Antoine Rogeau
email: antoine.rogeau@mines-paristech.fr

Thibaut Barbier
email: thibaut.barbier@mines-paristech.fr

Nicolas Kong
email: nicolas.kong@enedis.fr

EVOLUTION OF ELECTRICAL DISTRIBUTION GRID SIZING CONSIDERING SELF-CONSUMPTION OF LOCAL RENEWABLE PRODUCTION

In the last decades, renewable energy sources have been increasing their shares in the world energy market. In addition to the ecological benefits, this trend can have adjunct benefits, for example for distribution system operators: a gain in their grid sizing. Indeed, installation of decentralized production, when used in a selfconsumption approach, can lead to reduction of the consumption peaks. This work is willing to quantify what grid sizing reduction a distribution system operator can expect, knowing the renewable energies penetration rate on a MV feeder. To do so, a description of the actual sizing strategy is first described. Estimation of electricity demand is performed using a bottom-up simulation method while photovoltaics and wind power production are evaluated with reanalysis data coupled with a new method to inject variability to the smooth curves. This procedure leads to a new sizing power which can be used, guaranteeing an equivalent quality of supply for consumers. For the tested MV feeders, a maximum reduction of about 4 % of the sizing power is observed. Lastly, an analysis of the under-sizing risk is carried out, characterizing the error in the new sizing power estimation with the number of scenarios taken into account.

INTRODUCTION

Electricity production is a significant source of CO 2 emissions. According to the International Energy Agency, in 2013, electricity and heat represented 42% of global CO 2 emissions. To tackle this problem, many states are developing energy transition strategies including the growth of renewable energy sources (RES) production. In the case of photovoltaic production, the world cumulative installed capacity targeted by the energy transition roadmap for 2020 is now likely to be achieved five years earlier, and the capacity now expected in 2020 will be over twice that foreseen in the 2010 roadmap [START_REF] Iea | Technology roadmap. Solar Photovoltaic Energy[END_REF]. About half of PV deployment is due to be situated on buildings or nearby (such as parking lots) [START_REF] Iea | Technology roadmap. Solar Photovoltaic Energy[END_REF]. This implies considerable changes in the planning operation process of the distribution grid. Distribution system operators (DSOs) perform network sizing calculations by distribution considering extreme situations [START_REF] Dickert | Residential load models for network planning purposes[END_REF]. However, these extreme situations are a combination of different complex dynamics of production and consumer demand. Planning models need to incorporate simulations of these dynamics at local scale. To address this issue, this paper proposes a method for sizing the grid using a bottom-up model of electricity demand and a renewable production load curve simulator. To simulate more realistic production load curves, we present two methods to simulate local weather variability for wind and solar production. Finally, we describe a case study using French main DSO Enedis data.

GRID SIZING STRATEGIES AND FREQUENCY OF EXCEEDANCE

Distribution grid sizing calculations are generally carried out when new clients (producers or consumers) opt to connect their installation to the electrical grid. The DSO (e.g. Enedis in France) then verifies whether existing infrastructures, e.g. a distribution station, can handle this new client. To evaluate the distribution grid's capacity to receive a new load, Enedis [START_REF] Kong | Long term forecast of local electrical demand and evaluation of future impacts on the electricity distribution network[END_REF] defines dimensioning events that the grid needs to be able to resist. In this paper, we do not consider voltage issues and only consider the three following sizing events: 1) 𝑃𝑃 𝑡𝑡𝑡𝑡𝑡𝑡 : sizing the grid in normal conditions to resist the load at very low temperature 2) 𝑃𝑃 𝑡𝑡𝑚𝑚𝑚𝑚 * : sizing the grid in incident conditions, by summing the peak demand of all loads at normal temperature 3) 𝑃𝑃 𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 * = 𝑃𝑃 𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 -0.2 × 𝑃𝑃 𝑡𝑡𝑚𝑚𝑚𝑚 * : sizing the grid by production. 𝑃𝑃 𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 is the RES installed capacity.

The first event describes a case where the grid is at its normal state (no dysfunction), and the temperature is exceptionally low (probability of occurrence 1 day per year). This sizing load is called 𝑃𝑃 𝑡𝑡𝑡𝑡𝑡𝑡 . The second event considers a situation featuring an accident in the grid, such as a fault in an electric line, and tests the capacity of the restructured grid to resist the load on a normal cold day (the historical mean temperature on 15 January). This load is called 𝑃𝑃 𝑡𝑡𝑚𝑚𝑚𝑚 * . The last strategy is employed when the production means are used to size the grid: the load considers that all production means generate at their maximum capacity and that consumption is 20% of 𝑃𝑃 𝑡𝑡𝑚𝑚𝑚𝑚 * . The values 𝑃𝑃 𝑡𝑡𝑡𝑡𝑡𝑡 and 𝑃𝑃 𝑡𝑡𝑚𝑚𝑚𝑚 * can be calculated in two ways: using Enedis measurements or simulating the load curves. If we use historical measurements of the load curves, consumer behaviour can be extracted by eliminating the thermosensitive part. This is done by a linear model also used by the French Transmission System Operator [START_REF] Lefieux | Modèles semi-paramétriques appliqués à la prévision des séries temporelles[END_REF]. The statistical temperature on 15 January is then applied to the consumer behaviour, using the thermosensitivity model of the historical measurement. We then obtain 𝑃𝑃 𝑡𝑡𝑚𝑚𝑚𝑚 * . The same process, using the temperature with a probability of occurrence of 1/365, extracted from decades of measurements, can be applied to deduce 𝑃𝑃 𝑡𝑡𝑡𝑡𝑡𝑡 . This method does work, but requires reliable and complete measurement data. When some data is missing, it may be replaced by simulation. Indeed, Mines ParisTech and Enedis have developed models to simulate electricity demand and production. The electricity demand is highly correlated with the temperature, so introducing the statistical observed temperatures described above as inputs to the model permits to evaluate 𝑃𝑃 𝑡𝑡𝑚𝑚𝑚𝑚 * and 𝑃𝑃 𝑡𝑡𝑡𝑡𝑡𝑡 .

GENERATING CONSUMPTION SCENARIOS

Electricity consumption (power, temporality, etc.) depends on several parameters, such as the weather, solar irradiation and temperature, type of electric device, consumers' habits and lifestyle, and client category (residential, tertiary, industrial etc.). For several years, Enedis has been recording the electrical power delivered by its medium voltage (MV) feeders. Each feeder provides electricity for between several hundred and ten thousand low voltage (LV) clients. When Enedis wants to evaluate the impact of an area change on the feeder electricity consumption, different load scenarios are built. Building these load scenarios relies on two main techniques.

Using past measurements

One approach consists in using real consumption data. A load curve is available per year, and per MV feeder. It is possible to generate more scenarios from these measurements, by applying the meteorological conditions of an observed year to the consumer behaviour observed in another year. This involves two major steps: a. Making a thermosensitive model per feeder, and eliminating the thermosensitive part b. Applying another meteorological scenario. This approach, based on aggregated measured load curves, cannot be employed to simulate new electricity usages, such as electric vehicles or the evolution of household consumption, but only to test different meteorological conditions.

Using load curve simulation

Another approach is to simulate the load curves according to a given scenario. In our case we use a bottom-up method, named MOSAIC developed by MINES ParisTech and Enedis described in detail in [START_REF] Barbier | A novel approach for electric load curve holistic modelling and simulation[END_REF]. The description of the different household usages is defined by statistical distributions, thus making it possible to generate different consumption scenarios. The method for generating input data for MOSAIC per MV feeder is described in [START_REF] Kong | Long term forecast of local electrical demand and evaluation of future impacts on the electricity distribution network[END_REF]. Different temperature and irradiation data are used to generate multiple scenarios, combining consumer behaviour and weather conditions in order to provide inputs for MOSAIC. For each feeder, difficulties exist to collect such data, and for feeders with too many missing values and reaffectations, the past measurement method is not accurate enough. Hence, in the rest of this paper we choose to apply the different sizing methods on a simulated load curve using the MOSAIC method. We likewise calculate the MV feeders 𝑃𝑃 𝑡𝑡𝑡𝑡𝑡𝑡 and 𝑃𝑃 𝑡𝑡𝑚𝑚𝑚𝑚 * using the MOSAIC method. Moreover, as MOSAIC is a bottom-up method, it can be used to simulate the load at a smaller scale, such as LV feeders, which are not monitored by Enedis. This downscaling approach using MOSAIC is described and illustrated in [START_REF] Kong | Long term forecast of local electrical demand and evaluation of future impacts on the electricity distribution network[END_REF]. Load curves are simulated using 8 years of meteorological data. Five different scenarios are generated by the MOSAIC method and we thus get 40 possible electricity demand profiles of one year.

SIMULATION OF WEATHER VARIABILITY TOWARD REALISTIC RENEWABLE PRODUCTION DATA

Two local RES are considered in this work: photovoltaics (PV) and wind power (WP). Both productions are estimated from historical weather data, smoothed and sampled at a given temporal and spatial resolution and thus requiring the addition of variability.

Variability in PV production

Data used to simulate PV production are extracted from the SODA database, which is described in [START_REF] Espinar | HelioClim-3: a near-real time and long-term surface solar irradiance database[END_REF]. The spatial resolution of these irradiation data is about 1.5 x 1.5 km and they are sampled at a temporal resolution of 15 minutes. An introduction of spatial variability is performed. The reasoning is based on the fact that if the sky is very cloudy then spatial variability will be low, and this also applies to a very clear sky. However, for a partly cloudy sky, the irradiation variability can be high. For this reason, we performed a study of the error between the SODA irradiance estimation (𝐼𝐼 𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆 ) and measured irradiation data (𝐼𝐼 𝑆𝑆𝑂𝑂𝑆𝑆 ) as defined in [START_REF] Iea | Technology roadmap. Solar Photovoltaic Energy[END_REF].

𝜀𝜀 = 𝐼𝐼 𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆 -𝐼𝐼 𝑆𝑆𝑂𝑂𝑆𝑆 𝐼𝐼 𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆 (1)
The analysis is divided into clusters, depending on the Clear-Sky Index 𝐾𝐾 𝐶𝐶𝑆𝑆 as defined in [START_REF] Engerer | KPV: A clear-sky index for photovoltaics[END_REF] estimated at every time step (see ( 2)).

𝐾𝐾 𝐶𝐶𝑆𝑆 = 𝐼𝐼 𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆 𝐼𝐼 𝐶𝐶𝑆𝑆 ( 2
)
𝐼𝐼 𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆 is the horizontal irradiation given by the SODA model and 𝐼𝐼 𝐶𝐶𝑆𝑆 is the horizontal irradiation with a clear sky. The Clear-Sky data are obtained using the ESRA model, described in [START_REF] Rigollier | On the clear sky model of the ESRA -European Solar Radiation Atlas -with respect to the heliosat method[END_REF]. This leads us to different error distributions, depending on the cloudiness of the sky. Using the resulting distributions, we added the variability to the initial PV production estimated using SODA data to obtain photovoltaic production estimation, illustrated in Figure 1. This procedure is realized on 8 years data, due to the availability of SODA database. Ten different variable production curves are generated for each year of irradiation data.

Variability in WP production

Data used to simulate WP production are extracted from the MERRA database, described in [START_REF] Rienecker | MERRA: NASA's Modern-Era Retrospective Analysis for Research and Applications[END_REF]. The spatial resolution of these wind data is about 50 km x 50 km and they are sampled at a temporal resolution of 1 hour.

We then introduce spatial variability and compare the production estimation obtained using MERRA data with real production measures from several existing wind power plants. This study allows us to estimate wind fluctuations compared to the global trend, representing the slight variations in wind speed and direction. Some studies, such as [START_REF] Mahrt | Surface Wind Direction Variability[END_REF], have shown that the amplitude of fluctuation depends on wind speed, and so we estimate the error between the smoothed curve and the real measures on clusters based on the wind speed. As a result, we obtain production curves with extra variability, as shown in Figure 2. This procedure is realized on 8 years of data, to be consistent with the solar data availability. Ten different variable production curves are generated for each year of irradiation data.

RESULTS -EVOLUTION OF GRID SIZING

Using the data generated described above (consumption, PV and WP production), we simulate the impact on the grid sizing of implementing decentralized renewable production. The simulation of these means of production at different penetration rates provides a reliable view of their impact on the aggregated load, and the potential sizing gain in such cases. Moreover, the risk of misevaluation can be defined, depending on the number of scenarios simulated.

Evolution of sizing

When integrating renewable production into the grid, this production may possibly reduce demand peaks. It allows a potential gain in grid sizing, also understandable as new clients connected without grid reinforcements, which has been estimated as it follows: a. Simulation of the original situation, where the feeder is connected only to consumers. A high number of demand scenarios, 2,000 in our case, are generated (different consumption scenarios and meteorological conditions) and a mean overshoot time of 𝑃𝑃 𝑡𝑡𝑡𝑡𝑡𝑡 can be estimated. b. Simulation of scenarios considering decentralized production. A high number of production scenarios (2,000) are generated (different consumption scenarios, meteorological conditions and production variability). c. Indicators can be estimated for each of the simulations: maximum power flowing through the lines (consumption and production are counted), overshoot time over 𝑃𝑃 𝑡𝑡𝑡𝑡𝑡𝑡 and 𝑃𝑃 𝑡𝑡𝑚𝑚𝑚𝑚 * . d. Estimation of the new sizing power (𝑃𝑃 𝑁𝑁𝑁𝑁𝑁𝑁 ) corresponding to the overshoot time of the original scenario: we obtain the new sizing with the same quality of supply. Figure 3 represents the gain in grid sizing (see ( 3)) depending on the penetration rate of the different RES (in terms of percentage of total contracted power). We can note that both cases show a maximum gain in the grid sizing of about 4 % of 𝑃𝑃 𝑡𝑡𝑡𝑡𝑡𝑡 . Both MV feeders have a similar behaviour, but the sizing gain is higher for the feeder "a" at the same penetration rate. WP impact on the gain is considerable while PV production has a very limited -almost inexistent -impact on this sizing gain. This is explained by the fact that PV production is active in the daytime, before sunset, while consumption mainly occurs in the mornings and evenings, when there is no PV production at all. Energy storage could alleviate this effect. It is also notable that when the installed production power is too high, there is no gain in the grid sizing. Indeed, the maximum power flowing through is mainly due to production, and the grid is sized by production. In the cases presented above, we observe that when the global RES penetration rate (PV+WP) is about over 40%, the grid is sized by production.

𝐺𝐺 = 𝑃𝑃 𝑡𝑡𝑡𝑡𝑡𝑡 -𝑃𝑃 𝑁𝑁𝑁𝑁𝑁𝑁 (3)

Risks of error

In order to generate the different load and production curves, representing all credible scenarios, the electricity production and demand curves we generated as described in 2. and 3. are sampled. A high amount of simulations are needed to finally obtain an accurate estimation of the most critical case, sizing the grid. For this reason, errors can occur when the number of scenarios simulated is insufficient. Indeed, in the absence of a very restrictive scenario in the simulations, the new sizing power 𝑃𝑃 𝑁𝑁𝑁𝑁𝑁𝑁 elected to ensure the same quality of supply will be underestimated. The real overshoot time corresponding to the new sizing power 𝑃𝑃 𝑁𝑁𝑁𝑁𝑁𝑁 will be higher than expected.

The problem can be written as follows:

𝑇𝑇 = 𝑡𝑡 𝑁𝑁 ��� (𝑃𝑃 > 𝑃𝑃 𝑡𝑡𝑡𝑡𝑡𝑡 ) (4)
𝑡𝑡 𝑁𝑁 ��� represents the time when the load is higher than 𝑃𝑃 𝑡𝑡𝑡𝑡𝑡𝑡 , averaged over a high number 𝑁𝑁 of scenarios (in our case, 𝑁𝑁 = 2,000). T can be seen as a given quality of supply. We attempt to quantify 𝜇𝜇 𝑖𝑖 :

𝜇𝜇 𝑖𝑖 = 𝑡𝑡 𝑁𝑁 ��� (𝑃𝑃 > 𝑃𝑃 𝑖𝑖 𝑁𝑁𝑁𝑁𝑁𝑁 ) (5)
where 𝑃𝑃 𝑖𝑖 𝑁𝑁𝑁𝑁𝑁𝑁 is the new sizing power, defined using a restricted number of scenarios 𝑛𝑛 such as:

𝑡𝑡 𝑛𝑛 � (𝑃𝑃 > 𝑃𝑃 𝑖𝑖 𝑁𝑁𝑁𝑁𝑁𝑁 ) = 𝑇𝑇 (6)
𝜇𝜇 𝑖𝑖 can thus be seen as extra minutes of overshoot, which are for seen by the client as a quality of supply loss. The final error is expressed as follows:

𝜀𝜀 𝑡𝑡 = � 1 𝐾𝐾 �(𝜇𝜇 𝑖𝑖 -𝑇𝑇) 2 𝐾𝐾 𝑖𝑖=1 , 𝐾𝐾 = � 𝑁𝑁 𝑛𝑛 � (7)
Figure 4 represents the evolution of this sizing error depending on the number of scenarios used in the simulation. The error is very high when considering a few scenarios (under 50). There is up to 40 minutes of mean extra overshoot when considering few scenarios, increasing the probability to miss some high loaded scenarios. When using more than 300 scenarios for the evaluation, the extra minutes of overshoot are evaluated to less than 2 minutes, representing less than 10% of the initial value.

CONCLUSION

Integration of decentralized means of production, e.g. photovoltaics and wind power, is impacting the network in several ways, on voltage, intensity etc. In this work we consider only the electricity demand peaks issues. When considering self-consumption, this local production can mitigate peaks of electricity demand, and thus permits the distribution system operator to connect a higher load for a same MV feeder. Indeed, depending on the renewable energy systems penetration rates, their integration on the network permits a small gain in grid sizing.

For a same quality of supply, represented by the yearly mean overshoot time of the sizing power, we shown that RES permit to lower the sizing power by 4 % of the original value. This value, apparently low, would permit a DSO to connect new clients to a same MV feeder without reinforcement work, representing non negligible savings at a country level. The simulation has shown a reasonable accuracy (>90%) in terms of evaluation of the new sizing power when using more than 300 scenarios. Two models have been developed to inject variability of the renewable production means, in order to be more realistic. Their impact has not been quantified, and might be elevated when the MV feeder is mostly producer of electricity (few or no consumers). It has to be noticed that the simulations have been led using a restricted amount of load and production curves, and the accuracy of the developed method would be increased by the inclusion of a bigger amount of scenarios.

Figure 1 :

 1 Figure 1: Introduction of variability in the PV production. Red: SODA production estimation; Black: Production with variability

Figure 2 :

 2 Figure 2: Introduction of variability in the WP production. Red: MERRA production estimation; Black: Production with variability

Figure 3 :

 3 Figure 3: Evolution of the sizing gain (in % of 𝑃𝑃 𝑡𝑡𝑡𝑡𝑡𝑡 ) depending on the penetration rate. Example of two MV feeders in Lyon, FranceThis example simulates two MV feeders whose characteristics are detailed in Table1.

Figure 4 :

 4 Figure 4: Evolution of the mean square sizing error with the number of scenarios considered in the simulation. Error is expressed in extra minutes of overshoot. Objective overshoot time (T): 19 minutes.

Table 1 .

 1

	Name of feeder		"a"	"b"
	Number of clients		2,509	6,982
	Total contracted power (MW)	20.25	51.00
	𝑃𝑃 𝑡𝑡𝑡𝑡𝑡𝑡 (MW) 𝑃𝑃 𝑡𝑡𝑚𝑚𝑚𝑚 * (MW)		4.92 3.72	12.96 9.11
	Maximum sizing gain	kW	192.93	494.80
		%𝑃𝑃 𝑡𝑡𝑡𝑡𝑡𝑡 3.92%	3.82%

Table 1 :

 1 Characteristics of the two studied MV feeders


Keywords: Réseaux de grille, ordonnancement de flux, transferts massifs, limitation de débit, pacing

Méchanisme d'extremité pour l'implantation d'ordonnancement de flux dans les réseaux de grille Résumé : Les tâches de transferts et les ressources réseaux ont besoin d'être gérées de manière plus déterministe dans les grilles que dans l'Internet. De nouvelles approches comme l'ordonnancement de flux ont été proposées et étudiées comme alternatives aux approches classiques de QoS et réservations. Afin de permettre l'ordonnancement de flux, des mécanismes offrant la possibilité de controller les dates d'émission des flux et leurs débits sont nécessaires dans le plan donné. Ce rapport quantifie et compare, sous différentes latences, ces mécanismes en présence d'un protocole de transport dans le but de réaliser différentes stratégies d'ordonnancement. Nous montrons qu'un ordonnancement à débit constant implanté grâce à un protocole de transport AIMD et un mécanisme de pacing offre dans les réseaux haut débits des performances prévisibles et indépendantes de la latence. Ce rapport montre équalement les limites des autres stratégies et mécanismes de limitation de débit comme token bucket qui rends difficile la prédiction de la durée du transfert.

Introduction

High end instruments and applications generate huge amount of data which have to be moved between data centers, computing centers or visualization centers in a reliable and time-constrained manner [START_REF] Zhang | Providing data transfer with QoS as agreement-based service[END_REF]. Today, data are transferred within packet networks through transport services such as GridFTP based on TCP protocol. TCP enables a fair sharing of the link capacities among contending flows by applying a distributed congestion control algorithm. Such end to end congestion control approach do not fill the transfer time predictability and reliability needs of these applications. Mechanism to control huge movements of data in the time axis seems to be highly required in Grids. Indeed, tight coordination of resource allocation among end points often requires a data mover service to carry out a giant task in a specified time interval. Let us consider the following example: 200 GB data produced in a site A need to be moved to a site B for processing. The CPU and disk resources in site B have been reserved in advance from 200 s to 400 s, and from 0 s to 400 s respectively. If transfer can begin only when disk in site B is allocated, and there is no pipeline between transfer and computing services, the bulk data transfer task r 1 needs to move 200 GB data from site A to site B in the time interval [0 s, 200 s] (Figure 1), to fully use the CPU resources.

To manage transfer jobs and network resource sharing in a more deterministic way, researchers are studying new approaches all based on some resource reservation paradigm like dynamic light path provisioning or flow scheduling [START_REF] Marchal | Optimal bandwidth sharing in grid environment[END_REF]. Bandwidth reservation has been studied extensively for real-time applications [START_REF] Braden | Resource ReSerVation Protocol (RSVP)[END_REF], which are often approximately modeled as reserving a fixed amount of bandwidth from a given start time. In comparison, bulk data transfer tasks are specified in terms of volume and active window (from arrival time to deadline). The bulk data transfer optimization problem has been formulated in networks in different ways [START_REF] Guérin | Networks with advance reservations: The routing perspective[END_REF][START_REF] Burchard | Performance issues of bandwidth reservations for grid computing[END_REF]. Given a network model, minimizing the congestion factor appears to be a powerful objective function [START_REF] Bin | Scheduling deadline-constrained bulk data transfers to minimize network congestion[END_REF]. In this situation, allocating bandwidth to flows in a fair manner, as it is the case in the Internet, is no more the main objective. Indeed, to complete more tasks before their deadlines, sharing instantaneous bandwidth fairly among all active flows may not be optimal [START_REF] Gorinsky | Dedicated Channels as an Optimal Network Support for Effective Transfer of Massive Data[END_REF]. In some cases, it is beneficial to allow a connection with larger pending volume and earlier deadline to grab more bandwidth, similar to the case of Earliest Deadline First scheduling in real-time systems [START_REF] Stankovic | Implications of classical scheduling results for real-time systems[END_REF].

Chen and Primet demonstrated in [START_REF] Bin | Scheduling deadline-constrained bulk data transfers to minimize network congestion[END_REF] that spaghetti scheduling which consists of allocating a single rate over the full time window of each request is an optimal solution for the bulk data transfer scheduling (BDTS) problem, when all requests have the same time constraints. The allocated rate is obtained by dividing the volume by the maximal time window of the request. Indeed, this solution gives the minimal congestion factor. The flexibility of choosing bandwidth allocation profile can also be exploited to improve system performance, when the time-windows are different. The BDTS problem has an optimal solution with bandwidth reservation profile in the form of the step function with O(r) intervals where r is the number of requests. The implementation of the multi-rate allocation strategy is an extension of the single rate allocation ones.

As bulk data transfer scheduling (BDTS) problem has been formulated and proved to be a valuable solution to optimize both user and network provider utility functions, this paper concentrates on implementation issues of such approach. Indeed, all proposed scheduling algorithms operating at a session abstraction layer rely on an ideal transport protocol able to fully utilize the controlled bandwidth. However it is not very clear how current transport protocols have to be combined with time and rate control mechanisms to approximate the ideal implementation of such approach. The goal of this paper is then to explore end host based mechanisms which can be used to better control the bandwidth sharing in a scalable and simple way. We also study how window-based transport protocol interact with these mechanisms. We aim at evaluating the potential biases introduced at run time. These biases will have to be integrated in the flow scheduling algorithms outputs.

This paper is organized as follow: section 1 presents end hosts mechanisms considered to enforce allocations. Third section presents the scheduling strategies and transport protocol considerations, section 4 presents the experimental evaluation of these strategies and end hosts mechanisms combined.

End hosts mechanisms

Rate limitation mechanisms

In this work, for the sake of scalability, only software end-hosts rate limitation mechanisms are considered. We focus on GNU/Linux mechanisms as it is the most deployed operating system in grid environments.

Timescale used to define rates is of great importance. In real packet networks, flows are not fluid. Packets are sent entirely, one after one, at the wire bit-rate. This leads to an on/off sending process. Then, when considering fixed size packets, the only way to modify data rates over a large period of time is to vary inter-packets intervals.

To calculate these intervals, we have to consider the source of time that can be used to enforce the limitation. In an end-host system four different sources can be considered: 1. Userland timers; 2. TCP self clocking namely RTT of the transfer's path; 3. OS's kernel timers;

4. Packet-level clocking.

Userland timer based mechanisms

Application level timers can provide up to 8192 Hz timers through RTC1 under GNU/Linux. RTC timers above 64 Hz are normally not accessible to users. Another solution, the use of POSIX functions like nanosleep() has some limitations as the man-page suggests:

The current implementation of nanosleep() is based on the normal kernel timer mechanism, which has a resolution of 1/HZ s [. . . ] Therefore, nanosleep() pauses always for at least the specified time, however it can take up to 10 ms longer than specified until the process becomes runnable again. This scheduling issue also apply for processes that use RTC based timers.

Trickle proposed in [START_REF] Eriksen | Trickle: A userland bandwidth shaper for unix-like systems[END_REF] is a userland library which "moderate" send() and recv() calls using nanosleep() function in order to limit the rate. UDT [START_REF] Gu | Udt: Udp-based data transfer for high-speed wide area networks[END_REF] implementation which is a transport protocol using rate-based congestion control rely on userland sleep() function.

These mechanisms provide a coarse grained limitation.

TCP self-clocking based mechanisms

TCP self clocking depends on the round-trip time of the path and is subject to variations but range from about 0.01 ms within a LAN to several hundred of millisecond for worldwide connections.

As TCP is self-clocked by its acknowledgment mechanisms [START_REF] Jiang | The origin of TCP traffic burstiness in short time scales[END_REF]. The TCP congestion windows based limitation mechanisms is thus clocked on the RTT. TCP can not send more than its congestion window over one RTT period of time. We can thus limit the congestion window value to control the rate at the RTT timescale. This solution requires a precise knowledge of the RTT and only provides a controlled rate at RTT timescale which can slightly vary.

OS kernel timer based mechanisms

OS's kernel timers depend on the kernel implementation and can be set up to 1000 Hz under recent GNU/Linux kernel.

GNU/Linux kernel use an internal time source that rises an interrupt every HZ. This value can be set between 100 Hz and 1000 Hz. GNU/Linux provides several qdisc2 to control the rate limitation. These mechanisms use HZ clocking. We note that HTB (Hierarchical Token Bucket) provides a classful limitation mechanisms. This mechanisms is actually implemented as a DRR3 [START_REF] Devera | Hierachical token bucket theory[END_REF][START_REF] Shreedhar | Efficient fair queueing using deficit round robin[END_REF] queuing discipline.

Some transport protocols do also rely on this time source. For example, DCCP [START_REF] Melo | Dccp on linux[END_REF] (Datagram Congestion Control Protocol) GNU/Linux implementation which use TFRC (TCP Friendly Rate Control) as congestion control mechanism uses HZ timing.

Packet clocking based mechanisms

Packet-level clocking depends on the underlying link. Gigabit Ethernet carries a single 1500 bytes packet in 12 µs.

OS based timers cannot afford time sources being precise enough to accommodate packet length because it cannot be continuously handling interrupts. But the most precise solution to enforce bandwidth limitation is to increase packets' departure intervals. This solution is known as pacing. Although hardware solutions were proposed in [START_REF] Kobayashi | Transmission timer approach for rate based pacing TCP with hardware support[END_REF], generic Gigabit Ethernet NICs do not provide pacing.

Software implementations, like PSPacer [START_REF] Takano | Design and evaluation of precise software pacing mechanisms for fast long-distance networks[END_REF], also exist for packet pacing. PSPacer introduces Ethernet PAUSE packets between packets carrying data. These PAUSE packets are discarded at the first switch encountered. They just introduce spacing between real packets, then limiting the effective rate. PSPacer is implemented as a GNU/Linux kernel qdisc but does not use any timers at the cost of a higher PCI bus bandwidth utilization. PSPacer actually uses a byte-clock by counting bytes sent and defines the departure date of a given packets in terms of "byte" time.

These time sources allow to create different sending patterns as shown on figure 2. The upper figure shows a schematic view of an RTT-based rate limitation, the lower ones packet-level rate limitation and in-between timer based rate limitation. These different rate limitation patterns generate different burst types, which impact global performance. Consequently, even if the rates of two flows are limited to insure the sum does not exceed the available bandwidth, bursts of packets can lead to losses. The instantaneous aggregated rate, being larger than the output rate, may overflow the intermediate buffers. These losses generate retransmissions and TCP's congestion window moderation.

These different time sources can support different rate limitation mechanisms. In the absence of any rate limitation mechanisms, packets are sent in bursts due to TCP self-clocking.

Time control mechanisms

Synchronization mechanisms are often required by scheduling algorithms to enforce transfers start times. Two main solutions are available to control the time: time synchronization (real time) or explicit synchronization through signaling (virtual clocks). They both introduce some synchronization error. This error has to be much smaller (e.g. less than 10%) than the difference between minimum and maximum completion time of a transfer. For example, in a 1 Gbps real dedicated network, the difference between minimum and maximum completion time of the 15 GB file transfer with a single flow TCP-based protocol varies from 340 ms at 0.1 ms RTT to 9.3 s at 100 ms RTT.

The first solution relies on the time accuracy several machines can obtain from a time source. As attaching GPS device to each machine isn't practical, NTP-like synchronization of clock will have to be considered. In [START_REF] Mills | Precision synchronization of computer network clocks[END_REF] published in 1994, NTP synchronization over a LAN is said to have an accuracy ranging from 500 µs to 2 ms representing 0.14% (resp. 0.59%) of the difference between maximum and minimum completion time of a 15 GB file transfer time with 0.1 ms RTT on a 1 Gbps link. The second solution to provide synchronization is to use signalization. Both direct and indirect signalization can be used. With the direct signalization method, the first sender signals an event to the next sender (for example when the transfer is done as shown in figure 3(a)). Using indirect signalization, each sender exchange signals through a bandwidth broker (Figure 3(b)).

As a robust signalization mechanism is needed a three-way handshake should be used. For example TCP connection establishment ensures packet-loss resilience signalization. This basically means that the cost of the direct signalization will be in the order of 1.5 * RT T (due to SYN-SYN/ACK-ACK) where RT T is the path round-trip time between two senders plus the time to cross the local network stacks and the processing time.

In order to evaluate this cost, we measure the time required to perform two signalizations (one in each directions) between two machines and then divide this time by two. Figure 4 shows the distribution of this duration on a 0.1 ms RTT, 10 ms RTT and finally 100 ms RTT network. As expected, figure 5 shows that the cost grows linearly with a 1.5 rate from 0.374 ms at 0.1 ms RTT to 150.4 ms at 100 ms RTT. These durations represent respectively 0.11% and 1.6% of the difference of completion for the previously considered 15 GB transfer at 0.1 ms and 100 ms RTT. Thus cost of direct and indirect signalization are still a small part (less than 2%) of the variations of transfers' completion time if the processing time is assumed to be small.

We can conclude from this section that synchronization by NTP and direct or indirect signalization do not introduce much overhead and unpredictability to the completion time for the file size considered in this paper. But as the synchronization cost is independent from the size of transferred files, when this size decreases, the relative cost of time control will increase and will not be negligible with respects to the transfer completion time variability and will have to be considered.

Flow scheduling algorithms

Before evaluating the accuracy and the interaction of transport protocols with these mechanisms, let us present the principle of three scheduling strategies evaluated here with a simple example. In this paper, we compare three flow scheduling strategies, named respectively ViFi for Virtual Finish Time First, IFS for Instantaneous Fair Sharing, MinRate for spaghetti scheduling. We consider two identical requests with the same release date, the same deadline. The first request has a volume being twice the volume of the second request.

Simple illustrative example

Let us consider a classical dumbbell topology with two sources nodes (s 1 and s 2 ) and two sink nodes (S 1 and S 2 ). The topology is presented in figure 8. The shared link has a capacity of C (1 Gbps

t c,1 t c,2 IFS 2.v 1 C 2.v 1 C + v 2 -v 1 C = v 1 + v 2 C ViFi v 1 C v 1 + v 2 C Spaghetti scheduling v 1 + v 2 C v 1 + v 2 C
Table 1: Theoretical completion time of the two transfers.

Ethernet). Each source node has a file of size v i to transfer to the corresponding sink node (S 1 for s 1 and S 2 for s 2 ). We assume that both transfers have the same release date t r and we define the completion time of the transfers t c,1 and t c,2 . Table 1 summarizes the theoretical completion time of each transfer under the different scheduling strategies.

If we consider same size files, IFS and spaghetti scheduling are equivalent. Thus, the two files transferred will have a size of v 1 = 15000 MB and v 2 = 30000 MB. For the sake of simplicity, we will consider that the release dates are 0 (t r = 0). The completion time of each transfer might differ from strategy to strategy but the global completion time of the two transfers -i.e. the makespan -is theoretically the same. We will focus on this last objective: minimize the makespan t c , with t c = max{t c,1 , t c,2 } = (v 1 + v 2 )/C. The link capacity C used here is the effective rate of carried data. As the transport protocol provides congestion control mechanisms and reliable transfers, it introduces some overheads and the considered link capacity is smaller than the raw capacity of the link. This point will be detailed in next section. The three strategies allocate the full capacity (link utilization ratio of 1 is optimal) provided that a single flow can fill the shared link and we assume an accept rate of 1 (all request accepted) which means that the specified deadline of each transfer is greater than its completion time.

We consider that IFS can be well approximated by TCP's distributed congestion control. ViFi does not require any bandwidth limitation mechanism as there is only one flow at a time. But spaghetti scheduling requires bandwidth limitation enforcement mechanisms.

Transport protocol considerations

Our goal is to determine which configuration (scheduling strategy combined with end hosts mechanisms) is minimizing t c which is actually the time the bandwidth broker will have to reserve resources to complete the two transfers.

All proposed algorithms assume that an ideal transport protocol will be used to transfer the files. However, the achievable bandwidth is not known a priori because it depends on the efficiency of the real transport protocol and the rate limitations mechanisms. Current transport protocols, used in grid environments, are window-based protocol, like BIC TCP, which are quite efficient and fair when two flows have the same reasonable round-trip time (< 100 ms) [START_REF] Guillier | A study of large flow interactions in high-speed shared networks with grid5000 and gtrcnet-10 instruments[END_REF]. But such protocols still introduce some overhead. This overhead is partially due to the packets' header which size is a linear function of the data carried. The overhead is also due to the retransmissions induced by losses. Under a congested situation (which is the case here as we can have two potentially 1 Gbps sources sending data in 1 Gbps link at the same time with IFS scheduling), the overhead introduced by retransmissions is more difficult to estimate. The arbitration algorithms within the network equipment (e.g. Ethernet switch) that mixes the two flows infer the losses distribution among flows [START_REF] Soudan | Investigation of ethernet switches behavior in presence of contending flows at very high-speed[END_REF]. This loss-dependent overhead might suggest that spaghetti scheduling would provide better performance. It avoids congestions by limiting the ssendingate of each flow. ViFi scheduling insure that there is no congestion because only one flow is scheduled at a time. However these two scheduling strategies imply rate limitation or synchronization and signalization mechanisms which can't be costless. Spaghetti scheduling needs rate limitation. ViFi needs to start the second transfer just after the first one finished.

Goodput vs throughput

In this section no attention is paid to the timescale used to define rates. Let r EthB be the Ethernet bit rate. r EthB = 10 9 bps for Gigabit Ethernet. We define r Eth as the Ethernet frame rate assuming 1514 bytes frames (without frame checksum (FCS), frame preamble and inter frame gap (IFG)), see figure 7. r Eth = (1514/(1514 + 4 + 12 + 8)) * r EthB = 984.40 Mbps. We define r IP as the rate of IP packets (Ethernet payload). Under the assumption of a 1500 bytes MTU4 : r IP = (1500/1514) * r Eth = 975.30 Mbps.

In order to compare our measurements we define an ideal transport protocol over an 1 Gbps Ethernet link. We assume this protocol achieve perfectly max-min fairness among contending flows, there is no slow-start and no losses nor retransmissions. We define the data rate r TP of the ideal transport protocol. Under assumptions presented above, r TP = ((1500 -40)/1500) * r IP = 949.29 Mbps. This is especially important to differentiate goodput (r TP ) and throughput (r EthB ) as flows share links through throughput while completion time of transfers depends on goodput. Thus the capacity C used in section 3.2 is actually r TP . We can observe that this rate is a linear function of r Eth as each transport layer payload as its own set of headers, preamble, FCS and IFG. But real transport protocols are not ideal. More specifically, the effective data rates are not a linear function of the portion of the raw link obtained as real transport protocols use congestion window based congestion control driven by loss event or latency changes. These events are not independent between contending flows. In order to obtain deterministic completion time, we have to isolate flows.

Experimental evaluation 4.1 Objectives

In order to evaluate some of the rate limitation mechanisms combined with scheduling strategies introduced above, real experiments have been conducted. The main goal of these experiments is to compare the different scheduling strategies in term of completion time predictability and mean performance. These two points are important because in a scheduling perspective, predictability of completion time is of a central goal and secondly scheduling was introduced to improve mean performance. More specifically any scheduling algorithms has to be more efficient than raw TCP sharing.

Next section will present the testbed and scenarii considered, while two following section present mean and scheduling related performance results.

Testbed, scenarii & practical considerations

As stated before, two transfers are used. These transfers are realized by using iperf on Sun Fire V20z workstations of Grid5000 [START_REF] Cappello | Grid'5000: A large scale, reconfigurable, controlable and monitorable grid platform[END_REF] running GNU/Linux 2.6.20.1 kernels. The switch used to implement the topology is a ExtremeNetworks BlackDiamond 8810. Latencies are emulated using a GtrcNet-1 box [START_REF] Kodama | GNET-1: Gigabit ethernet network testbed[END_REF]. Four different experiments were conduced at three latencies (RTT): 0.1 ms, 10 ms and 100 ms. Completion times were measured with a 10 ms precision. Each experiment consists of hundred repetitions of the two transfers.

The first experiment implements the IFS strategy. The two transfers (15GB and 30GB) have been started at the same time without bandwidth limitation. In this experiment the time measured is the maximum of the two individual completion time.

Second experiment implements the ViFi strategy. The 15GB transfer is started first and once it finishes the second transfer is started. The duration measured in this experiment is the sum of the duration of the two transfers.

Third and Fourth experiments implement spaghetti scheduling strategy. Third experiment uses PSPacer as limitation mechanism while fourth uses HTB. Here the time measured is also the maximum of the two individual completion time. These two scenarii use qdisc based rate limitation mechanisms. First use packet-level rate limitation using PSPacer while second use OS's timer based approach with HTB. As they both use qdisc implementation, the rates specified for the two flows are 2/3 * r Eth = 0.1 ms RTT To summarize these results in term of mean, we can compare real completion time to ideal completion time obtained with r TP which is t c = (v 1 + v 2 )/r TP = 388.33 s in table 2. We observe a mean deficiency of spaghetti scheduling using PSPacer below 5% while IFS reaches more than 64.3% under 100 ms RTT. These results represent mean performance. Next section will develop worst case results in terms of minimizing the maximum completion time as stated in section 3.2.

Scheduling perspective

From a scheduling perspective, the main concern is the variability of completion times. This is because when the flow scheduler decides a time slot for a transfer, this one must have, with a high probability, enough time to complete. On the other hand, allocating a larger time window will be wasteful. In this perspective, mean completion time is of little help. As observed on figure 11(b), variability greatly depends on the strategy and end hosts mechanisms used. Variability is actually very low when using PSPacer and can be important (std. dev. greater than 20 s for a mean completion time of about 650 s) for IFS.

Figure 12 shows the 75 and 99-percentiles of the completion time for the different strategies as a function of latency. This value is the duration of the slot the scheduling system would have to allocate in order to have a probability of completion of 75% (99%) in a given situation. We can observe that these two values are quite close except under 100 ms RTT with IFS and HTB. Second observation, these last two strategies, and to a lesser extend ViFi, would require a scheduling system aware of the latencies of the links. Indeed, the performance slightly decreases as latency increases.

Performance obtained using real mechanisms and protocols do not behave as an ideal transport protocol as seen on figure 11(a) and 11(b). There are 3 differences. First, the mean completion time of real transfers is obviously larger than the one of ideal transfer (of 3.4% is the best case and 64.3% in the worst one). Second it increases as the latency increases for HTB and IFS as packet losses are introduced. Third, the variance is not null and can be relatively high. To conclude this section, spaghetti scheduling using PSPacer appears to be the strategy which provides the best maximum completion time t c under real experiments. Its 99-quantile completion time deficiency does not vary much with latency and is the lowest (except for 0.1 ms RTT) as can be seen in table 3.

Conclusion

In this paper we have quantified and compared, end-host based mechanisms combined with transport protocols to instantiate different scheduling strategies. A simple scenario has been deeply explored in a range of latency conditions. We have shown that, in high speed network, a single-rate scheduling strategy implemented by TCP-variant protocol like BIC with packet pacing mechanism offers predictable performance and is insensitive to latency (deficiency of mean completion time ranging from 4% at 0.1 ms RTT to 4.7% at 100 ms RTT). This paper also highlights the limits of other strategies and rate limitation mechanisms like token bucket which may present unpredictability and other drawbacks. Future work will concentrate on larger experiments on the Grid5000 testbed and will examine the scalability of the flow scheduling approach in real grid context, multirate allocations schemes and transfers preemption issues.

Figure 1 :

 1 Figure 1: 200 GB scheduled transfer.

Figure 2 :

 2 Figure 2: Different sending patterns.

Figure 3 :

 3 Figure 3: Signalization scenarii.

Figure 4 :

 4 Figure 4: Distribution of direct-signalization time (1000 repetitions).

Figure 5 :

 5 Figure 5: Mean direct-signalization time ({0.1 ms, 1 ms, 10 ms} RTT, 1000 repetitions).

Figure 6 :

 6 Figure 6: Three simple different scheduling strategies for two transfers (transfer 1 with volume v 1 and transfer 2 with volume v 2 = 2.v 1 ), having the same time window constraint.

Strategy

Figures 6 (

 6 a), 6(b) and 6(c) show the different scheduling strategies applied to the two transfers considered.

Figure 7 :

 7 Figure 7: Frame and payload.

Figure 9 :

 9 Figure 9: Completion time distribution and CDF for IFS, ViFi and Spaghetti scheduling using BIC TCP under different RTT (100 repetitions).

Figure 10 :

 10 Figure 10: Mean retransmitted bytes as a function of the RTT (10 repetitions).

INRIA

  Spaghetti sched. (HTB) Ideal transport proto. & isolation (a) 99% confidence interval for mean completion time as a function of the RTT.

  completion time's standard dev. (s) IFS ViFi Spaghetti sched. (PSP) Spaghetti sched. (HTB) (b) Standard deviation of completion time as a function of the RTT.

Figure 11 :

 11 Figure 11: Mean completion times and standard deviations.

  0

Figure 12 :

 12 Figure 12: 75 and 99-percentiles of completion times.

Table 2 :

 2 Relative deficiency of mean real completion time against ideal one.

			10 ms RTT 100 ms RTT
	IFS	3.4%	16.4%	64.3%
	ViFi	3.7%	9.2%	9.7%
	SS (PSP)	4.0%	4.0%	4.7%
	SS (HTB)	5.3%	17.7%	59.6%

Table 3 :

 3 Relative deficiency of 99-quantile of real completion time against ideal one.

		.1 ms RTT 10 ms RTT 100 ms RTT
	IFS	3.6%	17.5%	78.5%
	ViFi	3.8%	9.4%	11.4%
	SS (PSP)	4.0%	4.0%	4.7%
	SS (HTB)	5.6%	19.6%	67.6%

RR n°0123456789

Real Time Clock INRIA

Queue disciplines

Deficit Round Robin RR n°0123456789

Message Transfer Unit INRIA

Acknowledgments

This work has been funded by the French ministry of Education and Research via the HIPCAL ANR grant and by the EU IST FP6 EC-GIN Project. Experiments presented in this paper were carried out using the Grid'5000 experimental testbed, an initiative from the French Ministry of Research through the ACI GRID incentive action, INRIA, CNRS and RENATER and other contributing partners (see https://www.grid5000.fr).

656 Mbps and 1/3 * r Eth = 328 Mbps for 30 GB and 15 GB transfers as qdisc acts on ready-to-be-sent packets (Ethernet packets).

Retransmissions done by the transport protocol during 10 repetitions of these experiments are also measured using Web100 kernel patch.

Mean performance

Figure 9 shows the distribution and cumulative distribution function (CDF) of the completion times of the two transfers using different strategies at three latencies (RTT). CDF of completion time is important because it shows the dispersion which is a key point for defining the time granularity of the scheduling.

IFS strategy implemented through BIC TCP congestion control mechanism is efficient under low latencies but as the latency grows, the mean completion time grows quickly. This is due to the cost of losses which decrease the congestion window, i.e. the sending rate. Loss have more and more impact as the latency increases as recovering takes longer. At 0.1 ms RTT, the congestion window is of about 8 packets which is smaller than the buffer size of the switch. At 10 ms RTT, the congestion window is close to 800 packets and at 100 ms is close to 8000 packets. In these situations, the bursts sent by the two sources are very likely to cause congestion. In addition, as losses do not occur exactly at the same time from experiment to experiment, the dispersion tends to be very important especially under high latencies (figure 11(b)) were losses are more costly.

ViFi is a bit less efficient than IFS at 0.1 ms (figure 9(a)) because there is only one flow at a time. Increasing the number of flows sharing a link (i.e. the multiplexing level) is known to increase the average utilization rate of this link. Performance decreases a little as latency grows but the distribution remains quite compact. Spaghetti scheduling's performance depends on the limitation mechanisms used. HTB introduces some burstiness as it use OS's timers. Thus the number of losses may be important as observed on figure 10. While IFS strategy allows flows to recover by momentarily stealing bandwidth to each others, HTB does not which leads to poor performance. Using PSPacer, for rate limitation leads to a nearly constant completion time among repetitions. As we can observe on figure 11(a), the mean completion time of spaghetti scheduling using PSPacer is stable with respect to the latency. This combination (spaghetti and packet pacing) offers the near ideal implementation of the flow scheduling approach.


Francesco Flammini
email: francesco.flammini@ansaldo-sts.com

Stefano Marrone
email: stefano.marrone@unina2.it

Nicola Mazzocca
email: nicola.mazzocca@unina.it

Alfio Pappalardo
email: alfio.pappalardo@ansaldo-sts.com

Concetta Pragliola
email: concetta.pragliola@ansaldo-sts.com

Valeria Vittorini
email: valeria.vittorini@unina.it

Trustworthiness Evaluation of Multi-sensor Situation Recognition in Transit Surveillance Scenarios

Keywords: Physical Security, Sensor and Data Analysis, Event Correlation, Trustworthiness, Probabilistic Modelling, Quantitative Evaluation

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

In modern society the assurance of a secure environment is paramount due to the increasing number of threats against critical infrastructures. The number and the diversity of sensors used in modern wide-area surveillance is continuously increasing [START_REF] Garcia | The Design and Evaluation of Physical Protection Systems[END_REF]. The type of sensors includes: (1) Environmental probes measuring temperature, humidity, light, smoke, pressure and acceleration; (2) Intrusion sensors, like magnetic contacts, infrared/microwave/ultrasound motion detectors, etc.; (3) Radio-Frequency Identifiers (RFID) and position detectors, via satellite and/or electronic compasses; (4) Smart-cameras and microphones with advanced audio-video analytics capabilities;

(5) Chemical Biological Radiological Nuclear explosive (CBRNe) detectors. Different types of sensing units are often integrated in smart-sensors like the so called 'motes' of Wireless Sensor Networks (WSN), featuring on-board 'intelligence' through programmable embedded devices with dedicated operating systems, processors and memory [START_REF] Flammini | Wireless Sensor Data Fusion for Critical Infrastructure Security[END_REF].

Such a wide range of sensors provides a large quantity of heterogeneous information which has to be handled properly, in terms of pre-processing, integration and reasoning, in order to effectively support PSIM operators; otherwise, there is the serious risk of overwhelming operators with unnecessary information, warnings or alarms, with the consequence of making them unable to perform their task and possibly underestimate critical situations [START_REF] Zhu | Multimodal Surveillance: Sensors, Algorithms and Systems[END_REF] [START_REF] Wickens | The benefits of imperfect diagnostic automation: a synthesis of the literature[END_REF].

In such a context, the issue of automatic situation recognition in PSIM is of paramount importance. However, not much work has been done in the research literature to develop frameworks and tools aiding surveillance operators to take advantage of recent developments in sensor technology. In other words, so far researchers seem to ignore the apparent paradox according to which the more and complex the sensors, the more and complex the tasks required for operators to manage and verify their alarms.

We have addressed the issue of automatic situation recognition by developing a framework for model-based event correlation in infrastructure surveillance. The framework -named DETECT -is able to store in its knowledge base any number of threat scenarios described in the form of Event Trees, and then recognize those scenarios in real-time, providing early warnings to PSIM users [START_REF] Flammini | DETECT: a novel framework for the detection of attacks to critical infrastructures[END_REF] [START_REF] Flammini | On-line integration and reasoning of multi-sensor data to enhance infrastructure surveillance[END_REF].

In this paper we adopt a model-based evaluation approach to quantitatively assess the effectiveness of DETECT in reducing the number of false alarms, thus increasing the overall trustworthiness of the surveillance system. The evaluation is dependent on sensor technologies and scenario descriptions, and it is based on stochastic modelling techniques. To achieve such an objective, some mappings are performed from Event Trees to other formalisms like Fault Trees, Bayesian Networks and Petri Nets (and their extensions). Those formalisms are widespread in dependability modelling and allow engineers to perform several useful analyses, including 'what if' and 'sensitivity', accounting for false alarms and even sensor hardware faults.

Generally speaking, the method used for the analysis, which is the main original contribution of this paper, allows to:

• Support design choices in terms of type and reliability of detectors, redundancy configurations, scenario descriptions.

• Demonstrate the effectiveness of the overall approach in practical surveillance scenarios, in terms of the increase of trustworthiness in threat detection with respect to single sensors.

In order to demonstrate the application of the methodology, a threat scenario of a terrorist attack in a metro railway station is considered.

The rest of this paper is structured as follows. Section 2 provides an overview of the related literature on DETECT and for trustworthiness evaluation of surveillance systems and it introduces the basic concepts of the event description language. Section 3 describes the process used for the analysis customizing it to the Bayesian Networks formalism in Section 4. Section 5 presents the case-study application using a metro-railway threat scenario. Finally, Section 6 provides the conclusions and hints for future improvements.

Background

The first concept of DETECT has been described in [START_REF] Flammini | DETECT: a novel framework for the detection of attacks to critical infrastructures[END_REF], where the overall architecture of the framework is presented, including the composite event specification language (EDL, Event Description Language), the modules for the management of detection models and the scenario repository. In [START_REF] Flammini | On-line integration and reasoning of multi-sensor data to enhance infrastructure surveillance[END_REF], an overall system including a middleware for the integration of heterogeneous sensor networks is described and applied to railway surveillance case-studies. Reference [START_REF] Flammini | Augmenting surveillance system capabilities by exploiting event correlation and distributed attack detection[END_REF] discusses the integration of DETECT in the PSIM system developed by AnsaldoSTS, namely RailSentry [START_REF] Bocchetti | Dependable integrated surveillance systems for the physical security of metro railways[END_REF], presenting the reference scenario which will be also used in this paper. In order to detect redundancies while updating the scenario repository (off-line issue) and to increase the robustness of DETECT with respect to imperfect modelling and/or missed detections (on-line issue), distance metrics between Event Trees are introduced in [START_REF] Flammini | A robust approach for on-line and off-line threat detection based on event tree similarity analysis[END_REF].

A survey of state-of-the-art in physical security technologies and advanced surveillance paradigms, including a section on PSIM systems, is provided in [START_REF] Flammini | Challenges and emerging paradigms for augmented surveillance[END_REF]. Contemporary remote surveillance systems for public safety are also discussed in [START_REF] Räty | Survey on contemporary remote surveillance systems for public safety[END_REF]. Technology and market-oriented considerations on PSIM can be also found in [START_REF] Hunt | Physical security information management (PSIM): The basics[END_REF] and [START_REF] Frost | Analysis of the Worldwide Physical Security Information Management Market[END_REF].

In [START_REF] Ortmann | Enhancing reliability of sensor networks by fine tuning their event observation behavior[END_REF] the authors address the issue of providing fault-tolerant solutions for WSN, using event specification languages and voting schemes; however, no model-based performance evaluation approach is provided. A similar issue is addressed in [START_REF] Bahrepour | Sensor Fusion-based Event Detection in Wireless Sensor Networks[END_REF], where the discussion focuses on different levels of information/decision fusion on WSN event detection using appropriate classifiers and reaching a consensus among them in order to enhance trustworthiness. Reference [START_REF] Silva | Reliability and Availability Evaluation of Wireless Sensor Networks for Industrial Applications[END_REF] describes a method for evaluating the reliability of WSN using the Fault Tree modelling formalism, but the analysis is limited to hardware faults (quantified by the Mean Time Between Failures, MTBF) and homogenous devices (i.e. the WSN motes). Performance evaluation aspects of distributed heterogeneous surveillance systems are instead addressed in [START_REF] Legg | Distributed Multisensor Fusion System Specification and Evaluation Issues[END_REF], which only lists the general issues and some pointers to the related literature. Reference [START_REF] Tang | Tru-Alarm: Trustworthiness Analysis of Sensor Networks in Cyber-Physical Systems[END_REF] about the trustworthiness analysis of sensor networks in cyberphysical system is apparently one of the most related to the topics of this paper, since it focuses on the reduction of false alarms by clustering sensors according to their locations and by building appropriate object-alarm graphs; however, the approach is quite different from the one of DETECT and furthermore it applies to homogenous detectors. Another general discussion on the importance of the evaluation of performance metrics and human factors in distributed surveillance systems can be found in [START_REF] Karimaa | Efficient Video Surveillance: Performance Evaluation in Distributed Video Surveillance Systems[END_REF]; however, no hints are provided in that paper about how to perform such an evaluation on real systems.

Regarding the dependability modelling approach used in this paper, it is based on the results of the comparison among formalisms (i.e. Fault Trees, Bayesian Networks and Stochastic Petri Nets) in terms of modelling power and solving efficiency that has been reported in [START_REF] Bobbio | Sequential application of heterogeneous models for the safety analysis of a control system: a case study[END_REF] and also applied in [19] to a different case-study using an approach known as 'multi-formalism'.

Event Description Language

Threat scenarios are described in DETECT using a specific Event Description Language (EDL) and stored in a Scenario Repository. In this way we are able to permanently store all scenario features in an interoperable format (i.e. XML). A high level architecture of the framework is depicted in Fig. 1.

Fig. 1: The DETECT framework

A threat scenario expressed by EDL consists of a set of basic events detected by the sensing devices. An event is a happening that occurs at some locations and at some points in time. In this context, events are related to sensor data (i.e. temperature higher than a threshold). Events are classified as primitive events and composite events. A primitive event is a condition on a specific sensor which is associated with some parameters (i.e. event identifier, time of occurrence, etc...). A composite event is a combination of primitive events by means of proper operators. Each event is denoted by an event expression, whose complexity grows with the number of involved events. Given the expressions

n E E E ,..., , 2 1
, every applicaann on them through any operator is still an expression. Event expressions are represented by Event Trees, where primitive events are at the leaves and internal nodes represent EDL operators.

DETECT is able to support the composition of complex events in EDL through a Scenario GUI (Graphical User Interface), used to draw threat scenarios by means of a user-friendly interface. Furthermore, in the operational phase, a model manager macro-module has the responsibility of performing queries on the Event History database for the real-time feeding of detection models corresponding to threat scenarios, according to predetermined policies. Those policies, namely parameter contexts, are used to set a specific consumption mode of the occurrences of the events collected in the database. The EDL is based on the Snoop event algebra [START_REF] Chakravarthy | Snoop, An expressive event specification language for active databases[END_REF], considering the following operators: OR, AND, ANY, SEQ. For sake of space and due to their simplicity, the operators are not presented and further details are present in the literature.

Trustworthiness modelling process

The advantage of the modelling and analysis activity is twofold. On one hand it can be used during the design phase since it allows to quantitatively evaluate different design options for sensing and decision mechanisms allowing cost/effective trade-offs in protection systems design. In fact, the sensing strategies can differ in the number of sensors, in their reliability and/or in their efficiency in event detection; decision options are related to the logics that can be applied for correlating primitive events. On the other hand, the model can be used at run-time due to the possibility of tuning the models using data collected during the operational phase (i.e. event history log files merged with operator feedback about false negative/positive), allowing incremental refinement of detection models. Fig. 2 shows how the aforementioned objectives can be achieved in an integrated process, in which both the monitored and monitoring systems are represented using probabilistic modelling formalisms. Quantitative model evaluation enables two possibilities:

• When used at design-time, the analyses can be used to compute the probability of having an alarm and its confusion matrix (i.e. the false positive and false negative probabilities). Such information can be used in order to improve the system by using more accurate or redundant sensors.

• When used at run-time, the detected events can be used as the evidence in the models. In such a way, the probability that the configuration of the primitive events is actually representative of the composite event (i.e. the threat scenario) can be dynamically adapted. Consequently, alarms can be generated only when the confidence in the detection is greater than a certain threshold.

Fig. 2:

The modelling and analysis process. Focusing on the design-time analysis, it is essential to develop an appropriate modelling methodology. In the context of surveillance systems trustworthiness evaluation, models of interest can be structured in three layers as depicted in Fig. 3. These layers are:

• Event layer: this layer is devoted to modelling the actual cause-consequence relations in real environments. It determines how complex situations can be broken down into basic events (e.g. sneaking into a room by the window implies the breaking of the glass). It is usually the output of physical security surveys and risk assessment. In its most trivial form, it is constituted by the sequence of basic events associated to a threat scenario.

• Sensing layer: this layer models the sensors as objects with their characteristics (e.g. event detection capabilities, hardware reliability, detection performance) and the basic sensing actions with respect to the events identified in the lower layer.

• Decision layer: this layer addresses the (probabilistic) combination of simple events by means of EDL operators. It is important to note that this layer is built on top of the Sensing layer instead of the Event layer, since it does not deal with events actually occurring in the reality but with the ones generated by the sensing system, which can be different according to sensor types, deployment granularity, and detection performance.

In the following of this paper we mainly concentrate on the upper layer; however, the outputs of detection model evaluation can be used as inputs to refine threat modelling and better define sensor design parameters in order to meet the requirements of specific applications.

In this Section we instantiate the process schema shown in Fig. 2 using the Bayesian Networks (BN) reference formalism, which features several advantages when employed in situation recognition. Fault Tree (FT) and Petri Net (PN) based processes can be equally derived from the general process schema. A complete comparison of these formalisms against their modelling power and efficiency is reported in [START_REF] Frost | Analysis of the Worldwide Physical Security Information Management Market[END_REF]. In brief, FTs are very easy to build and analyse, but they have a limited modelling power. On the other hand, PNs feature a great expressive power but they are limited by the well-known state space explosion problem. BNs represent a good trade-off between those two extremes.

The operators used to build the Event Trees according to the event correlation approach implemented by DETECT have been briefly described in Section 2.2. Bayesian Networks fit the need to extend decision mechanisms adding the capability to handle probabilistic aspects. In fact features such as sensor hardware reliability and detection performance (i.e. false positive and false negative probabilities) rather than uncertainty in event modelling can be dealt with by appropriate BN subnets.

The process presented in Section 3 can be customized in the case of the BN formalism considering the specific types of analysis that can be conducted on a BN model [START_REF] Charniak | Bayesian Networks without Tears[END_REF]. Let: A be the set of alarms associated with threat scenarios; E be the set of events that can occur in the real environment; S be the set of states of the sensors. If we suppose a ∈ A, e ∈ E, s ∈ S, these three different indexes can be computed by solving the BN model:

• Prior probability, P(a), that is the likelihood of occurrence of an alarm before any evidence relevant to the alarm has been observed. This index is the probability that an alarm is raised and it may be used at the design time of a PSIM system to predict the expected alarm rate, provided that the rate of primitive events is known a-priori.

• Posterior probability, P(a | e, s), that is the conditional probability that an alarm is raised after some evidence is given. This index represents the probability of having an alarm in specific conditions, e.g. when some events happen (e.g. intrusion) and some others are generated by the surveillance system (e.g. sensor failure). It is useful at both design and run times. When used at design time it can be used to evaluate the performance of the detection system (i.e. the confusion matrix 1 ). In addition, the Posterior probability may be used to perform a 'what-if' analysis in order to evaluate the performance degradation in case of sensor failures. When used at run-time, a posterior analysis on the model fed with real evidence of events and/or sensor failures may provide a surveillance operator with alerts if probabilities are higher than a certain threshold.

• Likelihood, P(e | a, s), that is the probability of observing an element of E (real threat scenario) given evidence in A and S. In practice, it can be used to determine the probability that the alarm is trustworthy given that it has been generated. This kind of analysis is useful at run-time since it can support the decision making of the operators.

The layered model presented in Section 3 is substituted by a Bayesian Network where the BN nodes modelling the elements of the Event Layer are at the bottom, the ones representing the Sensing Layer are in the middle, the ones translating EDL operators at the Detection Layer are on the top. Specifically, we focus on the definition of a BN pattern that models the Sensing Layer and on the translation of EDL operators into BN elements. The BN pattern depicted in Fig. 4 shows how sensing can be modelled by means of three variables:

• ev: binary independent variable that models the occurrence of primitive events. The possible values of the variable are {true, false};

• sens: binary independent variable representing sensor operation that can be {ok, down};

• det: binary variable modelling event detection by the sensor. This is a {true, false, unknown} dependent variable whose Conditional Probability Table (CPT) is reported in Tab. 1. The CPT is built considering the two probabilities: falsepositive (sfp) and false-negative (sfn).

All the elements on the left side of Tab. 1 are translated into BN variables. The diverse operators are differentiated by CPTs.

Modelling trustworthiness in a specific scenario

The effectiveness of the modelling approach, described in the previous section, is demonstrated using a case-study in the mass transit domain, whose assets are vulnerable to several threats, including terrorist attacks. Therefore, surveillance systems for mass transit feature a growing number of heterogeneous sensing devices. In such a context, the quantitative evaluation of model trustworthiness and sensitivity to sensor faults is very important to design robust surveillance systems and to reduce the number of unnecessary alerts. In particular, at design time the results of model analysis provide valuable information to assess the level of redundancy and diversity required for the sensors, in order to find the appropriate configuration to comply with performance targets, perhaps given by the requirements specification of the end-user. Feedbacks from model evaluation can suggest changes about sensor dislocation and technologies. An estimation of detection model trustworthiness is essential also in real-time, whether using statically or dynamically updated data, in order to define confidence thresholds for triggering high level warnings and even automatic response actions.

Let us consider a threat scenario similar to the chemical attack with Sarin agent occurred in the Tokyo subway on March 20, 1995, which caused 12 fatalities and 5500 injured [START_REF]National Consortium for the Study of Terrorism and Responses to Terrorism (START)[END_REF]. The available technologies to early detect and assess the threat include intelligent cameras, audio sensors and specific standoff CWA (Chemical Warfare Agents) detectors, which feature a limited alarm trustworthiness. By means of the DETECT framework, the events detected by these sensors could be correlated as well as reported in the threat scenario representation in the reference [START_REF] Flammini | Augmenting surveillance system capabilities by exploiting event correlation and distributed attack detection[END_REF]. The main CWA detection technologies include Ion Mobility Spectroscopy (IMS), Surface Acoustic Wave (SAW), Infrared Radiation (IR), etc. They are employed in ad-hoc standoff detectors, characterized by different performances. One of the most accurate devices, the automatic passive IR sensor, can recognize a vapor cloud from several kilometres with a 87% detection rate. Obviously, it is possible to combine heterogeneous detectors (e.g. IMS/SAW and IR) and to correlate their alarms according to different criteria (e.g. logic, temporal, and spatial), in order to increase the CWA detection reliability. The same considerations apply to the alarms detected by the other sensing devices.

The threat scenario consists of a simultaneous drop of CWA in subway platforms. Let us assume the following likely set of events:

1.

attackers stay on the platforms, ready to drop the CWA;

2. contaminated persons fall down on the floor;

3. people around the contaminated area run away and/or scream;

4.

CWA spreads in the platform level and possibly reaches higher levels.

In each subway site, it is possible to use two smart-cameras positioned at platform end walls, a microphone in the middle and two CWA standoff detectors positioned on the platform and on the escalators. The scenario can be formally described by means of the notation "sensor description (sensor ID) :: event description (event ID)": The Event Tree model of the CWA threat scenario is depicted in Fig. 5. The OR operators correlate the events "person falling" and "person running", detectable by the two redundant intelligent cameras monitoring the platform. The other child node (E3-S3) of the ANY operator represents the event "person screaming", detectable by the intelligent microphone. When 2 out of these 3 events are detected in a certain (limited) time frame, the situation can reasonably be considered abnormal, so that a warning to the operator can be issued. The SEQ operator represents the upward CWA spread, detectable by the two redundant CWA sensors, installed at different levels. Finally the AND operator at the top of the tree represents the composite event associated with the whole CWA threat scenario.

• Intelligent Camera (
As described in the previous section, each occurrence of an event can be true with a probability p, or false with a probability 1-p. Each sensor can be available, i.e. ok, with a probability q, or unavailable, i.e. down, with a probability 1-q. Finally, each single event detected by a sensor can be true, false, or unknown according to the occurrence of the event condition and to the availability of the sensor at that time. Moreover, each sensor, for each detectable event, is characterized by the values: sfn and sfp, which are the sensor false positive and false negative probabilities. The BN model of the event tree is built and analysed according to the modelling schema and methodology described in the previous sections and it is represented in Fig. 6.

The Event Layer is constituted by a node E that represents the actual CWA attack, while E1, E2, E3 and E4 are the primitive events that can be detected by the sensors. The interface between Event Layer and Sensor Layer is the set of E1, E2, E3 and E4 nodes. In the Sensor Layer, there are five nodes (S1, S2, S3, S4 and S5) representing sensors and seven nodes (E1-S1, E2-S1, E1-S2, E2-S2, E3-S3, E4-S4 and E4-S5) representing the sensed events. These seven event nodes constitute the interface between the Sensing Layer and the Detection Layers. Such an interface is built according to the mapping between EDL operators and BNs. As already stated, the SEQ operator has been substituted by the AND operator, introducing a modelling error. For the sake of brevity, we report only the posterior probability analysis that has been performed in order to evaluate the confusion matrix (see Tab. 3). The left column represents the evidence, that can be true (CWA threat is actually happening) or false. The other columns represent the probability of CWA threat alarm is generated ('Alarm on', which can be a true positive, tp, or false positive, fp, depending whether the evidence is true or false, respectively) or not ('Alarm off', which can be a tn or a fn, depending whether the evidence is false or true, respectively), or being inactive due to the unavailability of essential sensors. The results show that the rate of alarms, and in particular the fp and fn probabilities, is largely acceptable, according to recent ergonomics studies [START_REF] Wickens | The benefits of imperfect diagnostic automation: a synthesis of the literature[END_REF]. Furthermore, the value of fp is much less than false positives generated by single sensors. The evaluation of those parameters is essential to ensure system effectiveness and usability in real environments. Trustworthiness evaluation of models employed in situation assessment has a great practical importance in several applications of critical infrastructure surveillance. In those domains, quantitative evaluation is essential since the output of detection models is used to support decisions of the operators. Trustworthiness models allow to evaluate the robustness of PSIM systems also with respect to human errors and/or sensor faults, and to demonstrate compliance to performance and ergonomic requirements. In this paper, we have provided a structured trustworthiness modelling approach especially suited to surveillance systems featuring situation recognition capabilities based on Event Trees, which is the threat specification formalism used in the DETECT framework.

Tab

The effectiveness of the approach described in this paper is twofold. At design time, the results of the analysis provide a guide to support the choice and dislocation of sensors with respect to specific threats. At run-time, trustworthiness indices can be associated with detection models and hence to alarms reported to the operators, taking into account sensor performance and dependability parameters. Furthermore, at runtime:

• Sensor status (e.g. events detected, hardware failures, etc.) can be used to update trustworthiness indices in real-time

• The feedback of the operators over a significant time period can be used to fine-tune trustworthiness parameters (e.g. the fp probability can be estimated by counting the average number of false alerts generated by single sensors or even by DETECT, and by normalizing that number according to the reference time frame).

We have shown that among the probabilistic modelling formalisms, BNs are the most suited to this kind of application, allowing a very good trade-off between ease of modelling and expressive power.

The results achieved by model evaluation demonstrate the effectiveness of the DETECT event correlation approach to reduce the number of unnecessary alerts, warning and alarms, thus improving PSIM ergonomics and usability. Model evaluation also allows to perform 'what-if' predictions and sensitivity analyses with respect to changes in detection model structure and parameters, enabling and supporting design optimisation at several levels. Future developments will address the following: evaluation results are going to be extended using further models and simulation campaigns; data coming from on-thefield experimentations and long term observations is going to be integrated with the models and used to validate them. The aforementioned automatic update of trustworthiness parameters is being implemented in DETECT using appropriate modules and exploiting the integration of DETECT in the PSIM system developed by AnsaldoSTS.

Fig. 3 :

 3 Fig. 3: Surveillance model layers.

Fig. 4 :Tab. 1 :

 41 Fig. 4: BN pattern for the Sensing Layer

  S1) :: Fall of person (E1) • Intelligent Camera (S1) :: Abnormal running (E2) • Intelligent Camera (S2) :: Fall of person (E1) • Intelligent Camera (S2) :: Abnormal running (E2) • Audio sensor (S3) :: Scream (E3) • IMS/SAW detector (S4) :: CWA detection (E4) • IR detector (S5) :: CWA detection (E4)

Fig. 5 :

 5 Fig. 5: Event tree associated to the CWA threat scenario

Fig. 6 :

 6 Fig. 6: BN model of the CWA threat scenario The model has been evaluated on the basis of the parameters summarized in Tab. 2, where (non conditional) probabilities refer to a standard time frame of 1 hour. The parameters have been valued considering realistic pseudo-data, since exact values depend on risk assessment results, specific sensor technology as well as operational reports in the real environment.

  Confusion matrix of the CWA threat scenario.

			. 2: BN model parameters
	Name	Description			Node	Value
	attackProb Probability of having a CWA attack		E	10 -6
	running	Probability of a running man in normal	E1	4*10 -1
		conditions (not related to an attack)
	falling	Probability of a falling man in normal	E2	10 -3
		conditions (not related to an attack)
	screaming Probability of a scream in normal conditions	E3	5*10 -3
		(not related to an attack)
	U 1	Unavailability of sensor 1		S1	2*10 -4
	U 2	Unavailability of sensor 2		S2	2*10 -4
	U 3	Unavailability of sensor 3		S3	10 -4
	U 4	Unavailability of sensor 4		S4	2*10 -5
	U 5	Unavailability of sensor 5		S5	10 -5
	Sfp 11	Sensor false positive probability of sensor 1	3*10 -2
	Sfp 12	(resp. 2) when sensing event 1		E1-S1
	Sfn 11	Sensor false negative probability of sensor 2	E1-S2	2*10 -2
	Sfn 12	(resp. 2) when sensing event 1
	Sfp 21	Sensor false positive probability of sensor 1	2*10 -2
	Sfp 22	(resp. 2) when sensing event 2		E2-S1
	Sfn 21	Sensor false negative probability of sensor 2	E2-S2	3*10 -2
	Sfn 22	(resp. 2) when sensing event 2
	Sfp 33	Sensor false positive probability of sensor 3	2*10 -2
		when sensing event 3		E3-S3
	Sfn 33	Sensor false negative probability of sensor 3	1.2*10 -2
		when sensing event 3
	Sfp 44	Sensor false positive probability of sensor 4	0.8*10 -2
		when sensing event 4		E4-S4
	Sfn 44	Sensor false negative probability of sensor 4	0.2*10 -2
		when sensing event 4
	Sfp 55	Sensor false positive probability of sensor 5	0.7*10 -2
		when sensing event 5		E5-S5
	Sfn 55	Sensor false negative probability of sensor 5	0.3*10 -2
		when sensing event 5
		Tab. 3: Evidence	Alarm on	Alarm off
		True	0.995 (tp)	0.22*10 -4 (fn)
		False	0.5*10 -2 (fp)	0.999978 (tn)

In this case of event detection, the confusion matrix accounts for binary events which can be true (i.e. occurred) or false. In DETECT, the false positive probability is given by P(a =true | e =false) while the false negative probability is P(a =false| e =true).