Sonny Tarbouriech

Benjamin Navarro

Philippe Fraisse

André Crosnier

Andrea Cherubini

Damien Sallé

Admittance control for collaborative dual-arm manipulation

Human-robot collaboration is an appealing solution to increase the flexibility of production lines. In this context, we propose a kinematic control strategy for dual-arm robotic platforms physically collaborating with human operators. Based on admittance control, our approach aims at improving the performance of object transportation tasks by acting on two levels: estimating and compensating gravity effects on one side, and considering human intention in the cooperative task space on the other. An experimental study using virtual reality reveals the effectiveness of our method in terms of reduced human energy expenditure.

I. INTRODUCTION

Letting several manipulator arms share the same workspace and operate cooperatively brings the potential of industrial robotics at a higher level [START_REF] Smith | Dual arm manipulationa survey[END_REF]. As for humans, the combination of two arms makes the realisation of complex tasks possible [START_REF] Felip | A solution for the cap unscrewing task with a dual arm sensor-based system[END_REF], [START_REF] Polverini | Robust constraint-based robot control for bimanual cap rotation[END_REF] and allows the manipulation of bigger and heavier objects than what would have been feasible with a unique arm [START_REF] Xian | Closed-chain manipulation of large objects by multi-arm robotic systems[END_REF].

Enabling physical human-robot collaboration has tremendous potential and is particularly attractive for industrial purposes [START_REF] Cherubini | Collaborative manufacturing with physical human-robot interaction[END_REF]. Within the numerous applications, collaborative carrying has raised great interest for its ability to facilitate the transportation of bulky objects.

Many researchers have addressed the control problem of a robot system handling an object in cooperation with a human. Early work involving human-robot object comanipulation was done by Kosuge et al. [START_REF] Kosuge | Robot-human collaboration for new robotic applications[END_REF]. They studied the general case of several humans collaborating with a multi-arm robotic system. Assuming a rigid grasp and no relative motion between the arms, the mechanical impedance of the commonly held object is controlled and the necessary impedance for each robotic arm is deduced. Taking a similar approach, the dual-arm mobile robot "MR helper" is able to collaborate with humans using wrench feedback from each arm's wrist [START_REF] Kosuge | Mobile robot helper[END_REF]. The apparent impedance of the object is estimated to generate the command in the task space.

The need for robotic assistance is particularly desirable for moving cumbersome objects. In [START_REF] Takubo | Human-robot cooperative manipulation using a virtual nonholonomic constraint[END_REF], the author proposes a method to facilitate the cooperative manipulation of long parts. By setting a virtual nonholonomic constraint at the tip of the robotic arm, the object's motion is restricted to a plane to prevent sideslip. Combining horizontal and vertical movements enables the 6 degrees of freedom (DOF) manipulation of the object in 3D space. The load sharing during co-manipulation is also an important aspect and effort sharing strategies have been proposed to improve the task performance [START_REF] Lawitzky | Load sharing in human-robot cooperative manipulation[END_REF].

From a control point of view, more versatility often means more complexity. A key element that emerges from previous research is that setting up dual-arm collaboration requires an appropriate task description. Initially introduced in [START_REF] Chiacchio | Direct and inverse kinematics for coordinated motion tasks of a two-manipulator system[END_REF], the cooperative task-space representation has been commonly adopted when dealing with dual-arm robots. Based on this approach, a task is defined by way of meaningful variables and can be kinematically solved using a dedicated Jacobian matrix [START_REF] Jamisola | A more compact expression of relative jacobian based on individual manipulator jacobians[END_REF].

Recently, the cooperative task-space representation has been used to perform physical human-robot collaboration [START_REF] Nemec | Bimanual human robot cooperation with adaptive stiffness control[END_REF], [START_REF]Adaptive human robot cooperation scheme for bimanual robots[END_REF]. A cooperative control scheme based on an impedance law allows performing kinesthetic guiding operations. Adaptation of the stiffness along the trajectory grants the human co-worker with more accuracy during critical parts of the task.

In this paper, we propose to extend our dual-arm kinematic controller presented in [START_REF] Tarbouriech | Mobile dual-arm collaborative framework[END_REF] to make it suitable for physical human-robot collaboration. In particular, we focus on improving the quality of interaction during the collaborative carrying of an object.

First, assuming that wrench sensory information is available at the arms' wrist, we perform the appropriate transformations to estimate external and internal wrenches applied to the object. Using vision, we take into account the contact point at which the interaction occurs to produce a motion that better reflects the human intention. We also propose a method to estimate and cancel the object's gravity effects during comanipulation. This way, the external wrench generated by the object's mass does not interfere with human action.

The dual-arm controller implements an admittance control law that uses the task space measures to process the command. Depending on how the parameters are tuned, different control modes are available and can be selected independently for each task variable. For instance, force control may be combined with pose control to maintain an object with the two arms while moving it in the workspace. Compared to previous works on human-robot co-manipulation, the decoupled control on the task space variables allows to better manage the robot's behavior, to enhance the safety and the human feeling during the interaction.

We demonstrate the efficiency of our approach by performing experiments on a dual-arm robot. We evaluate the benefits of our strategy through a table-moving scenario carried out in collaboration with humans. Using virtual reality, we are able [START_REF] Chiacchio | Direct and inverse kinematics for coordinated motion tasks of a two-manipulator system[END_REF], the absolute (subscript 'a') and relative (subscript 'r') tasks are controlled. The Task Space Adapter converts measurements (superscipt 'm') of joint positions m q and wrench m W 1 , m W 2 at the wrist of each arm into task space poses m xa, m xr, wrenches m Wa, m Wr and extracts task space Jacobian matrices m Ja, m Jr. The Dual-arm Controller then generates the command (superscipt 'c') at the task space level c ẋa, c ẋr from these feedback values and the desired (superscript '*') task space trajectory. Finally, the inverse kinematics provides the joint velocity command c q sent to the robot.

to quantitatively compare the task performance when taking into account human intention or not. We point out that this consideration leads to smooth and effortless interaction with humans.

The paper is organized as follows. Section II gives an overview of our kinematic control scheme for dual-arm coordinated motions. Section III deals with wrench considerations for human-robot collaborative carrying. In Section IV we describe the task space admittance control law. We show how safe the manipulation of objects and interaction with the environment are possible. We present an experimental study in Section V, showing the benefits of our method through an object transportation scenario using computer vision and virtual reality. Section VI states the conclusion and future prospects.

II. DUAL-ARM CONTROL SCHEME

The framework for dual-arm collaborative manipulators proposed in [START_REF] Tarbouriech | Mobile dual-arm collaborative framework[END_REF] relies on the online closed-loop control scheme depicted in Fig. 1.

The proposed strategy uses wrench feedback. It allows us to manage internal constraints to safely manipulate an object without any risk of breakage but also to perceive external forces, essential information to perform humanrobot physical interaction. We adapt the cooperative task representation from [START_REF] Chiacchio | Direct and inverse kinematics for coordinated motion tasks of a two-manipulator system[END_REF] in a more robust and generic form to specify dual-arm operations in terms of absolute task (i.e. expressing the pose of any frame in the space with respect to a fixed world frame) and relative task (i.e. expressing the pose of one end-effector with respect to the other), as depicted in Fig. 2.

The Task Space Adapter block is in charge of converting feedback data coming from the robot into relevant information in the task space. Joint position feedback m q is interpreted by the Forward Kinematics process to evaluate the current state in the task space: it outputs the poses m x a , m x r and Jacobian matrices m J a , m J r linked with the absolute and relative tasks, respectively. Wrench m W 1 , m W 2 (i.e., force and torques in operational space) measured at the tip of each end-effector are transformed by the Wrench Adapter block to have meaning in the task space through vectors m W a , m W r .

Given a task specification (e.g. waypoints to reach), the Trajectory generator will provide desired poses x * a , x * r and velocities ẋ * a , ẋ * r to follow for the task space variables. The desired task space trajectory as well as the task space feedback are sent to the Dual-arm Controller which delivers the joint command to the robot. This operation is decomposed in two successive steps. First, the Task Space Command is generated based on the admittance control law that we will present in Section IV. The process can be tuned for each task variable in order to choose between position, force, or damping control modes.

Finally, the Inverse Kinematics block is processed. Based on a Hierarchical Quadratic Programming (HQP) architecture, relative and absolute tasks are treated in a prioritized way to ensure the proper manipulation of objects. Joint limits and collision avoidance are included as hard constraints to be fulfilled at all times.

Throughout the rest of the document, we assume the following:

• The absolute task expresses the end-effector pose of Arm 1 with respect to some fixed world frame F w (superscript "w"). The corresponding homogeneous transformation matrix is T a = T w 1 .

• Arm 1 is taken as reference in the relative task definition, leading to T r = T platforms can be better exploited by allowing human-robot cooperation. Notably, co-manipulation of a shared object is an interesting type of interaction in an industrial context. This can be used to facilitate the displacement of an object, by letting the human physically guide the robot towards the target location without lifting the weight of the object. Also, it can be applied to perform "teaching by demonstration" operations. This allows to quickly reconfigure the task of the robot without programming.

To properly exploit the wrench information, it has to be meaningful from the task space perspective. This conversion is made by the Wrench Adapter block depicted in Fig. 1. To improve the quality of the interaction during human-robot collaborative carrying, this block implements sequential processes to generate the cooperative task wrenches, as shown in Fig. 3.

First, wrench feedback coming from sensors is interpreted at the task frames. Then, the object weight is removed from the external wrench, as this should not be considered when interacting with the human. By knowing the interaction location, external moments are finally adapted to follow human intention.

Further, by performing damping control on selected absolute task variables (see Section IV), the robot will follow the motion driven by the human operator interacting with it.

Wrench Adapter

Task space conversion Cancel object's gravity Retrieve human intent Fig. 3. The Wrench Adapter block is in charge of computing the cooperative task wrenches Wa, Wr from wrench measurements at the end-effectors W 1 , W 2 . After conversion in the task space, sequential operations are performed to first remove object weight from the absolute task wrench Wa and then retrieve human intention from the absolute task moment Ma.

A. Wrench evaluation in the task space

We detail here the role of the Task space conversion block from Fig. 3.

Let us assume that an object is held by the two endeffectors, as depicted in Fig. 4. Forces F i i and moments M i i are perceived at the arms' wrists (i = 1, 2) and gathered in the wrench vectors W 1 1 and W 2 2 that we write for simplicity

W 1 = F 1 M 1 T and W 2 = F 2 M 2 T
. By using the principle of "virtual sticks" [START_REF] Uchiyama | A symmetric hybrid position/force control scheme for the coordination of two robots[END_REF], the forces Fa and moments Ma exerted by the end-effectors at the absolute task frame F a are defined as:

Fa = F w 1 + F w 2 , Ma = M w 1 + p w 1,a × F w 1 + M w 2 + p w 2,a × F w 2 , (1)
where p w 1,a , p w 2,a , are vectors representing the "virtual sticks" joining at the absolute frame. The external wrench Wa = Fa Ma T corresponds to the resultant of all wrenches of the system applied to F a . It creates a linear mapping from the wrenches perceived at the end-effectors to the absolute task space.

The internal wrenches associated with the relative task do not affect the movements of the absolute frame, i.e. act in the null-space of Wa . There exists an infinite number of combinations of W 1 and W 2 that satisfy this condition. We keep the same definition as in [START_REF] Uchiyama | A symmetric hybrid position/force control scheme for the coordination of two robots[END_REF] to compute the internal wrench vector Wr = Fr Mr T :

     F r = 1 2 (F 1 2 -F 1 1 ), M r = 1 2 (M 1 2 -M 1 1 ). (2)
The internal wrenches are neither affected by the object's gravity nor by the interaction with the human. Thus, the vector Wr computed at this point corresponds to the final internal wrenches, such as Wr = W r .

B. Identification and cancellation of the objects' gravity effects

When performing physical interaction with kinesthetic guidance through a commonly held object, its mass permanently applies external wrenches that should not be interpreted as a human action.

To overcome this undesired behavior, we propose a practical method to estimate and then cancel the effects of the payload.

Similarly to (1), the perceived external wrench in the object's frame F o can be expressed with:

W w o = F w 1 + F w 2 M w 1 + M w 2 + F w 1 × p w 1,o + F w 2 × p w 2,o , (3)
where p w 1,o and p w 2,o denote the translation vectors going from each end-effector to the object's frame, expressed in the world's frame.

If we consider the manipulated object as a point mass under the sole influence of gravity (interaction being done at low speed/acceleration), this wrench can also be estimated as:

W w o = mg R w o c × mg , ( 4
)
where m is the mass of the object, c its center of mass, expressed in the object's frame, and g the gravity vector in the world frame.

When considering practical object manipulation, m and c are generally unknown or not well known. To estimate their parameters, one can collect measures while manipulating the object and use them in a non-linear optimization problem. Assuming that the grasping points are known, the problem can be formulated as follows:

min z W w o -W w o 2 s.t. m > 0, (5)
where z is the vector of optimization variables:

z = m c . (6)
Once z that satisfies (5) has been found, it can be used to cancel objects' gravity effects. This operation is performed by the Cancel object's gravity block from Fig. 3.

From the cooperative task perspective, the gravity effects of the manipulated object do not influence internal wrenches. They add however an additional component to the external wrenches, which should be subtracted to avoid interfering with the interaction.

Based on (1) and taking into account the objects' gravity effects, we can compute the external wrench vector Wa = Fa Ma T from which objects' gravity effects have been removed:

Fa = F a -mg, Ma = M a -R w o c × mg. (7)
In [START_REF] Kosuge | Mobile robot helper[END_REF], R w o is the rotation matrix expressing the center of mass c in the world frame.

The external force is not influenced by the location of the interaction during human-robot co-manipulation. The vector Fa computed at this point corresponds to the final external force, so that Fa = F a . Fig. 4. Assuming a rigid grasp, wrenches applied at the absolute frame Fa are reconstructed considering the "virtual sticks" p 1 and p 2 . Thereafter, external moments exerted by the human are retrieved from the "virtual stick" p 3 .

C. Retrieve human intention

During human-robot co-manipulation, the location on the object where the human exerts a force (called interaction point) has an incidence on what is perceived by the sensors. Indeed, considering the principle of levers, a linear force applied at some point of the object may create a moment at the grasping points. The bigger the object is, the more the perception is disturbed.

In [START_REF] Dumora | Experimental study on haptic communication of a human in a shared human-robot collaborative task[END_REF], Dumora et al. proposed a statistical model to identify the human intention during shared human-robot collaborative task based on haptic measures only.

In this work, we assume that the interaction point is known (e.g. using visual monitoring). Considering that the weight of the object has been priorly canceled, it is possible to infer the human intention by removing undesired components of the external moment vector Ma coming from the lever action. In contrast with [START_REF] Dumora | Experimental study on haptic communication of a human in a shared human-robot collaborative task[END_REF], this methods gives an accurate result.

Reusing the principle of "virtual sticks", one can easily retrieve the external moments M a applied at the interaction point from the following equation:

M a = Ma + F a × p w 3,a , (8)
where p w 3 is the translation vectors going from the absolute task frame to the interaction point, as depicted in Fig. 4. Note that the computed wrench is still associated with the absolute task control point defined by F a .

IV. TASK SPACE ADMITTANCE CONTROL

In an open-loop system, the task space command would be directly issued from the trajectory generator and converted into joint commands without worrying about the evolution of the robot and the environment. However, in an unstructured workspace in which physical interaction with human operators may occur, it is necessary to close the feedback loop. As presented in the previous section, the feedback data coming from the different sensors are interpreted in the task space. Here, the feedforward trajectory is combined with this information to adapt the command.

To let the robot interact with the environment, let us consider virtual spring-damper mechanisms attached to each control point, as illustrated in Fig. 5. The task space control law is deduced from the virtual spring-damper system dynamic equation:

W a = K a ∆x a + B a ∆ ẋa , W r = K r ∆x r + B r ∆ ẋr , (9)
In the remainder of this section, without loss of generality, we will treat the general case of admittance control applied to a single task space DOF (without distinguishing between the absolute and relative task), as there is no coupling between variables. Every term is now expressed as a scalar value. It gives:

W = K∆x + B∆ ẋ, (10)
with ∆x = x -x * , ∆ ẋ = ẋ -ẋ * being the error between the current and desired (superscript *) task pose and velocity, respectively. This equation relates the wrench W applied by the spring-damper system on the control point and the pose x of this control point by means of a proportional-derivative controller. The stiffness K and the damping B are the gain values for this DOF.

During dual-arm grasping of an object, it is often preferable to regulate the internal stress to prevent any damage to the object. To make this possible, we include the desired wrench value term W * in the previous equation:

∆W = K∆x + B∆ ẋ, (11)
with ∆W = W -W * expressing the error on the wrench regulation.

To realize admittance control, ( 11) can be rewritten in the following form: (c) Virtual objects seen in the HMD.

ẋ = ẋ * + B -1 (∆W -K∆x), (12)
Fig. 6. Human-robot co-manipulation of a large object using damping control. The interaction point is detected by the computer vision system. The current and target location of the object are displayed in the Head Mounted Display.

A. Scenario

The proposed approach has been evaluated through an experimental study conducted on the dual-arm cobot BAZAR [START_REF] Cherubini | A collaborative robot for the factory of the future: Bazar[END_REF]. To assess human intention consideration during cooperative manipulation, we set up an original simulated application scenario: selected participants were asked to achieve interactive tasks with the robot in the form of a table-moving scenario. The dual-arm robot is in charge of maintaining the table from one side by regulating internal efforts while the human operator grasps it on the opposite side with only one hand. The objective is to move the object, with damping control, from an initial pose in the space to a final one. The human motion should remain as natural as possible (taking the shortest distance to reach the goal and applying reasonable efforts).

During the experiments, participants wear a head-mounted display (HMD) in which the carried table is displayed both at the current (solid) and goal (transparency) location, as depicted in Fig. 6(c). The participants' task is to bring the solid object on top of the transparent one. The current pose is tracked online and its visualization in the virtual environment is updated continuously. This way, the user determines the motion needed to complete the task. Participants randomly execute the operation with/without the interaction point consideration without knowing it. A screenshot of the experiment is given in Fig. 6(a).

Three different operations have been elaborated for this study. In any case, the relative task is kept in a constant position on every component except for the z translational axis for which the force is regulated (to maintain the object properly). A damping term is added to the position control to give some compliance to the system. From a constant initial pose, a transform is applied to the absolute task for the three different cases:

1) trany+: translation of 25 cm along y axis. The user can move the object in the horizontal plane (in translation and rotation). 2) tranz+: translation of 25 cm along z axis. The user can move the object in the vertical plane in translation and rotate around y axis. 3) rotz+: rotation of 0.5 rad around z axis. The user can move the object in the horizontal plane (in translation and rotation). Video of the experiments is available at http://bit. do/e3mxM.

B. Setup

The BAZAR robot is equipped with two 7-DOF Kuka LWR4 arms. All experiments are performed on a computer with an Intel(R) Xeon(R) E5-2620 v3 CPU running Linux with the PREEMPT-RT patch. Our approach has been implemented in C++ using the RKCL framework. The Fast Research Interface Library (FRI) 1 is used to communicate with the Kuka arms, and the controller sample time was set to T = 5 ms.

We tune the gains depending on the control mode: for compliant pose control, we set B = 150, K = 250 for forces and B = 25, K = 40 for torques; same gains are used for damping controlled variables but the stiffness term is removed (K = 0); for force-controlled variables, the stiffness gain is also K = 0 while the damping term is B = 1000 for forces and B = 500 for torques.

We use computer vision to estimate online the position of the interaction point. The algorithm is based on the OpenPose library [START_REF] Cao | OpenPose: realtime multi-person 2D pose estimation using Part Affinity Fields[END_REF] which extracts the set of 2D points composing the skeleton of the persons present in a given color image. By using a Microsoft Kinect V2 RGB-D camera, we can reproject these 2D points in 3D using the depth information provided by the sensor, as shown in Fig. 6(b). We use the right-hand wrist as the interaction point since OpenPose doesn't provide a point for the hand itself. This allows us to position the point of interaction with an accuracy of a few centimeters 2 , which is sufficient for our application. In 1 https://cs.stanford.edu/people/tkr/fri/html/ 2 Accuracy decreases with distance due to depth inacuraries the case of occlusions, the last interaction point, expressed in the absolute frame, is kept. This hypothesis holds as long as the operator does not reposition his/her hand while the occlusion occurs. By using an NVIDIA GTX 1080 Ti GPU, we achieve around 7 estimations per second.

As mentioned in V-A, in order to get reproducible and accurate results to validate the proposed approach, we set up a virtual reality (VR) system to instruct the operator on the task to achieve. This system is composed of an HTC Vive Pro HMD, an HTC Vive tracker attached to the transported object and two fixed Steam VR base stations. This VR system was only used for validation purposes and is not required in normal operations. Fig. 7. Statistical data comparing several metrics for the three different tasks when the interaction point is taken into account (orange) or not (blue). Results showcase the benefits of our method since less effort is required by the to achieve the tasks.

C. Results

Ten participants performed a total of 15 operations (five for each case, selected in random order). Several criteria have been evaluated and statistical results are given in Fig. A general observation is that the interaction point consideration greatly improves task performances. Indeed, the various metrics indicate that all the tasks can be completed effortlessly when the interaction point is known (orange bars) while it is much more difficult otherwise (blue bars).

A closer look reveals that the differences are more noticeable for the translation tasks for which the necessary energy is between 2.5 (for the trany+ task) and 7.9 (for the tranz+ task) times higher when the interaction point is unknown. By contrast, the gap is smaller for the rotation task with a ratio of 1.5 for the average energy. The power consumption is even equivalent in this case with around 0.3W on average. Referring to [START_REF] Takubo | Human-robot cooperative manipulation using a virtual nonholonomic constraint[END_REF], this can be explained by the fact that the interaction point has an influence on the final wrench only in the presence of translational forces. In practice, it is almost impossible to apply perfect torque on the object without exerting any residual translation. Thus, the surplus energy supplied to complete the rotx task without interaction point may result from the greater effort generated to compensate for the translational error (1.3N against 0.6N), as the motion is less intuitive in this case.

The task tranz+ is the one that shows the strongest contrast when comparing the metrics. In particular, the maximum values are extremely higher when the interaction point is not taken into account. This is also the task in which the data are the most irregular (highlighted by standard deviation significant values). It seems that, depending on the participant, the unwanted torque generated when the interaction point is omitted creates some orientation error that is not trivial to compensate. It would appear that a task on the horizontal plane is easier to get under control when some error occurs.

The completion time is significantly influenced by the method that is used, and is more dependent on the person realizing the task.

VI. CONCLUSION

This paper addressed the problem of object comanipulation with a dual-arm robot, which is a very attractive kind of human-robot collaboration for industrial purposes. Indeed, combining the skills of humans (intelligence, versatility) with the powerful capabilities of robots (precision, repeatability) has a tremendous potential to increase the productivity of the manufacturing industry.

However, physical interactions between robots and humans have to be executed under adequate conditions to be natural and efficient. For that purpose, we extended our previous works on dual-arm kinematic control strategy to include new considerations which aim at improving the quality of cooperative tasks. Notably, we developed an online method for estimating gravity parameters of the manipulated object. Then, by applying some treatments on the wrench feedback data during collaborative operations, we are able to compensate the load exerted on the robotic arms to keep only external efforts applied by the human.

Furthermore, the human's contact location with the object is crucial information allowing to retrieve his intention from wrench measured at the arms' wrist. An experimental study has been elaborated to simulate a table-moving scenario using a virtual reality system and computer vision to detect the participant's hands during co-manipulation. The results clearly indicate that considering the interaction point is beneficial for co-manipulation tasks as it is more intuitive and thus requires less energy to be completed. Future works will be dedicated to validate the approach with different objects of various shapes and on more complex tasks.

Fig. 1 .

 1 Fig.1. Dual-arm kinematic control scheme. Based on the cooperative task representation[START_REF] Chiacchio | Direct and inverse kinematics for coordinated motion tasks of a two-manipulator system[END_REF], the absolute (subscript 'a') and relative (subscript 'r') tasks are controlled. The Task Space Adapter converts measurements (superscipt 'm') of joint positions m q and wrench m W 1 , m W 2 at the wrist of each arm into task space poses m xa, m xr, wrenches m Wa, m Wr and extracts task space Jacobian matrices m Ja, m Jr. The Dual-arm Controller then generates the command (superscipt 'c') at the task space level c ẋa, c ẋr from these feedback values and the desired (superscript '*') task space trajectory. Finally, the inverse kinematics provides the joint velocity command c q sent to the robot.

1 2 .Fig. 2 .

 22 Fig. 2. Cooperative tasks representation. The absolute task expresses the pose of any arbitrary frame in the space (F ctrl ) with respect to a fixed world frame (F ref ). The kinematic chain associated with this task uses only one arm and virtual links for joining the frames of interest. The relative task expresses the pose of one end-effector (F ctrl ) with respect to the other (F ref ).

Fig. 5 .

 5 Fig. 5. Representation of the virtual spring-damper systems attached to the relative and absolute task control points.

V

7 .

 7 Instantaneous power P has been obtained using the relation P = | -→ W • -→ ẋ | and the average energy Ē expended during a time interval ∆t arises from Ē = P * ∆t; P being the average power supplied during the same time interval.

ACKNOWLEDGMENT

This work has received funding from the EU H2020 research and innovation programme as part of the project VERSATILE (grant agreement No 731330).


Marian Brestic
email: marian.brestic@uniag.sk

André Rossi
email: andre.rossi@dauphine.psl.eu

Oksana Sytar
email: oksana.sytar@gmail.com

Marek Zivcak
email: marek.zivcak@uniag.sk

Marián Brestič

Marek Živčák

Optimization issues in phenotyping plateforms

Keywords: Biology, Phenotyping plateforms, Scheduling, Optimization

Introduction

The combined effects of climate change and population growth have made agriculture appear as one of the most important challenge of the century. In order to be able to produce food for everyone in the coming decades, there is an urgent need to build more knowledge about plants, and how to grow them in a sustainable way, i.e., how to produce enough biomass without resorting to pollutant chemicals inputs. Hence, plant biologists need to understand what makes plants resistant to diseases, parasites, insects and hydric stress, among other environment effects. The functional plant body, called the phenotype, is the result of the combination of the plan genotype with the environment : two plants with the same DNA will not have the same development under different environment conditions. As the so-called plant performance is the result of phenotype, a lot of effort has recently been devoted to study plants phenotype. More specifically, biologists run large scale experiments on hundreds or thousands of plants, for example to determine how resistant is a particular plant to a wide range of environment conditions. To this end, the plants are settled in pots, and these pots are moved by a conveyor belt from a cultivation chamber to different quantitative automated measurement stations, where RGB cameras, spectrography and other techniques are employed to monitor plants growth on a regular basis. The European project EPPN2020 [1] aims at gathering a large number of such facilities to share experience and accelerate the research progresses in plant biology. It currently involves 31 plant phenotyping platforms and 21 partners across Europe from 12 countries (including the Slovak University of Agriculture in Nitra), under the coordination of INRA, with a budget of e10 million for four years. It can be observed that the phenotyping platforms available in EPPN2020 and everywhere else in the world have a very similar structure (see Figure 1).

FIG. 1 -A synoptic view of the phenotyping platform in Nitra

The exploitation of these phenotyping platforms poses some challenges that are analogous to the issues raised by traditional manufacturing or production systems, along with some specific features. We present below a list of problems that have been identified in the phenotyping platforms.

Maximizing the throughput

Phenotyping platforms are sometimes called high-throughput phenotyping platforms, for conveying the idea that they should be able to perform a many measurements in a short amount of time. Hence, as a first approach, a phenotyping platform can be modeled as a permutation flowshop. Indeed, the conveyor belt system does not allow a pot to overpass the pot that is located ahead of it on the conveyor belt, and since no by-passes are available, all the plants visit all the stations in the same order. As the biologists sometimes do not require all the plants to undergo al the measurements, a possible problem variant is to decide which plants to send to which measurement stations while fulfilling the minimum measurement requirements.

Ensuring an equal lighting to all plants

Plants development is very sensitive to light, so when comparing different kinds of environmental conditions, it is important to ensure that all the plants have received the same amount of light. Even if the phenotyping platforms in greenhouses like the one in Nitra are equipped with controlled agriculture-specific LEDs light systems, all the plants standing in the cultivation chamber do not receive the same amount of light, with differences that can reach 30%, which is sufficiently large to bias the results of the experiments. This is due to the fact that upgrading the lighting system would be very expensive, and would increase the energy consumption of the phenotyping platform. This problem is usually addressed by moving the plants randomly in the cultivation chamber during the night [2], which is considered a satisfactory approach only if applied over a sufficiently long period of time. Here also, optimization methods can be used to minimize the maximum gap between the amount of light received by any pair of plants in the system.

Conclusions et perspectives

The scheduling problems identified in this work will be presented in more details during the conference, along with some solutions applied to real instances.

Acknowledgment

This work was supported by a grant from Campus France, under the scheme of a Partenariat Hubert Curien Stefanik number 40491QC and corresponding Slovak project APVV-SK-FR-2017-0007.

Références

[1] EPPN2020. https://eppn2020.plant-phenotyping.eu/

[ 2 ]

 2 C. Brien, B. Berger, H. Rabie and M. Tester. Accounting for variation in designing greenhouse experiments with special reference to greenhouses containing plants on conveyor systems. Plant Methods, 9(5220), 2013.


Hugues Bonnin
email: hugues.bonnin@continental-corporation.com

Olivier Flebus
email: olivier.flebus@continental-corporation.com

Data & Safety: challenges and opportunities

Keywords: Holistic Safety, Road Traffic Safety, Data, Datadriven approach, Data Engineering, Data Governance, System Engineering, Data vs. Software, Systems of Intelligence. I

This article presents our first analysis exploring the relationships of safety and data in the context of improving the safety of road vehicles, which will be connected and more automated in the future.

INTRODUCTION

"Safety First" has always been a core principle in transport industries, even if it has been analyzed and concretely declined into different safety approaches and standards in the aeronautics, railway and automotive domains. Several key standards have emerged over time, mainly focusing on how to engineer safe systems [START_REF]Road vehicles --Functional safety[END_REF] [START_REF]SAE ARP4754A Certification considerations for highly-integrated or complex aircraft systems[END_REF]. With the increased role of software in dependable systems, the question "How to engineer safe software?" has been addressed as well (in most cases from the point of view of the system integrating the software) [START_REF]Road vehicles --Functional safety[END_REF] [START_REF]RTCA DO178C software considerations in airborne systems and equipment certification[END_REF].

Data-driven approaches have emerged with the rise of the Internet and the digital transformation in almost every domain. Even if the Big Data real innovations (e.g. easier development and operations of distributed systems at scale, releasing sometimes unnecessary constraints with eventual consistency…) have been turned into a hype, there is no doubt that in many domains data is considered as a key asset for the organizations that can collect them. A key asset that can be leveraged as a competitive advantage and a defensibility against competitors.

We propose to address the following basic questions:

• What is (and will be) the role (and the importance) of data in the future automotive applications? For sure data could harm those systems. But could data also bring benefits?

• How to address the rise of data in dependable systems? Are existing safety standards for systems and software ready to integrate the new data-driven stakes? II. DEFINITIONS In our analysis, we use the following definitions for Information and Data (according to [START_REF]Information technology -Vocabulary[END_REF]):

• Information: knowledge concerning objects, such as facts, events, things, processes, or ideas, including concepts, that within a certain context has a particular meaning.

• Data: a reinterpretable representation of information in a formalized manner suitable for communication, interpretation, or processing.

That notably means that in our analysis information concern both humans and machines, while data apply to information that has been digitalized to be managed by machines (including in a human-understandable way).

III. CONTEXT AND ASSUMPTIONS

We list here the assumptions that we have chosen neither to describe with details nor to justify in this short paper. They could of course still be discussed and formalized in a longer version of this article.

(1) The future of mobility (and thus the future of automotive) implies more automated driving and autonomous vehiclesand a key motivation for that is the expected improved Road Traffic Safety.

(2) The future of mobility implies connected vehicles. Beyond single vehicles, connectivity drastically increases the complexity of the involved systems, dealing with interactions between thousands or even millions of vehicles and infrastructures systems.

(3) Beyond the automation and the connectivity, the (digital) cooperation between people, vehicles and infrastructures is key for Intelligent Transportation Systems. With regards to the impacts for safety, it brings unprecedented complexity levels on the challenge side, but also redundancy and other opportunities.

IV. STATE OF THE ART IN DATA SAFETY

We have initiated an analysis of current standards that could contribute to the definition of data safety. Multiple topics are covered, for instance:

• Standards dedicated to the connected vehicles [START_REF]2017 Road Vehicles --Extended vehicle (ExVe) methodology[END_REF] or Intelligent Transportation Systems (ITS) (ISO TC 211, ISO TC 204, CEN TC 278, CEN TC 226)

• Standards dedicated to maps, e.g. from the Open AutoDrive Forum (OADF)

• Standards addressing data quality [START_REF]Software engineering --Software product Quality Requirements and Evaluation (SQuaRE) --Data quality model[END_REF][7] [START_REF]Geographic information --Data quality[END_REF] • The data safety guidance [START_REF]SCSC-127D Data Safety Guidance (Version 3.1[END_REF] • Data standards used in other domains (i.e. [START_REF]A Standards for Processing Aeronautical Data[END_REF])

A very (very!) rough conclusion of this first analysis could be expressed as follows: existing standards for data don't address safety stakes beyond data quality and existing safety standards for automotive (and more generally dependable) systems don't address modern data stakes. For these standards, we identify as a limit the fact that the data safety is only considered as a result of its processing by systems, and that nothing is established on the information that it contains, or on which it is based.

V. A SIMPLE INFORMATION FLOWS MODEL FOR ROAD TRAFFIC SAFETY

A. Road Traffic Safety is not only about road vehicles

It would be a mistake to consider that vehicles should be the unique way of improving the road traffic safety. As increasing automation necessarily involves that humans do less things, it seems natural to consider the safety as a whole, including the way we currently deal with human faults (using a mobile phone while driving for instance) but also the human intelligence that in some cases is the last and unique way to prevent accidents. More generally Road Traffic Safety depends on multiple actors and information, not only vehicles! For instance:

• Road users: drivers in/with a vehicle, but also pedestrians, animals

• Regulations concerning drivers: driving license, restrictions related to alcohol, drugs or mobile phones.

• Regulations concerning vehicles for their safety, emissions, etc. Attached to mandatory vehicle inspections in many countries.

• Road Infrastructures: road signs, safety barriers, speed bumps, etc.

B. A very simple Information (data) flows model as a starting point

In our context of more automated vehicles and holistic road traffic safety, we considered a deliberately simple model to identify the information flows that are involved in driving activities (Figure 1).

The driver and the vehicle working together form a man-machine system that is critical for the safety of the transportation. In his/her driving activities, the driver mainly analyses the environment (including the other vehicles), monitors information produced by his/her vehicle, and acts on the vehicle to adapt his/her trajectory and more generally behavior.

Historically, the vehicle has been helping the driver to sense the environment (with wipers and lights for instance) and to enforce the relevance and the compliance of his/her behavior (comply with speed limits, stop when a fault is detected). More recently, vehicles have developed the ability to sense information from the environment, providing support to the driving activities, in some cases targeting "suprahuman" sensing capabilities in specific domains (e.g. radar sensing).

C. Can we separate (human) intelligence from information?

Exploring the dynamics of the previous model, and still considering that the human driver keeps making the main decisions regarding the driving activities, it appears that there's a whole class of knowledge (information) that are involved into the human decision-making process. Example of information that fall into that category are:

• Laws & regulations: common (in the sense of international) and country-specific driving rules (checked with a driving license).

• Information learned by drivers through their driving experience, which could improve the driver's ability to anticipate hazards…and also reduce driving attention and discipline during routine, daily trips.

• All the softer rules, social contracts and human judgments, for instance the ones that regulate heavy congested situations, leaving way to another vehicle even though driving rules don't say so.

D. What about all the data that are produced and processed in vehicles?

In a similar way than the fact that there are a lot of pieces information behind the human intelligence, there are a lot of data in vehicles to ensure its expected (and safe) behavior. Using those data for other purposes outside of the vehicleand complying to laws and regulations like GDPRis at the core of our motivation for our work.

E. Mapping Road Traffic Safety to our simple information flow model

Starting with our simple information flow model, what can we say about the safety questions that arise for each information flow? The Figure 2 gives a few examples:

As explained previously, Road Traffic Safety includes a very wide scope of questions in multiple domains (driver, infrastructures, vehicles). What we see also is that a very high diversity on information types is involved, including ones that are -for now -only accessible to humans. That concerns especially soft rules and social contracts. By the way, we can consider the safety itself as a social contract, mixing acceptable safety for the population, and eventual negotiations between stakeholders.

VI. PROPOSED APPROACH & NEXT STEPS

A. Data outside of Systems

It can be deduced from assumption (1) that in order to improve safety, a certain amount of information currently managed by the human driver must be handled by the vehicle. However, this transfer is accompanied by a considerable increase in the complexity of the resulting system, as we can guess from "V. A simple information flows model for Road Traffic Safety". Indeed, whether to manage the anticipation of events that will be encountered on the route (see beyond the horizon), or access knowledge about the weather and its consequences on traffic or driving conditions, or driving rules, including temporary or implicit rules of conduct, the car is necessarily connected. This extension of the information to be managed creates complexity, as we have stated in assumption (2). However, this new complexity is hardly compatible for us with the analysis and design of systems, including system of systems, as it is traditionally done: by defining a system at the highest level, and by breaking it down by refinement to products at lower levels, including equipments inside a vehicle. Moreover: this approach would very quickly meet another limitation: the differences of life cycles between the components of this giga-system, which means that some are operated even before others are defined.

To face up this complexity, we propose to reason directly on the information, and to apply a safety-oriented thinking on this flow of information. This inverts the common approach of This results in the data being considered as being outside of the systems. This point of view is a way to answer to the limit previously highlighted at the end of "IV-State of the art in data safety". By the way, it enables the decoupling between systems that produce, consume or manage data, necessary to address the differences of lifecycle stated above. This approach enables to consider end-to-end chains of trust, from the sensing/production of data to the consumption of knowledge. It relies on introducing transverse data checkpoints in the chain that enable systems to have their own different lifecycles and characteristics, while establishing confidence for whole chain.

This approach is not replacing the traditional way of dealing with data inside systems (and software). It comes in addition to the system-driven approaches, characterized by the following property: the trust we can have in data at system run-time comes from the trust we have in the system at development time.

B. The "Minimum Viable Chain of Trust" that combines

Systems & Data Following our principle to decouple systems using data checkpoints, we propose the following minimum viable chain of trust that combines systems and data (Figure 4):

• Sensing Systems can be embedded in vehicles or in infrastructures. Logging systems, even not attached to physical sensors, are considered as sensing systems in our analysis.

• Sensing systems are the main sources of data, as Observations, for which we strongly propose that should be considered outside of the system that have generated them, with their own quality and safety attributes.

• Systems of Insights or Systems of Intelligence that turn multiple input data (Observations) into new data (Knowledge) with additional value. This knowledge generation happens according to its own lifecycle, different from the lifecycles of the observations.

• The different kinds of knowledge produced by the Systems of Intelligence are also to be considered apart, like observations.

• Data-& AI-powered systems & services represent the last link of the chain in the context of connected vehicles. They consume knowledge, once again according to their own lifecycle. A typical example is Advanced Driving Assistance Systems (ADAS) that work according to their own "Sense, Plan, Act" operation principle, the knowledge being "plugged" to the "Plan" phase, enabling intelligence. Indeed, this knowledge has been elaborated through the collection of observations, which are senses of other vehicles, and a fusion and compilation of these observation to a knowledge, which is a sort of collective intelligence.

C. Safe Data

A key objective regarding data safety is to define what safe data (and safe knowledge) could mean. The quality attributes of the data are naturally essential for this, using for example the characteristics defined in [START_REF]Systems and software engineering --Systems and software Quality Requirements and Evaluation (SQuaRE) --Measurement of data quality[END_REF]. For data close to sensors (observations), those attributes are directly linked to the characteristics of the sensing system that has produced the data.

For instance, it seems safe to collect observations stating that a vehicle has detected a loss of traction for one or more of its tires (skidding) through its Electronic Stability Control (ESC) system.

The problem is much more difficult when considering the distilled, transformed data (knowledge). The value of the knowledge should be defined, and the core work to do on data safety is precisely on this topic. Among the ideas that could be considered (non-exhaustive list):

• the quantity (diversity, representativity) and quality of source data is of high influence.

• the complexity of the algorithm mixing the source data can influence the final quality.

• a probability of error should be introduced, for instance when the distillation uses stochastic models (and distinguish false positive and false negative is key). Keeping the same previous example, would it still be safe to consolidate all the skidding observations from multiple vehicle into a slippery road conditions warning? Would additional information be needed or relevant (like the temperature to help explain that there may be ice on the road)? When would it be safe to predict that the ice may be gone? What if a vehicle does not detect skidding at this location? How to differentiate ice from oil as a cause to slippery road conditions?

Let's assume that we could build a "map" of all those kinds of events, on which criteria could we consider that it's safe for a vehicle to drive autonomously? Obviously, the positive impacts and benefits from additional knowledge must be balanced with the risks of making decisions based on erroneous information. This balance exercise directly helps in the definition of the operation design domain (ODD) defined in [START_REF]Road vehicles -Safety of the intended functionality (SOTIF)[END_REF].

Additionally, in the context of autonomous driving, the location of geographical information is clearly safety-related. Then the choice of how the location is established (including the physical mean), and the way that this location is represented by data will directly enter in the confidence level of the geographic information. For example, a speed limit can be attached to a large road segment, based on the location of the speed limit sign which can be approximative (5-meter accuracy); on the other side, the curvature of a bend must be precisely located, and this location properly described (center of curvature, special points of the curve, etc.).

In other words, we can imagine an approach of the safety design centered on data: the exercise would consist in choosing which data is necessary to enhance the safety of a transport function (for example), considering all the valuable data, fostering the usage of available data, pushing the collection of other new data, evaluating the confidence potentially associated to these data, and the ways of mitigating the potential lack of confidence by another loop in this data investigation, or by alternative means (i.e. usage of another known subsystem). or transfer safe data For simplification purposes, our minimum viable chain of trust deliberately omits telecommunication systems that transfer data between systems, and storage/access systems that enable lifecycles to be decoupled. We believe that the traditional quality criteria such as integrity, availability, confidentiality, lineage and response times provide the right foundation so that those systems deal with safe data, but further analyses are yet to be conducted.

Our minimum viable chain of trust also describes only the case when the last link of the chain is a in-vehicle system (that can rely on off-board knowledge). For that case and more generally for all in-vehicle systems, the safety analysis context is the one defined by [START_REF]Road vehicles --Functional safety[END_REF] and [START_REF]Road vehicles -Safety of the intended functionality (SOTIF)[END_REF].

A key question is then "What does it mean for an automotive system [START_REF]Road vehicles --Functional safety[END_REF] or intended function [START_REF]Road vehicles -Safety of the intended functionality (SOTIF)[END_REF] to consume safe data or knowledge?"

To answer that question, it's crucial to come back to the objectives of the last link of the chain, the actual use case. Using the same weather information for optimizing the energy consumption on one hand and for "calibrating" an emergency braking system on the other hand defines two distinct safety contexts. We believe that we have to introduce some levels of safety for data in order to address this point: depending on its usage by the critical system or function, a data item must have a minimum level of safety corresponding to the criticity.

E. Define Safety for Systems of Intelligence

Systems of Intelligence produce safe data (or knowledge). They rely on principles and approaches (cloud computing, distributed systems with specific fault-tolerance solutions, AI, crowdsourcing…) for which there is no or a little experience regarding safety analyses.

We believe that a new area should be opened for the safety of those systems. Two aspects at least should be studiedand balanced: how to make those systems reliable and robust enough, and how to make them produce safe data.

VII. CONCLUSION: OUR VISION FOR DATA SAFETY

We have seen that the changing mobility landscape invites to reconsider some aspects of global road traffic safety. Among them, visit and challenge the way data interacts with safety seems to be promising.

On the one hand, to enhance safety, we need more information to give more autonomy to systems, but without losing the huge adaptation abilities of humans. This leads us to ask if safety activities should go from a system-centric view to a data-centric view. Doing so would open the opportunity to build a safety based on decoupled systems, allowing a high level of complexity and dynamic configuration, based on the idea that more and better data means more confidence. The obvious condition to that benefit is that the initial data (the observations) are to be produced with a known level of confidence.

On the other hand, there is a lot of work to make this shift happen! As any novelty in the quite conservative world of safety, we must show that the new introduced risks are positively balanced by the overall safety enhancement. At the heart of the problem, we must elaborate the rules, the guidance to build safe data (knowledge) based on source data (observations). We must build new criteria and measures, study how they could be linked to existing standards (for system and software). Finally, we must see which types and which level of rules and standardization would best fit systems of intelligence.

Figure 1 :

 1 Figure 1: A simple model for Information flows in driving activities

Figure 2 :

 2 Figure 2: Examples of safety-related questions mapped to information flows

Figure 3 -

 3 Figure 3 -Data not in systems

Figure 4 :

 4 Figure 4: The "Minimum Viable Chain of Trust" that combines Systems & Data

This work cannot be achieved by a single enterprise, it requires a whole community, and more than that: a new whole community! A community bridging the gap between (at least) two different worlds: the data-digital-web-IT world and the system-and-safety world.


Nikita Bhardwaj Haupt
email: haupt@cs.uni-kl.de

Peter Liggesmeyer
email: liggesmeyer@cs.uni-kl.de

Systematic Specification of a Service Safety Monitor for Autonomous Vehicles

Keywords: safety monitoring, safety monitor, safety rules, autonomous vehicles

Autonomous vehicles are complex safety critical systems that operate in uncertain and dynamic environment. To ensure safe behavior, possibly at all times in all possible situations, they must be aware of themselves, their environment and take decisions accordingly. To this end, safety monitoring is a valuable technique that allows the vehicle to observe its behavior and trigger corrective measures in case of any violations. In this paper, we present a systematic specification for such a safety monitor. The monitor is a collection of safety rules that are obtained by performing hazard and risk analysis based on the operational mode and environmental situation of the vehicle at the time of the hazard. The rules act like safety constraints for the vehicle and in case of a violation generate a trigger to bring vehicle back to a safe state.

I. INTRODUCTION

Autonomous vehicles are complex safety critical systems that operate in diverse and dynamic environment. Due to complexity of the system and unpredictability of the environment, it is challenging to anticipate all potential system behaviors at design time. As a consequence, it becomes difficult to determine which system behavior is appropriate in which situation at runtime. Under such circumstances, one way to ensure safe behavior is to supervise the vehicle by observing the failures causing hazardous situations and handling them at the time of its execution.

As defined in [START_REF] Avizienis | Basic Concepts and Taxonomy of Dependable and Secure Computing[END_REF], safety is "the absence of catastrophic consequences on the user(s) and the environment". Based on this definition, safe behavior of an autonomous vehicle can be defined as the capability of the vehicle to accomplish its tasks (e.g. driving), make decisions according to the changes in itself or the environment and at the same time ensure safety. The magnitude of safe behavior depends upon the level of autonomy, likelihood of human intervention and the environmental context. For instance, in presence of a human driver, a system malfunction can be tolerated by switching-off the function and giving driver the complete control of the vehicle. However, in case of a fully-autonomous vehicle, in the absence of a human assistance, the vehicle must be capable of detecting and tolerating a safety critical situation on its own. Safety critical situations can arise due to random errors in hardware components (e.g. sensors) or due to unsuitable environmental conditions at runtime. These situations often cause an unplanned behavior of the vehicle, which in a certain situation could result in a hazard, or even an accident, if left undetected. Since, it is unknown at design time in which situation which random error would occur and lead to a hazardous event, to maintain safe behavior, it is essential to be aware about it on the first place.

This can be achieved by monitoring the vehicle by means of a safety monitor that observes its behavior and trigger corrective measures in case of violations. Monitoring safety of the vehicle at runtime complements traditional safety assurance as it aids in finding design time as well as runtime defects that could potentially occur in software or hardware due to unexpected environmental conditions or runtime faults [START_REF] Koopman | Challenges In Representing CPS Safety[END_REF].

This way safety monitoring acts as a fault tolerance technique where, the fundamental task of the monitor is to continually administer the system for violations and bring it back to a safe state in the event of safety critical deviations [START_REF] Mekki-Mokhtar | Safety Trigger Conditions for Critical Autonomous Systems[END_REF]. A safety monitor, sometimes coined differently as safety manager [START_REF] Pace | A safety integrated architecture for an autonomous safety excavator[END_REF] or safety bag [START_REF] Klein | The safety-bag expert system in the electronic railway interlocking system Elektra[END_REF], equipped autonomous vehicle acts like a self-aware system [START_REF] Schlatow | Self-Awareness in Autonomous Automotive Systems[END_REF] capable of altering its behavior in response to the change in the environment or its own components to maintain safety.

In this paper, we present a systematic procedure for specifying such a service safety monitor, a sub-module of a service monitor, that monitors the vehicle for safety critical deviations using a set of safety rules. These rules are derived by performing hazard analysis of the deviations occurring in vehicle services in a particular scenario during a specific operational mode. The monitor ensures safe behavior of the vehicle by triggering corresponding corrective measures in case of detected deviations.

The rest of the paper is organized as follows: In Section II, we present the definitions used in our approach followed by a detailed and a stepwise specification of the safety the monitor. In Section III, we conclude this paper summarising the proposed monitoring approach.

II. SAFETY MONITORING APPROACH

As demonstrated in Fig. 1 (a), safety monitor encompasses three modules: a System Service Monitor (SSM), Configuration Evaluation (CE) and a Knowledge Base (KB). SSM is the principal module of the safety monitor. It is a collection of safety rules which are obtained at design time via Hazard and Risk Analysis (HARA) [START_REF] Bhardwaj | A Runtime Risk Assessment Concept for Safe Reconfiguration in Open Adaptive Systems[END_REF]. Each rule represents planned behavior of the component and its corresponding potential safety-critical deviations. The primary task of SSM is to monitor these deviations as they occur and trigger CE for a safety measure. The main goal of CE module is to evaluate the safety of the vehicle in accordance the currently activated operational mode and take safety measures, if necessary. This is accomplished by carrying out a runtime risk analysis [START_REF] Bhardwaj | A Conceptual Framework for Safe Reconfiguration in Open System of Systems[END_REF] based on the system information stored in the KB that acts like a knowledge repository that assists CE with system evaluation at runtime. The risk assessment procedure implemented in CE is out of scope of this paper, and thus not discussed further.

A definitive step-wise procedure of runtime safety monitoring is described in Fig. 1 (b). Safety monitor implements a knowledge-based system monitoring which can be outlined as a sequence of four consecutive computations:

Monitor-Analyze-Evaluate-Respond (MAER). The monitoring and analyses is performed by SSM. In case of safety-critical deviations, SSM triggers CE that evaluates risk associated with the vehicle and takes safety measures as a response to those deviations.

By means of a safety monitor we employ runtime monitoring to ensure safe operation of a vehicle (or its components). This is achieved by actively monitoring the currently activated configuration for safety critical deviations in its services. In this manner, our monitoring approach does not aim at fault prevention or fault removal but, at fault tolerance by detecting them and prompting safety measures to avoid any unsafe situations. The behavior of the monitor is a declarative collection of safety rules, where each rule represents the safety status of the vehicle and its corresponding restorative measure. To derive these rules and a systematic specification of our service monitor, we perform the following procedure:

I. Firstly, we determine all operational modes of the vehicle along with their potential configurations that can be activated during operation. II. Secondly, we ascertain complete set of services associated with each configuration for their respective operational modes. III. Thirdly, we perform hazards and risk analysis to identify the potential deviations in services that could result in hazardous situations during operation. IV. Lastly, we assign these deviations an integrity level based on the risk associated them. We then analyse dependencies between services and their deviations for a given operational mode and environmental situation, followed by constructing safety statuses and corresponding measures to form the rules.

Step I. Operational Modes and Configurations: First and foremost, we begin with determining all possible operational modes (OPM) that a vehicle is capable of. An OPM represents the level of autonomy with which system is operating. We classify them into: fully-autonomous (AM), semi-autonomous (SM) and manual mode (MM). A fully-autonomous mode is where all configurations of the vehicle are capable of carrying out all operations automatically i.e. without the presence of a human driver. However, in case of the other two, presence of a human driver is always required.

Subsequently, we determine the potential configurations for each operational mode. At the moment, all configurations are pre-determined at design-time. Each mode can have multiple configurations out of which only one can be activated at a time. Normally, configurations differ from each another in terms of functionality or redundancy. For instance, in case of Tractor Implement Automation (TIA) [START_REF] Hoyningen-Huene | Tractor-Implement-Automation and its application to a tractor-loader wagon combination[END_REF], a tractor (Trac) can have separate configurations for different implements1 e.g. a baler or a harvester, or

T rac AM Cf 1 , T rac SM Cf 1 , ... = Bal T rac OP M i potCf j , Bal AM Cf 1 , Bal AM Cf 2 , Bal SM Cf 1 , ... = Bal OP M m potCf n (1)
Identification and categorization of the potential configurations based on their operational modes has a twofold advantage: On the one hand, it assists in ascertaining the possible collaborations profiles (CollabProf ) between multiple configurations of the vehicle and its implements in different operational modes. On the other hand, it aids in an intensive hazard analysis. This due to the fact that, both the risk, associated with a particular deviation, and the magnitude of the corresponding safety measures to ensure safety, depends upon the activated configuration and the mode in which vehicle is operating.

T rac AM

Cf 1 ::

Bal AM Cf 1 :: SwSc AM Cf 1 ∈ CollabP rof 1 , {CollabP rof 1 , CollabP rof 2 , ...} = CollabP rof n Bal (2)
In TIA, for each implement, there exist at least one collaboration profile to carry out the implement specific task. The equations above manifest an exemplary collaboration profile that consists of configurations of a Trac, Bal and a SwSc collaborating together to render baling. In this case, the tractor as well as the baler support multiple operational modes and configurations. Thus there exist multiple potential collaboration profiles for carrying out baling specific tasks.

Step II. Services and Potential Configurations: Once we have all operational modes along with their potential configurations, the next step is to determine services associated with each of those configurations. Each configuration has a set of services that includes both required and provided services. Required services (rs) are the ones that a configuration receives from another components, whereas provided services (ps) are the services that a configuration renders for other components and their configurations. The reason behind ascertaining all services of a configuration is to filter the safety critical services from the non-safety critical ones. Typically, deviation in a required service influences the provided service thereby, causing an unplanned behavior of the entire configuration. For instance, a deviation in the speed sensor of the tractor results in an incorrect value of vehicle speed (vehspd). As a consequence, the tractor doesn't decelerate while steering thereby, loosing control over itself. However, it is also possible that the provided service suffers a deviation despite of no deviation(s) in the required services. Regardless of whether the deviation is at the required service or at the end of provided service, it results in an unsafe and unplanned behavior of the configuration thereby, in a hazardous situation of the entire vehicle.

Step III. Hazard and Risk Analysis: After identifying the set of safety critical services, we perform hazard and risk analysis to analyse their possible deviations and their consequences. We classify these deviations based on their discrepancies attributed to time, value or provision. For instance, in case of a tractor, if the service vehspd must be generated within 10ms from request time, but is generated after a delay of 2ms, then the service suffers a deviation attributed to time. In a fully-autonomous mode, even such small time-deviation might result in a hazardous situation as the tractor is unaware of its own speed for this duration. Moreover, if the speed generated after the delay (i.e. at 12ms) is incorrect, the safety of the vehicle, along with its implements, gets more vulnerable.

A particular deviation in a service can have different severities based on the operational mode and the environmental situation during vehicle operation. For instance, an incorrect value of vehspd in an autonomous mode is highly critical compared to in the semi-autonomous mode when the driver is present and can take control of the vehicle almost immediately. Moreover, when another tractor is driving ahead in the field, a delay in vehspd can result in delayed deceleration and thus collision of the two vehicles. However, in case of no additional vehicle ahead delay deviation in vehspd would be still critical but, would not have collision as an outcome. Therefore, while performing hazard analysis, we take the operational mode of the vehicle and its context into consideration as it aids in an in-depth analysis of the consequences of the deviations in services.

Step IV. Safety Statuses and Corresponding Measures: Subsequent to hazard identification, we estimate the risk associated with the deviations and assign them a corresponding integrity levels. Since we have an autonomous agricultural vehicle, we do the risk estimation in accordance with standard ISO 25119 [START_REF]2010 Tractors and machinery for agriculture and forestry -Safety-related parts of control systems -Part 2: Concept phase[END_REF] and consider the parameters: Severity of the accident caused by the deviation, the likelihood of the accident and the controllability of the situation to assign agricultural performance levels (AgPL) from 'a' to 'e' [START_REF] Benneweis | FACILITATING AGRICULTURE AUTOMATION USING STANDARDS[END_REF] for different levels of risk.

if Saf Status ⇒ Saf M easure ∈ SRule (4)
Following the AgPL assignment, the very last step is to construct safety statuses (SafStatus) for the safety rule (SRule). Each status acts like a condition which when true, indicates the vehicle being in an unsafe state and thereby, triggers a corresponding countermeasure (SafMeasure). Equation 5is an exemplar safety rule for TIA-Baling system. In case of a delay in front obstacle sensor signal, all autonomous configurations, for Trac, Bal and SwSc, are reconfigured to semi-autonomous mode. if (F ObstSignal delay ≤ 400ms while V Speed ≥ 15)

⇒ (AutoC f 1 to SemiAutoC f 1 ) ∈ SRule 1
(5) During the TIA case study, we observed that not all deviations, despite being in the safety critical services, result in hazardous situations. These are the deviations that are either improbable to occur or are easily controllable and thus, have a corresponding AgPl of 'a' or below (QM). We filter such deviations and consider the ones that have AgPL 'b' or higher for the safety statuses. Besides, we realised that creating safety statuses and an equivalent corrective measure for each individual service would result in a safety rule explosion. Especially, when the number of safety critical services is higher. Moreover, there exist certain associations between the some services where, a particular deviation in one along with a certain deviation in the other, in a specific operational mode, results in a hazardous situation with potentially catastrophic consequences.

To this end, a safety rule consists of a safety status that represent an unsafe state of the vehicle caused either due to individual service deviation or a deviation due to the associated services having an AgPL of 'b' or above, in a particular operational mode during a specific scenario. As a safety measure, we reconfigure the system to a configuration that brings the system back to a safe state. For each safety status, safety measure is a set of potential configurations that the vehicle can configure to. At runtime, the currently activated configuration as well as the other potential configurations are evaluated using a complexity based risk metrics [START_REF] Bhardwaj | A Conceptual Framework for Safe Reconfiguration in Open System of Systems[END_REF].

III. SUMMARY AND CONCLUSION

This paper presented a stepwise specification for a service safety monitor, a sub-module of a safety monitor, that administers an autonomous vehicle for safety critical deviations during its execution. The monitor is a collection of safety rules obtained by performing hazard and risk analysis at design time. We believe that for distributed autonomous system like TIA, such a safety monitor not only aids in achieving fault tolerance by prompting safety measures in form of reconfiguration, but aids in self-awareness and allows it to adapt its behavior to sustain a safe behavior at runtime.

Presently we are implementing the monitor in autonomous vehicles in the agricultural and road vehicle domain. As future work, we plan to explore the benefits and tackle challenges associated with its implementation and validation. Escalating complexity of safety rules owing to higher dependencies among and due to increasing amount of system services, structural decisions like centralized or decentralized monitor for the system with regards to functional and non-functional properties like performance and efficiency and validation of the monitor itself are one of the many challenges to be investigated systematically as a part of our research.

Fig. 1 .

 1 Fig. 1. Safety Monitor Specification and Monitoring Procedure

Fig. 2 .

 2 Fig. 2. Operational Modes & Configurations of TIA Vehicle

1 ( 3 )

 13 {vehspd rs , steerang ps , ...} = T rac AM Cf

An implement is a device or component that is attached to a tractor to perform a specific task like: a harvester for harvesting purposes.