Luc Boruta
email: luc.boruta@inria.fr

Sharon Peperkamp
email: peperkamp@ens.fr

Benoît Crabbé
email: benoit.crabbe@inria.fr

Emmanuel Dupoux
email: emmanuel.dupoux@gmail.com

Testing the Robustness of Online Word Segmentation: Effects of Linguistic Diversity and Phonetic Variation

Models of the acquisition of word segmentation are typically evaluated using phonemically transcribed corpora. Accordingly, they implicitly assume that children know how to undo phonetic variation when they learn to extract words from speech. Moreover, whereas models of language acquisition should perform similarly across languages, evaluation is often limited to English samples. Using child-directed corpora of English, French and Japanese, we evaluate the performance of state-of-the-art statistical models given inputs where phonetic variation has not been reduced. To do so, we measure segmentation robustness across different levels of segmental variation, simulating systematic allophonic variation or errors in phoneme recognition. We show that these models do not resist an increase in such variations and do not generalize to typologically different languages. From the perspective of early language acquisition, the results strengthen the hypothesis according to which phonological knowledge is acquired in large part before the construction of a lexicon.

Introduction

Speech contains very few explicit boundaries between linguistic units: silent pauses often mark utterance boundaries, but boundaries between smaller units (e.g. words) are absent most of the time. Procedures by which infants could develop word segmentation strategies have been discussed at length, from both a psycholinguistic and a computational point of view. Many models relying on statistical information have been proposed, and some of them exhibit satisfactory performance: MBDP-1 [START_REF] Brent | An efficient, probabilistically sound algorithm for segmentation and word discovery[END_REF], NGS-u [START_REF] Venkataraman | A statistical model for word discovery in transcribed speech[END_REF] and DP [START_REF] Goldwater | A bayesian framework for word segmentation: exploring the effects of context[END_REF]) can be considered state-of-the-art. Though there is evidence that prosodic, phonotactic and coarticulation cues may count more than statistics [START_REF] Johnson | Word segmentation by 8-month-olds: When speech cues count more than statistics[END_REF], it is still a matter of interest to know how much can be learned without linguistic cues. To use Venkataraman's words, we are interested in "the performance of bare-bones statistical models."

The aforementioned computational simulations have two major downsides. First, all models of language acquisition should generalize to typologically different languages; however, the word segmentation experiments mentioned above have never been carried out on phonemically transcribed, childdirected speech in languages other than English. Second, these experiments use phonemically transcribed corpora as the input and, as such, make the implicit simplifying assumption that, when children learn to segment speech into words, they have already learned phonological rules and know how to reduce the inherent variability in speech to a finite (and rather small) number of abstract categories: the phonemes. [START_REF] Rytting | Segmenting words from natural speech: subsegmental variation in segmental cues[END_REF] addressed this issue and replaced the usual phonemic input with probability vectors over a finite set of symbols. Still, this set of symbols is limited to the phonemic inventory of the language: the reduction of phonetic variation is taken for granted. In other words, previous simulations evaluated the performance of the models given idealized input but offered no guarantee as to the performance of the mod-els on realistic input.

We present a comparative survey that evaluates the extent to which state-of-the-art statistical models of word segmentation resist segmental variation. To do so, we designed a parametric benchmark where more and more variation was gradually introduced into phonemic corpora of child-directed speech. Phonetic variation was simulated applying contextdependent allophonic rules to phonemic corpora. Other corpora in which noise was created by random phoneme substitutions were used as controls. Furthermore, to draw language-independent conclusions, we used corpora from three typologically different languages: English, French and Japanese.

2 Robustness benchmark

Word segmentation models

The segmentation task can be summarized as follows: given a corpus of utterances in which word boundaries have been deleted, the model has to put them back. Though we did not challenge the usual idealization that children are able to segment speech into discrete, phoneme-sized units, modeling language acquisition imposes significant constraints on the models [START_REF] Brent | An efficient, probabilistically sound algorithm for segmentation and word discovery[END_REF][START_REF] Gambell | Statistics learning and universal grammar: Modeling word segmentation[END_REF]: they must generalize to different (if not all) languages, start without any knowledge specific to a particular language, learn in an unsupervised manner and, most importantly, operate incrementally.

Online learning is a sound desideratum for any model of language acquisition: indeed, human language-processors do not wait, in Brent's words, "until the corpus of all utterances they will ever hear becomes available". Therefore, we favored an 'infant-plausible' setting and only considered online word segmentation models, namely MBDP-1 [START_REF] Brent | An efficient, probabilistically sound algorithm for segmentation and word discovery[END_REF] and NGS-u [START_REF] Venkataraman | A statistical model for word discovery in transcribed speech[END_REF]. Even if DP [START_REF] Goldwater | A bayesian framework for word segmentation: exploring the effects of context[END_REF] was shown to be more flexible than both MBDP-1 and NGS-u, we did not include Goldwater et al.'s batch model, nor recent online variants by Pearl et al. (in press), in the benchmark. All aforementioned models rely on word n-grams statistics and have similar performance, but MBDP-1 and NGS-u are minimally sufficient in providing an quantitative evaluation of how cross-linguistic and/or segmental variation impact the models' performance. We added two random segmentation models as baselines. The four models are described below.

MBDP-1

The first model is Heinz's implementation of Brent's MBDP-1 [START_REF] Brent | An efficient, probabilistically sound algorithm for segmentation and word discovery[END_REF][START_REF] Heinz | MBDP-1, OCaml implementation[END_REF]. The general idea is that the best segmentation of an utterance can be inferred from the best segmentation of the whole corpus. However, explicitly searching the space of all possible segmentations of the corpus dramatically increases the model's computational complexity. The implementation thus uses an incremental approach: when the ith utterance is processed, the model computes the best segmentation of the corpus up to the ith utterance included, assuming the segmentation of the first i -1 utterances is fixed.

NGS-u

This unigram model was described and implemented by [START_REF] Venkataraman | A statistical model for word discovery in transcribed speech[END_REF]. MBDP-1's problems of complexity were circumvented using an intrinsically incremental n-gram approach. The strategy is to find the most probable word sequence for each utterance, according to information acquired while processing previous utterances. In the end, the segmentation of the entire corpus is the concatenation of each utterance's best segmentation. It is worth noting that NGS-u satisfies all three constraints proposed by Brent: strict incrementality, non-supervision and universality.

Random

This dummy model rewrites its input, uniformly choosing after each segment whether to insert a word boundary or not. It defines a chance line at and below which models can be considered inefficient. The only constraint is that no empty word is allowed, hence no consecutive boundaries.

Random +

The second baseline is weakly supervised: though each utterance is segmented at uniformly-chosen random locations, the correct number of word boundaries is given. This differs from Brent's baseline, which was given the correct number of boundaries to insert in the entire corpus. As before, consecutive boundaries are forbidden.

English

French Japanese Tokens Types Tokens Types Tokens Types U 9,790 5,921 10,000 7,660 10,000 6,315 W 33,399 1,321 51,069 1,893 26,609 4,112 P 95,809 50 121,486 35 102,997 49 Table 1: Elementary corpus statistics, including number of utterances (U), words (W) and phonemes (P).

Corpora

The three corpora we used were derived from transcribed adult-child verbal interactions collected in the CHILDES database [START_REF] Macwhinney | State of the art in continuous speech recognition[END_REF]. For each sample, elementary textual statistics are presented in Table 1. The English corpus contains 9790 utterances from the Bernstein-Ratner corpus that were automatically transcribed and manually corrected by [START_REF] Brent | Distributional regularity and phonotactic constraints are useful for segmentation[END_REF]. It has been used in many word segmentation experiments [START_REF] Brent | An efficient, probabilistically sound algorithm for segmentation and word discovery[END_REF][START_REF] Venkataraman | A statistical model for word discovery in transcribed speech[END_REF][START_REF] Batchelder | Bootstrapping the lexicon: a computational model of infant speech segmentation[END_REF][START_REF] Fleck | Lexicalized phonotactic word segmentation[END_REF][START_REF] Goldwater | A bayesian framework for word segmentation: exploring the effects of context[END_REF]among others) and can be considered a de facto standard.

The French and the Japanese corpora were both made by Le [START_REF] Calvez | Approche computationnelle de l'acquisition précoce des phonèmes[END_REF], the former by automatically transcribing the Champaud, Leveillé and Rondal corpora, the latter by automatically transcribing the Ishii and Noji corpora from rōmaji to phonemes.

To get samples comparable in size to the English corpus, 10,000 utterances were selected at random in each of Le Calvez's corpora. All transcription choices made by the authors in terms of phonemic inventory and word segmentation were respected.1

Variation sources

The main effect of the transformations we applied to the phonemic corpora was the increase in the average number of word forms per word. We refer to this quantity, similar to a type-token ratio, as the corpora's lexical complexity. As allophonic variation is context-dependent, the increase in lexical complexity is, in this condition, limited by the phonotactic constraints of the language: the fewer contexts a phoneme appears in, the fewer contextual allophones it can have. By contrast, the upper limit is much higher in the control condition, as phoneme substitutions are context-free.

From a computational point of view, the application of allophonic rules increases both the number of symbols in the alphabet and, as a byproduct, the lexical complexity. Obviously, when any kind of noise or variation is added, there is less information in the data to learn from. We can therefore presume that the probability mass will be scattered, and that as a consequence, statistical models relying on word ngrams statistics will do worse than with phonemic inputs. Yet, we are interested in quantifying how such interference impacts the models' performance.

Allophonic variation

In this experiment, we were interested in the performance of online segmentation models given rich phonetic transcriptions, i.e. the input children process before the acquisition of allophonic rules. Consider the following rule that applies in French:

/r/ → [X] before a voiceless consonant [K] otherwise
The application of this rule creates two contextual variants for /kanar/ (canard, 'duck'): Daland and Pierrehumbert (2010) compared the performance of a phonotactic segmentation model using canonical phonemic transcripts and transcripts implementing conversational reduction processes. They found that incorporating pronunciation variation has a mild negative impact on performance. However, they used adult-directed speech. Even if, as they argue, reduced adult-directed speech may present a worst-case scenario for infants (compared to hyperarticulated child-direct speech), it offers no quantitative evaluation of the models' performance using child-directed speech.

Because of the lack of phonetically transcribed child-directed speech data, we emulated rich transcriptions applying allophonic rules to the phonemic corpora. To do so, we represented the internal structure of the phonemes in terms of articulatory features and used the algorithm described by [START_REF] Boruta | A note on the generation of allophonic rules[END_REF] to create artificial allophonic grammars of different sizes containing assimilatory rules whose application contexts span phonologically similar contexts of the target phoneme. Compared to Daland and Pierrehumbert's manual inspection of the transcripts, this automatic approach gives us a finer control on the degree of pronunciation variation. The rules were then applied to our phonemic corpora, thus systematizing coarticulation between adjacent segments. We made two simplifying assumptions about the nature of the rules. First, all allophonic rules we generated are of the type p → a / c where a phoneme p is realized as its allophone a before context c. Thus, we did not model rules with left-hand or bilateral contexts. Second, we ensured that no two allophonic rules introduced the same allophone (as in English flapping, where both /t/ and /d/ have an allophone [R]), using parent annotation: each phone is marked by the phoneme it is derived from (e.g. [R] /t/ and [R] /d/ ). This was done to avoid probability mass derived from different phonemes merging onto common symbols.

The amount of variation in the corpora is determined by the average number of allophones per phoneme. We refer to this quantity as the corpora's allophonic complexity. Thus, at minimal allophonic complexity, each phoneme has only one possible realization (i.e. phonemic transcription), whereas at maximal allophonic complexity, each phoneme has as many realizations as attested contexts. For each language, the range of attested lexical and allophonic complexities obtained using [START_REF] Boruta | A note on the generation of allophonic rules[END_REF] algorithm are reported in Figure 1.

Phoneme substitutions

Allophonic variation is not the only type of variation that may interfere with word segmentation. Indeed, the aforementioned simulations assumed that all phonemes are recognized with 100% accuracy, but -due to factors such as noise or speech ratehuman processors may mishear words. In this control condition, we examined the models' performance on corpora in which some phonemes were replaced by others. Thus, substitutions increase the corpus' lexical complexity without increasing the number of symbols: phoneme misrecognitions give a straightforward baseline against which to compare the models' performance when allophonic variation has not been reduced. Such corpora can be considered the output of a hypothetical imperfect speechto-phoneme system or a winner-take-all scalar reduction of Rytting et al.'s (2010) probability vectors.

We used a straightforward model of phoneme misrecognition: substitutions are based neither on a confusion matrix [START_REF] Nakadai | The design of phoneme grouping for coarse phoneme recognition[END_REF] nor on phoneme similarity. Starting from the phonemic corpus, we generated 10 additional corpora controlling the proportion of misrecognized phonemes, ranging from 0 (perfect recognition) to 1 (constant error) in increments of 0.1. A noise intensity of n means that each phoneme has probability n of being rewritten by another phoneme. The random choice of the substitution phoneme is weighted by the relative frequencies of the phonemes in the corpus. The probability P (p → x) that a phoneme x rewrites a phoneme p is defined as

P (p → x) =    1 -n if p = x n f (x) + f (p) |P| -1 otherwise
where n is the noise intensity, f (x) the relative frequency of phoneme x in the corpus and P the phonemic inventory of the language.

Evaluation

We used [START_REF] Venkataraman | A statistical model for word discovery in transcribed speech[END_REF] implementation of the now-standard evaluation protocol proposed by [START_REF] Brent | An efficient, probabilistically sound algorithm for segmentation and word discovery[END_REF] and then extended by [START_REF] Goldwater | A bayesian framework for word segmentation: exploring the effects of context[END_REF]. Obviously, orthographic words are not the optimal target for a model of language acquisition. Yet, in line with previously reported experiments, we used the orthographic segmentation as the standard of correct segmentation.

Scoring

For each model, we report (as percentages) the following scores as functions of the lexical complexity of the corpus:

• P s , R s , F s : precision, recall and F -score on word segmentation as defined by Brent;

• P l , R l , F l : precision, recall and F -score on the induced lexicon of word types: let L be the standard lexicon and L ′ the one discovered by the algorithm, we define

P l = |L ∩ L ′ |/|L ′ |, R l = |L∩L ′ |/|L| and F l = 2•P l •R l /(P l +R l ).
The difference between scoring the segmentation and the lexicon can be exemplified considering the utterance [@wUdÙ2kwUdÙ2kwUd] (a woodchuck would chuck wood). If it is segmented as [@ wUdÙ2k wUd Ù2k wUd], both the segmentation and the induced lexicon are correct. By contrast, if it is segmented as [@ wUd Ù2k wUdÙ2k wUd], the lexicon is still accurate while the word segmentation is incorrect. A good segmentation inevitably yields a good lexicon, but the reverse is not necessarily true.

k-shuffle cross-validation

As the segmental variation procedures and the segmentation baselines are non-deterministic processes, all scores were averaged over multiple simulations. Moreover, as MBDP-1 and NGS-u operate incrementally, their output is conditioned by the order in which utterances are processed. To lessen the influence of the utterance order, we shuffled the corpora for each simulation. Testing all permutations of the corpora for each combination of parameter values is computationally intractable. Thus, scores reported below were averaged over three distinct simulations with shuffled corpora. 3 Results and discussion

Cross-linguistic evaluation

Performance of the segmentation models2 on phonemic corpora is presented in Figure 1 in terms of F sand F l -score (upper and lower panel, respectively). We were able to replicate previous results on English by Brent and Venkataraman almost exactly; the small difference, less than one percent, was probably caused by the use of different implementations.

From a cross-linguistic point of view, the main observation is that these models do not seem to generalize to typologically different languages. Whereas MBDP-1 and NGS-u's F s value is 69% for English, it is only 54% for French and 41% for Japanese. Similar observations can be made for F l . Purely statistical strategies seem to be particularly ineffective on our Japanese sample: inserting word boundaries at random yields a better lexicon than using probabilistic models.

A crude way to determine whether a word segmentation model tends to break words apart (oversegmentation) or to cluster various words in a single chunk (under-segmentation) is to compare the average word length (AWL) in its output to the AWL in the standard segmentation. If the output's AWL is greater than the standard's, then the output is undersegmented, and vice versa. Even if NGS-u produces shorter words than MBDP-1, both models exhibit, once again, similar within-language behaviors. English was slightly under-segmented by MBDP-1 and over-segmented by NGS-u: ouputs' AWL are respectively 3.1 and 2.7, while the standard is 2.9. Our results are consistent with what [START_REF] Goldwater | A bayesian framework for word segmentation: exploring the effects of context[END_REF] observed for DP: error analysis shows that both MBDP-1 and NGS-u also break off frequent English morphological affixes, namely /IN/ (-ing) and /s,z/ (-s). As for French, AWL values suggest the corpus was under-segmented: 3.1 for MBDP-1's output and 2.9 for NGS-u's, while the standard is 2.4. On the contrary, Japanese was heavily oversegmented: many monophonemic words emerged and, whereas the standard AWL is 3.9, the ouputs' AWL is 2.7 for both models.

Over-segmentation may be correlated to the number of syllable types in the language: English and French phonotactics allow consonantal clusters, bringing the number of syllable types to a few thousands. By contrast, Japanese has a much simpler syllabic structure and less syllable types which, as a consequence, are often repeated and may (incorrectly) be considered as words by statistical models. The fact that the models do worse for French and Japanese is not especially surprising: both languages have many more affixal morphemes than English. Consider French, where the lexical autonomy of clitics is questionable: whereas /s/ (s' or c') or /k/ (qu') are highly frequent words in our orthographic standard, many errors are due to the agglutination of these clitics to the following word. These are counted as segmentation errors, but should they? Furthermore, none of the segmentation models we benchmarked exhibit similar performance across languages: invariably, they perform better on English. There may be a correlation between the performance of segmentation models and the percentage of word hapaxes, i.e. words which occur only once in the corpus: the English, French and Japanese corpora contain 31.7%, 37.1% and 60.7% of word hapaxes, respectively. The more words tend to occur only once, the less MBDP-1, NGS-u and DP perform on segmentation. This is consistent with the usual assumption that infants use familiar words to find new ones. It may also be the case that these models are not implicitly tuned to English, but that the contribution of statistical cues to word segmen-tation differs across languages. In French, for example, stress invariably marks the end of a word (although the end of a word is not necessarily marked by stress). By contrast, there are languages like English or Spanish where stress is less predictable: children cannot rely solely on this cue to extract words and may thus have to give more weight to statistics.

Robustness to segmental variation

The performance of MBDP-1, NGS-u and the two baselines on inputs altered by segmental variation is presented in Figure 2. 3 The first general observation is that, as predicted, MBDP-1 and NGS-u do not seem to resist an increase in lexical complexity. In the case of allophonic variation, their performance is inversely related to the corpora's allophonic complexity. However, as suggested by the change in the graphs' slope, performance for English seems to stabilize at 2 word forms per word. Similar observations can be made for French and Japanese on which the performance of the models is even worse: F l values are below chance at 1.7 and 3 variants per word for Japanese and French, respectively; likewise, F s is below chance at 1.5 for Japanese and 2.5 for French. Phoneme substitutions also impede the performance of MBDP-1 and NGS-u: the more phonemes are substituted, the more difficult it becomes for the algorithms to learn how to insert word boundaries. Furthemore, F l is below chance for complexities greater than 4 for French, and approximately 2.5 for Japanese. It is worth noting that, in both conditions, the models exhibit similar withinlanguage performance as the complexity increases.

The potential lexicon that can be built by combining segments into words may account for the discrepancy between the two conditions, as it is in fact the models' search space. In the control condition, substituting phonemes does not increase its size. However, the likelihood of a given phoneme in a given word being replaced by the same substitution phoneme decreases as words get longer. Thus, the proportion of hapax increases, making statistical segmentation harder to achieve. By contrast, the application of allophonic rules increases the number of objects to build words with; as a consequence, the size of the potential lexicon explodes.

As neither MBDP-1 nor NGS-u is designed to handle noise, the results are unsurprising. Indeed, any word form found by these models will be incorporated in the lexicon: if [laeNgwIÙ] and [laeNgwIÃ] are both found in the corpus, these variants will be included as is in the lexicon. There is no mechanism for 'explaining away' data that appear to have been generated by systematic variation or random noise.

It is an open issue for future research to create robust models of word segmentation that can handle segmental variation.

Conclusions

We have shown, first, that online statistical models of word segmentation that rely on word n-gram statistics do not generalize to typologically different languages. As opposed to French and Japanese, English seems to be easier to segment using only statistical information. Such differences in performance from one language to another emphasize the relevance of cross-linguistic studies: any conclusion drawn from the monolingual evaluation of a model of language acquisition should be considered with all proper reservations. Second, our results quantify how imperfect, though realistic, inputs impact MBDP-1's and NGS-u's performance. Indeed, both models become less and less efficient in discovering words in transcribed child-directed speech as the number of variants per word increases: though the performance drop we observed is not surprising, it is worth noting that both models are less efficient than random procedures at about twenty allophones per phoneme. However, the number of context-dependent allophones we introduced is far less than what is used by state-of-the-art models of speech recognition [START_REF] Macwhinney | State of the art in continuous speech recognition[END_REF].

To our knowledge, there is no computational model of word segmentation that both respects the constraints imposed on a human learner and accommodates noise. This highlights the complexity of early language acquisition: while no accurate lexicon can be learned without a good segmentation strategy, state-of-the-art models fail to deliver good segmentations in non-idealized settings. Our re-sults also emphasize the importance of other cues for word segmentation: statistical learning may be helpful or necessary for word segmentation, but it is unlikely that it is sufficient.

The mediocre performance of the models strengthens the hypotheses that phonological knowledge is acquired in large part before the construction of a lexicon [START_REF] Jusczyk | The Discovery of Spoken Language[END_REF], or that allophonic rules and word segmentations could be acquired jointly (so that neither is a prerequisite for the other): children cannot extract words from fluent speech without knowing how to undo at least part of contextual variation. Thus, the knowledge of allophonic rules seems to be a prerequisite for accurate segmentation. Recent simulations of word segmentation and lexical induction suggest that using phonological knowledge [START_REF] Venkataraman | A statistical model for word discovery in transcribed speech[END_REF][START_REF] Blanchard | Improving word segmentation by simultaneously learning phonotactics[END_REF], modeling morphophonological structure [START_REF] Johnson | Unsupervised word segmentation for Sesotho using adaptor grammars[END_REF] or preserving subsegmental variation [START_REF] Rytting | Segmenting words from natural speech: subsegmental variation in segmental cues[END_REF] invariably increases performance.

Vice versa, Martin et al. (submitted) have shown that the algorithm proposed by [START_REF] Peperkamp | The acquisition of allophonic rules: statistical learning with linguistic constraints[END_REF] for undoing allophonic variation crashes in the face of realistic input (i.e. many allophones), and that it can be saved if it has approximate knowledge of word boundaries. Further research is needed, at both an experimental and a computational level, to explore the performance and suitability of an online model that combines the acquisition of allophonic variation with that of word segmentation.

  [kanaK Zon] (canard jaune, 'yellow duck') and [kanaX flotÃ] (canard flottant, 'floating duck'). Before learning the rule, children have to store both [kanaK] and [kanaX] in their emerging lexicon as they are not yet able to undo allophonic variation and construct a single lexical entry: /kanar/.

Figure 1 :

 1 Figure 1: Lexical complexity (the average number of word forms per word) as a function of allophonic complexity (the average number of allophones per phoneme).

Figure 2 :

 2 Figure2: Cross-linguistic performance of MBDP-1 and NGS-u on child-directed phonemic corpora in English (EN), French (FR) and Japanese (JP).

Figure 3 :

 3 Figure3: F s -score (left column) and F l -score (right column) as functions of the lexical complexity, i.e. the number of word forms per word, in the English (top row), French (middle row) and Japanese (bottom row) corpora.

Some transcription choices made by Brent and Cartwright are questionable(Blanchard and Heinz,

2008). Yet, we used the canonical version of the corpus for the sake of comparability.

The full table of scores for each language, variation source, and segmentation model was not included due to space limitations. It is available upon request from the first author.

For the control condition, we did not graph scores for noise intensities greater than 0.2: 80% accuracy is comparable to the error rates of state-of-the-art systems in speaker-independent, continuous speech recognition[START_REF] Macwhinney | State of the art in continuous speech recognition[END_REF].


Tushar Jain
email: tushar.jain@cran.uhp-nancy.fr

Joseph J Yamé
email: joseph.yame@cran.uhp-nancy.fr

Dominique Sauter
email: dominique.sauter@cran.uhp-nancy.fr

Model-free Reconfiguration Mechanism for Fault Tolerance

The problem of fault tolerant control is studied from the behavioral point of view. In this mathematical framework, the concept of interconnection among the variables describing the system is a key point. The problem is that the behavior we intend to control is not known. Therefore, we are interested in designing a fault accommodation scheme for an unknown behavior through an appropriate behavioral interconnection. Here we deal simply with the trajectories that are generated by the system in real time. These trajectories determine the behavior of a system in various (faulty/healthy) modes. Based on the desired interconnected behavior, only those trajectories are selected that obeys certain laws. These laws representing the desired behavior can indeed be achieved by a regular interconnection. Thus, when the trajectories do not belong to a certain desired behavior it is considered as due to the occurrence of fault on the system. The vantage point is the fault tolerant control problem now becomes completely a model free scheme. Moreover, no explicit fault diagnosis module is required in our approach. The proposed fault tolerance mechanism is illustrated on an aircraft during the landing phase.

I. INTRODUCTION

A fault represents an unexpected change of the system dynamics that tends to degrade the overall system performance and can lead to system instability as well. Generally, a fault tolerant control (FTC) system includes two modules: fault diagnosis (FD) module and fault accommodation (FA) module (see figure 1). An FD module is a monitoring module that is used to detect faults and diagnose their location and significance in a system. The module with fault estimation sub-module is very often considered as fault detection and isolation (FDI). An FA module is a fault-recovery module that controls the faulty system in a specific way, such that the system still achieves the objectives which were achieved by the healthy system before the occurrence of fault.

The general block diagram of a fault tolerant control is shown in the figure 1. The main controller activities occur on the execution level. In the faultless case, the nominal controller attenuates the disturbance d and ensures set-point following and other requirements on the closed loop system at the execution level. On the supervision level, the diagnosis block simply recognizes that the closed-loop system is faultless and no change of the control law is necessary. If a fault occurs, the supervision level makes the control loop fault-tolerant.

The diagnostic block identifies the fault and gives this information as D to the fault accommodation block. The FA module adjusts the controller to the new situation, such that the closed loop satisfies the performance specifications [START_REF] Jain | A model based 2-dof fault tolerant control strategy[END_REF] [START_REF] Zhang | Design of integrated fault detection, diagnosis and reconfigurable control systems[END_REF].

The problem of fault tolerant control is often handled in two ways: model-based approach and model-free approach. In the former approach, the full information of the actual plant is known a priori. Accordingly, a sub-system (state observer, output observer, Kalman's filter, etc.) is built, which reconstructs the plant output and diagnoses the fault. The fault is then accommodated using an FA module. On the other hand, generally in the socalled model-free approaches in the existing literature, the model of the plant is estimated.

Nevertheless, the plant knowledge is required during estimation in real-time as well. Hence, the knowledge of a plant model is mandatory at any time to achieve fault tolerance either by assuming the plant model to be known or to be estimated. This elicits the model mismatching issue that can generate false alarms, even in the fault-less situation. Consider the case of disgraceful performance degradation where control objectives are modified to achieve the partial tolerance to fault. This implies that after the accommodation of fault, the current state of plant still enfolds some dynamics of fault in the faulty mode that has not been accommodated entirely. Therefore, the fault diagnosis module must be adaptive with respect to fault accommodation module such that the further modeling issue can be averted. Otherwise, it will again result in false alarm. As we have seen, FTC requires two distinctive modules that operate sequentially to accommodate the fault. These two modules involve their respective time delays, particularly, known as fault detection delay and fault accommodation delay. A significant attention has to be entail while handling these time delays. In the time interval between the occurrence of fault and its accommodation, the stability aspects of any FTC scheme become a concern. In addition, due to historical reasons and the complexity of the problem, most of the research on FD and FA was carried out as a two separate entity. More specifically, most of the FDI techniques are developed as a diagnostic or monitoring tool, rather than an integral part of FTC systems. As a result, some existing FD methods may not satisfy the need of controller reconfiguration in FA module. On the other hand, most of the research on reconfigurable controls is carried out assuming the availability of a perfect FD. Little attention has been paid to the analysis and design with the overall system structure and interaction between FD and FA modules [START_REF] Zhang | Bibliographical review on reconfigurable fault-tolerant control systems[END_REF].

Seeing these shortcomings, the objective of this work is to develop a generic method for the fault tolerant control based on real trajectories from the system subjected to faults. The main contribution of the paper intends to formulate a model-free approach to FTC that does not require any information about the plant in real-time. Unlike the so-called subspace approach for FTC in [START_REF] Ding | Subspace method aided data-driven design of fault detection and isolation systems[END_REF], we do not focus on designing an FDI module that implicitly requires the knowledge of the plant parameters. On the contrary, our approach does not include any explicit FD module. The idea here is to choose an appropriate control law such that the system in any (faulty/healthy) mode achieves the performance specifications without the need of a plant model. We employed the mathematical framework of behavioral systems for the proposed approach. In the last decade, the behavioral point of view has received an increasingly broader acceptance as an approach for modeling dynamic systems, and now it is generally viewed as a cogent framework for system analysis [START_REF] Zerz | Behavioral systems theory: A survey[END_REF]. The proposed FTC mechanism is illustrated on an aircraft during the landing phase.

II. ACTIVE FAULT TOLERANT CONTROL STRATEGY

In a model based fault tolerant control, generally it is seen that the prime motive is to estimate the constraints C f (θ f ) of the faulty system for FD module. Based on this information, a new control law is applied in fault accommodation phase such that the system satisfies the performance specifications. The scheme is termed as active fault tolerance. On the counterpart, in passive fault tolerance the control law is not redesigned subject to the occurrence of fault. This implies that the system objectives can be obtained when the system is healthy, as well as when the system is faulty with the same control law. Thence in the literature, passive FTC system is also known as reliable control systems [START_REF] Zhao | Reliable state feedback control systems design against actuator failures[END_REF] or control systems with integrity.

The fault tolerant control is concerned with the control of a faulty system. This implies that we can consider any FTC problem as a control problem subject to state of the system (healthy/faulty). The problem is completely defined by the triple [START_REF] Blanke | Diagnosis and Fault tolerant control[END_REF] < O, C(θ), U >

where

• The objective O defines what the system is expected to achieve. This implies that the system should satisfy certain performance specifications.

• Constraints C are functional relations that depends on some parameter vector θ. The controlled system satisfy these constraints over the time. This represents the state and measurement equations of actual plant model in state space representation.

• The set U represents admissible control laws. These control laws are designed in such a manner, when implemented achieves the desired objective.

Now, let us analyze the impact of faults on the control problem. An occurrence of fault on the system transforms the control problem from

< O, C n (θ n ), U > into < O, C f (θ f ), U f >, f ∈ F
where F indexes the set of all considered faults, C n (θ n ) is the set of nominal constraints with nominal system parameters, and C f (θ f ) is a set of faulty constraints with faulty system parameters. Generally, the occurrence of fault does not result in the change of system objectives because the main idea of fault tolerant control is to try to reach them even in the presence of fault. However, this would sometimes be possible or not. The case when current specified objectives are not able to achieve, the problem is transformed into finding new objectives, which are less restrictive such that the system still managed to satisfy the fault-tolerance property. This is known as disgraceful degraded performance in the FTC literature.

One of the active approaches for FTC is to employ switching theory that is based on constructing a bank of controllers, each controller being associated to a healthy, or a faulty plant-working mode. The selection of a controller then, to be used for the present working mode assumes to be achieved with some delay. The critical issue in any model-based active FTC system (AFTCS) is the limited amount of time available for FD and for control system reconfiguration. The theory of logic based switching control provides a unique direction for AFTCS without utilizing an explicit diagnosis module, which relies on a bank of controllers (figure 2). The supervisor block shown in figure 3 is made-up of a set of estimators, followed by the so-called performance evaluation, and a switching logic scheme. Each estimator reconstructs the actual plant output in either healthy or faulty working modes. Its performance is evaluated by computing a norm of the output estimation error, and the estimator that yields the smallest error corresponds to the present working mode. Consequently, the controller corresponding to the smallest performance index yielding estimator is applied to the process by the switching logic. Here the notion of performance evaluation does not correspond to the closed loop performance of the system. Estimator n This approach has some shortcomings from a practical point of view. In the present configuration, the scheme presupposes that for each fault a reasonable controller has been designed before the plant is put into operation. However, the presence condition of a right controller is assumed in the controller bank. To build a set of estimators, partial or complete knowledge of the plant is required to be known, thus introducing model mismatch issues.

y (m) u (m) u (m) u (m) u (m) y (m) y (m) y (m) y (1) est y (2) est y
(n) est - + + + - - | | | | | | Switching Logic
In other words, the above scheme requires the knowledge of the plant model in real-time as well. Nevertheless, one cannot ignore the role of gradual convergence in latter approach required to estimate the current working mode. A notable feature of our proposed scheme is that it does not require an explicit fault diagnosis module in real-time.

III. FTC IN BEHAVIORAL CONTEXT

A mathematical model in behavioral setting is viewed as any dynamical relation among system variables classified as manifest variables and latent variables. Indeed, the resulting dynamical relations are constrained by the time-evolution of these variables. Hence, the collection of all time trajectories satisfying these equations is called the behavior. When the trajectories do not belong to a specified desired behavior, the cause is the occurrence of fault. The following gives a precise definition of the concept of a dynamical system.

w : T → W, t → w(t)
The set W is the space in which the system time-signals take on their values and the behavior B ⊆ W T is a family of W-valued time trajectories. Any behavior of dynamical system is also represented by its kernel representation, B :≡ P ( d dt )w = 0, where P ∈ R •×w [ξ] and ξ is an indeterminate operator. By assuming this point of view, important aspects of the classical system theory have been translated and solved in the behavioral framework.

A. Control via System Interconnection

In the behavioral setting, a control problem is viewed as an interconnection of two dynamical subsystems. These subsystems are the plant and the controller. Here we will consider the case of partial interconnection, which is different from the notion of full interconnection.

The difference lies in the fact that in latter all the variables are accessible for interconnection while in former only few are available. Therefore, it is natural to separate the variable w as w := [ w c ] T where w is the manifest variable and c is the latent variable (see figure4a). If Σ 1 = (T, W, B 1 ) and Σ 2 = (T, W, B 2 ) are two dynamical subsystems with the same time axis and same signal space, then the interconnection of Σ 1 and Σ 2 shared by variable c, denoted

as Σ 1 ∧ c Σ 2 , is defined as Σ 1 ∧ c Σ 2 := (T, W, B 1 ∧ c B 2 ). Thus, the behavior of Σ 1 ∧ c Σ 2 consists
simply of those trajectories w : T → W which are compatible with both the laws of Σ 1 and of Σ 2 . In a closed-loop feedback control, w and c are also termed as to-be controlled variables and control variables (see figure4b). In case of a linear time invariant (LTI) system, there exist co-prime polynomials R y and R u such that G = R -1 y R u , where G(ξ) is the polynomial representation of plant. In the behavioral context, a control problem is now formulated as follows. Assume that the plant, a dynamical subsystem Σ p = (T, W, P f ) whose behavior is given by

P f = {(w, c) ∈ R q+p | R(ξ)w = M(ξ)c} (2)
with appropriate matrices

R ∈ R •×q [ξ] and M ∈ R •×p [ξ], where [ R(ξ) -M(ξ) ]   w(t) c(t)   = 0
is the kernel representation of plant's behavior, w := (r T , y T ) T ; c := (e T , u T ) T and

R =   0 R y 1 -1   , M =   0 R u 1 0  
Here P f represents the full behavior of the plant and the manifest behavior in to-becontrolled variables is given by

P = {w ∈ R q | ∃c ∈ R p such that (w, c) ∈ P f } (3)
Similarly for the controller, there exist co-prime polynomials C e and C u such that C = C -1 e C u , where C(ξ) is the polynomial representation of the controller and its behavior is described as

C = {c ∈ R p | H(ξ)c = 0} (4) with H ∈ R •×p [ξ]
, where H(ξ)c(t) = 0 is the kernel representation. The interconnection between P f and C results in a manifest controlled behavior, K = (P f ∧ c C) w defined as

K = {w ∈ R q | ∃c ∈ C such that (w, c) ∈ P f } (5)
Therefore, we say that K is implemented by C which in connection with the hidden behavior

N gives the implementability condition [2] N ⊂ K ⊂ P (6)
where the hidden behavior is defined as the behavior consisting of plant trajectories with the interconnection variables put equal to zero. It is described as

N = {w ∈ R q | (w, 0) ∈ P f }
Let see an example of a control problem in the behavioral framework.

Example Given a plant G(ξ) = ξ-1 ξ(ξ+1) and the controller is given by C(ξ) = -ξ+1 ξ+2.6 . Find the controlled behavior K ?

y u = ξ -1 ξ(ξ + 1) = R u (ξ) R y (ξ) [ξ(ξ + 1)]y + (-ξ + 1)u = 0 e = r -y P f :=   1 -1 -1 0 0 ξ 2 + ξ 0 -ξ + 1          r y e u        = 0 For controller C(ξ) u e = - ξ + 1 ξ + 2.6 = C u C e (ξ + 1)e + (ξ + 2.6)u = 0 C := 0 0 ξ + 1 ξ + 2.6        r y e u        = 0 (P f ∧ c C) w :=      1 -1 -1 0 0 ξ 2 + ξ 0 -ξ + 1 0 0 ξ + 1 ξ + 2.6             r y e u        = 0
Since from equation ( 6) K is a restricted behavior in P and K = (P f ∧ c C) w , [START_REF] Polderman | Introduction to Mathematical Systems Theory: A Behavioral Approach[END_REF]Sec 6.2.3] there must exist an unimodular matrix. The greatest common divisor between R u (ξ) and C e (ξ) is 1. Using Bezout identity, there exists polynomials a(ξ), b(ξ) such that a(ξ).R u (ξ) + b(ξ).C e (ξ) = 1. Define unimodular matrices U 1 (ξ), U 2 (ξ) as follows:

U 1 (ξ) =      1 0 0 0 1 0 ξ + 1 0 1      , U 2 (ξ) =      1 0 0 0 a(ξ) b(ξ) 0 ξ + 2.6 ξ -1     
Here a(ξ) = -1 3.6 , b(ξ) = 1 3.6 . One easily checks that

U 2 (ξ)U 1 (ξ)      1 -1 -1 0 0 ξ 2 + ξ 0 -ξ + 1 0 0 ξ + 1 ξ + 2.6      =      1 -1 -1 0 ξ+1 3.6 -(ξ+1) 2 3.6 0 ξ+0.8 1.8 ξ 2 -1 (ξ + 1)(ξ 2 + 1.6ξ + 1) 0 0      K :=       1 -1 -1 0 ξ+1 3.6 -(ξ+1) 2 3.6 0 ξ+0.8 1.8 ξ 2 -1 (ξ + 1)(ξ 2 + 1.6ξ + 1) 0 0                r y e u          = 0 (7)
Here we see the relation between r and y is given by the third row in the above equation. In this framework, the control problem is also formulated as to find a controller C that yields a desired controlled behavior D. Hence the controller C should yield a controlled behavior K such that K ⊆ D . If it is possible to find a controller C that yields K ⊆ D, then D is said to be implementable or implemented by C. Further, if a given desired behavior D is implementable, we say that 'the control problem is solvable'. Polderman [START_REF] Polderman | Sequential continuous time adaptive control: A behavioral approach[END_REF] proposed that for a given control objective, we must select a desired behavior to design a controller such that the control objectives are satisfied. While in [START_REF] Weiland | A behavioral approach to the H ∞ optimal control problem[END_REF], it is proposed that for a given control objective, there exist an equivalent desired behavior to design a controller such as the control objectives are satisfied. These two investigations were generally formalized as a single entity in [START_REF] Van Der Schaft | Achievable behavior of general systems[END_REF] to design a controller based upon the desired behavior. This controller is termed as the canonical controller, irrespective of the control objective. Therefore, we can regard the desired behavior D as equivalent to the control objective O.

B. Switching control in Behavioral Context

The theory of switching control relies on constructing a bank of controllers. Adopting a well-defined switching algorithm, one of the controllers in the bank is selected such that the control objectives get satisfied. In the analysis and development phase, it has been assumed that a finite set of controllers

C = {C 1 , C 2 , ..., C N } (8)
is constructed in such a way that in every situation either healthy or faulty mode of the plant, there is at least one controller in that set which has the appropriate control action and is able to satisfy the control objectives. The notion of directability in the behavioral framework precisely describes the existence of controller bank. The following definition of weak directability is given below [START_REF] Polderman | Introduction to Mathematical Systems Theory: A Behavioral Approach[END_REF].

Definition 2. Let w 1 , w 2 ∈ B and t ∈ T. We say that w 1 is weakly directable to w 2 at time t ′′ if there exists a trajectory w 3 ∈ B and a t ′ ≤ t ′′ such that

w 3 (t) =      w 1 (t), t ≤ t ′ w 2 (t), t > t ′′
In above definition, the trajectories before t ′ belong to an undesired behavior. Therefore, satisfying the weak directability on plant ensures that it is possible to switch the trajectory at any time t ′ such that it achieves the desired behavior after time t ′′ , introducing some time delay.

Remark 1. The notion of directability is stronger than definition 2. Unlike to weak directability, the interconnected system satisfying directability does not allow any time-delay while switching to the desired trajectory. If the interconnected system is weakly directable, then it is equivalent to say that there must exist a controller such that K ⊆ D.

Interestingly, the behavior we intend to control is of the form given by equation 2. The matrices of polynomials R(ξ) and M(ξ) are unknown. Once a fault occurs, the behavior of the closed loop becomes inconsistent w.r.t. desired behavior, and it must be compensated by making an interconnection with another controller (compensator). A compensator is a set of laws that restrict the interconnection variable c and therefore w. No doubt the measurements render the information about a dynamical system. These measurements give a partial knowledge about the systems and might be thought as representing a small set of the behavior of a dynamical system. This can be formalized by viewing these measurements, collected over time τ , as a nonempty subset M of W T . Polderman [START_REF] Polderman | Sequential continuous time adaptive control: A behavioral approach[END_REF] uses a somewhat similar explanation relying only on the measurements taken from a dynamical system. In that explanation, each time a measurement is completed, a model from that measurements is derived using an iterative algorithm. A controller is then generated so that the interconnection satisfies the control objective for that particular derived model. This model is known as the Most Powerful Unfalsified Model (MPUM). A formal definition on measurements illustrating the plant behavior [START_REF] Willems | From time series to linear systems, part ii : Exact modeling[END_REF] is given as:

Definition 3. Given a vector space of time signals W T , a model or dynamical system Σ p = (T, W, P f ) ,a mapping O τ : W T → W T and a measurement set M τ ⊂ O τ (W T ), we say that the behavior P f is said to be unfalsified by the measurement set M τ if

M τ ⊂ O τ (P f )
where O τ (x) is the experimental observation time sampling operator defined by

[O τ (x)](t) =    x(t), t a -τ ≤ t < t a ; 0, otherwise.
where

t
O τ (O -1 τ (M τ )) ∧ c C) ⊂ O τ (D); where O -1 τ (M τ )) ∧ c C = K
Definition 4 supposes roughly that a controller, whose behavior is denoted by C, is said to be unfalsified if the set of trajectories that are consistent with the data and the controller, at the past observation times, is a subset of the desired set O τ (D). As we are working in real time, introducing the time sampling operator is justified.

Remark 2. The underlying idea of utilizing the behavioral approach is that it captures the behavior of the plant without any explicit modeling. In definition 4, the trajectories when to change the control law and which controller should be switched into feedback with the evolving plant. From the hypothesis of the existence of at least one corrective controller in the pre-designed set (eq.8) for the faults occurring in the plant and taking definition 4 into account, a simple conceptual solution to the controller selection would be to evaluate experimentally each candidate controller's performance by applying it to the plant. Unfortunately, not all the potential controllers can be tested simultaneously in the feedback loop. To overcome this situation, the idea of identifying directly the right corrective controller to be switched into the feedback loop using only the experimental information up to the current time would be appealing. The problem amounts to infer the closed loop behavior from the observed data produced by the plant driven by a different controller.

Moreover, without further modeling assumptions on the plant Σ p , it is logically impossible to verify that a controller Σ c will implement an interconnected system K that achieves the desired behavior D. Thus we provide a bound on the time of a controller to be present in the closed loop so that its performance can be analyzed during that time interval. The controller will be provisionally retained as the best available controller until it is falsified (or rejected) or possibly outmoded by a better controller present in the bank. As in real time operation, it is impossible to foresee the realization of the desired behavior by a closed loop system, unless we know the model of the plant. Whenever the controller is not rejected by the experimental data, it is said to be unfalsified. This formulation is based on an approach, which is popularly known as the unfalsified control concept [START_REF] Safonov | The unfalsified control concept and learning[END_REF].

Notice that the observed data M τ is not related to any particular experimental setting.

Hence a deep consequence of definition 4 is that the controller Σ c can be tested, even if it is not actually interconnected to the plant. This fact is a powerful tool for evaluating the ability of an off-the-shelf controller to perform corrective actions and satisfy the performance objective following an unexpected change in a feedback loop. In [START_REF] Weiland | A behavioral approach to the H ∞ optimal control problem[END_REF], Weiland et. al.

formalizes the desired behavior or acceptable behavior with the notion of control objective as follows.

O τ (S min ) ⊆ O τ (K) + O τ (R min ) (9)
O τ (K) ∩ O τ (R max ) ⊆ O τ (S max ) (10)
The control objective O from equation 1 specifies the desired behavior. It is specified in terms of a minimal and a maximal requirement on the behavior of the controlled system.

Thus we call equation ( 9) a minimal and equation ( 10) a maximal requirement for O τ (K).

Roughly speaking the minimal requirement formalizes the idea that O τ (K) should be "sufficiently rich" so that a suitable extension of this system contains at least a specified set of trajectories (such as disturbances, reference trajectories or norm-bounded signals). The maximal requirement articulates the performance of the system. Definition 6. Given L + 2 , the space of square integrable trajectories which vanish for t < 0, the truncated L 2 inner-product w 1 , w 2 τ and norm w τ is denoted by

w 1 , w 2 τ t+τ t w T 1 (t)w 2 (t)dt w τ w, w τ .
where w : R → R q

Let Q = Q T be a real symmetric full rank indefinite matrix of dimension q × q and suppose that

Q = Q + -Q -,
where Q + 0 and Q - 0 are such that q + := rank Q + and q -:= rank Q -satisfy q + + q -= q. Given such a Q, the control objective is defined by the quadruple

R min := Q -L + 2 , (11)
S min := L + 2 , (12)
R max := L + 2 , (13)
S max := {w ∈ L + 2 | J(w) ≡ w, Qw 0} ( 14
)
where J(w) is the performance index. Comparing to standard input-output formulation of the H ∞ control problem. Let w be partitioned as, w := [ r u y ] T ∈ W T , where r has dimension n r > 0, u has dimension n u > 0, y has dimension n y > 0 and

n w = n r + n u + n y .
The H ∞ control problem then amounts to find a controller which when connect in the closed-loop, the system becomes stable and satisfy

λ 2 r 2 τ -u 2 τ -y 2 τ =      r u y      ,      λ 2 I nr 0 0 0 -I nu 0 0 0 -I ny           r u y      τ 0, ∀w ∈ L + 2 ( 15
)
where constant λ > 0 is an upper bound of the H ∞ norm of the closed loop transfer function (see [START_REF] Grimble | Robust Industrial Control: Optimal Design Approach for Polynomial Systems[END_REF]Ch.3]). Now we proceed with the controller falsification test. For an unknown dynamical system Σ p = (T, W, P f ), named plant, we have a set of measurement M τ during the time interval τ composed of trajectories u and y such that O -1 τ (M τ ) ⊆ P f , where

M τ = {(r, u, y) ∈ O τ (W T ) | u = u (m) , y = y (m) }; W T = R × U × Y ( 16
)
for some

(u (m) , y (m) ) ∈ O τ (U × Y)
In other words, (u (m) , y (m) ) is the measured data during τ . The performance evaluation of a controller C k in the set is based on the measurement set (u (m) , y (m) ) proceeds as follows.

The behavior of the controller C k is given by so that based on the measurements, the signal r should have been

C k = {w := (r, u, y) ∈ W T | u(t) = C k (r(t) -y(t))} (
r k (t) = C -1 k u (m) (t) + y (m) (t), t a -τ ≤ t ≤ t a ( 18
)
where we have assumed that all the controllers in the set are stable causally left invertible (SCLI) controller. Note that this assumption is not restrictive since the controllers can be designed to be bi-proper. Alternatively, in order to avoid the restriction to the minimum phase (SCLI) controllers, we can use the matrix fraction description (MFD) form [START_REF] Stefanovic | Safe adaptive switching control: Stability and convergence[END_REF] for the controllers. The signal w k = (r k , u (m) , y (m) ) ∈ W T on the time interval [t aτ, t a ], clearly belongs to the controller behavior C k as well as to O -1 τ (M τ ), i.e.

w k ∈ O τ (C k ∧ c O -1 τ (M τ )
). From definition 4, a controller C k is unfalsified by the experimental measurements M τ generated by an unknown plant, whenever w k ∈ O τ (D) , i.e. the feedback loop with the current controller satisfies the control objective O at w k ∈ W T for a certain value of λ. We denote control objective O at w i as O w i . Equation 18 defines a filter F k that reconstructs the reference signal r k from the measurements of (u, y) [START_REF] Yamé | A real-time model-free reconfiguration mechanism for fault-tolerance: Application to a hydraulic process[END_REF]. The above procedure can also be applied to any off-the-shelf controller in the set (equation 8) of the N potential candidate controllers, thus yielding N performance indexes

{J(w i ), i = 1, 2, ..., N} (19)
The unfalsified controllers are those controllers with index i that satisfy the control objective O w i for a certain value of λ. These performance indexes facilitate the selection of right unfalsified controller that can switch into the loop. The explicit structure of the reconfiguration mechanism consists in a bank of filters (equation 18), a performance index generator producing the indexes (equation 19), and a controller selector block is shown in figure 6. The controller selector block is a system that produces a piecewise constant signal (the switching signal) σ based on {J(w i )} N i=1 whose job is to select the corrective controller from the bank. The switching signal is a map from the time axis T to the controllers index set {1, 2, ..., N}, i.e. σ : T → {1, 2, ..., N}.

As we have mentioned earlier, we take the measurements and scrutinize the performance index on the time interval [t aτ, t a ]. This implies that if it requires switching of the controller, the switch will occur after time τ exclusively. Therefore, it imposes a lower bound on the length of intervals between successive switches. This minimum length of time in which a controller is active in the loop is known as dwell time. The logic is then realized through

σ(t) = σ(t a ) for t a ≤ t < t a+1 (20)
with an updating rule

σ(t a+1 ) =    σ(t a ), if C σ(ta) is not falsified; k = arg min{J(w k )} k =σ(ta) , if O w k is not satisfied for certain value of λ (21)
where k is the index of to-be-switched controller. The controller selector block contains the control selection algorithm given in equation( 20)- [START_REF] Zerz | Behavioral systems theory: A survey[END_REF]. The switching logic implements the following: it lets the stable dynamics of the closed-loop switched system have enough time to decay before a next possible switching occurs, and it bounds the detection delay, i.e. the time elapsed from the occurrence of a fault to the invalidation of the active controller. Note that a short detection delay requirement will need a short dwell-time that clearly conflicts with the stability of the closed-loop switched system. Moreover, in [START_REF] Wang | Stability of unfalsified adaptive control using multiple controllers[END_REF] it is proven and in [START_REF] Baldi | Multi-model unfalsified adaptive switching supervisory control[END_REF] it is experimentally illustrated that the unfalsified control concept cannot prevent the destabilizing controller to be switch in the feedback loop. This implies that the switching signal σ ∈ {1, 2, ..., N} follows a certain switching order before selecting the right controller.

Hence, the corrective controller will not be switched directly in the loop. Therefore, any destabilizing controller is expected to remain in the loop during the time interval τ . This also infringes the stability of the switching system. So here, we see, the stability of the closed loop conflicts because of the two reasons: (a) due to the short dwell time that can lead to multiple switching; (b) due to the impact of a destabilizing controller operating in the closed loop during the time interval τ .

For point (b), we can assume that the controllers installed in the bank are stabilizing for at least one working mode of the plant. For the latter case, we do not consider the multiple switching any more. Since it is well known that the large dwell time, itself ensure the global exponential stability [START_REF] Morse | Lectures notes on logically switched dynamical systems[END_REF]. Therefore, these stabilizing controllers are corresponding to the modes, i.e. there always exist at least one plant/controller stable interconnection.

Reacting to these issues, a lower bound for τ should be imposed to ensure the exponential stability of the overall switched system [8, Lemma 1.1]. As a result, a lower bound on dwell time is also determined in the analysis and development phase. As we mentioned that for a fixed short dwell time, there will be multiple switching in the system. On the other hand, a fixed large dwell time can lead to the second stability issue. Therefore, similar to [START_REF] Stefanovic | Safe adaptive switching control: Stability and convergence[END_REF],

the dwell time must be adaptive with the evolving time. In [START_REF] Stefanovic | Safe adaptive switching control: Stability and convergence[END_REF], Stefanovic et al. discusses the finiteness of the overall number of switches in case of multiple switching and develops a bound on it that depends on the data. Since it is also proven that the final controller will be the corrective controller, which implies that the number of switches would be some finite value and hence there could be a set of data, for which the number of switches can be arbitrarily large (though finite). Nevertheless, this situation depends on the switching algorithm and the evaluation of performance functional. Take a more precise look in [START_REF] Stefanovic | Safe adaptive switching control: Stability and convergence[END_REF],

the performance of all the controllers is evaluated on the whole time axis, starting from the origin to the current time. In the switching algorithm as well, the performance functional is evaluated for all the controllers, even if it has already been falsified. However, in our switching algorithm, the correct controller is selected in one shot. As mentioned before, we evaluate the performance in a fixed time window, thus, the evaluation of dwell time from [8, Lemma 1.1] considers the fact that right controller is identified. Moreover, for the stability of the overall system, the performance index should reflect any instability taking place in the closed loop. This feature is termed as cost-detectability [START_REF] Stefanovic | Safe adaptive switching control: Stability and convergence[END_REF], which is different from the plant detectability. At the same time, cost-detectability is determined from the knowledge of performance index and the candidate controllers, based upon the trajectories generated by the system in real time. The formal definition is follows as Definition 7. Let w m i = (r, u m , y m ) denote the measured trajectories and J(w i ) denote the performance index with i-th controller C i as the current controller. The set {J(w i )} N i=1 is said to be cost-detectable if, without any assumption on the plant and for every i ∈ {1, 2, ..., N}, the following statements are equivalent:

1. J(w m f ), where f ∈ {1, 2, ..., N} is bounded as t increases to infinity, where index-f corresponds to final corrective controller;

Given D, C, τ Form a measurement set M τ ∈ O τ (W T ) J(w k ) ≥ λ Switch 'off-the-shelf' controller k = arg min{J(w k )} k =σ(ta)
Analysis & development phase 1.

Determine the behavior of plant 2.

Fulfills the cost-detectability 3.

Re-configure the controller 4. From definition 7, it is now clear that any unpermitted behavior in the closed loop will be reflected by the performance index evaluation. The proposed algorithm to achieve real-time fault tolerant control is illustrated in figure 7. The following theorem provides the main result.

Theorem 1. Let D be the desired behavior that captures the control objective O (definition 5) using a cost-detectable performance functional J(w) (definition 7), τ be the interval during which the behavior of plant is determined, and the interconnection between the plant and the controller is assumed to be weakly directable (definition 2). For any system with σ(t) selected in accordance with eq. 20, 21, the following statements are equivalent:

• with any occurrence of unpermitted behavior, the system is fault-tolerant.

• global stability of final interconnected system is assured by the experimental measurement set M τ .

Note that, here we equipped the 'logic-based switching' mechanism unlike to the switching criterion dealt in [START_REF] Yang | Supervisory fault tolerant control for a class of uncertain nonlinear systems[END_REF]. Namely, in [START_REF] Yang | Supervisory fault tolerant control for a class of uncertain nonlinear systems[END_REF] the so-called continuous arbitrary switching criterion was used. Certainly, with periodic switching law the stability issue during the switching becomes a concern. It is studied in [START_REF] Hespanha | Overcoming the limitations of adaptive control by means of logic-based switching[END_REF] that the limitations often seen in arbitrary switching is successfully overcame in logic-based switching.

IV. SIMULATION EXAMPLE

In this section, we show an application of the proposed approach to construct the autopilot mechanism for an aircraft during the landing phase [START_REF] Oishi | Hybrid verification of an interface for an automatic landing[END_REF]. The auto-landing system of the modern aircraft is supposed to follow a certain trajectory called glide-scope. The landing of a civil transport aircraft is divided into three parts, namely approaching a trajectory, flare, and touchdown and ground run. Figure 8 shows the aircraft in a certain trajectoryapproaching phase, which constitutes the final phase of the descent (i.e. the glide-slope). The instrument landing system (ILS) on ground determines the difference between the actual trajectory of the aircraft and the reference trajectory imposed for the descent. Here the purpose is to design a fault tolerant autopilot that fully supports the conduct of the flight in the vertical plane along the glide scope. In these simulations, we ignored the lateral movement and rolling movements of the aircraft assuming that these aspects are handled by another automated system.

For the problem considered (longitudinal flight), the aircraft is seen as a system with three outputs that are measured in real-time: speed V , angle γ of the flight path and the distance from the center of mass of the aircraft relative to the glide-scope h err . The control inputs of the system are the aircraft thrust T and the elevator command δ [START_REF] Oishi | Hybrid verification of an interface for an automatic landing[END_REF]. The elevator is a movable aerodynamic surface located in the empennage that controls the pitch of the aircraft. We assume there is no dynamics between the elevator command and the angle of attack α of the wing. Thus, we view α as equivalent to δ and consequently for the sake of simplicity, we treat α as a control input. The thrust controls the speed V of the aircraft.

The objective is that the aircraft follows along the glide slope, making a desired flight path angle at 3 degrees clockwise (i.e. γ r = -3 deg.). Thus, it makes h err null. The non-linear model of the longitudinal dynamics of a large jet aircraft is given as:

     m dV dt mV dγ dt dherr dt      =      -D(α, V ) + T cosα -mgsinγ L(α, V ) + T sinα -mgcosγ V (sinγ + cosγtanγ R )      (22)
See [START_REF] Yamé | Modeling and simulation of an aircraft in landing approach[END_REF] for the data and the parameters of the aircraft.

0 0      , C =      1 0 0 0 1 0 0 0 1      .
As mentioned before, the control objective is to maintain the h err equal to zero. However, the references to be tracked are V and h err . Thus, the output is now given as y = C o x,

where

C o =   1 0 0 0 0 1   .
We design two corresponding controllers for the two different modes based on eq. 23. The control law is given as

u(t) = -K.z(t) + K p .e(t) + K i . t 0 e(ϑ)dϑ (24)
with e(t) = wy, where w is the reference trajectory. The matrix gain corresponding to the measurement (or state) feedback is designed using the pole-placement technique. The poles for both modes are placed at (-2.8782, -2.3026 ± 1.7269i) that makes the system internally stable. The matrix gains corresponding to "Proportional+Integral" (PI) structure on error assist to follow the desired trajectory. The gains for healthy and faulty mode are then chosen as

K h =   2

 

The subscript h and f represent the gains for healthy and faulty mode respectively.

c. Parameters of supervisor The time interval during which the measurements are taken is τ and the performance is evaluated with t a , the instants of possible switching. The performance threshold λ distinguishes various modes of the system. These parameters are set to λ = 5, τ = 5s.

An experiment is run with a complete stuck in the angle of attack appearing at time 30s. The closed-loop signals of figure 9 show that the real-time FTC system successfully reacts at time 40s by switching to controller 2 (faulty mode controller). After an acceptable transient, the control objective is recovered as seen from the distance from the center of mass of the aircraft relative to the glide-scope approaching to zero. Note that since the FTC scheme is based on the control performance, when the active controller is invalidated by the operating plant data, the supervisor puts into feedback the best controller from the potential controllers set, that is the controller yielding optimal closed-loop performance in real-time. In this paper, the fault tolerant control problem has been formalized in the behavioral setting using the concept of system interconnection. This results in a model-free reconfiguration scheme in real-time that is solely based upon the input-output trajectories. In fact, the concept of interconnection among the variables describing the system is regulated by the closed-loop performance evaluation. A cost-detectable "performance functional" captures the control objectives effectively, and plays the role of a detector for any abnormal situation or faults in the closed-loop system. On detecting this undesired behavior of the closed loop, appropriate interconnection is made in real-time without using an explicit model of the plant so that the control objective is satisfied at anytime. A novel feature of this scheme is that it does not require any FDI unit. This clearly rules out the issues of generating false or missed alarms associated with standard FDI units, thus, increases the reliability of the FTC system. not be satisfied. From remark 1, there exist a controller C f such that the performance functional corresponding to C f is minimal relative to the connected controller C i in loop. Thus, on directing C f in loop, the system (P ∧ C) f is H ∞ -stable by the set of trajectories w := (r f , u (m) , y (m) ). Then, there exist finite nonnegative constants α 1 , α 2 , δ 1 , and δ 2 such that u (m) ≤ α 1 rf + δ 1 , y (m) ≤ α 2 rf + δ 2 .

As the virtual reference rf converges exponentially to the true reference r, there exists a finite nonnegative constant δ such that rτ f ≤ r τ + rτ fr τ ≤ r τ + δ.

Consequently, one can conclude that

u (m) ≤ α 1 r + β 1 , y (m) ≤ α 2 r + β 2 .
where β 1 := α 1 δ + δ 1 ≈ 0, β 2 := α 2 δ + δ 2 ≈ 0 and α 1 + α 2 = λ, viz. the system P ∧ C is H ∞ -stable by M τ . Here we see, after the occurrence of fault, following eq.20, 21, the interconnected system is H ∞ -stable. Hence, it is a fault tolerant system.

Figure 1 .

 1 Figure 1. Fault Tolerant Control architecture: r is a reference signal, u is the control signal, y is the output signal, f is a fault signal, d is a disturbance, D is the diagnosis information and C is the controller redesign information.

Figure 2 .

 2 Figure 2. Structure of logic-based switching controller

Figure 3 .

 3 Figure 3. Structure of Supervisor

Definition 1 .

 1 Dynamical system Σ is represented by a triple Σ = (T, W, B) where T ⊆ R, called the time axis, W ⊆ R w called the signal space and B ⊆ W T called the behavior. A trajectory is a function

Figure 4 .

 4 Figure 4. (a) Interconnection of subsystems (b) Feedback control in behavioral context

  a is arbitrary current time. Thus O τ (x) returns values of x(t) only for past time intervals over which experimental observations of x(t) have been recorded. The measurement set M τ is the set of actual experimental observations of the plant behavior as observed through the time sampler O τ . Thus, O -1 τ (M τ ) is a behavior that interpolates the observed data during the time interval τ . Definition 4. Given a vector space of time signals (T × W), a controller Σ c = (T, W, C), a desired behavior D, a mapping O τ : W T → W T and a measurement set M τ ⊂ O τ (W T ), we say that a controller Σ c is unfalsified by the measurement set M τ if

Figure 5 .

 5 Figure 5. Switching control scheme for FTC in behavioral setting

Definition 5 .

 5 A control objective is a quadruple O = (R min , S min , R max , S max ) of subsets of W T . A controller Σ c is said to achieve the control objective O for the interpolated plant behavior O -1 τ (M τ ) if the behavior O τ (K) satisfies the two inclusions

Figure 6 .

 6 Figure 6. Structure of reconfiguration mechanism

Figure 7 .

 7 Figure 7. Proposed Algorithm

Figure 8 .

 8 Figure 8. Aircraft during the landing phase

  a. Fault scenario: For illustrating the FTC mechanism, we consider the complete loss of one of the control surfaces, i.e. a fault in the elevator. Two modes of the aircraft system are considered: the nominal mode (no fault) and a complete stuck in the angle of attack (faulty mode). b. Constructing a controller bank: We use the following linearized model for designing a controller bank around the trim points, α = 2.686 deg. and T = 4.23 × 10 4 N. ẋ = Ax + Bu, z = Cx (23) where x = V γ h err T

.3288 × 10 2 . 2 × 2 . 2 ×× 10 3 - 1 .

 10222231 × 10 5 5.4095 × 10 -3 1.5979 × 10 5 10 -3 5.21 × 10 -2 9.2755 × 10 5 5.9528 × 10 6   , K ih =  10 -2 1.563 × 10 -1 9.2755 × 10 6 1.7858 × 10 7 2057 × 10 4 2.0298 × 10 6

Figure 9 .

 9 Figure 9. Closed-loop signals aircraft autopilot landing system

APPENDIX

The proof of Theorem 1 is somewhat similar to the stability proof in [START_REF] Stefanovic | Safe adaptive switching control: Stability and convergence[END_REF]. First, it is convenient to provide the following lemma.

Lemma 1. Consider a fault tolerant system with σ(t) selected in accordance with eq. 20, 21. For any controller C k in the loop, the corresponding virtual reference rk converges exponentially to the true reference r.

Proof. For any controller C k , eq. 18 yields

The corresponding controller in the loop gives the control signal by

From above two equations, we get

Hence, r(t)r(t) converges exponentially to zero being C ku (ξ) a co-prime factor.

We show our results corresponding to H ∞ -stable (eq. 15) interconnected system by the measurement set M τ .

Proof of Theorem 1. Recall that, by construction, ri can be viwed as the virtual reference that, if injected into the interconnected system (P ∧C) i , would reproduce (u (m) , y (m) ). Then, for any index i corresponding to an H ∞ -stable interconnected system, there exist positive reals α1 , α2 , δ1 , δ2 such that

In other words, for every right controller connected to the corresponding plant working mode, the interconnected system P ∧ C is H ∞ -stable by the set of trajectories w := (r i , u (m) , y (m) ), regardless of the switching sequence σ(t), t ∈ T. Consequently, from definition 7, one concludes that J(w) is bounded by λ. Since, the measurement set M τ determine the behavior of the plant. Therefore, after the occurrence of fault the unfalsification inequality will