Dr Camille Pelat
email: camille.pelat@gmail.com

Andrea Lasserre

Ana Xavier

Clément Turbelin

Thierry Blanchon

Thomas Hanslik

Hospitalization of influenza-like illness patients recommended by general practitioners in France between 1997 and 2010

Keywords: case-hospitalization ratio, emerging pathogens, influenza pandemics, surveillance, severity

BACKGROUND. The case-hospitalization ratio (CHR) is a key quantity for the management of emerging pathogens such as pandemic influenza. Yet, few running surveillance systems prospectively monitor the CHR during influenza epidemics. Here, we analyze the proportion of recommended hospitalizations (PRH) among influenza-like illness (ILI) patients attended in general practice in France and compare the PRH observed during the 2009-2010 A(H1N1) pandemic with the one of the twelve previous seasons.

METHODS. ILI cases were recorded by general practitioners (GPs) involved in surveillance, who indicated for each case whether they recommended hospitalization. We stratify the analysis by age, sex and viral subtype. We investigate the reasons why GPs recommended hospitalization and the presence of risk factors for pandemic A(H1N1) complications.

RESULTS. The average PRH over the seasons 1997-1998 to 2008-2009 was 3.4‰ (3-3.9). It was three times higher during the 2009-2010 pandemic than during seasonal influenza epidemics (OR=2.89, 95% CI: 2.28-3.64). The highest increase was among 20-39 year-old women: OR=11.8 (5.04-29.59). Overall, the principal reasons for recommending hospitalization were "respiratory problems" and "bad general condition". However, during the pandemic, "age" (mainly associated with infants), "pregnancy" and "diagnostic" became more frequent than before (p<0.001). Finally, pregnancy was the reported risk factor for pandemic A(H1N1) complications that had the largest impact on hospitalization recommendation during the pandemic (OR=38.62, p<0.001).

CONCLUSION. Easily implemented in surveillance systems, this protocol has the potential to reveal changes in hospitalization recommendation by GPs. Moreover, if the right data are collected alongside, it could give timely insights into epidemic severity.

INTRODUCTION

Accurate and timely assessment of severity through measures such as the case-hospitalization ratio (CHR) is essential for the management of emerging pathogens, such as pandemic influenza [START_REF] Van Kerkhove | Studies needed to address public health challenges of the 2009 H1N1 influenza pandemic: insights from modeling[END_REF] . The CHR was carefully analyzed to understand the severity of the 2009 A(H1N1) pandemic influenza and to measure its burden on the health care system [START_REF] Lipsitch | Managing and reducing uncertainty in an emerging influenza pandemic[END_REF][START_REF] Presanis | The severity of pandemic H1N1 influenza in the United States, from April to July 2009: a Bayesian analysis[END_REF] . It was also a key quantity entering the calculation of the case-fatality ratio [START_REF] Garske | Assessing the severity of the novel influenza A/H1N1 pandemic[END_REF] . It has been discussed elsewhere how consistent monitoring of influenza CHRs over the long term can help characterize at-risk populations for different viral subtypes, measure the impact of prevention programs and inform future strategies [START_REF] Simonsen | The impact of influenza epidemics on hospitalizations[END_REF][START_REF] Monto | Epidemiology of influenza[END_REF] .

The estimation of the CHR usually relies on outbreak investigation studies of limited size, or on the ratio of hospitalized cases provided by one surveillance system over the number of influenza cases estimated by another one [START_REF] Garske | Assessing the severity of the novel influenza A/H1N1 pandemic[END_REF][START_REF] Donaldson | Mortality from pandemic A/H1N1 2009 influenza in England: public health surveillance study[END_REF][START_REF] Wilson | The emerging influenza pandemic: estimating the case fatality ratio[END_REF] . There are few surveillance systems specifically aimed at monitoring this quantity. Since 1997, the proportion of recommended hospitalizations (PRH) among patients attended for influenza-like illness (ILI) in general practice has been monitored in France by one "self-sufficient" surveillance system based on sentinel general practitioners (GPs): the Sentinelles network [START_REF] Flahault | Virtual surveillance of communicable diseases: a 20-year experience in France[END_REF] . To achieve this goal, Sentinelles GPs have been recording those ILI cases for which they recommended hospitalization as part of their case reporting. The PRH is thus estimated as the proportion of recommended hospitalizations among Sentinelles GPs' ILI patients.

In the present study, we compare the PRH of the 2009-2010 A(H1N1) pandemic with the twelve preceding seasonal epidemics, stratifying by age, sex and viral subtype. We also investigate the reasons why GPs recommended hospitalization and the presence of risk factors for pandemic A(H1N1) complications. We finally evaluate the usefulness of this surveillance for public health information by monitoring the uncertainty of the PRH estimate throughout the pandemic.

METHODS

ILI surveillance by the Sentinelles network

The Sentinelles network is an epidemiological, real-time, electronic surveillance system based on voluntary sentinel general practitioners that has been monitoring the incidence of ILI in general practice since 1984 in France [START_REF] Valleron | A computer network for the surveillance of communicable diseases: the French experiment[END_REF] . Sentinelles GPs are similar to other French GPs with regards to their regional distribution, the proportion of GPs in rural practice and the type of practice [START_REF] Chauvin | Attitude of French general practitioners to the public health surveillance of communicable diseases[END_REF] . They use the following case definition for ILI: sudden onset of fever (39°C or above) with myalgia and respiratory signs [START_REF] Carrat | Evaluation of clinical case definitions of influenza: detailed investigation of patients during the 1995-1996 epidemic in France[END_REF] . Since January 1997, for each reported ILI case, Sentinelles GPs record if they recommended hospitalization for the patient.

We defined influenza epidemic periods using a periodic regression model fitted on historic non-epidemic data [START_REF] Costagliola | A routine tool for detection and assessment of epidemics of influenza-like syndromes in France[END_REF][START_REF] Pelat | Online detection and quantification of epidemics[END_REF] . This model provides an epidemic threshold that allows detection of an influenza epidemic. Each influenza season is further characterized by its dominant circulating viral subtype(s), thanks to virological surveillance data [START_REF] Cohen | Influenza surveillance in France[END_REF] : A(H1N1), A(H3N2), B or a combination. One subtype qualifies as dominant if it comprises more than 75% of the season's influenza isolates. Co-dominance of two subtypes could happen when neither of them accounted for more than 75% of a season's isolates.

Estimation of the PRH

We estimate the PRH among ILI cases attended in general practice in a given period j (PRH j ) as the proportion of reported ILI patients for whom Sentinelles GPs recommended hospitalization: "respiratory", "cardiac" and "other reason". They could also elaborate in writing any other reason(s). Since October 2009, the answer list was discarded: all answers had to be elaborated in writing. We compare the frequency of each reason between seasonal and pandemic influenza using Fisher's exact test.

Surveillance during 2009-2010 pandemic

Since October 2009, GPs were asked if their patients presented one or more risk factors for pandemic influenza complications, to be chosen from the following list: "pregnancy", "obesity", "chronic condition" and "other". Here, we evaluate with logistic regressions and Wald tests the impact of risk factors for complications on hospitalization odds during the pandemic.

We assess if the pandemic context made patients consult more by asking, since October 2009, the following question to Sentinelles ILI patients: "Would you consult your GP for the same symptoms if there was not the current pandemic context?". To assess potential changes in the way GPs attended ILI cases, a telephonic survey was conducted by a medical resident on 41

GPs, with the following question: "Would you recommend hospitalization for this patient, for the same symptoms, if there was not the current pandemic context?". On this occasion, GPs

were also asked about the future of the patients for whom they recommended hospitalization.

Finally, we use the pandemic to exemplify the real-time estimation of the PRH by the Sentinelles surveillance system. In 2009 in France, the first signal of unusual ILI activity was detected in week 28 (July) [START_REF] Turbelin | Early estimates of 2009 pandemic influenza A(H1N1) virus activity in general practice in France: incidence of influenza-like illness and age distribution of reported cases[END_REF] , and the epidemic officially began in week 37 (September).

However, pandemic A(H1N1) is believed to have spread in France since week 19 (May) [START_REF] Vaux | Dynamic and impact of the A(H1N1)2009 epidemic in mainland France, 2009-2010[END_REF] .

To assess how the CHR estimate evolved from May to December, successive weekly estimations were undertaken. For each week from 2009/19 to 52, estimations relied on the cumulative ILI cases reported by then from week 19. We define relative uncertainty (in %) as half the confidence interval divided by the estimate and multiplied by 100. The analysis was carried out with the R software package version 2.13.0. Confidence intervals for means, proportions and odds-ratio were obtained with the profile likelihood method [START_REF] Venzon | A Method for Computing Profile-Likelihood-Based Confidence-Intervals[END_REF] . A Bayesian adjustment was made when the number of hospitalizations was zero to move the loglikelihood function away from infinity [START_REF] Dorai-Raj | Binomial Confidence Intervals For Several Parameterizations[END_REF] .

We finish the analysis by studying two potential factors in the PRH variability: the composition of the Sentinelles GPs and the the intensity of influenza seasons, as measured by the cumulative consultation rate for ILI in general practice over each epidemic.

Composition of the Sentinelles network across the study period

We analyze the number, age, sex ratio and turnover of the GPs that have been reporting to the Sentinelles system between 1997 and 2010. A GP is reporting in a given year Y when he/she reports at least once to the system during year Y. The turnover in year Y is measured as the proportion of reporting GPs that joined the Sentinelles network in year Y among all Sentinelles GPs that have been reporting in year Y. We monitor for each year the number of GPs present from the start of the study period (i.e. who joined in 1997 or earlier) as a measure of "stability" of the network.

We also assess the number of consultations and visits per year per reporting GP, and the age distribution of patients, thanks to a subset of GPs who provided their activity report form (RIAP). RIAPs are given to GPs by the French national health insurance, usually annually or quarterly, and are based on reimbursement records. In this forms, the number of consultations and visits is given for the following age groups: 0-15 year-old, 16-59 year-old, 60-69 year-old and 70 year-old and over. As we did not have a RIAP per year per reporting GP, the closest in time to each study year (within a limit of three years) was chosen.

Relationship between the PRH and ILI consultation rates

We assess the relationship between the PRH and the cumulative rate of ILI consultations by season per 100,000 inhabitants using Pearson's linear correlation coefficient (ρ) and linear regression models. We repeat this analysis for each age group. To obtain ILI consultation rates overall and by age group, the weekly number of consultations reported by Sentinelles

GPs is extrapolated to all French GPs and standardized on the current French population using a procedure in use since 1984 [START_REF] Valleron | A computer network for the surveillance of communicable diseases: the French experiment[END_REF] . It ensures that estimated incidences are independent of the number of reporting GPs. The 2009-2010 season is excluded from the analysis, as it is an outlier both by its magnitude and by its PRH.

RESULTS

Over the thirteen epidemics analyzed herein, GPs reported 76,059 ILI cases, and recommended hospitalization for 326 of them. Detailed numbers by season, age group and gender are provided in Table 1. The largest PRH among ILI patients occurred during the 2009-2010 pandemic period (Figure 1). It was then equal to 9.7‰ (95% confidence interval: 8-11.7), when the average PRH over the seasons 1997-1998 to 2008-2009, was 3.4‰

(3-3.9). This increase was statistically significant, with an odds-ratio (OR) equal to 2.89 (95% CI: 2.28-3.64, Chi-square test for equal distributions: p<0.001).

PRH by viral subtype

The PRH varied substantially according to the dominant circulating influenza subtype(s) (logistic regression likelihood-ratio (LR) test: p<0.001, for detailed PRH by subtype see

PRH by age group

The PRH was the highest among patients above 40 years-old for every viral dominant subtype(s), yet to different extents (Table 2). During the A(H3N2) epidemics, the hospitalization odds of ≥40 year-old patients were

PRH by sex

The PRHs of men and women were not statistically different during seasonal influenza epidemics: OR=0.95 (0.73-1.24, p=0.713), see values in Table 2

Reasons for hospitalization

There were 278 patients for whom the reason for requiring hospitalization was stated: 174 in seasonal epidemics and 104 during the pandemic (Table 3). The distribution of reasons significantly differed between the two periods (Two sided Fisher's exact test: p<0.001). For seasonal epidemics, most patients (64%) were sent to hospital for respiratory reasons, followed by cardiac reasons (13.2%) and bad general condition (11.5%). During the 2009-2010 pandemic, although the main reasons remained respiratory problems (44.2%) and bad general condition (17.3%), "pregnancy", "diagnostic" and "age" became more frequent. The latter concerned seven infants less than one year old, two children aged 1 and 11 years-old, and an adult of 96 years. One of the two patients sent to hospital for an age reason during seasonal epidemics was under 1 year-old, and the age of the other one was unknown.

Surveillance during 2009-2010 pandemic

The presence/absence of risk factors for pandemic influenza complications was described for

Influence of the Sentinelles network's composition and of epidemic intensity

After decreasing from 339 in 1997 to 220 in 2002, the number of GPs reporting to the Sentinelles network augmented to reach 372 in 2010 (Table 5 and Figure 3). The mean turnover (the proportion of new reporting GPs) was 23% per year (range: 8%-36% 3). The median proportion of patients also remained roughly stable for all age groups, with a slight decrease (from 24% to 22%) in the 0-15 year-old and a slight increase (from 54% to 55%) for the 16-59 year-old.

Finally, no significant correlation was found between the PRH and the cumulative seasonal consultation rate for ILI in general practice: ρ=0.32 (p-value: p=0.30). Furthermore, this relationship did not have the same direction in all age groups and, for each of them, fell far from statistical significance (see Figure 4). [START_REF] Centers | Hospitalized patients with novel influenza A (H1N1) virus infection -California, April-May, 2009[END_REF][START_REF]Novel influenza A (H1N1) virus infections in three pregnant women -United States, April-May 2009[END_REF] and with the pandemic guidelines recommending hospital-based diagnosis for pregnant ILI patients [START_REF] Health | Handling and treatment of influenza A/H1N1 in pregnant women: recommendations as of Decembre 8[END_REF] .

DISCUSSION

Interpretation of the results

Sentinelles

Some pitfalls arise in the interpretation of the PRH presented in this work. First, the positive predictive value of the Sentinelles definition of ILI was reported around 40% for seasonal influenza, implying that the PRH based on these clinical data could be an underestimation of the true influenza PRH [START_REF] Carrat | Evaluation of clinical case definitions of influenza: detailed investigation of patients during the 1995-1996 epidemic in France[END_REF] . Second, this ILI definition has a limited sensitivity as it misses the asymptomatic cases and the symptomatic cases that do not feel bad enough to consult a GP.

This leads to overestimating the influenza PRH by biasing the case ascertainment to the most severe ones. Third, it might be worthy to note once again that, herein, we monitor the proportion of recommended hospitalizations. Some of the patients might not go to the hospital, and some might only have a consultation there. In that respect, the present measure overestimates the true CHR. On the other hand, some patients for whom GPs did not recommend hospitalization could have been hospitalized afterwards, for example if their condition persisted or got worse after their consultation with the GP, making the present measurement an underestimation of the CHR.

Finally, the specific hospitalization criteria set up for pandemic A(H1N1) patients may have encouraged French GPs to send ILI patients to hospital [START_REF]French committee of fight against influenza[END_REF] , biasing our numerator, while the heavy media coverage and fear of the pandemic might have boosted the public concern and health-seeking behaviours, biasing our denominator. In particular, guidelines incited French GPs to send pregnant ILI patients to hospital consultations dedicated to viral identification of pandemic A(H1N1) [START_REF] Health | Handling and treatment of influenza A/H1N1 in pregnant women: recommendations as of Decembre 8[END_REF] . It is thus possible that some Sentinelles GPs reported ambiguously directing a patient to hospital for consultation or hospitalization. The fact that GPs thought that they would have required hospitalization during a regular epidemic for only 53% of the patients seen during the pandemic is in accordance with this hypothesis (even if the magnitude of this bias doesn't explain the tripling of the PRH observed during the pandemic).

Thus, the PRH observed during the 2009-2010 pandemic does not readily reflects severity but, instead, the increased burden on the health-care system.

Enhancing surveillance for a better interpretation of the PRH

To disentangle severity from patients' behaviour and GP's practice inside the PRH and allow comparison between seasons, it is necessary to collect data both on the GP's tendency to recommend hospitalization (numerator) and on the patients' tendency to seek heath care (denominator). Questions in that respect could be asked to GPs and to their patients in each electronic case report. During the pandemic, we used a telephonic survey to assess the former and included the latter in the online questionnaire. The formulation and the suggested answer list should be allowed to change dynamically with the context (seasonal or pandemic in particular) while ensuring that the right data for inter-annual comparability are collected.

To infer from the PRH the true hospitalization ratio of ILI patients seen by general practitioners, and thus the true burden of the disease on hospitals, it would be also necessary to know 1) how many patients for whom hospitalization was recommended went to hospital and how many of them were admitted, and 2) how many ILI patients were hospitalized without GP recommendation. For question (1), it could be thought of GPs logging back into the system to complete a previous report. However, because reported cases are currently anonym in the system, this would imply rethinking the collection design. An annual crosssectional survey among GPs' ILI patients could instead be contemplated to collect information on both points (1) and (2). To this respect, a pilot survey was launched during the 2009 pandemic to shed light on the future of 60 patients for whom GPs recommended hospitalization. GPs were contacted by phone in the days following their declaration. They knew whether or not their patients went to the hospital for 50 patients (83.33%). Among those, 27 were admitted, 20 had a consultation, and only three did not go to the hospital. This pilot protocol has an encouraging response rate and should be considered for yearly implementation.

Finally, to assess the case-hospitalization ratio of confirmed influenza patients seen by general practitioners, both the PRH and the necessary side data described above should be collected on virologically confirmed patients. The Sentinelles network only implements virological surveillance in Corsica on a small number of patients, so currently these developments are not contemplated.

Influence of the Sentinelles network's composition and of epidemic intensity

We assessed if the composition of the Sentinelles network changed over the whole study period. We found that the average age of reporting GPs slightly increased and smoothly over the whole study period. The proportion of women also slightly increased, although with more fluctuations. Both increases are also observed in the French medical population as a whole [START_REF] Attal-Toubert | La démographie médicale à l'horizon 2030 : de nouvelles projections nationales et régionales détaillées[END_REF]25 . No noticeable trend or seasonal fluctuations in the number of consultations and visits or in the age distribution of patients was evidenced. Thus, it seems unlikely to us that the composition of the Sentinelles GPs explains the observed variations in the PRH, in particular the 2009-2010 increase. We also found no significant linear correlation between the PRH and the cumulative consultation rate for ILI in general practice, for all age groups and overall.

Hence, the intensity of influenza seasons does not seem to influence the probability that GPs recommend hospitalization for ILI patients.

Conclusion

To sum up, the surveillance protocol presented herein do not provide immediately interpretable CHRs unlike ad-hoc surveys based on virologically or serologically confirmed cases. Nevertheless, with the right data collected alongside to help with interpretation and assess inter-annual comparability, this system can help measuring the severity of epidemics on a scale defined by the GPs' concern about their patients' health. Furthermore, nested in a routine surveillance system, this protocol allows the continuous collection of baseline data on influenza-like illness severity. Besides, by linking hospitalizations to ILI cases at the individual level, the data presented here allows direct estimation of the probability of hospitalization among cases, and there is no delay between GPs' and hospitals notifications to be corrected for. Finally, the Sentinelles network was able to provide a PRH estimate with a relative uncertainty of ±32% two weeks before the peak of the 2009-2010 pandemic, and with a relative uncertainty of ±18% at the end of the pandemic. In conclusion, if data collection can be enhanced to help disentangling severity from behaviors and practices, this protocol is a promising tool for generating timely insights into the severity of influenza epidemics and their burden on the health care system.

  4.44 fold (3.13-6.45) those of 0-19 yearold patients (Wald z-statistic p<0.001), and 6.96 fold (4.39-11.77) those of 20-39 year-old patients (p<0.001). During the B and B-A(H1N1) epidemics, the difference between age groups was not statistically significant (respective LR test: p=0.12 and p=0.38). During the only seasonal A(H1N1) epidemic, few ILI cases were reported, and GPs recommended hospitalization only for 40 year-old or older patients, with a PRH of 5.7‰ (1.4-14.8). During the 2009-2010 pandemic, the differences in PRH between age groups flattened: the hospitalization odds of the ≥40 years-old were 1.15 fold the ones of 0-19 years-old (0.69-1.86, p=0.58) and 1.47 fold the ones of the 20-39 years-old (0.80-2.73, p=0.21). The PRH of ILI patients over 40 years-old was not statistically higher during the 2009-2010 pandemic than in seasonal epidemics: OR=1.

20. 5

 5 years (15.1-26.0, median 11 years), when it was 55.6 years (51.9-59.4, median 67.5 years) for seasonal epidemics. This difference was statistically significant (Student's T test for equal means: p<0.001).

Figure 1 .

 1 Figure 1. Proportion of recommended hospitalizations among ILI patients (‰) by season (panels A and B) or by subtype (panels C and D), distinguishing by sex and age group.

Figure 2 .

 2 Figure 2. Real-time weekly estimation of the proportion of ILI patients for whom GPs recommended hospitalizations (plain line) and its 95% confidence interval (dotted lines), for each week between week 2009/19 and 2009/52, based on cumulative cases from week 2009/19. Highlighted in red is the proportion of recommended hospitalization in week 44 (11.3‰).

Figure 3 .

 3 Figure 3. Characteristics of the GPs reporting to the Sentinelles network surveillance system from 1997 to 2010 (A: number and turnover, B: sex, C: age, D: activity). E-H: age distribution of Sentinelles GPs' patients in four age groups. Panel D to H are based on a subset of GPs that provided an activity report form within three years of each study year.

Figure 4 .

 4 Figure 4. Proportion of ILI patients for whom Sentinelles GP recommended hospitalization versus the cumulative rate of ILI consultations by influenza season: (A) among the 0 to 19 year-old, (B) the 20 to 39 year-old, (C) the 40 and more year-old, (D) overall.

Table 2

 2

	). Compared to the only seasonal A(H1N1) epidemic (2000-2001), the odds of
	hospitalization were significantly higher when A(H3N2) circulated: OR=3.44 (1.31-13.92,
	Wald z-statistic p=0.034). Co-circulation of A(H1N1) and B or dominance of B viruses did
	not significantly increase the odds of hospitalization: respectively OR=1.06 (0.34-4.65,
	p=0.929) and 2.46 (0.68-11.43, p=0.192). The 2009 A(H1N1) pandemic was associated with

hospitalization odds increased by 8.52 fold compared to seasonal A(H1N1) (3.21-34.65, p<0.001).

Table 1 )

 1 . On the contrary, the PRHs of 0-19 and 20-39 year-old patients were higher during the pandemic than in any previous season, with OR=6.10 (4.16-9.02, p<0.001) for the 0-19 years-old and OR=6.94 (3.77-12.79, p<0.001) for the 20-39 years-old.

	Furthermore, the relative ILI attack rate of the 0-19 year-olds was more important during the
	pandemic: 58% of reported ILI cases belonged to this age group versus 40% during seasonal
	epidemics, whereas the contrary was observed among ≥40 year-old: 17% versus 31%. The
	relative attack rate in intermediate ages remained stable 25% versus 29%. The hypothesis of
	equal age distributions in the two periods was significantly rejected (Chi-square test

5 (0.92-2.32), p=0.081. Two A(H3N2) epidemics, 2006-2007 and 1997-1998, presented higher PRHs for this age group than the pandemic (p<0.001). Therefore, this unusually high relative attack rate in the 0-19 year-old combined with the unusually high PRHs in the younger age groups resulted in a significantly lowered mean age of ILI patients requiring hospitalization during the 2009-2010 A(H1N1) pandemic:

  When asked by their GPs, 6,383 out of 7,758 patients (82%) thought that they would have consulted for the same symptoms in a regular seasonal epidemic. This fraction was significantly larger in the subgroup of patients requiring hospitalization: 70 out of 72 patients, i.e. 97%, (OR=7.44, 2.34-45.33, p=0.005). The 41 GPs interviewed over the phone accounted for 60 out of the 105 recommended hospitalizations during the pandemic. When asked their personal views, they thought that they would have recommended hospitalization for only 32 of the 60 patients (53%) during a regular epidemic. When asked about the future of these 60 patients, they answered that 27 (45%) were admitted to hospital, 20 (33.33%) only had a consultation there and were rapidly discharged, two did not go to the hospital (3.33%), and one did not go and died at home (1.67%). What happened of the remaining 10

	8,878 ILI patients during the 2009-2010 season. The PRH was 5.2‰ (3.7-6.9) in the 8,152
	patients without risk factors, and 56.5‰ (41.2-74.8) in the 725 ones presenting at least one
	risk factor (OR=11.56, 7.45-17.92, p<0.001). Specifically, pregnancy multiplied the odds of
	hospitalization by 38.62 (15.05-87.26, p<0.001), coexistence of chronic condition and

obesity by 20.69 (4.82-61.37, p<0.001), chronic condition alone by 7.12 (3.79-12.65, p<0.001) and obesity alone by 5.22 (0.29-25.00, p=0.107) (Table

4

). patients was unknown (16.67%).The weekly prospective monitoring of the PRH during the 2009-2010 season is shown in Figure 2. Real-time weekly estimation of the proportion of ILI patients for whom GPs recommended hospitalizations (plain line) and its 95% confidence interval (dotted lines), for each week between week 2009/19 and 2009/52, based on cumulative cases from week 2009/19.. Estimations culminated at 25.6‰ (10.3-51.2) in week 29, then decreased to reach 11.3‰ (8-15.

3) in week 44 (last week of October), and remained quite stable until week 52 (10.2‰, 8.5-12.2). Note that this final estimate differs slightly from the one in Table

1

, which is based only on data reported from week 37 to 52. The relative uncertainty of the PRH estimate was above 300% in week 19. It steeply decreased to reach 32% in week 44, i.e. two weeks before the epidemic peak, which occurred in week 46, and 18% in week 52.

  ). The proportion of GPs present from the start of the study period (1997) decreased from 100% in 1997 to 23% in 2009, and increased to 25.5% in 2010 as the total number of Sentinelles GPs

	decreased. The proportion of women fluctuated between 11% in 1999 and 18% in 2001,
	2008, 2009 and 2010, with an overall upward trend. The median age also augmented from 45
	year-old in 1997 to 53.5 year-old in 2010. Across the study period, the median number of
	consultations and visits per reporting GP per year was quite stable (from 4690 in 1997 to
	4665 in 2010) (Figure

Table 1 .

 1 Case-hospitalization ratio (‰) with 95% confidence limits, calculated as the ratio of recommended hospitalizations among ILI patients reported by Sentinelles GPs, for all influenza seasons from 1997-1998 to 2009-2010.

			Case-hospitalization ratio (‰) [95% confidence interval], # recommended hospitalizations (# ILI patients)
					By age group (years)*		By gender*
	Season	Subtype	Overall	0-19	20-39	≥ 40	Male	Female
	1997-1998 A(H3N2)	5.3 [3.8-7.3]	2 [0.7-4.3]	1.1 [0.2-3.3]	12.2 [8.3-17.2]	5.2 [3.1-8.1]	5.5 [3.4-8.3]
			36 (6738)	5 (2508)	2 (1853)	29 (2377)	17 (3261)	19 (3477)
	1998-1999 A(H3N2)	3.5 [2.3-5.1]	2.2 [0.8-4.6]	1.9 [0.6-4.4]	5.9 [3.5-9.3]	3.8 [2.1-6.2]	3.3 [1.7-5.5]
			25 (7136)	5 (2314)	4 (2111)	16 (2711)	13 (3457)	12 (3679)
	1999-2000 A(H3N2)	5.3 [3.7-7.2]	1.2 [0.2-3.7]	1.5 [0.4-3.9]	10.2 [7-14.2]	4.8 [2.8-7.5]	5.8 [3.6-8.8]
			35 (6635)	2 (1677)	3 (2006)	30 (2947)	16 (3345)	19 (3290)
	2000-2001 A(H1N1)	1.2 [0.3-3]	0 [0-2.5]	0 [0-4.6]	5.7 [1.4-14.8]	0.8 [0.1-3.3]	1.6 [0.3-4.8]
			3 (2605)	0 (1354)	0 (725)	3 (525)	1 (1317)	2 (1288)
	2001-2002 A(H3N2)	3.7 [2.1-6]	2 [0.5-5.2]	0.9 [0.1-3.9]	8 [3.8-14.3]	3.3 [1.3-6.6]	4.1 [1.9-7.7]
			14 (3769)	3 (1489)	1 (1130)	9 (1132)	6 (1835)	8 (1934)
	2002-2003 B	2.8 [1.2-5.5]	1.5 [0.3-4.6]	1.7 [0.2-7.2]	7.6 [2.4-17.6]	2.3 [0.6-6.1]	3.4 [1.1-7.9]
			7 (2473)	2 (1332)	1 (606)	4 (525)	3 (1278)	4 (1173)
	2003-2004 A(H3N2)	3.6 [2.3-5.3]	2.8 [1.3-5]	1.2 [0.2-3.7]	8.8 [4.6-15.1]	3.9 [2.1-6.5]	3.3 [1.7-5.8]
			22 (6130)	9 (3219)	2 (1648)	11 (1247)	12 (3071)	10 (3004)
	2004-2005 A(H3N2)	3.2 [2-4.8]	0.8 [0.1-2.6]	0 [0-1.8]	8.3 [5.1-12.6]	4 [2.2-6.6]	2.2 [0.9-4.2]
			21 (6578)	2 (2396)	0 (1878)	19 (2293)	13 (3262)	7 (3253)
	2005-2006 A(H1N1) & B	1.5 [0.6-3.1]	1.3 [0.3-3.3]	2.3 [0.4-7.1]	1.5 [0.1-6.4]	2.1 [0.6-4.8]	1 [0.2-3.2]
			6 (3886)	3 (2326)	2 (867)	1 (686)	4 (1942)	2 (1911)
	2006-2007 A(H3N2)	6.6 [4.6-9.1]	4.7 [2.4-8.3]	2.1 [0.5-5.4]	14.4 [9-21.6]	6.7 [3.9-10.5]	6.8 [4-10.5]
			33 (4979)	10 (2122)	3 (1446)	20 (1388)	16 (2390)	17 (2510)
	2007-2008 A(H1N1) & B	1 [0.4-2]	0.8 [0.1-2.5]	0 [0-1.9]	2.4 [0.7-5.5]	1 [0.3-2.7]	1 [0.3-2.6]
			6 (5951)	2 (2434)	0 (1798)	4 (1690)	3 (2902)	3 (2980)
	2008-2009 A(H3N2)	1.5 [0.9-2.6]	0.3 [0-1.3]	1.2 [0.3-3.2]	3.5 [1.7-6.2]	1.7 [0.8-3.4]	1.2 [0.4-2.5]
			13 (8388)	1 (3338)	3 (2453)	9 (2597)	7 (4001)	5 (4282)
	2009-2010 A(H1N1)	9.7 [8-11.7]	10 [7.8-12.7]	7.8 [4.9-11.6]	11.5 [7.3-17.2]	7.6 [5.5-10.2]	11.7 [9-14.8]
			105 (10791)	63 (6279)	21 (2685)	21 (1820)	40 (5241)	63 (5402)

* Some patients' age and/or sex might be unknown.

Table 3 .

 3 Number of recommended hospitalizations for ILI patients, by category of reason, and percentage over the columns.

		Seasonal epidemics 1997-	2009-2010 A(H1N1)
		1998 to 2008-2009	pandemic	Overall
	Age	2 (1.1%)	10 (9.6%)	12 (4.3%)
	Bad general condition	20 (11.5%)	18 (17.3%)	38 (13.7%)
	Cardiac	23 (13.2%)	5 (4.8%)	28 (10.1%)
	Confusion	6 (3.4%)	1 (1.0%)	7 (2.5%)
	Dehydration	2 (1.1%)	2 (1.9%)	4 (1.4%)
	Diagnostic	0 (0.0%)	9 (8.7%)	9 (3.2%)
	Meningitis	5 (2.9%)	3 (2.9%)	8 (2.9%)
	Pregnancy	1 (0.6%)	6 (5.8%)	7 (2.5%)
	Respiratory	111 (64.0%)	46 (44.2%)	157 (56.6%)
	Risk Factor	2 (1.1%)	2 (1.9%)	4 (1.4%)
	Social	2 (1.1%)	2 (1.9%)	4 (1.4%)
	Total	174	104	278

Table 4 .

 4 Case hospitalization ratio of ILI patients by risk factor, as reported by the general practitioners from the Sentinelles network.

		Case-hospitalization ratio (‰) and	Recommended hospitalizations
	Risk factor	95% confidence interval	(total ILI patients)
	None	5.2 [3.7-6.9]	42 (8152)
	Pregnancy	166.7 [75.3-297.5]	7 (42)
	Chronic condition & obesity	96.8 [25.2-232.1]	3 (31)
	Chronic condition	35.5 [20.6-56.1]	15 (422)
	Obesity	26.3 [3.3-110.8]	1 (38)
	Other	77.7 [45.5-121.1]	15 (193)
	At least one risk factor	56.5 [41.2-74.8]	41 (726)
	Overall	9.3 [7.5-11.5]	83 (8878)

Table 5 .

 5 Characteristics of the GPs reporting to the Sentinelles network surveillance system from 1997 to 2010.

														Year joined the Sentinelles
					Age (in years)				Sex				network
																After 1997
		Number of		1st			3rd						% of	1997 or	Current	and before
	Year	GPs	Min	quartile Median Mean	quartile Max Unknown Women Men Unknown	women	earlier	year	current year
	1997	339	31	40	45	45.32	50	68	2	40	299	0	12	339	-	-
	1998	275	32	42	46	46.23	50	69	2	34	240	1	12	252	23	-
	1999	252	32	43	47	47.42	51	70	4	28	223	1	11	221	24	7
	2000	236	31	43	48	47.98	52	69	3	32	203	1	14	183	35	18
	2001	268	30	42	47	47.17	52	69	1	48	219	1	18	158	80	30
	2002	220	31	43	48	47.61	53	76	2	32	187	1	15	109	60	51
	2003	237	29	44	49	48.49	53	77	6	34	202	1	14	104	83	50
	2004	228	30	45	50	49	54	78	6	35	193	0	15	96	54	78
	2005	242	31	46	51	50.08	55	79	17	31	211	0	13	90	75	77
	2006	255	30	46	52	50.74	56	80	16	36	219	0	14	88	54	113
	2007	283	28	47	52.5	51.36	57	81	15	36	247	0	13	92	68	123
	2008	379	29	46	53	51.39	58	82	18	68	311	0	18	106	138	135
	2009	452	29	46.25	53	51.77	58	83	18	81	371	0	18	104	136	212
	2010	372	30	47	53.5	52.3	59	84	14	67	305	0	18	95	36	241

ACKNOWLEDGEMENTS

We would like to thank all the general practitioners of the Sentinelles network who participated in the surveillance. This work was supported by the French medical research institute (Institut National de la Santé et de la Recherche Médicale) and by the University Pierre et Marie Curie -Paris 6. We also thank Cécile Souty for her analyses of the Sentinelles network composition.

CONFLICT OF INTEREST

The authors declare that they have no conflict of interest.

Percentage of patients in four age classes

Percentage of patients in each age class


Jérémy Parriaux
email: jeremy.parriaux@esstin.uhp-nancy.fr

Gilles Millérioux
email: gilles.millerioux@esstin.uhp-nancy.fr

Designing self-synchronizing switched linear systems: an application to communications

Keywords: switched systems, synchronization, communication, flatness, invertibility

This paper addresses the problem of self-synchronizing dynamical systems in a so-called master-slave configuration. The study is motivated by potential cryptographic applications. It is shown that the notion of flatness is central for guaranteeing a finite-time self-synchronization and that the concept of transmission zero plays also an important role. Next, the finite-time synchronization is relaxed to give rise to a so-called statistical self-synchronization, a mode of operation which makes sense in classical cryptography which operates over finite fields. The fact that switched linear systems are of great interest in this context is motivated.

Introduction

Synchronization of dynamical systems is an important purpose in many fields like biology, mechanics, communications. Synchronization means coordinated behavior of different interconnected entities involved in an overall system. Many different definitions and related configurations, in terms of coupling, can be investigated. An exhaustive and interesting overview can be found in [START_REF] Blekhman | On selfsynchronization and controlled synchronization[END_REF]. A special kind of synchronization is the self-synchronization. By self-synchronization, it is meant a coordinated behaviour which is achieved without any external control.

The configuration under consideration in this paper is a master-slave configuration with unidirectional coupling. It is borrowed from the field of communications and more specifically secure transmissions. In this context, cryptography plays a central role. It is the discipline which is mainly intended to protect information and to guarantee confidential exchanges through public channels. Since the 90's, many "scrambling" methods resorting to synchronized chaotic dynamical systems have been proposed. In the works [START_REF] Dachselt | Chaotic versus classical stream ciphers -A comparative study[END_REF][START_REF] Millérioux | A connection between chaotic and conventional cryptography[END_REF][START_REF] Millérioux | Self-synchronizing stream ciphers and dynamical systems: state of the art and open issues[END_REF][START_REF] Banerjee | Chaos Synchronization and Cryptography for Secure Communications: Applications for Encryption[END_REF], it is highlighted the connection between cryptography and the use of synchronized dynamical systems in a master-slave configuration exhibiting complex dynamics. The exhogenous input of the master dynamical system is the information to be encrypted. The master plays the role of the cipher. The slave is a dynamical system which plays the role of the decipher. The coupling is achieved through the output of the cipher which acts as the cryptogram. In all the "scrambling" methods, synchronization between the master and the slave is guaranteed without any external control. In other words, self-synchronization is achieved by means of the output coupling. That corresponds to some classical communication setups for which insertion of synchronization flags in the transmitted packets is forbidden for throughput purposes.

As it turns out, most of the "scrambling" methods resort to observer-based approaches for ensuring the synchronization and in general, asymptotical synchronization is achieved. It is clear that the asymptotical convergence may appear when operating over the field of real numbers as it is the case for chaotic systems. On the other hand, it makes no longer sense when operating over finite fields as it is precisely the case in classical cryptography. In [START_REF] Millérioux | A connection between chaotic and conventional cryptography[END_REF], it has been shown that a finite-time synchronization can be achieved whenever the dynamical system playing the role of the cipher is flat. In this case, the communication scheme is structurally equivalent to a so-called classical self-synchronizing stream cipher. As a result, resorting to flat dynamical systems not only makes sense from a cryptographic point of view but would provide a new approach for the design of self-synchronizing stream cipher s. However, this study was reduced to analysis.

The aim of the present work is to provide a constructive approach for the design of dynamical systems having the self-synchronization property. Discretetime switched linear systems are specifically addressed because they correspond to the so-called Maiorana McFarland construction which has proved to produce functions that have many interesting cryptographic properties (see [START_REF] Carlet | Boolean Models and Methods in Mathematics[END_REF]). Then, the finite-time convergence will be relaxed to give rise to the so-called statistical self-synchronizing stream ciphers. Such ciphers still make sense in classical cryptography but has only been touched on so far. Hence, the constructions proposed in this paper can be considered as a first step towards a complete framework for designing new classes of self-synchronizing stream ciphers. Let us point out that we mainly focus on the structural considerations of the ciphers while disregarding the security aspects which would be here out of the scope and are discussed in companion papers.

The outline of this paper is the following. In Section 2, strict necessary background on cryptography is provided. The role of self-synchronization in this context is emphasized and a formal definition of finite-time self-synchronization is given. In Section 3, the design of admissible master-slave configurations, described by piecewise linear systems, achieving finite-time self-synchronization is detailed. A constructive approach for guaranteeing the self-synchronization is suggested. It is mainly based on the notion of nilpotent semigroups. A connection between the issue of guaranteeing self-synchronization and the concept of flatness is brought out. Further considerations for the design are developed in Section 4 where it is shown that the concept of transmission zero of a dynamical system plays an important role as well. Section 5 extends finite-time selfsynchronization to statistical self-synchronization by releasing some constraints. Finally, Section 6 is devoted to illustrative examples.

Notation: 1 n stands for the identity matrix of dimension n, 0 stands for the zero matrix of appropriate dimension regarding the situation. We denote by {z} k2 k1 the sequence {z k1 , . . . , z k2 } when the initial and final times k 1 and k 2 are defined, otherwise the sequence is merely denoted by {z}. A general encryption mechanism, also called cryptosystem or cipher, is depicted in Figure 1. We are given an alphabet A that is, a finite set of elements named symbols. On the transmitter part, a plaintext (also called information or message) {u} ∈ U (U is called the message space) consisting of a string of symbols u k ∈ A is encrypted according to an encryption function e which depends on the key k e ∈ K (K is called the key space). The resulting ciphertext {y} ∈ C (C is called the ciphertext space), a string of symbols y k ∈ B, B being a set usually identical to A, is conveyed through a public channel to the receiver. At the receiver side, the ciphertext y k is decrypted according to a decryption function d which depends on the key k d ∈ K. For a prescribed k e , the function e must be invertible. Cryptography distinguishes asymmetric and symmetric ciphers. Asymmetric cryptography is largely based upon computationally very demanding mathematical problems, for instance, integer factorization into primes. It is not discussed in this paper.

Cryptography and synchronization

In symmetric encryption, both keys are identical that is, k d = k e . That explains the terminology "symmetric". This kind of encryption obeys a masterslave configuration. The transmitter, that is the master, is called in this context the cipher. It delivers a complex sequence (theoretically indistinguishable from a uniformly random one) used to conceal information. The information to be kept secret is, in some sense, "mixed" with the complex sequence so that the resulting sequence (called the cryptogram) conveyed to the receiver, cannot be understood by any unauthorized party. For proper information recovery, the receiver, that is the slave, called in this context the decipher, must deliver the same complex sequence synchronized with the cipher.

For stream ciphers depicted in Figure 2, the keys k e and k d are replaced by time-varying sequences called running keys or key-streams. They are denoted by {x} (with samples x k ) at the transmitter part and by { x} (with samples x k ) at the receiver part. As a result, stream ciphers require key-stream generators at both ends. The key-streams {x} and { x} must be synchronized to guarantee the equality x k = x k and thereby to match the symmetry principle. The secret keys k e and k d are some suitable selected parameters of the respective key-stream generators, the selection being based on security considerations. As mentioned in the introduction, some applications require that the synchro- nization is guaranteed without any external control that is, self-synchronization must be achieved. In such a case, the stream ciphers must have a special architecture and they are called Self-Synchronizing Stream-Ciphers, SSSC for short. An overview about this class of ciphers can be found in [START_REF] Daemen | The self-synchronizing stream cipher moustique[END_REF][START_REF] Millérioux | Self-synchronizing stream ciphers and dynamical systems: state of the art and open issues[END_REF].

e(x k , u k ) d( xk , y k ) y k u k

Self-synchronization and ciphering

Self-Synchronizing Stream Ciphers admit at the transmitter and receiver ends the respective equations:

x k = g k e (y k-K , . . . , y k-1 ) y k = e(x k , u k ) ( 1
)
x k = g k d (y k-K , . . . , y k-1 ) u k = d( x k , y k ) (2)
where g k e and g k d are the functions that generate the key-streams {x} and { x}.

Both functions depend on the last K past values of y k .

The ciphertext y k is worked out through an encryption function e which must be invertible for any prescribed x k . The decryption is performed through a function d depending on the ciphertext y k and on the running key x k of the receiver. Such a function must obey the rule:

u k = d( x k , y k ) = u k if x k = x k (3)
According to (3), the synchronization of the key-streams {x} and { x} generated respectively at the transmitter and receiver sides is a condition for proper decryption. Since the function g k e is identical at the transmitter and receiver sides and share the same arguments, namely the past ciphertexts y k-i (i = 1, . . . , K), it is clear that the generators synchronize automatically after a finite transient time of length K. This kind of self-synchronization is called finite-time selfsynchronization. A more formal definition will be given a little bit later.

Actually, the model ( 1)-( 2) of an SSSC is a conceptual model, called canonical representation, that corresponds to different architectures. In particular, it admits an equivalent recursive form involving a K-dimensional internal state z k = (y k-K , . . . , y k-1 ). Its i th coordinate is denoted by (z k ) i . The equations of the recursive form read

(z k+1 ) i = (z k ) i-1 if i > 0, y k if i = 0 y k = e(g k e (z k ), u k ) (4)
( z k+1 ) i = ( z k ) i-1 if i > 0, y k if i = 0 u k = d(g k d ( z k ), y k ) (5)
The state updating transformation of the canonical recursive form (4)-( 5) is a mere shift fed with the previous ciphertexts.

It turns out that resorting to dynamical systems instead of implementing directly the canonical form (1)-( 2) or its equivalent recursive form (4)-( 5) would broaden the possibilities of design of stream ciphers. More formally, we should propose a setup with two parts as shown in Figure 3. The first part (playing the role of the cipher) consists of a dynamical system C, with input u k (playing the role of the plaintext), output y k (playing the role of the cipher) and state vector x k (playing the role of the key-stream).

C x k+1 = f (x k , u k ) y k = h(x k , u k ) (6)
The output y k ensures a unidirectional coupling with the second part, the dynamical system D (playing the role of the decipher) with state vector x k . The quantity y k acts as an input for D.

D x k+1 = f ( x k , y k ) u k = h( x k , y k ) (7) C D u k y k u k Figure 3: Dynamical system-based cryptosystems
The symbol u k is the output of D. In a cryptographic context this is the recovered information, it must be equal to u k whenever x k = x k . The recursive form ( 4)-( 5) is actually a special case of the set-up ( 6)-( 7). However, not all the dynamical systems can be candidate. They must have the self-synchronization property which obeys the following definition:

Definition 1 (Finite-time self-synchronization). The unidirectional coupled sys- tem C-D is finite-time self-synchronizing if, for all admissible input sequences, ∃K ∈ N, ∀x 0 , x 0 , ∀k ≥ K, x k = x k (8)
More generally, a delay r ∈ N can be allowed. If so, (8) turns into

∃K ∈ N, ∀x 0 , x 0 , ∀k ≥ K, x k = x k+r (9)
Finally, the issue to be investigated is the following. How to design a masterslave setup C-D so that

• self-synchronization (8) (possibly ( 9)) can be guaranteed?

• proper input recovery u k = u k is ensured whenever self-synchronization is achieved?
It is the purpose of the next sections. We concentrate on the special class of switched linear systems. Indeed, when symmetric cryptography is sought, the functions to be considered are often the Boolean ones, that is, for some positive integers n and m the functions f : F n 2 -→ F m 2 where F 2 denotes the two-element field. And yet, it turns out that switched linear systems correspond to the Maiorana McFarland construction which has proved to provide functions that have many interesting cryptographic properties like the highest nonlinearity, high correlation immunity and good propagation characteristics [START_REF] Carlet | Boolean Models and Methods in Mathematics[END_REF]. Nevertheless, in digital transmissions, it can be interesting to consider other finite-fields than F 2 in general, we denote a finite field by F. The cardinality is no longer exclusively 2 but is p q with p a prime and q a positive integer. When q = 1, all the operations, namely, addition, subtraction, multiplication and inversion are still defined like in the field of real numbers except that the results are computed modulo p.

Finite-time self-synchronization and switched systems

The equations of the setup read at the transmitter part

C x k+1 = A σ(k) x k + B σ(k) u k y k = C σ(k) x k + D σ(k) u k (10)
and at the receiver part

D x k+1 = A ′ σ(k) x k + B ′ σ(k) y k u k = C ′ σ(k) x k + D ′ σ(k) y k (11) with u k , u k ∈ F, y k ∈ F and x k , x k ∈ F n .
The switching function σ is defined as

σ : k ∈ N → j = σ(k) ∈ {1, . . . , J} = J
At a given time k, the index j corresponds to the mode of the system given by the switching function σ. The number of modes is denoted by J. All the matrices, namely

A σ(k) ∈ F n×n , B σ(k) ∈ F n×1 , C σ(k) ∈ F 1×n and D σ(k) ∈ F
belong to the respective finite sets {A j , j ∈ J }, {B j , j ∈ J }, {C j , j ∈ J } and {D j , j ∈ J }. The switching function must depend on the output y k . The motivation of such a dependence lies in that the switching rule must also be self-synchronizing. Thus, it must depend on shared variables and so on the output y k or a finite sequence of delayed outputs. It is worth pointing out that the writing σ(k) is thereby somehow abusive. We denote by {v} the sequence of modes {v} = {σ(k), σ(k + 1), . . .} and the i th element is denoted by v i . If the sequence {v} has a finite length K, it is an element of the set denoted by J K .

In the following, we derive conditions for guaranteeing self-synchronization of the master-slave setup ( 10)- [START_REF] Parriaux | Synchronization of boolean dynamical systems: a spectral characterization[END_REF] and propose constructive approaches for achieving finite-time self-synchronization.

General conditions

Theorem 1. The setup (10)-( 11) is finite-time self-synchronizing whenever the three following conditions are fulfilled:

• ∀j ∈ J , D ′ j = 0 (12) • ∃K ∈ N, ∀x 0 , x 0 , ∀{v} ∈ J K , K-1 i=0 A ′ vi = 0 (13)
• Given the pairs {A ′ j , D ′ j } fulfilling (12) and ( 13) and arbitrary pairs

{B ′ j , C ′ j } of D, the system C reads      x k+1 = (A ′ σ(k) -B ′ σ(k) (D ′ σ(k) ) -1 C ′ σ(k) )x k +B ′ σ(k) (D ′ σ(k) ) -1 u k y k = -(D ′ σ(k) ) -1 C ′ σ(k) x k + (D ′ σ(k) ) -1 u k (14)
Proof. The input u k can be derived from the output equation of ( 14) and reads

u k = D ′ σ(k) y k + C ′ σ(k) x k (15)
Thus, from ( 11) and ( 15), one gets

u k -u k = C ′ σ(k) x k + D ′ σ(k) y k -D ′ σ(k) y k -C ′ σ(k) x k = C ′ σ(k) ( x k -x k )
Let the reconstruction error be ǫ k = x kx k . Then, from ( 11), ( 14) and [START_REF] Parriaux | Towards a spectral approach for the design of self-synchronizing stream ciphers[END_REF],

ǫ k+1 = A ′ σ(k) x k + B ′ σ(k) y k -(A ′ σ(k) -B ′ σ(k) (D ′ σ(k) ) -1 C ′ σ(k) )x k -B ′ σ(k) (D ′ σ(k) ) -1 u k = A ′ σ(k) ǫ k -B ′ σ(k) (y k -(D ′ σ(k) ) -1 u k ) -B ′ σ(k) (D ′ σ(k) ) -1 u k + B ′ σ(k) y k = A ′ σ(k) ǫ k (16)
After iterating ( 16) K times and taking into account [START_REF] Schrader | Research on system zeros: a survey[END_REF], one gets ǫ k = 0 or equivalently x k = x k for any k ≥ K. Hence, according to Definition 1, the set-up ( 10)-( 11) is finite-time self-synchronizing. That completes the proof.

Remark 1. Condition (13) means that regardless of the order of multiplication of the matrices A ′ j , and so for any mode sequences, the product is zero after a finite number K of iterations. K is the delay of synchronization.

Remark 2. The condition D ′ j = 0 for any j ∈ J means that the relative degree of the systems (11) is zero. Such an assumption is mandatory so that (11) makes sense in the context of cryptography. Indeed, the deciphering must be a function of the state vector and the cryptogram (here the output of (10)) Remark 3. The system [START_REF] Millérioux | A connection between chaotic and conventional cryptography[END_REF] with the state space realization (14) is a right inverse for the system [START_REF] Parriaux | Synchronization of boolean dynamical systems: a spectral characterization[END_REF]. Indeed, for any identical initial conditions x 0 = x 0 and for any identical mode sequence {v}, the system (14) drives [START_REF] Parriaux | Synchronization of boolean dynamical systems: a spectral characterization[END_REF]

such that ∀k ≥ 0, u k = u k .
The purpose of the next paragraph is to provide a constructive solution for the selection of appropriate matrices A ′ j which must fulfill (13) in Theorem 1. It is based on the notion of nilpotent semigroups.

Nilpotent semigroups approach for finite-time self-synchronization

Let us first recall two definitions:

Definition 2 (Semigroup). A semigroup S is a set together with an associative internal law. It is said to be finite if S has a finite number of elements.

Definition 3 (Nilpotent semigroup).

A semigroup S is said to be nilpotent if any product of a finite number t ∈ N * of its elements (possibly the same element) is always 0. The smallest integer t is called the class of nilpotency of S.

Proposition 1. In order for (13) to be fulfilled, the set of dynamical matrices {A ′ j , j ∈ J } must generate a nilpotent semigroup. The delay of synchronization K equals the class of nilpotency of this semigroup.

A theorem, useful for the construction of semigroups with a given class of nilpotency is stated in the book [START_REF] Radjavi | Simultaneous Triangularization[END_REF] (Theorem 2.1.7) and recalled below.

Theorem 2 (Levitsky's theorem). Any semigroup of nilpotent matrices can be triangularized.

In other words, all the matrices of a same nilpotent semigroup can be rewritten as upper triangular matrices up to a common linear transform (common basis). Since they are nilpotent their diagonal is zero.

Remark 4. The product of t nilpotent matrices which commute pairwise is 0 but the product of t nilpotent matrices is not, in general, nilpotent. Indeed, we observe that 0 1 0 0

0 0 1 0 = 1 0 0 0 .
Theorem 2 provides a generalization of this special case, should each matrix be nilpotent is only a necessary condition.

Hence, based on Levitsky's theorem, the construction of the family {A ′ j , j ∈ J } which fulfills (13) follows three successive steps Constructive Approach 1.

• choose an invertible matrix T ∈ F n×n

• choose a set of J upper triangular matrices Ā′ j with zero on the diagonal • for all j ∈ J , compute A ′ j = T -1 Ā′ j T

The matrix T may clearly be the identity matrix.

Remark 5. Because of Levitzky's theorem, the consideration of a semigroup of n-dimensional matrices is equivalent to the consideration of the corresponding set of upper triangular matrices. And yet, for triangular matrices, it is clear that the class of nilpotency is at most n. As a result, the delay of synchronization K is upper bounded by n.

Connection between flat systems and the self-synchronizing canonical form

Flatness is an important concept in control theory. It was introduced by Fliess in [START_REF] Fliess | Flatness and defect of non-linear systems: introductory theory and examples[END_REF] and a deep study can be found in the book [START_REF] Sira-Ramirez | Differentially Flat Systems[END_REF]. In this section, we show that the constructive approach proposed for designing a finite-time selfsynchronizing master-slave system amounts to designing a flat system C with flat output y k and that the resulting SSSC can be written in the canonical form (1)-(2). Definition 4 (Flat dynamical system [START_REF] Millérioux | Daafouz Flatness of switched linear discrete-time systems[END_REF]). A system with input u k and state vector x k is said to be flat if there is a set of independent variables y k , referred to as flat output, such that all the system variables can be expressed as a function of the flat output and a finite number of its backward and/or forward iterates. In particular, there exist two functions F and G such that

x k = F(y k+k1 , . . . , y k+k2 ) u k = G(y k+k ′ 1 , . . . , y k+k ′ 2 ) ( 17
)
where

k 1 , k 2 , k ′ 1 , k ′ 2 ∈ Z.
Proposition 2. The system C resulting from the conditions (12)-( 13)-( 14) is flat with flat output y k .

Proof. The state of the switched system (11) can be written, at time k + K

x k+K = K-1 i=0 A ′ σ(k+K-1-i) x k + K-1 i=0 K-1 j=i+1 A ′ σ(k+K-j) B ′ σ(k+i) y k+i
Therefore, if (13) holds, any state at time k ≥ 0 reads:

x k+K = K-1 i=0   K-1 j=i+1 A ′ σ(k+K-j)   B ′ σ(k+i) y k+i (18)
And yet, according to the proof of Theorem 1, ǫ k = 0 or equivalently x k = x k for any k ≥ K. Hence, after a shift of K, one obtains

x k = x k = K-1 i=0   K-1 j=i+1 A ′ σ(k-j)   B ′ σ(k-K+i) y k-K+i (19)
which gives the function F. On the other hand, the input u k reads like [START_REF] Parriaux | Towards a spectral approach for the design of self-synchronizing stream ciphers[END_REF]. Substituting the expression (19) of x k into [START_REF] Parriaux | Towards a spectral approach for the design of self-synchronizing stream ciphers[END_REF] gives the function G. That completes the proof.

Hence, under the flatness condition, the systems ( 10)-( 11) can be equivalently rewritten into the canonical form ( 1)-( 2) and read

x k = K-1 i=0 K-1 j=i+1 A ′ σ(k-j) B ′ σ(k-K+i) y k-K+i y k = C σ(k) x k + D σ(k) u k (20) x k = K-1 i=0 K-1 j=i+1 A ′ σ(k-j) B ′ σ(k-K+i) y k-K+i u k = C ′ σ(k) x k + D ′ σ(k) y k (21)
It is worth pointing out that, from a computational point of view, the recursive form ( 10)-( 11) that is, the use of dynamical systems, is more relevant than (20)-(21).

Transmission zeros and surjectivity

For cryptographic purposes (basically a consideration regarding the entropy of sequences), it is relevant that the maps x k → A j x k , j ∈ J are surjective. In other words, the following rank condition must be guaranteed:

∀j ∈ J , rank(A j ) = n (22)
The problem lies in that, according to Theorem 1, the matrices (A j , B j , C j , D j ) of the system C are not designed directly but are derived from (A ′ j , B ′ j , C ′ j , D ′ j ) of D. Hence, we must find out a condition on the matrices (A ′ j , B ′ j , C ′ j , D ′ j ) so that ( 22) is ensured. It turns out that the notion of transmission zeros is relevant to this end.

A definition of transmission zeros can be found for example in [START_REF] Schrader | Research on system zeros: a survey[END_REF]. It is recalled below and particularized for a SISO system. Definition 5. Let us consider a SISO linear system with state space realization (A, B, C, D). The transmission zeros are the complex numbers {s i } which fulfill

rank A -s i 1 n B C D < n + 1 ( 23
)
where it is recalled that 1 n stands for the identity matrix of dimension n. The matrix involved in (23) is often called the Rosenbrock matrix.

Before proceeding further, let us introduce a few additional notations. Consider the invertible matrix T and the corresponding matrices A ′ j = T -1 Ā′ j T derived from Ā′ j for j ∈ J as explained in Section 3.2 devoted to the Constructive Approach 1.

Let us write the upper triangular matrix Ā′ j as

Ā′ j =        0 a 1 j 0 a 2 j A * j . . . . . . 0 0 a n-1 j • • • 0        (24)
where A * j denotes the coefficients above the n -1 diagonal entries a m j (m = 1, . . . , n -1) located above the zero diagonal. Let have

T B ′ j = [b 1 j • • • b n j ] T (25)
b m j stands for the m th component of the column vector T B ′ j .

C ′ j T -1 = [c 1 j • • • c n j ] (26)
c m j stands for the m th component of the row vector C ′ j T -1 .

Proposition 3. The surjectivity of each map

x k → A j x k (j ∈ J }) of C is guaranteed whenever c 1 j b n j n-1 m=1 a m j = 0 (27)
Proof. According to Remark 3, ( 10) is a right inverse for [START_REF] Parriaux | Synchronization of boolean dynamical systems: a spectral characterization[END_REF]. Furthermore, let us recall that (see Remark 2) the relative degree of ( 10) and ( 11) is zero. We conclude that each realization (A ′ j , B ′ j , C ′ j , D ′ j ) (j ∈ J ) of D has n transmission zeros s i and the s i 's are nothing but the n eigenvalues λ i of A j of [START_REF] Millérioux | A connection between chaotic and conventional cryptography[END_REF]. They are the roots of

Ψ j (s) = det R = 0 with R = A ′ j -s1 n B ′ j C ′ j D ′ j ( 28
)
where Ψ j (s) is a polynomial, its constant monomial is Ψ j (0) and corresponds to the product of the roots of Ψ j (s) and so corresponds to the product n i=1 λ i of the eigenvalues of A j of C. Hence, surjectivity of x k → A j x k j ∈ J is guaranteed whenever Ψ j (0) = 0. The following equalities apply

Ψ j (0) = det A ′ j B ′ j C ′ j D ′ j = det T -1 Ā′ j T B ′ j C ′ j D ′ j = det T -1 0 0 1 Ā′ j T B ′ j C ′ j T -1 D ′ j T 0 0 1 = det Ā′ j T B ′ j C ′ j T -1 D ′ j ( 29
)
Consider a partitioned matrix with four sub-blocks E, F , G, H of compatible dimensions. We recall a result concerning its determinant.

det E F G H = det(H) • det(E -F H -1 G)
Hence, taking into account the special structure (24) of Ā′ j , (25) and (26), basic manipulations yield

Ψ j (0) = det Ā′ j T B ′ j C ′ j T -1 D ′ j = c 1 j b n j n-1 m=1 a m j (30)
That completes the proof.

Statistical self-synchronization

So far, we have proposed a construction which guarantees self-synchronization with a finite delay K. This assumption limits the complexity of the ciphering which can be represented as a memoryless function. This requirement is not mandatory in practice, and it is acceptable that the synchronization delay is not a constant value but a random variable with a probability law that reaches one as time reaches infinity. In this case, self-synchronization is said to be statistical [START_REF] Parriaux | Towards a spectral approach for the design of self-synchronizing stream ciphers[END_REF]. Statistical self-synchronization is more general than the finitetime one. Its interest lies in a broader choice of candidate dynamical systems. The resulting flexibility is important in view of matching additional constraints, besides the self-synchronization, in particular regarding the security of the communication setup. It could be interesting to relax the finite-time synchronization constraint so that the synchronization probability follows a probability law that ensures synchronization for a large enough random sequence {y}. To this end, we propose, as an extension, to introduce the statistical self-synchronization.

Definition 6 (Statistical self-synchronization). The unidirectional coupled sys- tem C-D is statistically self-synchronizing if ∀x 0 , x 0 , lim k→+∞ Pr[x k = x k ] = 1 (31)
where Pr[•] stands for the probability, x k and xk being considered as random variables. Let us stress that over the field of real numbers, we could have relaxed the finite-time synchronization constraint by allowing asymptotical synchronization with prescribed exponential decay rate. Over finite fields as it is the case here, asymptotical synchronization does no longer make sense.

General conditions

We give an equivalent theorem to Theorem 1 that corresponds to this situation. Note that the only difference with Theorem 1 concerns (13) which turns into (33). Theorem 3. The set-up (10)-( 11) is statistically self-synchronizing whenever the three following conditions are fulfilled:

• ∀j ∈ J , D ′ j = 0 (32) • ∃K ∈ N, ∀x 0 , x 0 , ∃{v} ∈ J K , K-1 i=0 A ′ vi = 0 (33)
• Given the pairs {A ′ j , D ′ j } fulfilling (32) and (33) and arbitrary pairs

{C ′ j , D ′ j } of D, the system C reads      x k+1 = A ′ σ(k) -B ′ σ(k) (D ′ σ(k) ) -1 C ′ σ(k) x k +B ′ σ(k) (D ′ σ(k) ) -1 u k y k = -(D ′ σ(k) ) -1 C ′ σ(k) x k + (D ′ σ(k) ) -1 u k (34)
Proof. The proof follows the same development than the one of Theorem 1 till Equation [START_REF] Bajić | Statistical Analysis of Search for Set of Sequences in Random and Framed Data[END_REF]. Equation (33) means that there exists a finite sequence of length K so that the product of K matrices A ′ j is zero. Considering that any finite sequence has the probability one to appear in an infinite sequence (provided that any symbols has a non null probability of occurrence), satisfying (33) implies satisfying Equation (31) of Definition 6.

Likewise the finite-time self-synchronization case, it should be interesting to check for constructive conditions, equivalent to (33), but with additionally the ability of controlling the probability of the synchronization delay while designing the system. Again, it turns out that we can resort to nilpotent semigroups.

Nilpotent semigroups for statistical self-synchronization

The proposed construction considers ℓ distinct nilpotent semigroups S i , i ∈ {1, . . . , ℓ} of square n dimensional matrices each generated by a set of matrices N i . The cardinality of the set N i (i ∈ {1, . . . , ℓ}) is denoted by J i . The construction of the family {A ′ j , j ∈ J } which fulfills (33) obeys the three following steps Constructive Approach 2.

• for each nilpotent semigroup S i (i ∈ {1, . . . , ℓ}) to be built, choose a distinct invertible matrix T i ∈ F n×n

• for i ∈ {1, . . . , ℓ}, choose a set of J i upper triangular matrices Ā′ j ′ j ′ ∈ {1, . . . , J i } with zeros on the diagonal • for i ∈ {1, . . . , ℓ}, for j ′ ∈ {1, . . . , J i }, compute A ′ j = T -1 i Ā′ j ′ T i with j = (i -1)ℓ + j ′ . These matrices are the elements of the set N i .

Let t i be the class of nilpotency of S i . The synchronization of C-D is ensured if the switching rule σ selects t i successive modes in the same nilpotent semigroup S i . Remark 6. It is worth emphasizing that finite-time synchronization is a special case of statistical self-synchronization which corresponds to ℓ = 1, J 1 = J.

Synchronization probability

When considering statistical self-synchronization, a question of interest is the shape of the synchronization probability function. Such a system is viable only if, for sequences of reasonable length, the synchronization probability is close to one. From the cryptographic point of view, it is also important that the synchronization does not occur too quickly. Such a system would be vulnerable to brute-force attacks that is, exhaustive search of the secret key.

The parameters that can be used to control the synchronization delay while designing the system are essentially, the dimension n of the system, the number ℓ of nilpotent semigroups S i , the number of generators J i and the class of nilpotency t i of S i . Section 6.2 illustrates such a purpose.

Illustrative examples

6.1. Finite-time self-synchronization This section gives an example that illustrates the construction of a finite-time self-synchronizing setup. We propose to design a finite-time self-synchronizing system of dimension n = 3 and with J = 3 modes. The matrices are defined over the finite field F = Z/7Z. Hence, their entries belong to the set of integers {0, . . . , 6} and the operations of additions and multiplications are performed modulo 7.

The design consists in a selection of matrices A ′ j , B ′ j , C ′ j , D ′ j which must fulfill the conditions of Theorem 1, the condition (13) being replaced by the Constructive Approach 1 provided in Section 3.2. The condition (27) on surjectivity is also incorporated into the constraints. Now let us detail the design.

First, for simplicity, we choose D ′ j = 1 for any j ∈ J = {1, 2, 3} (condition ( 12)). Secondly, following the Constructive Approach 1, it is chosen a set of three 3dimensional matrices Ā′ j in the form of strict upper triangular matrices and with non zero entries located above the diagonal for the surjectivity (Condition (27)).

Ā′ 1 =   0 3 2 0 0 1 0 0 0   Ā′ 2 =   0 2 1 0 0 2 0 0 0   Ā′ 3 =   0
′ j = T -1 Ā′ j T , we get that A ′ 1 =   5 5 4 6 1 3 2 1 0   A ′ 2 =   6 3 0 3 2 1 5 2 6   A ′ 3 =   0 2 4 1 4 0 6 1 3  
Next, we choose arbitrary matrices B ′ j and C ′ j except the fact that the first entry c 1 j of C ′ j T -1 and last entry b n j of T B ′ j are not zero to fulfil the surjectivity condition (27).

B ′ 1 =   0 0 1   , B ′ 2 =   1 2 5   , B ′ 3 =   3
  B 1 =   0 0 1   , B 2 =   1 2 5   , B 3 =   3 6 1   C 1 = 5 6 4 , C 2 = 1 5 6 , C 3 = 4 6 6 D 1 = D 2 = D 3 = 1
Having completed the design of ( 10)-( 11), a sequence {u} is applied to C. As expected, the self-synchronization is achieved after a finite transient time, and so does the recovery of the sequence of inputs (see Figure 4). The transient time before self-synchronization lasts K = 3 samples. It is in accordance with the class of nilpotency t = 3 of the set {A ′ 1 , A ′ 2 , A ′ 3 }.

Statistical self-synchronization

In this example we aim at designing a setup (10)- [START_REF] Parriaux | Synchronization of boolean dynamical systems: a spectral characterization[END_REF] having the statistical self-synchronization property. Besides, we assess the impact of the variation of the number of nilpotent semigroups ℓ on the synchronization delay. The dimension of the dynamical system is n = 10. The number of nilpotent semigroups varies from ℓ = 1 to 6. They are built according to the Constructive Approach 2 given in Section 5.2. The nilpotent semigroups have the same number of generators J i = 5 and class of nilpotency t i = 10 ∀i ∈ {1, . . . , ℓ}. The experiment is conducted by generating random mode sequences {v} = {σ(0), σ(1), . . .} and determining, over 2000 runs, the percentage of sequences for which selfsynchronization occurs. The result is depicted in Figure 5. The experiment shows that the more semigroups the higher the synchronization delay on average. In any case, the percentage gets close to 100% as K increases and is in accordance with Definition 6. The case when there is only one nilpotent semigroup deserves a special comment. The curve reaches 100% after K = 10. Indeed it corresponds to a finite self-synchronization according to Remark 6. The delay K = 10 corresponds to the class of nilpotency t = 10 of the set of matrices A ′ j . The probability law of synchronization seems to have an exponential-like shape. It is not trivial to figure out the exact expression of the law. Indeed, the problem amounts to determine the probability of occurrence of the mode sequences {v} that induce self-synchronization. And yet, it is shown in [START_REF] Bajić | Statistical Analysis of Search for Set of Sequences in Random and Framed Data[END_REF] that a general treatment of this issue can be very intricate.

Conclusion

This paper has addressed the problem of self-synchronization with potential applications to secure communications. The setup under considerations involved two dynamical systems coupled in a unidirectional way. Two kinds of self-synchronization have been investigated: the finite-time one and, as an extension, the statistical one. For discrete-time switched linear systems, it has been shown that a variety of concepts borrowed from control theory, namely flatness, right invertibility, transmission zeros are relevant to design an admissible setup. It turns out that the notion of nilpotent semigroups is central to guarantee the finite-time self-synchronization. More refined characterization of the probability law defining the delay of synchronization in the statistical case should be examined in a near future. The control theoretical concepts addressed through this work can be considered as a first step towards a complete framework for designing self-synchronizing stream ciphers. Clearly, security criteria must be further incorporated into this framework. They have not been discussed here because out of the scope but can be found in companion papers.

2. 1 .Figure 1 :

 11 Figure 1: General encryption mechanism

Figure 2 :

 2 Figure 2: Stream cipher



  Applying the change of basis A

Figure 4 :

 4 Figure 4: Time evolution of {u} and { u} of the setup C-D

Figure 5 :

 5 Figure 5: Percentage of the number of times the system C-D has synchronized with respect to the delay of synchronization K for different number ℓ of nilpotent semigroups

Acknowledgement

This work was supported in part by the Institut des Sciences et de l'Ingénierie des Systèmes, Centre National de la Recherche Scientifique, Programmes Exploratoires Pluridisciplinaires (PEPS), Projet Autocrypt.


Model Predictive Real-Time Controller for a Low-Consumption Electric Vehicle

Keywords: Electric vehicle, Model Predictive Control, realtime application

It is described a complete benchmark designed for testing performances of an electric vehicle in terms of consumption during the European Shell Eco-marathon race. A model of the electric vehicle built for the race is first obtained. Then, a low consumption driving strategy is derived. The tracking performances are tested on the electric Vir'Volt benchmark prototype, wherein a Model Predictive real-time Controller has been implemented. The experimental result are detailed.

I. INTRODUCTION

The principle of hybridization is to use several different modes of power supply together or separately according to the power requirements. The main of those requirements is to reduce harmful emissions. Research of energy efficiency in the field of transport has been carried out from few decades in the industry (diesel-electric locomotives) and more recently for the general public market (private hybrids cars are available for sale since 1997) [START_REF] Sciarretta | Control of hybrid electric vehicles[END_REF] [START_REF] Bordons | Model Predictive Control for power management in hybrid fuel cell vehicles[END_REF]. Many specific engineering issues arise, the more recent are energetic efficiency and real time implementation. Of special interest is the problem of how using the different energy sources so that the energy efficiency can be maximize or, in other words, how the vehicle must be driven so that the minimum quantity of fuel is used, the real time implementation constraints being taken into account [1] [3].

With the aim of promoting the research and innovation around the solution of the low consumption problem, the European Shell Eco-Marathon brings together over 200 teams from high schools and universities from all over Europe, in a race involving ecological and economical vehicles. The principle of the race is to go through a number of kilometres in a limited time and with the lower consumption. Several categories are distinguished according to the energy source: fuel cell (hydrogen), battery, solar energy.

The Ecole Supérieure des Sciences et Technologies de l'Ingénieur de Nancy (ESSTIN), has been involved in the European Shell Eco-marathon race since 12 years in the respective category fuel cell and battery. The performances of the team called EcoMotionTeam have been improved very significantly over the years and now regularly reach places of honour in the contest. In addition, the team was often awarded with special prizes such as the price of technical innovation, the price of the security or the price of National Education. Motivated by higher ambitious results, researchers from IECN, CRAN and INRIA have joined the EcomotionTeam this year. The aim of this paper is to show the effectiveness, in terms of consumption, of a Model Predictive Control implemented into the vehicle and tested on a benchmark which is intended to reproduce as close as possible the vehicles during the race. The motivation of resorting to a MPC-based controller lies in that they are known to have appealing ability to ensure robustness despite the uncertainties in the model and are amenable to incorporate constraints (saturation of the actuators for example) [START_REF] Sciarretta | Control of hybrid electric vehicles[END_REF].

This paper is organized as follows: In Sections II and III, the context of the present investigation and the prototype called Vir'Volt are presented. Section IV details the MPC algorithm that will achieve the tracking of the driving strategy. Finally, Section V presents the implementation of the low consumption strategy and the MPC real time controller into the vehicle and benchmark, and the experimental results are provided. Section VI is devoted to a conclusion and sketches future works.

II. CONTEXT

The EcoMotionTeam has developped successive vehicles over the past 12 years. The prototype named Vir'Volt is the fifth generation of vehicles developed by the EcoMotionTeam. This recent prototype (see Figure 1) has been ranked last year 2nd in the Plug-in (battery) category among 12 others vehicles and 7th among the 100 participants of the European competition with a result of 532km/kWh (equivalent to 4732km with one litre of fuel). The prototype is a three wheels vehicle, the direction is made by the front wheel and the propulsion by one of the two rear wheels. It can reach the speed of 35km/h and the energy is given by a 24V battery to an electric motor which develops 0, 4Nm. This vehicle has many electronics systems in order to communicate with the pit stop. The total weight of the car is 40kg, the pilot needs to weight at least 50kg according to the Shell Eco-marathon rules, thus total mass of the vehicle is 90kg.

So far, the driving strategy proposed by the EcoMotionTeam was a stop-and-go one. It merely reduced to manually turn on or off the engine by the pilot according to whether the vehicle was going up or down respectively. However, the new and ambitious challenges in terms of the consumption strategy requires more complex driving strategies and the accuracy of the tracking is decisive in the final performances.

In 2011, the race was held in Lausitz, Germany. The Lausitz's track could be considered like a straight line since their was no deceleration or complex curves. Then the driving instructions corresponding to the strategy could be follow easily by the pilot. The only strategy was so to maintain a fixed average speed along the track. The efficiency of the converter/motor being better when working at full regime, the strategy consisted in driving around an average value by accelerating at maximum until a maximum speed was reached and then decelerating until the vehicle reached a minimum speed.

On the other hand, in the Rotterdam's 2012 street circuit, the new track require high decelerations due to chicanes and to deal with an expected resulting high traffic. Then, it is clear that an advanced strategy and a control are required in order to gain efficiency.

Achieving a low consumption requires three central works. First, it must be obtained a valuable model of the vehicle. Secondly, deriving a reference driving trajectory in terms of expected position and velocity all along the circuit. Both tasks can be performed off-line. Finally, a powerful tracking strategy must be designed and implemented so that it can works in real-time. The following sections addressed all of these tasks. For the identification of the vehicle and the computation of the reference trajectory, an application called SimStrat (see examples of captured screens of the graphical interface in Figure 2) has been developed by the EcoMotionTeam.

III. MODELING

The dynamics of the vehicle can be described in terms of the internal forces acting over the vehicle and given by the force of traction F traction dt [m/s 2 ] as [START_REF] Santin | The world's most fuel efficient vehicle: design and development of PAC-Car II[END_REF]: is the gravitation acceleration. The traction force is given by the torque applied by the engine and the resistance of the connecting rod in the crankshaft. This resistance in given by C pivot /R, with C pivot [Nm] the bearing resistance and the R[m] the radius of the wheel. When the engine is working, the torque due to the motor is C mot [Nm], and if it is not working the new torque applied is C min [Nm]. By introducing the input u(t) ∈ [0, 1] (duty cycle), such as u(t) is the portion of a switching period in which the engine is on, and (1 -u(t)) the portion of period while the engine is off, then the traction force can be written by:

m dx2(t) dt =Ftraction -F aerodynamics -F rolling -F slope m dx2(t) dt =Ftraction - 1 2 ρCxSx2(t) 2 -mgNr -gx2(t) dθ dx1(t) (1
Ftraction = u(t)Cmot + (1 -u(t))Cmin R - Cpivot R (2)
Considering that the path profile has no elevations (flat path) or that the slope remains always constant, from (1) and ( 2), the nonlinear dynamics of the vehicle can be written as follows:

ẋ1 = x2 (3) ẋ2 = u(t)Cmot + (1 -u(t))Cmin -Cpivot mR -Nrg - 1 2 ρCxS m x2 2 (4)
A. The linear discrete model

For practical purposes, a discrete model should be obtained. To this end, the nonlinear model ( 3)-( 4) is discretized by using the Euler's Forward difference numerical approximation that is written in an explicit way, and not in an implicit way like the Tustin's method or Euler's backward discretizing method e.g [START_REF] Haugen | Advanced Dynamics and Control[END_REF].

Forward differentiation Euler's Method:

ẋ(t k ) = x(t k+1 ) -x(t k ) Ts Backward differentiation Euler's Method: ẋ(t k ) = x(t k ) -x(t k-1 ) Ts (5)
with T s the sample time. The Euler's Forward difference method makes easier the discretizing process of nonlinear functions since gives an explicit or isolated expression for the state variable x(t) in an direct way [START_REF] Haugen | Advanced Dynamics and Control[END_REF]. From ( 3)-( 4) and ( 5), the discrete state space model is obtained for the position and the velocity, considered respectively as the first and the second component of the state vector and denoted x 1 (k) and x 2 (k), by using the Euler's Forward method as:

x1(k) = x1(k -1) + Tsx2(k -1) (6) x2(k) = x2(k -1)+Ts (Cmot -Cmin)u(k -1) + Cmin -Cpivot mR -TsNrg -Ts 1 2 ρCxS m x2(k -1) 2 (7)
When the discretizing process is implemented, a zero holder is usually considered and introduces a delay T s /2. This delay can influence the stability of the system if it is too large. In [START_REF] Haugen | Advanced Dynamics and Control[END_REF], it is demonstrated that the effect of the time delay over the system stability is tolerable if the time delay T s /2 is smaller than one tenth of the rise time t r (63% rise time rule) of the system, i.e:

T s ≤ t r 5 (8)
As can be seen in ( 7), a nonlinear differential equation produces a nonlinear difference equations. By taking u e ∈ co({0, 1}) as the duty cycle of the averaged input that takes (7) to the equilibrium point x 2e :

x 2e = 2 • u e -(C pivot + N r gmR) ρC x SR (9)
Then the linearized discrete-time state space dynamics is given by:

x(k) = Ax(k -1) + Bû(k -1) (10)
where

x(k) = [x 1 (k), x 2 (k) -x 2e ] T ∈ R n (with n = 2), û(k) = u(k)
-u e and:

A = 1 T s 0 1 -2bT s m x 2e B = 0 (Cmot-Cmin) mR T s
The output equation is the linearized velocity x2 (k) = x 2 (k) -x 2e and reads

y(k) = Cx(k -1), where C = 0 1 (11)
In Figure 3 are plotted the velocity x 2e with respect to the controls u e in the admissible range [0, 1] and corresponds to the nonlinear characteristic (9). An example of linearization around a control operating point is also depicted.

IV. MODEL PREDICTIVE CONTROL

A. Driving Strategy

For a prescribed circuit, the driving strategy is a collection of finite numbers of pairs (x * 1 (k), x * 2 (k)) where x * 2 (k) corresponds to the required velocity assigned to the position x * 1 (k) in the circuit at time k, so as a minimal consumption is achieved. We define the driving strategy state vector as

x * (k) = [x * 1 (k), x * 2 (k)] T (12)
The search for the driving strategy is an iterative procedure which, given the model of the vehicle, the road profile (slope, curves, . . . ) and the constraints in terms of maximum velocity allowed at each curve, maximum time of the race, total number of kilometers, . . . , must return (12) for every k. Then, for each x * 2 (k), the corresponding required control u * (k) which guarantees that the actual velocity x 2 (k) is as close as possible of x * 2 (k) (tracking) can be derived by solving (9) with x 2e = x * 2 (k) and u e = u * (k), at each k. An example of driving strategy is depicted in the captured screen of Figure 4.

B. Tracking

This subsection addresses the problem of driving the vehicle in real-time in order to guarantee that the state x(k) = [x 1 (k), x 2 (k)] T ∈ R 2 of the vehicle remains as close as possible to the driving strategy x * (12). As pointed out in the introduction, a Model Predictive Control approach is well suited for that purpose.

Let us define ∆ũ(k) = u(k)-u * (k) as the distance between the predicted input u(k) and the control solution u * (k) at the instant k. Since at every sampling instant k, the state x(k) can be measured, then for a prediction horizon of length N p , the vector ∆U ∈ R Np×1 which should achieve the tracking can be defined as:

∆U = [∆ũ(k), ∆ũ(k +1), ∆ũ(k +2), . . . , ∆ũ(k +Np -1)] T (13)
Furthermore, let us define ∆x(k) = x(k) -x * (k) as the distance between the predicted state x(k) and the state solution x * (k) at the instant k. The predicted state variables are then given by:

∆X = [∆x(k +1) T , ∆x(k +2) T , ∆x(k +3) T , . . . , ∆x(k +Np) T ] T (14)
The relationship between ∆X ∈ R nNp×1 and ∆U is given by:

∆X = F(x(k) -x * (k)) + Φ∆U (15)
with F ∈ R nNp×n and Φ ∈ R nNp×Np (with n = 2) where:

F =        A A 2 A 3 . . . A Np        Φ =        B 0 0 . . . 0 AB B 0 . . . 0 A 2 B AB B . . . 0 . . . . . . . . . . . . . . . A Np-1 B A Np-2 B A Np-3 B . . . B        (16)
The MPC-based controller, which is intended to be embedded on-board during the race, must guarantee the tracking of the driving strategy despite unpredictable events like emergency brakes, wind, . . . . The control must be the solution of the following quadratic criterion:

min ∆U (J = ∆X T Q∆X + ∆U T P ∆U) s.t. ∆X = F(x(k) -x * (k)) + Φ∆U x(0) = x ini u ∈ [0, 1] (17)
with P ∈ R Np×Np and Q ∈ R nNp×nNp diagonal matrices. Plugging (15) into (17), it can be shown after some basic manipulations that the minimization problem (17) can be reformulated in a strictly equivalent way and reads:

min ∆U 1 2 ∆U T H∆U + f T ∆U s.t. M ∆U ≤ N (18)
where H ∈ R Np×Np and f ∈ R Np×1 are given by:

H = Φ T QΦ + P and f = Φ T QF(x(k) -x * k ) (19)
The constraint M ∆U ≤ N in (18) must be written in terms of the constraints required for the state (related to the reference tracking error) and the constraints required for the input (related to requirement u(k) ∈ [0, 1]). Firstly, the constrains of the state are expressed as:

M x ∆X ≤ N x ( 20
)
where M x ∈ R 2nNp×nNp and N x ∈ R 2nNp×1 are given by:

Mx =              In×n 0 . . . 0 0 In×n . . . 0 . . . . . . . . . . . . 0 0 . . . In×n -In×n 0 . . . 0 0 -In×n . . . 0 . . . . . . . . . . . . 0 0 . . . -In×n              Nx =              max∆x max∆x . . . max∆x min∆x min∆x . . . min∆x              (21)
with I n×n ∈ R n×n the identity matrix, and max ∆x ∈ R n×1 and min ∆x ∈ R n×1 the upper and lower limits desired for the tracking error ∆x(k), such as:

min ∆x ≤ ∆x(k) = x(k) -x * (k) ≤ max ∆x (22)
By using (15), the inequality in (20) can be rewritten in terms of ∆U, as:

M x Φ∆U ≤ N x -M x F∆x(k) (23)
On the other hand, the constrains for the input can be written as:

M u ∆U ≤ N u (24)
where M u ∈ R 2Np×Np and N u ∈ R 2Np×1 are given by:

Mu = IN p ×Np -IN p ×Np Nu =           max∆u . . . max∆u min∆u . . . min∆u           (25)
with I Np×Np ∈ R Np×Np the identity matrix, and max ∆u ∈ R 1×1 and min ∆u ∈ R 1×1 such as:

min ∆u ≤ ∆ũ(k) ≤ max ∆u (26)
The values max ∆u and min ∆u must be expressed such as the condition u(k) ∈ [0, 1] is always satisfied. By making:

min ∆u = 0 -u * (k) and max ∆u = 1 -u * (k) (27)
then, from (26) it is obtained:

0 ≤ u(k) ≤ 1 (28)
Finally from ( 23) and ( 24), M and N in (18) are expressed as:

M = MxΦ Mu N = Nx -MxF∆x(k) Nu (29)
V. EXPERIMENTAL RESULTS

A. Parameter estimation

The nonlinear model (1) involves two unknown parameters C x and N r . For the estimation of those parameters, multiple decelerations to zero have been performed for the Vir'Volt vehicle. It has been done by turning off the motor (F traction = 0) after accelerating the vehicle until a maximum velocity V el ini in a low slope variations road and without curves.

For the Vir'Volt vehicle and its environment, the physical known parameters are the gravity acceleration g = 9.81[m/s 2 ], the wheel radius R = 0.24m, the frontal surface S = 0.275m 2 , the total mass m = 90kg, the air density ρ = 1.225[kg/m 3 ], C pivot being neglected. The initial velocity is V el ini = 40km/h. The data bank and the corresponding best fitting in terms of Mean Square Error (MSE) regarding ( 1) is depicted in Figure 5. Finally, the linear dicrete model (10) has been obtained by considering a sampled time T s = 0.2s which fulfills (8), and the operating point u e = 0.040 and x 2e = 11km/h in (9).

B. Benchmark

In order to assess the efficiency of the control law, a benchmark emulating both the vehicle and the circuit profile has been built (see Figure 7). The benchmark is composed of two inertia wheels over which the vehicle is placed. The inertia wheels allows for emulating the intertia of the vehicle. This benchmark has an electric brake and a motor in order to simulate slopes, wind and others disturbances such as the friction torque in the wheels. The benchmark is also equipped by a a torque-meter. The energy consumed by the vehicle is measured by plugging an energy-meter onto the battery.

The data acquisition system (DAQ) used to probe the velocity and the current position of the vehicle consists in a National Instruments analog DAQ system (USB-6289) which receives data from the vehicle (such as velocity, position, current, voltage, . . . ). The MPC computation, in particular the quadratic solver corresponding to (19) is developed by a python script based on the mathematics C library CVXOPT, BLAS and LAPACK. The MPC is run on a Linux-embedded computer named APF51 developed by the company Armadeus. This embedded computer is based on an ARMv7 (working frequency 800Mhz) processor and will, after computation, send a command to the motor according to the velocity and position of the car.

C. Tracking experimental results

The Rotterdam 2012 circuit has a total length of 16.3km and five 90 • curves with lengths between 19m and 44m. The resulting driving strategy obtained by means of the aforementioned application SimStrat is depicted in Figure 8a. The constraints were: maximum motor current value 8A (and thus Cmot), maximum velocity regulation 13km/h, minimum velocity regulation 10km/h and velocity in curves 8km/h. The estimated consumption for this driving strategy is 9.2kJ (equivalent to 640km/kWh or 6278km/1Lfuel) and the average velocity is 11km/h. The MPC real-time controller has been tested firstly for the tracking of a non-variable reference and secondly for the tracking of the low consumption strategy found in Figure 8, with the MPC state restrictions set as min ∆x = -5km/h and max ∆x = 5km/h (see ( 22)). The matrices Q and P in (17) are unitary matrices.

Results shown in Figure 9 are achieved for the velocity and the control signal for the tracking of a reference of x 2 ref = 15km/h from initial condition x 2 ini = 0km/h. The total consumption was 3, 5676kJ. As it can be observed the control signal in Figure 9b accomplishes the control constraints imposed by (28). The stable state error is 0.44km/h, that corresponds to 2.93%. The time response of the controller is 7s.

The results shown in Figure 10 point out a good tracking of the driving strategy. The measured energy consumption was 12.1kJ (equivalent to 480km/kWh or 4780km/1Lfuel). The difference in the total consumption is due to the fact that the efficiency of the engine is not considered here and to the transients before exact tracking.

VI. CONCLUSIONS AND FUTURE WORK

A benchmark for testing a low consumption driving strategy of a vehicle with battery source energy supply has been built. The benchmark is able to emulate the race conditions. A model of the vehicle has been obtained and used to design a Model Predictive Control tracking strategy. The controller has been implemented in the vehicle and achieves good tracking performances. As future work, the controller will be tested on board for the actual race.

Fig. 1 .

 1 Fig. 1. The Vir'Volt prototype in the Shell Eco-marathon 2011.

  [N] due to the engine, and the external forces due to the aerodynamics F aerodynamics [N], the rolling resistance (contact wheel-ground) F rolling [N], and the slope resistance F slope [N]. All this forces are related by Newton's law involving the mass m[kg] of the vehicle and its

  (a) User interface. (b) Parameter estimation window.

Fig. 2 .

 2 Fig. 2. Graphical user interface SimStrat designed by the EcoMotionTeam to estimate the vehicle model and find the driving strategy.

) with x 1

 1 (t) the position in [m] and x 2 (t) the velocity of the vehicle in [m/s]. The aerodynamic force F aerodynamics is given in terms of the frontal area S[m 2 ] of the vehicle, the aerodynamic drag coefficient C x , and the air density ρ[kg/m 3 ]. The rolling force F rolling is given in terms of the rolling resistance coefficient N r , and the slope resistance force F slope is given in terms of the variation of the slope θ. g[m/s 2 ]

Fig. 3 .

 3 Fig. 3. Velocity x 2e with respect to control ue for the nonlinear model (continuous line) and the linearized model (dashed line)

Fig. 4 .

 4 Fig. 4. Rotterdam's 2012 street circuit (Courtesy of Shell) and a corresponding low consumption driving strategy.

Fig. 5 .

 5 Fig. 5. Decelerating data bank in circles and best fitting in dashed line for the Vir'Volt vehicle.

Fig. 6 .

 6 Fig. 6. Nonlinear system step response.

  (a) Vir'Volt vehicle, benchmark and DAQ system. (b) CAD benchmark.

Fig. 7

 7 Fig. 7. Benchmark.

  (a) Driving strategy. (b) Estimated energy consumption.

Fig. 8 .

 8 Fig. 8. Low consumption driving strategy with total consumption 9.2kJ. x 2 [km/h] is the velocity and x 1 [km] is the position.

  (a) Measured velocity x 2 . In dashed line is the reference. (b) Measured control u.

Fig. 9 .

 9 Fig. 9. Tracking experiment for a nonvariable reference.

  (a) Measured velocity x 2 . In dashed line is the reference. (b) Measured control u.

Fig. 10 .

 10 Fig. 10. Tracking experiment for the driving strategy.

VII. ACKNOWLEDGMENTS

It is a pleasure for the authors to thank the students and the teaching staff of EcoMotionTeam and ESSTIN for their valuable help.

The authors would also like to thank the company Armadeus for their sponsorship and help developing embedded solutions. This work has been supported by CPER Région Lorraine (AOC project), Fédération Charles Hermite, ESSTIN and INRIA.

Third author partially supported by ANR GCM, contract number NT-504590 and ERC StG number 239748.