Kebin Zeng

Hanne Flemming Nielson

Riis Nielson

Hanne Riis Nielson

The Stochastic Quality Calculus

de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Networked communication is the key for modern distributed systems as found in Systems of Systems [START_REF] Connect | Report from the European Union workshop on Directions in Systems of Systems Engineering as part of Horizon[END_REF] -encompassing service-oriented systems as well as cyberphysical systems -and including systems that are essential for the infrastructure in the 21 st century. Safety as well as security are key concerns for many of these systems and in particular denial of service attacks have received attention. Massive amounts of requests may be sent to a process thereby making it unavailable for genuine communication and in the case of wireless communication the actual communication may also be disrupted by interference with the frequency band and physically shielding the antennas of senders and receivers.

The Quality Calculus. The classical "super-optimistic" programming style of traditional software development no longer suffices -we need to take into account that the expected communications might not occur and that the systems still have to coordinate to the extent possible: we have to turn to a "realisticpessimistic" programming style. The Quality Calculus introduced in [START_REF] Riis Nielson | A calculus for quality[END_REF] is a first step towards a calculus supporting this change of paradigm; the communication paradigm is point-to-point (as in the π-calculus [START_REF] Milner | Communicating and Mobile Systems: the Pi-Calculus[END_REF]) and is accompanied by a SAT-based analysis for checking whether the processes are vulnerable to unreliable communication. Probabilistic reasoning is added to the calculus in [START_REF] Riis Nielson | Probabilistic analysis of the quality calculus[END_REF] in a setting where each input binder is annotated with a probability distribution indicating the trustworthiness of the inputs received with respect to a security lattice; a probabilistic trust analysis is then developed in order to identify the extent to which a robust programming style has been adhered to. Furthermore, a broadcast version of the calculus is developed in [START_REF] Vigo | Broadcast, denial-of-service, and secure communication[END_REF]; here it is additionally extended with cryptographic primitives and the focus is on the development of a rewriting semantics allowing us to reason -in a discrete setting -about unsolicited messages as well as the absence of expected communications.

Our contribution. The Stochastic Quality Calculus (SQC) presented in this paper is an extension of the previous works, and it differs in several aspects. First, it supports truly concurrent broadcast communication meaning that several processes may send messages at the same time (also over the same channel) and all processes that are ready to receive these messages must do so. Another main difference it that the timing aspect plays a central role. The time for completing a communication depends on the hardware architecture and the communication protocols but also the cyber environment. Hence real time considerations are relevant for those communications taking exact duration, and stochastic time considerations are relevant for those taking random time influenced by the cyber environment.

In our calculus, we use generally distributed random variables to characterise communication delays, so that both continuous stochastic time and real (exact duration) time can be expressed. An output process has the form t 1 ! G t 2 .P specifying that the value t 2 should be communicated over the channel t 1 within some time determined by the general distribution G. A unique feature of the Stochastic Quality Calculus is an input binder of the form:

& [a,a ) q (c 1 ?x 1 , • • • , c n ?x n ).
It specifies that the process is waiting for n inputs over the channels c 1 , • • • , c n ; it is waiting for at least a time units and at most a time units, where a < a . The quality predicate q determines when sufficient inputs have been achieved and will then allow the process to continue before a time units have passed (provided that a time units already have passed). The quality predicate q may be ∃ meaning that at least one of the n inputs must have been received, it may be ∀ meaning that all the n inputs must have been received, but other combinations are also possible. The continuation process will then have to inspect which inputs have been received and take appropriate actions in each case -thereby enforcing the "realistic-pessimistic" programming style alluded to above.

Related work.

The challenge of combining concurrency and stochasticity has been addressed in previous stochastic process calculi as PEPA [START_REF] Hillston | A compositional approach to performance modelling[END_REF] and IMC [START_REF] Brinksma | Process Algebra and Markov Chains[END_REF]; the challenge of combining concurrency, stochasticity and mobility have been addressed in the stochastic π-calculus [START_REF] Priami | Stochastic π-calculus[END_REF] and StoKLAIM [START_REF] De Nicola | Stoklaim: A stochastic extension of klaim[END_REF]; the challenge of combining concurrency and real time have been addressed in timed CCS [START_REF] Yi | CCS + time= an interleaving model for real time systems[END_REF] and PerTiMo [START_REF] Ciobanu | PerTiMo: A Model of Spatial Migration with Safe Access Permissions[END_REF]. Most stochastic calculi make use of exponential distributions (denoted Exp) to express random delay, and can then use classic techniques and tools for Markov chain analysis. However, it is well-known that Exp distributions often are inadequate to faithfully model many phenomena, where the systems contain real time delays or highly variable distributed durations. The work of e.g. [START_REF] Bravetti | Towards performance evaluation with general distributions in process algebras[END_REF][START_REF] Nielsen | Model checking multivariate state rewards[END_REF] go one step further and incorporate general distributions thereby expressing a rich class of randomness. However, the real time (exact duration) delays are much less frequently incorporated in stochastic process calculi.

A CCS-like process algebraic framework introduced in [START_REF] Markovski | Real and stochastic time in process algebras for performance evaluation[END_REF] considers both discrete real time and generally distributed stochastic time. It uses a "spent-lifetime" semantics to track the time passed since activation to perform a race among parallel processes without a clock. Differently, SQC utilizes a clock to keep tracking residual lifetimes for the race, which avoids the complexity of time additivity mentioned in [START_REF] Markovski | Real and stochastic time in process algebras for performance evaluation[END_REF]. Besides, the transformational semantics of SQC gives a clear picture of the separation of the stochastic aspect and the real time aspect:

-for local processes, process transitions replace all stochastic time variables by sampled clock values with no consideration of time features; -for global systems, real timed system transitions generate events and update the clocks with no consideration of stochastic features.

Overview. In Section 2 we introduce the syntax of the Stochastic Quality Calculus. The operational semantics of processes is presented in Section 3; it makes use of general distributions and in Section 4 we show that it amounts to Generalised Semi-Markov Decision Processes (GSMDPs) [START_REF] Doshi | Generalized semi-markov decision processes[END_REF] by modelling truly concurrent broadcast communication as discrete events. Some of the discrete events in GSMDPs are controllable, which introduces a decision dimension to execute controllable events nondeterministically; a policy (as in Markov decision processes [START_REF] Puterman | Markov Decision Processes: Discrete Stochastic Dynamic Programming[END_REF]) is introduced to deal with the nondeterminism. The classical problem is then to find an optimal strategy to maximise some reward function on GSMDPs and we refer to [START_REF] Doshi | Generalized semi-markov decision processes[END_REF][START_REF] Younes | Solving generalized semi-markov decision processes using continuous phase-type distributions[END_REF] for the analysis.

In order to avoid the decision dimension and perform purely stochastic reasoning on the systems, in Section 5 we introduce two analysable fragments of SQC that both admit truly concurrent behaviour. The first fragment does not contain the non-determinism thereby obtaining Generalised Semi-Markov Processes (GSMPs) [START_REF] Matthes | Zur theorie der bedienungsprozesse[END_REF][START_REF] Glynn | A GSMP formalism for discrete event systems[END_REF] that can be analysed using statistical model checking [START_REF] Younes | Ymer: A statistical model checker[END_REF][START_REF] Younes | Numerical vs. statistical probabilistic model checking[END_REF].

The second fragment maps further to numerically analysable GSMPs [START_REF] Lindemann | Numerical Analysis of Generalized Semi-Markov Processes[END_REF] that can be analysed using stochastic model checking techniques for Continuous Time Markov Chains [START_REF] Kwiatkowska | Stochastic model checking[END_REF] and Continuous Stochastic Logic [START_REF] Aziz | Verifying continuous time Markov chains[END_REF]. We conclude and present future work in Section 6.

Syntax of SQC

The syntax of the Stochastic Quality Calculus (SQC) consists of processes P , input binders b and terms t, as given in Table 1. A system S consists of a number of process definitions and a main process:

define A 1 P 1 . . .

A n P n in P * using c 1 , • • • , c m
Here A i is the name of a process, P i is its body, P * is the initial main process and c 1 , • • • , c m is a list of all the global channel names.

A process can have the form (νc) P introducing a new channel c with scope P , and it can be an empty process denoted 0; we shall feel free to dispense with trailing occurrences of the process 0. An output process has the form t 1 ! G t 2 .P specifying that value t 2 is transmitted over channel t 1 with a communication delay specified by the general distribution G. In SQC, we use broadcast transmission, so that all the receivers waiting on channel t 1 receive the value t 2 . An input process has the general form b.P , where b is a binder specifying the desired inputs with real time constraints to be satisfied before continuing with P .

A binder may have the form t?x stating that some value should be received over channel t, and stored in the variable x. More generally, a binder has the form & I q (t 1 ?x 1 , • • • , t n ?x n ) indicating that n inputs are simultaneously active: a quality predicate q determines whether sufficient inputs have been received to continue; a non-empty semi-closed time interval I determines when control is transferred to the continuation processes. The quality predicate q expresses when enough inputs have been received to continue; it can be ∃ meaning that one input is required, or it can be ∀ meaning that all inputs are required; formally

∃(x 1 , • • • , x n ) ⇔ x 1 ∨ • • • ∨ x n and ∀(x 1 , • • • , x n ) ⇔ x 1 ∧ • • • ∧ x n .
For more expressiveness, we shall allow quality predicates as for example [

1 ∨ (2 ∧ 3)](x 1 , x 2 , x 3 ) ⇔ x 1 ∨ (x 2 ∧ x 3 ).
A non-empty semi-closed time interval I takes the form [a, a ) meaning that the binder has the minimum waiting time a and maximum waiting time a (for 0 ≤ a < a ≤ ∞). As special cases a may be 0 or a may be ∞ and the subsequent development can be simplified in these cases; we shall feel free to leave the interval field empty when I = [0, ∞).

As an example, the system &

[a,a ) ∃ (c 1 ?x 1 , c 2 ?x 2 ).P || c 1 ! G1 t 1 || c 2 ! G2 t 2 expresses
that two output processes are simultaneously active at time 0, and wait for their output to be accomplished; the quality predicate ∃ of the input process will be evaluated at time a for the first time and the input process will continue with P if at least one of the two inputs has arrived. If not, the input process shall wait until one input arrives in the period [a, a ); if no input has arrived at

P ::= (νc) P | 0 | t1! G t2.P | b.P | case x of some(y) : P1 else P2 | P1 || P2 | A b ::= t?x | & I q (t1?x1, • • • , tn?xn) t ::= y | c Table 1. Syntax of the Stochastic Quality Calculus.
time a , the process shall stop waiting (i.e. time-out) and continue with P even though no input has been received.

In SQC, communication delays are associated with outputs. Thus, a process takes a generally distributed time to send some data out on the channel, but it takes instantaneous time for receiving and storing the data. This is reflected in the syntax where we write t 1 ! G t 2 for output and t?x for input. Associating delays with outputs rather than inputs is a deliberate design decision that is helpful for identifying analysable fragments of SQC later.

As a consequence of using a general binder, some variables might not obtain proper values as the corresponding inputs are missing. To model this we shall use optional data types as known for example from Standard ML [START_REF] Milner | A proposal for standard ML[END_REF]. Let y denote data variables and let x denote optional data variables. Also, let some(• • • ) express the presence of some data and none the absence of data. The case construct case x of some(y) : P 1 else P 2 has the following meaning: if x evaluates to a value some(c) then we bind c to y and continue with P 1 ; otherwise x evaluates to none and we continue with P 2 .

Continuing with the processes we also have parallel composition P 1 || P 2 . A process can also be a recursive call A to one of the defined processes.

We forbid recursion through parallel composition, thereby ensuring that the resulting semantics has a finite state space. We shall say that A P has no recursion through parallel composition if the syntax tree for P does not contain any process name B in a descendant of a || construct, such that B might (perhaps indirectly) call A.

We also forbid the creation of new channels in recursion, so that we have a finite number of channels that can be used. Let fc(P ) be the set of free channel names in the process P ; for A i P i we define fc(A i ) as the least solution to the simultaneous equation system fc

(A i ) = fc(P i ) (for i = 1 • • • n).
We say that A P has no creation of new channels in recursion if the syntax tree for P does not contain any process name in a descendant of a (νc) construct.

Finally, for a system of the form displayed above we shall require that the initial main process P * as well as the bodies P i have no free variables over neither data nor optional data, and that their free constants are among c 1 , • • • , c m . P ≡ P (νc) P ≡ P if c / ∈ fc(P )

A ≡ P if A P P1 ≡ P2 ⇒ C[P1] ≡ C[P2] P || 0 ≡ P P1 || P2 ≡ P2 || P1 P1 ≡ P2 ⇒ P2 ≡ P1 P1 ≡ P2 ∧ P2 ≡ P3 ⇒ P1 ≡ P3 (νc) (P1 || P2) ≡ ((νc) P1) || P2 if c / ∈ fc(P2) (νc1) (νc2) P ≡ (νc2) (νc1) P if c1 = c2
Table 2. The structural congruence.

[

INPUT] b ::tt θ b.P → P θ [OUTPUT] ω ∼ G c! G d.P → c! ω d.P [CONGRU] P ≡ Q Q → R P → R [PARA] P1 → P 1 P1 || P2 → P 1 || P2 [CASE1] case some(c) of some(y) : P1 else P2 → P1[y → c]
[CASE2] case none of some(y) : P1 else P2 → P2 Table 3. Transition relation for processes.

Semantics of SQC

The semantics consists of a structural congruence and a transition relation for processes and on top of this we define a transition relation for systems. To facilitate this we need to define the semantics of binders and this includes a transformation, a test on when the binder is satisfied and a transition relation for binders. Throughout this section we need to take care of the generally distributed output delays and the timing requirements.

The structural congruence defined in Table 2 is standard. The contexts C are defined by:

C ::= [ ] | (νc) C | C || P | P || C
As usual we apply α-conversion whenever needed to avoid accidental capture of names during substitution.

The transition relation for processes has the form P → P and describes how a process P evolves into another process P . The relation is defined in Table 3 and we notice that the rules [CONGRU] and [PARA] are standard. The two axioms [CASE1] and [CASE2] are straightforward and this leaves us with the rules for input and output; before explaining those we need some preliminaries.

Transforming the binders. We take a transformational approach to give the semantics to binders such that all the real time constraints from the binders are encoded as Dirac distributed delays. For clarity we shall write TSQC for the transformed version of SQC and observe that TSQC will be a fragment of SQC.

In the following let ≥0 be the set of nonnegative real numbers, let δ a denote a Dirac distribution with parameter a ∈ ≥0 , and let ω be a clock value generated according to the δ a distribution (written ω ∼ δ a ); then we have P(ω ≤ a)-P(ω < a) = 1. Thus real time delays can be expressed because a Dirac distribution δ a is a special case of a general distribution G.

The idea is now to transform an SQC process of the form & I q (t 1 ?x 1 , • • • , t n ?x n ).P into a process using specific channels for keeping track of the time and to let a modified version of the binder react when the time signals arrive. Depending on the interval I used in & I q (t 1 ?x 1 , • • • , t n ?x n ), different transformations are considered; here we shall only consider the case where I is [a, a ) (and 0 < a < a < ∞) and note that simpler transformations are mandatory in the special cases where a is 0 and/or a is ∞. Then we shall replace the SQC process & [a,a ) q

(t 1 ?x 1 , • • • , t n ?x n ).P with the TSQC process (νc a ) (νc a ) & q (t 1 ?x 1 , • • • , t n ?x n , c a ?x a , c a ?x a ).P || c a ! δa • || c a ! δ a • ,
Here two fresh outputs with Dirac distributed delays make use of fresh channels c a and c a to send the signals corresponding to the beginning and the end of the time interval. The binder itself is modified to listen for these signals and x a and x a are fresh variables used only to store the real time signal •. Finally, the quality predicate is modified to record this by taking q(x 1 ,

• • • , x n , x a , x a ) = (q(x 1 , • • • , x n ) ∧ x a ) ∨ x a .
We shall apply the above transformation rules for all the binders in the system, and we call & q (t 1 ?x 1 , • • • , t n ?x n , c a ?x a , c a ?x a ) a transformed binder of TSQC. To shorten the notation (by keeping c a ?x a , c a ?x a implicit), we write & q (t 1 ?x 1 , • • • , t n ?x n ) for the transformed binder.

Evaluation of binders. Now we introduce the relation b :: v θ to record whether all required inputs in b have been performed, by means of v ∈ {tt, ff}, as well as the composite substitution that has been constructed, by means of θ; it is defined in Table 4 and assumes that we have extended syntax

d ::= c | • b ::= t?x | & q (sb 1 , • • • , sb n ) sb ::= t?x | [x → some(d)] t?x :: ff [x → none] [x → some(c)] ::tt [x → some(c)] [x → some(•)] ::tt [x → some(•)] sb1 ::v 1 θ1 • • • sbn ::v n θn & q (sb1, • • • , sbn) ::v θn • • • θ1
, where v = q(v1, • • • , vn).

Table 4. Evaluation of binders.

[AX1] (ci

! ω di) m i=1 c?x ω,(c i ) m i=1 -→ [x → some(di)], if c = ci [AX2] (ci! ω di) m i=1 c?x ω,(c i ) m i=1 -→ c?x, if c ∈ {c1, . . . , cm} [AX3] (ci! ω di) m i=1 [x → some(d)] ω,(c i ) m i=1 -→ [x → some(d)] [AX4] j∈{1,...,n} (ci! ω di) m i=1 sbj ω,(c i ) m i=1 -→ sb j (ci! ω di) m i=1 & q (sb1, • • • , sbn) ω,(c i ) m i=1 -→ & q (sb 1 , • • • , sb n ) .
Table 5. Transition relation for binders.

where [x → some(d)] is the substitution θ that maps the variable x to some(d).

We shall use id for the identity substitution and θ 2 θ 1 for the composition of two substitutions, so (θ 2 θ 1 )(x) = θ 2 (θ 1 (x)) for all x.

Returning to the definition of the transition relation P → P in Table 3 we now see that the rule [INPUT] simply checks whether the binder is satisfied and if so it will apply the corresponding substitution to the continuation process.

Active and inactive outputs. To define the transition relation for binders we shall distinguish between active and inactive outputs. An output is active when it starts to send data over some channel, otherwise it is inactive. As soon as an output becomes active, we replace its delay distribution G with a clock ω ∈ ≥0 to track the residual time for the output to complete. The clock ω is initialised by a sampled nonnegative value according to the distribution of the channel (written ω ∼ G). Note that the case where ω = 0 indicates that the output completes instantaneously. To formalise that an inactive output becomes active, we extend the syntax by replacing the delay distribution with an explicit clock value like c! ω d. This is depicted by the rule [OUTPUT] in Table 3.

Furthermore, we assume that all the distributed processes share a global clock, and that the time of an output will be updated after each system transition (to be introduced below). In this manner, all active outputs implicitly remember the entire history of the time that has passed; we shall discuss this point later when we define the rule for system transitions.

[MATCH] Transition relation for binders. The transition relation for binders takes the form

(ci! ω di)i∈I b k ω,(c i ) i∈I -→ b k for all k ∈ K define • • • in P using f ω,(c i ) i∈I =⇒ define • • • in P using f , e , if {f } ∩ {e} = ∅, I = ∅
(c i ! ω d i ) m i=1 b ω,(ci) m i=1 -→ b
where (c i ! ω d i ) m i=1 records the m concurrently active outputs that will modify the binder b so that it becomes b and where the annotation ω, (c i ) m i=1 records the communication over the channels at the specified time. The relation is defined by the axioms [AX1] to [AX4] in Table 5 and is explained below.

The first axiom [AX1] records the change of a simple input c?x by receiving some value d i from the channel c i in (c i ) m i=1 at time ω. In the special case where the (c i ! ω d i ) m i=1 contains both c! ω d 1 and c! ω d 2 (i.e. two broadcasts take place over the same channel at the same moment), it is nondeterministic whether d 1 or d 2 shall be received for the input, so the axiom specialises to

c! ω d 1 , c! ω d 2 c?x ω,(c,c) -→ [x → some(d i )], where i ∈ {1, 2}.
This is a deliberate design decision and alternatives, as for example that none of the two values are received due to the collision, can be modelled if wanted.

The axiom [AX2] records that no data is received for a simple input at time ω because of the mismatch between inputs and outputs whereas [AX3] records that an already received input retains its value. From the individual records, we express the change of a transformed binder as the collection of individual input changes as recorded in the rule [AX4].

The transition relation for systems. Let us now turn to the semantics of systems; it is defined in Table 6 by a transition relation of the form

define • • • in P using f ω,(ci) i∈I =⇒ define • • • in P using f
The annotation on the arrow describes the truly concurrent communications (c i ) i∈I happening at time ω. The rule [MATCH] expresses that the main process P of the system first executes all the local steps from each distributed component; for this we use the reflexive transitive closure of the transition relation for processes → * composed with the structural congruence ≡. Note that the execution of the subprocesses may introduce new channels into the system; they are denoted e.

The distributed components of the processes resulting from this can be classified into three cases:

(1) || i∈I c i ! ω d i .P i are processes that will perform outputs at time ω;

(2) || j∈J c j ! ω+ωj d j .P j are the processes that will perform outputs at time ω + ω j for ω j ∈ >0 and hence later than at time ω; and (3) || k∈K b k .P k are the processes that are ready to perform inputs.

Given a set of broadcasts over (c i ) i∈I at time ω, the resulting system will be composed of the processes obtained from ( 1), ( 2) and ( 3). The processes of (1) will have completed their outputs so they will become || i∈I P i . The processes of (2) are still waiting to perform their outputs and their clock values will now be reduced so they become || j∈J c j ! ωj d j .P j . Finally, the processes of (3) will simply be updated to record which inputs they have performed as in || k∈K b k .P k . This completes the semantics of SQC as transformed into TSQC.

SQC is GSMDP

The transition systems obtained from the operational semantics turn out to constitute Generalised Semi-Markov Decision Processes (GSMDPs). Definition 1. A Generalised Semi-Markov Decision Process (motivated by [START_REF] Doshi | Generalized semi-markov decision processes[END_REF]) is a tuple (S, E, A, {E s } s∈S , {G e } e∈E , {Ω e } e∈E , =⇒), where -S is a finite and non-empty set of states, -E is a finite and non-empty set of events, -A ⊆ E is a set of so-called controllable events, -E s ⊆ E specifies for a state s ∈ S a set of events enabled at s, -G e specifies for an event e ∈ E a general probability distribution, -Ω e specifies for an event e ∈ E a real-valued clock; when the event e becomes enabled, ω e ∈ ≥0 is initialised by sampling from the distribution G e to express the residual time until event e occurs, -=⇒: S × {Ω e } e∈E × E × S is a transition relation: given s, s ∈ S, ω ∈ {Ω e } e∈E , e ∈ E s , the transition s ω,e =⇒ s expresses that a transition from s to s is triggered by an event e with ω being the sojourn time in state s; the sojourn time ω in state s is determined by the smallest clock value over {Ω e } e∈Es .

The dynamics of GSMDPs are described by execution paths. An execution path ρ for a GSMDP is a sequence ρ = s 0 ω0,e0

=⇒ s 1 ω1,e1 =⇒ s 2 ω2,e2 =⇒ • • • with s i ∈ S, e i ∈ E si
and ω i ≥ 0 being the sojourn time in state s i . The length of an execution path equals the number of transitions along the path, which can be either finite or infinite. The decision dimension of GSMDPs arises in the situation where s ω,e =⇒ s 1 , s ω,e =⇒ s 2 and s 1 = s 2 . A policy (as in Markov Decision Processes [START_REF] Puterman | Markov Decision Processes: Discrete Stochastic Dynamic Programming[END_REF]) picks an event in the set of enabled controllable events of a state to generate a partial execution path. Thereafter, the optimal strategy over different policy executions over a GSMDP can be obtained using the techniques of [START_REF] Doshi | Generalized semi-markov decision processes[END_REF][START_REF] Younes | Solving generalized semi-markov decision processes using continuous phase-type distributions[END_REF].

For a system expressed in TSQC, we model a sequence (more precisely a multiset) of truly concurrent broadcast communications as an event of a GSMDP. Therefore, when more than one output take place at the same time on the same channel, there exists a nondeterministic choice of the potential successive system configurations.

Theorem 1. The semantics of systems in SQC amounts to GSMDPs.

Proof. To see this we shall now define a GSMDP for a system of the Stochastic Quality Calculus as transformed into TSQC. First let S/ ≡ denote the quotient set obtained by using the structural congruence ≡ over a set S of systems. We then define the GSMDP (S, E, A, {E s } s∈S , {G e } e∈E , {Ω e } e∈E , =⇒) as follows:

-The set of states S is the quotient {define

• • • in P using • • • | define • • • in P using • • • is generated by the rules in Table 6 from define • • • in P * using • • • }/ ≡.
The obtained state space is finite, because recursion through parallel composition is forbidden.

-An event e in the state s = define • • • in P using • • • is defined as a sequence (c i ) i∈I such that each c i is used as an active output c i ! ω d i in the body P of s and all c i share the same clock value ω. The set E s is the set of events e enabled in the state s. -The set of events is the union of all the enabled events: E = s∈S E s .

-The set of controllable events is the union: A = s∈S A s , where

A s = {e | s ω,e =⇒ s 1 , s ω,e
=⇒ s 2 and s 1 = s 2 for some s, s 1 , s 2 , ω, and e ∈ E s }. -The distribution of an event is defined as follows: 6}.

• if the event is c where c! G d occurs in define • • • in P * using • • • , the distri- bution is G; • if the event is (c i ) i∈I where (c i ! ω d i ) i∈I occurs in define • • • in P * using • • • , the distribution of the event (c i ) i∈I is δ ω ; • for
The GSMDP semantics of SQC captures the most general behaviour of the systems expressed by the Stochastic Quality Calculus:

1. Output makes use of general probability distributions (expressing both stochastic and real time delay), and runs concurrently using clocks. 2. Input makes use of stochastic quality binders (expressing both real time and quality constraints), and enforces the "realistic-pessimistic" programming style. 3. A sequence of broadcast communications may occur at the same time, such that the data is determined nondeterministically when more than one communication makes use the same channel at the same time.

The classical analysis of GSMDPs is to find an optimal strategy to maximise some reward function, which may use techniques such as policy iteration [START_REF] Puterman | Markov Decision Processes: Discrete Stochastic Dynamic Programming[END_REF][START_REF] Younes | Solving generalized semi-markov decision processes using continuous phase-type distributions[END_REF].

Analysable Fragments of SQC

In order to perform more standard stochastic reasoning on the systems, we introduce two analysable fragments of SQC sitting at different levels of generality, so that more established analysing methods become available.

SQC with continuous distributions

To exclude the nondeterminism, we introduce a fragment of SQC disallowing non-continuous distributions for outputs.

Definition 2. The Stochastic Quality Calculus with continuous distributions (SQC con ) is the untransformed Stochastic Quality Calculus in Table 1 with the condition that all the probability distributions for the outputs have continuous Cumulative Density Functions (CDFs).

Note that the continuous CDF restriction of SQC con does not exclude the real time (Dirac) output delays that are created during the binder transformation and that are explicit in the TSQC form of SQC con . However, these real time (Dirac) output delays take place over freshly created channels. Therefore, when more than one binder in SQC con uses the same real time constraint, more than one communication may occur at the same time, but only over freshly created channels. Hence, by allowing truly concurrent transitions where all such communications take place at the same time we avoid any non-deterministic behaviour.

Proposition 1. The system expressed by SQC con does not have nondeterministic communications.

Proof. By the continuity of continuous probability distributions (be aware that Dirac distributions do not have continuous CDFs), the probability of two continuous random delays to be exactly the same is strictly zero, and hence we feel free to ignore the possibility that more than one output complete at the same time using the same channel. Hence nondeterministic communications are excluded (with probability 1).

Without the nondeterminism, the semantics of SQC con turns out to become a Generalised Semi-Markov Process, which is a subclass of GSMDPs. =⇒ s 2 imply s 1 = s 2 ).

A GSMP can be analysed using discrete event simulation or statistical model checking. We refer to [START_REF] Younes | Solving generalized semi-markov decision processes using continuous phase-type distributions[END_REF][START_REF] Younes | Ymer: A statistical model checker[END_REF] for the technical details.

Theorem 2. The semantics of systems in the Stochastic Quality Calculus with continuous distributions amounts to GSMPs.

Proof. The semantics of SQC is a GSMDP, and SQC con is a fragment of SQC without the nondeterminism. Removing the nondeterminism from a GSMDP, one obtains a GSMP system corresponding to SQC con . The construction of the GSMP from SQC con follows Theorem 1, and we shall omit the details due to space limitation.

SQC with exponential distributions

Despite the fact that statistical methods can be used to analyse the GSMPs obtained from SQC con , the general continuous probability distributions make numerical methods infeasible. Statistical methods scale better with the size of the state space, however a precise result often requires a large number of samples. Therefore, for state space |S| < 10 5 (based on a set of case studies over CTMCs in [START_REF] Younes | Numerical vs. statistical probabilistic model checking[END_REF]), numerical methods seem to be preferable. To enable numerical methods, we introduce another fragment of SQC by restricting output delays further to be only exponentially distributed (denoted Exp). We first introduce a subclass of GSMPs with only Exp and real time events, such that the numerical analysis approach in [START_REF] Lindemann | Numerical Analysis of Generalized Semi-Markov Processes[END_REF] Proof. Theorem 2 shows that the semantics of SQC con amounts to GSMPs, where the probability distributions have continuous CDFs. By Definition 5, the systems in SQC exp are special cases of SQC con , where the continuous probability distributions are restricted to be Exp distributions, which amounts to numerically analysable GSMPs by definition.

Both analysable fragments of SQC retain real time constraints on inputs to enforce the "realistic-pessimistic" programming style. Therefore, it is not possible to reduce the semantics further into continuous-time Markov chains. However, the stochastic behaviour (Exp distributed) and the real time behaviour (Dirac distributed) can often be split into a pure stochastic behaviour (Exp distributed) in the form of a Continuous Time Markov Chain [START_REF] Kwiatkowska | Stochastic model checking[END_REF] and a pure real time behaviour (Dirac distributed) embodied in a query in Continuous Stochastic Logic [START_REF] Aziz | Verifying continuous time Markov chains[END_REF]. These ideas are developed in [START_REF] Nielson | Stochastic Model Checking for the Stochastic Quality Calculus[END_REF].

Conclusion

The motivation behind the Quality Calculus [START_REF] Riis Nielson | A calculus for quality[END_REF] is that many of the security errors in modern distributed systems are due to an overly "optimistic" programming style. Programmers tend to think of benign communication environments, and hence focus on getting the software to perform as many functions as possible. To a much lesser extent, they consider malign environments and the need to focus on avoiding errors that can be provoked by outside attackers. We believe future programming languages need to support a more robust ("pessimistic") programming style: What conceivably might go wrong, probably will go wrong.

A major cause of disruption is due to the networked communication between distributed software components.

This paper developed the Stochastic Quality Calculus (SQC) to model and reason about truly concurrent broadcast communications. A distinguishing feature of SQC is to consider both stochastic and real time communications that express the influences from cyber physical environment. Furthermore, the stochastic quality binder enforces the "realistic-pessimistic" programming style: to program the ideal as well as default behaviour depending on the availability or absence of desired data.

The semantics of SQC amounts to generalised semi-Markov decision processes.

To avoid the decision dimension and enable purely stochastic analysis, we introduce two analysable fragments of SQC to express the systems in different levels of generality. The first fragment of SQC amounts to Generalised Semi-Markov Processes (GSMP) that can be analysed using statistical model checking, while the second amounts to a numerically analysable GSMP that can be further analysed using stochastic model checking.

These analyses lay a foundation for supporting a new discipline of robust programming. We believe that with the quantitative information obtained from the analysis, it will be possible to better determine whether or not the software continues to deal appropriately with risks and threats in the new application environment.

  all c a where c a is introduced by the transformation of a binder b in define • • • in P * using • • • , the distribution is δ a . -The real valued clock Ω e associated with the event e is ω whenever e is a sequence (c i ) i∈I where (c i ! ω d i ) i∈I occurs in define • • • in P * using • • • , or is introduced by the transformation of a binder in the same system. -=⇒= { ω,(ci) i∈I =⇒ | ω,(ci) i∈I =⇒ generated by the rules in Table

Table 6 .

 6 , where P → * ≡ (νe) ( || i∈I ci! ω di.Pi) || ( || j∈J cj! ω+ω j dj.Pj) || ( || k∈K b k .P k ) for ωj ∈ >0, and P = ( || i∈I Pi) || ( || j∈J cj! ω j dj.Pj) || ( || k∈K b k .P k ). Transition relation for systems.

  Definition 3. A Generalised Semi-Markov Process (GSMP) (motivated by[START_REF] Glynn | A GSMP formalism for discrete event systems[END_REF]) is a Generalised Semi-Markov Decision Process (cf. Definition 1) with the controllable event set A = ∅ and the transition relation =⇒ becoming a functional relation (meaning that s

	ω,e =⇒ s 1 and s	ω,e

  is applicable, which indicates that numerical verification techniques like stochastic model checking are also applicable. Definition 4. A numerically analysable GSMP is a generalised semi-Markov process, such that the general probability distributions are restricted to Exp distributions and Dirac distributions. Definition 5. The Stochastic Quality Calculus with Exp distributions (SQC exp ) is the untransformed Stochastic Quality Calculus in Table 1 with the condition that all the probability distributions for the outputs are exponentially distributed (denoted Exp). The semantics of systems in the Stochastic Quality Calculus with Exp distributions amounts to numerically analysable GSMPs.

	Numerical analysable GSMPs retain both stochastic (Exp distributions) and real
	time (Dirac distributions) behaviour. Next, we introduce a fragment of SQC that
	amounts to numerically analysable GSMP.
	Theorem 3.

Acknowledgment. The research has been supported by IDEA4CPS, granted by the Danish Research Foundations for Basic Research (DNRF86-10). The research question addressed was largely motivated by the European Artemis project SESAMO (www.SESAMO-PROJECT.eu).


Simon Chesné
email: simon.chesne@insa-lyon.fr

Arnaud Deraemaeker

Damage localization using transmissibility functions: a critical review

Keywords: Structural Health Monitoring, Damage localization, Transmissibility functions

This paper deals with the use of transmissibility functions for damage localization. The first part is dedicated to a critical review of the state-of-the-art highlighting the major difficulties when using transmissibility functions for damage detection and localization. In the second part, an analytical study is presented for non-dispersive systems such as chain-like mass-spring systems. The link between the transmissibility function and the mechanical properties of four subsystems defined by the boundary conditions, the position of the excitation and the two measurement locations used for the computation of the transmissibility functions is derived. This result is used to discuss the situations in which damage localization is likely to work. The last section discusses the extension of these results to more general dispersive systems such as beams or plates.

Introduction

Many countries are facing serious security problems due to the aging of their civil infrastructures, such as bridges. On one hand, the structures are coming to the end of their theoretical lifetime, and on the other hand, the maximum loads to which they are exposed are always increasing (i.e. traffic on bridges). It is therefore crucial to be able to estimate the current state of health of such structures, as well as their remaining lifetime. Current techniques are based on scheduled maintenances with visual inspections and local methods such as ultrasounds or eddy currents.

For more than twenty years, researchers have developed alternative global methods based on the measurement of vibration signals. Existence of structural damage in an engineering system leads to modification of the vibrations. The main idea is that damage changes the stiffness of the structure and therefore the modal properties (natural frequencies, mode shapes and modal damping values) which can be obtained from results of dynamic (vibration) testing. The goal of structural health monitoring (SHM) is to detect damage at or near its onset, before it becomes critical to structure's function and integrity. One of the major challenges in detecting and locating small-scale structural damage is that this type of damage is a local phenomenon. Rytter [START_REF] Rytter | Vibration based inspection of civil engineering structures[END_REF] distinguished four levels of damage identification each of which provides more detailed information about the structural damage. The ultimate goal of the previous work in SHM is to determine when, where, and how badly a structure is damaged or deteriorated. The literature on the subject is enormous [START_REF] Doebling | Damage identification and health monitoring of structural and mechanical systems from changes in their vibration characteristics: a literature review[END_REF] but these methods have not seen a big success, mainly for two reasons: (i) the modal properties of the structure are also dependant on environmental parameters (weather, loads, wind …) which cause changes in the vibration characteristics of the same order of magnitude as damage, and (ii) mode shapes and frequencies are global properties which are not very sensitive to small localized damages.

Thanks to the enormous advances in sensors and instrumentation, it is now possible to instrument a structure with hundreds or thousands of sensors which are capable of measuring the vibrations of structures in real time. By following the dynamic behavior of the structure in real time, it is possible to apply statistical methods in order to detect small damages and remove the effects of the environment ( [START_REF] Peeters | Roeck Vibration-based damage detection in civil engineering: excitation sources and temperature effects[END_REF], [START_REF] Worden | Damage detection using outlier analysis[END_REF], [START_REF] Kullaa | Damage detection of the Z24 bridge using control charts[END_REF] and [START_REF] Deraemaeker | Vibration based structural health monitoring using outputonly measurements under changing environment[END_REF]). This opens the way to the development of automated damage detection systems and could allow going from an "on schedule" maintenance to an "on demand" maintenance, therefore greatly reducing the costs and the risks of failure between two maintenances.

The next step to help the engineers in the maintenance of structures is to develop tools to locate damage. There exist two families of methods: the first family uses a model (i.e. finite elements) which is updated regularly based on experimental results [START_REF] Teughels | Structural damage identification of the highway bridge Z24 by FE model updating[END_REF]. Any change in the parameters of the model will give the indication of the position of damage. The major drawback with these methods is the difficulty to build accurate models of the initial structure. The second family of methods relies only on the experimental measurements to detect damage. In order to do this, it is important to choose the right feature. The ideal feature is one that is defined locally and changes only if damage appears at that specific location. To the best of our knowledge, for vibration based methods, two types of features have been identified and investigated in the past: curvature mode shapes ( [START_REF] Pandey | Damage detection from changes in curvature mode shapes[END_REF], [START_REF] Cornwell | Application of the strain energy damage detection method to plate-like structures[END_REF], [START_REF] Maeck | Dynamic bending and torsion stiffness derivation from modal curvatures and torsion rates[END_REF] and [START_REF] Deraemaeker | On the use of dynamic strains and curvatures for vibration based damage localization[END_REF]) and transmissibility functions. This paper deals with transmissibility functions (TF). The first section is dedicated to a critical review of the literature on the use of TFs for damage detection and localization. This section highlights the major issues for the development of SHM systems based on TFs: the importance of the choice of the frequency bands, and the problem of operational and environmental variability which might cause false alarms. In addition, we point out the lack of general analytical results to assess the limits of validity of the damage localization methods based on TFs.

The second section is dedicated to a review of the mathematical concepts of TFs and the associated damage indicators proposed in the literature. The third section deals with a specific type of systems: chain-like massspring systems. A general analytical result is derived in which the TF is expressed as a function of the properties of four sub-systems defined by the locations of the measurement points used for the TF, and the location of the force. This analytical formula is used to understand the impact on the TFs of a change of stiffness or mass parameters in each of the four sub-systems and to draw conclusions on the limits of the methods proposed for damage localization. The formula can be extended to more general non-dispersive systems such as rods in traction-compression or in torsion.

The last section is dedicated to more general types of systems for which the simple analytical formula obtained for chain-like mass spring systems cannot be derived. A beam example is presented in order to emphasize the fact that the applicability of the method is, in this case, even more restricted than for the simple non-dispersive systems studied in the previous section. It seems difficult however to derive more precisely these additional restrictions.

Review of transmissibility-based damage detection and localization methods

Transmissibility functions have been first proposed as potential features for damage detection in [START_REF] Chen | Structural fault detection using neural networks trained on transmissibility functions[END_REF]. Since then, they have been extensively used in the research group lead by Keith Worden at the University of Sheffield for damage detection and localization. In [START_REF] Worden | Structural Fault Detection Using a Novelty Measure[END_REF], an auto-associative neural network using TFs was developed to compute a novelty index for damage detection. The example treated was a numerical 3 degrees of freedom (dofs) chainlike mass spring system. Another numerical example involving a 3 dofs system was studied a few years later by the same research group [START_REF] Worden | Damage Detection Using Outlier Analysis[END_REF]. In this contribution, outlier analysis based on frequency lines in the TFs was used for damage detection. A few years later, experimental validations on the use of TFs for damage detection ( [START_REF] Worden | Experimental Validation of a Structural Health Monitoring Methodology: Part I. Novelty Detection on a Laboratory Structure[END_REF], [START_REF]Manson Experimental Validation of a Structural Health Monitoring Methodology: Part Ii. Novelty Detection on a Gnat Aircraft[END_REF] and [START_REF] Chen | Structural fault diagnosis and isolation using neural networks based on response-only data[END_REF]) and localization [START_REF] Manson | Experimental Validation of a Structural Health Monitoring Methodology: Part Iii. Damage Location on an Aircraft Wing[END_REF] have been performed using vibration data from a laboratory wing box structure and a gnat aircraft wing. Detection was based on three different novelty detection techniques (outlier analysis, auto-associative neural networks and kernel density estimation), while localization was based on supervised learning using a multi-layer perception (MLP) neural network. Apart from the fact that TFs appear to have a high sensitivity to damage, the main motivation for using them is the fact that there is no need to measure the excitation. Although this is true, it should be emphasized that for the types of structures encountered in aeronautics and civil engineering applications, TFs do not depend on the frequency content of the excitation, but do depend on the location of the excitations. A change in the excitation location might cause a significant change in the TFs under normal (undamaged) condition, which is very likely to cause false alarms. This issue was recently discussed in [START_REF] Devriendt | On the use of Transmissibility in the field of: operational Modal Analysis and Structural Health Monitoring[END_REF] where it was shown that TFs computed at the eigenfrequencies of the system are independent on the excitation location. Note that this property has also been used to develop output-only modal analysis techniques [START_REF] Devriendt | The use of transmissibility measurements in output-only modal analysis[END_REF]. Restricting the TFs to narrow frequency bands around these eigenfrequencies was therefore proposed as a way to get rid of the variability of the TFs due to a change in the location of the excitation.

In the studies cited above, the authors have used specific frequency lines or bands extracted from the TFs. For damage detection, one should find the frequency bands for which the features are highly sensitive to damage and insensitive to variability in the normal condition [START_REF] Worden | Experimental Validation of a Structural Health Monitoring Methodology: Part I. Novelty Detection on a Laboratory Structure[END_REF]- [START_REF]Manson Experimental Validation of a Structural Health Monitoring Methodology: Part Ii. Novelty Detection on a Gnat Aircraft[END_REF]. For damage localization, an additional requirement is to find frequency bands in which the features are highly sensitive to one type of damage, and almost insensitive to the others [START_REF] Manson | Experimental Validation of a Structural Health Monitoring Methodology: Part Iii. Damage Location on an Aircraft Wing[END_REF]. A major problem is that these frequency bands cannot be determined a priori without having access to data from the structure in the different damage conditions and that in practice, such data is rarely available. This problem has been recognized by the research group at the University of Sheffield who has proposed the use of pseudo-faults in the form of added masses on the actual structures in order to produce data representative of the structure in the damaged condition [START_REF] Worden | Damage detection in an aircraft compoment model[END_REF]- [START_REF] Papatheou | The use of pseudofaults for novelty detection in SHM[END_REF]. Although this approach has proved to work on specific examples, there is no evidence of its applicability on any given type of structure.

While all these studies show, on specific examples, the possibility to use TFs for damage detection and localization, they do not present any analytical results supporting these findings. While it is rather simple to demonstrate the sensitivity of TFs to damage (because they are the ratio of FRFs which are known to be sensitive to damage), it is much more difficult to prove the localization capabilities of TFs.

Around the same time, similar developments on the use of TFs (called transmittance functions in the related papers) for structural health monitoring have been presented in [START_REF] Mj | Detecting structural damage using transmittance functions[END_REF], [START_REF] Mj | Health monitoring and active control of composite structures using piezoceramic patches[END_REF], [START_REF] Zhang | Structural Health Monitoring Using Transmittance Functions[END_REF], [START_REF] Ghoshal | Structural Health Monitoring Techniques for wind turbine blades[END_REF] and [START_REF] Caccese | Detection of bolt load loss in hybrid composite/metal bolted connections[END_REF]. A damage indicator based on the integral over a frequency band of the difference between the intact and the damaged TFs was used for damage detection and localization. The underlying (heuristic) idea is that damage between points i and j will cause a change in the TF computed between these two points, and not (or only slightly) on the other TFs. The applicability of the technique was assessed using experimental data acquired on beams, plates and wind turbine blades. Although the method was shown to be efficient for the examples treated, there are again no analytical developments to assess the limits of applicability of the technique. In particular, the issue of the specific frequency bands to be used for successful damage localization is not raised.

In parallel to these investigations, several authors have published analytical work on the extension of the transmissibility concept, initially developed in the field of vibration isolation for two degrees of freedom systems, to multi-degree of freedom systems ( [START_REF] Liu | Transmissibility Properties of MDOF Systems[END_REF], [START_REF] Ribeiro | on the Generalisation of the Transmissibility Concept[END_REF] and [START_REF] Nmm | the Transmissibility Concept in Multi-Degree-of-Freedom Systems[END_REF]). In particular, in [START_REF] Ribeiro | on the Generalisation of the Transmissibility Concept[END_REF], the authors have demonstrated the fact that when generalizing the concept of transmissibility to MDOF systems, the transmissibility matrix depends on the location of the excitation, as stated above. In addition, it can easily be shown that the resonances and antiresonances of TFs correspond to the zeros of the frequency response functions (FRFs) of the two sensors from which the transmissibility is computed. A study of the sensitivity of these zeros to stiffness changes can be found in [START_REF] Mottershead | on the Zeros of Structural Frequency Response Functions and Their Sensitivities[END_REF]. This study does not show a strong difference in sensitivity between the poles and zeros of FRFs, at least on the numerical example treated, which somehow contradicts the statements of other authors (see for example [START_REF] Johnson | Transmissibility as a differential indicator of structural damage[END_REF]). This contradiction could show that the issue is very problem dependent so that care should be taken when generalizing a result from a few examples only.

Based on these theoretical developments, the possibility to detect and locate damage using TFs has been studied by the research team of Maia at IST in Porto [START_REF] Rpc | Transmissibility techniques for damage detection[END_REF]. The difference of TFs between the undamaged and the damaged conditions was used for damage localization, in a very similar way to the method presented in [START_REF] Zhang | Structural Health Monitoring Using Transmittance Functions[END_REF]. One important aspect of these methods is the fact that they are based on the data measured on the intact structure only, therefore avoiding the need of training data emphasized in [START_REF] Worden | Damage Detection Using Outlier Analysis[END_REF], [START_REF] Worden | Experimental Validation of a Structural Health Monitoring Methodology: Part I. Novelty Detection on a Laboratory Structure[END_REF] and [START_REF]Manson Experimental Validation of a Structural Health Monitoring Methodology: Part Ii. Novelty Detection on a Gnat Aircraft[END_REF]. The authors note however that while the approach seems to work well at low frequencies, the results deteriorate when increasing the frequency band, raising again the question of the frequency band to be used. In practice, the authors found that one should look at the difference between the TFs only below the first resonance or antiresonance, which restricts strongly the usable frequency range. An alternative proposed is to 'count the occurrences' instead of computing the cumulative error in a frequency band. Very recently in [START_REF] Nmm | Damage detection and quantification using transmissibility[END_REF], an alternative damage indicator based on correlations of the TFs rather than differences, similar to the well known modal assurance criterion (MAC) used in modal analysis, has been proposed for damage detection (but not for localization). The results show a higher sensitivity when TFs are used compared to FRFs. In all these examples, while the method seems to be effective on the numerical example studied, it is difficult to assess the general applicability of the approach.

In parallel to the work of the research group of Maia, the use of TFs for damage localization has also been studied by the group of Adams at Purdue University [START_REF] Johnson | Transmissibility as a differential indicator of structural damage[END_REF], based on the analytical developments in [START_REF] Ribeiro | on the Generalisation of the Transmissibility Concept[END_REF]- [START_REF] Mottershead | on the Zeros of Structural Frequency Response Functions and Their Sensitivities[END_REF] and the method proposed earlier in [START_REF] Mj | Detecting structural damage using transmittance functions[END_REF], [START_REF] Mj | Health monitoring and active control of composite structures using piezoceramic patches[END_REF] and [START_REF] Zhang | Structural Health Monitoring Using Transmittance Functions[END_REF]. In addition to dealing with linear systems, the authors extend the application of TFs to non-linear systems. For linear systems, the possibility to locate damage is shown on a 3 dofs chain-like mass-spring system, for which it is demonstrated that damage between masses i and j causes a change in the transmissibility between these two masses only. Note however that there are restrictions on the position of the excitation for this result to be valid. While this is probably the only tentative to derive analytical expressions to demonstrate the localization properties of TFs, the authors claim that this result can be generalized to systems with more degrees of freedom, but there is no proof presented. Further papers by the same research team deal with applications on a steel frame structure, a helicopter frame [START_REF] Johnson | Distributed structural health monitoring with a smart sensor array[END_REF] , and rolling tires [START_REF] Johnson | Rolling tire diagnostic experiments for identifying incipient bead damage using time, frequency, and phase plane analysis[END_REF]. A later paper [START_REF] Kess | Investigation of operational and environmental variability effects on damage detection algorithms in a woven composite plate[END_REF] deals with the issue of frequency band selection in order to reject variability due to operational and environmental conditions, emphasizing one more time this important aspect. Here again, data acquired on the damaged structure is necessary in order to select the frequency bands.

Although the present paper is intended to deal with linear structures only, it is worth citing a recent study on the extension of the concept of transmissibilities for non-linear systems using the concept of "non-linear output frequency response functions" (NORF) [START_REF] Zq | Transmissibility of non-linear output frequency response functions with application in detection and location of damage in MDOF structural systems[END_REF].

General formulation

This first part introduces the basic equations used in this work. It details the formulation of frequency response functions, necessary to understand the concept of TFs and of the damage indicator.

Frequency response functions

The usual n dof undamped system, illustrated in Figure 1, is written for the case of harmonic excitation as:

  2 xf   KM (1)
Where K and M are the stiffness and mass [nxn] matrices and f and x are the input and output (response) [nx1] vectors. The nature of the model of the system will determine the structures of matrices K and M. Next sections will show that particular properties of TFs depend on these structures. The displacement is given by

2 2 ( det( adj ) x f f )      KM H KM (2)
Where H is the dynamic flexibility matrix, and the j,k th term of the adjoint matrix is

  2 ( 1) det kj jk      KM (3)
The subscript jk on the matrix [K-ω 2 M]jk denotes the fact that the k th column and the j th row have been deleted. Note that the subscript k is linked to the input as illustrated in Figure 1.

It is known that the poles are the natural frequencies of the system, and represent a global behaviour of the structure; the poles are the eigenvalues of (K-ω 2 M). Poles appear when the denominator det(Kω 2 M) is zero. Zeros on frequency response function for a force at coordinate k and response at coordinate j occur when the respective adjoint element (element at column k and row j) is zero due to a singularity of the submatrix [K-ω 2 M]jk. The zeros are the eigenvalues of the submatrix [K-ω 2 M]jk, which are potentially different for each inputoutput pair.

Transmissibility functions

On the contrary to admittance functions (usually called frequency response functions FRF) which are frequency responses between conjugate variables (motion response/ force input), TFs are obtained by taking the ratio of two response spectra of like variables (motion response/motion input) xi and xj, for a given input located at degree of freedom (DOF) k :

    2 2 ( 1) det () () () ( 1) det ki k ik k i ij k kj j jk x T x               KM KM (4)
It can be observed that the common denominator det(K-ω 2 M), whose roots are the system's poles, disappears by taking the ratio of the two response spectra. Consequently, poles or zeros of the TF correspond to the zeros of both FRFs.

In general, TFs depend on the input location of the (unknown) force. Note that this definition corresponds to the case of a single point input, which may not cover all cases encountered in practice. It is however the most widely used in SHM applications. Moreover, the limitations of this approach which are highlighted in the present study hold for multiple-input locations, which have been found to be an even more restrictive case. For the sake of clarity, this study is therefore restricted to the single input location case.

Damage indicator

Damage detection and localization is based on the tracking of the changes of the TFs at certain frequencies or over certain frequency bands. For that purpose, a damage indicator was introduced first in [START_REF] Mj | Detecting structural damage using transmittance functions[END_REF] and used by many authors subsequently. This damage indicator Dij is a scalar value which quantifies the change of the TF between measurement points i and j across a given frequency band. It is defined over a frequency range from ω1 to ω2 by:

hd ij ij ij h ij T T d D Td              (5)
where T h ij is the baseline undamaged TF, and T d ij is the current potentially damaged TF. As stated earlier, the selection of an appropriate frequency range [ω1, ω2] is a key parameter for a good detection, as discussed in different papers in the literature. Note that a slightly different version of this indicator has been proposed in [START_REF] Johnson | Distributed structural health monitoring with a smart sensor array[END_REF] where the amplitude of the logarithm of the TFs is used instead of the TFs. In practice TF based on accelerations measurement are often used. Due to the definition of the TF, their expression is identical using accelerations or displacements, since the multiplying factorω 2 cancels out.

Non dispersive systems

Definition

The first class of problem that we shall consider is governed by a second order partial differential equation. This kind of problem presents non dispersive waves, including transverse vibrations of strings, longitudinal deformation of beams, or chainlike mass-spring systems. The system is governed by the well known wave equation. For simplicity, in the following, discussions on non dispersive systems will be illustrated with chain-like mass-spring systems.

N degree of freedom system

The chain-like mass-spring systems are models composed of masses interconnected by springs, capable of only translational motion. Each node has only one degree of freedom and is connected to its nearest neighbours. Such a simple model allows for a good understanding of various properties of TFs for non dispersive systems.

A n degree of freedom chain-like mass-spring is represented in Figure 1.

These systems are well known, and their equation of motion has the form of:

1 x x f   HZ (6)
With Z is the following 3 diagonal [nxn] matrix:

12 1 () () () j j j nn Mk k M k kM                  Z (7)
And where 2 1 ()

i i i i M k k m      (8)
Using Eq [START_REF] Doebling | Damage identification and health monitoring of structural and mechanical systems from changes in their vibration characteristics: a literature review[END_REF], the FRF between output j and input k can be written:

    ( 1) det det( kj jk j jk k x H f)    Z Z (9)
It is interesting here to develop the adjoint matrix (we recall here that it corresponds to the matrix Z without the k th column and the j th row, illustrated with the doted lines):

We can write this matrix in the following form:

  j jk jk k Ma Md Mb Me Mc       Z (11)   1 2 1 1 1 1 2 1 1 1 1 2 2 ( ) ( ) ( ) ( ) ( ) ( )
Z j j j j j j k k k k k k k n n jk M k k M k k M k k M k k M k k k M                                                                    (10)
Where the three sub matrices of interest, separated by the row j and the column k, are: It can be observed that matrices Md and Me are empty, expect at one corner where a single stiffness term appears. Nevertheless their determinant is zero so that they do not appear in the expression of the FRF The concept of subsystem appears clearly in equation [START_REF] Deraemaeker | On the use of dynamic strains and curvatures for vibration based damage localization[END_REF]. Noting that the sub matrix Mbjk is triangular, it follows that the FRF Hjk can be written as:

It is interesting to notice that the zeros of the FRF Hjk, do not depend on the dynamic parameters of the system between points j and k. The zeros correspond to the poles of the exterior subsystems when dofs j and k are grounded as shown by ( 12) and (13). Figure 2 illustrates the two exterior subsystems which determine the zeros of the FRF Hjk.

With these results and observations, we can write the TF for this type of mechanical systems:

1 ( ) det( ) ( ) ( ) ( ) det( ) j k ik i ij p pi jk j H Ma Tk H Ma         (14)
The expression of Tij k (ω) in equation ( 14) is not a function of the excitation coordinate k, which means that Tij k (ω) is not dependent on the excitation position as long as we have k ≥ j ≥ i. This independence on the force location is true as long as the force remains on the same side of points i and j.

Damage localization using TFs

If the poles are the natural frequencies of the systems, what is the physical meaning of the zeros? The information provided by the zeros seems to be a bonus because it refers to a different system (sometimes called a fictitious system) which can be represented by the original model matrix representation when certain rows and columns have been eliminated (through the adjoint matrix of the numerator). Miu [START_REF] Miu | Mechatronics -Electromechanics and controlmechanics[END_REF] considers that zeros of the FRF represent the resonant frequencies associated with energy storage characteristic of this subportion of the system defined by artificial constraints imposed by the location of input and output. They represent the frequencies at which energy is trapped in the energy storage elements of the subportion of the original system such that no output can ever be detected at the measurement point.

In the context of damage detection, we saw that the system (global) transfer function poles are sensitive to changes in structural health anywhere because the term det(Z) in ( 9) is a function of all the system parameters. In contrast, the zeros are only sensitive to a certain subset of mass and stiffness parameters that are localized in specific regions of the structure (see equation ( 14)). This difference in sensitivity to global/local changes can be exploited by selecting a damage feature based on TFs, which are independent of the poles and solely dependent on zeros. By focusing on the zeros rather than the poles, it might be possible to "trap" damage or local structure variation between certain DOFs and perform damage localization. Let us illustrate this with the subsystems (A, B, C and D) represented on Figure 3. The global system is limited by two fixed boundaries, and 3 particular DOFs, (1 input and 2 outputs) delimiting 4 subsystems. ) )

       Z Z (13)
We consider that outputs are not on the boundary or collocated to the input.

Applying equation ( 14), we find:

1 det( ) ( ) ( ) det( j ij p pi A Tk AB)     ( 15
)
This expression is of great interest, as it allows understanding the physical origin of poles, zeros and gains of the TF. The first thing to note is that the TF is not dependent on subsystems C or D and will not be affected by a damage located in these subsystems.

According to (15) a change of stiffness in subsystems A or B will affect Tij(ω). The possibility to locate damage depends on the sensitivity of Tij(ω) to stiffness changes in B due to two sources:

• A change in the gain of Tij(ω) through the term  

1 j pi p k   
which is the product of the spring stiffnesses between points i and j.

• A change in the poles of Tij(ω) through the term det(AB).

On the other hand, a damage in subsystem A will also cause a change in Tij(ω)which will be detrimental to the localization. The changes are due to two sources:

• A change in the zeros of Tij(ω) through the term det(A).

• A change in the poles of Tij(ω) through the term det(AB).

We can conclude from this, that if damage is present anywhere between the position of the applied force and the boundary condition, perfect localization is never possible, unless the damaged spring is located directly next to the applied force. In this very specific case, whatever the values of i and j, the damage is never in subsystem A. In all other cases, damage will cause a change in the poles and zeros of Tij(ω) for some values of i and j (i.e. when i and j are at the right of the damaged spring). In some cases, this leads to the impossibility to locate damage, as will be demonstrated in the examples. Figure 4 summarizes the role of each subsystem.

Analysis of a damage detection case

In this section, a 4 dofs mass-spring system is considered (Figure 5, m1,2,3=10 -3 kg, k1,2,3=10Nm -1 ).

Two representative damage cases are presented. The first case (Figure 6 and Figure 7) where the stiffness k3 is damaged (30%) is the ideal case for damage detection where the input is next to the damaged spring. The damage indicator Dij is computed using (5) and using a large frequency range [0; 300]rad.s -1 containing all poles and zeros of the TFs. The interpretation of the results is based on the subsystem representation previously proposed. Figure 8 is an illustration of how the subsystems are rearranged for T34.

T12 and T34 are unchanged, as shown by their null damage indicator. Indeed, for these TFs, the damage is located in a subsystem which has no effect on the TF (C or D). Equation [START_REF] Worden | Experimental Validation of a Structural Health Monitoring Methodology: Part I. Novelty Detection on a Laboratory Structure[END_REF] shows that TFs are not sensitive to a structural variation located in these subsystems. T23 contains the damaged stiffness. In this configuration, damage is located in subsystem B and the TF is affected by its presence, as shown by the non-zero damage indicator. This case is considered as the ideal one because the damage indicator is always zero except for the TF which contains the damaged element between its outputs.

The second illustrative case is more problematic. The damage is on stiffness k2. The various TFs and damage indicators are shown in Figure 9 and Figure 10.

The interesting result of this case is the fact that the damage indicator of T23 is not zero, although it is smaller than the damage indicator of T12. This result illustrates the dependence of the TF on a subsystem outside the domain delimited by its outputs as predicted previously.

In conclusion, for chain-like massspring systems, the TF between points i and j is very sensitive to changes in subsystem B, delimited by these two points. Unfortunately, it is also sensitive to changes in subsystem A, located between point i and the nearest boundary. Consequently, for good damage localization, a particular attention has to be paid on this domain. The numerical results on the simple system presented show that despite this problem, the damage indicator is maximal in the damaged region, so that localization is possible.

Effect of the frequency range

One another key parameter to consider is the frequency range used for the computation of the damage indicator. In order to observe its behavior, let's plot its evolution as a function of ω for a 7 DOF system. This new damage indicator is then defined as:

0 0 ( ') ( ') ' () ( ') ' hd ij ij ij h ij T T d D Td            (16)
The input force is localized on mass 6. For the first simulation, damage is localized on k6 directly next the applied force. Figure 11shows the evolution of the 6 damage indicators as a function of ω. This corresponds to the special case where the only TF which changes due to the damage is T56(ω). The damage only affects the poles and the gain of T56(ω) since only subsystem B is damaged, and not subsystem A. Note the sharp increase of T56(ω) around 50 rad/s due to the presence of the first pole in this TF. This first pole corresponds to the first eigenfrequency of the subsystem consisting of 5 masses.

For convenience, in the following, the damage indicators referring to a domain containing the fault are plotted using dotted lines.

In Figure 12, we plot the evolution of the 6 damage indicators as a function of ω when damage is located on k3. In this case, all damage indicators between point 2 and point 6 are affected. Localization is only possible below 50 rad/s where T23(ω) is larger than all the other indicators. As stated earlier, around 50 rad/s which corresponds to the eigenfrequency of the subsystem consisting of the first five masses, T56(ω) increases sharply. A sharp increase in T23(ω) occurs at a higher frequency, around 80 rad/s corresponding to the first eigenfrequency of the subsystem consisting of the first two masses. For this reason, between 50 and 80 rad/s, localization is not possible. This type of frequency behavior was also observed in [START_REF] Rpc | Transmissibility techniques for damage detection[END_REF] in which the authors have noted that the results of damage localization tended to deteriorate when increasing the frequency band. They also noted that one should stay below the first resonance or anti-resonance of the TF which is coherent with the results presented above.

In general, if the position of the force is not known, it is safe to consider the first eigenfrequency of the whole system as an upper limit for the computation of the damage indicator. In the example considered, this first eigenfrequency is equal to 39.01 rad/s. Figure 13 and Figure 14 show the damage indicators, for two different frequency ranges. In Figure 13, the damage indicator uses the whole frequency range [0,300] rad/s. Localization is not possible. Figure 14 shows that by restricting the frequency band to [0,39] rad/s (below the first eigenfrequency of the system), localization can be achieved, although as discussed earlier, the damage indicators corresponding to undamaged zones are not equal to zero.

3.4.2

Effect of added masses on transmissibility functions

From equation [START_REF] Worden | Experimental Validation of a Structural Health Monitoring Methodology: Part I. Novelty Detection on a Laboratory Structure[END_REF], it is clear that a change of mass will have a different effect on Tij(ω) than a stiffness change. The main difference is that there will not be any change in the gain due to the stiffness terms. The mass change will however modify the poles and zeros of Tij(ω). We saw in the previous section that good localization was possible at low frequencies thanks to the change in the gain of Tij(ω) so that we should expect to lose the localization capability for a mass change. This is an important issue, as it is quite common in practical experimental validation exercises, to replace the damage by added masses in order to avoid actually damaging the test structure (see for example [START_REF] Papatheou | The use of pseudofaults for novelty detection in SHM[END_REF]). The primary justification for such a procedure is that an added mass will shift the eigenfrequencies down, in a similar way that a stiffness reduction will do. The developments below show that this 'fake damage' technique should not be used to test a damage localization method using transmissibilities, especially if one uses the TFs at low frequencies.

Let's consider the system presented in Figure 15. The system is constructed with 13 masses and the displacements on masses 1,3,5..,13 are measured. It is then possible to introduce a mass change between two measurement points. In the next simulations an increase of 30% of mass 4 is introduced.

Figure 16 shows the evolution of the six damage indicators for an increase of mass (+30%) on mass 4, corresponding to the case of a modification between measurement points 3 and 5 for the 13 dofs system. One sees clearly that localization is not possible at low frequencies. At high frequencies (Figure 17), localization seems improved, but it is never as good as for a stiffness change when considering the damage indicator at low frequencies. The first eigenfrequency of the system is 22rad.s -1 . In order to compare this kind of damage with previous section, Figure 18 shows the damage indicators for   0, 21   rad.s -1 . It clearly appears that a mass variation cannot be localized.

Of course, localization could still be possible if one restricts the frequencies of interest for the computation of the damage indicator to some specific frequencies at which the damage indicator over the damaged region is much higher than in the other regions. Let us consider the 'single frequency' damage indicator Dsf given by : (

hd ij ij ij h ij TT Dsf T      ) ( ) () ()
For the same example with 13 masses, Figure 19 and Figure 20 show the value of Dsf(ω) when respectively the mass addition is located on m4 and the stiffness reduction is on k4, both between measurement points 3 and 5. It can be seen from the figure that localization is possible only in very limited frequency bands. This emphasizes again the importance of the choice of frequency bands for damage localization, and the fact that these frequency bands cannot be determined a priori without any knowledge on the damaged state. It can also be seen that there is no evidence that a mass change has a somehow similar effect on Dsf(ω) than a stiffness change.

Discussion

We have studied the use of TFs for damage localization in chain-like mass spring systems. Based on a simple formula relating the change of TFs to the damage in the massspring system, we have shown that perfect localization of damage is only possible when the damage is located directly next to the point of application of the force. In all other cases, damage localization is not perfect and tends to deteriorate when the frequency band used for the computation of the damage indicator is increased. We have shown numerically that for these other cases and frequencies lower than the first eigenfrequency of the system, the damage indicator computed between points i and j is maximum when damage is located between points i and j. In this case, damage localization seems to be possible, although there is no guarantee. For higher frequencies, localization is much more problematic and much care should be taken in the selection of the frequency bands of interest for the computation of the damage indicator. Unfortunately, it does not seem possible to determine these frequency bands without a priori knowledge on the response of the damaged structure.

Based again on the simple formula derived, we have compared the effect of a stiffness with the effect of a mass change on TFs for chain-like mass-spring systems. The results show that a mass change has a very different impact on the TFs so that localization is not guaranteed, even at low frequencies. It is therefore advised not to use 'fake damage' in experimental setups by using added masses when using TFs.

Extreme caution should therefore be taken in the use of TFs for damage localization. Even for very simple chain-like mass-spring systems, perfect localization is guaranteed only in very specific conditions (the damage is exactly next to the applied force), and good localization seems to be feasible (but not certain) only by looking at T k ij(ω) at frequencies below the first natural frequency of the system, providing that the structural modification is a stiffness change, and not a mass change. In previous sections the theory of the use of TFs to localize damage has been detailed for non dispersive systems. Such systems are characterized by the fact that only one transfer path is available. Unfortunately, this characteristic is rarely present in real life structures. Without this assumption the independence of the TFs with respect to the force location is not valid anymore. Liu and Ewins [40] proved it mathematically considering two subsystems linked by two springs on different DOFs as illustrated on Figure 21.

These parallel links represent the fact that more than one vibration path is available. Physically it can represent the coupling between rotational and transverse motion in Euler-Bernoulli beams. In this work the authors show that if the response of system A is measured at two DOFs, j1 and j2, the ratio of two FRFs, Hj1k / Hj2k is dependent on the input location k. This dependence on force location restricts the use of TFs for damage detection and localization to cases in which the input locations do not change. In addition, equation ( 15) is based on the tridiagonal nature of matrices K and M. For dispersive systems, the matrices are not tridiagonal and such a result does not hold anymore, so that even in the ideal case (damage next to the excitation location), localization cannot be proved. In fact, the zeros will be sensitive to all the parameters of the structure, and not only to a subset of parameters, as it was the case for nondispersive systems.

Damage localization: Illustrative example

In order to illustrate this, an Euler Bernoulli beam is modeled using the finite element method. This class of systems is governed by a fourth order differential equation and the discrete representation results in matrices which are not tri-diagonal. This means that nodes have more than one connection to others nodes or that that the connections are not only to their nearest neighbors (as illustrated Figure 21).

We consider a cantilever beam of length L = 1.12m, rectangular cross section of width 1.18cm and height 0.635cm. The beam is made of fiberglass which has a density 1620kg/m3 and a Young's modulus E = 22.4GPa and is identical to the one used in [START_REF] Zhang | Structural Health Monitoring Using Transmittance Functions[END_REF]. It is discretized with 16 Euler-Bernoulli finite elements as illustrated Figure 22. A transverse force is applied on 13, element 11 is damaged with a bending stiffness reduction of 5%, and 8 transverse displacements are used as outputs for TF computation.

This case corresponds to the ideal one for damage localization as illustrated in Figure 11 for mass-spring systems. The frequency band includes the 8 first flexural modes of the beam. Figure 23 shows the evolution of the 7 damage indicators (computed with ( 16)) as a function of ω. Damage contained between x5 and x6 should appear in D56. Clearly, although damage is detected, it cannot be localized, except in a very small frequency range around 150 rad.s - 1 between the second and the third mode of the structure.

Conclusions

The first part of this paper was devoted to a critical review on the use of TFs for damage detection and localization. The review highlights the importance of the choice of the frequency bands, the effects of environment, and the dependency on the force location. It also highlights the lack of analytical results to determine the practical limitations when using TFs for damage detection and localization.

In the second part of the paper, we have studied non dispersive systems such as chainlike mass-spring systems and derived an analytical formula linking the TF to the properties of four subsystems, defined by the boundary conditions, the excitation location, and the position of the two points used for the computation of the TF. This formula shows that damage localization is only guaranteed when the excitation force is located exactly next to the damage, which is very rarely the case in practice. In all other cases, although damage localization is not guaranteed, it seems to work when restricting the frequency band to frequencies lower than the first eigenfrequency of the system. The study also shows that locally changing the mass of the system has not the same impact as changing the stiffness, especially at low frequencies, so that replacing damage by an added mass is not advised when using TFs. The analytical results derived for nondispersive systems cannot be extended to more general dispersive systems such as beams or plates. For such systems, damage localization is therefore not guaranteed, even for the ideal case in which the excitation is located next to the damage. This is illustrated on a simple beam example in the last section of this paper. A general conclusion to this study is that extreme care should be taken when using TFs for damage detection and localization. While it is obvious that such functions are sensitive to damage, it seems to be difficult to use them in an unsupervised manner, i.e. without knowing a priori how they will be affected by damage, environment, and the excitation location.

[40] W. Liu and D J Ewins, Transmissibility Properties of MDOF Systems, In Proc of International modal analysis conference N o 16, Santa Barbara CA , USA, pp. 847-854 (1998).

Figure 1 :Figure 2 :Figure 3 :Figure 4 :Figure 5 :

 12345 Figure 1: A n DOF mass spring system

Figure 6 :Figure 7 :Figure 8 :

 678 Figure 6: Transmissibility functions, k3 is damaged (Black line: Healthy structure, Red dotted line: damaged structure)

Figure 9 :Figure 10 :Figure 11 :Figure 12 :Figure 13 :Figure 14 :Figure 16 :Figure 17 :Figure 18 :Figure 19 :Figure 20 :Figure 21 :Figure 22 :Figure 23 :

 910111213141617181920212223 Figure 9:Transmissibility functions, k2 is damaged (Black line: Healthy structure, Red dotted line: damaged structure)


A Climatology of Rapidly Intensifying

Tropical Systems over the Southwest Indian Ocean M-D. Leroux 1 , J. Meister, D. Mekies, and O. Bousquet Laboratoire de l'Atmosph ère et des Cyclones, Unit é mixte CNRS/M ét éo-France/Universit é de La R éunion, France 1 mariedominique.leroux@gmail.com

The southwest Indian ocean (SWIO) has been poorly studied so far despite a similar TC activity to that of the North Atlantic. Under the responsibility of RSMC La R éunion, tropical systems that form in this area strike vulnerable islands such as Madagascar (22 million inhabitants with very fragile infrastructures and an agriculture-dominated livelihood) or the Mascarene islands that include La R éunion (840 000 inhabitants) and Mauritius (1.2 million inhabitants). To support international efforts toward the improvement of TC prediction, it is important to characterize the present-day TC activity over the SWIO in light of intensively-studied basins such as the North Atlantic. ) and of 24-h intensity changes (part 2.), using a 15-year (1999-2014) homogeneous database from RSMC La R éunion. 3. Investigation of the large-scale dynamic and thermodynamic conditions conducive for rapid intensification (RI) in the SWIO, using the Era-Interim dataset. The methodology is that used for the Atlantic [START_REF] Kaplan | Large-scale characteristics of rapidly intensifying tropical cyclones in the North Atlantic basin[END_REF] and eastern North Pacific [START_REF] Kaplan | A revised tropical cyclone rapid intensification index for the Atlantic and eastern North Pacific basins[END_REF] to allow for basin inter-comparisons. To be analyzed at a given time t, a system must:

ACRONYMS

• be tropical • have reached at least the TD stage • be over water to ensure the Dvorak technique is valid

SWIO CLIMATOLOGY

173 tropical systems formed over the 1999-2014 period. Each year on average: • 9.3 / 11.5 systems develop into TSs. • 4.9 of those go on to become TCs. This is about 11% of global tropical activity and almost equals the NA activity [START_REF] Neumann | Global Overview[END_REF]. The official TC season runs between 1 November and 30 April but the basin sees activity from September to June.

RI CLIMATOLOGY

' & $ %

RI thresholds (24-h intensity change)

1. RI is defined by ∆V 24 ≥ 15.4 m s -1 or 30 kt (94.4 th percentile of the cumulative frequency distribution of 24-h maximum wind speed changes)

2. RI can also be defined by ∆P 24 ≤ -25hP a (resp. -45 hPa) corresponding to the 5 th (resp. 1 st ) percentile of 24-h pressure changes. 3. RI also corresponds to ∆CI 24 ≥ +2.0 (resp. +2.5 CI) using the 96.5 th (resp. 99 th ) percentile of 24-h Dvorak CI changes.

The ∆V 24 threshold equals that of the NA basin [START_REF] Kaplan | Large-scale characteristics of rapidly intensifying tropical cyclones in the North Atlantic basin[END_REF][START_REF] Kaplan | A revised tropical cyclone rapid intensification index for the Atlantic and eastern North Pacific basins[END_REF] but we used 10 min average winds instead of sustained winds so RI would correspond to a higher 24-h intensity change in the SWIO based on a 0.88 conversion factor. This result must be put into perspective knowing that the NA dataset benefits from aircraft reconnaissance inputs and, thus, more reliable wind speed data. The ∆P 24 threshold can be compared to the minimum 24-h pressure fall of 42 hPa found in the western North Pacific [START_REF] Holliday | Climatological characteristics of rapidly intensifying typhoons[END_REF]. The ∆CI 24 threshold is almost twice the climatological intensification rate of tropical systems defined by the Dvorak technique. Overall, 39% of all SWIO tropical systems underwent RI. 12% of systems that attained the TS stage, 41% of systems that attained TC intensity, 91% of ITCs and all VITCs underwent RI at least once during their lifetime. However, systems that did not exceed the TD stage never experienced a RI period. RI occurs preferably in March and April for TCs, coinciding with the end of the warm season when SSTs are maximized. The probability of RI for TDs decreases from November to April, suggesting that the large-scale atmospheric environment may play a more important role than ocean factors in inducing RI for tropical systems at the depression stage. RI cases are rather evenly distributed from 50 • to 85 • E and confined within the 10 -20 • S latitude band with a main west-southwestward track (Fig. 1). Very few RI cases occur southward of 20 • S, except in the Mozambique channel. The probability of RI as a function of the initial maximum wind speed of the system (Fig. 2) highlights a bimodal distribution with two peaks at 40-55 and 60-75 kts.

' & $ % RI distribution 30 • S 20 • S 10 • S 30 • S 20 • S 10 • S 35 • E 45 • E 55 • E 65 • E 75 • E 85 • E 95 • E C D B A

RI cases tracks

FIG. 2:

The frequency of RI (number of cases per 5-kt bin over the total number of RI cases) as a function of the maximum wind speed of systems at t = 0 h.

LARGE-SCALE CONDITIONS ASSOCIATED WITH RI

An analysis of the dynamic and thermodynamic environmental fields in the 24-h intensification periods (in a 200-800-km region surrounding the storm center) using ERA-Interim data revealed five potential RI predictors (Fig. 3). For each of them, statistically significant differences are found to exist between the means of the RI and non-RI samples at the 99.9% level using a two-sided t test, after adjusting both sample sizes for serial correlation between cases [START_REF] Aberson | Verification of a Nested Barotropic Hurricane Track Forecast Model (VIBCAR)[END_REF]. RI predictors are: the previous 12-h change in maximum wind speed (DVMXM12), a high 200-hPa divergence (DIV200), a weak 850-200-hPa vertical wind shear (SHR), a high sea surface temperature in a 200-km radius surrounding the storm center (SST), and a weak upper-level cyclonic potential vorticity (on the 350-K isentrope, PV350). The storm's center latitude also showed statistically significant differences, but at the 99% level. RI threshold satisfied RI threshold not satisfied FIG. 3: The probability of RI when the specified predictors (X-axis) were satisfied (blue) or not (yellow) for the whole sample. RI thresholds for each variable (in blue columns) were determined as their means in the RI sample. To illustrate, RI occurred 25% (8%) of the time when DVMXM12 was above (below) the 3.6 m s -1 threshold.

CONCLUSIONS AND PERSPECTIVES

→ Further analyze the distribution in Fig. 2 and understand whether it results from a real atmospheric process driving RI or whether it is induced by the Dvorak technique application with satellite images that do not give the same amount of detail at different storm intensities (e.g., prior versus after eyewall formation). → Develop a statistical-dynamical tool for estimating the probability of RI using best multilinear regression of the most relevant environmental RI predictors over the basin and test it over the next cyclonic seasons. → Conduct the same study over the 1979-201X period to address climate change issues, as soon as the reanalysis project for TC intensity in the SWIO basin is completed by RSMC La R éunion.

FIG. 1 :

 1 FIG. 1: 24-h tracks of all RI cases during the 15-year period; black circles indicate the start of each track; TDs are drawn in yellow, TSs in orange, TCs in red. Letters A, B, C, D indicate Africa, Madagascar, Reunion and Mauritius islands.