Thibault Catry
email: thibault.catry@ird.fr

Zhichao Li
email: zhichao.li@teledetection.fr

Emmanuel Roux
email: emmanuel.roux@ird.fr

Vincent Herbreteau
email: vincent.herbreteau@ird.fr

Christophe Révillion
email: christophe.revillion@ird.fr

Nadine Dessay
email: nadine.dessay@ird.fr

FUSION OF SAR AND OPTICAL IMAGERY FOR STUDYING THE ECO-EPIDEMIOLOGY OF VECTOR-BORNE DISEASES IN TROPICAL COUNTRIES

Vector-borne diseases like malaria represent a major public health issue worldwide. Other mosquito-borne diseases affect more and more countries and people, with effects on health which are not all identified yet. Recent developments in the field of remote-sensing allow to consider overriding the existing limits of studying such diseases in tropical regions, where cloud and vegetation cover often prevent to identify and characterize environmental features. We highlight the potential of SAR-optical fusion for the mapping of land cover, the identification of wetlands, and the monitoring of environmental changes in different habitats related to vector-borne diseases in the French Guiana -Brazil cross-border area. This study is the foundation of a landscape-based model of malaria transmission risk. Environmental factors, together with epidemiological, socio-economic, behavioral, demographics, and entomological ones, contribute to assess risks related to such pathologies and support disease control and decision-making by local public health actors.

VECTOR-BORNE DISEASES

Malaria has declined by 37% between 2000 and 2015, nearly half of the world's population remains at risk (about 3.2 billion people, [START_REF]World Malaria Report 2015[END_REF], Fig. 1). Other emerging mosquito-borne diseases (e.g. dengue, chikungunya, Zika) affect more and more countries and people, with lasting effects on health which are not all identified yet. Various possible causes of rapid spreading of dengue and Zika epidemics have been identified: climate change, demographic growth, urban growth, urban fragmentation, ecological changes, increase in travels and international trade, disturbances in health systems and vector control efficiency, land cover/use changes... It is also known that natural and human-made ecosystem changes, such as climatic perturbation and land use and land cover (LULC) changes, can affect significantly the distribution of malaria by making disease vector (anopheles darlingi mosquito) habitats more or less suitable [START_REF] Stefani | Land cover, land use and malaria in the Amazon: a systematic literature review of studies using remotely sensed data[END_REF][START_REF] Li | Mapping a Knowledge-Based Malaria Hazard Index Related to Landscape Using Remote Sensing: Application to the Cross-Border Area between French Guiana and Brazil[END_REF]. Hence, the prevention and control of vector borne diseases requires to identify, characterize and monitor these environmental factors, their changes and their impacts on the emergence of diseases. In this context, using remote sensing appears to be a pertinent tool that can characterize almost completely and continuously the environment related to vector-borne diseases transmission.

VECTOR-BORNE DISEASES AND REMOTE-SENSING

There has been a growing use of remote sensing data in epidemiology in the last 30 years [START_REF] Herbreteau | Thirty years of use and improvement of remote sensing, applied to epidemiology: from early promises to lasting frustration[END_REF][START_REF] Stefani | Land cover, land use and malaria in the Amazon: a systematic literature review of studies using remotely sensed data[END_REF], but some limitations usually occur, like (1) the price of very highresolution data, (2) the general use of pre-processed data, (3) some technical limitations and (4) the fact that vector-borne diseases are strongly scale-dependent. In tropical regions persistent cloud cover and dense vegetation cover strongly affect the use of remotelysensed data for environmental purposes. The adaptability of remote-sensing data is then limited when addressing epidemiology. Stefani et al. [START_REF] Stefani | Land cover, land use and malaria in the Amazon: a systematic literature review of studies using remotely sensed data[END_REF] did a systematic review of literature studying the relationship between malaria and land cover/use types in the Amazon (Fig. 2). -How to describe social discrepancies and their influence?

-How to characterize the dynamics of multiscale processes?

-How to provide real-time information, for monitoring and surveillance systems?

-How to facilitate the transfer of data and products towards the research community, actors of health services and the public?

CASE STUDY

Context

The Franco-Brazilian cross-border region considered here is composed by the French municipalities of Camopi, Saint-Georges-de-l'Oyapock and Ouanary, which are located on the western bank of the Oyapock River, and the Brazilian municipality of Oiapoque on the eastern bank of the river (Fig. 3). The human habitats in this study area mainly locate in Saint-Georges (FR), Oiapoque (BR) and the villages of Camopi (FR) (see the red rectangles in Fig. 3). In the Americas, the Amazonian region is the most affected by malaria. Movement of malaria across international borders poses a major obstacle for malaria elimination due to various human activities, population movement, human vulnerability due to limited formal education and few financial resources, inadequate health systems, etc. [START_REF] Wangdi | Cross-border Malaria: A Major Obstacle for Malaria Elimination[END_REF].

Methodology

Overall methodology In this study, we follow a four step approach (fig. 4) which is part of a more general landscape-related malaria hazard model. This model is based on the exploitation of an optical image (like SPOT 5) in order to establish a simple forest/non forest land cover classification. This classification then integrates information regarding wetlands distribution extracted from a SAR image (L-band SAR like PALSAR) and a layer of urban classification derived from very high resolution sensors (optical alone or optical and SAR combined together). These land cover classes are then confronted to epidemiology and entomology data in order to calculate spatialized landscape indicators used to create malaria hazard/risks maps to be delivered to local authorities and public health actors.

Images characteristics and treatments

One SPOT 5 image was acquired at 1A level in which radiometric calibration and orthorectification have been successively performed by using the ENVI 5.1. For the PALSAR image acquired at level 1.5 in which radiometric calibration, geometrical correction and speckle filtering (Lee filter 3*3) have already been performed by Japanese Space Agency (JAXA).

Several spectral indices were calculated from the pretreated SPOT 5 MS image. A decision tree-based classification was then carried out for mapping the various LULC types using ENVI 5.1 (Fig. 5). The resulting classification was post-processed using the majority analysis (kernel size 3*3) for removing the isolated pixels. Finally, we evaluated the classification by randomly choosing 20 sites in each class and establishing the actual land cover of these sites by photo-interpretations of one Pleiades image dated September 30, 2012 with a 50-centimeter spatial resolution.

A textural analysis (GLCM under Sentinel tool box) was performed and a simple thresholding method on the variance of PALSAR signal and a colored composition (Red = VH, Green = VV, Blue = VH/VV) was then used for extracting bare soil, flooded forest, forest, free water and swamps (fig. 6).

A multi-sensor approach

Optical data

Figure 7 shows the resulting SPOT 5 classification. The overall accuracy was found to be 0.90 and the kappa coefficient was 0.84. Comparing with the SPOT 5 classification, this method allowed us to characterize free water, flooded forest and swamps (Fig. 8) using an archive 2010 image. Moreover, it is important to remind that we used free archive PALSAR imagery in order to test the contribution of L-band SAR data to the identification of malaria environmental features, before considering the acquisition of expensive new L-band data.

The validation of PALSAR classification is complicated but some insights could be obtained from 2010 archive optical imagery if the cloud cover is not too dense. Recent field surveys during the similar period (similar season) can also be used for the validation since the identified wetlands are not strongly changed with time.

L-band SAR (here 12.5 m resolution PALSAR data) is an efficient tool for the detection of large wetlands, which can define main resting, and breeding sites of malaria vectors.

A multi-resolution approach

High spatial resolution data (SPOT 5, S2, S1, PALSAR) are used to characterize areas covered by various types of forest, where adult mosquitoes rest and feed. This part of the study focuses on the relationship between the environment and the vectors of the disease, i.e. the "hazard" component of the malaria transmission risk. Very high spatial resolution data (SPOT 7, Pleiades, TerraSAR-X) will be used to characterize urban and peri-urban structures and domestic wetlands, where breeding sites for mosquitoes are frequent. This part will focus on the relationship between the environment and human populations, i.e. the "vulnerability" component of the malaria transmission risk.

A multi-temporal approach: S1 and S2

The repetitivity of Sentinel data (up to 5 days) will allow the production of land cover maps on a weekly basis, from free satellite imagery. Combining S1 and S2 products, the monitoring of urban and peri-urban changes, at the interface with forest areas and wetlands, main « mosquito reservoirs » and sources of epidemic risk, is to be made possible. These data should be used to update a preexisting map of urban and peri-urban areas, established from a sensor like SPOT 5 (similar resolutions in space). The combination of SAR S1 and optical S2 data should be efficient tool to overcome disturbances from persistent cloud cover over the studied area. Finally, Sentinel images are to be combined to meteorological data (from satellite or ground station) to better constrained the role of rainfall in the evolution of wetlands in the area.

FUSION OF OPTICAL AND SAR data

On the basis of remotely-sensed and field data, the fusion of layers containing spatialized information extracted from optical and SAR images from various sensors and at various resolutions will favour the production of indicators and maps to support decisionmaking processes by public health actors (fig. 9) Figure 9: Process of fusion of various remotely-sensed data at the decision-level (from [START_REF] Pohl | Review article multisensor image fusion in remote sensing: concepts, methods and applications[END_REF]).

DEFINITION OF LANDSCAPE INDICATORS

In this study, we use a model previously established by Stefani et al. ([2], Fig. 10). This paper proposed a generic model of the relationship between deforestation and malaria transmission risk emerges from the literature. It considers that: i) deforested areas can procure favourable conditions for An. darlingi breeding, ii) forest and secondary vegetation can define resting sites for adult An. darlingi mosquitoes that return to the forest after feeding, when houses are located close to the forest and iii) that malaria transmission risk depends on the spatial distribution of LC types and, in particular, the interaction level between human populations and LC/LU types associated with breeding and resting sites. This generic model is schematically represented in Figure 9. This shows the importance of distinguishing different situations by considering the LC/LU types over time in terms of both proportions and spatial distributions.

TOWARDS EPIDEMIC HAZARD MAPS

This study shows that fusion of land cover layers extracted from optical and SAR high-resolution imagery is an efficient tool for detecting large permanent (or long-lasting) wetlands (potential breeding sites) and various forest types (potential resting and feeding sites). Land cover classification of SPOT 5 image suffers two mains flaws: the impossibility to penetrate the forest canopy and disturbance from persistent cloud cover in tropical areas. In particular, L-band SAR has proven its ability to detect the water under forest, a key element for the identification of breeding sites of malaria vectors and malaria vector control. Until now, only free archive SAR data were used in order to test the methodology but the acquisition of PALSAR 2 data is planned. Its main advantage is the possibility to access very high spatial resolution. Combining very high resolution optical (SPOT 6-7 / Pleiades) together with the very high resolution SAR permit characterize the urban structures and minor sizes, non-permanent water bodies such as domestic wetlands within the urban areas, at the direct contact with vulnerable populations.

These results of land cover classification fusion from optical and SAR data are the basis of a landscapebased model of malaria transmission risk (Fig. 11) The layers of forest / vegetation and wetland types, are then combined to a layer of urban classification and 2 fieldbased layers: one regarding the entomology of mosquitoes and the malaria epidemiology in the area. These combined layers allow the calculation of landscape indicators and consequently the creation of malaria transmission risk map integration vector-related environmental information (hazard estimation) and human related environmental factors (vulnerability assessment).

CONCLUSION

This study provides a method of identification of environmental features associated with malaria vector resting and breeding sites. Optical and SAR remote sensing have been proved to be complementary for this purpose. This method provides the complete LULC information about malaria transmission, which may be automatically and easily reproduced at temporal scale using a time series of images. The fusion of layers containing spatialized information extracted from optical and SAR data from various sensors and at various resolutions aims at producing indicators and malaria transmission hazard/risk maps to support decision--making processes by local institutions /authorities and public health actors.

Data processing methodologies developed in this study will be automated and made available to the science community and the actors of public health. All products (land cover maps, hazard maps) will be made available on a preexisting platform. These results contribute to Theia CES "health and environment" and "land cover".

Figure 1 :

 1 Figure 1: Malaria incidence rates by countries from 2000 to 206, WHO, 2015.

Figure 2 :

 2 Figure 2: Relationship between malaria and land cover/use types in the amazon [2].. Black = positive correlation, grey = no correlation, white = unknown. Using remote-sensing for studying vector-borne diseases however implies some challenges -How to quantify the role of environmental factors on the transmission of such diseases compared to other factors like sociodemographic and behavioral factors?

Figure 3 :

 3 Figure 3: Map of cross-border region between FrenchGuiana and Brazil.

Figure 4 :

 4 Figure 4: 4 steps methodology developed in this study, in the frame of a landscape-related malaria hazard model.

Figure 5 :

 5 Figure 5: Classification decision tree applied to optical imagery. Decision tree nodes are in grey.

Figure 6 :

 6 Figure 6: Summarized method of optical-SAR classification fusion for mapping the malaria environmental features. Combining the information from SPOT 5 and PALSAR data using the knowledge-based decision rules: 1) If a pixel belongs to PALSAR free water or SPOT 5 free water, then the pixel is labelled as free water; 2) If a pixel belongs to PALSAR bare soil or SPOT 5 bare soil/built-up/road, then the pixel is labelled as bare soil/built-up/road; 3) If a pixel belongs to one of PALSAR wetlands classes and SPOT 5 vegetation class, then the pixel is labelled as wetland.

Figure 7 :

 7 Figure 7: Pixel-based land cover map of SPOT 5 image in the region of Saint-Georges and Oiapoque.

Figure 10 :

 10 Figure 10: Landscape indicators that may increase or decrease malaria transmission risk as a function of time and landscape fragmentation [2].

Figure 11 :

 11 Figure 11: Landscape-based model of malaria transmission risk involving the decision-level fusion of spatialized information layers.

ACKNOWLEDGEMENTS

This research was supported by the TéléPal project (CNES-TOSCA 2014 call), and the China Scholarship Council. We greatfully thank ESA for inviting us at the LPS 2016 in Prague.


Benjamin Justus

Frédéric Cuppens

Nora Cuppens-Boulahia

Julien Bringer

Hervé Chabanne

Olivier Cipiere

Enhance Biometric Database Privacy: Defining Privacy-Preserving Drawer Size Standard for the Setbase

Keywords: database fragmentation, setbase, k-anonymity, l-diversity, biometric privacy

Shamir proposed the setbase approach as a means of improving security and privacy of the traditional biometric system. In this paper, we propose privacy-preserving drawer size standards for the biometric setbase. The proposal incorporates database privacy metrics such as k-anonymity and l-diversity into the definition of privacy-preserving drawer size standard for the biometric setbase. We also empirically evaluate the system reliability of the prototype setbase for the purpose of studying the trade-off values between the level of privacy protection and the level of system security.

Introduction

The setbase approach was proposed by Adi Shamir [START_REF] Shamir | Adding privacy to biometric databases: The setbase approach[END_REF] (see also [START_REF] Didier | Person identification control method and system for implementing same[END_REF]) as a means of improving security and privacy of the traditional biometric system. The traditional biometric database uses a one-to-one data linking between biometric data stored in the biometric database and personal information stored in the identity database. The setbase approach depends on the creation of drawers in which the biometric and personal data are stored. The linking between the identity and the corresponding biometric data takes places at the level of linking identical drawer IDs in the databases. Since each drawer contains multiple records, the identification of an identity is blurred which leads to privacy protection of an individual. With the number of drawers sufficiently large, the probability of an identity theft can be made negligible. Furthermore, the lack of cryptographic mechanisms in a setbase can be seen as another privacy virtue because we do not want to place too much trust in a single entity as for instance the owner of the cryptographic keys.

Given the theoretic interest of Shamir's proposal, there have been hitherto no studies in the literature on how practical shamir's scheme is. Specifically, one would like to know at least in theory:

1. Set of metrics capable of measuring the privacy level of the setbase approach.

2. Value ranges of the important setbase system parameters, such as the number of drawers and possible sizes of a drawer. 3. Impact of the setbase parameters on the level of database privacy.

The importance of choosing the appropriate drawer sizes in a setbase can be seen in the context of preserving privacy of individuals in a biometric database. To make things concrete, we explain the concept using the crime investigation example. In such a scenario, the investigator has gathered some generic information such as the sex, the age group, and the domicile region of a suspect. Furthermore, the investigator based on the biometric data (e.g. fingerprints collected at the crime scene) is able to locate the drawer in which a suspect is located. To identify the person, he must retrieve the identity of a suspect. If the drawer size is small, the investigator would have a little trouble in sieving out entries inside the drawer that satisfy his searching criteria. In the extreme case of a traditional biometric database (one-to-one biometric and identity association), the identity of a suspect would be revealed once a successful bio and identity matching is achieved. The increase of the drawer size would make an investigator's search more difficult. Thus strong privacy in a setbase requires a large drawer size. The downside of a large drawer size is that it would expose the system to a higher chance of drawer ID collision attacks (see section 3). The appropriate choices of the drawer size for a setbase require a judicious way of balancing between privacy and security.

Our Contribution

The starting point of our project is a prototype implementation of the biometric setbase in the context of studying its suitability for the integration with the French national identity cards. There had been many propositions in the French National Assembly advocating the protection of sensitive information such as those contained in the national identity cards [1,5]. The main goal of our project is on the one hand to measure the feasibility of the setbase approach for a real world implementation, and on the other hand to quantify as accurately as possible how much privacy is enhanced by using the setbase approach.

In order to measure the privacy level of the setbase, we had to develop a drawer size standard that depends on a set of well known database privacy metrics. The current paper relies on the concept of k-anonymity and l-diversity as a means of measuring the privacy level of data tables contained in the database. Our study is based on the French population data released from National Institute of Statistics and Economic Studies. The present study shows that the drawer size standard proposed in the paper permits feasible setbase solution for the integration with the traditional biometric database currently in use.

Paper Outline

The paper is organized as follows. The proposed privacy-preserving drawer size formula is presented in section 2. We evaluate the prototype system performance empirically in section 3. Section 4 provides a detailed analysis of the trade-off between security and privacy when deciding the drawer size.

Notation

We use the following notations throughout the paper: N T : the number of drawers that is maintained by the system T T : the size of a drawer that is maintained by the system

Database Tracing Modeling

The aim of this section is to provide some reasonings behind the privacy-preserving drawer size formula:

T T = T ol(k) • E(X) P + N expire (1)
where T ol(k) is a linear function depending on the k-anonymity parameter (see [START_REF] Samarati | Generalizing data to provide anonymity when disclosing information[END_REF][START_REF] Samarati | Protecting respondents' identities in microdata release[END_REF] for the definition). N expire is a fixed number that represents the number of expired entries in the drawer. It is a numerical parameter belonging to the drawers due to the definite expiration date of the biometric data. The value N expire is usually determined by the relevant government policies in the public domains. The random variable X represents the number of sequential searches required before one hits an identity record that satisfies the specified sex, age group, and domicile region criteria. The random variable X assumes a geometric distribution. And the expected value E(X) P is calculated from the default population distributions P s , P a ,P d on the sex, age group, and domicile region attributes inside the biometric identity database. We first introduce the required variables in modeling the identity tracing procedure during the biometric-identity matching procedure. The deduction of (1) takes place in section 2.3.

Database Related and Search Variables

The database related variables and the search variable are discrete random variables. They are summarized in Table 1.

The random variable S represents the sex of an identity. It takes on two values 1 (male), and 2 (female) with the corresponding probabilities {p s 1 , p . This is a French scenario because currently there exists 101 French departments. 4The random variable X represents the number of sequential searches required before one hits a personal record in the identity database that satisfies the specified sex, age group, and domicile region criteria. The search random variable X has a value range from 1 to the size of a drawer T T , and it assumes a discrete geometric distribution.

Anonymity Related Variables

The variables described in this section are related to the quantization of anonymity levels for a specific criterion. To guarantee the k-anonymity requirement for a specific criterion, we require that each specified criterion in the released table has at least k occurrences [START_REF] Samarati | Protecting respondents' identities in microdata release[END_REF]. Table 3 summarizes the variables.

T ol s,a,d : the minimum standard needed for achieving indistinguishability among people who satisfy the respective criterion. In order to achieve k-anonymity, one should have T ol s ≥ 2k, T ol a ≥ 8k, T ol d ≥ 101k. ω i : the weights associated with the variables T ol s , T ol a and T ol d respectively.

They represent the reliability of information held by an investigator. The weight ω i is normally set at 1 unless there are reliability issues on the information, which would lead ω i to a value strictly less than 1. The value ω i = 0 indicates that the specific criterion is not used in the investigation. T ol: the global value that represents the tolerance for all the criteria used in the investigation. It is defined as

T ol = ω 1 T ol s + ω 2 T ol a + ω 3 T ol d . (2)
We explain below the lower bound associated with each anonymity related T ols (see the variable description above). In the course of sequential searching for a specific criterion, we use a random variable Y to represent the outcome of each

E(Y ) = np ≥ k ⇐⇒ n ≥ k p ( 3
)
where n is the number of searches, p the probability of a successful identification. The value p is determined by the probability associated with the particular search criterion. For practical calculations as used in deriving the lower bounds associated with T ol s , T ol a , T ol d , we have used a rough estimate p = 1/#Group, where #Group is the number of groups under a specific criterion.

Derivation of Formula (1)

We prove the privacy-preserving drawer size formula (1) in this section. To determine the drawer size T T , one must fix a priori a search scenario specifying the sex, age group, and domicile region criteria. For instance, the search profile contains the following information: sex S = i, age group A = j, domicile D = k, where i, j, k are fixed in their respective domains. Henceforth, the expected value E(X) P based on the default distributions P s , P a ,P d is

E(X) P = 1 P r(S = i; A = j; D = k) = 1 p s i • p a j • p d k
assuming a geometric distribution on the search random variable X. Thus, the number of persons in the drawer satisfying the condition (S = i; A = j; D = k) is expected to be about T T /E(X). To preserve indistinguishability among the matched individuals, T T /E(X) must exceed the anonymity tolerance T ol(k):

T T E(X) ≥ T ol(k) ⇐⇒ T T ≥ E(X) • T ol(k).
The formula (1) now follows if we let T T = E(X) • T ol(k). And one may obviously without loss of generality assume N expire = 0 in the proof.

Empirical Study of System Reliability

Attack Model

We present an attack model here, based on which the reliability of the system can be defined. In an identity theft scenario, the attacker assumes the identity of another person (or he hijacks the biometric data of another person). Presenting himself before the registration authority, the theoretical probability of his success in finding a match between the drawer ID of the identity and the drawer ID of the biometric data is:

p = 1 N T (4)
and we define the system reliability as 1 -p. The lower attack probability is equivalent to a higher system reliability.

Test Methodology

Our confidence tests are based upon the attack model described above. The test is performed on the prototype setbase system. Specifically for a fixed population of 10,000 and a fixed number of drawers, we perform identity thefts at the registration authority, and record the number of attack successes. The test results are recorded in Table 4. The theoretical attack rates are recorded in the second column. The observed attack rates are recorded in the third column. The observed attack rate is expressed as a ratio of the number of observed attack successes over the number of attack attempts. For the statistics generated in this section, we have performed attack attempts in the range of 1000 to 5000. The system reliability rates are obtained by subtracting the observed attack rates from 1. Figure 5 is a plot of the system reliability versus the number of drawers N T . The observed attack rates adhere to the theoretical attack rates. This indicates that the basic architecture of the prototype system is sound and corresponds to how it should be. The source of absolute deviation between the theoretical rates and observed rates stems from the system performance fluctuations, and the inherent system errors.

Privacy versus Security

For sufficiently large population, the variables number of drawers (N T ) and size of a drawer (T T ) are related by

P opulation ≈ N T • T T. (5)
If we need privacy protection in the system, one possible solution would be to determine the minimum drawer size by means of formula (1). We then may adjust the number of drawers to reach a suitable system reliability level. We make this analysis rigorous in this section. Without consideration of privacy, we could chose a suitable N T based on the test results described in the previous section (Table 4).

We need the following data for carrying out the relational analysis: T T, N T , anonymity level k, attack probability, system reliability. Precisely, we first calculate the anonymity-preserving drawer size T T based on the general formula (1). The next step is to calculate N T using the formula (5), and the corresponding attack probability is calculated using the single attempt attack model (4). The reliability of the system is subsequently derived by subtracting the attack probability from 1.

We demonstrate the relation between T T and N T by studying the relation between the anonymity level variable k and the system reliability variable. Figure 1 and Figure 2 are two typical relational plots for the variables k and system reliability. Figure 1 reflects the entire range of k, 2 ≤ k ≤ 30. Figure 2 reflects the range k, 2 ≤ k ≤ 10 within which the highest system reliability rates occur. As can be been from the plots, the relation between k and system reliability is linear, inversely proportional. This fact again illustrates the underlying principle of the setbase: a stricter anonymity requirement (large k) requires a larger drawer size to be in place, that corresponds to a decrease on the number of drawers which in turn leads to a lower system reliability rate.

Conclusion

We have in this paper proposed a privacy-preserving drawer size standard for the setbase. The standard incorporates well known data privacy metrics such as k-anonymity and l-diversity as part of the drawer size formulation. The mathematical formulation gives one the ability to adjust the drawer size according the desired level of privacy. The future research in this direction includes issues such as how one can incorporate other database privacy notions into the privacy-preserving drawer size standard.

Fig. 1 :Fig. 2 :

 12 Fig. 1: System Reliability vs. Anonymity Level k, 2 ≤ k ≤ 1000 Fig. 2: System Reliability vs. Anonymity Level k, 2 ≤ k ≤ 100

Table 1 :

 1 s 2 }. The random variable A represents the age group to which an identity belongs. In this paper, A has 8 possible values with the corresponding probabilities {p a Random Variables

	1 , p a 2 , ..., p a 8 }.

Table 2 :

 2 Age DistributionThe random variable D represents the domicile of an identity. This variable has a range of 1 to 101 with the corresponding probabilities p d 1 , p d 2 , ..., p d 101

Table 3 :

 3 Anonymity Related Variables

	Variable Description
	k	the anonymity-preserving level k
	T ols the minimum standard needed for achieving indistin-
		guishability among people who have the same sex cri-
		terion
	T ola the minimum standard needed for achieving indistin-
		guishability among people who have the same age group
		criterion
	T ol d the minimum standard needed for achieving indistin-
		guishability among people who have the same domicile
		criterion
	ω1	weight for T ols, 0 ≤ ω1 ≤ 1
	ω2	weight for T ola, 0 ≤ ω2 ≤ 1
	ω3	weight for T ol d , 0 ≤ ω3 ≤ 1
	T ol	global tolerance := ω1T ols + ω2T ola + ω3T ol d

search, whether be success or failure. To preserve k-anonymity, we require that the expected number of successful identifications exceeds k among n sequential searches. That is

Table 4 :

 4 Probability of Attack Success for various N T

Table 5 :

 5 Confidence Test: System Reliability versus N T

http://www.insee.fr/en/methodes/default.asp?page=definitions/departement.htm

Acknowledgments. We would like to thank Vincent Pineau for implementing the prototype setbase in JAVA.


Chérif El

Valid Diouf

Mihai Telescu
email: mihai.telescu@univ-brest.fr

Igor S Stievano

Noël Tanguy

Flavio

Flavio G Canavero

Simplified topology for IC buffer behavioural models

published or not. The documents may come

Introduction

Nowadays, the design of modern electronic equipment requires the assessment of system performance in the very early design phase. Such an assessment, which is mainly achieved via the numerical simulation of interconnected structures, is aimed at predicting the transient evolution of the analogue signals flowing on system interconnects to detect possible malfunctioning and to promptly apply design corrections [START_REF] Yelten | Demystifying Surrogate Modeling for Circuits and Systems[END_REF][START_REF] Li | Progress Review of Electromagnetic Compatibility Analysis Technologies for Packages, Printed Circuit Boards, and Novel Interconnects[END_REF][START_REF] Swaminathan | Designing and Modeling for Power Integrity[END_REF][START_REF] Stievano | Macromodeling of differential drivers[END_REF]. In this framework, the availability of numerical models describing the external behaviour of digital integrated circuits (ICs) is of paramount importance.

IC ports act as nonlinear dynamical terminations for the interconnects at various levels within an electronic system (on printed circuits boards for example as shown in Fig. 1), thus strongly influencing the shape of signals on the interconnects themselves. Transistor-level descriptions are seldom available since they disclose confidential information on the internal structure and technology of devices. Even when provided by IC suppliers, in encrypted form, they lack portability, turn out to be greedy in terms of processor cycles and cannot effectively be used in a simulation environment. Owing to this, the best compromise is the development of behavioural models, that attempt to mimic the port electrical behaviour of devices (e.g., see Fig. 2a) and that can be effectively estimated from the observation of the signals at the IC interfaces. The standard solution in IC buffer modelling is offered by the Input/Output Buffer Information Specification (IBIS). IBIS assumes simplified equivalent circuits of typical buffer structures and provides guidelines for collecting the key features of devices (e.g., the static characteristics of the output port of a buffer, the equivalent capacitance of the silicon die, the parameters of the equivalent circuit of the package,...) [START_REF] Varma | Improving Behavioral IO Buffer Moldeing Based on IBIS[END_REF][START_REF] Zhu | Application of surrogate modeling to generate compact and PVT-sensitive IBIS models[END_REF]. Recently, other approaches that complement IBIS and provide improved accuracy for recent device technologies have been proposed [START_REF] Zhu | Accurate and Scalable IO Buffer Macromodel Based on Surrogate Modeling[END_REF][START_REF] Stievano | Macromodels via Parametric Identification of Logic Gates[END_REF][START_REF] Mutnury | Macromodeling of nonlinear digital I/O drivers[END_REF][START_REF] Cao | State-Space Dynamic Neural Network Technique for High-Speed IC Applications: Modeling and Stability Analysis[END_REF][START_REF] Cao | A New Training Approach for Robust Recurrent Neural-Network Modeling of Nonlinear Circuits[END_REF][START_REF] Dghais | A Novel Two-Port Behavioral Model for I/O Buffer Overclocking Simulation[END_REF][START_REF] Dghais | Reduced-order Parametric Behavioral Model for Digital Buffers/Drivers with Physical Support[END_REF][START_REF] Cao | Transient Behavioral Modeling of Nonlinear I/O Drivers Combining Neural Networks and Equivalent Circuits[END_REF].

However, all the state-of-the-art approaches share common limitations. The switching behaviour of devices is not always accurately reproduced; models often have troubles mimicking overclocking operation or spurious transition events. In some cases models have a very complex structure and cumbersome algorithms are used for parameter estimation. ( , )

IC Buffer Modelling

i F v v =
. Nevertheless, most of the available models are built around a simpler

paradigm 2 2 ( ) i F v =
, where a system of weighting functions is used to account for the influence of the input voltage. This simplification facilitates the computation of model parameters from both simulation and measurement (e.g., see [START_REF] Zhu | Accurate and Scalable IO Buffer Macromodel Based on Surrogate Modeling[END_REF] and [START_REF] Stievano | Macromodels via Parametric Identification of Logic Gates[END_REF]) but may lead to inaccuracies, specifically in the case of overclocking-related phenomena.

A Texas Instruments 8-bit bus transceiver (model name SN74ALVCH16973, nominal power supply voltage 2.5 VDD = V) is used as an illustrative example throughout the paper. Its SPICE transistor level description is available on the vendor's official website and was used to compute the reference waveforms.

The power supply voltage ( ) dd v t is considered constant throughout sections 3, 4 and 5 of the paper. Section 6 is specifically dedicated to modelling power-supply variations and all issues related to the topic are discussed therein.

Generalized Thevenin Model

In the proposed approach the Thevenin-like structure of Fig. 2b is used, where ( , ) G v v is a nonlinear conductance. In a more general case a nonlinear admittance element could be used instead in order to take into account the dynamic behaviour of the output port, mainly the output capacity, but for the sake of a simpler illustration of the method a purely static circuit element was considered in this paper. This assumption may appear restrictive, but it is justified in light of the accurate results shown in the following sections. In addition, it allows a simpler understanding of how the model structure relates to state-of-the-art methodologies and what its advantages are. As a further refinement, ( , ) G v v from device responses. In order to facilitate parameter estimation from both simulation and measurement, the series conductance is assumed to be defined by: The first issue that needs to be addressed is the modelling of ˆ( ) e v could be reconstructed in the exact same manner. However, this approach, while being robust, is also responsible for the inaccurate behaviour observed in IBIS models used in overclocking conditions. Indeed, overclocking has become a topic of significant interest among modellers.

1 2 2 2 1 1 2 2 ( , ) ( ) ( ) ˆ( ) ( ) ( ) 1 ( ) H H L L H L G v v w G v w G v e v e v G v G v VDD VDD             = + = + - (1) where 2 (
The authors chose to use a variant of the classical Hammerstein approach depicted in Fig. 3 The only block requiring the use of elaborate identification tools is the linear filter. Indeed, this block needs to be compact and to accurately mimic the device's input-output dynamic behaviour.

Literature provides a wide range of possible approaches and the authors chose to rely on the well-known vector-fitting algorithm [START_REF] Gustavsen | Rational approximation of frequency domain responses by vector fitting[END_REF] in its relaxed version [START_REF] Gustavsen | Relaxed Vector Fitting Algorithm for Rational Approximation of Frequency Domain Responses[END_REF]. This technique is known to be robust, reliable and is readily available to potential users. The required input data consists in a set of n samples of the frequency-domain response (i.e. ( ) H jω for , ,..., 0 1 n

ω ω ω ω =
). A cleverly cast least squares problem and an iterative pole-relocation algorithm are then used to compute a rational approximation of ( ) H jω .

Convergence is generally fast, requiring less than 10 iterations. It should be noted that the order of the filter, which corresponds to the total number of poles included in the rational approximation, depends on the desired accuracy vs. speed trade-off. However, given its simple structure, this type of system is very efficiently handled by SPICE tools even at higher orders. A detailed presentation of vector fitting is beyond the scope of this paper, one can refer to [START_REF] Gustavsen | Rational approximation of frequency domain responses by vector fitting[END_REF], [START_REF] Gustavsen | Relaxed Vector Fitting Algorithm for Rational Approximation of Frequency Domain Responses[END_REF] and the references therein for additional information.

Fig. 4 shows the open circuit response of the driver as well as that of the model to an input waveform featuring spurious transition events. With a normalized mean square error of -38.13 dB the predicted response proves remarkably accurate. The order of the linear filter used in this case was 4, amounting to a very compact model. The second issue concerns conductances It is relevant to remark that model parameters, i.e. ê and , H L G , can also be computed from actual measurements performed on a real device, with standard solutions for the test fixture.

The overall Thevenin-like model extraction algorithm is summarized below and graphically illustrated in Fig. 6 It's worth noting that steps 2) and 3) could be modified to allow a direct identification in time domain using time-domain vector fitting [START_REF] Grivat-Talocia | Package Macromodeling via Time-Domain Vector Fitting[END_REF]. On a more general level, the Thevenin-like model in Fig. 2b. could be implemented in various ways. The identification of the 1 ˆ( ) e v block, for example, is a classical single-input-single-output dynamic system identification problem and a plethora of methods is available in academic literature: neural networks, polynomial filters or various heuristics (e.g., see [START_REF] Haykin | Neural Networks -A Comprehensive Foundation[END_REF][START_REF] Telescu | An Application of Volterra Series to IC Buffer Models[END_REF][START_REF] Diouf | Statically constrained nonlinear models with application to IC buffers[END_REF]). The authors preferred the Hammerstein approach for its straightforward implementation but also because the static characteristic of the device, which is of paramount importance, is modelled in accurate and explicit fashion.

Simulation results

In this section, the Thevenin-like model is used to simulate a realistic interconnect structure consisting of the driver connected to a distributed load defined by a transmission line with a 60 Ohm characteristic impedance and 100 ps delay. The transmission line is terminated by a lumped equivalent of a receiver circuit represented by the shunt connection of a 7 pF capacitor.

The input waveform is the same as the one in Fig. 4. The responses of the driver, of the Theveninlike model and of an IBIS model are shown in Fig. 7. There is a very good agreement between the Thevenin response and the reference while the IBIS response exhibits misalignment phenomena each time a spurious transition occurs. This is not surprising, the crop-and-paste IBIS strategy has an intrinsic problem at high frequencies and this is precisely the issue that the Thevenin approach presented here addresses.

The waveforms in Fig. 7 were generated on a standard computer with an Intel(R) Core(TM) i5 reference. This further confirms the strength of the proposed method and it's worth noting that the speedup is independent of the complexity of the original transistor model.

The eye diagram is one of the most efficient validation tools in the field of system integrity. Fig. 8 provides comparative eye diagrams for the reference driver and the Thevenin-like model using clock signals at three different frequencies: 333, 606 and 827 MHz respectively. A transmission line load with a characteristic impedance of 75 Ohm and a delay of 400 ps terminated on a 1pF far end capacitor in parallel with a 200 Ohm resistor was used. The match between the diagrams is almost perfect at lower frequencies and retains remarkable accuracy as the frequency increases. Note that at 827 MHz the driver is functioning in overclock conditions. Some signal integrity parameters have been collected in Table I for the three clock signals. Rise and fall times are defined with respect to thresholds accounting for 20% and 80% of the step height.

Relation to previous approaches

In IBIS models (or models generated by similar techniques such as [START_REF] Zhu | Accurate and Scalable IO Buffer Macromodel Based on Surrogate Modeling[END_REF][START_REF] Stievano | Macromodels via Parametric Identification of Logic Gates[END_REF][START_REF] Mutnury | Macromodeling of nonlinear digital I/O drivers[END_REF]) the output current of the buffer writes:

1 1 2 2 2 , ( ) ( ) ( , ) ( ) ( ) H H L L i t w t f v v w t f v v = + % % % %
(2)

Inclusion of the power supply variation

In this section a simple way of modelling the influence of the power-supply voltage on the output signal is considered.

The power supply voltage ( ) dd v t is seen as an independent aggressor source acting on the output current 2

i . The objective is to capture both fast variations due mostly to electromagnetic compatibility issues and slow deviations from the nominal value due to the supply itself and the structure of the Thevenin-like model allows a straightforward approach.

Let VDD denote the nominal value of ( )

dd
The influence of the power supply voltage on the behaviour of a single-ended driver locked in offstate is negligible, thus one may consider L G as independent from ( ) dd v t . This is not the case when the driver is in on-state. A simple way of accounting for this dependence is a linear correction under the form

1 1 ( , ) ( ) ( , ) ( ) H H dd dd dd G v v a v G v VDD b v = + (5) where 1 ( ,

Conclusions

This paper presents an original paradigm in IC buffer black-box modelling. The concept is based on a generalization of the Thevenin equivalent circuit and, interestingly enough, is mathematically related to the existing IBIS paradigm. The overall buffer model is made up of very simple building blocks, static mappings, an ideal delay line, a low order linear filter. It is easy to derive and implement using commonly available software. The strength of the method resides in the novel way of assembling these building blocks and is well illustrated by the accurate results and the significant speed-up. Device operations are accurately reproduced even during spurious state transitions or overclocking. Furthermore the input-output characteristic of the device is mathematically modelled in a simple and efficient way thus offering a far more flexible solution than the crop-and-paste approach currently used in IBIS-based software. The possibility of including power supply variations has also been explored in the final section of the paper.

Hence, this study provides a reliable basic framework for future EDA tools. Furthermore, the approach is flexible and versatile and subsequent enhancements should easily fit on the established framework. Such enhancements may include additional model blocks accounting for higher order output port dynamics, model customizations accounting for specific device technologies or for environmentdependent parameters such as temperature.

Fig. 1 .

 1 Fig. 1. Example of interconnect system on a printed circuit board.

Fig. 2 .

 2 Fig. 2. a) Typical structure of a digital IC with the relevant electric variables b) Generalized Thevenin mode .

  Consider the single-ended CMOS buffer in Fig. 2a. It represents the basic structure of the I/O interfaces between the internal core circuitry to the external interconnects. Any model of such a device needs to implement a nonlinear dynamic mathematical relation binding the port voltage to the current variables, e.g. 2 1 2

  may be modelled by a nonlinear dynamical element, without modifying the general theoretical framework provided in this paper. The estimation of model parameters amounts to determining 1 ˆ( ) e v and the characteristic curve of the nonlinear conductance 1 2

  the nonlinear conductances associated to the fixed high and low output state, respectively. The equation above is a two-piece relation accounting for the change of the output buffer's impedance with respect to the variation of the input signal driving the buffer. Note that (1e v as a weighting function that accounts for switching. This is consistent with the physics of CMOS circuits. During switching events the output current is intrinsically weighted by the gate voltage which in turn is related to the open circuit-output voltage.

  e v . Ideally, an EDA tool should implement a general solution. IBIS-based tools use concatenated, properly trimmed, pre-recorded voltage curves describing typical up-down and down-up transitions in order to simulate drivers for arbitrary input signals. The open circuit voltage 1

Fig. 3 .

 3 Fig. 3. Block diagram illustrating the model of voltage-controlled power source

Fig. 4 .

 4 Fig. 4. Top panel: input voltage (random bit stream). Bottom panel: transient open circuit responses of the real device (solid line) and of the model (dashed line).

  of (1) (see Fig.5). These are determined via a DC analysis with an ideal voltage source 2 v connected to the output port of the buffer.The buffer is locked in high or low state respectively, and the conductances are computed via Ohm'in the SPICE netlist of the model as tables.

Fig. 5 .

 5 Fig. 5. Nonlinear conductance as a function of v 2 and of the operating state of the buffer.

Fig. 6 .

 6 Fig. 6. Flow chart illustrating the algorithm described in section 3.

processor and 4

 4 GB RAM. A 10 × speed-up was recorded for the Thevenin-like model with respect to the

Fig. 7 .

 7 Fig. 7. Output port voltage response of the example buffer loading an transmission line with 60 Ohm characteristic impedance, 0.1 ns delay and a far end 7 pF capacitor. Solid black: reference response; solid blue: Thevenin model prediction; dashed red: IBIS model prediction.

Fig. 8 .

 8 Fig. 8. Eye diagrams comparing the driver response (solid black) and the model response (blue) at 333 MHz (top panel), 606 MHz (middle panel) and 827 MHz (bottom panel).

v t and let the open circuit voltage 1 ˆ 1 ˆ

 11 be modelled according to the algorithm described in section III. It can be assumed that the influence of ( ) dd v t on the actual switching threshold voltage is small and that the problem is mostly a matter of amplitude matching. A general model of

  ) H G v VDD is simply the nonlinear conductance computed in section III. The practical implementation simply requires DC analysis to be performed for various values in a given range around VDD . Coefficient vectors a and b can subsequently be obtained by simple polynomial fitting and embedded in the model as tables. The technique is basic but quite effective as long as ( ) dd v t variations remain within reasonable limits. Fig. 9 illustrates the approach for a random bit stream and a realistic ( ) dd v t waveform exhibiting impulse noise commonly associated with switching phenomena. With a normalized error of -30.03 dB the match between the model response and the reference is remarkably accurate The nominal value of the power supply voltage for the example driver was 2.5 V. Being able to perform signal integrity assessments accounting for ( ) dd v t .

Fig. 9 .

 9 Fig. 9. Input voltage (upper panel), v dd variation (middle panel) and driver response(lower panel); transistor model response in solid black, Thevenin-like model response in dashed blue.

  is modelled as a cascade of three blocks. The first block is purely static and consists in a table-based model simply mapping the static open-circuit input-output characteristic of the buffer. The second block is a linear filter and the third block is an ideal delay line accounting for the measured delay of the device in open circuit.

		. The
	open circuit voltage	1 ˆ( ) e v

Table 1

 1 Signal integrity parameters for the transistor model and the Thevenin-like model at different frequencies

		333 MHz	606 MHz	827 MHz
		Ref.	Mod.	Ref.	Mod.	Ref.	Mod
	Rise time (ns)	0.335 0.307 0.334 0.307 0.335 0.307
	Fall time (ns)	0.228 0.232 0.229 0.222 0.314 0.265
	Overshoot (V)	2.526 2.524 2.534 2.524 2.550 2.562
	Undershoot (V) -0.145 -0.140 -0.115 -0.122 -0.155 -0.168

)

, ( )

are the static characteristics of the output port of the buffer in the fixed high and low state, respectively, and , ( )

w t % are weighting functions that are computed numerically from the device responses on two resistive loads via the solution of a least-squares problem (e.g., see [START_REF] Varma | Improving Behavioral IO Buffer Moldeing Based on IBIS[END_REF] or [START_REF] Zhu | Application of surrogate modeling to generate compact and PVT-sensitive IBIS models[END_REF] for details). This is also true for alternative approaches such as [START_REF] Stievano | Macromodels via Parametric Identification of Logic Gates[END_REF] or [START_REF] Mutnury | Macromodeling of nonlinear digital I/O drivers[END_REF].

The first advantage of the technique described in the present paper is the use of the structure in Fig. 3. This is a sound and accurate analytical model describing the input-output behaviour of the buffer while remaining SPICE-friendly, simple and robust. The importance of this issue was already recognized by the authors of [START_REF] Dghais | A Novel Two-Port Behavioral Model for I/O Buffer Overclocking Simulation[END_REF]. Their approach was to use two coupled structures, each similar to the one in Fig. 3, to model the pre-driver stage of a buffer. While leading to very accurate models, the method breaks away from the requirements of black-box modelling because it requires information on internal circuit nodes.

Furthermore it may not be used for some buffer architectures. These issues were circumvented by the solution proposed in this paper which also turns out to be more compact. Now consider Fig. 2b and equation [START_REF] Yelten | Demystifying Surrogate Modeling for Circuits and Systems[END_REF]. In this case, the expression of the output current can be cast as follows:

Clearly, equations ( 2) and ( 3) are similar and it is interesting to note that the top-down approach of the authors (from circuit theory to macromodel) finally leads to a paradigm similar to the IBIS one obtained by a bottom-up approach (from transistor model to macromodel). Yet another difference appears when carefully comparing (2) and (3). In the case of the IBIS-based models, the two submodels H f % and L f % of (2) only account for fixed high and low state nominal values of the input, namely VDD and 0 respectively. The same holds for the approaches described in [START_REF] Stievano | Macromodels via Parametric Identification of Logic Gates[END_REF] or [START_REF] Mutnury | Macromodeling of nonlinear digital I/O drivers[END_REF] which seek to maximize accuracy by relying on improved, dynamic submodels. Instead, in the case of the Thevenin-like model, the inclusion of 1 ˆ( ) e v in H f and L f provides a stronger link to the input port when switching actually occurs, and the model, more reactive, is more successful in mimicking the overall dynamic behaviour of the circuit.


N Rakotovaoravahatra

F Duprat

F Schoefs

T De Larrard

E Bastidas-Arteaga

Assessing the capability of analytical carbonation models to propagate uncertainties and spatial variability of reinforced concrete structures

Keywords: Spatial correlation, Uncertainty, Carbonation, Reinforced concrete, Inspection

Most of the approaches for diagnosis or prognosis of deteriorated reinforced concrete(RC) structures are based on two stages: acquiring data (concrete properties, quantitative degradation information), and then predicting the evolution of degradation by using appropriate models. Spatial variability of both properties and degradation processescannot be neglected in the lifecycle assessment and implies that (i) data should be acquired for a representative part of the concrete surface and (ii)models should be capable of dealing with this variability.However, the assessment and modeling of spatial variability is not a straightforward task particularly when uncertainties affect the measurementsorwhen the number of measurements is limited.The present paper aims at studying the capability of analytical carbonation models to deal with the spatial variability of model inputs in terms of spatial correlation of model outputs.Analytical models are considered herein because they provide practical and usual tools in engineering. This paper focuses on the case of a RC wallexposed to atmospheric carbonation where concrete properties and carbonation depths were measured by destructive techniques at several points over a linear portion of a wall within the framework of the French ANR EVADEOS project.Uncertainties due to experimental devices and procedures are estimated and propagated throughout random field models to account for spatial variability of spatial observations. Correspondence indexes are proposed to rank carbonation models with respect to their ability of reflecting the observed correlation profiles of carbonation depth. It was found that for the available database the proposed correspondence index that incorporates uncertainties was useful to assess the capabilities of models to deal with the spatial variability.

Introduction

Reinforced concrete (RC) is a material widely used in the construction of infrastructure and buildings because of its relative low cost and large durability. However, there are some environmental conditions where physical, chemical and biological deterioration processes reduce significantly its durability and safety [START_REF] Bastidas-Arteaga | Probabilistic lifetime assessment of RC structures under coupled corrosion-fatigue processes[END_REF][START_REF] De Larrard | Effects of climate variations and global warming on the durability of RC structures subjected to carbonation[END_REF][START_REF] Marquez-Peñaranda | Effects of biodeterioration on the mechanical properties of concrete[END_REF].Among these deterioration processes, atmospheric carbonation of RCstructures is one of the major causes of depassivation and then corrosion of steel reinforcing rebars [START_REF] Ann | Service life prediction of a concrete bridge structure subjected to carbonation[END_REF]. Carbonation-induced corrosion damage could certainly increase in the future years by the rise of environmental CO 2 concentration inducing additional maintenance costs [START_REF] Ipcc | Climate Change 2013: The Physical Science Basis. Contribution of Working Group I to the Fifth Assessment Report of the Intergovernmental Panel on Climate Change[END_REF][START_REF] De Larrard | Effects of climate variations and global warming on the durability of RC structures subjected to carbonation[END_REF]Peng and Stewart 2014a;[START_REF] Stewart | Climate Adaptation Engineering and Risk-Based Design and Management of Infrastructure[END_REF].

Maintenance strategies of corroding RC structures aim atpredicting corrosion and planning repair operations (coating, replacement of concrete cover, cathodic protection, etc.) in order to maintain acceptable serviceability and safety levels. For new or non-corroded structures, inspection and data collection are crucial to characterize parameters of carbonation models. Theinherent spatial variability of concrete properties and cover depth is of prime importance and must be properly characterized and modeled [START_REF] Li | Effect of spatial variability on maintenance and repair decisions for concrete structures[END_REF][START_REF] Peng | Spatial time-dependent reliability analysis of corrosion damage to RC structures with climate change[END_REF][START_REF] Stewart | Spatial time-dependent reliability analysis of corrosion damage and the timing of first repair for RC structures[END_REF];it implies that models must be selected, on the one hand, for representing the carbonation process andpredicting corrosion initiation. On the other hand, models must be capable of integrating the spatial variability of input and propagating it onto the output. A convenient way to characterize the spatial variability of stationary random fields is to assess the spatial correlation of data [START_REF] O'connor | Experimental Evaluation of the Scale of Fluctuation for Spatial Variability Modeling of Chloride-Induced Reinforced Concrete Corrosion[END_REF][START_REF] Pasqualini | Measurements and statistical analysis of fillet weld geometrical parameters for probabilistic modelling of the fatigue capacity[END_REF][START_REF] Schoefs | Assessment of spatially dependent ROC curves for inspection of random fields of defects[END_REF][START_REF] Schoefs | Characterization of random fields from NDT measurements: A two stages procedure[END_REF]. Knowing the spatial correlation before inspection helps to define an optimal inspection by reducinginspection cost and increasing thepredictions accuracy [START_REF] Bastidas-Arteaga | Stochastic improvement of inspection and maintenance of corroding reinforced concrete structures placed in unsaturated environments[END_REF][START_REF] Gomez-Cardenas | New optimization algorithm for optimal spatial sampling during non-destructive testing of concrete structures[END_REF]O'Connor et al. 2013). Inspection or repair decision-making can be efficiently conducted in a probabilistic context especiallywhen statistical and spatial variability of data have been characterized [START_REF] Papakonstantinou | Probabilistic model for steel corrosion in reinforced concrete structures of large dimensions considering crack effects[END_REF][START_REF] Stewart | Spatial variability of pitting corrosion and its influence on structural fragility and reliability of RC beams in flexure[END_REF][START_REF] Stewart | Spatial Variability of Damage and Expected Maintenance Costs for Deteriorating RC Structures[END_REF].Data collected from real structures can be perturbed by: spatial variability, measurement error, inaccuracy of experimental devices, complexity of experimental process, etc. Therefore, a dedicated treatment is often applied to data in order to discard gross outliers. In addition, it is not possible to generalize outcomes regarding spatial variabilitybetween structureseven for the same material property.For instance,concrete mix, execution and environmental conditionshave an important impact on the concrete porosity, and then, the spatial variability of porosity between two components supposedly casted with the same concrete is not necessarily the same. This issue was addressed within the framework of the ANR-EVADEOS project (funded by the French National Research Agency) where a wide experimental investigation was undertaken on several RC structures. Destructive and non destructiveevaluations (NDE) were performed to estimate durability properties of concrete as well as carbonation depth.Only results of destructive tests are considered in this paper. Measurements were taken over a representative part of a concrete wall.

The main objective of the present study is to the estimatethe ability ofanalytical carbonation models to propagate the spatial variability of measured inputs (porosity and saturation degree). The method relies on a comparison between simulated and measured outputs (carbonation depth). A peculiar attention is paid to the quality of data. The effect of gross outliers on the correlation profile of concrete properties is hence studied as well as the influence of unintended deviations in experimental measurements. Moreover,a statistical approach is proposed to study the capability of analytical models to deal with the spatial variability. Section 2 presents the studied structure and the data collected in one experimental investigation of the ANR-EVADEOS Project. Section 3 introduces the computational tools used to assess the correlation profiles and tosimulatestationary random fields. We evaluate in section 4 the uncertainties related to experimental measures. Finally, we propose in section 5 various metricsused to evaluate and compare the capability of analytical models to deal with spatial variability.

Investigated structure

The structure investigated is a concrete wall (Figure 1) built in 1979 enclosing a yard where inert wastes are stored. From carbonation point of view, the exposed surface of the wall represents perfectly a vertical surface of a bridge girder or a column and can be investigated with a lower cost. However, the wall is not cyclically loaded. If the structure was subjected to external mechanical loading, two cases may occur: (i) the loading causes significant mechanical degradation (excessive cracking on given zones for instance): the concrete is hence subjected to substantial supplementary heterogeneity and therefore the methodology could not be applied due to the non-stationarity of random fields; (ii) the loading causes negligible or uniform degradation: the results presented in the following would not be affected. The wall is 2.3 m high, several tens of meters long and 20 cm width. The portion of wall considered is east-west oriented and 3.5 m length. Non destructive and destructive measurements were carried out on the north face whilst only destructive measurements were carried out on the south face. The 21 successive measurements along asingle horizontal line situated at 1.5 m above the ground were located at center of the reinforcement meshes with a constant distance of 16 cm between measurements. These are common operational conditions: limited number of semi-destructive tests or small distance between tests to ensure the condition of similar exposure zone. It was shown that second order statistical properties of the random filed could be characterized from a single sample function (or trajectory) when using NDEs on similar exposure zones [START_REF] Schoefs | Characterization of random fields from NDT measurements: A two stages procedure[END_REF]. Concrete saturation degree and porosity were estimated by both destructive and non destructive techniques. For the destructive tests, cores were extracted according to (EN-13791 2007), porosity and density were determined following the procedure described by (NF 18-459 2010). The distance of the measurement line to the ground (1.5m) and to the top (0.8m) was selected to avoid edge effects both from environmental conditions and material variability due to concreting. Compressive strength was estimated by non destructive techniques (rebound hammer). After inspection, carbonation depth was estimated from extracted cores immediately placed into sealed plastic bags and measurements were conducted in lab.

Non destructive evaluation of the same parameters results from a procedure combining different non destructive technics (ultrasonic waves, radar, impact echo, surface waves and capacitive sound) by data fusion. This technique was adapted because any of these NDEs can provide a direct measurement of the quantities of interest. Data fusion is based on possibility and fuzzy set theories [START_REF] Dubois | Possibility Theory, Probability Theory and Multiple-Valued Logics: A Clarification[END_REF]. Nevertheless the assessment of uncertainties affecting the output of the NDEs cannot be easily directly determined from the observations (frequency, wave velocity …), and European standards do not address this topic yet. Since we want to analyze the capacity of models to propagate uncertainties and spatial variability, NDEs are therefore not considered in this paper.

Exposure conditions after 35 years of each wall face are rather different and consequently their effect on measured quantities (carbonation depth or saturation degree) is not negligible: on the South side, the drying is faster and the carbonation is supposed to be accelerated. The results indicate (Tables 1 and2) that the mean value of carbonation depth is 1.96 cm for North side (Side A) and 2.42 cm for South side (Side C). It was therefore decided to analyze separately the measurements obtained on each face.

Simulation of random fields

This paper will focus on modeling spatial variability of three properties: concrete saturation degree, porosity and carbonation depth. Given that many studies have been devoted to numerical simulation of random fields-e.g., [START_REF] Kenshel | Influence of spatial variability on whole life management of reinforced concrete bridges[END_REF][START_REF] Schoefs | Assessment of spatially dependent ROC curves for inspection of random fields of defects[END_REF], this work employs well-known numerical methods towards this aim.

A random field X(x, ) is a set of random variablesX() (where  denotes hazard) indexed by a parameter x (continuous or discrete) whose values belong to R n . In this case, x represents the space in the horizontal direction.For a given realization  0 ,X(x,  0 )represents a sample function (or trajectory) of the random field. This study assumes that the field is ergodic(stationary) to be able to estimate allproperties of X(x, ) (mean, variance, correlation length, statistical moments) from a unique sample function X(x,  i ). We thus consider only one sample function for each field in the following and is not mentioned anymore. For each x 0 , X(x 0 ) is a random variable whose probability

density function is     h f 0 x X
. The n-order spatial moment n D m and the global statistical moment n x 0 m are respectively defined as:

 dx x X D 1 D m D 0 n n D     lim [1] [2]
whereD describes the geometry of the field and is the space of real numbers.In the case where

n X 0 m and     h f 0 x X
do not depend on x 0 , the random field is stationary (Property P1). On the other hand, when n D m and n X 0 m are equal, the random field is ergodic (Property P2): an ergodic field is thus stationary. Moreover, if the spatial variance 2 D m is also equal to the global statistical variance 2 X 0 m , the random field is second order stationary (Property P3). In this case, the autocorrelation function ρ(x-x') depends only on the lag distance Δx=x-x'. Due to the fact that only one realization of each random field is available and for the sake of simplicity, we assume that the random fields are ergodic (P2) and Gaussian.However additional experimental observations are required to confirm this assumption. Moreover considering more complex type of random fields (non stationarity or piecewise stationarity) [START_REF] Schoefs | Assessment of spatially dependent ROC curves for inspection of random fields of defects[END_REF])is beyond the scope of this study and would complicate the comparison between models.That is the case for excessive cracking on given zones. For many practical cases in civil engineering, the amount of data is insufficient to justify or use P1 and we assume P3 (second order stationarity).

The autocorrelation function of a stationary random field describes the decay of the correlation with respect to the distance between points. Many autocorrelation functions were proposed in the literature (see for instance [START_REF] Kenshel | Influence of spatial variability on whole life management of reinforced concrete bridges[END_REF][START_REF] Sudret | Stochastic Finite Elements and Reliability: A state-of-the-art report[END_REF]for an overview).These functions are characterized by the scale fluctuation θ.

Two main procedures are reported in the literature for the estimation of θ. The Maximum Likelihood Estimate method consists in searching for the value of θthat maximizes the joint probability density of the data, supposed to be the realizations of the same distribution function [START_REF] Li | Effect of spatial variability on maintenance and repair decisions for concrete structures[END_REF]. Initially correlated according to the ongoing value of θ, these realizations must be transformed into uncorrelated variables so as to compute the joint probability density as a simple product of independent standardized Gaussian variables.The fitting method aims at assessingθthat best fits the correlation profile

 

x D   obtained from the measured data [START_REF] Vanmarcke | Random fields: analysis and synthesis[END_REF]). For a one dimensional and stationary random field the correlation profile along the domain is determined as the successive values of the correlation coefficient with respect to the distance x between points:

r D Dx ( ) = X x i ( ) -m X ( ) X x i + Dx ( ) -m X ( ) é ë ù û i=1 m å ms X 2 [3]
wherem X and s X are respectively the mean and standard deviation of X estimated from independent values of data and m is the number of points at a distance x from each other.

Among other possible techniques [START_REF] Lévy | Processus stochastic et mouvement brownien[END_REF][START_REF] Vanmarcke | Random fields: analysis and synthesis[END_REF])the Karhunen-Loève expansion [START_REF] Karhunen | Uber lineare methoden in der wahrscheinlichkeitsrechnung[END_REF][START_REF] Lévy | Processus stochastic et mouvement brownien[END_REF]) was used in this study to simulate a Gaussian stationary random field:

           n 1 i i i i X X x f s m x X , [4]
wherenis number of terms in the truncated expansion, ξ i is a standardized Gaussian random variable, λ i and f i are respectively the eigenvalues and eigen-functions of the autocorrelation function ρ D (Δx). Only few papers in the literature, recommend the use of a given autocorrelation function. We propose herein to use an exponential autocorrelation function, generally used for representing the auto-correlation of concrete property or durability indicators [START_REF] Kenshel | Influence of spatial variability on whole life management of reinforced concrete bridges[END_REF][START_REF] Schoefs | Characterization of random fields from NDT measurements: A two stages procedure[END_REF]. Figure 2b shows that it is well adapted in the present case also. In the case of an exponential autocorrelation function that depends on the correlation parameter b, the eigenvalues λ i and eigen-functions f i are expressed under the assumption that the field is second order stationary [START_REF] Sudret | Stochastic Finite Elements and Reliability: A state-of-the-art report[END_REF]:

          2 i 2 i b 1 b 2 [5]                             even for odd for i 2 a 2 a x i 2 a 2 a x x f i 0 i 0 i i 0 i 0 i i sin sin sin cos [6]
wherea 0 is half the length of the domain and  i is the solution of the following transcendental equations: . The uncertainty on the saturation degree or the porosity, u f , is then expressed as:

                
             m n 1 k 2 k m f m f u u [8]
The carbonation depthwasmeasuredvisually with a determination error c x   depending from the operator. The uncertainty affecting the carbonation depth is then

3 x u c x c   .

Gross outliers

A primary treatment for the collected data was carried outin order to discard the gross outliers related to particular measurement conditions:the value exceeds the quality requirement (for instance the discrepancy with other values is greater than 3 times the standard deviation [START_REF] Boéro | Statistical analysis of corrosion process along French coast[END_REF][START_REF] Pasqualini | Measurements and statistical analysis of fillet weld geometrical parameters for probabilistic modelling of the fatigue capacity[END_REF], or thevalue appears to have no physical meaning (for instance the magnitude of corrosion rate is negative).In case of spatial variability, the spatial evolution of measured values is not chaotic and consecutive values should stay in a given range.

Figure 2adepictsthe sample function of measurements of saturation degree from destructive tests on the south face of the wall. It is noted that the value at the abscissa 336 cm is a gross outlier with respect to the values measured in other locations. Accounting for this value in the calculation of the correlation profile leads to significant and meaningless negative values of the correlation coefficient as it can be seen in Figure 2b. Once this value has been removed, the correlation profile seems more relevant although some oscillation remains with still negative values.These negative correlation coefficient values have been alsoreported when the evaluation is performed with limited data [START_REF] Pasqualini | Measurements and statistical analysis of fillet weld geometrical parameters for probabilistic modelling of the fatigue capacity[END_REF]).

Uncertainty of assessment for correlation coefficient

The correlation profile of data is estimated according to Eq. [3] and its accuracy depends on the number m of couples of measurements available for a distance Δx between points.A larger number of couples reducesthe statistical uncertainty.Since repeated values of measurements are used in this work to assess the correlation coefficient of each distance between points, it can be deemed that uncertainty on spatial correlation belongs to type A of uncertainties as described in European standard.Nevertheless, a direct statistical treatment of spatial correlation is not possible from only one sample function of data. A numerical investigation is hence carried out in order to compute the mean and standard deviation of the correlation coefficient when a large number of sample functions is available and in terms of m.

Using Karhunen-Loeve expansion for an exponential autocorrelation function, n t =500 sample functions are simulated for each experimental parameter. n=100 points of measurements per sample function are generated (the number of points of measurement for each sample function is n=21 for the experimental data). For each sample function it is possible to compute a spatial correlation at each distance Δx;and therefore, to estimaten t correlation coefficients bwith a standard deviation computed as:

                  t n 1 i t i D t t x x n 1 x , [9]            t n 1 i i D t x n 1 x , t
: with

[10]
The following procedure was applied to assess how the number m, or indirectly the number of npoints in the sample function, impactsthe standard deviation  

  x D   is then simply     m x u t x D      .

Metrics for estimating the quality of the spatial variability predictions

This section proposes quality indicators to analyze the ability of predictive models to represent the spatial correlation of degradation indicators (carbonation depth). The idea is to quantify how well the spatial correlation of the degradation estimated by the propagation of uncertain measured data through models fits the spatial correlation of the measured degradation. In the aforementioned onsite investigation, each extracted core was divided into three zones namely A, B and C (Figure 1). Sides A and C comprised the edges of the concrete wall exposed to the atmospherewhile B was the inner part of the wall. As the carbonation depth is the matter of interest and was not detected on the portion B, only the destructive measurements on sides A and C are considered in this study. The mean values and their related uncertainties are reported inTables 1 and 2. Under the assumption of perfect measurements [START_REF] Schoefs | Assessment of spatially dependent ROC curves for inspection of random fields of defects[END_REF], mean values of measurements reported in Tables 1 and2 were used as input parameters of the four considered carbonation models:Hyvert [START_REF] Hyvert | Dependency of C-S-H carbonation rate on CO2 pressure to explain transition from accelerated tests to natural carbonation[END_REF]), Miragliotta [START_REF] Miragliotta | Modélisation des processus physico-chimiques de la carbonatation des bétons préfabriqués : prise en compte des effets de paroi[END_REF], Ying-Yu (Ying-Yu and Qui-Dong 1987) and Papadakis [START_REF] Papadakis | Fundamental Modeling and Experimental Investigation of Concrete Carbonation[END_REF]. Only one sample function of the carbonation depth and subsequent correlation profile were hence computed from each carbonation model (at exposure time t exp =35 yr) and compared to the correlation profile of the experimental data. Taking into account the lag ε ρ (Δx i ) between points of the two correlation profiles at the same distance Δx i (see Figure 4for the Hyvert model) a normalized scalar metric is proposed as:

I CM =1- 1 4n e r Dx i ( ) é ë ù û 2 i=1 n å 0 £ e r Dx i ( ) £ 2 [11]
Sinceρ takes values between -1 and 1,ε ρ (Δx i )can vary from 0 (best situation) to 2 (worst situation), the so-called "correspondence index" varies from 0 to 1.

Table 3 provides the ranking of modelsusing this metric. A slight difference appears between the ranking for the sides A and C forHyvert and Papadakis models. Nevertheless,these results indicate that this metric does not discriminate efficiently the models because all valuesare close to 0.99. Simulated correlation profiles of x c , ρ D (Δx),were estimated from these sample functions according to eq. [3].Figures 3 and4 illustrate these correlation valuesfor two carbonation models. Uncertainty due to the numerical inaccuracy in the computation of the experimental correlation profiles (section 4.3) is also added to the global uncertainties represented by up and down doted lines.It is noted that values corresponding to experimental correlation profiles are more sprayed, for the same lag distance x, than those computed from model output. This is due to the fact that the coefficient of variation of the carbonation depth is lower when computed from the rather narrowrange of variation of input parameters, than when calculated from experimentalcarbonation depth. When comparing Figure 3 and Figure 4 it can be seen that this variation depends also on the considered model; for the considered models the propagation of the same uncertainties of input parameters leads to a wider dispersion forthe Papadakis model. 1. for each distance Δx i let n mes,i and n global,i be the number of values of spatial correlations which satisfy to: [12] 2. ifN is the total number of spatial correlation profiles, two correspondence marks could be defined for each distance Δx i :

[13]

3. the correspondence indices can be expressed as follows, where n is the number of evaluation points:

[14] According to Table 4,Hyvertmodel seems to be more appropriate to represent spatial variability, excepting for the side C when numerical inaccuracy for the computation is not considered. Miragliotta model appears also relevant in its capability to transfer the spatial variability for the side A, but it should be discarded for the side C.Due to their exposure to rain, sun and wind sides A and C of the wall experienced different behavior regarding carbonation, despite the fact that concrete properties should be the same (concrete pouring was naturally simultaneous for both sides). It seems that exposure effect, combined to the initial spatial variability of concrete properties, considerably modified spatial variability of deterioration processes. It can be deemed in addition that concrete aging is also altered by exposure conditions impacting the initial spatial variability. These considerations could partly explain the discrepancy of the model performance as function of the side considered.

Conclusions

The spatial variability of degradation processes (chlorination, carbonation, depassivation of steel reinforcing bars, etc.) has to be considered for structural inspection,diagnosis and maintenance. Indeed when the maintenance strategy is risk-based, which is a global trend nowadays, assessing the probability of depassivation over a global surface of a concrete wall or structure can help to define a portion of that surface presenting a substantial risk and then prescribe appropriate maintenance measures. The probabilistic assessment must be based on a more or less refined knowledge of the spatial correlation existing in concrete cover depth, concrete properties (for instance porosity) and state indicators (for instance saturation degree). Theoretical considerations where developed from decades to represent this spatial variabilitywithin the rational framework of the stochastic finite element method. The probabilistic assessment combines these stochastic methods with deterioration (carbonation) models to estimate failure risks. Carbonation models could take more or less complex analytical or numerical forms.

This paper estimated the capability of one-dimension analytical carbonation models to deal with spatial variability based on in-field data. The databasecontains some input and output model parameters determined from destructive testing on cores extracted from an enclosurewall. The correlation profiles of the carbonation depth either obtained from the measurements or computed thanks to the experimental input used in the models were established. Two normalized so-called correspondence indices were proposed based on: (i) the "distance" between profiles for perfect measurements, or (ii) the "overlapping" of simulated and experimental data for uncertain measurements.The correspondence index determined without accounting for uncertainties is not relevant in practice because itdoes not allow the models to be properly discriminated. Contrarily the correspondence index incorporating uncertainties reveals clearly the various capabilities of models to transfer the spatial variability from input to output, compared to the experimental one.It was found that some models are more or less appropriate to propagate spatial variability depending on the exposure conditions. However, it was not possible to establish a unique ranking from the existing database because carbonation processes were influenced by environmental conditions that differ for each side of the wall. It can be therefore concluded that the proposed methodology allows determining the capability of carbonation models to deal with uncertainties and spatial variability as a function of the exposure zone. More experimental data is required for generalization purposes.

Acknowledgement

Partners of the ANR EVADEOS project are warmly thanked for the data that have been acquired and shared out (CEA Saclay, IFSTTAR Nantes, LMA Univ. Aix-en-Provence, I2M Univ. Bordeaux, EDF Chatou, LMDC Univ. Toulouse, GeM Univ. Nantes).

Figure 1 :

 1 Figure 1: Investigated RC wall built in 1979

  uncertainties are described in European standard(AFNOR X07-040-3 2014):(i) type A: for a large number of repeated measurements, a statistical treatment allows to express the uncertainty as a function of the standard deviation; (ii) type B: when only few measurements are available (even only one) other ways can be alternatively employed for assessing the uncertainty in relationship with previous similar measurements, specificity of the device used, error determination of the device, etc.; (iii) combined: a possible combination of the two previous types of uncertainty; and (iv) expandedstandard uncertainties: a combined uncertainty weighted by a coefficient.Within this study, the experimental parameters affected by uncertainties are those measured once at different locations of the wall from extracted cores: porosity, saturation degreeand carbonation depth. Porosity and saturation degree are estimated as a function   core: as such, after complete drying and after complete saturation (mass measured in air or in water). The electronic balance has a known determination error m

Figure 2 :

 2 Figure 2: Sample function (a) and spatial correlation profiles (b) of measured saturation degree on the south face of the wall

.

  For each sample function the correlation profile is computed considering that a set of n r points among n is removed from the sample function. All possible sets of n r points are accounted for, and an average correlation profile is determined for the same sample function. Eq. [9] and [10] are then used to compute the mean n r points for all the sample functions. Experimental data are sample functions of 21 points, therefore the corresponding standard deviations of 79 points from an initial sample function of 100 points. The combined uncertainty on

  Measurements uncertainty was represented by uniform distributions centered at the measured (mean) values for each investigated point along the wall for the saturation degree and porosity: expansion was used to simulate 1,000 sample functions of these input parameters that were then used to compute sample functions of carbonation depth at t exp =35 yr.Similarly 1,000 sample functions of experimental carbonation depth were directly sampled according to a uniform distribution of x c ,

Figure 4 :

 4 Figure 3: Experimental correlation profiles and profiles obtained by the Hyvert model

Table 1 :

 1 Mean values of the measurements and related uncertaintiesof the saturation degreeS r , porosityΦand carbonation depth x c for the side A

	Abscissa(cm)	S r,m (%)	ΔS r (%)	Φ m (%)	ΔΦ (%) x c,m (cm) Δx c (cm)
	0	56.79	0.27	17.97	0.11	1.67	0.1
	16	63.7	0.22	18.64	0.1	1.87	0.1
	32	59.76	0.24	18.15	0.1	1.87	0.1
	48	60.53	0.24	19.07	0.1	1.95	0.1

Table 2 :

 2 Mean values of the measurements and related uncertainties of the saturation degree S r , porosity Φ and carbonation depth x c for the side C

	Abscissa (cm)	S r,m (%)	ΔS r (%)	 m (%)	Δ (%) x c,m (cm) Δx c (cm)
	0	51.68	0.29	17.64	0.11	2.37	0.1
	16	56.83	0.27	16.73	0.11	2.12	0.1
	32	54.65	0.27	16.89	0.11	2.32	0.1
	48	56.63	0.28	16.4	0.12	2.12	0.1
	64	52.09	0.26	17.84	0.1	2.5	0.1
	80	45.88	0.26	18.12	0.11	3	0.1
	96	55.68	0.28	17.63	0.11	2.32	0.1
	112	52.32	0.3	16.83	0.12	2.32	0.1
	128	52.22	0.26	17.96	0.1	2.4	0.1
	144	52.33	0.28	16.83	0.11	2.35	0.1
	160	47.77	0.3	17.68	0.11	2.1	0.1
	176	49.92	0.28	17.82	0.11	2.47	0.1
	192	52.85	0.27	17.5	0.11	2.22	0.1
	208	54.09	0.26	17.62	0.11	2.45	0.1
	224	57.31	0.26	16.48	0.11	2.42	0.1
	240	58.3	0.27	18.03	0.11	2.27	0.1
	256	51.25	0.26	17.65	0.1	2.12	0.1
	272	48.92	0.29	17.47	0.11	2.52	0.1
	288	39.52	0.35	17.92	0.11	2.52	0.1
	304	50.65	0.27	17.62	0.1	3.3	0.1
	320	52.43	0.28	17.01	0.11	2.8	0.1

Table 3 :

 3 Correspondence index for perfect measurement

	Carbonation model	SideA	Rank	SideC	Rank
	Hyvert(Hyvert et al.	0.9911	3	0.9935	2
	2010)
	Miragliotta(Miragliotta	0.9898	4	0.992	4
	2000)
	Ying-Yu(Ying-Yu and	0.9928	1	0.9939	1
	Qui-Dong 1987)
	Papadakis(Papadakis	0.9925	2	0.9929	3
	et al. 1991)
	5.2. Uncertain measurements

Table 4

 4 summarizes the ranking of the models according toI CM,mes andI CM,global . Not surprisingly the values of I CM,global , encompassing the effect of numerical inaccuracy in the computation of the correlation coefficients, are larger than those of I CM,mes . Both indices provide the same ranking for the models for side A. Nevertheless for the side C most part of correlation profiles obtained by models are negative whereas those deduced from carbonation depth measurement remain largely positive (Figures3 and 4). Excepting Ying-Yu (Ying-Yu and Qui-Dong 1987) model, all the values of I CM,mes andI CM,global were significantly reduced meaning that the models are less useful to represent the spatial variability of side C.In comparison with the I CM metric established without accounting for uncertainties (eq. [11]), it is forth noting that I CM,mes andI CM,global are more efficient metrics to discriminate models once uncertainties are accounted for.

Table 4 :

 4 Rank of the models according to I CM,mes and I CM,global

	Model	I CM,mes	Side A Rank I CM,global	Rank	I CM,mes	Rank	Side C I CM,global	Rank
	Hyvert(Hyvert et al. 2010)	0.5	1	0.74	1	0.25	3	0.67	1
	Papadakis(Papadakis et al. 1991)	0.36	3	0.69	3	0.26	2	0.49	4
	Ying-Yu(Ying-Yu and Qui-Dong 1987)	0.25	4	0.6	4	0.3	1	0.62	2
	Miragliotta(Miragliott a 2000)	0.5	2	0.72	2	0.23	4	0.57	3