Pierre-Marie Bajan

Christophe Kiennert

Herve Debar

A New Approach of Network Simulation for Data Generation in Evaluating Security Products

Keywords: cybersecurity, simulation, evaluation

Evaluating a security product requires the ability to conduct tests to assert that the product reacts as expected, both in terms of scalability and semantics. However, the production of evaluation data at a large scale with a high semantic is very costly with current methods. Load tests are semantically poor and semantic tests require a testbed environment to be deployed at a large scale. Evaluation data from real world activity need to be anonymized and a compromise must be made between the request of the evaluator and the interest of the real world organization. Moreover, to evaluate the full scope of a security product, the evaluator needs multiple test methods. In this paper, we describe a new methodology to produce evaluation data with a customizable level of realism and the possibility to be deployed at a large scale with lower resource requirements for a network support than a testbed environment. Our prototype relies on this method to generate realistic activity for up to 250 simulated users interacting with a real-world webmail server.

I. INTRODUCTION

Security products can be defined as all services and products designed to protect a service, machine or network against attacks. Like other products, they must be tested to guarantee adherence to specifications. Tests can be divided into two categories: semantic tests -tests of capability that require data with a high-level of semantic; and load tests -tests that subject the product to a large amount of data.

With current testing methods [START_REF] Milenkoski | Evaluating computer intrusion detection systems: A survey of common practices[END_REF], load tests are semantically poor, thus not realistic. Meanwhile, semantic tests either require vast amount of resources to reach large scales (e.g., testbed environments), or rely on real life captures with their own set of challenges (e.g., elaboration of the ground truth and privacy concerns). Moreover, a complete evaluation of a security product tests several properties of the product and the evaluator needs to select different methods with the right granularities. The granularity of interactions of the data corresponds to the level of control or precision of the data. For an evaluator, the right granularity for a testing method is a granularity that is fine enough to test specific vulnerabilities or properties. Rather than relying on several methods with different granularities, we aim to elaborate a method to produce data with a customizable granularity and the possibility to achieve large scale generation with appropriate semantic.

In this paper, we present a methodology to produce simulated evaluation data with different granularities independently of the network support. To achieve variable granularity of our model, we formally define two concepts. First, a Data reproducing function represents the level of realism of the simulation (the property of the data to reproduce) and decides the level of control over the data. Second, elementary actions correspond to the most atomic actions the evaluator can simulate, the basis upon which the experimental scenario will be built. We also develop a prototype of our methodology and validate our approach with a series of experiments.

The remainder of this paper is organized as follows. Section II reviews the related work on the production of evaluation data and their limits. Section III defines the concepts of our methodology and uses those concepts to introduce our model. Section IV explains the different choices we made for the implementation of our prototype and shows the experiment results to validate our model. Finally, we conclude our work in Section V.

II. RELATED WORK A. Semantic tests

Semantic tests generate evaluation data with high semantic value. Their goal is to generate realistic workloads to produce real-life reactions of the security product or to test specific functionalities and vulnerabilities of the product. One of the approaches to obtain data with the highest semantics is to use real world data, which can come from several sources: provided by organizations doing real world productions, or obtained from honeypots where actors from the real world were tricked into interacting with a recording system to learn about the current trends (ex: generation of intrusion detection signatures using a honeypot [START_REF] Kreibich | Honeycomb: creating intrusion detection signatures using honeypots[END_REF]).

However, the evaluator does not have a complete knowledge of the content of the data. Some of it can be misidentified or the intent behind some actions misinterpreted. Moreover, real world data are difficult to obtain. Organizations are reluctant to provide data that can damage their activity, and data anonymization has the drawback of deleting relevant information (e.g., challenges of anonymization [START_REF] Seeberg | A new classification scheme for anonymization of real data used in ids benchmarking[END_REF] and desanonymization techniques [START_REF] Coull | Playing devil's advocate: Inferring sensitive information from anonymized network traces[END_REF]). As for honeypots, the evaluator can never know beforehand how many data he can obtain or what kind of data he will gather.

Another way to obtain high semantic data is to generate them according to a defined scenario, relying on tools and scripts to produce specific and calibrated data. Those scripts can be homegrown scripts, exploits, or software testing scripts that try every function of a software to validate its specifications. Manually generating the data (e.g., video transcoding [START_REF] Srivastava | Secure observation of kernel behavior[END_REF], file copy operations [START_REF] Lombardi | Secure virtualization for cloud computing[END_REF], compiling the Linux kernel [START_REF] Reeves | Intrusion detection for resource-constrained embedded control systems in the power grid[END_REF], etc.) offers the greatest control over the interactions inside the data, but the automation of the activity generated through scripts with tools like exploit databases (Metasploit [START_REF] Nasr | Performance analysis of wireless intrusion detection systems[END_REF], Nikto [START_REF] Ma | Toward a lightweight framework for monitoring public clouds[END_REF], w3af [START_REF] Ke | Using w3af to achieve automated penetration testing by live dvd/live usb[END_REF], Nessus [START_REF] Massicotte | Context-based intrusion detection using snort, nessus and bugtraq databases[END_REF]) also offers good control.

However, those methods are quite time-consuming or require in-depth knowledge of the evaluated product. Moreover, the available tools are not necessarily appropriate for customized generation.

B. Load tests

Load tests create stress on the tested product [START_REF] Puketza | A methodology for testing intrusion detection systems[END_REF]. The most common tests use workload drivers like SPEC CPU2000 [START_REF] Reeves | Intrusion detection for resource-constrained embedded control systems in the power grid[END_REF], ApacheBench [START_REF] Riley | Guest-transparent prevention of kernel rootkits with vmm-based memory shadowing[END_REF] [START_REF] Jin | A vmm-based intrusion prevention system in cloud computing environment[END_REF], iozone [START_REF] Jin | A vmm-based intrusion prevention system in cloud computing environment[END_REF], LMBench [START_REF] Morris | Linux security modules: General security support for the linux kernel[END_REF] [7], etc. They produce a customizable workload with a specific intensity. The evaluator can also manually start tasks or processes known to stimulate particular resources (e.g., kernel compilation [START_REF] Riley | Guest-transparent prevention of kernel rootkits with vmm-based memory shadowing[END_REF] [15], files download [START_REF] Laureano | Protecting host-based intrusion detectors through virtual machines[END_REF], or execution of Linux commands [START_REF] Laureano | Protecting host-based intrusion detectors through virtual machines[END_REF]). Those methods are designed to test particular resources of a system (like I/O, CPU and memory consumption) or produce large amount of workload of a specific protocol. For example, SPEC CPU 2017 generates CPUintensive workloads while ApacheBench generates intensive HTTP workloads. However, the semantics of the workloads are low: the generated data are characteristic of the driver used and do not closely resemble real life data.

C. Deployment of semantic tests at a large scale

Evaluators prefer tests that are both intensive and with a high semantic, as the performance of security products like intrusion detection systems often deteriorate at high levels of activity [START_REF] Mell | An overview of issues in testing intrusion detection systems[END_REF]. Methods for semantic tests are deployed on a large scale network support like a testbed environment where a large amount of resources and contributors are gathered to create a large-scale test. Evaluators must either have access to a testbed environment with enough resources to deploy largescale experiments or use the results of other organizations that conducted large-scale experiments and made their data publicly available for the scientific community (DARPA/KDD-99 [START_REF] Cunningham | Evaluating intrusion detection systems without attacking your friends: The 1998 darpa intrusion detection evaluation[END_REF], CAIDA [START_REF] Phan | Distributed-som: A novel performance bottleneck handler for large-sized software-defined networks under flooding attacks[END_REF], DEFCON [START_REF] Cowan | Defcon capture the flag: Defending vulnerable code from intense attack[END_REF], MawiLab [START_REF] Fontugne | Mawilab: combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking[END_REF], etc.).

However, publicly available datasets, on top of often containing errors [START_REF] Milenkoski | Evaluating computer intrusion detection systems: A survey of common practices[END_REF], are not designed for the specific needs of each evaluator. The evaluator needs to have an in-depth knowledge of the characteristics of the activities recorded in the dataset to avoid having an incorrect interpretation of the results of studies using those datasets. Finally, those large-scale experiments produce one-time datasets that can be quickly outdated.

III. OUR EVALUATION DATA PRODUCTION METHOD

Our goal is to generate evaluation data at a large scale with a customizable level of realism and semantic richness. The main weakness of large scale semantic test's method lies in the testbed environment. A testbed environment requires large resources and a lot of contributors to set up, use, maintain and return to a previous state. The virtual machines used to support the data generation methods are costly and the light virtual machines are currently too limited for the requirements of semantic methods. We propose a new production method that generates controlled activity data from short traces independently of the network support. It can be implemented on a testbed environment or on a network support with lower requirements like a lower end network simulator.

We also want our method to meet the need of evaluators to generate tests with a rich variety (different systems, properties of the data, etc.) and to devise hybrid tests, both semantic and load oriented. In our methodology, the simulated data is not produced by the execution of activity functions of the host system but by a generic Data generating function that represents a level of realism required of the simulated data. A simulated activity is comprised of a single Data generating function that is provided with a set of Model data extracted from the execution of specific Elementary actions and used to create a Script of the activity. In the following section, we define concepts on which we build a formal description of our methodology.

A. Concepts and definitions 1) Elementary action: In our methodology, we distinguish real activity -not issued from our simulation method -(R) and simulated activity -issued from our simulation method -(S) in Elementary actions. We call Elementary action (A) a short ordered set of interactions that represents an action between two actors of the activity. Those actors are a Host -a source of generated data -or a Service -a set of functionalities available to a Host. A Service can be an external server or an internal service.

For each Elementary action, we acquire Model data that are the captured data of the execution of this Elementary action during real activity. The goal of Elementary actions is to divide the activity we simulate in individual actions that correspond to an entry of the ground truth, such as "connection to the web interface of a webmail server". The ground truth is an exact representation of the activity generated. So a finer set of Elementary actions for an activity means a finer representation of the simulated activity and a finer control of the activity model for the evaluator.

Model data take different forms (traces, logs, values, etc.), and to label the ground truth, Model data are classified by the evaluator. The evaluator can use that classification to label the resulting Simulation data. For example, the evaluator can create two classes of Model data to represent malicious activity and benign activity, respectively. In other contexts, such as generating activity for the evaluation of administration tools of a network, the actors to consider are different (security: attacker/user, administration: admin/user/client) and the evaluator will have to define classes of data accordingly.

After capturing Model data for every Elementary action relevant for the evaluation, the resulting set of Model data is then given to a Data generating function. We call Equivalence (∼) the fact that two activity data have the same properties. The properties of the data are of different forms: acknowledgement of the data by the Service, size of sent packets, value of a measure, etc. and they represent the level of realism chosen by the evaluator. The evaluator selects a set of Elementary actions to decide the finesse of control over the simulation and he chooses a Data generating function to reproduce the properties of the data he requires. If the Data generating function that produces Simulation data from a dataset of Model data cannot produce data with the same properties, it is useless for the evaluator. Thus, we define the following verification property of Data generating functions:

Property 1: a Data generating function f is said to be useful to a set of Model data D if all Simulation data generated by f from any Model data that belong to D is equivalent to the data used as model.

∀ d ∈ D and f /f (d) = d simulation ⇒ f is usef ul to D, if ∀d ∈ D, d ∼ d simulation
The evaluator can select the Data generating function that is useful to his Model data with Simulation parameters (p simulation ) and provide the Data generating function with additional parameters called Elementary action parameters (p A ). Elementary action parameters allow the evaluator to modify the behavior of the Data generating function to match a larger dataset of Model data (e.g. services accepting the same credentials but with different identifiers, such as "id=" and " id=") or provide a finer control (e.g. possibility to change the credentials in the submit form).

Data generating functions are selected with Simulation parameters by the evaluator for the properties they preserve and the evaluator adapts or controls the Simulation data with Elementary action parameters. The data exchanged by the program that controls the simulation and the Host that runs a Data generating function is the Control data (d control ) and is essentially the ground truth of the simulation. The compilation of the Control data informs us of all the actions taken during the simulated activity.

3) Scenario and Scripts: We finally define a Script, which is the representation of a realistic behavior of a Host. A Script is an ordered set of actions coupled with Elementary action parameters. These actions can be Elementary actions or actions that do not generate activity data (e.g. "wait X seconds"). A Script (Script H ) is defined for each individual Host and describes the activity it must generate during the simulation. The set of defined Scripts is called the Scenario (Sce) of the simulation.

A Script can be represented as a graph of actions, as illustrated in Figure1.

4) Our model: Figure 2 is a representation of our model. In that figure, the evaluator provides the simulation control program with the Simulation parameters (p simulation ) and the Scenario (Sce): The model we presented is the situation where all the Hosts are simulated and the Services are real services. If some Hosts also acted as Services, they could also initiate the generation of Simulation data according to requests received from other Hosts in the form of other Simulation data.

Sce = {Script H0 , Script H1 } = {([A, p A ], . . . ), ([A, p A ], etc.)} A 0 , p A0 A 1 , p A1 A 2 , p A2 . . .
In our model, the ground truth is built upon the Control data of Hosts simulated by our model. Therefore, no data from Hosts unrelated to the simulation are processed.

Lastly, we must present one of the major issues of our model: the parameterization of the Elementary actions. Indeed, in accordance with the required level of realism of the simulation, the parameterization must allow the Data generating function to preserve various data properties. The higher the level of realism, the more complex the reproduction of Elementary actions becomes. Therefore, designing a Data generating function for a highly realistic simulation, where not only packet size is preserved but also data acknowlegement, requires to consider three main aspects:

• typing: identification and generation of short-lived data like tokens, identifiers of session, etc. • semantics: modification of inputs with a high semantic value in the Model data: credentials, mail selection, mail content, etc. • scalability: a large scale execution of the Data generation function can have consequences on the previous aspects and requires additional changes (e.g., creation of multiple user accounts in the Service database).

These three aspects are integrated to the Elementary action parameters. However, a few in-depth issues still require further consideration and development in order to elaborate a model able to adapt to various test situations without the intervention of the evaluator. The typing issue can be solved with methods based on machine learning, but others may require specific methodologies according to the context of the evaluation. For example, in the case of real-life network reproduction, the semantic and scalability issues can be solved by identifying and using inputs with a high semantic value recorded during a long Model data acquisition period.

IV. IMPLEMENTATION OF THE PROPOSED METHOD

In this section, we describe the implemention of a prototype that follows the requirements of our model, and we show that simulations based on that prototype are both scalable and realistic.

This prototype uses Mininet [START_REF] De Oliveira | Using mininet for emulation and prototyping software-defined networks[END_REF] as the network support of our simulation. Mininet is an open-source network simulator that deploys lightweight virtual machines to create virtual networks, and able to create hundreds of lightweight virtual machines in a short amount of time.

A. Model of the prototype

Our prototype contains several Data generating functions that conserve each of these properties: execution time, packet size, acknowledgement of the data by the Service. Based on these Data generating functions we simulate the activity of 50 to 200 Hosts representing regular employees of a small company interacting with the Service of a webmail server Roundcube on a Postfix mail server. A simulation control program follows the Script described in Figure 3 for all the Hosts of the simulation. In Figure 3, the Elementary actions are in italics while actions that do not generate activity data are in a regular font. The Host can simulate two different series of Elementary actions after a waiting period of X seconds each time. The intensity of the Script can be modulated by modifying the value of X.

To make sure that our method improves the existing methods, it must meet these two requirements:

• Scalability: ability to generate evaluation data proportionally to the scale of the simulation, up to a few hundreds of hosts. • Realism: closeness of the generated data to the the referential Model data.

Our Data generating functions are designed to preserve specific data properties (cf. Property 1), thus

B. Experiments on the prototype

The validation of our prototype is conducted with two separate experiments, which aim to prove that our model leads to both scalable and realistic data generation.

The first experiment is a control experiment. We deploy 5 virtual machines on the network simulator Hynesim [START_REF]Homepage of Hynesim[END_REF] and make them generate the activity of our simulation. We script the Elementary actions of the Script described in Figure 3 with the web driver Selenium [START_REF] Razak | Agile testing with selenium[END_REF] and make the virtual machines use their browser to interact with the webmail server. This experiment provides referential values for our second experiment. To prove the scalability of our prototype, we expect proportionality between these values and the results of our simulation, with respect to the number of Hosts. In the second experiment, we simulate different number of Hosts (5, 50, 100, 150, 200 and 250) and make them generate the activity of regular users using a webmail service for 30 minutes. We measure the activity at three different points: the webmail server, the network simulator Mininet and the server hosting the simulation. Every 30 seconds, we measure four parameters: CPU usage, memory usage, network I/O, and disk I/O. Figure 4 is an example of the measured activity. It represents the network traffic received and sent by the webmail server with 50 simulated Hosts. Each Host follows the Script described in Figure 3, with X = 30.

We also retrieve the logs produced by the webmail server during both experiments. The quantity and content of the logs is analyzed in Table I and Table II.

In the second experiment, we use the Data generating function with the highest level of realism: the adapted replay. That Data generating function preserves the data acknowledgement by the Service and allows Elementary action parameters to modify the inputs of submitted forms. Concretely, it means that a server cannot distinguish the adapted replay from an interaction with a real user. Also, with the help of Elementary action parameters, the evaluator can freely change the credentials replayed to the webmail server.

The analysis of the results aims at proving that the data generated in the second experiment are consistent with those obtained from the first experiment, in terms of both quantity and semantics.

Table I represents the quantity of logs produced by the webmail server during both experiments. We express the average number of lines in the log files of the webmail and their standard deviation. The first column is the name of the main log files produced by the server: "userlogins" logs every connection (successful or not), "imap" logs every instruction from the server that uses the IMAP protocol, and "sql" logs every interaction between the server and its database. The entries under the name "5 VMs" correspond to the results of the control experiment while the other entries are the results of the simulation experiment.

The number of lines in "userlogins" represents the number of connections during the experiments (one line per connection) and can be used to calculate the number of sessions created during both experiments. Figure 5 shows the average number of sessions created during the second experiment and its standard deviation according to the number of simulated Hosts. We also estimate the average number of sessions inferred from the results of the control experiment, based on proportionality (avg("5 VMs") × number of Hosts

5

).

We observe that the number of sessions created during the second experiment is close to our estimation. Our simulation produces more sessions than expected but it can be explained by the fact that our Data generating function reproduces the Model data of an Elementary action faster than the browser of the virtual machines. Hence, in a period of 30 minutes, the simulated activity has gone through more cycles of the Script than the control experiment. A projection of the number of lines of the other log files ("imap" and "sql") displays similar results. These results establish that the simulated activity produces a consistent amount of logs. In Figure 6, we examine the network traffic produced by our simulated activity. The blue and red parts represent the average number of bytes, respectively, received and sent by the webmail server every 30 seconds, along with the standard deviation. For comparison, the black lines correspond to the estimation of the expected results based on the control experiment. As before, the results of the second experiment are close to our estimation. The deviation can be justified with the same explanation regarding the activity speed difference. This deviation is also partly due to the cached data. Since these data are stored on the host after the first connection, the amount of exchanged data during the first connection is higher than during subsequent sessions.

However, our Data generating function does not take cached data into account. Therefore, our simulated connections request more data from the webmail server than estimated. This observation is part of the parametrization issues of the Data generating function raised at the end of Section III. Adding Elementary action parameters to modify the behavior of the function can solve this issue as we did for previous typing and semantic issues. However, the addition of new Elementary action parameters is made from empiric observation and could be improved by adding new methods to our model like machine learning.

Despite those issues, we have shown that the simulated activity of the second experiment generated a large network activity proportionally to the number of simulated Hosts, as expected. We now focus on proving that the activity semantics was also preserved. For each Elementary action of the activity Script, we look for log entries that could act as signatures for the action. By comparing these signatures in both experiments, we obtain the results displayed in Table II.

From Table II, the following observations can be made:

• the number of signatures for the "connect" Elementary action is slightly inferior to the number of sessions (the number of lines from "userlogins") observed for 150 Hosts and above. It is explained by the fact that the signatures correspond to the number of successful connections to the webmail server. If we remove the number of lines in the "userlogins" file that correspond to failed connections, we find the exact number of signatures for the "connect" Elementary action. • the number of signature for the "disconnect" Elementary action corresponds to the exact number of sessions observed in Table I. • the number of signatures for the "open" Elementary action is slightly inferior to the number of signatures for the "connect" Elementary action for 50 Hosts and above. It is likely due to the experiment ending before the last Script cycle ended for a few Hosts. • no characteristic entry for the "send an email" Elementary action could be found in the "userlogins", "imap" and "sql" log files.

The failure of several connections in our simulation may also be due to the parameterization of the Data generating function. The adapted replay Data generating function was designed to modify short-lived information from the Model data like the token or the session identifier according to the server reply from the requests. However, such modification was not included in the first request. The webmail server possibly refused some connections because they contained the same information at the same time. Therefore, an improvement of the typing of the adapted replay Data generating function should raise the number of successful connections with a high number of simulated Hosts. Table II shows that for each successful session in our simulated activity, the webmail server correctly interpreted the Elementary actions.

To sum up the results analysis, our prototype generates a simulated activity that produces a realistic amount of network traffic and logs from the webmail server. Moreover, the webmail server produces the appropriate number of logs reflecting the correct semantics. Therefore, our prototype succeeds in providing scalable and realistic data generation, thus validating our model.

V. CONCLUSION

In this paper, we establish a new methodology to generate realistic evaluation data on a network support (Mininet) with far fewer requirements than the common network testbeds. This methodology takes into consideration the need for an evaluator to test different properties and evaluate different vulnerabilities in a security product. Therefore, an evaluator can select the Data generation function that matches the properties of the product that need to be tested. The evaluator also has a control on the granularity of the activity Elementary actions. The finesse of the simulated activity can be improved by introducing new Elementary actions or adding Elementary action parameters to the Data generation function.

We validate our model with a prototype able to generate realistic activity up to 250 users interacting with a webmail server. The traffic can be customized in terms of Hosts numbers as well as Scripts content. Therefore, it will be possible to use this prototype to develop more complex activity scenarios dedicated to the evaluation of security products such as intrusion detection systems.

However, our prototype still has a few limitations. The existing Data generating functions mostly focus on the creation of network activity and does not generate system activity for host-based security products. The parametrization for more realistic Data generating functions also raises additional issues that need to be addressed with further work. Finally, our prototype is currently limited to the simulation of Hosts. In parallel with the testing of network-based intrusion detection systems based on our prototype, the next steps of our work will focus on extending our prototype to include the simulation of Services and develop new Data generating functions that focus on the generation of system data rather than network data.

2 )

 2 Data generating function: A Data generating function (f ) creates Simulation data from Model data. Simulation data (d simulation ) is created from the execution by a Host (H) of an Elementary action (A) during a simulated activity. It is the output of a Data generating function and we express our demands for Simulation data as Equivalence.

Figure 1 .

 1 Figure 1. Example of a Script

Figure 2 .

 2 Figure 2. Generation of simulated activity from short traces

8 Figure 3 .

 83 Figure 3. Generation of simulated activity from short traces

Figure 4 .

 4 Figure 4. Network traffic of the webmail server for a single experiment (50 Hosts)

Figure 5 .

 5 Figure 5. Number of sessions created during simulation (blue) compared to estimation (black)

Figure 6 .

 6 Figure 6. Network traffic of the webmail server

TABLE I .

 I NUMBER OF LINES IN THE WEBMAIL LOG FILES.

		5 VMs	5 Hosts	50 Hosts	100 Hosts	150 Hosts	200 Hosts	250 Hosts
	Filenames	avg	stdev	avg	stdev	avg	stdev	avg	stdev	avg	stdev	avg	stdev	avg	stdev
	userlogins	90	9	112	10	1032	36	2084	45	3085	52	4121	53	5118	74
	imap	43245	5070	57775	5306	487883	22742	984642	28820	1450507	27792	1933823	21117	274825	235985
	sql	4955	525	6703	563	56081	1886	113031	2452	167138	2964	223427	2906	265354	4688


Maxime Thieffry
email: maxime.thieffry@inria.fr

Alexandre Kruszewski

Christian Duriez

Thierry-Marie Guerra

Control Design for Soft Robots based on Reduced Order Model

Keywords: Modeling, Control, and Learning for Soft Robots, Robust Control of Robotic Systems, Model Order Reduction

Inspired by nature, soft robots promise disruptive advances in robotics. Soft robots are naturally compliant and exhibit nonlinear behavior, which makes their study challenging. No unified framework exists to control these robots, especially when considering their dynamics. This work proposes a methodology to study this type of robots around a stable equilibrium point. It can make the robot converge faster and with reduced oscillations to a desired equilibrium state. Using computational mechanics, a large-scale dynamic model of the robot is obtained and model reduction algorithms enable the design of low order controller and observer. A real robot is used to demonstrate the interest of the results.

I. INTRODUCTION

O NE of the driving forces behind soft robotics is the requirement for machines that can work closely with humans rather than in competition with them. Where there is no need for a high level of adaptability in the environment, there is no need to think about soft robots; traditional rigid robots will most likely outperform soft robots if the desired task is well defined, in a well known and structured environment. The ever-increasing mastery of rigid robots and the desire to design more realistic robots, to interact with humans and/or in confined space in contacts with the environment, pushed the roboticist community to invent new paradigms, among which is soft robotics [START_REF] Kim | Soft robotics: a bioinspired evolution in robotics[END_REF], [START_REF] Majidi | Soft robotics: a perspective current trends and prospects for the future[END_REF], [START_REF] Laschi | Soft robotics: new perspectives for robot bodyware and control[END_REF].

By definition, soft robots are compliant to the environment, and regarding the variety of materials used for their design and manufacture, which are also lighter than rigid robots. Another advantage is a larger power to weight ratio, which make them easy to deploy. Potential applications are too numerous to be all cited, but one of the most important is health-care industry, in particular surgery where a soft robot is used as a medical device for heart implant [START_REF] Payne | An implantable extracardiac soft robotic device for the failing heart: Mechanical coupling and synchronization[END_REF], cardiovascular therapy [START_REF] Wamala | The use of soft robotics in cardiovascular therapy[END_REF] and prosthesis and exosuits: removing rigid links in wearable robot makes it more comfortable to wear, and more efficient [START_REF] Ding | Biomechanical and physiological evaluation of multi-joint assistance with soft exosuits[END_REF], [START_REF] O'neill | A soft wearable robot for the shoulder: Design, characterization, and preliminary testing[END_REF].

Biology provides a major inspiration in the design of soft robots. The elephant's trunk, octopus arm or snake body lead to the design of the first soft robots [START_REF] Neppalli | Octarm-a soft robotic manipulator[END_REF], [START_REF] Laschi | Soft robot arm inspired by the octopus[END_REF]. The octopus' arm's morphology allows it to benefit from its interaction with the environment to achieve a specific task. These biological examples have no backbone and achieve therefore better performance in unstructured and cluttered environments, which is one of the motivation to design soft robots. This bioinspiration can also come from the human, and helps to improve industrial gripper, or, coming back to health related applications, could improve the hand-prosthesis design [START_REF] Mattar | A survey of bio-inspired robotics hands implementation: New directions in dexterous manipulation[END_REF].

This new field of research has opened research areas, among which is the need of accurate modeling methods, design tools and control methodologies [START_REF] Rus | Design, fabrication and control of soft robots[END_REF], [START_REF] Lipson | Challenges and opportunities for design, simulation, and fabrication of soft robots[END_REF]. The present work aims at providing new results in this last category: it proposes a methodology to control the dynamics of soft robots around a stable equilibrium point based on its finite element model.

II. PREVIOUS WORK AND STATE OF THE ART A. Modeling

Soft robotics is often referred to as a subclass of continuum robots, and results are available in this field to design, model and control continuum robots as in [START_REF] Walker | Continuous backbone continuum robot manipulators[END_REF], and [START_REF] Bieze | Contribution to the kinematic modeling and control of soft manipulators using computational mechanics[END_REF] presents a detailed state-of-the-art of kinematic modeling of continuum manipulator for which a visual summary is shown in figure 1.

Soft robotics can take benefits of some methods initially developed for continuum robots, such as the Cosserat-Rod theory, see [START_REF] Renda | Discrete cosserat approach for multi-section soft robots dynamics[END_REF] for details. This theory has the advantage of being real-time computable and geometrically exact. Another modeling method is the Piecewise-Constant Curvature, see [START_REF] Webster | Design and kinematic modeling of constant curvature continuum robots: A review[END_REF] for details, but it requires the studied robots to have a specific shape in order to validate the constant curvature assumption.

For simple geometry, such as beam, the modeling problem can be solved, as in [START_REF] Gamus | Interaction between inertia, viscosity, and elasticity in soft robotic actuator with fluidic network[END_REF]. However, the present work aims at being generic and should therefore not make any assumption regarding the geometry of the robot in order to be used on various types of robots.

Different modeling solutions are combined in [START_REF] Runge | A framework for the automated design and modelling of soft robotic systems[END_REF], where authors use continuum robot modeling, finite element method (FEM) and machine learning to develop a generic modeling method for soft robots. Finite element method is also used in [START_REF] Coevoet | Software toolkit for modeling, simulation, and control of soft robots[END_REF] and [START_REF] Duriez | Control of elastic soft robots based on real-time finite element method[END_REF]. These papers propose a real-time implementation of the FEM that has the advantage to start from the constitutive law of the material which is measurable experimentally.

B. Control

The aforementioned FEM methodology has shown some significant results for kinematics control: [START_REF] Bieze | Contribution to the kinematic modeling and control of soft manipulators using computational mechanics[END_REF], [START_REF] Zhang | Kinematic modeling and observer based control of soft robot using realtime finite element method[END_REF]. However, the extension of this method to dynamical study is not trivial and brings additional challenges, such as dimensionality.

A recent survey recall the current state of research in control of soft robots manipulators [START_REF] Thuruthel | Control strategies for soft robotic manipulators: A survey[END_REF]. With a precise comparison between model-based and model-free controllers and kinematics and dynamic controllers, this work states that considering the complete dynamic of the robots is probably the most challenging field of soft robot control. It recall that modelbased dynamic controllers are still in their "nascent stage and consequently, there are a multitude of gaps that should be addressed in design, modeling, and control". This is the aim of the present work.

Recently, different strategies to provide generic approaches for soft robot control have been proposed. In [START_REF] Jiang | A two-level approach for solving the inverse kinematics of an extensible soft arm considering viscoelastic behavior[END_REF], authors propose a solution for the inverse kinematics problem and a model free control method is presented in [START_REF] Thuruthel | Learning dynamic models for open loop predictive control of soft robotic manipulators[END_REF]. This last method is based on machine learning and seems not to require any assumptions about the model, but is for now restricted to open-loop. Learning algorithms have also been used in [START_REF] Lee | Nonparametric online learning control for soft continuum robot: An enabling technique for effective endoscopic navigation[END_REF] where a generic control framework is presented. The control strategy is based on a training step to learn the model without prior consideration regarding the robot's structure. In the present work, we aim at presenting a model-based dynamic control approach using finite element method modeling, such as in [START_REF] Thieffry | Reduced Order Control of Soft Robots with Guaranteed Stability[END_REF].

Soft robots have a theoretical infinite number of degrees of freedom. The spatial discretization in finite element limits it to a considerable large number and brings us to large-scale control theory, which is also an active field of research.

To design a controller usable in practice with a reasonable number of sensors, the use of model reduction is explored. Again, lots of results exists in this field, as recalled here [START_REF] Benner | Model Reduction and Approximation: Theory and Algorithms[END_REF], bringing the soft robotics community to use it for soft robot modeling [START_REF] Chenevier | Reduced-order modeling of soft robots[END_REF], and control of continuum manipulators [START_REF] Sadati | Control space reduction and real-time accurate modeling of continuum manipulators using ritz and ritz-galerkin methods[END_REF].

In [START_REF] Della Santina | Controlling soft robots: balancing feedback and feedforward elements[END_REF], authors identify difficulties about soft robot control because identifying good performance is not straightforward when studying soft robots. This work highlights the need of a better control design but shows that those controllers affect the natural behavior of the soft robot, making them stiffer. A mix between feedback, feedforward and iterative learning is proposed to solve this issue.

III. PRESENT CONTRIBUTION

The present work aims at providing a methodology to control soft robots in order to make them converge faster and without oscillations to a desired final position. It is an extension of the work presented in [START_REF] Thieffry | Reduced Order Control of Soft Robots with Guaranteed Stability[END_REF], that presented a methodology to control the convergence rate of soft robots using state feedback controller. The present work extends the previous results from state feedback (all states were supposed available) to output feedback (real-time considerations) via a state observer design. The full methodology is then tested experimentally. It covers modeling, control and state observation of soft robots in both simulation and real experiments on an academic case. It focuses on model-based control, to maximize the benefits from the FEM method described in [START_REF] Coevoet | Software toolkit for modeling, simulation, and control of soft robots[END_REF].

To avoid the expansion of dimensionality and ensure the solvability of the problem two steps are performed. The first one is to get a linear model from the FEM nonlinear model via linearization. The second step uses model-reduction providing a reduced linear model compatible with the actual solvers, in order to derive both a controller and an observer (for the unmeasured states). Of course, both steps introduce an error that has to be taken into account for the control design.

The present work contributions are:

• an experimental validation of the control methodology presented in [START_REF] Thieffry | Reduced Order Control of Soft Robots with Guaranteed Stability[END_REF],

• a robust reduced order Luenberger observer.

IV. FEM-BASED MODELING A. FEM model

Modeling soft robots relies on both continuum mechanics theory and numerical approaches to solve the underlying equations. First, it requires a mesh of the studied robot, which can be obtained using any mechanical design software. Let us define position and velocity vectors, respectively q(t) ∈ R n and v(t) ∈ R n whose dimension n is proportional to the size of the FEM mesh used to model the robot. As there is no ambiguity, the time-dependency of those vectors will be omitted in the latter and v(t) = v, q(t) = q. The more nodes the mesh has, the more the model tends to be accurate and, for soft robots application, the size N of the FEM mesh goes from hundreds to thousands of variables. The dimension n of the vectors q and v is made of 3 × N variables, as the position and velocity vectors are given in the 3 dimension of space.

The non-linear equation of motion of the robots is given by Newton's law:

M(q) v = P(q) -F(q, v) + H T (q)z(t) (1)
where M(q) is the mass matrix, H T (q)z is the actuators contribution : H T (q) contains the direction of the actuators forces and z their amplitude. The matrix F(q, v) represents the internal forces and P(q) gathers all the known external forces. As we consider only the gravity field, P(q) is constant and P(q) = P. Let q 0 ∈ R n be a stable equilibrium that could be obtained using an inverse problem. This configuration q 0 is the desired state of the robot and is induced by P and z(t) = z 0 , i.e. q 0 is solution to

0 = P -F(q 0 , 0) + H T (q 0 )z 0 (2)
Equation ( 1) can also be written as:

M(q) v = P -F (q, v) + H T (q)u(t) -P + F(q0, 0) -H T (q0)z0 ⇔ M(q) v = F(q0, 0) -F (q, v) + H T (q)u(t) -H T (q0)z0 (3)
We can approximate the internal forces F with a first order Taylor expansion around this equilibrium point:

F(q, v) ≈F(q0, 0) + ∂F(q, 0) ∂q q=q 0 (q -q0) + ∂F(q0, v) ∂v v=0 v (4)
where ∂F (q,v) ∂q = K(q, v) is the compliance matrix, and

∂F (q,v) ∂v = D(q, v
) is the damping matrix. By definition, mass, compliance and damping matrices are positive definite. With these notations, the equation of motion around an equilibrium point q 0 is given by the following relation:

M(q) v ≈ -K(q0, 0)d -D(q0, 0)v + H T (q)u(t) -H T (q0)z0 (5)
with d the displacement vector defined by:

d = q -q 0 (6)

B. Linear state-space Equation

Around an equilibrium point q 0 , let us consider M = M(q 0 , 0), D = D(q 0 , 0), K = K(q 0 , 0) and H(q 0 ) = H(q) = H. Defining the new input vector u as u = z -z 0 , system (5) can be approximated by the following linear representation:

         ẋ = -M -1 D -M -1 K I 0 A x + M -1 H T 0 B u y = Cx (7)
where x = v d , x ∈ R 2n and where system matrices are large-scale sparse matrices, i.e.

A ∈ R 2n×2n , B ∈ R 2n×m , C ∈ R p×2n
, where m is the number of actuators and p the number of outputs.

C. Experiments on a real robot 1) Experimental setup: The theoretical results developed in this paper are illustrated with an experimental setup shown in figure 2 and3. This robot is a 90 centimeters long soft beam that weighs 13 grams. It is actuated with 2 cables placed at the middle of the beam, at 45 centimeter of the wall. The validation results are given for the following experiment: the robot is released from an initial position, left of figure 2, and converges to a stable position given by P and u 0 , right of figure 2. The output of this robot is the displacement of the tip (left extremity) of the beam in the three directions of space, x y and z as described on the figure 3. In simulation, a mesh made of 2531 tetrahedrons and 907 nodes is used, corresponding to position and velocity vectors of dimension n = 2721 and a state x ∈ R 5442 . 2) Nonlinear model validation: Using the SOFA framework, see [START_REF] Coevoet | Software toolkit for modeling, simulation, and control of soft robots[END_REF] for details, the nonlinear system is simulated and its output is compared to the real measurements in figure 5. It presents the worst case error signal evolution compared to the real measurement, with a 3.5 centimeters absolute maximum error. 3) Validation of the linearization step: Figure 6 presents the worst case error signal between linear and nonlinear evolution with a 1.1 centimeters absolute maximum error. In addition, the linear model is validated as it captures faithfully the oscillations.

V. MODEL ORDER REDUCTION

To design a state feedback control law, the large-scale FEM model is not adapted. Control design tools are indeed not suitable for systems with thousands of decision variables. That is why model reduction is proposed to obtain a system of reduced dimension used to compute both controller and observer.

Even if different results exist in the literature for linear model reduction, like balanced truncation or iterative tangential interpolation [START_REF] Antoulas | Approximation of large-scale dynamical systems[END_REF], the only method suitable for non-linear system is the Proper Orthogonal Decomposition (POD) [START_REF] Benner | Model Reduction and Approximation: Theory and Algorithms[END_REF].

To ease the extension of this work to nonlinear model, this method is used to perform model reduction.

A. State projection

Projection-based model order reduction consists of finding two projectors V = V r V r ∈ R 2n×2n and W = W r W r ∈ R 2n×2n to compute a reduced order state x r ∈ R and a neglected state x r ∈ R 2n-r , defined as:

x = V r x r + V r x r (8)
Projectors are orthogonals, it holds W T r V r = I and W T r V r = 0. Thus, the system's dynamics writes:

             ẋr = W T r AV r Ar x r + W T r B Br u + W T r AV r x r ẋr = W T r AV r x r + W T r Bu + W T r AV r x r y r = CV Cr x + CV r x r (9)
It provides us with a low dimensional state x r and a reduced order system which is used to design a controller and an observer. In both case, the aim is to use only x r to control the whole state dynamics described in [START_REF] O'neill | A soft wearable robot for the shoulder: Design, characterization, and preliminary testing[END_REF].

B. Application to soft robotics

POD reduction needs a first experiments where snapshots of the robots' state are saved, then a singular value decomposition of these snapshots is performed. The state vector is truncated depending on how fast the singular values decay. The presented reduction method is used on the soft robot presented in figure 2. Figure 7 shows the decay of its singular values, showing a fast decay for the first 10 values, and those 10 first values represent more than 99% of the singular values of the model. The results of the reduction algorithm are shown in figure 8, that shows a comparison between outputs of the full and reduced systems with 10 states. The reduced system clearly represents faithfully the large-order one around the studied equilibrium point.

VI. CONTROL DESIGN

The aim of this work is to present a methodology to design feedback controller for soft robots, based on the dynamical model presented in the previous section. Robots' dynamics is controlled based on the reduced order model introduced previously. A control method for soft robots based on a reduced model and taking into account reduction error has been presented in [START_REF] Thieffry | Reduced Order Control of Soft Robots with Guaranteed Stability[END_REF]. The idea behind this control design is to control the dynamics of the reduced system using a feedback control law and ensure the large-scale closed loop stability using Lyapunov theory.

Let L ∈ R m×r , where m is the number of inputs of the system, be the feedback matrix of the control law: u = -Lx r [START_REF] Mattar | A survey of bio-inspired robotics hands implementation: New directions in dexterous manipulation[END_REF] leading to the following closed-loop reduced order model:

ẋr = (A r -B r L)x r y r = C r x r (11)
and to corresponding the large-scale closed-loop system:

ẋ = (A -BLW T )x y = Cx (12)
Let us recall here theorem 2 of [START_REF] Thieffry | Reduced Order Control of Soft Robots with Guaranteed Stability[END_REF]. It is based on the existence of an energy-based Lyapunov function in open-loop. The closed-loop poles are placed at desired location thanks to the state feedback and the stability is ensured thanks to the large-scale LMI.

Theorem 2: System (7) with feedback (10) is stable with a decay rate λ if: There exists such as:

(1 + )M M M (1 + )K + D > 0 (13)
and

(S + T) < -λ (1 + )M M M (1 + )K + D ( 14
)
with

S = V T -(1 + )D + M 0 0 -K V + ( * ) (15)
which also writes

S =     -( 1
+ )D rv rv + M rv rv 0 -( 1
+ )D rv rv + M rv rv 0 0 -K rv rv 0 -K rv rv -( 1
+ )D rv rv + M rv rv 0 -( 1
+ )D rv rv + M rv rv 0 0 -K rv rv 0 -K rv rv    
where

D rv rv = V T rv DV rv , D rv rv = V T rv DV rv and T = V T (1 + )H T H T LV + ( * ) =     (1 + )V T rv H T Lrv (1 + )V T rv H T L rd 0 0 V T rd H T Lrv V T rd H T L rd 0 0 (1 + )V T rv H T Lrv (1 + )V T rv H T L rd 0 0 V T rd H T Lrv V T rd H T L rd 0 0     + ( * ) (16)
This LMI problem implies few decision variables, as the feedback matrix L is of reduced dimension, and a large number of constraints are solved to ensure large-scale stability and performances. In the case considered in this work, the state vector x is made of 5442 variables, the matrices S and T are also of dimension 5442 × 5442 and the low order feedback matrix L is of dimension 2 × 10.

This control strategy is tested in simulation on the linear large-scale system. The goal of this simulation experiment is to drive the robot to the final position with reduced vibrations, compared to figure 4. Results are shown on the figure 9 and show a clear diminution of the oscillations.

VII. OBSERVER

To use the previous control design in practice, where neither x nor x r are available from sensor, an observer is designed to reconstruct x r from y (in our case, from the position of the tip in three dimensions of space). As for the control part, where the reduction error is taken into account in the computation, the goal is to design an observer that is robust according to the reduction error. To do so, an unknown input observer, in the form of a PI-observer as in [START_REF] Ichalal | Simultaneous state and unknown inputs estimation with pi and pmi observers for takagi sugeno model with unmeasurable premise variables[END_REF], reconstructs x r and considers the reduction error as a disturbance, i.e. the unknown input.

A. Observer design

From ( 9), the dynamics of the reduced order state writes:

ẋr = A r x r + B r u + W T r AV r x r y r = C r x r (17)
A Luenberger-observer for this system would be:

ẋr = Ar xr + Bru + W T r AVrxr + F obs (yr -ŷr) ŷr = Cr xr (18)
However, the vector x r ∈ R 2n-r is of large dimension and cannot be used to compute

F obs . Let us denote Φ = W T r AV r x r , Φ ∈ R r , equation (17) writes:
ẋr = A r x r + B r u + Φ y r = C r x r (19)
We propose to define an unknown input ω to model the behavior of Φ. Let us assume that:

Φ = Zω + Ψ (20)
with Z ∈ R r×nω , ω ∈ R nω and Ψ ∈ R r and assuming that the p th derivative of ω is zero, i.e. the dynamics of ω can be captured via a cascade of integrators such as:

     ω ω . . . ω (p)      Γ =      0 1 . . . 0 . . . . . . . . . 0 0 . . . 0 1 0 . . . . . . 0      J      ω ω . . . ω (p-1)      Γ (21)
Under these assumptions, ( 19) is observable iff:

(A r , C r ) is observable, rank(Z) ≤ n y ( 22
)
where n y is the number of outputs. The problem is that Φ is of larger dimension than ω, otherwise the state would be completely measured. A way to tackle this problem is to determine the matrix Z that minimizes Φ-Zω and that can be obtained thanks to simulation experiments, where the vector Φ is computable and snapshots of this vector are saved:

Ω = Φ(t 1 ) Φ(t 2 ) Φ(t 3 ) . . . Φ(t f ) (23)
It is possible to see how x r affects x r by performing a singular value decomposition of Ω and retrieve the unknown input matrix Z:

Ω = Z diag(σi) 0 2n×(tf -2n)     ω1 ω2 . . . ω tf     (24)
Where σ i are the singular values of Ω and 0 r,c is a zero matrix of size r × c. Thus, for each t i the reduction error is:

Ω i = Φ(t i ) = Z diag(σ i ) 0 2n×(tf -2n) ω i (25)
which also writes:

Φ(t i ) = 2n j=1 Z j σ j ω i,j Φ(t i ) = r j=1 Z j σ j ω i,j + 2n j=r+1 Z j σ j ω i,j (26)
From SVD algorithm, it holds:

|| 2n j=r+1 Z j σ j ω i,j || ≤ 2n j=r+1 σ j (27)
The vector ω gathers the reduction error and is the unknown input of the observer.

ẋr = A r xr + B r u + F obs (y -ŷr ) + Z ω ŷr = C r xr (28)
Considering the extended state x e = x r Γ T , whose dynamics (with Γ and J defined in ( 21)) writes:

ẋe = A r Z 0 . . . 0 0 J Ae x e + Br 0 Be u + Ψ 0 (29)
and the observed extended state

xe = xr Γ (30)
the observation error e = x e -xe dynamics is the following:

ė = Ar -F obs 1 Cr Z 0 . . . 0 -F obs 2 Cr J e + Ψ 0 (31)
with ||Ψ|| ≤ 2n j=r+1 σ j . In order to minimize the effect of the residue Ψ, the observer gain F obs = F obs1 F obs2 T is computed using a H ∞ criteria:

F obs = arg min F obs max ||Ψ||<1 ||e|| 2 ||Ψ|| 2 (32)

B. Simulation results

During this simulation experiment, the observed state xr is compared to the one of large-scale linear system (7), i.e. W T r x, the corresponding results are shown in figure 10.

C. Experiments on real device

Once both controller and observer have been tested in simulation, the entire control strategy, i.e. low dimensional state feedback using observer, is applied to the real robot and results are shown in figure 11. Compared to figure 4, it shows a clear diminution of the oscillations before converging to the reference. However, the oscillations are not exactly damped as it was noticed during simulation. This behavior is mainly due to the state estimation error dynamics.

VIII. COMPLETE CLOSED-LOOP STABILITY ANALYSIS

This section is dedicated to the study of the stability of the closed-loop using the observer, i.e. the stability of system (33):

ẋ = Ax -BLx r (33)
which can be written as:

ẋr ẋr = W T r AV T r W T r AV T r W T r AV T r W T r AV T r x r x r + W T r B W T r B Lx r (
34) and using the definition of e = x e -xe , whose dynamics is described in equation ( 31), the previous equation can be written in the following form:

    ẋr ẋr ẋr -ẋr Γ - Γ     = O     x r x r x r -xr Γ - Γ     (35)
where the matrix O is defined as:

  W T r AV T r -W T r BL W T r AV T r W T r BL 0 W T r AV T r -W T r BL W T r AV T r W T r BL 0 0 0 Ar -F obs1 Cr (Z 0 . . . 0) 0 0 -F obs2 Cr J  
This formulation can be used as a tool to check the stability of the complete closed-loop system, under the assumption that the reduction error is bounded. Once both controller and observer have been computed using the methodology described in the previous sections, the sign of the eigenvalues of O determines the stability of the closed-loop.

In the case of the foam beam studied in this work, the 5455 eigenvalues of O are all negative, with a maximum real part of -7.7058. The closed-loop system composed of the large-scale model of section IV, the observer designed in section VII and the controller of section VI is also stable.

IX. DISCUSSION A. Use of linear model

The model used to compute both controller and observer is a linear model. Therefore, all the results presented in this paper are valid in a neighborhood around the equilibrium point where the system has been linearized. We are currently investigating the extension of this work to Linear Parameter Varying modeling, to enable the control around multiple points of interest.

B. Different actuation and sensing

The presented methodology has been tested on a real device to show its effectiveness. The soft robot considered in this work is actuated with cables and only the position of the tip is measured. In a near future, the proposed method will be implemented on several kind of soft robots in order to test how the method is generic, especially thinking that no geometric assumptions are needed as only a finite element mesh is needed. The proposed method can be tested indifferently on a robot actuated with cables, pneumatic, hydraulics... Only the definition of the matrix B of the model would be changed.

C. No proof for tracking

As the initial FEM nonlinear model is linearized around an equilibrium point, the trajectories to follow must remain in a region around this point. Moreover, the trajectory tracking is only tested experimentally and no theoretical proof has been given. This will be the topic of future research.

D. Simultaneous Observer and Controller Design

In the last section of this work, a validation of both controller and observer is proposed to check the stability of the closed-loop. It provides a proof of stability for the large-scale closed-loop system but is for now only a postdesign step. Future work will focus on the simultaneous design of both controller and observer while ensuring stability and performances of the large-scale closed-loop.

X. CONCLUSIONS

We have presented a control method for cancelling the vibrations of soft robots around a stable equilibrium point. This strategy uses finite element method and model reduction to compute a control law and an observer. Using Lyapunov theory and large-scale linear matrix inequalities, a reduced order feedback set the performances and ensure stability of the large-scale model in closed-loop. This work can be seen as a first step to design closedloop controller for soft robots using FEM and model order reduction. In addition to the tracks developed in the discussion section, future work could for instance include the ability to handle contacts with environment.

Fig. 1 .

 1 Fig. 1. Summary of available modeling methods for continuum robots, from [14].

Fig. 2 .

 2 Fig. 2. Experimental conditions. Left: start position; Right: end position

Fig. 4 .

 4 Fig. 4. Measurements of open-loop position error of the tip of the robot. Red : error along z axis; Yellow : x axis; Blue : y axis.

Fig. 5 .

 5 Fig. 5. Difference between outputs of nonlinear model and real robot.

Fig. 6 .

 6 Fig. 6. Difference between outputs of nonlinear and linear models.

Fig. 7 .

 7 Fig. 7. Evolution of the singular values of the model of the soft robot.

Fig. 8 .

 8 Fig. 8. Error between outputs of large and reduced models yr -y ||y|| . Red : error along z axis; Yellow : x axis; Blue : y axis.

Fig. 9 .

 9 Fig. 9. Position error of the large-scale linear model in closed-loop. Red : error along z axis; Yellow : x axis; Blue : y axis.

Fig. 10 .

 10 Fig. 10. Error between projected state of large linear model and observed state: W T r x-xr ||W T x|| .

Fig. 11 .

 11 Fig. 11. Measurements of position error of the tip of the beam in closed-loop. Red : error along z axis; Yellow : x axis; Blue : y axis.

Fig. 12 .

 12 Fig. 12. Measurements of the position of the beam along the z axis. Red : reference, Blue = real measurements.

This paper was recommended for publication by Editor Yu Sun upon evaluation of the Associate Editor and Reviewers' comments. This project has been funded by Universities of Lille and Valenciennes, by ANR (Project ANR-17-ERC2-0029) and by the European Union through the European Regional Development Fund (ERDF).

1 M. Thieffry and T.M.