_REF] shows that the required PFC for a HVDC grid of ±500 kV and currents up to 3 kA is a medium voltage converter that must insert voltages in the order of just several kV, although being insulated from ground for the high voltage. Complementary works have also analyzed the technical feasibility of such a converter, taking into account points such as the protection of the device, the cooling management, powering of the semiconductors at high voltage, among others [START_REF] Sau-Bassols | Technical feasibility of Power Flow Controllers for HVDC grids[END_REF]. Nevertheless, less attention is put into how to integrate those PFCs in the DC switchyard of the converter station. Usually, the works deal with the power electronics circuit but do not consider the required busbar arrangement, DC breakers, bypass switches, disconnectors, etc. to properly integrate the PFC.

On the one hand, a fault at a node of the HVDC grid can have major consequences, thus, the design of the switchyard at the node needs particular attention. Several solutions are possible [START_REF] Torres | Busbar Configurations for HVDC Grids[END_REF]: using different types of switches, such as disconnectors, transfer switches, breakers, etc.; different busbar arrangements, such as single busbars, double busbars, one and a half breaker arrangement, etc. Fig. 1 and Fig. 2 illustrate two typical busbar arrangements, a single busbar single breaker and a double busbar single breaker, respectively. In case a fault in a busbar, considering a single busbar (see Fig. 1), the power exchange between the 3 terminals is totally stopped with the corresponding consequences that this can have for the system. Considering a double busbar (see Fig. 2), after a fault in one of the busbars, it is still possible to reconfigure the switches and resume the service between the different terminals using the other busbar. In the end, the choice between busbar arrangements is done according to availability and cost objectives bearing in mind the protection strategy of the HVDC grid. As the PFC is connected to a node, it is necessary to think of those aspects when integrating the device into the system. A fault in the PFC should not compromise the operation of the rest of the HVDC grid. On the other hand, during the HVDC grid operation, it is likely that the PFC will not be permanently needed. Switches are then required to bypass and insert the power converter into the system without any grid shutdown. Besides, the PFC insertion and bypass, while the HVDC system is in operation, must be smoothly conducted, without disturbances in the HVDC grid. During PFC maintenance operations, the integration circuit must allow the grounding of the device without disturbing the network operation.

The purpose of this paper is to propose a busbar arrangement circuit providing good availability, moderate cost and allowing insertion, bypass and grounding of the PFC, while the rest of the system is in operation. Different busbar arrangements with a PFC are first analyzed, and two options are then selected, one of them inspired in a single busbar and another one in a double busbar. Then, the circuit inspired in a single busbar with the PFC is analyzed in detail. Its sequence of operation is defined, illustrating the switching pattern to insert, bypass and ground the PFC ensuring minimum disturbances in the HVDC network. The previous sequences are validated using simulations in EMTP and they also allow to assess the voltage, current and time requirements for the needed switches considering a certain case study. Depending on the configuration and the sequence of operations, there are cases where some switches should be able to open the circuit when the current flowing through them is null. In other cases, there is a low-impedance path in parallel with a switch which is opened when its current is at the rated value. The previous analysis provides the requirements for the switches of the selected busbar arrangement with PFC.

BUSBAR ARRANGEMENT WITH PFC

Overview of busbar arrangements with PFC

Several publications deal with possible busbars for HVDC grids, trying to minimize the requirement of HVDC breakers due to their high cost [START_REF] Torres | Busbar Configurations for HVDC Grids[END_REF]. Those busbars are inspired in the arrangements used in AC, with many options being possible: single busbar single breaker, double busbar single breaker, one and a half breaker, double busbar double breaker, etc. When integrating the PFC into the HVDC grid, the choice of the busbar arrangement is not straightforward, and the number and type of switches depends on the expected availability in case of faults, cost objectives and the general protection strategy of the HVDC grid. This work considers the single busbar and the double busbar scheme as a base to propose busbar arrangements with PFC. In those arrangements, the PFC replaces one of the busbars or is added as an additional PFC-busbar, with different configurations of switches. Busbar arrangements having 3 terminals are considered (for example, an MMC and 2 OHLs). To simplify the analysis, the number and disposition of HVDC circuit breakers is defined by establishing a minimum availability of the circuit when having faults in different points: For single busbar arrangements, it is defined that a fault in the busbar may stop the power transmission between the different terminals. For double busbar arrangements, it is defined that a fault in one of the busbars may temporally stop the power transmission between the different terminals, but after a switch reconfiguration, the power transmission can be resumed. And for both types of busbars, it is defined that a fault in one of the terminals must be isolated without stopping the power transmission between the other terminals.

Based on the previous points, a DC circuit breaker in each terminal (3 in total) is considered for the following busbar arrangements with PFC. The rest of the switches in the different busbar arrangement options are expected to go from disconnectors to line transfer switches, in terms of requirements, but without current breaking capability. The analysed options are illustrated in Fig. 3. For each of the previous options, it is assessed if it is possible to resume the power transmission after a fault in the MMC, OHL 1, OHL 2, PFC and busbars, by rearranging the internal switches (assuming the switches in contact with the CB that opens the fault will open as well). Also, for each type of fault, the number of paths that the circuit provides is identified. Table I shows the previous analysis for the busbar arrangement in Option 2 as an example. A summary of the results of all the options is given in Table II.

Option 1 and 2 are inspired in single busbars, with option 2 having one more switch than option 1. They both provide a path for the power transmission when there is a fault in the MMC, OHL 1 or OHL 2. However, if a fault happens in the PFC in option 1, there is no possibility to resume the power transfer. While for option 2, the circuit provides 3 paths for that situation. Even considering a single busbar philosophy, since the PFC is a new element (with a robustness to be proven) to be introduced into the system, it seems reasonable in terms of a risk/reliability assessment to choose option 2 before option 1. This way, a fault in the PFC still allows to transmit power. Option 2 is the busbar arrangement that is used in the following sections to introduce the sequence of insertion, bypass and grounding. Regarding the other options, inspired from double busbars, option 3 is discarded since it provides low redundancy for a double busbar. A fault in busbar 1 implies to compulsorily use the PFC path to transmit power, even if the device is not necessary (increasing the losses of the system). Option 4 is also discarded, despite providing a lot of redundancy (many paths), since it is also the option with more switches and busbars. Finally, option 5 and 6 offer similar performances and the same number of switches. Option 5 has more redundancy when a fault happens in the MMC, while option 6 has more redundancy for PFCs faults. Following the previous argument, option 6 is chosen because it provides more redundancy for PFC faults (considering the lack of return of experience regarding the robustness of this device), but the consideration of other aspects could lead to also select option 5.

Selected busbar arrangement

Option 2 has been selected in the previous section as a trade-off between simplicity and performance. Fig. 4 depicts the selected busbar arrangement including the grounding switches and the power electronic circuit of the PFC. The PFC topology considered in this study is the circuit proposed in [START_REF] Touré | Power flow control device for controlling the distribution of currents in a mesh network[END_REF], whose sizing was done in [START_REF] Sau-Bassols | Methodology to obtain the specifications and perform the sizing of a power flow controller for meshed HVDC grids[END_REF].

It is a unidirectional PFC converter with two interleaved branches. The current enters through S1 and goes out through S4 and S5. By acting on the duty cycle to the transistors T1 and T2 (shifted a half of the period), the capacitor voltages are controlled, and the device can increase the current going to OHL 1 and reduce the current going to OHL 2 (with respect to the current values without PFC).

SEQUENCE OF OPERATION

In this section, the procedure to insert, bypass and ground the PFC is illustrated. The following subsections detail the sequence of switches that must be opened and closed. As mentioned before, the busbar arrangement to consider is the one depicted in Fig. 4. It must be noted that the sequences introduced in this section represent a possibility among several to achieve a smooth insertion, bypass and grounding, thus, other approaches could be also considered. In the following figures, the blue ellipses represent closed switches; the red ellipses, open switches; the green ellipses, that the switch can be open or closed; and the yellow ellipses, the semiconductors switching.

Insertion sequence

Fig. 5 to Fig. 10 present the steps to smoothly insert the PFC into the HVDC grid. It is considered that the HVDC grid is exchanging power at the moment of the PFC insertion (current direction given by the red arrows). Initially, at step 1, the PFC is grounded and the bypass switches, S2 and S3, are closed, allowing the power transmission through the circuit. In step 2, the grounding switches open and then, in step 3, S1, S4, S5 close, connecting the PFC to the high potential. At this moment, the current through the PFC is almost 0 since it represents a higher impedance path compared to the bypass switches. At step 4, S2 opens, switching the current into the PFC. Since S2 has to switch the nominal current to a parallel path, the requirements are checked in the next section. The current at this point circulates through two paths: S3 and through the LC circuit and the PFC diodes, resulting in an oscillatory behaviour. Then, in step 5, the S3 opens, switching the current into the PFC. It is important to ensure a path for the current of OHL 2 after opening S3, otherwise, the current will charge the capacitor C3 until it stops the current going to OHL 2. To avoid that, in step 6, the IGBTs start to switch (this could be done at the same time than opening S3). In order to smoothly start the operation of the PFC, a duty cycle that corresponds to the initial current relation between the currents of OHL 1 and OHL 2 is used. By doing this, the PFC does not modify the HVDC grid currents and the capacitors maintain a low voltage. Once in operation, the PFC can be controlled by changing the duty cycle or changing the setpoint of the corresponding current loop [START_REF] Sau-Bassols | Methodology to obtain the specifications and perform the sizing of a power flow controller for meshed HVDC grids[END_REF].

Bypass and grounding sequence

Fig. 11 to Fig. 16 show the steps to bypass, isolate and ground the PFC. At the starting of the sequence, the PFC is controlling the current with a certain duty cycle as in the scheme shown in Fig. 11 (step 1). The first step consists in applying the duty cycle equivalent to the relation between currents OHL 1 and OHL 2 when the PFC is bypassed, to discharge the PFC capacitors. By doing this, the PFC is switching, but it is not modifying the natural current distribution. Then, S2 closes while the voltage across capacitor C1 is very low. At step 3, S3 also closes and now the current is redirected from the PFC to the bypass switches S2 and S3, with a much lower impedance. Then, with most of the current circulating through the bypass switches, S1 opens with a current close to 0. Consequently, at step 4, S4 and S5 can open with null current and the PFC gets isolated from the high voltage potential. Finally, the grounding switches close and bring the PFC at ground potential in step 6.

CASE STUDY

The case study considers the Zhangbei HVDC grid in China [START_REF] Tang | Research on Key Technology and Equipment for Zhangbei 500 kV DC Grid[END_REF] to test the insertion and bypass sequence introduced in the previous section. The power electronic circuit of the PFC is the result of the sizing process explained in [START_REF] Sau-Bassols | Methodology to obtain the specifications and perform the sizing of a power flow controller for meshed HVDC grids[END_REF]. Fig. 17 presents the HVDC grid and the location of the PFC with the power values being exchanged in each station. The model of the PFC and the HVDC grid that is used for the insertion sequence is depicted in Fig. 18. Notice that for the bypass switches S2 and S3, a switch model implementing the effect of the arc behaviour when opening the switch is considered. For the bypass sequence, S2 and S3 are replaced by ideal switches and S1 is implemented with the previous switch arc model. The model also considers contact resistances (R=0.001 Ω) and stray inductances (L=1 µH) between the switches and the PFC circuit to assess the effect on the switches' requirements.

Insertion sequence results

The simulation results of the insertion sequence are shown in Fig. 19 and Fig. 20. The simulations start at step 3 (see Fig. 7) with the PFC bypassed. At t=1.6 s, S2 opens, switching the current into the LC circuit of the PFC. After, at t=2 s, S3 opens and at the same time a duty cycle corresponding to the current relation is sent to the IGBTs. It can be seen that the voltages of the capacitors are kept at a low value after a short transient and the grid currents are not modified. Then, at t=3 s, the duty cycle is ramped down from 0.5305 to 0.45, modifying accordingly the grid currents. It is possible to notice that the capacitors charge to apply this change. During the insertion process the node powers are kept constant and the node voltages suffer only small oscillations in the order of some kV.

Bypass sequence results

The simulation results of the bypass sequence are shown in Fig. 21 and Fig. 22. The simulations start at step 1 (see Fig. 11) with the PFC applying a duty cycle equal to 0.45 with the capacitors charged and modifying the grid current distribution. At t=3.5 s, the duty cycle is ramped up until 0.5305 (corresponding to the natural current distribution). It is possible to see that by doing this, the capacitors discharge and the current distribution is modified. S2 and S3 are closed at t=4.6 s and t=5 s, respectively. After t=5 s, the current is switched from the PFC to the bypass switches (S2 and S3) since it provides a very low impedance path. With almost 0 current, S1 opens at t=5.7 s, bypassing completely the PFC (notice that the opening of S4 and S5 will be done at 0 current after opening S1 and they are not included in the simulation). Then the current flows entirely through the bypass switches and the PFC can now be grounded after opening S4 and S5.

Requirements of switches

This section shows in detail the current and voltage values when opening the external switches of the PFC, to assess what type of switches are required. Fig. 23 presents the current and voltage at the instant of the opening for switches S2 (first column), S3 (second column) and S1 (third column). The first two columns of graphics correspond to the insertion sequence, while the third one corresponds to the bypass sequence. On the one hand, for both S2 and S3, in the instant of opening during the insertion sequence, the current to be switched is in the order of 1.2-1.3 kA. The opening takes around 20 ms and during this time the voltage across the switch is in the order of 80 V. On the other hand, S1 opens a current lower than 0.1 A, with a very small voltage applied on it, less than 1 V. Based on this, S2 and S3 have requirements in between transfer line switches and transfer busbar switches. Consequently, their constraints are much lower than DC breakers. There exist switches in already built HVDC projects, such as the metallic return transfer breaker (MRTB), that have higher specifications, meaning that the technical feasibility of these bypass switches is not questionable [START_REF]34 CIGRE[END_REF]. Regarding S1, the low requirements allow to implement the previous switch as a disconnector since the current and voltage are very low. The rest of the switches of the busbar arrangements do not seem to imply higher requirements, since S4 and S5 will open when the current is already 0. S6 is not used in the previous sequences, it is required when a fault on the MMC happens and the system needs to be reconfigured to provide a new path between OHL 1 and 2. Since it is not used during normal operation, the constraints and sizing of this switch should come from protection studies [START_REF] Poullain | System comprising a power flow control device used to control the distribution of currents in a grid network and means for protecting said device[END_REF], in which the S6 operation is included in the corresponding sequence.

CONCLUSIONS

This work has introduced the concept of integrating a PFC into the DC switchyard of a converter station. Different busbar arrangements with their corresponding switches have been discussed and a circuit providing good availability, moderate number of switches and the capability to insert, bypass and ground the PFC has been selected. The paper has outlined the sequence of switches to be opened and closed to insert, bypass and ground the PFC. The simulation results show that the proposed sequence provides a smooth insertion and bypass of the PFC without disturbing the power exchanges within the HVDC grid. Additionally, the simulation results also provide the requirements for the external switches of the PFC. It has been seen that the bypass switches have significant constraints, but they are below the requirements of already used switches in the HVDC projects, meaning that their feasibility is not questionable. The requirements of the other switches in the busbar arrangement are expected to be much lower. Then, this work confirms that the PFC can be inserted, bypassed and grounded without disturbing the power transmission in the HVDC grid, using switches technically feasible during normal operation. Further work should analyze the system under abnormal conditions, such as faults, to obtain the PFC constraints in terms of protection.

Fig. 1 .

 1 Fig. 1. Single busbar single breaker arrangement to connect a modular multilevel converter (MMC) with two overhead lines (OHL). Fig. 2. Double busbar single breaker arrangement to connect an MMC with two OHL.

Fig. 3 .

 3 Fig. 3. Busbar arrangement options with PFC.

Fig. 4 .

 4 Fig. 4. Selected busbar arrangement with the chosen PFC converter.

Fig. 5 .Fig. 6 .Fig. 7 .Fig. 8 .Fig. 9 .

 56789 Fig. 5. Insertion sequence: step 1. PFC bypassed and grounded. Fig. 6. Insertion sequence: step 2. PFC ungrounded.

Fig. 11 .Fig. 13 .

 1113 Fig. 11. Insertion sequence: step 1. PFC in operation. Fig. 12. Bypass sequence: step 2. S2 closed.

Fig. 17 .

 17 Fig. 17. Zhangbei HVDC grid with the PFC installed in station 3. Fig. 18. Model of the PFC and HVDC during the insertion sequence in EMTP.

Fig. 19 .

 19 Fig. 19. Insertion sequence simulation results. Fig. 20. Insertion sequence simulation results.

Fig. 21

 21 Fig. 21 Bypass sequence simulation results. Fig. 22. Bypass sequence simulation results.

Fig. 23 .

 23 Fig. 23. Voltage and current values across the switches S2, S3 and S1 during their opening.

Table I .

 I Fault analysis and possible paths to resume the power transmission for Option 2.

	Faults	Switches	Comments
	MMC	S 1 S 2 S 3 S 4 S 5 open / S 6 closed	1 path
	OHL 1	S 1 S 2 S 4 S 5 S 6 open / S 3 closed	1 path
	OHL 2	S 1 S 3 S 4 S 5 S 6 open / S 2 closed	1 path
		S 1 S 4 S 5 open / S 2 S 6 closed / S 3 DM
	PFC	S 1 S 4 S 5 open / S 3 S 6 closed / S 2 DM	3 paths PPC
		S 1 S 4 S 5 open / S 2 S 3 closed / S 6 DM
	PPC: Possible power curtailment since the PFC cannot be used. DM: Does not matter.

Table II .

 II Summary of the fault analysis and possible paths to resume power transmission for the different options.

	Faults/switches	Op. 1	Op. 2	Op. 3	Op. 4	Op. 5	Op. 6
	MMC	1 path	1 path	1 path	2 paths	2 paths	1 path
	OHL 1	1 path	1 path	1 path	2 paths	2 paths	2 paths
	OHL 2	1 path	1 path	1 path	2 paths	2 paths	2 paths
	PFC	No path	3 paths PPC	1 path PPC	4 paths PPC	1 path PPC	4 paths PPC
	Busbar 1	-	-	1 path with PFC	2 paths (w/o PFC)	2 paths (w/o PFC)	2 paths (w/o PFC)
	Busbar 2	-	-	-	2 paths	-	-
	N° switches	5	6	6	9	8	8

ACKNOWLEDGMENTS

This work was supported by a grant overseen by the French National Research Agency (ANR) as part of the "Investissements d'Avenir" Program ANE-ITE-002-01.

BIBLIOGRAPHY


Gerben Van Der Hoek
email: g.vanderhoek@uu.nl

Evaluating digital student work through model backtracking

Keywords: Digital assessment, Intelligent Tutoring System, Model tracing

Designing a digital assessment system for mathematics brings along a number of challenges, such as creating an intuitive interface or providing the right feedback. We investigate how these challenges are met in different methods for evaluating digital student work. After done so, we formulate an idea for a new approach: model backtracking. That is, retracing students' calculations through their final or intermediate answers. We explain the mathematical principle behind model backtracking and conclude that the method is promising, despite its limitations. Finally, we hypothesize about possible ways of meeting design challenges using model backtracking and provide recommendations for further research.

Introduction

Digitally assessing mathematics has become increasingly important in the field, since there are many different applications that can lead to increased potential for student learning and summative assessment as well as didactical insight in students' problem-solving behavior. When designing a digital assessment system, a number of challenges needs to be overcome. In this paper we formulate a new approach for evaluating digital mathematical student work, that may help to overcome such challenges: model backtracking (MBT). With this technique, the model the student employs is derived from the final or intermediate answers. The aim of this paper is to explain the idea behind MBT and hypothesize about possible applications, this paper is therefore purely theoretical.

Although MBT could be used in summative settings, in this paper we mainly focus on the applications of MBT in formative settings. We single out intelligent tutoring systems (ITSs) to discuss in detail and outline the general structure of ITSs. We then proceed to investigate feedback and relate specific feedback to the granularity of the student input. We elaborate on various challenges that arise when designing ITSs. The principles behind MBT are explained and we proceed to hypothesize on how MBT may help to overcome design challenges. After done so we discuss the limitations of MBT and give suggestions for further research. Since MBT is still very much in a developmental stage, the results in this paper are of a hypothetical nature, indicating which design difficulties could be overcome using MBT.

Intelligent tutoring systems

ITS can guide the learning process by providing students with feedback. There are essentially two types of feedback: inner loop feedback which focusses on in-task guidance, and outer loop feedback which guides the learning process over several tasks [START_REF] Santos | Interoperable intelligent tutoring systems as open educational resources[END_REF][START_REF] Vanlehn | The Behavior of tutoring systems[END_REF]. Inner loop feedback can provide appropriate hints if a student fails to make a correct step or is unable to successfully complete the task [START_REF] Heeren | Feedback services for stepwise exercises[END_REF]. Outer loop feedback can include an indication of the degree of mastery of different learning goals, based on a student model covering the domain. From such a model a suggestion on the next task to be completed by the student can be provided adaptively [START_REF] Heeren | Fine-Grained Cognitive Assessment Based on Free-Form Input for Math Story Problems[END_REF].

Generally, ITSs consist of four modules [START_REF] Nwana | Intelligent tutoring systems: an overview[END_REF], as Figure 1 illustrates. The user interface module is used for communication between the system and the student. It is an important part of the ITS since the way in which information is displayed can affect, for instance, the willingness of the student to work with the ITS. The user interface module communicates directly with the tutoring module; this module is also known as the pedagogical module, it can make educational decisions such as suggesting the next tasks best suited for the student or how much and what type of feedback to provide. The tutoring module draws on the student model module which contains information about the knowledge of the student. This knowledge is often represented as a subset of the expert knowledge in the expert knowledge module [START_REF] Brusilovsky | User Models for Adaptive Hypermedia and Adaptive Educational Systems[END_REF]. The expert knowledge module contains rules governing the way objects in a domain may be manipulated. It also contains so-called buggy rules. These rules model well known student errors within the domain. Currently, there are two approaches to evaluating student input: model tracing [START_REF] Anderson | Cognitive Tutors: Lessons Learned[END_REF] and constraint-based modelling [START_REF] Mitrovic | Intelligent tutors for all: The constraint-based approach[END_REF]. In a model tracing approach, a step in the user input is compared to an expert solution for the problem. If a step deviates from the expert model, a buggy rule can be applied to check which specific error occurred. In constraint-based modelling the input is evaluated using two conditions: a relevance condition and a satisfaction condition. If a relevance condition of the error applies, then the satisfaction condition also needs to be satisfied to flag the error.

Feedback

Both [START_REF] Shute | Focus on formative feedback[END_REF] and [START_REF] Narciss | Feedback strategies for interactive learning tasks[END_REF] studied literature on feedback, in this section we compare both studies with regard to specific errors. In both papers we find evidence that specific student errors need to be known in order to provide meaningful feedback. Both authors give a definition of feedback:

Formative feedback is information communicated to the learner that is intended to modify his or her thinking or behavior for the purpose of improving learning. (Shute) Feedback in instructional contexts is all the post response information that is provided to a learner to inform the learner on his or her actual state of learning. (Narciss) In both definitions feedback is information provided with the intent of informing the learner on the state of learning. Where Shute takes it one step further by demanding that the purpose of feedback is to modify behavior to improve learning. How may learning be improved by communicating information on the actual state of learning? Shute argues that a factor inhibiting learning is uncertainty. Since uncertainty is an unpleasant state that needs to be reduced it induces a cognitive load that could distract attention from actual task completion. Feedback could reduce this uncertainty; however, feedback can also serve the function of informing the learner on possible solving strategies or mistakes. To accomplish this, the feedback needs to be specific [START_REF] Shute | Focus on formative feedback[END_REF] or equivalently: elaborate [START_REF] Narciss | Feedback strategies for interactive learning tasks[END_REF], although, the feedback should not contain the actual solution. Both Shute and Narciss support the claim that specific feedback leads to better learning outcome than feedback only on the correctness of answers. Narciss formulates five cognitive functions for feedback four of which require the specific error to be known. According to Narciss, a key issue is: how well a learning medium (i.e. teacher or ITS) is able to transform a discrepancy between the current state of learning and the required state into feedback that contains relevant information to mastering the requirements. The performance of a learning medium in this respect increases if it is more able to identify specific errors.

Granularity [START_REF] Vanlehn | The Behavior of tutoring systems[END_REF] of the student input plays an important role in digitally assessing students reasoning. The granularity can range from students inputting every aspect of their reasoning to inputting only the final answer. When there is less information available the difficulty of correctly assessing student reasoning increases. Typically, ITSs require that students input every step of their calculation in order to detect specific errors and provide specific feedback in the sense of [START_REF] Shute | Focus on formative feedback[END_REF] and [START_REF] Narciss | Feedback strategies for interactive learning tasks[END_REF]. [START_REF] Drijvers | Digital assessment of mathematics: Opportunities, issues and criteria[END_REF] stipulates that a task shouldn't be essentially altered to accommodate a digital environment. However, inputting every step, in comparison to just calculating steps using pencil and paper, forms an additional requirement for completing a task. Furthermore, inputting every step could be cumbersome and might discourage students from working with ITSs.

Challenges

When designing ITSs there are certain factors that need to be considered.

Interface

One needs to avoid that proficiency in editing mathematical text digitally is required [START_REF] Drijvers | Digital assessment of mathematics: Opportunities, issues and criteria[END_REF]. [START_REF] Heeren | Fine-Grained Cognitive Assessment Based on Free-Form Input for Math Story Problems[END_REF] deal with this problem by allowing all kinds of input, even textual or mathematically nonsensical. The drawback however is that it is very difficult to evaluate such input to a high degree of accuracy.

Stepwise evaluation

When dealing with tasks concerning equivalent expressions, such as solving equations and simplifying algebraic expressions, often assessment systems require stepwise input. For example, Heeren and Jeuring (2014) describe such a system. Through such a system the required feedback can be provided with a high level of expediency if all the steps are inputted. Although inputting each step separately in the environment can be quite time consuming. Additionally, step by step input isn't feasible on devices with small screens such as smartphones, making this technology less accessible.

Granularity

The granularity of the expected student input concerns the step size of the input by the student. If the student skips a few steps the assessment system was expecting, the efficiency of diagnosing possible errors drops. In the ASSISTment system [START_REF] Feng | Addressing the assessment challenge with an online system that tutors as it assesses[END_REF] this problem is solved by asking additional questions to the student. However, in a summative setting there is a risk that these questions give away part of the solution.

Non-stepwise evaluation

Some tasks consist of the calculation of several different non-equivalent components such as for instance, linear extrapolation where first the average change is computed before computing a future value. Since stepwise evaluation generally evaluates equivalency of steps it is not applicable here. One way to deal with this problem is to ask the student to input each of the different components of the calculation. The drawback however, is that this gives away part of the structure of the calculation. [START_REF] Tacoma | Automated Feedback on the Structure of Hypothesis Tests[END_REF] solve this problem by letting the student select the next step from a dropdown menu before performing the actual calculation. However, this only partly solves the problem since the menu only contains steps necessary to perform the required computation.

The general idea of model backtracking

We propose to retrace the students' computation from the final answer. There will be obvious limitations to this method, however many of the problems mentioned above could be solved for certain classes of digital assessment environments.

Consider the task of computing the derivative of 𝑓(𝑥) = (3𝑥 + 2) 3 , if the student arrives at the answer 𝑓′(𝑥) = 3 • (3𝑥 + 2) 2 it is unclear if the student forgot to multiply with the exponent 3, or if the student forgot to apply the chain rule. In this example these two errors are indistinguishable. However, when computing the derivative of 𝑓(𝑥) = (3𝑥 + 2) 5 these errors are in fact distinguishable since they lead to different answers. So, when implementing a task for computing derivatives of functions of the type: 𝑓(𝑥) = (𝑝 1 𝑥 + 𝑝 2 ) 𝑝 3 one should choose the parameters such that 𝑝 1 ≠ 𝑝 3 .

The idea behind model backtracking is to design tasks in ITSs with parameters that make it possible to distinguish different errors. Along with a structure in the expert model module as a tree containing all possible paths of errors through the steps of the task given the predetermined buggy rules. When certain conditions are satisfied one can retrace a student error by means of just the final answer. Of course, model backtracking can also be used for evaluating intermediate steps in a computation.

One immediately notices that not all tasks can be designed using MBT (since there are restrictions on the initial values of the task), for instance not all real-world tasks can be modelled using MBT. However, MBT works well on tasks that draw on random parameters, these parameters can simply be restricted to a domain that makes backtracking possible.

The mathematics of MBT: an example

In this section we will describe how model backtracking works, doing so we will formulate certain definitions that can be extended to more general settings. We start out by defining what we mean by a computational task. We proceed to show how, in this setting, buggy rules can be represented by functions and that various errors are comprised of compositions of these functions. We then find sufficient conditions for determining the path, that is, which composition of functions, the student used to arrive at a certain answer. When the path is known, appropriate feedback can be given to the student.

A computational task is the pair (Ω, 𝐹) where Ω ⊆ ℝ 𝑛 is called the parameter space and 𝐹: Ω ⟶ ℝ 𝑚 is called the computation. An element (𝑝 1 , 𝑝 2 , ⋯ , 𝑝 𝑛 ) ∈ Ω represents the given parameters in the task.

Given the table

𝑡 … 𝑡 1 … 𝑡 2 … 𝑁 … 𝑁 1 … 𝑁 2 …
Assume 𝑁 depends on 𝑡 exponentially.

Compute the growth factor per unit of 𝑡. This task is a computational task with Ω = {(𝑡 1 , 𝑡 2 , 𝑁 1 , 𝑁 2 ) ∈ ℝ 4 | 𝑡 1 < 𝑡 2 , 𝑁 1 ≠ 𝑁 2 } and

𝐹(𝑡 1 , 𝑡 2 , 𝑁 1 , 𝑁 2 ) = ( 𝑁 2 𝑁 1 ) 1 𝑡 2 -𝑡 1
On didactical bases we can distinguish between two steps in this calculation:

Step 1: Computing the growth factor for [𝑡 1 , 𝑡 2 ]:

𝑓 1 (𝑡 1 , 𝑡 2 , 𝑁 1 , 𝑁 2 ): = (𝑡 1 , 𝑡 2 , 𝑁 2 𝑁 1

)

Step 2: Computing the growth factor per unit of time:

𝑓 2 (𝑡 1 , 𝑡 2 , 𝑥): = 𝑥 1 𝑡 2 -𝑡 1
We see that:

𝐹 = 𝑓 2 ∘ 𝑓 1
In each of the two steps we can now introduce buggy rules for errors in the steps, the compositions of these rules represent different calculations by the student: (24,28,8,16) backtracking the student error isn't possible. We wish to avoid this.

𝐸 1 : = {𝑒 1 1 , 𝑒 2 1 ,
Having the entries in 𝑀 ̅ differ can be characterized by the following equivalent statement:

For fixed 𝑝 ∈ Ω we define the function:

𝑀 𝑝 : {1,2,3} × {1,2,3} ⟶ ℝ 𝑀 𝑝 (𝑖, 𝑗): = 𝑀 ̅ 𝑖,𝑗 (𝑝)

Then 𝑀 𝑝 needs to be injective.

For the computational task, we only select parameters from: 𝑅𝑆 ≔ {𝑝 ∈ Ω|𝑀 𝑝 is injective}. This ensures that we will be able to backtrack the students' computation. These definitions can be generalized to tasks with more than two steps. And depending on the structure of the ITS1 one can find relaxations on the injectivity condition allowing for a wider selection of possible parameters.

The definition of a computational task as the pair (Ω, 𝐹) where Ω ⊆ ℝ 𝑛 and 𝐹: Ω ⟶ ℝ 𝑚 seems to exclude tasks involving computations done on functions. However, when the class of functions is known, these functions may often be expressed in terms of their parameters. Therefore, MBT can also be used to develop ITSs involving functions and algebraic expressions. Arguably MBT can even be used for evaluating formulae derived from geometrical representations.

Figure 1 :

 1 Figure 1: structure of ITSs from Heeren & Jeuring, 2014, p.112, with permission

Figure 2 :

 2 Figure 2: computational task on computing a growth factor from a table

  Above we see all the entries of 𝑀 ̅ are different, which means the steps through the various errors are uniquely determined by the outcome; whereas below we see that various entries of 𝑀 ̅ have the same value. So, for 𝑝 =

	𝐸 2 : = {𝑒 1 2 , 𝑒 2 2 , 𝑒 3 2 } denotes the set of rules for the second step where: 𝑒 1 2 : = 𝑓 2 and 𝑒 2 2 and 𝑒 3 2 are buggy
	rules defined by:
	Dividing by elapsed time:		𝑒 2 2 (𝑡 1 , 𝑡 2 , 𝑥): =	𝑥 𝑡 2 -𝑡 1
	Forgetting to recalculate for time:	𝑒 3 1 (𝑡 1 , 𝑡 2 , 𝑥): = 𝑥
	Now for fixed 𝑝 ∈ Ω we look at the 3 × 3 matrix 𝑀 ̅ (𝑝) with entries: 𝑀 ̅ 𝑖,𝑗 : = 𝑒 𝑗 2 ∘ 𝑒 𝑖 1 (𝑝). We can
	compare the input from the user to the entries in this matrix. For instance, if the input matches the
	entry 𝑀 ̅ 3,2 (𝑝), we know the growth factor was calculated as a slope.
	Two examples of 𝑀 ̅ (𝑝):
		1.63 2.3 11.34 𝑀 ̅ (22, 27, 29, 329) = ( 0.62 0.02 0.09 )
			3.12 60	300
		1.19 0.5 𝑀 ̅ (24, 28, 8, 16) = ( 0.84 0.13 0.5 2	)
			1.68	2	8
	𝑒 3 1 } denotes the set of rules for the first step where: 𝑒 1 1 : = 𝑓 1 and 𝑒 2 1 and 𝑒 3 1 are buggy
	rules defined by:
	Wrong time direction:	𝑒 2 1 (𝑡 1 , 𝑡 2 , 𝑁 1 , 𝑁 2 ): = (𝑡 1 , 𝑡 2 ,	𝑁 1 𝑁 2	)
	Calculating the difference: 𝑒 3 1 (𝑡 1 , 𝑡 2 , 𝑁 1 , 𝑁 2 ): = (𝑡 1 , 𝑡 2 , 𝑁 2 -𝑁 1 )

For examples of ITS with MBT see: Linear interpolation: https://www.geogebra.org/m/e5ewfude Linear equations: https://www.geogebra.org/m/rqa4w5wb

Acknowledgement

Special thanks to Paul Drijvers for all his support and writing pointers.

Possible applications of MBT

In this section we conjecture how MBT could contribute to overcome design challenges. However, currently these conjectures remain to be proven.

Interface

When working in an ITS for the first time, students often start by inputting only their final answer. Therefore, just demanding the final answer is very intuitive. With the use of MBT, feedback can be provided on the basis of just this input. A student can make a calculation using pen and paper and input only the final answer, thereby staying very close to the way mathematics is normally practiced [START_REF] Drijvers | Digital assessment of mathematics: Opportunities, issues and criteria[END_REF]. As very little input is needed ITSs can be created for small screen devices, which make ITS technology more accessible. Of course, major drawbacks are that sloppy notation isn't detected nor corrected.

Stepwise evaluation and Granularity

By adding the identity function to the set of rules at each step, MBT could also be used to inspect intermediate steps in a calculation. Where, if steps are skipped or haven't been inputted, MBT could still provide feedback. This could constitute an addition to existing systems improving error detection. MBT could be used in combination with constraint-based modelling and model tracing. This way expert knowledge modules that already exist can be employed. When a student for instance inputs step 𝑖 and then inputs step 𝑗 (> 𝑖 + 1) without inputting the intermediate steps, the parameters at step 𝑖 can be seen as starting parameters p for a computational task. The corresponding function 𝑀 𝑝 generally won't be injective however a list of possible paths can still be produced.

Non-stepwise evaluation

If the task consists of the calculation of several different non-equivalent components it is possible to let students work in a digital environment without adding any structure: an empty page. After which the computations are scanned for intermediate answers [START_REF] Heeren | Fine-Grained Cognitive Assessment Based on Free-Form Input for Math Story Problems[END_REF]. By construction the intermediate (wrong) answers differ. Therefore, it may be possible to recognize intermediate steps by just the values they produce and provide specific feedback.

Limitations and suggestions for further research

A clear drawback is that MBT can only be implemented for certain tasks since the possible parameters will be subject to constraints. Furthermore, the class of computational tasks does not contain many higher order tasks, aside from deriving expressions from geometrical representations. Further research might extend the possibilities of ITS beyond computational tasks. One of the drawbacks of the design principle of MBT is that it is very specific for the computational task. Usually ITSs make use of expert knowledge modules which contain rules for an entire mathematical domain. This way different tasks can be designed using the same set of rules [START_REF] Heeren | Feedback services for stepwise exercises[END_REF]. Perhaps MBT could also be used over entire domains, possibly in combination with existing expert knowledge modules. Currently it is unclear what the performance of error detection trough MBT is, nor is it clear if specific feedback on the final answer enhances learning. Empirical experiments will be necessary to indicate if MBT can contribute to a positive learning outcome.


Djibrilla Amadou Kountche
email: djibrilla.amadou-kountche@akka.eu

Marwan El-Bekri
email: marwane.el-bekri@akka.eu

Pedro J Fernández Ruiz
email: pedroj@um.es

José Santa
email: jose.santa@upct.es

Antonio F Gómez-Skarmeta

Joao Almeida

Qiang Tang
email: qiang.tang@list.lu

Nuno Cruz
email: ncruz@isel.ipl.pt

Pedro J Fernández

Marwane El Bekri

Pedro J Fernandez

Antonio F Skarmeta
email: skarmeta@um.es

Cybersecurity and data privacy aspects in 5G-MOBIX

Keywords: Cybersecurity, CCAM, GDPR, 5G

la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Transportation systems are becoming increasingly interconnected, even across different countries. This implies the coexistence of people and systems of unknown trustworthiness. These systems depend on the proper functioning of their sub-systems which might have serious vulnerabilities whose exploitation could cause massive disruptions. Those vulnerabilities are due to many reasons among which:

• Security requirements are not being met with sufficient warranty in the CCAM infrastructures that are available with flaws some of which are potentially serious. Vulnerabilities in the existing infrastructure and the risks that can results from them tend to be underestimated. Also, the lack of awareness of the stakeholders can result in critical problems.

• Resiliency (cyber-resiliency) of complex systems require intelligent, well-trained, and experienced workforce, especially for critical infrastructures.

• Privacy of users in a CCAM infrastructure (vehicles, roadsides, and cloud) is undermined by the data (different identifiers or quasi-identifiers) that could be harvested on them and lead to Cybersecurity and data privacy aspects in 5G-MOBIX 2 monitoring and surveillance activities. Therefore, it is desirable to minimize the information that is collected and to control strictly who has access, and also to ensure the correct identity of all individuals engaged in risky activities. Desires for privacy are generally incompatible with the desire for accountability as attempts to create completely anonymous services tend to run against practical notions of authenticity, integrity, revocability, or non-reputability. A trade-off should be found between privacy and accountability.

Security requirements (security-by-design) should be properly addressed at the early stages of the CCAM infrastructure specification in order to avoid malicious actions during the deployment and exploitation phases. Furthermore, other important aspects such as privacy (privacy-by-design), resiliency, reliability, system survivability and safety are considered at the requirement phase. Thus, it is necessary the understanding of a complete set of requirements in advance, embracing security, privacy, resiliency, safety, survivability and the interactions among them.

The next sections present the overall CCAM infrastructure designed for 5G-MOBIX and an analysis of the different security challenges in 5G-MOBIX [START_REF]H2020-ICT-18-2018 5G-MOBIX project "5G for cooperative & connected automated MOBIility on X-border corridors[END_REF] by presenting the existing security issues on each scope of the project and offering a list of good practices and requirements to be met in order to have solid security architecture and data privacy scheme 5G-MOBIX.

Overview of 5G-MOBIX CCAM architecture

This section provides a general view of 5G-MOBIX CCAM infrastructures 1 as depicted by Figure 1 with the goal to study the security risks related to its components.

Security threats and risks related to CCAM

The list of detected threats and risks is too large to expose it here completely, but a representative selection is performed below in order to make a closer idea of them in a summarized way.

• Masquerading: Ensuring the authenticity of the information received and processed by an CCAM systems involves the protection of the system from masquerade attacks that insert false messages into the network, the identification of unplanned replay of legitimate message interchanges, the exposure of false GNSS signals and the protection against illusion and Sybil attacks.

• Identification or de-identification of a vehicle owners, tracking: An attacker may construct a profile of a given vehicle by observing which services are used regularly, at what times and at which location. Such analysis might be used to gain information on private vehicles and 1 https://www.etsi.org/deliver/etsi_ts/102900_102999/102941/01.03.01_60/ts_102941v010301p.pdf enabling the performance of masquerade attacks and location linking.

• Denial of Service (DoS): DoS attacks are performed by introducing malwares or transmitting a high volume of messages (spamming, flooding, etc.). These attacks are difficult to protect against and may result in CCAM (Vehicles, Roadside and Cloud) systems failing to function properly.

• Unauthorized access: Threats to the confidentiality of information include the illicit collection of transaction data by eavesdropping and the collection of location information through the analysis of message traffic. Restricted information may be accessed and tampered with (on the different interfaces or within the CCAM systems) by means of masquerade attack or malwares leading to the compromise of the integrity of the CCAM systems.

The section 4 of deliverable D2.3 2 (Specification of roadside and cloud infrastructure and applications to support CCAM) describes in more details the security mechanisms in order to secure the 5G-MOBIX CCAM reference architecture.

5G and other networks

5G is being developed with new architectural concepts and capabilities to enable new business models and to provide enhanced applications and services to network subscribers. To ensure that 5G fulfils its promise, all security matters accompanying the 5G architecture need to be addressed. The security architecture presented here has been developed in the 5G-ENSURE project [START_REF]G-ENSURE Project home[END_REF] and can be seen as an evolution based on the existing security architectures for 3G [START_REF]Security architecture[END_REF] and 4G [START_REF]UMTS architecture[END_REF]. The basic concepts, e.g. domains and strata, remain, but have been adapted and extended to fit and cover the 5G environment.

In [START_REF]5G-ENSURE project Deliverable D2.4 "Security Architecture Draft[END_REF] and the The 5G Infrastructure Public Private Partnership (5GPPP) Phase I Security Landscape white paper [START_REF]5GPPP Phase1 Security Landscape[END_REF], the need for a new security architecture for 5G is discussed and motivated and an initial draft is presented. The work covered here, backed by the 5GPPP Security Work Group , leverages on what has been described in both documents.

The first assumption that is made about 5G security is that it must include all security already provided in pre-5G networks, and improve them if necessary, to cope with the new services and user needs. Apart of that, standardization bodies have been adding to the new 5G technology some novel concepts such us Network Function Virtualisation (NFV), Cloud Computing, Software-Defined Networking (SDN), Multi-access Edge Computing (MEC) and Network Slicing, in order to reach a full softwarised mobile network. In addition, new communication scenarios have been incorporated to the standard with different and specific requirements of QoS. Apart from the usual service of providing voice and data connectivity to mobile customers (Enhanced Mobile Broadband), Ultra-reliable and Low Latency Keeping all these new services safe and secure is a great challenge and may introduce new threats that should be addressed.

Since the adoption of IP protocol in the core network in 4G, mobile networks have inherited all the security threads and risks of IP networks and the Internet world. 5G has indeed a more difficult challenge with the addition of millions of IoT devices that will be connected, that are the perfect target to attackers in order to perform DoS and botnets attacks among others. In addition to this, 5G has to focus on the huge fleet of vehicles that circulates roads and highways and analyse the new threads and risk that this new kind of network may introduce, especially when there may be human lives at risk.

According to their new security requirements introduced by the new actors, the Next Generation Mobile Networks (NGMN) Alliance, an important organization focused on providing guidelines and recommendations about 5G, which helped in the identification of some of the most probable threats that could appear.

5G technologies Threats

5G Access

Networks

• Expected high traffic either malicious or accidental. Reduce traffic changers whenever possible and be flexible for maintaining system performance.

• Risk of key leakage between operator's links.

• Optional security implementation offers security threat.

• Subscriber device level security in 5G due to roaming routed IP traffic in 5G.

• DoS attacks:

o Exhaustion of signalling plane with several devices that gain access simultaneously.

o Exhaustion of signalling plane with several simultaneously and intermittently data transfer devices.

o Stopping services for several devices due to traffic overload is sometimes a trick by an attacker.

• Bulk configuration leading to bulk provisioning.

VNF

• Inter-operability issues. Different VNF providers.

• DoS / DDoS attacks • MEC applications run on the same platform of network function. A new framework for either providing access to only trusted MEC devices or making MEC and network operator independent of trust.

• Influence on network by an allowed third party. Network operators must limit network distortion to a certain level.

• MEC environment user plane attacks. It is required to carefully study the scenario specially in case of a few caches and new architecture.

• Sensitive security assets on Edge. Proper encryption, assurance of security, protection of decryption keys.

• Exchange of data between Edge and Core. Encryption of the sensitive asset.

• Trust establishment between the edge and the core functions. Authentication between communication resources.

•

Slicing

• Attacks on internetwork slices communication. An attacker can disrupt the communication between slices to prevent the proper life cycle management of slices.

• Impersonation attack. An attacker can impersonate as a physical host platform to allocate unavailable resources. Moreover, an attacker can impersonate as network slice manager to steal network slice creation parameter

• Security policy mismatch. Variance of security policies and security protocols for different slices allow attackers to access the NS system and control entities via less secure slice.

• DoS attacks. An attacker performs a DoS attack either on vitalization platform or physical resources to exhaust the available network resources for other slices

• Side channel attacks. An attacker gain access to one slice and attack a set of slices which share the same primary hardware.

• Privacy attacks. Infrastructure providers or VNF suppliers steal the cross-slice user information.

• Hypervisor attacks. Perform attacks against the hypervisor to jeopardize the virtualization of resources. These attacks include, software errors in hypervisor, backdoor entry via hosting OS, DoS attacks and attacking the hardware resources

Privacy

• Personal data leaking will suppose very high fines from the GDPR law application.

• Different personal data regulations between EU members and third parties may produce problems due to the existence of non-matching security policies between them.

SDN

• Forged or faked traffic flows

• Man in the middle attacks

• Reply attacks

• DoS attacks

• Back door entrance

• Clone or deviate network traffic

• Fake switches-and controller-based attacks More details on can be found in the section 7 of the deliverable D2.2 3 (5Garchitecture and technologies for CCAM specifications).

The vehicle infrastructures

Connected and automated vehicles are today the targets of various attacks that threaten the security, safety and privacy of the drivers, passengers and other road users. These threats might have severe impacts on manufacturers and might result in a bad reputation for a research project such as 5G-MOBIX.

The protection of connected and automated vehicles depends on the protection of all the systems involved (vehicles' components, cloud infrastructure, 5G network, other networks, etc.).

This section presents the challenges residing mostly in the security of the connected and automated vehicles, where security mechanisms should be implemented in spite of the several kinds of limitations due to the very large number of interfaces to secure which might lead to conflicts between security requirements and safety requirements, planning and cost issues.

The augmented vehicles used in 5G-MOBIX integrate IoT components to bring added-value services to drivers and passengers. These components communicate with each other and with the outside world of the vehicle (other vehicles, 5G network, etc.). The section 6 of the deliverable D2.4 4 (Specification to implement.Also, good practices, intended for the trial sites, that ensure the security of the connected vehicle against cyber threats are presented in D2.4, with the particularity that connected vehicles security shall also guarantee safety. These good practices are related to Policy and standards, organizational measures, and security functions 5 .

The impact of attacks on the vehicles could have far-reaching consequences in terms of safety. The risks to the driver, their passengers and other users of the road during the trials should be managed by each trial site in the 5G-MOBIX project.

Data Privacy and the GDPR application in 5G

The European General Data Protection Regulation (GDPR) [START_REF][END_REF] is a regulation on personal data protection and privacy for all individual citizens of European Union (EU) and the European Economic Area (EEA). It is designed to harmonize all the previous existing data protection laws and replacing the directive 95/94/EC. It has been in force since May 25, 2018. Due to the coincidence in time with the development of 5G standards by the 3GPP WGs, all data protection and privacy issues has been considered from the very beginning in the development of those 5G standards. However, it is undeniable that GDPR will have a strong impact on 5G.

Vendors, operators and standardization bodies are facing the application of this restrictive law from the beginning. In general, data protection by design and by default should be increasingly adopted by standardization. Different working groups in 3GPP are currently working in close coordination with the security working group (SA WG3), designing identifiers and protocols, and specifying test cases for privacy assurance in 5G. The same is true for vendors that are implementing 5G standards and developing proprietary solutions. Vendors must have, besides data protection by design and default, privacy impact assessment built into their product development lifecycle and should advise operators about the privacy impact of new technologies. Additionally, the operators must analyse how the GDPR affects their business model and take proactive steps in achieving compliance, for example, by appointing a competent Data Protection Officer (DPO).

Companies can reduce the probability of a data breach and thus reduce the risk of fines in the future, if they choose to use encryption of personal data by default. The processing of personal data is naturally associated with a certain degree of risk. Especially nowadays, where cyber-attacks are nearly unavoidable for companies above a given size. Therefore, risk management plays an ever-larger role in IT security and data encryption is suited, among other means, for these companies. The GDPR recognizes these risks when processing personal data and places the responsibility on the controller and the processor in Art. 32 to implement appropriate technical and organisational measures to secure personal data. This article deliberately does not define which specific technical and organisational measures are considered suitable in each case, in order to accommodate individual factors.

5 https://www.enisa.europa.eu/publications/enisa-good-practices-for-security-of-smart-cars

Cybersecurity and data privacy aspects in 5G-MOBIX 9 However, it gives the controller a catalogue of criteria to be considered when choosing methods to secure personal data. Those are the state of the art, implementation costs and the nature, scope, context and purposes of the processing. In addition to these criteria, actors always must consider the severity of the risks to the rights and freedoms of the data subject and how likely those risks could manifest. This basically boils down to the following: The higher the risks involved in the data processing and the more likely these are to manifest, the stronger the taken security measures must be and the more measures must be taken. Encryption as a concept is explicitly mentioned as one possible technical and organisational measure to secure data in the list of Art. 32 of the GDPR, which is not exhaustive. Again, the GDPR does not mention explicit encryption methods to accommodate for the fast-paced technological progress. When choosing a method, actors must also apply the criteria catalogue above.

To answer the question of what is currently considered "state of the art" DPOs usually rely on the definitions set out in information security standards like ISO/IEC 27001 or other national IT-security guidelines.

Encryption of personal data has additional benefits for controllers and/or order processors. For example, the loss of a state-of-the-art encrypted mobile storage medium which holds personal data is not necessarily considered a data breach, which must be reported to the data protection authorities. In addition, if there is a data breach, the authorities must positively consider the use of encryption in their decision on whether and what amount a fine is imposed as per Art. 83 of the GDPR.

With penalties that can reach as high as 20 million euros or 4 percent of total worldwide annual turnover, there is a huge financial risk for operators in case of potential non-compliance. There are also real risks to reputation or brand image. Therefore, operators must take the GDPR obligations very seriously, and vendors and standardization bodies must make sure that operators are able to comply with the GDPR.

Cybersecurity and data privacy aspects in 5G-MOBIX 10

Conclusion

Cybersecurity is an important aspect in software development project and especially for H2020 projects.

This paper presents the approach chosen to study the security needs in 5G-MOBIX and the proposed solutions. These solutions target the cloud, network and vehicle infrastructures and also data privacy and GDPR applications.

Figure 1

 1 Figure 1 5G-MOBIX High-level CCAM Reference architecture

  2 https://www.5g-mobix.com/assets/files/5G-MOBIX-D2.3-Specification-of-roadside-and-cloudinfrastructure-and-applications-to-support-CCAM-V2.0.pdf Cybersecurity and data privacy aspects in 5G-MOBIX 5 Communications (URLLC) and massive Machine-Type Communications (mMTC/IoT) are now considered.

3

  https://www.5g-mobix.com/assets/files/5G-MOBIX-D2.2-5G-architecture-and-technologies-for-CCAMspecifications-V1.0.pdf 4 https://www.5g-mobix.com/assets/files/5G-MOBIX-D2.4-Specification-of-Connected-and-Automated-Vehicles-V1.0.pdf Cybersecurity and data privacy aspects in 5G-MOBIX 8 of Connected and Automated Vehicles) summarizes the components of the vehicles used in 5G-MOBIX trial sites as well as the corresponding threats, risks, mitigation factors and possible security measures


Rosemary Fayjaloun
email: rosemaryfayjaloun@gmail.com

Caterina Negulescu
email: c.negulescu@brgm.fr

Samuel Auclair
email: s.auclair@brgm.fr

Marta Faravelli
email: marta.faravelli@eucentre.it

Sensitivity of earthquake damage estimation to the input data: Case study in the Luchon valley, France

Keywords: Damage and loss assessment, site effects, exposure modelling, spatial resolution, earthquake scenario

This article studies the effects of the soil data and exposure data of residential building inventories, as well as their spatial resolution, on seismic damage and loss estimates for a given earthquake scenario. Our aim is to investigate how beneficial it would be to acquire higher resolution inventories, at the cost of additional effort and resources. Seismic damage computations are used to evaluate the relative influence of varying spatial resolution on a given damage model, where other parameters were held constant. We use soil characterization maps and building exposure inventories, provided at different scales from different sources: the European database, a national data set at the municipality scale, and local field investigations. Soil characteristics are used to evaluate site effects and to assign amplification factors to the strong motion applied to the exposed areas. Exposure data sets are used to assign vulnerability indices to sets of buildings, from which a damage distribution is produced (based on the applied seismic intensity). The different spatial resolutions are benchmarked in a case-study area which is subject to moderate-to-average seismicity levels (Luchon valley in the Pyrénées, France). It was found that the proportion of heavily dam-aged buildings is underestimated when using the European soil map and the European building database, while the more refined databases (national/regional vs. local maps) result in similar estimates for moderate earthquake scenarios. Finally, we highlight the importance of pooling open access data from different sources, but caution the challenges of combining different data sets, especially depending on the type of application that is pursued (e.g., for risk mitigation or rapid response tools).

Introduction

Earthquake risk assessment is a complex exercise, involving the assimilation of geological, seismological, engineering, demographic, and economic data within a risk assessment model [START_REF] Corbane | Pan-European seismic risk assessment: a proof of concept using the Earthquake Loss Estimation Routine (ELER)[END_REF]. Significant efforts have been made in the last 25 years towards the development of regional, national, continental, or even global seismic hazard and risk models, such as the National Risk Assessment (NRA) for Italy (Dolce et al., 2020), the Global Earthquake Risk Model developed by the Global Earthquake Model (GEM) foundation [START_REF] Silva | Development of a global seismic risk model[END_REF] and, more recently, the European Seismic Risk Model ERSSRM20, which is an output of the European Horizon 2020 SERA project (Crowley et al., 2020a), building upon the research efforts of many previous projects (e.g., LESSLOSS, SYNER-G, and NERA-SHARE) [START_REF] Riga | Verification of seismic risk models using observed damages from past earthquake events[END_REF]. Seismic damage assessment requires taking three main factors into consideration: hazard, exposure, and vulnerability. Hazard refers to a specific given scenario (deterministic study) or to the aggregation of all possible future occurrences of seismic events (probabilistic study) which may have adverse effects on vulnerable and ex-posed elements. On the other hand, exposure refers to the inventory of elements in an area in which the hazard may occur, while vulnerability refers to the susceptibility of exposed elements, such as physical components (e.g., buildings), human beings, and their livelihoods, to suffer adverse effects when subjected to the hazard. Several models have been developed for assessing the vulnerability of buildings and estimating the expected earthquake damages and losses for a given scenario. The methods developed may be empirical, analytical, or mechanical, based on fragility curves of buildings or hybrid methods [START_REF] Calvi | Development of seismic vulnerability assessment methodologies over the past 30 years[END_REF]. The methodological and input data choices inevitably introduce uncertainty in the results of the seismic risk assessment. A variety of uncertainties, originating from different sources, are present at every step of the risk assessment process (e.g., natural variability of the phenomena under investigation, in-completeness of input data, or inadequacies in the models and methods). [START_REF] Bal | The influence of geographical resolution of urban exposure data in an earthquake loss model for Istanbul[END_REF] studied the geographical resolution of exposure data and of the ground motion (PGA amplified by the soil effect) for the sea of Marmara region in Turkey, using several different levels of spatial aggregation to estimate the losses due to a single earthquake scenario. They showed that, if only mean estimates are needed, the effort required to refine the spatial definition of exposure data is not justified. The average damage values over the simulations were almost insensitive to the resolution of the ground motion field. Their results indicated that a significant reduction in the variability of these estimates can be achieved by moving to higher resolution ground-motion fields. As the effect of moving to higher resolutions is to introduce some regions with higher-thanaverage damage and others with lower-than-average damage, these two effects largely cancel each other out.

The collection of harmonized data at a regional scale, as well as at the local scale, still represents one of the major challenges in seismic risk assessment studies. Preparing for data inventory is usually the most time-consuming and costly aspect of a loss study. It is also the most frustrating as, in principle, it is ideal to develop a perfect inventory; however, in practice, compromises must be made. It is wise to compile and update inventories that are as accurate as possible, under the circumstances and re-sources available.

In this study, we focus on two key inventories that are needed to estimate seismic damage: the soil database, which is part of the hazard factor when considering site amplification, and the building database, which establishes the exposure and vulnerability factors. The first inventory is about the local site conditions that have a great effect on earthquake losses. The second inventory is related to the buildings and their vulnerability. It provides the spatial distribution of buildings at the territorial scale (i.e., the number of buildings in each territorial unit of analysis), as well as the vulnerability classification of these buildings.

A question thus arises: to what extent is acquiring a higher resolution inventory beneficial? This article aims to study the effects of spatial scale (i.e., the resolution of input data describing the soil conditions and the characteristics of residential buildings) on the estimation of damage and loss for a given earthquake scenario, by considering either 'weak data' (collected at a large-scale) or 'more accurate,' yet more difficult-to-obtain, detailed surveys. Specifically, we address the question of how detailed such data sets should be, in order to yield a robust enough estimation of damage and loss, and how this affects the information delivered to operational emergency managers. We conduct this investigation in the Luchon valley, located in the French Pyrenees, due to the wealth of available data on the exposure of residential buildings and on local site effects at different scales (Table 1 and Figure 1). More detailed description of the different soil and building exposure inventories are presented in [START_REF] Fayjaloun | Sensitivity of Earthquake Damage Estimation to the Input Data (Soil Characterization Maps and Building Exposure): Case Study in the Luchon Valley, France[END_REF]. The structural damage are estimated using the intensity-based empirical vulnerability relationships developed by [START_REF] Lagomarsino | Macroseismic and mechanical models for the vulnerability and damage assessment of current buildings[END_REF], without considering site effects at first stage (constant PGA), to study the effect of exposure data resolution in a deterministic scenario; and with site amplifications at a second stage to study the effects of both soil and exposure data resolution on the damage estimates. Finally, two historical deterministic scenarios are studied. The findings of this study are detailed in Section 3. The objective of studying the two historical regional earthquakes is not to compare the damage prediction with the observed damages, but rather to illustrate the differences obtained using different resolution of the input data. Indeed, for these two earthquakes, documentary archives do provide descriptions of the damage observed following these two earthquakes, but these observations cannot be used for validation, because the distribution and vulnerability of the buildings in 1855 and 1923 are very different from today.

Scenarios and Methodology

The risk evaluation procedure used herein consists of various steps, which are briefly outlined in this section. The first step of the procedure is to set the level of strong motion for rock conditions (i.e., without site effects), expressed in Peak Ground Acceleration (PGA), using either (i) a user-defined PGA map, or (ii) calculation per-formed using a ground motion prediction equation (GMPE), based on the magnitude and location of the scenario-earthquake assuming rock site conditions. Then, the impact of site effects on the PGA due to local variations in the near-surface lithology-and, possibly, topography (not considered here)-are modeled, by applying soil amplification coefficients using a site classification map (ideally coming from a seismic microzonation study). The PGA maps are then converted into macroseismic intensity, in terms of the EMS98 European Macroseismic Scale (Grünthal, 1998), using a ground-motion-to-intensity conversion equation (GMICE developed by [START_REF] Atkinson | Empirical relationships between modified Mercalli intensity and response spectra[END_REF]. The elements at risk (in this study, residential buildings) are characterized by vulnerability indices (Vi): a Vi value is assigned to each building type, defined in terms of its age, material, technique of construction and, potentially, other characteristics. Next, the damage degree is estimated, using the intensity-based empirical vulnerability relationships developed by [START_REF] Lagomarsino | Macroseismic and mechanical models for the vulnerability and damage assessment of current buildings[END_REF] on the basis of the EMS98 macroseismic scale, where an analytical expression for the mean damage grade, μD (mean of the discrete beta distribution), is provided as a function of the macroseismic intensity and the Vi of a given building type. Finally, the distribution of damage at each location is assessed, based on μD and a value, t, which governs the spread of the discrete beta distribution. The outcome is the distribution, in terms of the six damage levels defined in the EMS98-D0 (undamaged), D1 (slight damage), D2 (moderate damage), D3 (heavy damage), D4 (partial collapse), and D5 (total col-lapse)-for each location, which are separately considered. This procedure was implemented in the in-house BRGM software Armagedom, which was used for the computations presented here. Armagedom software is accessible via BRGM VIGIRISKS platform, a web-tool for Single and Multi-Hazard Risk Assessment (https://vigirisks.fr/). Details on the procedure and the software have been provided by [START_REF] Sedan | Armagedom-a tool for seismic risk assessment illustrated with applications[END_REF] The National map (issued from collaboration between BRGM and CCR), Municipal level [START_REF] Monfort | Variable resolution probabilistic modeling of residential exposure and vulnerability for risk applications[END_REF]; and -The maps issued from microzonation studies at the specific area (SISPyr project), District level [START_REF] Roullé | Performing seismic scenarios in the Luchon-Val d'Aran area, Central Pyrenees[END_REF]. We also identified three databases for collecting data concerning building exposure: -

The European database (issued from SERA project), Municipal level [START_REF] Crowley | Towards a uniform earth-quake risk model for Europe[END_REF]); -Data from the French national statistics institute (INSEE), Municipal lev-el-in which the spatial distribution is juxtaposed with the occupancy areas [START_REF] Sedan | Scénario départemental de risque sismique -Méthodologie et processus de réalisation[END_REF]; and -Data issued from site inspection at the specific area (SISPyr project), district level [START_REF] Monfort | Seismic risk scenarios in a cross-border zone of the Pyrenees Pyrenees[END_REF]. Table 1. Scale-Scenario description based on the source of databases to characterize the site amplification as well as the building exposure.

Level of detail

Soil

Site effect zonation

European Geological map

National geological map Regional geological map Geol map (1/1'000'000) Geol map (1/ 40'000) + Boreholes Geol map (1/ 10'000) + boreholes + geophysical measurements Therefore, we defined three scale-scenarios, in order to estimate the seismic damage corresponding to a given ground-motion scenario, using the various data sources: SS1-Europe: using the European soil map and the European database for the buildings, at the municipal level; SS2-France: using the National soil map and the national statistics database for the buildings, at the municipal level; and SS3-Luchon: using the soil maps and building data issued at the district level. Then, we estimate the seismic damage, using a constant ground acceleration of 200 cm/s2 in rock conditions. This is the value of the PGA for a return period of 475 years, given by the French Annex of Eurocode 8 (Eurocode C.E.N., 2004). In the first run, rock conditions and the site amplifications due to the variations in local site conditions were taken into account, in order to locally modulate the amplitude of strong motions. The resulting ground motion field was then applied to the buildings, in order to compute the associated damage. This allowed us to study the effects of both soil and exposure data resolution on the damage estimates. In a second time, we calculated two historical deterministic scenarios, for which the PGA was estimated by a GMPE applied to the magnitude and epicenter location of the scenario-earthquakes (M 5.4 event of 1855 and M 5.6 event of 1923). By using these two scenarios with the characteristics of historical regional earthquakes, and by applying them to the current building, the objective is not to validate the damage prediction, but rather to illustrate the differences that may appear in terms of loss assessment, depending on the data used.

Site effect amplification

Results and Discussion

Damage estimation for the hazard of pga = 200 cm/s2 (on rock conditions)

First, we observed the results for the simulations with a constant moderate ground acceleration of 200 cm/s2 applied to the buildings, without considering the local soil effect (Figure 2, values "w/o"). Next, we observed the results of the simulations computed for the three scale scenarios, where the ground motion was amplified by the corresponding site amplification factors (Figure 2, values "w"). SS1 (using the European soil map with an amplification factor up to 1.5 and the European exposure database) showed that 12.7% of buildings would face heavy damage to complete collapse, versus 18% following SS2 (using the regional soil map with an amplification factor up to 1.8 and the National statistics database) and 20.3% following SS3 (using the local soil map with an amplification factor up to 1.8 and the field-investigation database). The impact of the soil conditions was not linear/translational. We noticed that the low resolution of the European soil map in SS1 barely changed the results when comparing the results with and without consideration of the soil amplification map, with a difference factor of only 1.1. This factor was about 2.2 and 2.5, respectively, for SS2 and SS3. Thus, SS1 highly underestimated the proportion of heavily damaged to collapsed buildings (D3-D5). Even though SS3 had the lowest vulnerability indices, it estimated the largest damages, due to the site effects highly amplifying the local ground motion at buildings. For the Luchon area and for moderate earthquakes, we conclude that SS1 overestimated the heavy damages, when considering the building database only, and under-estimated the heavy damages, when additionally considering the soil characterization maps. We also conclude that SS2 and SS3 generated comparable results, in terms of heavy damages. These results are in accordance with [START_REF] Kalakonas | Exploring the impact of epistemic uncertainty on a regional probabilistic seismic risk assessment model[END_REF], who mentioned that the loss estimates become accurate and stable beyond a certain (fine) spatial resolution. They also proposed that a potential way to reduce this type of uncertainty is by improving the detail of information, concerning the location of the building inventory; however, this process can be time-and resource-demanding and, in many cases, it is simply impractical (e.g., for risk analysis at the national level). When we compare the simulations of the three data sets at the municipality level, the results were quite consistent; however, if we are interested in the infra-municipality level, better resolution of the building data can provide some information about the spatial distribution of damage inside a municipality.

We note that more outliers (or extreme values) were present for SS1 and SS2 than for SS3, where the latter database was collected from field inspections. The percentage of damages D3-D5 was, however, more uniformly distributed for SS3, compared to SS2 (for which the values of Vi were more variable). Pittore et al. ( 2020) concluded that an adaptive model is favorable, with higher spatial resolution in highly urbanized areas (where most of the assets are located) and lower resolution in rural, less-inhabited regions (where higher spatial aggregation could increase the robustness of the risk estimates).

Application to two historical earthquakes

Several destructive earthquakes have occurred in the past around the Luchon area, as evidenced by the historical seismicity database SISFRANCE (BRGM-EDF-IRSN: www.sisfrance.net; [START_REF] Scotti | The French macroseismic database SISFRANCE: objectives, resultsand perspectives[END_REF]; including, in particular, two earthquakes that occurred in the 19th century-in 1855 and then in 1870-with an epicentral macro-seismic intensity of VII, felt in the Luchon valley with maximum macroseismic intensities of VII and VI, respectively. However, the most important recent regional earthquake remains that of Viella, which occurred on November 19, 1923 in Spain in the Aran Valley, with an epicentral macroseismic intensity of VIII, felt with a macroseismic intensity of VII in the Luchon valley: in Bagnères-de-Luchon, some walls, chimneys, and roofs had cracked.

Considering the epicentral positions and the macroseismic intensity level in the area of interest, we evaluated the seismic damage in Luchon region for the two historical earthquakes (i.e., those of 1855 and 1923). Utilizing the characteristics of these two earthquakes (location, magnitude, and depth) determined by [START_REF] Manchuel | The French seismic CATalogue (FCAT-17)[END_REF] in their FCAT-17 parametric catalog, we use the GMPE of [START_REF] Ambraseys | Equations for the estimation of strong ground motions from shallow crustal earthquakes using data from Europe and the Middle East: horizontal peak ground acceleration and spectral acceleration[END_REF] to estimate the ground motion in the region, in terms of PGA. Then, the PGA estimated under rock site conditions was convoluted with site effects, following the three soil characterization maps corresponding to each of the three scale-scenarios. Concerning the 1855 earthquake, due to the proximity of the epicenter to the study area, high PGA values were obtained, resulting in damages up to D4 and D5 (Table 2). The distribution of the damage differed from one scenario to another and it was very sensitive to the soil characterization map, as well as to the resolution of the building distribution. Without considering site effects, SS1 generated higher D5 damages (almost double, compared to SS1 and SS2) and less D2-D3 damages, whereas SS2 and SS3 exhibited a similar distribution of damages. When considering the amplified ground motion due to site effects, the conclusions were reversed: SS2 and SS3 generated considerably more damages at levels D3-D5. Here, we focused on the Bagnères-de-Luchon municipality, where important differences appeared: only 10 buildings were expected to have D3 damage in this area when using SS1; however, 195 buildings were expected to have D3 damage when using SS2, and 190 in total with SS3, which were spatially dispersed.

For the event of 1923 (Table 2), the epicenter being further away from the study area, low to moderate levels of PGA gave rise to relatively similar distributions of damage. Damages were dominated by levels ranging from D0 to D3. Without considering any soil amplification, SS1 scenarios were the most conservative, whereas SS2 and SS3 gen-erated a similar distribution of damages. When considering the amplified ground motion, this observation did not hold and SS3, followed by SS2, was slightly more conservative. Through observation of Figure 3, which shows the spatial distribution of D3 for the three scale-scenarios in the municipality of Bagnères-de-Luchon, we can estimate that six buildings reached damage level D3 using SS1, and 11 buildings using SS2; how-ever, checking SS3 at the infra-municipality level, we can notice that the buildings with damage D3 are spatially distributed with unit values. When collectively aggregated at the municipality level, the number rose to 10. SS2 and SS3 gave similar results. We can notice that, for the two studied events, the site effect had a large impact on the proportion of destructive damage, and SS2 and SS3 resulted in similar damage distribution estimates, with SS3 having better spatial resolution of the building locations on the map. However, as this comparison is not based on damage observations, this study is not a validation of damage predictions, but rather an illustration of the variations expected in terms of loss assessment in the event of a major earthquake.

Conclusions

A major source of uncertainty in damage estimations is the intrinsically difficult inventory problem. Despite these limitations, it is important to thoroughly document the manner in which the inventories were established and damages were estimated, and that the main findings and conclusions are presented in a way that is useful and clear. Seismic damage studies which are properly conducted and used with an under-standing of the strengths and limitations of the used method(s) can be of great value in planning, initiating, and updating programs for earthquake risk reduction and in emergency planning.

This paper explored the impact of the resolution of both the ground motion field due to the soil effect and building exposure data on the estimation of seismic damages. The study was limited necessarily to a single seismic ground shaking affecting the region, and the damage calculations were carried out using only one methodology.

For the Luchon area and for moderate earthquakes, use of the European soil map (with an amplification factor up to 1.5) and the European building database led to underestimation of the heavy damage classes (D3-D5). Using the regional soil map (with an amplification factor up to 1.8) and the National statistics building database resulted in similar estimates to those using the local soil map (with an amplification factor up to 1.8) and a fieldinvestigation database for the buildings; however, the spatial resolution to detect the locations of buildings of interest was unsurprisingly better when using the better-resolved exposure database. We would like to highlight that the main conclusions from this study are valid for the case of the Luchon area and, as such, their application to other countries or cities should be carefully considered.

  ,[START_REF] Tellez-Arenas | A web platform for storing, sharing and executing scientific workflows for Natural Risk Assessment: part 2-description of an interoperable architecture based on open-source components[END_REF],[START_REF] Negulescu | A web platform for storing, sharing and executing scientific workflows for Natural Risk Assessment: part 1-data, approaches and case studies[END_REF] and[START_REF] Negulescu | Adjustability of exposed elements by updating their capacity for resistance after a damaging event: application to an earthquake-tsunami cascade scenario[END_REF].We identified three sources for the databases, concerning the soil classification maps: -The European map (issued from SERA project), Municipal level[START_REF] Crowley | Delivrable SERA : D26.4 Methods for Estimating Site Effects in Risk Assessments -Dolce[END_REF]; -

Fig. 1 -

 1 Fig. 1 -The site characterization maps and the building exposure used for the 3 scale-scenarios defined in this study.

  Vi corresponding to SERA typology based on RISK-UE Vi from INSEE statistics (based on age, type, number of floor) Vi from INSEE statistics improved with Field inspection Damage Lagomarsino and Giovinazzi (2006) Methodology: Building Damage using EMS98 intensity-based buildings vulnerability

Fig. 2 -

 2 Fig. 2 -The damage distribution per scale-scenario considering the ground motion amplification due to soil effects. The color shows the percentage of buildings per level of damage. The number shows the total number of damaged buildings: "w/o" for the scenario without considering the local soil effect and "w" for the scenario with local soil effect

Fig. 3 -

 3 Fig. 3 -D3 damage distribution in the Luchon area in number of buildings at the 53 municipalities, due to the 1923 earthquake. The site effect is considered here.

Table 2 :

 2 Percentage and number of residential buildings per damage level per scale-scenario for the earthquake event of1855 and 1923

			D0			D1			D2			D3			D4			D5
	1855	SS1	SS2	SS3	SS1	SS2	SS3	SS1	SS2	SS3	SS1	SS2	SS3	SS1	SS2	SS3	SS1	SS2	SS3
	%	65	50	43	21	25	27	9	14	18	4	7	9	1	3	3	0.1	0.4	0.3
	#	4262	4065	3562	1359	2037	2292	608	1172	1471	252	584	745	81	214	243	10	31	26
	1923	SS1	SS2	SS3	SS1	SS2	SS3	SS1	SS2	SS3	SS1	SS2	SS3	SS1	SS2	SS3	SS1	SS2	SS3
	%	87	85	83	11	12	14	2	3	3	0	0	0	0	0	0	0	0	0
	#	5691	6857	6897	712	1004	1162	147	211	243	21	30	34	1	2	2	0	0	0

Acknowledgements

This research was funded by the European Union's Horizon 2020 research and innovation program, grant number 821046, project TURNkey.