Georgios Is Detorakis
email: gdetorak@uci.edu

Antoine Chaillet
email: antoine.chaillet@centralesupelec.fr

Incremental stability of spatiotemporal delayed dynamics and application to neural fields

We propose a Lyapounov-Krasovskii approach to study incremental stability in spatiotemporal dynamics with delays and their capability to be entrained by a periodic input. We then focus on delayed neural fields, which describe the spatiotemporal evolution of neuronal activity. We provide an explicit condition, involving the slope of the activation functions and the strength of coupling, under which delayed neural fields are incrementally stable regardless of communication delays. We finally show how this approach can be used to draw frequency profiles of neuronal populations.

I. INTRODUCTION

Incremental stability characterizes systems whose solutions all converge to one another, with a transient overshoot "proportional" to the distance between initial states. It can be established through the study of an incremental Lyapunov function provided that its derivative along any two solutions of the system is negative as long as they do not coincide [START_REF] Angeli | A Lyapunov approach to incremental stability properties[END_REF].

Incremental stability shares strong similarities with convergent [START_REF] Pavlov | Uniform Output Regulation of Nonlinear Systems: A Convergent Dynamics Approach[END_REF], [START_REF] Demidovich | Lectures on Stability Theory[END_REF] and contractive [START_REF] Lohmiller | On contraction analysis for nonlinear systems[END_REF], [START_REF] Forni | A differential Lyapunov framework for contraction analysis[END_REF] systems. These similarities have been studied in details in [START_REF] Rüffer | Convergent systems vs. incremental stability[END_REF]. A key feature that can be deduced from these properties is the ability of the system to be entrained by its input. More precisely, if any of these properties holds uniformly in the applied input then, under mild conditions, the response of the system to any Tperiodic input is asymptotically T -periodic [START_REF] Lohmiller | On contraction analysis for nonlinear systems[END_REF], [START_REF] Pavlov | Uniform Output Regulation of Nonlinear Systems: A Convergent Dynamics Approach[END_REF], [START_REF] Russo | Global entrainment of transciptional systems to periodic inputs[END_REF], [START_REF] Chaillet | A Razumikhin approach for the incremental stability of delayed nonlinear systems[END_REF], [START_REF] Margaliot | Contraction after small transients[END_REF]. While this property is natural for asymptotically stable linear systems, it is far from granted when dynamics are nonlinear. More precisely, examples of systems that have a globally asymptotically stable equilibrium for each constant value of the input, but for which this entrainment property does not hold, can be found in [START_REF] Yu | A non-quadratic criterion for stability of forced oscillations[END_REF], [START_REF] Russo | Global entrainment of transciptional systems to periodic inputs[END_REF].

As observed in [START_REF] Pavlov | Frequency response functions for nonlinear convergent systems[END_REF], the capacity of a system to be entrained by its input is the key ingredient from which one can derive frequency profiles. These take the form of magnitude Bode plots, reflecting the asymptotic amplification of the system in response to harmonic excitations at various frequencies. Unlike in the linear case, their shape may depend on the input amplitude.

These frequency profiles are especially attractive for neuroscience applications. Indeed, oscillations play a fundamental role in brain coordination [START_REF] Buzsaki | Rhythms of the Brain[END_REF] and altered oscillations in specific structures correlate with pathological symptoms, for instance in Parkinson's disease [START_REF] Hammond | Pathological synchronization in Parkinson's disease: networks, models and treatments[END_REF]. The possibility to predict which frequency band is preferably amplified by a given brain structure might be a valuable tool for computational neuroscientists, and could lead to the development of stimulation strategies to restore healthy frequency profiles.

The spatiotemporal dynamics of brain oscillations can be captured by neural fields models [START_REF] Coombes | Neural Fields: Theory and Applications[END_REF]. These models take the form of integro-differential equations that abstract the brain structure to a continuous medium. Communication delays can be taken into account in this model, giving rise to delayed neural fields [START_REF] Faye | Some theoretical and numerical results for delayed neural field equations[END_REF], [START_REF] Atay | Neural fields with distributed transmission speeds and long-range feedback delays[END_REF], [START_REF] Veltz | Interplay between synaptic delays and propagation delays in neural field equations[END_REF]. This feature is particularly relevant as the non-instantaneous communication between neurons, due to axonal propagation and synaptic delays, is believed to play a significant role in the onset and features of brain oscillations [START_REF] Nevado-Holgado | Conditions for the generation of beta oscillations in the subthalamic nucleus-globus pallidus network[END_REF], [START_REF] Pasillas-Lépine | Delay-induced oscillations in Wilson and Cowan's model: An analysis of the subthalamo-pallidal feedback loop in healthy and parkinsonian subjects[END_REF], [START_REF] Kopell | Gamma rhythms and beta rhythms have different synchronization properties[END_REF].

To the best of our knowledge, no systematic tool to guarantee incremental stability of neural fields (with or without delays) has yet been proposed. Incremental stability of delayed systems can be established using Krasovskii [START_REF] Pola | Symbolic models for nonlinear time-delay systems using approximate bisimulations[END_REF] or Razumikhin [START_REF] Chaillet | A Razumikhin approach for the incremental stability of delayed nonlinear systems[END_REF], [START_REF] Devane | Delay-independent incremental stability in time-varying monotone systems satisfying a generalized condition of two-sided scalability[END_REF] approaches, but these results have not yet been extended to spatiotemporal dynamics.

Here, we propose a Lyapunov-Krasovskii approach to establish incremental stability of spatiotemporal delayed dynamics and provide conditions under which it guarantees the entrainment property. We then focus on delayed neural fields to show that, under the stability condition derived in [START_REF] Faye | Some theoretical and numerical results for delayed neural field equations[END_REF], the system happens to be also incrementally stable. An example motivated by the study of the brain circuitry involved in the motor symptoms of Parkinson's disease demonstrates the possibility to draw frequency profiles of the dynamics involved, which happen to exhibit a resonance at frequencies associated to motor symptoms.

II. SPATIOTEMPORAL DELAYED DYNAMICS

Throughout this paper, we make use of the following notation.

Ω denotes a compact subset of R q , q ∈ N ≥1 . Given n ∈ N ≥1 and d ∈ R ≥0 , U n := C 0 (R ≥0 , F n ), F n := L 2 (Ω, R n ), C n := C 0 ([-d; 0], F n ) if d > 0,
and C n := F n if d = 0 . Accordingly, we defined the norms • F and • C as x F := Ω x(r) 2 dr for all x ∈ F n and x C := sup t∈[-d;0] x(t) F for all x ∈ C n . A continuous function α : R ≥0 → R ≥0 belongs to class K if it is increasing and satisfies α(0

) = 0. α ∈ K ∞ if α ∈ K and lim s→∞ α(s) = ∞. A continuous function β : R ≥0 × R ≥0 → R ≥0 belongs to class KL if β(•, t) ∈ K
for any t ∈ R ≥0 and, given any s ∈ R ≥0 , β(s, •) is nonincreasing and tends to zero as its argument tends to infinity.

A. Definition

We consider dynamical systems defined as

ẋ(t) = f (x t , u(t)), (1)
where f :

C n × F m → F n and u ∈ U m . x(
v ∈ F, f (φ, v) -f (ϕ, v) F ≤ ρ( φ -ϕ C ).
We stress that Assumption 1 ensures that f maps bounded sets of C × F to bounded sets of F. In other words, f is completely continuous.

Uniform incremental stability was originally studied in a finite-dimensional context [START_REF] Angeli | A Lyapunov approach to incremental stability properties[END_REF]. A natural extension for the class of systems ( 1) is as follows. Definition 1 The system (1) is uniformly incrementally stable (δGAS) if it is forward complete and there exists β ∈ KL such that, for any pair of initial conditions x 0 , y 0 ∈ C and any input u ∈ U, the corresponding solutions of (1) satisfy, for all t ∈ R ≥0 ,

x(t; x 0 , u) -x(t; y 0 , u) F ≤ β( x 0 -y 0 C , t). (2)
Similarly to incremental stability for finite-dimensional systems [START_REF] Angeli | A Lyapunov approach to incremental stability properties[END_REF] and time-delay systems [START_REF] Chaillet | A Razumikhin approach for the incremental stability of delayed nonlinear systems[END_REF], [START_REF] Devane | Delay-independent incremental stability in time-varying monotone systems satisfying a generalized condition of two-sided scalability[END_REF], δGAS imposes that any two solutions with the same applied input eventually converge to one another at a rate uniform in the applied input, and that the maximum distance between them in the transients is small if the distance between initial states is small. Similar ingredients are present in the input-output formulation of incremental stability [START_REF] Fromion | Necessary and sufficient conditions for lur'e system incremental stability[END_REF], [START_REF] Fromion | Asymptotic properties of incrementally stable systems[END_REF], [START_REF] Van De Wouw | Model reduction for delay differential equations with guaranteed stability and error bound[END_REF].

B. Krasovskii-Lyapunov approach for incremental stability

Given V : C → R locally Lipschitz, we indicate its upperright Dini derivative along solutions of (1) by

V (1) (t, φ, u) := lim sup h→0 + V (x t+h ) -V (x t ) h ,
on the interval of existence of the solution x(•) of ( 1) with initial state φ ∈ C and input u ∈ U. As discussed in [START_REF] Karafyllis | Lyapunov theorems for systems described by retarded functional differential equations[END_REF], Assumption 1 and the fact that all considered inputs are continuous in time ensure absolute continuity of the map t → x t . Consequently, the map t → V (x t ) is also absolutely continuous, ensuring that the negativity of V for almost all t in an interval [t 1 ; t 2 ] implies V (x t2 ) < V (x t1 ). Reasoning as in [START_REF] Pepe | The problem of the absolute continuity for Lyapunov-Krasovskii functionals[END_REF], it might be possible to extend the results presented here to merely measurable locally essentially bounded inputs: see [START_REF] Chaillet | Robust stabilization of delayed neural fields with partial measurement and actuation[END_REF] for a spatiotemporal version of this observation.

The following result provides a way to establish δGAS of spatiotemporal delayed dynamics.

Theorem 1 (Lyapunov-Krasovskii for δGAS) Assume that there exist α, α ∈ K ∞ , α ∈ K, and a locally Lipschitz functional V : C × C → R ≥0 such that, for any x 0 , y 0 ∈ C and any u ∈ U, the solutions of (1) x(•) := x(•; x 0 , u) and y(•) := x(•; y 0 , u) satisfy, for almost all t ∈ R ≥0 ,

α( x(t) -y(t) F ) ≤ V (x t , y t ) ≤ α( x t -y t C ) (3) V (1) (t, x 0 , y 0 , u) ≤ -α( x(t) -y(t) F ). (4)
Then, under Assumption 1, the system (1) is δGAS.

A specificity of the above result lies in the fact that the dissipation rate in (4) involves the F-norm of the incremental state error, rather than its C-norm. In other words, it depends on the current value of the incremental state error rather than its prehistory. If the right-hand side of (4) was -α( x t -y t C ), then it would hold that V (1) ≤ -α•α -1 (V ) and uniform incremental stability would readily follow from the comparison lemma. Here, the proof is slightly more involved, but follows along the lines of the original Lyaponov-Krasovskii approach [START_REF] Hale | Theory of functional differential equations[END_REF], [START_REF] Krasovskii | Problems of the theory of stability of motion[END_REF]. Due to page limits, this proof is moved to the on-line extended version of this work [START_REF] Detorakis | Incremental stability of spatiotemporal delayed dynamics and application to neural fields[END_REF].

C. Entrainment

One interesting feature of δGAS systems is their capability to be entrained by their input.

Definition 2 (Entrainment) The system (1) is said to be entrained by its input if, given any T ≥ 0 and any Tperiodic 1 u ∈ U, there exists a T -periodic solution xu : R ≥0 → F of (1) such that, for any x 0 ∈ C,

lim t→∞ x(t; x 0 , u) -xu (t) F = 0.
The entrainment property thus ensures that, after transients, the system evolves in a periodic fashion at the rhythm of the applied input. We stress that entrainment ensures in particular that, in response to any constant input, there exists a unique equilibrium to which all solutions converge.

In line with [START_REF] Chaillet | A Razumikhin approach for the incremental stability of delayed nonlinear systems[END_REF] with an incremental stability approach, [START_REF] Yu | A non-quadratic criterion for stability of forced oscillations[END_REF], [START_REF] Pavlov | Uniform Output Regulation of Nonlinear Systems: A Convergent Dynamics Approach[END_REF] with a convergent systems approach, and [START_REF] Russo | Global entrainment of transciptional systems to periodic inputs[END_REF], [START_REF] Lohmiller | On contraction analysis for nonlinear systems[END_REF] with a contraction approach, the following result provides a condition under which δGAS ensures entrainment.

Theorem 2 (Entrainment by periodic inputs) Assume that Assumption 1 holds and that (1) is δGAS. If there exists a continuous function σ : R ≥0 → R ≥0 such that, given any x 0 ∈ C and any periodic u ∈ U, the solution of (1) satisfies

lim sup t→∞ x(t) F ≤ σ sup t≥0 u(t) F , (5)
then (1) is entrained by its input u.

The proof, provided in [START_REF] Detorakis | Incremental stability of spatiotemporal delayed dynamics and application to neural fields[END_REF], relies on the fact that δGAS ensures entrainment provided that a compact set, whose size may depend on the input magnitude, attracts all solutions.

III. DELAYED NEURAL FIELDS

A. Considered dynamics

We now focus on a particular class of spatiotemporal dynamics for which the entrainment property constitutes an interesting feature. Delayed neural fields are integrodifferential equations representing the spatiotemporal activity of neuronal populations and accounting for the noninstantaneous communication between neurons. They read:

τ i ∂z i ∂t (r, t) = -z i (r, t)+ (6)
S i n j=1 Ω w ij (r, r )z j (r , t -d j (r, r ))dr + I ext i (r, t) ,
for each i ∈ {1, . . . , n}. Ω is a compact set of R q , q ∈ {1, 2, 3}, representing the physical support of the populations. r, r ∈ Ω are the space variables, whereas t ∈ R ≥0 is the time variable. z i (r, t) ∈ R represents the neuronal activity of population i at position r and at time t. τ i > 0 is the time decay constant of the activity of population i. w ij (r, r ) describes the synaptic strength between location r in population j and location r in population i; it is assumed that Neural fields have been introduced in [START_REF] Amari | Dynamics of pattern formation in lateral-inhibition type neural fields[END_REF], originally without considering delays. Since then, they have been employed in a number of computational neuroscience studies, ranging from the understanding of brain functions to the development of neuromorphic architectures [START_REF] Bressloff | Spatiotemporal dynamics of continuum neural fields[END_REF]. A reason explaining this success probably stands in the good compromise they offer between richness of possible behaviors and mathematical tractability. In particular, a Lyapunov framework has been developed to study the stability of stationary patterns [START_REF] Faugeras | Absolute stability and complete synchronization in a class of neural fields models[END_REF], [START_REF] Faugeras | Persistent neural states: stationary localized activity patterns in nonlinear continuous n-population, q-dimensional neural networks[END_REF]. Qualitative behavior can also be assessed through bifurcation theory [START_REF] Beim Graben | Attractor and saddle node dynamics in heterogeneous neural fields[END_REF], [START_REF] Veltz | Local/global analysis of the stationary solutions of some neural field equations[END_REF]. Delayed neural fields have also been the subject of stability and robustness studies, using linearization techniques [START_REF] Atay | Neural fields with distributed transmission speeds and long-range feedback delays[END_REF] and a spatiotemporal extension of the Lyapunov-Krasovskii approach [START_REF] Faye | Some theoretical and numerical results for delayed neural field equations[END_REF], [START_REF] Veltz | Stability of the stationary solutions of neural field equations with propagation delays[END_REF], [START_REF] Chaillet | Robust stabilization of delayed neural fields with partial measurement and actuation[END_REF]. This mathematical background constitutes a fertile ground for the analysis of incremental stability of delayed neural fields, and particularly their ability to be entrained by a periodic input.

w ij ∈ L 2 (Ω × Ω, R). I ext i : Ω × R ≥0 → R is a

B. Delay-independent condition for δGAS

Let [x(t)](•) := z(•, t), [u(t)](•) := I ext (•, t), and f = (f 1 , . . . , f n ) T where each f i , i ∈ {1, . . . , n}, is defined for all all φ ∈ C and all v ∈ F as

f i (φ, v) := 1 τ i -φ(0) (7)
+ S i n j=1 Ω w ij (•, r)[φ j (-d j (•, r))](r)dr + v i .
Then the delayed neural fields (6) take the form [START_REF] Amari | Dynamics of pattern formation in lateral-inhibition type neural fields[END_REF]. Applying Theorem 1 to this particular dynamics leads to the following explicit condition for the δGAS of delayed neural fields.

Theorem 3 (δGAS of delayed neural fields) For each i ∈ {1, . . . , n}, let S i be globally Lipschitz with Lipschitz constant i . Then, under the condition n i,j=1

2 i Ω Ω w ij (r, r ) 2 dr dr < 1, (8)
the delayed neural fields (6) are δGAS.

To the best of our knowledge, this result is new even in the non-delayed case ( d = 0). Roughly speaking, condition (8) can be interpreted as follows: δGAS holds if the L 2 norm of the synaptic gains distributions is below the inverse of the Lipschitz constant of the activation functions. It therefore imposes a trade-off between synaptic strength (as measured through w ij ) and excitability (as measured through i ).

The exact same condition was proposed in [START_REF] Faye | Some theoretical and numerical results for delayed neural field equations[END_REF] to establish the existence of a globally asymptotically stable equilibrium configuration for any given constant input. In view of Theorem 2, the above statement allows to go beyond that conclusion by considering periodic inputs.

Corollary 1 (Entrainment of neural fields) Assume that the assumptions Theorem 3 hold and that the activation functions S i , i ∈ {1, . . . , n}, are bounded. Then the delayed neural fields (6) are entrained by their input I ext .

The proof of this result, provided in [START_REF] Detorakis | Incremental stability of spatiotemporal delayed dynamics and application to neural fields[END_REF], relies on Theorems 2 and 3 by observing that the boundedness of S i ensures ultimate boundedness of solutions.

IV. EXAMPLE

In order to illustrate our theoretical findings, we make use of the model introduced in [START_REF] Detorakis | Closed-loop stimulation of a delayed neural fields model of parkinsonian STN-GPe network: a theoretical and computational study[END_REF]. This model involves two brain structures: the subthalamic nucleus (STN), mostly excitatory, and the external part of the globus pallidus (GPe), mostly inhibitory. These two structures are believed to be involved in the generation of beta oscillations (13-30Hz), the intensity of which correlates with the severity of parkinsonian motor symptoms [START_REF] Hammond | Pathological synchronization in Parkinson's disease: networks, models and treatments[END_REF]. More precisely, [START_REF] Nevado-Holgado | Conditions for the generation of beta oscillations in the subthalamic nucleus-globus pallidus network[END_REF] and [START_REF] Pasillas-Lépine | Delay-induced oscillations in Wilson and Cowan's model: An analysis of the subthalamo-pallidal feedback loop in healthy and parkinsonian subjects[END_REF] showed that too strong coupling between STN and GPe may yield beta oscillations through an instability process. Here, we advocate that another mechanism might be at work that relies on entrainment: the preferential amplification of exogenous oscillations in the beta band. The spatiotemporal dynamics of these two structures can be grasped by: ci , for all r, r ∈ Ω, where c i denotes the conductance velocity for neurons projecting from population i (c 1 = 2.5 m/s and c 2 = 1.4 m/s). The synaptic weights are taken as

τ 1 ∂z 1 ∂t (r, t) = -z 1 (r, t)+ (9a) S 1 Ω w 12 (r, r )z 2 (r , t -d 2 (r, r ))dr + I ext 1 (r, t) , τ 2 ∂z 2 ∂t (r, t) = -z 2 (r, t)+ (9b)
w 12 (r, r ) = -g 12 (|r -r -µ 2 |), ∀r ∈ Ω 1 , r ∈ Ω 2 w 21 (r, r ) = g 21 (|r -r -µ 1 |), ∀r ∈ Ω 2 , r ∈ Ω 1 , w 22 (r, r ) = -|r -r |g 22 (|r -r |), ∀r, r ∈ Ω 2 ,
and zero anywhere else, where µ 1 = 1.25 mm and µ 2 = 13.25 mm correspond the centers of STN and GPe respectively, and the functions g ij are Gaussian functions: g ij (x) := k ij exp(-x 2 /2σ ij ) with σ 12 = σ 21 = 0.03, and σ 22 = 0.015. All these parameters are spatiotemporal extensions of those in [START_REF] Nevado-Holgado | Conditions for the generation of beta oscillations in the subthalamic nucleus-globus pallidus network[END_REF], that were derived based on experimental evidence: please refer to [START_REF] Detorakis | Closed-loop stimulation of a delayed neural fields model of parkinsonian STN-GPe network: a theoretical and computational study[END_REF] for more details.

By picking I ext 1 (r, t) = I * 1 (r) and I ext 2 (r, t) = I * 2 (r) + v(r, t), where I * 1 and I * 2 are chosen in such a way that the system exhibits an equilibrium at the point where the slopes of S 1 and S 2 are maximum, this dynamics can be reformulated, after a change of variables, as

τ 1 ∂z 1 ∂t = -z 1 + S 1 Ω w 12 (r, r )z 2 (r , t -d 2 )dr , (10a)
τ 2 ∂z 2 ∂t = -z 2 + S 2 Ω w 21 (r, r )z 1 (r , t -d 1 )dr + Ω w 22 (r, r )z 2 (r , t -d 2 )dr + v(r, t) , (10b)
where some variables have been omitted for the sake of notation compactness. For each i ∈ {1, 2}, S i (x) := S i (xa i ) -S i (a i ), where a i is the point at which the slope of S i is maximum. For simulation purposes, we discretize the space Ω in 60 segments of equal length. By picking k 12 = 7, k 21 = 10.5 and k 22 = 3.0, the quantity w :=

Ω Ω w 12 (r, r ) 2 + w 21 (r, r ) 2 + w 22 (r, r ) 2 dr dr, equals 0.97, thus making (8) fulfilled. Theorem 3 then ensures that ( 10) is δGAS and Corollary 1 guarantees that the dynamics are entrained by the striatal input v. We let v(r, t) = U sin(ωt) and we compute the ratio z2 (ω)/U in dB, for various frequencies ω between 1 and 1000 rad/s, where z2 (ω) denotes the steady-state magnitude of the oscillations of the spatial average of the GPe activity 1 #Ω 2 Ω2 z 2 (r, t) 2 dr, where # Ω2 = 2.5 denotes the measure of Ω 2 . We obtain the frequency profiles depicted in Figure 1 [START_REF] Demidovich | Lectures on Stability Theory[END_REF] remains entrained by its input although w = 6 > 1 thus violating condition [START_REF] Chaillet | A Razumikhin approach for the incremental stability of delayed nonlinear systems[END_REF]. The corresponding frequency profiles appear in dashed lines, for the same input magnitudes as before. The beta resonance is much more pronounced. 2 shows that endogenous oscillations take place (still in the beta band) even though the applied input is constant (v(r, t) = 50). Consequently, the system is no longer entrained by its input and, in view of Theorem 2, δGAS does not hold anymore.

V. CONCLUSION

Incremental stability is thus a powerful tool to ensure that a system is entrained by its input, and to derive frequency profiles, even for spatiotemporal delayed dynamics. The sufficient condition proposed for δGAS of delayed neural fields can easily be tested based on the system parameters. However, simulations indicate that this condition is not tight. In the future, deriving delay-dependent condition for δGAS of spatiotemporal dynamics may help reducing this conservatism. The results of this paper also plead for the development of control tools to tune the frequency profiles of the system, for instance to reduce amplification in a targeted frequency band.

VI. PROOF OF THEOREM 3

First observe that Assumption 1 is satisfied since the functions S i , i ∈ {1, . . . , n}, are globally Lipschitz. We consider the functional V defined, for all φ, ϕ ∈ C, as

V (φ, ϕ) = 1 2 n i=1 τ i φ i (0) -ϕ i (0) 2 F + n i=1 Ω γ(r) Ω 0 -di(r,r ) [φ i (θ)](r ) -[ϕ i (θ)](r ) 2 dθdr dr,
where γ is a bounded function to be chosen latter. Given any continuous I ext , let u ∈ U be defined as u(t) := I ext (t, •). Consider any x 0 , y 0 ∈ C and let x(•) and y(•) denote the corresponding solutions of (6). Elementary computations show that

c x(t) -y(t) 2 F ≤ V (x t , y t ) ≤ c x t -y t 2 C ,
where c := 1 2 min i=1,...,n τ i and c := max i=1,...,n τ i + # 2 Ω max r∈Ω γ(r). This establishes (3). In view of [16, Theorem 3.2.1], x(•) and y(•) are uniquely defined and continuously differentiable on R ≥0 . It follows that the map V : t → V (x t , y t ) is continuously differentiable on R ≥0 . Consequently, its upper-right Dini derivative coincides with its classical derivative, which reads

V(t) = n i=1 Vi (t) + Ẇi (t), (11)
with

V i (t) := τ i 2 x i (t) -y i (t) 2 F W i (t) := Ω γ(r) Ω t t-di [x i (θ)](r ) -[y i (θ)](r ) 2 dθdr dr,
where the spatial dependency of the delays d i has been omitted in the notation. In order to lighten the notation, we let e i := x i -y i . The derivative of [e i (t -d i )](r ) 2 dr dr.

V i reads Vi = d dt τ i 2 Ω |[x i (t)](r) -[y i (t)](
Combing [START_REF] Detorakis | Incremental stability of spatiotemporal delayed dynamics and application to neural fields[END_REF], [START_REF] Detorakis | Closed-loop stimulation of a delayed neural fields model of parkinsonian STN-GPe network: a theoretical and computational study[END_REF], and ( 13), we obtain that i Ω Ω w ij (r, r ) 2 dr dr < 1, which corresponds to condition [START_REF] Chaillet | A Razumikhin approach for the incremental stability of delayed nonlinear systems[END_REF].

V(t) ≤ - 1

  continuous function describing the external input of population i, arising either from the influence of exogenous cerebral structures or from an artificial stimulation device. The function d j : Ω × Ω → [0; d], d ≥ 0, is continuous; d j (r, r ) represents the axonal, dendritic and synaptic delays between a pre-synaptic neuron at position r in population j and a post-synaptic neuron at position r. It typically depends on the distance separating the two considered positions, namely |r -r |. S i : R → R is a globally Lipschitz function, known as the activation function of the neural population i.

S 2 Ω

 2 w 21 (r, r )z 1 (r , t -d 1 (r, r ))dr + Ω w 22 (r, r )z 2 (r , t -d 2 (r, r ))dr + I ext 2 (r, t) , where I ext 1 denotes the cortical input, whereas I ext 2 represents inputs from the striatum. The physical space Ω = [0, 15] mm is divided in two regions: Ω 1 = [0, 2.5] mm corresponding to STN, and Ω 2 = [12.5, 15] mm corresponding to GPe. The time constants are picked as τ 1 = 6 ms and τ 2 = 14 ms. The activation functions S i , i ∈ {1, 2}, are taken as sigmoids, namely S i (x) = m i b i /(b i +(m i -b i )e -4x/mi ), where m 1 = 300, b 1 = 17, m 2 = 400 and b 2 = 75. These functions are bounded and globally Lipschitz with Lipschitz constants i = 1. The delays d i are given by d i (r, r ) = |r-r |

  (solid lines). Varying the amplitude U of the striatal input, different frequency profiles are obtained due to the nonlinear nature of the dynamics. For U = 10, a slight resonance appears at around 150 rad/s, corresponding to the beta band. Increasing the synaptic coupling (k 12 = 21.5, k 21 = 22.5, and k 22 = 20.5) simulations indicate that

Fig. 1 .

 1 Fig. 1. Frequency responses of (10) for w = 0.97 (solid lines) and w = 6 (dashed lines), and for different input amplitudes U .

Fig. 2 .

 2 Fig. 2. spatiotemporal evolution of (10) with constant input for w = 7.5.

w 2 Fw

 2 ij [x j (t -d j )](r )dr + [u(t)](r) -S i n j=1 Ω w ij [y j (t -d j )](r )dr + [u(t)](r) dr.Using the fact that |S i (a -b)| ≤ i |a -b| for all a, b ∈ R and Cauchy-Schwarz inequality, it follows that Vi ≤ -e i (t) ij [e j (t -d j )](r )dr dr ≤ -e i (t)

2 Ω

 2 [e j (t -d j )](r ) 2 dr dr.So the assumptions of Theorem 1 are fulfilled provided that Ω γ(r) < 1/2 and γ(r) ≥

  Banach space C n . From now on, unless explicitly stated, C n , F n , and U m will be simply written as C, F, and U. Throughout the paper, we assume the following.

	t) ∈ F n
	represents the instantaneous value of the state: at each time
	instant t, it is a function of the space variable rather than
	a single point of R n . x t ∈ C n represents the history of this function over the latest time interval of length d; in
	other words, for each fixed θ ∈ [-d; 0], x t (θ) := x(t + θ).
	Given any t ∈ R ≥0 , ẋ(t) ∈ F n is the function defined as
	r → ∂ ∂t [x(t)](r) . System (1) is thus rules by a differential
	equation over the Assumption 1 (Uniform regularity) f is locally Lipschitz
	and there exists ρ ∈ K ∞ such that, for all φ, ϕ ∈ C and all

  where we used the fact that ab ≤ (a 2 + b 2 )/2 to get the last bound. Using again Cauchy-Schwarz inequality, we get that Similarly, the derivative of W i reads (t)](r ) 2 -[e i (t -d i )](r ) 2 dr dr = e i (t) 2 (t -d i )](r ) 2 dr dr.

	Ẇi (t) :=	d dt Ω	γ(r)	Ω	t t-di	[e i (θ)](r ) 2 dθdr dr
	=	γ(r)
		Ω
			F	γ(r)dr -	γ(r)
				Ω			Ω
	It follows that
	n
	Ẇi (t) = e(t) 2 F		γ(r)dr	(13)
	i=1				Ω
						n
		-	γ(r)
				Ω		i=1 Ω
							2
							2
							dr
							≤ -	1 2	e i (t) 2 F +	2 i 2 Ω	n j=1 Ω
							Vi ≤ -	1 2	e i (t) 2 F
							+	2 i 2 Ω	j=1 n	Ω	w 2 ij dr	2 dr
							≤ -	1 2	e i (t) 2 F
							2	n	n
							+	i 2 Ω	j=1 Ω w 2 ij dr	j=1 Ω	[e j (t -d j )](r ) 2 dr dr
							≤ -	1 2	e i (t) 2 F +	1 2 Ω	wi (r)	n j=1 Ω [e j (t -d j )](r ) 2 dr dr,
							where wi (r) := 2 i	n j=1 Ω w ij (r, r ) 2 dr . It follows that
							n i=1	Vi (t) ≤ -	1 2	e(t) 2 F	(12)
							+	1 2 Ω	n i=1	wi (r)

F + i e i (t) F Ω n j=1 Ω w ij [e j (t -d j )](r )dr w ij [e j (t -d j )](r )dr 2 dr, Ω [e j (t -d j )](r ) 2 dr n j=1 Ω [e j (t -d j )](r ) 2 dr dr. Ω [e i Ω [e i

When T = 0, u is called T -periodic if it is constant.

This work is supported by a public grant overseen by the French National Research Agency (ANR) as part of the "Investissement d'Avenir" program, through the "iCODE Institute project" funded by the IDEX Paris-Saclay, ANR-11-IDEX-0003-02, and by the ANR JCJC project SynchNeuro.

G.


Youssef Damak

Marija Jankovic

Yann Leroy

Bernard Yannou

Analysis of safety requirements evolution in the transition of land transportation systems toward autonomy

Keywords: model based engineering, design process, safety analysis, autonomous vehicles

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Autonomous Vehicles (AV) design and development are gaining more and more focus in the last years. Many carmakers got in the heated race to be the first to industrialize a safe autonomous car. AVs are the evolution of current Land Transportation Systems (LTS) and will introduce new forms of urban mobility and usages [START_REF] Dokic | European roadmap smart systems for automated driving[END_REF]. They will likely introduce considerable changes in society. Often mobility experts consider road safety improvement as one of their major positive impacts. On the other hand, the safety requirement is one of the major challenges of AV design and development (Hulse et al., 2018).

Our field observations and interviews showed that carmakers want to reuse existing Advanced Driver Assistant Systems (ADAS) for the AV development, with minimal redesign and reworking. However, the Automotive Safety Integrity Level (ASIL) defined in the ISO 26262 constrained the development of ADAS development and their integration in today's car [START_REF] Iso | 2011 Road vehiclesfunctional safety -Part 1: Vocabulary[END_REF]. Due to the systemic changes brought by AV, the evaluation of ASIL on the system level will impact their system architecture. In the scope of this paper, the authors propose to address how to analyse the safety requirements evolution in the transition of LTS toward AV. The analysis is applied on two evolution types with the steering by wire and the platooning use cases.

The remainder of this paper is organized as follows. The reviewing of the literature in presented in section 2, followed by the analysis method in section 3. The section 4 presents the results of the analysis on two case studies. The paper ends with a discussion on the validity of the method and its results in section 5.

Literature review

Systems evolution

Autonomous Vehicles (AV) are considered the cells for the future mobility. They are actually the evolution of current LTS. As such, their design is constrained and limited by previous vehicles architectures, in particular current ones. Systems evolution was studied in the literature from many aspects. The TRIZ theory implies that all technical systems are subject to 8 laws of evolution. With each evolution stage, contradictions are generated. The TRIZ methodology proposes different methods, tools and algorithms to help design during the evolution of technical systems. The matrix of contradictions is an example of tools useful to solves the contradictions [START_REF] Savransky | Engineering of creativity: Introduction to TRIZ methodology of inventive problem solving[END_REF]. Even though powerful, the TRIZ approach doesn't propose a framework to adapt the current design process to the evolving system. In addition to TRIZ and thanks to new methods and computational capabilities for data analysis and decision making, knowledge-based approaches emerged to orient designer during systems evolution. Gerdes et al. propose a tool to support constraint-based decision making in the context of systems evolution using previous knowledge about the system for new architectures evaluation [START_REF] Gerdes | Decision buddy: tool support for constraint-based design decisions during system evolution[END_REF]. However, the knowledge feed-back for AV is still too small to know architecturally significant factors to efficiently generate and evaluate architectures.

External causes of systems evolution are not considered in the TRIZ theory. System's environmental changes were explored by Bürger et al. from the security knowledge point of view. They proposed a model-based framework using ontologies to adapt the co-evolution of systems with the organization's security knowledge. To ensure the co-evolution, they use events modelling, graph algorithms for and graphs synchronization and transformation. They could realize meta-models synchronization and identify property violation [START_REF] Bürger | A framework for semi-automated co-evolution of security knowledge and system models[END_REF]. This approach is specific to security knowledge evolution. Adequate meta-models and context analysis have to be performed to reuse it on other contexts. Other studies consider the system's interdependencies with (design) processes and stakeholders requirements as external factors of systems evolution. Hoang et al. proposed a model to support mechatronic systems evolution based on the interdependencies of products, processes and resources [START_REF] Hoang | Modeling of interdependencies between products, processes and resources to support the evolution of mechatronic systems[END_REF]. However, the modelling concept needs to be accompanied with an interdependencies analysis specific to each studied system. This literature review of systems evolution showed a lack of understanding for significant internal and external factors in the AV's context. These factors are numerous. So, for a better contribution to the understanding of LTS evolution, this study is focused on only one factor. The following literature review explains the importance of safety requirements factor for this topic.

Safety requirements evolution

Public acceptance of AV is often positively associated with the improvement of road safety. AV are perceived as a great opportunity to increase the safety of pedestrian and passengers (Hulse et al., 2018). Ironically, safety is one of the major challenges of AV's design and development. If AV couldn't ensure a minimal safety level (unknown yet), it will have a negative impact on their public acceptation [START_REF] Dokic | European roadmap smart systems for automated driving[END_REF]ERTRAC, 2015). For this reason, the future evolution of safety requirements of LTS represents one of the major factors in the evolution of their design processes.

The literature contains a few studies in eliciting safety requirements evolution and analysing its impact. Luiz and Mikulski analysed the safety requirements changes of spacecraft's software. These changed where deduced from post-launch anomalies thanks to reporting mechanism whenever the system's behaviour differs from the requirement. The criticality level was evaluated according to the standards of the domain. A fourth of the highly safety-critical anomalies resulted in software requirements changes [START_REF] Lutz | Operational anomalies as a cause of safety-critical requirements evolution[END_REF]. Transposed on AV's case, the safety criticality of functions would be evaluated only post-tests.

Anderson and Felici proposed metrics to measure software requirements evolution. They proposed the Requirement Maturity Index (RMI) and its 2 extensions the Requirement Stability Index (RSI) and the Historical Requirement Maturity Index (HRMI) [START_REF] Anderson | Quantitative aspects of requirements evolution[END_REF]. These metrics are useful to understand and monitor the requirements evolution. However, they work on past and present software releases, and are not yet used for requirements evolution forecasting. On safety requirements forecasting, Szarata and Dźwigoń predicted the impact planned new roads in Poland on road safety. They analysed data such as average traffic volume to quantitatively predict the density of accidents, injuries and fatalities [START_REF] Szarata | Modelling of road safety attributes in the case of road network development on regional level in Poland[END_REF]. Their approach is inspiring; however, to the best knowledge of the authors, there is no model to quantitatively predict safety criticality of new AV designs. For this particular reason, safety analysis of AVs and Cyber-Physical Systems (CPS) in general became an active research domain.

Safety analysis of Cyber-Physical Systems

Izosimov and Levholt synthesised the safety-based design flow of CPS. Their proposition complied with the different standards such as ISO 26262 and Do-178B [START_REF] Izosimov | Mixed Criticality Metric for Safety-Critical Cyber-Physical Systems on Multi-Core Architectures[END_REF]. Safety oriented activities were added to a standard design process as follows: Hazard Analysis and Risk Assessment (HARA) follow to the system definition. A system's safety analysis is applied on system architecture for a safety-based architecting. The process is iterative until the safety requirements are satisfied [START_REF] Izosimov | Mixed Criticality Metric for Safety-Critical Cyber-Physical Systems on Multi-Core Architectures[END_REF]. Most of the research works join both activities with different synergy. Matsubasa and Aoyama proposed a combination of safety requirements meta-modelling with scenarios modelling and hazard analysis. It was applied for the safety analysis of Toyota's Crown Majesta. It resulted in safety requirements models used for the design of mitigation actions. They finally evaluated the safety model after the mitigation plan with Bayesian network analysis [START_REF] Matsubara | An Analysis Method of Safety Requirements for Automotive Software Systems[END_REF]. Bayesian network analysis was also used by Duran et al. to evaluate the probability of safety failure of vehicle's optical systems. However, they applied it on Fault Tree Analysis (FTA) modelling chain of events. The tree is based on a preliminary HARA [START_REF] Duran | Safety analysis of Autonomous Ground Vehicle optical systems: Bayesian belief networks approach[END_REF].

Other propositions for CPS's safety analysis use the Model-Based System Engineering (MBSE) approach. The deployment of MBSE in the industry is increasing and is considered by the INCOSE as the future of systems engineering [START_REF] Friedenthal | INCOSE model based systems engineering (MBSE) initiative[END_REF]. Mhenni et al. used SysML for an enhanced safety analysis of mechatronic systems. They semi-automatically generated a Failure Modes and Effects Analysis (FMEA) from the SysML Internal Block Diagram (IBD) of the systems. They extended the classical SysML modelling with multi-physical flows which enhanced the initial FMEA and improved the safety analysis of mechatronic systems [START_REF] Mhenni | Extended mechatronic systems architecture modeling with SysML for enhanced safety analysis[END_REF]. The research team extended their proposal in an integrated MBSE-MBSA framework for complex systems design. The framework is based on 4 main tasks conducted synergistically between MBSE and MBSA. With the MBSE approach, the designers use scenarios modelling for (safety) requirements definition. They also model the system's functional topology. FMEA and FTA are then conducted based on this topology. In synergy and iteration with these tasks, simulations are used for performance and safety assessment [START_REF] Choley | Topology-based Safety Analysis for Safety Critical CPS[END_REF]. Yakymets et al. also propose a MBSE-MBSA framework with SysML models converted to the AltaRica language for the automatic generation of FTA and the computation of model checking simulations. The main advantage of their approach is to loop on the SysML models by propagating the FTA results [START_REF] Yakymets | Model-driven safety assessment of robotic systems[END_REF].

Safety requirements evolution analysis

In the previous section, the authors argued the interest of studying safety requirements evolution of LTS. On this line, they propose a method based on the MBSE and MBSA approaches to build a descriptive study for the analysis of LTS safety requirements evolution. This research study was conducted in collaboration with the autonomous systems team of the engineering company AKKA Technologies. The method was designed and tested on two R&D projects for the design of a steering by wire system and a platooning system. Its steps are applied in parallel on today's systems and the systems under design for future autonomous LTS.

The MBSE approach was applied with Polarsys open source MBSE software Capella and the Arcadia method [START_REF] Roques | MBSE with the ARCADIA Method and the Capella Tool[END_REF]. The Arcadia method is divided into 4 main engineering levels: Operational Analysis, System Analysis, Logical Architecture and Physical Architecture. The method presented below takes place in the two first levels. The reader can find more detail on Arcadia's overall process in [START_REF] Roques | MBSE with the ARCADIA Method and the Capella Tool[END_REF]. Following is the detailed steps of the safety requirements evolution analysis:

Nominal operational scenarios definition with sequence diagrams on an MBSE software

In the Operational Analysis phase of the projects, the designers and the stakeholders define the operational capabilities. Then, sequence diagrams are used to define nominal scenarios describing each capability.

Hazard Analysis and Risk Assessment (HARA) with ASIL evaluation of nominal scenarios

A HARA is conducted on the nominal scenarios defined in the previous steps. The operational activities, elements of the scenario's sequence diagram, are analysed individually. The hazards that result from their independent failures are analysed by the engineers and evaluated with the ASIL metric from ISO 26262.

The ASIL of a hazard is calculated from its Severity (S), Exposition time (E) and Controllability (C). ASIL is a scale from A to D and is used to designate the necessary level of safety measures engineers have to take in the design, development and manufacturing of a component or a system. ASIL A represents the lowest level and ASIL D the highest level of required safety measures. Quality Managements (QM) is a level bellow ASIL A and indicates that the hazard will impact the quality of the final product without real safety risks (ISO, 2011).

The Severity, Exposition time and Controllability are defined and scaled as follows:

 Severity (S): the severity of a hazard represents the gravity of a failure's consequence within a scenario of interest.

System design and functional modelling

After several iterations with the different stakeholders, a set of hazard events is agreed on. The transitions and traceability from the Operational Analysis to the System Analysis is managed by the MBSE software Capella. In the System Analysis phase, the functional exchanges and functional architecture of the system are modelled

Functional chains modelling

Once the system analysis phase of the project is completed, every system's nominal scenario is decomposed into one or more functional chains. The functional chains describe the needed functional flows for the execution of the scenario. Functional chains and scenarios are important to build a common base for the comparison between two different systems: today's system and their evolution. They also limit the variation in the functions granularity levels.

Failure Modes and Effects Analysis (FMEA) of the functions and mapping with the previous ASIL evaluation

An FMEA is conducted on the functions forming the functional chains. Their effects are mapped with the hazard events of the nominal scenarios. Figure 1 illustrates the first five steps of the method. It shows from the mapping between the system functions (SF) and the hazards that the failure of a single function can cause two different hazards. These two hazards can even be on two different scenarios. In addition, they potentially have two different ASIL. In this case, the function's ASIL would be the highest ASIL of the caused hazards (in the figure's example, it would be ASIL D).

As explained earlier, the exposition time (E) is evaluated with the relative time when the hazard could happen, or the function could fail. When a function can cause two hazards, one could think that its relative time of possible failure will increase. However, the ASIL is evaluated on hazards considered independent. As such, we consider no increase of its ASIL if a function causes multiple hazards.

Figure 1. Mapping of the system functions, the nominal scenarios and their hazards

Comparison of overall ASIL evaluation of both systems

The final step is to compare the overall ASIL of driving assisted vehicles from the present and the conceptualized future AV. The comparison is done for equivalent operational scenarios, on the base of the functional chains. Three types of differences naturally emerged from the comparison: new functions; disappearance of functions; and a change in the ASIL evaluation of functions. Finally, an analysis of the ASIL evolution is conducted to characterize the safety requirements evolution.

Case studies

With the autonomous systems team of AKKA Technologies, the authors observed mainly two types of systems development for autonomous LTS. The first type corresponds to an evolution of existing system toward higher level or complete automation. The second one is the design of new systems to answer new usages of AVs. In this part, two case studies of both types are presented:

 An evolution of the electrical power-assisted steering system toward a steering by wire then to an absence of steering (vehicle wheels controlled directly with from on board calculator)  A platooning system composed of a lead vehicle driven by a human operator and 4 AVs

Steering by wire & Automated steering

Currently, AKKA Technologies is working on its second AV prototype, the Link&Go 2. For this vehicle, they intend it to be equipped with an advanced steering by wire system. Compared to the first version, the advanced steering by wire system provides road feedbacks. Today's vehicles steering system is ensured with a mechanical system mainly accompanied with an electrical power-assistance. It is composed of an intermediate shaft that mechanically links between both the steering column and the rack assemblies. Actually, The former is composed of a steering wheel, a steering column and potentially the powerassistance motor. In addition to the rack, the rack assembly could also contain a power-assistance motor instead of the steering column assembly. Moreover, the rack controls the direction of the vehicle's wheels.

With a steering by wire system, the link between the steering wheel and the vehicle's wheels rotation is ensured with an electrical connection. As the rotational torque in not transmitted with a mechanical link, motors on both sides are needed to replace this function. Two popular architectures for the wheel rotation are: A unique motor on the rack to rotate the vehicle's front wheels at the same time, or to remove the rack and rotate them independently. The current Link&Go prototype has one motor on each of the front vehicle wheel for a rotation without a rack.

The team developed the HARA of the systems based on the operational analysis through iterations. After the transition to the system analysis the team ended up with 4 functional chains: Initialize and align direction system; Block vehicle's wheel rotation when idle; Turning the steering wheel; and providing road feedback. With these functional chains analysed, the first difference observed is an increase of the functions number from present system to the steering by wire one. The number of functions drops back for a fully automated steering system as shows the Table 2 This observation indicates that it is more complex to design a hybrid system where two concepts -the assisted steering and the automated steering-co-exist in the form of the steering by wire system. In fact, both systems share a few function such as "Apply the direction command on the road wheels" or "Acquire road wheel information". However, for the co-existence of both systems, specific functions need to be added such as "Acquire steering wheel angle" and "Transmit and display alignment notification".

The FMEA and mapping of the functions with hazard events emphasised a second result corresponding to the safety requirements evolution. It is possible to observe from Table 3 an increase of the ASIL level in functions shared between the systems. In addition, new functions appear with high ASIL. The number of identified ASIL D functions increases with the automation of the steering system, with 4 ASIL D functions against 1 ASIL D function for the assisted steering system: "Generate Road Feedback". Unsurprisingly, it is even higher with the hybrid steering by wire system with 6 ASIL D functions. These conclusions are discussed more in the fifth section of the paper.

Platooning system

The platooning system, illustrated in the Figure 2, is one of the new usages of the AV creating a considerable amount of interest. It can take numerous possible forms such as a pre-fixed platoon or dynamically cooperating vehicles with the same common interests. It also presents several economic advantages such as the lowering of fuel consumption and of goods transportation cost. A considerable amount of work was undergone for the development and introduction of the platooning system on response to this increasing interest [START_REF] Jia | A Survey on Platoon-Based Vehicular Cyber-Physical Systems[END_REF].

Figure 2. Illustration of the platooning system

AKKA's AV team is also developing a platooning system in collaboration with other companies for the integration on a test platform and the development of the communication network. The system is composed of a lead vehicle, driven by a trained operator, and followed by 4 AVs. To limit the risk and severity of injuries, the maximum speed of the platoon is 30 km/h. There is a platooning component in each of the 5 vehicles managing the integrity of the platoon. The system turned out to be quite complex because of a great number of interactions. Using the Arcadia method and a number of iteration, the operational team could manage this kind of complexity and apply the HARA.

As the platooning system is novel and answers to a new usage, one can identify many new interactions and functions involved. At the system analysis level, 4 functional chains for the nominal scenarios of the platooning were identified. The scenario "Drive in normal platooning mode" is composed of 3 functional chains: Transmit driver commands; Collect and calculate data for platooning; Transmit own data to other vehicles. The second scenario is the emergency stop procedure and is composed of 1 function chain. The block diagram in Figure 3 displays the exchange flow of the 4 functional chains, between the platooning system, the vehicle's platform, the connexion network and the other entities. It can be noticed from the diagram that some of the functions are bottlenecks in most of the functional chains such as "Transmit signal" and "measure vehicle states". "Transmit signal" is an example of a function involved in more than one hazard event. The loss of the function could lead to the 2 scenarios of Table 4. In this case, ASIL C is attributed to the function. As explained in the fifth point of the analysis method, ASIL levels don't stack. The events and their effects are considered independent. The authors considered the platooning system as an evolution of the present vehicle. They compared the functional chains of the platooning system, both in the lead vehicle and follower ones, with existing ADAS functions. It resulted in new function with high ASIL level. For a relevant comparison, the safety evaluation of the present vehicle is done in the same operational condition: with a maximum speed of 30 km/h. It resulted in 2 new ASIL D functions. The risk of a collision with VRU in a sandwich effect is the cause of the high ASIL. In addition, 6 ASIL C functions were obtained. 3 of these functions were new and 3 had their ASIL increased. Table 5 provides an example.

Discussion and future perspectives

The method proposed in this paper serves to build a descriptive study for the analysis of Land Transportation Systems (LTS) safety requirements evolution. It is based on the MBSE and MBSA approaches inspired from previous framework proposition [START_REF] Choley | Topology-based Safety Analysis for Safety Critical CPS[END_REF][START_REF] Mhenni | Extended mechatronic systems architecture modeling with SysML for enhanced safety analysis[END_REF]. Additionally to FMEA, the method extends their work by using classical tools of CPS safety analysis: scenario modelling and HARA. However, it doesn't compute failure events' chains with FTA or probabilistic tools such as Bayesian network analysis.

The contribution within this method is the quantitative analysis of safety-criticality evolution of LTS using the standard ASIL metric. To the best knowledge of the authors, there is no such analysis in the literature. The authors use previous works in the CPS safety analysis domain to imitate Szarata and Dźwigoń's quantitative prediction without data on AVs safety criticality [START_REF] Szarata | Modelling of road safety attributes in the case of road network development on regional level in Poland[END_REF]. They use the functional chain modelling to ensure a common base of comparison for the different systems and limit the variation in the functions granularity levels. Furthermore, with the comparison of the function's ASIL and the analysis of its evolution, they provide a first insight to the evolution of the safety requirements of LTS. However, this evaluation is based on the final architecture choice of the designers. As such, the ASIL evolution of the two compared systems functions during the design phase cannot be expressed with this method. It could be improved using metrics for requirements evolution such as the RMI and its extensions, the RSI and HSMI [START_REF] Anderson | Quantitative aspects of requirements evolution[END_REF].

The application of the method on two evolution types of the LTS results in quantifying the way safety will impact their design process evolution. In fact, the evolution of ASIL from today's to the future systems shows two main points. First, if hybrid systems were to be developed for the transition from current LTS to the AV, many functions will emerge for the co-existence of both systems. These functions will bring a layer of complexity to the system as well as high levels of safety criticality. Second, in the new operational context of AVs, the old functions will have their ASIL increase. The reuse of such functions in AVs, with minimum modifications, will be difficult. It will at least require a change propagation analysis and bring integration issues.

On future perspective, the method should be tested in other domains with the appropriate metrics for safety evaluation. The authors think that it could be extended to R&D projects in which there is a focus on requirements engineering for the design of safety-critical systems with low technical maturity. Autonomous Vehicles would be an adequate case study for this research problematic.

Figure 3 .

 3 Figure 3. Functional chains block diagram of the platooning nominal scenarios

Table 1 . ASIL evaluation from the

 1 Exposition time (E): the exposition time of a hazard represents the relative time when the hazard could happen. It doesn't take into account the probability of functional failures To observe the possible hazards for the system of interest, the consequences of operational activities failures are analysed: loss of activity during the scenario, intermittent activity, unintended activity activation and wrong activity output or result. The resulting hazards are evaluated on the Severity (S), Exposition time (E) and Controllability (C) scales. Table1synthesises the computation of ASIL in ISO 26262.

	o E0=0: Improbable
	o E1=1: Very low probability
	o E2=2: Low probability
	o E3=3: Medium probability
	o E4=4: High probability
	 Controllability (C): the controllability of a hazard represents the capacity of external systems
	(example: driver) to control the situation in case it happens:
	o C0=0: Controllable in general
	o C1=1: Simply controllable
	o C2=2: Normally controllable
	o C3=3: Difficult to control or uncontrollable
			C1	C2	C3
	S1	E1	QM	QM	QM
		E2	QM	QM	QM
		E3	QM	QM	ASIL A
		E4	QM	ASIL A	ASIL B
	S2	E1	QM	QM	QM
		E2	QM	QM	ASIL A
		E3	QM	ASIL A	ASIL B
		E4	ASIL A	ASIL B	ASIL C
	S3	E1	QM	QM	ASIL A
		E2	QM	ASIL A	ASIL B
		E3	ASIL A	ASIL B	ASIL C
		E4	ASIL B	ASIL C	ASIL D

It is scaled as follows o S0=0: No injuries o S1=1: Light and moderate injuries o S2=2: Severe and life-threatening injuries (probable survival) o S3=3: Life-threatening injuries (uncertain survival), fatal injuries  (S), (E) and (C) scales

Table 2 . Number of functions in the different steering systems

 2 :

		the electrical power-	Steering by wire system	Automated steering
		assisted steering system
	Number of functions	10	21	11

Table 3 . Extract of the evolution of functions ASIL in the steering system

 3

	Functions	Assisted-	Steering by	Automated
		steering		wire		Steering
	Scales	S E C ASIL S E C ASIL S E C ASIL
	Monitor vehicle's wheels component	2 4 2	B	2 4 3	C	2 4 3	C
	Apply the direction command	2 4 2	B	3 4 3	D	3 4 3	D
	Acquire vehicle's wheel information	2 4 2	B	3 4 3	D	3 4 3	D
	Extract road information from filtered wheel angle	---	-	3 4 3	D	3 4 3	D
	Generate road feedback	3 4 3	D	3 4 3	D	---	-

Table 4 . implication of the "Transmit signal" function with 2 hazard events

 4

	Function	Hazard Event	Undesirable Effect	S E C ASIL
	Transmit	Vehicles On-Board Measurement	Crazy behaviours of vehicles	2 4 3	C
	signal	and/or orders are not available for	followers lead to collisions with
		follower vehicles	Vulnerable Road Users (VRU)
		No transmission of an emergency	Impossibility of avoiding collisions	1 4 2	A
		stop order to the following vehicle	with front vehicle

Table 5 . Example of functions ASIL level evolution with the platooning system

 5

	Functions	Present vehicle	Platoon Lead	Platoon Follower
				vehicle			vehicles
	Scales	S E C ASIL S E C ASIL S E C ASIL
	Measure vehicle state	2 4 1	A	2 4 3	C	2 4 3	C
	Display information on HMI	2 3 3	A	2 4 3	C	--	-	-
	Transmit signal	---	-	2 4 3	C	2 4 3	C
	Activate emergency stop	---	-	---	-	3 4 3	D

Acknowledgement

The authors thank the AKKA Technologies Autonomous Vehicle team for providing the data, insight and expertise that greatly assisted the research project.