Nouredine Tamani
email: tamani@lirmm.fr

Patricio Mosse
email: patricio.mosse@gmail.com

Madalina Croitoru
email: croitoru@lirmm.fr

Patrice Buche
email: patrice.buche@supagro.inra.fr

Valérie Guillard

Carole Guillaume

Nathalie Gontard
email: gontard@um2.fr

An argumentation system for eco-efficient packaging material selection

Keywords: Logic-based argumentation, argumentation tool, decision support system, Food packaging

est destinée au dépôt

Introduction

Within the framework of the European project EcoBioCap (ECOefficient BIOdegradable Composite Advanced Packaging), we have designed a Decision Support System (called DSS) whose objective is to select, for a given food, the most relevant packaging materials according to possibly conflicting requirements (food to pack, shelf life, storage temperature, packaging biodegradability, etc.) expressed by the involved parties (food and packaging industries, health authorities, consumers, waste management authority, etc.).

The DSS software, as depicted in Figure 1, realizes a multi-criteria flexible querying process [START_REF] Destercke | A flexible bipolar querying approach with imprecise data and guaranteed results[END_REF] which takes as inputs desired preferences associated with packaging characteristics (dimensions, minimum shelf life, biodegradability, transparency, ...) and uses them to query a packaging database to retrieve a ranked list of most relevant packagings. Optimal permeabilities of the targeted packaging can be computed thanks to a Modified Atmosphere Packaging (MAP) simulation model [START_REF] Guillard | Parameters uncertainties and error propagation in the modelling of modified atmosphere packaging[END_REF].

In this paper, we propose a new component of the DSS. It implements an argumentation process which aims at combining several stakeholders (researchers, consumers, food industry, packaging industry, waste management policy, etc.) requirements expressed as simple textual arguments, to enrich the querying process by stakeholders' justified preferences. Each argument supports/opposes a choice justified by the fact that it either meets or does not meet a requirement according to a particular aspect of the packagings (end of life management, transparency, ...).

For example, a market shop manager expresses the need for a new packaging to pack apricots such that its dimensions are 20 cm in length, 15 cm in width and 15 cm in depth and ensures a minimum shelf life of 10 days.

The design of this new packaging needs also to take into consideration the packaging industry constraints (ability to scale-up the production process, the availability of the row material, etc.), the waste management administration rules about packaging end of life (biodegradability, recyclability, incineration, burying, etc.) and consumer preferences (transparent packaging, environment-friendly packaging, no extra-cost due to packaging, etc.).

As illustrated in Figure 1, the former conditions (dimensions and shelf life in addition to the fresh food to pack, i.e. apricots in this case) are the inputs of the virtual MAP simulator which returns the optimal parameters for gaz (O2 and CO2) permeability to ensure the shelf life required to preserve the apricots. The latter conditions are expressed as text arguments of the form "Biodegradable materials are suitable since they help to protect the environment" or "Life cycle analysis results are not in favor of biodegradable and compostable materials". These arguments are the input of the argumentation system which distinguishes for each option (biodegradable material, compostable material, etc.) the reason leading to its acceptance or its rejection. Then, the argumentation system detects the conflicts among the arguments and computes the sets of coherent arguments which defend themselves against attacks. After that, it extracts from the winner arguments the most justified options (for instance biodegradable materials) as predicates in order to enrich the querying process. Finally, the multi-criteria flexible querying system combines the outputs of both virtual MAP system and argumentation system to deliver from the Packaging Solution DB the list of packaging materials satisfying the requirements.

We detail in this paper how arguments are modeled within a structured argumentation system and how the delivered justified conclusions can be used in the querying process. This paper is a detailed and an extended version of the previous work [Tamani et al., 2014].

Thus, packagings have to be selected according to several aspects or criteria (permeance, interaction with the packed food, end of life, etc.) highlighted by arguments expressed by the stakeholders involved in the project.

The problem at hand does not simply consist in addressing a multi-criteria optimization problem [START_REF] Bouyssou | Decision-making process -Concepts and Methods[END_REF], but the DSS would need to be able to justify why certain packagings are chosen. To this aim, we make use of argumentation theory [Dung, 1995, Besnard and Hunter, 2008, Rahwan and Simari, 2009], in which some approaches combine argumentation and multi criteria decision making [START_REF] Amgoud | Using arguments for making and explaining decisions[END_REF].

The arguments we consider in this paper are based on a defeasible reasoning. We rely in this work on a logical-based structured argumentation system, called ASPIC [START_REF] Amgoud | Final review and report on formal argumentation system[END_REF] and on its extension ASPIC+ [Prakken, 2010, Modgil andPrakken, 2013], which (i) allows the expression of logical arguments as a combination of atoms and rules, (ii) defines attack and defeat relations among arguments based on a logical conflict relation.

The main contributions of the work are the following:

1. An instantiation of ASPIC argumentation system (AS) in a DSS dedicated to the selection of packaging solutions well suited for a given food product.

2. The study of the mutual influences between arguments expressed over several options regarding different concerns. We show the limitation of the regular instantiation of the ASPIC AS, and we propose to overcome this limitation with a viewpoint approach in which arguments are gathered according to packaging aspects or concerns. Each viewpoint delivers subsets of non-conflicting arguments supporting or opposing a kind of packaging according to a single topic (shelf life, cost, material type, safety, end of life, etc.).

3. The use of the argumentation results for a multi-criteria flexible querying of the packaging database. The coupling of both components provides a new multi criteria decision making tool dedicated to packaging selection taking into account potentially contradictory stakeholders' preferences.

4. Implementation of the approach as a java GXT/GWT web application accessible on http://pfl.grignon.inra.fr/EcoBioCapProduction/. A demonstration video is also accessible on http://umr-iate.cirad.fr/FichiersComplementaires/DemoRomeHD.mp4.

Evaluation of the argumentation tool within the EcoBioCap project

with a collaboration of the experts of packaging industry.

In Section 2, we detail the main functionalities of the developed argumentation tool. In Section 3, we introduce the main architecture of the developed argumentation system. In Section 4, we recall briefly our approach defining an argumentation theory relying on ASPIC. Then, we explain through a real world example the rationale behind the notion of viewpoints in Section 5.

Section 6 is dedicated to the implementation and evaluation of the approach.

Section 7 sums up some related works, and finally, in Section 8 we recall our contributions and introduce some perspectives.

Functional specification of the argumentation process

We detail hereinafter the main functions of the argumentation system integrated into the EcoBioCap Decision Support System. After discussions and interviews with the project partners, we have identified some requirements summarized in the following functionalities:

• Formalize text arguments: the argumentation system should provide users with a user-friendly interface allowing them to express their arguments as text and then formalizing them as concepts and rules. Here, concepts can be linked to corresponding attributes of the packaging database to permit the exportation of consensual preferences computed by the argumentation system towards the multi-criteria flexible querying of the packaging database. The system should also be equipped with a function of import/export formalized arguments into/from an XML format. Thus, one can load already formatted concepts and rules directly in the system.

• Process arguments: the system should automatically compute the logical arguments obtained from the set of concepts and rules. The arguments can be gathered into pros and cons with regard to some packaging alternative characteristics which are discussed by the stakeholders (for example, the end of life characteristics of the packaging: biodegradable, recyclable, etc). Once logical arguments are built, the system should compute all conflicts or attacks among them.

• Compute extensions: an extension is the result of the argumentation process and corresponds to a subset of non-conflicting arguments. The system should implement different kinds of semantics proposed in the literature (admissible, preferred, grounded, stable, etc.). In this way, the user would be able to compute the extensions associated to a particular semantics or to all semantics.

• Enrich the multi criteria flexible querying: based on the obtained extensions, the system should be able to automatically translate the extension into preferred values associated with attributes of the packaging database. These attributes and eventually associated values become predicates (conditions) which can be used later to enrich the multi criteria flexible query which can be processed by the flexible querying system of the DSS.

Architecture of the argumentation system

As illustrated in Figure 2, the proposed argumentation system relies on 5 main modules which implement the argumentation work flow, described below.

! Argument) Formalization)) Logical) arguments) Conflicts)and) attacks) Extensions)) (Non;conflicting) arguments)) Justified)Preference)extraction)) Rules) DB) Text) arguments) Justified) preferences) XML)file)
Figure 2: The architecture of the argumentation system.

• Step 1: Argument formalization: this module implements a user-friendly interface for an interactive translation of text arguments into a formal representation made of concepts and rules. A graphical representation of the expressed rules is also built as the users formalize manually their text arguments. The formal representation obtained is finally saved in a database for a persistent storage allowing to reload argumentation projects without rebuilding all the arguments and to reuse also the already formatted rules in other projects.

• Step 2: Logical arguments building: this module receives as inputs the list of concepts and rules corresponding to text arguments. This list can be the result of the formalization module or given by the user as an XML file. Then, by a derivation process, this module builds all possible arguments according to the process defined in ASPIC/ASPIC+ logicbased argumentation frameworks [START_REF] Amgoud | Final review and report on formal argumentation system[END_REF], Prakken, 2010] and reused in [START_REF] Tamani | A viewpoint approach to structured argumentation[END_REF], Tamani et al., 2014]. This module also implements a function to export the argument list into an XML file.

• Step 3: Conflicts and attacks detection: this module relies on the logical arguments built by the previous module. According to the negation operator, it detects all the conflicts among arguments and models them as attacks with respect to the definition of attacks introduced in [START_REF] Tamani | A viewpoint approach to structured argumentation[END_REF], Tamani et al., 2014]. The output of this module is an argumentation graph made of arguments (nodes) and attacks (edges).

• Step 4: Extensions computation: an extension is a subset of nonconflicting (consistent) arguments which defend themselves from attacking arguments. The computation of extensions is made under one semantics (preferred, stable, grounded, etc.) as defined in [Dung, 1995]. This module allows the computation of one or all semantics considered (preferred, stable, grounded, eager, semi-stable, naive).

• Step 5: Extraction of the justified preferences: the computation of extensions delivers one or several extensions. In the case of several extensions, the system lets the users select the most suitable extension according to their objectives. If the users cannot reach an agreement over the extensions, the system allows them to add new arguments and re-compute the extensions on the fly. Finally, the selected extension is then used to extract corresponding preferences underlying the contained concepts. These preferences are expressed as a list of couples (attribute, value), where attribute stands for a packaging attribute as defined in the packaging database schema of the flexible querying system part of the DSS, and value is the preferred value expressed for the considered attribute.

In the next section, we introduce the logical language developed for argument formalization.

The argumentation framework

We recall in this section the Dung abstract framework for argumentation (see subsection 4.1) and we instantiate it with the ASPIC framework (see subsection 4.2).

Dung argumentation principles

A Dung abstract argumentation framework (AF ) [Dung, 1995] [START_REF] Baroni | An introduction to argumentation semantics[END_REF], Caminada et al., 2011] if and only if S is a complete extension where S ∪ S + is maximal, where S + is the set of arguments attacked by those of S. S is the eager extension [START_REF] Baroni | An introduction to argumentation semantics[END_REF] if and only if it is the greatest admissible set that is a subset of each semi-stable extension.

Example 1. In figure 3 below, examples of extensions are presented on different argumentation graphs using Dung's semantics ({admissible, complete, preferred, grounded, stable}). Green nodes form the computed extension and nodes in red color correspond to those which do not belong to the computed extension. We notice that some semantics can return empty or even no extensions.

This situation occurs particularly when a user expresses at least one selfdefeated argument, which is not attacked by any other argument, but attacks all the others. This kind of arguments are called contaminating arguments [Wu, 2012]. The current version of our system detects the rules leading to such arguments and discards them before performing the process of extension computations. The user is warned and the list of discarded rules is displayed.

ASPIC argumentation system

In this paper we consider a subset of ASPIC+ [Prakken, 2010] argumentation system, which is compatible with the ones presented in [START_REF] Amgoud | Final review and report on formal argumentation system[END_REF]].

An ASPIC+ argumentation system is denoted AS = (L, cf, R, ≥), where:

• L is the logical language of the system.

• cf is a contrariness function which associates to each formula f of L a set of its incompatible formulas (in 2 L ): in our case, cf corresponds to

classical negation ¬. • R = R s ∪ R d is the set of strict (R s ) and defeasible (R d ) inference rules where R s ∩ R d = ∅.
As stated in [START_REF] Modgil | A general account of argumentation with preferences[END_REF]],

ASPIC+'s inference rules can be used to encode domain-specific information but they could also express general laws of reasoning. In this paper we use these rules to encode packaging domain-specific information. Thus, a strict rule, denoted by →, expresses a natural implication in the domain, as "GlutenPackaging is a Packaging", and a defeasible rule, denoted by ⇒, expresses an implication which is not always true, as "GlutenPackaging can be a suited Packaging". For each strict rule a → b, we add in R s the rule ¬b → ¬a to ensure the completeness and the consistency of reasoning (see [START_REF] Caminada | On the evaluation of argumentation formalisms[END_REF] for further details),

• ≥ is a preference ordering over defeasible rules, not used in our framework.

A knowledge base in an AS = (L, cf, R, ≥) is K ⊆ L, which contains the concepts defined in the domain and the alternative choices under discussion.

Argument structure. An ASPIC argument A can be of the following forms:

1. c with c ∈ K, such that P rem(A) = {c}, Sub(A) = {A} and Conc(A) = c, with P rem returns premises of A, Sub returns its sub-arguments and Conc returns its conclusion,

2. A 1 , ..., A m ⇒ c (resp. A 1 , ..., A m → c), such that there exists a strict (resp. defeasible) rule in R s (resp. R d ) of the form Conc(A 1 ), ..., Conc(A m ) ⇒ c (resp. Conc(A 1 ), ..., Conc(A m ) → c), with P rem(A) = P rem(A 1 ) ∪ ... ∪ P rem(A m ), Conc(A) = c, Sub(A) = Sub(A 1 ) ∪ ... ∪ Sub(A m ) ∪ {A}.
Form 1 associates one argument with each alternative choice defined in the argumentation system AS. Based on arguments generated by Form 1, Form 2 permits to create new arguments by applying a derivation process over the set of strict (R s ) and defeasible (R d ) rules defined in AS. A step in the derivation process considered in this case means that, if a set of final conclusions of a given set if arguments matches the antecedents of a rule then the arguments can be combined by applying the rule, thus creating a new argument. Each step in this derivation process forms an argument.

We make the assumption that the set of arguments constructed from the argumentation system is finite. An argument is said strict if and only if it does not involve any defeasible rules. Otherwise, it is called defeasible.

The set of strict rules R s is consistent if and only if it is impossible to construct in the argumentation system two strict arguments having conflicting conclusions ( A, B such that A, B are strict arguments and

Conc(A) = ¬Conc(B)).
Notation. To improve the readability, by abuse of notation, we associate to each argument a label made of a capital letter followed by a subscript number.

The labels are then used in an argument to refer to its sub-arguments. In this notation, a label followed by colon is not a part of the argument.

Let AS be an The following arguments can be built:

• A 1 : a • A 2 : b • A 3 : A 1 , A 2 → c.
A 3 means that Conc(A 1 ) and Conc(A 2 ) are the hypothesis that lead to the claim c, by applying the rule a, b → c.

Example 3. We consider the following textual arguments expressed about biodegradability of packaging materials.

• Life Cycle Analysis (LCA) results are not in favor of biodegradable materials, regarding their high environmental impact during the production process.

• Consumers are in favor of biodegradable materials since they could help to protect the environment.

We model these arguments by using the proposed logical language as follows:

• BP is a concept referring to biodegradable packaging materials.

• P EV , HIP are concepts referring to packagings which respectively protect the environment and have a high environmental impact (according to LCA).

• ACC, REJ are concepts referring to the global decisions (accepted, rejected) about the packaging to choose according to the aspect considered (in this example, the biodegradability of the material). Intuitively, ACC = ¬REJ and REJ = ¬ACC. We can syntactically replace REJ with ¬ACC.

The set of rules R = R s ∪ R d is:

• R s = {BP → HIP, ¬HIP → ¬BP, HIP → ¬ACC, ACC → ¬HIP } • R d = {BP ⇒ P EV, P EV ⇒ ACC}
Please notice that strict rules are used to model reliable knowledge based on measured parameters by using well-defined and stated procedures, or expressed with linguistic terms such as "must", "shall", "mandatory", "important", etc. On the other hand, defeasible rules model knowledge based on empirical observations or expressed with linguistic terms such as "may", "could", "optional", etc. Here, the rules involve HIP are considered as strict and those involving P EV are defeasible.

The following structured arguments can be built on the knowledge base

K = K p = {BP }: • A 0 : BP • A 1 : A 0 → HIP • A 2 : A 1 → ¬ACC • B 1 : A 0 ⇒ P EV • B 2 : B 1 ⇒ ACC • B 3 : B 2 → ¬HIP • B 4 : B 3 → ¬BP
ASPIC/ASPIC+ attack and defeat relations. We only consider in this work the rebutting attack as defined in [START_REF] Modgil | A general account of argumentation with preferences[END_REF]:

Argument A rebuts argument B on B if and only if Conc(A) ∈ cf (ϕ)
(where ϕ is an atom in the language) for some B ∈ Sub(B) of the form Only one preferred extension

B 1 , ..., B m ⇒ ϕ. Finally, A defeat B if A rebuts B.
E 1 = {A 0 , A 1 , A 2 , B 1 } can be computed over this set of arguments. The output of E 1 is Output(E 1 ) = Concs(E 1 ) =
{BP, HIP, P EV, ¬ACC}.

It is worth noticing that as we obtain only one extension then all its arguments are both skeptically and credulously accepted in the argumentation system, under the preferred semantics.

In the following, we detail how this argumentation system has been instantiated with the EcoBioCap project knowledge.

ASPIC instantiation for packaging selection application

In this section we introduce the instantiation of our logical representation of text arguments within ASPIC AS. We describe in Subsection 5.1 how textual arguments are modeled as options and rules, which are used after that to instantiate ASPIC AS for argument derivation, conflict detection, extension computation and predicate extraction. We show in Subsection 5.2 the drawback of a direct instantiation of the ASPIC argumentation system in our application context and we introduce our solution based on viewpoints.

Logical modeling of text arguments in ASPIC AS

As described in Section 3, we aim at developing an argument-based application for packaging selection in order to be able:

• to model logically the stakeholders' arguments in order to extract the underlying knowledge that could enrich the querying process,

• to compute the extensions (the subsets of consistent arguments that defend themselves against attacks),

• to extract from the chosen extension the predicates to use in the querying process, called justified preferences.

The first requirement can be achieved by defining two levels of modeling:

syntactical level and logical level. At the syntactical level, we identify in each argument the concepts involved, their corresponding attributes in the database and optionally the values associated with attributes. A concept is seen as a subclass of packaging. The concepts syntactically correspond to the atoms of the propositional language used to instantiate the argumentation framework. At the logical level, we distinguish for each argument the body (or the premises) and the head (or the conclusion) of the underlying rules and we specify if the extracted rule is either strict or defeasible. The body and the head of a rule correspond to concepts defined at the syntactical level.

Example 6. Let us consider the following argument:

"Life Cycle Analysis (LCA) results are not in favor of biodegradable materials, regarding their high environmental impact during the production process, expressed by the carbon footprint ≥ 5kg eq. CO 2 ".

At the syntactical level, we define the following concepts:

• BiodegradableP ackaging: it corresponds to the biodegradable packaging; it is related to the attribute Biodegradability which is already defined in the database schema and to the value T rueBiodegradableP ackaging also defines one of the possible choices of packaging, which are discussed in the argumentation system.

• HighEnvImpactP ackaging: it corresponds to packaging having a bad carbon footprint value. This concept is related to the attribute CarbonF ootP rint and the value ≥ 5kg eq. CO 2 . In the case that the attribute is not defined in the database schema; the application allows, however, the user to add the required information to define it (value type, measure unit, minimal value, etc.), and to suggest it as a possible extension of the database schema.

At the logical level, the argument is translated into the following rules:

• BiodegradableP ackaging → HighEnvImpactP ackaging

• HighEnvImpactP ackaging ⇒ N otAccepted

These rules express the fact that each biodegradable packaging is a packaging having a high environmental impact (considered here as strict for the sake of demonstration), and such packaging are not accepted or rejected (represented as a defeasible rule as a decision is generally defeasible). The user specifies both rules at once using the same user interface, and indicates also for each rule if it is strict or defeasible. The application automatically adds the transposed rule in the case of strict rules.

The rules and the options (seen as premises), in addition to the decision atoms Accepted and Not Accepted, are used to instantiate the AS-PIC AS. Once ASPIC AS is instantiated, the system derives the arguments (as illustrated in Example 3), detects the conflicts amongst them (as in Example 4), computes the extensions (like in Example 5), and finally extracts the predicates to send to the querying process. As illustrated in Example 5, the argumentation system recommends the rejection of the biodegradable packaging. This recommendation is translated into the predicate Biodegradable = F alse, which can be expressed in a SQL query. This query is afterwards addressed to the database containing the packaging materials in order to retrieve the packaging which are not biodegradable.

In the next subsection, we show the limitation of a direct instantiation of the ASPIC AS based on our logical approach for argument modeling, and we introduce a solution relying on viewpoints.

Viewpoint-based ASPIC AS for packaging selection

When stakeholders are engaged in an argumentation process, they express their arguments for or against the acceptance of some kinds of packagings according to some characteristics, corresponding to their concerns and objectives. Let us consider the following text arguments expressed by the stakeholders obtained by interviews and surveys.

1 Here, we distinguish several packaging options: Biodegradable, Recyclable, Compostable, Micro-Perforated, Multilayered, Mono-layered packagings.

Let us consider all the above mentioned arguments to instantiate an AS-PIC/ASPIC+ argumentation system. In this case, the argumentation system returns extensions (in any Dung semantics) which are not enough informative to make a decision, as shown by the following instantiation limited to arguments 5 and 9 (but without loss of generality):

Example 7. Arguments 5 and 9 are defeasible and involve two different options: Biodegradable (denoted by Bio) and Multi-layered (denoted by M ul) materials. A classical ASPIC argumentation system derives from these text arguments the following 6 logical arguments:

• A 0 : Bio • A 1 : A 0 ⇒ P rotectEnvironment • A 2 : A 1 ⇒ Accepted • B 0 : M ul • B 1 : B 0 ⇒ Expensive • B 2 : B 1 ⇒ N ot Accepted
Argument A 2 attacks Argument B 2 and vice-versa and we get 2 preferred extensions:

• E 1 = {A 0 , A 1 , A 2 , B 0 , B 1 } • E 2 = {A 0 , A 1 , B 0 , B 1 , B 2 }
The output of each extension1 are as follows:

• Concs(E 1 ) = {Bio, P rotectEnvironment, M ul, Expensive, Accepted}

• Concs(E 2 ) = {Bio, P rotectEnvironment, M ul, Expensive, N ot Accepted}

We notice that the conclusions of E 1 ad E 2 are identical, expect for the decision (Accepted, Not Accepted ). Therefore, they cannot be used for decision support because their conclusions say that we accept and we reject both options M ul and Bio for the same reasons.

To alleviate this situation, we suggest to separate the options according to the topic or the concern considered. Each topic is called viewpoint, which gathers arguments involving some options or alternatives and dealing with the same subject. Hence, we can handle arguments for both acceptance and rejection of packaging but considered only from one packaging aspect. In this way, decisions reached in each viewpoint are based on one packaging aspect debated by stakeholders' arguments.

A viewpoint helps the users to express their arguments by connecting an option with the reason behind its acceptance or rejection. The resulted extensions in a viewpoint not only provide accepted (resp. rejected) options but provide some information explaining why they are accepted (resp. rejected) as well. A viewpoint facilitates the analysis of the output of the argumentation framework for decision making, since we get one extension which contains the accepted options and all the reasons leading to their acceptance, and a second extension which contains the rejected options and all the reasons leading to their rejection.

Each viewpoint instantiates our logical approach for argument modeling.

Decisions can then be made relying on the computed extensions corresponding to the consensual solutions from a single packaging attribute. We then obtain several attributes with their related values, which are finally used to enrich the querying process for packaging selection, handled by the multicriteria flexible querying system.

It is worth noticing that this approach is a simplification of a theoretical viewpoint model introduced in [START_REF] Tamani | A viewpoint approach to structured argumentation[END_REF].

Example 8 (Cont. Example 7). In the above example, the first argument deals with the end of life characteristics of the material to use, and the second argument deals with the design of the packaging. Thus, we can consider two viewpoints: End of life and Design. Each viewpoint instantiates an ASPIC argumentation system. We here obtain one preferred extension per viewpoint:

• E End_of _lif e = {A 0 , A 1 , A 2 } from which we extract the predicate "Biodegradability = T rue",

• E Design = {B 0 , B 1 , B 2 } from which we extract the predicate "M ultilayered = F alse".

Both predicates are finally available for the querying process to retrieve from the database the packaging material satisfying them. The user can select both predicates since they are not contradictory or just one of them, which is considered as the most important predicate according to his/her needs. It amounts to decide which of the viewpoints is the most important for his/her query.

The above twelve arguments can be split into the following viewpoints:

• end of life: in this viewpoint, stakeholders (waste management authority, users, researchers) argue between biodegradability, compostability and recyclability of the packaging. It contains arguments 1 to 6, 11 and 12,

• design for a better shelf life: this viewpoint contains arguments 7 to 10, the choice is between mono-layered, multilayered and micro-perforated packagings.

It is worth noticing that there is not a crisp boundary between viewpoints and it is possible to have arguments expressed on more than one aspect of packaging. For instance, arguments 11 and 12 could be gathered into a new viewpoint about the economic concerns. For the sake of flexibility, the current version of the system does not impose any restriction on the process of affectation of the arguments to the viewpoints. In addition, it allows users to duplicate such arguments in more than one viewpoint to see their effects on different aspects of packaging.

The benefits of viewpoints are the following:

• Helping the stakeholders to express their argument by considering one topic at a time, and to analyse the results delivered from the argumentation framework.

• Associating subsets of arguments to attributes defined in the database schema. It facilitates the querying process, which retrieves the list of packaging materials.

• Reducing the mutual influence between arguments expressed about different issues.

• Possible reduction of the CPU-time for extension computation, since the number of arguments and attacks to consider is less than all the arguments to handle in the argumentation framework. It has been proven in [Vreeswijk, 2006] that the extension computation is expo-nential in time. The higher the number of conflicts among arguments in the system is, the higher the response time for extensions will be.

The drawback of viewpoints lies in the fact that it is possible in some case that a single option is accepted in one viewpoint and rejected in another one, since the argumentation system does not forbid the use of a single option in more than one viewpoint. For instance, biodegradable packaging is acceptable from the environment (end of life) viewpoint but not accepted from the economic viewpoint. The system is designed to be flexible enough to give the experts the ability to decide which extensions to consider and which ones to discard. In this case, as said above, it is up to the user to decide which viewpoint is the most important for the querying process.

In the next section we describe the functionalities implemented of the argumentation system through several screenshots showing the process of instantiation of the argumentation system on the end of life viewpoint as well as the results delivered.

Implementation and evaluation of the argumentation approach

We detail in Subsection 6.1 the implementation of the approach as a webbased application. Then, we evaluate in Subsection 6.2 the argumentation tool for packaging selection according to the end of life viewpoint with experts from four european countries (France, Hungary, Italy and Sweden), involved in the EcoBioCap project.

Implementation of the argumentation tool

The implementation of the approach was done in the context of the Eco- Figure 8 shows the formalizing interface in which a user can select the already created concepts as premise or conclusion to form the rule underlying the text argument. The rule is then connected to a decision (Accepted, Not Accepted ). The rule and its decision can be specified either as a strict or as a defeasible rule.

Figure 9 illustrates the obtained rules in the case of the viewpoint end of life in which stakeholders argued about biodegradability, recyclability and compostability.

Figure 9: Example of the rules built upon the viewpoint end of life.

The system generates arguments and computes conflicts and attacks as shown in Figure 10. For the arguments of end of life viewpoint, the system detected 409 conflicts. The extensions under different semantics (stable, preferred, admissible, grounded, naive) are after that computed and their contents are displayed to the user in Figure 11, by using the Java DungAF API3 . For the sake of simplicity, we made the design choice to display only the conclusions of the arguments belonging to an extension. To highlight the recommendations in each extension, the concepts playing the role of the choices and decision variables (Accepted and Not Accepted ) are displayed in bold font.

It is worth noticing that all the extensions recommending the rejection (Not Accepted ) are displayed in a positive way by negating all concepts contained (NOT "Not C" becomes "C" and NOT "C" becomes "Not C" with C is either a concept or a decision). The reason for this translation is to address one of the expert feedbacks obtained during an early test of the user interface.

In fact, the experts considered that it is not intuitive to choose an extension recommending a rejection (which contains the decision Not Accepted ).

Figure 11: Delivered extensions in the end of life viewpoint.

In Figure 11, the system concludes skeptically that biodegradable packagings are the most justified ones under the preferred semantics (the concept underlined in red).

In addition to its ability to aggregate non-structured knowledge expressed as text arguments, the argumentation process also provides the user with some justifications supporting the recommended result. For example, we notice in Figure 11 that biodegradable packagings are accepted because they help protecting the environment (P rotectEnvP ackaging), as they have a low environmental impact and do not imply any additional taxes (N ot HighT axes)

to be paid by the society (industries, population, etc.).

Furthermore, the proposed approach is also dynamic in the sense that if an expert does not agree with the argumentation results, he/she can add on the fly additional arguments to express his/her disagreement. Then, the application detects the conflicts generated by the added arguments and recompute the extensions accordingly.

The extensions obtained are stored as a list of attribute = value (Figure 12) to be used in the flexible querying system in addition to some other parameters useful for the querying process (value 1 and value 2 corresponding to the values min and max in Figure 7, their respective data type: columns T ype, the attribute is either negated or not: the column N egated, and finally the attribute is either defined in the database schema or not: the column Supported in DB).

In the context of end of life viewpoint, the condition Biodegradable = T rue is sent to the querying process to be used as a justified preference for packaging material selection.

Figure 12: Exporting the extensions composed of concepts and associated attributes belonging to the database.

In fact, the user can select the extensions, previously translated into couples attribute = value, from the graphical user interface of the flexible multicriteria querying system as displayed in Figure 13. Figure 14: The final result after running the multi-criteria querying process.

Evaluation of the argumentation tool

The evaluation of the tool has been carried out in two phases. The first one was performed at the middle of the implementation process when only main user interfaces and functions were implemented. The second phase was performed at the end of the implementation process.

The first evaluation aimed at validating the user interfaces and the usability of the tool. The evaluation method was based on the implementation of real use cases in which some experts involved in the project were invited to express some text arguments. Then, we guided them through the argumentation process, from argument formalization to extension computation.

The main evaluation criteria considered here were:

• The intuitiveness of the user interfaces,

• The relevance of the functions implemented,

• The usefulness of the graphical representation of the data (argument graph made of arguments and attacks, argument derivation, alternatives and rules representation),

The conclusions drawn from this early evaluation is as follows.

• The experts (who are not computer scientists) were more interested on the input and the output of the tool than on the detailed process it goes through. Thus, argument modeling and extension outputs are the main functions of the tool from the experts' standpoint.

Consequently, we have hided by default the graphical representation of the arguments, attacks amongst them and the argument derivation process so as the information shown to the users focus on the text argument, the result of modeling and the output of extensions. The users can still display on demand further details about the argumentation process.

• The second feedback was about the rule modeling as either defeasible or strict, which is seen by the experts as an important limitation of the expressiveness of arguments, since a rule could be less/more defeasible than another. As mentioned on future work, this issue gave birth to fuzzy argumentation framework [Tamani and[START_REF] Tamani | A quantitative preference-based structured argumentation system for decision support[END_REF]Croitoru, 2014a].

The second evaluation process aimed at validating the reasoning process by the experts. During a 2-day workshop, we have collected text arguments on diverse options about the end of life of packaging in different European countries. We have modeled the arguments and compute the extensions, which we have after that shown to the experts the second day to evaluate the likelihood and the coherence of the results obtained. The evaluation criterion considered here is the correctness of the implementation of the reasoning process.

The evaluation of the argumentation tool has been carried out for the following four countries: France, Hungary, Italy and Sweden. We summarize in Table 1 the data collected via discussions and interviews with diverse experts from each country about the aspect packaging's "end of life". For each country, we listed the discussed options according to the local context and the number of text arguments collected. We refer the reader to Tables 3,4, 5 and 6 in appendix A for the text arguments gathered for France, Hungary, Italy and Sweden, respectively. In the case of Italy, the argumentation tool returns the same skeptical outputs as for Hungary and for quite similar reasons. Biodegradable packaging are returned for their positive image toward the protection of the environment, but marketing aspects are not important for Italy. Recyclable packaging are discarded because of the taxes the consumers would have to pay.

In the case of Sweden, the argumentation tool returns two preferred extensions and three skeptically accepted choices: Biodegradable, Incinerated and N ot Landf ill packaging. The main reasons here to accept biodegradable packaging are energy bio-gas production in addition to the environment protection. Incinerated packaging are also accepted since they are used to produce energy. The landfill packaging are rejected in all situations because the authorities forbid all kinds of landfilling solution for packaging.

In the case of France, due to the number of arguments and conflicts generated5 , the computation of extensions takes a long time and the server ran out of resources (because of the Java DungAF which implements exponential algorithms as shown in [Vreeswijk, 2006]). Therefore, we simplified the argumentation graph by deleting the rules leading to self-attacked arguments.

The result delivered from the argumentation tool is actually an approximation. From the returned two preferred extensions, two skeptically accepted choices are obtained, namely: N ot M ultiLayered recyclable P ackaging and incinerated P ackaging (also denoted by OtherP ack). The incinerated packaging produce energy and the multilayered recyclable packaging are rejected since there is no recycling chain available. The rest of listed reasons are related to the other discarded options (biodegradable, compostable, recyclable and burying packaging). There have been returned by the system because of the simplification of the argumentation graph.

These results are however validated by the experts with respect to the text arguments used in the computation of extensions.

To conclude this section, we have learned from this evaluation that:

• The argumentation process delivered coherent results, in the sense of attack definition,

• The process can be time consuming when the number of text arguments is important,

• The need for an explanation function when the output contains some unexpected results, or in the contrary does not contain some expected results.

Related work

Related work can be considered according to application standpoints in the argumentation field. Based on the recent survey [START_REF] Schneider | A review of argumentation for the social semantic web[END_REF] and the web site http://www.phil.cmu.edu/projects/argument_mapping/, applications and tools developed for argumentation can be divided into the two following categories:

• Software for argument expression and modeling. This software, such as Araucaria [START_REF] Reed | Araucaria: Software for argument analysis, diagramming and representation[END_REF], Argunet [START_REF] Schneider | Argunet-a software tool for collaborative argumentation analysis and research[END_REF] and DebateGraph,6 allows the expression of arguments as texts to manually formalize them as hypothesis and conclusions. The user can after that save the arguments as an XML file.

• Software for extension computation (we recall that an extension is a conflict-free subset of arguments defending themselves against attacks) over an argumentation graph given as input, like OVA-GEN7 and Ar-guLab8 . Despite the plethora of available software in the field of argumentation, there are few argumentation software systems implementing an argumentation process from argument expression to extensions computation, while providing users with several graphical user interfaces to visualize the entire process. In addition to the software introduced in this paper we can cite ArgTrust [START_REF] Parsons | Argtrust: Decision making with information from sources of varying trustworthiness[END_REF], in which the authors considered the uncertainty underlying the sources of the knowledge used in the argumentation framework for decision making; CISpaces framework [START_REF] Toniolo | Argumentation-based collaborative intelligence analysis in cispaces[END_REF], which supports collaborative intelligence analysis of conflicting information in collaboration exploiting argumentation schemes; "Quaestion-it.com" [START_REF] Evripidou | Quaestioit.com: a social intelligent debating platform[END_REF] which is a social intelligence debating platform, based on computational argumentation, for modeling and analyzing social discussions, and demonstrate a question-and-answer web application providing support for extracting intelligent answers to user-posed questions; and the Carneades argumentation system web version [Gordon, 2013], which provides software tools based on a common computational model of argument graphs useful for policy deliberations.

We presented in this paper a real world application based on argumentation reasoning and connected to the querying process by harnessing the result of the argumentation process as justified preferences expressing consensual solutions encompassing the stakeholders needs and requirements. It is to the best of our knowledge an original contribution in the field of food packaging.

Conclusion and Future Work

In this paper we applied an argumentation approach to a real use case from the industry, based on an ASPIC argumentation system specifications allowing stakeholders to express their preferences and providing the system with stable concepts and inference rules of a domain. We have proposed an argumentation system in which each criterion (attribute or aspect) is considered as a viewpoint in which stakeholders express their arguments in homogeneous way. Each viewpoint delivers extensions supporting or opposing certain choices according to one packaging aspect, which are then used in the querying process. The approach was implemented as a web-based application and evaluated in real use cases modeling possible packaging end of life solutions in four european countries.

Compared to the current stakeholder decision-making practices, this DSS is a significant breakthrough in the field of food packaging. The DSS proposed in this paper answers to multi-criteria queries including several food packaging characteristics. Moreover, the DSS is able to aggregate in a consensual way the arguments expressed by to the packaging food chain stakeholders about their constraints, acceptances and needs considering several criteria (biodegradability, transparency etc). To the best of our knowledge, this type of tool was never attempted previously in that field. Among the list of possible packagings retrieved by the DSS, the user has to choose one (usually the one ranked on top) and then to test it in real condition of use. Compared to the empirical approach that requires numerous experimental trials, using the DSS the user will have only one trial to perform (validation step). For the aforementioned reasons, the DSS proposed in this paper can be of help for decision-making in the field of food packaging for fresh produce.

As future work, we need to improve the scalability of the argumentation system regarding the number of arguments expressed within a viewpoint. This issue could be tackled either by considering recently introduced effective approaches and algorithms for computation, such as SATbased approach [START_REF] Cerutti | Argsemsat: Solving argumentation problems using SAT[END_REF][START_REF] Cerutti | A scc recursive meta-algorithm for computing preferred la-bellings in abstract argumentation[END_REF], recursive metaalgorithm [START_REF] Cerutti | An SCC recursive meta-algorithm for computing preferred labellings in abstract argumentation[END_REF], and algorithms for decision problems [START_REF] Nofal | Algorithms for decision problems in argument systems under preferred semantics[END_REF]. Another possible solution could be splitting again arguments' viewpoint into subtopics which would be easier to handle as small subsets of arguments. This solution imposes to study how to aggregate the solutions delivered by subtopics to compute the final recommendation of a given viewpoint.

The approach proposed and implemented in this paper can benefit from the diverse argumentation approaches for decision making, such as the value-based argumentation approaches [START_REF] Atkinson | Practical reasoning as presumptive argumentation using action based alternating transition systems[END_REF]] [Bench-Capon et al., 2011, Bench-Capon et al., 2013, Prakken, 2012] which argument schemes are used as means to deliberate or to reason with legal cases using values. Besides, it is also possible to refine the reasoning with preferences which can be expressed over the arguments or the alternatives like in [START_REF] Amgoud | Using arguments for making and explaining decisions[END_REF], Modgil and Prakken, 2013, van der Weide et al., 2011] or by multi-criteria argument selection such as in [van der Weide et al., 2012].

Besides, some experts feedback pointed out the difficulties to consider a rule as either strict or defeasible and expressed the need to be able to specify a sort of importance encompassing the notions of strictness and defeasibility.

One work in progress [Tamani and[START_REF] Tamani | A quantitative preference-based structured argumentation system for decision support[END_REF]Croitoru, 2014a] is to extend the proposed approach to fuzziness to make it possible to deal with vague and uncertain concepts and rules. Another important feedback from the expert was about explaining the results delivered from the argumentation process. The experts expressed the need for explanation function which is capable to provide more information about how a given conclusion was or was not delivered. The issue of explaining is currently undertaken and some preliminary results have already published such as [Arioua et al., 2014a] in which the authors introduced a preliminary approach to explain why a result was delivered, and [Arioua et al., 2014b] in which the authors proposed a dialogical approach to explain why a given conclusion was not delivered by the argumentation process.

Another line to develop consists of studying the bipolarity in our con-text of argumentation, since extensions can be formed to support/oppose decisions. Therefore a bipolar reasoning process could be considered as a refinement of the introduced argument-based reasoning process, especially when a single choice is accepted by some viewpoints and rejected by others.

Figure 1 :

 1 Figure 1: Global insight of the DSS.

Figure 3 :

 3 Figure 3: Examples of extensions under different Dung semantics.

  ASPIC argumentation system defining the strict rule a, b → c and the alternative choices a, b. The knowledge base is K = {a, b, c}. The set of strict rules (closed under transposition) is R s = {a, b → c; ¬c, b → ¬a; a, ¬c → ¬b}.

Example 4 .

 4 Let us consider the arguments built in Example 3. Argument A 2 rebuts argument B 2 since Conc(B 2 ) = ACC and Conc(A 2 ) = ¬ACC and B 2 : B 1 ⇒ ACC, which means that ACC stems from a defeasible rule, therefore it is less strong than A 2 and B 2 cannot attack A 2 . Then, A 2 defeats B 2 . Extension output. The output of an extension E is defined as the union of the conclusion of its arguments: Output(E) = Concs(E) = {Conc(A), A ∈ E}, where Conc(A) is the conclusion of argument A. Example 5. Let us consider again the arguments built in Example 3.

  BioCap DSS. A java GXT/GWT web interface was developed and an open version is accessible on http://pfl.grignon.inra.fr/EcoBioCapProduction/. A short demonstration video is available for download 2 . Hereinafter, some user interfaces are displayed showing the obtained result in the case of the viewpoint "end of life".The main interface of the system is illustrated in Figure4. It is divided into 5 zones. Zone 1 corresponds to the task bar implementing general functions applied on projects(create, load, close, refresh, export, etc.). Zone 2 lists the text arguments by stakeholders. Zone 3 displays the extracted concepts and rules from the text arguments, they are also listed by stakeholders.Zone 4 displays the graphical representation of the formalized concepts and arguments. Zone 5 is a notification area displaying the computed conflicts and extensions.

Figure 4 :

 4 Figure 4: The main interface of the argumentation system.

Figure 5 :

 5 Figure 5: Adding a concept based on a defined attribute in the packaging database.

Figure 6 :

 6 Figure 6: Adding a concept which is not related to the database.

Figure 7 :Figure 8 :

 78 Figure 7: Adding a concept not supported yet in the packaging database but suggested for addition.

Figure 10 :

 10 Figure 10: Conflicts computed in the viewpoint end of life.

Figure 13 :

 13 Figure 13: Selecting preferences associated with the end of life viewpoint to complete the query with Biodegradable = T rue. (File 31 corresponds to Extension 1 in Figure 12).

Figure 14

 14 Figure 14 finally displays the final result after execution of the multicriteria querying which takes into account the consensual preferences about the biodegradability attribute. Four packagings are ranked according to their relevance to the query preferences.

  25the number of logical arguments, number of conflicts, number of preferred extensions 4 returned and the skeptical output of the argumentation system.The skeptical output contains the consensual options (displayed in bold font) which are supported by arguments present in any extension, in addition to other concepts corresponding to reasons why these options are delivered.In the case of Hungary, the argumentation tool returns two preferred extensions and two skeptically accepted choices, namely: Biodegradable and N ot Recyclable packaging. The argumentation tool recommends biodegradable packaging because they have a positive image regarding the protection of the environment, which increases their marketing attractiveness. The recyclable packaging are discarded cause of the extra taxes imposed by the local authorities.

  . Packaging materials with low environmental impact are preferred, low environmental impact corresponds to carbon footprint of value[0, 10]

	10. Mono-layered byproduct made packagings are easier to produce,
	11. Consumers do not want to pay an extra cost greater than 5% for a
	product packed with biodegradable or compostable packaging,
	12. According to the waste management agency, recycling can create new
	job opportunities.
	kg CO 2 ,
	2. Waste management authority aims at collecting at least 75 % of recy-
	clable packaging,
	3. Consumers are unwilling to sort packaging cause of its extra tax,
	4. Life Cycle Analysis (LCA) results are not in favor of biodegradable and
	compostable materials,
	5. Consumers are in favor of biodegradable material because they help to
	protect the environment,
	6. Biodegradable materials could encourage people to throw their pack-
	aging in nature, causing visual pollution,
	7. Micro-perforated packaging can increase the shelf life by about 20 days,
	8. Multilayered byproduct made packagings allow a good permeance,
	9. Multilayered byproduct made packagings are generally expensive to
	produce,

Table 2

 2 summarizes the results obtained for each country in terms of

Table 1 :

 1 Options discussed within the arguments collected for each country.

	Country	Options discussed for end of life viewpoint	Number of text arguments
		Biodegradable Packaging
	Hungary	Compostable Packaging	9
		Recyclable Packaging
		Biodegradable Packaging
	Italy	Compostable Packaging	8
		Recyclable Packaging
		Biodegradable Packaging
		Compostable Packaging
	Sweden	Incinerated Packaging	13
		Landfill Packaging
		Recyclable Packaging
		Biodegradable Packaging
		Burying Packaging
	France	Compostable Packaging MultiLayered Recyclable Packaging
		Recyclable Packaging
		Other (Incinerated) Packaging

Table 2 :

 2 Obtained results for each country.

	Country	Number of logical argu-ments	Number of Con-flicts	Number sions of preferred exten-	Number of skeptical outputs
					Biodegradable Packaging
					Not Recyclable Packaging
	Hungary	50	316	2	Marketing Attractive Packaging
					Not HighTaxes
					Protect Env Packaging
					Biodegradable Packaging
	Italy	54	409	2	Not Recyclable Packaging Not HighTaxes,
					Protect Env. Packaging
					Biodegradable Packaging
					Incinerated Packaging
	Sweden	146	2445	2	Not Landfill Packaging Energy Recovery Packaging
					Gas Production Packaging
					Protect Env. Packaging
					Not MultiLayered
					Recyclable Packaging
					OtherPack (incinerated)
					BonusTax Packaging
					Energy Production Packaging
					High Env. Impact Packaging
	France	117	4408	2	HighTreatmentCost
					Low Env. Impact Packaging
					Not MalusTax
					Not NoChain
					Not Recycling Disturb sorting
					Not Visual Pollution
					Partially Recycled Packaging

We recall that the output of an extension is the set of its argument conclusion.

http://umr-iate.cirad.fr/FichiersComplementaires/DemoRomeHD.mp4

https://github.com/jtdevereux/javaDungAF

We computed for each country the extensions under diverse semantics (admissible, preferred, stable, semi-stable, ground, etc.), but we limit our analysis to the preferred semantics since it delivers the largest sets of non-conflicting arguments that defend themselves against attacks.

The original argument graph contains 289 logical arguments and 27113 conflicts.

www.debategraph.org

http://ova.computing.dundee.ac.uk/ova-gen/

https://code.google.com/p/pyafl/

Acknowledgements

The research leading to these results has received funding from the European Community's Seventh Framework Program (FP7/ 2007-2013) under the grant agreement n o FP7-265669-EcoBioCAP project.

Visual pollution of packaging could not be the worst effect. Knowledge on the toxicity impact of micro and nanoparticles of partially degraded plastic is needed (potentially negative impact on health if high concentration of nanoparticles).

Researcher

The use of PLA leads to a penalty on eco-tax Eco-Packaging.

Researcher

The bio-polyesters (compostable) as PLA are disturbing of PET recycling (non-organic polyester).

Waste Management

In France, numerous waste management facilities are available (incineration, burying, composting organic waste, methane production or Anaerobic digestion) which encourages biodegradable materials.

Waste Management

In France, numerous waste management facilities are available (incineration, burying, composting organic waste, methane production or Anaerobic digestion) which encourages compostable materials.

Waste Management

Biodegradable materials may disturb the sorting of recyclable packagings. For example PLA material disturbs the PET recycling.

Waste Management

Compostable materials may disturb the sorting of recyclable packagings. For example PLA material disturbs the PET recycling.

Waste Management

In France, burying is encouraged (low cost around 80 euros per ton).

Waste Management

In France, Composting is not encouraged (high treatment cost around 130 euros per ton). Waste Management Incineration (other pack) permits to produce energy.


An integrated framework for business continuity management of critical infrastructures

Jinduo Xing,

INTRODUCTION

Critical infrastructures are exposed to various types of hazards, which could occur individually or concurrently. The consequent failures of CIs could generate serious damage (fatality, injury, environmental pollution, business interruption and company reputation loss). In this scenario, BCM (business continuity management) is crucial to provide confidence that the outputs of processes and operations can be delivered reliably through the CIs in the face of risks [START_REF] Gibb | A framework for business continuity management[END_REF]Buchanan 2006, Zio 2016). The international organization for standards gives a definition of BCM as "Holistic management process that identifies the potential threats to an organization and the impacts to business operations by those threats, if realized, might cause, which provides a framework for building organizational resilience with the capability of an effective response that safeguards the interests of its key stake-holders, reputation, brand and value-creating activities." (ISO 2012). Through identification and management of the risks leading to potential damage to business profit, one could improve the resilience of business activities. Several studies have proposed different methods for BCM. Rabbani et al. adopted the cost-benefit analysis for evaluating BCM strategies [START_REF] Rabbani | Developing a two-step fuzzy cost-benefit analysis for strategies to continuity management and disaster recovery[END_REF]. Satorabi et al. determined the maximum tolerable period of disruption for a minimum business continuity objective, within a framework for business impact analysis [START_REF] Torabi | A new framework for business impact analysis in business continuity management (with a case study)[END_REF]. Bhamra et al. presented the relationship between business continuity and system resilience, and pointed out that those organizations that adopt BCM can have a higher level of resilience [START_REF] Bhamra | Resilience: the concept, a literature review and future directions[END_REF]. Sahebjamnia et al. integrated BCM and disaster recovery planning to present a proactive approach for resilience of organization [START_REF] Sahebjamnia | Integrated business continuity and disaster recovery planning: Towards organizational resilience[END_REF]. A crucial part of

An integrated framework for business continuity management of critical infrastructures Jinduo Xing

Chair on Systems Science and the Energetic Challenge, Fondation EDF, Centrale-Supelec, Universite Pairs-Saclay, France

Enrico Zio

Chair on Systems Science and the Energetic Challenge, Fondation EDF, Centrale-Supelec, Universite Pairs-Saclay, France; Energy Department, Politecnico di Milano, Milano, Italy ABSTRACT: Business continuity of critical infrastructures (CIs) is exposed to various hazards including random failures, malicious threats, natural disasters and human errors, which could generate accidents with serious consequences (fatality, injury, environmental damage, business interruption and company reputation loss). We conceptualize the business continuity management (BCM) process as the integration of four active stages: prevention, mitigation, emergency and recovery. Integrated assessment and management is needed on all stages. On the contrary, the current approaches of BCM have not considered all phases in an integrated manner. We propose a new framework, which stands on an extension of the Bow-Tie model, to efficiently and effectively prevent and mitigate the potential consequences of an accident by properly designing and strengthening safety barriers for preventing and mitigating accidents, and making safety decisions for emergency and recovery. The proposed framework allows considering safety barriers and decisions in an integrated way. For operationalization, we explore the use of two complementary quantitative methods, Bayesian Network (BN) and Constraint Goal Method. BN takes the "negative" viewpoint of failure to determine the causes which lead to the final damage. CGM employs the positive perspective of the goal achievement process. An oil pipeline system is considered to show the application of the proposed approaches.

BCM is business impact analysis, to determine the latent probability and consequence of the events and the dependence between previous factors and subsequent events.

These previous studies on BCM have pointed out the benefit for crisis and recovery management. The hazards need to be considered over the whole business process. To this purpose, the business process can be divided into four phases along the event evolution process, as shown in Fig 1 . Firstly, when the hazard attacks the targeted system, it could cross the preventive barriers (black rectangle) and affect the business of the system (S1). When the accident enters the crisis stage (S2), the mitigative barriers (gray rectangle) and the emergency decisions taken to control the accident, shape the resistance of the system in minimizing the damage. Then, external resources would be called upon to rescue the system, reducing the damage. During the emergency stage, additional emergency barriers (dark rectangle) and decisions of action shape the evolution of the accident. Eventually, a last step of recovery is undertaken to regain the site safety and reconstruct business, as soon as possible. The overall business loss and consequences depend on the preset barriers and decisions taken at the various stages of accident evolution. The study reported in the present work aims at providing an integrated framework for BCM. We consider the Bayesian Network (BN) and Constraint Goal Method for a comprehensive analysis. The main contributions are:

(1) Conceptualization of the BCM of CIs.

(2) Presentation of an integrated framework for BCM of CIs, by an extended Bow-Tie diagram.

(3) Applying BN and CGM for BCM.

PROPOSED FRAMEWORK

Analysis framework

Risk management of CIs typically includes accident occurrence prevention and consequence mitigation. Emergency and recovery are usually considered outside this parameter, or at least separated. On the contrary, an integrated framework of risk analysis and management seems in order. For example, in the Huangdao petroleum transportation pipeline explosion accident of 2013, the reason for the accident escalation was a misoperation in the emergency phase, causing the explosion of the volatile gas. In 2015 Tianjin Port accident in China, 99 firefighters and 11 policemen died (among 165 casualties) during emergency operations.

The proposed integrated framework of BCM consists of four stages of a risk management process. The interface and dependence between different stages needs to be analyzed, for effective management decisions.

For business continuity throughout the different stages of risk management, the different safety barriers play an important role. Accident prevention involves technical aspects and organization decisions, concerning passive barriers, active barriers, human factors, etc. [START_REF] Dianous | ARAMIS project: a more explicit demonstration of risk control through the use of bowtie diagrams and the evaluation of safety barrier performance[END_REF]. Once the hazard affects the system, an emergency situation arises, for which mitigation of consequences is the important aspect. Also for this, there exist passive or active barriers, detection and diagnosis instruments, and human actions. Then, when in the emergency stage, appropriate decisions and safety actions must be taken to safeguard the emergency activities. The principle is to control the hazardous consequences of the accident, for eliminating the site danger and provide suitable, safe recovery conditions of the system. Eventually, recovery starts.

Extended Bow-Tie model for BCM framework

Bow-Tie is a traditional method to model an accident process, coupling a fault tree and an event tree representation [START_REF] Chevreau | Organizing learning processes on risks by using the bow-tie representation[END_REF]). The use of Bow-Tie is common in many areas of risk management, hazard analysis, accident scenario analysis [START_REF] Khakzad | Safety analysis in process facilities: Comparison of fault tree and Bayesian network approaches[END_REF]. Bow-Tie is capable of representing the logic relationships between the causes, intermediate events, possible consequences and safety barriers involved in an accident progression. Typically, the representation ends at the accident consequence, without considering emergency and recovery. Also, in traditional Bow-Tie the causes and consequences are assumed independent, which does not reflect the reality in some practical situations. We develop a Bow-Tie for the integrated framework of BCM, as illustrated in Fig 2. In stage S1, the hazards affect the system operation by generating business disturbance, which becomes a hazardous event if the disturbance goes through the safety barriers. As the accident progresses, it comes to the crisis stage, where consequences (e.g. materials waste, explosion, injuries, fatalities) are experienced to an extent which depends on the effectiveness of the mitigation barriers. Emergency decisions and actions are needed to prevent the accident to expand. Finally, decisions and actions are required to guide the recovery of the business to normal situation.

OPERATIONALIZATION OF THE INTEGRAT-ED FRAMEWORK

To make sound application of the framework in practice, we consider the integration of quantitative methods, like CGM and BN. The former models the goal achievement process (a positive viewpoint), the latter models the failure logic to determine the causes of final damage (a negative perspective).

Bayesian network in BCM.

Bayesian network is a directed acyclic graphical representation method, where the nodes are random variables and dependencies are represented by the directed arcs between the nodes [START_REF] Khakzad | Risk management of domino effects considering dynamic consequence analysis[END_REF]. Conditional probabilities are assigned to reflect the strength of dependencies. The root nodes are allocated marginal probabilities [START_REF] Khakzad | Application of dynamic Bayesian network to risk analysis of domino effects in chemical infrastructures[END_REF]. By applying the chain rule and the d-separation criteria [START_REF] Khakzad | Risk management of domino effects considering dynamic consequence analysis[END_REF], the joint probabilities of the parent node events are given from those of their children nodes:

1 2 n i i 1 (X) P(X , X , , X ) (X (X )) n i P P Pa    (1)
where Pa (X i ) is the parent set of X i . P(X) is the joint probability of its variables X={X 1 , X 2 , …X n }. Bayes' theorem is used to update the probability (1), when are new evidences E:

( ) P( ) () ( ) P( ) X P X E X P X E P X E X   (2)
where (X ) PE is the posterior joint probability updat- ed based on the new evidence E. We propose to use BN to represent the process of business impact analysis for BCM. By using BN, we can determine the probabilities of potential consequences and the importance for business continuity. Eventually, the probability updating of BN can improve BCM by adding evidences (measures) to control the critical factors during the different stages of the accident propagation.

Constrained goal modeling

CGM (http://www.cgm-tool.eu/) is used for requirement analysis in the computer science domain. The method aims to explain the requirement of stakeholders, and provide alternative designs for decision makers [START_REF] Asnar | Goal-driven risk assessment in requirements engineering[END_REF]. The CGM starts from the interests of the stakeholders and structures the process of goal achievement. The constrained goal model can be used to perform two types of analysis: (1) Given a CGM and assuming that certain leaf goals are fulfilled, one can infer the probability of the root goal; (2) given a CGM find a set of leaf goals that fulfill the root goal. To establish the CGM, the requirements of the stakeholders, resources, actions, tasks and data are needed. The probability P(G) of the goal G of CGM is:

1 (G) ( ) n ii i P R P T    (3)
where R i is the influence weight of the sub-goal (task) for the achievement of the goal in the upper layer, P(T i ) is the probability of task T i . This work shows how to support the BCM through a goal achieving process structured by CGM for identifying critical aspects and actions.

CASE STUDY

The purpose of the case study is to illustrate the application of the framework described in section 2. The steps for the development of the integrated BCM framework are:

(1) Identify the BCM stages.

(2) Identify the potential business-impacting factors in the different stages.

(3) Determine the relationships between these factors. (4) Calculate the business impact probabilities.

(5) Evaluate the importance index of every factor. (6) Propose measures to reduce the probability of these critical factors.

Case description

On the morning of November 22, 2013, a severe oil pipeline accident occurred in Qingdao city, Shandong Province, P.R. China. Dong-Huang pipeline has been operating for 27 years. A leakage of explosive oil was discovered at 2:12 am and exploded at 10:25 am, China standard time (CST). The accident caused 62 fatalities, 132 injuries and a direct economic loss of 751.72 million RMB, including 2000 tons crude oil (Accident Investigation Team 2014). Liu et al described the propagation mechanism of the accident [START_REF] Liu | Risk propagation mechanism: Qingdao Crude Oil Leaking and Explosion case study[END_REF]. The accident evolution is illustrated in Fig 4.

The direct cause of the leakage is the combination of transmission pipeline and drainage system corro-sion and rupture. The spill entered into the drainage system and rushed to the pavement. During the emergency phase, the emergency personnel employed hydraulic hammers to punch, which unfortunately generated strike sparks. Consequently, the oil and gas in the drainage system was ignited and exploded.

In the whole process of accident propagation, there were various factors that contributed to the final outcome. The dependency relationship among them is presented in the following.

Case analysis

Based on the proposed framework of BCM, the whole accident analysis process can be divided into four stages. First comes the preventive stage, which must consider the possible hazards that may occur and the related influencing factors.

Corrosive environment and medium cause the pipeline becoming thinner. With high pressure and vibration, the corrosion situation becomes worse. Afterwards, the municipal city changed the road path, which resulted in the open drainage becoming covered drainage: during operation, there was then less checking and maintenance, which led to the final leakage. Inadequate supervision from related departments accelerated the progression of the leakage.

After the operator received the alarm signal, the emergency action started. Because of little emergency training and risk assessment ability, misoperation occurred. At the same time, wrong emergency decisions, where taken, with respect to no evacuation and safe guarding. Consequently, the accident generated severe fatality and injury consequences, environment pollution and economic loss. At the recovery stage, there still existed many threats including the spilled oil and fire, the offshore pipeline nearby, the chemical factory close-by and the polluted Jiaozhou bay of the Yellow Sea, North-West Pacific Ocean.

Note that this accident shows no distinction between the prevention and mitigation barriers. The inherent safety design is the first safety barrier. Periodical safety training is also included in the first safety barrier. Besides, safety decisions after disruption are included inside the barriers of the mitigation stage. Emergency training, knowledge of the site and risk assessment expertise are barriers for the emergency stage.

Bayesian network for pipeline BCM

The hazards and the safety barriers, and potential consequences need to be determined first. Based on literature review (OREDA participants 2002) and profes- sional knowledge, the prior probabilities of the basic events are found (Table 1). A BN model for the accident was developed, covering the whole process of the BCM, as presented in Fig 5. 2. To analyze the contribution of each event to the final consequence of the accident progression, the improvement index was applied [START_REF] Faisal | Risk-based process safety assessment and control measures design for offshore process facilities[END_REF], which indicates the contribution of the event. The importance index is:

ui PP I P   ( 4
)
where P is the probability of final event, in this case P equals to 0.0221, P ui is the updating probability of final event under the condition of ith event does not occur. The higher the improvement index is, the more critical is the event for the consequence. Table 3 shows that the emergency error is the most important factor leading to the final accident. . Fig 6 shows that the emergency and safety training help reducing the accident consequences. The posterior probability for casualty and injury is 0.0086 against the prior where of 0.0221. This shows that using BN in business impact analysis helps to allocate safety barriers. 4. The goal is keeping the pipeline continuity operation, which can be divided into three sub-goals. The first one is reasonable pipeline design and covers the reasonable planning and suitable materials. Next is safety construction for pipeline, which includes two tasks based on regulations and safety supervision during the construction process. The last one is safety production (operation), which could be attained by five actions corrosion resistant, obeying the regulations, periodic maintenance, effective emergency, and preventing third party damage. The influence weight of the sub-layers to the achievement of the upper layer is given in Table 5. With the probability of each task given in section 3.2, the gradual goal achieved probability is, where i G means that the goal i has not occurred. The complement probability of system failure probability is 0.0560. Compared with the BN result, the accident evolution process is more visual. CGM gives the propagation weight of each sub-goal or task to the upper layer. However, such propagation weight depends on expert judgement, with inherent subjectivity.

Fig 1 .

 1 Fig 1.Systems performance evolution during the accident progression

Fig 2

 2 Fig 2 Extended Bow-Tie for the integrated framework of BCM

  Fig 3 presents the basic structure of CGM for BCM.

Fig 3

 3 Fig 3 The basic structure of CGM. The round square represents different goal of the system; hexagon is the task or measure taken in the process. General goal means the overall goal of the system. Sub-goals are the different goals during the whole process. Task is the action in the process)

Fig 4

 4 Fig 4 Timeline for Dong-Huang pipeline explosion accident

Fig 5

 5 Fig 5 BN for the pipeline accident case

Fig 6

 6 Fig 6 Probability updating for the top event of BN for the pipeline accident case

Table 1

 1 Prior probabilities of basic events for pipeline accident

	Number Event	Symbol	Failure probability
	1	No protection measures	N-prote	0.0749
	2	Pipeline corrosion	Corrosion	─
	3	Incomplete safety inspection Is-ins	0.2506
	4	Yet to repair	Yet-t	0.1345
	5	Pipeline leakage	Leakage	─
	6	Pipeline traverse	Traverse	0.2050
	7	Combustible gas	Combu_gas	─
	8	Emergency error	Emerg-error	0.3466
	9	Combustible gas detection	Combu_det	0.2696
	10	Fire and explosion	Fire_explosion	─
	11	Weak safety awareness	W-sa	0.2132
	12	Lack supervision	L-superv	0.1024
	13	No emergency evacuation	N-ee	0.1365
	14	Bearing and vibration	B-v	0.0902
	15	No cordon off	N-co	0.1075
	16	Detector failure	detectf	0.1915
	17	Casualty and injury	Casualty-inj	─

Table 2

 2 Prior probabilities of intermediate and top events for the

	pipeline accident
	Occurring event	Probability
	Pipeline corrosion	0.1583
	Pipeline leakage	0.0556
	Combustible gas	0.0114
	Fire and explosion	0.0896
	Casualty and injury	0.0221

Table 3

 3 Consequence probability and improvement indices from BN analysis Then, to improve business continuity, measures could be taken to reduce the probability of emergency error. For this, emergency training and safety training can be developed. The probability updating of the final accident is shown in Fig 6, with two new evidences (no emergency drilling with probability 0.0765, no emergency training with probability 0.0625) added.

	Event not occurring	Probability	Improvement index (%)
	Casualty and injury	0.0221	0.0
	No protection measure	0.0218	1.3567
	Bearing and vibration	0.0218	1.3567
	Incomplete safety inspection 0.0217	1.81
	Yet to repair	0.0219	0.09
	Pipeline traverse	0.0215	2.715
	Detector failure	0.0206	6.7
	Emergency error	0.0005	97
	No cordon off	0.0139	37
	No emergency evacuation	0.0114	48.41
	Lack supervision	0.0205	7.24
	Weak safety awareness	0.0205	7.24

Table 4

 4 The node name and the acronym

	Node name		Acronym	Node name	Acronym
	Pipeline continuity	G1-PCO	Effective	T7-EE
	operation			emergency
	Reasonable	pipe
	design

Table 5

 5 The CGM for the pipeline accident

		The value of each influence weight
	R	Value R	Value	R	Value	R	Value
	R1 0.24	R5	0.35	R9	0.09	R13 0.75
	R2 0.40	R6	0.50	R10 0.13	R14 0.05
	R3 0.36	R7	0.50	R11 0.08	R15 0.50
	R4 0.65	R8	0.65	R12 0.25	R16 0.50

http://www.hugin.com

DISCUSSION AND CONCLUSION

In this article, we have proposed an integrated framework for business continuity management based on an extended Bow-Tie model of the four stages, prevention, mitigation, emergency and recovery. We have illustrated the proposed framework for the accident analysis of a severe oil and gas pipeline accident in 2013. BN and CGM have been used to quantitatively analyze the accident. Through the analysis process, the critical activities and factors have been identified.