INTRODUCTION

We consider critical infrastructures (CIs); these are large scale, man-made networked systems, mostly spanning long distances, which grant the continuous production and distribution of goods (e.g. fluids, energy, data) and services (e.g. banking, health care) essential for the welfare and security of modern Society. Such infrastructures are named critical, as any incapacity or destruction would have a debilitating impact on the health, safety, security, economics and social well being [START_REF] Kröger | Vulnerable Systems[END_REF].

To evaluate the vulnerability of CIs models must be built describing the flow of the physical quantities within the networks.

Functional models have been proposed to capture the basic features of CI networks within a weighted topological analysis framework which abstracts the representation of the dynamics of the CI elements [START_REF] Motter | Cascade-based attacks on complex networks[END_REF][START_REF] Dobson | Complex systems analysis of series of blackouts: Cascading failure, critical points, and self-organization[END_REF][START_REF] Zio | Modeling failure cascade in network systems due to distributed random disturbances[END_REF]. These models have been shown to shed light on the way complex networks react to faults and attacks [START_REF] Kröger | Vulnerable Systems[END_REF].

A characteristic of CIs is that they are highly interconnected and mutually dependent in complex ways, both physically and through information and communication technologies used for data acquisition and control, leading to the concept of "systems of systems" [START_REF] Rinaldi | Modeling and simulating critical infrastructures and their interdependencies[END_REF]). This adds the need of assessing the influences and limitations which interacting CIs impose on their operating conditions [START_REF] Zimmerman | Social Implications of Infrastructure Network Interactions[END_REF].

The functional modeling of interdependent CIs can be carried out in a simulation framework which abstracts the physical details of the individual infra-structures, but at the same time captures their essential operating features and interdependencies, and examines the emergent effects of cascading failures [START_REF] Newman | Risk Assessment in Complex Interacting Infrastructure Systems[END_REF][START_REF] Zio | Modeling interdependent network systems for identifying cascade-safe operating margins[END_REF]. In such modeling framework, interdependencies are represented as links (edges) connecting nodes across the interdependent systems; these links are conceptually similar to those of the individual systems and can be bidirectional with respect to the interdependence.

In this paper, the modeling framework described above is extended to account for the physical nature of the components and their interdependencies. The propagation of cascading failures in a power transmission network is taken as reference example; its components are physically specialized in "generators" and "distributors"; the effects onto two other interdependent CIs (communication and transportation) are investigated, whereby the interdependencies are distinguished in "physical", "cyber", "geographic" and "logical" [START_REF] Rinaldi | Identifying, understanding and analyzing critical infrastructures interdependencies[END_REF]). The analysis focuses on cascading failures triggered by the intentional removal of a single component, e.g. due to a malicious attack.

Inaccuracies in the values of the parameters of the cascading failure model may lead to erroneous estimations of the effects that a failure has on the CI system. Then, uncertainties in the model parameters are accounted for within a probabilistic framework.

The paper is organized as follows: the modeling of cascading failures in the power transmission CI with physical characterization of the components is presented in Section 2; in Section 3, the characterization of interdependencies is introduced; in Section 4, the functional model for interdependent CIs is de-Modeling cascading failures in "systems of systems" with uncertain behavior

E. Zio

Ecole Centrale Paris and Supelec, Paris, France Energy Department, Politecnico di Milano. Milan, Italy

G. Sansavini

Energy Department, Politecnico di Milano, Milan, Italy ABSTRACT: We model cascading failures in interdependent critical infrastructures (CIs). We adopt a modeling framework based on simulation, which accounts for the physical specialization of the components and their interdependencies. We analyze cascading failures triggered by the intentional removal of a single component in the CIs and study the influence of the systems operating safety margins and interdependency parameters on the consequences of the cascade. Uncertainties in the model parameters are propagated, within a probabilistic representation framework. tailed; in Section 5, the proposed model is applied to three interdependent CIs whose topological structures are based on the 380 kV Italian power transmission network [START_REF] Terna | Dati statistici sull"energia elettrica in Italia[END_REF][START_REF] Rosato | Topological properties of high-voltage electrical transmission networks[END_REF]. Conclusions are drawn in Section 6.

A MODEL OF CASCADING FAILURES IN A POWER TRANSMISSION NETWORK

The model proposed represents the power grid as a network of N nodes (substations) and K edges (transmission lines). Two types of substations are distinguished: N G generators are the sources of power and N D distribution substations are at the outer edge of the transmission grid, as centers of local distribution grids.

While the connectedness of the power grid allows for the transmission of power over large distances, it also implies that local disturbances may propagate over the whole grid. The failure of a power line due to a lightning strike or a short-circuit leads to overloads in nearby lines. Power lines are guarded by automatic devices that take them out of service when the voltage is too high. Generating substations are designed to switch off if their power cannot be transmitted; this protective measure has the unwanted effect of diminishing power for all consumers. Another possible consequence of power line failure is the incapacitation of transmission substations, possibly causing the power from generators to not reach distribution substations and ultimately consumers.

In the unperturbed state, each distribution substation can receive power from any of the generators. As substations lose function, the number of generators, N G i , connected to (and able to feed) a certain distribution substation i decreases. The concept of connectivity loss, C L , is used to quantify the average decrease in the number of generators connected to a distributing substation [START_REF] Albert | Structural vulnerability of the North American power grid[END_REF]). The calculation of this parameter relies on the topological structure of the network and the available leastresistance pathways. Denoting by N G the order of the generation subset at the unperturbed state of the network, and N G i the number of generation units able to supply flow to distribution node i after disruptions take place, C L takes the following form:

1 1 1 D N i L G G i D C N N N    (1)
where the averaging is done over all distributing substations. In synthesis, C L measures the decrease in the ability of distribution substations to receive power from the generators.

The load on a transmission or distribution substation is modeled as dependent on the number of links transiting through it, when flow is sent from each available generation node to each distribution node. In this view, the maximum load or amount of flow passing through a node is related to the node betweenness [START_REF] Sabidussi | The centrality index of graphs[END_REF][START_REF] Nieminen | On the centrality in a graph[END_REF][START_REF] Freeman | Centrality in social networks conceptual clarification[END_REF][START_REF] Freeman | Centrality in valued graphs: A measure of betweenness based on network flow[END_REF][START_REF] Little | Controlling Cascading Failure: Understanding the Vulnerabilities of Interconnected Infrastructures[END_REF], calculated as the number of shortest paths that pass through a node when flow is sent from each available generation node to each distribution node. The node with the highest value of betweenness is that through which the largest electric power flows within the system. Assuming that power is routed through the most direct path, the number of shortest paths that transit through a substation is a good approximation of how much power it is transmitting, i.e. its load [START_REF] Albert | Structural vulnerability of the North American power grid[END_REF]).

In the proposed modeling framework, the load at a component is then the total number of shortest paths connecting every generator to every distributor passing through that component [START_REF] Newman | Finding and evaluating community structure in networks[END_REF], [START_REF] Batagelj | Semirings for social networks analysis[END_REF]. At any instant of time, the load is to be compared with the component capacity, i.e., the maximum load that it can process. In man-made CI networks, the capacity of a component is limited by technological limitations and economic considerations. For modeling purposes, it can be assumed that the capacity C j of component j is dimensioned proportionally to its nominal load L j at which it is designed to operate initially,

  1 1, 2,..., j j j C L j N      (2)
where the parameter α j > 0 is called the tolerance parameter of the distributing substation j. This parameter can be regarded as an operating margin allowing safe operations of the component under possible load increments. When α j = 0, the system is working at its limit capacity, its operating margin being null: any further load added to a component would result in its failure and removal from the network and in the propagation of a cascading failure involving a large part of the system. When all the components are working, the network operates without problems in so far as α j > 0. On the contrary, the occurrence of component failures leads to a redistribution of the shortest paths in the network and, consequently, to a change in the loads of the surviving components. If the load on a component increases beyond capacity, the component fails and a new redistribution of the shortest paths and loads follows, which, as a result, can lead to a cascading effect of subsequent failures.

When looking at the potential of a cascading process triggered by the removal of a single component, two situations are expected: if prior to its removal the component is operating at a relatively small load (i.e., if a small number of shortest paths go through it), its removal will not cause major changes in the balance of loads and subsequent overload failures are unlikely; however, when the load of the component is relatively large, its removal is likely to affect significantly the loads of other components and possibly start a sequence of overload failures. Intuitively, the following behavior is expected [START_REF] Motter | Cascade-based attacks on complex networks[END_REF]: global cascades occur if the network exhibits a highly heterogeneous distribution of loads and the removed component is among those with highest loads; otherwise, cascades are not expected.

However, any uncertainty in the tolerance parameter α j can result in erroneous estimations of the operating margins that ensure safe operations with respect to the propagation of failures. To account for this, the tolerance α j is assumed to be described by a normal distribution, i.e. α j = N(  ,   ).

MODELLING OF INTERDEPENDENCIES AMONG CRITICAL INFRASTRUCTURES

A framework for the characterization of interdependencies has been proposed in [START_REF] Rinaldi | Identifying, understanding and analyzing critical infrastructures interdependencies[END_REF].

Interdependencies are characterized as either physical (an output from a system is required as an input to another system), cyber (the state of a system is dependent on information transmitted through an information infrastructure), geographic (two or more systems can be affected by the same local event, i.e. because they are spatially proximate), and logical (includes all other types of interdependencies, for example related to human behavior).

Operatively, from the modeling point of view, interdependencies between CIs can be represented as edges connecting nodes belonging to different infrastructures. If a CI is not able to supply the demanded service the outgoing dependency edge is removed, thus signaling the unavailability of the desired service to other CIs. The effect of a removed dependency edge is evaluated separately in the functional model of each of the dependent infrastructures. This means that each infrastructure only sees and acts upon local information regarding dependencies (Johansson and Jonsson 2009).

In the following, physically specialized interdependencies among three CIs, i.e. power transmission, communication and railway networks, are modeled and analyzed.

FUNCTIONAL MODEL OF INTERDEPENDENT SYSTEMS

Only the most essential functional properties of the CIs are modeled in order to provide a clear presentation of the developed methodology. More detailed functional models, embedding additional physical features, could be developed in case a more realistic characterization of the CIs is required.

The functional models of the railway and communication CIs are quantified by a connectedness evaluation algorithm which computes the shortest path lengths, d ij , between node i and j in the two CIs. Upon failure, the variation in the systems performances is then evaluated as the relative decrease in the average global efficiency, ΔE glob , with respect to the unperturbed systems. The average global efficiency of a network, E glob , is defined as the average of the inverse shortest path lengths in the network, i.e.

 

1 1

glob ij i j G E d N N         
 [START_REF] Latora | Vulnerability and protection of infrastructure networks[END_REF].

A node of the railway network is in service as long as it has access to the telecommunication system and as long as the power transmission system is supplying electricity. Hence, each node of the railway network has a cyber dependency from the telecommunication system and a physical dependency from the power transmission network. If the interdependent node in the communication network fails, the node in the railway network may fail with probability p cr , while if the interdependent node in the power transmission network fails, the node in the railway network is disconnected.

A node of the communication network is in operation as long as the power transmission system is able to supply electricity. Hence, each node of the communication network has a physical dependency from the power transmission network. If the interdependent node in the power transmission network fails, the node in the railway network is disconnected.

The functional model of the power transmission network has been introduced in Section 2. An input from the communication system is required for the nodes of the power transmission network to operate. Hence, each node of the power transmission network has a cyber dependency from the communication network. If the interdependent node in the communication network fails, the node in the power transmission network may fail with probability p cp .

The cyber dependencies from the communication network and the power transmission system, and from the communication network and the railway network imply different effects owing to different systems operating conditions. If communication is temporarily not required at a train station, then the effects of the unavailability of the dependent node in the communication network will not propagate to the railway network. The same argument holds for the cyber dependencies between the communication network and the power transmission system. This behavior is modeled assuming that p cr and p cp are described by a probability distribution, in particular two normal distributions are assumed, i.e. p cr = N( cr ,  cr ) and

p cp = N( cp ,  cp ).
From the functional descriptions of the three CIs, it follows that cascading failures propagate in the power transmission network only due to the rerouting of the flows between generators and distributors, and their effects propagate to the communication and railway networks through the removal of the interdependency connections. Moreover, unlike the communication and the power transmission systems, which show mutual interdependencies, the operation of the transportation network are affected by the other two CIs but has no effect on them.

CASE STUDY

The model of cascading failure introduced in Section 2 has been applied to the topological network of the 380 kV Italian power transmission network (Figure 1). The network has N=127 nodes (N G =30 generator and N D =97 distributor nodes) connected by K=171 links [START_REF] Terna | Dati statistici sull"energia elettrica in Italia[END_REF][START_REF] Rosato | Topological properties of high-voltage electrical transmission networks[END_REF]). We simulate the propagation of cascading failures in the power transmission network and the effects on the communication and railway networks. Due to the lack of actual data, but with no loss of generality, the topological structure of the railway network has been taken identical to the structure of the power transmission network. Conversely, the base topological structure of the communication network has been taken from the power transmission network, but additional links have been added so that the neighborhood of each node forms a fully connected subgraph. For each node i, we identified the nodes k i that are directly connected to it (forming the so called neighborhood of i), and connected k i nodes by direct links. If node i malfunctions, information can still flow through this redundant wiring. This alteration accounts for the presence of alternative communication routes among nodes which are not "too far" from one another. The effects of cascading failures triggered by the removal of substations in the power transmission system are first investigated. The scenario considered regards the malevolent targeted attack aiming at disconnecting node {88} (Figure 1), which handles the largest load in the system, i.e., through which pass the largest number of generatordistributor shortest paths. Previous studies have showed that power transmission networks can be very sensitive to this kind of attacks due to the difficulty of handling flow redistribution when the most congested elements fail, because neighboring elements are also working close to their full capacity and are incapable of handling significant additional flows (Duenas-Osorio & Vemuru 2009). Hence, the disconnection of a most congested node is regarded as a critical scenario of malicious attack. In addition to that, node {88} plays a strategic role in the system, bridging the northern and the southern branches of the Tyrrhenian backbone.

Once the triggering event occurs, flow redistribution takes place as a mechanism to equilibrate supply and demand constraints. The flow redistribution process is simulated at discrete time steps. At t 0 the network is intact; at t 1 a failure occurs; at t i , i  2 the cascading failure progresses as nodes overload and cause further failures in neighboring elements. The cascading process is followed until the response stabilizes; at this point, indicators of the severity of the cascade are computed, e.g. the connectivity loss, C L (Section 2).

The analysis is made with respect to different values   of the tolerance parameter α and fixed standard deviation,   =0.3. The parameters  cr and  cp are taken equal to 0.5;  cr =0.3 and  cp =0.2. A sensitivity analysis with respect to  cr and  cp is presented in Section 5.1; on the contrary, the   ,  cr and  cp values have been heuristically set.

The variables α i , p cr and p cp can assume only nonnegative values. To describe their uncertainties normal distributions have been assumed to constrain the values to be  0. The conditional sampling of such distributions is such that when  α  0, the presence of more tolerant components is favored, i.e. α i  0, and when  cr  0 and  cp  0, a stronger coupling among the interdependent CIs is favored, i.e. p cr  0 and p cp  0, respectively.

In Figure 2, the final value of the connectivity loss, C L , obtained after the system has stabilized in response to the disconnection of node {88}, is plotted versus   , the mean value of the probability distribution of the tolerance parameter, α.

Values of   =200% of the design working load have been considered as further increments of   do not improve C L . Obviously, such a wide safety margin of   =200% of the design working load would in most cases not be a reasonable situation in standard practice. As expected, increasing the flow-carrying capacity of the network elements (i.e. increasing   ) reduces the extent of the cascades because flow redistribution can be handled at the local scale. The typical jumps to larger values of the connectivity loss, related to the so-called "islanding" effect [START_REF] Zio | Modeling failure cascades in critical infrastructures with physically-characterized components and interdependencies[END_REF], are absorbed by the uncertainties on α.

The results shown in Figure 2 allow identifying an operating safety margin with respect to the transition between the cascade-safe region and the onset of disrupting cascades. For example, if one wants to reduce the average connectivity loss C L below 60%, the power transmission network must be operated accounting for a safety margin   ≥ 57% beyond the design working load; the cascading failures occurring beyond this safety margin would result in connectivity losses lower than the selected value. Yet, such a wide safety margin might not be always available in real power transmission systems and component replacements might be required to comply with the prescribed safety margins.

Information concerning the benefits from possible system improvements can also be inferred. For example, the average connectivity loss is more sensitive to variations in the ranges    [0%, 45%] and    [140%, 180%]. Hence, an increase in the tolerance within these ranges is more effective in improving the system vulnerability towards cascading failures.

We also analyzed the effects of the disconnection of the most congested node {88} in the power transmission CI on the communication and railway networks. Figure 3 shows the loss of service in these networks in terms of the relative decrease of the average global efficiency with respect to the unperturbed systems, ΔE glob , versus   . Due to the strong physical interdependencies between the power transmission system and the other two CIs, the loss of service trend is closely related to the connectivity loss, C L , as it can be seen comparing Figure 2 and Figure 3. Due to the higher degree of redundancy in the communication network, the loss of service for this infrastructure is smaller than it is for the railway system. The curve in Figure 3 provides vulnerability information as the one in Figure 2. For example, if we aim at protecting the railway system by requiring a maximum loss of service, e.g. ΔE glob ≤ 0.5, the interdependent power transmission network must be operated at   ≥ 66%. With respect to the malicious targeted attack of single nodes, the components of the system can be ranked in view of the damage caused by the cascade of failures triggered by their individual removal. To this aim, in Figure 4 the histogram of the average connectivity loss, C L , caused by the removal of each node in the power transmission system is presented for   = 30% which is a reasonable assumption in standard practice. Surprisingly, the most congested node {88} is not among the most critical. Nodes {14, 79, 76, 71 and 12} are ranked as the most critical ones, being bottlenecks for many generatordistributor shortest paths due to their position in the network. Hence, an attacker aiming at disrupting the most "active" node would not actually produce the maximum "desirable" damage.

The ranking of the most critical components is dependent on the expected value of the tolerance parameter,   , characteristic of the system; thus, it must be reevaluated in case the system undergoes modifications affecting its operating margins.

Expected

Expected

The analysis performed is limited to the removal of individual nodes, as removing groups of nodes constitutes a combinatorial problem which lies beyond the scope of the current work.

In Figure 5, the removal of each node in the power transmission system is associated with its consequences on the interdependent CIs. Similarities with Figure 4 appear, for the reasons explained above. We performed an additional analysis focused on the intentional removal of the most connected node {64} of the communication system. The results are reported in Figures 6 and7 for values of the interdependency strengths  cr =  cp = 0.5. Comparing Figures 6 and 7 with Figures 2 and3, it appears that cyber dependencies are on the average less critical than physical dependencies with respect to the failure propagation, due to their assumed probabilistic nature. Yet, an attack on the communication network results in highly-variable consequences as it can be seen from the wide error bars in Figure 6 and7. This renders more difficult any decision-making on CI protection.

Sensitivity analysis with respect to  cp and  cr

To look at the effects of the interdependency strengths on the failure propagation, we carried out a sensitivity study with respect to p cp for two different   values. Its results are reported in Figures 8 and9, with  cr = 0.5. A linear decrease in the effects of the cascading failure C L and ΔE glob , is shown when the interdependency strength,  cp , is reduced. The curves in Figures 8 and 9 convey information concerning the vulnerability of CIs with respect to the interdependency strength. As an example, if a maximum service loss is prescribed for the railway system, e.g. ΔE glob ≤ 40%, the interdependencies be-Expected tween the communication system and the power system must be operated so that  cp ≤ 54%. The interdependent CIs are not sensitive to variations of  cr , which do not influence the cascade triggering in the power system. Finally, the removal of each node in the communication system is associated with its consequences on the interdependent CIs (Figures 10 and11). The most connected node {64} in the communication system is the most critical with respect to failure propagation in the power system and in the railway network. Other critical nodes are {81,78,79,61,14,110}. Nodes {14,79,110,76,81,78,61 and 64} are ranked as most critical for the communication infrastructure. Compared to the removal of the power stations, the relative ranking of some node originally present has changed and other nodes (i.e., node {12}) are not among the most critical. It turns out that the nodes {81, 78, 79, 61, 12, 14 and 64} linking the northern and the Tyrrhenian sections of the networks are the most critical. Moreover, node {110} that links the Adriatic and the Tyrrhenian sections of the networks is also ranked as critical.

CONCLUSIONS

To improve the modeling of cascading failures propagation based on network theory, we have introduced the physical characterization of the components and of the interdependencies among CIs. The model has been applied to assess the cascade propagation process triggered by a defined node-removal scenario. Three interdependent CIs have been considered, namely the power transmission, the communication and the railway networks. We have accounted for uncertainties in the model parameters by a classic probabilistic framework of representation. The knowledge gained from the type of analysis performed can help setting the value of the operating safety margin,   , so as to limit the consequences of cascading failures, e.g. measured by C L or ΔE glob .

Expected Expected

Ranking of the nodes according to the disruptions triggered by their individual removal has shown that nodes which could be thought of as most critical because of their high congestion or connectivity are not always associated with the largest consequences following their removal. This points to the fact that the physical characterization of the components and interdependencies and the introduction of the uncertainties add a further level of complexity to the cascade propagation, so that the system bottlenecks cannot be identified simply by the static topological analysis alone.

The proposed modeling framework allows also to look at the extent to which the interdependency parameters affect the cascade propagation, for different operating safety margins,   . For example, given an operating safety margin value, the systems can be designed and operated, tweaking the interdependency strength,  cr , so as to limit the maximum average connectivity loss, C L or service loss, ΔE glob .

Future developments of this work will be the modeling of active safety systems for preventing and mitigating cascading failures propagations and the analysis of interdependent CIs having their own individual cascade dynamics.

Figure 1 .

 1 Figure1. The 380 kV Italian power transmission network[START_REF] Terna | Dati statistici sull"energia elettrica in Italia[END_REF][START_REF] Rosato | Topological properties of high-voltage electrical transmission networks[END_REF]) and two interdependent CIs. Interdependencies are represented by links among the systems. Solid arrows symbolize "physical" dependencies on the power transmission infrastructure. Dashed arrows symbolize "cyber" dependencies on the communication infrastructure.

Figure 2 .

 2 Figure 2. Final value of the connectivity loss, C L , vs. the expected value of the tolerance parameter,   , when the system response has stabilized. The cascades are triggered by the removal of the most congested node {88} in the power system. The error bars identify the standard error from 100 simulations for constant   .

Figure 3 .

 3 Figure 3. Loss of service in terms of the relative decrease of the average global efficiency with respect to the unperturbed systems vs. the expected value of the tolerance parameter,   . The cascades are triggered by the removal of the most congested node {88} in the power transmission system. The error bars identify the standard error from 100 simulations for constant   .

Figure 4 .Figure 5 .

 45 Figure 4. The average connectivity loss, C L , caused by the removal of each node (abscissa) in the power transmission system. The expected value of the tolerance parameter is   = 30%.

Figure 6 .Figure 7 .

 67 Figure 6. Final value of the connectivity loss, C L , vs. the expected value of the tolerance parameter,   . The results are averaged over 100 cascades triggered by the removal of the most connected node {64} in the communication system.  cr =  cp = 0.5.

Figure 8 .Figure 9 .

 89 Figure 8. Average connectivity loss, C L , vs. the interdependency strength,  cp . The results are averaged over 100 cascades triggered by the removal of the most connected node {64} in the communication system.  cr = 0.5.

Figure 10 .Figure 11 .

 1011 Figure10. Average connectivity loss, C L , caused by removal of each node (abscissa) in the communication system (100 simulations for each node).   = 30%,  cr =  cp = 0.5.

ACKNOWLEDGMENTS

This work has been partially funded by the Foundation pour une Culture de Securite Industrielle of Toulouse, France, under the research contract AO2006-01.


R Flage

Terje Aven

Piero Baraldi

Enrico Zio

On imprecision in relation to uncertainty importance measures

INTRODUCTION

The use of importance measures (IM) is an integral part of reliability and risk analysis. IM are used to study the effect on system level reliability or risk parameters of altering component level parameters. A number of uncertainty importance measures (UIM) have also been proposed in the literature. These extend the "classical" reliability and risk IM in the presence of epistemic uncertainty. UIM are used to study to what degree uncertainty about risk and reliability parameters at the component level influences uncertainty about parameters at the system level.

Consider the following setting: We are interested in the quantity Y, possibly a vector, and introduce a model g(X) which links n input quantities X = (X 1 ,X 2 ,…,X n ) to Y. In the present paper, particular attention is paid to the case p = g(q), where p and q are reliability or risk parameters at the system and component level, respectively. Typically p and q have the interpretation of long-run frequencies, e.g. the fraction of time a system and its components are functioning, respectively. This interpretation is seen, for example, in the probability of frequency approach to risk analysis [START_REF] Kaplan | On the quantitative definition of risk[END_REF].

Classical IM are used to analyze changes to p given changes to q. For example, the so-called "improvement potential" of component i is defined as the change to the system availability p when the component availability q i is set equal to 1. Furthermore, the Birnbaum IM is defined as the partial derivative of p with respect to q i . UIM are typically founded on a Bayesian perspective. A subjective probability distribution F is introduced for q and propagated through a model g. The result is a probability distribution of p, and UIMs are used to analyse changes to the distribution of p given changes to F. Reference is made to Section 2 for a brief review of IM and UIM.

In a Bayesian perspective subjective probabilities express epistemic uncertainty; hence, they do not reflect imprecision in probability assignments. The term imprecision here labels the phenomenon captured by a wide range of extensions of the classical theory of probability, including lower and upper previsions [START_REF] Walley | Statistical Reasoning with Imprecise Probabilities[END_REF], belief and plausibility functions [START_REF] Dempster | Upper and lower probabilities induced by a multivalued mapping[END_REF][START_REF] Shafer | A Mathematical Theory of Evidence[END_REF], possibility measures [START_REF] Dubois | Possibility Theory -An Approach to Computerized Processing of Uncertainty[END_REF], robust Bayesian methods [START_REF] Berger | The robust Bayesian viewpoint[END_REF], p-boxes [START_REF] Ferson | Constructing probability boxes and Dempster-Shafer structures[END_REF] and interval probability [START_REF] Weichselberger | The theory of interval probability as a unifying concept for uncertainty[END_REF].

One much studied type of UIM is that reflecting the effect on system level parameter uncertainty of removing component level parameter uncertainty. For example, for a probability distribution F of component level parameters q which propagated through a model g induces a probability distribution of the

P. Baraldi

Polytechnic of Milan, Italy

E. Zio

Ecole Centrale Paris and Supelec, France Polytechnic of Milan, Italy ABSTRACT: A number of uncertainty importance measures have been proposed in the literature to extend classical risk and reliability importance measures in the presence of epistemic uncertainty. Uncertainty importance measures typically reflect to what degree uncertainty about risk and reliability parameters at the component level influences uncertainty about parameters at the system level. The definition of these measures is typically founded on a Bayesian perspective where subjective probabilities are used to express epistemic uncertainty; hence, they do not reflect the effect of imprecision in probability assignments, as captured by alternative uncertainty representation frameworks such as imprecise probability, possibility theory and evidence theory. In the present paper we consider the issue of imprecision in relation to uncertainty importance measures. We define an imprecision importance measure to evaluate the effect of removing imprecisionin the present paper focusing on imprecision removal to the extent that no epistemic uncertainty remains; as further work we suggest to also consider the more general case of imprecision removal to the extent that a probabilistic representation of uncertainty remains. A numerical example is presented to illustrate the suggested measure in the case of a possibilistic uncertainty representation. system level parameter p, this type of UIM evaluates changes to the distribution of p by assuming q i known for some i. Of course, the value of q i cannot be specified with certainty and so the resulting measure becomes a function of q i . An example is the measure Var(p) -Var(p|q i ), expressing the reduction in the variance of the system level parameter p that is achieved by specifying the value of the component level parameter q i . One way to proceed is to consider the expected value of the above measure, as done by [START_REF] Iman | A matrix-based approach to uncertainty and sensitivity analysis for fault trees[END_REF], namely:

]) | [ ( )] | ( [ ) ( i q p E Var i q p Var E p Var  
.

(1) [START_REF] Aven | On the use of uncertainty importance measures in reliability and risk analysis[END_REF] investigate the link between UIM and traditional IM. In doing so they distinguish between the cases that X and Y as introduced above are (a) observable events and quantities, such as the occurrence of a system failure and the number of system failures, and (b) unobservable parameters, such as p and q. Based on their findings a combined set of IM and UIM is defined.

In the present paper we consider the case that a distribution pair H q is introduced for q. We may for example have H q = [N q , Π q ], where N q and Π q are the cumulative necessity and possibility distributions of q, respectively; or H q = [Bel q , Pl q ], where Bel q and Pl q are the cumulative belief and plausibility distributions of q, respectively; or H q = [H q l , H q u ] where H q l and H q u are lower and upper imprecise probability distributions of q, respectively. Defining the imprecision of a distribution pair as the area between its lower and upper cumulative distributions, we define an imprecision importance measure (IIM) that evaluates the effect on system level parameter imprecision of removing component level parameter imprecision. Two extents of imprecision removal are possible:

i. Removal of imprecision to the extent that a probabilistic representation remains. ii. Removal of imprecision to the extent that no epistemic uncertainty remains.

The latter case may be seen as a special case of the former. The definition of an IIM in terms of imprecision removal is associated with an analogous problem as was seen above for uncertainty removal in the case of UIM; namely, the measure can be defined but neither the specific value of a component level parameter nor its probability distribution can really be specified. We are led to consider, respectively:

I. The least and most specific probability distributions consistent with H q . II. The IIM as a function of q i .

In the following we refer to these as type I and type II measures. In the present paper we focus on the type II measure.

The remainder of the paper is organized as follows: In Section 2 we review some basic classical IM and some UIM. In Section 3 we review the concepts of uncertainty and imprecision, as well as their representation. In Section 4 we define an IIM as indicated above, and in Section 5 the suggested measure is evaluated in terms of a numerical example. Section 6 provides a discussion and some directions for further work.

CLASSICAL IM AND UIM

There are essentially two fundamental classical IM: the "improvement potential" of a component, describing the effect on the system reliability of making the component perfectly reliable; and the Birnbaum IM, reflecting the effect on system reliability of an incremental change in the reliability of a component. The improvement potential of a component is defined by (e.g. [START_REF] Aven | Stochastic Models in Reliability[END_REF][START_REF] Nøkland | On selection of importance measures in risk and reliability analysis[END_REF])

) ( ) , 1 ( q h q i h  , (2)
where h(q) is the system reliability function, i.e. an expression of p as a function of q; and h(1 i ,q) = h(q 1 ,...,1 i ,...q n ), i.e. the system reliability function when component i is perfectly reliable. The IMs referred to as risk achievement worth (RAW) and risk reduction worth (RRW) (e.g. [START_REF] Cheok | Use of importance measures in risk-informed regulatory applications[END_REF][START_REF] Nøkland | On selection of importance measures in risk and reliability analysis[END_REF][START_REF] Zio | Computational Methods for Reliability and Risk Analysis[END_REF] represent minor adjustments of the improvement potential IM. The Birnbaum IM is defined by (e.g. [START_REF] Aven | Stochastic Models in Reliability[END_REF][START_REF] Nøkland | On selection of importance measures in risk and reliability analysis[END_REF][START_REF] Zio | Computational Methods for Reliability and Risk Analysis[END_REF]

) i q q h   ) ( , (3)
i.e. as the partial derivative of the system reliability with respect to q i . The improvement potential IM is most relevant in the design phase of a system, whereas the Birnbaum IM is most relevant in the operational phase (Nøkland & Aven, unpubl.). See [START_REF] Nøkland | On selection of importance measures in risk and reliability analysis[END_REF] and [START_REF] Zio | Computational Methods for Reliability and Risk Analysis[END_REF] for a more in-depth review of classical IMs. UIMs were described to some extent in Section 1.

The UIM by [START_REF] Iman | A matrix-based approach to uncertainty and sensitivity analysis for fault trees[END_REF] is variance-based and hence an example of a measure in one of the three categories described by [START_REF] Borgonovo | Measuring uncertainty importance: Investigation and comparison of alternative approaches[END_REF]:

i. Nonparametric techniques (input-output correlation) ii. Variance-based importance measures iii. Moment-independent sensitivity indicators.

See [START_REF] Borgonovo | Measuring uncertainty importance: Investigation and comparison of alternative approaches[END_REF] for a more in-depth review of UIMs.

UNCERTAINTY, IMPRECISION AND ITS REPRESENTATION

In engineering risk analysis a distinction is commonly made between aleatory (stochastic) and epistemic (knowledge-related) uncertainty (e.g. [START_REF] Apostolakis | The concept of probability in safety assessments of technological systems[END_REF][START_REF] Helton | Guest editorial: treatment of aleatory and epistemic uncertainty in performance assessments for complex systems[END_REF]. Aleatory uncertainty refers to variation in populations. Epistemic uncertainty refers to lack of knowledge about phenomena and usually translates into uncertainty about the parameters of a model used to describe random variation. Whereas epistemic uncertainty can be reduced, aleatory uncertainty cannot and for this reason it is sometimes called irreducible uncertainty [START_REF] Helton | Guest editorial: treatment of aleatory and epistemic uncertainty in performance assessments for complex systems[END_REF].

Traditionally, limiting relative frequency probabilities are used to describe aleatory uncertainty and subjective probabilities are used to describe epistemic uncertainty. However, as described in Section 1, several alternatives to probability as representation of epistemic uncertainty have been suggested, the motivation being to capture imprecision in subjective probability assignments. Imprecision here refers to inability to precisely specify a probability (distribution).

Numerical possibility distributions can encode special convex families of probability measures [START_REF] Dubois | Possibility theory and statistical reasoning[END_REF]. In possibility theory, uncertainty and imprecision is represented by a possibility function π. For each element ω in a set Ω, π(ω) expresses the degree of possibility of ω. Since one of the elements of Ω is the true value, it is assumed that π(ω) = 1 for at least one element ω. The possibility measure of an event A, Π(A), is defined by

) ( sup ) (        A , ( 4
)
and the necessity measure of A, N(A), by

) ( 1 ) ( A A N    . ( 5
)
Uncertainty about the occurrence of an event A, then, is represented by the couple [N(A), Π(A)], where the necessity and possibility measures can be given the interpretation of probability bounds, i.e. lower and upper probabilities, respectively.

AN IMPRECISION IMPORTANCE MEASURE

Consider the system level reliability or risk parameter p and its distribution pair H p induced by the propagation of a distribution pair H q through a model g. Define the imprecision of a distribution pair H, denoted Δ(H), as the area between its lower and upper cumulative distributions, i.e.

    dx x H x H H )) ( min ) ( (max ) ( . ( 6
)
For example, in the case of a distribution pair H = [N, Π] induced by a triangular possibility distribution π with support S, we haveby geometrical considerations and recalling that a possibility distribution has unit heightthat the imprecision of the possibility distribution is Δ(H) = |S|/2. In the case of a probabilistic representation of uncertainty we have max H(x) = min H(x) for all x, and hence Δ(H) = 0. Now define Δ i (H p ) as the imprecision of H p when the imprecision of the distribution on the parameter q i is removed. We may then define an imprecision removal importance measure (IRIM) as

) ( ) ( p i p i H H IRIM     , (7)
which expresses the amount of system level imprecision removal that comes from removing imprecision at the component level. The relative imprecision removal effect can be studied in terms of the measure

) ( ) ( ) ( p p i p i H H H RIRIM      , ( 7
)
which expresses the fraction of imprecision associated with the distribution pair H p that is attributable to component i.

As described in Section 1, imprecision can be removed either to the extent that a probabilistic representation remains, or to the extent that no epistemic uncertainty remains. Removal of imprecision to the extent that a probabilistic representation remains means that uncertainty about q i is described using a (subjective) probability distribution F qi (x) = P(q i ≤ x), as illustrated in Figure 1. Removal of imprecision to the extent that no epistemic uncertainty remains means that q i can be specified with certainty, and hence represented by δ qi (x), where δ qi (x) is the Dirac measure which equals 1 at x = q i and 0 otherwise, as illustrated in Figure 2. As described in Section 1, a substitute to imprecision removal to the extent that a probabilistic representation remains is the least and most specific probability distribution consistent with H q . In the case of removal of imprecision to the extent that no imprecision remains, we are led to consider the suggested IIM as a function of q i , denoted (R)IRIM i II (q i ). In Section 5 we present a numerical example evaluating the latter type of measure.

NUMERICAL EXAMPLE

We consider a system S consisting of three independent components, where component 1 and 2 are connected in a parallel configuration, which is again connected to component 3 in a series configuration. The reliability block diagram associated with system S is shown in Figure 1. Component i has availability q i , i = 1, 2, 3. The availability of the system, denoted p, is then Table 1 lists the component and system availability distribution parameters as well as the associated imprecision index. Figure 5 shows the type II RIRIM as a function of q i for all the three components in system S. The (R)IRIM for each component is evaluated as a function of q i on the support of the associated distribution. Fixing the value of the availability of components 1 and 2 has the least imprecision removal effect on the system availability distribution. Depending on which values q 1 and q 2 are fixed at, the imprecision of the system availability distribution is reduced by a percentage between 1.29 and 7.54 for component 1 and between 9.05 and 12.6 for component 2. The greatest imprecision reduction can be obtained by fixing the value of the availability of component 3. By fixing q 3 , the imprecision related to the system availability can be reduced by between 83.5 and 85.3 per cent. Table 2 summarises the value ranges of the (R)IRIM. In the present paper we have suggested an importance measure that can be used to evaluate the effect on system level parameter imprecision of removing component level parameter imprecision. Hence the suggested measure is defined analogously with the classical improvement potential IM which describes the effect of removing the unreliability of a component, and analogously with a number of UIMs that describe the effect of removing uncertainty about component performance.

Two extents of imprecision removal are considered: reduction to a probabilistic representation (type I) and removal of epistemic uncertainty (type II), the latter a special case of the former. Focus is put on the type II measure, and in a numerical example we study both the absolute and relative versions of the measure.

The relative version of the measure expresses the fraction of the initial amount of imprecision on the system level parameter that is attributable to each component. In a ranking setting this format is perhaps easier to comprehend than the underlying absolute numbers; however, the fractions need to be seen in relation to the initial amount of imprecision on the system level parameter.

Table 1 shows that component 2 and 3 have the same imprecision index when looked at in isolation, yet for the simple system example presented in Section 5 the conclusion is clearly that component 3 has the greatest imprecision importance. Looking at the structure function of system S it is clear that changes to the availability of component 3 will have the greatest direct effect on the system availability. In relation to system S it thus seems that the physical structure of the system is more important in terms of imprecision than is the shape of the individual distributions. For more complex systems and for other input distributions the conclusion may be less clear.

Further work in relation to the suggested measure is intended directed towards the implementation of the type II measure on more complex systems. Further work is also intended towards the development and implementation of the type I measure. Moreover, possibility theory provides a relatively simple and hence convenient uncertainty representation to use for the implementation of the suggested measures; however, other representations should also be considered in terms of application.

Finally, IIMs may be seen simply as a (natural) technical extension of UIMs when the uncertainty representation is no longer single-valued probability but instead some alternative representation with the interpretation of lower and upper probabilities. More interesting and potentially more decisiveis the role of IIMs in highlighting the relevancefor decisionmakingof making the imprecision concept a central object of study in risk and reliability analysis. There is currently much interest and debate concerning the use of alternative representations of uncertainty in this setting, and sensibly defined and decision-relevant IIMs would be a relevant argument in this debate.

Figure 1 .

 1 Figure 1. Removal of imprecision (imprecise probability sitributiondashed lines) to the extent that a single-valued probabilistic representation remains (solid line).

Figure 2 .

 2 Figure 2. Removal of imprecision (imprecise probability sitributiondashed lines) to the extent that a no epistemic uncertainty remains (solid line).

Figure 3 .

 3 Figure 3. Reliability block diagram of system S.

Figure 5 .

 5 Figure 5. Type II RIRIM for each component of system S.

  On imprecision in relation to uncertainty importance measures R. Flage & T. Aven

	University of Stavanger, Norway

Table 1 .

 1 Component and system availability distribution parameters and imprecision index for system S.

	__________________________________________________
	i __________________________________________________ s 1 c 1 c 2 s 2 Δ(H i )
	1	0.80	0.85	0.85	0.90	0.05
	2	0.80	0.85	0.90	0.95	0.10
	3 __________________________________________________ 0.80 0.80 0.90 0.90 0.10
	System __________________________________________________ 0.77 0.78 0.89 0.90 0.12

Table 2 .

 2 Type II (R)IRIM value ranges.

	__________________________________________________
	i __________________________________________________ IRIM i II II RIRIM i
	1	[0.0015, 0.0087] [1.29 %, 7.54 %]
	2	[0.0105, 0.0146] [9.05 %, 12.6 %]
	3 __________________________________________________ [0.0969, 0.0990] [83.5 %, 85.3 %]
	6 DISCUSSION AND FURTHER WORK

2 1

ACKNOWLEDGEMENTS

The work of E. Zio and P. Baraldi has been partially funded by the "Foundation pour une Culture de Securite" Industrielle" of Toulouse, France, under the research contract AO2009-04.

Terje: RAMONA???

The availability parameters q = (q 1 , q 2 , q 3 ) are assumed to be unknown, the uncertainty being described using marginal necessity/possibility distribution pairs H = (H 1 , H 2 , H 3 ), where H i (x) = [N(q i ≤ x), Π(q i ≤ x)], i = 1, 2, 3. We assume that the distribution pair H 1 is induced by a triangular possibility distribution π 1 with lower support 0.90, mode 0.95 and upper support 0.99; that the distribution pair H 2 is induced by a trapezoidal possibility distribution π 2 with lower support 0.92, lower mode 0.94, upper mode 0.96 and upper support 0.98; and that the distribution pair H 3 is induced by a uniform possibility distribution π 3 with lower support 0.85 and upper support 0.95. The component availability distributions and the resulting system availability distribution are illustrated in Figure 4. Let s 1 and s 2 (c 1 and c 2 ) denote the lower and upper support (core) limit of a possibility distribution, respectively. For a trapezoidal distribution we have s 1 < c 1 < c 2 < s 2 , for a triangular distribution s 1 < c 1 = c 2 < s 2 , and for a uniform distribution s 1 = c 1 < c 2 = s 2 . For these distribution classes we then have that the imprecision equals


INTRODUCTION

According to the current EU regulations (Directive 85/337/EEC as amended by Directives 97/11/EC and 2003/35/EC), an Environmental Impact Assessment (EIA) is required for public and private projects likely to have significant impacts on the environment by virtue inter alia of their nature, size or location. The scope of an EIA is the identification, description and assessment of project's direct and indirect effects on human beings, fauna and flora, soil, water, air, climate, landscape, material assets and cultural heritage. EIA procedure is a part of the decisional process for the approval of a proposed project. Predictions of EIA help and orient the activity of decision makers ensuring that environmental considerations are taken into account. Furthermore, EIA serves an important procedural role in the overall decision-making process by promoting public information and participation. Therefore, an EIA study needs to be carried out considering that its output will be not only handled by expertise but also it will be communicated to decision maker, stakeholders and local population. Assuming that in most cases the proposed project does not meet popular consensus, communicability of EIA predictions to residents and stakeholders plays a major and challenging role. To this purpose the whole EIA procedure must be an open and transparent process leading to robust and reproducible outputs for informed decision-making and correct public awareness.

In this context, waste disposal installations for the incineration of both hazardous and non-hazardous waste are subject to EIA, in particular with regards to their potential impact on air quality.

With reference to the proposal of a new project, EIA consists of three main steps (Figure 1): a) the characterization of the source: estimation of the atmospheric emissions from the operation of the plant in terms of both the types and the quantities of pollutants; b) the estimation of the atmospheric pollutant concentration levels in the area close to the proposed new installation by means of proper dispersion models; c) the assessment of the pollutant concentration levels at the receptor, resulting from the superposition of the estimated concentration to the existing background concentration levels The first objective is that of proving the compliance of the estimated concentrations with both long-term (i.e.: annual average) and short-term (i.e.: hourly and daily average) air quality limits. Secondly, as those installations are responsible for the emission of metals, dioxins and furans (PCDD/Fs), additional evaluations may also include human health risk assessment for both carcinogenic and noncarcinogenic pollutants. This latter assessment is characterized by two main features: i) a considerable complexity of the mechanisms involved and hence related uncertainties, ii) a general attitude of "aversion to risk", with implications on the way uncertainties are treated [START_REF] Guyonnet | Soft methods for treating uncertainties: applications in the field of environmental risks[END_REF].

E. Zio

Ecole Centrale Paris and Supelec, Paris, France & Dipartimento di Energia -Politecnico di Milano, Milano, Italy ABSTRACT: In this paper we propose a comparison between two different approaches for uncertainty propagation in Environmental Impact Assessment (EIA) procedures. Both a purely Probabilistic (PMC) and a Hybrid probabilistic-possibilistic Monte Carlo method (HMC) are applied on an estimation model of dioxin/furans emission from a waste gasification plant. The analysis shows that when input variables affected by scarcity of information are present, HMC seems to be a valid alternative method that properly propagates uncertainty from data to output avoiding arbitrary and subjective assumptions on the input probability distribution functions. HMC could improve the transparency of the EIA procedure with positive effects on the communicability and credibility of its predictions. These uncertainties, which affect all the three steps of the EIA procedure, may be originated from randomness of process or from scarcity of information and lack of knowledge. In particular, regardless for the approaches and models adopted to estimate the plant emissions and their dispersion in the atmosphere, the final concentrations and deposition estimates are seriously affected by the uncertainty of the values of the source term parameters.

The attitude of "aversion to risk" often leads to answer to the question whether a given "acceptable" threshold may be exceeded relying on limiting scenario calculations. In common practice, this means that input parameter uncertainties are often neglected and a simplistic deterministic approach is adopted, in which the emissions are conservatively estimated on the basis of project design data and assuming i) a full-load plant operation and ii) the emission concentrations of the pollutants equal to the emission regulatory limits. This approach is often excessively conservative, and does not provide a realistic and objective description of the plant impact on the environment.

To overcome this problem, the EIA procedures can be applied within a probabilistic approach for i) describing the uncertainties of the input parameters and ii) propagating them to the models outputs, i.e. the atmospheric pollutant concentrations. In the probabilistic approach the uncertain variables are described by means of probability distribution functions (PDFs), which are then propagated through the impact assessment model by Monte-Carlo (MC) simulation [START_REF] Lonati | Health risk analysis of PCDD/F emissions from MSW incineration: comparison of probabilistic and deterministic approaches[END_REF]) [START_REF] Schuhmacher | The use of Monte-Carlo simulation techniques for risk assessment: study of a municipal waste incinerator[END_REF][START_REF] Sonnemann | Framework for the uncertainty assessment in The Impact Pathway Analysis with an application on a ocal scale in Spain[END_REF].

However, in general, the construction of the empirical PDFs representing the uncertainty in the input parameters by statistical analysis may not be an easy task due to the scarce data availability typical of the environmental context [START_REF] Ferson | Different methods are needed to propagate ignorance and variability[END_REF], Baudrit et al. 2006). Within a probabilistic framework the analyst solves this task forcing a PDF on the scarce available data on the basis of his subjective judgement. This operation presents two important drawbacks: -doubts have been raised on the consistency of this forced PDF with the incomplete/imprecise information at hand. The risk is to introduce information that is in fact not available. -this subjective and arbitrary view of probability adds assumptions in the analysis, which are often neither declared nor justified, causing a loss of transparency in the procedure. These drawbacks are of particular relevance, considering the EIA role as decision aiding tool and informative tool. A lack of transparency in the procedure can lead to a loss of credibility among decision makers and public. A number of alternative representations of uncertainty under limited information availability (e.g.: fuzzy set theory, evidence theory, possibility theory and interval analysis) have been proposed and applied in different field of risk assessment [START_REF] Klir | Fuzzy Sets and Fuzzy Logic: Theory and Applications[END_REF][START_REF] Aven | Some considerations on the treatment of uncertainties in risk assessment for practical decision making[END_REF]. Among them, Possibility Theory has received growing attention because of its representation power and its relative mathematical simplicity. In recent past years some applications of these alternative approaches have also been exploited in the environmental risk assessment field [START_REF] Kumar | Partitioning total variance in risk assessment: Application to a municipal solid waste incinerator[END_REF][START_REF] Guyonnet | Hybrid approach for addressing uncertainty in risk assessments[END_REF][START_REF] Kentel | 2D Monte Carlo versus 2D fuzzy Monte Carlo health risk assessment[END_REF][START_REF] Li | An integrated fuzzy-stochastic modelling approach for risk assessment of groundwater contamination[END_REF].

In practice, different input parameters of the same model may be characterized by different amounts of information availability, thus possibly giving rise to both probabilistic and possibilistic uncertainty representations. In this regard, recently Hybrid probabilistic-possibilistic Monte Carlo methods (HMC) have been proposed for combining both representations in the same uncertainty propagation analysis (Baudrit et al. 2006[START_REF] Baraldi | A Combined Monte Carlo and Possibilistic Approach to Uncertainty Propagation in Event Tree Analysis[END_REF][START_REF] Flage | Possibilityprobability transformation in comparing different approaches to the treatment of epistemic uncertainties in a fault tree analysis[END_REF].

In this work a HMC method is applied to an uncertainty propagation analysis in an emission estimation model for PCDD/Fs in a planned new waste gasification plant. The results are compared to those obtained by a standard PMC approach, showing a better capability of handling limited data knowledge, without forcing statistically unjustified probability distributions on data. The positive aspect of this approach with respect to the transparency of the EIA procedure and to the communicability of results are also discussed.

The paper is organized as follows. In Section 2 the HMC and PMC methods are methodologically compared on a case study regarding the emission model of dioxin/furans from a waste gasification plant; the results are provided in Section 3. Finally, some conclusions on the advantages of the HMC method are

Source term (emission estimation)

Transport term (atmospheric dispersion)

Impacts on targets term (concentration in air, deposition to soil, human exposure & health risk) drawn in Section 4. In the appendix Section A1 provides the basics of possibility theory and Section A2 presents the pure Probabilistic Monte Carlo method for uncertainty propagation and its evolution to the Hybrid probabilistic-possibilistic Monte Carlo method under scarce data availability.

CASE STUDY: THE EMISSION MODEL OF DIOXIN/FURANS FROM A WASTE GASIFICATION PLANT

The uncertainty representation and propagation methods introduced in Section 3 are applied to the first step of the EIA procedure with reference to a planned waste gasification plant. The objective is the estimation of dioxin/furan (PCDD/F) emission within the flue gas released at the stack of the plant. Notice that PCDD/F pollutants have a relevant role in health risk assessment due to their carcinogenic potential and their persistency in the environment, once released into the atmosphere.

The emission model adopted computes the emitted PCDD/F mass flow, Q (ng/s), as a function of the plant daily throughput, P (Mg waste /day), the PCDD/F concentration in the emitted flue gas, C D (ng/m 3 ), and the specific gas production V F (m 3 /Mg waste) :

24 3600    F D V C P Q (1)
As usual for this kind of evaluations, the PCDD/F concentration is expressed in terms of equivalent toxicity mass per unit volume at normal conditions (0° C, 101.3 kPa); coherently, the specific gas production refers to the same temperature and pressure conditions. The input parameters can be characterized as follows:  the plant daily throughput P is a constant parameter whose value is assigned during project design.

In the plant of the case study, P is set to the value of 9000 Mg waste /day.  the PCDD/F concentration C D is an uncertain parameter whose value varies during normal gasification operation due to the fluctuations of the process parameters and to the heterogeneous and variable composition of the fed waste.  the specific gas production V F is an uncertain parameter. Although its value is set during the project design phase, V F can present variations during plant operation caused by fluctuations of the energy content of the fed waste, which is characterized by an heterogeneous and variable composition.

Due to the rather limited applications of the waste gasification process, datasets containing C D e V F values collected during operation of similar plants are not available. However, different studies have recently investigated the pollutant emission from waste gasification plants (University of California 2009, [START_REF] Yamada | Thermoselect Waste Gasification and Reforming Process[END_REF][START_REF] Porteous | Why energy from waste incineration ia an essential component of environmentally responsible waste management[END_REF], Arena et al. 2008b[START_REF] Klein | Gasification: An Alternative Process for Energy Recovery and Disposal of Municipal Solid Wastes[END_REF]. From these studies, it has been possible to identify 35 C D and 4 V F values.

Given the availability of a statistically significant set of C D values, the uncertainty on this model parameter has been represented using a probability distribution. A Kolmogorov-Smirnov's test considering lognormal, Weibull, Beta, logistic PDFs has been performed in order to properly choose the PDF representative of the available data. Figure 1 shows the selected Beta-PDF of parameters α = 0.36 and β = 1.32 and maximum value 0.07 ng/m 3 . With respect to V F , the available information (four literature values and the case study project value) is very scarce. Thus, two different alternative representations of the uncertainty affecting V F have been considered:  a subjective triangular PDF based on analyst judgment. The PDF range is [3360,6670] corresponding to the minimum and maximum values of the four available literature values and its mode is 5420 corresponding to the current case study project value (Figure 2).  a triangular possibility distribution with the same range of the subjective PDF and most likely value set equal to the case study project value (Figure 3). Notice that, although the possibility and probability distributions used to represent the uncertainty on V F have similar shapes, they convey very different information: the possibility distribution summarizes a set of cumulative distributions, bounded by the so-called Necessity and Possibility functions, whereas the subjective PDF defines just one specific cumulative distribution of that set.

Table 1 summarizes the different distributions used in this work for the representation of the uncertainty on the two input parameters. With respect to the uncertainty propagation, the PMC method is applied to the case in which the uncertainty on C D and V F are represented by the PDFs, whereas the HMC method considers the PDF for C D and the possibility distribution for V F .

The number m of MC realizations of the parameters C D and V F used in the PMC method has been set to 1000. The HMC procedure, instead, has been run considering 1000  m realizations of the parameter C D and, for each of these realizations, 21 α values (range 0-1, step 0.05) for the possibilistic variable V F .

Although C D and V F are expected to be somehow correlated, both PMC and HMC methods have been applied assuming independency between the two parameters. Notice that, due to the complexity of the waste gasification process and to the high number of involved parameters, information useful to model the dependence between C D and V F has not been found in literature.

RESULTS

The cumulative distributions of the model output variable, Q, obtained by applying the PMC and HMC uncertainty propagation methods are presented in Figure 5. The PMC method provides a single cumulative distribution (continuous line), whereas the HMC model provides the belief (lower dotted curve) and the plausibility (upper dashed curve) distributions, which can be interpreted as the boundary cumulative distributions of Q.

As expected, the cumulative distribution of the model output obtained by the PMC is within the belief and plausibility functions obtained by the hybrid approach.

Notice that the representation of the uncertainty on Q provided by the PMC method is more concise and easy to be interpreted than that provided by the HMC method. However, this is a consequence of the different representation of the uncertainty on the input parameter V F : while the HMC method considers a set of cumulative distributions, the PMC forces all the uncertainty on V F to be represented by a single distribution. Given the scarcity of information available in this case, the use of a PDF seems statistically unjustified. It can also be seen that the HMC method allows to process separately the uncertainty on C D , represented by a probability distribution, from the uncertainty on V F , represented by a possibility distribution. These two contributions are explicitly visible in the results: the uncertainty on Q affects the slope of the belief and plausibility functions, while the separation between the belief and plausibility functions reflects the imprecision in the knowledge of the parameter V F . In the PMC method, instead, the contributions of the uncertainty on the two input parameters onto the output uncertainty are merged and result in the slope of the output cumulative distribution.

Within the EIA procedure it can be interesting to lump all the information contained in the obtained cumulative distribution of Q into a single value such as a β percentile. To this purpose, setting a degree of confidence β=0.95, the PMC method provides a single value, Q 95 =3.08 ng/s, representative of the 95 th percentile. Using the HMC, the 95 th percentile is an uncertain quantity whose true value is in the interval [2.52 ng/s -3.42 ng/s] corresponding to the 95 th percentile of the Belief and Plausibility functions. Table 2 reports the values of different percentiles both for PMC and HMC methods, as visible PMC values are always in the range of HMC values and the distance between the plausibility and belief functions increases from lower to higher percentile.

Finally, notice that these estimates of the 95 th percentile of the emitted PCDD/F mass flow, Q, obtained with both uncertainty propagation methods are one order of magnitude lower than the estimate, Q=56.4 ng/s, calculated with a deterministic approach based on the plant design data and on the PCDD/F regulatory emission limit (0.1 ng/m 3 ). [0.44, 0.61] [1.27, 1.75] [2.52, 3.42] 4 CONCLUSION

In this paper a Hybrid probabilistic and possibilistic Monte Carlo method (HMC) has been applied to the Dioxin/Furan emission assessment model of a planned waste gasification plant and the results have been compared to those obtained by a pure Probabilistic Monte-Carlo method (PMC).

When input variables affected by scarcity of information are present, the HMC method has shown to be more effective in propagating the input uncertainties through the model in that i) the information provided by its outputs is more consistent with that available for the input parameters and ii) uncertainty is processed more "transparently" than with PMC methods, thus avoiding arbitrary and subjective assumptions by the analyst on the input probability distribution functions. Moreover, the HMC method allows separating the contributions to the output uncertainty due to the probabilistic and the possibilistic input parameters.

This work has been conceived as a preliminary study to understand the applicability of HMC methods to the complete EIA procedure. In this regard, the satisfactory outcomes of this first analysis foster future works towards the extension of the HMC method to the remaining stages of an EIA procedure.

Finally, it is worth noticing that the principal users of EIA outputs are decision-makers often responsible for communicating the results to the population living in the area of the planned installation. With respect to environmental and health-related issues, there is in general social aversion to accept information expressed in terms of probability. Therefore, future studies will also have to investigate the way of post-processing the results of a whole EIA procedure developed within an hybrid probabilisticpossibilistic framework to make them communicable to the stakeholders and to make them more easily understandable. To this purpose, the abilities of the HMC method to avoid arbitrary assumptions and to provide results that explicitly report both probabilistic and possibilistic uncertainties could be useful for a transparent and clear post-process.



for some y , it means that the outcome y is considered an impossible situation. When 1 ) (  y  for some y , it means that the outcome y is possible, i.e.: is just unsurprising, normal, usual [START_REF] Dubois | assessment of the effects of certain public and private projects[END_REF]. This is a much weaker statement than when probability is 1.

The possibility function gives rise to probability bounds, upper and lower probabilities, referred to as necessity and possibility measures ( N ,  ). The possibility of an event

A ,   A 
, is defined by

    ) ( sup y A A y     , (a.1)
and the necessity measure  

A N is defined by     ) ( sup 1 ) ( 1 y notA A N A y       
.

Let P(  ) be a family of probability distributions such that for all events A ,  

) ( ) ( A A P A N    . Then,   ) ( inf A P A N  and   ) ( sup A P A   (a.2)
where inf and sup are with respect to all probability measures in P. Hence the necessity measure is interpreted as a lower level for the probability and the possibility measure is interpreted as an upper limit. Referring to subjective probabilities, the bounds reflect that the analyst is not able or willing to precisely assign his/her probability, and the bounds are the best he/she can do given the information available; in other words, he or she can only describe a subset of P which contains his/her probability [START_REF] Dubois | assessment of the effects of certain public and private projects[END_REF].

A.2. PROBABILISTIC-POSSIBILISTIC UNCERTAINTY REPRESENTATION AND PROPAGATION THROUGH A MODEL

Let us consider a model whose output

  n Y Y Y f Z ,..., , 2 1  is a function of n uncertain va- riables n i Y i , , 1 ,  
. The uncertainties of the first k variables can be represented by probability distributions

  y p i Y
properly derived from data, whereas for the remaining k n  the scarcity of information provide a weaker statistical base for a specific probability assignment, making the construction of PDFs a critical operation. Two different approaches are here presented to represent and propagate such uncertainties a. Pure probabilistic Monte-Carlo method (PMC) The uncertainties of all n input variables are treated in terms of probability distributions. Probability representations of the k n  variables can be assigned i.e.: based on expert judgment. For example, let us considered a typical case in which the available information on a model parameter x is only that its values are located somewhere between a value x min and a value x max. In this case, a uniform probability

distribution     m in m ax / 1 x x x p   ,  x [x min ,
x max ] is typically assumed to represent the uncertainty on x. This approach appeals to: i) Laplace principle of insufficient reason according to which all that is equally plausible is equally probable and to ii) the maximum entropy approach [START_REF] Baraldi | Methods of Uncertainty Analysis in prognostics[END_REF] . However, doubts on the consistency of this uncertainty representation have been raised (Baudrit et al. 2006) as it seems that the insufficient knowledge may justify choices of specific functional probability distributions, like the uniform, but it should somehow account for the full set of possible probability distributions on X = |x min , x max |, so that the probability of value   x is allowed to take any values in |0,1| [START_REF] Baraldi | Methods of Uncertainty Analysis in prognostics[END_REF].

The PMC method then applies a single loop Monte Carlo simulation to propagate the uncertainties of the n variables through the model. The operative steps of the propagation procedure are the following: 1 Sample the th i  realization  

n k Y Y   , , 1   .
Different methods have been developed to derive possibility distributions from the available information (Baudrit & Dubois 2006, Dubois 1993). Often the analyst only knows that an uncertain variable can take values in a given range [a, b] wherein the most likely value is c. Triangular possibility function with the range |a, b| taken as base and c taken as vertex can be typically used to describe this information. It has been shown that the family of probability distributions defined by such possibility distribution with contains all the probability distributions with support [a, b] and mode c (Baudrit & Dubois 2006).

In the HMC method, the propagation of the uncertainties expressed in terms of both PDFs and possibility curves is performed by combining the Monte Carlo technique with fuzzy interval analysis (Baudrit et al. 2006)

  k Y Y , , 1 
and all values of the possibi-

listic variables   n k Y Y , , 1   in the α -cuts of their possibility distributions   n k Y Y   , , 1   found in 2.



, by:  

) ( max ) ( z A f i A z f i     (a.3)     A z A f i f i A z f i         1 ) ( 1 inf ) ( (a.4) Z U A  
Finally, the m different realizations of possibility and necessity measures can be combined to obtain the belief ) ( A Bel and the plausibility ) (A Pl for any set A , respectively (Baudrit et al. 2006) (Baudrit et al. 2006). Thus, one way to estimate the total uncertainty on

    z Y f Bel z F , ) ( ) (     ,     z Y f Pl z F , ) ( ) (    
  Y f
is to provide a confidence interval at a given level of confidence, taking the lower and upper bounds from

    z Y f Pl , ) (    and   ) (Y f Bel   z ,  
, respectively (Baudrit et al. 2006). Notice, however, that it is not possible to directly obtain information on the mean and standard deviation of the output distribution from the plausibility and belief distributions.

Figure 1

 1 Figure 1 Schematic framework of the main steps of the EIA for industrial plants.

Figure 2

 2 Figure 2 Empirical cumulative distribution (dots) of the data used to estimate the PCDD/F concentration, C D , and Beta distribution used to fit the data.

Figure 3 Figure 4

 34 Figure3Subjective triangular-PDF of the specific gas production, V F , considered by the PMC method

Figure 5

 5 Figure 5 Comparison of the cumulative distributions of the emitted PCDD/F mass flow (ng/s), Q, obtained by the PMC and HMC methods.

  formation on the output uncertainty. Setting a percentile  , that corresponds to the desired degree of confidence, a concise output value of Z can be provided. The output realizations i be directly used to compute other lumped indicators of the output distribution, such as its mean and standard deviation values.b. Hybrid probabilistic-possibilistic Monte-Carlo method (HMC)In the Hybrid probabilistic-possibilistic method, the uncertainties of the k n  variables are represented in terms of possibility distributions  

  step 2. and repeat for another α -cut; the fuzzy random realization (fuzzy interval) each α -cut 5 return to step 1. to generate a new realization of the random variables.The procedure is repeated for m end of the procedure m realizations of fuzzy intervals are obtained, i.e.: A contained in the universe of dis- course Z U of the output variable Z , it is possible to obtain

  :

  A , this technique computes the belief and plausibility the average of the possibility measures associated with each output fuzzy interval.The likelihood of the value   Y f passing a given threshold z can then be computed by considering the belief and the plausibility of the set

Table 1

 1 Distributions used to represent the uncertainty on the model parameters by the PMC and HMC method

	Parameter	Type	PMC method	HMC method
	P	Constant	9000	9000
	C D	Uncertain	Beta-PDF [ =0.36, =1.22, Max=0.07]
	V F	Uncertain	Triangular-PDF [3360, 6670, 5420] Triangular-π

Table 2

 2 Estimated PCDD/F mass flow (ng/s): comparison of some percentiles obtained by the PMC and HMC method.

	percentile