come   L'archive ouverte pluridisciplinaire

Essence and Existence in Marius Victorinus and in Avicenna

It is well known that in general 1 , Marius Victorinus uses the term ex(s)istentia to translate the Greek huparxis (existence), substantia to translate ousia (substance), and subsistentia to translate hypostasis (subsistence). As far as the meaning of these terms is concerned, Victorinus declares that existentia is opposed to substantia in the way that pure Being (Greek einai, Latin esse)2, considered without its accidents, is opposed to a concrete existent (Greek on; Latin ens or, in Boethius, id quod est) once the latter has been determined by its substantial and accidental qualities or predicates3. Thus, Victorinus postulates a contrast between two kinds or rather states or stages of being: an initial state, represented by the simple, pure, indeterminate act of being, prior to any composition, and a subsequent stage in which being is compounded with qualities. At this (ontologically) posterior stage, we no longer have to do with pure Being as an indeterminate act that produces form: instead, being is henceforth being-something, (aliquid esse) 4 : a concrete substance 5 endowed with qualitative form. Whereas in its original, indeterminate state, Being or Existence is unknowable, being, or rather the existent qua substance is henceforth determinate and knowable6 .

According to Pierre Hadot, this doctrine presupposes a very specific metaphysical doctrine, according to which Being (existentia), as a pure act or subjectless verbal infinitive, starts out in a state of absolute universality and indeterminacy, then gradually determines itself by the addition of increasingly particular determinations or qualities. This doctrine, which has many parallels with that of such late Greek Neoplatonists as Damascius7, has its origin in the metaphysical speculation of the Neoplatonic philosopher Porphyry of Tyre 8 . Building on but adapting and reversing Aristotelian 9 and Stoic ideas 10 , Porphyry transformed the notion of huparxis from one that referred to predicates presently attributable to their subject, into a notion of Being or Existence as a kind of Platonic idea in which substances can participate. Existence thus becomes the transcendent principle of pre-existence -to einai monon, or rather to proon 11 -out of which substance is constituted 12 . Reduced to its absolute universality, simplicity, and universality, Porphyry henceforth views Being as a pure movement that generates form. The result of this process of assimilation and adaptation is thus the appearance, for the first time in the West, of the fundamental opposition between the verbal infinitive "Being" (Greek to einai), as an act without a subject, creative of form, and the neuter participle "existent" (to on), as the first substance that results from the process by which Being externalizes itself in the process designated as "life", only to be limited, determined and returned to its origin under the aegis of "thought".

Pierre Hadot found distinct similarities between the metaphysical scheme which he found in the Anonymous Commentary on the Parmenides and attributed to Porphyry, and the thought of Victorinus. Like the One for <Porphyry> in the In Parm., for Victorinus, God the Father is pure being (esse purum), indeterminate, unparticipated, and consequently unknowable by means of normal rational human thought 13 : Ante ὂν et ante λόγον vis et potentia exsistendi illa est quae significatur hoc verbo quod est esse, graece quod est τὸ εἶναι (...) Verum esse primum ita inparticipatum est, ut nec unum dici possit, nec solum, sed per praelationem, ante unum et ante solum, ultra simplicitatem, praeexsistentiam potius quam exsistentiam, universalium omnium universale, infinitum, interminatum, sed aliis omnibus, non sibi, et idcirco sine forma; intellectu quodam auditur et praeintellegentia potius quam intellegentia accipitur, cognoscitur, creditur.

10 Hadot (Porphyre) emphasized the importance for Porphyry's thought of what he called the Neoplatonization of Stoicism, which entailed adopting and adapting several Stoic doctrines (of the pneuma, vital tension, doctrine of types of mixture, etc.) while rejecting their materialism. Recently, Chiaradonna ("Nota"; "Causalité", "Logica e teologia") has endorsed Hadot's findings with regard to the adaptation of Stoicism by the author of the Anon. In Parm. (with some divergences), but in my opinion this eminent expert on Neoplatonism goes too far when he interprets the teachings of the Anonymous Commentary on the Parmenides as nothing but a Porphyrian adaptation of the Stoic doctrine of the lekton, perhaps inspired by Porphyry's teacher Longinus, combined with Aristotelian doctrines of essential predication. For Chiaradonna, the Anon. In Parm. would thus anything like the distinction between essence and existence, which, he asserts, does not appear in Western thought until much later. I hope to provide an in-depth analysis of Chiaradonna's important publications in forthcoming work. 11 Victorinus,Ad Cand. 14,23;15,2. Cf. Hadot,Porphyre,I,[208][209]In Parm.,X,[25][26] ἀλλὰ καὶ τοῦ εἶναι καὶ τοῦ ἔστιν ἐξήλλακται αὐτοῦ τὸ προούσιον• The rare term proousion is unattested prior to Porphyry, but its occurrence in Synesius (Hymn I, 222) and Didymus (De Trinitate, 4, 8, 2 implies a Porphyrian source. On Bechtle's view of the occurrence of the term proousion in the Anon. In Parm. as "preparing Plotinus' way of expressing himself" -even though the term does not occur in Plotinus -cf. Leinkauf, "Bestimmung", 75. n. 48. 12 Hadot, Porphyre, I, 489. 13 Victorinus, Ar., IV, 19, 4-20. Cf. Němec, "Theorie", 198. As pure Being, God is bereft of form, and must be described by a radically negative theology. Unintelligible, infinite, invisible, inconceivable, and unsubstantial, God is the non-existent above the existent14 : Necessario per praelationem et per eminentiam τῶν ὄντων deum dicemus supra omnem exsistentiam, supra omnem vitam, supra omnem cognoscentiam, supra omne ὂν et ὄντως ὄντα, quippe inintellegibile, infinitum, invisibile, sine intellectu, insubstantiale, incognoscibile, et quod super omnia, nihil de his quae sunt, et quoniam supra quae sunt, nihil ex his quae sunt. Μὴ ὂν ergo deus est (...) istud τὸ μὴ ὂν super τὸ ὂν est 15 .

God is, therefore, understandable only in ignorance (sed ut in ignoratione intellegibile, ibid. 14, 2-3). The parallels16 to this doctrinal formulation, both in the works by Porphyry universally recognized as authentic17, in doctrines attributed to him18, and in the Commentary on the Parmenides19, are striking indeed. In the latter work, the mode of supra-rational cognition by which alone the First Principle can be known corresponds to the mode by which the First itself "knows" all things: it is a "knowledge outside of knowledge and ignorance", from which knowledge derives20 .

In contrast, for Victorinus Christ the Son, like the Second One of the Parmenides according to Porphyry, is the existent or the first substance, who receives his being from the pre-existent Father21 .

It was thus, Hadot claims, in Porphyry and his Latin adaptation by Marius Victorinus that, for the first time in Western history, being as an infinitive was distinguished from being as a participle: in other words, between essence, or what a thing is, and existence, or the fact that it is 22 . The distinction was known to Boethius, in whom it appears as the contrast between esse and quod est 23 . It was Boethius, in turn, who transmitted to medieval Western thought this distinction between Being (esse), conceived as pure action transcending all form, and the existent (ens/quod est) as the concrete substance or subject endowed with a determinate form 24 . Finally, it was probably from Boethius and the centuries-long history of the adaptations of his doctrine in medieval Scholasticism that Heidegger derived his doctrine of the ontological difference 25 .

Hadot's own views on this subject underwent a certain evolution. In 1963, he thought that this distinction between Being as pure act and being as concrete determinate substance, originating in Porphyry's interpretation of the first two hypotheses of the Parmenides and adapted to Christianity by Marius Victorinus and by Boethius, laid the foundations for the distinction in Western thought between Existence and the existent. By the time of the publication of his magnum opus Porphyre et Victorinus in 1968, however, Hadot affirmed that Porphyry's doctrine does not imply a difference 22 Pierre Hadot, "L'Être et l'Étant dans le néoplatonisme", in P. Hadot, Plotin, Porphyre. Etudes néoplatoniciennes (Paris: Les Belles Lettres, 1999), 71-88; cf. Němec, "Theorie", 187. Cooper, "Marius Victorinus", 548, speaks of this opposition as having its roots in Plotinus, but he quotes no Plotinian examples. To be sure, several contemporary scholars (Gerson, Corrigan) have interpreted Plotinus as maintaining a distinction between essence and existence, but this interpretation, based inter alia on the inadmissible translation of hypostasis by "existence", has been persuasively refuted by Riccardo Chiaradonna, "Neoplatonismo e atto d'essere: a margine dell'interpretazione di Cornelio Fabro", in A. Acerbi (ed.), Crisi e destino della filosofia. Studi su Cornelio Fabro (Roma 2012) 123-138. For her part, Karfíková ("Victorinus (Marius-)", 162) rightly includes this doctrine of the difference between the existent (on) and being (einai) among those which are absent in Plotinus but present in Victorinus. Taken together, the ensemble of such doctrines (on which cf. Němec, "Theorie", 187) -Plotinus, unlike Victorinus, establishes a subordination between One and Intellect; he never identifies the One with the first member of the triad of being-life-thought; he does not use the technical term huparxis to designate the first member of this triad; he does not teach the pre-existence of intelligible forms within the One; and, perhaps most crucially for our present purposes, he does not identify the One with being -seems to me to rule out Plotinus an important direct source for Victorinus, pace Cooper. It is worth noting that all these non-Plotinian themes, typical of the thought of Victorinus, also characterize the metaphysics of Porphyry as reconstructed by Hadot. 23 Boeth., De hebdomadibus 2-4 Stewart-Rand. Cf. ibid. 28-30: diversum est esse et id quod est. ipsum enim esse nondum est, et vero quod accepta essendi forma est atque consistit. Cf., with Hadot 1968, 1, 491, n. 4, Damascius, De princ., p. 312, 19-20 Ruelle: τὸ πάντων ἐπέκεινα προϋποκείμενον ἕν [...] οὔπω δὲ οὐσία. 24 Hadot, "La distinction", 153. 25 In the context of a rich study of Heidegger's interpretation of medieval philosophy, Pasquale Porro ("Heidegger, la filosofia medievale, la medievistica contemporanea", Quaestio I (2001), 431-462, at 435) describes Thomas Aquinas' goal in emphasizing the distinction between essence and existence as that of marking the difference between, on the one hand, what possesses a formal determination (sc. all entities other than God) and God, i.e. that which is pure being without form, a being which cannot be objectified and therefore cannot be thought on the basis of an essence distinct from it, whether such an essence be conceived as formal or objective content, quiddity, or "coseità". On the ontological difference in Avicenna as between God as the uncaused principle and the world as caused, cf. Lizzini, "Ibn Sina's Metaphysics". between essence and existence 26 . Instead, the difference between Being (to einai) and the existent (to on) amounts to that between the indeterminate and the determinate: whereas Being is pure activity, absolute, unlimited, unrelated to and incommensurable with anything else, the existent (to on) is merely Being that has been rendered concrete, particular and determinate by its assumption of qualitative attributes. This is what allows the author of the Anonymous Commentary on the Parmenides to speak of Being (to einai) as "like the idea of the existent'' (idea tou ontos) 27 . Being (to einai) is a pure, subject-less action or movement that generates form, while the existent (to on) is the first substance, a subject henceforth endowed with form 28 . As we have seen, moreover, since Being, bereft of form or attributes, it is unknowable, at least by any kind of rational human cognition. Thus, we have here the origin of what Hadot has termed the "negative theology of Being" 29 .

Yet to what extent might it be legitimate to pursue Hadot's earlier intuition, that is, that the distinction found in Porphyry, Victorinus and Boethius between Being (to einai, esse) and the existent (to on, ens, id quod est) is indeed analogous to the Avicennan distinction between essence and existence, which was so influential on Western Scholastic thought? As we shall se, it seems hard to deny that there is some analogy between these two complexes of ideas, which helps to explain why the young Thomas Aquinas made such abundant use of the Latin version of Avicenna's Metaphysics of the Healing in his commentaries on Boethius' Theological Tractates 30 .

Essence and existence in Avicenna

The doctrine of the distinction between essence and existence 31 in Avicenna is notoriously complex and controversial, so much so that leading modern 26 Hadot Porphyre, I, 490; "L'Être et l'Étant", 80. 27 <Porphyry>, In Parm., 12, 31-33: ...τοῦ ὄντος τοῦ ἐπέκεινα ἑνὸς τοῦ εἶναι ὄντος τὸ ἀπόλυτον καὶ ὥσπερ ἰδέα τοῦ ὄντος. On the importance of this qualifying hôsper as neutralizing K. Corrigan's contention that the Anon. In Parm. contradicts Porphyry's elsewhere attested view that the intelligible cannot participate in anything, cf. Chiaradonna, "Nota", 87-88 n. 2; "Causalité", 78-79. 28 Hadot "L'Être et l'Étant". In the words of G. Huber (Das Sein und das Absolute. Studien zur Geschichte der ontologischen Problematik in der spätantiken Philosophie [Basel 1955], 114), for Victorinus "das formlose Sein erzeught erst das formhaft Seiende". 29 Hadot "L'Être et l'Étant", 80. 30 Cf. R. E. Houser, "Avicenna and Aquinas: essence, existence and the esse of Christ", The Saint Anselm Journal 9.1 (2013). 31 Not unlike Victorinus, Avicenna's terminology sometimes fluctuates and may have undergone some evolution throughout his intellectual career. In general, the Avicennan terms designating being or existence are anniyya and wujūd, but one sometimes also finds huwiyya or aysa. Essence or quiddity, for their part, are referred to as ḏāt, māhiyya, šayʾiyya, ṭabīʿa, or haqīqa, cf. Lizzini, "Ibn Sina's Metaphysics". Each of these terms possesses its own nuances. Confusingly, Avicenna can also refer to a thing's essence as its "proper existence" (al-wujūd al-ḫāṣṣ), cf. Amos Bertolacci, "The Distinction of Essence and Existence in Avicenna's Metaphysics: The Text and Its Context", in F. Opwis & D. Reisman, eds., Islamic Philosophy, Science, Culture and Religion. Studies in honor of Dimitri Gutas (Leiden etc.: Brill, 2012), 257-288.

commentators have proposed a variety of mutually exclusive interpretations of it 32 . The following sketch will therefore be necessarily inadequate, but I hope will not be misleading. I will base my exposition on Avicenna's own account in section 8.4 of the Metaphysics (Ilāhiyāt) of the Šifāʾ 33 .

For Avicenna, God or the First (al-awwal) has no quiddity or essence (māhiyya) other than being (al-anniya) 34 . Avicenna adds that he has explained how essence differs from anniyya "at the beginning of our present exposition", although modern interpreters do not all agree on what he means 35 . At any rate, God as the Necessarily Existent (al-wājib al-wujūd) cannot be compound, as He would be if made up of a quiddity or essence (māhiyya) and existence (wujūd). The Necessarily Existent has no other essence than the fact that He is necessarily existent, and this is being (alanniya) 36 . 32 Cf. Olga Lizzini, "Wuǧūd-Mawǧūd/Existence-Existent in Avicenna. A Key Ontological Notion of Arabic Philosophy", Quaestio 3 ( 2003), 111-138, at 122, with further literature, who discusses current interpretations that range from a "logical-conceptual" to a "real" interpretation of the essence-existence distinction; Bertolacci, "The Distinction", 258-260. I will argue that at least in some passages, such as the one cited below from the Notes on the Theology of Aristotle, Avicenna seems clearly to propound a realist doctrine of the ontological priority of essence to existence. 33 For a full exposition of this doctrine in all its subtleties, the reader is referred to the masterful expositions of Olga Lizzini ("Wuǧūd-Mawǧūd"; "Ibn Sina's Metaphysics") and Amos Bertolacci ("The Distinction; id., "A Hidden Hapax Legomenon in Avicenna's metaphysics: considerations on the use of Avicenna goes on to assert that everything that has an essence other than being (anniyya) is caused, because being (anniyya) and existence (wujūd) are not like necessary concomitants to the essence. All that has an essence is caused, and this includes everything other than the Necessarily Existent. In other words, only contingent beings have a essence. The First Principle has no essence 37 , but existence flows from him upon beings that do have an essence 38 . The First can be designated as absolute existence, on condition that non-existence and other attributes are denied of Him 39 . Immediately afterwards, Avicenna clarifies that he does not mean that the First is participable absolute existence 40 ; instead, what he means is that the First is an existent on condition that no composition is added to Him. In other words, the First is not a universal, for a universal is shared by everything, whereas the First is not attributed to what is susceptible of addition, that is, everything other than He. Furthermore, the First's lack of an essence entails that He has no genus: if He did, the genus would be a part of Him, and He would be composite. He also has no specific difference, and His lack of genus and specific difference entails, of course, that he has no definition. There can therefore be no demonstration of him, nor does He have a cause or a "why". Finally, the First, is not a substance (jawhar) 41 .

It certainly seems hard to deny that in this section of the Metaphysics of the Šifāʾ, we find many themes that are highly analogous to several of those we found in Marius Victorinus. These include the ideas that God or the First Principle is One and alone 42 , that He is simple, that he is identical with his essence 43 , that he has no essence, 37 On passages in Avicenna implying that the First has no essence at all, cf. Bertolacci "Distinction", 276 & n. 26. 38 Note that at least in this passage, there is the clear implication that sheer essences exist (presumably in the mind of God), independent of and prior to existence. It therefore provides grist for the mill of those who interpret Avicenna's distinction between essence and existence from a realist or ontological perspective (cf. Sarah Pessin, "Proclean 'remaining' and Avicenna on existence as accident. Neoplatonic methodology and a defense of pre-existing essences", in J. Inglis, ed., Medieval Philosophy and the Classical Tradition in Islam, Judaism and Christianity, [London 2002]), rather than one that is primarily logical or conceptual (Bertolacci, Lizzini). 39 Avicenna, Ilāh. 8.4, p. 347, 10: Fa-huwa mujarrad al-wujūd bi-šarṭ salb al-ʿadam wa-sāʾir al-awṣāf ʿanhū. Translations: "Esso è, infatti, puramente esistente a condizione che se ne neghino l'inesistenza e tutte le alte descrizioni" (Lizzini); "Il est l'existence pure avec condition de nier de lui le non-existant et les autres qualifications" (Anawati); "He is pure existence with the condition of negating privation and all other description of Him" (Marmura). 40 Compare Marius Victorinus' insistence that the Father is inparticipatum (one of Victorinus' many uses of a Latin hapax). 41 Avicenna, Ilāh. 8, 4, p 348, 7ff. Cf. Bertolacci, "Distinction", 279 n. 29. 42 On God as unum et solum, cf. Victorinus, Cand. I.3.15-17. On the One as purely one, without existence, substance or knowledge: Ar. 1B.49.7-19; cf. Cooper "Marius Victorinus", 546. 43 For Avicenna, only in the case of God does existence coincide with essence (Lizzini, "Wuǧūd-Mawǧūd, 115). For Victorinus, in divine realities the quod est esse (pertaining to substance) differs from the quod est ita esse (pertaining to qualities, which is characteristic of the perceptual world); but the two are united in the case of divine, eternal realities (Ar. 3.1.20-24; cf. Cooper "Marius Victorinus", 548). As Pierre Hadot pointed out ("La distinction", 152-153), we find an analogous doctrine in Boethius, for whom Being (esse) and the existent (id quod est) coincide in the First Principle: cf. De hebd. 45-48: omne simplex esse suum et genus, difference or definition, and is therefore unknowable, and that he is not a substance. Perhaps the most striking common feature Avicenna shares with Marius Victorinus is the designation of the First Principle as being (anniyya). This term, which goes back to al-Kind and the Neoplatonica Arabica 44 that arose under his supervision in the second quarter of the 9th century CE, is of disputed etymology, but it is generally translated as "being", "proper being" or "existence" 45 . Scholars have already drawn attention to the similarity between the use of the term anniyya to designate God or the First principle in the Neoplatonica Arabica and use of the Greek verbal infinitive einai to designate the One in the Anonymous Commentary on the Parmenides, attributed to Porphyry 46 : indeed, this resemblance constitutes one of the main grounds for supposing that, as the incipit of the Theology of Aristotle indicates, Porphyry may have played a role in the elaboration of the Greek original of this pseudepigraphic work.

The problem of avenues of transmission

How, then are we to explain these apparent similarities between, on the one hand, the metaphysics of Avicenna and certain metaphysical themes attested in the Neoplatonica Arabica, and, on the other, some doctrines of the theological writings of Marius Victorinus and Boethius? Clearly, there can be no question of direct influence: Avicenna certainly knew no Latin, and it is highly unlikely that either Boethius of Marius Victorinus was ever translated into Latin.

One could envisage several hypotheses. First, as far as the distinction between essence and existence is concerned, we might have to do with completely independent developments of philosophical themes already present in Aristotle. Aristotle's famous enumeration of four methodological questions in Book Two of the Posterior Analytics 47 presuppose a distinction between whether a thing exists (to hoti) and what a thing is (ti estin): perhaps both the Latin and the Arabic tradition independently developed this distinction into one between existence and essence respectively. Plausible as such an explanation may be, however, it fails to account for the other analogous features present in Arabic-language philosophical thought and in the theological speculations of Boethius and Marius Victorinus. There are many of these: to limit ourselves to features shared by the Theology of Aristotle (ThA) and the theological works of Marius Victorinus, one might mention:

1. The idea the time is only introduced, in the description of suprasensible realities, to facilitate human understanding: Victorinus, Adv. Ar., IV, 5, 26-48; IV, 21, 16-17; Ad Cand. 21, 2. Cf. ThA p. 27-28 Badawi: "The ancients were obliged to mention time at the beginning of creation since they wanted a description of the generation of things, and were obliged to introduce time into their description of generation and into their description of creation, which did not take place in time at all."

Compare Porphyry, according to Šahrast n 48 : "And he [sc. Porphyry] claimed that the statement attributed to Plato concerning the world's coming into being is not correct. He said in his Letter to Anebo: what separates Plato from you, viz. that he 47 Aristotle, Posterior Analytics 2, 1, 89b23-25, translation Barnes: "The things we seek are equal in number to those we understand. We seek four things: the fact, the reason why, if something is, what something is" (Τὰ ζητούμενά ἐστιν ἴσα τὸν ἀριθμὸν ὅσαπερ ἐπιστάμεθα. ζητοῦμεν δὲ τέτταρα, τὸ ὅτι, τὸ διότι, εἰ ἔστι, τί ἐστιν). 48 Porphyry, fr. 459, p. 529-351 Smith ap. al-Šahrast n , Book of Religions and sects, in D. Gimaret, G. Monnot, and J. Jolivet, Shahrastānī, i re des religions et des sectes. 2 vols (Louvain 1986-1993), vol. II, p. 357-358. gives the world a temporal beginning, is a mendacious assertion. This is because Plato did not think that the world has a temporal origination, but an origination with regard to a cause".

2. The First One remains immobile, and exerts no activity in order to engender the second Principle. With Victorinus Adv. Ar. I, 33; I, 51, 11f.; I, 52, 20f., cf. Sayings of the Greek Sage, p. 184, 10 f. Badawi = Philosophy Reader 32, p. 94, 7 Wakelnig: "The first agent must be at rest and unmoved" (wa-yanbaġī li-l-fāʿil al-awwal an yakūna sākinun ġayr mutaḥarrakun); Miskawayh, al-Fawz al-aṡġar, I, 8, p. 54, 3 Uḍayma: "we say that He is unmoved " (naqūlū annahū lā bi-mutaḥarrakin).

3. The need for divine ignorance as higher cognitive faculty in order to know God: with Victorinus Adv. Ar. IV, 19, 15-16 cf. ThA p. 9, 8; 37, 2-4 Badawi, which speaks of "an ignorance more noble than knowledge" (bi-jahlin ašraf min al-ʿilm). The author declares that God can only be known by a kind of "intellectual imagination"; cf below. Compare the Porphyrian texts cited above, n. 00.

4. The First Principle has no attributes: with Victorinus, Ad. Ar., IV, 19, 10, cf. ThA p. 62, 3-6 Badawi: "As for the first maker, He makes a thing without any attribute, for there is no attribute within Him at all, but he makes <things> by his essence". Cf. Sayings of the Greek Sage 6, p. 184 Rosenthal: "there is no attribute at all in Him" (laysa fīhī šayʾun min al-ṣifāt).

5. There is no distinction between essence and existence in the higher world. We saw above that for Marius Victorinus, Boethius and Avicenna, essence coincides with existence in divinis. Similarly, the author of the Theology of Aristotle (p. 69f. Badawi) explains that the separation between the what-it-is and the that-it-is applies only to natural things; but in the case of things whose goal is originated simultaneously with their existence, as is the case for things originated without time, there can be no separation between the that-it-is and the what-it-is. When a thing's origination is simultaneous with its achievement of its goal, one knows "why it is" by knowing "what it is": "If here in the lower world 'what a thing is' and 'why it is' are found to be identical, all the more so is this necessary in intellectual things, I mean 'what it is' and 'why it is' are identical". Human beings, the author goes on to affirm, can perceive this state of affairs, in which the world is whole and causes are simultaneous with their effects, by an act of intellectual imagination (tawahhum ʿaqlī) 49 . 49 It is true that in this passage, the author of the ThA builds on the doctrine of Plotinus VI 7, on which cf. Chiaradonna "Causalité". But the author expands upon Plotinus by adding elements extraneous to him, such as the doctrine of intelligible imagination. I have discussed parallels between Porphyry and the Theology of Aristotle in Chase, "Porphyry and the Theology of Aristotle". On the idea that the Highest principle is absolute knowledge, for instance: with <Porphyry>, In Parm., V, 34; VI, 4-12 Hadot, cf. Sayings of the Greek Sage fr. A, 6, p. 484 Rosenthal = Wakelnig, Philosophy Reader §36, p. 98: "(He) is the pure, ultimate knowledge that contains every knowledge (li-annahū huwa al-ʿilm al-maḥḍ al-aqsā al-muḥīṭ bi-kull ʿilm), and the cause of <all> sciences" (wa-ʿilla al-ʿulūm). On the appearance of this theme in the <Porphyry>, In Parm., and the fact that, As we have seen, however, the most striking common feature shared by Avicenna, the Neoplatonica Arabica, Marius Victorinus and Boethius is no doubt the description of the First Principle as being (Greek einai, Latin esse, Arabic anniyya). Like <Porphyry's> Commentary on the Parmenides, but unlike Plotinus, the Theology of Aristotle describes this principle as "the first, true Being" (al-anniya al-ūlā al-ḥaqq, p. 26 Badawi), or "the first Being (al-anniya al-ūlā, ibid., p. 51, 8; 87, 10; 113, 14 B). The First is also designated as "simple Being" (anniyya faqaṭ) in the Book of the Pure Good = Liber De Causis 8[9] p. 79.1 Bardenhewer, as well as in the Sayings of the Greek Sage (p. 185, 5 Badawi) 50 . In his Muqābasāt, which reports on philosophical discussions current at the Būyid court at Baghd d in the 10th century CE, where the philosophical koinê of the Neoplatonica Arabica formed the basis for theological speculation, both Christian and Islamic 51 , al-Tawḥid reports a series of definitions he had read in books and heard from the mouths of sages. One of these reads as follows 52 :

It was asked, What is the first cause (yuqāl mā al-ʿilla al-ūlā)? The answer <is> that it is the Originator of the all (al-jawāb mubdiʿ al-kull), the Perfector of all (mutammim al-kull) unmoved (ġayr mutaḥarrik) and again, pure being (wa-ayḍan anniyya faqaṭ), and again, pure good (wa-ayḍan ḫayr maḥḍ).

So striking and numerous are these resemblances, I would argue, that one could almost speak of a "philosophical koinê", or complex of shared ideas, common to Marius Victorinus, Boethius, the Neoplatonica Arabica and Avicenna. Yet how can we explain the origin of this koinê, which presupposes the circulation of ideas among Greek, Latin and Arabic sources?

A possible solution: the role of Porphyry

In a nutshell, the answer may be Porphyry. We have seen that Pierre Hadot has maintained that Porphyry, the probable author of the Anonymous Commentary on contrary to what some critics have maintained, it does not contradict the doctrine of Plotinus, cf. Chiaradonna "Causalité", 78-79. 50 The author of the ThA also has no hesitation in referring to God as the First Cause (al-ʿilla al-ūlā ThA p. 6, 7; 34; 37, 7.18; 51, 7.8; 87, 4; 89, 10.11 Badawi), or even the "cause of causes" (al-ʿilla al-ʿilal ThA 6, 8; 156, 20; 157, 1; 161, 9; 172, 12; 177, 16), while the Greek Sage ( §41, p. 106, 20-21 Wakelnig) refers to it as "pure cause" (ʿilla maḥḍ) or "simple cause" (ʿilla faqaṭ). In contrast, Plotinus is extremely reticent to ascribe causality to the First; cf. Chiaradonna "Causalité", 68-69. 51 Christian, as in the thought of Yaḥy ibn Ad (c. the Parmenides, is likely to be at least one main source of the complex of ideas concerning the distinction between essence and existence in Marius Victorinus and in Boethius. But as I have argued elsewhere 53 , Porphyry is also likely to be at the origin of the Neoplatonic Arabica, or at least of Theology of Aristotle. Indeed, the incipit of this work presents it as a "commentary by Porphyry", and Porphyry himself tells us (Life of Plotinus, ch. 26.) that he added commentaries on some of the Enneads to his edition of his teacher's masterwork. I have suggested that the ThA's considerable divergences from Plotinus may be due to the fact that the Arabic translator of the Enneads was working from a manuscript that contained the text of Plotinus in the middle, surrounded, as was customary in Late Antiquity, by scholia, in this case originating from Porphyry. The translator thus reproduced both Plotinus' text and Porphyry' scholia, without being particularly concerned to distinguish them.

This hypothesis may at least partially explain the presence of Porphyrian themes in the Neoplatonica Arabica. But what of Avicenna?

The influence of the Neoplatonica Arabica on Avicenna is a subject that is still in its infancy 54 . What is certain, however, is that at some point in his intellectual career Avicenna produced an important work known as the Notes on the Theology of Aristotle 55 . This under-studied work shows Avicenna struggling with distinctly Neoplatonic ideas which the text ascribed to Aristotle: he rejects some but adopts many others 56 , and one of these notions he takes over from the Theology of Aristotle may well be the famous distinction between essence and existence 57 . In one of Avicenna's Notes, we find the following passage, which discusses the duality that arises when the Intellect emanates forth (yaṣduru ʿanhā) from the First Principle:

We say: there is no composition in essence from the viewpoint of the two relations 58 , so that it is not originated insofar as it is an essence (fa-naqūl inna al-māhiyya lā tarkīb fīhī min jihati al-nisbatīna fainnahā laysat mubdaʿa min ḥayṯu hiya māhiyya), but insofar as existence is combined with it (bal min ḥayṯu maqrūn bi-hā al-wujūd), and when the essence turns to it insofar as it is essence, it is not a 53 Chase, "Porphyry and the Theology of Aristotle". 54 Cf. Cristina D'Ancona, "Avicenna and the Liber de Causis. A contribution to the dossier", Revista Español de Filosofía Medieval 7 (2000): 95-114; eadem, "The Timaeus model for Creation and Providence. An example of continuity and adaptation in early Arabic philosophical literature ", in G. J. Reydams-Schils, ed., Plato's Timaeus as a Cultural Icon (Notre Dame/ University of Notre Dame Press 2003), 206-237. 55 Ed. 'Abdurraḥm n Badaw , Arisṭū 'inda-l-'Arab (Cairo 1947, many reprints); French translation Georges Vajda, "Notes d'Avicenne sur la Théologie d'Aristote", Revue Thomiste, 51 (1951), 346-406. 1951. A team at the CNRS Centre Jean Pépin, consisting of M. Geoffroy †, M. Sebti, J. Janssens and myself, is currently working on a badly-needed new critical edition with French translation of this work. 56 Among the ideas he rejects is the pre-existence of the soul. Here, Avicenna suspects the text of the " has been tampered with. 57 For a discussion of this passage cf. Lizzini, "Wuǧūd-Mawǧūd", 121-122. Bertolacci makes no mention of Avicenna's Notes on the Theology in his two recent articles ("Distinction", " Hapax Legomenon") dedicated to the Avicenna's distinction between essence and existence. My translation of the passage is extremely tentative, based as it is on Badawi's inadequate edition. 58 I.e., between essence and existence. combination of essence and existence from the first was necessary by it ? (fa-laysat al-māhiyya iḏā iltafat ilayhā min ḥayṯu hiya māhiyya majmūʿ māhiyyatin wa-wujūdin min al-awwal bi-hī wajabat), but existence is related to it like a thing that occurs to it (bal al-wujūd muḍāf ilayhā ka-šayʾ ṭāriʾ ʿalayhā).

We have here, in the context of a commentary on the Neoplatonically-inspired Theology of Aristotle, a statement of Avicenna's doctrine, not only of the distinction between essence and existence 59 , but of the accidentally of existence, which is described as something that accrues or occurs later to essence. This doctrinal element, which seems to envisage a set of pre-existence essences upon which existence is subsequently conferred, is highly embarrassing for those who wish to interpret Avicenna as a dyed-in-the-wool Aristotelian averse to all that smacks of "mysticism". To make matters worse, at the end of this crucial passage Avicenna informed the reader that he has already explained the relation between essence and existence in detail in his "Oriental Wisdom" 60 , a work which has been, and continues to be, the subject of fierce debate between those who understand Avicenna as, to some extent and in contexts, a mystic and a Sufi, and those who understand him as a hard-head Aristotelian who would feel quite at home in any modern analyticallyoriented Philosophy Department 61 .

Let me be clear about precisely what it is I am proposing. It is emphatically not my suggestion that Avicenna merely took over his doctrine of the distinction between existence and essence lock, stock and barrel from works belonging to the complex of works known as the Neoplatonica Arabica, works which, I believe, can be shown to contain a high degree of Porphyrian influence. There is no trace in Avicenna of the scheme we have identified, following Pierre Hadot, in the metaphysical theology of <Porphyry's> Commentary on the Parmenides and Marius Victorinus' Theological Treatises, according to which an initially indeterminate Being or Existence externalizes itself in a stage corresponding to Life, only to return to itself, henceforth endowed with self-consciousness, in a stage identified with the Intellect, resulting the determination of Being into substance or the existent, henceforth delimited, endowed with qualities that can be predicated of it, and thus knowable. Nor is this surprising: Avicenna was much too great a philosopher to slavishly copy any 59 It is important to note that whereas, according to Badawi's edition, this passage occurs in that part of Avicenna's treatise that comments on Maymar 5 of the ThA, it is in fact far from clear which passage from the ThA Avicenna is actually referring to and/or inspired by. Did he have access to a version of the ThA containing passages that are absent from the current edition as edited by Badawi? Cf. Amos Bertolacci, The Reception of Aristotle's Metaphysics in A icenna's Kitāb al-Šifā' (Leiden 2006), 49. Further work on the critical edition of Avicenna's Notes, in conjunction with the new critical edition of the ThA announced by Cristina D'Ancona, will be required to shed light on this subject. 60 fa-qad šuriha fī al-Ḥikma al-Mašriqiyya, p. 61, 24 Badawi. 61 For a fair-minded survey of the issues, cf. Jules Janssens, "Ibn S n . A Philosophical Mysticism or a Philosophy of Mysticism?", in Mediterranea. International Journal for the Transfer of Knowledge, 1 (2016), 37-55. 2016. The extreme terms of the interpretations of Avicenna range from Henry Corbin's characterization of his thought as fundamentally mystical, to Dmitri Gutas' portrayal of him as a rationalist. philosophical doctrine from the many various sources he encountered in the course of his vast reading. Instead, my claim is much more modest. I suggest that may be that Avicenna encountered materials in the Neoplatonic Arabica, some of which may have been of Porphyrian origin, which contained some form of the existence-essence distinction. These materials served as the starting-point for Avicenna's developments of his own complex doctrine of the distinction between essence and existence, which mobilizes elements, such as the relationship between necessity and contingency, of which there is, so far as we know, no trace in the philosophical doctrines attributable to Porphyry. It is in fact quite conceivable that Avicenna developed his own doctrine of essence and existence, at least in part, in reaction to, rather than in imitation of, Porphyrian material that he may have found circulating in the school of Ibn Ad , a Christian of Neoplatonic tendencies whose indebtedness to Porphryian philosophical doctrines is only now beginning to become apparent 62 .

The advantage of this hypothesis set forth here is that it may help to explain how an apparently similar doctrine -that of the differentiation between essence and existence -appears in such widely different linguistic, historical and cultural contexts as late 3rd-century Greek Neoplatonism (Porphyry), 4th and 6th century Latin Church Fathers (Marius Victorinus, Boethius), 9th century Arabic apocrypha (the Neoplatonica Arabica), and the early 11th century Islamic philosopher Avicenna. The defect of my hypothesis is, of course, that it is deeply speculative and probably unprovable, not unlike Pierre Hadot's attribution of the Anonymous Commentary on the Parmenides to Porphyry, and his concomitant claim of wide-ranging Porphryian influence on the theological thought of Marius Victorinus. But to classify a hypothesis as speculative is not equivalent to proving it to be wrong: in the study of ancient philosophy and theology, where such a huge percentage of original works have disappeared without a trace, there is, in my view, no place for dogmatic positivism, and it remains true, even more so that in the other fields of the humanities, that absence of evidence is not evidence of absence. Certainty in such matters is forever unattainable: the best we can ever hope for is plausibility and the cumulatively increasing confirmation or disconfirmation of a given hypothesis. In the present instance, this goal can, I believe, be achieved, or at least approximated, by continued work on the edition, translation and commentary of Arabic works that contained echoes of Neoplatonic doctrines, first and foremost among which are the Neoplatonica Arabica and Avicenna's Notes on the Theology of Aristotle.

  Anniyya and Ayyiyya in the Ilāhiyyāt of the Kitāb al-Šifāʾ", in A.M.I. van Oppenraay et al., eds., The Letter before the Spirit. The Importance of Text Editions for the Study of the Reception of Aristotle (Leiden etc.: Brill, 2012) 289-309.), with exhaustive references to previous literature. For the text from Ilāh. 8.4 cf. Bertolacci, "Hapax Legomenon", 296. 34 Avicenna, al-Šifāʾ, al-ilāhiyyāt, ed. M. . Mūs , S. Suny , S. yid (Cairo: al-Hay a al-mma li-u ūn alma bi al-am riyya, 1960), 8.4, p. 344, 10f.: wa-naʿūd fa-naqūl: inna al-awwal lā māhiyya lahū ġayr alanniya. Some translations: "Il primo non ha une quiddità che sia diversa dal suo proprio essere" (Lizzini in A icenna Ibn Sīnā , Meta sica. a scien a delle cose di ine al-ilāhiyyāt dal ibro della uarigione Kitāb al-Šifāʾ), a cura di O. Lizzini e P.Porro (Milano: Bompiani, 2002), who notes (p. 1214 n. 110) that the meaning of this term oscillates between "existence" and "particular essence"); "Le premier n'a pas de quiddité que al-anniyya" (Anawati in A icenne, a métaphysique du Shifāʾ. Livres de VI à X.Traduction, notes et commentaires par G.C. Anawati (Paris: Vrin, 1985); "The First has no quiddity other than his individual existence" (Michael A. Marmura, The metaphysics of "The healing": a parallel English-Arabic text = aš-Šifā': al-Ilāhiyyāt [Provo, Utah: Brigham Young University Press, 2005]); "The First has no quiddity other than existence" (Bertolacci, "Hapax Legomenon", 296).35 For Anawati and Lizzini, the reference is Ilāh. I.5; but Marmura thinks the reference is to the Avicenna's paraphrase of the Isagoge of the Šifāʾ. Bertolacci ("Distinction", 283 & n. 43) argues that both interpretations are possible, pointing out that in his paraphrase of the Isagoge(Madḫal I, 5, p. 29, 11-13), Avicenna opposes quiddity to "individual thatness" (anniyya šaḫsiyyya) as the concrete existence of the individual.36 Avicenna, Ilāh. 4, 8, p. 346,[11][12] fa-lā māhiyya al-wājib al-wujūd ġayr annahū wājib al-wujūd, wahāḏihī hiya al-inniya. Translations: "Dunque per il Necessariamente Esistente non c'è une quiddità diversa dal fatto che è necessariamente esistente, e questa è il suo stesso essere" (Lizzini); "Il n'y a donc pas d'autre quiddité pour le nécessairement existant que le fait qu'il est nécessairement existant. Et c'est cela l'être" (Anawati).

  893.-974), the learned theologian of the Trinity and commentator on Aristotle; Islamic as in the bold speculations of al-Sijist n (c. 912-c. 985) and Miskawayh (c. 936-1030). Cf. Joel Kraemer, Philosophy in the Renaissance of Islam: Abu Sulayman al-Sijistani and his Circle (Leiden: Brill 1986); idem, Humanism in the Renaissance of Islam. The cultural revival during the Buyid age (Leiden: Brill 1992). Al-Tawḥ d 's Muqābasāt (ed. Muḥammad Tawf q Ḥusain [Baghdad 1970]) also contains one of two known versions of the Treatise on the Soul attributed to Porphyry, which exhibits very close parallels in doctrine and terminology to the ThA; cf. Charles Genequand. "La mémoire de l'âme. Porphyre et la Théologie d'Aristote", Bulletin d'Etudes Orientales 48 (1996): 103-113. 52 Al-Tawḥ d , Muqābasāt, 91, p. 298, 3ff. Ḥusain.

  Marwan Rashed. "Ibn Ad et Avicenne: sur les types d'existants", in V. Celluprica -C. D'Ancona, eds., Aristotele e i suoi esegeti neoplatonici (Naples: Bibliopolis, 2004), 107-171; Fedor Benevich, "Fire and heat. Yaḥy b. Ad and Avicenna on the essentiality of being substance or accident", Arabic Sciences and Philosophy 27 (2017), 237-267.

But not always. In some passages, Victorinus exhibits the confusion between huparxis and hupostasis that was typical of several 4th-century Church Fathers; cf. Thomas Leinkauf "Die Bestimmung des

Hadot, "La distinction", 148.

On huparxis as indicating the fact of pure being or existence, Pierre Hadot (Porphyre et Victorinus, 2 vols. (Paris: Etudes Augustiniennes, 1968), vol. I, p. 252 n.1) cites Dexippus, In Cat., p. 35, 18-22 Busse, a text which probably derives from Porphyry's lost commentary on Aristotle's Categories addressed to Gedalius.

Victorinus, Ad Cand., 13,[5][6][7][8][9][10][11][12][13][14] 1. For God as "Das nichtseiende über allem Seiendem", cf. Matthias Baltes, Marius Victorinus. Zur Philosophie in seinen theologischen Schriften (München: K.G. Saur, 2002), 28-29, with further references.

When one considers that the only occurrence in all of Greek literature of the locution τὸ ὑπὲρ τὸ ὂν μὴ ὄν occurs in Porphyry (Sentence 26, cited by Pierre Hadot, Marius Victorinus, Traités théologiques sur la Trinité [Paris: Éditions du Cerf, 1960], vol. II, 715), it becomes hard to deny that the thought of Porphyry is at least one of the sources drawn upon by Marius Victorinus.

Cited by Jean Pépin in Luc Brisson et al., eds., Porphyre, Sentences. Études d'introduction, texte grec et traduction française, commentaire par l'Unité Propre de Recherche n° 76 du Centre National de la Recherche Scientifique avec une traduction anglaise par John Dillon (Paris: Vrin, 2005), vol. II, 566-567.

Porphyry, Sentence 25, 2, in Brisson et al., eds., Porphyre, Sentences, 324 = p. 15, 1-2 Lamberz: θεωρεῖται δὲ ἀνοησίᾳ κρείττονι νοήσεως.

Porphyry, fr. 427 F Smith = Theosophy of Tübingen, 13, p. 34,[107][108][109] Beatrice: Ὅτι Πορφύριος ὁ Φοῖνιξ, ὁ Ἀμελίου μὲν συμοιτητής, μαθητὴς δὲ Πλωτίνου, φησὶν οὕτως• 'περὶ τοῦ πρώτου αἰτίου οὐδὲν ἴσμεν• οὔτε γὰρ ἁπτὸν οὔτε γνωστόν, ἀλλ' ἔστιν αὐτοῦ γνῶσις ἡ ἀγνωσία.'

<Porphyry>, In Parm., II,[16][17] IX,[24][25][26] X,[25][26][27][28][29]

<Porphyry>, In Parm., V, 1-11 Hadot: Ὅτι φημὶ εἶναι γνῶσιν ἔξω γνώσεω<ς> καὶ ἀγνοίας, ἀφ' ἧς ἡ γνῶσις. Cf. Leinkauf "Bestimmung", 80.

Victorinus, Ad Cand., 15, 1-3: ilius ergo Iesus Christus et solus natus filius, quoniam illud προὸν nihil aliud genuit quam ὂν ante omnia et omnimodis perfectum ὄν.

id quod est unum habet. Hadot cites a parallel passage from Simplicius (In Phys., vol. 9, p. 773,(19)(20)(21)(22)(23)(24)(25) perhaps reproducing the doctrine of Simplicius' teacher Damascius, which speaks of the state in which the One begins to emanate the Unified or One-Many. Prior to this emergence of the first trace of difference, Being is not yet distinguished from the existent (καὶ οὐδὲ τὸ εἶναι τοῦ ὄντος ἐκεῖ διακέκριται). Once difference and multiplicity makes its appearance, Being becomes distinct from the existent (καὶ τὸ εἶναι ἄλλο γέγονε παρὰ τὸ ὄν). It is at this point that time makes its appearance. 44 A catchall term designating a group of apocrypha, mostly ascribed to Aristotle but in fact consisting primarily of Arabic paraphrases, originating in the 2nd quarter of the 9th century CE, of Greek Neoplatonic texts by Plotinus, Proclus, and (in my view, at least), Porphyry. Their titles include the Theology of Aristotle (hereafter ThA, ed. Abdurraḥm n Badaw , Aflūṭīn inda l-ʿarab/Plotinus apud Arabes. Theologia Aristotelis et fragmenta quae supersunt [Cairo 1955]), the Book of the Pure Good (ed. Otto Bardenhewer, Die pseudo-aristotelische Schrift Ueber das reine Gute, bekannt unter dem Namen Liber de Causis (Freiburg: Herdersche Verlagshandlung, 1882), translated into Latin as the Liber De Causis, and the Sayings of the Greek Sage (ed. Franz Rosenthal, "A -Šayḫ al-ūn n and the Arabic Plotinus source", Orientalia 21: 461-492; 22: 370-400; 24: 42-65 (1952-1955); Badaw , Aflūṭīn; Elvira Wakelnig, A Philosophy Reader from the Circle of Miskawayh (Cambridge 2014). Several passages in works by Miskawayh, Sijist n and Miskawayh (10th cent), as yet insufficiently explored, contain doctrines, often anonymous, that bear strong affinities to these Neoplatonica Arabica; cf. Gerhard Endress, "Die Integration philosophischer Traditionen in der islamischen Gesellschaft des 4/10. Jahrhunderts: at-Tauḥidi und as-Siǧist n ", in U. Rudolph, ed., Philosophie in der Islamischen Welt. 1, 8.-10. Jahrhundert (Grundriss der Geschichte der Philosophie, Basel: Schwabe, 2012); 198-209; Elvira Wakelnig, "Die Philosophen in der Tradi on al-Kind s. Al-mir , al-Is z r , Miskawayh, as-Siǧist n und at-Tawḥ d ", in H. Eichner, M. Perkams und C. Schäfer (eds.), Islamische Philosophie im Mittelalter. Ein Handbuch (Darmstadt 2013), 233-252. I believe these works may contain many a Porphyrian doctrine: Miskawayh, for instance, claims that his entire exposition on the meanings of "One" in his Minor Triumph (Al-Fawz al-aṣġar, section 1.5, ed. Ṣ. Uḍayma -R. Arnaldez, Miskawayh, Le petit livre du salut [Tunis 1987]), is derived from Porphyry. 45 Lizzini "Wuǧūd-Mawǧūd", 112 n. 5. According to Bertolacci "Hapax Legomenon", 295, in Avicenna's Metaphysics, anniyya means "existence" as an opposite term to "quiddity" (māhiyya) and as a synonym of wujūd; cf. ibid. p. 298. For a full survey of the translations of anniyya, cf. Bertolacci ibid., 292-293, who lists "quoddité", "haeccéité", "être", "entitas", "essence individuelle", "existence". As this author notes (ibid., 293 n. 8), Cristina d'Ancona usually translates anniyya by essere in her edition and translation of chapters 1 and 7 of the Theology of Aristotle; cf. Cristina D 'Ancona, et al., eds., Plotino, La dicesa dell'anima nei corpi (Enn. IV 8 [6]); Plotiniana arabica (Pseudo-Teologia di Aristotele, capitoli 1 e 7; "Detti del sapiente greco" (Padova: Il Poligrapho 2003). 46 Cf. Richard Taylor, "Aquinas, the Plotiniana Arabica, and the Metaphysics of Being and Actuality," Journal of the History of Ideas 59 (1998), 217-239; Michael Chase, "Porphyry and the Theology of Aristotle", in press, with references to previous literature.

(goya@vjf.cnrs.fr) CNRS Centre Jean Pépin -UMR 8230 Villejuif-Paris France


Gerardo Rubino
email: gerardo.rubino@inria.fr

Network reliability, performability metrics, rare events and standard Monte Carlo

In this chapter, we consider static models in network reliability, that cover a huge family of applications, going way beyond the case of networks of any kind. The analysis of these models is in general #P-complete, and Monte Carlo remains the only effective approach. We underline the interest in moving from the typical binary world where components and systems are either up or down, to a multi-variate one, where the up state is decomposed into several performance levels. This is also called a performability view of the system. The chapter then proposes a different view of Monte Carlo procedures, where instead of trying to reduce the variance of the estimators, we focus on their time complexities. This view allows a first straightforward way of exploring these metrics. The chapter focuses on the resilience, which is the expected number of pairs of nodes that are connected by at least one path in the model. We discuss the ability of the mentioned approach for quickly estimating this metric, together with variations of it. We also discuss another side effect of the sampling technique proposed in the text, the possibility of easily computing the sensitivities of these metrics with respect to the individual reliabilities of the components. We show that this can be done without a significant overhead of the procedure that estimates the resilience metric alone.

Introduction

Network reliability refers to a large family of random graph-based models used in multiple areas of science and technology, for different types of analysis [START_REF] Ball | Network reliability[END_REF]. The reference case, and the one with which we will work in this chapter, is when we use them to analyze a communication network composed of a set V of nodes connected by a set E of edges (undirected links, no loops). The graph G = (V, E) is called the underlying graph in the model. We are then interested in the communications between nodes using paths. Graph G is assumed to be connected. With each each link we associate a given fixed probability , and the interpretation is that with probability 1the link is removed from the graph. More formally, with each link we associate a Bernoulli or Binary random variable (r.v.) with parameter ; this means that ∈ {0, 1} and that = P( = 1). We call the (elementary) reliability of link and the state of link . Observe that there is no explicit time variable. That is why we call these models static [START_REF] Rubino | Network reliability evaluation[END_REF]. We see the system at a "typical" point in time, or at a specific instant of interest, possibly at infinity, but there is no stochastic process in the model. Denote by = |E | the number of edges. Then, and always referring to the reference model, we assume that the r.v.s 1 , . . . , are independent.

With this setting, we build a random graph with values in the set of partial subgraphs of G (that is, has the same nodes as G and a subset of G's edges). Observe that there are 2 points in 's space of values. Informally, in a realization of edge ∈ E exists with probability . More formally, we define the distribution of by the following expression: for any subset of E,

P = (V, ) = Π ∈ Π ∉ (1 -).
Using this random object, we can define many connectivity-based metrics quantifying different properties of related to its capability to transport something (information, some fluid, ...) from some nodes to other nodes in the model. By far, the most used one is the so-called source-to-terminal reliability defined as follows: two different nodes are fixed, say and , and the metric is , = P( and are connected in ), that is, the probability that and belong to the same connected component of . This is also called the 2-terminal reliability, or simply the --reliability. Another widely used metric is the all-terminal reliability, all , defined by all = P(all nodes are connected in ), that is, the probability that is connected (that it has a single connected component). Formally, we usually code the fact that the selected property holds by 1 and that it doesn't hold by 0, and we call system's state that random number.

There are many variations around this melody. Instead of looking at the connections between two nodes and or between all pairs of nodes, we can define a -terminal reliability concerning a given subset of nodes; the corresponding definition is = P(all nodes in belong to the same connected component of ).

The connectivity criteria can be more complicated. For instance, we can define the distance-based 2-terminal reliability with parameter , ; , , where ≥ 1 is an integer, by ; , = P( and are connected in by at least a path having length ≤ ), and similarly for all or [START_REF] Cancela | Reliability of communication networks with delay constraints: computational complexity and complete topologies[END_REF]. A different extension consists of associating a non-negative integer with node for all ∈ V and defining a new metric as the probability that there are min{ , } elementary edge-disjoint paths between nodes and , for all and [START_REF] Grötschel | Design of survivable networks[END_REF]. All these metrics can also be defined in a similar model where the nodes and not the edges, have random states, or both nodes and edges are random, on directed graphs, instead of undirected ones, etc. Recently, some works appeared which remove the independence assumption concerning the state variables [START_REF] Singpurwalla | Dependence in network reliability[END_REF][START_REF] Matus | On the Marshall-Olkin Copula Model for Network Reliability Under Dependent Failures[END_REF].

The evaluation of all these reliability metrics is, in general, a computational hard problem [START_REF] Valiant | The complexity of enumeration and reliability problems[END_REF]. Formally, it belongs to the # -complete class, a family of -hard problems not known to be in . A #P-complete problem is equivalent to counting the number of solutions to an -complete one. For this reason, # -complete problems are, at least, as hard as -complete ones. Even in very restricted classes of graphs, the computation of the before mentioned metrics remains in this complexity class. For instance, it is shown in [START_REF] Provan | The complexity of reliability computations in planar and acyclic graphs[END_REF] that the computation of the source-to-terminal reliability is in the # -complete class even when the graph is planar (in fact, , -planar) and has vertex degree at most equal to three. From a practical point of view, this means that a graph with, say, more than one hundred elements (nodes, lines) can not be exactly evaluated (except for special topologies). An efficient alternative is then to use a Monte Carlo method, the topic of this chapter. The standard version consists of generating an -sample of , say 1 , . . . , , and to estimate the reliability metric, say , , using the standard estimator

, = 1 =1 1 and connected in , (1)
where 1( ) is equal to 1 if the predicate is true, 0 if it is false. In many cases, this approach can handle medium and large size models, but, of course, it has its own problem, namely the fact that its efficiency is sensitive to the numerical values of data (the s). In particular, this standard procedure (sampling times graph and checking the property used to define the desired metric on each realization) becomes of no use in the rare event case, that is, when the system reliability metric is (very) close to one. Unfortunately, this is often the interesting case.

For the reader unfamiliar with the area, let us finally comment that the specific source-to-terminal model has a huge application area in the dependability analysis of many kinds of systems. The general literature is rich in examples. Let us just mention [START_REF] Sebastio | Fast computation of bounds for two-terminal network reliability[END_REF], where bounds of the metric , are proposed, applied to the analysis of critical control subsystems of a modern aircraft.

There is a very large literature in the network reliability area. A good review of the main concepts and results is [START_REF] Ball | Network reliability[END_REF], and an older and classical text, [START_REF] Locks | Network reliability -the state of the art[END_REF]. Another already mentioned survey is ours [START_REF] Rubino | Network reliability evaluation[END_REF]. Specifically in the Monte Carlo side, some papers by Pierre L'Ecuyer and co-authors are [START_REF] L'ecuyer | Approximate Zero-Variance Importance Sampling for Static Network Reliability Estimation[END_REF][START_REF] Botev | Static Network Reliability Estimation via Generalized Splitting[END_REF][START_REF] Cancela | Combination of Conditional Monte Carlo and Approximate Zero-Variance Importance Sampling for Network Reliability Estimation[END_REF]. See also [START_REF]Rare event simulation[END_REF] on the rare event side, in particular Chapter 7, or [START_REF] Colbourn | The Combinatorics of Network Reliability[END_REF] for many technical aspects.

In the sequel of this chapter, we explore in Section 2 the interest of using performability metrics to quantify the capacity of a network to provide service in spite of failures (or equivalent events) of its components, and we focus on one of them, called resilience. Then, in Section 3, we discuss the estimation of the resilience using the naive Monte Carlo approach. After commenting the rare event problem, we show that it is possible to be efficient in the use of the naive, or standard, or crude estimator, by means of a smarter implementation (this extends old work presented in [START_REF] Khadiri | Accelerating the standard Monte Carlo evaluation of highly reliable binary systems[END_REF]). In Section 4, we illustrate the use of the previously discussed implementation, and we show that it allows exploring other types of metrics, written as variations on the resilience idea. We also show that the same approach makes straightforward to evaluate also the gradient of the resilience with respect to the elementary reliabilities, with almost no overhead (extension to ideas presented in [START_REF] Rubino | Sensitivity analysis of network reliability using Monte Carlo[END_REF]). Section 5 concludes the chapter.

Performability metrics and resilience

Quantitative analysis of systems is mainly done following two different viewpoints. Either we assume the system perfect (that is, we ignore its possible failures and repairs) and we focus on measures related to the work it does, on the properties of the service it provides, or we ignore the latter and we focus on those possible failures and repairs, and try to analyze different related properties of the system. Around the 80s appeared another idea, in general a much more complex one, where we look simultaneously, that is, in the same model, at both sides of systems' behavior. Following the pioneering work done by Meyer [START_REF] Meyer | On evaluating the performability of degradable computing systems[END_REF], we call it performability. We will consider this view here, based on the reference model presented before.

So, we have an undirected graph G = (V, E) assumed to be connected and with no loops, with nodes and edges (the underlying graph), and our standard probabilistic setting parameterized by the elementary reliabilities 1 , . . . , . Consider now the all metric, widely used to quantify the ability of the network to support communications between all pairs of nodes. It measures a binary property, an allnothing one, the probability that all nodes can communicate. But for the system manager, or for the users, the fact that, for instance, a single node is isolated, making that among the total number ( -1)/2 of pairs of nodes, only -1 of them can't communicate, is very different than the situation where many links are failed making that just a few pairs of nodes can talk to each other (possible none of them if all links are failed). A way of measuring this is by directly looking at the number of pairs that can communicate.

We thus define the central r.v. of this chapter, NCP = number of pairs of nodes that can communicate in .

The analysis of this r.v. provides a much richer information about the capacity of the network to provide communications between its nodes. We will focus on its expectation in the sequel.

The resilience metric

The expectation of NCP has been called resilience in some works [START_REF] Van Slyke | Network reliability analysis I[END_REF], in the same context as in this chapter. It has been explored in a few other works [START_REF] Colbourn | Network resilience[END_REF][START_REF] Amin | The expected number of pairs of connected nodes: Pair-connected reliability[END_REF], always in the setting discussed here. So, formally, the resilience Res of our model is

Res = E(NCP). (2)
Observe first that we have the following immediate properties:

• 0 ≤ NCP ≤ 2 = ( -1) 2 ;
• P(NCP = 0) = Π ∈ E (1 -);

• P NCP = 2 = all ; • Res| ∀ in E, =0 = 0, Res| ∀ in E, =1 = 2 .
We can normalize the metric, dividing E NCP by 2 , thus leading to an index in [0, 1]. The scaled resilience of the network, ResScaled, is then ResScaled = 2Res/ ( -1) .

Let us provide first a few simple examples, assuming, to simplify the presentation, that we are in the i.i.c. case, meaning independent and identical components (here, we refer to the links) with common elementary reliability .

Bridge. Take first a bridge, as depicted in Fig. 1. Using brute force (listing all 2 5 possible links' states), we get Res = 5 + 8 -14 3 + 7 4 . Paths. Consider now a path with nodes (thus, with -1 edges), ≥ 2. Denote by Res its resilience. Conditioning on the state of any of the 2 extreme edges, we can verify, after some algebra, that

Res = (1 -) -(1 -) (1 -) 2 = -1 -( --1 ) (1 -) 2
.

A few first values:

(Res 1 = 0,) Res 2 = , Res 3 = 2 + 2 , Res 4 = 3 + 2 2 + 3 .
Rings. Last, consider a ring with ≥ 3 nodes (or ≥ 2 if we accept the multigraph corresponding to the = 2 case). Denote again Res its resilience. Conditioning on the state of any of its links, we obtain

Res = 1 --1 1 - - - 1 2 -1 .
A few first values of Res :

(Res 1 = 0,) Res 2 = 2 -2 , Res 3 = 3 + 3 2 -3 3 , Res 4 = 4 + 4 2 + 4 3 -6 4 .

Some properties of resilience

The "first moment principle" says that if ≥ 0 is an integer r.v., then it holds that P( > 0) ≤ E( ). Applied to E NCP , this means that 1 -Π ∈E (1 -) ≤ Res. However, this is not very good, because Res is, in general, > 1, and 1

-Π ∈E (1 -) is ≤ 1.
Now, simply by definition, 2 all ≤ Res ≤ 2 , which are better bounds, especially in the rare event case. For the scaled resilience, we have all ≤ ResScaled ≤ 1. Now, define the r.v.

, = 1 there is a path connecting nodes and .

We have , = P( , = 1) = E( , ) and also

NCP = all nodes , , < , ,
from which, taking expectations, we have the following important relation, making the connection between this performability approach and the classical binary metrics:

Res = all nodes , , < , . (3)
Conditioning with respect to the state of any edge , we can write

Res(G) = E(NCP(G) | = 1) + Res(G ) (1 -), (4)
where we use the notation Res( ) to make explicit the fact that we define the metric on graph , and where G is the graph obtained by removing edge from G. If G denotes the graph obtained by contracting edge in G, here we don't have the usual fact that Res(G ) coincides with E(NCP(G) | = 1), a relation that holds for classical metrics such as , . This makes that Relation (4) is less useful than for standard metrics, where it is the basis of the most powerful approach for their exact numerical analysis. This is because of the more complex structure of Res(G ) related to Res(G). This issue is out of the scope of this paper, so, we will not pursue commenting it here.

In the rest of this paper, we will look at the evaluation of this expectation using Monte Carlo.

Using standard Monte Carlo for resilience-based analysis

First of all, consider reliability metrics such as , or all (or any of their many variations). Since these metrics are typically close to 1, it is better to work with the complementary events and target the corresponding unreliability values, which we will denote here by (for instance, 1 -, , or 1all ). The fact that now the target is close to 0 makes clear that the correct way to look at the quality of these estimations is through the analysis of relative errors and not absolute ones.

The standard estimator

Estimating an unreliability metric such as 1-, or 1all , say generically = 1-, and using the standard or crude estimator, means sampling the following r.v.:

= 1 =1 ( ) ,
where (1) , . . . , ( ) are independent copies of the Binary r.v. equal to 1 if the considered connectivity property doesn't hold, and to 0 otherwise ( is the complementary of what we called the system's state). We have E( ) = E( ) = (that is, is unbiased). A pseudo-code corresponding to this estimator is as follows: , this means that we repeat times the following: for each link ∈ E, we sample a Binary r.v. having parameter , and we put the result in ; then, we remove from the underlying graph G those links such that = 0; next step is to execute a procedure to check the connectivity property used, for instance, to check if the obtained partial graph of G is connected or not; at the end, we return the number of times the graph wasn't connected divided by , which is an estimator of = 1all .

Algorithm A //
Observing first that we have V( ) = (1 -)/ , the corresponding standard confidence interval is ∓ ( ) (1 -)/( -1) , where 1is the confidence level, or ideal coverage probability, with

( ) = Φ -1 1 - 2 , Φ( ) = 1 √ 2 ∫ 0 -2 /2 d
(e.g., (0.05) ≈ 1.96 for a confidence level of 95%). The quantity (1 -)/( -1) is proportional to half the confidence interval length (the proportionality constant being ( )), and can thus be interpreted as an absolute error. The ratio

(1 -) -1 = 1 - ( -1)
≈ 1 can then be seen as an estimation of the (statistical) relative error we have, and we conclude by saying that it goes to ∞ as the rarity of the event of interest increases, that is, as → 0. This formally show that as the system's failure becomes rarer, the estimation procedure becomes less accurate, and this happens without any bound. The point to be made next is that the estimator can be computed in a more efficient way, especially in the frequent case where the s are all close to 1, and this leads to efficient estimations, because what matters is to have a small product "mean running time × variance of the estimator" [START_REF] Cancela | New measures of robustness in rare event simulation[END_REF]. This is the topic developed in next subsection.

The standard estimator efficiently implemented in the rare event case

Imagine we implement the standard estimator of as follows. Instead of sampling a huge number of times and checking the connectivity property on each sample, we sample times each and put the results in column of a big table. The table has + 1 columns, one for each link plus a last one for the complement of the system's or network's state, and rows. Then, we read the table by rows and we fill the last ( + 1)th column checking the system's state. Since, of course, we will not implement such a table, we will call it the virtual table from now on. Now, assume for a moment that = ∞, and consider column . Since is usually close to 1, the column has a majority of 1s. The position of its first 0 is a geometric r.v.

with values in the strictly positive integers and distribution given by P( = ℎ) = ℎ-1 (1ℎ ), ℎ ≥ 1. The discrete point process defined by the positions of the different 0s in that column is a Bernoulli process, where the distance between consecutive 0s (and from the first 0 and an auxiliary initial and empty row 0 in the table) are independent copies of . Now, let = min{ 1 , . . . , } be the first row where there is at least one 0 in the first columns. We have that the r.v.

is also geometric, with values on the integers ≥ 1, and law given by

P( = ℓ) = ℓ-1 (1 -), ℓ ≥ 1, where = 1 2 • • • .
And in the same way as for column , if we look at those rows in the infinite virtual table where at least one link is down, the distance between consecutive rows with that property are the points of a discrete Bernoulli process with parameter (that is, if is the th such row, then the sequence ( 1 , 2 -1 , 3 -2 , . . .) is i.i.d. with the law of . The interest of this type of description of the estimation procedure is that the statistical properties of the estimator used are those of the standard one, in particular, the variance.

This suggests a different way of implementing the standard estimator of . Sample and add the obtained value to a first register rows. In the first -1 rows of the table, we have only 1s in the first columns, so, the r.v.s 1 , . . . , -1 are 0 (technically, we assume coherent systems [START_REF] Rubino | Network reliability evaluation[END_REF], so, they are always up if all the components are up). It remains to see what happens with the th row. For that purpose, we must sample the s, but now knowing that there is at least one zero in the vector of links' states. Consider the natural ordering 1, 2, . . . , of the network's links, denote by the r.v. "number of zeros in the vector of links' states", and by the index of the first zero in that vector. We have then the following immediate result: for = 1, 2, . . . , ,

P( = | ≥ 1) = 1 2 • • • -1 (1 -) 1 - . (5)
Then, we sample from this distribution, obtaining some ∈ E, we set the states of links 1, 2, . . . , -1 to 1 and that of link to 0, and we independently sample the states of links + 1, . . . , using their original Binary distributions with parameters +1 , . . . , respectively. Once known the states of all the links, we check if the connectivity property used holds or not. In the latter case, we increase a second register counter. We repeat the procedure, sampling a new value from 's law, obtaining some integer ≥ 1, adding it to rows, and repeating the conditional sampling of the links knowing that there is at least a 0 in the vector of links' states, until updating counter. We stop the process when we reach the condition rows ≥ , and we return the estimation counter/ . In pseudo-code, this gives Algorithm B.

Algorithm B // 2nd implementation of standard Monte Carlo

// goal: network unreliability // the connectivity property used is denoted here CP rows = 0; counter = 0; while rows < : // main loop f = sampleFrom( ); rows + = ; if rows ≤ : conditionally sample vector of links' states; if CP doesn't hold: counter + + // end of main loop return counter/N Recall that the instruction "sample vector of links' states" means sampling first using [START_REF] Singpurwalla | Dependence in network reliability[END_REF], obtaining some value , then setting

1 = 2 = • • • = -1 = 1,
= 0, and sampling each remaining state variable , for = + 1, . . . , , according to the Binary law with parameter , and independently from each other.

Complexity analysis. Consider first Algorithm A. Sampling needs Θ( ) in computation time. Testing the connectivity property used has a cost ( + ) in most of the cases mentioned in the chapter, in particular, for the resilience (see below) and since ≥ -1 because the underlying graph is connected, we can also write it ( ). Since we iterate times, the total mean computational cost is ( ). In Algorithm B, we will sample from , for large (almost always the case), on average, /E( ) times. We have E( ) = (1 -) -1 . The conditional sampling procedure of (5) plus the test of the selected connectivity property costs ( ), so, the total average computational cost is ( (1 -) ). The time reduction in B with respect to the naive implementation of A is, then,

(1 -) = 1 1 - .
This approach alone is modest in time reduction, but it can be improved (see below, in Subsection 3.4).

Remark 1

Observe that what we are doing is somehow inspired by a conditional Monte Carlo technique. The interest of the type of implementation of the estimation procedure followed here is that we can see it as a different algorithm for the evaluation of the standard estimator, and this can be useful, as shown below. It will be exploited for quickly exploring other possible metrics of the resilience type, and also to estimate sensitivities (gradients). The central interest in the conditioning we used is that its effect can be seen as a significant reduction in the sampling process of the standard estimator, but not on the estimator's variance, that is, in the execution time instead.

Let us come back first to the estimation of the resilience.

Estimating the resilience

Recall that the resilience is defined as the expected number of pairs of nodes that can communicate, in the random graph , E(NCP) (Relation (2)). Observe that if the graph is connected, we have NCP = ( -1)/2. Suppose now that it is not, and let NCC be the number of connected components of . Denote the associated node sets as S 1 , . . . , S NCC and their cardinalities by 1 , . . . , NCC . We then obviously have

NCP = NCC ℎ=1 ℎ 2 (6)
where ℎ = 0 when ℎ < . Since computing NCC and the cardinalities 1 , . . . , NCC needs only a DFS (Depth First Search) or a BFS (Birth First Search) [START_REF] Cormen | Introduction to Algorithms[END_REF] on , the cost of computing NCP is ( ). So, the procedure for estimating Res is basically the same in both Algorithms A and B: the only change to do is that instead of checking one of the considered connectivity properties, we have just to decompose into its connected components and use [START_REF] Matus | On the Marshall-Olkin Copula Model for Network Reliability Under Dependent Failures[END_REF]. For instance, the resilience version of Algorithm B is as follows.

Algorithm Bbis // 2nd implementation of standard Monte Carlo // goal: network resilience rows = 0; counter = 0; sum = 0; while rows < : // main loop f = sampleFrom( ); if rows + ≤ : + = ( -1) ( -1)/2; conditionally sample vector of links' states with (5); find the connected components of ; + = of using ( 6) else + = ( -) ( -1)/2 rows + = // end of main loop return counter/N Formally, we are using the standard estimator

Res = 1 =1 Res ( ) ,
where Res ( ) is Res( ). A confidence interval for Res with confidence level of, say, 95%, is then given by ( Res ∓ 1.96 ), where 2 is the standard estimator of the variance of Res. We have

2 = 1 ( -1) =1 NCP ( ) 2 - 1 -1 Res 2 .

Improving Algorithm B

Assume you know, for instance, the breadth of the underlying graph, that is, the size of a mincut of minimal size (a set of edges whose removal disconnect the graph [START_REF] Cormen | Introduction to Algorithms[END_REF]). This number can be computed using a max flow algorithm such as Edmonds-Karp's, and its cost is polynomial in ( , ). For instance, suppose that = 2. This means that to transform G into an unconnected graph by removing edges, you must remove at least 2 edges. This means that instead of checking the connectivity property used when there is at least one zero in the row of the virtual table, or instead of decomposing into its connected components in the resilience case, we can first just count how many zeros we have, and if the number is less than , we know that the current realization of is connected, so, NCP is equal to ( -1)/2. This will make a supplementary gain in performance, needing only to compute the graph breadth, which is a one shot polynomial task, executed only at the beginning. The corresponding algorithm is presented again in pseudo-code, this time for estimating the resilience.

Algorithm C // 3rd implementation of standard Monte Carlo // goal: network resilience = breadthOf (G); rows = 0; counter = 0; sum = 0; while rows < : // main loop f = sampleFrom( ); if rows + ≤ then + = ( -1) ( -1)/2; conditionally sample vector of links' states with (5); if its # of zeros is ≤ then + = ( -1)/2 else find the connected components of ; + = of computed using (6) else + = ( -) ( -1)/2 // end of main loop return sum/N For the improvement in reducing the computing time of the estimation process, let us wait until next section, where some numerical illustrations are given.

Comment. The way we presented Algorithm C is to underline that it improves version B (or Bbis). But it can be simplified, by redefining the r.v. . Instead of being the first row of the virtual table with at least 1 zero, we can define it as the first row of the virtual table with at least zeros. This means then to use again Algorithm B but with this new conditioning. There are other possibilities, using a covering tree of G, or several ones, etc. To discuss the idea here we will just keep the very simple idea of counting the 0s in the vector of links' states, that is enough to describe the methodology. More on this in Section 4, but let us look now at sensitivities.

Sensitivity analysis

The last element of the discussion given in this chapter concerns the sensitivity analysis of resilience. This means computing the gradient of Res seen as a function of the variables 1 , . . . , , that is, the partial derivatives Res/ for all ∈ E. This subsections builds on the results presented in [START_REF] Rubino | Sensitivity analysis of network reliability using Monte Carlo[END_REF], extended to handle the resilience concept. Define = Res and , ; = , .

Denote, similarly as for the reliability metrics,

Res = Res(G | = 1) (≠ Res(G ))
and

Res = Res(G | = 0) = Res(G ).
Then, the next result is the first step toward the estimation of the gradient of the resilience.

Proposition 1

We have

= Res -Res 1 - = Res -Res .
Proof Let us show the steps to prove the first equality. The second one is similar. In (3) we stated the basic identity Res = all nodes , , < , .

Taking partial derivatives with respect to , we get = all nodes , , < , ;

.

In [START_REF] Rubino | Sensitivity analysis of network reliability using Monte Carlo[END_REF], we proved that

, ; = , ; -, 1 - = , - , ;
.

Using the first equality, we have

E( ) = 1 (1 -) all nodes , , < , ; - Res = Res -Res 1 - = ,
by means of the result of Proposition 1.

As we can see, the estimator consists basically of sampling simultaneously the states of the links and the NCP variable, something explicit in the virtual table. So, estimating the sensitivities of the resilience with respect to the elementary reliabilities in the system is straightforward following the same approach as for the resilience itself. Next section gives a few examples and discusses other possible resiliencelike metrics easily analyzed using the procedure we have described, including the sensitivities.

Examples and discussions

In this section, to simplify the presentation we will only consider the i.i.c. case (independent and identical components) in the models, that is, the case of homogeneous links, all sharing the same elementary reliability, denoted here by .

To provide a few illustrations of previous results, let us consider the model depicted by its underlying graph in Figure 2. This network has = 21 nodes and = 26 links. Its breadth is = 2. The expected reduction in the execution time, using the basic Algorithm B and written as a factor, is 1 -, = = 26 . Taking = 0.9999 we obtain a time reduction denominator of ≈ 385. Using the breadth (Algorithm C), we have = 2. The supplementary factor to add is P( ≥ 2 | ≥ 1), where denotes the number of zeros in a row, a Binomial r.v. with P( = ) =

(1 -) -. The supplementary factor is then P( ≥ 2 | ≥ 1) = P( ≥ 2)/P( ≥ 1), and P( ≥ 1) = 1 -P( = 0) = 1 -, so, the new global average time reduction factor becomes P( ≥ 2) = 1 ---1 (1 -) ≈ 3.2448 • 10 -6 , which corresponds to a denominator of about 300, 000. This shows that the time reduction can be considerable even when using such a simple conditioning. The accelerations we observed in practice have been lower than the theoretical factors, probably due to the implementations of the algorithms we had, but in all cases they were important. Using only Algorithm Bbis, in the case of = 0.999, we got accelerations of several hundreds, depending on the tools used (C code, python alone, python with numpy). The accelerations were higher using the breadth, but there are other possibilities in the same spirit and still more powerful. Let us give another example here.

Assume we computed a covering tree of the underlying graph, that is, a tree sharing with the underlying graph all its nodes. If we denote the tree as T = (V, E ) the probability that all its links are up is ∈E . In case of that event, we know that NCP = ( -1)/2, so, we can use the event to get a better reduction factor than 1 -= 1 -. The sampling of the links' states conditioned to the fact that all links in the covering tree are working is straightforward, only the links out of the tree must be sampled. In the Arpanet model given in Figure 2, the gain is modest. See first a covering tree of this graph in Figure 3. In the case of Algorithm B with = 0.9999, we had a time reduction factor of about 385. Using a covering tree, always in the i.i.c. case, the factor changes to about 1 -20 ≈ 500. If the graph is more dense, we can have several edge-disjoint covering trees and considering their union we can reach much higher reductions in time. We can also use mincuts with the same purpose. This will not be explored further here, we intend to show only the general principles.

In the general heterogeneous case, when the elementary reliabilities are not necessarily all equal, we can look for covering trees with minimal total weight, where the weight of the tree is the product of the reliabilities of its links. For that purpose, we can use standard graph algorithms such as Prim's or Kruskal's (see any good reference in the area, such as [START_REF] Cormen | Introduction to Algorithms[END_REF]). Both have complexity ( ln ) where is the number of edges in the graph.

Concerning sensitivities, we only illustrate the main interest in their evaluation, a point underlined already in [START_REF] Rubino | Sensitivity analysis of network reliability using Monte Carlo[END_REF]. Consider the example in Figure 4.

We see that, from the connectivity point of view and when we have an i.i.c. model (homogenous links), the link {4, 5} is the most important one, the first one to improve if possible. For example, in the case of = 0.999, we have the estimations given in Table 1. This illustrates well the fact that the order induced on the links by the gradient of the resilience is a much more robust result than the metric itself. Of course, the example has been chosen to amplify the effect of having links playing a more critical role than the others, but the phenomenon is visible in any model.

Let us come back now at our resilience estimation. Considering the Arpanet model previously shown, the resilience gets pretty close to its maximal value as gets close to 1. Some examples are given in Table 2. For the Arpanet model used, since we have = 21 nodes, the maximal possible resilience is 2 = 210. We observe that the resilience gets very close to that value, which is expected (the rare event effect). This leads to consider other ideas for differentiating situations. For instance, a way of measuring the way a network reacts face to failures, is seeing what happens when there is no more total connectivity in the model. This means looking at the mean number of communicating pairs when the graph is unconnected. If we denote by NCC the number of connected components of our random graph , observe first that the best situation is when there is only one component, a connected graph, and the worst is when no link is working and we have as many connected components as there are nodes, that is, NCC = . So, we have NCC ∈ {1, 2, . . . , }, and on the borders, P(NCC = 1) = P(NCP = 2 = all and P(NCC = ) = P(NCP = 0) = ∈E (1 -). Now, a metric capturing what happens when the graph is not connected is the conditional resilience E(NCP | NCC ≥ 2).

Let us illustrate this with some numerical examples. In Table 3 we show the mean number of connected components E(NCC), and the two resiliences just discussed. The values of the conditional resilience are more separated than those of the unconditional one. But our tools allow us to make other trials. For example, take as central variable the number of pairs of nodes that can communicate using at least two edge-disjoint paths. This is related to bi-connectivity in graphs, and we will not developed the point here, but evaluating this variable needs to decompose the graph into its bi-connected components (also a linear computation, using a DFS or a BFS, see again [START_REF] Cormen | Introduction to Algorithms[END_REF], for example). Denoting our variable as NCP2, we can look at the metric E(NCP2 | NCC ≥ 2). We will not pursue these illustrations here. The goal is to show that evaluating these types of metrics is pretty straightforward, and only needs to be able to compute the corresponding graph analysis.

In the Appendix we provide analytical expressions to all the quantities described here in the case of a bridge, that can be useful to check algorithms and to observe behaviors.

Conclusions

In this chapter we first discuss the interest of moving to performability-like metrics in network reliability. This allows to distinguish several performance levels when different components fail, capturing the capacity of the system to continue to work but possibly in degraded modes. We center the chapter around one of these metrics, called resilience, that has not received yet much attention in the literature. In telecommunications, the word is being used with the same spirit but in other contexts and associated with it, there are other technologically-oriented definitions.

Then, we considered exploring these metrics with Monte Carlo. We proposed to see the standard or crude Monte Carlo procedure differently, leading to a way of implementing it with much less computational effort when components, and then systems, are highly reliable. This is just a different look at a conditional Monte Carlo approach, but it allows testing in a straightforward manner estimators for these performability metrics. Moreover, and this is how this viewpoint on standard Monte Carlo developed, we can evaluate also the sensitivities of all these metrics with respect to the (elementary) reliabilities of the systems' components, and with a very small overhead with respect to the cost of the metric evaluation itself.

In future work, we will explore appropriate ways of conditioning, depending on the metric considered, and the properties of the types of metrics we discuss here, as well as their possible uses in the area.

Fig. 1

 1 Fig.1The bridge topology.

Fig. 2 A

 2 Fig.2A widely used Arpanet topology in network reliability, from the history of this famous communication network.

Fig. 3 A

 3 Fig. 3 A covering tree on the Arpanet model of Figure 2.

Fig. 4

 4 Fig.[START_REF] Grötschel | Design of survivable networks[END_REF] Two bridges connected by a "bridge" link.

  Using the states of the links 1 , . . . ,

		naive implementation of standard Monte Carlo
		// goal: network unreliability
	// the connectivity property used is denoted here CP
	set counter to 0;
	execute	times:
	sample ;
	if the CP doesn't hold: counter + +
	return counter/N

Table 1

 1 A few sensitivities of the resilience, on the model depicted in Figure4. In the estimations, the absolute error is less than half the last significant digit (confidence level: 95%).

	edge	{1, 2}	{2, 3} {4, 5}
	sensitivity 7.01 10 -3 3.79 10 -5 16.0

Table 2

 2 Some values of resilience as increases. Same accuracy as in Table1.

	0.91 0.95 0.99 0.995	0.999	0.9999
	Res 199.8 207.2 209.9 209.977 209.9991 209.999989

Table 3

 3 Three metrics on the Arpanet, i.i.c. case (homogeneous links). All the shown digits are correct (confidence level: 95%).

		0.91 0.95 0.99 0.995	0.999
	E(NCC)	1.251 1.073 1.0027 1.00066 1.000026
	E(NCP)	199.8 207.2 209.9 209.977 209.9991
	E(NCP | NCC ≥ 2) 160.3 167.6 174.5 175.2	175.5

.

The second equality follows when using the second one in [START_REF] Valiant | The complexity of enumeration and reliability problems[END_REF]. Now, in the same paper [START_REF] Rubino | Sensitivity analysis of network reliability using Monte Carlo[END_REF], it was shown that

, is an unbiased estimator of , ; .

Remark 2 Observe that these estimators fit precisely the idea of having at our disposal the virtual table filled with the values of the states of all links and the corresponding value of NCP, at each iteration of the standard method. Actually, the idea of seeing a conditional Monte Carlo approach as described here appeared at the same time that we developed the estimators of sensitivities of classical network reliability metrics of the type presented in the chapter.

Observe that evaluating , ; adds almost no overhead to the estimation of the reliability metrics considered (classical or of the performability type).

Based on previous result, we have the following one. Taking expectations, and using the fact that E( , ) = , ; , we get

Appendix

For checking purposes, we put here analytical expressions of all the objects considered in Section 4 of the chapter, in the case of the bridge model. They are obtained basically by brute force, given the small size of the model.

• On the number of connected components NCC, NCC ∈ {1, 2, 3, 4}:

-

• On the number of communicating pairs NCP, NCP ∈ {0,

- • On the number of pairs communicating through at least 2 edge-disjoint paths: