A Framework to Analyze the Robustness of Social-ecological Systems from an Institutional Perspective

. What makes social-ecological systems (SESs) robust? In this paper, we look at the institutional configurations that affect the interactions among resources, resource users, public infrastructure providers, and public infrastructures. We propose a framework that helps identify potential vulnerabilities of SESs to disturbances. All the links between components of this framework can fail and thereby reduce the robustness of the system. We posit that the link between resource users and public infrastructure providers is a key variable affecting the robustness of SESs that has frequently been ignored in the past. We illustrate the problems caused by a disruption in this link. We then briefly describe the design principles originally developed for robust common-pool resource institutions, because they appear to be a good starting point for the development of design principles for more general SESs and do include the link between resource users and public infrastructure providers.


INTRODUCTION
Over the past century, growing human influences on biophysical processes have led to many perceived environmental problems.A typical response has been to improve our understanding of the underlying biophysical process about which decisions must be made, and thus reduce the uncertainty decision-makers must face.This is a difficult task.A degree of irreducible uncertainty always exists about how the dynamics of coupled social and ecological processes will unfold.This suggests that, rather than asking how society can better "manage" ecological resources, we ought to be asking "what makes social-ecological systems (SESs) robust?" The concept of robustness is well developed in engineering, where it refers to the maintenance of system performance either when subjected to external, unpredictable perturbations, or when there is uncertainty about the values of internal design parameters (Carlson and Doyle 2002).Robust design often involves a tradeoff between maximum system performance and robustness.A "robust" system will typically not perform as efficiently with respect to a chosen set of criteria as its non-robust counterpart.However, the robust system's performance will not drop off as rapidly as its non-robust counterpart when confronted with external disturbance or internal stresses.
Resilience, a concept similar to robustness that has been developed in ecology (Holling 1973), measures the amount of change or disruption that is required to transform the maintenance of a system from one set of mutually reinforcing processes and structures to a different set of processes and structures.Resilience is an appealing concept and it is tempting to extend it to SESs (Berkes et al. 1998).However, resilience can be difficult to apply to systems in which some components are consciously designed (Carpenter et al. 2001).More recent developments in resilience theory emphasize adaptive capacity and coupled cycles of change that interact across several scales (Gunderson and Holling 2002).These ideas are useful in a descriptive sense, but are less useful for studying designed systems.How does one design for adaptive capacity?What is the cost of adaptive capacity?Robustness, on the other hand, emphasizes the cost-benefit trade-offs associated with systems designed to cope with uncertainty.As such, robustness is a more appropriate concept when trying to understand how SESs can deal with disruptions.However, we do not abandon the concept of resilience.For example, one approach to enhance the robustness of a SES would be to focus on governance that enhances the Ecology and Society 9(1): 18. http://www.ecologyandsociety.org/vol9/iss1/art18resilience of an ecosystem configuration that produces a desirable bundle of goods and services.The important point is to recognize both the designed and selforganizing components of a SES and to study how they interact.
Given the previous discussion, it seems natural to extend the idea of robustness to a SES.However, it is difficult in practice.In engineered systems, defining a performance index is straightforward.Engineered systems are frequently relatively simple, controllable, and better understood than ecological or social systems.Even complex engineered systems that are composed of many subsystems, like a jet airplane, have relatively complete blueprints that can be used when diagnosing a problem and engaging in repair.Socio-ecological systems are never fully designed or controllable, nor are they amenable to the definition of one simple, easily measurable performance index, such as output value minus input costs.In this sense, fully engineered systems and SESs provide examples at different ends of the spectrum of systems with both designed and selforganizing subcomponents and levels of uncertainty.In the former, the majority of subsystems are designed (airplane components), very few subsystems selforganize (pressure drop over an airfoil), and uncertainty is low (mostly eliminated by wind tunnel experiments and prototype testing).In the latter, the majority of components are self organizing (ecological systems, social networks), very few are designed (rules of interaction), and uncertainty is high (experimentation is difficult or impossible).Despite these difficulties, the idea of enhancing the robustness of SESs is appealing in the present context of rapid change and increasing uncertainty at and across various scales.The first step is to develop a framework to study the robustness of SESs and then to posit broad design principles for robust SESs that may be improved with further research.
Any such framework must address three issues: 1) cooperation and potential for collective action must be maintained within the social system, 2) ecological systems are dynamic, as are the rules of the games that agents play amongst themselves, and 3) ecological systems can occupy multiple stable states and move rapidly between them.The first issue has become a well developed field over the last three decades.The conditions under which cooperation is maintained or will evolve has been the focus of field researchers, game theorists, and experimental economists for some time (e.g., Axelrod 1984, Ostrom et al. 1994, Bowles and Gintis 2003).However, this work focuses on resource users and their actions when payoffs are constant over time, i.e., the resource base is static.Dynamic or differential game theory allows the incorporation of the second issue into models of strategic interaction.Dynamic games have been applied to dynamic resource management issues (e.g., Clark 1990, Mäler et al. 2003), but here the focus is to determine optimal strategies and to assess the effectiveness of economic instruments in achieving them.Little attention has been paid to the institutional context.It is simply assumed that the necessary institutional and any other associated infrastructure is in place.Finally, the third issue has been addressed in several recent papers (Carpenter et al. 1999a, 1999b, Scheffer et al. 2001, Anderies et al. 2002, Janssen et al. 2004, Brock and Xapapadeas 2004).These studies focus on management regimes that reduce the probability that a system with multiple stable states will enter, and possibly remain in, undesirable states.However, these studies do not include institutional contexts.
The innovation in this paper is that we propose a framework to address these three issues (the resource, its governance system, and associated infrastructure) as a coupled system.We attempt to lay the foundations for eventual theories and models.We deliberately employ the term "framework."A framework identifies a broad set of variables and their linkages.Within any particular framework, alternative theories are used to make broad predictions about the effect of changes in relevant variables, and multiple models operationize theories using a variety of formal techniques (see Ostrom 1999).In this paper, we first define our area of interest and characterize "robustness" in this context.We then use this framework to discuss several general themes and apply it to specific cases.Finally, we suggest initial directions for future research.

THE FRAMEWORK
How do institutional arrangements affect the robustness of SESs?Why do some systems survive in highly varying environments over time and others collapse?Which attributes of the institutions are more likely to lead to the creation of robust SESs?How do these attributes depend on the underlying ecological system?To answer these questions, we propose a "framework" that consists of a set of definitions and a list of attributes that are of key importance to understanding the robustness of a SES.This framework is only a beginning.We present it here in order to lay the foundation for future work.

Defining a Social-ecological System
What is a SES?A SES is an ecological system intricately linked with and affected by one or more social systems.An ecological system can loosely be defined as an interdependent system of organisms or biological units."Social" simply means "tending to form cooperative and interdependent relationships with others of one's kind" (Merriam-Webster Online Dictionary 2004).Broadly speaking, social systems can be thought of as interdependent systems of organisms.Thus, both social and ecological systems contain units that interact interdependently and each may contain interactive subsystems as well.We use the term "SES" to refer to the subset of social systems in which some of the interdependent relationships among humans are mediated through interactions with biophysical and non-human biological units.A simple example is when one fisher's activities change the outcomes of another fisher's activities through the interacting biophysical and non-human biological units that constitute the dynamic, living fish stock.Furthermore, we restrict our attention to those SESs where the cooperative aspect of social systems is key, i.e., where individuals have intentionally invested resources in some type of physical or institutional infrastructure to cope with diverse internal and external disturbances.When social and ecological systems are so linked, the overall SES is a complex, adaptive system involving multiple subsystems, as well as being embedded in multiple larger systems.Given this focus, we suggest than a minimal representation includes the elements depicted in Fig. 1.Examples of the elements and their interactions are given in Tables 1 and 2. One component is a resource (A in Fig. 1) that is used by multiple resource users.Two components are composed of humans: the resource users (B in Fig. 1) and the public infrastructure providers (C in Fig. 1).There may be a substantial overlap of individuals in B and C, or they may be entirely different individuals, depending on the structure of the social system governing and managing the SES.
Public infrastructure (D in Fig. 1) combines two forms of human-made capital-physical and social (Costanza http://www.ecologyandsociety.org/vol9/iss1/art18et al. 2001).Physical capital includes any engineered works, such as dikes, irrigation canals, etc.By social capital, we mean the rules actually used by those governing, managing, and using the system and those factors that reduce the transaction costs associated with the monitoring and enforcement of these rules (Ostrom and Ahn 2003).One example of a rule used in many self-organized SESs is rotating the role of monitor among resource appropriators.In centrally governed SESs, monitors would be employed and paid by a government agency.
In our examination of robustness, we address two types of disturbances.External disturbance can include biophysical disruptions (Arrow 7), such as floods, earthquakes, landslides, and climate change, that impact the resource (A) and the public infrastructure (D), or socioeconomic changes (Arrow 8), such as population increases, economic change, depressions or inflations, and major political changes, that have an impact on the resource users (B) and the public infrastructure providers (C).Internal disturbances refer to rapid reorganization of the ecological or social system induced by the subsystems of the ecological or social system.

Highlighting the Key Drivers
Our framework highlights key interactions within SESs, often overlooked in the past, that are especially important with regard to robustness.These interactions revolve around strategic interactions between agents, the rules devised to constrain the actions of agents, and the collective-choice process used to generate the rules.We discuss each of these in turn.

Strategic Interactions
A major focus of previous literature has been strategic interactions among resource users themselves and the consequences for the resource system.Classic studies by Gordon (1954) and Hardin (1968) presumed that, without private ownership by individuals or a governmental unit, the temptation to overharvest (Link 1) and to take a free ride on public infrastructure provisions would lead to the destruction of the resource base.The "property rights" solution persisted through the 1980's as the method of choice for solving common-pool resource dilemmas, one of the possible dilemmas that resource users may experience in SESs.Scholars disagreed, however, on whether this was private or government ownership.Many models presumed very simple, single-species ecological systems (Gordon 1954).In irrigation, the presumption was that water could be delivered to farmers in known quantities following a careful marginal benefit analysis Ecology and Society 9(1): 18. http://www.ecologyandsociety.org/vol9/iss1/art18 Operational Rules and Collective-Choice Processes so that those farmers with the highest productivity would receive the most water and pay appropriately for the water they received (e.g., Smith 1988).
Most institutional analyses of SESs so far have focused on either the harvesting decisions of resource users (operational processes) or the policy choices of public infrastructure providers (collective-choice processes).Operational-level analyses have normally assumed an exogenously fixed set of rules and then determined the appropriate incentive to maximize a social welfare objective (e.g., Clark 1990).Such studies suggest that the operational rules need to be well-tailored to avoid overharvesting or, in the case of public infrastructure provision (e.g., irrigation systems), to avoid freeriders.The resulting recommendation is, frequently, that the government should manage these systems through rules that limit the choice sets of resource users with regard to harvesting or investment.Alternatively, individual rights to resource units should be determined so that a market mechanism will allocate resources to their most valued use (see Tietenberg (2002) for a recent review of this literature).
These simple models were used to determine Maximum Sustainable Yield (MSY) and Maximum Economic Yield (MEY) and to prescribe simple policies to reach these goals.Their simplicity made them tractable and appealing to scholars searching for ways to improve the performance of SESs through the application of modeling and policy analysis.For decades, donors urged developing countries to change indigenous institutions, which had existed for long periods of time, because they did not conform to the prescriptions derived from the earlier models (Lansing 1991, Mwangi 2003, Netting 1976, 1982).
We argue that a richer characterization is required to properly address the robustness of a SES.We must move beyond early work focusing on just the resource users, the incongruence between individual and collective rationality, and the problem of maintaining cooperation (Sandler 1992, Udéhn 1993, Ostrom et al. 1994).For example, referring to Fig. 1, there are a variety of strategic factors that may influence the interaction between: resource users and the public infrastructure providers (Link 2 in Fig. 1), public infrastructure providers and actual investment in the infrastructure (Link 3), resource users and the harvesting rate (Link 1), and, potentially, resource users and the public infrastructure (Link 6).Link 6 is rarely even addressed in most analyses of SESs because many analysts have ignored the active coproduction of resource users themselves in the day-today operation and maintenance of a public infrastructure (but see Evans 1997).Furthermore, the links between the ecological entities (Links 1, 4, and 5) are also sources of fluctuations that may challenge the robustness of the overall SES at any particular point in time.In Tables 1 and 2, we present an initial overview of some of the potential problems that may exist within the four entities and eight links identified in Fig. 1.
At the collective-choice level, scholars investigate how to aggregate preferences of individual resource users over various policies and the likely outcomes of various voting procedures given the preference structure involved.Arrow (1951) highlighted the impossibility of mapping individual preference orderings into a societal preference order.Shepsle's (1979Shepsle's ( , 1989) ) work showed how institutions may solve some of these problems by empowering some actors and demoting others.McKelvey's (1976McKelvey's ( , 1979) chaos theorem asserts that (a) when a policy has more than one dimension, the social preference ordering is likely to be intransitive, and (b) by manipulating the agenda, public infrastructure providers can choose anything!That is, group choice becomes completely unpredictable and, what is perhaps worse, subject to strategic manipulation by a smart agenda-setter.
We argue that the operational and collective-choice levels must be analyzed together in order to assess the robustness of SESs.Thus, the main aspect of the framework (Fig. 1) that we wish to examine first in this paper is the link between the operational level (resource users) and the collective choice level (public infrastructure providers).Depending on the precise implementation of the institutional rules, conflicts between resource users and public infrastructure providers may exist because there may be a mismatch We know it is not possible to have one integrated model that captures all these potential interactions.It is important, however, to understand the broad structure of the entities and links in a SES and to begin to show how the strategic interactions within and between entities affect the likelihood of long-term robustness.
That is what we hope to illustrate in this paper and other research in progress.http://www.ecologyandsociety.org/vol9/iss1/art18between costs and benefits.For example, resource users may not be willing to pay a tax if public infrastructure providers do not invest in and maintain a public infrastructure that is of benefit to the resource users.

Robustness in SESs
Given our characterization of the main components of a SES and the key drivers, we can now define robustness more precisely.By robustness, we mean "the maintenance of some desired system characteristics despite fluctuations in the behavior of its component parts or its environment" (Carlson and Doyle 2002).Unfortunately, which kinds of system failure should be measured are not very clearly defined for SESs (Carpenter et al. 2001).To examine robustness, at a minimum the following questions must be addressed: (1) What is the relevant system?
(2) What are the desired system characteristics?and (3) When does the collapse of one part of a SES imply that the entire system loses its robustness?For example, when a particular ecological system collapses, but the social system continues to function due to its ability to adapt and use alternative resources, is that system robust?Or, does the entire system lose its robustness due to the robustness of the social component?
Within SESs, this difficulty of interpretation is a problem of defining the appropriate scale of analysis.
For example, a small-scale (or short time scale) resource might collapse in order to maintain desired functions at a larger scale (or longer time scale).One example is the transformation of mangroves and rice fields in Thailand and Vietnam for intensive shrimp aquaculture, an activity that is unsustainable but argued to be necessary as a stepping stone (short time scale) toward the industrial development (long-term stability) of these countries (Lebel et al. 2002).
Another example is peat mining in Holland, mainly during the 17 th century, to meet the demand for fuel in Dutch cities (Westbroek 2002).Peat bogs were drained in order to mine the peat.Interestingly, the characteristic Dutch landscape of waterways, polders, and dikes is nowadays viewed as natural, but was actually a peat bog before the peat mining industry started a few centuries ago.
As we explicitly analyze SESs, we distinguish between the collapse or undesirable transformation of a resource (e.g., a fishery or a water distribution system that is no longer productive), and the collapse or loss of robustness of the entire system.We require that both the social and ecological systems collapse before we classify a SES as collapsed and, thus, implicitly define our scale of analysis (or system boundary) to include the human social system and all the ecological systems from which it extracts goods and services.
For example, a social system that rewards innovation can be robust to many external shocks, as long as it innovates quickly enough.As Anderies (2003) shows in a recent paper, however, such innovation can make the eventual collapse of a larger-scale system more extreme.Unless a society can manage to organize around principles other than "replacement technologies," its eventual collapse is likely.Are such SESs robust?We would argue that they are, with respect to a certain time scale.As time progresses and problems become more complex, the probability increases that the society will eventually fail to cope with a shock.Eventually, a "collapse" event will be triggered, after which reorganization will occur on a very large scale (Holling's r-K phase followed by Ω) (Holling 1986).
In summary, we suggest that a SES is robust if it prevents the ecological systems upon which it relies from moving into a new domain of attraction that cannot support a human population, or that will induce a transition that causes long-term human suffering.We might argue that the ability of a social system (B and C in Fig. 1) to persist in the face of an ecological collapse is a sign that that system has a low adaptive capacity in relation to that ecological resource.Rather than searching for mechanisms to prevent the collapse of a resource base, the social system maintains itself and looks for another resource to exploit.Eventually, we hope to be able to offer some useful suggestions for how to avoid this sequential destruction of natural resources.

APPLYING THE FRAMEWORK: DESIGNING FOR ROBUSTNESS
In this section, we apply the framework to highlight aspects of robust designs for SESs.Through the discussion of general examples, we highlight examples of vulnerabilities that reduce the robustness of SESs and reflect on Ostrom's (1990) design principles for common-pool resource institutions.These principles were based on extensive field work and extensive reviews of case-study literature and of the growing http://www.ecologyandsociety.org/vol9/iss1/art18theoretical literature on institutions.The cases varied from small, self-contained systems of homogeneous resource users to complex systems organized in modern economies where the resource users were linked to public infrastructure providers through a variety of mechanisms.Rather than focusing on specific rules, we tried to identify underlying design principles that characterized robust common-pool resource institutions.We do not claim that the people crafting these institutions intentionally used these design principles, but rather that robust systems could be characterized as incorporating a large number of these principles.The design principles identified at that time are listed in Table 3. Table 3. Design principles derived from studies of long-enduring institutions for governing sustainable resources

Clearly Defined Boundaries
The boundaries of the resource system (e.g., irrigation system or fishery) and the individuals or households with rights to harvest resource units are clearly defined.

Proportional Equivalence between Benefits and Costs
Rules specifying the amount of resource products that a user is allocated are related to local conditions and to rules requiring labor, materials, and/or money inputs.

Collective-Choice Arrangements
Most individuals affected by harvesting and protection rules are included in the group who can modify these rules.

Monitoring
Monitors, who actively audit biophysical conditions and user behavior, are at least partially accountable to the users or are the users themselves.

Graduated Sanctions
Users who violate rules-in-use are likely to receive graduated sanctions (depending on the seriousness and context of the offense) from other users, from officials accountable to these users, or from both.

Conflict-Resolution Mechanisms
Users and their officials have rapid access to low-cost, local arenas to resolve conflict among users or between users and officials.

Minimal Recognition of Rights to Organize
The rights of users to devise their own institutions are not challenged by external governmental authorities, and users have long-term tenure rights to the resource.

For resources that are parts of larger systems:
8. Nested Enterprises Appropriation, provision, monitoring, enforcement, conflict resolution, and governance activities are organized in multiple layers of nested enterprises.
One limitation of the original design principles is that ecological dynamics are not explicitly addressed (Brown 2003).Future versions of the design principles should address mechanisms related to the match between the spatial and temporal dynamics of ecological and social systems, e.g., those that sustain Ecology and Society 9(1): 18. http://www.ecologyandsociety.org/vol9/iss1/art18institutional and ecological memory (Berkes et al. 1998).Several aspects of the case studies that follow highlight the importance of the close link between the biophysical and social components of these systems.However, our analysis just scratches the surface of this important issue that deserves significant future research effort.

The Cases
Many examples exist of complex interactions between the components of a SES.Many are farmer-organized irrigation systems, such as those of Bali (Lansing 1991), the zanjeros of the Philippines (Siy 1982) and of Spain (Maass and Anderson 1986).These are examples of long-lived, "robust" irrigation SESs.The Hohokam, on the other hand, provides an example of a long-lived irrigation SES that eventually collapsed (Bayman 2001).Other examples come from managed fisheries, forests, and dike systems.Some of these are long-lived and remain robust, e.g., the Dutch water boards (Kaijser 2002), the lobster fisheries in Maine (Acheson 2003), or the Hatfield Forest (Rackham 1988), but others were long-lived and yet eventually collapsed, e.g., early Mesopotamian civilization, the lowland Mayas (Tainter 1988), Chacoan culture (Mills 2002), Mesa Verde (Lipe 1995), the northern cod fisheries (Finlayson and McCay 1998), and the customary marine system of the Tonga (Malm 2001).Other SESs have not been long lived and have been rapidly destroyed, e.g., the Aral Sea (Glantz 1999).Still others never seem to get organized in the first place and experience substantial overuse and mismanagement, e.g., the oyster fishery of Chesapeake Bay (McHugh 1972) or the irrigation systems of Ghana (Webb 1991).
Our objective is not to characterize the robustness of each of these cases in detail in this article.Rather, we look for commonalities.Each case includes a common-pool ecological resource that has two characteristics (Ostrom et al., 1994): 1) it is costly to devise physical (e.g., fences) and institutional (e.g., boundary rules) means of excluding potential beneficiaries, and 2) one person can withdraw valued "resource units" (e.g., water, fish, CPU time) from the system for the given infrastructure at a particular point in time that cannot be used by others.When exclusion is difficult and consumption is subtractive, resource users face incentives to overharvest, to freeride on the provisional infrastructure, and to shirk maintenance, unless institutions are crafted, monitored, and enforced that counteract these incentives.What can we learn about general robust design principles from these cases?

The Simplest Type of Case
The simplest case of the link between B and C (the operational and collective-choice levels discussed above) would be a small group with relatively homogeneous interests in which each agent acts as both a resource user and an infrastructure provider.Furthermore, if there is no medium of exchange other than labor and goods, cooperation in constructing and maintaining infrastructure must be undertaken by transparent means.An example might be a small irrigation system where the farmers meet once a year to decide how many days they will work to repair and maintain the canal and how they will monitor each other's use of the flow of water from the system (see Tang 1992, Lam 1998, Ostrom 1992).If all farmers are required to be present for a work day to maintain a canal, it is easy to detect non-cooperation.This is also the group that sets the rules for allocating water and these rules need to be relatively easy to understand, monitor, and enforce.So, in such a system, the resource users are also involved in collective choice and impose upon themselves harvesting rules and investment requirements.Such rules then tend to be perceived by resource users as legitimate and tend to be followed without high costs of monitoring and enforcement.If such systems experience few external challenges, they can sustain themselves for very long periods.Some long-lived irrigation systems in Asia (Coward 1979, 1980, Siy 1982) were examples of this kind of extremely simple SES until the end of the last century.
Although SESs consisting of small homogeneous groups of resource users can function for long periods of time, they are not immune to new disturbances.Challenges to the continuation of these SESs come from outside the system, such as new technologies, new job opportunities, and new media of exchange.Our framework can be useful to understand the impact of such challenges, as we illustrate with some examples below.
In the case where the actors at the operational and collective-choice levels are roughly the same individuals, the system is likely to persist in an environment with a stable disturbance regime.Because the SES is well adapted to this stable disturbance http://www.ecologyandsociety.org/vol9/iss1/art18regime, however, it may not be robust to challenges coming from outside the system.An example might be the construction of a new road.The population in the system may decline as a result of better opportunities elsewhere, leading to declining investments in maintenance and a resulting decay of the SES.On the other hand, the population may increase as a result of immigration or accelerated natural growth (e.g., a decline in the death rate due to better health care, the option to import food in periods of scarcity, etc.) and this may threaten the SES.More resource users may harvest the resource, challenging the rule makers at the collective-choice level to develop new and better ways to allocate resource units.Alternatively, they might provide more labor and investments in the public infrastructure to increase the carrying capacity of the system (Fox 1993, Leach andFairhead 2000).
With a larger population size, it becomes more likely that task specialization will occur.A subset of resource users may now become public infrastructure providers.As long as there is a strong social embedding of public infrastructure providers within the community of resource users, control and monitoring networks may be strong, and the system may persist for a long time.The irrigation system of Bali is an example.Temple priests act as public infrastructure providers by giving advice, maintaining knowledge, and ensuring coordination (Lansing 1991).The public infrastructure providers are closely related to the resource users as the priests are family members of the resource users.When the Indonesian government imposed the Green Revolution to increase rice production, the robustness of the Bali irrigation system was seriously challenged.The bureaucrats from the Indonesian government lacked an understanding of the system.The introduction of new rules and infrastructure (artificial fertilizers and new rice varieties) and ignorance of indigenous rules resulted in water shortages and pest outbreaks (Lansing 1991).
Changes in the economic opportunities in a region may also challenge a SES.When all resource users depend heavily on the resource, they are more likely to follow rules and contribute time and effort to coproducing infrastructure.Baker (in press) analyzes a set of 39 farmer-managed irrigation systems in Himalchal Pradesh, India, where some farmers using an irrigation system began to obtain significant offfarm income.Baker finds that their valuation of some of the resources and their own time changed substantially.For some SESs, the resource is thus reduced to marginal economic importance.The cost of the work required to maintain those irrigation systems exceeded benefits generated and these systems collapsed, although others with higher continuing economic value reorganized their rules and continued as robust SESs.
Just the introduction of money as a medium of exchange can, by itself, be an important disturbance.When labor is the primary medium of exchange, investment in public infrastructure is easy to monitor.Furthermore, resource users can easily see where this input is allocated.If, for example, the public infrastructure providers request resource users to build them beautiful homes, resource users can object on the grounds that such activity does not contribute to their irrigation system.If money is involved, it is more difficult to monitor both the tax-paying efforts of resource users and the rent allocation of the public infrastructure providers.

More Complex Types of Cases
Beyond the case of small, homogeneous groups involved in a pattern of mutual reciprocity to produce an obvious collective benefit, the picture becomes more difficult.The more the composition of the resource users and the public infrastructure providers differs, the more complex incentive structures become.In an extreme case, when there is no overlap, public infrastructure providers have an incentive to engage in rent seeking, by imposing high taxes on the resource users and yet not investing in public infrastructure.In such a case, the public infrastructure providers do not depend on the SES and may act as "roving bandits," extracting wealth with little regard for the future (Olson 1993).Multiple variations exist between these two extremes: • The public infrastructure providers may be (elected) representatives from the population of resource users.As they also benefit from the resource, there is an incentive to invest in public infrastructure.However, problems with rent seeking and lobbying may lead to little investment reaching public infrastructure.Therefore, it is important how Link 2 is implemented, so that public infrastructure providers experience the consequences when resource users are not satisfied with their decisions.http://www.ecologyandsociety.org/vol9/iss1/art18 Resource users and public infrastructure providers may posess different information sets.Resource users may have better knowledge concerning resource dynamics, but the public infrastructure providers may have better knowledge of larger-scale processes.Public infrastructure providers may generate harvesting rules without sufficient understanding of the resource dynamics, and thus may generate unintended consequences.An example is the collapse of the northern cod fishery.Government scientists used a scientific model of the fishery and highly aggregated data to assert that the amount of fish being harvested was within the MSY, although the fishers argued, based on the size of the catch in their nets, that the fishery was in grave danger (Finlayson and McCay 1998).Some argue that the politicians and bureaucrats were biased when choosing which scientific information to include in the decision making (Spurgeon 1997).Public infrastructure providers are often unable to directly observe the diverse dimensions of the state of the resource in complex SESs.They may derive information about the functioning of the resource in different ways.For example, resource users who directly experience the resource dynamics (Link 1) may provide the information to the public infrastructure providers (Link 2), which may, for various reasons, include misinformation.Public infrastructure providers may also employ scientists or others who study the resource (Link 5), and report back to the them (Link 3).Again, the indirect method of deriving information may lead to errors in translation.
Heterogeneity may exist in the benefits resource users derive.Some may benefit from the public infrastructure and others may not.Non-beneficiaries may refuse to pay tax.The Aral Sea is an extreme example of heterogeneity.Farmers upstream benefited from the irrigation infrastructure, but those who depended on the ecological services of the Aral Sea witnessed the disappearance of their resource system.In more complex SESs, the boxes in the framework consist of a diversity of agents who may have conflicting goals and attributes.
The public infrastructure provider may behave as a stationary bandit, who has some incentive for investing in improvements because he will reap some return from those improvements (Olson 1993).Therefore, the public infrastructure provider has an incentive to invest in the public infrastructure to maximize his or her long-term tax revenues without regard for the welfare of resource users.
In some cases, relatively robust local SESs have been seriously challenged by a lack of understanding of public infrastructure providers (such as governmental bureaucrats), of how they operate, and of why an effective link between the resource users and the public infrastructure providers is so essential.An intriguing example is from Taiwan, where the weakening of Link 2 led to a weakening of Links 3 and 6.There, a set of 17 irrigation associations has been responsible for the operation and maintenance of a large number of Taiwan's irrigation systems.The irrigation associations were corporations organized by the farmers, who paid fees to their local irrigation association.The local irrigation association, in turn, took substantial responsibility for the day-to-day maintenance and operation of local canals, and the Government of Taiwan undertook responsibility for the construction and operation of the larger irrigation works.Thus, the irrigation associations acted as local public infrastructure providers that were linked to a larger-scale public infrastructure provider.The irrigation associations have repeatedly been acclaimed as major contributors to efficient irrigation in the country and thus to substantial agricultural development (Levine 1977, Moore 1989, Lam 1996).
Taiwan, like other countries whose economies are less and less dependent on agriculture and increasingly dependent on industrial and service industries, has been trying to find ways of adjusting a variety of economic policies.Furthermore, the rural population still has a significant vote and national politicians have been vying for support in the rural areas.In the early 1990s, politicians argued that farmers faced hard times and could not make a decent living."The government, argued these politicians, should not burden the farmers with irrigation fees.In 1993, after much political negotiation, the government agreed to pay the irrigation fees on behalf of the farmers" (Lam 2003).As it turned out, both major national parties supported the cancellation of irrigation fees as no one wanted to be seen as being against the farmers, even though many of the officials familiar with irrigation expressed substantial concern about the long-term consequences.
The cancellation of the fee has had substantial and unexpected adverse consequences.Farmers are much less likely to volunteer for work activities, to pay voluntary group fees, or to pay much attention to what is happening on the canals and in the ecological environment around them, as they had done earlier (Wade 1995).As one irrigation association official http://www.ecologyandsociety.org/vol9/iss1/art18expressed it: "The problem facing irrigation management at the field level is not simply a matter of finding one or two farmers to serve as local group leaders, the more serious challenge is that nowadays fewer and fewer farmers have good knowledge of their own systems and understand how to engage with one another in organizing collective action" (quoted in Lam 2003).Maintenance of the systems has declined precipitously.The cost of water has been increasing rather than decreasing.Thus, systems that had been robust for long periods of time have largely been destroyed in an effort "to help" the resource users by changing Link 2 between the users and the public infrastructure providers.The problem of misunderstanding what makes a SES robust can lead to public policies that undermine the more successful SESs.

Design Principles for Robustness
We do not wish to argue that the only robust SESs are small-scale common-pool resources in remote locations serving a homogeneous community without market opportunities or access to a commonly used medium of exchange (see Dietz et al. 2003).We started with the example of how operational and collective-choice situations may be robustly linked as the "simplest" possible example of a relatively robust system.In such a simple SES, it is easy to understand why the system can be robust over very long periods: the resource users and the public infrastructure providers are the same individuals who observe on a daily basis each other's behavior and the impact of their actions on the resource.They solve their internal problems through reciprocity and trust based on reputation and repeated interactions over an indefinite time horizon (Ostrom 1998).Such systems may collapse rather rapidly, however, when large biophysical or socioeconomic disturbances occur.
The design principles of Ostrom (1990) were developed with robustness in mind.However, Ostrom used the definition of Shepsle (1989), and studied whether the institutions were robust or in institutional equilibrium.To enhance the robustness of SESs, it might be desirable to have institutions that are not persistent but may change as social and ecological variables change.Ostrom (1990) mentioned that "appropriators designed basic operational rules, created organizations to undertake the operational management of their CPRs, and modified their rules over time in light of past experience accoding to their own collective-choice and constitutional-choice rules."This statement illustrates a situation in which a social system adapts to an ecological system whose dynamics do not change over time.Ecological dynamics may change, and institutions may need to adapt to this change in order to sustain the robustness of the SES.We do not yet know in detail what the design principles for robustness of SESs are.However, we will briefly discuss aspects of the original design principles that suggest they are a good starting point.
We now return to the principles listed in Table 3.Why would these design principles enhance robustness in SESs?Clearly defined boundaries (Principle 1) help identify who should receive benefits and pay costs.If boundaries are not well defined, resource users are less willing to trust one another and the public infrastructure providers.Assigning a rough proportionality between the benefits a resource user obtains and his or her contributions to the public infrastructure (Principle 2) is considered a fair procedure in most social systems (Isaac et al. 1991).Decisions that are considered fair reduce the chance that the resource users will try to challenge, avoid, or disrupt the policies of the public infrastructure providers.Decisions by local users to establish harvesting and protection rules (Principle 3) enable those with the most information and highest stakes in a system to have a major voice in regulating use.This principle emphasizes the importance of Link 2 in Fig. 1.Furthermore, rules that are established by most of the resource users themselves are better known, understood, and perceived as being legitimate.
The first three principles together help solve core problems associated with freeriding and subtractability of use.They do not by themselves necessarily improve the robustness of a SES because rules made to solve these problems are not self-enforcing.Thus, incorporating monitoring (Principle 4), graduated sanctioning (Principle 5), and conflict-resolution mechanisms (Principle 6) as part of the public infrastructure provides continuous mechanisms for invoking and interpreting rules and finding ways of imposing sanctions that increase common knowledge and agreement.These principles, taken together, can be thought of as a feedback control for resource use.They transform information about the state of the system into actions that influence the system.However, the constraints imposed by rules are not like the constraints imposed by the physical infrastructure.Whether resource users follow the rules depends on http://www.ecologyandsociety.org/vol9/iss1/art18their perception of legitimacy and whether the rules are monitored and enforced.Thus, given that agents do not possess perfect information about the state of the system and actions of other agents, the SES can become fragile from within due to conflicts over the interpretation of rules, whether certain agents have indeed broken a rule, and the nature of the appropriate punishment.Without regular access to low-cost and rapid conflict-resolution mechanisms to mediate this internal noise, the common understanding about what rules mean can be lost.Graduated sanctions preserve a sense of fairness by allowing flexible punishment when there is disagreement about rule infractions.Without these mechanisms, the incentives to overharvest and freeride may again dominate strategic behavior.
Recognizing the formal rights of users to do the above (Principle 7) prevents those who want to evade local systems from claiming a lack of legitimacy.In addition, nesting a set of local institutions into a broader network of medium-to larger-scale institutions helps ensure that larger-scale problems are addressed as well as those that are smaller.Institutions that have failed to sustain resources tend to be characterized by very few of these design principles, and those that are characterized by a few of the principles are fragile.
We expect that more systematic analyses of the robustness of SESs will provide design principles concerning how communities deal with ecological dynamics at various scales.Such principles will include, for example, sustaining memory, adapting rules when ecological conditions change, maintaining institutional diversity, or experimenting systematically with alternative institutional configurations.

CONCLUSION
We have presented an initial framework for the analysis of the robustness of SESs.Our framework is useful for scholars from diverse disciplines as a method for analyzing the internal dynamics within the components of a SES and the important links among the components.The design principles that were originally developed to understand robust, but simple, common-pool resources are, we think, a good starting point for developing further design principles of robust but more complex SESs.Given that many scholars have independently examined the relevance of these design principles for explaining the difference between sustainably vs. unsustainably managed SESs, we have some confidence in starting here (Guillet 1992, Abernethy andSally 2000;de Moor et al. 2002, Kaijser 2002).Future research will include the development of a set of formal dynamic rule-based models for various types of SESs that will enable us to examine specific conditions and identify specific components of SESs that enhance or reduce the robustness of SESs (Anderies 2002, Janssen 2002).
In this paper we have made some modest steps in what might become an exciting journey to understand how institutional arrangements affect the robustness of SESs.We hope that the proposed framework will function as a valuable roadmap on this journey.

Fig. 1 .
Fig. 1.A conceptual model of a social-ecological system.

Table 1 .
Entities involved in social-ecological systems

Table 2 .
Links involved in social-ecological systems