Michel De Lara
email: lara@cermics.enpc.fr

A Mathematical Framework for Resilience: Dynamics, Uncertainties, Strategies and Recovery Regimes

Keywords: resilience, control theory, uncertainty, risk measures, recovery regimes

Resilience is a rehashed concept in natural hazard managementresilience of cities to earthquakes, to floods, to fire, etc. In a word, a system is said to be resilient if there exists a strategy that can drive the system state back to "normal" after any perturbation. What formal flesh can we put on such a malleable notion? We propose to frame the concept of resilience in the mathematical garbs of control theory under uncertainty. Our setting covers dynamical systems both in discrete or continuous time, deterministic or subject to uncertainties. We will say that a system state is resilient if there exists an adaptive strategy such that the generated state and control paths, contingent on uncertainties, lay within an acceptable domain of random processes, called recovery regimes. We point out how such recovery regimes can be delineated thanks to so called risk measures, making the connection with resilience indicators. Our definition of resilience extends others, be they "à la Holling" or rooted in viability theory. Indeed, our definition of resilience is a form of controlability for whole random processes (regimes), whereas others require that the state values must belong to an acceptable subset of the state set.

Introduction

Consider a system whose state evolves with time, being subject to a dynamics driven both by controls and by external perturbations. The system is said to be resilient if there exists a strategy that can drive the system state towards a normal regime, whatever the perturbations. Basic references are [START_REF] Holling | Resilience and stability of ecological systems[END_REF][START_REF] Martin | The cost of restoration as a way of defining resilience: a viability approach applied to a model of lake eutrophication[END_REF][START_REF] Martin | Defining resilience mathematically: from attractors to viability[END_REF][START_REF] Rougé | Extending the viability theory framework of resilience to uncertain dynamics, and application to lake eutrophication[END_REF][START_REF] Arnoldi | Resilience, reactivity and variability: A mathematical comparison of ecological stability measures[END_REF].

In the case of fisheries, the state can be a vector of abundances at ages of one or several species; the control can be fishing efforts; the external perturbations can affect mortality rates or birth functions appearing in the dynamics (an extreme perturbation could be an El Niño event, affecting the populations renewal). In the case of a city exposed to earthquakes, floods or other climatic events, the state can be a vector of capital stocks (energy reserves, energy production units, water treatment plants, health units, etc.); the controls would be the different investments in capital as well as current operations (flows in and out capital stocks); the dynamics would express the changes in the stocks due to investment and to day to day operations; external perturbations (rain, wind, climatic events, etc.) would affect the stocks by reducing them, possibly down to zero.

In Sect. 2, we introduce basic ingredients from the mathematical framework of control theory under uncertainty. Thus equipped, we frame the concept of resilience in mathematical garbs in Sect. 3. Then, in Sect. [START_REF] Lara | Sustainable Management of Natural Resources[END_REF], we provide illustrations of the abstract general framework and compare our approach with others, "à la Holling" or the stochastic viability theory approach to resilience. In Sect. 5, we sketch how concepts from risk measures (introduced initially in mathematical finance) can be imported to tackle resilience issues. Finally, we discuss pros and cons of our approach to resilience in Sect. 6.

Ingredients for an abstract control system with uncertainties

We outline the mathematical formulations of time, controls, states, Nature (uncertainties), flow (dynamics) and strategies. As the reference [START_REF] Rougé | Extending the viability theory framework of resilience to uncertain dynamics, and application to lake eutrophication[END_REF] is the more mathematically driven paper on resilience, we will systematically emphasize in what our approach differs from that of Rougé, Mathias and Deffuant.

Time, states, controls, Nature and flow

We lay out the basic ingredients of control theory: time, states, controls, Nature (uncertainties) and flow (dynamics).

Time

The time set T is a (nonempty) subset of the real line R. The set T holds a minimal element t 0 ∈ T and an upper bound T , which is either a maximal element when T < +∞ (that is, T ∈ T) or not when T = +∞ (that is, +∞ ∈ T). For any couple (s, t) ∈ R ∪ {+∞} 2 , we use the notation

s : t = {r ∈ T | s ≤ r ≤ t} (1)
for the segment that joins s to t (when s > t, s : t = ∅).

Special cases of discrete and continuous time. This setting includes the discrete time case when T is a discrete set, be it infinite like T = {t 0 + k∆t, k ∈ N} (with ∆t > 0), or finite like T = {t 0 + k∆t, k = 0, 1, . . . , K} (with K ∈ N). Of course, in the continuous time case, T is an interval of R, like [t 0 , T ] when T < +∞ or [t 0 , +∞[ when T = +∞. But the setting makes it possible to consider interval of continuous times separated by discrete times corresponding to jumps. For these reasons, our setting is more general than the one in [START_REF] Rougé | Extending the viability theory framework of resilience to uncertain dynamics, and application to lake eutrophication[END_REF], which considers discrete time systems.

Environmental illustration. In fisheries, investment decisions (boats, equipment) are made at large time scale (years), regulations quotas are generally annual, boat operations are daily. By contrast, populations and external perturbations evolve in continuous time. Depending on the issues at hand, the modeler will choose the proper time scales, symbolized by the set T. In an energy system, like a micro-grid with battery and solar panels, investment decisions in equipment (buying or renewal) occur at large time scale, whereas flows inside the system have to be decided at short time scales (minutes).

States, controls, Nature

At each time t ∈ T,

• the system under consideration can be described by an element x t of the state set X t ,

• the decision-maker (DM) makes a decision u t , taken within a control set U t .

A state of Nature ω affects the system, drawn within a sample set Ω, also called Nature. No probabilistic structure is imposed on the set Ω.

Environmental illustration. In the case of dengue epidemics control at daily time steps, the state can be a vector of abundances of healthy and deseased individuals (possibly at ages), together with the same description for the mosquito vector; the control can be the daily fumigation effort, mosquito larva removal, quarantine measures, or the opening and closing of sanitary facilities; Nature represents unknown factors that affect the dengue dynamics, like rains, humidity, mosquito biting rates, individual susceptibilities, etc. Some of these factirs (like rain) can be progressively unfolded as times passes.

Special case where the sample set is a set of scenarios. In many cases, at each time t ∈ T, an uncertainty w t affects the system, drawn within an uncertainty set W t . Hence, a state of Nature has the form ω = {w t } t∈Tand is called a scenario -drawn within a product sample set Ω = t∈T W t .

Environmental illustration. The above definition of scenarios is in phase with the vocable of scenarios in climate change mitigation; it represents sequences of uncertainties that affect the climate evolution. In our framework, a scenario is not in the hands of the decision-maker; for instance, a scenario does not include investment decisions.

Relevance for resilience. In the case of scenarios, as the uncertainty sets W t depend on t, we cover the case where

• an uncertainty w t ∈ W t affects the system at each time t, possibly progressively revealed to the DM, hence available when he makes decisions;

• other uncertainties, that are present from the start (like parameters), hence are part of the set W t 0 ; such uncertainties are not necessarily revealed to the DM as times passes, and remain unknown.

Our setting is more general than the one in [START_REF] Rougé | Extending the viability theory framework of resilience to uncertain dynamics, and application to lake eutrophication[END_REF]. First, we do not restrict the sample set to be made of scenarios as Rougé, Mathias and Deffuant do.

Second, even in the case of scenarios, no probabilistic structure is imposed on the set t∈T W t whereas Rougé, Mathias and Deffuant require that it be equipped with a probability distribution having a density (with respect to an, unspecified, measure, likely the Lebesgue measure on a Euclidian space).

State and control paths

With the basic set T and the basic families of sets {X t } t∈T and {U t } t∈T , we define Relevance for resilience. We introduce paths because, as stated in the abstract, our (forthcoming) definition of resilience requires that, after any perturbation, the system returns to an acceptable "regime", that is, that the state-control path as a whole must return to a set of acceptable paths (and not only the state values must belong to an acceptable subset of the state set). We introduce tail paths because resilience encapsulates the idea that recovery is possible after some time, and that the system remains "normal" after that time.

• the set t∈T X t of

Dynamics/flow

We now introduce a dynamics under the form of a flow {φ s:t } (s,t)∈T 2 , that is, a family of mappings

φ s:t : X s × t r=s U r × Ω → t r=s X r . (2)
When s > t, all these expressions are void because s : t = ∅. The flow φ s:t maps an initial state xs ∈ X s at time s, a tail control path {u r } r∈s:t and a state of Nature ω towards a tail state path {x r } r∈s:t = φ s:t xs , {u r } r∈s:t , ω ,

with the property that x s = xs .

Relevance for resilience. Our setting is more general than the one in [START_REF] Rougé | Extending the viability theory framework of resilience to uncertain dynamics, and application to lake eutrophication[END_REF]: as illustrated below, we cover differential and stochastic differential systems, in addition to iterated dynamics in discrete time (which is the scope of Rougé, Mathias and Deffuant). Our approach thus allows for a general treatment of resilience.

Cemetery point to take into account either analytical properties or bounds on the controls. In general, a state path cannot be determined by ( 3) for any state of Nature or for any control path, for analytical reasons (measurability, continuity) or because of bounds on the controls. To circumvent this difficulty, one can use a mathematical trick and add to any state set X t a cemetery point ∂. Any time a state cannot be properly defined by the flow by (3), we attribute the value ∂. The vocable "cemetery" expresses the property that, once in the state ∂, the future state values, yielded by the flow, will all be ∂. Therefore, the stationary state path with value ∂ will be the image of those scenarios and control paths for which no state path can be determined by [START_REF] Carpentier | Stochastic Multi-Stage Optimization[END_REF].

Special case of an iterated dynamics in discrete time. In discrete time, when T = N, the flow is generally produced by the iterations of a dynamic

x t = x , x s+1 = F s (x s , u s , w s ) , t ≥ s . (4)
How do we include control constraints in this setting? Suppose given a family of nonempty set-valued mappings U s : X s ⇒ U s , s ∈ T. We want to express that only controls u s that belong to U s (x s ) are relevant. For this purpose, we add to all the state sets X s a cemetery point ∂. Then, when u r ∈ U r (x r ) in ( 4) for at least one r ∈ s : t, we set φ s:t xs , {u r } r∈s:t , {w r } r∈s:t , γ = {∂} s∈t:T in (3).

Environmental illustration. In natural resource management, many population models (anmal, plants) are given by discrete time abundance-at-age dynamical equations. Outside population models, many stock problems are also based upon discrete time dynamical equations. This is the case of dam management, where water stock balance equations are written at a daily scale (possibly less like every eight hours, or possibly more like months for long term planning); control constraints represent the properties that turbined water must be less than the current water stock and bounded by turbine capacity.

Special case of differential systems. In continuous time, the mapping φ s:t in (2) generally cannot be defined over the whole set t r=s U r × Ω. Tail control paths and states of Nature need to be restricted to subsets of t r=s U r and Ω, like the continuous ones for example when dealing with Euclidian spaces. For instance, when T = R + and the flow is produced by a smooth dynamical system on a Euclidian space X = R n

x t = x , ẋs = f s (x s , u s ) , s ≥ t , (5)
control paths {u s } s∈t:T are generally restricted to piecewise continuous ones for a solution to exist.

Special case of stochastic differential equations. Under certain technical assumptions, a stochastic differential equation

dX s = f s (X s , U s , W s )ds + g(X s , U s , W s )dW s , (6)
where {W s } s∈R + is a Brownian motion, gives rise to solutions in the strong sense. In that case, a flow can be defined (but not over the whole set

t r=s U r × Ω).
The case of the history flow. Any possible state derives from the socalled history

h t = {u r } r∈t 0 :t , ω . (7)
In that case, the flow (3) is trivially given by {h r } r∈s:t = h s , {u r } r∈s:t . We will use the notion of history when we compare our approach with the viability approach to resilience.

Adapted and admissible strategies

A control u t is an element of the control set U t . A policy (at time t) is a mapping

λ t : X t × Ω → U t (8)
with image in the control set U t . A strategy is a sequence {λ t } t∈T of policies.

Environmental illustration. In climate change mitigation, a strategy can be an investment policy in renewable energies as a function of the past observed temperatures. In epidemics control, a strategy can be quarantine measures or vector control as a function of observed infected individuals.

Admissible strategies

Suppose given a family of nonempty set-valued mappings U t :

X t × Ω ⇒ U t , t ∈ T.
An admissible strategy is a strategy {λ t } t∈t 0 :T such that control constraints are satisfied in the sense that, for all t ∈ T,

λ t (x t , ω) ∈ U t (x t , ω) , ∀(x t , ω) ∈ X t × Ω . (9)

Adapted strategies

Suppose that the sample set Ω is equipped with a filtration {F t } t∈T . Hence each F t is a σ-field and the sequence t → F t is increasing (for the inclusion order). Suppose that each state set X t , is equipped with a σ-field X t . An adapted policy is a mapping (8) which is measurable with respect to the product σ-field X t ⊗ F t . An adapted strategy is a family {λ t } t∈t 0 :T of adapted policies.

Special case where the sample set is a set of scenarios. Consider the case where Ω = t∈T W t and where each set W t is equipped with a σ-field W t (supposed to contain the singletons). The natural filtration {F t } t∈T is given by

F t = r≤t W r ⊗ s>t {∅, W s } . (10)
Then, in an adapted strategy {λ t } t∈t 0 :T , each policy can be identified with a mapping of the form [3]

λ t : X t × t r=t 0 W r → U t . (11)
In that case, our definition of adapted strategy means that the DM can, at time t, use no more than time t, current state value x t and past scenario {w s } s∈t 0 :t to make his decision u t = λ t (x t , {w s } s∈t 0 :t ).

Relevance for resilience. Though this is not the most general framework to handle information (see [START_REF] Carpentier | Stochastic Multi-Stage Optimization[END_REF] for a more general treatment of information), we hope it can enlighten the notion of adaptive response often found in the resilience literature. Our setting is more general than the one in [START_REF] Rougé | Extending the viability theory framework of resilience to uncertain dynamics, and application to lake eutrophication[END_REF]: indeed, Rougé, Mathias and Deffuant only consider state feedbacks, that is, Markovian strategies as defined below. By contrast, our setting includes the case of corrupted and partially observed state feedback strategies, that is, the case where strategies have as input a partial observation of the state that is corrupted by noise.

Special case of Markovian or state feedback strategies. Markovian or state feedback policies are of the form

λ t : X t → U t . (12)
With this definition, we express that, at time t, the DM can only use time t and current state value x t -but not the state of Nature ω -to make his decision u t = λ t (x t ). In some cases (when dynamic programming applies for instance), it is enough to restrict to Markovian strategies, much more economical than general strategies.

Closed loop flow

From now on, when we say "strategy", we mean "adapted and admissible strategy".

Given an initial state and a state of Nature, a strategy will induce a state path thanks to the flow: this gives the closed loop flow as follows.

Let s ∈ T and t ∈ T, with s < t. Let {λ t } t∈T be a strategy. We suppose that, for any initial state xs ∈ X s and any state of Nature ω, the following system of (closed loop) equations 3 Resilience: a mathematical framework

{x r } r∈s:t = φ s:t xs , {u r } r∈s:t , ω (13a) u r = λ r (x r , ω) ,
Equipped with the material in Sect. 2, we now frame the concept of resilience in mathematical garbs. For this purpose, we introduce the notion of recovery regime. Compared to other definitions of resilience [START_REF] Holling | Resilience and stability of ecological systems[END_REF][START_REF] Martin | The cost of restoration as a way of defining resilience: a viability approach applied to a model of lake eutrophication[END_REF][START_REF] Martin | Defining resilience mathematically: from attractors to viability[END_REF][START_REF] Rougé | Extending the viability theory framework of resilience to uncertain dynamics, and application to lake eutrophication[END_REF], our definition requires that, after any perturbation, the state-control path as a whole can be driven, by a proper strategy, to a set of acceptable paths (and not only the state values must belong to an acceptable subset of the state set, asymptotically or not). In addition, as state and control paths are contingent on uncertainties, we require that they lay within an acceptable domain of random processes, called recovery regimes. Once again, as the reference [START_REF] Rougé | Extending the viability theory framework of resilience to uncertain dynamics, and application to lake eutrophication[END_REF] is the more mathematically driven paper on resilience, we will systematically emphasize in what our approach differs from that of Rougé, Mathias and Deffuant.

Robustness, resilience and random processes

The notion of robustness captures a form of stability to perturbations; it is a static notion, as no explicit reference to time is required. By contrast, the concept of resilience makes reference to time (dynamics), strategies and perturbations. This is why, to speak of resilience -a notion that mixes time and randomness -we find it convenient to use the framework of random processes, although this does not mean that we require any probability.

From now on, we consider that the sample space Ω is a measurable set equipped with a σ-field F (but not necessarily equipped with a probability). When we consider a deterministic setting, Ω is reduced to a singleton (and ignored). The set of measurable mappings from Ω to any measurable set Y will be denoted by L 0 Ω, Y . Elements of L 0 Ω, Y are called random variables or random processes, although this does not imply the existence of an underlying probability. Random variables are designated with bold capital letters like Z. From now on, every state set X t is a measurable set equipped with a σ-field X t , every control set U t with a σ-field U t , and, when needed, every uncertainty set W t with a σ-field W t .

Fields are introduced when probabilities are needed. When they are not, as with the robust setting, it suffices to equip all sets with their complete σ-fields, made of all subsets. Then, measurable mappings L 0 Ω, Y from Ω to any set Y are all mappings.

Recovery regimes

Recovery regimes, starting from t ∈ T, are subsets of random processes of the form

A t ⊂ L 0 Ω, T s=t X s × T s=t U s . (15)
When there are no uncertainties, Ω is reduced to a singleton, so that A t ⊂ T s=t X s × T s=t U s , as in the two first following examples.

Example of recovery regimes converging to an equilibrium. Let T = R + , X t = R n and U t = R m , for all t ∈ T. Let x be an equilibrium point of the dynamical system ẋs = f (x s , ū) when the control is stationary equal to ū, that is, 0 = f (x, ū). The recovery regimes, starting from t ∈ T, converging to the equilibrium x form the set

A t = {x s } s≥t , {u s } s≥t ∈ X [t,+∞[ × U [t,+∞[ | x s → s→+∞ x . (16)
In general, the equilibrium x is supposed to be asymptotically stable, locally or globally. A more general definition would be

A t = {x s } s≥t , {u s } s≥t lim s→+∞ x s exists , (17)
and, to account for constraints on the values taken by the controls, we can consider

A t = {x s } s≥t , {u s } s≥t lim s→+∞
x s exists and u s ∈ U s (x s ) , ∀s ≥ t , (18) where U s : X s ⇒ U s , for all s ∈ T.

Example of bounded recovery regimes. Let

T = R + , X t = R n and U t = R m , for all t ∈ T. If B is a bounded region of X = R n , we consider A t = {x s } s≥t , {u s } s≥t | x s ∈ B , ∀s ≥ t . ( 19
)
When B is a ball of small radius ρ > 0 around the equilibrium x, we obtain state paths that remain close to x.

Example of random recovery regimes. Suppose that the measurable sample space (Ω, F) is equipped with a probability P. Let X t = R n and U t = R m , for all t ∈ T. Letting B be a bounded region of X = R n and β ∈]0, 1[, the set

A t ={ {X s } s≥t , {U s } s≥t ∈ L 0 Ω, T s=t X s × T s=t U s | P ∃s ≥ t | X s ∈ B ≤ β} (20)
represents state paths that get at least once outside the bounded region B with a probability less than β.

If T is discrete, the set

A t ={ {X s } s≥t , {U s } s≥t ∈ L 0 Ω, T s=t X s × T s=t U s | P ∃s 1 ≥ t , s 2 ≥ t , s 3 ≥ t | X s 1 ∈ B , X s 2 ∈ B , X s 3 ∈ B = 0} (21)
represents state paths that get no more than two times outside the bounded region B.

Resilient strategies and resilient states

Consider a starting time t ∈ T and an initial state xt ∈ X t . We say that the strategy λ is a resilient strategy starting from time t in state xt if the random process {X s } s∈t:T , {U s } s∈t:T given by

{X s (ω)} s∈t:T = φ λ t:T x t , ω (22a) U s (ω) = λ s (X s (ω), ω) , ∀s ∈ t : T , ( 22b
)
where the closed loop flow φ λ t:T is given in ( 14), is such that

{X s } s∈t:T , {U s } s∈t:T ∈ A t . ( 23
)
Notice that we do not use the part {λ r } r<t of the strategy λ = {λ r } r∈t 0 :T . With this definition, a resilient strategy is able to drive the state-control random process into an acceptable regime. As a resilient strategy is adapted, it can "adapt" to the past values of the randomness but no to its future values (hence, our notion of resilience does not require clairvoyance of the DM). Our definition of resilience is a form of controlability for whole random processes (regimes): a resilient strategy has the property to shape the closed loop flow φ λ t:T so that it belongs to a given subset of random processes. We denote by Λ R t (x t ) the set of resilient strategies at time t, starting from state xt . The set of resilient states at time t is

X R t = xt ∈ X t Λ R t (x t ) = ∅ . ( 24
)
4 Illustrations

In Sect. 3, we have provided some illustrations in the course of the exposition. Now, we make the connection between the previous setting and two other settings, the resilience "à la Holling" [START_REF] Holling | Resilience and stability of ecological systems[END_REF] in §4.1 and the resilience-viability framework [START_REF] Martin | The cost of restoration as a way of defining resilience: a viability approach applied to a model of lake eutrophication[END_REF][START_REF] Martin | Defining resilience mathematically: from attractors to viability[END_REF][START_REF] Rougé | Extending the viability theory framework of resilience to uncertain dynamics, and application to lake eutrophication[END_REF] in §4.2.

Deterministic control dynamical system with attractor

As the paper [START_REF] Holling | Resilience and stability of ecological systems[END_REF] does not contain a single equation, it is bit risky to force the seminal Holling's contribution into our setting. However, it is likely that it corresponds to T = R + and to recovery regimes of the form

A t = {x s } s≥t , {u s } s≥t | x s converges towards an attractor . (25)
Note that, as often in the ecological literature on resilience [START_REF] Arnoldi | Resilience, reactivity and variability: A mathematical comparison of ecological stability measures[END_REF], the underlying dynamical system is not controlled.

Resilience and viability

Some authors [START_REF] Martin | The cost of restoration as a way of defining resilience: a viability approach applied to a model of lake eutrophication[END_REF][START_REF] Martin | Defining resilience mathematically: from attractors to viability[END_REF][START_REF] Rougé | Extending the viability theory framework of resilience to uncertain dynamics, and application to lake eutrophication[END_REF] propose to frame resilience within the mathematical theory of viability [START_REF] Aubin | Viability Theory[END_REF]. Let X t = X and U t = U, for all t ∈ T. Let A ⊂ X denote a set made of "acceptable states". Let U s : X ⇒ U, s ∈ T be a family of set-valued mappings that represent control constraints.

Deterministic viability

Consider a starting time t ∈ T and the recovery regimes

A t = { {x s } s≥t , {u s } s≥t | x s ∈ A , u s ∈ U s (x s ) , ∀s ≥ t} . (26)
Then, a resilient strategy is one that is able to drive the state towards the set A of acceptable states.

Robust viability

When there are no uncertainties, we just established a connection between recovery regimes and viability. But, with uncertainties, as resilience requires a form of stability "whatever the perturbations", we are in the realm of robust viability [START_REF] Lara | Sustainable Management of Natural Resources[END_REF], as follows.

Let Ω ⊂ Ω, corresponding to the (nonempty) subset of states of Nature with respect to which the DM expects the system to be robust. Consider a starting time t ∈ T and the recovery regimes

A t = { {X s } s∈t:T {U s } s∈t:T ∈ L 0 Ω, T s=t X s × T s=t U s | ∃τ ∈ L 0 Ω, T , ∀ω ∈ Ω , τ (ω) ≥ t , X s (ω) ∈ A , U s (ω) ∈ U s (X s (ω)) , ∀s ≥ τ (ω)} . (27)
Then, a resilient strategy is one that is able to drive the state towards the set A of acceptable states, after a random time τ , whatever the perturbations in Ω.

Robust viability and recovery time attached to a resilient strategy

Let Ω ⊂ Ω, whose elements can be interpreted as shocks. Consider a starting time t ∈ T and an initial state xt ∈ X t . If λ = {λ s } s∈t:T is a resilient strategy for the recovery regimes (27), the recovery time is the random time defined by

τ (ω) = inf{r ∈ t : T | {X s (ω)} s∈t:T = φ λ t:T xt , ω U s (ω) = λ s (X s (ω), ω) , ∀s ∈ t : T X s (ω) ∈ A , U s (ω) ∈ U s (X s (ω)) , ∀s ≥ r} , (28)
for all ω ∈ Ω, with the convention that inf ∅ = +∞.

Thus, the resilient strategy drives the state towards the set A of acceptable states, after the random time τ , whatever the perturbations (shocks) in Ω. By contrast, the so-called time of crisis occurs before τ [START_REF] Doyen | Scale of viability and minimum time of crisis[END_REF].

Stochastic viability

Suppose that the measurable sample space (Ω, F) is equipped with a probability P and let β ∈ [0, 1], represent a probability level. Consider a starting time t ∈ T and the recovery regimes

A t = { {X s } s∈t:T , {U s } s∈t:T ∈ L 0 Ω, T s=t X s × T s=t U s | P X s ∈ A , U s ∈ U s (X s ) , ∀s ≥ t ≥ β} . (29)
With these recovery regimes, we express that the probability to satisfy state and control constraints after time t is at least β [START_REF] Doyen | Stochastic viability and dynamic programming[END_REF].

4.2.5 Discussion and comparison with the viability theory approach for resilience.

Our setting is more general than the viability theory approach for resilience as introduced in [START_REF] Martin | The cost of restoration as a way of defining resilience: a viability approach applied to a model of lake eutrophication[END_REF][START_REF] Martin | Defining resilience mathematically: from attractors to viability[END_REF][START_REF] Rougé | Extending the viability theory framework of resilience to uncertain dynamics, and application to lake eutrophication[END_REF]. Indeed, the viability approach to resilience deals with constraints time by time; our approach does not. To illustrate our point, consider the deterministic case with discrete and finite time, and scalar controls, to make things easy. It is clear that the recovery regimes given by

A t = { {x s } s≥t , {u s } s≥t | min s≥t u s ≤ 0} (30a) = { {x s } s≥t , {u s } s≥t | ∃s ≥ t , u s ≤ 0} . ( 30b
)
cannot be expressed as time by time constraints on the controls. Of course, the viability approach could handle such a case, but at the price of extending the state and the dynamics, to turn an intertemporal constraint into a time by time constraint. For instance, with the history state introduced at the end of §2.1.4, we can always express any recovery regimes set as viability constraints. In the example above, we do not need the whole history to turn the set A t into one described by time by time constraints: it suffices to introduce an additional component to the state like s≥t 1 {us≤0} in discrete time and impose the final constraint that this new part of an extended state be non zero.

To sum up, our approach to resilience covers more recovery regimes, described with the original states and controls, than those captured by the time by time constraints that make the specificity of the viability approach to resilience.

Resilience and risk

We now sketch how concepts from risk measures (introduced initially in mathematical finance [START_REF] Föllmer | Stochastic Finance. An Introduction in Discrete Time[END_REF]) can be imported to tackle resilience issues. This again is a novelty with respect to the stochastic viability theory approach for resilience as in [START_REF] Rougé | Extending the viability theory framework of resilience to uncertain dynamics, and application to lake eutrophication[END_REF]. Risk measures are potential candidates as indicators of resilience.

Recovery regimes given by risk measures

We start by a definition of recovery regimes given by risk measures, then we provide examples.

Definition of recovery regimes given by extended risk measures

Suppose that T ⊂ R is equipped with the trace T of the Borel field of R. Then, T × Ω is a measurable space when equipped with the product σfield T ⊗ F. Then, any random process in L 0 Ω, T s=t X s × T s=t U s can be identified with a random variable in L 0 t : T × Ω, T s=t X s T s=t U s . We call extended risk measure any G t that maps random variables in L 0 t : T × Ω, T s=t X s T s=t U s towards the real numbers [START_REF] Föllmer | Stochastic Finance. An Introduction in Discrete Time[END_REF]. The lower the risk measure G t , the better.

The basic example of a risk measure is the mathematical expectation under a given probability distribution. A celebrated risk measure in mathematical finance is the tail/average/conditional value-at-risk.

With G t an extended risk measure and α ∈ R a given risk level, we define

Random exit time and viability

Let µ be a measure on the time set T like, for instance, the counting measure when T = N or the Lebesgue measure when T = R + . Then, the random quantity

µ{s ≥ t , X s ∈ A or U s ∈ U s (X s )} (35)
measures the number of times that the state-control path {X s } s∈t:T , {U s } s∈t:T exits from the viability constraints.

Using risk measures -like the tail/average/conditional value-at-risk [7] -or stochastic orders [START_REF] Muller | Comparison Methods for Stochastic Models and Risk[END_REF][START_REF] Shaked | Stochastic Orders[END_REF], we have differents ways to express that this random quantity remains "small".

The general umbrella of cost functions

All the examples above, and many more [START_REF] Rougé | Vulnerability: From the conceptual to the operational using a dynamical system perspective[END_REF], fall under the general umbrella of cost functions as follows.

Consider a starting time t ∈ T and a measurable function

Ψ t : T s=t X s × T s=t U s × Ω → R , (36)
that attachs a disutility or cost -the opposite of value, utility, payoffto any tail state and control path, starting from time t, and to any state of Nature.

Let F be a risk measure that maps random variables on Ω towards the real numbers. Then, an extended risk measure is given by

G t {X s } s∈t:T , {U s } s∈t:T = F Ψ t {X s (•)} s∈t:T , {U s (•)} s∈t:T , • . (37)

Resilience and risk minimization

When the set Λ R t (x t ) of resilient strategies at time t in §3.3 is not empty, how can we select one among the many? Here is a possible way that makes use of risk measures for risk minimization purposes.

Indicators of resilience

Let G t be an extended risk measure. We can look for resilient strategies that minimize risk, solution of

min λ∈Λ R t (xt)
G t φ λ t:T (x t , •), • .

The minimum of the risk measure is a potential candidate as an indicator of resilience. Indeed, it is the best achievable measure of residual risk under a resilient strategy.

Examples

Using cost functions as in §5.1.

where F is a risk measure that maps random variables on Ω towards the real numbers [START_REF] Föllmer | Stochastic Finance. An Introduction in Discrete Time[END_REF]. For instance, in the robust viability setting of §4.2.3, an indicator of resilience could be the minimum (over all resilient strategies) of the maximal (over all states of Nature in Ω) recovery time.

Conclusion

Resilience is a rehashed concept in natural hazard management. Most of the formalizations of the concept require that, after any perturbation, the state of a system returns to an acceptable subset of the state set. Equipped with tools from control theory under uncertainty, we have proposed that resilience is the ability for the state-control random process as a whole to be driven to an acceptable "recovery regime" by a proper resilient strategy (adaptive). Our definition of resilience is a form of controlability: a resilient strategy has the property to shape the closed loop flow so that the resulting state and control random process belongs to a given subset of random processes, the acceptable recovery regimes.

We have proposed to handle risk thanks to risk measures1 , by defining recovery regimes that represent a form of "risk containment". In addition, risk measures are potential candidates as indicators of resilience as they measure the residual risk under a resilient strategy.

Our contribution is formal, with its pros and cons: by its generality, our approach covers a large scope of notions of resilience; however, such generality makes it difficult to propose resolution methods. For instance, the possibility to use dynamic programing in stochastic viability relies upon a white noise assumption that we have not supposed. Much would remain to be done regarding applications and numerical implementation.

  state paths, made of sequences {x t } t∈T where x t ∈ X t for all t ∈ T; tail state paths {x r } r∈s:t (starting at time s < t) are elements of t r=s X r ; • the set t∈T U t of control paths, made of sequences {u t } t∈T where u t ∈ U t for all t ∈ T; tail control paths {u r } r∈s:t (starting at time s < t) are elements of t r=s U r .

  ∀r ∈ s : t (13b) has a unique solution {x r } r∈s:t , {u r } r∈s:t . Quite naturally, we define the closed loop flow φ λ

s:t by φ λ s:t xs , ω = {x s } s∈s:t , {u s } s∈s:t . (14)

  5, we can look for resilient strategies that minimize expected costs

	min λ∈Λ R t (xt)
	min λ∈Λ R t (xt)	ω∈Ω sup	Ψ t φ λ t:T (x t , ω), ω ,	(40)
	or, more generally, that minimize
	min λ∈Λ R t (xt)

E Ψ t φ λ t:T (x t , •), • ,

(39)

or that minimize worst case costs, where Ω ⊂ Ω,

F Ψ t φ λ t:T (x t , •), • ,

We also hinted at the possibility to use so-called stochastic orders.

recovery regimes by

The quantity G t {X s } s∈t:T , {U s } s∈t:T measures the "risk" borne by the random process {X s } s∈t:T , {U s } s∈t:T . Therfore, recovery regimes like in (31) represent a form of "risk containment" under the level α.

Robust viability and the worst case risk measure

The robust viability inspired definition of resilience in §4.2.2 corresponds to (31) with α < 1 and the worst case risk measure

where

is the complementary set of A in X) for all ω ∈ Ω.

Here, the worst case risk measure captures that the state X s (ω) belongs to A both for all times -the core of viability, here handled by the term sup s≥t -and for all states of Nature in Ω -the core of robustness, here handled by the term sup ω∈Ω .

Stochastic viability and beyond: ambiguity

The stochastic viability inspired definition of resilience in §4.2.4 corresponds to (31) with α = 1 -β and the risk measure

Now, suppose that different risk-holders do not share the same beliefs and let P denote a set of probabilities on (Ω, F). We can arrive at an ambiguity viability inspired definition of resilience using the risk measure

(34) Here, G t {X s } s∈t:T , {U s } s∈t:T ≤ α = 1 -β means that P X s ∈ A , U s ∈ U s (X s ) , ∀s ≥ t ≥ β, for all P ∈ P.


Michael Döhler

Falk Hille

Laurent Mevel

Vibration-based monitoring of civil structures with subspace-based damage detection

Keywords: Subspace methods, damage detection, statistical tests, vibrations, structural health monitoring

Automatic vibration-based structural health monitoring has been recognized as a useful alternative or addition to visual inspections or local non-destructive testing performed manually. It is, in particular, suitable for mechanical and aeronautical structures as well as on civil structures, including cultural heritage sites. The main challenge is to provide a robust damage diagnosis from the recorded vibration measurements, for which statistical signal processing methods are required. In this chapter, a damage detection method is presented that compares vibration measurements from the current system to a reference state in a hypothesis test, where datarelated uncertainties are taken into account. The computation of the test statistic on new measurements is straightforward and does not require a separate modal identification. The performance of the method is firstly shown on a steel frame structure in a laboratory experiment. Secondly, the application on real measurements on S101 Bridge is shown during a progressive damage test, where damage was successfully detected for different damage scenarios.

Introduction

Structural health monitoring (SHM) has the goal of determining the system health, i.e. the occurrence and characterization of damages, based on the measurement data Michael Döhler, Laurent Mevel Inria, I4S / IFSTTAR, COSYS, SII, Campus universitaire de Beaulieu, 35042 Rennes, France, email: michael.doehler@inria.fr, laurent.mevel@inria.fr Falk Hille BAM Federal Institute of Materials Research and Testing, Unter den Eichen 87, 12205 Berlin, Germany, e-mail: falk.hille@bam.de 1 recorded on the monitored structure [START_REF] Farrar | An introduction to structural health monitoring[END_REF]. With statistical signal processing techniques, one can find damages automatically within a monitored structure, before they grow to dangerous extents. Automatic inspection is of enormous value for structures with high failure consequences or poor accessibility, such as bridges, structures of cultural heritage, offshore constructions, large engineering structures, power plants, etc. With these means, maintenance operations can be optimized and costly downtime kept to a minimum, while the structural safety is increased.

Vibration-based SHM has shown great potential for automated damage monitoring [START_REF] Brownjohn | Vibration-based monitoring of civil infrastructure: challenges and successes[END_REF]. Methods for damage assessment are categorized into four groups of increasing difficulty and complexity: 1/ detection, 2/ localization, 3/ quantification, and 4/ prognosis of remaining life [START_REF] Rytter | Vibrational based inspection of civil engineering structures[END_REF]. Many methods have been proposed in the literature (see e.g. reviews [START_REF] Carden | Vibration based condition monitoring: a review[END_REF] and [START_REF] Fan | Vibration-based damage identification methods: a review and comparative study[END_REF]), with however few methods taking into account the statistical nature of the vibration measurements, which is essential for robustness under realistic (noisy) operational conditions in practice. Among the methods for damage assessment, the detection methods are currently the most developed and some of them have matured to an industrial application level [START_REF]Structural Vibration Solutions A/S: ARTeMIS Modal Pro -Damage Detection Plugin[END_REF].

Vibration-based damage detection is performed on the rationale that damage affects the stiffness of the monitored structure and, thus, changes its dynamic properties. The analysis of the dynamic properties can be performed entirely based on measurements, without the need of a finite element model. Many of the currently used vibration-based methods for early damage detection perform modal system identification and compare the obtained modal parameter of the actual state with those of the undamaged state, e.g. by using control charts [START_REF] Kullaa | Damage detection of the Z24 Bridge using control charts[END_REF][START_REF] Ramos | Monitoring historical masonry structures with operational modal analysis: Two case studies[END_REF]. In this context, especially the natural frequencies are used for a comparison, as they can be reliably identified. However, the automated estimation of modal parameters from a system identification method and matching them from measurements of different states of the structure for their comparison might require an extensive preprocessing step. Other methods avoid the system identification step in the possibly damaged state. For instance, such methods include non-parametric change detection based on novelty detection [START_REF] Worden | Damage detection using outlier analysis[END_REF][START_REF] Yan | Structural damage diagnosis by Kalman model based on stochastic subspace identification[END_REF], whiteness tests on Kalman filter innovations [START_REF] Bernal | Kalman filter damage detection in the presence of changing process and measurement noise[END_REF] or other data-driven features that are sensitive to changes in the modal parameters.

The subspace-based damage detection approach [START_REF] Basseville | Subspace-based fault detection algorithms for vibration monitoring[END_REF][START_REF] Basseville | Statistical model-based damage detection and localization: subspace-based residuals and damage-to-noise sensitivity ratios[END_REF][START_REF] Döhler | Structural health monitoring with statistical methods during progressive damage test of S101 Bridge[END_REF][START_REF] Döhler | Subspace-based fault detection robust to changes in the noise covariances[END_REF][START_REF] Döhler | Subspace-based damage detection under changes in the ambient excitation statistics[END_REF]], which will be considered in this chapter, also falls into the latter category. In this method, a data-driven model is obtained in the reference state and compared to measurements from an unknown, possibly damaged state. This comparison is performed using a subspace-based residual function and a χ 2 -test built on it for a hypothesis test, without actually estimating the modal parameters in the unknown, possibly damaged states. In this way, the entire structural response is taken into account. This approach provides a complete statistical framework for analyzing a damage residual for both reference and possibly damaged structures. The asymptotic probability distribution of the considered damage residual is given and a statistical hypothesis test to detect damage in the structure has been proposed.

In this chapter, the subspace-based damage detection method is presented. The performance of the method is firstly shown on a steel frame structure in a laboratory experiment. Secondly, the application on real measurements on S101 Bridge is shown during a progressive damage test, where damage was successfully detected for different damage scenarios.

Subspace-based damage detection

In this section, the subspace-based damage detection algorithm is introduced. With this global automated damage detection method, vibration measurements from the current system are compared to a reference state in a subspace-based residual vector. In a hypothesis test, the uncertainties of the residual are taken into account and the respective test statistic is compared to a threshold in order to decide if the structure is damaged or not.

Dynamic structural system model

The vibration behaviour of the monitored structure is assumed to be described by a linear time-invariant dynamical system

M z(t) + C ż(t) + K z(t) = υ(t), (1)
where t denotes continuous time; M , C , K ∈ R m×m are mass, damping, and stiffness matrices, respectively; the state vector z(t) ∈ R m is the displacement vector of the m degrees of freedom of the structure; and υ(t) is the external force. Since the excitation is usually ambient and unmeasured for long-term monitoring, the external force is modelled as white noise. Observed at r sensor positions (e.g. by displacement, velocity or acceleration sensors) at discrete time instants t = kτ (with sampling rate 1/τ), system (1) can be transformed into a discrete-time state space system model [START_REF] Juang | Applied system identification[END_REF]

x k+1 = Ax k + v k y k = Cx k + w k (2)
with the state vector x k = z(kτ) T ż(kτ) T T ∈ R n , the measured outputs y k ∈ R r , the state transition matrix

A = exp 0 I -M -1 K -M -1 C τ ∈ R n×n
and the observation matrix

C = L d -L a M -1 K L v -L a M -1 C ∈ R r×n ,
where n = 2m is the model order and L d , L v , L c ∈ {0, 1} r×m are selection matrices indicating the positions of displacement, velocity or acceleration sensors at the degrees of freedom of the structure, respectively. The state noise v k and output noise w k are unmeasured and assumed to be centered and square integrable. Damages in the monitored system correspond to changes in the matrices M , C or K in (1), e.g. loss of mass or loss of stiffness, and affect the system matrices (A,C) in (2) and the modal parameters (natural frequencies, damping ratios, mode shapes). Hence, damages in model ( 1) can be equivalently detected as changes in the system matrices in [START_REF] Balmès | Handling the temperature effect in vibrationbased monitoring of civil structures: a combined subspace-based and nuisance rejection approach[END_REF]. Based on measurements y k of the monitored system from a reference and from a possibly damaged state, a residual vector is defined based on subspace properties, as outlined in the following section.

Description of the method

In [START_REF] Basseville | Subspace-based fault detection algorithms for vibration monitoring[END_REF][START_REF] Basseville | Statistical model-based damage detection and localization: subspace-based residuals and damage-to-noise sensitivity ratios[END_REF] a residual vector was proposed whose mean is zero in the reference state, and non-zero in the damaged state. It is computed from the measurements y k without actually identifying the modal parameters in the unknown, possibly damaged state. The considered residual is associated with a covariance-driven output-only subspace identification algorithm as follows.

Define the block Hankel matrix H p+1,q of the output covariances

R i = E(y k y T k-i ) as H p+1,q def =      R 1 R 2 . . . R q R 2 R 3 . . . R q+1 . . . . . . . . . . . . R p+1 R p+2 . . . R p+q      def = Hank(R i ),
where the parameters p and q are chosen such that min{pr, qr} > n with usually p + 1 = q. It possesses the well-known factorization property

H p+1,q = O p+1 C q (3)
into the matrices of observability and controllability

O p+1 =      C CA . . . CA p      , C q = G AG . . . A q-1 G , (4)
where G = E(x k+1 y T k ) is the cross-covariance between the states and the outputs. From a singular value decomposition of H p+1,q , the left null space matrix S can be obtained with the characteristic property

S T H p+1,q = 0 (5)
in the reference state of the structure. If the system is damaged, the matrices (A,C) and thus H p+1,q change, thus the product S T H p+1,q is not zero anymore in the damaged state.

Based on these properties, a residual vector is defined as follows. From a set of output measurements y k , k = 1, . . . , N, estimates of the output covariances and the Hankel matrix are computed as

R i = 1 N N ∑ k=1 y k y T k-i , H p+1,q = Hank( R i ),
and the residual vector is defined as

ζ = √ N vec(S T H p+1,q ), (6)
where vec(•) denotes the column stacking vectorization operator. Due to property ( 5), the mean of ζ is zero in the reference state of the structure, and non-zero in the damaged state. The residual vector ζ is asymptotically Gaussian distributed [START_REF] Basseville | Subspace-based fault detection algorithms for vibration monitoring[END_REF]. Let Σ be the asymptotic residual covariance matrix. Then, the corresponding hypothesis test for a decision between H 0 : the system is in the reference state, and H 1 : the system is in a damaged state, leads to the test statistic

s = ζ T Σ -1 ζ , (7)
which is asymptotically χ 2 distributed with a non-centrality parameter in the damaged state. To decide if the monitored structure is damaged or not, the test statistic s is compared to a threshold t, and damage is announced if s > t. The threshold t is typically chosen such that the probability of false alarms (type I error) is below a certain level. An example of the probability distributions of the test statistic s in the reference and damaged states is given in Figure 1. Computational details for obtaining estimates of the null space matrix S, covariance matrix Σ and the threshold t in the reference state of the monitored structure, which are required for the damage detection test, are given in the Appendix. Note that the multiplication with √ N in the definition of the residual vector (6) ensures its asymptotic Gaussianity through the central limit theorem, and thus the definition of a χ 2 -distributed test statistic in [START_REF] Bernal | Kalman filter damage detection in the presence of changing process and measurement noise[END_REF]. Moreover, this statistical framework allows the detection of very small damages if the number of measurements N is large enough. A detailed description of the statistical framework and more theoretical insight of this method is given in [START_REF] Basseville | Subspace-based fault detection algorithms for vibration monitoring[END_REF][START_REF] Döhler | Subspace-based fault detection robust to changes in the noise covariances[END_REF][START_REF] Döhler | Subspace-based damage detection under changes in the ambient excitation statistics[END_REF][START_REF] Döhler | Fault detection, isolation and quantification from Gaussian residuals with application to structural damage diagnosis[END_REF], including parametric test variants.

Robustness to environmental nuisances

In the previous section, the subspace-based damage detection test is given in its most basic version. The test is set up entirely on measurement data without the need of a numerical model, and no modal analysis is required at all. It takes into account the natural variability that is related to the measurements, which is due to unknown ambient excitation and measurement noise. While it is convenient for many applications, additional robustness to natural environmental changes like excitation or temperature variations can be easily accounted for.

Changes in the ambient excitation properties do not affect the dynamic properties of the structure, but may have an influence on the test statistic ( 7) that is directly computed on the measurements. Robustness to such changes is achieved by a slight modification of the residual vector [START_REF] Basseville | Statistical model-based damage detection and localization: subspace-based residuals and damage-to-noise sensitivity ratios[END_REF], where the Hankel matrix estimate H p+1,q is replaced by the matrix U 1 of its principal left singular vectors as in [START_REF] Carden | Vibration based condition monitoring: a review[END_REF], leading to the robust residual ζ = √ N vec(S T U 1 ).

Since the principal left singular vectors of H p+1,q also satisfy the characteristic property (5) of the reference state, the robust residual ζ similarly detects changes in the dynamic system properties, with the advantage that U 1 is an orthonormal matrix and thus independent from scaling due to excitation changes. The respective test statistic with the appropriate covariance matrix Σ is, analoguously,

s = ζ T Σ -1 ζ . ( 8
)
Further theoretical and implementation details are given in [START_REF] Döhler | Subspace-based fault detection robust to changes in the noise covariances[END_REF][START_REF] Döhler | Subspace-based damage detection under changes in the ambient excitation statistics[END_REF].

Temperature variations can be taken into account in a non-parametric or in a parametric way. In the non-parametric way, the left null space matrix S and the residual covariance matrix Σ are computed on several datasets that are recorded under different temperature scenarios [START_REF] Balmès | Merging sensor data from multiple temperature scenarios for vibration-based monitoring of civil structures[END_REF]. In this way, the variation of the residual due to temperature changes is eliminated in the test statistic. In the parametric way, a model describes the influence of the temperature on the monitored structure. Then, variations in the temperature parameter can be rejected in the test statistic as nuisance or the left null space matrix S can be adjusted with the temperature [START_REF] Balmès | Handling the temperature effect in vibrationbased monitoring of civil structures: a combined subspace-based and nuisance rejection approach[END_REF][START_REF] Basseville | Handling the temperature effect in vibration monitoring: two subspace-based analytical approaches[END_REF].

Application to a steel frame

In this section, the damage detection method is applied to a scaled two-dimensional section of a jacket-type support structure of an offshore wind turbine in a laboratory experiment. In practice, these support structures are used in deep sea waters of 30 m and more. They generally include a significant number of highly stressed joints and, therefore, possess a high vulnerability to fatigue damage. In addition, most of the structural components are situated under sea level which makes damage investigation costly. This leads to the application of robust SHM techniques.

Laboratory test configuration

The developed model structure out of steel pipe components represents a scaled twodimensional section of a jacket-type support structure of an offshore wind turbine as they are common for wind park installations. The scale of the general dimensions is approximately 1:10. The lab model is designed with one and a half diagonal bracings between two legs. The upper completion is formed by an I-sectional girder. At the lower end the legs end in steel foot plates. With exception of the damage sections all structural parts of the model are welded. The foot plates are screwed via a transition piece to the lab floor. In the third direction the structure is held on the head girder by an auxiliary construction, whose two fork-like support bars allow for the horizontal movement of the head girder. Figure 2 shows the laboratory test structure in the proof testing facilities at BAM.

The damage to be modeled is supposed to represent fatigue cracks according to the characteristic cyclic stressing which can even escalate by resonance effects as well as due to the notches in the material from the welding process. The descriptiveness of the damage in location and quantification for comparison of different test series within the study as well as reversibility of the inserted damage for the ability to repeat test series were considered for the damage modeling.

For the difficulty in designing a reversible damage in the joint area of a gusset, the damage areas of the laboratory structure were constructed with a shift into the steel tube domain. A crack-like damage can be induced artificially by the loosening of bolted flange connection at one K-type gusset of the model structure. Four of such flange connections are designed, each at the four ends of the K-type gusset. So there were two damage locations at the leg and two at the bracing diagonal. In Figure 2 the four flanges at the end of the red drawn component on the left side of the model can be seen at each end of the red K-type gusset.

During the test series, dynamic excitations and cyclic loading of the laboratory structure were deployed. With different excitations the dependency of the detection of simulated damage on the frequency and energy input of the excitation source was examined. The excitation for the tests was provided by an electrodynamic shaker. A broadband random acceleration signal with a frequency content between 10 Hz and 1000 Hz was produced by a shaker control unit and was induced after amplification via the shaker at the top of the structure. The shaker was equipped with a 5 kg excitation mass and the excitation direction was horizontal and approximately 30 • rotated out of the in-plane-direction. Eight piezoelectric accelerometers were applied at the structure for the vibration measurements. The sensors were connected with the structure by permanent magnets and measured in the direction perpendicular to the surface they were applied to. The signals were amplified, recorded and stored with a 20-channel DIFA measurement unit.

Artificial damage detection tests

In a first test stage, the general reaction of the test as well as its robustness to changing ambient excitation levels were investigated. The damage location was chosen at the lower brace of the flange. In the reference state all bolts were screwed tight. For inducing damage, successively one, two, three, five or seven adjacent bolts were unscrewed, each representing a fatigue crack of increasing length. Thereby, the loosening of three bolts is comparable with a reduction of the moment of inertia by 3%, whereas the unscrewing of seven bolts means a loss of 30% of the bending stiffness.

To validate the damage detection algorithm under changing excitation, three excitation (power) levels were used for each damage state. Besides the full scale level, a reduction of 5 dB and a reduction of 10 dB with respect to the full scale level were performed and are denoted as "Excitation 1", "Excitation 2" and "Excitation 3" in the tests, respectively. A reduction of 5 dB accounts for a power ratio of ≈0.31 and an amplitude ratio of ≈0.56 and a reduction of 10 dB for a power ratio of 0.1 and an amplitude ratio of ≈0.31. The full-scale excitation power level was chosen preliminary in dependence of the shaker performance. For each damage level and each excitation level, four signals of 16.4 s length was measured.

In Fig. 3(a), the test statistic s from ( 7) is computed on the datasets with excitation 1. The test values increase with the damage size, where the damage cases of five and seven loosened bolts are well above the threshold that was established in the reference state. The robustness to unknown changing excitation properties is tested with the robust test variant [START_REF] Brownjohn | Vibration-based monitoring of civil infrastructure: challenges and successes[END_REF]. Results for the three different excitation levels are shown in Figure 3(b). There are small fluctuations of the test values in the reference state and in the states with small damage, but these fluctuations are not significant with respect to the established threshold. For the damages of three or more loosened bolts, these variations seem to be independent from the excitation level, which validates the robustness of the test to changing excitation. The relatively small damage (a) Test ( 7) under constant excitation levels. of only three loosened bolts can be detected, and the further damages of five and seven loosened bolts are clearly above the threshold. Further details and results of this experiment are given in [START_REF] Döhler | Subspace-based damage detection on steel frame structure under changing excitation[END_REF].

Fatigue damage detection tests

In the next step, a fatigue test was accomplished to test the applicability of the damage detection method to real damage. The test procedure consisted of two alternating tasks: the insertion of the fatigue relevant load cycles and the measurement of dynamic response series for determination of the damage detection test value. A load series with a constant alternating horizontal force of ±50 kN was applied at the top girder of the structure with a frequency of 3 Hz. After completion of each load series, a damage test was conducted, where a broadband random excitation signal with a frequency content between 10 Hz and 1000 Hz was produced by the shaker. The vibration response was measured with nine piezoelectric accelerometers at the structure. A total of ten load series (with varying number of load cycles) and, therefore, ten damage states were applied. The fatigue damage did not occur at the expected location of one gusset, but at the welded connection of the legs to the footplate. After approximately 152,000 load cycles, the loading was stopped, since the cracks had a considerable length of approximately a = 100 mm each (Figure 4). modal system changed gradually with the effect of a continuous increase of the damage test value, while the second crack resulted in a distinct switch back of the modal system and thus led to a decrease of the test value. A detailed description of the fatigue test and discussion of its result is given in [START_REF] Hille | Subspace-based detection of fatigue damage on a steel frame laboratory structure for offshore applications[END_REF]. Note that the fatigue damage was successfully detected with the presented technique. The relationship between the test value and the actual damage extent is non-trivial and requires the usage of further damage quantification techniques [START_REF] Döhler | Fault detection, isolation and quantification from Gaussian residuals with application to structural damage diagnosis[END_REF].

Application to S101 Bridge in progressive damage test

Within the European research project, "Integrated European Industrial Risk Reduction System (IRIS)" a prestressed concrete bridge was artificially damaged [START_REF]Progressive damage test S101 Flyover Reibersdorf / draft[END_REF]. The intention was to provide a complete set of monitoring data during a defined loss of structural integrity for testing and evaluation of various SHM methods and applications. Therefore, the static and dynamic behavior of the structure was measured permanently during the three-day damaging process. The progressive damage campaign was planned and organized by the Austrian company VCE. The characteristics of the structure under observation, the measurement campaign and the introduced damages are presented briefly.

The S101 bridge

The S101 Bridge was a prestressed concrete bridge from the early 1960s and, therefore, a characteristic representative of the partly invalid highway infrastructure asset in Europe. Despite a general lack of experience in the time of their design, pre-stressed concrete was a very popular construction type in those days. Retrospectively, some of the major design assumptions proofed to be erroneous and after short periods of operation significant and characteristic damage patterns occurred at the structure. The load bearing capacity and especially the durability of the bridges remained mostly limited despite costly retrofitting activities. In addition, an increase of heavy load vehicle traffic has been ongoing since the start of operation. Thus, prestressed bridge structures in central Europe have been exposed to degradation processes initiated by poor design, while the operational loading and the associated dynamic stressing increases steadily in the same time.

Damage description

The progressive damage test took place from 10-13 December 2008. During the test the highway beneath the bridge was open in one direction. The second direction was closed for traffic because of construction works, which in addition took place near the bridge.

Two major damage scenarios were artificially induced. First, a significant damage of one of the four columns was inserted by cutting through the column on its lower end. With this action a change in the global structural system was implemented. After a second cut a 5 cm thick slice of the column was removed and the column was lowered for altogether 3 cm. Afterwards the column was uplifted again to its original position and secured there by steel plates. Then, prestressing tendons of one of the beams were cut successively for a second damage scenario. All in all three and a quarter of a wire bundle were cut through. Between each intersection pauses of several hours were kept to let the structural system change into a new state of equilibrium. Pictures of both scenarios of the progressive damaging are shown in Figure 7. In Table 1 all damage actions are sorted in chronological order.

Measurement Description

For the vibration measurements a BRIMOS R measurement system with a permanent sensor grid was used. The grid consisted of 15 sensor locations on the bridge deck (see Fig. 8), in each location three sensors for measurements in the bridge deck's vertical, longitudinal and transversal direction. Altogether, 45 acceleration sensors were applied. The data were recorded permanently with a sampling frequency of 500 Hz. During the three days measurement campaign, 714 data files each containing 45 chan-nels with 165 000 data points were produced, corresponding to 5.5 min of measurements each.

Data analysis

The vibration measurements were recorded throughout the whole three day long damage test, including the nights. The measurement campaign started approximately 12 hours before the damage of the column was introduced to monitor the undamaged state for an adequate time period.

The reference state of the undamaged structure was set up by computing and averaging the reference matrices from several datasets. With this approach [START_REF] Balmès | Merging sensor data from multiple temperature scenarios for vibration-based monitoring of civil structures[END_REF], a possible disturbance by single excitation events or different environmental conditions is minimized. In the test stage, the test statistics s in ( 7) is computed for every data set, which in real time means an indicator of damage for every 5.5 min. Note that no modal parameter estimation or tracking is necessary for this damage detection approach.

Results of damage detection

Figure 9 shows a bar plot of values as damage indicators of all consecutive tests within the three days campaign, where all 45 sensors (r = r 0 = 45) were used. For the computation of the residual covariance matrix 100 datasets of the undamaged state were used. The abscissa of the plot describes the chronological sequence of the damage activities as noted in Table 1 as well as the 6:00 am and 6:00 pm points of time for orientation.

The reaction of the damage detection test at the main damage events can be easily observed. From the measurements in the reference state (before damage event A), a threshold of the damage indicator can be set easily, such that all the subsequent scenarios after damage event B would be correctly classified as damaged. This qualifies the proposed method for damage detection. In the following, the obtained results are analyzed in more detail. It can be seen that the damage indication is interfered by noise in the ambient excitation of the bridge. The s values periodically swell up in the morning and ebb away in the evening. It is assumed that the traffic going underneath the bridge and/or the construction work nearby are the source of the noise. Since the measurements in the reference state were only taken during 12 hours in the night, an extension of the measurement time period of the undamaged state to a whole day circle might reduce these disturbances significantly when taken into account in the residual covariance matrix. Influences by solar radiation and/or temperature alternation can be excluded, since during the three-day campaign misty winter weather with only moderate temperature changes just below freezing was dominant.

Figure 10 shows the damage indicator during the several steps of the first damage scenario, the cutting and settling of one of the four bridge columns. With exception of the time periods of the direct mechanical destruction processes, the displayed sequence of damage indicators has a consecutive course. As can be seen in Fig. 10, the three steps of the column settlement action are very distinctive in their influence on the computed damage indicator. Obviously, the dynamic system has changed to quite some extent, and the elastic settlement of altogether 27 mm can be clearly detected. Although not that strongly visible, the cutting of the column (A+B) also caused an increase of the indicator of approximately 75 %. However it has to be mentioned that the absolute effect is superimposed by noise effects. The inlet in Fig. 10 shows a detail of that time period.

The column remained in the settled condition for approximately one day and was then uplifted again in its former position (event G). The effect of the uplifting is again clearly visible in Fig. 9 by a drop of the damage indicator. However, the indicator did not drop completely to its original value, which is certainly due to the fact that the lowering of one column has led to cracking within the concrete structure to some extent and hence to a change of the dynamic signature of the system.

As one can see in Fig. 9, the cutting of the prestressing tendons did not lead to a significant change in the damage indicator after the single cutting steps. Nevertheless, a distinctive increase of the indicator could be observed at the end of the measurement. Figure 11 shows the last time period in detail. It is possible that a change of the bridge's structural system took place with a time delay after cutting partly the fourth tendon.

For a prestressed concrete structure, the loss of prestressing is a major damage that comes along with a significant loss of its load bearing capacity. One reason that the cutting of the tendons does not affect the proposed damage indicator might be that the overall prestressing is designed for combinations of dead and traffic loads. Since the bridge deck of S101 has a quite slender cross section, the dead load is not that high in comparison with the maximum design traffic loading. An additional dead load reduction comes from the removal of the asphalt surface before the damage test. Furthermore it has to be recalled that the prestressing was designed with adequate safety margins. Also, the cutting results only in local loss of prestressing because of the bound between tendons and concrete. For these specified reasons it is assumed that the cutting of the tendons during the damage test did not lead to a sig-nificant change of the global structural system, since the loading of the structure was not high enough to activate the damage right after its insertion. The increase of the indicator at the end of the test series might be the result of a delayed rearrangement of the structural system by a reduction of stresses under generation of cracks in the concrete of the bridge deck. Though, an evidence of that assumption, for instance by an increase of the measured bridge deck deflection, could not be found.

Conclusions

In this chapter, a method for vibration-based damage detection has been presented that combines statistical robustness with simplicity of application. A damage test statistic is computed entirely from measurement data of a (healthy) reference system and the current system, without the need of a finite element model. The method is designed for the detection of small damages before they grow to dangerous extents, while taking the intrinsic uncertainties of vibration measurements due to unknown excitation and noise into account. The damage detection method has been validated successfully on a laboratory test case and on a full scale damage test on a real highway bridge. Thanks to its properties, it is well suited for being embedded in automated structural health monitoring systems. Extensions of the damage detection method to damage localization and quantification in the same framework [START_REF] Balmès | Statistical model-based damage localization: a combined subspace-based and substructuring approach[END_REF][START_REF] Döhler | Fault detection, isolation and quantification from Gaussian residuals with application to structural damage diagnosis[END_REF] are possible in connection with a finite element model, being a step towards the development of robust damage assessment systems that will combine measurement data with physical models in the future.

Second, the residual covariance matrix Σ is obtained by separating the available reference dataset into n b data blocks of length N b , such that the total data length yields N = n b N b . On each block, the Hankel matrix is computed as

R ( j) i = 1 N b jN b ∑ k=1+( j-1)N b y k y T k-i , H ( j)
p+1,q = Hank( R

( j) i )
Then, H 0 p+1,q = 1 n b ∑

n b j=1 H ( j)
p+1,q and the covariance estimate of the residual follows from the covariance of the sample mean as

Σ = N b n b -1 n b ∑ j=1 vec S T H ( j)
p+1,q -S T H 0 p+1,q vec S T H ( j) p+1,q -S T H 0 p+1,q T . Finally, compute the test statistic s for several training datasets of length N from the reference state, and determine the threshold t from the test values for a desired type I error.

Fig. 1

 1 Fig. 1 Scheme of the probability density functions (pdf) of the χ 2 -distributed damage detection test statistic s in the reference and in a damaged state.

Fig. 2

 2 Fig. 2 Laboratory test stand at BAM.

  Robust test variant (8) under different excitation levels.

Fig. 3

 3 Fig. 3 Damage detection tests on steel frame structure for different damage extents (log-scale).

  The result of the subspace-based damage detection is shown in Fig. 5. The bars represent the mean of 10 to 30 tests executed in one damage state and the error bars represent the related standard deviation. The diagram shows a continuous increase of the χ 2 -test value, except for the final load series, where a significant drop of the value is noticeable. The reason for this evolution is, that a first fatigue crack has evolved at one leg-footplate connection during load series 3 to 9. Due to stress redistribution in the last loading series, a second fatigue crack developed at the other leg-footplate connection of the structure. During progression of the first crack, the

Fig. 4

 4 Fig.4First fatigue crack at one jacket foot.

Fig. 5

 5 Fig. 5 Mean and standard deviation of damage detection test values for the 10 damage states.

Fig. 6

 6 Fig.6Bridge S101 during damage test[START_REF]Progressive damage test S101 Flyover Reibersdorf / draft[END_REF].

Fig. 7

 7 Fig.7Progressive damage of column and tendons on bridge S101[START_REF]Progressive damage test S101 Flyover Reibersdorf / draft[END_REF].

Table 1

 1 Notation of consecutive damage actions. Damage Action Damage Action A Begin of cutting through column G Uplifting column B End of second cut through column H Exposing cables and cutting of 1st cable C Lowering of column -1st step (10mm) I Cutting through 2nd cable D Lowering of column -2nd step (20mm) J Cutting through 3rd cable E Lowering of column -3rd step (27mm) K Partly cutting of 4th cable F Inserting steel plates

Fig. 8

 8 Fig.8Location of the sensors on the bridge deck[START_REF]Progressive damage test S101 Flyover Reibersdorf / draft[END_REF].

Fig. 9

 9 Fig. 9 Course of the damage indicator over the three-day damage test.

Fig. 10

 10 Fig. 10 Damage indicator for cutting and settling of one bridge column, detail of damage indicator for cutting through one bridge column.

Fig. 11

 11 Fig. 11 Detail of damage indicator at the end of the tendon cutting process.

Acknowledgements We thank Dr. Helmut Wenzel, VCE, and the FP7 IRIS project for providing the data from S101 Bridge.

Appendix

The damage detection test statistic s is set up using measurements from the reference state of the structure, requiring the estimation of the left null space matrix S, the residual covariance matrix Σ and setting up a threshold t.

First, the Hankel matrix H 0 p+1,q is computed from the reference measurements. Then, the left null space matrix S can be estimated from its SVD

as S = U 0 , where the SVD is truncated at the desired model order n with ∆ 1 ∈ R n×n and ∆ 0 ≈ 0.