S Maza
email: samia.maza@ensem.inpl-nancy.fr

innovative production systems of goods and services" STOCHASTIC ACTIVITY NETWORKS FOR THE MODELING OF REPAIRABLE SYSTEMS INCLUDING DIAGNOSIS PERFORMANCE

Keywords: Dependability, Diagnosis, Reconfiguration, Stochastic Activity Networks (SAN)

The productivity and quality requirements have conducted the manufacturing systems to be more and more complex. Indeed, many sub-systems are in interaction such that the process system, the control system and the supervision or diagnosis system. The dependability and availability analysis in those systems is of a major importance, since they impact directly on system's productivity and safety. The aim of this paper is to present a modelling framework based on an extension of Petri nets called Stochastic Activity Networks (SANs) that systematically includes the diagnosis performance for the dependability evaluation. The major advantage of such formalism is that it allows the modelling of dynamic systems by modelling all their possible states. And unlike tools such as automata and Markov processes, the modelling can be done simply and in a compact manner. Fault-tolerant systems are considered in here. That is systems including a diagnosis system to allow fault detection, and backup system(s) to allow fault-recovery. The systems under study are considered repairable. Monte-Carlo simulation study is conducted to show the impact of the diagnosis performance and corrective maintenance actions on the system's availability.

INTRODUCTION

Dependability analysis is an important problem to deal with in modern industrial systems. It is becoming a more and more difficult task due to the rapid technology evolution and increasing complexity of the systems, which often cause the increase of failures occurrence in the system. For manufacturing systems for example, an important failure rate will induce the availability of the system to be low which, at its turn, will reduce the system productivity and throughput. This is why some sub-systems are added to improve the system's dependability, such that supervision or diagnosis systems, and backup systems. The overall system (i.e. the one including the process, supervision and backup systems) is called fault-tolerant system. The supervision system allows the diagnosis of faults. That is the detection and localization of system's faults. However backup systems allow the reconfiguration of the system when faults occur. Obviously, those systems are not completely reliable. Thus, their performances should be included when dealing with the dependability of the overall system. Indeed, the fault detection is based on some diagnosis algorithm which defines a procedure to detect a failure based on some parameters, called design parameters. The choice of those parameters impacts the performance of the diagnosis algorithm, and thus the quality of the detection, and thus the actions that will be taken to recover from the faults. So these parameters act directly on the system's performance such that availability. This means that in one hand, the performance of diagnosis systems should be considered explicitly when evaluating system's dependability. On the other hand, the objectives in term of system's availability, safety, etc should be considered to constrain upstream the diagnosis problem by choosing correctly its design parameters.

The diagnosis problem and dependability analysis and design problem should be considered jointly in order to improve the system's performances. There are only few papers in the literature that deal with the interaction between supervision and dependability analysis and design. For example, Weber et al in (Weber et al., 2007) propose a new approach that improves the performance of the decision making in fault diagnosis by taking into account a priori knowledge of the system/components' reliability. Aslund et al in [START_REF] Aslund | A systematic inclusion of diagnosis peroformance in fault tree analysis[END_REF][START_REF] Aslund | Safety analysis of autonomous systems by extended fault tree analysis[END_REF], consider the safety study of fault tolerant control systems that include diagnosis subsystem. They propose an approach allowing the inclusion of diagnosis performance in the fault-tree analysis in order to evaluate its impact on the overall system's safety. In the same way, Gustafsson et al, propose a method to optimize the detection threshold based on the previously cited approach [START_REF] Gustafsson | On threshold optimization in faulttolerant systems[END_REF]. Bonivento et al [START_REF] Bonivento | Reliability evaluation for fault diagnosis in complex systems[END_REF] propose a procedure for evaluating reliability of diagnostic systems in terms of capability of not generating false alarms and missed diagnosis using statistical tools. Castaneda et al in [START_REF] Castaneda | Simulation de Monte Carlo par automate stochastique hybride: application à un cas test pour la fiabilité dynamique[END_REF] address the problem of dynamic reliability estimation of hybrid systems modelled by stochastic hybrid Automata. Some MOSIM '10 -May 10-12, 2010 -Hammamet -Tunisia diagnosis performances amounts are included in their simulation study. Guenab et al in [START_REF] Guenab | Système tolerant aux défauts : Synthèse d'une méthode de reconfiguration et/ou restructuration intégrant la fiabilité de certains composants[END_REF] deal with the fault tolerant control systems and their reconfiguration. They propose a control strategy that incorporates both reliability and dynamic performance of the system for control reconfiguration.

In this paper, we propose a method to include systematically the diagnosis performance when evaluating system's dependability parameters like the availability. The systems under study are repairable and fault-tolerant. We propose to use the stochastic activity networks (SANs) to model the supervised fault-tolerant system, and the Monte-Carlo simulation to evaluate the system's availability.

This paper is organized as follows:

In section 2, some tools for the dependability analysis are briefly and formally presented. Section 3 presents the principle of detection in diagnosis systems and expresses the performance amounts that will be used later in the paper. Section 4 deals with the inclusion of diagnosis performance in the dependability analysis. Static and dynamic modeling methods are presented. Section 5 is devoted to the simulation study. The model used in simulation will be presented and explained. Some simulation results will be reported and discussed. We conclude the paper in section 6, where many perspectives of our work are given.

DEPENDABILITY ANALYSIS

The dependability of a system is described by various non-functional properties of that system such as, reliability, availability, safety and security [START_REF] Laprie | Dependability: Basic concepts and associated terminology[END_REF]. It can be defined as a property that allows its users to have a justified reliance on the service they are delivered. In this paper, we are dealing with the availability factor. It is defined as the probability that a system is operational at the time of interest.

A variety of classical methods for dependability analysis exist [START_REF] Villemeur | Sûreté de fonctionnement des systèmes industriels, Fiabilité -Facteurs Humains -Informatisation[END_REF]. These include reliability block diagrams (RBDs), Markov processes, failure mode and effect analysis (FMEA), fault-trees analysis (FTA), Petri nets (PNs), Monte-Carlo simulation, etc. Some of these methods are static (such as RBDs and FTA) since they allow the representation of logic relations. Others are dynamic (such as Markov processes, PNs and Monte-Carlo simulation) and allow the modelling of system dynamic states and events. For our needs, only FTA and PNs will be briefly presented.

Static methods: Fault-tree analysis

A fault-tree arises from the logic diagram that is used to analyze the probabilities associated with various causes and their effects. FTA starts by identifying a problem (catastrophic accident or other undesirable result) and all possible ways that a failure occurs. FTA has been widely used for the safety and reliability assessment. It is equivalent to the structure function which defines for a system the set of all components whose failures lead to the failure of the global system. Both FTA and the structure function express the logical relationship between the event "failure of the system" and the events "failure of component j". Then, the probability of the first event can be easily calculated from the probability of the other events (i.e. the failure of its components). An example is shown and explained in paragraph (4.1).

Dynamics methods: Petri nets

General definitions

Petri nets are used for the modelling and validation of discrete event systems in which concurrency, communication, and synchronisation play a major role. They are widely used as a tool for analyzing the safety and dependability of complex systems. First developed by Adam Petri in the 1960s, Petri nets have become a powerful and generic tool for modelling and simulation [START_REF] Cassandras | Introduction to discrete event systems[END_REF]. Formally, a Petri net structure is a directed weighted bipartite graph defined by a 4-tuple N=(P, T, Pre, Post), where T and P are two distinct sets of vertexes (see figure 1). T={t 1 , t 2 ,…t n } is a set of transitions, and P={p 1 , p 2 , …p k } is a set of places. A transition can be seen as an event or an action, and a place represents the condition for the event or the consequence of it. Pre and Post are two applications, defined from the set of arcs to the set of natural numbers  : pre (Pi, Tj): PxT   and post (Ti, Pj): TxP   .

They define the valuation of arcs relating places to transitions (Pre) and transitions to places (Post). If pre (Pi,Tj)=0 (resp. post (Ti,Pj)=0) there is no arc relating Pi to Tj (resp. Ti to Pj). Arcs from P to T are called input arcs and arcs from T to P are called output arcs. A marked Petri net is a 5-tuple N m =(P, T, Pre, Post, M 0 ), where M 0 is the initial marking of the Petri net representing the initial state of the system. It is a k-dimension vector, where k is the number of places. A marking vector could be written as: M=(m 1 , m 2 , …m k )`, where m i is the marking of the place i and indicates the number of tokens in that place. A place with (or without) a token indicates that the state represented by the place is true (or false).

Stochastic activity networks

Stochastic activity networks (SANs) are stochastic extensions to Petri nets. They were first introduced by Mogavar et al., [START_REF] Mogavar | Performability modeling with stochastic activity network[END_REF]. SANs have the modelling power of Petri nets and allow a compact representation of systems. They consist of: places, activities, input gates and output gates.

-Places can be seen as a state of the modelled system. Each place of a SAN contains a certain number of tokens which represents the marking of the place. Places are represented graphically by circles.

-Activities represent actions of the modelled system that could take some specified amount of time to complete. They are similar to transitions in ordinary Petri nets, and are of two types: timed and instantaneous. Timed activities have durations that impact the performance of the modelled system such as a packet transmission time. This duration can be stochastic. Instantaneous activities represent actions that complete or fire immediately when enabled in the system. Activities are graphically represented by thick lines for the timed ones, and thin lines for the instantaneous ones. Unlike autonomous Petri nets, SANs allow the use of uncertainties associated with the completion of an activity. It is called Case probabilities, and is reprensented graphically by small circles on the right side of an activity (see Figure 2). Each case stands for a possible outcome, such as a routing choice in a network, or a failure mode in a faulty system. So each activity in the SAN can have a probability distribution associated with its cases. Moreover, this distribution can depend on the marking of the network at the moment of completion of an activity. This shows how SAN could be a high level modelling formalism.

-Input gates are used to control the "enabling" of activities. An activity is enabled when the conditions, called predicates, of all input gates connected the activity are true. They are graphically represented by triangles, with the flat side inside connected to the activity via its input arc (figure 2).

-Output gates are used to change the state of the system when an activity "completes" by defining the marking change that will occur. They are graphically represented by triangles, with the flat side inside connected to the activity via its output arc (Figure 2).

DIAGNOSIS PERFORMANCE

The diagnosis system is a key component in faulttolerant control system. Indeed, it allows the detection of abnormal functioning of components which is in charge of. One common way in performing diagnosis is the use of a set of tests r i , called residuals, and to compare them to a threshold J i . These residuals are fault indicators and are defined as the difference between the measured values of some system's variables and the expected ones, estimated from the system's fault-free model (Figure 3).

Several methods to perform residual generation and fault detection are proposed in literature (Weber et al., 2007). A residual r i is designed such that r i is small if the system to be diagnosed is okay (OK) and large otherwise. This test quantity is compared to a predefined threshold J i and if then the test is said to alarm and the process to be diagnosed is said to be not okay and will be denoted "KO". Otherwise the system will be considered OK.

i i J r 
The residuals are always corrupted by noise, which affects the decision making. The performance of such tests and the efficiency of detection are related to the probability of two events: false alarm (FA i ) and missed detection (MD i ). In statistical theory, the hypothesis "the component i is OK" is called the null hypothesis of a test and is denoted . Its complementary hypothesis, i.e. "the component i is KO" is denoted . The events: good detection (D), false alarm (FA) and missed detection are related to the residuals value and whether the null hypothesis is true or not as depicted in table 1:

0 i H 1 i H System

Inputs Outputs

Residuals generator The probability of the events FA i and MD i is:

r i
i i J r  0 i H is rejected : r i i J  0 i H is true 1 i H is true Ok MD i FA i D i
) ( ) ( 0 true H J r P FA P i i i i   ) ( ) ( 0 false H J r P MD P i i i i  
A typical example of the evolution of FA and MD probabilities according to the threshold is given in Figure 4.

The choice of threshold adjusts the compromise between a small FA probability and a small MD probability.

DEPENDABILITY OF FAULT TOLERANT SYSTEMS INCLUDING DIAGNOSIS PERFORMANCE

From the preceding section, it appears clearly that the diagnosis performances should be considered when evaluating the system's dependability parameters since decisions are taken according to diagnosis resulting events (reconfiguration when D and FA, corrective maintenance actions, etc.)

Static modeling

In [START_REF] Aslund | Safety analysis of autonomous systems by extended fault tree analysis[END_REF], the authors propose a method to include the diagnosis performances when evaluating the safety of a fault-tolerant system. They propose the use of fault-tree analysis, which is a systematic way to investigate credible causes for an undesired event in a system to happen. As said before, a fault-tree presents the logical relationships between the undesired event and the basic events leading to it (Figure 5).

In the example of Figure 5, the system fails if its component C1 and one of the components C2 or C3 fail together. The probability of the top event (system failure) to occur can be computed if the probabilities of the basic events are known. Here, events e i (i=1,3) represent the failure of component C i .

In order to improve system's reliability by decreasing the probability of system's failure, diagnostic and backup systems are always added. Hence, the system is OK if the original one is OK, or if the backup system is switched on and is OK. The switching depends on the diagnosis results. Hence, the probabilities of D, FA and MD, the same as the failure probability of the backup system could be added into the fault-tree of the overall system as depicted in the example of Figure 6. In this example, the component under diagnosis study is C 2 and the backup system is C 4 . When an alarm A occurs, the system switches from the original one to C 4 . ).

ure 4: The probabilities of FA and MD as func tions of the threshold size -

The global system will fail if the original one fails and no alarm is generated, or when an alarm is generated, the backup system is switched on but it is out of service (Figure 6).

The probability of the top event depends now on the diagnosis performances. When evaluating this probability, the repeated events in the tree should be considered carefully.

Figure 6: The fault-tree of the preceding example including diagnosis performances

Dynamic modelling

The major drawback of the preceding method is that it is suitable only for un-repairable systems and uses a static model. Also, it is only suitable for systems whose backups are in active or hot redundancy, i.e. they operate simultaneously with the original ones from time zero. Static fault-trees are not suitable to model components that are in cold standby redundancy since they are sequentially used in the system at failure times [START_REF] Kuo | Optimal reliability design[END_REF]. Sequential or dynamic models should then be used. In what follows, we propose a dynamic model based on stochastic activity networks, to model the The proposed method will be explained on the example presented previously in Figures 5 and6.

Basically, a Petri net or a SAN can be built based on the system's fault-tree. The following guidelines allow the systematic construction of a SAN model based on the logical relationship between the failure of a system and the failure of its components:

Step 1: each component Cj can be represented with a set of two places: {Cj_OK, Cj_KO}, where a token on place "Cj_OK" (resp. "Cj_KO") means that component Cj is OK (resp. not okay or KO). These two places are related to each other by a timed transition or activity called "Panne j" representing the failure of component j. "Panne j" is represented in Figure 7 with a bold line. The duration could be stochastic (according to an exponential distribution function for example).

Figure 7: the modeling of a physical component

The marking of those places is binary (i.e. one token at most) and are mutually exclusive since a component is in one state or another (i.e. okay or failed).

Step 2: when the failure of two components or more is necessary to conduct the system S to fail, which could be represented by an AND logic gate, an activity with several input places will be used as depicted in Figure 8. Step 3: when the failure of one component in a set of components is sufficient for the system to fail, which could be represented by an OR logic gate, a place modeling the failure of a system with many input transitions is used as shown in Figure 9. Step 4: the diagnostic system is considered as a system which will deliver three possible events: D for good detection of faults, FA for false alarm and MD for missed detection. It could be modeled by a place, called "ALGO", having an initial marking of one token, and three output transitions. Each transition will be given some firing rate based on the probabilities of D, FA and MD events. Only one transition should be enabled and can fire at a time since all these transitions are in a conflict. The autonomous Petri nets and their corresponding software tools cannot handle conflicts but fortunately the SAN does. In fact, when a structural conflict is modeled in a Petri net, this latter must be assorted with a policy to handle this conflict. However, with stochastic Petri nets, such policy is not necessary since the conflict is cleared up thanks to the stochastic aspect. Indeed, in stochastic Petri nets, the events that are associated with the conflicting transitions form a complete system of events, i.e. they are mutually exclusive (Cf. law of total probability). Thus, when enabled only one of them will be fired. With SANs, the three previous transitions associated to the mutual exclusive events D, FA and MD, can be replaced by one activity having several cases and thus, several output arcs (see section 2). Each output arc will be related to an output place representing the fact that: a default is well detected (place Detect), or missed (place MD) or detected however it doesn't exist (place Alarm). Each case is given a probability to be chosen to fire (and the corresponding output arc to be selected) such that the sum of all cases probabilities is 1 (see Figure 10).

Figure 10: The modeling of the diagnosis system and its performance Each of the places {MD, Alarm, Detect} are related to some activities of some sub-models to contribute to their enabling.

Step 5: the backup system BS is also modeled by a set of two places {BS_OK, BS_KO} modeling the fact that it could be okay or failed, as described in step 1. The only difference with the components of step 1, is that the initial marking of the preceding places depends on the redundancy policy of the backup system. If the backup system is used in an active redundancy with the original system, then the place BS_OK will have an initial marking of one token (see step 1). Otherwise, if passive redundancy is used, the initial marking of the both places is zero. A token will be added to BS_OK only when the diagnosis system detect a fault whether the detection is good or not (i.e. the place Detect or Alarm is marked). Then, the marking of "BS_OK" could change to zero if the backup system fails, or if some corrective maintenance actions are undertaken. Indeed, if the component which is considered by the diagnosis system is repaired after fault detection, then the backup system could be switched off. These last remarks, define in some way how the place BS_OK should be related to some output activities other than the failure transition "Panne BS". This situation is illustrated in the simulation model of the next section.

Step 6: The models of components, including the diagnosis system, are combined with each other according to steps 2 and 3, in order to form the overall system.

Our procedure is a generic one and can be used to derive a a SAN model of any fault tolerant system including a diagnosis subsystem. This is possible for example using FMEA method to describe the way that the elementary events like components failures propagate through the system to give a rise to the undesired event: the system's failure. However, the dynamic aspect of these events can be modeled with Petri nets thanks to the markings and the temporal dimension.

SIMULATION STUDY

To drive our simulation study, we used Möbius software tool developed at university of Illinois for modeling complex systems behavior. It is a successor of UltraSAN tool and was originally developed for studying the reliability, availability and performance of computer and network systems. After that, its use has expanded rapidly. The Möbius tool is an environment that supports multiple modeling formalisms such as fault-trees and stochastic activity networks. All our models were developed using Möbius tool.

Description of the SAN model

The system considered in our simulation study is the one used in [START_REF] Aslund | Safety analysis of autonomous systems by extended fault tree analysis[END_REF] and presented in section 3. We developed a stochastic activity network associated to this system according to our algorithm explained in the paragraph (3.2). Each couple of places (Ci, CiKo) is associated to component Ci to describe its two states: okay and failed (i=1, 4). In this example, C2 is the component supervised by the diagnosis system. The diagnosis system is modeled here by 4-tuple of places (Diagnostic, MD_C2, Alarme, Detect) constructed as previously explained ( §3.2). the performances of the diagnosis algorithm (i.e. P(MD), P(FA) and P(D)) are defined in the Case probabilities of the instantaneous activity called "algo". The marking of the place "Detect" models the fact the C2 fails and the failure is well detected by the diagnosis system. Marking the place "Alarme" implies that a failure on C2 was detected however it is okay. Place "MD_C2" marked implies that C2 is failed and it wasn't detected by the diagnosis system. But the failure of C2, even if it's not detected, will contribute to the failure of the original system if C1 fails too. This is why the place "MD_C2" is related to the activity named "Panne12". This activity has also the place "C1Ko" as an input place. The place "Sys_Orig" models the failure of the original system as shown in the fault-tree of Figure 5. It will be marked when "Panne12" or "Panne13" completes. The notation "Panneij" means that "Ci" and "Cj" are both failed. When an alarm is produced by the diagnosis system, whether the system is okay or not, will conduct the original system to switch into its backup system C4. In that case, there are two possibilities: C4 is in an active redundancy with the original system, or in passive redundancy. Also, when an alarm occurs and the backup system is switched-on, corrective maintenance actions could be undertaken on the component C2 considered as failed. So there are 4 possible solutions according to whether C2 is maintained or not, and C4 is in active or passive redundancy. We have derived 4 different SAN models to describe each solution. The model of Figure 11 is the one where C4 is in passive redundancy and C2 is repaired. This is modeled by the place "maint_C2" and there are two ways for a token to arrive there: by the firing of the activities "maintenir1" if good detection, or "maintenir2" if false alarm. Since C4 is considered in passive redundancy, no one of its associated places "C4" and "C4Ko" is initially marked. Place "C4" will be marked to model the switching to the backup system when an alarm is produced, that is by firing "maintenir1" or "maintenir2". Therefore, "C4" is also an output place for those two activities. Place "C4" has two output activities: "Panne4" modeling the failure of C4 and "maintC2" modeling the end of the reparation procedure on C2. If "maintC2" fires before "Panne4", then the token in "C4" will be removed to model the switching-off of component C4.

Otherwise, this token is removed from "C4" and is added to "C4Ko" modeling the failure of C4. This will lead obviously to the failure of the system (firing of "Panne24"). Notice that there are two input gates "I1" and "I2" on arcs relating places "C1" and "C3" to their output activities "Panne1" and "Panne3". These input gates allow the enabling of their associated activities only when the backup system is switched off (i.e. the currently running system is the original one). The predicate (i.e. the logical condition) defined in those input gates is that the marking of "C4" and "C4Ko" is null. Since we are interested in repairable systems, a place modeling the maintenance actions on the global system called "Panne" is defined in the SAN model (see Figure 11). It has a timed output activity called "Reparation" which models actually the maintenance actions. This activity is related to an output gate called "alimentation_en_jetons" which defines the way the tokens are added to all the output places. When place "Panne" is marked, it means that the system or its backup is out of service. Then, maintenance actions are undertaken to repair the overall system, by repairing all its failed components.

MOSIM '10 -May 10-12, 2010 -Hammamet -Tunisia To model that, tokens will be added only to places "Ci" where the couple (Ci, CiKo) is not marked (i=1, 4). This is the output condition defined in the preceding output gate. Notice that activities "Pannej" (j=1, 4), "maintC2" and "reparation" are all timed. We choose exponential distribution for the delays of "Pannej" of a constant rate  j , and a uniform distribution for "maintC2" and "reparation".

Simulation results

To evaluate the impact of diagnosis performance on some performance amounts of the system such as its availability, we conducted a Monte Carlo simulation on the SAN model described before and another model where C2 is not maintained if an alarm is generated. This last one is not presented here. Only its simulation results will be given.

Planning Monte Carlo simulations with Möbius is easy. There is a solving interface which allows the definition of the simulation parameters such that the number of histories to be simulated, the stopping criterion… The stopping criterion that we used is an upper bound on the discrepancy between the results of the simulations (in our study, it is fixed to 10 -3 ). We also chose to simulate at least 50000 histories and at most 800000 histories. This means that the simulator will stop if one of the two preceding conditions is fulfilled. The time duration of each history T h is 20000 time units.

Table 2 shows the values of the timed-activities distribution function parameters used in our simulation study.

Figure 11: The SAN model of the fault tolerant system of [Aslund] including maintenance actions From table 3 and Figure 12, many remarks can be done: First, we can clearly see that if the probability of good detection is set to a fix value (here 80%), when the probability of false alarm increases, the system's availability decreases since the time occupation of place "Panne" increases. This can be seen for both models (i.e. with and without maintenance on C2). This can be explained by the fact that a great rate of false alarms will lead the system to switch a lot to its backup system. This makes the system more vulnerable since if the backup system fails, the system does too, while the original system is switched-off but is actually okay. Notice also that the backup system is less reliable than the original system (see table 2 and the fault-tree of Figure 5).

Second, if we compare the fourth and fifth columns to each other, it can be seen that the availability of the second model is greater to the one of the first model. This is due to the fact that each time an alarm occurs, the backup system is turned-on and a corrective maintenance action on C2 is rapidly undertaken. And when C2 is repaired, the system switches from the backup system to the original one. This policy increases the system availability compared to the one of not maintaining C2. Notice however that when the false alarm rate is important (19%), the two models availabilities are quite close. In fact, when the false alarm rate is important, maintaining C2 will not improve the system's availability greatly in comparison to the first model. Indeed, the system will already switch to the backup one and much time will be spent trying to repair C2 even if it's okay. Third, we can see clearly that the generally used hypothesis that considers that failure detection is done with certainty is too optimistic provided that the system availability is greater than in any other cases and this, for both models.

In this paper, we are not interested in the cost of maintenance, but it could be integrated in the model and may offer a good performance indicator.

The simulation run time varies from few seconds for the SAN model with no maintenance actions on C2 (model 1) to few minutes for one where C2 is maintained (model 2). For example, when P(FA)=P(MD)=10%, the run time is of 71.148 seconds for the model 1 and 171.486 seconds for model 2. The model 2 takes more time in execution since some transitions are fired much more times than the ones in model 1 and thus, these models don't behave similarly. For example, the transition "Maintenir1" is fired in average 22.48 times in model 1 and 120.36 times in model 2 that is at least five times more. The same thing can be said for transition "Maintenir2". This is due to the fact that C2 is maintained each time an alarm is generated and the more it is repaired, the more it is prone to fail again. These simulations were done on an Intel® core™ Duo CPU with a clock speed of 2.26 Ghz.

CONCLUSION

The aim of this paper was to propose a modelling framework based on stochastic activity networks (SAN) to model a fault-tolerant system in order to evaluate its dependability parameters. We showed how the performances of diagnosis system could be taken into account when constructing a dynamic model for a faulttolerant system. We proposed a method for model construction which systematically includes diagnosis performances when the system's structure function is known. This implies of course that a dependability analysis should be done upstream. We presented also our simulation model for a faulttolerant system, where two policies were applied: maintenance and no maintenance on the supervised component. Monte-Carlo simulations were conducted in MOSIM'10 -May 10-12, 2010 -Hammamet -Tunisia both models to evaluate the average of the system's time duration failure and the system's mean availability. Some simulation results were reported in the paper and show the impact of each policy on the overall system's availability. As predicted, corrective maintenance actions on the supervised component improve the availability of the system. The simulation results show also that when the probability of false alarm increases, the availability of the system decreases, and thus for both models. This is due to the fact that detecting a fault falsely will conduct the system to switch to its backup system which makes the system less reliable. It also means that it is better to miss the detection of some faults than to detect them wrongly.

There are many perspectives to this work that we intend to work on. For example, since we are using the Petri nets (or SANs) formalism which is a very flexible modelling way, states other than "Ok" and "not Ok" could be considered to take into account some degrading modes of components/system. Also, the cost analysis study could and should be considered when maintenance actions are provided.

Components time degradation could be also considered.

We also generally suppose that the switching on and off is done instantaneously and with certainty however, this isn't always true. Thus, a probability of successful switching could be considered in the model. Another perspective of this work is to make a feedback from such a dependability evaluation to the diagnosis problem in order to constraint the design of the diagnosis threshold J based on its impact, via FA and MD, on the system's performance such that availability. We are also planning to evaluate with numerical simulation the impact of the threshold (instead of FA and MD events) on the dependability factors.

Figure 1 :

 1 Figure 1: An example of Petri net with three places and transitions (k=3 and n=3)

Figure 3 :

 3 Figure 3: Example illustrating the residuals generator

  Figure 2: Presentation of stochastic activity networks

Figure 5 :

 5 Figure 5: An example of a fault-tree of a three components system

Figure 8 :

 8 Figure 8: Petri net modeling the logic operator AND

Figure 9 :

 9 Figure 9: Petri net modeling the logic operator OR

Table 1 :

 1 Definition of FA and MD events

	Place	Instantaneous activity	Timed activity	Case probability activity (2 cases)
		Input gate		Output gate

Table 2 :

 2 Distribution functions of the timed activitiesIn table 2,  1 and  1 (resp.  2 and  2 ) denote the lower and upper bound of the uniform distribution associated with the timed activity "maintC2" (resp. "reparation").

	Exponential distribution				Uniform distribution
	 1	 2	 3		 4			 1  1  2	 2
	0.0009 0.009 0.0005 0.004 5		20 10 50
	Many simulations were conducted with different values
	of the probabilities FA, MD and D (good detection). For
	that, we fixed the probability of detecting successfully an
	alarm (event D) to 80% and we varied the values of
	P(FA) and P(MD). We also considered the case where
	the hypothesis that the failure detection is done with
	certainty (i.e. P(D)=1). Even if it's false, this hypothesis
	is still widely used in the literature.
	The simulation results are reported in table 3.
	The statistics collected in table 3 are:
	-The average of the time occupation T panne of place
	"Panne" in the SAN model, calculated over 50000
	histories. It is reported in each cellule of the table in
	black thin line.
	-The system's mean availability A, calculated
	according to the relation:	A		1 (		T	h panne T	)		100	, where T h
	is the simulation duration (equal to 20000). The system
	availability is reported in each cellule of the table in red
	bold line.


THE CHARACTERISTIC POLYNOMIALS OF ABELIAN VARIETIES OF DIMENSIONS 3 OVER FINITE FIELDS SAFIA HALOUI

Keywords: Mathematics Subject Classification. 14G15, 11C08, 11G10, 11G25 Abelian varieties over finite fields, Weil polynomials

We describe the set of characteristic polynomials of abelian varieties of dimension 3 over finite fields.

Introduction and results

The isogeny class of an abelian variety over a finite field is determined by its characteristic polynomial (i.e. the characteristic polynomial of its Frobenius endomorphism). We describe the set of characteristic polynomials which occur in dimension 3; this completes the work of Xing [START_REF] Xing | The characteristic polynomials of abelian varieties of dimension three and four over finite fields[END_REF] (we will recall his results in this section). Since the problem has been solved in dimensions 1 and 2 (see [START_REF] Waterhouse | Abelian varieties over finite fields[END_REF], [START_REF] Rück | Abelian surfaces and Jacobian varieties over finite fields[END_REF] and [START_REF] Maisner | Abelian surfaces over finite fields as jacobians[END_REF]), it is sufficient to focus on simple abelian varieties.

Let p(t) be the characteristic polynomial of an abelian variety of dimension g over F q (with q = p n ). Then the set of its roots has the form {ω 1 , ω 1 , . . . , ω g , ω g } where the ω i 's are q-Weil numbers. A monic polynomial with integer coefficients which satisfies this condition is called a Weil polynomial. Thus every Weil polynomial of degree 3 has the form p(t) = t 6 + a 1 t 5 + a 2 t 4 + a 3 t 3 + qa 2 t 2 + q 2 a 1 + q 3 for certains integers a 1 , a 2 and a 3 . The converse is false; indeed, since the absolute value of the roots of p(t) is prescribed (equal to √ q), its coefficients have to be bounded. Section 2 is dedicated to the proof of the following proposition: Theorem 1.1. Let p(t) = t 6 +a 1 t 5 +a 2 t 4 +a 3 t 3 +qa 2 t 2 +q 2 a 1 t+q 3 be a polynomial with integer coefficients. Then p(t) is a Weil polynomial if and only if either

f (t) = (t 2 -q) 2 (t 2 + βt + q)
where β ∈ Z and |β| < 2 √ q, or the following conditions hold [START_REF] Amice | Les nombres p-adiques[END_REF]

|a 1 | < 6 √ q, (2) 4 √ q|a 1 | -9q < a 2 ≤ a 2 1 3 + 3q, (3) - 2a 3 1 27 + a1a2 3 + qa 1 -2 27 (a 2 1 -3a 2 + 9q) 3/2 ≤ a 3 ≤ - 2a 3 1 27 + a1a2 3 + qa 1 + 2 27 (a 2 1 - 3a 2 + 9q) 3/2 , (4) -2qa 1 -2 √ qa 2 -2q √ q < a 3 < -2qa 1 + 2 √ qa 2 + 2q √ q.
The Honda-Tate Theorem gives us a bijection between the set of conjugacy classes of q-Weil numbers and the set of isogeny classes of simple abelian varieties over F q . Moreover, the characteristic polynomial of a simple abelian variety of dimension 3 over F q has the form p(t) = h(t) e where h(t) is an irreducible Weil polynomial and e is an integer. Obviously e must divide 6.

As remarked by Xing [START_REF] Xing | The characteristic polynomials of abelian varieties of dimension three and four over finite fields[END_REF], e cannot be equal to 2 or 6, otherwise p(t) would have a real root and real q-Weil numbers (± √ q) correspond to dimension 1 or 2 (according to the parity of n) abelian varieties (see [START_REF] Waterhouse | Abelian varieties over finite fields[END_REF]).

When e = 3, using a result from Maisner and Nart [3, Proposition 2.5], we get the following proposition, proved by Xing, which gives us the form of h(t).

Proposition 1.2 (Xing). Let β ∈ Z, |β| < 2 √ q.
There exists a simple abelian variety of dimension 3 over F q with h(t) = t 2 + βt + q if and only if 3 divides n and β = aq 1/3 , where a is an integer coprime with p.

It follows that a simple abelian variety of dimension 3 with a reducible characteristic polynomial has p-rank 0; this fact was proved by González [START_REF] González | On the p-rank of an abelian variety and its endomorphism algebra[END_REF]. Note that the Newton polygon of a polynomial from Proposition 1.2 is of type 1/3 (see Figure 4, Section 4).

It remains to see what happens when p(t) is irreducible (e = 1). First, we need an irreducibility criterion for Weil polynomials. In section 3, we prove the following proposition:

Proposition 1.3. Set r = - a 2 1 3 + a 2 -3q and s = 2a 3 1 27 - a 1 a 2 3 -qa 1 + a 3 and ∆ = s 2 - 4 27 r 3 and u = -s + √ ∆ 2 • Then p(t) is irreducible over Q if and only if ∆ = 0 and u is not a cube in Q( √ ∆).
Next, we determine the possible Newton polygons for p(t); this is the aim of Section 4.

Theorem 1.4. Let p(t) = t 6 +a 1 t 5 +a 2 t 4 +a 3 t 3 +qa 2 t 2 +q 2 a 1 +q 3 be an irreducible Weil polynomial. Then p(t) is the characteristic polynomial of an abelian variety of dimension 3 if and only if one of the following conditions holds

(1) v p (a 3 ) = 0, (2) v p (a 2 ) = 0, v p (a 3 ) ≥ n/2 and p(t) has no root of valuation n/2 in Q p , (3) v p (a 1 ) = 0 v p (a 2 ) ≥ n/2, v p (a 3 ) ≥ n and p(t) has no root of valuation n/2 in Q p , (4) v p (a 1 ) ≥ n/3, v p (a 2 ) ≥ 2n/3, v p (a 3 ) = n and p(t) has no root Q p , (5) v p (a 1 ) ≥ n/2, v p (a 2 ) ≥ n, v p (a 3 ) ≥ 3n/2 and p(t) has no root nor factor of degree 3 in Q p .
The p-ranks of abelian varieties in cases 1, 2, 3, 4 and 5 are respectively 3, 2, 1, 0 and 0. The abelian varieties in case 5 are supersingular.

It is possible to make condition (5) of Proposition 1.4 more explicit. Indeed, in [START_REF] Nart | Jacobians in isogeny classes of supersingular threefolds in characteristic 2[END_REF], Nart and Ritzenthaler gave the list of supersingular q-Weil numbers of degree 6. We derive from it the following proposition (see Section 5).

Proposition 1.5. If p(t) is the characteristic polynomial of a supersingular abelian variety of dimension 3 then one of the following conditions holds

(1) (a 1 , a 2 , a 3 ) = (q 1/2 , q, q 3/2 ) or (-q 1/2 , q, -q 3/2 ), q is a square and 7 |(p 3 -1), (2) (a 1 , a 2 , a 3 ) = (0, 0, q 3/2 ) or (0, 0, -q 3/2 ), q is a square and 3 |(p -1), (3) (a 1 , a 2 , a 3 ) = ( √ pq, 3q, q √ pq) or (-√ pq, 3q, -q √ pq), p = 7 and q is not a square, (4) (a 1 , a 2 , a 3 ) = (0, 0, q √ pq) or (0, 0, -q √ pq), p = 3 and q is not a square.

The coefficients of Weil polynomials of degree 6

In order to prove Theorem 1.1, we use Robinson's method (described by Smyth in [7, §2, Lemma]). Fixing a polynomial of degree 3 and doing an explicit calculation we get the following lemma: Lemma 2.1. Let f (t) = t 3 + r 1 t 2 + r 2 t + r 3 be a monic polynomial of degree 3 with real coefficients. Then f (t) has all real positive roots if and only if the following conditions hold:

(1)

r 1 < 0, (2) 0 < r 2 ≤ r 2 1 3 , (3) r1r2 3 - 2r 3 1 27 -2 27 (r 2 1 -3r 2 ) 3/2 ≤ r 3 ≤ r1r2 3 - 2r 3 1 27 + 2 27 (r 2 1 -3r 2 )
3/2 and r 3 < 0. Proof. If f (t) has all real positive roots, so do all its derivates. Thus condition (1) is obvious. Let f ′ 0 (t) be the primitive of f ′′ (t) vanishing at 0; if we add a constant to f ′ 0 (t) so that all its roots are real and positive, we obtain [START_REF] González | On the p-rank of an abelian variety and its endomorphism algebra[END_REF]. Repeating this process with a primitive of f ′ (t) vanishing at 0, we obtain [START_REF] Maisner | Abelian surfaces over finite fields as jacobians[END_REF].

Let x = (x 1 , x 2 , x 3 ) ∈ C 3 and set p x (t) = 3 i=1 (t 2 + x i t + q), (1)
f x (t) = 3 i=1 (t -(2 √ q + x i )) and f x (t) = 3 i=1 (t -(2 √ q -x i )). If p x (t) is a Weil polynomial (thus x i = -(ω i + ω i ),
where ω 1 , ω 1 , . . . , ω g , ω g are the roots of p x (t)) then the roots of f x (t) and f x (t) are real and positive. Conversely, suppose that the roots of f x (t) and f x (t) are real and positive, then if p x (t) has integer coefficients and it is a Weil polynomial.

For i = 1, 2, 3, let a i denote the coefficient associated to p x (t) in Proposition 1.1, s i the ith symmetric function of the x i 's and r i and r i the respective ith coefficients of f x (t) and f x (t).

Expanding the expression of p x (t) in (1), we find

a 1 = s 1 a 2 = s 2 + 3q a 3 = s 3 + 2qs 1 .
In the same way, expanding the expressions of f x (t) and f x (t), we find

r 1 = -6 √ q -s 1 r 1 = -6 √ q + s 1 r 2 = 12q + 4 √ qs 1 + s 2 and r 2 = 12q -4 √ qs 1 + s 2 r 3 = -8q √ q -4qs 1 -2 √ qs 2 -s 3 r 3 = -8q √ q + 4qs 1 -2 √ qs 2 + s 3 .
Therefore we have

r 1 = -6 √ q -a 1 r 1 = -6 √ q + a 1 r 2 = 9q + 4 √ qa 1 + a 2 and r 2 = 9q -4 √ qa 1 + a 2 r 3 = -2q √ q -2qa 1 -2 √ qa 2 -a 3 r 3 = -2q √ q + 2qa 1 -2 √ qa 2 + a 3 .
The polynomials f x (t) and f x (t) satisfy condition 1 of Lemma 2.1 if and only if

|a 1 | < 6 √ q.
The polynomials f x (t) and f x (t) satisfy condition 2 of Lemma 2.1 if and only if

4 √ q|a 1 | -9q < a 2 ≤ a 2 1 3 + 3q.
We find that the first inequality in condition 3 of Lemma 2.1 holds for f x (t) if and only if it holds for f x (t) if and only if

- 2a 3 1 27 + a 1 a 2 3 +qa 1 - 2 27 (a 2 1 -3a 2 +9q) 3/2 ≤ a 3 ≤ - 2a 3 1 27 + a 1 a 2 3 +qa 1 + 2 27 (a 2 1 -3a 2 +9q) 3/2 .
Finally, f x (t) and f x (t) satisfy the second inequality in condition 3 of Lemma 2.1 if and only if

-2qa 1 -2 √ qa 2 -2q √ q < a 3 < -2qa 1 + 2 √ qa 2 + 2q √ q.
Hence Theorem 1.1 is proved.

Irreducible Weil polynomials

Given a Weil polynomial p(t) = g i=1 (t 2 + x i t + q), we consider its real Weil polynomial f (t) = g i=1 (t + x i ). Proposition 3.1. Suppose that g ≥ 2 and p(t)

= (t - √ q) 2 (t + √ q) 2 . Then p(t) is irreducible over Q if and only if f (t) is irreducible over Q.
Proof. Suppose that p(t) is reducible. It is sufficient to prove that p(t) factors as the product of two Weil polynomials (then f (t) will be the product of its associated polynomials). The polynomial p(t) decomposes as p(t) = (t -√ q) 2k (t + √ q) 2ℓ h(t) where h(t) has no real root. If k = ℓ, √ q ∈ Q and p(t) factors obviously. The same conclusion holds when k = ℓ = 0 and h

(t) = 1. If k = ℓ > 1 and h(t) = 1, we have the decomposition p(t) = [(t - √ q) 2 (t + √ q) 2 ][(t - √ q) 2k-2 (t + √ q) 2ℓ-2 ]
. Finally, if k = ℓ = 0, by hypothesis h(t) is the product of two monic non-constant polynomials which are obviously Weil polynomials.

Conversely, if f (t) is reducible, we can assume (possibly changing labels of the x i 's) that there exists an integer k between 1 and (g -1) such that the polynomials k i=1 (t + x i ) and g i=k+1 (t + x i ) have integer coefficients. Thus k i=1 (t 2 + x i t + q) and g i=k+1 (t 2 + x i t + q) have integer coefficients and their product is p(t). Now we focus on the case g = 3. In order to know if p(t) is irreducible, it is sufficient to check if f (t) (a polynomial of degree 3 with all real roots) is irreducible. To do this, we use Cardan's method. Let us recall quickly what it is.

Fixing a polynomial h(t) = t 3 + rt + s, we set ∆ = s 2 -4 27 r 3 . If h(t) has all real roots, we have ∆ ≤ 0. Moreover, ∆ = 0 if and only if h(t) has a double root. When ∆ < 0, we set u = -s+ √ ∆ 2

. The roots of h(t) are in the form (v + v) where v is a cube root of u.

We apply this to f (t

) = t 3 + a 1 t 2 + (a 2 -3q)t + (a 3 -2qa 1 ): Proof of proposition 1.3. We set h(t) = t 3 + rt + s so that f (t) = h(t + a1 3 ). The polynomial f (t) is reducible if and only if it has a root in Q if and only if h(t) has a root in Q. If ∆ = 0, f (t) is reducible. Suppose that ∆ < 0. If u is the cube of a certain v ∈ Q( √ ∆), we have obviously (v + v) ∈ Q. Conversely, if h(t) has a root in Q then u has a cube root v = a + ib with a ∈ Q and we have u = v 3 = (a 3 -3ab 2 ) + ib(3a 2 b -b 2 ).
If a = 0, identifying real parts in the last equality, we see that b

2 ∈ Q, then, identifying imaginary parts, b ∈ Q( √ -∆). Therefore v ∈ Q( √ ∆). If a = 0, then s = 0 and ∆ = 4 27 r 3 = ( 2 3 r) 2 r 3 . Thus u = 1 2 4 27 r 3 = ( r 3 ) 3 is a cube in Q( √ ∆) = Q( r 3 ).

Newton polygons

Let p(t) be an irreducible Weil polynomial of degree 3 and e the least common denominator of v p (f (0))/n where f (t) runs through the irreducible factors of p(t) over Q p (the field of p-adic numbers). By [START_REF] Milne | Abelian varieties over finite fields[END_REF], p(t) e is the characteristic polynomial of a simple abelian variety. Thus p(t) is the characteristic polynomial of an abelian variety of dimension 3 if and only if e is equal to 1 that is, v p (f (0))/n are integers. One way to obtain information about p-adic valuations of the roots of p(t) is to study its Newton polygon (see [START_REF] Weiss | Algebraic number theory[END_REF]). The condition "v p (f (0))/n are integers" implies that the projection onto the x-axis of an edge of the Newton polygon having a slope ℓn/k (with pgcd(ℓ, k) = 1) has length a multiple of k. We graph the Newton polygons satisfying this condition and in each case, we give a necessary and sufficient condition to have e = 1. The obtained results are summarized in Theorem 1.4.

Ordinary case: v p (a 3 ) = 0
The Newton polygon of p(t) is represented in Figure 1 This is the Newton polygon of p(t) if and only if v p (a 3 ) ≥ n/2. If this condition holds, p(t) has a factor in Q p of degree 2 with roots of valuation n/2 and thus e = 1 if and only if this factor is irreducible, that is, if and only if p(t) has no root of valuation n/2 in Q p (note that when n is odd, this last condition always holds).

p-rank 1 case: v p (a 3 ) > 0, v p (a 2 ) > 0 and v p (a 1 ) = 0

The only Newton polygon for which e = 1 is represented in Figure 3. This is the Newton polygon of p(t) if and only if v p (a 2 ) ≥ n/2 and v p (a 3 ) ≥ n. If these conditions hold, p(t) has a factor in Q p of degree 4 with roots of valuation n/2 and thus e = 1 if and only if this factor has no root in Q p , that is, if and only if p(t) has no root of valuation n/2 in Q p . This is the Newton polygon of p(t) if and only if v p (a 1 ) ≥ n/2, v p (a 2 ) ≥ n and v p (a 3 ) ≥ 3n/2. If these conditions hold, e = 1 if and only if p(t) has no root nor factor of degree 3 in Q p .

Supersingular case

Nart and Ritzenthaler [START_REF] Nart | Jacobians in isogeny classes of supersingular threefolds in characteristic 2[END_REF] proved that the only supersingular q-Weil numbers of degree six are

± √ qζ 7 , ± √ qζ 9 , if q is a square, √ qζ 28 (p = 7), √ qζ 36 (p = 3), if q is not a square,
where ζ n is a primitive nth root of unity. We will use this result to obtain a list of possible supersingular characteristic polynomials as stated in Proposition 1.5. We will have to calculate the minimal polynomial of some algebraic integers; in order to do this, we will often use the (trivial) fact that if α is a root of f (t) = n i=0 b i t n-i and a ∈ C then aα is a root of f a (t) = n i=0 b i a i t n-i . We denote by φ n (t) the nth cyclotomic polynomial.

• If q is a square, as φ 7 (t) = t 6 + t 5 + t 4 + t 3 + t 2 + t + 1, the minimal polynomial of √ qζ 7 (respectively -√ qζ 7 ) is p(t) = t 6 + q 1/2 t 5 + qt 4 + q 3/2 t 3 + q 2 t 2 + q 5/2 t + q 3 (resp. p(t) = t 6 -q 1/2 t 5 + qt 4 -q 3/2 t 3 + q 2 t 2 -q 5/2 t + q 3 ). If p = 7, p(t) has no factor of degree 1 and 3 over Q p if and only if Q p and its cubic extensions do not contain a 7th primitive root of unity; this is equivalent (see [1, Proposition 2.4.1., p.53]) to 7 |(p 3 -1). In the same way, φ 9 (t) = t 6 + t 3 + 1 and the minimal polynomial of √ qζ 9 (respectively -√ qζ 9 ) is p(t) = t 6 + q 3/2 t 3 + q 3 (resp. p(t) = t 6 -q 3/2 t 3 + q 3 ). If p = 3, p(t) have no factor of degree 1 and 3 over Q p if and only if 3 |(p -1).

If p = 7 in the first case or p = 3 in the second case, p(t) is irreducible over Q p (apply Eisenstein's Criterion to p(t + 1)).

• Suppose that q is not a square. When p = 7, as φ 28 (t) = t 12 -t 10 +t 8 -t 6 +t 4 -t 2 +1, the monic polynomial with roots √ qζ 28 is t 12 -qt 10 + q 2 t 8 -q 3 t 6 + q 4 t 4 -q 5 t 2 + q 6 which is the product of t 6 + √ pqt 5 + 3qt 4 + q √ pqt 3 + 3q 2 t 2 + q 2 √ pqt + q 3 and t 6 -√ pqt 5 + 3qt 4 -q √ pqt 3 + 3q 2 t 2 -q 2 √ pqt + q 3 . When p = 3, as φ 36 (t) = t 12 -t 6 + 1, the monic polynomial with roots √ qζ 36 is t 12 -q 3 t 6 + q 6 which is the product of t 6 + q √ pqt 3 + q 3 and t 6 -q √ pqt 3 + q 3 . The resulting polynomials are characteristic polynomials of abelian varieties of dimension 3 (see [START_REF] Nart | Jacobians in isogeny classes of supersingular threefolds in characteristic 2[END_REF]).

Figure 1 . 2 Figure 2 .

 122 and we always have e = 1. Ordinary case p-rank 2 case: v p (a 3 ) > 0 and v p (a 2 ) = 0 The only Newton polygon for which e = 1 is represented in Figure p-rank 2 case

Figure 3 . 4 Figure 4 .Figure 5 .

 3445 p-rank 1 case p-rank 0 case: v p (a 3 ) > 0, v p (a 2 ) > 0 and v p (a 1 ) > 0 There are two Newton polygons for which e = 1. One is represented in Figure Type 1/3 case This is the Newton polygon of p(t) if and only if v p (a 1 ) ≥ n/3, v p (a 2 ) ≥ 2n/3 and v p (a 3 ) = n. If these conditions hold, p(t) has two factors in Q p of degree 3, one with roots of valuation 2n/3 and the other with roots of valuation n/3; e = 1 if and only if those factors are irreducible in Q p , that is, if and only if p(t) has no root in Q p .The other Newton polygon is represented in Figure5; the corresponding abelian varieties are supersingular. Supersingular case

Acknowledgements

I would like to thank Christophe Ritzenthaler for suggesting this work and for helpful discussions. I would also like to thank my thesis advisor, Yves Aubry, for his helpful comments and Hamish Ivey-Law for his careful reading of this paper.


David Nualart

Bruno Saussereau

Malliavin calculus for stochastic differential equations driven by a fractional Brownian motion

Introduction

Let B = {B t , t ≥ 0} be an m-dimensional fractional Brownian motion (fBm in short) of Hurst parameter H ∈ (0, 1). That is, B is a centered Gaussian process with the covariance function E(B i s B j t ) = R H (s, t)δ ij , where

R H (s, t) = 1 2 t 2H + s 2H -|t -s| 2H . (1)
If H = 1 2 , B is a Brownian motion. From [START_REF] Baudoin | A version of Hörmander's theorem for the fractional brownian motion[END_REF], it follows that E |B t -B s | 2 = m|t -s| H so the process B has α-Hölder continuous paths for all α ∈ (0, H). We refer to [START_REF] Nualart | Stochastic integration with respect to fractional Brownian motion and applications. 3-39[END_REF] and references therein for further information about fBm and stochastic integration with respect to this process.

In this article we fix 1 2 < H < 1 and we consider the solution {X t , t ∈ [0,T ]} of the following stochastic differential equation on R d

X i t = x i 0 + m j=1 t 0 σ ij (X s )dB j s + t 0 b i (X s )ds , t ∈ [0,T ] , (2)
i = 1, . . . , d, where x 0 ∈ R d is the initial value of the process X.

The stochastic integral in ( 2) is a path-wise Riemann-Stieltjes integral (see Young [START_REF] Young | An inequality of the Hölder type connected with Stieltjes integration[END_REF]). Suppose that σ has bounded partial derivatives which are Hölder continuous of order λ > 1 H -1, and b is Lipschitz, then there is a unique solution to Equation (2) which has Hölder continuous trajectories of order H -ε, for any ε > 0. This result has been proved by Lyons in [START_REF] Lyons | Differential equations driven by rough signals (I): An extension of an inequality of L.C. Young[END_REF] in the case b = 0, using the p-variation norm. The theory of rough paths analysis introduced by Lyons in [START_REF] Lyons | System control and rough paths[END_REF] was used by Coutin and Qian to prove an existence and uniqueness result for Equation [START_REF] Coutin | Stochastic analysis, rough path analysis and fractional Brownian motions[END_REF] in the case H ∈ ( 1 4 , 1 2 ) (see [START_REF] Coutin | Stochastic analysis, rough path analysis and fractional Brownian motions[END_REF]). The Riemann-Stieltjes integral appearing in Equation ( 2) can be expressed as a Lebesgue integral using a fractional integration by parts formula (see Zähle [START_REF] Zähle | Integration with respect to fractal functions and stochastic calculus[END_REF]). Using this formula for the Riemann-Stieltjes integral, Nualart and Rȃşcanu have established in [START_REF] Nualart | Differential Equations driven by fractional Brownian motion[END_REF] the existence of a unique solution for a class of general differential equations that includes [START_REF] Coutin | Stochastic analysis, rough path analysis and fractional Brownian motions[END_REF].

The main purpose of our work is to study the regularity of the solution to Equation [START_REF] Coutin | Stochastic analysis, rough path analysis and fractional Brownian motions[END_REF] in the sense of Malliavin calculus, and to show the absolute continuity for the law of X t for t > 0, assuming an ellipticitity condition on the coefficient σ. First we establish a general result on the regularity with respect to the driven function for the solution of deterministic equations, using the techniques of fractional calculus developed in [START_REF] Nualart | Differential Equations driven by fractional Brownian motion[END_REF]. This allows us to deduce the differentiability of the solution to Equation [START_REF] Coutin | Stochastic analysis, rough path analysis and fractional Brownian motions[END_REF] in the direction of the Cameron-Martin space. These results are related to those proved by Lyons and Dong Li in [START_REF] Lyons | Smoothness of Itô's maps and simulated annealing on path spaces[END_REF] on the smoothness of Itô maps for such equations in term of Fréchet-Gâteaux differentiability.

The regularity results obtained here have been used in a recent paper by Baudoin and Hairer [START_REF] Baudoin | A version of Hörmander's theorem for the fractional brownian motion[END_REF] to show the smoothness of the density under a hypoellipticity Hörmander's condition. This result requires also the existence of moments for the iterated derivatives, which has been established in [START_REF] Hu | Differential equations driven by Hölder continuous functions of order greater than 1/2[END_REF]. In [START_REF] Nourdin | On the absolute continuity of one-dimensional SDEs driven by a fractional Brownian motion[END_REF], the existence of a density for the solution of a one-dimensional equation is shown.

The paper is organized as follows. In Section 2 we establish the Fréchet differentiability with respect to the input function for deterministic differential equations driven by Hölder continuous functons. Section 3 is devoted to analyze stochastic differential equations driven by a fBm with Hurst parameter H ∈ ( 1 2 , 1), the main result being the differentiability of the solution in the directions of the Cameron-Martin space. In Section 4 we prove the absolute continuity of the solution under ellipticity assumptions. The proofs of some technical results are given in the Appendix.

Deterministic differential equations driven by rough functions

We first introduce some preliminaries. Given a measurable function f : [0,T ] → R d and α ∈ (0, 1 2 ), we will make use of the notation

∆ α t (f ) = |f (t)| + t 0 |f (t) -f (s)| |t -s| α+1 ds.
We denote by W α 1 (0, T ; R d ) the space of measurable functions f :

[0,T ] → R d such that f α,1 := sup t∈[0,T ] ∆ α t (f ) < ∞ .
For any 0 < λ ≤ 1, denote by C λ (0, T ; R d ) the space of λ-Hölder continuous functions f : [0,T ] → R d , equipped with the norm

f λ := f ∞ + sup 0≤s<t≤T |f (t) -f (s)| (t -s) λ ,
where

f ∞ := sup t∈[0,T ] |f (t)|. We denote by W 1-α 2 (0, T ; R m ) the space of measurable functions g : [0,T ] → R m such that g 1-α,2 := sup 0≤s<t≤T |g(t) -g(s)| (t -s) 1-α + t s |g(y) -g(s)| (y -s) 2-α dy < ∞ .
Clearly for any ε > 0 such that 1 -α+ ε ≤ 1 we have

C α+ε (0,T ; R d ) ⊂ W α 1 (0, T ; R d ) and C 1-α+ε (0, T ; R m ) ⊂ W 1-α 2 (0, T ; R m ) ⊂ C 1-α (0, T ; R m ) .
For d = m = 1 we simply write W α 1 (0, T ), C λ (0,T ), and

W 1-α 2 (0, T ).
Suppose that g ∈ W 1-α 2 (0, T ) and f ∈ W α 1 (0, T ). In [START_REF] Zähle | Integration with respect to fractal functions and stochastic calculus[END_REF], Zähle introduced the generalized Stieltjes integral

T 0 f t dg t = (-1) α T 0 D α 0+ f (t) D 1-α T -g T -(t)dt, (3)
defined in terms of the fractional derivative operators

D α 0+ f (x) = 1 Γ(1 -α) f (x) x α + α x 0 f (x) -f (y) (x -y) α+1 dy , and
D α T -g T -(x) = (-1) α Γ(1 -α) g(x) -g(T ) (T -x) α + α T x g(x) -g(y) (x -y) α+1 dy .
We refer to [START_REF] Samko | Fractional integrals and derivatives, Theory and applications[END_REF] for further details on fractional operators. Zähle proved that if f ∈ C α+ε (0, T ), then this integral coincides with the Riemann-Stieltjes integral, which exists by the results of Young (see [START_REF] Young | An inequality of the Hölder type connected with Stieltjes integration[END_REF]). Using formula (3), Nualart and Rȃşcanu have derived the following estimates (see [START_REF] Nualart | Differential Equations driven by fractional Brownian motion[END_REF], Propositions 4.1 and 4.3).

Proposition 1 Fix 0 < α < 1 2 . Given two functions g ∈ W 1-α 2 (0, T ) and f ∈ W α 1 (0, T ), we denote G t (f ) = t 0 f s dg s and F t (f ) = t 0 f s ds.
(i) The function G(f ) belongs to C 1-α (0, T ) and we have

∆ α t (G(f )) ≤ c α,T g 1-α,2 t 0 (t -r) -2α + t -α ∆ α r (f )dr , (4)
G(f ) 1-α ≤ c α,T g 1-α,2 f α,1 , (5)
with a constant c α,T which depends only on α and T .

(ii) The function F (f ) belongs to C 1 (0, T ) and moreover

∆ α t (F (f )) ≤ c α,T t 0 |f s | (t -s) α ds , (6)
F (f ) 1 ≤ c T f ∞ , (7)
with a constant c α,T which depends only on α and T .

We first study deterministic differential equations driven by Hölder continuous functions of order stricktly larger that 1 2 . Fix 0

< α < 1 2 . Let g ∈ W 1-α 2 (0, T ; R m ) and consider the deterministic differential equation on R d x i t = x i 0 + t 0 b i (x s )ds + m j=1 t 0 σ ij (x s )dg j s , t ∈ [0,T ] , (8)
i = 1, . . . , d, where

x 0 ∈ R d .
For any integer k ≥ 1 we denote by C k b the class of real-valued functions on R d which are k times continuously differentiable with bounded partial derivatives up to the kth order. We also denote by C ∞ b the class of infinitely differentiable functions on R d with bounded partial derivatives of all orders.

In [START_REF] Nualart | Differential Equations driven by fractional Brownian motion[END_REF], the authors prove that Equation (8) has a unique solution x ∈ W α 1 (0, T ; R d ) which is moreover (1 -α)-Hölder continuous, if b i , σ ij ∈ C 1 b and the partial derivatives of σ ij are Hölder contiuous of order λ > 1 H -1. In this section we will show the differentiability of the mapping g → x(g). For a function ϕ from R p to R, we set ∂ k ϕ = ∂ϕ ∂xx . The first setp is to establish the existence and uniqueness of a solution for linear equations that are generalizations of [START_REF] Lyons | Smoothness of Itô's maps and simulated annealing on path spaces[END_REF]. The iterated derivatives of the solution of Equation ( 8) satisfy these kind of equations.

Proposition 2 Fix g ∈ W 1-α 2 (0, T ; R m ) and consider the following linear equation:

y t = w t + t 0 B s y s ds + t 0 S s y s dg s , (9)
where

w ∈ C 1-α (0, T ; R d ), S ∈ C 1-α (0, T ; R d×d×m ) and B ∈ C 1-α (0, T ; R d×d ).
There exists a unique solution y ∈ C 1-α (0, T ; R d ) of Equation ( 9) which satisfies

y α,1 ≤ c 1 w α,1 exp c 2 g 1 1-2α 1-α,2 ( B ∞ + S 1-α ) , (10)
where c 1 and c 2 depend only on α and T .

Proof. The existence and uniqueness of a solution can be established following the same lines as in the proof of Theorem 5.1 of [START_REF] Nualart | Differential Equations driven by fractional Brownian motion[END_REF]. Let us prove the estimate [START_REF] Nualart | The Malliavin Calculus and Related Topics[END_REF]. Set F B t = t 0 B s y s ds and G S t = t 0 S s y s dg s . Using (4) we have

∆ α t (G S ) ≤ c α,T g 1-α,2 t 0 (t -s) -2α + s -α ∆ α s (Sy)ds ≤ c α,T g 1-α,2 t 0 (t -s) -2α + s -α |y s | × s 0 S 1-α (s -r) 1-α (s -r) α+1 dr ds + S 1-α t 0 (t -s) -2α + s -α ∆ α s (y)ds ≤ c α,T g 1-α,2 S 1-α t 0 (t -s) -2α + s -α ∆ α s (y)ds,
where the constant c α,T may vary from line to line but depends only on α and T . On the other hand, using (6) we get

∆ α t (F B ) ≤ c α,T B ∞ t 0 |y s | (t -s) α ds .
Then the above inequalities yield that

∆ α t (y) ≤ w α,∞ + c α,T (Λ α (g) S 1-α + B ∞ ) t 0 (t -s) -2α + s -α h s ds .
Applying a Gronwall-type Lemma (see Lemma 7.6 in [START_REF] Nualart | Differential Equations driven by fractional Brownian motion[END_REF]) we derive the estimate [START_REF] Nualart | The Malliavin Calculus and Related Topics[END_REF].

The following technical lemma is a basic ingredient in the proof of the Fréchet differentiability of the mapping x → x(g), where x is the solution of Equation [START_REF] Lyons | Smoothness of Itô's maps and simulated annealing on path spaces[END_REF].

Lemma 3 Let x be the solution of [START_REF] Lyons | Smoothness of Itô's maps and simulated annealing on path spaces[END_REF]. Assume b i , σ ij ∈ C 3 b . Then the mapping

F : W 1-α 2 (0, T ; R m ) × W α 1 (0, T ; R d ) → W α 1 (0, T ; R d ) defined by (h, x) → F (h, x) := x -x 0 - • 0 b(x s )ds - • 0 σ(x s )d(g s + h s ) (11)
is Fréchet differentiable and we have for any

(h, x) ∈ W 1-α 2 (0, T ; R m )×W α 1 (0, T ; R d ), k ∈ W 1-α 2 (0, T ; R m ), v ∈ W α 1 (0, T ; R d ), and i = 1, . . . , d D 1 F (h, x)(k) i t = - m j=1 t 0 σ ij (x s )dk j s , (12)
D 2 F (h, x)(v) i t = v i t - d k=1 t 0 ∂ k b(x s )v k s ds - d k=1 m j=1 t 0 ∂ k σ ij (x s )v k s d(g j s + h j s ). ( 13
)
Proof. For (h, x) and ( h, x) in

W 1-α 2 (0, T ; R m ) × W α 1 (0, T ; R d ) we have F (h, x) t -F ( h, x) t = x t -xt + t 0 (b(x s ) -b(x s )) ds - t 0 (σ(x s ) -σ(x s )) (g s + h s ) - t 0 σ(x s )(h s -hs ).
Using Proposition 1 one easily deduce that

F (h, x) -F ( h, x) α,1 ≤ (1 + c α,T ∂b ∞ ) x -x α,∞ + c α,T g + h 1-α,2 σ(x) -σ(x) α,∞ + c α,T σ(x) α,∞ h -h 1-α,2
.

Since σ is a Lipschitz function we have σ(x) α,1 ≤ |σ(0)|+ ∂σ ∞ x α,1 . Using the fact that for any x 1 , x 2 , x 3 and x 4 :

|σ(x 1 ) -σ(x 2 ) -σ(x 3 ) + σ(x 4 )| ≤ ∂σ ∞ |x 1 -x 2 -x 3 + x 4 | + ∂ 2 σ ∞ |x 1 -x 3 | (|x 1 -x 2 | + |x 3 -x 4 |) , it follows that σ(x) -σ(x) α,1 ≤ ∂σ ∞ + ∂ 2 σ ∞ ( x α,1 + x α,1 ) x -x α,1 .
Consequently, there exists a constant C depending on α, T and the coefficients b and σ such that

F (h, x) -F ( h, x) α,1 ≤ (1 + C ( x α,1 + x α,1 ) g + h 1-α,2 ) x -x α,1 +C(1 + x α,1 ) h -h 1-α,2 ,
which implies that F is continuous.

We now prove that it is differentiable with respect to x. Thanks to Proposition 1, it holds that D 2 F defined in (13) satisfies

D 2 F (h, x)(v) α,1 ≤ c v α,1 ,
and, therefore, it is continuous. Let us now check that for any h ∈ W 1-α 2 (0, T ; R m ), D 2 F is the Fréchet derivative (with respect to x) of (h, x) → F (h, x). We have

F (h, x + v) t -F (h, x) t -D 2 F (h, x)(v) t = t 0 (b(x s ) -b(x s + v s ) + ∂b(x s )v s ) ds + t 0 (σ(x s ) -σ(x s + v s ) + ∂σ(x s )v s ) d(g s + h s ). ( 14
)
By the mean value theorem we can write

|b(x s ) -b(x s + v s ) + ∂b(x s )v s | ≤ ∂ 2 b ∞ |v s | 2
and thanks to [START_REF] Lyons | System control and rough paths[END_REF] one easily remarks that

• 0 (b(x s ) -b(x s + v s ) + ∂b(x s )v s ) ds 1 ≤ c α,T ∂ 2 b ∞ v 2 α,1 .
Similar computations for the second term of the right hand side of ( 14) yield

• 0 (σ(x s ) -σ(x s + v s ) + ∂σ(x s )v s ) d(g s + h s ) α,1 ≤ c α,T ∂ 2 σ ∞ + ∂ 3 σ ∞ x α,1 g + h 1-α,2 v 2 α,1 .
Thus it follows that

F (h, x + v) -F (h, x) -D 2 F (h, x)(v) α,1 ≤ C g + h 1-α,2 v 2 α,1 ,
where

C depends on α, T , ∂ 2 b ∞ , ∂ 2 σ ∞ , ∂ 3 σ ∞ and x α,1 . Then (h, x) → F (h, x)
is Fréchet differentiable with respect to x and (13) holds. Similar arguments give the differentiability with respect to h and Formula [START_REF] Nualart | Differential Equations driven by fractional Brownian motion[END_REF].

Proposition 4 Let x be the solution of Equation [START_REF] Lyons | Smoothness of Itô's maps and simulated annealing on path spaces[END_REF].

Assume b i , σ ij ∈ C 3 b . The mapping g → x(g) from W 1-α 2 (0, T ; R m ) into W α 1 (0, T ; R d ) is Fréchet differentiable and for any h ∈ W 1-α 2 (0, T ; R m ) its derivative in the direction h is given by D h x i t = m j=1 t 0 Φ ij t (s)dh j s , (15)
where

for i = 1, . . . , d, j = 1, . . . , m, 0 ≤ s ≤ t ≤ T , s → Φ ij t (s) satisfies: Φ ij t (s) = σ ij (x s ) + d k=1 t s ∂ k b i (x u )Φ k,j u (s)du + d k=1 m l=1 t s ∂ k σ il (x u )Φ k,j u (s)dg l u , ( 16
) and Φ ij t (s) = 0 if s > t.
Proof. We apply the implicit function theorem to the functional F defined by [START_REF] Nualart | Stochastic integration with respect to fractional Brownian motion and applications. 3-39[END_REF] in Lemma 3. For any (h, x), F (h, x) belongs to C 1-α (0, T ; R d ) thanks to Proposition 1. Since x is a solution of ( 8), one remarks that F (0, x) = 0. Thanks to Lemma 3, the mapping F is Fréchet differentiable with first partial derivatives with respect to h given by [START_REF] Nualart | Differential Equations driven by fractional Brownian motion[END_REF] and the first partial derivative with respect to x is given by [START_REF] Samko | Fractional integrals and derivatives, Theory and applications[END_REF]. We have to check that D 2 F (0, x) is a linear homeomorphism from

W α 1 (0, T ; R d ) to C 1-α (0, T ; R d ).
By the open map theorem it suffices to show that it is bijective and continuous. We apply Proposition 2 with t → B t = ∂b(x t ) and t → S t = ∂σ(x t ) which are (1 -α)-Hölder continuous. Thus

D 2 F (0, x)(v) i t = v i t - d k=1 t 0 ∂ k b i (x s )v k s ds - d k=1 m j=1 t 0 ∂ k σ ij (x s )v k s dg j s
is a one-to-one mapping thanks to the existence and uniqueness result of Equation ( 8). Now we fix w ∈ C 1-α (0, T ; R d ). Thanks to Proposition 2, there exists

v ∈ W α 1 (0, T ; R d ) such that w = D 2 F (0, x)(v), hence D 2 F (0, x)
is onto and then it is a bijection. We already know that it is continuous. By the implicit function theorem g → x(g) is continuously Fréchet differentiable and

Dx = -D 2 F (0, x) -1 • D 1 F (0, x) . (17)
So for any

k ∈ W 1-α 2 (0, T ; R m ), -Dx(k)
is the unique solution of the differential equation

w i t = -Dx(k) i t + d k=1 t 0 ∂ k b(x s )Dx(k) k s ds + d k=1 m j=1 t 0 ∂ k σ ij (x s )Dx(k) k s dg j s with w i t = D 1 F (0, x)(k) t = - m j=1 t 0 σ ij (x s )dk j s .
On the other hand, from Equation ( 16) we get

m j=1 t 0 Φ ij t (s)dh j s = m j=1 t 0 σ ij (x s )dh j s + m j=1 t 0 d k=1 t s ∂ k b i (x u )Φ k,j u (s)du ds + m j=1 t 0 d k=1 m l=1 t s ∂ k σ il (x u )Φ k,j u (s)dg l u dh j s . (18)
Using Fubini's theorem we can invert the order of integration in the second integral of the right hand side of (18). The treatment of the third integral is more involved. Thanks to Proposition 9 in the Appendix, ∂ k σ il (x u )Φ k,j u (s) is Hölder continuous of order 1 -α in both variables (u, s). As a consequence, we can apply Fubini's theorem for the Riemann-Stieltjes integrals and we obtain

m j=1 t 0 Φ ij t (s)dh j s = m j=1 t 0 σ ij (x s )dh j s + d k=1 t 0 ∂ k b i (x u )   m j=1 u 0 Φ k,j u (s)ds   du + d k=1 m l=1 t 0 ∂ k σ il (x u )   m j=1 u 0 Φ k,j u (s)dh j s   dg l u . Hence t → m j=1 t 0 Φ ij t (s)dh j
s is a solution of Equation ( 16) and by uniqueness we get the result.

If the coefficients b and σ are infinitely differentiable, the mapping g → x(g) is actually infinitely Fréchet differentiable. The proof of this result uses essentially the same arguments as in the case of first order derivatives, but the notation is more involved. We state here the result and present the proof in the Appendix.

Proposition 5 Assume b i , σ ij ∈ C ∞ b .
Then the solution x to Equation ( 8) is infinitely continuously Fréchet differentiable. Moreover, for any

(h 1 , . . . , h n ) ∈ (W 1-α 1 (0, T ; R m )) n , it holds that D h1,...,hn x i t = m i1,...,in=1 t 0 . . . t 0 Φ i,i1,...,in t (r 1 , . . . , r n )dh i1 1 (r 1 )dh i2 2 (r 2 ) . . . dh in n (r n ) , (19)
where the functions Φ i,i1,...,in t (r 1 , . . . , r n ) for t ≥ r 1 ∨ . . . ∨ r n are defined recursively by

Φ i,i1,...,in t (r 1 , . . . , r n ) = n i0=1 A i i0,i1,...,
and 0 if t < r 1 ∨ . . . ∨ r n . We have denoted

A i j,i1,...,in (r 1 , . . . , r n ; s) = I1∪...∪Iν d k1,...,kν =1 ∂ k1 . . . ∂ kν σ ij (x s ) × Φ k1,i(I1) s (r(I 1 )) . . . Φ kν ,i(Iν ) s (r(I ν )), B i i1,...,in (r 1 , . . . , r n ; s) = I1∪...∪Iν d k1,...,kν =1 ∂ k1 . . . ∂ kν b i (x s ) × Φ k1,i(I1) s (r(I 1 )) . . . Φ kν ,i(Iν ) s (r(I ν )) ,
where the first sums are extended to the set of all partitions I 1 ∪ . . . ∪ I ν of {1, . . . , n}.

Stochastic Differential Equations driven by a fractional Brownian motion

Let Ω = C 0 ([0, T ]; R m ) be the Banach space of continuous functions, null at time 0, equipped with the supremum norm. Fix H ∈ ( 1 2 , 1). Let P be the unique probability measure on Ω such that the canonical process {B t , t ∈ [0, T ]} is an m-dimensional fractional Brownian motion with Hurst parameter H.

We denote by E the set of step functions on [0, T ] with values in R m . Let H be the Hilbert space defined as the closure of E with respect to the scalar product

1 [0,t1] , . . . , 1 [0,tm] , 1 [0,s1] , . . . , 1 [0,sm] H = m i=1 R H (t i , s i ).
We recall that

R H (t, s) = t∧s 0 K H (t, r)K H (s, r)dr,
where K H (t, s) is the square integrable kernel defined by

K H (t, s) = c H s 1 2 -H t s (u -s) H-3 2 u H-1 2 du for t > s, where c H = H(2H-1) β(2-2H,H-1
2 ) and β denotes the Beta function. We put

K H (t, s) = 0 if t ≤ s.
The mapping 1 [0,t1] , ..., 1 [0,tm] → m i=1 B i ti can be extended to an isometry between H and the Gaussian space H 1 (B) spanned by B. We denote this isometry by ϕ → B(ϕ).

We introduce the operator K * H : E → L 2 (0, T ; R m ) defined by:

K * H 1 [0,t1] , ..., 1 [0,tm] = (K H (t 1 , .), ..., K H (t m , .)) .
For any ϕ, ψ ∈ E, ϕ, ψ

H = K * H ϕ, K * H ψ L 2 (0,T ;R m ) = E (B(ϕ)B(ψ)) and then K *
H provides an isometry between the Hilbert space H and a closed subspace of L 2 (0, T ; R m ).

We denote

K H : L 2 (0, T ; R m ) → H H := K H L 2 (0, T ; R m ) the operator defined by (K H h)(t) := t 0 K H (t, s)h(s)ds .
The space H H is the fractional version of the Cameron-Martin space. In the case of a classical Brownian motion,

K H (t, s) = 1 [0,t] (s), K *
H is the identity map on L 2 (0, T ; R m ), and H H is the space of continuous functions, vanishing at zero, with a square integrable derivative.

We finally denote by

R H = K H • K * H : H → H H the operator R H ϕ = • 0 K H (•, s) (K * H ϕ) (s)ds .
We remark that for any ϕ ∈ H, R H ϕ is Hölder continuous of order H. Indeed,

(R H ϕ) i (t) = T 0 K * H 1 [0,t] i (s) (K * H ϕ) i (s)ds = E B i t B i (ϕ) ,
and consequently

(R H ϕ) i (t) -(R H ϕ) i (s) ≤ E |B i t -B i s | 2 1/2 ϕ H ≤ ϕ H |t -s| H . Notice also that R H 1 [0,t] = R H (t, •),
E e i B,ϕ = exp - 1 2 ϕ 2 H .
As a consequence, (Ω, H, P) is an abstract Wiener space in the sense of Gross.

Notice that the choices of the Hilbert space and its embedding into Ω are not unique and in [START_REF] Decreusefond | Stochastic Analysis of the Fractional Brownian Motion[END_REF] the authors have made another (but equivalent) choice for the underlying Hilbert space. Let {X t , t ∈ [0,T ]} be the solution of the stochastic differential equation ( 2), and assume that the coefficients are infinitely differentiable which are bounded together with all their derivatives. Fix 1 -H < α < 1 2 . Then the trajectories of the fractional Brownian motion belong almost surely to

C 1-α+ε (0, T ; R m ) ⊂ W 1-α 2 (0, T ; R m ) if ε < H +α-1. Therefore, by Proposition 5, the mapping ω → X(ω) is infinitely Fréchet differentiable from W 1-α 2 (0, T ; R m ) into W α 1 (0, T ; R d ).
On the other hand, we have seen that

H H ⊂ C H (0, T ; R m ) ⊂ W 1-α 2 (0, T ; R m ).
As a consequence, the following iterated derivatives exists

D R H ϕ1,...,R H ϕ1 X i t = d dε 1 • • • d dε n X i t (ω + ε 1 R H ϕ 1 + • • • + ε n R H ϕ n )| ε1=•••=εn=0 ,
for all ϕ i ∈ H. In this way we have proved the following result.

Theorem 6 Let H > 1/2 and assume that b i , σ ij ∈ C 3 b . Then the stochastic process X solution of the stochastic differential equation ( 2) is almost surely differentiable in the directions of the Cameron-Martin space. If b i , σ ij ∈ C ∞ b , then X is almost surely infinitely differentiable in the directions of the Cameron-Martin space.

The iterated derivative D R H ϕ1,...,R H ϕ1 X i t coincides with D n X i t , ϕ 1 ⊗ • • • ⊗ ϕ n H ⊗
, where D n is the iterated derivative in the Malliavin calculus sense. In fact, if F is a smooth cylindrical random variable of the form

F = f (B(ϕ 1 ), . . . , B(ϕ m )) with f ∈ C ∞ b (R m ), ϕ i ∈ H, then the Malliavin derivative DF is the H-valued random variable defined by DF, h H = m i=1 ∂ i f (B(ϕ 1 ), . . . , B(ϕ m )) ϕ i , h H = d dε f (B(ϕ 1 ) + ε ϕ 1 , h H , . . . , B(ϕ m ) + ε ϕ m , h H ) ε=0 ,
and one can easily see that

B(ϕ 1 )(ω + εR H h) = B(ϕ 1 )(ω) + ε ϕ 1 , h H .
We recall here that D k,p is the closure of the space of smooth and cylindrical random variable with respect to the norm

F k,p =   E(|F | p ) + k j=1 E( D j F p H ⊗j )   1 p
, and D k,p loc is the set of random variables F such that there exist a sequence

{(Ω n , F n ), n ≥ 1} such that Ω n ↑ Ω a.s, F n ∈ D k,p and F = F n a.s. on Ω n .
By the results of Kusuoka (see [START_REF] Kusuoka | The non-linear transformation of Gaussian measure on Banach space and its absolute continuity (I)[END_REF], Theorem 5.2 or [START_REF] Nualart | The Malliavin Calculus and Related Topics[END_REF], Proposition 4.1.3), Theorem 6 implies that X i t belongs to the space D k,p loc for all p > 1 and any integer k. Now we give the equations satisfied by the derivatives of the process X.

Proposition 7 If we denote (i 1 , . . . , i n ) ∈ {1, . . . , m} n a multi-index, the nth derivative in the sense of Malliavin calculus satisfies the following linear equation a.s.:

D i1,...,
if t ≥ r 1 ∨ . . . ∨ r n , and D i1,...,in r1,...,rn X i t = 0 otherwise. In the above equation, we have denoted

α i j,i1,...,in (r 1 , . . . , r n ; s) = I1∪...∪Iν d k1,...,kν =1 ∂ k1 . . . ∂ kν σ ij (X s ) D i(I1) r(I1) X k1 s . . . D i(Iν ) r(Iν ) X kν s , β i i1,...,in (r 1 , . . . , r n ; s) = I1∪...∪Iν d k1,...,kν =1 ∂ k1 . . . ∂ kν b i (X s ) D i(I1) r(I1) X k1 s . . . D i(Iν ) r(Iν ) X kν s ,
where the first sums are extended to the set of all partitions I 1 ∪ . . . ∪ I ν of {1, . . . , n} and for any subset K = {i 1 , . . . , i η } of {1, . . . , n}, we put D i(K) r(K) the derivative operator D i1,...,iη ri 1 ,...,ri η . For the first order derivative, Equation (21) reads as follows: for i = 1, . . . , d, j = 1, . . . , m,

D j s X i t = σ ij (X s )+ d k=1 t s ∂ k b i (X u )D j s X k u du+ d k=1 m l=1 t s ∂ k σ il (X u )D j s X k u dB l u ,
if s ≤ t and 0 if s > t.

Proof. We use the representation result on the deterministic equation given by (19) in Proposition 5. For any h = (h 1 , . . . , h n ) with h i ∈ H, we have

D R H h1,...,R H hn X i t = m i1,...,in=1 t 0 . . . t 0 Φ i,i1,...,in t (r 1 , . . . , r n ) ×d(R H h 1 ) i1 (r 1 ) • • • d(R H h n ) in (r n ). ( 22
)
We denote K * ⊗n

H the map from H ⊗n into L 2 (0, T ; R m ) ⊗n defined for ϕ ∈ H ⊗n by K * ⊗n H ϕ (s 1 , . . . , s n ) = T s1 . . . T sn ϕ(r 1 , . . . , r n ) ∂K H ∂r 1 (r 1 , s 1 ) • • • ∂K H ∂r n (r n , s n )dr 1 . . . dr n . It holds that ϕ, ψ H ⊗n = ξ∈{1,...,m} n [0,T ] n K * ⊗n H ϕ ξ (s 1 , . . . , s n ) K * ⊗n H ψ ξ (s 1 , . . . , s n )ds 1 . . . ds n .

Thanks to

Step 3 in the proof Proposition 5, for any 1

≤ k ≤ n, s k → [0,t] k-1 Φ i,i1,...,in t (s 1 , ..., s k-1 , s k , s k+1 , . . . , s n )dh i1 1 (s 1 ) • • • dh i k-1 k-1 (s k-1 )
belongs to C 1-α (0, T ) and we can apply n times Lemma 11 from Appendix. This yields that almost surely

D R H h1,...,R H hn X i t = m i1,...,in=1 t 0 . . . t 0 Φ i,i1,...,in t (r 1 , . . . , r n ) r1 0 ∂K H ∂r 1 (r 1 , u) (K * H h 1 ) i1 (u)du × • • • × rn 0 ∂K H ∂r n (r n , u) (K * H h 1 ) in (u)du dr 1 • • • dr n = m i1,...,in=1 T 0 • • • T 0 K * ⊗n H Φ i t i1,...,in (s 1 , . . . , s n ) × n l=1 (K * H h l ) i l (s i )ds 1 . . . ds n = Φ i t , h 1 ⊗ ... ⊗ h n ⊗n
, and the result is proved.

Absolute continuity of the law of the solution

The fact that for H > 1 2 , the solution of Equation ( 8) belongs to the localized domain of the Malliavin derivative operator D will imply the absolute continuity of the law of X t for all T > 0 under suitable nondegeneracy conditions.

Theorem 8 Let H > 1/2 and assume that b i , σ ij ∈ C 3 b . Suppose that the following nondegeneracy condition on the coefficient σ holds:

(H) The vector space spanned by σ 1j (x 0 ), . . . ,

σ dj (x 0 ) , 1 ≤ j ≤ m is R d .
Then for any t > 0, the law of the random vector X t is absolutely continuous with respect to the Lebesgue measure on R d .

Proof. We already know by Theorem 6 that X i t belongs to D 1,2 loc for all t ∈ [0, T ] and for i = 1, ..., d. Then, thanks to [START_REF] Nualart | The Malliavin Calculus and Related Topics[END_REF], Theorem 2.1.2, it suffices to show that the Malliavin covariance matrix of X t defined by

Q ij t = DX i t , DX j t H
is invertible almost surely. We first deduce another expression for the matrix Q t . We stress the fact that K * H is an isometry between H and a closed subspace of L 2 (0, T ; R m ). Let {e n , n ≥ 1} be a complete orthonormal system in this closed subspace. The elements f n = (K * H ) -1 (e n ) for a complete orthonormal system of H. Then it holds almost surely that

DX i t = n≥1 DX i t , f n H f n ,
and consequently

Q ij t = n≥1 DX i t , f n H DX j t , f n H .
Suppose now that the Malliavin covariance matrix is not almost surely invertible, that is P(det Q t = 0) > 0. Then there exists a vector v ∈ R d , v = 0, such that v T Q t v = 0. Our aim is to prove that condition (H) cannot be satisfied. One may write

v T Q t v = n≥1 DX t , f n H , v R d 2 .
From (22) it follows that

DX i t , f n H = D R H fn X i t ,
and thanks to the representation ( 17), the directional derivative

D R H fn X i t sat- isfies D R H fn X i t = D 2 F (0, X) -1 • D 1 F (0, X) (R H f n ) i t . It follows that 0 = D 2 F (0, X) -1 • D 1 F (0, X) (R H f n ) t , v R d . Since D 2 F (0, X) -1 is a linear homeomorphism, there exists v 0 ∈ R d , v 0 = 0, such that 0 = D 1 F (0, X)(R H f n ) t , v 0 R d = d i=1   m j=1 t 0 σ ij (X s )d(R H f n ) j s   v i 0 = d i=1 v i 0 σ i (X)1 [0,t] , f n H
holds true for any n ≥ 1 (where σ i denotes the ith row of the matrix σ). Then

0 = d i=1 v i 0 σ i (X)1 [0,t]
H and this yields that for all j = 1, ..., m and s ∈ [0, t]

d i=1 v i 0 σ ij (X s ) = 0.
Taking s = 0 we get d i=1 v i 0 σ ij (x 0 ) = 0 for all j = 1, ..., m and this contradicts (H). Then the law of the solution of the stochastic differential equation ( 2) at any time t > 0 is absolutely continuous with respect to the Lebesgue measure on R d .

Appendix

The next proposition provides the joint continuity property of the solution of the equations similar to Equation ( 16) satisfied by the kernel of the derivative.

Proposition 9 Fix γ, B, S ∈ C 1-α (0, T ) and g ∈ W 1-α 2 (0, T ) and consider the equation

ρ t (s) = γ(s) + t s B u ρ u (s)du + t s S u ρ u (s)dg u (23) if s ≤ t and ρ t (s) = 0 if s > t.
Then the solution is a Hölder continuous function of order 1 -α in both variables.

Proof. First notice that ρ • (s) α,1 is uniformly bounded in s, by the estimate [START_REF] Nualart | The Malliavin Calculus and Related Topics[END_REF]. Hence, the function ρ t (s) is Hölder continuous in t, uniformly in s by ( 5) and [START_REF] Lyons | System control and rough paths[END_REF]. On the other hand, for s ≤ s ≤ t we have

ρ t (s) -ρ t (s ) = |w(s, s ) + t s B u (ρ u (s) -ρ u (s )) du + t s S u (ρ u (s) -ρ u (s )) dg u , (24)
where

w(s, s ) = γ(s) -γ(s ) + s s B u ρ u (s)du + s s S u ρ u (s)dg u . (25)
Proposition 2 yields the estimate

sup s∈[0,T ] ρ • (s) α,1 ≤ c 1 γ α,1 exp c 2 g 1 1-2α 1-α,2 ( B ∞ + S 1-α ) . (26)
Substituting ( 26) into (25) yields

|w(s, s )| ≤ γ 1-α (s -s ) 1-α + B ∞ sup s ρ • (s) α,1 (s -s ) + c S α,1 g 1-α,2 sup s ρ • (s) α,1 (s -s ) 1-α ≤ c 1 (s -s ) 1-α . (27)
Then Proposition 2 applied to Equation (24) and the Estimate (27) imply that

ρ • (s) -ρ • (s ) α,1 ≤ c 1 (s -s ) 1-α exp c 2 g 1 1-2α 1-α,2 ( B ∞ + S 1-α ) .
Therefore, ρ t (s) is Hölder continuous in the variable s, uniformly in t. This completes the proof of the proposition.

For the proof of Proposition 5 we need the following technical lemma.

Lemma 10 Suppose that we are given a mapping g

→ v g from W 1-α 2 (0, T ; R m ) to W α 1 (0, T ; R M ) which is continuously Fréchet differentiable.
Consider five bounded differentiable functions a 0 , . . ., a 4 from R d to R d×m×M , R d×M , R d×d , R d×m×M and R d×m×d , respectively. We moreover assume that these functions have bounded derivatives up to order two. Let y ∈ W α 1 (0, T ; R d ) be the solution of the following equation

y t = t 0 a 0 (x g r )v g r dk r + t 0 {a 1 (x g r )v g r + a 2 (x g r )y r } dr+ t 0 {a 3 (x g r )v g r + a 4 (x g r )y r } dg r , (28)
where k ∈ W 1-α 2 (0, T ; R m ) and x g is the unique solution of (8) which is already continuously Fréchet differentiable.

Then g → y is continuously Fréchet differentiable and the directional derivative in the direction h ∈ W 1-α 2 (0, T ; R m ) is the unique solution of

D h y t = t 0 {∂a 0 (x r )D h x r v r + a 0 (x r )D h v r } dk r + t 0 {a 3 (x r )v r + a 4 (x r )y r } dh r + t 0 {∂a 1 (x r )D h x r v r + a 1 (x r )D h v r + ∂a 2 (x r )D h x r y r + a 2 (x r )D h y r } dr + t 0 {∂a 3 (x r )D h x r v r + a 3 (x r )D h v r + ∂a 4 (x r )D h x r y r + a 4 (x r )D h y r } dg r . (29)
Proof. We introduce the map One has F (0, y) = 0 since y is the solution of (28). As in Lemma 3 we can show that F is Fréchet differentiable and

W 1-α 2 (0, T ; R m ) × W α 1 (0, T ; R d ) → C 1-α (0, T ; R d ) ⊂ W α 1 (0, T ; R d ) (h, y) → F (h, y)(t) := y t -
D 1 F (0, y) t = - t 0 {∂a 0 (x r )Dx(h) r v r + a 0 (x r )Dv(h) r } dk r - t 0 {a 3 (x r )v r + a 4 (x r )y r } dh r - t 0 {∂a 1 (x r )Dx(h) r v r + a 1 (x r )Dv(h) r + ∂a 2 (x r )Dx(h) r y r } dr - t 0 {∂a 3 (x r )Dx(h) r v r + a 3 (x r )Dv(h) r + ∂a 4 (x r )Dx(h) r y r } dg r D 2 F (0, y)(z) t = z t - t 0 a 4 (x r )z r dg r - t 0 a 2 (x r )z r dr ,
for any z ∈ W α 1 (0, T ; R d ). Then, using Proposition 2 and the same arguments as in the proof of Proposition 4 we conclude that g → y is continuously Fréchet differentiable and it has a directional derivative in the direction h satisfying (29).

Proof of Proposition 5. The proof of Proposition 5 is divided into several steps. We begin by proving that x is infinitely Fréchet differentiable. Then we show that Equation (20) has a unique solution and derive some of its properties. Finally we prove that (19) holds.

Step 1 We begin by proving by induction that x is infinitely Fréchet continuously differentiable. We introduce some notation in order to write the equations satisfied by the higher order directional derivatives.

Let n ≥ 1 and for i = 1, . . . , n, h i = (h 1 i , . . . , h m i ) ∈ W 1-α 2 (0, T ; R m ). For any subset K = {ε 1 , . . . , ε η } of {1, . . . , n}, we denote by D j(K) the iterated directional derivative x kν s for all the partitions I 1 ∪ . . . ∪ I ν with ν ≥ 2 and with appropriate functions a i , i = 0, . . . , 4. This lemma yields that g → D h1,...,hn x is continuously Fréchet differentiable and the directional derivative of order n + 1 is solution of (30) at the rank n + 1.

D j(K) x = D hε 1 ,...,hε η x = D η x(
Let us now prove by induction that the map (h 1 , . . . , h n ) → D (h1,...,hn) x is multi-linear and continuous. By Proposition 4 this is true for n = 1. Suppose it holds up to n -1, that is, for any subset {ε 1 , . . . , ε n0 } of {1, . . . , n} with n 0 < n, the maps (h ε1 , . . . , h εn 0 ) → D hε 1 ,...,hε n 0 x are multi-linear and continuous. We denote

w i (h 1 , . . . , h n ; g) t = n j0=1 m j=1 t 0 α ij (h 1 , . . . , h j0-1 , h j0+1 , . . . , h n ; s)dh j j0 (s) + t 0    I 1 ∪...∪Iν ν>1 d k1,...,kν =1 ∂ k1 . . . ∂ kν b i (x s ) D j(I1) x k1 s . . . D j(Iν ) x kν s    ds + m j=1 t 0    I 1 ∪...∪Iν ν>1 d k1,...,kν =1 ∂ k1 . . . ∂ kν σ i (x s ) D j(I1) x k1 s . . . D j(Iν ) x kν s    dg j s ,
and using [START_REF] Nualart | The Malliavin Calculus and Related Topics[END_REF] we have the following estimate

D h1,...,hn x α,1 ≤ C w α,1 ,
where the constant C do not depend on (h 1 , ..., h n ). Using the induction hypothesis, we easily deduce that for any i 0 ∈ {1, . . . , n} w α,1 ≤ C h1,...,hi 0 -1,hi 0 +1,...,hn h i0 1-α,2 .

So the map h i0 → D h1,...,hi 0 ,...,hn x . is continuous for any i 0 ∈ {1, . . . , n}. This map is clearly linear thanks to the induction hypothesis and the existence and uniqueness result of Proposition 2.

It only remains to prove that g → D n x(g), from W 1-α 2 (0, T ; R d ) to the space of multi-linear continuous applications on W 1-α 2 (0, T ; R m ), is continuous. We proceed again by induction. We write the difference between the two equations satisfied respectively by D h1,...,hn x(g) and D h1,...,hn x(g) (with b = 0 for reading facilities) D h1,...,hn x(g) t -D h1,...,hn x(g) t = w(h 1 , ..., h n ; g) t -w(h 1 , ..., h n ; g) t

+ d k=1 m j=1 t 0 ∂ k σ ij (x(g) s ) -∂ k σ ij (x(g) s ) D h1,...,hn x(g) s dg s + d k=1 m j=1 t 0 ∂ k σ ij (x(g) s )D h1,...,hn x(g) s d(g s -gs ) + d k=1 m j=1 t 0 ∂ k σ ij (x(g) s ) (D h1,...,hn x(g) s -D h1,...,hn x(g) s ) dg s ,
with w(h 1 , ..., h n ; g) defined above. Using [START_REF] Nualart | The Malliavin Calculus and Related Topics[END_REF] and the induction hypothesis, we deduce easily that the map g → D n x is continuous, and the map g → x is n times Fréchet differentiable.

Step 2 Equation (20) can be written in the following way Φ i,i1,...,in t (r 1 , . . . , r n ) = γ i,i1,...,in t (r 1 , . . . , r n )

+ d k1=1 t r1∨...∨rn ∂ k1 b i (x s )Φ i,i1,...,in s (r 1 , . . . , r n )ds + d k1=1 m l=1 t r1∨...∨rn ∂ k1 σ il (x s )Φ i,i1,...,in s (r 1 , . . . , r n )dg l s , (31)
where

γ i,i1,...,in t (r 1 , . . . , r n ) = n i0=1 A i i0,i1,...,
∂ k1 . . . ∂ kν b i (x s ) Φ k1,i(I1) s (r(I 1 )) . . . Φ kν ,i(Iν ) s (r(I ν ))ds.
Notice that the function Φ i,i1,...,in t (r 1 , . . . , r n ) is symmetric in (i 1 , r 1 ), . . . , (i n , r n ) for any t, i. As we did it for Equation (23) (see Proposition 9), we can show by induction that there exists a unique solution of (31) which is Hölder continuous of order 1 -α in all its variables.

Step 3 Let us show Equation (19).We again proceed by induction. ( 19) is true for n = 1 by [START_REF] Young | An inequality of the Hölder type connected with Stieltjes integration[END_REF]. Assume that it is true up to the rank n -1. For any subset K = {i 1 , . . . , i ν } of {1, . . . , n}, we denote |K| its cardinal and dh K (r(K)) = dh i1 (r i1 ) • • • dh iν (r iν ). Using Fubini's theorem (by the previous step, the integrals are Riemann-Stieltjes ones) and the induction hypothesis we have is a solution of (30) and then it is equal to D h1,...,hn x i t by the existence and uniqueness result for such equations.

An integration by parts formula

Proof. Assume m = 1. Since R H ϕ is H-Hölder continuous, the left-hand side of (32) is well defined as a Riemann-Stieltjes integral. Let {0 := x 0 ≤ x * 0 ≤ x 1 ≤ . . . ≤ x n ≤ x * n ≤ x n+1 := T } a finite partition such that max i (x i+1 -x i ) < ∆. We write

T 0 f (r)d(R H ϕ) r = lim ∆→0 i f (x * i ) [(R H ϕ)(x i+1 ) -(R H ϕ)(x i )] = lim ∆→0 i f (x * i ) xi+1 0 [K H (x i+1 , t) -K H (x i , t)] (K * H ϕ) (t)dt = lim ∆→0 i f (x * i ) xi+1 0 ∂K H (
A 2 i .
We subtract A 1 i to A 2 i and we get that

|A 1 i -A 2 i | = f (x * i ) xi+1 x * i ∂K H (r, t) ∂r (x * i ,t)
-∂K H (r, t) ∂r

(x * i ,t) (K * H ϕ) (t)dt (x i+1 -x i ) ≤ f ∞ K * H ϕ ∞ (x i+1 -x i ) xi+1 x * i ∂K H (
(t -x i ) H-3 2 dt ≤ C(x i+1 -x i ) H-1 2 .
We report the above estimate in (33)

|A 2 i -A 1 i | ≤ C (x i+1 -x i ) H-

+ a 4

 4 (x g+h r )y r d(g r + h r ) .

∂∂(r 1

 1 ..,in (r 1 , . . . , r n ; s)dh i11 (r 1 ) • • • dh in n (r n ) ds k1 . . . ∂ kν b i (x s ) [0,T ] |I 1 | Φ k1,i(I1) s (r(I 1 ))dh i(I1) (r(I 1 )) • • • • • • × [0,T ] |Iν | Φ kν ,i(Iν ) s (r(I ν ))dh i(Iν ) (r(I ν )) k1 . . . ∂ kν b i (x s )D i(I1) x k1 s • • • D i(Iν ) x kν s , . . . , r n )dh i1 1 (r 1 )dh i2 2 (r 2 ) • • • dh in n (r n )

Lemma 11

 11 Let λ such that λ + H > 1, f ∈ C λ (0, T ) and h ∈ H. Then it holds that T 0 f (r)d(R H ϕ) r = t) (K * H ϕ) (t)dt dr .

  and, as a consequence, H H is the Reproducing Kernel Hilbert Space associated with the Gaussian process B.The injection R H : H → Ω embeds H densely into Ω and for any ϕ ∈ Ω * ⊂ H we have

  h ε1 , ..., h εη ), where D η denotes the iterated Fréchet derivative of order η. Define for i = 1, ..., d and j = 1, ..., mα ij (h 1 , . . . , h n ; s) = k1 . . . ∂ kν b i (x s ) D j(I1) x k1 s . . . D j(Iν ) x kν s ,where the first sums are extended to the set of all partitions I 1 ∪ . . . ∪ I ν of {1, . . . , n}. The n-th iterated derivative satisfies the following linear equation: Now we prove by induction that x is infinitely Fréchet differentiable and (30) holds. The result is true for n = 1 thanks to Proposition 4. Suppose that these properties hold up to the index n. Observe that α ij (h 1 , . . . , h n ; s) is equal to the term corresponding to ν = 1, namelyd k=1 ∂ k σ ij (x s )D h1,...,hn x k s ,plus a polynomial function on the derivatives ∂ k1 . . . ∂ kν σ ij (x s ) with ν ≥ 2, and the functions D j(I) x s , with card(I) ≤ n -1. Therefore, we can apply Lemma 10 with y = D h1,...,hn x, v the vector function whose entries are the products D j(I1) x k1 s . . . D j(Iν )

				d
				∂ k1 . . . ∂ kν σ ij (x s ) D j(I1) x k1 s . . . D j(Iν ) x kν s ,
	I1∪...∪Iν	k1,...,kν =1
				d
	β i (h 1 , . . . , h n ; s) =
	I1∪...∪Iν	k1,...,kν =1
	n	m	t
	D h1,...,hn x i t =			α ij (h 1 , . . . , h j0-1 , h j0+1 , . . . , h n ; s)dh j j0 (s)
	j0=1	j=1	0
		t		m	t
	+	β i (h 1 , . . . , h n ; s)ds +	α ij (h 1 , . . . , h n ; s)dg j s . (30)
	0			j=1	0
	for i = 1, . . . , n.

∂

  i0-1,i0+1,...,in (r i0 , r 1 , . . . , , r i0-1 , r i0+1 , . . . , r n )

		d	m	t
	+			∂ k1 . . . ∂ kν σ ij (x s ) Φ k1,i(I1) s	(r(I 1 )) . . . Φ kν ,i(Iν ) s	(r(I ν ))dg j s ,
	ν≥2 I 1 ∪...∪Iν	k1,...,kν =1	j=1	r1∨...∨rn
		d	t
	+
	ν≥2 I 1 ∪...∪Iν	k1,...,kν =1	r1∨...∨rn

  r, t) ∂r

									(x i+1 -x i ) (K * H ϕ) (t)dt
									(xi+1,t)
						:= lim ∆→0	i	A 1 i .
	One also have
	0	T	f (r)	0	r	∂K H ∂r	(r, t) (K * H ϕ) (t)dt dr
							= lim ∆→0	i	f (x * i )	0	x * i	∂K H (r, t) ∂r	(x * i ,t)	(K * H ϕ) (t)dt (x i+1 -x i )
						:= lim ∆→0	i

  1/2+1 ,

	and then
	0	T	f (r)	0	r	∂K H ∂r	(r, t) (K

* H ϕ) (t)dt dr -T 0 f (r)d( H h) r ≤ C lim ∆→0 i (x i+1 -x i ) H+ 1 2 ≤ C T lim ∆→0 ∆ H-1 2 = 0 , so

(32)

is proved.

Acknowledgement

This work was carried out during a stay of Bruno Saussereau at the IMUB (Institut de Matemàtica de la Universitat de Barcelona). He would like to thank the IMUB for its hospitality and support.

* Partially supported by the NSF Grant DMS 0604207 1