Jean-Gabriel Ganascia
email: jean-gabriel.ganascia@lip6.fr

The New Ethical Trilemma: Security, Privacy and Transparency

Keywords:

Numerous ethical and societal issues are related to the development of nanotechnology. Among them, the risk for privacy has long been discussed. Some people say that technology is neutral and that it does not really change the nature of problems, which are mainly political, while others state that its contemporary developments considerably amplify them; there are even persons who assert that it will make privacy protection obsolete. This paper discusses those different positions by making reference to the classical Panopticon that is an architecture for surveillance, which characterizes the total absence of privacy. It envisages the possible evolutions of the Panopticon due to the development of nanotechnologies. It shows that the influence of nanotechnology on privacy concerns cannot be dissociated from the influence of computers and biotechnologies, i.e. from what is currently called the NBIC convergence. Lastly, it concludes on the new ethical trade-off that has to be made between three contradictory requirements that are security, transparency and privacy.

Résumé

Le développement des nano-technologies soulève de nombreuses questions d'ordre éthique et sociétal. Parmi elles, celles qui portent sur la protection de la vie privée ont fait l'objet de nombreux débats. Certains pensent que les technologies sont neutres et qu'elles ne changent pas fondamentalement les problèmes qui sont d'ordre politique, tandis que d'autres prétendent que les développements techniques contemporains les amplifient considérablement. Il existe même des personnes qui affirment que la protection de la vie privée devient obsolette. Cet article discute ces différentes positions en faisant référence à l'architecture classique du Panopticon qui a été conçue pour faciliter la surveillance et qui se caractérise comme un totale privation de vie privée. Il envisage les évolutions possibles du Panopticon dues au développement des nanotechnologies. Il montre que l'influence des nanotechnologies sur tout ce qui concerne la vie privée ne peut être dissociée de celle des ordinateurs et des biotechnologies, c'est-à-dire de ce que l'on a coutume de désigner comme la convergence NBIC. Enfin, cet article conclut sur le nouveau compromis qui doit 1.2 Main Issues: From Nano-toxicity to Privacy "Nano-ethical" development of nanotechnology requires to address various issues that belong to three main categories: nano-toxicity, environment protection and privacy.

Nano-toxicity (Marano et al. 2011) covers the effects of ingestion or inhalation of nanoparticles on health. Some scientists fear that substances, which are benign by themselves become malignant when spread in the form of nanoparticles [START_REF] Stern | Nanotechnology safety concerns revisited[END_REF]. They allege that, because of their extremely small size, nanoparticles can invade and infect the lungs and that they can also cross through nasal cavities into the brain or via the placenta into developing fetuses. For instance, while gold dust is relatively safe, gold nanoparticles seem to be biologically active and to trigger intense chemical reactions.

Ecotoxicity, i.e. the potential danger of nanotechnologies for the environment has also been pointed out by numerous scientists. While it was proposed to use nanoscale iron to decontaminate the soil and the water (e.g. [START_REF] Hillie | Nanotechnology and the challenge of clean water[END_REF])) or to clean up clothes and surfaces contaminated with biological agents, some have argued that nanotechnologies could pose risks for our environment. For instance, titanium dioxide, which is usually a non-reactive substance that is present in many products like house paint, becomes chemically active under the form of nanoparticles. It can then burn bacteria. It could also accumulate in animal organs and lead to unanticipated consequences for those animals which might be passed to humans.

According to some visionaries authors (e.g. [START_REF] Joy | Why the future doesn't need us[END_REF]), risk may go well beyond classical toxicity, since they announce proliferation of intelligent nanoscale particles, that could reproduce by themselves.

Today, many people are afraid of the violations of privacy due to the extensive use of invisible modern technologies. They fear the nanotechnologies will violate their privacy with nanoscale sensors, which will render all our intimate and private life accessible to everybody. This could transform our world in a society of surveillance analogous to what was described in George Orwell's famous novel "1984" [START_REF] Orwell | Nineteen Eighty-Four. A novel[END_REF]. This could also be worse if all the physiological mechanisms that take place in our body were continuously inspected and reported.

Specificity of Nanotechnology

One important question concerns the specificity of nanotechnology in general, and, more precisely, the specificity of the ethical issues straight to the development of nanotechnology. One currently argues that nanotechnology is nothing more than the prolongation of macromolecule chemistry. And, indeed, the difference between a nanoscale particle, for instance a nanosphere or a carbon nanotube, and a complex macromolecule is not easy to delineate.

Concerning nanotoxicity, nothing really distinguishes the study of the specific toxicity of nanoparticles from the study of the activity and toxicity of chemical products in general. As a consequence, nano-toxicity constitutes a subfield of classical toxicity studies. It goes the same with environmental consequences of nanotechnology, which look, to some respects, analogous to the consequences of chemical contaminations. The only real difference would be in the case of intelligent auto-replicating particles that adapt their behavior to the environment. But, even in such situation, nanoparticles would not fundamentally differ from biological agents like viruses or bacterias.

The situation for nanomedicine is not far from the one in medicine. Benefits of medical applications of nanotechnologies, for instance the use of nanosphere systems that can help to detect diseases or to transport chemotherapeutic drugs through the organism and to deliver into the brain (e.g. [START_REF] Yu | Integrintargeting thermally cross-linked superparamagnetic iron oxide nanoparticles for combined cancer imaging and drug delivery[END_REF]) -or into any well targeted location -, may thus be counterbalanced by the potential danger of nanoparticles for human health. This corresponds to the classical trade-off in the evaluation of drugs and ethical issues are the same.

Privacy

This paper deals with with privacy implications of nanotechnology. At first sight, the situation seems analogous to what happens with the other questions related to nanotechnology. For some people, the risks for privacy are of the same nature with nanotechnology than they were in the past with classical communication technologies that require to remain constantly vigilant, because of the risk of personal data theft and misuse, while others state that nanotechnology considerably amplifies the risks. There are even persons who assert that nanotechnology will make privacy protection obsolete, because of the proliferation of invisible sensors [START_REF] Smith | Scary stuff[END_REF].

For the use of nanotechnology in health care or handling environmental issues, adverse effects may be counterbalanced by beneficial effects and decisions result from a cost-benefit evaluation. For the privacy issue the situation is quite different. There would be no obvious beneficial effects of nanotechnology enhancing privacy itself that could counterbalance privacy violation. In fact, as we shall see in the following, the beneficial effects that offset the risks for privacy don't concern the privacy itself, but the security of persons and the public transparency, which look to be highly desirable today. As a consequence, the privacy cannot be considered in isolation, without any other consideration; there is a necessary trade-off between privacy, security and transparency, that corresponds to what we call in the following the "ethical trilemma".

This paper contains a discussion about those various positions by making reference to the classical Panopticon that is an architecture for surveillance, which represents the total absence of privacy. The possible evolutions of the Panopticon due to the development of nanotechnology and, more generally, of convergent technologies are envisaged. In conclusion the new ethical conflicts generated by the development of nanotechnology, that constitute, as we argue here, an ethical trilemma, are discussed.

The paper is organized accordingly: after a first remind of the notion of privacy and a brief description of the classical Panopticon, in the second part the notion of Nano-Panopticon is presented. Then, a third part introduces the digital Panopticon and shows that, by potentiation with the Nano-Panopticon, it constitutes a digital Nano-Panopticon. Finally, the paper discusses the ethical issues that can be drawn from the consideration of those risks and the necessary trade-off between security, transparency and privacy that follows.

Privacy and Surveillance

Origin of the Notion of Privacy

In one of her most famous essay, The Human Condition [START_REF] Arendt | The Human Condition[END_REF], Hannah Arendt reminds the traditional distinction between the public and the private realm. She recalls that it comes from the Ancient Greece where the "public realm" was the place where state affairs were discussed and decided. From an urbanistic point of view, it corresponds to the agora in the Athenian city, i.e. to an open area where the freemen debated the questions of common interest. However, it was not restricted to a physical locus: the public realm was the symbolic place of political action, i.e. of freedom. By opposition, the private realm was devoted to labor and work, i.e. to the accomplishment of necessary things. The notion of "private realm" was then understood as synonymous of family in its extended significance, which included not only the atomic family, i.e. the father, the mother and the children, but the grand-parents, the cousins, the aunts and uncles, and also the servants who were for many of them slaves. The private realm was entirely dedicated to the subsistence. It was there that people were organizing to cultivate, hunt, raise animals, build and repair houses etc. This realm was totally submitted to the achievement of material constraints of life.

In its contemporary meaning, the notion of privacy comes from the end of the 19 th century. Its original aim was to restrict the public dissemination of details relating to a person's private life in the context of the development of press and publicity allowed by the invention of photography and newspapers. It then appeared necessary to recognize the right to be alone and the moral integrity of the person. Afterwards, the protection of the "right to one's personality" has been explicitly stipulated [START_REF] Warren | The right to privacy[END_REF] under the name of privacy.

Note that the feeling of the individual didn't suddenly appear at the end of the 19 th century. Before, there were many people wanting to express their individuality through their life or their creation. It was the case in the Antiquity and, especially, in the Modern Age, with the rise of the individualism. However, for centuries, because of the material constraints, especially because of the exiguity of living spaces, only a few educated and rich persons had the ability to care of their self and of their privacy. It's only, by the end of the 19 th century, that this requirement became collective in western developed societies [START_REF] Langelier | Prolgomnes une recherche sur la vie prive dans une perspective historique et sociologique[END_REF].

The development of modern communication technologies and of sensors, e.g. microphones, video cameras and web-cams, during the 20 th century encouraged invasion of privacy and violation of personality rights2 . Obviously, there is no strict causality relation between the development of modern communication technologies and the threat for privacy and personality rights, but these techniques afford many opportunities to threaten privacy to states, to criminals or even to idealists like, for instance, Julian Assange, the founder and editor in chief of WikiLeaks.

This leads philosophers to describe in more details some main interests in the protection of privacy rights, for instance, the intrusion into a person private affairs, the public disclosure of embarrassing private facts about an individual or the publicity placing one in a false light in the public eye. Briefly speaking, the privacy protection is based on a general principle according to which everyone has the right to totally control his personal information, i.e. to decide what information he/she accepts to reveal, when and to whom he/she does it. However, this general principle is difficult to apply. For instance, in France, in the case of the image -e.g. in the case of photos or videos -of a person in public, the French notion of "droit à l'image" allows persons to dispose of their image. This "droit à l'image", which does not exist in UK legislation, conflicts with the freedom of expression and the freedom of press, which permit journalists to take pictures in the public space. As a consequence, depending on the context, it can be either prohibited or allowed to take pictures of persons in public without their permission.

In addition, note that, in this narrow view, the protection of privacy is restricted to the individual control over personal information dissemination. However, privacy is a more general and essential notion that is related to the idea of intimacy, i.e. to the close, familiar, and affectionate personal relationship with another person or within a group. Privacy is necessary for intimacy, without intrusion or observation, which plays a key role in the development of the moral and social personality of individuals able to respect, love and trust. As such, it also needs to be protected.

The Panopticon

The Panopticon was designed at the end of the eighteenth century by Jeremy Bentham as a piece of prison architecture [START_REF] Bentham | The Inspection House : Containing the Idea of a New Principle of Construction Applicable to Any Sort of Establishment, in Which Persons of Any Descriptions are to be Kept under Inspection and in Particular to Penitentiary-Houses, Prisons[END_REF]) that was supposed both to decrease the cost of surveillance and to improve its efficiency. It characterizes a rationally organized prison society where the detainees cannot vindicate any right to protect their individual intimacy because they have been judged so bad that they need to be continuously surveyed and educated. Briefly, the Panopticon is built on a ring around a central tower, where prison guards can see everything their prisoners do without being viewed by them. The cells are transparent, they receive and transmit sunlight. In that way, inspectors may observe the prisoners' every movement without being seen. Because the prisoners don't see their guards, the fear to be observed is sufficient to overawe them, even when nobody is watching. Moreover, the prisoners are totally isolated from each other and, consequently, they don't communicate.

The Panopticon played a central role in modern societies. It was not restricted to the surveillance of prisoners. Key institutions of the modern age like factories, hospitals, asylums and even schools were organized on this model. The original paper of Bentham explicitly refers to all those institutions3 . Later on, many philosophers, among them Michel Foucault in Discipline and Punish [START_REF] Foucault | Discipline and Punish[END_REF], described it as a typical device ("dispositif" in French) of the modern legal state, i.e. a social arrangement that summarizes the underlying political structure of the society, as it threatens all the deviants, i.e. criminals that are put in jail, sick persons in hospitals, mad locked up in asylums, etc.

The Panopticon defines a structural schema that is diametrically opposed to the idea of protection of privacy. This is the reason why it has been referred by those who fear the possible violations of privacy. But, it has not been uniquely designed to imprison, i.e. to efficiently protect the society against the violation of the rights; it can also serve to cure people. It has even been seen as a model of organization on which many institutions of the modern society were shaped in the state of right as it appears in the 18 th and 19 th century revolutions. Lastly, the original Panopticon model was not supposed to be generalized to the overall society except later, with some deviations like the one developed in the Orwell's novel entitled "1984" [START_REF] Orwell | Nineteen Eighty-Four. A novel[END_REF].

Despite the positive role that might play the Panopticon for public health and respect of law, it clearly conflicts with the privacy protection that has emerged at the end of the 19 th century. On one side, the Panopticon is a way to protect individuals, on the other side, it considerably restricts their freedom and their right to privacy, which is an essential condition of the freedom. This is the reason why it is so interesting for our purpose: indeed, it is emblematic of the lack of privacy in the former modern societies, more precisely in the modern societies that appear between the end of 18 th century and the 20 th century, and, as such, it will help us, in the following, to understand the new nature of privacy violations that follows the development of nanotechnology and, more generally, of converging technologies.

3 Nano-Panopticism

Invisible Surveillance

The major privacy related issue of nanotechnology is its potential to considerably extend surveillance with nanoscale devices, which become invisible and unperceivable by the individuals. In a paper untitled "On Nano-Panopticism: A Sociological Perspective" [START_REF] Mehta | On nano-panopticism: A sociological perspective[END_REF], Michael Mehta investigates the social consequences of the proliferation of micro sensors. With such devices disseminated everywhere in houses, in streets, in clothes, etc., the utopia of a total visibility would become a reality. It would then be possible to achieve a perfect Panopticon where prisoners would be continuously under the gaze of guards.

This prospect is certainly very distant from what the current state of the art allows. In particular, it presupposes that all the recorded data could be analyzed, which, even with the help of powerful data mining techniques, remains today totally intractable. However, seen as a prospective view of the future of nanotechnologies, it shows how the developments of converging technologies might entail a total lack of privacy if nobody is taking care.

Internal Panopticon

In addition to this "external Nano-Panopticon", which allows to record all the movements of individuals, researchers imagine to build an "internal Nano-Panopticon" by implanting nano-devices controlled by microchips in human body [START_REF] Aubert | Rfid technology for human implant devices[END_REF]. Some of these devices could deliver drugs or aid Alzheimer's patients with assisted cognition devices. Some others would continuously record physiological parameters. For instance, it is mentioned gold nanoparticle probes that might allow earlier cancer detection [START_REF] Wang | Gold nanoparticle probes[END_REF][START_REF] Yu | Integrintargeting thermally cross-linked superparamagnetic iron oxide nanoparticles for combined cancer imaging and drug delivery[END_REF][START_REF] Cheng | Nanotechnologies for biomolecular detection and medical diagnostics[END_REF]. More generally, implantable medical diagnostic tools could help to establish a self-monitoring of physiological well-being and dysfunctions. In the NSF report on converging technologies edited by M.C. Roco and W.S. Bainbridge (Roco & Bainbridge 2003), the development of implantable sensors or "smart" patches that regulate drug delivery or heart rate is mentioned. It is said that "Such sensors might monitor, for example, blood chemistry, local electric signals, or pressures." and that "The sensors would communicate with devices outside the body to report results, such as early signals that a tumor, heart damage, or infection is developing."

Mentioned by (Roco & Bainbridge 2003), the implantation of chips in a person's brain could send neural signals from brain areas to control exoskeleton or prosthetic robotic arms. According to this report, it could help to restore or to augment fundamental motor functions such as grabbing, reaching and walking. It could also help to record and to archive individual neural activities. In this respect, existing Brain-Computer Interfaces could certainly be greatly improved by the nano-sensors directly implanted in the brain.

Note that the NSF report edited by Roco and Bainbridge (Roco & Bainbridge 2003) was a visionary statement of which role was to motivate new researches. The present reality doesn't correspond to this vision. Nevertheless, we mention this report here, since the role of this paper is to envisage the question of privacy in the future, and not only in the present time, where the development of nanotechnology doesn't yet alter our privacy. More generally, some of the most frightening scripts of invasion of privacy have to be envisaged, even if there is no actual risk with the today development of technology.

Metamorphosis of the Panopticon

In brief, nanotechnology contributes to the surveillance at three levels.

First, it prolongs the classical surveillance techniques by developing Radio Frequency Identity Chips (RFIDs) [START_REF] Aubert | Rfid technology for human implant devices[END_REF], invisible tags and nanosensors that are able to record and to trace individuals movements [START_REF] Avoine | Rfid traceability: A multilayer problem[END_REF]. With the proliferation of unapparent video-cameras build with nano-sensors [START_REF] Liua | Dielectrophoretic manipulation of nano-materials and its application to micro/nano-sensors[END_REF] and their dissemination, it considerably extends the classical Bentham's Panopticon, without fundamentally changing its nature.

Second, with inner surveillance techniques that make intrusion in the body, the oversight goes beyond the classical observation of one's move. It's not only a question of intensity of sensors; it's the nature of surveillance that is changing: it's becoming possible to continuously observe biological modifications that affect our body and that are invisible to our own consciousness. As a consequence, the surveillance techniques help us to know us better than we would do it by ourselves. In this respect, this second level overtakes the classical logic of surveillance of which the Bentham's Panopticon was emblematic. On the one hand, it certainly corresponds to a very interesting evolution of surveillance, which might be very beneficial in the future, because it could lead to improve health care and security in the population. On the other hand, the risk might be that this knowledge of ourselves by others -e.g. by physicians and/or by the administration -escapes to our control.

Furthermore, a third level might allow to directly capture the brain signal, to automatically interpret it and then to get direct access to the thoughts. If this were actually true, this would certainly lead to intrude into our deepest intimacy to an unthought degree. Nevertheless, despite of the recent progresses in functional Brain imagery and in the Brain-Machine Interfaces, it seems that presently we are yet far away from being able to realize such devices with the current development of technology. One of the main impediments is the difficulty to analyze and to understand the meaning of the considerable mass of data generated by brain signals. Maybe, in the future, it could happen that the progresses of data mining would make those data comprehensible and thus, our most intimate thoughts transparent to anyone. Note that this visionary view is not new. For instance, Vannevar Bush in the conclusion his famous paper "As we may think" [START_REF] Bush | As we may think[END_REF]) had developed a similar idea: he has imagined that one day the MEMEX -i.e. the external memory made of electronic devicesmight be directly plugged to our brain. Obviously, if it would be accessible, this third level of surveillance would exceed again the second level to the point that no privacy at all -and consequently no intimacy -would remain possible. But, we are so distant from such an achievement that there is no need to deepen further on this point.

To conclude, nanotechnology enhances heavily the degree of surveillance of the classical Panopticons, which are metamorphosed in what we call, following Michael Mehta [START_REF] Mehta | On nano-panopticism: A sociological perspective[END_REF], Nano-Panopticons. These Nano-Panopticons not only increases the amount of surveillance; they also transform the nature of surveillance; they make evolve the old centralized logic of surveillance, of which the architecture of Panopticon was emblematic, into a new decentralized logic of surveillance (van den Hoven & Vermaas 2007) that is decribed in the next chapter.

Extensions within Digital Panopticons

Extension to Digital World

Both the beneficial effects of the information gathered by implanted nanosensors and the possible privacy harms due to a misuse of this information directly depend on interpretation processes. Due to the enormous mass of information, this interpretation cannot be done manually. Computers are required to help to understand the meaning of a so huge quantity of information. Furthermore, it is necessary to commission people to intervene when required, for instance to cure patients who are diagnosed or to prohibit deviant behaviors. Without this social environment of services, nanotechnology is useless. This means that nanotechnology cannot be understood isolated. It has to be associated with communication technologies, with computers, with data mining processes and with human organizations. In other words, nano-devicesand more especially nano-sensors -are part of computing artefacts, because they include automatic computers to deal with the generated data. They are also socio-technical systems, because their usefulness directly depends on the social organizations that allow to build the necessary infrastructures that are required to exchange data and to act appropriately. As a consequence, the nano-Panopticons that were described in the previous section need to be extended to the digital world, i.e. to the human world surrounded by computers and networks.

Digital Panopticons

Besides the use of nanotechnology, web-cams, RFID tags and many other recent information technology devices render now possible to record and to broadcast an increasing part of anybody's daily activities [START_REF] Bailey | The experience capture experiments of ringley & mann[END_REF][START_REF] Mitton | From the internet of things to the internet of physical world[END_REF]. As soon as a mobile phone is switched on, it is easy to identify and localize its owner. The Location-Based Services [START_REF] Joore | Social aspects of location-monitoring systems: the case of guide me and of my-sos[END_REF], which have been perceived as an incredible contribution to individual empowerment, allow for continuously tracking any of our movements. In many developed countries, personal data concerning health, employment, income, travel and digital communications are officially recorded and stored in databases [START_REF] Lahlou | Cognitive technologies, social science and the three-layered leopardskin of change[END_REF]. It is then in principle possible to fuse [START_REF] Laudy | High-level fusion based on conceptual graphs[END_REF] all those data using modern data mining techniques. Therefore, most of our personal data that are now becoming available within digital media could be merged. As such, they might be easily divulged throughout the world and exploited.

Certainly, there are national legislations that protect privacy and that preclude such a merge and a fortiori such a divulgation, for instance in France the law "Informatique et liberté". Simultaneously, there are attempts to open access to data, without infringing privacy. As an illustration, the "open data" movement tends both to anonymize data and to make them more publicly avail-able. Therefore, the digital world becomes more and more transparent because huge amounts of data may be accessible anywhere all over the world through Internet and there exists a social aspiration to public access to data.

In a way, this digital world seems to be analogous to the Bentham's Panopticon, because all the personal data seem to be accessible, which makes it transparent, even if individuals have acquired the right to protect some of their data. But, there is no more limit to its extension, which is no longer restricted to a building, like a prison or an hospital, nor localized to specific place. As a consequence, digital technology gives birth to what has been called the digital Panopticon, which extends, to the entire planet, the scope of the classical Panopticon. In addition, the digital Panopticon makes the data available to many people and not just to a few guards, as in the original Bentham's Panopticon.

Potentiation

In medicine, the notion of potentiation designates the enhancement of a drug effect due to biochemical interactions with other drugs or environmental conditions. By analogy, nanotechnology and digital technology mutually potentiate each other, which could give birth to an hybrid of the Nano-Panopticon and the digital Panopticon that we call the digital Nano-Panopticon.

On the one hand, nanotechnology has the potential to tremendously enhance computer technology by increasing computing power and storage capacity of electronic devices. Available technologies allow to reach in industry size of order of 22 nanometers while in laboratory much smaller components can be fabricated.

Recently, in February 2010, Professor Jean-Pierre Colinge, from the Tyndall National Institute in Cork, Ireland announced a breakthrough in transistors with the design and fabrication of the world's first junctionless transistor that can be produced at 10-nanometer (Colinge, Lee, Afzalian, Akhavan, Yan, Ferain, Razavi, O'Neill, Blake, White, Kelleher, McCarthy & Murphy 2010).

On the other hand, coupling the nanotechnology to digital world would make them considerably more powerful. The coupling of nano-devices with "nanochips" would increase their efficiency. For instance, drug delivery nano-spheres could adapt their behavior to physiological parameter, by an automatic computation. Moreover, the interpretation of the data recorded by nano-sensors requires an intense computing power that the enhancement of computer technology due to the use of nano-devices may certainly contribute to afford.

This mutual potentiation of nanotechnology and digital technology amplifies the threats for privacy protection. We may fear the erection of Neo-Panopticons -or digital Nano-Panopticons -that are hybrids of Nano-Panopticons, Digital Panopticons and Bio-Panopticons, i.e. Panopticons built with biotechnologies for the permanent and continuous surveillance of living organisms justified both by health care and environmental protection concerns.

Undoubtedly, in such a context, it would be more and more difficult to ensure the privacy protection. Without going in a catastrophic scenario by showing the danger of digital Nano-Panopticons, the classical notion of privacy protection, according to which anyone is the owner of all the data about his/her private life is evolving. This justifies the arguments of those, like Robert Ellis Smith, the publisher of the Privacy Journal newsletter, who argue [START_REF] Smith | Scary stuff[END_REF]) that the new environment of nanotechnology may render obsolete the old regime of protecting privacy. More generally, considering that the notion of privacy protection is quite recent in the history of humankind, it would be possible to live in a world with new privacy regulation rules, which would substantially differ from the classical ones that are inherited from the end of the 19 th century.

Towards the End of Privacy?

Let us summarize our argument. First of all, we have recalled that the notion of privacy protection is historical and that its apparition during the 19 th century is more or less concomitant with the systematization of the surveillance (cf. section 2.1). It is as if there were a dialectical link between privacy and surveillance, which makes the need for privacy protection increase when the surveillance is widespread. We have then shown that, with the development of nano-technology and with its coupling with information technology and biotechnology, i.e. with the development of converging technologies, the nature of surveillance is evolving (cf. section 4). On the one hand, it becomes technically possible to follow and to trace everyone movements. On the other hand, the amount of generated data and the easiness with which everyone can now catch and spread information, change the nature of surveillance, which according to van den Hoven et al. (van den Hoven & Vermaas 2007) becomes decentralized. Our underlying hypothesis is that this evolution of the surveillance, i.e. the change-over from a centralized to a decentralized surveillance, greatly affects the need for privacy protection. We envisage in this section the new status of privacy protection that derives from those evolutions.

The Ethical Limit of Privacy

Is privacy always suitable? The question may cause surprise, because the right to privacy seems to be largely recognized as fundamental, but there exist people [START_REF] Posner | The Economics of Justice[END_REF][START_REF] Parent | Privacy, morality and the law[END_REF][START_REF] Thomson | The right to privacy[END_REF] scrutinizing the notion of privacy and blaming, for ethical reason, the emphasis put on it. Some of the detractors are philosophers [START_REF] Posner | The Economics of Justice[END_REF][START_REF] Parent | Privacy, morality and the law[END_REF] who argue that the known privacy violation cases can be analyzed in terms of violation of property rights or violation of the person rights. As a consequence, the concept of privacy is a mixture, which is not really distinctive and which does not really help to rule behavior. Other, for instance feminists (MacKinnon 1989), say that privacy has a dark side, because it can be used as a shield to eclipse cases of domination, degradation, harassment and abuse of persons, especially of women and children.

These objections do not totally reject any idea of privacy protection, but they aim at targeting its theoretical justifications in order to see if it is not an instance of a more general right of the person, like the right to security. It is of particular importance in a time where the state of technology makes privacy necessarily evolve. In other words, the focus is to understand the ethical limits of privacy, while the development of technology raises doubts on the classical view of informational privacy considered as the ability to fully control on its own personal data.

Surveillance vs. Sousveillance

More generally, one currently argues that the full disclosure of all public and private information contributes to establish a state of total transparency in society that is desirable. According to these ones, for instance to Steve Mann, this would not really strengthen the logic of surveillance and lead to a generalized surveillance society, but would instead contribute to institute a new regime, described as a "sousveillance" [START_REF] Mann | Sousveillance: Inventing and using wearable computing devices for data collection in surveillance environments[END_REF][START_REF] Ganascia | Voir et pouvoir: qui nous surveille?[END_REF], in which powerful people are permanently observed by those they are supposed to dominate. The word "sousveillance" is a neologism built on the model of "surveillance", the latter from French "sur", meaning "over" and "veiller", "to watch", and which literally means "watching from above". By analogy, sousveillance has been built to designate the act of watching ("veiller") from below ("sous"). In the case of sousveillance, the watchers are socially below those who are watched, while in the case of surveillance it is the opposite, they are above.

Note that the original notion of sousveillance promoted by Steve Mann signifies that every watcher would voluntarily give free access to all information recorded. Usually, people recording information take part in the event and participants are aware of the recording. According to Steve Mann and to others, this would lead to a more balanced world state of justice, since everybody would act as if he was observed by others [START_REF] Munro | Non-disciplinary power and the network society[END_REF]. Moreover, the sousveillance would help to denounce abuse or to check the conformity of public goods. For instance, Steve Mann shows how, with a camera in his pocket, he can record violation of the electrical code (cf. http://wearcam.org/password-66-450.htm) and make it publicly known. However, in that case, it may happen that people disagree with the information capture and attempt to destroy the camera. On the other hand, if someone has been wrongly accused, it would always be possible to show his records to be free from doubts. As an illustration, let us recall the story of Rodney Bradford. This 19 years old man has been arrested and held for 12 days for an armed robbery on October 17 th 2009 of two people in the Brooklyn housing project where he lives. He has then been exonerated thanks to a status update he posted on social networking site Facebook. The message on Rodney Bradford's Facebook page, posted at 11:49 a.m. on October 17 th , asked where his pancakes were. The words were typed from a computer in his father's apartment in Harlem.

Transparency vs. Privacy

Those examples and the subsequent discussions show that many of our contemporaries share the aspiration to a total transparency, which seems to mismatch the need for privacy protection. Let us remind another recent illustration of such a conflict between transparency and privacy. It took place by the end of 2010 when 400,000 of secret telegrams containing embarrassing information about American, European and Middle-East foreign policies were divulged to newspapers by the WikiLeaks organization. Among these, there were private declarations of statesmen and confidential assessments of diplomats expressing their personal feelings about the governments of the countries they had visited. The diplomacy of the United-States of America and of some other countries has been called into question by what people were calling the Cablegate, by analogy to the Watergate. Modern democracies, and especially the United-States of America, were hampered; as sovereign states, they were facing a novel dilemma. On the one hand, last few years, many of them have tried to open the public data to all citizens. This tendency is present in Europe and in the United-States of America. For example, once elected, Barak Obama has promoted the Open Government [START_REF] Obama | Transparency and open government, Memorandum for the heads of executive departments and agencies[END_REF], which makes all the administrative datai.e. heath inquiries, environmental records, public funding etc. -available to everybody. On the other hand, states are used to deal with many matters, especially in the diplomatic area, either in secrecy, or, at least, in a discrete way. As a consequence, they can't easily accept the public disclosure of top secret information.

The New Ethical Trilemma

For summarizing, let us recollect the different steps of our analysis. After recalling the scope of the notion of privacy (cf. section 2.1), we have examined the impact of the development of contemporary nanotechnology on privacy protection (cf. section 3). We saw that this study cannot be envisaged without taking into account the mutual potentiation of nanotechnology, information technology and biotechnology (cf. section 4.3). It then appeared that the surveillance has been evolving not only in intensity, but also, in its organization, which becomes more and more decentralized (cf. 5.1). The notion of sousveillance and its generalization to the overall society help to understand the present evolution. More precisely, the logic of surveillance, which corresponds to a vertical cast of information, coexists more and more often with a logic of sousveillance that leads to an horizontal spread of information.

Lastly, we also noticed that privacy protection was directly related to the surveillance organization. As a consequence, we can hypothesize that the principles on which privacy protection is based are changing, because now the privacy is not only related with a centralized surveillance organization, but also with a decentralized sousveillance schema. The definition of privacy itself should considerably evolve in the future due to the above mentioned development of converging technologies. In particular, the idea according to which everybody should control his/her personal data becomes more and more untenable.

In addition to these technical impediments to a full privacy protection, criticisms have been addressed to the focus on privacy protection (cf. 5.1). Some argue that privacy is an instance of more fundamental rights of the person while others mention some requirements that may interfere with privacy. For instance, health care and security could necessitate full traceability of both motions and physiological parameters of individuals, which becomes possible with digital convergence, i.e. with the coupling of nanotechnology, digital technology and biotechnology. The socio-technical systems that are erected to ensure the continuous recording and the exploitation of traces of individual behaviors, inevitably conflict with privacy protection requirements. However, security and privacy equally answer to a demand of most of our contemporaries. Therefore, between the privacy protection need and the security exigency, there is a tension.

Moreover, as we already mentioned, besides this first tension, there exists a second tension between privacy protection and the aspiration to transparency. And, not only, privacy protection and security of persons on the one hand, and privacy protection and transparency on the second hand, are conflicting, but also security and transparency, which has appeared obvious during the WikiLeaks affair, when the information divulged by the WikiLeaks website had deleterious consequences both for the security of persons and for state policy. Therefore, we could also add a third tension, between security of persons and the need for transparency. Note that the first tension, i.e. the tension between privacy protection and security, existed since the origin of the privacy protection, in the end of the 19 th century, while the second and the third tension, between privacy protection and transparency on the one hand and between security and transparency on the other hand are quite recent, because they are due to the need for transparency and to the ease with which everybody can divulge information now. As a result of those three tensions, there is now a necessary trade-off between privacy, security and transparency.

To illustrate this point, let us take an example of this necessary trade-off between privacy, security and transparency. Suppose that, as we suggested earlier (cf. section 3.2), the development of converging technologies would render possible a preventive detection of diseases by the use of medical sensors that might monitor blood chemistry, local electric signals or pressures and communicate with communication devices to report results, such that a tumor, a heart damage, or infection is developing. Such recorded data need physicians to be interpreted, but the privacy protection requirements mean that confidentiality be ensured.

To conclude, we are now facing a new ethical trilemma that is a choice between three mutually exclusive ethical options: security, transparency and privacy. None of the three options can be totally privileged. Therefore, it's necessary to continuously arbitrate between them, because the development of modern technologies, especially of nanotechnology and digital technology, makes them both conflicting and equally suitable.

cf. http://www.springer.com/social+sciences/applied+ethics/journal/11569

The notion of personality rights is a technical legal term that can simply be defined as the right of an individual to control the commercial use of his/her name, image, likeness or other unequivocal aspects of one's identity.

To be more precise, the title of the Bentham's essay on the Panopticon (cf.[START_REF] Bentham | The Inspection House : Containing the Idea of a New Principle of Construction Applicable to Any Sort of Establishment, in Which Persons of Any Descriptions are to be Kept under Inspection and in Particular to Penitentiary-Houses, Prisons[END_REF]) lists some of the institutions of which the organization could be built on the Panopticon model that are Penitentiary-Houses, Prisons, Houses of Industry, Work-Houses, Poor-Houses, Manufactories, Mad-Houses, Lazarettos, Hospitals and Schools

the (Roco & Bainbridge 2003) report sponsored by the United-States National Science Foundation


Roya Golchay
email: roya.golchay@insa-lyon.fr

Frédéric Le Mouël
email: frederic.le-mouel@insa-lyon.fr

Stéphane Frénot
email: stephane.frenot@insa-lyon.fr

Julien Ponge
email: julien.ponge@insa-lyon.fr

Towards Bridging IoT and Cloud Services: Proposing Smartphones as Mobile and Autonomic Service Gateways Position Paper

Keywords: C.2.1 [Computer-Communication Networks]: Network Architecture and Design-Internet of Things, C.2.4 [Computer-Communication Networks]: Distributed Systems-Cloud computing, D.2.11 [Software Engineering]: Software Architectures-Service-oriented architecture (SOA) Algorithms,Management,Performance,Reliability Cloud Computing, Internet of Things, Service-oriented Applications, Middleware, Smart and Autonomic Gateways, Smartphone

Computing is currently getting at the same time incredibly in the small with sensors/actuators embedded in our everyday objects and also greatly in the large with data and service clouds accessible anytime, anywhere. This Internet of Things is physically closed to the user but suffers from weak run-time execution environments. Cloud Environments provide powerful data storage and computing power but can not be easily accessed and integrate the final-user contextawareness. We consider smartphones are set to become the universal interface between these two worlds. In this position paper, we propose a middleware approach where smartphones provide service gateways to bridge the gap between IoT services and Cloud services. Since smartphones are mobile gateways, they should be able to (re)configure themself according to their place, things discovered around, and their own resources such battery. Several issues are discussed: collaborative event-based context management, adaptive and opportunistic service deployment and invocation, multi-criteria (user-and performance-oriented) optimization decision algorithm.

INTRODUCTION

Computing is currently getting at the same time incredibly in the small with sensors/actuators embedded in our everyday objects and also greatly in the large with data and service clouds accessible anytime, anywhere. This Internet of Things is physically closed to the user but suffers from weak run-time execution environments. Cloud Environments virtualize and provide powerful data storage and computing power but can not be easily accessed and integrate the finaluser context-awareness.

In parallel with these run-time environment evolutions, the service-oriented programming and architectures are also important evolutions in software engineering. These paradigms allow to easily split applications, enable a great reuse and (sometimes) handle (some) communication protocol issues. New run-time challenges are still raised especially with IoT and Cloud environments such as service deployment mechanisms, service placement, service invocation scheduling, etc. We consider smartphones are set to become the universal interface between Internet of Things and Cloud Computing worlds, as shown in Figure 1. In this position paper, we propose a middleware approach where smartphones provide service gateways to bridge the gap between IoT services and Cloud services. Since smartphones are mobile gateways, they should be able to (re)configure themself according to their place, things discovered around, and their own resources such battery. Several issues are discussed to implement a smart and autonomic service gateway: collaborative event-based context management, adaptive and opportunis- The rest of this paper is organized as follow. Next section presents related works. An overview of our proposed solution is given in section 3 and smart and autonomic mechanisms are detailed in section 4. Finally the last section states our current and future works.

RELATED WORK

While talking about mobile environment the first thing that attracts attention is resource-poor devices compared with fixed stations. Mobile phones are limited in computation power, available memory and battery life. The wireless connections with different available bandwidth and probability of disconnection and reconnection are another important point in these environments. There is a considerable amount of research on how to address these mobility issues by migrating data and computation to distributed systems [START_REF] Le Mouël | AeDEn: An adaptive framework for dynamic distribution over mobile environments[END_REF]. This issue is now raised by Internet of Things where things are even more constrained. To address the low energy power issue, [START_REF] Kumar | Cloud computing for mobile users: Can offloading computation save energy[END_REF] proposed using cloud computing. According to this article sending computation to the cloud will save energy on smart phone. The amount of saved energy is depends on the wireless bandwidth, the amount of data to be transmitted to cloud and also the application type if it is real-time data application or not. In order to use the cloud more efficiently, how to distribute the application is very important. Wishbone [START_REF] Newton | Wishbone: profile-based partitioning for sensornet applications[END_REF] is a system that takes a data-flow graph of operators and produces an optimal partitioning. The partitioning problem is to find a cut of data-flow graph, where its vertices are stream operators and its edges are streams. Edge and vertex weights represent bandwidth and CPU utilisation respectively. The partitioning algorithm models the program as an integer linear program that minimizes a linear combination of network bandwidth and CPU load. The notion of data-flow graph is also used in [START_REF] Giurgiu | Calling the cloud: Enabling mobile phones as interfaces to cloud applications[END_REF] where the presented middleware platform can automatically distribute different layers of an application between the phone and the cloud. In this graph the vertexes are software modules where service dependency between them represents by the edges. The optimal cut of the graph will minimizes or maximizes the objective function that can be the end-to-end interaction time between a phone and a server, the amount of exchanged data or complete the execution in less than a predefined time. The layered architecture is also considered in [START_REF] Gnawali | The tenet architecture for tiered sensor networks[END_REF] where presented tenet architecture for tiered sensor networks networks simplified application development. This architecture composed of two tiers: a lower tier consisting of motes, which enable flexible deployment of dense instruction, and upper tier containing fewer, relatively less constrained nodes. Another three tiers management architecture is used in [START_REF] Bourcier | AutoHome: An autonomic management framework for pervasive home applications[END_REF] where a service-oriented framework is introduced to simplify the development and run-time adaptive support of autonomic pervasive applications. A middleware is proposed to serve as a framework to host autonomic home applications. A distributed resource model and management tailored for deployment of adaptive services in a mobile environment is also discussed in [START_REF] Alia | Managing distributed adaptation of mobile applications[END_REF]. This research is focuses on the resources directly surrounding one mobile user. The presented distributed resource management framework is used to monitor the context and dynamically respond to changes by selecting the most appropriate application variant which called self-adaption mechanism. Although the distributed powerful resources in the cloud seems useful to cover the resource constraints of small components in Internet of Things, absence of context-awareness in the cloud make it difficult to communicate with it for the users. Several bridging approaches exist [START_REF] Bissyandé | Bridging the gap between legacy services and web services[END_REF] but a link is required to handle communication between almost physical environment of IoT and virtual environment of the cloud.

SOLUTION OVERVIEW

We consider service-oriented applications modeled as a graph where nodes are services and vertices are service dependencies. Two service dependencies are possible: static deployment dependency and dynamic run-time invocations. For the smartphone service gateway we propose, as shown in Figure 1, the major challenge consists in deploying, invoking, (and eventually replicating) services of an application by integrating (i) existing light-services on communicating objects from IoT, (ii) mid-services on the smartphones closer to the end-users, (iii) heavy-services distributed in the Cloud.

The proposed conceptual model in Figure 2 has this service graph in input, applies a multi-criteria decision algorithm and realizes deployment/invocation/(replication) actions to schedule/coordinate the service choreography. The decision algorithm takes into account different context inputs extracted from the services (size, performance, etc), from plateforms (mobility, location, etc) and from the user (preferences, profile, etc). This process is autonomic because we think a smartphone has especially to be self-managed, without the user intervention. It is however important the decision algorithm to be user-oriented because a smartphone is really an end-user terminal. The process includes so a retro-action loop from service uses/monitoring feedbacks. This retro-action loop allows to automatically modify the user profile, to change the algorithm inputs by reannotating the service graph, or to adapt the decision algorithm it-self.

SMART AND AUTONOMIC GATEWAY MECHANISMS

After analysing the properties of autonomic systems, we propose several mechanisms implemented in a service-oriented middleware approach (cf Figure 3). The context management is crucial in an autonomous system while these inputs are conditioning the decision. In our approach, we focus the context monitoring on services: their performance, location, mobility, etc. In very highly changing environments such as IoT and Cloud ones, to have a constantly reevaluating algorithm, we use a Listener/Event Notifier approach for each changes. Pertinently qualifying the moment to send an event is critical on a smartphone because a too active monitoring leads to a battery run off and a too passive monitoring do not produce a accurate view of the physical world. We will examine context aggregation and filtering such as in [START_REF] Riboni | COSAR: hybrid reasoning for context-aware activity recognition[END_REF].

2. Collaborative services repositories: Services running on a smartphone can be available for other smartphones in vicinity. Each smartphone holds a local Repository Service that can be discovered by using different discovery protocols. Smartphones can then collaborate, for example, to use all the same service and reduce battery consumption of participants. Aimed collaborative approaches are not those of distributed systems with strong consensus or transaction problems, either are geographically-closed and short-lived collaborations with only local stability.

Adaptive property

3. Adaptive, delayed and opportunistic service deployment and invocation: Deployment and coordination mechanisms need to be adaptive to allow migration or call redirection according to smartphones mobility and/or disconnections. We will use a DTN communication stack implementation (Disrupted-Tolerant Network) in the Communication Service to provide ondemand deployment and most of all -spontaneous and opportunistic deployment such as in [START_REF] Guidec | Opportunistic software deployment in disconnected mobile ad hoc networks[END_REF]. The opportunistic deployment can for instance be implemented by caching services prioritarily from well-known users or from users sharing common interests such as in Social Networks.

Automatic property

4. Smart multi-criteria decision algorithm: Our Service Gateway bridging several worlds -IoT, Cloud, Smartphones and End-users -, the decision algorithm implemented in the Choreography Engine Service has to consider contextual events from the physical environment such as the service location or mobility, from the virtual environment such as the service execution performances, from plateforms such as the battery level and from user such as the service use statistics. This problem of solving multiple constraints is NP-complete but several approaches seems very interesting for mobile environments such as approximation algorithms for constrained knapsack problems [START_REF] Borradaile | Approximation algorithms for constrained knapsack problems[END_REF] or biologically-inspired algorithms [START_REF] Wada | Evolutionary deployment optimization for service-oriented clouds[END_REF][START_REF] Altman | Paradigms for Biologically-Inspired Autonomic Networks and Services -The BIONETS Project eBook[END_REF]. Using the feedback control loop, we will particularly enrich them with a smart learning of the user profile.

CURRENT AND FUTURE WORK

A prototype -AxSeL1 , A conteXtual SErvice Loader -was implemented based on a Felix2 , one Java implementation of the OSGi service-oriented specification3 [START_REF] Ben Hamida | A graph-based approach for contextual service loading in pervasive environments[END_REF][START_REF] Ben Hamida | Déploiement adaptatif d'applications orientées services sur environnements contraints[END_REF]. This prototype can run on constrained devices and locally manages service-oriented application deployment according to hardware resources. It has been tested with a PDF reader application.

As immediate extensions, we will improve the prototype and focus on Smart Building domain with the INSA Lyon project: "The Smart Chappe Building: a Plateform for Contextual Services" 4 . This plateform will allow us to demonstrate the integration and detail (i) the interaction between smartphones and temperature/presence sensors in the building, (ii) the interaction between smartphones and static Wifi hotspots and/or mobile service gateways and (iii) the storage and computation migration of sensed data collected in the building to a cloud.

Figure 1 :

 1 Figure 1: Smartphone Service Gateways Bridging IoT and Cloud Services

Figure 2 :

 2 Figure 2: Smartphone Service Gateway -Conceptual Model

Figure 3 : 1 .

 31 Figure 3: Smartphone Service Gateway -Architecture Overview Aware property 1. Event-based context management: The contextmanagement is crucial in an autonomous system while these inputs are conditioning the decision. In our approach, we focus the context monitoring on services: their performance, location, mobility, etc. In very highly changing environments such as IoT and Cloud ones, to have a constantly reevaluating algorithm, we use a Listener/Event Notifier approach for each changes. Pertinently qualifying the moment to send an event is critical on a smartphone because a too active monitoring leads to a battery run off and a too passive monitoring do not produce a accurate view of the physical world. We will examine context aggregation and filtering such as in[START_REF] Riboni | COSAR: hybrid reasoning for context-aware activity recognition[END_REF].

http://amazones.gforge.inria.fr/, INRIA Amazones Team Forge

http://felix.apache.org/

http://www.osgi.org/


Philippe Manon
email: manon@lagep.univ-lyon1.fr

Claire Valentin

Manon Philippe

Valentin-Roubinet Claire
email: claire@lagep.univ-lyon1.fr

About the trajectory synthesis to go back to nominal mode for a class of hybrid systems

Keywords: hybrid automata, reachability, linear vector fields, state-space MOTS CLES : automate hybride, atteignabilité, champs de vecteurs linéaires, espace d'état

published or not. The documents may come

About the trajectory synthesis to go back to nominal mode for a class of hybrid systems

Introduction

Reactive processes with equally continuous, discrete or hybrid features, may operate in different modes. They are in a nominal mode if all the process parts behave in a normal way. They are in a default mode if at least one of the different parts of the system does not behave in a normal way any more. For instance this is the case if a machine in a manufacturing process breaks down or if the level in a batch process tank oversteps the maximum or minimum allowed level. In this case, the security or the productivity decreases but the global process is not necessarily stopped. It is then a priority to find how to drive the system from its current default mode to one of its nominal mode as soon as possible.

This paper presents parts, dealing with region analytical description, of a new method which synthesizes such a trajectory for hybrid dynamical systems. The studied systems class is modeled by a hybrid automata with linear vector fields. The analysis is led in the state-space and is based on regions computations. The automata is composed of different phases. The initial phase models the system default mode and the final phase models the nominal mode the system must be driven to. The problem can be divided into two steps: a reachability analysis and a controller design.

The method presented in this paper extends Tittus's work [TIT 93], [TIT 98] on integrators hybrid systems to first order switching hybrid systems with linear vector fields. This evolution is important because we now can deal with a larger class of systems as, for example, the concentration dynamics in a batch system reactor. Firstly, a brief example with a system in a default mode which must be driven back to its nominal mode is presented in order to clearly fix the position of the problem.

Then, the useful theory basis which is necessary to solve the problem will be developed. In section 5.2., we will explain how the sets we use can be formally described by a inequations system. The corresponding algorithm will be then briefly described. Other points of the method are presented in [MAN 99a] as the extension criteria which are necessary to solve the reachability problem.

In the last section, we will illustrate the algorithm on the example presented in section 2 and show the results.

Illustration of the problem

The method explained in this paper will be illustrated on the two tanks batch process presented figure 1. The global constraints define the minimal and maximal levels (0m and 4m) during every operating phase for the two tanks. The nominal mode limits are such that the liquid height in each tank stays between a low level (2m) and a high level (2.1m). If this constraint is violated, the system will enter a default mode. In the example, we may assume that a breakdown on the valve V1 has lead the system in a default mode. The level in each tank is then less than 0.1m, i.e. they are almost empty. The question we must solve is to decide whether or not the nominal mode is reachable from this current default mode and what is a possible control sequence which achieves it, in case it is feasible.

The hybrid modeling

The hybrid process is modeled by a hybrid automata [TIT 98], [ASA 95]. As well as Branicky unified model [BRA 94], autonomous and controlled jumps (continuous variable discontinuity) and autonomous and controlled switching (vector field discontinuity) may be represented.

Definition 1:

A hybrid automata HA is defined by a tuple HA=(V D , Q, Σc, µ 1 , µ 2 , µ 3 , Q m ): -V D is the real valued state variables set: V D = {x i , i ∈ {1, ..., n}}. x is the continuous state vector of the system: x=

[x 1 … x n ] T n D V ∈
. The continuous state x is continuously observable.

-Q is the possible phases set (or locations or discrete states) of the hybrid process: Q = {l j , j ∈ {1, ..., m}}. The system global state is given by the couple (x,l)∈ n D V ×Q.

-Σ is the events set. Σ = {δ i,j , i∈{1, …, m}, j∈{1, …, m}/i ≠ j}.

-µ 1 is the set of m vector fields associated with each phase l j . It models the dynamics of the state vector x: µ 1 = {µ 1 (l j ), j ∈ {1, ..., m}}, that is:

∀ ∈ = = l Q l x dx dt f x j j , ( )( ) ( ) 1 µ with f Lipschitz continuous.
µ 2 is the set of constraints for each phase:

{ } { } m ,..., 1 i / ) l ( i 2 2 ∈ µ = µ
. µ 2 (l j ) is the constraint for phase l j . It is a set of l boundaries described by the linear inequalities: C x ≤ d with dim(C)=lxn and dim(d)=lx1. It is not necessarily a state-space partition.

A constraint µ 2 (l j ) can not be violated, which means that the phase l j is left as soon as a constraint µ 2 (l j ) is going to be violated. A discrete transition can be either autonomous or controlled. If the constraint µ 2 (l j ) is going to be violated, a uncontrolled event occurs and the transition is autonomous, else a controlled event occurs and the transition is controlled.

-µ 3 is a set of functions associated to each phase transition:

{ } { } { } k j , m ,..., 1 k , m ,..., 1 j / ) l , , l ( k jk j 3 3 ≠ ∈ ∈ δ µ = µ
. It defines real valued variables jumps when a transition occurs.

Q Q ) l , l ( k j × ∈ ∀ :
if the phase transition exists, then δ jk is defined and

)) t ( x )( l , , l ( ) t ( x / : ) l , , l ( k jk j 3 k jk j 3 - + δ µ = → δ µ
if the phase transition does not exist, then δ jk is not defined and

) l , , l ( k jk j 3 δ µ
is not defined.

If µ 3 (l j , δ jk , l k )(x(t -)) ≠ x(t -), a state jump (or state discontinuity) occurs. -Q m is a set of marked phases, that is initial or final. Υ

In order to simplify the hybrid automata graphical representation:

-µ 1 (l j ) is not represented inside a phase if the vector field µ 1 (l j )(x)=dx/dt=0, that is if the state-variables are constant; -µ 2 (l j ) is not represented inside a phase if it is equal to the global constraint GC, marked phases are represented by double circles. x(t +)=x(t -)

x(t +)=x(t -) x(t +)=x(t -)

x(t +)=x(t -) x(t +)=x(t -) µ 1 1 1 4 3 1 1 4 5 2 2 10 2 3 ( ): & . & . l d d a x x d a x x x x 1 2 = -- = - = - = - ⎧ ⎨ ⎩ µ 1 2 2 4 3 1 1 4 5 2 2 2 2 3 ( ): & . & . l d d a x x d a x x x x 1 2 = -- = -- = - = - ⎧ ⎨ ⎩ [ ] x x x T = 1 2 µ 2 0 01 ( ): . l x 0 ≤ ≤ µ 2 3 2 1 ( ): . l x 2 ≤ ≤ 4 x 0 : GC ≤ ≤

Figure 2. Batch process model

All the possible behaviors of the batch process presented figure 1 are modeled figure 2. The state variables x 1 and x 2 are the liquid heights in the two tanks.

There are two types of valves. V1, V2 and V4 have a constant flow which is equal to d 1 , d 2 and d 4 . Valves V3 and V5 have a flow which is considered proportional with the level in the upstream tank (a 3 .x 1 and a 5 .x 2 ).

The operating constraints force either the valves V1, V3, V4 and V5 to be simultaneously open, which defines the phase 1, or the valves V2, V3, V4 and V5 to be simultaneously open, which defines the phase 2.

The maximum height in the tanks is 4m. The global constraint GC is then defined as: 4 x 0 ≤ ≤ . Every event of Σ is controllable.

Controllability for hybrid dynamic systems (HDS): theoretical basis

If it is possible to drive the process from the initial state to the final state the system is controllable [TIT 93], [TIT 98]. Let remember the fundamental definitions for the hybrid systems controllability. They will be useful to fix the reachability algorithm.

Definition 2:

A hybrid system (of any dimension) is controllable if and only if there exists at least one sequence of discrete control inputs (i.e. of controlled events) that gives an acceptable trajectory along some path in the hybrid automata from any initial state to any final state in a finite time and which respects all the state constraints. Υ

One or more state of the hybrid automata may not belong to the path, as well as one or more states may appear several times in the path. In this method, the reachability analysis is realized backwards, from the final state to the initial state.

The problem is to prove that a transition to any phase l i+1 of the path does not lead to constraint violation, that means that µ 2 (l i+1 ) is respected. The set of acceptable values for the continuous variables which respect µ 2 (l i ) and are included in µ 2 (l i+1 ) after the jump defined by the function ) l , , l (

1 i 1 i , i i 3 + + δ µ
must be calculated. This set will be named jump-set from phase l i to phase l i+1 and will be noted λ li→li+1 . Moreover, this jump-set from phase l i to phase l i+1 may be reached by the process continuous state with the continuous dynamic evolution µ 1 (l i ). Then, the jump-set can be extended to define the extended-jump-set from phase l i to phase l i+1 .

It is noted λext li→li+1 . These concepts are defined in definition 3 and 4 and illustrated figure 3. if l i and l i+1 are two consecutive phases of the hybrid automata, the jump-set from phase l i to phase l i+1 (λ li→li+1 ) is the intersection of the phase constraints µ 2 (l i ) with the inverse image region of the desired reachable set X by the inverse function (µ 3 (l i ,δ (i,i+1) , l i+1 )) -1 (X):

li+ 1 li µ 1 (li) ) l l ( 1 i i + → λ ) l l ( 1 i i ext + → λ X ) l ( 1 i 2 + µ ) l ( i 2 µ ) X )( l , , l ( 1 i 1 i , i i 1 3 + + - δ µ
∀x∈λ li→li+1 , µ 3 (l i ,δ (i,i+1) , l i+1 )(x) ∈ X ∀x∉λ li→li+1 , µ 3 (l i ,δ (i,i+1) , l i+1 )(x) ∉ X i.e. ) X )( l , , l ( ) l ( ) l l ( 1 i 1 i , i i 1 3 i 2 1 i i + + - + δ µ ∩ µ = → λ Υ
More detail will be given about X after the definition of the extended jump-set.

Definition 4: if l i and l i+1 are two consecutive phases of the hybrid automata, the extendedjump-set from phase l i to phase l i+1 (λext li→li+1 ), is the region inside the phase constraint µ 2 (l i ) such that λ li→li+1 is reachable by respecting the dynamic µ 1 (l i ), that is:

{ } ) l l ( )) t ( x )( l ( , t / ) l ( x ) l l ( 1 i i i 1 i 2 1 i i ext + + + → λ ∈ µ ∈ ∃ µ ∈ = → λ Υ We notice that λ li→li+1 ∈ λext li→li+1 .
Explanations about what is X can now be given. Let consider the path π=(l 1 , ... ,l i , l i+1 , l i+2 , ... , l f -1 , l f ). The process initial phase is l 1 and a possible process final phase is l f . The phase index i gives the occurrence order of the different phases in the path (and not the phases number of the model). The same phase can occur several times in the path. Now, let define what is the set X:

if l i = l f-1 then l i+1 is the final state l f of π and X is its constraint set: X = ) l ( f 2 µ if l i ≠ l f-1 then l i+1 is not the final state l f of π and X is the extended jump-set of the two next phases of the path: X= ) l l (

2 i 1 i ext + + → λ .
Then comes corollary 1:

Corollary 1: Given the discrete path π of the hybrid automata leading from the initial phase to a final phase, given i∈{1,…,m}, j∈{1,…,m}/

π ∈ i l , π ∈ j l are two consecutive discrete phases of π: - { } m ,..., 1 i ∈ ∃
, if λ li→li+1 = ∅, then the constraint 2 µ is not respected along the path and it is not possible to reach the final phase from the initial phase.

- { } m ,..., 1 i ∈ ∀
, if λ li→li+1 ≠ ∅, then the final phase is reachable from the initial phase along the path π in a finite time. Υ 5. Controllability of HDS: application to systems with linear vector fields

Assumptions and state-space trajectories

The problem is solved using an analytical approach in the state-space. In the following, except if something else is stated, the system is limited as follow:

Assumptions: -There are only two continuous state variables: x 1 and x 2 -The system has linear vector fields. Moreover the differential equations described by µ 1 are decoupled, accept converging solutions (which are traditional industrial cases) and are globally Lipschitz vector fields:

µ 1 1 1 1 2 2 2 ( ): & . & . l a x b a x b i x x 1 2 = - + = - + ⎧ ⎨ ⎩
with a j ≥ 0 -All the real state-variables in all phases must respect a minimum and a maximum value:

{ } max min j j j x x x , n ,..., 1 j ≤ ≤ ∈ ∀
. Thus the constraint for any phase ) l ( i 2 µ is a rectangle defined by horizontal and vertical lines.

First assumption leads to a 2 dimensional state-space problem but the two next theorems are easily extendable to any higher dimension. However it will not be possible to formally characterize these higher dimension systems [ASA 95] that is there are no formal equations which can exactly describe the shape of the regions we will have to deal with.

Third assumption is not a hard limitation because in practical, the constraints for a real variable are often given with a minimum and a maximum value.

In a 2 dimensional state-space, the value of a j ,

{ } 2 , 1 j∈ ∀
, leads to different cases.

Theorem 1: Given the differential equations described in µ 1 : if a 1 = a 2 = 0, the solutions of the equations are linear and x 2 =f(x 1 ) are straight lines (see figure 4a).

if a 1 or a 2 is null but not both (a 1 =0 or a 2 =0 exclusively), the set of curves x 2 =f(x 1 ) is composed of exponential curves which converge to a vertical or a horizontal asymptotic line ∆ (see figure 4b). The line equation is:

∆:x b a i i i =
if a 1 >0 and a 2 >0, the set of curves x 2 =f(x 1 ) is composed of exponential curves which converge to an equilibrium point x e (see figure 4c and4d), where:

{ } x f o r i 1 , 2 ei = ∈ a b i i
In all cases, the curves x 2 =f(x 1 ) are monotonous.

Υ . .

= +

-is a monotonous curve and if x 1 (t) and x 2 (t) are monotonous, then

x 2 =f(x 1 ) is also monotonous. Therefore, 0 a ≥ ∀ , the solution to & . x a x b = -
+ is a monotonous curve.

-In case 1, a 1 = a 2 = 0 so x t b t C

⎟ ⎟ ⎟ ⎟ ⎠ ⎞ ⎜ ⎜ ⎜ ⎜ ⎝ ⎛ - - ⎟ ⎟ ⎠ ⎞ ⎜ ⎜ ⎝ ⎛ - + = 1 1 10 1 1 1 1 2 a b x a b x ln a a 2 2 20 2 2 2 e . a b x a b x x i0 is the initial value of x i .
This is the equation of exponential curves which converge to the point

⎟ ⎠ ⎞ ⎜ ⎝ ⎛ = 2 2 1 1 2 1 a b , a b ) x , x (
when t tends to infinity.

It is reminded that We notice that figure 4 gives a representation of the state-space when there are only two real valued variables ( n x ∈ , n=2) but theorem 2 is true for any value of n∈ ∠.

Theorem 2:

Given a vector field µ 1 (l i ) of dimension 3 2 where the equilibrium point x e is defined, if the equilibrium point xe is strictly included in the jump-set λ li→li+1 then the extended jump-set λext li→li+1 is bounded by the phase constraint µ 2 (l i ):

λext li→li+1 = µ 2 (l i )
In that case, the equilibrium point can be reached (see figure 4c). Υ

Demonstration 2:

In theorem 2, we are in the case where curves converge to an equilibrium point x e . So, it is possible to reach the jump-set from anywhere in the state-space with the dynamic µ 1 :

if ) l l ( x 1 i i e + → λ ∈ , + ∈ ∃ ∈ ∀ t , x 2 / ) l l ( )) t ( x )( l ( 1 i i i 1 + → λ ∈ µ
[1] By theorem 1, the curves defined by µ 1 (l i ) are monotonous. Thus, 1

x & and 2

x & are either always positive or always negative.

By assumption, the contour of µ 2 is formed of a set of line segments which are horizontal or vertical. So,

{ } 2 , 1 i ∈ ∀ , x i =cst and 0 x i = &
. So, the set of curves defined by µ 1 (l i ) will cross at most one time the lines segment defining the contour of µ 2 (l i ).

If the equilibrium point x e is inside µ 2 (l i ), once a curve defined by µ 1 (l i ) get inside µ 2 (l i ), it will never go out again:

if ) l ( x i 2 e µ ∈ , + ∈ ∀ µ ∈ ∀ t ), l ( x i 2 , ) l ( )) t ( x )( l ( i 2 i 1 µ ∈ µ
[2] As a consequence of [1] and [2], we get:

if ) l ( ) l l ( x i 2 1 i i e µ ⊆ → λ ∈ + , + ∈ ∃ µ ∈ ∀ t ), l ( x i 2 / ) l l ( )) t ( x )( l ( 1 i i i 1 + → λ ∈ µ ′
The constraints µ 2 (l i ), the jump-set λ li→li+1 and the extended jump-set λext li→li+1 are are the different state-space regions (or sets) we can get. Before we go further, it is necessary to define how these regions can formally be described.

Analytical expression for a two dimensions region and for its contour

The aim of this section is to define the existence conditions of an analytical expression which describes the regions we will get.

Definition 5:

The contour of the region R is S(R). It is defined by a set of p boundaries s k (R):

S(R)={s k (R), k ∈{1, …, p}} s k (R
) is a curve segment (or boundary) defined by a curve and two extreme points. Each extreme point ep j (R) belongs to two different boundaries of the contour.of the region. The set of extreme points Pext(R) of a given region R, is defined as follow: Pext(R)={ep j (R), j∈{1, …, p}} A curve segment s k (R) is analytically defined by:

a timed parametered equations system:

s R x f t x f t k ( ): ( ) ( ) 1 1 2 2 = = ⎧ ⎨ ⎩
two extreme points (ep a and ep b ) coordinates:

x ep x ep x ep x ep a a b b 1 2 1 2 ( ) ( ) ( ) ( ) ⎡ ⎣ ⎢ ⎤ ⎦ ⎥ Υ Definition 6:
The half-space Rs k (R) associated to the boundary s k (R) is the half-space which is over or below the boundary s k . It is analytically defined by: Rs R

x f t x ep x x ep x f t k a b ( ): ( ) ( ) ( ) ( ) 1 1 1 1 1 2 2 = ≤ ≤ ≥ ≤ ⎧ ⎨ ⎪ ⎩ ⎪ x f t 2 2
≥ ≤ ( ) means that the equation x 2 =f 2 (t), which is one of the equations defining

s k (R), is transformed into an inequation x f t 2 2 ≤ ( ) or x f t 2 2 ≥ ( ) . Υ
Now, we can easily imagine that taking the intersection of the half-spaces Rs k (R) associated to the set of boundaries s k (R) will define the region R. So an analytical description for these regions seems to be possible. Nevertheless, these regions must verify the property of monotonous regions to be modeled by definition 6 equations / inequations systems.

Definition 7:

Let σ be a point situated on the contour of a region S(R). Let δ be a line which equation is: x i =kΥ3 where i={1, 2}, k may be equal to 0 but it is not compulsory.

Let define the orthogonal projection from S(R) to δ which gives an image η ∈δ to any point σ of S(R):

S R proj ( ) → δ η σ a Let proj -1 be the inverse projection of proj. δ ∈ σ ∀
, if proj -1 (η) has either an infinite number of images or at most only two images belonging to S(R) then the region R is monotonous. Υ

Figure 5 illustrates this property with δ line chosen as a horizontal line. Thus i=2 and its equation is x 2 =k. For specific points δ ∈ η

, the number of image that proj -1 (η) accepts is counted. We notice that a monotonous region has not necessarily a contour composed with a set of monotonous boundaries and a set of monotonous boundaries does not always define a monotonous region.

We also notice that a monotonous region can be non convex.

It is time now to realize the link between the boundaries analytical description and the monotonous regions.

Theorem 3:

If R is a monotonous region and if its contour is composed of a set of boundaries S(R), then an analytical description for R always exists, being the intersection of the half-spaces Rs k (R):

R Rs R k p k = = I 1 ( )
and analytically, R is described by: R

x f t x ep x x ep x f t i p i i ai i bi i i = = ≤ ≤ ≥ ≤ ⎧ ⎨ ⎪ ⎩ ⎪ = U 1 1 1 1 1 1 2 2 ( ) ( ) ( ) ( ) Υ Demonstration 3:
Let R be a monotonous region and s k (R) ∈S(R) be a boundary for R, it always exists an equation system which describes s k (R). Moreover, it always exists an analytical description of the associated half-space Rs k (R).

Let x ∈R be any point of the monotonous region, x will always belong to two half-spaces associated to S(R) and only two.

So, if we generalize to the set of points x defining the region R, R can have an analytical description which is the union of all the systems describing the halfspaces set: R

x f t x ep x x ep x f t i p i i ai i bi i i = = ≤ ≤ ≥ ≤ ⎧ ⎨ ⎪ ⎩ ⎪ = U 1 1 1 1 1 1 2 2 ( ) ( ) ( ) ( )

′

Here is an example which gives the analytical description of a monotonous region (figure 6).

s x t b a C e x t b a C e a x b a a 1 1 1 1 1 2 2 2 2 1 1 2 : ( ) . ( ) . .t .t = - + ≤ - + ≤ ≤ ⎧ ⎨ ⎪ ⎩ ⎪ - - s x t b a C e x t C a x c a t 3 1 1 1 1 2 2 1 1 : ( ) . ( ) . = - + ≥ ≤ ≤ ⎧ ⎨ ⎪ ⎩ ⎪ - x 1 x2 a b c s1 s2 s3 extrem points s x t b t C x t b t C a x c 2 1 1 1 2 2 2 1 : ( ) . ( ) . = + ≤ + ≤ ≤ ⎧ ⎨ ⎪ ⎩ ⎪

Figure 6. Monotonous set analytical description

This analytical method used to describe the regions fits with only 2 dimensional state-spaces. Consequently, the studied systems can have only two state variables.

A n-dimensional monotonous region will have a contour defined by a ndimensional "hypersurface segments" set. For instance, if we have a 2-dimensional monotonous region, its contour is a 2-dimensional curve segment set, if we have a 3dimensional monotonous region, its contour is a 3-dimensional hypercurve segment set which would be a kind of curved plane.

But a n-parameter equations system: x i =f i (t) where i={1, …, n} describes a single curve in a n-dimensional space. So, it is possible to use this kind of equation systems to describe the "hypersurface segments" only when they are curve segments, i.e. when the space dimension is n=2.

About trajectory synthesis with two dimensional monotonous regions

Now we have proven it always exists an analytical description for monotonous regions with contour made of a segment curves set, we want to be sure we will always have to deal with such kinds of regions.

The model we have presented uses three different state-space regions:

the set of m state constraints µ 2 (l i ) the jump-set λ li→li+1 the extended-jump-set λext li→li+1

Firstly, the state constraint of any phase µ 2 (l i ) is rectangular with vertical and horizontal lines by assumption. So it is always monotonous. For the two other sets (λ and λ ext ), we must define conditions which are required to be sure they remain monotonous when time flows and when discrete transitions occur.

The monotonous property conservation for function µ 3 is not well defined but we can note that any action on a state-variable must have an equivalent effect on all the others.

For instance, let consider a two dimensional state-space, i.e. [ ]

2 T 2 1 x x , x ∈ =
. The function µ 3 such that x 1 (t + )=x 1 (t -)+k 1 and x 2 (t + )=x 2 (t -)+k 2 is an example of what is an equivalent effect for both variables.

Moreover, we are sure that if there are no continuous discontinuity when a transition occurs, that is if µ 3 (l i→ l l+1 )=Id, then µ 3 conserves the monotonous property. This is the case in the example presented in section 2 and solved in section 6.

Definition 8:

If λext li→li+1 ≠ µ 2 (l i ), the extended jump-set contour (λext li→li+1 contour) is composed of three kinds of boundaries (or curve segments):

some λ li→li+1 boundaries some µ 2 (l i ) boundaries curve segments which are solutions of the differential equations described by µ 1 (l i ). These curves are called extension curves. they can cross a λ-boundary or be a tangente to λ Υ ,l (

1 i 1 i , i i 3 + + δ µ
conserves the monotonous property and if the evolution function µ 1 (l i ) is such that the state-variables are not coupled, then all the regions we will get when computing the reachability set will be monotonous. So, a formal description of all encountered sets will always be possible. Υ

Corollary 2 defines the conditions we need to be able to formally compute the reachable set using an algorithm.

Algorithm and application to the batch system

λext computation algorithm for two dimensional state-space problems

The hardest step to decide whether a system is controllable or not is the computation of the extended jump-set λext for a given location l i . The algorithm is given below:

initialization of:

the evolution function µ 1 modeled by differential equations the jump-set λ and the constraint set µ 2 by their analytical description if the equilibrium point is defined and is strictly included in the jump-set λ then:

λext = µ 2 else:
calculation of all extreme-points calculation of all the curves having µ 1 (l i ) dynamic trajectory and crossing a λ extreme-point calculation of λ tangential trajectory curves if they exist . We remind that in the current paper, the goal is to present the analytical definition of regions which are necessary to the calculation of the extended jump-set for a given phase.

Application to the batch system

Let us apply this control synthesis methodology to the batch system example described in section 2 (see figure 1) and modeled in section 3 (see figure 2).

A discrete controllable path π must be calculated. It must start from the initial state l 0 and stop at the final state l 3 . The path computation is realized backward. The jump-sets, extended jump-sets and phase constraints are represented in the statespace x 2 =f(x 1 ). A new state-space representation is given for each phase the system goes through.

A controllable discrete path π is synthesized: π=(l 0 , l 1 , l 2 , l 1 , l 3 )

Concluding remarks

We have presented parts, dealing with region analytical description, of a new method which goal is to synthesize a return trajectory from a default mode to one of the nominal modes for hybrid dynamical systems with linear vector fields in a two dimensional state-space. It is an extension of Tittus's works on integrator hybrid systems. A great care has been taken in proving the computability of the state-space regions involved into the reachability analysis.

Firstly, we have presented a brief example with a batch system in a default mode to be driven back to its nominal mode.

Once the position of the problem was clearly fixed, some theoretical reminds from Tittus's researches, necessary to solve the problem, were presented.

Afterward, we have explained it is always possible to formally describe a monotonous region and we have defined the necessary conditions to always have such kind of regions when computing a safe hybrid trajectory.

In the last section, the algorithm which computes the extended jump-set for a given location was given and a solution for the batch system example was presented.

At that point of research, the assumptions made for the continuous state variables x i are rather strong and limit the possible applications field. One next step is to relax them. Particularly systems with coupled variables are now under investigation and first results are positive [CHA 99].

Once the jump-sets and extended jump-sets are computed for a given path, it is necessary to choose a control strategy (e.g. switch as soon as possible, switch as late as possible, …) in order to determine the switching instants.

An another field under investigation is to develop a methodology which can achieve an optimal control strategy. If the criteria to be optimized is time independent, then the control sequence design seems to be computable using pure discrete optimization tools. In the other case, continuous and discrete optimization tools must be combined.

Figure 1 .

 1 Figure 1. The batch process

Figure 3 .

 3 Figure 3. Jump-set λ li→li+1 and extended jump-set λext li→li+1

  a ≥ 0. If a = 0, the solution to a such equation is x t b t C ( ) . = + . This is the equation of a line which is monotonous.If a ≠ 0, the solution is x .C=cst so the sign of x & is always the same when t flows. Thus,

-

  equation of a straight line. In case 2, the differential equation solution is x t b t other dimension. The equation of the curves in the state-j=2 or i=2 and j=1. This is the equation of exponential curves which converge to a horizontal or a vertical asymptotic line ∆:x 0 is the value of x when t=0.The equation of the curves in the state-space are:

Figure 4 .

 4 Figure 4. Different cases for λ and λext

Figure 5 .

 5 Figure 5. Monotonous set -non monotonous set

Figure 9 .

 9 Figure 9. Controllability analysis realized in the state-space

Theorem 4:

The intersection of two monotonous regions is a monotonous region. Υ Demonstration 4: Let define two monotonous regions R a and R b and their contour S(R a ) and S(R b ). It is reminded that a region is monotonous if the orthogonal projection from a horizontal or vertical line to its contour has either an infinite number of images or at most two.

In the current demonstration, the projection line δ is chosen to be horizontal and never cuts the two regions R a and R b :

Let define the two orthogonal projections proj a and proj b such that

can be two points, σ i1 is defined as the furthest point of η and σ i2 as the closest.

If

) ( proj 1 i η is an infinite number of points then we define:

We notice that d(x,y) means the distance between the two points x and y.

So we can always associate two points (σ i1 and σ i2 ) to every

, we must determine which two points of σ a1 , σ a2 , σ b1 and σ b2 must be kept in order to sketch the contour of the R a and R b intersection. These two points are called σ 1 and σ 2 .

, a set of points σ 1 , σ 2 and σ inf is defined. This set will define the contour S(R) of the region R /

Finally, let define

and the inverse projection proj -1 , δ ∈ η ∀ , ) ( proj 1 i η will be:

not defined or one point: σ 1 =σ 2 or two points: σ 1 ≠ σ 2 or an infinite number of points ∈ σ inf Thus S(R) has either an infinite number of images or at most two images. This is the definition of a monotonous region. ′ { }