Thèse De

Bassino Frédérique

Jungers Raphaël

Petrucci Laure

André Étienne

Frédérique Bassino

Thao Dang

Raphaël Jungers

Giusseppe Lipari

Laure Petrucci

David Lesens

Olivier Bruneau

Emmanuel Coquard

Sahar Mhiri

Abdelwaheb Hafs

Ugochukwu Enrico Mehdi

Florent, Boris Tito Dina

Juan José

Ikram Daniel

Guillaume

François Gaspard

Vdp Van Der Pol

Guaranteed properties of dynamical systems under perturbations

Keywords: Dynamical systems, real-time systems, model checking, verification, parametric timed automata, parameter synthesis, IMITATOR, schedulability, synchronization, reachability, robustness, stability, hybrid system, Euler method Systèmes dynamiques, systèmes temps-réel, model-checking, vérification, automates temporisés paramétrés, synthèse de paramètres, IMITATOR, ordonnancement, synchronisation, accessibilité, robustesse, stabilité, système hybride, méthode d'Euler. Remerciement

Since dynamical systems has a major impact on human development, especially critical systems that can put human lives at risk if something goes wrong. Hence, the need of studying the behavior of these systems in order to guarantee their correct functioning. Nevertheless, computing such type of system has never been an easy task, as the complexity of these systems is constantly increasing, in addition to the perturbations that may arise during their performance, as well as undefined parameters that may exist. To ensure that a system always produces the expected results and does not fail in any way, a formal verification of its behavior and properties is necessary.

In this thesis, we study dynamical systems from different aspects and using various techniques. More specifically, we focus on the formal verification of some of its critical properties such as schedulability, synchronization, robustness and stability.

In the first part, we start with the formal verification of real-time systems under uncertainty, where we use parametric timed automata sometimes extended by stopwatches to model systems with preemption. This formalism is very suitable for real-time systems due to its good expressiveness. It allows to study the schedulability of the flight control of a space launcher with unknown parameters and under constraints. Then, a synthesis of the admissible timing values of the unknown parameters is provided by a parametric timed model checker. We increase the complexity of the problem by taking into consideration the switch time between two threads. We extend this work by developing a tool that translates a given real-time system design into parametric timed automata in order to infer some timing constraints ensuring schedulability.

In the second part, we study the stability of dynamical systems and the robustness of controls. We give a simple technique based on Euler's integration method which allows to build an invariant set around a given system. This technique guarantees that the approximate Euler solutions are attracted by a limit cycle. We apply the method on different systems, including chaotic systems with strange attractors. Furthermore, we show that a basic combination of a random sampling with a symbolic computation method assists to deal with robust control problems for nonlinear systems. Also, we illustrate a basic condition guaranteeing that a system with perturbation is robust under a repeated control sequence obtained by solving a horizon optimal control problem. Finally, we unified the main contributions of the second part in a tool called ORBITADOR which checks the stability of a given system and notably returns plots containing the evolution of the system in different views and the shape of the invariant ii if it exists.

Analyses formelles des propriétés des systèmes dynamiques sous perturbations

Résumé:

Étant donné que les systèmes dynamiques ont un impact majeur sur le développement humain, en particulier les systèmes critiques qui peuvent mettre des vies humaines en danger en cas de problème. D'où la nécessité d'étudier le comportement de ces systèmes afin de garantir leur bon fonctionnement. Néanmoins, le calcul de ce type de système n'a jamais été une tâche facile, puisque la complexité de ces systèmes est toujours en augmentation, en plus des perturbations qui peuvent survenir lors de leur fonctionnement, ainsi que des paramètres indéfinis qui peuvent exister. Pour s'assurer qu'un système produit toujours les résultats attendus et n'échoue en aucune façon, une vérification formelle de son comportement et de ses propriétés est nécessaire.

Dans cette thèse, nous étudions les systèmes dynamiques sous différents aspects et en utilisant diverses techniques. Plus précisément, nous nous concentrons sur la vérification formelle de certaines de ses propriétés critiques telles que l'ordonnancement, la synchronisation, la robustesse et la stabilité.

Dans la première partie, nous commençons par la vérification formelle de systèmes temps réel sous incertitude, où nous utilisons des automates temporisés paramétriés parfois étendus par des "stopwatches" pour modéliser des systèmes avec préemption. Ce formalisme est très adapté aux systèmes temps réel en raison de sa bonne expressivité. Il permet d'étudier l'ordonnancement de la commande de vol d'un lanceur spatial avec des paramètres inconnus et sous des contraintes. Ensuite, une synthèse des valeurs temporelles admissibles des paramètres inconnus est fournie par un model checker paramétré temporisé. Nous augmentons la complexité du problème en prenant en considération le temps de basculement entre deux threads. Nous étendons ce travail en développant un outil qui traduit une conception de système temps réel donnée en automates temporisés paramétrés afin d'inférer des contraintes temporelles assurant l'ordonnancement.

Dans la deuxième partie, nous étudions la stabilité des systèmes dynamiques et la robustesse des commandes. Nous donnons une technique simple basée sur la méthode d'intégration d'Euler qui permet de construire un ensemble invariant autour d'un système donné. Cette technique garantit que les solutions d'Euler approchées sont attirées par un cycle limite. Nous appliquons la méthode sur différents systèmes, y compris des systèmes chaotiques avec des attracteurs "étranges". De plus, nous montrons qu'une combinaison de basique d'un échantillonnage aléatoire avec une méthode de calcul symbolique aide à traiter des problèmes de contrôle robuste pour les systèmes non linéaires. De plus, nous illustrons une condition de base garantissant iv qu'un système avec perturbation est robuste sous une séquence de contrôle répétée obtenue en résolvant un problème de contrôle optimal d'horizon. Enfin, nous avons unifié les principales contributions de la deuxième partie dans un outil appelé ORBITADOR qui vérifie la stabilité d'un système donné et retourne notamment des graphiques contenant l'évolution du système dans différentes vues et la forme de l'invariant s'il existe.

List of publications

Motivations and problematic

Dynamical systems became more and more complex specially in the recent years and in different domains for example, transports, communications, industrial units and robotics.

In the past, there were accidents where issues were caused by the lack of behavioral study and of robust verification, i. e., when the system faced external perturbations (like weather conditions) or internal perturbations (such as switching between human and automated systems guidance in aircraft). An example of such accident in the Fukushima Daiichi nuclear disaster in March 2011 when three nuclear reactors collapsed; among the causes, there was a problem in the control of the cooling systems. Another example is the case of the crash of the Air France Flight 447 (from Rio de Janeiro, Brazil, to Paris, France) in June 2009; one of the causes was an issue in the accuracy of the speed value shown by the indicators. Therefore, modeling and verification of these dynamical systems is an important task because it can help to avoid dramatic accidents. We focus here on some significant properties: schedulability, synchronization, stability, robustness and control optimization, which guarantee the smooth functioning of the system and keep it away from chaos.

Among the major challenges that the study of these properties on complex dynamical systems can generate, we can cite the complexity of computation due to the exploration of the behavior of the system and the influencing external factors, also the lack of information on the values of certain parameters. Moreover, the modeling of such systems is in itself a challenge because of the complexity of their evolution, especially for hybrid systems (hybrid systems mix continuous behaviors with discrete actions, such as jumps).

A lot of research has been done on dynamical systems to study their stability: a system is considered stable if small perturbations to the solution lead to a new solution that stays close to the original solution for all time, and to verify the robustness of controllers that may guide a system. Consequently, many techniques have been developed to check stability and robustness. However, most of these methods have a high computational complexity, which makes their implementation to real case studies often difficult. Thus, the need for methods that study the stability and the robustness and which are less greedy in term of memory and computational resource.

Context of the thesis

Overview of the thesis manuscript

The structure of this document is organized as follows. Part I: Real-time systems analysis:

• In Chapter 1, we introduce the first part of the thesis and we give its objectives.

• In Chapter 2, we formally define the notations related to the first part. We first recall the formalism of clocks, parameters and constraints. Then, we remind the syntax of timed automata, parametric timed automata and parametric stopwatch automata. Finally, we describe scheduling problem for real-time systems.

• In Chapter 3, we introduce an approach for the specific case of the scheduling of the flight control of a space launcher. The approach requires two successive steps: First, the formalization of the issue to be tackled in a parametric formal model. Second, the analysis of the model parameters using a tool. We first describe the problem of the scheduling of a launcher flight control, then we show how this problem can be formalized with parametric stopwatch automata; we then present the results computed by the parametric timed model checker IMITATOR. We enhance our model by taking into consideration the time for switching context.

Contents

• In Chapter 4, we present Time4sys2imi, a tool that we developed to translate Time4sys models [START_REF] Yassine | Time4sys in a nutshell[END_REF] into parametric timed automata in the input language of IMITATOR [START_REF] André | IMITATOR 3: Synthesis of timing parameters beyond decidability[END_REF]. Time4sys is a graphical formalism developed by Thales Group that allows the design of real-time systems and interoperability between timed verification tools. The importance of the translation by Time4sys2imi comes from the fact Time4sys does not perform verification. Besides, it not only allows to check the schedulability of real-time systems, but also to infer some timing constraints (deadlines, offsets, . . . ) guaranteeing schedulability.

• In Chapter 5, we conclude the first part and we give some perspectives.

Part II: Limit cycle of oscillators using Euler method:

• In Chapter 6, we introduce the second part of the thesis by giving its objectives and contributions.

• In Chapter 7, we first define the symbolic Euler's method, then we focus at the synthesis of an approximate minimax control (which is the control that guarantees the optimal performance under the worst-case scenario of disturbance, see [START_REF] Dimitri | On the minimax reachability of target sets and target tubes[END_REF]) for a system dynamic given in the form ẋ(t) = f (x(t), u(t), w(t)) where x represents the state, u the control (or input) and w a perturbation. The disturbance d(t) is prescribed to a compact domain D on which it can take any value (bounded uncertainty). The method makes use of symbolic computation (or algebraic computation which is the computation with symbolic expressions, see [START_REF] Akhrif | Symbolic computations in differential geometry applied to nonlinear control systems[END_REF]) to enclose the solutions corresponding to all possible disturbance d(•) ∈ D, together with a simple algorithm of random sampling which is a sampling technique where each randomly selected sample has the same probability of being selected (see [START_REF] Vidyasagar | Randomized algorithms for robust controller synthesis using statistical learning theory[END_REF]) to select the minimum control u * (•).

• In Chapter 8, we first describe, for a given dynamical system Σ p with a parameter p taking its values in a fixed interval Q, a simple criterion of set inclusion which guarantees that the Euler approximate solutions of Σ p 0 for some value p 0 ∈ Q converge to a limit cycle L. Moreover, we characterize a compact set I containing L which is invariant (i. e., an unchanged object after operations applied to it, see [START_REF] Sternberg | Approximate robust optimal control of periodic systems with invariants and high-index differential algebraic systems[END_REF]) for the exact solutions of Σ p whatever the value of p ∈ Q. Then, we consider the application of optimal periodic control sequences which are open-loop (no feedback) (see [START_REF] Gilbert | Optimal periodic control: A general theory of necessary conditions[END_REF]) to switched dynamical systems which are systems with continuous-time evolution punctuated by discrete switching event (see [START_REF] Sun | Stability Theory of Switched Dynamical Systems[END_REF]). The control sequence is obtained using a finite-horizon optimal method which implies that the overall cost over an indicated number of stages is to be minimized (see [START_REF] Allen | Survey of the Dynamic Programming Formulation[END_REF]). This method is based on dynamic programming that is basically an optimization algorithm (see [START_REF] Bellman | Dynamic Programming[END_REF]). We then consider Euler approximate solutions for the system extended with bounded perturbations. The main result gives a simple condition on the perturbed system for guaranteeing the existence of a stable limit cycle of the unperturbed system which means all adjacent trajectories approach the limit cycle as time approaches infinity (see [START_REF] Hiskens | Switching-induced stable limit cycles[END_REF]).

• In Chapter 9, we show how, using Euler's integration method and an associated function bounding the error in function of time, one can generate structures closely surrounding the invariant tori of dynamical systems, where all the orbits located in the invariant tori stay in this tori at any time (see [START_REF] Edoh | Computation of invariant tori by orthogonal collocation[END_REF]). Such structures are constructed from a finite number of balls of R n and encompass the deformations of the tori when small perturbations of the flow of the system occur.

• In Chapter 10, we present ORBITADOR, a tool that I developed to study the stability analysis of dynamical systems. ORBITADOR uses a method that generates a bounded invariant set (which is a set that has both an upper bound and a lower bound and respects the property that if the system state is in the set at some time, then it will always contain the system in the future, see [START_REF] Blanchini | Invariant sets[END_REF]) of a differential system with a given set of initial conditions around a point x 0 to prove the existence of a limit cycle which is a periodic trajectory that repeats itself after a specified period of time also it is defined, in [START_REF] Rush D Robinett | What is a limit cycle?[END_REF], as the stability boundaries for linear and non-linear systems. This invariant has the form of a tube centered on the Euler approximate solution starting at x 0 , which has for radius an upper bound on the distance between the approximate solution and the exact ones. The method consists in finding a real T > 0 such that the "snapshot" of the tube at time t = (i + 1)T is included in the snapshot at t = iT , for some integer i with adding a small bounded uncertainty. This uncertainty allows using an approximate value T of the exact period.

• In Chapter 11, we conclude the second part and we give some perspectives related to this part.

Introduction

Context

Real-time systems are systems the accuracy of which depends not only on the results of computations, but also on the time at which the results are delivered [START_REF] Liu | Real-Time Systems[END_REF]. Real-time systems combine concurrent behaviors with hard timing constraints that dictate that the system computation must be completed before a stringent deadline, failing which the operation may be considered to have failed (see [START_REF] Xu | On satisfying timing constraints in hardreal-time systems[END_REF]). An out-of-date reply is often considered as invalid even if its content is correct. For critical real-time systems, if a time constraint is violated, then the consequences can be disastrous. Thus, a formal verification phase is essential in order to statically guarantee that all the tasks will be executed in their allocated time, and that the system will return results within the deadline guaranteed by the specification.

Scheduling

Scheduling [START_REF] Liu | Scheduling algorithms for multiprogramming in a hard-real-time environment[END_REF] is a decision-making process that concerns the allocation of restricted resources (that may be seen as processors) to concurrent tasks over time in order to optimize objectives. It is a procedure that regulates the time execution of several processes in real-time systems. Process schedulers obey a scheduling policy which can generally be preemptive or non-preemptive. Non-preemptive schedulers run a process until the execution time is completed. However, preemptive schedulers can temporarily interrupt the execution of a process if a higher priority process is activated.

Real-time systems

Real-time systems [START_REF] Xu | On satisfying timing constraints in hardreal-time systems[END_REF] are systems where the result is guaranteed to be calculated within a predefined time interval.

In soft real-time systems, the system continue to perform even if a deadline is missed. This means that, there is a tolerance on the deadline of the system and it does not fail during this margin, but the system's quality of service is considered to be degraded, for example streaming media systems. However, in hard real-time a failure to meet a deadline is catastrophic for example aircraft control systems.

Context

Formal methods

Formal methods [START_REF] Wing | A specifier's introduction to formal methods[END_REF] are techniques which allow to specify and model the behavior of a system and to prove that the design and the implementation of the system satisfy the functionalities and the various safety properties. Formal methods provide a framework of mathematical techniques that aim to formally guarantee correctness for the system.

Model checking

Model checking [CGK + 18] is a set of formal methods to check whether a model of a system satisfies a formal specification. In other words, given a formal model of the system (given in a formalism such as timed automata, Petri nets, process algebras, etc.) and a property (expressed in a formalism such as temporal logics, automata, etc.), model checking gives a formal guarantee whether the system satisfies its property. The output then is "yes" if the given model satisfies the given specifications, otherwise a counterexample may be generated. Model checking can encounter the infamous state space explosion problem, and it is a challenge to develop efficient methods, which will succeed in verifying actual case studies.

Timed Automata

A timed automaton (TA) [START_REF] Alur | A theory of timed automata[END_REF] is a strong formalism that allows to model real-time systems. It is extended of finite automata with a set of clocks. The values of clocks can be assigned to a constant during the execution of a transition, besides they can be compared with (integer) constants to check if a transition from a location to another is allowed to happen or not. Also, this comparison can take place within a location, where a system must remain at the current location as long as the condition is true. For Timed automata, the reachability properties are decidable [START_REF] Alur | A theory of timed automata[END_REF], this is why they are used in several model checkers for example Uppaal [START_REF] Kim Guldstrand Larsen | UPPAAL in a nutshell[END_REF]. Thanks to these model checkers, many case studies have been verified. Fig. 1.1 illustrates an example of timed automata which models the mechanism of a flashlight. In this TA, there are three locations: init, BrightMode and StrobeMode, one clock x and an action Press?. Initially, the system stars from the location init which indicates the off mode, and stays there location until a Press? action occurs.

Introduction init

BrightMode StrobeMode Press?

x := 0 Press? x >= 2 Press?

x < 2 Press? Then the system moves to the location BrightMode while resetting the clock x to 0. If a Press? action is triggered when x ≥ 2 then the system goes back to the location init; otherwise if this action is activated when x < 2 the flashlight goes into strobe mode. The flashlight remains in strobe mode until a new Press? action occurs, which brings the system back to its initial mode.

Objectives

The objective of this part is, first, to propose a methodology of scheduling of a real-time system, particularly the case of flight control of a space launcher. We initially depict the problematic of the scheduling of a launcher flight control. Then, we formalize this case study with parametric stopwatch automata (PSA) [SSL + 13], which is an extension of PTA with stopwatches, where clocks can be stopped in some locations of the automaton (Definition 2.3). After, we show the results analyzed by the IMITATOR parametric timed model checker. Finally, we compare our results and the ones acquired by different tools used traditionally in scheduling.

The second objective of this part is to propose a tool that translates Time4sys models into parametric timed automata [START_REF] Alur | Parametric real-time reasoning[END_REF] in the input language of IMITATOR which permits to check the schedulability of real-time systems and to infer some timing constraints guaranteeing schedulability.

Scheduling

A long line of works in the last four decades has been devoted to the problem of scheduling analysis of real-time systems with various flavors. Several analytical methods were proposed to study the schedulability for a particular situation. Such analytical methods need to be tuned for each precise setting (uniprocessor or multiprocessor, scheduling policy, absence or presence of offsets, jitters, etc.). Most of them do not cope well with uncertainty. For example, in [START_REF] Bate | Schedulability analysis of fixed priority real-time systems with offsets[END_REF], three methods for the schedulability analysis with offsets are proposed. the goal of this method is to modify the offsets of the transaction to satisfy all the requirements. In this model, there is a set of periodic transactions, which composed by a set of tasks. Each tasks are released at a fixed time interval. Besides, tasks in different transactions are analyzed assuming they are released at the worst instant. Using offset, that can made a particular case of asynchronous periodic tasks. In [START_REF] Bini | Schedulability analysis of periodic fixed priority systems[END_REF], an efficient approach for testing schedulability for RMS (rate monotonic) in the case of (uniprocessor) analysis is proposed, through a "parameter" (different from our timing parameters) to balance complexity versus acceptance ratio.

Scheduling with model checking

Schedulability with model checking is a trend that started as early as the first works on timed model checking (e. g., [WME92, AHV93, AD94, YMW97, CC99]), and grew larger since the early 2000s.

A natural model to perform schedulability analysis is (extensions of) timed automata (TAs) [START_REF] Alur | A theory of timed automata[END_REF]. On the negative side, the cost of state space explosion often prevents to verify very large real-time systems. On the positive side, they allow for more freedom, and can model almost any system with arbitrarily complex constraints; in addition, despite the cost of state space explosion, they can be used to verify small to medium-size systems for which no other method is known to apply.

In [START_REF] Abdeddaïm | Job-shop scheduling using timed automata[END_REF][START_REF] Adbeddaïm | Preemptive job-shop scheduling using stopwatch automata[END_REF], (acyclic) TAs are used to solve job-shop problems. The preemption is encoded in [START_REF] Adbeddaïm | Preemptive job-shop scheduling using stopwatch automata[END_REF] with stopwatches, while keeping some decidability results. In [START_REF] Adbeddaïm | Scheduling with timed automata[END_REF], scheduling is performed using TAs. Timed automata allow to 1. Introduction model naturally and verify more complex systems, which are not captured so easily in traditional formalisms for schedulability analysis.

In [START_REF] Norström | Timed automata as task models for event-driven systems[END_REF][START_REF] Fersman | Task automata: Schedulability, decidability and undecidability[END_REF], task automata are proposed as a formalism extending TAs to ease the modeling (and the verification) of uniprocessor real-time systems: in some cases, the schedulability problem of real-time systems is transformed into a reachability problem for standard TAs and it is thus decidable. This allows to apply model-checking tools for TAs to schedulability analysis with several types of tasks and most types of scheduler.

In [SLS + 14], hierarchical scheduling systems are encoded using linear hybrid automata, a model that generalizes TAs. This approach outperforms analytical methods in terms of resource utilization. In [START_REF] Sun | A weak simulation relation for real-time schedulability analysis of global fixed priority scheduling using linear hybrid automata[END_REF], linear hybrid automata are used to perform schedulability analysis for multiprocessor systems under a global fixed priority scheduler: this method is more scalable than existing exact methods, and shows that analytical methods are too pessimistic.

In [START_REF] Fang | Schedulability analysis of timed regular tasks by underapproximation on WCET[END_REF], a schedulability analysis method is introduced using the model of timed regular task automata (using under-approximated WCETs) and then using nested timed automata; this method is shown to be exact.

The problem solved here shares similarities with analyses done in [FBG + 10, MLR + 10]. An important difference between [FBG + 10, MLR + 10] and our case study comes from the fact that, here, there are two distinct notions of "thread" and "processing", while in [FBG + 10, MLR + 10] there was only one notion called "task". Most importantly, none of these works consider timing parameters.

Scheduling with parameters

When some of the design parameters are unknown or imprecise, the analysis becomes much harder. Model checking with parameters can help to address this. In [START_REF] Cimatti | Symbolic computation of schedulability regions using parametric timed automata[END_REF], PTAs are used to encode real-time systems so as to perform parametric schedulability analysis. A subclass (with bounded offsets, parametric WCETs but constants deadlines and periods) is exhibited that gives exact results. In contrast, our work allows for parameterized deadlines; in addition, reactivities are not considered in [START_REF] Cimatti | Symbolic computation of schedulability regions using parametric timed automata[END_REF].

In [START_REF] Fribourg | Robustness analysis for scheduling problems using the inverse method[END_REF], the robust schedulability analysis are performed on an industrial case study, using the inverse method for PTAs [START_REF] André | An inverse method for parametric timed automata[END_REF] implemented in IMITATOR. While the goal is in essence similar to the one in this manuscript, the system differs: [START_REF] Fribourg | Robustness analysis for scheduling problems using the inverse method[END_REF] considers multiprocessor, and preemption can only be done at fixed instants, which therefore resembles more Round Robin than real Fixed Priority Policy (FPS). In [SSL + 13], it is shown that PTAs-based methods are significantly more complete than existing analytical methods to handle uncertainty. In [START_REF] Sun | Verification of two real-time systems using parametric timed automata[END_REF], an industrial challenge is solved by Thales using IMITATOR.

In [START_REF] Thieu | Timed-automata based schedulability analysis for distributed firm real-time systems: a case study[END_REF], the analysis is not strictly parametric, but concrete values are iterated so as to perform a cartography of the schedulability regions. However, the resulting analysis of the system is incomplete.

In [START_REF] Bérard | Interrupt timed automata with auxiliary clocks and parameters[END_REF], timed automata are extended with multi-level clocks, of which exactly one at a time is active. The model enjoys decidability results, even when extended with polynomials and parameters, but it remains unclear whether concrete classes of real-time systems can actually be modeled.

The aforementioned task automata were extended in [START_REF] André | A unified formalism for monoprocessor schedulability analysis under uncertainty[END_REF] to parametric task automata; some schedulability problems remain decidable in this setting, i. e., it is possible in some cases to decide whether the set of valuations ensuring schedulability is empty or not. In addition, procedures for exhibiting schedulability regions are proposed and implemented.

Finally, Roméo [LRST09] also allows for parametric schedulability analysis using parametric time Petri nets [START_REF] Traonouez | Parametric model-checking of stopwatch Petri nets[END_REF].

Plan of Part I

The overview of Part I is organized as follow.

• In Chapter 2, we remind the formalism of clocks, parameters and constraints.

Then, we recall the syntax of timed automata, parametric timed automata and parametric stopwatch automata. Finally, we depict scheduling problem for real-time systems.

• In Chapter 3, we explain an implementation of the scheduling of the flight control system of a space launcher into parametric timed automata. The proposed solution is modular where each element of the system is presented by an automaton.Then, we present the results computed by the parametric timed model checker IMITATOR.

• In Chapter 4, we present a tool called Time4sys2imi, that we developed to translate graphical models into parametric timed automata. The translation by Time4sys2imi allows to check the schedulability of real-time systems and to infer some timing constraints (deadlines, offsets,• • • ) guaranteeing schedulability.

• In Chapter 5, we conclude the part and we present some future research.

Introduction

In this chapter, we introduce the formalism used in the first part of this thesis.

Clocks, parameters, constraints

Let N, Q + and R + denote the sets of positive integers, positive rational numbers and positive real numbers respectively.

Clocks

We assume a set X = {x 1 , . . . , x |X| } of clocks, i. e., real-valued variables that progress at the same rate. A clock valuation is a function w : X → R ≥0 . We write ⃗ 0 for the clock valuation assigning 0 to all clocks. Given R ⊆ X, we define the reset of a valuation w, denoted by [w] R , as follows: [w] R (x) = 0 if x ∈ R, and [w] R (x) = w(x) otherwise. Given a valuation w, d ∈ R + and X ′ ⊆ X, we define the time-elapsing of w by d except for clocks in X ′ , denoted by w ↗+d \X ′ , as the clock valuation such that

w ↗+d \X ′ (x) =    w(x) if x ∈ X ′ w(x) + d otherwise

Parameters

We consider a set P = {p 1 , . . . , p |P| } of parameters, i. e., unknown constants. A parameter valuation v is a function v : P → Q+.

Constraints

We denote ▷◁ ∈ {<, ≤, =, ≥, >}. A guard g is a constraint over X ∪ P defined by a conjunction of inequalities of the form x ▷◁ d or x ▷◁ p, with x ∈ X, d ∈ N and p ∈ P. Given a guard g, we write w |= v(g) if the expression obtained by replacing in g each x ∈ X by w(x) and each p ∈ P by v(p) evaluates to true.

Timed automata

Timed automata is defined in [START_REF] Alur | A theory of timed automata[END_REF] as an extension of finite-state automata allowing the use of clocks, i. e., real-valued variables increasing linearly at the same rate. It is a strong formalism for real-time systems modeling and verification with timing constraints.

Syntax

Definition 2.1 (TA [START_REF] Alur | A theory of timed automata[END_REF]). A timed automaton (TA) A is a tuple A = (Σ, L, ℓ 0 , X, I, E), where:

• Σ is a finite set of actions,

• L is a finite set of locations,

• ℓ 0 ∈ L is the initial location,

• X is a finite set of clocks,

• I is the invariant, assigning to every ℓ ∈ L a guard I(ℓ),

• E is a finite set of edges e = (ℓ, g, a, R, ℓ ′ ) where ℓ, ℓ ′ ∈ L are the source and target locations, g is a guard, a ∈ Σ, and R ⊆ X is the set of clocks to be reset.

Parametric timed automata

Parametric Timed Automata (PTA) are an extension of Timed Automata to the parametric case. It allows the use of parameters within guards and invariants in place of integer constants [START_REF] Alur | Parametric real-time reasoning[END_REF].

Syntax

Definition 2.2 (PTA). A parametric timed automaton (PTA) A is a tuple A = (Σ, L, ℓ 0 , X, P, I, E), where:

• Σ is a finite set of actions,

• L is a finite set of locations,

• ℓ 0 ∈ L is the initial location,

• X is a finite set of clocks,

• P is a finite set of parameters,

• I is the invariant, assigning to every ℓ ∈ L a guard I(ℓ),

• E is a finite set of edges e = (ℓ, g, a, R, ℓ ′ ) where ℓ, ℓ ′ ∈ L are the source and target locations, g is a guard, a ∈ Σ, and R ⊆ X is the set of clocks to be reset.

Parametric stopwatch automata

For many real-time systems, especially when they are subject to preemptive scheduling, parametric timed automata are not sufficiently expressive. So the interest of PTA with stopwatches [START_REF] Cassez | The impressive power of stopwatches[END_REF], namely parametric stopwatch automata [SSL + 13].

Syntax

Definition 2.3 (PSA). A parametric stopwatch automaton (PSA) A is a tuple A = (Σ, L, ℓ 0 , X, P, I, S, E), where:

• Σ is a finite set of actions,

• L is a finite set of locations,

• ℓ 0 ∈ L is the initial location,

• X is a finite set of clocks,

• P is a finite set of parameters,

Scheduling problem for real-time systems

21

• I is the invariant, assigning to every ℓ ∈ L a guard I(ℓ),

• S is the stop function S : ℓ → 2 X , assigning to every ℓ ∈ L a set of stopped clocks,

• E is a finite set of edges e = (ℓ, g, a, R, ℓ ′ ) where ℓ, ℓ ′ ∈ L are the source and target locations, g is a guard, a ∈ Σ, and R ⊆ X is the set of clocks to be reset.

Stopwatch automata can be composed as usual using parallel composition on synchronized actions. Note that by default, i. e., a same clock (i. e., with the same name) can be read, stopped or reset in several automata. The same applies to parameters.

Given a parameter valuation v and PSA A, we denote by v(A) the non-parametric structure where, for each parameter p ∈ P, all occurrences of p have been replaced by v(p). Any structure v(A) is also a stopwatch automaton [START_REF] Cassez | The impressive power of stopwatches[END_REF]. If S(ℓ) = ∅ for all ℓ ∈ L, then by assuming a rescaling of the constants (multiplying all constants in v(A) by the least common multiple of their denominators), we obtain an equivalent (integer-valued) TA, as defined in [START_REF] Alur | A theory of timed automata[END_REF].

Let us now recall the concrete semantics of stopwatch automata. Definition 2.4. Given a PSA A = (Σ, L, ℓ 0 , X, P, I, S, E), and a parameter valuation v, the semantics of v(A) is given by the timed transition system (TTS) (S, s 0 , →), with

• S = {(ℓ, w) ∈ L × R |X| ≥0 | w |= v(I(ℓ))}, • s 0 = (ℓ 0 , ⃗ 0),
• → consists of the discrete and (continuous) delay transition relations:

1. discrete transitions: (ℓ, w) e → (ℓ ′ , w ′ ), if (ℓ, w), (ℓ ′ , w ′ ) ∈ S, and there exists e = (ℓ, g, a, R, ℓ ′ ) ∈ E, such that w ′ = [w] R , and w |= v(g).

delay transitions

: (ℓ, w) d → (ℓ, w ↗+d \S(ℓ) ), with d ∈ R ≥0 , if ∀d ′ ∈ [0, d], (ℓ, w ↗+d ′ \S(ℓ) ) ∈ S.

Scheduling problem for real-time systems

Due to the increasing complexity in real-time systems, designing and analyzing such systems is an important challenge, especially for safety-critical real-time systems, for which the correctness is crucial. The scheduling problem for real-time systems consists in deciding which task the processor runs at each moment by taking into consideration 22 2. Preliminary definitions the needs of urgency, importance and reactivity in the execution of the tasks. Systems can feature one processor ("uniprocessor") or several processors ("multiprocessor"). Each processor features a scheduling policy, according to which it schedules new task instances. Tasks are usually characterized by a best and worst case execution times (BCET and WCET), and are assigned a deadline and often a priority. Tasks can be activated periodically ("periodic task"), sporadically ("sporadic tasks"), or be activated upon completion of another task-to which we refer to "dependency" or "task chain". This latter feature is often harder to encode using traditional scheduling models. Periodic tasks may be subject to a "jitter", i. e., a variation in the period; all tasks can be subject to an "offset", i. e., a constant time from the system start to the first activation of the task. The schedulability problem consists in verifying that all tasks can finish their computation before their relative deadline, for a given scheduling policy. This problem is a very delicate task: The origin of complexity arises from a large number of parameters to consider (BCET and WCET, tasks priorities, deadlines, periodic and sporadic tasks, tasks chains, etc.). The schedulability problem becomes even more complicated when periods, deadlines or execution times become uncertain or completely unknown: we refer to this problem as schedulability under uncertainty.

Introduction

Assessing the absence of timing constraints violations is even more important when the system can be hardly controlled once launched. This is especially true in the aerospace area, where a system can only very hardly be modified or even rebooted after launching.

The next generation of space systems will have to achieve more and more complex missions. In order to master the development cost and duration of such systems, an alternative to a manual design is to automatically synthesize the main parameters of the system. While verifying a real-time system is already a notoriously difficult task, we tackle here the harder problem of synthesis, i. e., to automatically synthesize a part of the system so that it meets its specification. We notably focus on the synthesis of admissible timing values.

Contribution

The goal of this chapter is to propose an approach on the specific case of scheduling of the flight control of a space launcher.

1. We first describe the problematic of the scheduling of a launcher flight control.

2. Then, we formalize this problematic with parametric stopwatch automata (PSA) (Definition 2.3).

3. We present the results computed by the IMITATOR tool.

4. We compare our results with the ones obtained by other tools classically used in scheduling.

A key aspect is the verification and synthesis under some reactivity constraints: the time from a data generation to its output must always be less to a threshold. The solution we propose is compositional. The given solution handles two cases, the first for system with an instant switch from one thread to another, the second case is for more general systems where the switch between two threads has a CPU cost due to the copy of data between the contexts of each thread.

We propose here a solution to the problems using an extension of parametric timed automata (PTAs) (Definition 2.2), which are an extension of finite state automata with clocks and parameters [START_REF] Alur | Parametric real-time reasoning[END_REF]. The general class of PTAs is notoriously undecidable, and notably the main problem of deciding whether at least one parameter 3. Parametric schedulability analysis of the flight control of a space launcher valuation allows the system to reach a global state is undecidable, even over discrete time [START_REF] Alur | Parametric real-time reasoning[END_REF], with a single integer-valued parameter over dense time [START_REF] Beneš | Language emptiness of continuous-time parametric timed automata[END_REF], or with a single clock compared to parameters [START_REF] Miller | Decidability and complexity results for timed automata and semi-linear hybrid automata[END_REF] (see [START_REF] André | What's decidable about parametric timed automata[END_REF] for a survey). Still, some decidable subclasses were proposed (e. g., [HRSV02, BL09, AL17, ALR18]), notably in the field of scheduling real-time systems [START_REF] Cimatti | Symbolic computation of schedulability regions using parametric timed automata[END_REF][START_REF] Frehse | Formal analysis of timing effects on closed-loop properties of control software[END_REF][START_REF] André | A unified formalism for monoprocessor schedulability analysis under uncertainty[END_REF]. In spite of these undecidability results, the use of parametric timed automata for solving various concrete problems was recently considered, in frameworks such as hardware verification [START_REF] Chevallier | Timed verification of the generic architecture of a memory circuit using parametric timed automata[END_REF], analysis of music scores [START_REF] Fanchon | Formal timing analysis of mixed music scores[END_REF], monitoring [START_REF] André | Offline timed pattern matching under uncertainty[END_REF] or software product lines testing [LGS + 19]. We show here that this formalism is also handful for solving concrete scheduling problems-such as the one considered here.

This work was carried out in the setting of a collaboration with ArianeGroup (David Lesens and Emmanuel Coquard), and was subsquently published in the proceedings of ACSD 2019 [ACF + 19], and an extended version was then published in Fundamenta Informaticae [ACF + 21].

Outline

Section 3.2 presents the problem we aim at solving. Section 3.3 exposes our modeling, and we extend our solution in Section 3.4 in a compositional manner, and in Section 3.5 to enhance the model with context switch times. Section 3.6 gives the results obtained, while Section 3.7 makes a comparison with additional tools of the literature (solving only a part of the problem). Section 3.8 concludes the chapter.

Description of the system and problem

The flight control of a space launcher is classically composed of three algorithms:

1. The navigation computes the current position of the launcher from the sensor's measurement (such as inertial sensors);

2. The guidance computes the most optimized trajectory from the launch pad to the payload release location;

3. The control orientates the thruster to follow the computed trajectory.

Due to the natural instability of a space launcher, strict real-time requirements have to be respected by the implementation of the flight control: frequency of each algorithm and reactivity between the sensor's measurement acquisition and the thruster's command's sending. The case study described in this chapter is a simplified version of a flight control composed of a navigation, a guidance, a control and a monitoring algorithms; these four parts are called processings1 in the following. Each processing has a name and a required rational-valued period; in our setting, the processing deadline is equal to the period. A processing can potentially read data from the avionics bus ("in" data) and/or write data to the same avionics bus ("out" data). Fig. 3.1 shows an example of such a system (all the numerical data provided in this chapter are only examples that do not necessarily correspond to an actual system).

Threads and deterministic communications

The software components of the system are physically deployed on a single processor [START_REF] Ober | Modeling and validation of a software architecture for the Ariane-5 launcher[END_REF]. Processings are allocated on threads run by the processor. 3.2 exemplifies the way data are exchanged between two threads. The fast thread (in yellow) has a period of 1 time unit. This period defines the time granularity of the system (this implies that the offset of the fast thread is 0 and that its deadline is 1). In this example, the slow thread (in blue) has an offset of 1 (its start is delayed by 1 cycle compared to the start of the fast thread), a period of 10 and a deadline of 8. The numbers from 1 to 10 denote the index of the period of the fast thread within the period of the slow thread. The first communication between the fast thread and the 3. Parametric schedulability analysis of the flight control of a space launcher slow one is performed at the end of the first period; this explains that, although the second occurrence of the fast thread finishes before the first occurrence of the slow thread, this is the first occurrence of the fast thread which is communicated to the slow thread. Similarly, in order to ensure the determinism and taking into the priority between the threads, the communication between the slow thread and the fast thread is performed at the deadline of the slow thread, i. e., at the end of cycle 9 (offset + deadline). That is, the first occurrence of the fast thread to receive data from the slow thread is not the one starting at t = 8 nor at t = 9, but the one starting at t = 10.

In our setting, all the thread periods are harmonic, i. e., a thread period is a multiple of the period of the thread just faster (they pairwise divide each other). In other terms, for a system that contains a set of threads t 1 , . . . , t k , all the thread periods are considered harmonic if for every thread t j (for all j ∈ {1, . . . , k}), the period PT j of t j is a multiple of the periods of all the threads of smaller period, that is, PT j is a multiple of the periods of all threads t i ∈ {t 1 , . . . , t k | PT i < PT j }. In our case, the harmonic assumption on threads will not affect the modeling of the system in Section 3.3; however, it may be used to reduce the number of clocks and considerably decrease the computation time of our approach.

In addition, in order to ensure the determinism of the scheduling (which facilitates the verification of the system), the threads work in a synchronous manner:

• The inputs of a thread are read at its start; that is, no inputs are read during the execution of the thread.

• The outputs of a thread are provided at its deadline; that is, not only no outputs are provided during the execution of the thread, but the output is also not provided as soon as the thread terminates-if it terminates before its deadline-but only at its deadline.

Switch time

In our case study, the switch time, i. e., the time needed by the CPU to copy memory information when changing threads, is 500 µs.

Reactivities

To ensure the controllability of the launcher, a reactivity 2 is required between a data read from the avionics bus (a measurement) and a data written to the avionics bus (a command). A reactivity imposes a maximum bound on the time required by these data to "travel" from the measurement to the command. This concept is quite similar to that studied in [FBG + 10] (without timing parameters). Definition 3.1 (reactivity). A reactivity constraint imposes an upper bound from a data read from the avionics bus to a data written to the avionics bus, where the sequence of the path of the data represents a precedence constraint.

Several paths are potentially possible between a read data and a written data. Reactivities too must follow the deterministic communication model from Section 3.2.1. Consider the execution of threads and processings in Fig. 3.4 (the values of periods and WCETs are given for illustration purpose, and do not correspond to the ones from our case study). Consider the reactivity imposing that the sequence of data "Meas → Navigation → Guidance → Control → Cmd" should be equal to or less than 5. Due to the data being communicated at the end of each thread only, the Guidance processing (marked with green "G" in Fig. 3.4) does not receive the data from the third execution of the Navigation processing (marked with "N" in red), as the data of the third Navigation will be sent at the end of the thread T1 period, but from the second execution of Navigation. Therefore, in Fig. 3.4, the only path of interest is the path of the data starting from the second execution of Meas, going to the second execution of Navigation, then going to the (only) execution of Guidance, and then finishing in the third execution of Control, before being written to the third occurrence of Cmd. Also note that the data output by the first execution of Navigation are successfully sent to T2 at the end of the first period of T1, but will be overwritten by the second occurrence of Navigation, and are therefore not of interest when checking the satisfaction of reactivities. Therefore, the time from the production of these data (at t = 1) to their writing on the avionic bus (at t = 6) is 5, and therefore the reactivity is satisfied.

We want to solve the scheduling problem of periodic processings under reactivity constraints.

Parametric schedulability analysis of the flight control of a space launcher

Processings and assignment into threads

A WCET (worst case execution time) is measured or computed for each processing. An example is given in Fig. 3.5. An important problem is to find a proper assignment of the processings into threads, with their respective periods, while minimizing the number of threads. A solution to this problem consists of a set of cyclic threads on which the processings are deployed. In our setting, these threads are scheduled with a preemptive and fixed priority policy (FPS). A thread has a name and is defined by the following data:

1. a rational-valued period; 2. a rational-valued offset (with 0 ≤ offset < period), i. e., the time from the system start until the first periodic activation;

3. a rational-valued (relative) deadline (with 0 < deadline ≤ period), i. e., the time after each thread activation within which all processings of the current thread should be completed;

4. a rational-valued major frame (or "MAF"). A MAF defines the duration of a pattern of processing activation. The MAF in this case study is equal to 10.

5. a set of processings deployed on the thread. Different processings may be executed in an order which may change at each cycle. However, after a MAF duration, the same pattern of processings is repeated.

In order to simplify the scheduling problem, we have considered in this chapter a pre-allocation of processings on threads, as specified in Fig. 3.7: that is, Navigation and Control are allocated on T1, while Monitoring and Guidance are allocated on T2 and T3, respectively. In addition, Navigation is executed at every period of T1, while Control is executed (after Navigation) on odd cycles only; this is denoted by the when 1 syntax in Fig. 3.7.

A formal framework for real-time systems

A real-time system S = {P, T , R} is viewed here as a set of processings

P = {p 1 , p 2 , • • • , p m }, a set of threads T = {t 1 , t 2 , • • • , t n } and a set of reactivities R = {r 1 , r 2 , • • • , r q }. A thread t i computes a usually infinite stream of processings instances.
In our setting, a thread t i is periodic, i. e., generates instances every fixed amount of time (the "period"), and is characterized by a 5-tuple (PT i , OT i , DT i , MAF i , P i ), where PT i corresponds to the period, OT i to the offset, DT i to the deadline, MAF i defines the duration of a pattern of processing activation p i k (where p i k denotes the kth proccessing computed in thread t i ), and P i defines a subset of processings of P allocated to t i . 3A processing p i is characterized by two values WCET i (Worst Case Execution Time) and PP i (Processing Period): When a processing is activated, it is executed for at most time WCET i time units every PP i time units. A reactivity is of the form

0 t WCET i WCET i WCET i WCET j WCET j OT i DT i DT i DT i PP i PP i PP i PP j PT i PT i PT i MAF i
r i = ((p i 1 → p i 2 → • • • → p i k ), DR i ) where p i 1 , p i 2 , . . . , p i k are k processings of P, (p i 1 → p i 2 → • • • → p i k )
denotes a precedence constraint, and DR i is the maximum time of reactivity for r i : the end of the thread period containing the last processing p i k of the precedence sequence has to be completed before the deadline DR i . (If a reactivity is satisfied, its precedence constraint is obviously satisfied too.) Definition 3.2. A system S is schedulable if 1. ∀ t i ∈ T , the end of each instance of t i occurs before its relative deadline DT i .

2. ∀ r i ∈ R, the end of each instance of the thread containing the last processing p i k of r i occurs before DR i .

Formalization of the case study

We formalize in the following the system, with the values given in Figs. 3.1 and 3.5 and the assignments onto threads given in Fig. 3.7.

Processings

Let P denote the set of processings. This set can be defined as P = {p Navi , p Cont , p Moni , p Guid }, where:

Control: p Cont = (WCET Cont , PP Cont ) = (3, 10).
Guidance: p Guid = (WCET Guid , PP Guid ) = (15,60). 20).

Monitoring: p Moni = (WCET Moni , PP Moni ) = (5,
Navigation: p Navi = (WCET Navi , PP Navi ) = (1, 5).

Threads

Let T = {t 1 , t 2 , t 3 } denote the set of threads, with:

• t 1 = (PT 1 , OT 1 , DT 1 , MAF 1 , P 1 ) = (5, OT 1 , DT 1 , 10, {p Navi , p Cont }). • t 2 = (PT 2 , OT 2 , DT 2 , MAF 2 , P 2 ) = (20, OT 2 , DT 2 , 20, {p Moni }).
• t 3 = (PT 3 , OT 3 , DT 3 , MAF 3 , P 3 ) = (60, OT 3 , DT 3 , 60, {p Guid }).

Reactivities

Let R = {r 1 , r 2 , r 3 } denote the set of reactivities, with:

• r 1 = (p Navi → p Guid → p Cont ), DR 1 with DR 1 = 150.

• r 2 = (p Navi → p Cont ), DR 2 with DR 2 = 15.

• r 3 = (p Navi → p Moni ), DR 3 with DR 3 = 55.

Objectives

Let us summarize the problems we address in this chapter.

Our problems take as input a real-time system, i.e.:

1. a list of processings with their WCET (for example Fig. 3.5) and period, and their input or output data (for example Fig. 3.1);

2. a set of reactivities (for example Fig. 3.3);

3. an allocation of processings on threads, with period, offset, deadline and MAF for each thread (for example Fig. 3.7).

Remark 1. Observe in Fig. 3.7 that the harmonic assumption on threads is respected, with threads ordered by increasing frequency as follows: T3, T2, T1. The first problem is to formally verify the schedulability of the real-time system:

Parametric

Scheduling verification problem:

Input: a real-time system Problem: formally verify that S is schedulable.

Recall that schedulability also ensures that all reactivity constraints are met (from Definition 3.2).

The second problem assumes that some constants of the real-time system (deadlines, periods, offsets, WCET. . . ) become unknown. The real-time system can then be seen as a partially specified or abstract system.

In this work, we assume that the offsets and deadlines of each thread are unknown; that is, some of the values in Fig. 3.7 are not known anymore. The scheduling synthesis problem for our flight control system consists thus in computing the offsets and deadlines of each thread in order to fulfill the required reactivities.

Scheduling synthesis problem:

Input: a real-time system, a set of unknown constants Problem: exhibit valuations for the unknown constants such as S is schedulable.

Recall that our synthesis problem still considers as input the periods; therefore offsets and deadlines are the main results of interest.

Specifying the system

Since the seminal work of Liu and Layland in [START_REF] Liu | Scheduling algorithms for multiprogramming in a hard-real-time environment[END_REF], an abundant number of methods and tools have been designed to check the schedulability of real-time systems. However, while some aspects are reasonably easy (FPS, no mixed-criticality), the problem we address here is not typical for several reasons:

1. offsets may be non-null; 2. the executed processings may differ depending on the cycle; 3. the reactivities must always be met, and therefore define new, non-classical timing constraints; and, perhaps most importantly, 4. the admissible values for deadlines and offsets may not be known. Only the global end-to-end reactivity is specified.

As a consequence, we choose to follow a model checking based method. Model checking is known for being more expressive than analytical methods, at the cost of performance or even decidability. We show here that, although we use an undecidable formalism, we do get exact results for the instance of the problem we consider. We indeed rely on a procedure ("reachability synthesis", formalized in e. g., [START_REF] Jovanović | Integer parameter synthesis for real-time systems[END_REF]) which is not guaranteed to terminate-but is correct whenever it does.

We present in the remainder of this section our modeling of the verification and the synthesis problem using parametric stopwatch automata (PSA). This formalism has several advantages:

• It is helpful to model concurrent aspects of the system (different threads and processings running concurrently).

• Stopwatches can be used to model preemption.

• Parameters can be used to model the unknown constants, and solve the synthesis problem.

For now, we consider that there are no context switches in the system. We will discuss in Section 3.5 how to introduce them.

Architecture of the solution

A modular solution

To model the system, we use the concurrent structure of parametric stopwatch automata so as to build a modular solution: that is, each element (thread, processing, scheduling policy) and each constraint (reactivity) is defined by a dedicated PSA. These automata are then composed by usual parallel composition on synchronization actions.

Parametric schedulability analysis of the flight control of a space launcher

This makes our solution modular in the sense that, in the case of a modification in the system (e. g., the scheduling policy), we can safely replace one PSA with another (e. g., the FPS scheduler automaton with another scheduler PSA) without impacting the rest of the system.

Encoding elements and constraints as automata

We will model each processing activation as a PSA. These automata ensure that processings are activated periodically with their respective period and initial offset.

In addition, we will create one PSA for each thread: the purpose of these automata is to ensure that the processings associated with each thread are executed at the right time. In the case of our concrete problem, we assign both the Navigation and Control processings to thread T1, the monitoring process to T2 and the guidance processing to T3.

The reactivities also follow the concept of modularity. That is, each reactivity is tested using a single PSA. By testing (as in [START_REF] Aceto | The power of reachability testing for timed automata[END_REF]), we mean that a reactivity fails iff a special location is reached. Therefore, ensuring the validity of the reactivities is equivalent to the unreachability of these special locations.

Finally, we will specify a scheduler automaton that encodes the scheduling policy between the different threads (in our problem, recall that the scheduling policy is fixed priority scheduling (FPS)).

We give more details on each of these automata in the following.

Modeling periodic processing activations

Each processing is defined by a WCET and a period (also equal to a deadline). To model the periodicity of the processings, we create one PSA for each processing activation. This PSA simply performs the activations in a periodic manner. Activations are modeled by a synchronization action that is used to communicate with other automata (typically the thread automaton). For example, the activation of the Control processing is denoted by actControl; this action will be used to synchronize between the Control activation automaton with other automata (e. g., the threads or the scheduler).

In addition, the period processing activation automaton detects whether a processing missed its (implicit) deadline (equal to its period); that is, we assume that a processing that has not finished by its next period is a situation corresponding to a deadline miss. We present in Fig. 3.8 a simplified version of the periodicControl automaton, modeling the periodic activation of the Control processing. 4 This automaton uses one clock xControl and one parameter periodControl. The clock xControl is used to measure the time between any two consecutive processing activations; it is never stopped. Note that the period periodControl is known beforehand, and is therefore not strictly speaking a parameter, but that makes our solution both more generic and more readable (in IMITATOR, a parameter can be statically instantiated to a constant before running the analysis).

The initial location is init: from then, the first occurrence of Control is immediately activated (action actControl), and the automaton enters the periodic location. Then, exactly every periodControl time units (guard xControl = periodControl), another instance of Control is activated.

Modeling threads

We create one PSA for each thread. Each of these automata contains one clock for the thread (used to measure the thread period and offset), as well as one clock per processings assigned to the thread. These processings clocks are used to measure the amount of time spent on executing these processings; these clocks can be stopped (they are therefore stopwatches, strictly speaking) when the processor was preempted for a higher priority task. For example in Fig. 3.9, the thread automaton threadT1 contains xT1 (the thread clock), as well as xExecControl and xExecNavigation (the clocks associated to the processings of T1). Parameters include the offset, period, and deadline of the thread, but also the WCETs of the processings assigned to this thread.

The thread automaton is responsible for:

1. encoding the initial thread offset, i. e., starting the periodic thread activation only after the offset;

2. performing the periodic thread activation; The clocks associated with the processings are used to measure the execution time of these processings: they are in fact stopped most of the time, except when the thread is actively executing the processing. This is in contrast with the clocks associated with the processing activation automaton, which are never stopped, as they measure a period. Then, a deadline miss occurs if the clock measuring the thread period reaches the deadline (recall that the deadline is less than or equal to the period, and therefore we can use the same clock), while the clock measuring a processing execution time is strictly less than its WCET.

We give in Fig. 3.9 a fragment of the automaton threadT1. We only give the odd cycle, as this is the most interesting; that is, we removed the fragment corresponding to the even cycle (only executing Navigation) between locations init and exec_nav_odd (and the transition from idle should go to the removed exec_nav_even location). The automaton uses several synchronization variables, notably the end of the processings (e. g., finishControl), but also the start and end of the concerned thread (e. g., actT1 and endT1, not depicted in the simplified version in Fig. 3.9). We also abbreviate some variable names to save space (e. g., xExecC for xExecControl and xExecN for xExecNavigation or WCETN for WCETNavigation).

First, the automaton waits for the offset: that is, it stays in init exactly offsetT1 time units. Then, it executes the first processing of the odd cycle, i. e., Navigation: it stays in exec_nav_odd until completion, i. e., for WCETNavigation time units. 5 Note that this is the only location where xExecNavigation is elapsing, i. e., is not stopped, as it measures the execution time. Then, upon completion of the Navigation processing, the automaton moves to exec_control_odd, where Control is executed. Upon completion, it moves to idle, and waits until the clock xT1 reaches its period. Then, the cycle restarts and so on.

In addition, at any time, possible deadline misses are checked for. A deadline miss occurs on an odd cycle while execution Navigation whenever xT1 = deadlineT1 and either xExecControl < WCETControl or xExecNavigation < WCETNavigation. 6When executing Control, only the execution time of Control needs to be checked.

Remark 2. Our model is in fact more complicated as, for sake of modularity, we make no assumption in the thread automaton on how the other automata behave, notably the processings activation automata. Therefore, we allow for processings to be activated at any time, which must be taken care of in the thread automaton.

Modeling the FPS scheduler

The FPS scheduler is modeled using an additional PSA. It reuses existing works from the literature (e. g., [FKPY07, SSL + 13]), and does not represent a significant original contribution. We mainly reuse the scheduler encoding of [SSL + 13], which consists of an automaton synchronizing with the rest of the system on the start and end task synchronization actions as well as the task activation actions. Whenever a new task is activated, the scheduler decides what to do depending on its current state and the respective priorities of the new and the executing tasks (if any).

Nevertheless, we had to modify this encoding due to the fact that existing scheduler automata simply schedule tasks: in our setting, the scheduler schedules both the threads and the threads' processings. Among the various modifications, in case of preemption, our scheduler does not stop the clocks measuring the execution times of the preempted threads (because such clocks do not exist), but stop the clocks measuring the execution times of the processings deployed on the preempted threads.

We give in Fig. 3.10 an example of such a scheduler in a simplified version, with only two threads T1 and T2; the full scheduler is of course more complete. If any of the two threads get activated (actT1 or actT2), the scheduler starts executing them. If a second thread gets activated, the highest priority thread (T1) is executed, while T2 is put on the waiting list (which is encoded in location execT1waitT2). This is the location responsible for stopping the clock of the (only) processing of T2, i. e., Monitoring (clock xexecM ). Only after T1 has completed (endT1), T2 can execute. Our real scheduler is in fact significantly more complex as it has to cope with three threads, but also with special cases such as the activation of a new thread activation of t i while executing a previous instance of t i , etc.

Reachability synthesis

Finally, the system is schedulable if none of the "bad" locations (corresponding to deadline misses, e. g., in the thread automata) is reachable. If all parameters are valuated, the system is a TA, and schedulability reduces to reachability checking. If some parameters are free (i. e., the analysis is parametric), the set of valuations for which the system is schedulable exactly corresponds to the valuations for which these bad locations are unreachable, i. e., the complement of the valuations set result of reachability synthesis. This guarantees our method correctness.

Compositional verification of reactivities

An originality of our work-which among other reasons, notably the timing parameters, justifies our choice to use model checking-is the encoding of reactivities. Indeed, our goal is to verify a system, or synthesize valuations, for which all reactivities are met.

How to properly encode reactivities turned out rather subtle. Let us first exemplify the complexity of the definition of reactivities.

Example 3.2. Consider the third reactivity in Fig. 3.3 (abbreviated by NM in the following) that requires that any data transmission Meas → Navigation → Monitoring → Safeguard must always be less than 55 ms. Recall that data are transmitted upon the end of a thread period.

We can see this reactivity as the start of a timer at the beginning of the last thread period of an execution of Navigation that completed before the end of an execution of task T1, where T1 is such that it is the last execution of T1 the period of which ends before the start of an execution of Monitoring; then, the timer stops following the end of the period of an execution of T1 immediately following the end of the period of T3 corresponding to the end of the aforementioned execution of Monitoring. At the end, the timer must be less than 55 ms.

In other words, this reactivity requires that any following sequence of actions should take less than 55 ms: actT1, startNavigation followed by endNavigation (without any occurrence of startNavigation in between) followed by endT1, followed by actT3 (without any occurrence of endT1 in between), startMonitoring followed by endMonitoring (without any occurrence of startMonitoring in between), followed by endT3.

Encoding reactivities is arguably the most technical part of our solution, and we tried multiple methods (either incorrect or that represented a too large overhead) before converging to this solution. Nevertheless, the solution we chose still represents a large overhead, as we will see in Section 3.6.

In our solution, each reactivity is encoded as a sort of observer automaton [START_REF] Aceto | The power of reachability testing for timed automata[END_REF][START_REF] André | Observer patterns for real-time systems[END_REF]; an observer automaton observes the system behavior without interfering with it. That is, it can read clocks, and synchronize on synchronization actions, but without impacting the rest of the systems; in particular, it must be non-blocking (except potentially once the property verified by the observer is violated). In addition, an observer often reduces to reachability analysis (see,e. g., [START_REF] Doyen | Verification of hybrid systems[END_REF][START_REF] Dang | Reachability analysis and hybrid systems biology -in memoriam oded maler[END_REF]): the property encoded by the observer is violated iff a special location of the observer is reachable.

Each reactivity automaton uses a single (local) clock used to check the reactivity constraint, and synchronizes with the rest of the system on (some) synchronization labels encoding the start and end of processings and tasks.

In fact, we deviate from the principle of observer automaton by allowing it to block in some cases. Indeed, a key point in the definition of reactivities in our problem is the communication between threads as exemplified in Example 3.2. In order to allow a generic solution for reactivities, and due to the fact that some timing parameters are unknown, we cannot make assumptions on the respective ordering of processings w.r.t. each other. Therefore, when a given processing is faster than another one (e. g., Navigation is faster than Guidance), it is not possible to know a priori which instance of the fast processing (e. g., Navigation) will effectively transmit its data to the following slower processing (e. g., Monitoring). As a consequence, our observer will nondeterministically "guess" from which instance of the slower processing to start its timer: this is achieved by a nondeterministic choice in the initial location of the automaton. If the guess is wrong, the observer "blocks" the system (impossibility to fire a transition or let time elapse). Note that, while blocking is usually not an admissible feature of observer automata, this is harmless in this case as, due to the nondeterministic guess and the fact that model checking explores all choices, all possible behaviors of the system are still explored by our solution.

Example 3.3. Consider again reactivity NM from Example 3.2. Consider a given instance of Navigation. If a second full instance of Navigation (including the end of thread T1) is observed before the start of T2, our observer made a wrong guess, and the observer clock is not measuring a proper reactivity, as the instance of Navigation on which the clock should be started must be the last completed instance before the start of T2. In that case, the observer simply blocks.

Observer construction

Our solution consists in translating the sequence of starting and ending actions of threads and processings following the definition of the reactivities, while forbidding some actions in some locations to ensure the proper encoding of the definition of thread communication and reactivities. In addition, a clock measuring the reactivity is started upon the (nondeterministic) activation of the first thread, and is checked against the reactivity nominal maximum time upon completion of the last thread. If this maximum time constraint is violated, the observer enters a special "bad" location. This observer violation location is added to the list of "bad" locations in Section 3.3.5 when performing reachability synthesis.

Example 3.4. We give the observer automaton corresponding to reactivity NM in Fig. 3.11. We abbreviate in Fig. 3.11 the names of processings (N and M stand for Navigation and Monitoring respectively). The only clock is xNM while reacNM denotes the maximum nominal reactivity for NM (55 ms here). Σ N M stands for this automaton alphabet; given a ∈ Σ N M , a denotes Σ N M \ {a} (we extend this notation to sets of actions). In addition, whenever xNM > reacNM occurs in any location (except the initial location), a transition leads to the special "bad" location (these transitions are not depicted in Fig. 3.11 for sake of clarity).

The nondeterministic choice is encoded in the initial location where, upon action actT1, the automaton can either self-loop in init, or go to actT1 to try to measure the reactivity from this instance of T1. The blocking is encoded by the absence of transition labeled with endT1 in location wait_T3 (an alternative is to synchronize on endT1 to a sink location that also blocks time elapsing).

Both remaining reactivities in Fig. 3.3 follow easily from this scheme: the first reactivity (Navigation → Guidance → Control) follows the same principle for Navigation and Guidance, and is immediately followed by a third check for Control, while the second reactivity (Navigation → Control) is simpler as both Navigation and Control are on the same thread.

Compositional verification and synthesis

Due to the nondeterministic choice, the verification of the reactivities entails a clear overhead to the verification (see Section 3.6). Verifying all three reactivities can be naturally done by adding the three observer automata to the same system, and performing synthesis on the composition of all these automata. However, we claim that this can be done in a compositional fashion. Indeed, checking reactivities is checking that a constraint is met for all executions; this can be seen as a global invariant of the property "all reactivities are satisfied", and we will verify it using observers. Observers simply observe the system and do not interact with it as long as the property they are verifying is not violated ; therefore, independent properties can be observed by different observers using different executions. Therefore, checking that these three invariants are valid can be done separately. In the nonparametric case, we will perform three different verifications of the system, with only one reactivity automaton at a time. Then, if the "bad" locations are unreachable for the three different verifications, then the system is schedulable and the reactivities are met. In the case of synthesis, we will intersect the result of the synthesis applied to the three parametric models. This compositional analysis comes in contrast with many works on scheduling, where compositionality is hard to achieve (see, e. g., [SL03, Ric05, LB05, SEL08, CPV13]). Note that our compositional verification is not necessarily specific to a parametric approach, and using our approach in a non-parametric setting (e. g., using Uppaal, PHAVer [START_REF] Frehse | Phaver: algorithmic verification of hybrid systems past hytech[END_REF]) could also benefit from a similar compositionality.

Parametric schedulability analysis of the flight control of a space launcher

processing wcet N a v i g a t i o n ( 1ms) ; processing wcet Guidance ( 1 0 . 5ms) ; processing wcet C o n t r o l ( 3ms) ; processing wcet M o n i t o r i n g ( 3ms) ; Figure 3.12: Example of Worst Case Execution Times for a system with switch time 3.5 Enhancing the analysis with context switches

Problem

When switching between two threads, the CPU needs to store the state of a thread, so that it can be restored later, and consequently the execution can be resumed from the same point later. Threads usually do not switch instantaneously: a certain amount of time is required for copying data. For each change in thread execution, the system must copy data before running the next thread. The time to save this state and restore another is known as thread context-switch time. This context-switch time between threads is small, but can be important to consider for schedulability.

Example 3.5. For the threads assignment given in Fig. 3.7 together with the processings values in Figs. 3.1 and 3.5, we can show using the Cheddar analyzer (see Section 3.7.1.1) that the schedule is tight, i. e., the occupancy of the processor is 100 %. For this reason, any non-zero context-switch time implies that the system becomes non-schedulable.

Because of the tight schedule mentioned in Example 3.5, in order to study the system using non-zero context-switch times, we consider the second set of (fictitious) values, given in Fig. 3.12. This set reduces the WCETs of the processings, and therefore allows for some non-zero context-switch time.

Following the new data from Fig. 3.12, let us redefine the set of processings as P ′ = {p Navi , p Cont , p Moni , p Guid }, where:

Control: p Navi = (WCET Navi , PP Navi ) = (1, 5).

Guidance: p

Cont = (WCET Cont , PP Cont ) = (3, 10).

Monitoring: p

Moni = (WCET Moni , PP Moni ) = (3, 20).
Navigation: p Guid = (WCET Guid , PP Guid ) = (10.5, 60). From now on, we consider that the switch from a thread to another one requires a (constant) switch time equal to 500 µs7 . Also note that, during the change of processing within the same thread (e. g., from Navigation to Control in the odd period of Thread T1 in Fig. 3.7), the switch remains 0, as these processings are part of the same thread.

Enhancing the analysis with context switches

Modeling the context switch

The switch time between threads is modeled as part of the scheduler automaton. For each change of execution from one thread to another, we go through an intermediate location: upon activation of a thread implying a thread switch (recall that some thread activations may not imply an immediate thread change, if the newly activated thread has lesser priority than the currently activated thread, e. g., activating Thread T2 in location execT1 in Fig. 3.10), then a clock xSwitch is set to 0, and counts until it reaches the context switch time. In our case, this timing is parameter pSwitch (this parameter is in practice assigned to its nominal value 500 µs and is therefore not truly parametric).

Example 3.6. We give in Fig. 3.13a a fragment of the original FPS scheduler from Fig. 3.10, corresponding to the execution of thread T2, followed by the activation of thread T1, which has higher priority and therefore requires a context-switch time.

In the original version in Fig. 3.13a, the processor immediately starts executing T1 in location execT1waitT2. In contrast, in the transformed version in Fig. 3.13b, the processor first transits through an intermediate location switching, that it can only leave pSwitch time units later; only from there, T1 starts being executed. Also note that, in the intermediate location switching, all clocks measuring the execution times of the processings associated to any of the threads of the processor 3. Parametric schedulability analysis of the flight control of a space launcher (here Navigation and Control for T1 and Monitoring for T2) are stopped, as the processor is not executing any thread, but is performing the context switch.

We give in Fig. 3.14 the Gantt chart of the case study of interest with switch time equal to 500 µs. (This Gantt chart was generated by Cheddar [Sin].) --------------------

Experiments

Experimental environment

We modeled our network of PSA in the IMITATOR input language [START_REF] André | IMITATOR 3: Synthesis of timing parameters beyond decidability[END_REF]. IMITATOR is a parametric model checker taking as input networks of PSA extended with useful features such as synchronization actions and discrete variables. Synthesis can be performed using various properties. We use here reachability synthesis (formalized in, e. g., [START_REF] Jovanović | Integer parameter synthesis for real-time systems[END_REF]). When IMITATOR terminates (which is not guaranteed in theory), the result is always sound (but not necessarily complete), but the tool is often able to infer whether the result is exact (sound and complete). All analyses mentioned in this manuscript terminate with an exact result. The translation effort was manual due to the specificity of our solution (with the exception of the scheduler, for which we started from an automated generator). However, we tried to keep our translation as systematic as possible to allow for a future automated generation from the problem input data. We made intensive use of clock resets and stopwatches for clocks not necessary at some points, in order to let IMITATOR apply inactive clock reductions.

All experiments were conducted using IMITATOR 2.10.4 "Butter Jellyfish" on an ASUS X411UN Intel Core™ i7-8550U 1.80 GHz with 8 GiB memory running Linux Mint 19 64 bits.8

In Sections 3.6.2 and 3.6.3, we first study the system without the extra context switch time introduced in Section 3.5; then, we study in Section 3.6.4 the overhead incurred by the context switch time.

Verification and synthesis without reactivities

In order to evaluate the overhead of the satisfaction of the reactivities, we first run analyses without reactivities.

Non-parametric model

First, a non-parametric analysis shows that the bad locations are unreachable, and therefore the system is schedulable under the nominal values given in Figs. 3.1 and 3.5.

The computation time of this non-parametric analysis, together with other parametric analyses (all without reactivities) are given in Table 3.1.

We give in Fig. 3.16 the Gantt chart (obtained with Cheddar [Sin]) of this entirely instantiated model.

Valuation offsetT1 offsetT2 offsetT3 |= K v 1 0 2 1 √ v 2 4 0 11 √ v 3 2 11 0 √ v 4 0 9 0 √ v 5 2 12 1 × v 6 5 9 0 ×

Parameterized offsets

We then parameterize offsets, i. e., we seek admissible offsets for which the system is schedulable. The constraint synthesized by IMITATOR is given in Fig. 3.17. We can see that, while several conditions for schedulability are given, at least one offset must be 0 to ensure schedulability.

5 ≥ offsetT2 ∧ offsetT3 + 5 > offsetT2 ∧ offsetT3 ≥ 0 ∧ offsetT2 ≥ 0 ∧ 1 ≥ offsetT3 ∧ offsetT1 = 0 OR offsetT1 ≥ 0 ∧ 11 ≥ offsetT3 ∧ offsetT3 > 1 + offsetT1 ∧ 4 ≥ offsetT1 ∧ offsetT2 = 0 OR offsetT3 > 1 ∧ 11 ≥ offsetT3 ∧ offsetT2 > 0 ∧ 1 ≥ offsetT2 ∧ offsetT1 = 0 OR offsetT1 > 0 ∧ offsetT2 ≥ 0 ∧ 11 ≥ offsetT2 ∧ 4 ≥ offsetT1 ∧ offsetT3 = 0 OR 11 ≥ offsetT2 ∧ offsetT3 ≥ 0 ∧ offsetT2 > 9 ∧ 1 ≥ offsetT3 ∧ offsetT1 = 0 OR offsetT1 + 1 ≥ offsetT3 ∧ offsetT1 > 0 ∧ offsetT3 > 0 ∧ 4 ≥ offsetT1 ∧ offsetT2 = 0 OR offsetT2 > 5 ∧ 9 ≥ offsetT2 ∧ offsetT3 > 0 ∧ 1 ≥ offsetT3 ∧ offsetT1 = 0 OR offsetT2 ≥ 5 ∧ 9 ≥ offsetT2 ∧ offsetT1 = 0 ∧ offsetT3 = 0
In order to exemplify admissible values, we exhibit some valuations satisfying this constraint in Table 3.2; we also give some valuations not satisfying this constraint. These valuations were derived manually from the constraint, but an automatization thanks to an SMT solver would be possible.

Parametric schedulability analysis of the flight control of a space launcher

Parameterized deadlines

We then parameterize deadlines, i. e., we seek admissible deadlines for which the system is schedulable. The constraint is: deadlineT2

∈ [11, 20] ∧ deadlineT1 ∈ [4, 5] ∧ deadlineT3 = 60.
That is, the deadline of T3 is strict, while T1 and T2 can be relaxed while preserving schedulability.

Again, we exhibit some valuations satisfying this constraint in Table 3.3.

Compositional verification of reactivities

We then solve the scheduling verification and scheduling synthesis problems with reactivities, using two methods:

1. monolithic verification: all three reactivity automata are included in the model; and

2. compositional verification: we verify sequentially three different models, each of them including all automata modeling the system, but only one reactivity at a time.

We give the various computation times, including the overhead incurred by each reactivity, in Table 3.4. Table 3.4 shows the interest of the compositional verification over monolithic verification, as the computation time is divided by a factor 2, except in the case of parametric offsets, where the compositional verification is just a little more efficient. Also, without surprise, the most complicated reactivity (NGC) takes the longest computation time.

Switch time

We now give the computation times in the case of switch time of 500 µs in Tables 3.5 and 3.6. In Table 3.6, "TO" denotes non-termination after 12 hours.

The constraints for offsets and deadlines synthesized by IMITATOR are given respectively in Fig. 3.18 and in Fig. 3.19.

We give in Tables 3.7 and 3.8 some examples of the values of parameters for which the system with switch time is schedulable ("|= K") or not.

Let us briefly compare the computation times of the system without switch time on the one hand, and of the system with the switch time of 500 µs on the other hand. The execution time of IMITATOR for the system with the switch time is nearly three times higher than the system without switch time, in the non-parametric case and the Table 3.7: Some valuations for which the system is schedulable (without reactivities)

Valuation offsetT1 offsetT2 offsetT3 |= K v 1 0 11.5 1.5 √ v 2 3 0 10 √ v 3 0 5 1 √ v 4 12 0 3 × v 5 3 15 0 × 52
3. Parametric schedulability analysis of the flight control of a space launcher case of parametric deadlines. For the case of parametric offsets, it is nearly ten times higher.

offsetT3 ≥ 10 ∧ 7 ≥ 2 * offsetT1 ∧ 2 * offsetT1 > 5 + 2 * offsetT2 ∧ 23 ≥ 2 * offsetT3 ∧ offsetT1 ≥ 3 ∧ 2 * offsetT2 + 7 > 2 * offsetT1 ∧ offsetT2 ≥ 0 ∧ offsetT1 > 2 + offsetT2 OR offsetT2 + 2 * offsetT3 + 3 > 3 * offsetT1 ∧ offsetT2 ≥ 0 ∧ 2 * offsetT3 > 1 + 2 * offsetT1 ∧ 19 ≥ 2 * offsetT3 ∧ 2 * offsetT2 + 7 > 2 * offsetT1 ∧ offsetT1 ≥ 3 + offsetT2 ∧ 7 ≥ 2 * offsetT1 OR offsetT3 > 3 ∧ offsetT3 ≥ 3 + offsetT2 ∧ 2 * offsetT3 > 5 + 2 * offsetT2 ∧ offsetT1 + offsetT3 > 6 + 2 * offsetT2 ∧ offsetT1 ≥ 3 + offsetT2 ∧ offsetT2 ≥ 0 ∧ 2 * offsetT1 + 1 ≥ 2 * offsetT3 ∧ 7 ≥ 2 * offsetT1 OR 19 ≥ 2 * offsetT3 ∧ offsetT1 ≥ 0 ∧ offsetT3 > 5 ∧ offsetT2 > 1 + offsetT1 ∧ 2 > offsetT2 OR offsetT1 ≥ 0 ∧ offsetT2 > 0 ∧ offsetT3 > 5 + offsetT2 ∧ offsetT2 ≥ offsetT1 ∧ offsetT1 + 1 ≥ offsetT2 ∧ 1 > 2 * offsetT1 ∧ 19 ≥ 2 * offsetT3 OR offsetT2 ≥ 5 ∧ 23 ≥ 2 * offsetT2 ∧ offsetT1 ≥ 0 ∧ offsetT3 > 1 + offsetT1 ∧ 3 ≥ 2 * offsetT3 OR 23 ≥ 2 * offsetT2 ∧ offsetT3 ≥ 0 ∧ offsetT2 ≥ 5 ∧ 1 ≥ offsetT3 ∧ offsetT1 = 0 OR 2 * offsetT2 > 7 ∧ 3 * offsetT2 > 4 ∧ offsetT2 + 8 > 0 ∧ 10 > offsetT2 ∧ 2 * offsetT1 = 7 ∧ offsetT3 = 0
2 * deadlineT2 ≥ 9 ∧ 2 * deadlineT1 ≥ 9 ∧ 5 ≥ deadlineT1 ∧ 20 ≥ deadlineT2 ∧ deadlineT3 = 60

Comparison with other tools

Comparison of our results with non-parametric tools

We perform a comparison with two other well-known tools, one from the real-time system community, namely Cheddar [Sin], and one from the timed automata community, namely Uppaal [START_REF] Kim Guldstrand Larsen | UPPAAL in a nutshell[END_REF]. Both tools cannot handle parameters nor consider partially specified problems, and therefore can only solve the scheduling verification problem. Therefore, in this section, we consider the instantiated version of the system according to the nominal values given in Figs. 3.1 and 3.5. In addition, to the best of our knowledge, Cheddar cannot test the reactivities.

Non-parametric comparison with Cheddar

Cheddar is a real-time scheduling tool distributed under the GPL license. Cheddar is used to model software architectures of real-time systems and to check if the system is schedulable.

We checked the system's schedulability using Cheddar when the system is instantiated (i. e., all offsets are initialized to 0 and the deadline of each thread equal to the period). We have indicated the period, the execution time and deadline of each processings.

As result, Cheddar proves that the system in Fig. 3.5 without switch time between threads is schedulable and there are no deadline missed in the computed scheduling. We give in Fig. 3.16 the Gantt chart of this system using Cheddar. The computation time of this analysis is given in Table 3.11. In this solution, the number of context switches per period of T3 is 29 and the number of preemptions is 8.

0 11.5 1.5 √ v 2 3 0 10 √ v 3 0 5 1 √ v 4 12 0 3 × v 5 3 15 0 ×
Cheddar cannot give a solution to the scheduling synthesis problem since it only works with instantiated systems, so we cannot determine offsets and deadlines, and also it does not deal with reactivities.

Non-parametric comparison with Uppaal

We also compare the obtained results using IMITATOR with Uppaal results (for the model without switch time). Uppaal is a timed model checker taking as input networks of timed automata, extended with some useful features such as synchronization, integervalued global variables, data structures and C-style functions. We wrote a Uppaal model identical to the IMITATOR model-with instantiated parameters as Uppaal does not support parametric analyses.

As result, Uppaal proves that the instantiated system is schedulable, both without and with reactivities. We give in Table 3.9 obtained results using Uppaal when offsets are parameterized and in Table 3.10 when deadlines are parameterized.

Summary of comparisons

We give the computation times without reactivities in Table 3

"Testing" the parametric analysis

Finally, we tried to obtain additional guarantees on our model's correctness. Indeed, while we can reasonably suppose that our methodology is correct and that the tools are exempt from bugs for the algorithms used here (which remains to be done formally though), a major issue is that of the manual coding of our model into the input language of IMITATOR. In order to have further guarantees, we compared several aspects of the results with other results, or with other tools, whenever applicable.

Using non-parametric model checking

In order to increase our confidence in the results obtained with IMITATOR in Section 3.6.2, we will first test that sampled valuations from the parametric constraint synthesized by IMITATOR are indeed proved schedulable (resp. non-schedulable) by non-parametric tools whenever they belong (resp. do not belong) to the constraint synthesized by IMITATOR. Once more, we do so using both a popular tool in the real-time systems community (Cheddar) and a non-parametric timed model checker (Uppaal).

Model with reactivities

First, we fix the deadlines, and we vary the offsets according to the constraint synthesized in Section 3.6.3. We sample four valuations of this constraint, and give them in Table 3.12 (v 1 to v 4 ); we also add two valuations (v 5 and v 6 ) not belonging to the constraint synthesized by IMITATOR. For each of these valuations, we test using Cheddar and Uppaal whether the system is schedulable.

We give in Table 3.12 obtained results using Cheddar and Uppaal when deadlines are instantiated (and offsets remain parameterized) and in Table 3. 13

v 1 0 2 1 √ √ √ v 2 4 0 10 √ √ √ v 3 2 10 0 √ √ √ v 4 0 9 0 √ √ √ v 5 2 12 1 × × × v 6 5 9 0 × × ×
v 1 5 20 60 √ √ √ v 2 4 11 60 √ √ √ v 3 5 15 60 √ √ √ v 4 4 20 60 √ √ √ v 5 3 11 60 × × × v 6 4 9 55 × × ×
instantiated (and deadlines remain parameterized). As one can see from Tables 3.12 and 3.13, all results are consistent. Recall that this does not formally prove the correctness of our method, but increases our confidence by testing sample points.

Still, if one considers that Uppaal or Cheddar are reliable tools and that our model is entirely correct, once a given valuation is chosen from the constraint output by IMITATOR, checking again its correctness using one of the aforementioned tools is a good way to assess the validity of the whole process.

Using constraints comparisons

We now perform additional tests on the results of IMITATOR.

Model without switch time

We consider here the constraints for the full system including reactivities but excluding the switch time in Section 3.6.3 (the case of the switch time gave similar results).

Constraints comparisons

First, we verified using PolyOp9 that the constraint obtained by monolithic verification is equal to the intersection of the 3 constraints (reactivity NC, reactivity NM

0 2 0 √ × v 2 0 4 1 √ × v 3 0 3 1 √ ×
and reactivity NGC) obtained by separate verifications, on the one hand when offsets are parameterized, and on the other hand when deadlines are parameterized.

Second, we checked that the results with reactivities are included in the constraint without reactivities in all three cases (no parameter, parametric offsets, parametric deadlines). Indeed, the model with reactivities is more constrained, and therefore its admissible valuations set shall be included in or equal to the valuations set without reactivity constraints.

Constraints difference

We give below the difference of constraints without reactivities and constraints with reactivities when offsets are parameterized:

offsetT3 + 5 > offsetT2 ∧ offsetT1 = 0 ∧ offsetT2 ∈ (1, 5] ∧ offsetT3 ∈ [0, 1]
This shows that the two constraints are not equal: some valuations ensure schedulability when reactivities are not considered, but do not ensure schedulability under reactivity constraints. This is a major outcome of our experiments, as it justifies for the analysis under reactivity constraints. That is, tools that are not able to test schedulability under reactivity constraints (such as Cheddar) will give incorrect results for this case study.

We present in Table 3.14 some examples of values of offsets in the difference of constraints without and with reactivities: as expected, Cheddar mistakenly guarantees the system is correct while Uppaal shows it is not, due to some violated reactivities.

Model with switch time

We finally perform additional verifications on the results of Section 3.6.4. We verify using PolyOp that the constraint with switch time obtained by monolithic verification is equal to the intersection of the 3 constraints (reactivity NC, reactivity NM and reactivity NGC) obtained by separate verifications when deadlines are parameterized, just as we did in Section 3.4. We also checked that the result with reactivity NC is included in the constraint without reactivities when offsets are parameterized; and similarly for the result with all 3 reactivities. Not all situations could be considered, as some analyses reach time out (see Table 3.6).

Parametric schedulability analysis of the flight control of a space launcher

We also rechecked the sample results obtained by IMITATOR in Tables 3.7 and 3.8 using Uppaal. We did not use Cheddar in this example because, to the best of our knowledge, Cheddar cannot apply switch time between threads.

Conclusion

In this chapter, our implementation of the flight control system into parametric timed automata using IMITATOR allow to determine offsets and deadlines of each thread taking into account that all reactivities are satisfied and ensure formally that the FPS type scheduling can be a solution for our problem. We build a modular solution, i. e., we specified an automaton for each element of our system (thread, processing, scheduling policy) and each constraint (reactivity). The interest of using IMITATOR as the main tool of our approach is that it allows to analyze a system with parameters in order to determine the possible values of those parameters, unlike other existing tools (e. g., Cheddar and Uppaal) which treat only initialized systems. In addition, we showed that the reactivity constraints are important as, without them, wrong valuations can be derived.

For our longer-term future works, we envisage to:

1. Generalize the flight control scheduling problem by automatically synthesizing the allocations of processings on threads. This generalization raises first the issue of modeling such problematic (how to model an allocation with a parameter) and second the classical combinatorial explosion of states.

2. Apply this approach to the automatic synthesis of the launcher sequential, i. e., of the scheduling of all the system events necessary to fulfill a mission: ignition and shut-down of stages, release of firing, release of payloads, etc.

3. Verify more complex architectures, in a more automated and efficient way.

In the next chapter, we will present Time4sys2imi a tool translating Time4sys models into parametric timed automata [START_REF] Alur | Parametric real-time reasoning[END_REF].

Introduction

Thales Group, a large multinational company specialized in aerospace, defense, transportation and security, developed a graphical formalism Time4sys 1 to allow interoperability between timed verification tools. Time4sys responds to a need to unify the approaches within Thales Group: This formalism is being rolled out at TSA (Thales Airborne Systems) and studies are underway at TAS (Thales Alenia Space). Time4sys is now an open source framework, offering many features to represent real-time systems. However, Time4sys lacks for a formalization: it does not perform any verification nor simulation, nor can it assess the schedulability of the depicted systems. Since Time4sys does not allow to perform formal analyses for real-time systems, a translation to a well-grounded formalism is needed to verify and analyze real-time systems. In this chapter, we present a tool Time4sys2imi which allows to translate Time4sys into parametric timed automata (PTAs) [START_REF] Alur | Parametric real-time reasoning[END_REF] described in the input language of IMITATOR. PTAs extend finite-state automata with clocks (i. e., real-valued variables evolving at the same rate) and parameters (unknown timing constants). PTAs are a formalism well-suited to verify systems where some timing delays are known with uncertainty, or completely unknown. IMITATOR [AFKS12] is the de-facto standard tool to analyze models represented using PTAs. This translation allows not only to assess the schedulability of systems modeled using Time4sys, but only to synthesize some timing constants guaranteeing schedulability.

[And19a] present a set of rules translating Time4sys to PTAs. We introduce here the tool performing this translation, with its practical description, as well as a set of case studies, absent from [START_REF] André | Formalizing Time4sys using parametric timed automata[END_REF].

This work was published in the proceedings of ICTAC 2019 [START_REF] André | Time4sys2imi: A tool to formalize real-time system models under uncertainty[END_REF].

Related works

Scheduling using (extensions) of timed automata was proposed in the past (e. g., [START_REF] Adbeddaïm | Scheduling with timed automata[END_REF]). For uniprocessor real-time systems only, (parametric) task automata offer a more compact representation than (parametric) timed automata [FKPY07, NWY99, And17]; however [START_REF] Fersman | Task automata: Schedulability, decidability and undecidability[END_REF][START_REF] Norström | Timed automata as task models for event-driven systems[END_REF] do not offer an automated translation and, while [START_REF] André | A unified formalism for monoprocessor schedulability analysis under uncertainty[END_REF] comes with a script translating some parametric task automata to parametric timed automata, the case of multiprocessor is not addressed. Schedulability analysis under uncertainty was also tackled in the past, e. g., in [CPR08, FLMS12, SSL + 13,

Time4sys in a nutshell

61

ACF + 19]. The main difference with our tool is that we allow here a systematic translation from an industrial formalism.

An export from Time4sys is available to Cheddar [START_REF] Singhoff | Cheddar: a flexible real time scheduling framework[END_REF]. However, while Cheddar is able to deduce schedulability of real-time systems, it suffers from two main limitations:

1. it does not allow task dependencies; and 2. all timing constants must be fixed in order to study the schedulability.

In contrast, our translation in Time4sys2imi allows for both.

A model represented with Time4sys can also be exported to MAST [START_REF] Michael González Harbour | MAST: Modeling and analysis suite for real time applications[END_REF] which is an open-source suite of tools to perform schedulability analysis of real-time distributed systems. However, the effectiveness of this tool is limited: it does not allow us to have a complete solution to our problem since it only works with instantiated systems, so we can not perform a real-time system with unknown parameters.

Outline

Section 4.2 describes Time4sys, and states the problem. Section 4.3 exposes the architecture of Time4sys2imi. As a proof of concept, Section 4.4 gives the results obtained on some examples. We conclude the chapter and we discuss future works in Section 4.5.

Time4sys in a nutshell

We review here Time4sys, and make a few (minor) assumptions to ease our translation.

Time4sys is a formalism that provides an environment to prepare the design phase of a system through the graphical visualization developed. Time4sys contains two modes: Design and Analysis. In our translation, we use the Time4sys Design mode which uses a subset of the OMG MARTE standard [START_REF] Omg | Modeling and analysis of real-time and embedded systems[END_REF] as a basis for displaying a synthetic view to the real-time system. This graphical representation encompasses all the elements and properties that can define a real-time system. The Time4sys Design tool allows users to define the following elements: 62 4. Formalize real-time system models under uncertainty

• Hardware Resource: a hardware resource in Time4sys is a processor, and it contains a set of tasks; it is also assigned a scheduling policy.

• Software Resource: a software resource in Time4sys is a task, and it features a (relative) deadline.

• Execution Step: an execution step can be seen as a subtask. It is characterized by a BCET, a WCET, and a priority. In our translation, we assume that each software resource contains exactly one execution step. That is, we do not encompass for subtasks.

• Event: an event can be seen as an activation policy for tasks. There are two main types of Events:

-PeriodicEvent: defined by its period, its jitter and its phase (i. e., offset).

-SporadicEvent: defined by its minimum and maximum interarrival times, its jitter and its phase. Finally, this example features two periodic events, both characterized by a 10 ps period, a 0 ps jitter and a 0 ps phase ("offset").

In this example, we start executing with Step1 in the CPU HardwareResource0. After 6 ps, the execution of Step1 ends so Step2 takes its place. At the same time, Step3 in the CPU HardwareResource1 starts performing. At t = 10 ps, the execution of Step2 finishes and a new period of Step1 starts, however at that time Step3 is still executing. So this real-time system is not schedulable i. e., the period of StepT1 is strictly less than the WCET of Step1 plus the WCET of Step3. Time4sys Design can be used for different design modeling tool. It can be exported to different languages such as UML and AADL.

Objective

The main objective of Time4sys2imi is as follows: given a real-time system with some unknown timing constants (period, jitter, deadlines. . . ), synthesize the timing constants for which the system is schedulable. Note that, when all timing constants are known precisely, this problem is schedulability analysis.

Architecture and principle

The main purpose of Time4sys2imi is to perform the translation of Time4sys models into the input language of IMITATOR. The schedulability analysis itself is done by IMITATOR, using reachability synthesis.

Targeted user

The application is intended primarily for the designer of real-time systems, aiming to verify the schedulability of her/his system, or synthesize the timing constants ensuring schedulability.

4. Formalize real-time system models under uncertainty

Time4sys2imi can automatically analyze a graphical representation of a real-time system realized by Time4sys using IMITATOR. The end-user does not need to have skills on PTAs nor on model checking.

Time4sys2imi allows the user to:

• Use the GUI of Time4sys2imi (cf. Fig. 4.2) and configure the options of both the translation and IMITATOR.

• Import an XML file generated by Time4sys. This file contains the data that describes the real-time system to be analyzed.

• Generate an .imi model analyzable by IMITATOR.

User workflow

The analysis of real-time systems, using the proposed translation, can be summed up in three main parts:

1. Graphical modeling of a real-time system containing all its components with Time4sys. This part allows us to have a complete architecture of the system on the one hand. The architecture is encoded in an XML file automatically generated by Time4sys. This file contains all the data needed to describe the system.

2. The second part is the automatic translation of the XML file to the input language of IMITATOR, and is performed by Time4sys2imi. Time4sys2imi creates an .imi file that is analyzable with IMITATOR.

3. Finally, the user can run IMITATOR from Time4sys2imi to get the answer to the schedulability problem.

The translation rules are described in [START_REF] André | Formalizing Time4sys using parametric timed automata[END_REF]. In short, we translate each task, each task chain and each processor scheduling policy (earliest deadline first, rate monotonic, shortest job first. . . ) into a PTA; most of these PTAs feature a special location corresponding to a deadline miss (i. e., this location is reachable iff a deadline miss occurs). Timing constants are encoded either as constants (if they are known) or as timing parameters (if they are unknown). Then, we build (on-the-fly) the synchronous product of these PTAs. Finally, the set of valuations for which the system is schedulable is exactly those for which the special deadline miss locations in the synchronous product are unreachable. See [START_REF] André | Formalizing Time4sys using parametric timed automata[END_REF] for details.

Global architecture

Time4sys2imi is made of 5,500 lines of Java code, and can therefore run under any operating system. We explain in Fig. 4.3 the global architecture of the system. Time4sys2imi takes as input the Time4sys model in XML, then we used the DOM parser to extract data. These data are translated into an abstract syntax for PTAs. We then translate these abstract PTAs into the concrete input language of IMITATOR.

Time4sys2imi is developed with the help of Sahar Mhiri and under the supervision of Étienne André.

Detailed architecture

The global process is in Fig. 4.4. Level 2 This level is loaded by the translation of the XML file through the following steps:

1. Parsing the XML file that Time4sys generates in order to get an abstract data structure from Time4sys.

2. Translation of the result into an abstract data structure of PTAs.

3. Construct an IMITATOR file from the PTAs abstract data structure.

Level 3 This level shows the XML files generated by Time4sys when designing a real-time system.

Proof of concept

As a proof of concept to show the applicability of our translation tool, we modeled some real-time systems with Time4sys, then we translated those models to PTAs using with Time4sys2imi and analyzed them using IMITATOR.

We give in Table 4.1 a list of four case studies with, from top to bottom, the number of CPU, of tasks and task chains in the original Time4sys model, followed by the number of automata, locations, clocks, discrete variables2 and parameters in the translated IMITATOR target model. We also give the name of the constants that are indeed parameterized (if any), and give the analysis time by IMITATOR. The translation time using Time4sys2imi is always negligible in our experiments. Finally, we give whether the system is schedulable (if it is entirely non-parametric), or we give the condition for which it is schedulable. The parametric results (i. e., the constraints over the valuations ensuring schedulability) are given in Table 4.2.

We ran experiments on an ASUS X411UN Intel CoreŮ i7-8550U 1.80 GHz with 8 GiB memory running Linux Mint 19 64 bits. All experiments were conducted using IMITATOR 2.10.4 "Butter Jellyfish". Source, binaries, examples and results are available at www.imitator.fr/static/ ICTAC19.

From Table 4.1, we see that the analysis time using IMITATOR remains small, with the exception of the larger model with 11 concurrent tasks featuring dependencies, for which the analysis time using IMITATOR for a three-dimensional analysis becomes above 2 minutes.

Example 4.2. Consider again the real-time system modeled in Fig. 4.1 using Time4sys. We translate it using Time4sys2imi; the set of PTA obtained for this example are illustrated in Fig. 4.5.

First, we consider a non-parametric analysis: applying IMITATOR to the PTAs translated using Time4sys2imi shows that the system is not schedulable, as it was expected from Example 4.1.

Second, we parameterize the BCET and WCET of Step1. The result of the schedulability synthesis using IMITATOR yields the following constraint: 0 ≤ BCETStep1 ≤ WCETStep1 < 5. This constraint explains why this real-time system was not schedulable when WCET = BCET = 6 i. e., the values taken for WCET and BCET are not in the interval for which the system is schedulable.

? × Condition1 √ Condition2 √ Condition3 √ Condition4
We give in Appendix B a set of examples with models and translated PTAs.

Condition1 Condition2 Condition3 Condition4 5 > WCETStep1 DeadlineStep2 >= 4 DeadlineStep1 >= 5 WCETStep5 >= BCETStep5 & BCETStep1 >= 0 & BCETStep5 >= 0 & WCETStep1 >= BCETStep1 & 15 > WCETStep5 & DeadlineStep11 >= 5 OR 5 > DeadlineStep11 & BCETStep5 > 4 & DeadlineStep11 >= 2 & WCETStep5 >= BCETStep5 & 6 >= WCETStep5 OR DeadlineStep11 >= 2 & 5 > DeadlineStep11 & 15 > WCETStep5 & BCETStep5 > 14 & WCETStep5 >= BCETStep5

Conclusion and perspectives

In this chapter, we presented our approach that can give first useful guarantees at the preliminary stage of system design and verification, notably to help designers to exhibit suitable ranges of timing parameters guaranteeing schedulability.

Seeing from our experiments, the toolkit made of Time4sys, Time4sys2imi and IMITATOR can analyze non-trivial case studies and it already allows to provide the first elements of correction for users.

Conclusion and perspectives

This chapter concludes and discuss future perspectives of Part I

Conclusion

In Chapter 3, we proposed an approach to synthesize timing valuations ensuring schedulability of the flight control of a space launcher. A key issue is to ensure that the system reactivities are met-for which we proposed a compositional solution.

In Chapter 4, we studied Time4sys which is a formalism developed by Thales Group, realizing a graphical specification for real-time systems. However, this formalism does not allow to perform formal analyses for real-time systems. So a translation of this tool to a formalism equipped with a formal semantics is needed. We presented Time4sys2imi, a tool translating Time4sys models into parametric timed automata in the input language of IMITATOR. This translation allows not only to check the schedulability of real-time systems, but also to infer some timing constraints (deadlines, offsets. . . ) guaranteeing schedulability. We successfully applied Time4sys2imi to various examples.

Perspectives

In Chapter 3, due to the efficiency gap of an order of magnitude, combining some non-parametric analyses (e. g., with Uppaal or Cheddar) with parametric analyses (IMITATOR) would be an interesting future work.

The harmonic periods are a strong assumption of the problem. Tuning our solution to benefit from this assumption is on our agenda. This may indeed allow us to reuse some clocks, and therefore reduce the number of clocks; it is well-known that the model-checking problem is exponential in the number of clocks.

In addition, synthesizing the admissible values for the context switch time, i. e., making this time a parameter, seems interesting as it derives admissible values of the processor context switch speed for which the system can be scheduled.

We envisage two tracks for our longer-term future works:

1. Generalizing the flight control scheduling problem by automatically synthesizing the allocations of processings on threads. This generalization raises first the issue of modeling such problematic (how to model an allocation with a parameter) and second the classical combinatorial explosion of states.

2. Applying this approach to the automatic synthesis of the launcher sequential, i. e., of the scheduling of all the system events necessary to fulfill a mission: ignition and shut-down of stages, release of firing, release of payloads, etc.

In Chapter 4, future work will be to optimize our translation: while we followed the rules developed in [START_REF] André | Formalizing Time4sys using parametric timed automata[END_REF], it is likely that varying the rules in order to optimize the size of the automata or reducing the clocks, may help to make the model more compact and the analysis more efficient.

Second, when the model is entirely non-parametric, we believe that using the Uppaal model checker [START_REF] Kim Guldstrand Larsen | UPPAAL in a nutshell[END_REF] instead of IMITATOR may be more efficient; for that purpose, we plan to develop a translator to the input language of Uppaal too; this implies to modify only the last step of our translation (from the abstract (P)TAs into the concrete input language of the target model checker).

Third, so far the analysis using IMITATOR is exact, i. e., sound and complete; however, it may sometimes be interesting to get only some ranges of parameter valuations for which the system is schedulable. Such optimizations (on the IMITATOR side) should help to make the analysis faster.

Finally, real-time systems with uncertain timing constants were recently proved useful when Thales Group published an open challenge1 for a system (actually modeled using Time4sys) with periods known with a limited precision only; while this problem was not strictly speaking a schedulability problem (but rather a computation of minimum/maximum execution times), it shed light on the practical need for methods to formally analyze real-time systems under uncertainty in the industry.

Introduction

This chapter introduces limit cycle of oscillators using Euler method and highlights the motivation of the research conducted in the second part of the thesis

Introduction

Context

Robust control

Robust control methods are generally applied as long as there are uncertain parameters or perturbations in the system. They are intended to make the system robust and stable when uncertainties remain within a given range. In other words, controllers designed using robust control are able to overcome small errors in the system.

Limit cycle

A limit cycle is an isolated periodic solution of an autonomous system of differential equations. If the trajectory converges towards a limit cycle and a small perturbation on the trajectory will cause the system to return to the state of the limit cycle. Then, the limit cycle is an attractor and is called stable. On the other hand, if neighboring trajectories move away from the limit cycle. Then, the limit cycle is considered unstable.

Stability

A system is considered stable if a bounded input produces a bounded ouput (i. e., Bounded-Input/ Bounded-Ouput (BIBO) stability).

Euler method

The Euler method can be used to solve ordinary differential equations (ODE) with a given initial condition. Although Euler's method is not as precise as the other methods, it is faster and does not require a lot of computational resources.

Objectives 79 6.2 Objectives

In order to analyze the stability of differential systems, which highlights the resistance to changes (i. e., any other solution of the system that begins adequately near it stays close, see [START_REF] Pinto | Stability of nonlinear differential systems[END_REF]) we give a method that generates a bounded invariant set for a given differential system with a given set of initial conditions around a point x 0 , we remind that a bounded invariant set is a set that respects the property that if the system state is in the set at some time, it will always contain the system, see [START_REF] Blanchini | Invariant sets[END_REF]. This invariant has the form of a tube centered on the Euler approximate solution starting at x 0 , which has for radius an upper bound on the distance between the approximate solution and the exact ones. The method consists in finding a real T > 0 such that the "snapshot" of the tube at time t = (i + 1)T is included in the snapshot at t = iT , for some integer i.

Contributions

The first chapter of the 2nd part of the thesis (Chapter 7) recalls the results obtained by Adrien Le Coënt in [START_REF] Le | Guaranteed control synthesis for switched spacetime dynamical systems[END_REF] on which this part of our work is based. In his thesis, Adrien Le Coënt found an upper bound δ(t) of the error at time t, between the exact solution of the dynamical system and the approximated solution of this system via the explicit Euler method. This error bound allows him to express an (over-approximation) of the reachable set at each time t as a union of balls of the form B(t) whose center is the solution approximated by Euler's method, and whose radius is δ(t). This reachable set that starts from some initial state x 0 can be defined as the set of states crossed by use of all conceivable admissible control sequences from x 0 [START_REF] Pecsvaradi | Reachable sets for linear dynamical systems[END_REF]. Using this result, he then shows how to find a (sub)optimal control for switch subsystems, by selecting, at each time sample 0, τ , 2τ ,..., an element u in a finite set U of constant controls. These results are recalled in Chapter 7.

The main contribution of our work is to give a simple criterion of inclusion of the current reachability set in a previous reachability set, in order to construct a (forward) invariant set I of the system. This invariant set regards the property that if the system state is in the set at a certain time, then it will consistently contain the framework later on, see [START_REF] Blanchini | Invariant sets[END_REF]. Moreover, under certain conditions, the invariant set I is guaranteed to contain a (unique and attractive) limit cycle L whose basin of attraction is I. This limit cycle is a periodic trajectory that repeats itself every period of time [START_REF] Ricardo | Chapter 7 -systems of nonlinear differential equations[END_REF]. We also show that this result allows us to define robust (sub)optimal periodic control strategies. This robust periodic optimal control helps to design basic

Introduction

time-variant controllers that can be used online in order to to schedule gain [START_REF] Bittanti | Periodic systems: filtering and control[END_REF]. These results are presented in Chapter 8.

Then, in Chapter 9, we show how this criterion of inclusion of reachability sets allows us to construct invariant tori where all the approximate solutions which start in the invariant tori stay there at any time (see [START_REF] Edoh | Computation of invariant tori by orthogonal collocation[END_REF])., and how to trace their evolution according to the modification of a key parameter of the system, and make appear bifurcation phenomena, period doubling, and chaos (i. e., a period-doubling bifurcation is produced when a slight change in a system induces a transition to chaos, in which the period of the system is the double of the original, see [START_REF] Venkatesan | Occurrence of multiple period-doubling bifurcation route to chaos in periodically pulsed chaotic dynamical systems[END_REF]).

Finally, in Chapter 10, we describe the main features of the implementation of the ORBITADOR program, which allowed the application of the method on numerous examples from the literature. This second part of the thesis ends with Chapter 11 in which we summarize our main contributions and give some perspectives for this work.

Symbolic Euler's method and its application for controlled systems

This chapter introduces the basic knowledge related to the second part of the thesis.

Introduction

In this chapter, we introduce the formalisms and the results associated with the second part of the thesis.

Symbolic Euler's method

This section comes essentially from [START_REF] Le | Guaranteed control synthesis for switched spacetime dynamical systems[END_REF].

Euler's method and error bounds

Let us consider a time discretization of time-step τ and the differential system:

dx(t) dt = f (x(t)).
where x(t) ∈ R d denotes the state of the system at time t. We use x(t; x 0 ) to denote the exact continuous solution x of the system at time t ∈ [0, τ ], with initial condition x 0 . This solution is approximated using the explicit Euler integration method. We use x(t; x 0 ) = x 0 + tf (x 0 ) to denote Euler's approximate value of x(t; x 0 ) for t ∈ [0, τ ].

The solution of the system x(t; x 0 ) on t ∈ [0, τ ) with initial condition x 0 is extended continuously with the solution of the system on t ∈ [τ, 2τ ], and so on iteratively until t ∈ [(k -1)τ, kτ ) where k ∈ N. Likewise, we use x(t) to denote Euler's approximate value of x(t) for t ∈ [0, kτ ) defined by x(t; x i ) = x(t; x i-1 ) + tf (x(t; x i-1 )) for t ∈ [(i -1)τ, iτ ) and 1 ≤ i ≤ k. The approximate solution x(t) is here a continuous piecewise linear function for t ∈ [0, kτ ) starting at x 0 .

We suppose that we know a bounded region S ⊂ R d containing the solutions of the system for a set of initial conditions B 0 and a certain amount of time. We now give an upper bound to the error between the exact solution of the ODE and its Euler approximation on S (see [START_REF] Le | Guaranteed optimal reachability control of reaction-diffusion equations using one-sided Lipschitz constants and model reduction[END_REF][START_REF] Le Coënt | Control synthesis of nonlinear sampled switched systems using Euler's method[END_REF]). Definition 7.1. Let ε be a given positive constant. Let us define, for t ∈ [0, τ ], δ ε (t) as follows:

7.2. Symbolic Euler's method 83 if λ < 0 : δ ε (t) = ε 2 e λt + C 2 λ 2 t 2 + 2t λ + 2 λ 2 1 -e λt 1 2 if λ = 0 : δ ε (t) = ε 2 e t + C 2 (-t 2 -2t + 2(e t -1)) 1 2 if λ > 0 : δ ε (t) = ε 2 e 3λt + C 2 3λ 2 -t 2 - 2t 3λ + 2 9λ 2 e 3λt -1 1 2
where C and λ are real constants specific to function f , defined as follows:

C = sup y∈S L∥f (y)∥,
where L denotes the Lipschitz constant for f , and λ is the "one-sided Lipschitz constant" (or "logarithmic Lipschitz constant" [AS14]) associated to f , i. e., the minimal constant such that, for all y 1 , y 2 ∈ S:

⟨f (y 1 ) -f (y 2 ), y 1 -y 2 ⟩ ≤ λ∥y 1 -y 2 ∥ 2 , ( H0
)
where ⟨•, •⟩ denotes the scalar product of two vectors of S.

The constant λ can be computed using a nonlinear optimization solver (e. g., Sequential quadratic programming (SQP) [K + 88], CPLEX [START_REF]V12. 1: User's manual for cplex[END_REF] and YALMIP [START_REF] Löfberg | Yalmip : A toolbox for modeling and optimization in matlab[END_REF]) or using the Jacobian matrix of f (see, e. g., [START_REF] Aminzare | Contraction methods for nonlinear systems: A brief introduction and some open problems[END_REF]).

Remark 3. Let us give an algorithm to compute local values of λ. Given an initial ball B 0 with radius d 0 := ε, we calculate the local value λ 1 of λ and the "successor" ball B 1 of B 0 at t = ∆t as follows:

1. Select a candidate T 1 for a convex zone including B 0 and calculate the contraction rate -λ 1 on T 1 .

Calculate

B 1 = B W (∆t) and B ′ 1 = B W (2∆t) using the function δ d 0 ,W associated with λ 1 . 3. Check that B 1 and B ′ 1 are included in T 1 . If yes, B 1 is indeed the successor ball (of radius d 1 = δ d 0 ,W (∆t)) of B 0 ; if not, go to step 1.
We can repeat the process by taking B 1 as a new initial ball, select a candidate zone T 2 of rate -λ 2 , calculate a ball B 2 of radius d 2 = δ d 1 ,W (∆t) using λ 2 , and so on iteratively.

Proposition 7.1. [START_REF] Le Coënt | Control synthesis of nonlinear sampled switched systems using Euler's method[END_REF] Consider the solution x(t; y 0 ) of dx dt = f (x) with initial condition y 0 and the approximate Euler solution x(t; x 0 ) with initial condition x 0 . For all y 0 ∈ B(x 0 , ε), we have:

∥x(t; y 0 ) -x(t; x 0 )∥ ≤ δ ε (t).
Proposition 7.1 underlies the principle of our set-based method where set of points are represented as balls centered around the Euler approximate values of the solutions. This illustrated in Fig. 7.1: for any initial condition x 0 belonging to the ball B(x 0 , δ(0)) with δ(0) = ε, the exact solution x 1 ≡ x(τ ; x 0 ) belongs to the ball B(x 1 , δ ε (τ )) where x1 denotes the Euler approximation x0 + τ f (x 0 ) at t = τ .

Systems with bounded uncertainty

Let us now show how the method extends to systems with "perturbation" or "bounded uncertainty". A differential system with bounded uncertainty is of the form

dx(t) dt = f (x(t), w(t)), with t ∈ R d ≥0 , states x(t) ∈ R d , and uncertainty w(t) ∈ W ⊂ R d ,
where W is a compact (i. e., closed and bounded) set. We assume that any possible perturbation trajectory is bounded at any point in time in the compact set W . We denote this by w(•) ∈ W, which is a shorthand for w(t) ∈ W, ∀t ≥ 0. The diameter of W (i.e., the maximal distance between two elements of W) is denoted by |W|. See [START_REF] Schürmann | Optimal control of sets of solutions to formally guarantee constraints of disturbed linear systems[END_REF][START_REF] Schürmann | Guaranteeing constraints of disturbed nonlinear systems using set-based optimal control in generator space[END_REF] for details. We now suppose (see [LCADSC + 17]) that there exist constants λ ∈ R and γ ∈ R ≥0 such that, for all y 1 , y 2 ∈ S and w 1 , w 2 ∈ W:

⟨f (y 1 , w 1 ) -f (y 2 , w 2 ), y 1 -y 2 ⟩ ≤ λ∥y 1 -y 2 ∥ 2 + γ∥y 1 -y 2 ∥∥w 1 -w 2 ∥ (H1).
This formula can be seen as a generalization of (H0) (see Section 7.2.1). Recall that λ has to be computed in the absence of uncertainty (|W| = 0). The additional constant γ is used for taking into account the uncertainty w. Given λ, the constant γ can be computed itself using a nonlinear optimization solver. H1). Consider a point x 0 ∈ S and a point y 0 ∈ B(x 0 , ε).Let x(t; y 0 ) be the exact solution of the system dx(t) dt = f (x(t), w(t)) with bounded uncertainty W and initial condition y 0 , and x(t; x 0 ) the Euler approximate solution of the system dx(t) dt = f (x(t), 0) without uncertainty (|W| = 0) with initial condition x 0 . We have, for all w(•) ∈ W and t ∈ [0, τ ]: ∥x(t; y 0 ) -x(t; x 0 )∥ ≤ δ ε,W (t).

with

• if λ < 0, δ ε,W (t) = C 2 -λ 4 -λ 2 t 2 -2λt + 2e λt -2 + 1 λ 2 Cγ|W| -λ -λt + e λt -1 + λ γ 2 (|W|/2) 2 -λ (e λt -1) + λε 2 e λt 1/2 (7.1) • if λ > 0, δ ε,W (t) = 1 (3λ) 3/2 C 2 λ -9λ 2 t 2 -6λt + 2e 3λt -2 + 3λ Cγ|W| λ -3λt + e 3λt -1 + 3λ γ 2 (|W|/2) 2 λ (e 3λt -1) + 3λε 2 e 3λt
1/2 (7.2) 86 7. Symbolic Euler's method and its application for controlled systems

• if λ = 0, δ ε,W (t) = C 2 -t 2 -2t + 2e t -2 + Cγ|W| -t + e t -1 + γ 2 (|W|/2) 2 (e t -1) + ε 2 e t 1/2 (7.3)
We will sometimes write δ W (t) and δ(t) instead of δ ε,W (t) and δ ε (t) respectively.

Extension of Euler Method with control

Optimal control using Euler time integration

We present here the Euler-based method of optimal control synthesis given in [LCF19, CF19, LCADSC + 17, LC17].

Explicit Euler time integration with control

We consider here a time discretization of time-step τ , and we suppose that the control law u(•) is a piecewise-constant function, which takes its values on a finite set U ⊂ R m , called "modes" (or "control inputs"). Given u ∈ U , let us consider the differential system controlled by u:

dy(t) dt = f u y(t) .
where f u (y(t)) stands for f (u(t), y(t)) with u(t) = u for t ∈ [0, τ ], and y(t) ∈ R d denotes the state of the system at time t. The function u is assumed to be Lipschitz continuous. We use Y u y 0 (t) to denote the exact continuous solution y of the system at time t ∈ [0, τ ] under constant control u, with initial condition y 0 . This solution is approximated using the explicit Euler integration method. We use Ỹ u y 0 (t) ≡ y 0 + tf u (y 0 ) to denote Euler's approximate value of Y u y 0 (t) for t ∈ [0, τ ].

Given a sequence of modes (or "pattern")

π := u 1 • • • u k ∈ U k
, we denote by Y π y 0 (t) the solution of the system under mode u 1 on t ∈ [0, τ ) with initial condition y 0 , extended continuously with the solution of the system under mode u 2 on t ∈ [τ, 2τ ], and so on iteratively until mode

u k on t ∈ [(k -1)τ, kτ ). The control function u(•) is thus piecewise constant with u(t) = u i for t ∈ [(i -1)τ, iτ ), 1 ≤ i ≤ k. Likewise, we use Ỹ π y 0 (t) to denote Euler's approximate value of Y π y 0 (t) for t ∈ [0, kτ ) defined by Ỹ u 1 •••u i y 0 (t) = Ỹ u 1 •••u i-1 y 0 (t) + tf u i ( Ỹ u 1 •••u i-1 y 0 (t)) for t ∈ [0, τ ) and 2 ≤ d ≤ k.
The approximate solution Ỹ π y 0 (t) is here a continuous piecewise linear function on [0, kτ ) starting at y 0 . Note that we have supposed here that the step size ∆t used in Euler's integration method was equal to the sampling period τ of the switching system. Actually, in order to have better approximations, it is often convenient to take a fraction of τ as for ∆t (e. g., ∆t = τ /400). Such a splitting is called "sub-sampling" in numerical methods (see [START_REF] Le Coënt | Control synthesis of nonlinear sampled switched systems using Euler's method[END_REF]). Henceforth, we will suppose that k ∈ N is the length of the pattern π, and T = kτ = K∆t for some K multiple of k, and T > 0.

Finite horizon and dynamic programming

The optimization task is to find a control pattern π ∈ U k which guarantees that all states in a given set S = [0, 1] d ⊂ R d1 are steered at time t end = kτ as closely as possible to an end state y end ∈ S. Let us explain the principle of the method based on DP and Euler integration method used in [START_REF] Le | Guaranteed control of sampled switched systems using semi-Lagrangian schemes and onesided Lipschitz constants[END_REF][START_REF] Le | Guaranteed optimal reachability control of reaction-diffusion equations using one-sided Lipschitz constants and model reduction[END_REF]. We consider the cost function:

J k : S × U k → R ≥0 defined by: J k (y, π) = ∥Y π y (kτ ) -y end ∥,
where ∥ • ∥ denotes the Euclidean norm in R d2

We consider the value function v k : S → R ≥0 defined by:

v k (y) := min π∈U k J k (y, π) ≡ min π∈U k ∥Y π y (kτ ) -y end ∥ .
Given k ∈ N and τ ∈ R >0 , we consider the following finite time horizon optimal control problem: Find for each y ∈ S

• the value v k (y), i. e., min π∈U k ∥Y π y (kτ ) -y end ∥ ,

• and an optimal pattern:

π k (y) := arg min π∈U k ∥Y π y (kτ ) -y end ∥ .
We then discretize the space S by means of a grid X such that any point y 0 ∈ S has an "ε-representative" z 0 ∈ X with ∥y 0 -z 0 ∥ ≤ ε, for a given value ε > 0. As explained in [START_REF] Le | Guaranteed optimal reachability control of reaction-diffusion equations using one-sided Lipschitz constants and model reduction[END_REF], it is easy to construct via DP a procedure PROC ε k which, for any y ∈ S, takes its representative z ∈ X as input, and returns a pattern π ε k ∈ U k corresponding to an approximate optimal value of v k (y).

Correctness of the method

Given a point y ∈ S of ε-representative z ∈ X , and a pattern π ε k returned by PROC ε k (z), we are now going to show that the distance ∥ Ỹ π ε k z (kτ ), -y end ∥ converges to v k (y) as ε → 0. We first consider the ODE: dy dt = f u (y), and give an upper bound to the error between the exact solution of the ODE and its Euler approximation (see [START_REF] Le | Guaranteed optimal reachability control of reaction-diffusion equations using one-sided Lipschitz constants and model reduction[END_REF][START_REF] Le Coënt | Control synthesis of nonlinear sampled switched systems using Euler's method[END_REF]). Definition 7.2. Let µ be a given positive constant. Let us define, for all u ∈ U and t ∈ [0, τ ], δ u µ (t) as follows: if λ u < 0 :

δ u µ (t) = µ 2 e λut + C 2 u λ 2 u t 2 + 2t λ u + 2 λ 2 u 1 -e λut 1 2
if λ u = 0 :

δ u µ (t) = µ 2 e t + C 2 u -t 2 -2t + 2(e t -1) 1 2 if λ u > 0 : δ u µ (t) = µ 2 e 3λut + C 2 u 3λ 2 u -t 2 - 2t 3λ u + 2 9λ 2 u e 3λut -1 1 2
where C u and λ u are real constants specific to function f u , defined as follows:

C u = sup y∈S L u ∥f u (y)∥,
where L u denotes the Lipschitz constant for f u , and λ u is the "one-sided Lipschitz constant" (or "logarithmic Lipschitz constant" [START_REF] Aminzare | Contraction methods for nonlinear systems: A brief introduction and some open problems[END_REF]) associated to f u , i. e., the minimal constant such that, for all y 1 , y 2 ∈ T :

⟨f u (y 1 ) -f u (y 2 ), y 1 -y 2 ⟩ ≤ λ u ∥y 1 -y 2 ∥ 2 , (7.4)
where ⟨•, •⟩ denotes the scalar product of two vectors of T , and T is a convex and compact overapproximation of S such that

T ⊇ {Y u y 0 (t) | u ∈ U, 0 ≤ t ≤ ∆t, y 0 ∈ S}.
The constant λ u can be computed using a nonlinear optimization solver.

Proposition 7.3. [START_REF] Le Coënt | Control synthesis of nonlinear sampled switched systems using Euler's method[END_REF] Consider the solution Y u y 0 (t) of dy dt = f u (y) with initial condition y 0 of ε-representative z 0 (hence such that ∥y 0 -z 0 ∥ ≤ ε), and the approximate solution Ỹ u z 0 (t) given by the explicit Euler scheme. For all t ∈ [0, τ ], we have:

∥Y u y 0 (t) -Ỹ u z 0 (t)∥ ≤ δ u ε (t).
Remark 5. The function δ u ε (•) is similar to the "discrepancy function" used in [START_REF] Fan | Bounded verification with on-thefly discrepancy computation[END_REF], but it gives an upper-bound on the distance between an exact solution and an Euler approximate solution while the discrepancy function gives an upper-bound on the distance between any two exact solutions. Proposition 7.3 underlies the principle of our set-based method where set of points are represented as balls centered around the Euler approximate values of the solutions. This illustrated in Fig. 7.1: for any initial condition x 0 belonging to the ball B(x 0 , δ(0)),the exact solution x 1 ≡ Y u x 0 (τ ) belongs to the ball B(x 1 , δ(τ )) where x1 ≡ Ỹ u x0 (τ ) denotes the Euler approximation of the exact solution at t = τ , and δ u (τ ) ≡ δ u δ(0) (τ ).

We have:

Theorem 7.1 (convergence [START_REF] Le | Guaranteed optimal reachability control of reaction-diffusion equations using one-sided Lipschitz constants and model reduction[END_REF]). Let y ∈ S be a point of ε-representative z ∈ X . Let π ε k be the pattern returned by PROC ε k (z), and π ♯ := arg min π∈U k ∥Y π y (kτ ) -y f ∥. Let v k (y) := ∥Y π ♯ y (kτ )-y end ∥ be the exact optimal value of y. The approximate optimal value of y, ∥ Ỹ π ε k y (kτ ) -y end ∥, converges to v k (y) as ε → 0.

Theorem 7.1 formally justifies the correctness of our method of optimal control synthesis by saying that the approximate optimal values computed by our method converge to the exact optimal values when the mesh size tends to 0.

Examples

In Examples 7.1 to 7.3, we illustrate the application of the procedure PROC ε k to some dynamical systems. These experiments are implemented in Python and computed by 90 7. Symbolic Euler's method and its application for controlled systems an extension of ORBITADOR (See Chapter 10). They are running on a 2.80 GHz Intel Core i7-4810MQ CPU with 8 GiB of memory.

Example 7.1. Considering a Magnetic Resonance Imaging (MRI) system q consisting of two different particles with spins q 1 , q 2 (see [START_REF] Bonnard | Comparison of numerical methods in the contrast imaging problem in NMR[END_REF][START_REF] Bonnard | Geometric and numerical methods in the contrast imaging problem in nuclear magnetic resonance[END_REF]). The magnetization vectors q 1 = (y 1 , z 1 ) ∈ R 2 and q 2 = (y 2 , z 2 ) ∈ R 2 satisfy the differential system: andu 2 ∈ [-1, 1] the magnetic field (control). Let Ω max = 202.95, T 11 = 2, T 12 = 0.3, T 21 = 2.5, T 22 = 2.5, T m = 26.17 and t m = 2. The goal is to make q 1 reach the origin (0, 0) at a given time t = t end while maximizing the "contrast" ∥q 2 (t end ) -q 1 (t end )∥ = ∥q 2 (t end )∥. In order to account for the (soft) constraint q 1 (t end ) = (0, 0), we integrate in the cost function J k a "penalty term" of the form ∥q 1 (t end )∥ 2 . Our goal is thus to minimize the terminal cost: α∥q 1 (t end ) 2 ∥ -β∥q 2 (t end ) -q 1 (t end )∥ 2 . The domain S of the states (q 1 , q 2 ) ≡ ((y 1 , z 1 ), (y

q 1 :    . y 1 = 2πT m t m (-Γ 1 y 1 -u 2 z 1 ) . z 1 = 2πT m t m (γ 1 (1 -z 1 ) + u 2 y 1 ) q 2 :    . y 2 = 2πT m t m (-Γ 2 y 2 -u 2 z 2 ) . z 2 = 2πT m t m (γ 2 (1 -z 2 ) + u 2 y 2 ) with: Γ 1 = 1 T 12 Ωmax , γ 1 = 1 T 11 Ωmax , Γ 2 = 1 T 22 Ωmax , γ 2 = 1 T 21 Ωmax ,
2 , z 2 )) is equal to [-1, 1] 2 × [-1, 1] 2 ≡ [-1, 1] 4 .
The grid X corresponds to a discretization of S = [-1, 1] 4 , where each component interval [-1, 1] is uniformly discretized into a set of K points. The codomain [-1, 1] of the original continuous control function u 2 (•) is itself discretized into a finite set U with our method. After discretization, u 2 (•) is a piecewise-constant function that takes its values in the finite set U made of 30 values uniformly taken between -1 and 1. The function u 2 (•) can change its value every τ seconds. In the following experiments, we use the following parameter values: α = 0.99, β = 0.01, τ = 1/250, k = 215, t end = kτ = 0.86, and q 1 (0) = (0, 1). We will consider the cases K = 10 (coarse grid) and K = 20 (finer grid). One can check that assumption (H) is satisfied in both cases. In order to test the robustness of the method, we will consider the cases q 2 (0) = (0, 1) and q 2 (0) = (0.1, 1).

For K = 10 and q 2 (0) = (0, 1), we have q 2 (t end ) = (0.6567, -0.2558), and the optimal value of the contrast is ∥q 2 (t end )∥ = 0.7048. The CPU computation takes 389 seconds. See Fig. 7.2. For q 2 (0) = (0.1, 1), the synthesized control and the results are identical, which demonstrates the robustness of our method.

For K = 20, and q 2 (0) = (0, 1), we have q 2 (t end ) = (0.6439, -0.2913), and the contrast is ∥q 2 (t end )∥ = 0.7067. (see Fig. 7.3). The CPU computation takes 3657 seconds. See Fig. 7.3. For q 2 (0) = (0.1, 1), the synthesized control and the results are again identical, thus confirming the robustness of our method. with q 1 = (y 1 , z 1 ) (top left), q 2 = (y 2 , z 2 ) (top right) and control u 2 (bottom). When applied to q 2 (0) = (0, 1), the method gives the same results.

Figure 7.3: Robust method applied to MRI for K = 20 and initial condition q 2 (0) = (0.1, 1), with q 1 = (y 1 , z 1 ) (top left), q 2 = (y 2 , z 2 ) (top right) and control u 2 (bottom). When applied to q 2 (0) = (0, 1), the method gives the same results.

For comparison, we now perform the same experiments with the version of the numerical solver Bocop using convex optimization [START_REF]Bocop: an open source toolbox for optimal control[END_REF]. For q 2 (0) = (0, 1), we have with Bocop: q 2 (t end ) = (0.0499, -0.7938); the contrast is ∥q 2 (t end )∥ = 0.6746. The CPU computation time is 230 seconds. See Fig. C.3 (Appendix C.4). For q 2 (0) = (0.1, 1), 92 7. Symbolic Euler's method and its application for controlled systems we have, with Bocop: q 2 (t end ) = (0.0877, -0.6631); the contrast is ∥q 2 (t end )∥ = 0.6689. The CPU computation time is 43 seconds. See Fig. C.4 (Appendix C.4). The optimal values of the contrast computed by Bocop and our program are comparable. However, the CPU times of Bocop are smaller than those of our program (especially for K = 20).

Example 7.2. We consider a dual tank reactor: a first one in which microalgae are cultivated and a second one where the microalgae are converted into biogas. The aim of this example is to find an optimal feeding strategy in order to maximize the production of biogas in the second reactor. The dual-tank bioreactor can be modeled as a 3-dimensional dynamical system. The state variables are the concentration of micro-algae y, biomass x and substrate s. The control variable is the input flow u throughout the whole reactor. The system dynamics is given by:

         dy dt = µ(t)y 1+y -ry -uy ds dt = µ 2 (s)x + uβ(γy -s) dx dt = (µ 2 (s) -uβ)x
where µ is the light model, µ 2 (s) = µ m 2 s Ks+s the growth function in reactor 2, and β the volume ratio between the two tanks.

The optimal control problem is written as:

                       M ax 1 β+c t f 0 µ 2 (s(t))x(t)dt d dt (y, s, x) = f (t, y, s, x, u) u ∈ [0, 1] (y(0), s(0), x(0)) ∈ Z 0 (y(t f ), s(t f ), x(t f )) = (y(0), s(0), x(0)) Let r = 0.005, β = 1, γ = 1, µ m 2 = 0.1, K s = 0.05 and c = 2
We transform the PDE into a system of ODEs. We thus consider that we have 3 oscillators of state (y(t), s(t), x(t)) with initial conditions (y(0), s(0), x(0)).

We calculate the control u at each time t by spatial discretization of (y(t), s(t), x(t)) using a grid (K • K • K). We assign at each node of the grid the correct mode. The mode refer to the adequate control u. We apply the mode which is at the nearest node at each instant. We assume that K = 20 and u can takes 300 values between 0 and 1. The control u is linked to the maximum cost of:

1 β+c t f 0 µ 2 (s(t))x(t)dt.
In Fig. 7.4, we give an example of dual-tank bioreactor with initial conditions (y(0), s(0), x(0)) = (5.657, 1.569 × 10 -6 , 6.463) and T f = 10, for a maximization of cost function over 1 day.

In Fig. 7.5, we show a simulation for a larger time period (100 days) with the same conditions as the previous example. Now in Fig. 7.6, we change the initial conditions to (y(0), s(0), x(0)) = (5.8, 0.01, 6.44) and T f = 10. This simulation present a maximization of cost function over 1 day. Comparing this experience with Fig. 7.4, we note that the two simulations have the same shape in the end.

In Fig. 7.7, we give a simulation when t f = 1000 (which corresponds to 100 days) with the same conditions as Fig. 7.6.

The CPU time taken for each experience is 3400 seconds.

We compare now the value of the cost function at t = t f between our method and Bocop. Using Bocop, the cost function at t = t f equal to 0.615. However, our method gives 1.4 as a value of cost function which is greater than the value returned by Bocop. Example 7.3. We consider a microgrid problem defined in [mic] « introduced and solved by Mixed-integer linear programming (MILP) techniques in [PBBL + 13]. In the context of an isolated village in the Chilean mountains, the microgrid is comprised of a diesel generator, photovoltaic panels and a battery energy storage system (BESS).

The aim is to satisfy the energy demand (power load) from the villagers at all times, while minimizing the overall diesel consumption. One of the difficulties is that the diesel generator has a turn-on cost, thus we have to keep track of its on/off state over time. This problem falls in the class of switched systems and can be solved with a dynamic programming approach.

We consider a fixed horizon t f = 48 hours. For t ∈ [0, t f ], we denote by P S (t) the solar power from the photovoltaic panels, P D(t) the diesel generator power and P L (t) the electricity load.

The state of charge SOC(t) of the BESS evolves according to .

SOC(t) = 1 Q B (P I (t)ρ I -P O (t)/ρ O ) = 1 Q B (P I (t) ∼ ρ -P O (t))
where Q B is the maximum capacity of the battery, P I , P O > 0 are the input and output power of the BESS, and ρ I , ρ O are the efficiency ratios for the charge and discharge processes, assumed constant.

We model the fuel consumption of the diesel generator by We transform the PDE into a system of ODEs. We thus consider that we have 1 oscillator of state SOC(t) with initial conditions SOC(0).

t f 0 KP D (t) 0.9 dt
We calculate the controls P D , P I and P O at each time t by spatial discretization of SOC(t) using a grid (K). We consider in this case that K = 20. We assign at each node of the grid the correct modes. The modes refer to the adequate controls P D , P I and P O . We apply the modes which are at the nearest node at each instant.

We assume that P D can take 51 values between 0 and 120, P I can take 23 values between 0 and 110 and P O can take 16 values between 0 and 15. The controls P D , P I and P O are linked to the minimum cost of: α t f 0 KP D (t) 0.9 dt + β∥P D + P S + P O -P L -P I ∥.

In Fig. 7.8, we give an example of microgrid energy management system with initial conditions SOC(0) = 0.76 and t f = 48. In the bottom-left, we illustrate x(t). In the bottom-right, we have the control u(t).

In Fig. 7.9, we show the corresponding controls where diesel consumption at t = t f equal to 26580. 18 The CPU time taken for each experience is 1200 seconds.

We compare now the value of the cost function at t = t f between our method and Bocop. Using Bocop, the cost function at t = t f equal to 27765.96. However, our method gives 26580.18 as a value of cost function which is lower than the value returned by Bocop.

Extension to systems with perturbation

Let us now show how the method extends to systems with "bounded perturbations", and assess its robustness. A differential system with "bounded perturbations" is of the form dy(t) dt = f u y(t), w(t) , with u ∈ U , t ∈ [0, τ ], states y(t) ∈ R d , and perturbations w(t) ∈ W ⊂ R d (W is compact, i. e., closed and bounded). See, e. g., [START_REF] Schürmann | Guaranteeing constraints of disturbed nonlinear systems using set-based optimal control in generator space[END_REF]. Any possible perturbation 98 7. Symbolic Euler's method and its application for controlled systems trajectory is thus bounded in W, and there exists ω ∈ R ≥0 such that ∀t ∈ [0, τ ], ∥w(t)∥ ≤ ω. Given a perturbation w ∈ W, we use Y u y 0 ,w (t) to denote the solution of dy(t) dt = f u (y(t), w(t)) for t ∈ [0, τ ] with y(0) = y 0 . We use Y u y 0 ,0 (t) (resp. Ỹ u y 0 (t)) to denote the solution (resp. the approximate Euler solution) without perturbations, i. e., when W = 0.

Given a pattern π = u k • • • u 1 ∈ U k , these notations extend naturally to t ∈ [0, kτ ] by considering the solutions obtained by applying successive modes u k , . . . , u 1 in a continuous manner. The optimization task is now to find a control pattern π ∈ U k which guarantees that all states in S ⊂ R d are steered at time t = kτ as closely as possible to an end state y end , despite the perturbation set W.

We suppose (see [LCADSC + 17]) that, for all u ∈ U , there exist constants λ u ∈ R and γ u ∈ R ≥0 such that, for all y 1 , y 2 ∈ T and w 1 , w 2 ∈ W:

⟨f u (y 1 , w 1 ) -f u (y 2 , w 2 ), y 1 -y 2 ⟩ ≤ λ u ∥y 1 -y 2 ∥ 2 + γ u ∥y 1 -y 2 ∥∥w 1 -w 2 ∥ (7.5)
This formula can be seen as a generalization of Eq. (E.6) (see Section 7.3.1). Recall that λ u has to be computed in the absence of perturbation (W = 0). The additional constant γ u is used for taking into account the perturbation w. Given λ u , the constant γ u can be computed itself using a nonlinear optimization solver. Instead of computing them globally for T , it is advantageous to compute λ u and γ u locally depending on the subregion of T occupied by the system state during a considered interval of time ∆t. Note that the notion of contraction (often used in the literature [MS13, AS14]) corresponds to the case where λ u is negative on the whole space set of interest. (Here, λ u can be positive, at least locally, see Remark 3.)

We now give a version of Proposition 7.3 with bounded perturbation w(•) ∈ W, originally proved in [LCADSC + 17].

Proposition 7.4 ([LCADSC + 17]). Consider a sampled switched system with bounded perturbation of the form { dy(t)

dt = f u (y(t), w(t))} u∈U satisfying Eq. (7.5).

Consider a point y 0 ∈ S of ε-representative z 0 ∈ X . We have, for all u ∈ U , t ∈ [0, τ ] and w(t) with ∥w(t)∥ ≤ ω:

∥Y u y 0 ,w (t) -Ỹ u z 0 (t)∥ ≤ δ u ε,W (t) (or: B( Ỹ u z 0 (t), δ u ε,W (t)) ⊇ {y(•) | ∃w(•) ∈ W : ẏ(t) = f u (y(t), w(t)) for all t ∈ [0, kτ ] ∧ y(0) = y 0 }) with: • if λ u < 0, δ u ε,W (t) = C 2 u -λ 4 u -λ 2 u t 2 -2λ u t + 2e λut -2 + 1 λ 2 u 2C u γ u ω -λ u -λ u t + e λut -1 + λ u γ 2 u ω 2 -λ u (e λut -1) + λ u ε 2 e λut 1/2 (7.6) • if λ u > 0, δ u ε,W (t) = 1 (3λ u ) 3/2 C 2 u λ u -9λ 2 u t 2 -6λ u t + 2e 3λut -2) + 3λ u 2C u γ u ω λ u -3λ u t + e 3λut -1 + 3λ u γ 2 u ω 2 λ u (e 3λut -1) + 3λ u ε 2 e 3λut 1/2 (7.7) • if λ u = 0, δ u ε,W (t) = C 2 u -t 2 -2t + 2e t -2 + 2C u γ u ω -t + e t -1 + γ 2 u ω 2 (e t -1) + ε 2 e t 1/2 (7.8) Let B u W (t) ≡ B( Ỹ u z 0 (t), δ u ε,W (t)
). Proposition 7.4 expresses that, for t ∈ [0, τ ], the tube B u W (t) contains all the solutions Y u y 0 ,w (t) with ∥y 0 -z 0 ∥ ≤ ε and w ∈ W, and is therefore robustely (positive) invariant. The function δ u W : [0, τ ] → R d extends continuously to δ π ε,W : [0, kτ ] → R d for a sequence π of k modes, and the robust invariance property now holds for t ∈ [0, kτ ]. The function extends further continuously to δ π * ε,W (•), when considering the iterated application of sequence π, and robust invariance property now holds for all t ≥ 0. Under the iterated application of π, we denote by Y π * y 0 ,w (t) the exact solution at time t, of the system with perturbation w ∈ W and initial condition y 0 . Likewise, we denote by Ỹ π * z 0 (t) (or sometimes just Ỹ (t)) the approximate Euler solution at time t, of the system without perturbation, with initial condition z 0 .

In the following we assume that the bound ω of the perturbation W is large enough so that, for all ε ≥ 0 and all local rate of contraction -λ:

(H) δ ε,W (∆t) ≥ εe λ∆t .
100 7. Symbolic Euler's method and its application for controlled systems

An Approximation of Minimax Control using Random Sampling and

This section hails essentially from [START_REF] Jerray | An approximation of minimax control using random sampling and symbolic computation[END_REF].

Introduction

A control is said to be robust if it ensures a certain level of performance despite the presence of perturbation. There are generally two ways to model a perturbation: either we know a distribution law for the perturbation (probabilistic approach), or we only know that the perturbation is prescribed to a compact domain (bounded uncertainty) (see, e. g., [START_REF] Mesbah | Stochastic model predictive control: An overview and perspectives for future research[END_REF]). In the first case, the performance of the system is generally expressed in terms of "expectations of the cost" (see, e. g., [CHZ03, KMLV09, CDL + 14, DMP + 15, GJ10, PRG16, WQCD16, RFM + 18, AGLP18]). In the second case, the criterion is rather the "worst-case performance" (see, e. g., [START_REF] Wu | Minimax optimal control of linear system with input-dependent uncertainty[END_REF]).

In this chapter, we adopt the second approach (bounded uncertainty). In such a framework, a pioneering paper is that of [START_REF] Dimitri | On the minimax reachability of target sets and target tubes[END_REF], which expresses robustness in the form of a "minimax" (or "min-max") control, i. e., the control that ensures minimum (optimal) performance under the worst-case scenario of perturbation. The paper [START_REF] Dimitri | On the minimax reachability of target sets and target tubes[END_REF] focuses on linear systems and is interested in reachability issues. Since then, minimax control has handled more general optimization problems for systems with non-linear dynamics, in the context of Model Predictive Control (MPC) in particular (see, e. g., [MV93, MPG95, BM98, Löf03b, Löf03a, RLL + 09]). These minimax control methods basically rely on the use of set-based (or "symbolic") methods to describe the entire state trajectory under the form of a "tube containing the desired trajectory under all possible disturbances" [START_REF] Dimitri | On the minimax reachability of target sets and target tubes[END_REF]. However, such methods often present a major complexity problem, and simplified versions have been created to overcome this drawback. These methods often make use of "gradient descent" techniques, and rely on appropriate assumptions of convexity of the optimization domain in order to avoid to be stuck in local minima (see, e. g., [START_REF] Zheng | Stability of model predictive control with mixed constraints[END_REF][START_REF] Bemporad | Robust model predictive control: A survey[END_REF]).

Here, we present such an approximate model of minimax control, which is efficient without resorting to any gradient descent technique or convexity hypothesis. Basically, we generalize the "tube-based" method of [START_REF] Dimitri | On the minimax reachability of target sets and target tubes[END_REF] in order to handle non-linear systems and account for more general objectives than problems related to reachability. In order to overcome the problem of complexity, we use a random sampling method which allows us to synthesize a control that satisfies the desired performance specification for most values of the uncertainties, i. e., with an a priori specified (high) probability (see [START_REF] Vidyasagar | Randomized algorithms for robust controller synthesis using statistical learning theory[END_REF]). Besides, our method can easily be extended in order to account for specified

An Approximation of Minimax Control using Random Sampling and Symbolic Computation 101

constraints on the state of the system. We illustrate the interest of this approximate minimax control on an example of a biochemical reactor (see [START_REF] Houska | Approximate robust optimization of time-periodic stationary states with application to biochemical processes[END_REF]).

Method

We consider a dynamic system with input (or control) u(•) and a bounded perturbation function w(•) over a domain W (bounded uncertainty). The system is a switched system with a finite set of modes (see, e. g., [START_REF] Girard | Approximately bisimilar symbolic models for incrementally stable switched systems[END_REF]): The control u(•) is a piecewise constant function from R ≥0 to a finite set U of "modes", and the function changes of value only at times t = τ, 2τ, . . . . We consider, moreover, the problem of control with a finite horizon T = Kτ for some positive integer K, so that the set of possible controls of the system for t ∈ [0, T ] is itself finite and can be described by the set U ≡ U K . We suppose given a cost function C : R d × U K → R ≥0 , which, having given z 0 ∈ R d , ε > 0 and a control law u, allows calculating the value T 0 C(x(t), u(t))dt for any solution x(t) with initial condition x 0 ∈ B(z 0 , ε) of ẋ(t) = f (x(t), u(t), w(t)) for t ∈ [0, T ] associated with some bounded perturbation w(t) over W.

In this context, the minimax method aims at finding a control v defined by:

v = arg min u∈U K max x(•) J z 0 ,ε (x(•), u(•)) with J z 0 ,ε (x(•), u(•)) ≡ T 0 C(x(t), u(t))dt | ∃w(•) ∈ W : ẋ(t) = f (x(t), u(t), w(t)) for t ∈ [0, T ] ∧ x(0) ∈ B(z 0 , ε) .
Since the minimax methods are excessively complex (even in the sampled and finitehorizon setting), simplified variants of the minimax problem have been developed (see, e. g., [START_REF] Bemporad | Robust model predictive control: A survey[END_REF]). We propose here such a simplified method composed of two steps.

First step

In a first step, using an Euler-based symbolic computation method, we will first obtain an upper-bound

K z 0 ,ε (u(•)) of max x(•) J z 0 ,ε (x(•), u(•)) with K z 0 ,ε (u(•)) ≡ max x(•)∈B(x u(•) z 0 (•),δ u(•) ε,D (•)) { T 0 C(x(
∈ R d , • δ u(•)
ε,W (•) denotes the function defined in Proposition 7.4 (see Section 7.3.4), and 102 7. Symbolic Euler's method and its application for controlled systems

• x(•) ∈ B(x u(•) z 0 (•), δ u(•) ε,W (•)) means, for all t ∈ [0, T ]: x(t) ∈ B(x u(•) z 0 (t), δ u(•)
ε,W (t)). In particular x(0) ∈ B(z 0 , ε).3 Proposition 7.5. We have, for all u(•) ∈ U K :

max x(•) J z 0 ,ε (x(•), u(•)) ≤ K z 0 ,ε (u(•)), Proof. max x(•) J z 0 ,ε (x(•), u(•)) = max x(•) { T 0 C(x(t), u(t)dt | ∃w(•) ∈ W : ẋ(t) = f (x(t), u(t), w(t)) for t ∈ [0, T ] ∧ x(0) ∈ B(z 0 , ε)} ≤ max x(•)∈B(x u z 0 (•),δ u(•) ε,W (•)) { T 0 C(x(t), u(t))} (since, for x(0) ∈ B(z 0 , ε), we have: B(x u z 0 (•), δ u(•) ε,W (•)) ⊇ {x(•) | ∃w(•) ∈ W : ẋ(t) = f (x(t), u(t), w(t)) for t ∈ [0, T ] ∧ x(0) ∈ B(z 0 , ε)}; see Proposition 7.4 in Section 7.3.4) = K z 0 ,ε (u(•)).

Second step

In a second step, as the number of controls u(•) ∈ U K is exponential in K, and therefore explodes combinatorially, we will not consider the absolute minimum, but a probable near-minimum of K z 0 ,ε (u(•)) (see [START_REF] Vidyasagar | Randomized algorithms for robust controller synthesis using statistical learning theory[END_REF]). Definition 7.3. [START_REF] Vidyasagar | Randomized algorithms for robust controller synthesis using statistical learning theory[END_REF] Suppose g : Y → R, that P is a given probability measure on Y , and that α, β > 0 are given numbers. A number g 0 ∈ R is said to be a probably approximate near-minimum of g(•) to accuracy α and level β, if g 0 ≥ g * ≡ inf y∈Y g(y) -α, and in addition

P [y ∈ Y : g(y) < g 0 -α] ≤ β.
The probably approximate near-minimum of K z 0 ,ε is obtained by drawing randomly N control u 1 , • • • , u N of U K , i. e., by generating N independent identically distributed (i.i.d.) samples u 1 , • • • , u N of U K , with a uniform probability (i. e., with probability 1/|U | N ) then by taking

K z 0 ,ε (u * N ) with u * N = arg min u 1 ,••• ,u N K z 0 ,ε (u i ).
We recall from [START_REF] Vidyasagar | Randomized algorithms for robust controller synthesis using statistical learning theory[END_REF]:

An Approximation of Minimax Control using Random Sampling and Symbolic Computation 103

Proposition 7.6. [START_REF] Vidyasagar | Randomized algorithms for robust controller synthesis using statistical learning theory[END_REF] Draw randomly

N controls u 1 , • • • , u N of U K (i. e., generate N i.i.d. samples u 1 , • • • , u N of U K with a uniform probability). Let u * N = arg min u 1 ,••• ,u N K z 0 ,ε (u i ). Then K z 0 ,ε (u * N ) is a probable near-minimum of K z 0 ,ε (u) for u ∈ U K to level α and confidence 1-β (i. e., K z 0 ,ε (u * N ) ≈ α,1-β min u∈U K K z 0 ,ε (u)) provided that N ≥ ln(1/β) ln(1/(1-α)) .
Remark 6. Note that even if N < ln(1/β) ln(1/(1-α)) , we have:

K z 0 ,ε (u * N ) ≥ min u∈U K K z 0 ,ε (u) ≥ min u∈U K max x(•) J z 0 ,ε (x(•), u(•))
(by Proposition 7.5). Therefore, random sampling on the set of controls always yields a suboptimal result.

From Propositions 7.5 and 7.6, it follows:

Proposition 7.7. Draw N independent samples u 1 , . . . , u N distributed uniformly on

U K . Let u * N = arg min u 1 ,••• ,u N K z 0 ,ε (u i ).
Then, we have:

min u∈U K max x(•) J z 0 ,ε (x(•), u(•)) ≤ K z 0 ,ε (u * N ) (≈ α,1-β min u∈U K K z 0 ,ε (u) provided that N ≥ ln(1/β) ln(1/(1-α)) ).

Note that u *

N is an open-loop control. With respect to classical robust methods, our method allows us to avoid:

• the excessive complexity of minimax methods,

• the use of a feedback ancillary control as used in the MPC-tube methods,

• the use of samples of large size, as is often the case in statistical learning, when one wants to calculate the (expected) evaluation of the cost function with precision and confidence.

Besides, the method is easily extended to take into account constraints on the state of the system during its evolution. Such a consideration of a set of constraints C on the state is classic within the framework of a random sampling procedure (see, e. g., [START_REF] Bemporad | Robust model predictive control: A survey[END_REF][START_REF] Dunlap | Sampling based model predictive control with application to autonomous vehicle guidance[END_REF][START_REF] Giuseppe C Calafiore | Research on probabilistic methods for control system design[END_REF]). In our context, it suffices in Proposition 7.7 to replace

u * N = arg min u 1 ,••• ,u N K z 0 ,ε (u i ) by u * N = arg min u∈U ′ K z 0 ,ε (u i )
, where U ′ contains the only elements of {u 1 , • • • , u N } under the control of which the state x(t) always satisfies C. (This requires the inclusion of a satisfaction test of C for each u i with 1 ≤ i ≤ N .)

Example

The implementation has been done in Python and corresponds to a program of around 500 lines. The source code is available at lipn.univ-paris13.fr/~jerray/ orbitador/MCRS/. In the experiments below, the program runs on a 2.80 GHz Intel Core i7-4810MQ CPU with 8 GiB of memory.

Example 7.4. We consider a biochemical process model Y of continuous culture fermentation (See [START_REF] Houska | Approximate robust optimization of time-periodic stationary states with application to biochemical processes[END_REF] as well as [AKR89, KSC93, Par00, RC08]). Let x(t) = (X(t), S(t), P (t)) ∈ R 3 satisfies the differential system:

         .

X(t) = -DX(t) + µ(t)X(t)

.

S(t) = D S f (t) -S(t) -µ(t)X(t) Y x/s . P (t) = -DP + αµ(t) + β X(t) (7.9)
where X denotes the biomass concentration, S the substrate concentration, and P the product concentration of a continuous fermentation process. The model is controlled by

S f ∈ [S min f , S max f ].
While the dilution rate D, the biomass yield Y x/s , and the product yield parameters α and β are assumed to be constant and thus independent of the actual operating condition, the specific growth rate µ : R → R of the biomass is a function of the states:

µ(t) = µ m 1 -P (t) Pm S(t) K m + S(t) + S(t) 2 K i
The parameters values are listed in Table 7.1.

The goal is to maximize the average productivity presented by the cost function: with x(0) ∈ B(z 0 , ε) while satisfying the constraint on the state X:

J z 0 ,ε (x(•), S f (•)) = 1 T T 0 DP (t
1 T T 0 X(t)dt ≤ 5.8 (7.11)
The set S ⊂ R d that is controlled Euler-invariant for the system with null perturbation (see Section 7.3.1.2) is here equal to [3, 8] × [10, 28] × [15.5, 25.5].

The codomain [28.7, 40] of the original continuous control function S f (•) is discretized into a finite set U , for the needs of our method. After discretization, S f (•) is a piecewise-constant function that takes its values in the finite set U made of 2 values uniformly taken in {28.7, 40}. The function S f (•) changes (possibly) its value every τ seconds.

We take: z 0 = (6.52, 12.5, 22.40), ε = 0, τ = 3, ∆t = τ /1004 , T = 48, K = T /τ = 16. We consider an additive perturbation w with w(•) ∈ W = [-0.05, 0.05]. The values of λ and γ are computed locally and vary from +5.0 to -0.12, and from 0 to 1 respectively. The parameters λ and γ are used to calculate δ u * ε,W (t).

In total, we have 2 k = 2 16 possible control cases. We then perform 3 experiences:

1. We randomly pick one sample over every 100 possible controls, which gives 2 16 /100 ≈ 655 samples.

2. We randomly pick one sample over every 10 possible controls, which gives 2 16 /10 ≈ 6, 554 samples.

3. We consider all the possible controls, which gives 2 16 = 65, 536 samples. (The computation is tractable in this example because the set U contains only 2 modes, and because the length K of the horizon is moderate.) 106 7. Symbolic Euler's method and its application for controlled systems

For each experience, we select the control sequence u * that optimizes the cost function (Eq. (7.10)) while satisfying the constraint on the state X (Eq. (7.11)). These 3 experiences give the following results:

1. The control u * is depicted in Fig. 7.10 (top), and the result on P (t) is depicted in Fig. 7.10 (bottom). The red curve represents the Euler approximation xu * z 0 (t) of the solution without perturbation (w = 0) as a function of time t in the plan P using u * . The green curves correspond, in the P plan, to the borders of the tube centered around the red curve, that is B(t) ≡ B(x u * z 0 (t), δ u * ε,W (t)) with xu * z 0 (0) = z 0 and δ u * ε,W (0) = ε = 0 (see Definition 7.2). We get: K z 0 ,ε (u * ) = 3.1618 (the constraint on the state X is satisfied since 1 T T 0 X(t)dt = 5.782 ≤ 5.8). The CPU computation time of this example is 7 seconds.

2. The control u * is depicted in Fig. 7.11 (top), and the result on P (t) is depicted in Fig. 7.11 (bottom). We get: K z 0 ,ε (u * ) = 3.1667. (the constraint on the state X is satisfied since 1 T T 0 X(t)dt = 5.794 ≤ 5.8) The CPU computation time of this example is 18.69 seconds.

3. The control u * is represented in Fig. 7.12 (top), while Fig. 7.12 (bottom) shows the result on P (t) of applying u * . We get: K z 0 ,ε (u * ) = 3.1677 (the constraint is satisfied since 1 T T 0 X(t)dt = 5.7995 ≤ 5.8). The CPU computation time of this example is 200 seconds.

We can see on these 3 experiments that, despite the multiplication by 10 each time of the number of samples (which leads to a multiplication of the CPU time by 3 and then by 10), the optimal cost K increases only slightly (here, the optimum K corresponds to a "maximin", not a "minimax" as described in Section 7.4.2). The results are comparable to those obtained by [START_REF] Houska | Approximate robust optimization of time-periodic stationary states with application to biochemical processes[END_REF], despite the use of a much simpler method (without gradient descent).5 This experiment thus illustrates the interest of our method by symbolic computation coupled with random sampling.

In Example C.2 (in Appendix C.6), we give an extension of Example C.2 where the finite set U is made of 3 values uniformly taken in {28.7, 40}. instead of 2 values.

Search a control that maintains the periodicity

Example 7.5. We consider again the biochemical process example defined in Example E.1. We take here z 0 = (6.52, 12.5, 22.40), ε = 0.1, τ = 6, ∆t = τ /1200 and w(•) ∈ W = [-0.01, 0.01]. In this experience, we select, from all the 2 8 possible control cases, the control sequence u * that optimizes the cost function (Eq. (7.10)) while satisfying the constraint on the state X (Eq. (7.11)) and the periodicity. We get: the control sequence u * = [40.0, 40.0, 28.7, 40.0, 28.7, 28.7, 28.7, 28.7] and the cost function K z 0 ,ε (u * ) = 3.05531278637455 (the constraint is satisfied since

An Approximation of Minimax Control using Random Sampling and

1 T T 0 X(t)dt = 5.762832783059367 ≤ 5.8).
We repeat this control sequence for 4 periods in order to check if there is an invariant set as defined in Section 8.1.2. We find:

x(0) = (6.52, 12.5, 22.4), δ W (0) = 0.1 x(T ) = (6.41716821, 12.88269576, 22.12447169), δ W (T ) = 0.4012066523089154 x(2T ) = (6.41333272, 12.89237801, 22.10498929), δ W (2T ) = 0.43189334897336074 x(3T ) = (6.41339481, 12.89222284, 22.10519839), δ W (3T ) = 0.405053277371014 x(4T ) = (6.41339565, 12.89222076, 22.10520337), δ W (4T ) = 0.4015446938437213.

We have: B ε,W (3T ) ⊂ B ε,W (2T ), i.e.: B ε,W ((i 0 + 1)T ) ⊂ B ε,W (i 0 T ) for i 0 = 2. 108 7. Symbolic Euler's method and its application for controlled systems Example 7.6. We consider again the biochemical process example defined in Example E.1. We take here z 0 = (6.52, 12.5, 22.40), ε = 0.1, τ = 4, ∆t = τ /800 and w(•) ∈ W = [-0.01, 0.01]. In this experience, we select, from all the 2 12 possible control cases, the control sequence u * that optimizes the cost function (Eq. (7.10)) while satisfying the constraint on the state X (Eq. (7.11)) and the periodicity.

We get: the control sequence u * = [40.0, 40.0, 40.0, 40.0, 40.0, 28.7, 28.7, 28.7, 28.7, 28.7, 28.7, 28.7] and the cost function K z 0 ,ε (u * ) = 2.9819027540810454 (the constraint is satisfied since

1 T T 0 X(t)dt = 5.622078165864359 ≤ 5.8).
We repeat this control sequence for 4 periods in order to check if there is an invariant set as defined in Section 8.1.2. We find:

x(0) = (6.52, 12.5, 22.4), δ W (0) = 0.1 x(T ) = (6.43476685, 12.77392689, 22.10591651), δ W (T ) = 0.41905446781605554 x(2T ) = (6.43252247, 12.77958314, 22.09454207), δ W (2T ) = 0.44881421592844783

An Approximation of Minimax Control using Random Sampling and

x(3T ) = (6.43255426, 12.77950369, 22.0946442), δ W (3T ) = 0.3945243591434912

x(4T ) = (6.432555, 12.77950184, 22.09464799), δ W (4T ) = 0.4370536635376794.

We have:

B ε,W (3T ) ⊂ B ε,W (2T ), i.e.: B ε,W ((i 0 + 1)T ) ⊂ B ε,W (i 0 T ) for i 0 = 2.
Fig. 7.14 shows the approximate Euler solution of x in red, the control sequence, the invariant I in green and its radius δ W (t). The control sequence search time is 195 seconds and the computation takes 1260 seconds of CPU time.

Example 7.7. We consider again the biochemical process example defined in Example E.1. We take here z 0 = (6.52, 12.5, 22.40), ε = 0.1, τ = 3, ∆t = τ /1200 and w(•) ∈ W = [-0.01, 0.01]. In this experience, we select, from 6554 control cases choosing randomly from all the 2 16 possible control cases, the control sequence u * that optimizes the cost function (Eq. (7.10)) while satisfying the constraint on the state X (Eq. (7.11)) and the periodicity. 110 7. Symbolic Euler's method and its application for controlled systems We get: the control sequence u * = [40.0, 40.0, 40.0, 40.0, 40.0, 28.7, 28.7, 40.0, 28.7, 28.7, 28.7, 28.7, 28.7, 28.7, 28.7, 28.7] and the cost function K z 0 ,ε (u * ) = 3.0470735325260314 (the constraint is satisfied since 1 T T 0 X(t)dt = 5.751187667683308 ≤ 5.8).

We repeat this control sequence for 4 periods in order to check if there is an invariant set as defined in Section 8.1.2. We find:

x(0) = (6.52, 12.5, 22.4), δ W (0) = 0.1 x(T ) = (6.49460463, 12.64681063, 22.3940334), δ W (T ) = 0.417523353848292

An Approximation of Minimax Control using Random Sampling and

x(2T ) = (6.49201155, 12.65335538, 22.38160201), δ W (2T ) = 0.5027104415729283

x(3T ) = (6.49204079, 12.65328231, 22.38168693), δ W (3T ) = 0.42222636557122256

x(4T ) = (6.49204142, 12.65328075, 22.38169034), δ W (4T ) = 0.4323415458918441.

We have: B ε,W (3T ) ⊂ B ε,W (2T ), i.e.: B ε,W ((i 0 + 1)T ) ⊂ B ε,W (i 0 T ) for i 0 = 2. Fig. 7.15 shows the approximate Euler solution of x in red, the control sequence, the invariant I in green and its radius δ W (t). The control sequence search time is 723 seconds and the computation takes 3220 seconds of CPU time. Example 7.8. We consider again the biochemical process example defined in Example E.1. We take here z 0 = (6.52, 12.5, 22.40), ε = 0.1, τ = 2, ∆t = τ /1200 and w(•) ∈ W = [-0.01, 0.01]. In this experience, we select, from 16777 control cases

An Approximation of Minimax Control using Random Sampling and Symbolic Computation 113

choosing randomly from all the 2 24 possible control cases, the control sequence u * that optimizes the cost function (Eq. (7.10)) while satisfying the constraint on the state X (Eq. (7.11)) and the periodicity.

We get: the control sequence u * = [40.0, 40.0, 40.0, 40.0, 40.0, 40.0, 40.0, 28.7, 40.0, 28.7, 40.0, 28.7, 28.7, 28.7, 28.7, 28.7, 28.7, 28.7, 28.7, 28.7, 28.7, 28.7, 28.7, 28.7] and the cost function K z 0 ,ε (u * ) = 3.042700158904687 (the constraint is satisfied since 1 T T 0 X(t)dt = 5.744236785244066 ≤ 5.8). We repeat this control sequence for 4 periods in order to check if there is an invariant set as defined in Section 8.1.2. We find:

x(0) = (6.52, 12.5, 22.4), δ W (0) = 0.1 x(T ) = (6.52882162, 12.53007531, 22.50237533), δ W (T ) = 0.6792257292088323

x(2T ) = (6.52711033, 12.53439235, 22.49465237), δ W (2T ) = 0.41200867041384653 x(3T ) = (6.52712177, 12.53436378, 22.49467265), δ W (3T ) = 0.5042660098628413

x(4T ) = (6.52712224, 12.53436261, 22.49467501), δ W (4T ) = 0.5715581347559725.

We have:

B ε,W (2T ) ⊂ B ε,W (T ), i.e.: B ε,W ((i 0 + 1)T ) ⊂ B ε,W (i 0 T ) for i 0 = 1.
Fig. 7. [START_REF]dLBK +[END_REF] shows the approximate Euler solution of x in red, the control sequence, the invariant I in green and its radius δ W (t). The control sequence search time is 1403 seconds and the computation takes 3472 seconds of CPU time.

Conclusion

As explained in [START_REF] Houska | Robust Optimization for MPC, chapter Robust optimization for MPC[END_REF] (in the context of model predictive control), although exact minimax control problems are intractable in general, new tools, based on recent developments in the field of symbolic (or "set-valued") computation are opening new perspectives for the robust treatment of optimal problems. We have explored here such a path by showing that the simple combination of random sampling with a symbolic computation method (based on Euler's integration method) allows us to deal with robust optimization problems for nonlinear systems on non-convex domains, without resorting to sophisticated theories such as analysis of viscosity solutions of the Hamilton-Jacobi-Bellman-Isaacs equation or Pontryagin's maximum principle (see, e. g., [START_REF] Liberzon | Calculus of variations and optimal control theory: a concise introduction[END_REF]). The method has been illustrated on an example of biochemical reactor.

114 7. Symbolic Euler's method and its application for controlled systems

Generation of bounded invariants via stroboscopic set-valued maps

In this chapter, we present a method for generating a bounded invariant of a differential system with a given set of initial conditions around a point x 0 .

Contents

Generation of bounded invariants without control

This section derives from the work that has been published in [START_REF] Jerray | Determination of limit cycles using stroboscopic set-valued maps[END_REF]. Compared to Chapter 7, we add , in this section, a method that generates an invariant set I which allows to guarantee the existence of a limit cycle L that attracts the approximate Euler solutions of Σ as defined in Section 8.1.2.

Introduction

Given a differential system Σ : dx/dt = f (x) of dimension d, an initial point x 0 ∈ R d , a real ε > 0, and a ball B 0 = B(x 0 , ε)1 , we present here a simple method allowing to find a bounded invariant set of Σ containing the trajectories starting at B 0 . This invariant set has the form of a tube whose center at time t is the Euler approximate solution x(t) of the system starting at x 0 , and radius is a function δ ε (t) bounding the distance between x(t) and an exact solution x(t) starting at B 0 . The tube can thus be described as t≥0 B(t) where B(t) ≡ B(x(t), δ ε (t)).

To find a bounded invariant, we then look for a positive real T such that B((i + 1)T ) ⊆ B(iT ) for some i ∈ N. In case of success, the ball B(iT ) is guaranteed to contain the "stroboscopic" sequence {B(jT )} j=i,i+1,... of sets B(t) at time t = iT, (i + 1)T, . . . .

It follows that the bounded portion t∈[iT,(i+1)T ] B(t) is equal to t∈[iT,∞) B(t), and thus constitutes the sought bounded invariant set.

We apply the finding of such a (forward) invariant set to the analysis of parameterized time-periodic differential systems. We illustrate our results on the example of a parametric Van der Pol system driven by a common periodic input.

Comparison with related work

We explain here some similarities and differences of our method with several kinds of related work.

• There exists a trend of work on the generation of torus-shaped invariants using stroboscopic maps of quasi-periodic systems with possible parameters (see, e.g., [START_REF] Baresi | Quasi-periodic invariant tori of timeperiodic dynamical systems: Applications to small body exploration[END_REF][START_REF] Gómez | The dynamics around the collinear equilibrium points of the RTBP[END_REF][START_REF] Zubin | Numerical method for computing quasi-periodic orbits and their stability in the restricted three-body problem[END_REF]). A first difference is that these works consider stroboscopic mappings of points of R d , while our stroboscopic maps apply to sets of points.

A second difference is that they often use a Fourier analysis in the frequency domain (using, e.g., the notion of "radii polynomials" [START_REF] Castelli | Rigorous numerics in Floquet theory: computing stable and unstable bundles of periodic orbits[END_REF]) while we remain in the time domain.

• Our method makes use of a rigorous time-integration method in order to enclose the exact solutions with tubes, which is similar to what is done using high order of Taylor method in ODE integration as proposed by Lohner or Taylor models [START_REF] Lohner | Enclosing the solutions of ordinary initial and boundary value problems[END_REF][START_REF] Zgliczynski | C1 Lohner algorithm[END_REF]. Such methods are used in [START_REF] Castelli | Rigorous numerics in Floquet theory: computing stable and unstable bundles of periodic orbits[END_REF][START_REF] Kapela | Computer assisted proofs for nonsymmetric planar choreographies and for stability of the eight[END_REF] to rigorously compute the eigenvalues of a so-called "monodromy matrix", which allows to determine the linear stability of the equilibrium points of the system. Unlike these works, our stability analysis does not try to compute such eigenvalues of monodromy matrices.

• Our method shares also some common features with the works of [APS08, [START_REF] Aminzare | Contraction methods for nonlinear systems: A brief introduction and some open problems[END_REF][START_REF] Bouwe Van Den | A general framework for validated continuation of periodic orbits in systems of polynomial ODEs[END_REF], which aim at proving a contractivity property of the system (i.e., that any two solutions converge exponentially to each other). In [START_REF] Aminzare | Contraction methods for nonlinear systems: A brief introduction and some open problems[END_REF], contractivity amounts to the finding of a negative definitive quadratic form (which is equivalent to the existence of a Lyapunov function for the system). In [START_REF] Aylward | Stability and robustness analysis of nonlinear systems via contraction metrics and SOS programming[END_REF], "Squaresof-Sum programming is used to find ranges of uncertainty under which a system with uncertain perturbations is always contracting with the original contraction metric". In [START_REF] Bouwe Van Den | A general framework for validated continuation of periodic orbits in systems of polynomial ODEs[END_REF], they turn the stability problem into the contractivity of a fixed point operator that is checked with the assistance of a computer. The difference here is that we do not try to prove a contractivity property, but only the existence of two set-valued snapshots, one of which is included in the other one. This is a much weaker property and easier to prove.

Our method is simple, efficient, and allows us to construct a cyclic approximate solution L (using Euler's method) together with a (forward) invariant set I around L. Note however that, even if the approximate and exact solutions are very close in practice, our method does not guarantee the formal existence of cyclic exact solutions inside I, which requires more technical methods such as Poincaré maps.

Outline

In Section 8.1.2, we present our method, then explain how to apply it to the analysis of parameterized systems in Section 8.1.3. We conclude in Section 8.1.4.

Method

Correctness

Consider a differential system Σ : dx/dt = f (x, w) with w ∈ W, an initial point x 0 ∈ R d , a real ε > 0 and a ball B 0 = B(x 0 , ε). Let B W (t) denote B(x(t), δ ε,W (t)) where x(t) is the Euler approximate solution of the system without uncertainty and 118 8. Generation of bounded invariants via stroboscopic set-valued maps initial condition x 02 . It follows from Proposition 7.2 that t≥0 B W (t) is an invariant set containing B 0 . We can make an a stroboscopic map of this invariant. by considering periodically the set B W (t) at the moments t = 0, T, 2T , etc., with T = kτ for some k (τ is the time-step used un Euler's method).

If moreover, we can find an integer i ≥ 0 such that B W ((i + 1)T ) ⊆ B W (iT ), then we have B W (iT ) = j=i,i+1,... B W (jT ) and t∈[iT,(i+1

)T ] B W (t) = t∈[iT,∞) B W (t). The set t∈[iT,(i+1)T ] B W (t)
is thus a bounded invariant set which contains all the solutions x(t) starting at B 0 , for t ∈ [iT, ∞). In the phase space, this invariant set has a "torus" shape. We have: Proposition 8.1. Suppose that there exist T = kτ with k ∈ N, and i ∈ N such that:

B W ((i + 1)T ) ⊆ B W (iT ).
Then I W ≡ t∈[0,T ] B W (iT + t) is a compact (i.e., bounded and closed) invariant set containing, for t ∈ [iT, ∞), all the solutions x(t) of Σ with initial condition in B 0 .

Consider a differential system Σ W : dx/dt = f (x, w) with w ∈ W, an initial point x 0 ∈ R d , a real ε > 0 and a ball B 0 = B W (x 0 , ε). Let B W (t) denote B(x(t), δ ε,W (t))
where x(t) is the Euler approximate solution of the system without uncertainty and initial condition x 0 . It follows from Proposition 7.2 that t≥0 B W (t) is an invariant set containing B 0 . If moreover, we can find an integer i ≥ 0 and a real T = kτ (for some k ∈ N) such that B W ((i + 1)T ) ⊆ B W (iT ), then the set I W = t∈[iT,(i+1)T ] B W (t) is a bounded invariant which contains all the solutions x(t) of Σ W starting at B 0 , for t ∈ [iT, ∞). In the phase space, this bounded invariant has a "torus" shape. We have (see [START_REF] Jerray | Determination of limit cycles using stroboscopic set-valued maps[END_REF]): Proposition 8.2. Suppose that there exist T > 0 (with T = kτ for some k) and i ∈ N such that: B W ((i + 1)T ) ⊆ B W (iT ). Then I W ≡ t∈[iT,(i+1)T ] B W (t) is a compact (i.e., bounded and closed) invariant set containing, for t ∈ [iT, ∞), all the solutions of Σ W with initial condition in B 0 . The set I W is also an invariant for the unperturbed system Σ.

Proof. All solutions x(t) of Σ W starting from B 0 are contained for t = (i + 1)T in B W ((i + 1)T ) by Proposition 7.2, hence in B W (iT ) by inclusion hypothesis. A solution starting from B W ((i + 1)T ) ⊆ B W (iT ) after an additional time t ′ = T finds itself in in B W ((i + 1)T ) ⊆ B W (iT ). And so on, any solution of I W starting from B W (iT ) returns periodically (with period T ) in B W (iT ). Similarly, any point of B W (iT + t ′ ) with t ′ ∈ [0, T ) returns periodically (with period T ) in B W (iT + t ′ ). The set I W = t∈[iT,(i+1)T ] B W (t) is thus an invariant of Σ W . It is also an invariant set for the unperturbed system Σ corresponding to the particular case W = 0. Theorem 8.1. Suppose that there exist T > 0 (with T = kτ for some k) and i ∈ N such that: B W ((i + 1)T ) ⊆ B W (iT ). Then there exists a closed orbit (limit cycle or fixed-point) for the unperturbed system Σ which is contained in I W .

Proof. (Sketch) Consider a section V tranverse to the flow of the unperturbed system Σ, and the "first return map" (or Poincaré map) T from V ∩ I W to V . This mapping is known to be continuous (and even differentiable). Besides T (V ∩ I W ) ⊆ V ∩ I W because I W is an invariant set of Σ. Therefore, by Brouwer's fixed-point theorem, there is a point M ∈ V ∩ I W such that T (M ) = M . It follows that the solution of Σ starting at M returns to M after some time, say T * . This defines a closed periodic orbit of Σ passing by M of period T * .

Application to Parametric Systems

Let us now consider a family {Σ p } p∈P of differential systems Σ p of the form dx/dt = f p (x) involving a parameter p ∈ P (but no uncertainty). It is useful to find a subset Q of P and a system Σ ′ : dx/dt = f (x, w) with uncertainty such that, for any p ∈ Q, Σ p is a particular form of Σ ′ for an appropriate uncertainty function w(•) ∈ W. This is useful to infer certain common properties of the solutions of {Σ p } p∈Q from the analysis of the system Σ ′ with uncertainty (cf. [START_REF] Aylward | Stability and robustness analysis of nonlinear systems via contraction metrics and SOS programming[END_REF], Section 5).

The implementation has been done in Python and corresponds to a program of around 600 lines. The source code is available at lipn.univ-paris13.fr/~jerray/ orbitador/parameter/. In the experiments below, the program runs on a 2.80 GHz Intel Core i7-4810MQ CPU with 8 GiB of memory. Given x 0 , τ, ε, |W|, the program searches heuristically for values of i ∈ N and T = kτ (for some k ∈ N) in order to verify B W ((i + 1)T ) ⊆ B W (iT ). This is illustrated in the following examples. The code source of Examples 8.1 to 8.3 is given in Appendix C.3.

Example 8.1. Consider the Van der Pol system Σ p of dimension d = 2 with parameter p ∈ R (see, e.g, [START_REF] Maciej | Computer Assisted Proofs of Attracting Invariant Tori for ODEs[END_REF]) and initial condition in B 0 = B(x 0 , ε) for some given x 0 ∈ R 2 and ε > 0 (see [START_REF] Bouwe Van Den | A general framework for validated continuation of periodic orbits in systems of polynomial ODEs[END_REF]):

   du 1 /dt = u 2 du 2 /dt = pu 2 -pu 2 1 u 2 -u 1
Consider now the system Σ ′ with uncertainty w(•) ∈ W:

   du 1 /dt = u 2 du 2 /dt = (p 0 + w(t))(1 -u 2 1 )u 2 -u 1
120 8. Generation of bounded invariants via stroboscopic set-valued maps with p 0 = 0.4. Each solution of Σ p with p ∈ [p 0 -0.01, p 0 + 0.01] = [0.39, 0.41] and initial condition x 0 is thus a particular solution of the system Σ ′ with uncertainty w ∈ W 0 = [-0.01, 0.01] (hence |W 0 | = 0.02) and set of initial conditions B(x 0 , ε 0 ). With: x 0 = (u 1 (0), u 2 (0)) = (1.35473686, -0.843734), initial radius ε 0 = 0.1, τ = 1/1000 and T 0 = 6.347 = 6347τ . We find:

x(0) = (1.35473686, -0.843734), δ W 0 (0) = 0.1 x(T 0 ) = (1.50761699, -1.04068552), δ W 0 (T 0 ) = 0.0788996465393 x(2T 0 ) = (1.52191721, -1.06003795), δ W 0 (2T 0 ) = 0.067913377036902 x(3T 0 ) = (1.52340404, -1.06120714), δ W 0 (3T 0 ) = 0.065311894281103 x(4T 0 ) = (1.52389638, -1.06095282), δ W 0 (4T 0 ) = 0.064876906743529 x(5T 0 ) = (1.52431256, -1.06058959), δ W 0 (5T 0 ) = 0.064487089163028.
We have: B W 0 ((i + 1)T 0 ) ⊂ B W 0 (iT 0 ) for i = 2. The computation took 603s of CPU time. This shows that the invariant I W 0 has a torus shape for t ∈ [2T 0 , 3T 0 ], and contains the solutions of Σ p for each p Example 8.2. Consider again the system Σ p of Example 8.1 and let p 1 = 1.1, the amplitude of uncertainty w ∈ W 1 = [-0.02, 0.02], and initial radius ε 1 = 0.1. Each solution of Σ p with p ∈ [p 1 -0.02, p 1 + 0.02] = [1.08, 1.12] and initial condition x 0 is now a particular solution of Σ ′ with uncertainty w ∈ W 1 = [-0.02, 0.02] and set of initial conditions B(x 0 , ε 1 ).

∈ [p 0 -|W 0 |/2, p 0 + |W 0 |/2].
With: x 0 = (u 1 (0), u 2 (0)) = (1.35473686, -0.843734), τ = 1/1000 and T 1 = 6.746 = 6746τ . We find:

x(0) = (1.35473686, -0.843734), δ W 1 (0) = 0.1 x(T 1 ) = (1.35387121, -0.84432851), δ W 1 (T 1 ) = 0.063151349209946 x(2T 1 ) = (1.353005, -0.84492382), δ W 1 (2T 1 ) = 0.062882360441883 x(3T 1 ) = (1.3521381, -0.84551992), δ W 1 (3T 1 ) = 0.063009935056069 x(4T 1 ) = (1.35127062, -0.84611681), δ W 1 (4T 1 ) = 0.063098074488825
x(5T 1 ) = (1.35040254, -0.84671449), δ W 1 (5T 1 ) = 0.062964897273475. We have: B W 1 ((i + 1)T 1 ) ⊂ B W 1 (iT 1 ) for i = 0. As shown in Fig. 8.2, the set I W 1 is an invariant for the system with uncertainty, and contains the limit cycle (LC). The computation time is 748 seconds.

Example 8.3. Consider again the system Σ p of Example 8.1 and let p 2 = 1.9, the amplitude of uncertainty w ∈ W 2 = [-0.025, 0.025], and initial radius ε 2 = 0.1. Each solution of Σ p with p ∈ [p 2 -0.025, p 2 + 0.025] = [1.875, 1.925] and initial condition x 0 is now a particular solution of Σ ′ with uncertainty w ∈ W 2 = [-0.025, 0.025] and set of initial conditions B(x 0 , ε 2 ).

With: x 0 = (u 1 (0), u 2 (0)) = (1.35473686, -0.843734), τ = 1/1000 and T 2 = 7.53 = 7530τ .

We find:

x(0) = (1.35473686, -0.843734), δ W 2 (0) = 0.1 x(T 2 ) = (1.28789326, -0.64934662), δ W 2 (T 2 ) = 0.06943220637642 x(2T 2 ) = (1.28750976, -0.64962723), δ W 2 (2T 2 ) = 0.06993146851437 x(3T 2 ) = (1.2871261, -0.64990814), δ W 2 (3T 2 ) = 0.069519667483199 x(4T 2 ) = (1.28674228, -0.65018933), δ W 2 (4T 2 ) = 0.069909061138188 8

Conclusion

Given a parametric differential system parameter Σ p (with a parameter p taking its values in an interval of the form Q = [p 0 -|W|/2, p 0 + |W|/2]), we have introduced a simple condition of inclusion of sets (Euclidean balls) which guarantees that the approximate Euler solutions of Σ p 0 are attracted by a limit cycle L, which is itself a cyclic solution of Σ p 0 . Moreover, we have introduced a toric set I 0 around L which is invariant for Σ p 0 , and whose radius δ(t) becomes in practice quickly very small. This shows that the exact solutions of Σ p 0 exist in the close neighborhood of the cycle L and have themselves an almost cyclic behavior. Finally, we have constructed a compact set Σ W centered also on L, whose radius δ W (t) is now non negligible, which is invariant for every system Σ p (p ∈ Q). We hope that this method, illustrated on the example of a parametric Van der Pol system, opens an alternative practical way to the complex techniques based on contractivity, Lyapunov functions or Poincare maps that are used presently to show the existence of attractive limit cycles.

Robust optimal periodic control using guaranteed Euler's method

This section flows the work carried out in [START_REF] Jerray | Robust optimal periodic control using guaranteed Euler's method[END_REF].

Introduction

When considering the optimization of real-time processes, it has been shown that a periodic time-dependent control often yields better performance than a simple timeinvariant steady-state control. This observation has led to the creation of the field of Optimal Periodic Control (OPC) theory in the 70's (see [START_REF] Gilbert | Optimal periodic control: A general theory of necessary conditions[END_REF] and references therein). These periodic controls are open-loop (no feedback), so they are not a priori "robust" or "stable" against possible perturbations or uncertainties, and special attention must be paid to ensure the robustness of such controls against possible perturbations (see, e. g., [START_REF] Wang | Optimal periodic control of hypersonic cruise vehicle: Trajectory features[END_REF][START_REF] Dai | Optimizing robust limit cycles for legged locomotion on unknown terrain[END_REF][START_REF] George Thuruthel | Stable open loop control of soft robotic manipulators[END_REF]). Among recent works on new methods of robust OPC, we focus here on a line of research developed by Houska and co-workers [HLID09, SHD12, SHGD12]. Their methodology consists in generating a "central optimal path" for the case of a null perturbation, which is surrounded by a "tube", which is invariant in a robust manner (i. e., in the presence of a bounded perturbation w ∈ W). Here we consider a simplified problem compared to that 8.2. Robust optimal periodic control using guaranteed Euler's method 125 of [HLID09] (cf. [START_REF] Zoltan | Worst-case and distributional robustness analysis of finite-time control trajectories for nonlinear distributed parameter systems[END_REF]): we focus on the optimal open-loop control of the system without perturbation ("nominal control") and analyze its robustness in the presence of perturbation while [START_REF] Houska | Approximate robust optimization of time-periodic stationary states with application to biochemical processes[END_REF] modifies the nominal control in order to satisfy additional prescribed constraints on the state of the system ("robustified control").

We keep the idea of "tube" used in [HLID09, SHD12, SHGD12], but we make use of recent results related to approximate solutions by Euler's method (see [START_REF] Le | Guaranteed control of sampled switched systems using semi-Lagrangian schemes and onesided Lipschitz constants[END_REF][START_REF] Le | Guaranteed optimal reachability control of reaction-diffusion equations using one-sided Lipschitz constants and model reduction[END_REF]). Our method makes a preliminary use of a dynamic programming (DP) method for generating a finite sequence of control π which solves a finite horizon optimal problem in the absence of perturbation. We then calculate an approximate Euler solution of the unperturbed system denoted by Ỹ (t) under π * , which corresponds to the sequence π applied repeatedly. We consider the tube defined by B W (t) of the form B( Ỹ (t), δ W (t))3 where Ỹ (t) is the central path, and δ W (t) an upperbound of the deviation due to W. The main contribution of this chapter is to give a simple condition on B W (t) which guarantees that the system is "stable in the presence of perturbation" in the following sense: the unperturbed system under π * is guaranteed to converge towards an attractive limit cycle (LC) L, and the trajectories of the perturbed system under π * are guaranteed to remain inside B W (t), which is a "torus" surrounding L.

In contrast with many methods of OPC using elements of the theory of LCs, our method does not use any notion of "Lyapunov function" (as, e. g., in [SHD12, SHGD12]) or "monodromy matrix" (as, e. g., in [START_REF] Houska | Approximate robust optimization of time-periodic stationary states with application to biochemical processes[END_REF]). We also explain how to compute a rate of local contraction of the system in order to obtain more accurate results than those obtained using global contraction (see, e. g., [START_REF] Aminzare | Contraction methods for nonlinear systems: A brief introduction and some open problems[END_REF][START_REF] Manchester | Transverse contraction criteria for existence, stability, and robustness of a limit cycle[END_REF]). The simplicity of our method is illustrated on a classical example of bioreactor (see [START_REF] Houska | Approximate robust optimization of time-periodic stationary states with application to biochemical processes[END_REF]).

Outline

In Section 7.3.1, we recall the principles of the Euler-based method, described in [LCF19, CF19, LCADSC + 17], for finding a finite control sequence π that solves a finite-horizon optimal control problem. In Section 8.2.2, we give a simple condition that ensures the robustness of the control (Theorem 8.2); the method is illustrated on the bioreactor example of [START_REF] Houska | Approximate robust optimization of time-periodic stationary states with application to biochemical processes[END_REF]. We conclude in Appendix E.4.

Application to Guaranteed Robustness

We suppose that a control sequence π has been generated by PROC ε k for solving the finite-horizon optimal control problem for the unperturbed system (w = 0, T = kτ = K∆t). We now give a simple condition on the system with perturbation W under π * 126 8. Generation of bounded invariants via stroboscopic set-valued maps which guarantees the existence of a stable LC L for the unperturbed system, as well as the boundedness of the solutions of the perturbed system. Let us consider the tube

B W (t) ≡ B( Ỹ π * z 0 (t), δ π * µ,W (t)) for some µ ≥ ε. Lemma 8.1. Suppose ( * ) B W (i + K)∆t ⊂ B W (i∆t)
, for some i ≥ 0.

Then we have:

1. The set I ≡ {y ∈ B W (t)} t∈[i∆t,(i+K)∆t] is an invariant of the perturbed system, i.e.: if y 0 ∈ I then Y π * y 0 ,W (t) ∈ I for all t ≥ 0.

2. λ i+1 + • • • + λ i+K < 0, where -λ j (j = i + 1, . . . , i + K) is the local rate of contraction 4 for the region {y ∈ B W (t)} t∈[(j-1)∆t,j∆t] .
This implies that the distance between two solutions of the unperturbed system starting at I decreases exponentially every T = K∆t time-steps, and each solution of the unperturbed system starting at I converges to an LC L ⊂ I.

Proof. (sketch). Item 1 follows easily from ( * ). Item 2 is proved ad absurdum:

Suppose λ i+1 + • • • + λ i+K ≥ 0. It follows, using (H): δ µ,W ((i + K)∆t) ≥ e (λ i+1 +•••+λ i+K )∆t δ µ,W (i∆t) ≥ δ µ,W (i∆t)
. This implies that the radius of B W ((i + K)∆t) is greater than or equal to the radius of B W (i∆t), which contradicts ( * ). So

λ i+1 + • • • + λ i+K < 0.
It follows that I is a "contraction" region for the unperturbed system, and every solution starting at y 0 ∈ I converges to an LC L ⊂ I (cf. proof of Theorem 2 in [START_REF] Manchester | Transverse contraction criteria for existence, stability, and robustness of a limit cycle[END_REF]).5

From Lemma 8.1, it easily follows:

Theorem 8.2. Let y 0 ∈ S be a point of ε-representative z 0 ∈ X (so ∥y 0 -z 0 ∥ ≤ ε).

Let T = kτ = K∆t. Let π ∈ U k be the optimal pattern output by PROC ε k (z 0 ) for the unperturbed system with finite horizon T . Let us consider the tube

B W (t) ≡ B( Ỹ π * z 0 (t), δ π * µ,W (t))
for some µ ≥ ε. Suppose that the following inclusion condition holds:

( * )

B W (i + K)∆t ⊂ B W (i∆t) for some i ≥ 0.
Then:

1. The exact solution Y π * y 0 ,0 (t) of the unperturbed system under control π * converges to an LC L ⊂ I when t → ∞. 8.2. Robust optimal periodic control using guaranteed Euler's method 127 2. For all w ∈ W, the exact solution Y π * y 0 ,w (t) of the perturbed system always remains inside I for t ≥ i∆t.

This reflects the robustness of the perturbed system under π * . Proof (sketch). First of all, it is easy to see that the "tail-biting" condition implies that, for all ℓ ≥ j: B W ((ℓ + 1)T ) ⊂ B W (ℓT ). Now: Y y 0 ,0 (ℓT ) ∈ B( Ỹz 0 ,0 (ℓT ), δ ε,0 (ℓT )) by Proposition 7.3, and it is easy to see: c,ρ) for all ℓ ≥ j + 1. The exact solution Y y 0 ,0 (t) therefore periodically passes through the ball B W ((j + 1)T ) (which can be seen as a Poincaré section). By the theory of LCs, it means that Y y 0 ,0 (t) converges towards an LC L (which proves Item 1). It follows that the closed set B W ((j + 1)T ) contains a point of L. Besides, B W ((j + 1)T ) ≡ B( Ỹz 0 ,0 ((j + 1)T ), δ W ((j + 1)T )) contains Y y 0 ,W ((j + 1)T ) by Proposition 7.4, so it contains all the points Y y 0 ,W (ℓT ) for ℓ ≥ j + 1 (since B W ((j + 1)T ) ⊃ B W (ℓT )). Hence B W ((j + 1)T ) contains a point of L as well as Y y 0 ,W (ℓT ) for ℓ ≥ j + 1. Therefore, for all ℓ ≥ j + 1, Y y 0 ,W (ℓT ) is at a distance of less than 2δ W ((j + 1)T ) from L (which proves Item 2).

δ ε,0 (t) ≤ δ ε,W (t) ≤ δ µ,W (t) for µ ≥ ε. It follows: Y y 0 ,0 (ℓT )) ∈ B( Ỹz 0 ,0 (ℓT ), δ µ,W (ℓT )) = B W (ℓT ) ⊆ B W ((j + 1)T ) ≡ B(
Remark 7. In the OPC literature, it is classical to formulate the optimization problem with an explicit periodicity constraint of the form Y (T ) = Y (0) (see, e. g., [START_REF] Gilbert | Optimal periodic control: A general theory of necessary conditions[END_REF][START_REF] Houska | Approximate robust optimization of time-periodic stationary states with application to biochemical processes[END_REF]). This is not needed here. Actually, at the end of the first period t = T , Y (t) is in general very different from Y (0) with our method (see Example 8.4).

Example

The implementation has been done in Python and corresponds to a program of around 500 lines. The source code is available at lipn.univ-paris13.fr/~jerray/ orbitador/robust/. In the experiments below, the program runs on a 2.80 GHz Intel Core i7-4810MQ CPU with 8 GiB of memory.

Example 8.4. Let us consider the system of Example E.1 and the initial point z 0 ≡ (X(0), S(0), P (0)) = (6.52, 12.50, 22.40).

The domain S of the states (X, S, P ) is equal to Let π be the control sequence found by PROC (z 0 ) for the process without perturbation for τ = 1, ∆t = 1/400 and T = 48 (i. e., k = 48, K = 19200). Here, λ is independent of the value of the mode S f . The values of λ and γ are computed locally and vary from +4.0 to -0.1, and from 0.06 to 0.12 respectively. Let us apply the control sequence π repeatedly to the process with perturbation: we suppose here that the perturbation is additive and ∥w∥ ≤ ω = 0.001. Fig. 8.4 displays the results of the 4 first applications of π. In these figures, the red curves represent the Euler approximation Ỹ (t) of the unperturbed solution as a function of time t in the plans X, S and P . The green curves correspond, in the X, S and P plans, to the borders of tube B W (t) ≡ B( Ỹ (t), δ W (t)) with Ỹ (0) = z 0 and δ W (0) = µ = 0.06667. 6 The 10 blue curves correspond to as many random simulations of the system with perturbation, with initial values in B(z 0 , µ). It can be seen that the blue curves always remain well inside the green tube B W (t) which overapproximates the set of solutions of the system with perturbation. The values of the coordinates of the center Ỹ (t) and the radius δ W (t) of the green tube B W (t), at t = 0, T, 2T, 3T, 4T , are: Ỹ (0) = (6.52, 12.5, 22.4), δ W (0) = 0.06667; Ỹ (T ) = (6.78068367, 12.61279314, 23.98459177), δ W (T ) = 0.02396854; Ỹ (2T ) = (6.77663937, 12.62347387, 23.95516391), δ W (2T ) = 0.01649916; Ỹ (3T ) = (6.77670354, 12.62331389, 23.95558776), δ W (3T ) = 0.01635563; Ỹ (4T ) = (6.77670254, 12.62331638, 23.95558164), δ W (4T ) = 0.01628267.

We have:

B W (4T ) ⊂ B W (3T ) (but B W (3T ) ̸ ⊆ B W (2T ) ̸ ⊆ B W (T ) ̸ ⊆ B W (0)
). The computation takes 480 seconds of CPU time. It follows by Theorem 8.2 that the solution of the perturbed system, for t ≥ 3T passes periodically by B W (3T ) = B( Ỹ (3T ), 0.01635563), and the solution of the unperturbed system converges to an LC contained in I ≡ {(X, S, P ) ∈ B W (t)} t∈[3T,4T ] shown in Fig. 8.5 (bottom). This appears clearly on Fig. 8.4, where simulations of the process with perturbation corresponds to the blue lines, and the process without perturbation to the red line.

Conclusion

We have supposed here that a control sequence π has been generated for solving a finitehorizon optimal control problem for the system without perturbation (w = 0). We have then given a simple condition which guarantees that, under the repeated application π * of π, the system with perturbation (w ∈ W) is robust under π * : the unperturbed system is guaranteed to converge towards an LC L, and the system perturbed with W is guaranteed to stay inside a bounded tube around L. In contrast with many methods ) for ∆t = 1/400 and initial condition (X(0), S(0), P (0)) = (6.52, 12.5, 22.4), with, from top to bottom, X(t), S(t), P (t) and control S f (t).

of OPC using elements of the theory of LCs (e. g., [HLID09, SHD12, SHGD12]), the method does not make use of any notion of monodromy matrix or Lyapunov function.

The method uses a simple algorithm to compute local rates of contraction in the framework of Euler's method (see Remark 3), which may be more accurate than the global rates considered in the literature (see e. g., [START_REF] Aminzare | Contraction methods for nonlinear systems: A brief introduction and some open problems[END_REF][START_REF] Manchester | Transverse contraction criteria for existence, stability, and robustness of a limit cycle[END_REF]). The simplicity of application of our method has been illustrated on the example of a bioreactor given in [START_REF] Houska | Approximate robust optimization of time-periodic stationary states with application to biochemical processes[END_REF].

As mentioned in Appendix E.1, we have treated here a simplified problem of robustness compared to the one dealt with in [HLID09] (cf. [START_REF] Zoltan | Worst-case and distributional robustness analysis of finite-time control trajectories for nonlinear distributed parameter systems[END_REF]).

Enclosures of invariant tori and strange attractors using Euler's method

In this chapter, we show how, using Euler's integration method and an associated function bounding the error in function of time, one can generate structures closely surrounding the invariant tori of dynamical systems. Such structures are constructed from a finite number of balls of R d and encompass the deformations of the tori when small perturbations of the flow of the system occur.

Introduction

Invariant tori are objects which are omnipresent in physics and intervene in a multiplicity of different domains: chemical reactions, population dynamics, electrical circuit theory, electrodynamics, fluid dynamics, . . . (see, e.g., [START_REF] Edoh | Computation of invariant tori by orthogonal collocation[END_REF][START_REF] Rasmussen | Numerical methods for the continuation of invariant tori[END_REF]). These tori are (positively) invariant in the sense that all the orbits lying on their surface at t = t 0 remain on them at all subsequent time t ≥ t 0 .

The topology of tori conveys important information. In order to understand it, one introduces a "continuation" parameter (say µ) in the equations of the dynamical system, a simple basic case corresponding to µ = 0. One then progressively make µ vary, and observe the change of topology of the torus. Roughly speaking, a torus appears when, in a Poincaré section, a stable fixed-point M becomes unstable while an invariant closed curve ("circle") L appears around M . In the full space, M corresponds to a repulsive circle C of the system, and L to an attractive invariant torus T . Further variations of µ lead to the deformation of T until a "torus bifurcation" occurs. When µ is still modified, the solutions of the system become "aperiodic" and a phenomenon of chaos appears.

There are basically three kinds of methods of numerical analysis that exploit this mechanism of parameter continuation: partial differential equation [START_REF] Dieci | Solution of the systems associated with invariant tori approximation. II: multigrid methods[END_REF][START_REF] Trummer | Spectral methods in computing invariant tori[END_REF], graph transform [BHV02, Rei00, SOV05] and orthogonality methods [START_REF] Edoh | Computation of invariant tori by orthogonal collocation[END_REF][START_REF] Rasmussen | A geometrical method for the approximation of invariant tori[END_REF]. Their respective advantages and disadvantages are analyzed, basically from a computational efficiency point of view, in, e.g., [START_REF] Edoh | Computation of invariant tori by orthogonal collocation[END_REF][START_REF] Rasmussen | Numerical methods for the continuation of invariant tori[END_REF]. From a formal point of view, all the methods are incomplete because they focus on a discretization of the continuous dynamical system, but do not take the associated errors in consideration, or, at best, evaluate them modulo unknown constants (see, e.g., [START_REF] Garay | Estimates in discretizing normally hyperbolic compact invariant manifolds of ordinary differential equations[END_REF][START_REF] Hairer | Invariant tori of dissipatively perturbed hamiltonian systems under symplectic discretization[END_REF][START_REF] Volker | Computing invariant tori and circles in dynamical systems[END_REF]).

On the other hand, Capinski and co-authors recently developed a guaranteed computer assisted method of proof for attractive invariant tori (see [START_REF] Maciej | Computer Assisted Proofs of Attracting Invariant Tori for ODEs[END_REF]). They obtain an outer approximation of the torus via covering by polygons. Their implementation is based on the validated integrators developed by Wilczak and Zgliczynski [START_REF] Wilczak | C r -Lohner algorithm[END_REF]. We follow a similar approach, but rely here on Euler's integration method associated to an error function δ(t) that bounds, at time t, the distance between the numerical and the exact solutions (see [START_REF] Le Coënt | Control synthesis of nonlinear sampled switched systems using Euler's method[END_REF]). We are thus able to generate a finite number of d-dimensional balls of radius δ(t) for bounded values of t, which encompass the torus. The set of balls is itself invariant and continues to contain the torus when the latter deforms under small variations of µ. This approach extends our previous work [START_REF] Jerray | Determination of limit cycles using stroboscopic set-valued maps[END_REF], which was limited to the determination of invariant circles. The method applies naturally to periodic systems, but we explain how to extend it in order to construct an overapproximation of "strange attractors" existing in certain chaotic systems.

Comparison with related work

The elements of the following discussion are based on [START_REF] Edoh | Computation of invariant tori by orthogonal collocation[END_REF] and EWY [START_REF] Rasmussen | Numerical methods for the continuation of invariant tori[END_REF]. Classically, in order to analyze an invariant torus, the torus is parameterized in terms of a subset of the variables of the original dynamical system, and a "continuation" principle is applied. The basic methods differ by the conditions they use to justify the continuation process: the partial differential equation (PDE) condition, the graph transform condition and the orthogonality condition. In the PDE approach, the condition that the torus is an invariant set for the original systems leads to the solution of an equivalent system of first-order PDEs subject to periodic boundary conditions [START_REF] Dieci | Solution of the systems associated with invariant tori approximation. II: multigrid methods[END_REF][START_REF] Trummer | Spectral methods in computing invariant tori[END_REF]. The graph transform method [BHV02, Rei00, SOV05] follows Fenichel's proof of the continuation of tori in [START_REF] Fenichel | Persistence and smoothness of invariant manifolds for flows[END_REF]. The orthogonality method [ERS00, RD08] relies on purely geometrical reasoning. Under some hypotheses, the three conditions are equivalent but the implementation of the associated methods is fundamentally different, and each kind of method has its own difficulties. In particular, the PDE methods require the formulation and numerical resolution of a PDE, which make them applicable to a restricted class of problems in practice. The graph transform methods require the splitting of the "normal bundle" into attracting and repelling spaces. The orthogonality-based methods encounter numerical instability problems with natural discretization schemes (see [START_REF] Rasmussen | Numerical methods for the continuation of invariant tori[END_REF] for details).

As mentioned above, from our point of view, the main problem of all these methods is that the errors inherent to the discretization process are not precisely evaluated. In order to account for the discretization errors, we extend the approach initiated in [START_REF] Jerray | Determination of limit cycles using stroboscopic set-valued maps[END_REF], which was restricted to the determination of invariant circles ("limit cycles"), in order to determine higher-dimensional invariant tori.

Outline

In Section 9.2, we explain how to construct an invariant structures around tori for periodic systems then for chaotic systems. We conclude in Section 9.3.

Constructing Invariant Stuctures Around Tori

Basic method for periodic systems

Consider a differential system Σ W : ẋ = f (x, w) with w ∈ W, an initial point x 0 ∈ R d , a real ε > 0 and a ball B 0 = B(x 0 , ε). Let B ε,W (t) denote B(x(t), δ ε,W (t)) where x(t) is 134 9. Enclosures of invariant tori and strange attractors using Euler's method the Euler approximate solution of the system without uncertainty and initial condition x 01 . It follows from Proposition 7.2 that t≥0 B ε,W (t) is an invariant set containing B 0 . We can make a stroboscopic map of this invariant. by considering periodically the set B ε,W (t) at the moments t = 0, T, 2T , etc., with T = kτ for some k (τ is the time-step used in Euler's method). The value of T is an estimate of the exact period T * of the system.

If moreover, we can find an integer i ≥ 0 such that B ε,W ((i + 1)T ) ⊆ B ε,W (iT ), then we have

B ε,W (iT ) = j=i,i+1,... B ε,W (jT ) and t∈[0,(i+1)T ] B ε,W (t) = t≥0 B ε,W (t).
The set t∈[0,(i+1)T ] B ε,W (t) is thus a bounded invariant which contains all the solutions x(t) starting at B 0 , for t ∈ [0, ∞). We have: Proposition 9.1. [START_REF] Jerray | Determination of limit cycles using stroboscopic set-valued maps[END_REF] Consider a system Σ W : ẋ = f (x, w) with uncertainty w ∈ W satisfying (H1), and a set of initial conditions B 0 ≡ B(x 0 , ε). Suppose that there exist T > 0 (with T = kτ for some k ∈ N) and i ∈ N such that (*): B ε,W ((i + 1)T ) ⊆ B ε,W (iT ). Then we have:

1. t∈[0,(i+1)T ] B ε,W (t) is a compact (i.e., bounded and closed) invariant set contain- ing, for t ∈ [0, ∞), all the solutions x(t) of Σ W with initial condition in B 0 .
2. The subset t∈[iT,(i+1)T ] B ε,W (t) contains an attractive circle (or "stable limit cycle") of the system Σ 0 without uncertainty (w = 0).

Proposition 9.1 states that the invariant set t∈[0,(i+1)T ] B ε,W (t) is an d-dimensional tube having the form of a "lasso"composed of a linear part t∈[0,iT ] B ε,W (t) connected to a looping part t∈[iT,(i+1)T ] B ε,W (t). Besides, the looping part encloses a 1-dimensional attractive circle. Since B ε,W (t) is a ball of R d (of radius δ ε,W (t)), a lasso is constructed from a finite number (viz., (i + 1) × k) of balls.

Given ε, W, τ , T = kτ , the lasso: t∈[0,(i+1)T ] B ε,W (t) is uniquely determined by the center x 0 ∈ R d of the initial ball B 0 = B(x 0 , ε) and by i 0 , the integer such that (*) holds. We call x 0 the source point of the lasso, and B 0 = B(x 0 , ε) the source ball. We will denote such a lasso by L(x 0 , i 0 ) or more simply by L(x 0 ), where i 0 is left implicit. Note that the invariance property of a lasso L(x 0 ) is robust: the invariance persists even in presence of a bounded perturbation w ∈ W of the dynamical system.

The implementation of the construction of lassos has been done in Python and corresponds to a program of around 500 lines. The source code is available at lipn. univ-paris13.fr/~jerray/orbitador/. In the experiments below, the program runs on a 2.80 GHz Intel Core i7-4810MQ CPU with 8 GiB of memory. Given x 0 , one searches for values of τ, ε, W, T at hand (by trial and error) so that inclusion (*) can be successfully verified by the program.

Example 9.1. Consider the forced Van der Pol (VdP) system Σ W with initial condition in B 0 = B(x 0 , ε) for some x 0 ∈ R 3 and ε > 0 (adapted from [START_REF] Rasmussen | Numerical methods for the continuation of invariant tori[END_REF]). ẋ1 =

x 1 ( √ x 2 1 +x 2 2 -3) √ x 2 1 +x 2 2 (µ -( x 2 1 + x 2 2 -3) 2 -x 2 3 ) - x 2 2 +x 1 x 3 √ x 2 1 +x 2 2 ) + w ẋ2 = x 2 ( √ x 2 1 +x 2 2 -3) √ x 2 1 +x 2 2 (µ -( x 2 1 + x 2 2 -3) 2 -x 2 3 ) + x 1 x 2 -x 2 x 3 √ x 2 1 +x 2 2 ) + w ẋ3 = ( x 2 1 + x 2 2 -3) + µx 3 -x 3 (( x 2 1 + x 2 2 -3) 2 + x 2
3 ) + w with a parameter µ that controls the periodic forcing term and a bounded perturbation w ∈ W. Here µ = 1 and W = [-0.001, 0.001]. Let the time-step be equal to τ = 10 -3 and the radius of the initial ball around the source points be ε = 0.05. Let X(t) := (x 1 (t), x 2 (t), x 3 (t)) with source point. Our program finds that, for T = 6.283, we have:

X(0) := (4, -10 -3 , -4.8985872 • 10 -16
) and δ W (0) = ε = 0.05. We have: Given a closed orbit ("circle") C, and a union R of balls of radius ε > 0, we say that R isolates C if there exists α > 0 such that: (**) Any continuous curve containing a point of C and a point located at distance α from C, also contains a point of R. We say that R is at distance α 0 > 0 of C, where α 0 is the greatest α satisfying property (**).

X(T ) = (3.96480714, -5.31384851 • 10 -1 , -1.78122434 • 10 -4 ), δ W (T ) = 0.009369013554590614 X(2T ) = (-3.99399126, -2.23716163 • 10 -1 , -1.12718456 • 10 -3 ), δ W (2T ) = 0.013528832294010595 X(3T ) = (-4.00024909, -4.16869048 • 10 -4 , -1.31261670 • 10 -3 ), δ W (3T ) = 0.008339289838071407 X(4T ) = (-4.00024885, -7.76179315 • 10 -7 , -1.49692259 • 10 -3 ), δ W (4T ) = 0.008181686420182348 X(5T ) = (-4.00024856, -1.44518842 • 10 -9 , -1.68122843 • 10 -3 ), δ W (5T ) = 0.008088285030977036 X(6T ) = (-4.00024823, -2.69083383 • 10 -12 , -1.86553421 • 10 -3 ), δ W (6T ) = 0.008001319005309636 X(7T ) = (-4.00024787, -5.01013330 • 10 -15 , -2.04983993 • 10 -3 ), δ W (7T ) = 0.008408806943539475 X(8T ) = (-4.00024747, -9.32849705 • 10 -18 , -2.23414558 • 10 -3 ), δ W (8T ) = 0.007976450475139826. We have: B ε,W (8T ) ⊂ B ε,W (7T ), i.e.: B ε,W ((i 0 + 1)T ) ⊂ B ε,W (i 0 T ) for i 0 = 7.
Let T be a torus of repulsive circle C, and M a set of lassos. We say that M covers T (besides the α 0 -neighborhood of C), if all orbit O on T starting at a distance greater than α 0 from C is contained in a lasso of M. We have:

Theorem 9.1. Let T be a torus of repulsive circle C, and R a union of balls of R d isolating C at distance α 0 . The set of lassos M having the balls of R as source balls, covers T (besides the α 0 -neighborhood of C). Furthermore, M continues to cover T for a bounded perturbation w ∈ W of the dynamical system.

The proof is based on the fact that, by Proposition 9.1, each lasso of M connects its source ball to an attractive circle. Note that the application of Theorem 9.1 requires the prior estimate of the location of the torus repulsive circle C. Actually, as seen in the forthcoming examples, taking a subset R ′ of R as source balls, even if R ′ does not isolate C "completely", suffices to provide useful information on T .

Example 9.2. For the system of Example 9.3, we generate 100 lassos which (partially) cover the invariant torus of the system, as depicted on Fig. 9.3. The choice of the 100 source points is as follows. One knows (see [START_REF] Rasmussen | Numerical methods for the continuation of invariant tori[END_REF]) that the system has, in the x 2 -x 3 plane, a repulsive invariant circle C of centre (3, 0, 0) and radius 1. We thus take 100 source points distributed in the vicinity of the circumference of C.The same values of ε, τ, T = kτ, W are used for all the lassos (see Example 9.3). For each source point, the generation of the corresponding lasso stops when the inclusion relation (*) is verified, which takes around 1000 seconds of CPU time2 . Note that, as stated by Proposition 9.1, the looping part of each lasso contains an attractive invariant circle (here, the circle of centre (-3, 0, 0) and radius 1, in the x 2 -x 3 plane).

An other example (Example C.1: coupled VdP oscillators) is given in Appendix C.5.

Extension to chaotic systems

The existence of the cyclic part of a lasso means that there exists an instant t 1 = ℓ 1 τ (with ℓ 1 ∈ N) such that:

(1) B ε,W (t 1 + T 1 ) ⊆ B ε,W (t 1 ) for some T 1 = k 1 τ (k 1 ∈ N \ {0}).
This implies that the unperturbed system has a periodic closed orbit ("limit cycle") passing through B 1 (cf. Proposition 9.1). Now we know that there exist "chaotic" or "quasi-periodic" systems that never pass through the same point again: so (1) never holds for these systems. Nevertheless, the reachability space of such systems may be compact, and we can hope to find a finite number of instants, say two instants t 1 = ℓ 1 τ and t 2 = ℓ 2 τ for some ℓ 1 , ℓ 2 ∈ N for the sake of simplicity, such that:

(1.1) B ε,W (t 1 + T 1 ) ⊆ B 1 ∪ B 2 for some T 1 = k 1 τ (k 1 ∈ N \ {0}), and (1.2) B ε,W (t 2 + T 2 ) ⊆ B 1 ∪ B 2 for some T 2 = k 2 τ (k 1 ∈ N \ {0}),
where B j := B ε,W (t j ) for j = 1, 2. The relation (1.1-1.2) guarantees the following recurrence property: Whatever the point of B 1 ∪ B 2 from which it starts, the system returns to B 1 ∪ B 2 within a time equal to T 1 or T 2 . I j := t∈[0,T j ] B ε,W (t j + t) (j = 1, 2). Besides, when starting at B 1 ∪ B 2 , the system is guaranteed to return to B 1 ∪ B 2 within a time equal to T 1 or T 2 . The computation takes 35398 seconds of CPU time.

For all the cases k 1 = 0.09, 0.06, 0.05, let τ = 0.01 and w ∈ W = [-0.0001, 0.0001]. Let Y (t) denote the Euler approximation of the solution (y 1 (t), y 2 (t), y 3 (t)) at time t.

For k 1 = 0.09, let ε = 0.1 and take as initial condition: Y (0) = (-1.1, 1, 1.4). Our program finds that, for T = 63.02s, B ε,W (2T ) ⊂ B ε,W (T ) with:

Y (0) = (-1.1, 1, 1.4), δ W (0) = 0.1, Y (T ) = (-0.8451889, 1.08708964, 1.36775201), δ W (T ) = 0.017653110058938166, Y (2T )
= (-0.84049942, 1.09501111, 1.36834661), δ W (2T ) = 0.005405413251680326. This corresponds to a simple limit cycle, as depicted on Fig. 9.5.

For k 1 = 0.06, let ε = 0.2, and take as initial condition: Y (0) = (-0.70980849, 0.98196113, 1.43337992). The program finds that, for T = 104s, B ε,W (2T ) ⊂ B ε,W (T ) with: Y (0) = (-0.70980849, 0.98196113, 1.43337992), δ W (0) = 0.2, Y (T ) = (-0.78068153, 1.03727912, 1.41704223), δ W (T ) = 0.017162929835499604. Y (2T ) = (-0.7754963, 1.03256313, 1.41878211], δ W (2T ) = 0.006770367587314312. This corresponds to a limit cycle with a doubled period, as depicted on Fig. 9.6.

For k 1 = 0.05, let ε = 0.2, and take as initial condition: Y (0) = (-0.70980849, 0.98196113, 1.43337992). The program finds that, for T = 188.4s, B ε,W (T ) ⊂ B ε,W (0) with: Y (0) = (-0.70980849, 0.98196113, 1.43337992), δ W (0) = 0.2, Y (T ) = (-0.67051189, 0.95978894, 1.43388091), δ W (T ) = 0.009574141119020567. This corresponds to a limit cycle with a quadrupled period, as depicted on Fig. 9.7.

Conclusion

We have introduced a simple technique based on Euler's integration method which allows us to construct an invariant structure made of a finite number of d-dimensional balls covering the invariant torus of the system. Although it has not been done here, the implementation can be fully parallelized in the periodic case, since the construction of each lasso is independent of each other. We have also shown how to extend the basic method to treat chaotic systems with strange attractors. Our method, which takes 142 9. Enclosures of invariant tori and strange attractors using Euler's method into account the discretization errors, can help to complement the results obtained with standard numerical methods. ORBITADOR: A tool to analyze the stability of periodical dynamical systems

We present ORBITADOR, a tool for stability analysis of dynamical systems. ORBITA-DOR uses a method that generates a bounded invariant set of a differential system with a given set of initial conditions around a point x 0 to prove the existence of a limit cycle. This invariant has the form of a tube centered on the Euler approximate solution starting at x 0 , which has for radius an upper bound on the distance between the approximate solution and the exact ones. The method consists in finding a real T > 0 such that the "snapshot" of the tube at time t = (i + 1)T is included in the snapshot at t = iT , for some integer i with adding a small bounded uncertainty. This uncertainty allows using an approximate value T of the exact period. We successfully applied ORBITADOR to several classical examples of periodical systems. This chapter comes mainly from [START_REF] Jerray | Orbitador: A tool to analyze the stability of periodical dynamical systems[END_REF].

Contents

Introduction

The analysis of stability and convergence of numerical schemes for differential systems is often based on the property of contraction of the space of solutions [LS98, AS14, KGD15].

Given a differential system Σ : dx/dt = f (x) of dimension d, an initial point x 0 ∈ R d , a real ε > 0, and a ball B 0 = B(x 0 , ε) 1 , we present here a simple approach allowing to find a bounded invariant set of Σ containing the trajectories starting at B 0 . We first add a (small) bounded perturbation w(t) to the system, whose values belong to a convex set W. We thus obtain a perturbed system of the form Σ W : dx/dt = f (x, w), and we look for a bounded (forward) invariant set for Σ W . This invariant set has the form of a tube whose center at time t is the Euler approximate solution x(t) of the system starting at x 0 , and radius is a function δ W (t) bounding the distance between x(t) and any exact solution x(t) of Σ W starting at B 0 . The tube can thus be described as t≥0 B W (t) where B W (t) ≡ B(x(t), δ W (t)). To find a bounded invariant set, we then look for a positive real T such that B W ((i + 1)T ) ⊆ B W (iT ) for some i ∈ N. In case of success, we show that the set I W = t∈[iT,(i+1)T ] B W (t) constitutes a bounded invariant set for Σ W (and also for Σ corresponding to the particular case W = 0).

We integrated this approach to ORBITADOR in order to study the stability of dynamical systems.

Outline:

In Section 10.2, we expose the organization and the features of ORBITADOR. Section 10.3 gives the results obtained on the biped example. Section 10.4 concludes this work.

ORBITADOR organization and principle

ORBITADOR is a tool that implements a formal method to prove formally the stability of dynamical systems governed by differential equations.

Targeted user

The tool is intended to the user wishing to verify the existence of an attractive limit cycle, and to construct an invariant set enclosing it.

Global architecture

ORBITADOR is written in Python, it is made of 1,037 lines of code, and can therefore run under any operating system. We explain in Section 10.2.2 the global architecture of the system, that starts by the input Python file describing the ODE and all specifications of the computed system. Using this input, the method defined in Section 8.1.2 generates an invariant set I W that allows study the stability of the given system. Graphical an numerical results can be provided as the output of the analysis.

The input file of ORBITADOR is composed of 3 main modules:

1. Problem Definition: In this module, the user defines the names of the states that constitute the system, also the user specifies the names of the parameters and their values. After that, the user gives the differential equations of the system.

If the problem contains a guard condition and a reset, it is possible to add them in the problem definition part.

Problem Configuration:

In the problem configuration module, the user can set the options to run ORBITADOR. Among these options, we find the time steps, the initial conditions of the system or the starting point at initial time t 0 the value of the uncertainty W and the number of the periods.

3. Visualization: In the last module, the user specify the states to display. It can be a 1D plot where the state is shown as a function of t or a phase portal where To launch ORBITADOR the user needs to run, in the terminal, the executable file orbitador followed by the name of the input file:

./orbitador input_system.py As shown in Fig. 10.2, to analyze a dynamical system using ORBITADOR, the user needs to give as inputs its differential equations and initial conditions, also he needs to provide the time step τ , the number of periods N in order to fix a maximum duration T f = N T in which ORBITADOR tries to find the index sought i (as defined in Proposition 8.2), the bounded uncertainty W and the radius ε of the initial ball B 0 . An approximate value T (= kτ for some integer k) of the period of the system can be computed automatically by ORBITADOR or it can be fixed by the user as an input. Using those inputs, ORBITADOR computes the local values of λ, L, C and γ as well as the function δ ε,W (•) (as defined in Definition E.3 and Section 7.2.2). Then ORBITADOR outputs the invariant set I W (as defined in Proposition 8.2).

The tool, its source code, several examples and results are available on the website of ORBITADOR https://lipn.univ-paris13.fr/~jerray/orbitador/.

Example: Passive biped model

It is possible to use ORBITADOR in order to analyze the stability of hybrid systems, i. e., continuous systems which, upon the satisfaction of a certain state condition 10.3. Example: Passive biped model 151 ("guard"), may reset instantaneously the state before resuming the application of ODEs. Many works in the domain of symbolic control have explained how to compute an overapproximation of the intersection of the current set of reachability with the guard condition, and perform the reset operation (see, e. g., [GG08, AK12, DFGLG13, Fre15, KA20]). We describe here the results of such an extension to the passive biped model [START_REF] Mcgeer | Passive dynamic walking[END_REF], seen as a hybrid oscillator. The passive biped model exhibits indeed a stable limit-cycle oscillation for appropriate parameter values that corresponds to periodic movements of the legs [START_REF] Shirasaka | Phase reduction theory for hybrid nonlinear oscillators[END_REF]. The model has a continuous state variable

x(t) = (ϕ 1 (t), . ϕ 1 (t), ϕ 2 (t), . ϕ 2 (t)) ⊤ . The dynamics is described by dx(t) dt = f(x) + w with w ∈ W ⊂ R 4 and f(x) =        . ϕ 1 sin(ϕ 1 -γ) . ϕ 2 sin(ϕ 1 -γ) + . ϕ 2 1 sin ϕ 2 -cos(ϕ 1 -γ) sin ϕ 2        , Reset(x) =        -ϕ 1 . ϕ 1 sin(2ϕ 1 ) -2ϕ 1 . ϕ 1 cos 2ϕ 1 (1 -cos 2ϕ 1 )        Guard(x) ≡ (2ϕ 1 -ϕ 2 = 0 ∧ ϕ 2 < -δ).
The time-step used in Euler's method is τ = 2 • 10 -5 , and ORBITADOR then automatically computes an approximate value of the period equal to T = kτ with k = 194129. Also, we choose N = 5 as the number of periods. Therefore, the maximum duration T f of this experience is T f = N T = 5T = 19.4129s. For a system with W = [-0.0001, 0.0001] 4 and set of initial conditions B(x 0 , ε) with ε = 0.01 and x 0 = (0.009, -0.05869, -0.0009629, -0.3432), ORBITADOR finds: B W ((i 0 + 1)T ) ⊂ B W (i 0 T ) for i 0 = 4. On Fig. 10.3, the curve of Euler's approximation x(t) is depicted in red for initial condition x 0 and t ∈ [0, T f ]. The borders of the tube B W (t) ≡ B(x(t), δ ε,W (t)) are depicted in green. The black vertical lines delimit the portion of the tube between t = i 0 T and t = (i 0 + 1)T corresponding to the invariant set I W enclosing the limit cycle.

It follows by Theorem 8.1 that, for any initial condition in B(x 0 , ε), the system converges towards an attractive limit cycle contained in

I W ≡ t∈[4T,5T ] B W (t).
The experiment above is performed on an ASUS X411UN Intel CoreŮ i7-8550U 1.80 GHz with 8 GiB memory running Linux Mint 19. The proof takes 327 seconds of CPU time.

Conclusion

We presented ORBITADOR, a tool coded in Python that guarantees the existence of limit cycles and constructs invariant sets around them. ORBITADOR uses a very general criterion of inclusion of one set in another. This is simpler than classical criteria based on contractivity properties or Lyapunov functions. Also, by adding a small bounded uncertainty w ∈ W to the system, we can use an approximate value T of the period and not an exact value.

Conclusion and perspectives

This chapter concludes and discuss future perspectives of Part II

Summary of Part II

In Chapter 7, we have first introduced symblic Euler's method and error bounds also we have presented an extension of Euler method with control and perturbation. Then, we have shown that the simple combination of random sampling with a symbolic computation method (based on Euler's integration method) allows us to deal with robust optimization problems for nonlinear systems on non-convex domains.

In Chapter 8, we have first introduced a simple condition of inclusion of sets for parametric differential systems (with a parameter p taking its values in an interval of the form Q = [p 0 -|W|/2, p 0 + |W|/2]) which guarantees that its approximate Euler solutions of are attracted by a limit cycle. Moreover, we have introduced a toric set around the limit cycle which is invariant for Σ p 0 , and whose radius becomes in practice quickly very small. This shows that the exact solutions of Σ p 0 exist in the close neighborhood of the cycle and have themselves an almost cyclic behavior. Finally, we have constructed a compact set with perturbation centered also on the limit cycle, whose radius is now non negligible, which is invariant for every system Σ p (p ∈ Q).

Then, we considered the application of optimal periodic control sequences to switched dynamical systems. The control sequence is obtained using a finite-horizon optimal method based on dynamic programming. The main result gives a simple condition on the perturbed system for guaranteeing the existence of a stable limit cycle of the unperturbed system.

In Chapter 9, we have given a simple method based on Euler's integration method which allows us to construct an invariant structure made of a finite number of ddimensional balls covering the invariant torus of the system. We have presented how to use the basic method to treat chaotic systems with strange attractors. Since the method takes into account the discretization errors, it can help to complement the results obtained with standard numerical methods.

In Chapter 10, we presented a tool called ORBITADOR that guarantees the existence of limit cycles and constructs invariant sets around them. It uses a very general criterion of inclusion of one set in another.

Perspectives

In Chapter 8, we plan to improve our method in order to take into account the specification of state constraints during the evolution of the system.

In Chapter 9, we envisage to implement a fully parallelized analysis in the periodic case.

In Chapter 10, we plan to upgrade ORBITADOR so that it computes dynamical systems with control(see [START_REF] Jerray | Robust optimal periodic control using guaranteed Euler's method[END_REF]). As short term perspectives, we aim to verify by ORBITADOR the control that has been implemented on the exoskeleton represented in [VBV + 21a].

General conclusion

Conclusion Part I:

Part I highlights the formal verification of real-time systems under uncertainty, notably using parametric timed model checking. We aimed at translating real-time systems into parametric timed (or stopwatch) automata, a formalism particularly well-suited for parametric timed model checking. First, we presented a methodology for the particular case of the scheduling of the flight control of a space launcher. The methodology required that the formalization of the case study to be handled in a parametric formal model and the computation of the model parameters using IMITATOR. We initially represented the problem of the scheduling of a launcher flight control, then we showed how this problem can be formalized with parametric stopwatch automata; we then presented the outcomes processed by the parametric timed model checker IMITATOR. Finally, we improved our model by taking into consideration the time for switching context, and we compared the results to those obtained by other tools classically used in scheduling. Also, we presented Time4sys2imi, a tool making an interpretation of Time4sys models into parametric timed automata in the input language of IMITATOR. This interpretation permits to study the schedulability of real-time systems and to infer some timing constraints ensuring schedulability. Then, we successfully applied Time4sys2imi to various examples.

Part II:

Part II focuses on the study of stability of dynamical systems and robustness of controls. We have illustrated that the basic combination of random sampling with a symbolic computation method permits to manage with robust optimization problems for nonlinear systems on non-convex domains. Also, we have shown that for a given a differential system Σ, we can guaranteed that the approximate Euler solutions of Σ are attracted by a limit cycle L using a simple condition of inclusion of sets (Euclidean balls). This limit cycle L is itself a cyclic solution of Σ. Moreover, we have introduced a toric set I 0 around L which is invariant for Σ, and whose radius δ(t) becomes in practice quickly very small. This shows that the exact solutions of Σ exist in the close neighborhood of the cycle L and have themselves an almost cyclic behavior. Finally, we have constructed a compact set Σ W centered also on L, whose radius δ W (t) is now non negligible, which is invariant for every system Σ. Besides, we have given a basic condition which ensures that, under the repeated application π * of a control sequence π obtained by solving a finite horizon optimal 158 11.

Conclusion and perspectives

control problem for the system without perturbation (w = 0), the system with perturbation (w ∈ W) is robust under π * : the unperturbed system is ensured to converge towards a LC L, and the system perturbed with W is ensured to remain inside a bounded tube around L.

In addition, we have presented a basic procedure dependent on Euler's integration technique which permits us to build an invariant set made of a finite number of d-dimensional balls covering the invariant torus of the system. We have additionally shown an extension of the basic technique to treat chaotic systems with strange attractors. Finally, we introduced ORBITADOR, a tool that ensures the presence of limit cycles and builds invariant sets around them. ORBITADOR uses a general basis of inclusion of one set in another that does not require the exact value of the period of the system. Only an approximate period value is needed which can be calculated automatically by ORBITADOR.

Perspectives Part 1:

We envisage to generate automatically the synthesis of the allocations of processings on threads. This generalization raises first the issue of modeling such problematic (how to model an allocation with a parameter) and second the classical combinatorial explosion of states. We plan to use other formalisms less expressive but more effective than parametric timed automata.

Part 2:

As long term perspectives, we plan to apply the minimization with gradient descent instead of Euler's method to reduce the error between exact and approximate solutions, also we envisage to upgrade ORBITADOR so that it computes dynamical systems with control.

deadlineT2 > 11 ∧ 11 ≥ offsetT3 ∧ deadlineT1 ≥ 4 ∧ offsetT3 > offsetT2 ∧ 20 ≥ deadlineT2 ∧ offsetT2 > 0 ∧ 5 ≥ deadlineT1 ∧ 1 ≥ offsetT2 ∧ offsetT1 = 0 ∧ deadlineT3 = 60 OR offsetT1 > 0 ∧ deadlineT1 ≥ 4 ∧ 20 ≥ deadlineT2 ∧ offsetT3 > 5 ∧ deadlineT2 ≥ 15 ∧ 11 ≥ offsetT3 ∧ 5 ≥ deadlineT1 ∧ deadlineT1 ≥ 1 + offsetT1 ∧ offsetT2 = 0 ∧ deadlineT3 = 60 OR offsetT1 > 0 ∧ offsetT1 + 1 ≥ offsetT3 ∧ deadlineT2 ≥ 15 ∧ 20 ≥ deadlineT2 ∧ 4 ≥ offsetT1 ∧ offsetT3 ≥ 0 ∧ deadlineT1 = 5 ∧ offsetT2 = 0 ∧ deadlineT3 = 60 OR deadlineT2 > 11 ∧ 11 ≥ offsetT3 ∧ deadlineT1 ≥ 4 ∧ offsetT3 > deadlineT1 ∧ 20 ≥ deadlineT2 ∧ 5 ≥ deadlineT1 ∧ offsetT2 = 0 ∧ offsetT1 = 0 ∧ deadlineT3 = 60 OR deadlineT2 > 11 ∧ 1 ≥ offsetT3 ∧ deadlineT2 ≥ 10 + offsetT2 ∧ offsetT2 ≥ 1 ∧ 20 ≥ deadlineT2 ∧ deadlineT1 ≥ offsetT2 ∧ 5 > deadlineT1 ∧ offsetT3 ≥ 0 ∧ deadlineT1 ≥ 4 ∧ offsetT1 = 0 ∧ deadlineT3 = 60 OR 20 ≥ deadlineT2 ∧ deadlineT1 ≥ 4 ∧ offsetT1 > 0 ∧ deadlineT1 ≥ 1 + offsetT1 ∧ deadlineT2 > 11 ∧ offsetT3 > 1 + offsetT1 ∧ 5 ≥ deadlineT1 ∧ 5 ≥ offsetT3 ∧ offsetT2 = 0 ∧ deadlineT3 = 60 OR offsetT1 >= 0 ∧ deadlineT2 > 11 ∧ offsetT1 + 1 ≥ offsetT3 ∧ deadlineT1 ≥ 4 ∧ deadlineT2 ≥ 11 + offsetT1 ∧ 20 ≥ deadlineT2 ∧ offsetT3 ≥ 0 ∧ 5 > deadlineT1 ∧ deadlineT1 ≥ 1 + offsetT1 ∧ offsetT2 = 0 ∧ deadlineT3 = 60 OR offsetT2 > 5 ∧ 20 ≥ deadlineT2 ∧ offsetT1 ≥ 0 ∧ deadlineT1 ≥ 4 ∧ deadlineT2 ≥ 10 + offsetT2 ∧ 5 ≥ deadlineT1 ∧ deadlineT1 ≥ 1 + offsetT1 ∧ deadlineT2 ≥ 19 ∧ offsetT3 = 0 ∧ deadlineT3 = 60 OR deadlineT2 > 11 ∧ offsetT3 > 0 ∧ 20 ≥ deadlineT2 ∧ 5 ≥ offsetT3 ∧ offsetT2 = 0 ∧ deadlineT1 = 5 ∧ offsetT1 = 0 ∧ deadlineT3 = 60 OR deadlineT2 > 11 ∧ 19 > deadlineT2 ∧ offsetT2 ≥ 1 ∧ 5 > offsetT2 ∧ offsetT3 > 0 ∧ deadlineT2 ≥ 10 + offsetT2 ∧ 1 ≥ offsetT3 ∧ offsetT1 = 0 ∧ deadlineT1 = 5 ∧ deadlineT3 = 60 OR deadlineT2 > 11 ∧ deadlineT1 ≥ 4 ∧ 5 ≥ deadlineT1 ∧ offsetT3 > 0 ∧ 1 > offsetT2 ∧ 20 ≥ deadlineT2 ∧ offsetT2 ≥ offsetT3 ∧ offsetT1 = 0 ∧ deadlineT3 = 60 OR 19 > deadlineT2 ∧ offsetT3 ≥ 0 ∧ offsetT2 > deadlineT1 ∧ deadlineT2 ≥ 10 + offsetT2 ∧ 5 > offsetT2 ∧ 1 ≥ offsetT3 ∧ deadlineT1 ≥ 4 ∧ offsetT1 = 0 ∧ deadlineT3 = 60
∧ offsetT3 >= 0 ∧ offsetT2 >= offsetT3 ∧ 1 >= offsetT3 ∧ offsetT1 = 0 OR offsetT3 > offsetT2 ∧ 1 >= offsetT2 ∧ offsetT2 >= 0 ∧ 11 >= offsetT3 ∧ offsetT1 = 0 OR offsetT2 >= 0 ∧ offsetT1 > 0 ∧ 11 >= offsetT2 ∧ 4 >= offsetT1 ∧ offsetT3 = 0 OR offsetT1 > 0 ∧ 11 >= offsetT3 ∧ offsetT3 > 0 ∧ 4 >= offsetT1 ∧ offsetT2 = 0
offsetT3 >= 10 ∧ 7 >= 2 * offsetT1 ∧ 2 * offsetT1 > 5 + 2 * offsetT2 ∧ 23 >= 2 * offsetT3 ∧ offsetT1 >= 3 ∧ 2 * offsetT2 + 7 > 2 * offsetT1 ∧ offsetT2 >= 0 ∧ offsetT1 > 2 + offsetT2 OR offsetT2 + 2 * offsetT3 + 3 > 3 * offsetT1 ∧ offsetT2 >= 0 ∧ 2 * offsetT3 > 1 + 2 * offsetT1 ∧ 19 >= 2 * offsetT3 ∧ 2 * offsetT2 + 7 > 2 * offsetT1 ∧ offsetT1 >= 3 + offsetT2 ∧ 7 >= 2 * offsetT1 OR offsetT2 >= 5 ∧ offsetT3 >= 0 ∧ 23 >= 2 * offsetT2 ∧ 1 >= offsetT3 ∧ offsetT1 = 0 OR offsetT1 >= 0 ∧ offsetT2 > 0 ∧ offsetT3 > 5 + offsetT2 ∧ offsetT2 >= offsetT1 ∧ offsetT1 + 1 >= offsetT2 ∧ 1 > 2 * offsetT1 ∧ 19 >= 2 * offsetT3 OR 19 >= 2 * offsetT3 ∧ offsetT1 >= 0 ∧ offsetT3 > 5 ∧ offsetT2 > 1 + offsetT1 ∧ 2 > offsetT2 OR 23 >= 2 * offsetT2 ∧ offsetT2 >= 5 ∧ offsetT1 >= 0 ∧ offsetT3 > 1 + offsetT1 ∧ 3 >= 2 * offsetT3 OR 2 * offsetT3 + 1 > 2 * offsetT1 + 2 * offsetT2 ∧ offsetT3 >= 3 + offsetT2 ∧ 2 * offsetT3 > 5 + 2 * offsetT2 ∧ offsetT1 + offsetT3 > 6 + 2 * offsetT2 ∧ offsetT1 >= 3 + offsetT2 ∧ 2 * offsetT1 + 1 >= 2 * offsetT3 ∧ 7 >= 2 * offsetT1 ∧ offsetT2 >= 0 OR 2 * offsetT1 > 7 ∧ offsetT2 >= 0 ∧ offsetT3 > 5 ∧ offsetT1 > 3 + offsetT2 ∧ 19 >= 2 * offsetT3 ∧ 4 >= offsetT1 OR offsetT3 > 11 ∧ offsetT1 + 1 >= offsetT2 ∧ offsetT1 >= 0 ∧ 1 > 2 * offsetT1 ∧ offsetT2 > 0 ∧ offsetT2 >= offsetT1 ∧ 23 >= 2 * offsetT3 OR 1 > 2 * offsetT1 ∧ offsetT3 > 5 ∧ offsetT1 + 1 >= offsetT2 ∧ offsetT2 > offsetT1 ∧ 2 * offsetT2 > 1 + 2 * offsetT1 ∧ offsetT2 + 5 >= offsetT3 ∧ offsetT1 >= 0 OR offsetT1 >= 0 ∧ 2 * offsetT2 + 19 >= 2 * offsetT3 ∧ 6 * offsetT2 + 35 > 4 * offsetT3 ∧ offsetT3 >= 10 ∧ 2 * offsetT2 >= 3 ∧ 2 > offsetT2 ∧ offsetT2 > 1 + offsetT1 OR 5 >= offsetT3 ∧ 9 > offsetT1 + offsetT3 ∧ 5 > offsetT1 ∧ offsetT3 > offsetT1 ∧ 2 * offsetT3 > 1 + 2 * offsetT1 ∧ 4 >= offsetT1 ∧ 2 * offsetT1 >= 7 + 2 * offsetT2 ∧ offsetT2 >= 0 OR 3 >= 2 * offsetT2 ∧ offsetT3 >= 3 + offsetT2 ∧ offsetT2 > 0 ∧ 5 > offsetT3 ∧ offsetT1 = 0 OR offsetT2 + 3 >= offsetT3 ∧ 2 * offsetT1 + offsetT2 + 3 > offsetT3 ∧ offsetT3 >= offsetT2 ∧ offsetT1 >= 0 ∧ offsetT2 > 1 + offsetT1 ∧ 3 >= 2 * offsetT2 OR 4 * offsetT2 + 5 > 2 * offsetT1 + 2 * offsetT3 ∧ 2 * offsetT1 + 2 * offsetT2 + 2 > offsetT3 ∧ 2 * offsetT2 + 2 > offsetT3 ∧ 4 * offsetT1 + 2 * offsetT2 > 3 ∧ 2 * offsetT2 >= 3 ∧ offsetT1 >= 0 ∧ offsetT3 > 3 + offsetT2 ∧ offsetT2 > 1 + offsetT1 ∧ 5 >= offsetT3

C.1 Reaction-diffusion PDEs

Let us consider the special class of partial differential equations, called "reactiondiffusion" equations. For the sake of notation simplicity, we focus on 1D reactiondiffusion equations with Dirichlet boundary conditions (the domain Ω is of the form [0, ℓ] ⊂ R), but the method applies to 2D or 3D reaction-diffusion equations with other boundary conditions. A 1D reaction-diffusion system with Dirichlet boundary conditions is of the form (P ):

∂y(x, t) ∂t = σ ∂ 2 y(x, t) ∂x 2 + f (y(x, t)), t ∈ [0, ∞], x ∈ Ω. y(0, t) = b 0 (t), y(ℓ, t) = b ℓ (t).
Here, y = y(x, t) is an R d -valued unknown function, Ω is a bounded domain in R with boundary ∂Ω := {0, ℓ}, f is a function from Ω × [0, ∞] to [0, γ] d , and σ a positive constant, called "diffusion constant". Besides, we have:

y(x, 0) = y 0 (x), x ∈ Ω ≡ [0, ℓ],
where y 0 (x) is a given function called initial condition.

We assume (see e.g. [START_REF] Shafi | Spatial uniformity in diffusively-coupled systems using weighted L2 norm contractions[END_REF]):

A1 f (x,

C.2 Centered finite difference scheme

For the sake of notation simplicity, we let here d = 1. Given system (P ), let us apply the centered difference scheme (see, e. g., [START_REF] Koto | IMEX Runge-Kutta schemes for reaction-diffusion equations[END_REF]) for transforming it into a system of continuous time ODEs. Let M be a positive integer, h = ℓ/(M + 1), and let Ω h be a uniform grid with nodes x j = jh, j = 1, . . . , M . By replacing the 2nd order spatial derivative with the second order centered difference, we obtain an ODE of the form:

(O h ) : dy h (t) dt = σL h y h (t) + σφ h (b) + f (y h (t)),
with y h (t) = [y 1 h (t), . . . , y M h (t)] ⊤ , y j h (t) ≈ y(t, x j ), and

L h = 1 h 2          -2 1 0 • • • 0 1 -2 1 • • • 0 0 1 -2 • • • 0 • • • 0 0 • • • 1 -2          φ h (b) = 1 h 2 [b 0 (t), 0, . . . , 0, b ℓ (t)] ⊤ .
Here, L h is a M × M -matrix (called Laplacian matrix), and φ h (b) a vertical M -vector. Let us abbreviate the system (O h ) as

dy h dt = σφ h (b) + F h (y h ) with F h (y h ) ≡ σL h y h + f (y h ).
We denote by Y h y 0 (t) the solution of (O h ) at time t ≥ 0 with initial condition y

0 = [y 1 0 , . . . , y M 0 ] ∈ [0, γ] M , where y i 0 = y 0 (ih), i = 1, . . . , M . Finally, let S h ≡ [0, γ] M . Definition C.1. The Lipschitz constant for F h on S h , denoted by L h , is defined by (i) L h := sup y 1 ̸ =y 2 ∈S h ∥F h (y 1 ) -F h (y 2 )∥ ∥y 1 -y 2 ∥ .
The one-sided Lipschitz (OSL) constant for F h on S h , denoted by λ h , is defined by

(ii) λ h := sup y 1 ̸ =y 2 ∈S h ⟨F h (y 1 ) -F h (y 2 ), y 1 -y 2 ⟩ ∥y 1 -y 2 ∥ 2 ,
where ⟨•, •⟩ denotes the scalar product of two vectors of S h , and ∥ • ∥ the Euclidean norm1 .

The constants L h and λ h can be computed using a (nonlinear) constraint optimisation solver via formula (i) and (ii) (see, e. g., [START_REF] Le Coënt | Control synthesis of nonlinear sampled switched systems using Euler's method[END_REF]).

The ODE (O h ) is said to be dissipative if we have λ h < 0 (see [START_REF] Chartier | A parallel shooting technique for solving dissipative ODE's[END_REF][START_REF] Aminzare | Contraction methods for nonlinear systems: A brief introduction and some open problems[END_REF]). Note that it is always possible to make (O h ) dissipative by augmenting sufficiently its diffusion coefficient σ (see, e. g., [START_REF] Chartier | A parallel shooting technique for solving dissipative ODE's[END_REF][START_REF] Le | Guaranteed optimal reachability control of reaction-diffusion equations using one-sided Lipschitz constants and model reduction[END_REF]). We suppose in the following that (O h ) is dissipative.

Remark 9. By Proposition 4 of [START_REF] Aminzare | Logarithmic Lipschitz norms and diffusion-induced instability[END_REF] for the Euclidean norm ∥ • ∥, λ 1 can also be defined on any convex domain D as:

λ 1 := sup y∈D\{0} lim ε→0 ∥y + εJ[F h (y)](y)∥ -∥y∥ ε∥y∥ ,
where J[F h (y)] is the Jacobian matrix of F h at y

∂F 1 (y) ∂u ∂F 1 (y) ∂v ∂F 2 (y) ∂u ∂F 2 (y) ∂v
The ODE (O h ) is said to be contractive on S 1 if we have λ 1 < 0 (see [START_REF] Chartier | A parallel shooting technique for solving dissipative ODE's[END_REF][START_REF] Aminzare | Contraction methods for nonlinear systems: A brief introduction and some open problems[END_REF]).

Error bound for Euler's method

Let us now approximate the solution x z of ẋ = f(x) with initial condition z ∈ R d × R d , by time integration using the forward Euler method. Given a starting point w ∈ D ⊆ R d × R d , we denote by xw (t) the Euler-based image of w, using a time-step τ > 0, at time t ∈ [0, τ ], defined by: xw (t) := w + t f(w).

The Euler-based image xw (t) is computed for all

t ∈ [0, ∞) by iteration on each interval [t k , t k+1 ] with t k = kτ (k ≥ 0).
We now give a result that reflects the error of the Euler-based approximate solution xw in relation to the exact solution x z .

Proposition C.1 ([LCDVCF17]). (guaranteed integration) Consider

a system ẋ = f(x) on D ⊆ R d × R d of associated OSL constant λ ∈ R, a point w ∈ D and a point z ∈ B(w, ε) ⊂ D 2 for some ε > 0.
We have for all t ∈ [0, τ ]:

x z (t) ∈ B(x w (t), δ λ ε (t)),
where x z (t) is the solution of ẋ = f(x) at time t for initial condition z.

We suppose that the state space

R d × R d is decomposed into I (overlapping) domains {D i ≡ D 1 i × D 2 i } 1≤i≤I . We suppose besides that each D i ⊆ R d × R d is associated with an OSL constant (upperbounded by) λ i ∈ R.
We consider, at initial time, a ball B(0) of the form B(w, ε) with w = (w 1 , w 2 ) and ε > 0 (so B(w, ε) ≡ (B(w 1 , ε), B(w 2 , ε))). We assume that the initial point z = (z 1 , z 2 ) of the solution x(t) of ẋ = f(x) belongs to B(0); the center w of B(0) can thus be viewed as an approximate value of z.

Let us define recursively a growth function d(k), using Definition E.3, as follows: 2 B(w, ε) denotes the ball of center w and radius ε; it contains all the points y such that ∥y -w∥ ≤ ε. 3 In practice, the dynamic value λ at time t ∈ [kτ, (k + 1)τ ] is computed as follows: the value of λ(kτ ) and λ((k + 1)τ ) are computed, using the Jacobian formula, for the center of balls B(k) and B(k + 1) respectively, and the maximum of the two values is assigned to λ for t ∈ [kτ, (k + 1)τ ]. print (" minimum m +" , min_wall_top_u1 ) print (" maximum M -=" , ma x_ wa ll_ bo tt om _u 1 ) for i in range (0 , periods ) : print ( i + 1 , " th period : from " , i_one_period * i , " ->" , i_one_period * ( i + 1) , " sum ( lambda ) = " , sum ( all_lambda [ i * i_one_period : In total, we have 3 k = 3 16 possible control cases. We then perform 3 experiences:

• d(0) = ε, • d(k + 1) = δ λ d(k) (τ ), where λ ∈ R is the maximum of the OSL constants λ i of the domains D i ≡ D 1 i × D 2 i traversed
1. We randomly pick one sample over every 1000 possible controls, which gives 3 16 /1000 ≈ 43, 047 samples.

2. We randomly pick one sample over every 100 possible controls, which gives 3 16 /100 ≈ 430, 467 samples.

3.

4. We randomly pick one sample over every 10 possible controls, which gives 3 16 /10 = 4, 304, 672 samples.

For each experience, we select the control sequence u * that optimizes the cost function (Eq. (7.10)) while satisfying the constraint on the state X (Eq. (7.11)). These 3 experiences give the following results: example is 3683 seconds.

We can see on these 3 experiments that, despite the multiplication by 10 each time of the number of samples (which leads to a multiplication of the CPU time by 3 and then by 10), the optimal cost K increases only slightly (here, the optimum K corresponds to a "maximin", not a "minimax" as described in Section 7.4.2). The results are comparable to those obtained by [START_REF] Houska | Approximate robust optimization of time-periodic stationary states with application to biochemical processes[END_REF], despite the use of a much simpler method (without gradient descent).6 This experiment thus illustrates the interest of our method by symbolic computation coupled with random sampling.

D

Appendix: Convergence and robustness of the Hopf oscillator applied to an ABLE exoskeleton: reachability analysis and experimentation [START_REF] Teramae | EMGbased model predictive control for physical human-robot interaction: application for assist-as-needed control[END_REF][START_REF] Treussart | Controlling an upper-limb exoskeleton by EMG signal while carrying unknown load[END_REF] or electroencephalography [START_REF] Dindorf | Using the bioelectric signals to control of wearable orthosis of the elbow joint with bi-muscular pneumatic servo-drive[END_REF]. Other biological signals such as gaze were also included in the control strategies to detect human intention [KLB + 20]. All these strategies rely on the appearance of the signals considered before the appearance of the movement kinematics, which is called electromechanical delay in the case of myoelectrical signals. Another proposed approach was to learn the human movement [START_REF] Jarrasse | How can human motion prediction increase transparency[END_REF], which led to a significant reduction of unwanted interaction efforts in reaching movements.

In the case of periodical movements, approaches based on adaptive oscillators have been proposed and successfully experimented [RBI06, RI06, RBI09, RVL + 11]. At the theoretical level, the authors of [START_REF] Righetti | Dynamic hebbian learning in adaptive frequency oscillators[END_REF] proved the stability of the model of one of these oscillators: the Hopf oscillator. The proof uses the classical "perturbation method" that consists in introducing an infinitesimal perturbation ε in the model, expressing the solution as a power series in ε, and showing the positiveness of the radius of convergence of the series. The Hopf oscillator is also considered here, but the stability is proven by introducing a bounded perturbation w (instead of an infinitesimal perturbation ε) taking its values non-deterministically in a given set W of the form [-c; c] with c > 0. In order to show the stability of the system in presence of such perturbations, we make use of a recent development of the method of "reachability analysis" (see [START_REF] Althoff | Set Propagation Techniques for Reachability Analysis[END_REF] for a survey). Given an initial set of states S 0 , this method constructs iteratively by "set-based integration" the set S 1 of the states reached at the end of one time step, then S 2 at the end of a new time step, etc. These sets S 1 ; S 2 ; ... are over-approximations of the exact sets of solutions of the system, for any initial state in S 0 and for any admissible perturbation taking its values in W. When one succeeds in generating a finite representation of the set I := ∪ ∞ i=0 S i , one obtains a description of a superset of all the states that can be reached from S 0 . The set I is an invariant set of the system: the trajectory from any point of I remains in I indefinitely (see [START_REF] Blanchini | Set invariance in control[END_REF]). We explain here how to successfully generate such a set I for the Hopf oscillator.

In the present work, this previously defined oscillator [RVL + 11] is applied to an upper-limb exoskeleton to design a transparent control. Transparency is defined as the interaction between the human and the exoskeleton with minimum efforts. The objective here is to formally prove the convergence and stability of the oscillator and confirm the obtained proof with experimental results. The theoretical development allows a priori evaluation of whether the system converges to a limit cycle and is robust to non-deterministic bounded amplitude disturbances. In particular, the experiments have confirmed the invariance property of the set I: once a first experimental datum relative to the arm position lies in I, all the subsequent data also lie in I. In the present study, the transparent control mode is chosen to experimentally evaluate the stability of the oscillator, independently from model errors that can appear when using assistance control modes and that can lead to instability [RVL + 11]. In this control mode, the human movement should be impacted as little as possible by the exoskeleton [AZI + 18, JPPM08, BVGB18, VBV + 21b]. The experiments are conducted on elbow flexion/extension with an upper-limb exoskeleton called ABLE [SBCF14, GFMP08] (see Appendix E.2 for details). This work is done as part of a collaboration with Abdelwaheb Hafs 1,2 , Dorian Verdel 1,2 , Olivier Bruneau 3 , Nicolas Vignais 1,2 , Bastien Berret 1,2,4 and Laurent Fribourg

D.2 Material and methods

D.2.1 Adaptive oscillators

As mentioned in the introduction, human intention prediction may be achieved by adaptive oscillators for periodic movements. These oscillators allow to estimate the fundamental parameters (amplitude and frequency) of arbitrary rhythmic signals in a supervised learning framework. Among different types of adaptive oscillators, we focus here on the Hopf oscillator, which is one of the most widely used types in the field of robotics and assistive technology [RVL + 11, RBI06, WQY + 19, ZWL + 18].

D.2.2 Exoskeleton modeling

ABLE is an upper limb exoskeleton. This exoskeleton is based on a screw and cable transmission allowing high levels of reversibility and transparency [START_REF] Garrec | an Innovative Transparent Exoskeleton for the Upper-Limb[END_REF][START_REF] Garrec | Screw and Cable Acutators (SCS) and Their Applications to Force Feedback Teleoperation, Exoskeleton and Anthropomorphic Robotics[END_REF]. It has four active degrees of freedom (see Fig. E.10). The first three correspond to rotations of the human shoulder, the fourth correspond to rotation of the elbow (flexion/extension). The physical interfaces between the exoskeleton and the user include passive rotations and translation to minimize undesired efforts due to the connection hyperstatism [START_REF] Jarrasse | Connecting a Human Limb to an Exoskeleton[END_REF][START_REF] Schiele | Influence of attachment pressure and kinematic configuration on pHRI with wearable robots[END_REF]. Additional settings are available to adapt the exoskeleton to the user. The robot is mounted on a fixed frame with a winch to adapt its height.

D.3 Reachability Analysis

We focus here on sinusoidal inputs (corresponding to sinusoidal movements of the users) with bounded uncertainty.

The stability of the Hopf oscillator was proved in [RBI06] using the "perturbation method". The perturbation method was developed in the 19th century by Laplace and others to show, for example, the orbital stability of the moon around the Earth despite the influence of the sun. Roughly speaking, the equation of the ideal motion (without perturbation) is modified by injecting an infinitesimal value ε, and the solution of the modified equation is expressed as a power series in ε. The stability is demonstrated by showing that the radius of convergence of the series is non-zero. We prove here the stability of the Hopf oscillator using the method of "reachability analysis". Reachability analysis has been developed since a couple of decades in the community of formal methods and model checking (see [START_REF] Althoff | Set Propagation Techniques for Reachability Analysis[END_REF] for a recent review). In this method, one is given a set S 0 of initial points and a perturbation w, which is not infinitesimal as in the perturbation method, but of bounded amplitude (typically w ∈ W = [-c, c] with c > 0). Reachability analysis then constructs by "set-based integration" first the set S 1 of the states reached at the end of one time step, then S 2 at the end of a new time step, etc. These sets S 1 , S 2 , . . . are over-approximations of the exact sets of solutions of the system, for any initial state in S 0 and for any admissible perturbation taking its values non-deterministically in W. The set K k=0 S k characterises a superset of all the states on the time interval [0, Kh], where h is the time-step size. This set is often referred to as the "reachability tube".

In the case where we can detect that at a time t = Lh for some L ∈ N, the set of states S L is contained in the tube currently generated (S L ⊂ L-1 k=0 S k ), we obtain a D.3. Reachability Analysis 233 finite representation of a superset of all the states that can be reached from S 0 . The set I = L k=0 S k is an invariant set of the system: the trajectory from any point of I remains in I indefinitely (see [START_REF] Blanchini | Set invariance in control[END_REF]). For an oscillatory system, this invariant set is shaped like a tube rounding on itself (a "doughnut" in 3D). In [START_REF] Fribourg | Euler's method applied to the control of switched systems[END_REF], we represented the set S k as a ball B(y k , δ(k)) of centre y k and radius δ(k). The centre y k of the ball B(y k , δ(k)) is the value computed by Euler's explicit method at the k-th step. The radius δ(k) is determined by an analytical formula giving an upper bound on the error introduced by Euler's method (see [START_REF] Fribourg | Euler's method applied to the control of switched systems[END_REF]). The detection of the inclusion S L ⊆ L-1 k=0 S k , is done by finding a value K such that B(y L , δ(L)) ⊆ B(y K , δ(K))

with L = K + ℓh for some integer ℓ. The value T = ℓh is the estimated value of the system period (see [START_REF] Jerray | Robust optimal periodic control using guaranteed Euler's method[END_REF] for details). The invariant set I = L k=0 S k is here a looping tube, centred on a set of values y 0 , y 1 , . . . , y L corresponding to the "limit cycle" C of the system.

The main advantage of the reachability analysis over the perturbation method is its ability to take into account perturbations of a given amplitude, and to construct an invariant set I in which the state of the system is guaranteed to be confined. This allows us to characterize the "robustness" of the system against bounded perturbations.

Our method of reachability analysis has been implemented in Python in a software called ORBITADOR. Here ORBITADOR is applied to the system Eq. (D.2) for W = [ -2π 4000 , 2π 4000 ], h = 10 -3 (which corresponds to the real time sampling frequency of exoskeleton control), δ 0 = 0.084, and the initial condition x 0 = (α 1 (0), α 0 (0), ϕ(0), ω(0), θ(0)) = (0.059rad, 0.059rad, 0.123rad, 0.062rad/s, 0.

D.4.2 Kinematics

The kinematics of the human movement are measured by the opto-electronic motion capture device called "Qualysis". This system is composed of 10 cameras to capture the to an ABLE exoskeleton: reachability analysis and experimentation human movement at 179Hz. There are 7 reflecting markers placed on the participant forearm, which allow the construction of plans based on the recommendations of Ge Wu et al [WvD + 05]. The identification of the 7 markers is carried out using an AIM (Automatic Idenfication Markers) model on the Qualysis Track Manager software. In order to make the participant do oscillatory movements, a sinusoidally moving target is projected on a screen in front of the subject.

D.4.3 Data acquisition

The code which controls the exoskeleton, also allows us to obtain its position as well as the parameters of Hopf oscillator. This allows to analyze the convergence of the oscillator. The data is first cleaned up, keeping only the part where the experiment starts.

D.4.4 Motor task

The participant is first placed in the robot at a distance from the targets corresponding to 2 times the size of his arm. The first three axis of the exoskeleton were mechanically blocked to avoid unwanted movement. Then a moving target is projected in a big screen in front of the participant. The target moves vertically with a varying sinusoidal trajectory. The participant is asked to follow the target by performing only the flexion/extension of the elbow. The pointing position is computed as the intersection between the line of the index and the plan of the screen, it is then projected in real time in the screen as a visual feedback for the participant. The subject starts with the forearm pointed at the fixed target in the middle (starting target) and then starts the experiment when the target starts to move.

The target follows the following sinusoidal trajectory :

x(t) = A sin(ωt) , A = 0.3 rad, ω = 5 rad.s -1 . (D.4)

D.4.5 Experimental data

This section presents the behaviour of the set of states obtained in the experiment where we used the control scheme presented in Appendix E.2. More precisely, there are in total 10336 experimental data points: 4918 points for t < 4.918s and 5418 points for t ≥ 4.918s. All the 5418 points at t ≥ 4.918s are located inside the invariant set I. For t < 4.918s, the average of the distance between the experimental data and the limit cycle C is 0.0493 and the standard deviation 0.0255; for t ≥ 4.918s, the distance average is 0.0028 and the standard deviation 0.0023. As a conclusion, the experimental results allowed us to verify the efficiency of the Hopf oscillator on a complex robot such as ABLE.

D.5 Conclusion

We have described a methodology for 1. controlling the ABLE exoskeleton in a transparent manner by exploiting adaptive oscillators [RBI09, RBI06],

D.5. Conclusion 239

2. formally guaranteeing the convergence and robustness of the controlled system, at the model level, using a recent method of reachability analysis of periodic movements [START_REF] Jerray | Robust optimal periodic control using guaranteed Euler's method[END_REF], and 3. verifying all these properties at the experimental level, via a protocol on human subjects.

We have verified that all the data of the experiments (after a possible transient phase) are located within the controlled invariant set I found, at the theoretical level, by reachability analysis (see Appendix D.3).

We are presently enriching the model by taking into account additional axes of movement, and considering more sophisticated adaptive oscillators than the Hopf oscillator. We think that the methodology presented here (relying on control with adaptive oscillators, and formal verification via reachability analysis) is still well-suited to the validation of such extensions.

E.1 Introduction

Different approaches have been proposed in the literature in order to provide a deeper understanding of different optimization algorithms through the use of continuous-time differential equations. Indeed, the use of differential equations makes it possible to exploit the plethora of tools developed within dynamical systems analysis and control community in order to analyse stability and convergence properties. In this context, the authors in [START_REF] Su | A differential equation for modeling nesterov's accelerated gradient method: Theory and insights[END_REF] derived a continuous-time version of the Nesterov accelerated gradient and used a Lyapunov formulation to estimate the convergence rate. Finally, they transformed the continuous time Lyapunov function into a discrete-time version and provided a new proof of the convergence rate of the Nesterov accelerated gradient method. A similar Lyapunov-based approach has been used to provide proofs of the convergence rates for the Nesterov accelerated algorithm in [START_REF] Shi | Understanding the acceleration phenomenon via high-resolution differential equations[END_REF] and the accelerated mirror descent method in [START_REF] Krichene | Accelerated mirror descent in continuous and discrete time[END_REF]. However, all the aforementioned approaches fail to provide a general discretization procedure that generate a provably convergent optimization algorithm, except of the work in [START_REF] Zhang | Direct runge-kutta discretization achieves acceleration[END_REF], where the authors used a Runge-Kutta scheme for a particular case of an accelerated Nesterov algorithm. Indeed, the main difficulty comes from the fact that designing a Lyapunov function of a continuous-time ordinary differential equation (ODE) is the "art of the designer".

In this work, we explore another strategy that does not require an a priori knowledge of a Lyapunov function, but rather relies on the contractivity properties of the continuous-time differential equation. More precisely, we give here conditions as general as possible on the flow of ODEs in order to guarantee the convergence to 0 of the error in Euler's method, making use of an analytic formula δ(t) bounding this error at time t [START_REF] Le Coënt | Control synthesis of nonlinear sampled switched systems using Euler's method[END_REF]. This work is done as part of a collaboration with Adnane Saoud 1 and Laurent Fribourg 2 . 1 CentraleSupélec 2 Université Paris-Saclay, CNRS, ENS Paris-Saclay, LMF, Gif-Sur-Yvette, France

E.1.0 Comparison with related work

Let us mention that the concept of contractivity has been previously used in the literature, where the authors in [START_REF] Cisneros-Velarde | A contraction theory approach to optimization algorithms from acceleration flows[END_REF] were able to generate a contractive continuoustime version of the accelerated Nesterov algorithm.

Let us also note that an important part of the literature studies the convergence of the discretization error as the step size h → 0. In contrast here, the size h is constant while the number of steps k → ∞. Such a convergence at constant h was the subject of pioneering work by [START_REF] Dahlquist | Error analysis for a class of methods for stiff non-linear initial value problems[END_REF] who developed the notion of A-stability and studied the disk around the origin within which the error remains bounded. However, these studies concern a particular type of linear differential equation of the type ẋ = -αx with α > 0 (cf. [START_REF] Efimov | Realization and discretization of asymptotically stable homogeneous systems[END_REF] for extension to "homogeneous systems"), and not arbitrary differential equations as here.

Regarding the analysis of the gradient descent algorithm, it is well-known that the error (between the sequence generated by the algorithm and the optimal point) is non-decreasing when the step size satisfies h < 2/L, where L is the Lipschitz constant of the gradient [START_REF] Dahlquist | Error analysis for a class of methods for stiff non-linear initial value problems[END_REF][START_REF] María | Contractivity of runge-kutta methods for convex gradient systems[END_REF][START_REF] Nesterov | Introductory Lectures on Convex Optimization: A Basic Course[END_REF]. The same constraint is used here for the gradient descent (see Corollary 1), but, when coupled with an assumption of strong monotonicity, it is proved that the error tends to 0. We also make use of the property of co-coercivity (Theorem E.3) whose role has already been observed by Zhu and Marcotte [START_REF] Zhu | Co-coercivity and its role in the convergence of iterative schemes for solving variational inequalities[END_REF] in the different context of iterative schemes for solving variational inequalities.

E.1.0 Outline

Section E.2 recalls some classical results on convexity, strong monotonicity and cocoercivity. Section E.3 gives some sufficient conditions on the flow of the differential equation and the discretization time-step to make the error in Euler's method converge to 0. We give some final remarks in Section E.4.

E.2 Preliminaries

We start by recalling some definitions that will be used through the work. We first recall some classical results on convexity, monotonicity and co-coercivity (see, e.g., [START_REF] Nesterov | Introductory Lectures on Convex Optimization: A Basic Course[END_REF][START_REF] Boyd | Convex Optimization[END_REF][START_REF] Ryu | A primer on monotone operator methods[END_REF]). In this work, we focus on the Euclidean norm, denoted by ∥ • ∥. Definition E.1. Consider a continuously differentiable function f : R n → R. The function f is convex if, for all x, y ∈ R n : f (y) -f (x) ≥ (∇f (x)) ⊤ (y -x).

E. Appendix: Asymptotic Error in Euler's Method with a Constant Step Size

It f is convex and bounded from below, then a minimum of f exists in some x * ∈ R n , and ∇f (x * ) = 0. Definition E.2. A function g : R n → R n is • L-Lipschitz continuous if for all x, y ∈ R n : ∥g(x) -g(y)∥ ≤ L∥x -y∥.

• strongly monotone if there exists m > 0 such that, for all x, y ∈ R n :

(g(x) -g(y)) ⊤ (x -y) ≥ m∥x -y∥ 2 .

(E.1)

• co-coercive if there exists a positive constant a such that for all x, y ∈ R n :

(g(y) -g(x)) ⊤ (y -x) ≥ a∥g(y) -g(x)∥ 2 .

Remark 10. The property (E.1) of strong monotonicity is equivalent to saying that g has a negative one-sided Lipschitz constant (OSL) λ (see [START_REF] Dahlquist | Error analysis for a class of methods for stiff non-linear initial value problems[END_REF][START_REF] Hairer | Solving Ordinary Differential Equations II[END_REF]; cf Definition E.3 below), equal to -m.

We consider a differential system of the form ẋ(t) = g(x(t)) (E.2) with initial condition x 0 ∈ R n , where g : R n → R n is a differentiable Lipschitzian function of constant L > 0. Without loss of understanding, we will denote by x(t; x 0 ), or more simply by x(t), the solution of this system at time t.

We denote by y k the (explicit) Euler discretization of ẋ(t) = g(x(t)) at time t = kh, for k ∈ N, where h > 0 is a constant step size. Given an initial point y 0 ∈ R n , y k is defined, for k ≥ 1, by: y k = y k-1 + hg(y k-1 ) (E.3) Proposition E.1. On a domain where -g is strongly monotone (i.e., g has an OSL constant λ < 0), any two solutions x(t; x 0 ) and x(t; y 0 ) of (E.2) with initial conditions x 0 and y 0 respectively, converge to each other exponentially in time: ∥x(t; x 0 ) -x(t; y 0 )∥ ≤ ∥x 0 -y 0 ∥e λt .

It follows that there is at most one stationary point x * (with g(x * ) = 0). This result states that strong monotonicity leads to a form of contraction (as studied in [START_REF] Cisneros-Velarde | A contraction theory approach to optimization algorithms from acceleration flows[END_REF][START_REF] Wensing | Cooperative adaptive control for cloud-based robotics[END_REF]). Size {δ µ 0 (kh)} k≥ℓ is decreasing, and converges to a limit δ * ≥ 0 with rate r k . This limit δ * must satisfy (E.7), i.e.: (δ * )2 ≤ (δ * ) 2 e λh + C 2 k h 3 /(3|λ|).

Since C k = L∥g(y k )∥ → 0 as k → ∞ and e λh < 1, one must have δ * = 0. Therefore δ µ 0 (kh) → 0 with rate r k .

From Lemma E.1 and Theorem E.1, it follows:

Theorem E.2. Consider the system ẋ(t) = g(x(t)), with g : R n → R n L-Lipschitz continuous. Let x(t) and (y k ) as defined in (E.2) and (E.3) respectively. Suppose:

1. ∥g(y k )∥ → 0 with a convergence rate r k , 2. g of OSL constant < 0 (i.e., -g strongly monotone).

Then δ µ 0 (kh) → 0 and ∥y k -x(kh)∥ → 0 with a convergence rate r k as k → ∞.

Note that Theorem E.2 applies even if ∥y k ∥ → ∞, as shown in Example E.1.

Remark 11. For the sake of simplicity of the statement, we assume in Theorem E.2 (as well as Theorem E.3 and Corollary E.3 below), that the property of Lipschitz continuity and strong monotonicity (as well as, later on, co-coercivity and existence of stationary point) hold over all R n . In fact, it is enough that these properties hold on a subdomain D ⊂ R n only, provided that D be "invariant" in the following sense: there exists ℓ ∈ N such that for all k ≥ ℓ, B(y k , δ µ 0 (kh)) ⊆ D 2 .

Example E.1. Let g(x) = 1 2 √

x , y 0 = 1, h = 0.5, µ 0 = 0.5, and let D = [1, +∞). We have y k+1 = y k + h 1 2 √ y k > y k , therefore {y k } is an increasing sequence which converges to +∞, and g(y k ) = 1

E.3.3 Application to gradient descent

An immediate consequence of Theorem E.2, using Lemma E.1 and Proposition E.4 with g = -∇f , is the following result (which avoids mentioning ∥g(y k )∥ → 0 as an explicit hypothesis).

E.3.4 Co-coercivity

The following result is a generalization of Corollary 1.

Theorem E.3. Consider the system ẋ(t) = g(x(t)), with g : R n → R n L-Lipschitz continuous. Let x(t) and (y k ) as defined in (E.2) and (E.3) respectively. Suppose

E.4 Conclusion

In this work, we have focused on the following problem: given an ODE ẋ = g(x) and the sequence (y k ) generated by its discretization with explicit Euler's method, what are the sufficient conditions on g to ensure that the discretization error ∥x(kh) -y k ∥ converges to 0 as k → ∞? In particular, under certain properties of g called "strong monotonicity" and "co-coercivity", we have shown the convergence of the discretization

1 Introduction

 1 The first chapter introduces real-time systems and highlights the motivation of the research conducted in the first part the thesis Contents 1.1 Context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1.1 Scheduling . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1.2 Real-time systems . . . . . . . . . . . . . . . . . . . . . . . 1.1.3 Formal methods . . . . . . . . . . . . . . . . . . . . . . . . 1.1.4 Model checking . . . . . . . . . . . . . . . . . . . . . . . . 1.1.5 Timed Automata . . . . . . . . . . . . . . . . . . . . . . . 1.2 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3 Related works . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.1 Scheduling . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.2 Scheduling with model checking . . . . . . . . . . . . . . . . 1.3.3 Scheduling with parameters . . . . . . . . . . . . . . . . . . 1.4 Plan of Part I . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 1 . 1 :

 11 Figure 1.1: An example of timed automata modeling a flashlight

Figure 3 . 1 :

 31 Figure 3.1: An example of a flight control system

Figure 3 . 2 :

 32 Figure 3.2: The communication between threads

Fig. 3 .Figure 3 . 3 :

 333 Figure 3.3: Some typical reactivities

Figure 3 . 4 :

 34 Figure 3.4: Determinism and reactivities

Figure 3 . 5 :

 35 Figure 3.5: Example of Worst Case Execution Times

Figure 3 . 6 :

 36 Figure 3.6: Real-time characteristics of the system

Figure 3 . 7 :

 37 Figure 3.7: A typical solution of the flight control scheduling problem

Figure 3 . 8 :

 38 Figure 3.8: Automaton periodicControl

  Figure 3.9: Fragment of automaton threadT1

Figure 3 . 10 :

 310 Figure 3.10: Encoding the FPS scheduler (simplified version)

Figure 3 . 11 :

 311 Figure 3.11: Encoding reactivity Navigation → Monitoring

Figure 3 . 13 :

 313 Figure 3.13: Encoding the FPS scheduler without and with switch (fragment)

Figure 3 . 14 :

 314 Figure 3.14: Gantt chart of the system GNC with switch time = 500 µs

Figure 3 . 15 :

 315 Figure 3.15: Encoding the FPS scheduler with switches (full version)

48 3 .

 3 Parametric schedulability analysis of the flight control of a space launcher

Figure 3 . 16 :

 316 Figure 3.16: scheduling GNC without reactivities using Cheddar

Figure 3 . 17 :

 317 Figure 3.17: Parametric offsets

Figure 3 . 18 :

 318 Figure 3.18: Parametric offsets for model with switch time

Figure 3 . 19 :

 319 Figure 3.19: Parametric deadlines for model with switch time

54 3 .

 3 Parametric schedulability analysis of the flight control of a space launcher

when offsets are 56 3 .

 3 Parametric schedulability analysis of the flight control of a space launcher

Figure 4 . 1 :

 41 Figure 4.1: Example of a Time4sys design

Figure 4 . 2 :

 42 Figure 4.2: GUI of Time4sys2imi

Figure 4 . 3 :

 43 Figure 4.3: Workflow of Time4sys2imi

66 4 .

 4 Formalize real-time system models under uncertainty

Figure 4

 4 Figure 4.4: Detailed architecture

  Contents 5.1 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 5.2 Perspectives . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Contents 6 . 1

 61 Context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.1.1 Robust control . . . . . . . . . . . . . . . . . . . . . . . . . 6.1.2 Limit cycle . . . . . . . . . . . . . . . . . . . . . . . . . . 6.1.3 Stability . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.1.4 Euler method . . . . . . . . . . . . . . . . . . . . . . . . . 6.2 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 7 . 1 :

 71 Figure 7.1: Illustration of Proposition 7.1

Remark 4 .

 4 The complexity of PROC ε k is O(m × k × N ) where m is the number of modes (|U | = m), k the time-horizon length (t end = kτ ) and N the number of cells of X (N = K d with K = √ M /2ε). (N = K d ).

Figure 7 . 2 :

 72 Figure7.2: Robust method applied to MRI for K = 10 and initial condition q 2 (0) = (0.1, 1), with q 1 = (y 1 , z 1 ) (top left), q 2 = (y 2 , z 2 ) (top right) and control u 2 (bottom). When applied to q 2 (0) = (0, 1), the method gives the same results.

Figure 7 . 4 :

 74 Figure 7.4: Dual-tank bioreactor which maximize the production of biogas in the secondreactor during 1 day with initial conditions (y(0), s(0), x(0)) = (5.657, 1.569 × 10 -6 , 6.463) and T f = 10. In the top-left, we show y(t). In the top-right, we present s(t). In the bottom-left, we illustrate x(t). In the bottom-right, we have the control u(t).

Figure 7 . 5 :

 75 Figure 7.5: Dual-tank bioreactor which maximize the production of biogas in the secondreactor during 100 days with initial conditions (y(0), s(0), x(0)) = (5.657, 1.569× 10 -6 , 6.463) and T f = 1000. In the top-left, we show y(t). In the top-right, we present s(t). In the bottom-left, we illustrate x(t). In the bottom-right, we have the control u(t).

Figure 7 . 6 :

 76 Figure 7.6: Dual-tank bioreactor which maximize the production of biogas in the second reactor during 1 day with initial conditions (y(0), s(0), x(0)) = (5.8, 0.01, 6.44) and T f = 10. In the top-left, we show y(t). In the top-right, we present s(t).In the bottom-left, we illustrate x(t). In the bottom-right, we have the control u(t).

  and the battery loss by SF I out cost B Ah B with I out = 3P out /U B and SF = (-4SOC 2 + 5)/5" » Let ∼ ρ = 0.85, Q B = 123, K = 0.471 , U B = 576, Ah B = 124200 and cost B = 10 7

Figure 7 . 7 :

 77 Figure 7.7: Dual-tank bioreactor which maximize the production of biogas in the second reactor during 100 days with initial conditions (y(0), s(0), x(0)) = (5.8, 0.01, 6.44) and T f = 1000. In the top-left, we show y(t). In the top-right, we present s(t).In the bottom-left, we illustrate x(t). In the bottom-right, we have the control u(t).

Figure 7 . 8 :

 78 Figure 7.8: Microgrid energy management system which minimize the overall diesel consumption with initial conditions SOC(0) = 0.76 and T f = 48. In the top-left, we show SOC(t). In the top-right, we present the diesel consumption. In the bottom, we illustrate the battery consumption

Figure 7 . 9 :

 79 Figure 7.9: The controls of the microgrid energy management system shown in Fig. 7.8. In the top-left, we show P D (t). In the top-right, we present P I (t). In the bottom, we give P O (t)

Figure 7 . 10 :

 710 Figure 7.10: Top: control u * satisfying the constraint on X, obtained by selection among 655 samples picked randomly; bottom: P (t) under u * without perturbation (red curve) and with an additive perturbation w ∈ [-0.05, 0.05] (green curve) over 1 period (T = 48) for ∆t = 1/400 and initial condition (X(0), S(0), P (0)) = (6.52, 12.5, 22.4).

Figure 7 . 11 :

 711 Figure 7.11: Same Figure as Fig. 7.10 but with 6554 samples (instead of 655).

Fig. 7 .

 7 Fig.7.13 shows the approximate Euler solution of x in red, the control sequence, the invariant I in green and its radius δ W (t). The control sequence search time is 12 seconds and the computation takes 1092 seconds of CPU time.

Figure 7 . 12 :

 712 Figure 7.12: Same Figure as Fig. 7.10 but with 65536 samples (instead of 655).

Figure 7 . 13 :

 713 Figure 7.13: When τ = 6, biochemical process with an additive perturbation ∥w∥ ≤ 0.01 over 4 periods (4T = 192) for ∆t = 1/200 and initial condition (X(0), S(0), P (0)) = (6.52, 12.5, 22.4), from top left to bottom right: X(t), S(t), P (t), control S f (t), δ W (t) and a 3D view of the invariant I represented by the green shape.

Figure 7 . 14 :

 714 Figure 7.14: When τ = 4, biochemical process with an additive perturbation ∥w∥ ≤ 0.01 over 4 periods (4T = 192) for ∆t = 1/200 and initial condition (X(0), S(0), P (0)) = (6.52, 12.5, 22.4), from top left to bottom right: X(t), S(t), P (t), control S f (t), δ W (t) and a 3D view of the invariant I represented by the green shape.

Figure 7 . 15 :

 715 Figure 7.15: When τ = 3, biochemical process with an additive perturbation ∥w∥ ≤ 0.01 over 4 periods (4T = 192) for ∆t = 1/200 and initial condition (X(0), S(0), P (0)) = (6.52, 12.5, 22.4), from top left to bottom right: X(t), S(t), P (t), control S f (t), δ W (t) and a 3D view of the invariant I represented by the green shape.

Figure 7 . 16 :

 716 Figure 7.16: When τ = 2, biochemical process with an additive perturbation ∥w∥ ≤ 0.01 over 4 periods (4T = 192) for ∆t = 1/200 and initial condition (X(0), S(0), P (0)) = (6.52, 12.5, 22.4), from top left to bottom right: X(t), S(t), P (t), control S f (t), δ W (t) and a 3D view of the invariant I represented by the green shape.

  Fig. 8.1 shows the cyclic approximate solution L of Σ p 0 in the plane phase (top), and the radius δ(t) of the invariant I W 0 of Σ p (bottom). The invariant I W 0 with |W 0 | = 0.02 is depicted in green on Fig. 8.1 (top), and it can be seen that I W 0 encloses all the solutions of Σ p for p ∈ [p 0 -|W 0 |/2, p 0 +|W 0 |/2] = [0.39, 0.41], as stated by Proposition 7.2.

Figure 8 . 1 :

 81 Figure 8.1: In the top figure, the red cycle represents the approximate Euler solution of Σ p 0 in the phase plan near the limit cycle L with p 0 = 0.4 and |W 0 | = 0.02. The invariant I W 0 is the green torus which is centered around the (red) approximate Euler solution of Σ p 0 , and its radius δ W 0 (t) is represented in the bottom figure.

Figure 8 . 2 :

 82 Figure 8.2: In the top figure, the red cycle represents the approximate Euler solution of Σ p 1 in the phase plan near the limit cycle L with p 1 = 1.1 and |W 1 | = 0.04. The invariant I W 1 is the green torus which is centered around the (red) approximate Euler solution of Σ p 1 , and its radius δ W 1 (t) is represented in the bottom figure.

. 1 .

 1 Generation of bounded invariants without control 123 x(5T 2 ) = (1.28635829, -0.65047081), δ W 2 (5T 2 ) = 0.069944710932281. We have: B W 2 ((i + 1)T 2 ) ⊂ B W 2 (iT 2 ) for i = 2. The computation took 761s of CPU time. This shows that the invariant I W 2 has a torus shape for t ∈ [2T 2 , 3T 2 ], and contains the solutions of Σ p for each p ∈ [p 2 -|W 2 |/2, p 2 + |W 2 |/2]. Fig. 8.3 shows the cyclic approximate solution L of Σ p 2 in the plane phase (top), and the radius δ(t) of the invariant I W 2 of Σ p (bottom). The invariant I W 2 with |W 2 | = 0.05 encloses all the solutions of Σ p for p ∈ [p 2 -|W 2 |/2, p 2 + |W 2 |/2] = [1.875, 1.925].

Figure 8 . 3 :

 83 Figure 8.3: In the top figure, the red cycle represents the approximate Euler solution of Σ p 2 in the phase plan near the limit cycle L with p 2 = 1.9 and |W 2 | = 0.05. The invariant I W 2 is the green torus which is centered around the (red) approximate Euler solution of Σ p 2 , and its radius δ W 2 (t) is represented in the bottom figure.

124 8 .

 8 Generation of bounded invariants via stroboscopic set-valued maps

  [4.8, 7.5] × [11, 26] × [17.5, 26]. The grid X corresponds to a discretization of S, where each component is uniformly discretized into a set of κ points. The codomain [28.7, 40] of the original continuous control function S f (•) is itself discretized into a finite set U , for the needs of our method. After discretization, S f (•) is a piecewise-constant function that takes its values in the set U made of 300 values uniformly taken in [28.7, 40]. The function S f (•) can change its value every τ seconds.

Figure 8 . 4 :

 84 Figure 8.4: Biochemical process with an additive perturbation ∥w∥ ≤ 0.001 over 4 periods (4T = 192) for ∆t = 1/400 and initial condition (X(0), S(0), P (0)) = (6.52, 12.5, 22.4), with, from top to bottom, X(t), S(t), P (t) and control S f (t).

130 8 .

 8 Generation of bounded invariants via stroboscopic set-valued maps

Figure 8 . 5 :

 85 Figure 8.5: Top: a 3D view of the Euler approximation Ỹ (t) of the unperturbed solution represented by the red curves in Fig. 8.4. Bottom: a 3D view of the invariant I represented by green shape.

  The computation takes 1038 seconds of CPU time. See Fig. 9.1. An analogous computation of lassos for 3 other source points takes 4052 seconds. The 4 lassos are depicted together on Fig. 9.2. 136 9. Enclosures of invariant tori and strange attractors using Euler's method

Figure 9 . 1 :

 91 Figure 9.1: Forced VdP. Top: the function δ W (t) giving the evolution of the radius of a lasso ball. Bottom: the corresponding invariant lasso.

Figure 9 . 2 :

 92 Figure 9.2: Forced VdP. Top: the function δ W (t) giving the evolution of the radius of 4 lasso balls. Bottom: the 4 corresponding invariant lassos.

Figure 9

 9 Figure 9.4: k 1 = 0.38, strange attractor. Top: in the (y 1 , y 2 )-plane, the trajectory (red) ending in the invariant set I 1 ∪ I 2 , where I 1 (cyan) starts from a ball B 1 , and I 2 (purple) starts from a ball B 2 , with a zoom view of B 1 and B 2 (orange), and their images (grey and light green) at t = T 1 and t = T 2 respectively. Middle: a 3D view of I 1 ∪ I 2 . Bottom: a 3D view of I 1 (cyan) and I 2 (purple).

144 9 .

 9 Figure 9.5: k 1 = 0.09, limit cycle with a simple period. Top: the trajectory computed via Euler's method (red) and the surrounding tube B W (t) from t = 0 to t = 2T (green), in the (y 1 , y 2 )-plane. Middle: the invariant set in 3D. Bottom: δ W (t).

Figure 9

 9 Figure 9.6: k 1 = 0.06, limit cycle with a doubled period. Top: the trajectory computed via Euler's method (red) and the surrounding tube B W (t) from t = 0 to t = 2T (green), in the (y 1 , y 2 )-plane. Middle: the invariant set in 3D. Bottom: δ W (t).

146 9 .

 9 Figure 9.7: k 1 = 0.05, limit cycle with a quadrupled period. Top: the trajectory computed via Euler's method (red) and the surrounding tube B W (t) from t = 0 to t = T (green), in the (y 1 , y 2 )-plane. Middle: the invariant set in 3D. Bottom: δ W (t).

Figure 10 . 1 :

 101 Figure 10.1: Workflow of ORBITADOR

150 10 .Figure 10 . 2 :

 10102 Figure 10.2: ORBITADOR's structure

152 10 .Figure 10 . 3 :

 10103 Figure 10.3: Biped system with uncertainty w ∈ W = [-0.0001, 0.0001] 4 , initial radius ε = 0.001, approximate period T = 3.8826s and time-step τ = 2 • 10 -5 .

Contents 11 . 1

 111 Summary of Part II . . . . . . . . . . . . . . . . . . . . . . . 154 11.2 Perspectives . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure A. 1 :

 1 Figure A.1: Parametric offsets and deadlines

Figure A. 2 :

 2 Figure A.2: Parametric offsets for model with the 3 reactivities

Figure A. 3 :

 3 Figure A.3: Parametric deadlines for model with the 3 reactivities

Figure A. 4 :

 4 Figure A.4: Parametric offsets for model with reactivities and with switch time

Figure A. 5 :

 5 Figure A.5: Parametric deadlines for model with reactivities and with switch time

Figure B. 1 :

 1 Figure B.1: An example without tasks chain

Example B. 2 (

 2 Example with tasks chain). We modeled an example with Time4sys presented in Fig. B.3. This example contains three tasks, of which one is periodic; it contains also a tasks chain.

Figure B. 3 :

 3 Figure B.3: An example with tasks chain

Fig

  Fig. B.4 illustrates the PTAs obtained from Fig. B.3 after the translation using Time4sys2imi.

Figure B. 5 :

 5 Figure B.5: General example

Figs

  Figs. B.6 to B.8 illustrate the PTAs obtained from Fig. B.5 after the translation using Time4sys2imi

Figure B. 6 :

 6 Figure B.6: First part of translation of Fig. B.5

Figure B. 7 :Figure B. 8 :

 78 Figure B.7: Second part of translation of Fig. B.5

Figure C. 1 :

 1 Figure C.1: For the step from B(k) to B(k + 1), λ is the maximum of λ i 1 and λ i 2 corresponding to the domains D i 1 and D i 2 traversed by the convex hull of B(k) to B(k + 1).

  ( i + 1) * i_one_period ]) ) vanderpol_orig = np . array ( vanderpol_orig ) vanderpol_max = np . array ( vanderpol_max ) vanderpol_min = np . array ( vanderpol_min ) wall_tube_bottom = np . array ( wall_tube_bottom ) wall_tube_top = np . array ( wall_tube_top ) begin_plot = 0 end_plot = NodeT begin_zoom_plot = i_one_period end_zoom_plot = NodeT tf = timeEnd T = linspace (0 , tf , NodeT ) step_plot = 1 index_plot = 1 fig = plot . figure () ax = plot . gca () plot . xlabel ( 't ') plot . ylabel ( ' u1 ') plot . plot ( T [: NodeT : step_plot ] , wall_tube_top [: NodeT : step_plot , 0] , color = ' green ') plot . plot ( T [: NodeT : step_plot ] , wall_tube_bottom [: NodeT : step_plot , 0] , color = ' green ') plot . plot ( T [: NodeT : step_plot ] , vanderpol_min [: NodeT : step_plot , 0] , color = ' cyan ') plot . plot ( T [: NodeT : step_plot ] , vanderpol_max [: NodeT : step_plot , 0] , color = ' blue ') plot . plot ( T [: NodeT : step_plot ] , vanderpol_orig [: NodeT : step_plot , 0] , color = ' red ') plot . savefig ( f ' vanderpol -u1 -dt =1 -on -{1 / dt } -tf ={ tf } -w ={ w } -epsilon ={ ecart_epsilon } -p ={ p } -parametric -{ index_plot }. png ') plot . show ( block = False ) fig1 = plot1 . figure () ax1 = plot1 . gca () plot1 . xlabel ( 't ') plot1 . ylabel ( ' u2 ') plot1 . plot ( T [: NodeT : step_plot ] , wall_tube_top [: NodeT : step_plot , 1] , color = ' green ') plot1 . plot ( T [: NodeT : step_plot ] , wall_tube_bottom [: NodeT : step_plot , 1] , color = ' green ') plot1 . plot ( T [: NodeT : step_plot ] , vanderpol_min [: NodeT : step_plot , 1] , color = ' cyan ') plot1 . plot ( T [: NodeT : step_plot ] , vanderpol_max [: NodeT : step_plot , 1] , color = ' blue ')

Figure C. 5 :

 5 Figure C.5: Coupled VdP. The function r 1 (θ 1 , θ 2 ) corresponding to 10 simulations, under two different views.

Figure C. 6 :

 6 Figure C.6: Coupled VdP. The function r 2 (θ 1 , θ 2 ) corresponding to 10 simulations, under two different views.

Figure C. 7 :

 7 Figure C.7: Coupled VdP. Middle and bottom: The function r 1 (θ 1 , θ 2 ) corresponding to the lassos associated with the 10 simulations of Fig. C.5, under the same views. Top: the radius δ W (t) of these lassos.

Figure C. 8 :

 8 Figure C.8: Coupled VdP. Top and bottom: The function r 2 (θ 1 , θ 2 ) corresponding to the lassos associated with the 10 simulations of Fig. C.6, under the same views.

  5 . 1 CIAMS, Université Paris-Saclay, Bât. 335, Bures-sur-Yvette, Orsay cedex, France 2 CIAMS, Université d'Orléans, Orléans, France 3 LURPA, ENS Paris-Saclay, 4 Av. des Sciences, Gif-sur-Yvette, France 4 Institut Universitaire de France, Paris, France 5 Université Paris-Saclay, CNRS, ENS Paris-Saclay, LMF, Gif-Sur-Yvette, France

Figure D. 2 :

 2 Figure D.2: Exoskeleton ABLE

Figure D. 3 :

 3 Figure D.3: Exoskeleton Control scheme

  117rad). It automatically finds that, for T = 5.168s, B(y L , δ(L)) ⊆ B(y K , δ(K)), with L = 10336 and K = 5168. The associated limit cycle C and controlled invariant set I are depicted on Fig. D.4 and Fig. D.5 respectively, according to various 2D projections. In Fig. D.5, the ball B(y K , δ(K)) is represented in orange, and the ball B(y L , δ(L)) in green (we see B(y L , δ(L)) ⊂ B(y K , δ(K))).

234D.Figure D. 4 :D. 4 Figure D. 5 :

 445 Figure D.4: 2D projections of the limit cycle C.

Fig. D. 6

 6 Fig. D.6 represents the real position θ (aslo the oscillator input) and the estimated position θ computed by the oscillator. We can see that the estimation follows the desired position θ.

Figure D. 6 :Figure D. 8 :

 68 Figure D.6: Evolution of the estimated position

Fig

  Fig. D.8 shows the evolution of the distance between the experimental data and the limit cycle.

2√

  y k converges to 0. Using the software ORBITADOR [Jer21], one calculates that L ≤ 0.5 and λ < 0 on D (see Figures E.1, E.2). Since ∥g(y k )∥ → 0 (Figure E.3), it follows by Theorem E.2: δ µ 0 (kh) → 0 and |y k -x(kh)| → 0 as k → ∞ (see Figures E.4 and E.5).

Figure E. 1 :Figure E. 3 :

 13 Figure E.1: Evolution of λ

Corollary 1 .

 1 Consider a continuously differentiable function f : R n → R. Suppose:

  that δ µ 0 (t) → 0 (see Figure E.10 for t = kh ≤ 95 and Figure E.11, with a change of scale, for 95 ≤ t = kh ≤ 120), y k → w * and x(kh) → w * , with w * = (2, 3) (which is the stationary point of ∇f and the minimizer of f ).

Figure E. 6 :Figure E. 9 :Figure E. 10 :

 6910 Figure E.6: Evolution of λ computed locally (λ(t) ≤ -0.187)

Figure E. 11 :

 11 Figure E.11: Evolution of δ(t) for t ∈ [95, 120]

E. 3 .Figure E. 12 :Figure E. 13 :

 31213 Figure E.12: Evolution of w 1 (t) (which converges to w * 1 = 2)

Figure E. 14 :Figure E. 15 :Figure E. 16 :Figure E. 17 :Figure E. 18 :Figure E. 19 :

 141516171819 Figure E.14: Evolution of L (L ≤ 12)

  .2.4 A formal framework for real-time systems . . . . . . . . . . . Formalization of the case study . . . . . . . . . . . . . . . . 3.2.6 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . .

	3.2.5

3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.1 Contribution . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.2 Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 Description of the system and problem . . . . . . . . . . . .

3.2.1 Threads and deterministic communications . . . . . . . . . .

3.2.2 Reactivities . . . . . . . . . . . . . . . . . . . . . . . . . .

3.2.3 Processings and assignment into threads . . . . . . . . . . . 33.3 Specifying the system . . . . . . . . . . . . . . . . . . . . . .

3.3.1 Architecture of the solution . . . . . . . . . . . . . . . . . .

3.3.2 Modeling periodic processing activations . . . . . . . . . . .

3.3.3 Modeling threads . . . . . . . . . . . . . . . . . . . . . . .

3.3.4 Modeling the FPS scheduler . . . . . . . . . . . . . . . . . .

3.3.5 Reachability synthesis . . . . . . . . . . . . . . . . . . . . . 3.4 Compositional verification of reactivities . . . . . . . . . . .

3.4.1 Observer construction . . . . . . . . . . . . . . . . . . . . .

3.4.2 Compositional verification and synthesis . . . . . . . . . . . 3.5 Enhancing the analysis with context switches . . . . . . . .

3.5.1 Problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5.2 Modeling the context switch . . . . . . . . . . . . . . . . . . 3.6 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6.1 Experimental environment . . . . . . . . . . . . . . . . . . 3.6.2 Verification and synthesis without reactivities . . . . . . . . .

3.6.3 Compositional verification of reactivities . . . . . . . . . . .

3.6.4 Switch time . . . . . . . . . . . . . . . . . . . . . . . . . . 3.7 Comparison with other tools . . . . . . . . . . . . . . . . . .

3.7.1 Comparison of our results with non-parametric tools . . . . .

3.7.2 "Testing" the parametric analysis . . . . . . . . . . . . . . .

3.8 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

  Let us illustrate these definitions using Fig.3.6. A single thread t i is considered, with offset OT i , MAF MAF i , period PT i and deadline DT i . This thread has two processings p i and p j , where p i is characterized by a WCET WCET i and a period PP i and p j has WCET WCET j and period PP j .

schedulability analysis of the flight control of a space launcher

			1 thread T2 i s		1 thread T3 i s
	thread T1 i s		2	period	( 2 0ms)	2	period	( 6 0ms)
	period	( 5ms) ;		;			;
	o f f s e t	( 0ms) ;	3	o f f s e t	( 0ms) ;	3	o f f s e t	( 0ms) ;
	deadline	( 5ms) ;	4	deadline	( 2 0ms)	4	deadline	( 6 0ms)
	maf	( 1 0ms) ;		;			;
	processing (when 0 => (	5	maf	( 2 0ms)	5	maf	( 6 0ms)
	N a v i g a t i o n ) ;		;			;
		when 1 => (	6	processing (		6	processing (
	N a v i g a t i o n ; C o n t r o l ) ) ; end		M o n i t o r i n g ) ;		Guidance ) ;
	;		7 end ;		7 end ;
	(a) Thread T1		(b) Thread T2		(c) Thread T3

Table 3 . 1 :

 31 Computation times without switch time and without reactivities

	Analysis	Time (s)
	No parameter	3.1
	Parametric offsets	95.8
	Parametric deadlines	17.7

Table 3 . 2 :

 32 Possible offset valuations (without reactivities)

Table 3 . 3 :

 33 Possible deadline valuations (without reactivities)

	Valuation deadlineT1 deadlineT2 deadlineT3 |= K v 1 5 20 √ 60 v 2 4 11 √ 60 v 3 5 15 √ 60 v 4 4 20 60 √
	v 5	3	11	60	×
	v 6	4	9	55	×

Table 3 . 4 :

 34 Computation times with reactivities (s)

	Analysis	Monolithic NGC	NC NM Compositional
	No parameter	109.4	21.4	3.4	15.2	40.1
	Parametric offsets	2304.0 1111.9 210.8 955.7	2278.4
	Parametric deadlines	637.2	173.0	28.5 129.8	331.3

Table 3 . 5 :

 35 Computation times with switch time and without reactivities

		Analysis		Time (s)
		No parameter			17.9
		Parametric offsets	5,396.3
		Parametric deadlines		38.7
	Analysis	Monolithic	NGC	NC	NM Compositional
	No parameter	476.5	47.5	6.5	34.5	88.5
	Parametric offsets	TO 33,449.6 2915.4	TO	TO
	Parametric deadlines	1,919.7	342.3	62.7 278.0	683.0

Table 3.6: Computation times with reactivities and switch time (s)

Table 3 . 8 :

 38 Some valuations for which the system is schedulable (with reactivities)

	Valuation deadlineT1 deadlineT2 deadlineT3 |= K v 1 4.5 20 √ 60 v 2 5 4.5 √ 60 v 3 4.5 4.5 60 √
	v 4	4	5	60	×
	v 5	4.5	4	65	×

Table 3 . 9 :

 39 Possible offset valuations with switch time using Uppaal

	Valuation offsetT1 offsetT2 offsetT3	Uppaal (with reactivities)
	v 1

Table 3 . 10 :

 310 Possible deadline valuations with switch time using Uppaal

	Valuation deadlineT1 deadlineT2 deadlineT3 v 1 4.5 20 60 v 2 5 4.5 60 v 3 4.5 4.5 60	Uppaal (with reactivities) √ √ √
	v 4	4	5	60	×
	v 5	4.5	4	65	×

Table 3 .11: Computation times without parameters Analysis Without reactivities (s) With reactivities (s)

 3 Uppaal (if some reactivities are specified) should be used. However none of these tools cope with uncertain constants. Therefore, despite the complexity overhead, IMITATOR should be used if some timing constants are unspecified.

	Cheddar	< 0.1	N/A
	IMITATOR	3.086	109.404
	Uppaal	0.002	0.003
	specified) or

Table 3 .

 3 12: Possible offset valuations (with reactivities) checked using Cheddar and Uppaal

	Valuation	offsetT1	offsetT2	offsetT3	|= K	Cheddar (without reactivities)	Uppaal (with reactivities)

Table 3 . 13 :

 313 Possible deadline valuations (with reactivities) checked using Cheddar and Uppaal

	Valuation	deadlineT1	deadlineT2	deadlineT3	|= K	Cheddar (without reactivities)	Uppaal (with reactivities)

Table 3 . 14 :

 314 Possible offset valuations in the difference of constraints without and with reactivities

	Valuation offsetT1 offsetT2 offsetT3 Cheddar Uppaal
	v 1

Table 4 . 1 :

 41 Summary of experiments

	Case study	Example 4.1[Fig. 4.1] Example B.1[Fig. B.1] Example B.2[Fig. B.3] Example B.3 [Fig. B.5]
	# CPU		2		1		1		4
	# tasks		4		4		3		11
	# tasks chains		2		0		1		4
	# number of automata		6		9		3		12
	# total number of locations		22		26		14		53
	# clocks		8		8		6		22
	# discrete		4		4		3		11
	# parameters	0	2	0	1	0	2	0	3
	Parameters	-	WCETStep1	-	DeadlineStep2	-	DeadlineStep1	-	WCETStep5
			BCETStep1						BCETStep5
									DealineStep11
	Execution time (seconds)	0.040	0.112	0.263	0.289	0.042	0.045	2.276	144.627
	Schedulable

Table 4 .2: Synthesized constraints

 4

  Instead of computing them globally for S, it is advantageous to compute λ and γ locally depending on the subregion of S occupied by the system state during a considered interval of time. We now give a version of Proposition 7.1 with bounded uncertainty w(•) ∈ W, originally proved in [LCADSC+ 17].

Proposition 7.2. [LCADSC + 17] Consider a system Σ with bounded uncertainty of the form dx(t) dt = f (x(t), w(t)) satisfying (

An Approximation of Minimax Control using Random Sampling and Symbolic Computation 105

	7.4. Table 7.1: Nominal fermentation process parameters
	Name	Symbol	Value
	dilution rate	D	0.15h -1
	substrate inhibition constant substrate saturation constant product saturation constant	K i K m P m	22 g L 1.2 g L 50 g L
	yield of the biomass	Y x/s	0.4
	first product yield constant	α	2.2
	second product yield constant	β	0.2h -1
	specific growth rate scale	µ m	0.48h -1
	minimum feed substrate maximum feed substrate	S min f S max f	28.7 g L 40 g L
		)dt	(7.10)

2 Robust optimal periodic control using guaranteed Euler's method

  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

8.1 Generation of bounded invariants without control . . . . . . 8.1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1.2 Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1.3 Application to Parametric Systems . . . . . . . . . . . . . . 8.1.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.8.2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.2 Application to Guaranteed Robustness . . . . . . . . . . . . 8.2.3 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 8.

Generation of bounded invariants via stroboscopic set-valued maps

132 9.2 Constructing Invariant Stuctures Around Tori

  Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . .

	Contents
	9.1

. . . . . . . . 133 9.2.1 Basic method for periodic systems . . . . . . . . . . . . . . 133 9.2.2 Extension to chaotic systems . . . . . . . . . . . . . . . . . 138 9.3 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

141 132 9. Enclosures of invariant tori and strange attractors using Euler's method

152 148 10. ORBITADOR: A tool to analyze the stability of periodical dynamical systems

  Targeted user . . . . . . . . . . . . . . . . . . . . . . . . . 149 10.2.2 Global architecture . . . . . . . . . . . . . . . . . . . . . . 149 10.3 Example: Passive biped model . . . . . . . . . . . . . . . . . 150 10.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

	10.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
	10.2 ORBITADOR organization and principle . . . . . . . . . . . . 148
	10.2.1

10.2. ORBITADOR organization and principle 149

					Graphical
	Input describing ODE (input_system.py)	Method (defined in Section 8.1.2)	Invariant set	Stability analysis	and numerical results (figures of evolution
			ORBITADOR		of states)

  t) is twice continuously differentiable with respect tox and continuous with respect to t.

	Under this assumption, there exists a unique solution of (P ) with Dirichlet
	boundary condition y(x, t) ∈ {b 0 (t), b

ℓ (t)} for x ∈ ∂Ω and initial condition y(x, 0) = y 0 ∈ ([0, γ] d ) Ω (see, e. g.,

[START_REF] Cantrel | Spatial ecology via reaction-diffusion equations[END_REF][START_REF] Kumar | An introduction to numerical methods for the solutions of partial differential equations[END_REF]

).

Let S ≡ ([0, γ] d ) Ω .

A2 S is invariant for (P ), i.e., for each initial condition in y 0 ∈ S and each (x, t) ∈ Ω × [0, ∞), the solution y(x, t) of (P ) is in [0, γ] d ; A3 for each t ∈ [0, ∞), the solution y(•, t) is a C 4 continuous function on Ω.

C.3. Source code of Examples 8.1 to 8.3: Parametric Van der Pol system 213

	plot1 . plot ( T [: NodeT : step_plot ] , vanderpol_orig [: NodeT : step_plot ,
	1] , color = ' red ')
	plot1 . savefig (
	f ' vanderpol -u2 -dt =1 -on -{1 / dt } -tf ={ tf } -w ={ w } -epsilon ={
	ecart_epsilon } -p ={ p } -parametric -{ index_plot }. png ')
	plot1 . show ( block = False )
	fig8 = plot8 . figure ()
	ax8 = plot8 . gca ()
	plot . xlabel ( 't ')
	plot8 . ylabel ( ' u1 ')
	plot8 . plot ( T [ begin_zoom_plot : end_zoom_plot : step_plot ] ,
	wall_tube_top [ begin_zoom_plot : end_zoom_plot : step_plot , 0] , color
	= ' green ')
	plot8 . plot ( T [ begin_zoom_plot : end_zoom_plot : step_plot ] ,
	wall_tube_bottom [ begin_zoom_plot : end_zoom_plot : step_plot , 0] ,
	color = ' green ')
	plot8 . plot ( T [ begin_zoom_plot : end_zoom_plot : step_plot ] ,
	vanderpol_min [ begin_zoom_plot : end_zoom_plot : step_plot , 0] , color
	= ' cyan ')
	plot8 . plot ( T [ begin_zoom_plot : end_zoom_plot : step_plot ] ,
	vanderpol_max [ begin_zoom_plot : end_zoom_plot : step_plot , 0] , color
	= ' blue ')
	plot8 . plot ( T [ begin_zoom_plot : end_zoom_plot : step_plot ] ,
	vanderpol_orig [ begin_zoom_plot : end_zoom_plot : step_plot , 0] ,
	color = ' red ')
	plot8 . savefig (
	f ' vanderpol -u1 -dt =1 -on -{1 / dt } -tf ={ tf } -w ={ w } -epsilon ={
	ecart_epsilon } -p ={ p } -parametric -{ index_plot } -zoom . png ')
	plot8 . show ( block = False )
	fig9 = plot9 . figure ()
	ax9 = plot9 . gca ()
	plot9 . xlabel ( 't ')
	plot9 . ylabel ( ' u2 ')
	plot9 . plot ( T [ begin_zoom_plot : end_zoom_plot : step_plot ] ,
	wall_tube_top [ begin_zoom_plot : end_zoom_plot : step_plot , 1] , color
	= ' green ')
	plot9 . plot ( T [ begin_zoom_plot : end_zoom_plot : step_plot ] ,
	wall_tube_bottom [ begin_zoom_plot : end_zoom_plot : step_plot , 1] ,
	color = ' green ')
	plot9 . plot ( T [ begin_zoom_plot : end_zoom_plot : step_plot ] ,
	vanderpol_min [ begin_zoom_plot : end_zoom_plot : step_plot , 1] , color
	= ' cyan ')
	plot9 . plot ( T [ begin_zoom_plot : end_zoom_plot : step_plot ] ,
	vanderpol_max [ begin_zoom_plot : end_zoom_plot : step_plot , 1] , color
	= ' blue ')
	plot9 . plot ( T [ begin_zoom_plot : end_zoom_plot : step_plot ] ,
	vanderpol_orig [ begin_zoom_plot : end_zoom_plot : step_plot , 1] ,
	color = ' red ')
	plot9 . savefig (
	f ' vanderpol -u2 -dt =1 -on -{1 / dt } -tf ={ tf } -w ={ w } -epsilon ={
	ecart_epsilon } -p ={ p } -parametric -{ index_plot } -zoom . png ')
	plot9 . show ( block = False )
	fig2 = plot2 . figure ()

C.

Appendix: Limit cycle of oscillators using Euler method

	ax2 = plot2 . gca ()
	plot2 . xlabel ( ' u1 ')
	plot2 . ylabel ( ' u2 ')
	ind_cls = 0
	for i_p in range ( i_one_period *( periods -1) , i_one_period * periods ) :
	circle2 = plot2 . Circle (( vanderpol_orig [ i_p , 0] , vanderpol_orig [
	i_p , 1]) , all_delta [ i_p ] , color = ' green ' , fill = False )
	ax2 . add_patch ( circle2 )
	plot2 . plot ( vanderpol_orig [ begin_zoom_plot : end_zoom_plot : step_plot ,
	0] , vanderpol_orig [ begin_zoom_plot : end_zoom_plot : step_plot , 1] ,
	color = ' red ')
	plot2 . plot ( vanderpol_orig [ begin_zoom_plot , 0] , vanderpol_orig [
	begin_zoom_plot , 1] , 'o ' , color = ' orange ')
	plot2 . savefig (f ' vanderpol -u1 -u2 -dt =1 -on -{1 / dt } -tf ={ tf } -w ={ w } -
	epsilon ={ ecart_epsilon } -p ={ p } -parametric -{ index_plot }. png ')
	plot2 . show ( block = False )
	fig2 = plot2 . figure ()
	ax2 = plot2 . gca ()
	plot2 . xlabel ( ' u1 ')
	plot2 . ylabel ( ' u2 ')
	ind_cls = 0
	for i_p in range ( begin_plot , end_plot ) :
	circle2 = plot2 . Circle (( vanderpol_orig [ i_p , 0] , vanderpol_orig [
	i_p , 1]) , all_delta [ i_p ] , color = ' green ' , fill = False )
	ax2 . add_patch ( circle2 )
	plot2 . plot ( vanderpol_orig [ begin_plot : end_plot : step_plot , 0] ,
	vanderpol_orig [ begin_plot : end_plot : step_plot , 1] , color = ' red ')
	plot2 . plot ( vanderpol_orig [ begin_plot , 0] , vanderpol_orig [ begin_plot
	, 1] , 'o ' , color = ' orange ')
	plot2 . savefig (f ' vanderpol -u1 -u2 -dt =1 -on -{1 / dt } -tf ={ tf } -w ={ w } -
	epsilon ={ ecart_epsilon } -p ={ p } -parametric -{ index_plot } -all . png ')
	plot2 . show ( block = False )
	fig6 = plot6 . figure ()
	ax6 = plot6 . gca ()
	plot6 . xlabel ( 't ')
	plot6 . ylabel ( ' Lipschitz constant ')
	plot6 . plot ( T [ begin_plot : end_plot : step_plot ] , Lu [ begin_plot : end_plot
	: step_plot ] , color = ' red ')
	plot6 . savefig (
	f ' vanderpol -lipschitz -constant -dt =1 -on -{1 / dt } -tf ={ tf } -w ={ w } -
	epsilon ={ ecart_epsilon } -p ={ p } -parametric -{ index_plot }. png ')
	plot6 . show ( block = False )
	fig7 = plot7 . figure ()
	ax7 = plot7 . gca ()
	plot7 . xlabel ( 't ')
	plot7 . ylabel ( 'C ')
	plot7 . plot ( T [ begin_plot : end_plot : step_plot ] , Cu [ begin_plot : end_plot
	: step_plot ] , color = ' red ')
	plot7 . savefig (

f ' vanderpol -C -constant -dt =1 -on -{1 / dt } -tf ={ tf } -w ={ w } -epsilon ={ ecart_epsilon } -p ={ p } -parametric -{ index_plot }. png ') plot7 . show ( block = False ) C.

3. Source code of Examples 8.1 to 8.3: Parametric Van der Pol system 215

	fig3 = plot3 . figure ()
	ax3 = plot3 . gca ()
	plot3 . xlabel ( 't ')
	plot3 . ylabel ( ' lambda ')
	plot3 . plot ( T [ begin_plot : end_zoom_plot : step_plot ] , all_lambda [
	begin_plot : end_plot : step_plot ] , color = ' red ')
	plot3 . savefig (
	f ' vanderpol -lambda -dt =1 -on -{1 / dt } -tf ={ tf } -w ={ w } -epsilon ={
	ecart_epsilon } -p ={ p } -parametric -{ index_plot }. png ')
	plot3 . show ( block = False )
	fig4 = plot4 . figure ()
	ax4 = plot4 . gca ()
	plot4 . xlabel ( 't ')
	plot4 . ylabel ( ' delta ')
	plot4 . plot ( T [ begin_plot : end_plot : step_plot ] , all_delta [ begin_plot :
	end_plot : step_plot ] , color = ' red ')
	plot4 . savefig (f ' vanderpol -delta -dt =1 -on -{1 / dt } -tf ={ tf } -w ={ w } -
	epsilon ={ ecart_epsilon } -p ={ p } -parametric -{ index_plot }. png ')
	fig10 = plot10 . figure ()
	ax10 = plot10 . gca ()
	plot10 . xlabel ( 't ')
	plot10 . ylabel ( ' delta ')
	plot10 . plot ( T [ begin_zoom_plot : end_zoom_plot : step_plot ] , all_delta [
	begin_zoom_plot : end_zoom_plot : step_plot ] , color = ' red ')
	plot10 . savefig (f ' vanderpol -delta -dt =1 -on -{1 / dt } -tf ={ tf } -w ={ w } -
	epsilon ={ ecart_epsilon } -p ={ p } -parametric -{ index_plot } -zoom . png ')
	if w != 0:
	plot4 . show ( block = False )
	fig5 = plot5 . figure ()
	ax5 = plot5 . gca ()
	plot5 . xlabel ( 't ')
	plot5 . ylabel ( ' gamma ')
	plot5 . plot ( T [ begin_zoom_plot : end_zoom_plot -1: step_plot ] ,
	all_gamma [ begin_zoom_plot : end_zoom_plot -1: step_plot ] , color
	= ' red ')
	plot5 . savefig (
	f ' vanderpol -gamma -dt =1 -on -{1 / dt } -tf ={ tf } -w ={ w } -epsilon ={
	ecart_epsilon } -p ={ p } -parametric -{ index_plot } -zoom . png ')
	print (" Execution time : % s secondes ---" % ( time . time () -
	start_time ) )
	plot5 . show ()
	else :
	print (" Execution time : % s secondes ---" % ( time . time () -
	start_time ) )
	plot4 . show ()

  Introduction Active exoskeletons are wearable robotic devices, developed to assist human movement [GBKM16, AZI + 18]. Their versatility makes it possible to consider numerous applications, both to improve rehabilitation protocols [FBM + 07, FPC + 12, Pon10, MSC + 13, JzzT + 20] and to prevent musculoskeletal disorders in workers [MRH14, SBCF14, Bog15, dLBK + 16]. The implementation of exoskeletons for these different applications is nevertheless constrained by the impossibility of completely predicting human movement intention [AZI + 18, JPPM08]. Several approaches have been proposed in the literature to solve this problem. The first approach relies on controllers based on bioelectric signals such as electromyography

D.1

Preliminary definitions

Following the vocabulary used within ArianeGroup. Technically, a processing is a node in SCADE, i. e., a subprogram activated cyclically, with a frequency, an activation condition and inputs/outputs.

In the literature, the term "reactivity" is also referred to as "latency" (see, e. g., [FBG + 10]).

Note that the MAF is a per-thread property; it is quite similar to the ARINC 653 standard used in industrial civil airplane[START_REF] Ghoshhajra | Arinc 653 api and its application -an insight into avionics system case study[END_REF] designs, except that the ARINC 653 is a per-CPU property.

Among the simplifications, we do not represent the check for the deadline miss.

In the full model, we can allow for a best case execution time, in which case the duration is nondeterministically chosen in the interval [BCETNavigation, WCETNavigation].

This encoding is not necessarily optimal. In fact, on odd cycles, as Navigation is executed first, and followed by Control, a deadline miss can be detected earlier, i. e., if Navigation is still executed, but there is not enough time to finish the execution of Navigation and that of Control: that is, an optimized deadline miss condition could be xT1 + WCETControl = deadlineT1 and xExecNavigation < WCETNavigation. This optimization has not been implemented, so as to leave the model (relatively) simple and maintainable, but could be tested in the future.

All values are confidential and therefore the given values in this case study are not the genuine ones.

Sources, binaries, models and results are available at imitator.fr/static/FI2021/ and at https: //www.doi.org/10.5281/zenodo.5042059.

A simple interface over the Parma Polyhedra Library[START_REF] Bagnara | The Parma Polyhedra Library: Toward a complete set of numerical abstractions for the analysis and verification of hardware and software systems[END_REF], available at github.com/ etienneandre/PolyOp, and that allows for polyhedral computations such as intersection or difference, as well as polyhedral checks such as equality or (strict) inclusion.

This chapter presents Time4sys2imi, a tool translating Time4sys models into parametric timed automata[START_REF] Alur | Parametric real-time reasoning[END_REF] in the input language of IMITATOR. This translation allows not only to check the schedulability of real-time systems, but also to infer some timing constraints (deadlines, offsets. . . ) guaranteeing schedulability.

Formalize real-time system models under uncertainty

Discrete variables are global rational-valued variables that can be read and modified by the PTAs.

Formalize real-time system models under uncertaintyFigure 4.5: Translation of Fig. 4.1

Formalize real-time system models under uncertaintyIn the next chapter, we will conclude the first part of the thesis and we will give some perspectives.

"Formal Methods for Timing Verification Challenge", in the WATERS workshop: http:// waters2015.inria.fr/challenge/

We take here S = [0, 1] d for the sake of notation simplicity, but S can be any convex subset of R d .

We consider here the special case where the cost function is only made of a "terminal" subcost. The method extends to more general cost functions.

y ∈ B(z, a) with y, z ∈ R d and a ≥ 0 means ∥y -z∥ ≤ a where ∥ • ∥ denotes the Euclidean norm.

∆t is the "sub-sampling' parameter of the Euler scheme.

Computation times are not given in the experiments of[START_REF] Houska | Approximate robust optimization of time-periodic stationary states with application to biochemical processes[END_REF].

B(x 0 , ε) is the set {z ∈ R d | ∥z -x 0 ∥ ≤ ε} where ∥ • ∥ denotes the Euclidean distance.

Note that B W (0) = B 0 because x(0) = x 0 and δ ε,W (0) = ε.

We write B(x, d) to denote the ball of center x and radius d, i. e., the set of elements y such that ∥y -x∥ ≤ d, where ∥ • ∥ is the Euclidean norm.

See Remark 3.

Actually, the system may also converge to an equilibrium point, but it is convenient to consider an equilibrium as a trivial form of LC (see[START_REF] Manchester | Transverse contraction criteria for existence, stability, and robustness of a limit cycle[END_REF]).

It is clear that, as required by Theorem 8.2, µ = 0.06667 > ε ≈ 0.004.

Note that B ε,W (0) = B 0 because x(0) = x 0 and δ ε,W (0) = ε.

which means a total of nearly

hours of CPU time for generating the 100 lassos.

Figure B.2: Translation of Fig. B.1

Other norms can be considered (see, e. g.,[START_REF] Shafi | Spatial uniformity in diffusively-coupled systems using weighted L2 norm contractions[END_REF]), but for simplicity we focus here on Euclidean norms.

∆t is the "sub-sampling' parameter of the Euler scheme.

Computation times are not given in the experiments of[START_REF] Houska | Approximate robust optimization of time-periodic stationary states with application to biochemical processes[END_REF].

Figure C.10: Same Figure as Fig. C.9 but with 430467 samples (instead of 43047).

Figure C.11: Same Figure as Fig. C.9 but with 4304672 samples (instead of 43047).

This slight modification of the definition of C, as originally given in[START_REF] Le Coënt | Control synthesis of nonlinear sampled switched systems using Euler's method[END_REF], is justified by a simple inspection of the proof of Theorem E.1 in[START_REF] Le Coënt | Control synthesis of nonlinear sampled switched systems using Euler's method[END_REF].

B(x, r) denotes the ball of centre x ∈ R n and radius r ≥ 0 (i.e., the set of points z ∈ R n such that ∥z -x∥ ≤ r).

adapted from https://codingvision.net/gradient-descent-simply-explained-with-example

This corresponds to the existence of a "strange attractor" of the system. Besides, we have:

Proposition 9.2. Consider a system Σ W : ẋ = f (x, w) with uncertainty w ∈ W satisfying (H1), and let, for j = 1, 2, B j := B ε,W (t j ) with t j = ℓ j τ for some ℓ j ∈ N. Suppose that, for j = 1, 2, there exists T j = k j τ (with k j ∈ N \ {0}) such that:

Let I j := t∈[0,T j ] B ε,W (t j + t) (j = 1, 2). Then I 1 ∪ I 2 is a compact invariant set containing, for t ≥ 0, all the solutions x(t) of Σ W with initial condition in B 1 ∪ B 2 .

140 9. Enclosures of invariant tori and strange attractors using Euler's method

The invariant set I 1 ∪ I 2 can be seen as an overapproximation of the "strange attractor" of the system. Remark 8. Proposition 9.2 treats the case j ∈ {1, 2}, but extends to the case j ∈ {1, 2, • • • , q} with q ≥ 2.

Example 9.3. Consider the system Σ W (see [START_REF] Schilder | Continuation of quasi-periodic invariant tori[END_REF]): ẏ1 = 1 2 (-k 1 y 1 -Ay 2 ) + w ẏ2 = 1 2 (Ay 1 -k 1 y 2 + 0.22) + w ẏ3 = 0.03 -0.005 16 (3r 2 + 2y 2 3 )y 3 + w with A := 1 -3 32 (r 2 + 4y 2 3 ), r 2 := y 2 1 + y 2 2 , and a bounded perturbation w ∈ W. Here W = [-0.0001, 0.0001]. Let the time-step be equal to τ = 10 -2 .

In [START_REF] Schilder | Continuation of quasi-periodic invariant tori[END_REF], it is observed that "a family of attracting periodic orbits branches off" for certain values of k 1 , e.g., for k 1 = 0.09. Using the basic method of Section 9.2.1 with ε = 0.1, one can prove the existence of an attracting periodic orbit for k 1 = 0.09 (see Fig. 9.5). Then, decreasing the value of k 1 , it is observed in [START_REF] Schilder | Continuation of quasi-periodic invariant tori[END_REF] that, "at k 1 ≈ 0.0772 the periodic orbits lose stability in a period-doubling bifurcation and a family of doubled periodic orbits emanates. At k 1 ∈ {0.0509, 0.0476, . . . } further period doublings occur that apparently form a cascade". The basic method of Section 9.2.1 with ε = 0.2 allows us to prove the existence of orbits of such doubled and quadrupled families for k 1 = 0.06 and k 1 = 0.05 respectively (see Fig. 9.6 and Fig. 9.7).

When decreasing further the value of k 1 , it is then noticed in [START_REF] Schilder | Continuation of quasi-periodic invariant tori[END_REF] that, "for k 1 ≈ 0.04 a strange attractor is observed in simulations". For k 1 = 0.038, we prove indeed, using the extended method, that there exists an invariant set of the system that gives us an overapproximation of the strange attractor (see Fig. 9.4). The invariant set is constructed as follows.

Let x 0 = (1.25170752, 1.45865452, 1.20794305), ε = 0.2, t 1 = 5397.83s, t 2 = 5486.28s, and B j := B ε,W (t j ) for j = 1, 2. Our program finds that, for T 1 = 1260.42s:

Likewise, our program finds that, for T 2 = 272.37s:

The balls B 1 and B 2 are depicted in orange, and their images B ε,W (t 1 + T 1 ) and B ε,W (t 2 + T 2 ) in light green and grey respectively, on Fig. 9.4 (zoom view). By Proposition 9.2, we know that I 1 ∪ I 2 is an invariant set of the system, with

A.2.2 Parametric deadlines

The constraint synthesized by IMITATOR for the model with the 3 reactivities and parametric deadlines in

C

Appendix: Limit cycle of oscillators using Euler method 4 We have:

Consider balls

We have:

C.4 Sensitivity of Bocop to Initial Conditions

In Figs. C.3 and C.4, we give the solution of MRI using Bocop when q 2 (0) = (0, 1) and q 2 (0) = (0.1, 1) respectively.

Figure C.3:

Bocop solution on MRI when initially q 2 (0) = (0, 1), with q 1 = (y 1 , z 1 ) (top left), q 2 = (y 2 , z 2 ) (top right) and control u 2 (bottom). .4: Bocop solution on MRI for initial condition q 2 (0) = (0.1, 1), with q 1 = (y 1 , z 1 ) (top left), q 2 = (y 2 , z 2 ) (top right) and control u 2 (bottom).

C.5 Coupled Van der Pol oscillators example

where

The parameter µ is the coupling constant and the oscillators decouple for µ = 0. Each oscillator has then a unique attractive circle, and the uncoupled product system has a unique attractive invariant torus. The torus persists for a weak coupling and contains two periodic circles, one is attractive and the other is repulsive when

) denotes an invariant torus for the system, then the uncoupled system has an invariant torus defined by M 1 := (θ 1 , θ 2 , 1, 1).

Here, we take w ∈ W = [-0.0001, 0.0001] and, as in [START_REF] Edoh | Computation of invariant tori by orthogonal collocation[END_REF], α 1 = α 2 = 1.0, β 1 = β 2 = β = 0.55, and µ = 0.2601. Let the time-step τ = 10 -3 , and the radius of the initial ball around the source points ε = 0.1. Let T = 11.425 be used as an approximation of the exact period T * = 2π β .Each lasso generation now takes around r 1 (θ 1 , θ 2 ) and r 2 (θ 1 , θ 2 ). Ten simulations are thus depicted on Figs. C.5 and C.6, and the corresponding lassos on Figs. C.7 and C.8. The value of µ is close to the value µ 1 ≈ 0.2605 for which a torus bifurcation appears (see [START_REF] Edoh | Computation of invariant tori by orthogonal collocation[END_REF]; cf [START_REF] Dieci | Solution of the systems associated with invariant tori approximation. II: multigrid methods[END_REF][START_REF] Moore | Computation and parametrisation of invariant curves and tori[END_REF]). This explains the extent of the deformation of the structure, the attractive circle being shaped like a eight figure on Figs. C.5 and C.6. The source points of the 10 lassos (which coincide with the initial points of the simulations) have been chosen close to the repulsive circle (itself estimated by numerical simulation), as follows: The Hopf oscillator is defined by a system of two differential equations (Eq. (D.1)).

, where x(t) and y(t) are the orthogonal coordinates of the oscillator, e is the oscillator's external force, ν the coupling gain, µ and γ are the amplitude and attractiveness of the oscillator respectively [START_REF] Righetti | Adaptive frequency oscillators and applications[END_REF]. For this study γ = 1 (as in [RBI09, RBI06, RVL + 11]), and µ = 1 (so that the intrinsic amplitude of the oscillator is equal to 1).

The input of the oscillator is the real position θ. In this case the external force of the oscillator e represents the difference between the real position θ of the human elbow and the estimated position θ. [START_REF] Righetti | Programmable central pattern generators: an application to biped locomotion control[END_REF] augmented this oscillator to learn the frequency ω, amplitude α 1 and offset α 0 of the input using integrators. The complete estimation algorithm is presented in Eq. (D.2)

Righetti and Ijspeert

Where η is the integrator gain and ϕ the output phase. Finally the estimated position θ is used to compute the torque generated by the exoskeleton to assist the human movement (see Appendix E.2 for details). 1. -g is co-coercitive, 2. the step size h < 2/L, 3. g(x * ) = 0 for some x * ∈ R n (existence of a stationary point).

Then ∥g(y k )∥ → 0 with rate O(1/k) for the averaged iterates, where {y k } k∈N is defined as in (E.3).

A proof (adapted) from [START_REF] Robert | Convergence theorems for gradient descent[END_REF] is given in Appendix in order to be selfcontained.

In the following, we show how the result of Proposition E.3 applies to the case of the gradient descent algorithm. We first recall the link between the gradient flow and gradient descent algorithm.

Consider a function f : R n → R, the gradient descent algorithm generates a sequence {x k } k∈N described as:

where h > 0 is a constant step size. This algorithm is generally used to resolve optimization problems of the form min x∈R n f (x) for a function f . The algorithm in (E.4) can be seen as the (explicit) Euler discretization of the gradient flow differential equation described by: ẋ = -∇f (x) (E.5) for a continuously differentiable function f : R n → R.

From

where • L denotes the Lipschitz constant for g,

• λ is the "one-sided Lipschitz constant (OSL)" (or "logarithmic Lipschitz constant" [AS14]) associated to g, i. e., the minimal constant such that, for all x 1 , x 2 ∈ R n :

Note that the constant C k depends on the value of y(t) at time t = kh 1 . The constants L and λ can also be calculated "locally" for the zone occupied by x(t) at time t ∈ [kh, (k + 1)h], using a nonlinear optimization solver (see, e.g., [START_REF] Jerray | Robust optimal periodic control using guaranteed Euler's method[END_REF] for details).

Let us now consider the sequence {µ k } k≥0 where µ k is defined recursively, for k ≥ 1 as

We can now define δ µ 0 (2h) as δ µ 1 (h) with µ 1 = δ µ 0 (h), and more generally, we can extend the definition of δ µ 0 (•) on [0, ∞) as follows: for all k ≥ 0 and t ∈ [0, h], δ µ 0 (kh + t) = δ µ k (t).

In particular, it is easy to see that: δ µ 0 (kh) = δ µ k (0) = µ k and δ µ 0 ((k + 1)h) = δ µ k (h) = µ k+1 .

Theorem E.1. [START_REF] Le Coënt | Control synthesis of nonlinear sampled switched systems using Euler's method[END_REF] Consider the system ẋ(t) = g(x(t)), with g : R n → R n . Let x(t) and (y k ) be defined as in (E.2) and (E.3) respectively, and µ 0 := ∥y 0 -x 0 ∥.

Then, for all t = kh with k ≥ 0:

In the following, we give sufficient conditions on g and h ensuring that δ µ 0 (kh) (hence ∥y k -x(kh)∥) converge to 0 as k → ∞. In the rest of the work, we will always assume that g is Lipschitz continuous with constant L > 0.

E.3.2 Strong monotonicity

Lemma E.1. Consider the system ẋ(t) = g(x(t)), with g : R n → R n . Let x(t) and (y k ) be defined as in (E.2) and (E.3) respectively, and µ 0 := ∥y 0 -x 0 ∥. If the following conditions are satisfied: 1. ∥g(y k )∥ → 0 as k → ∞ with a convergence rate r k , 2. g of OSL constant λ < 0 (i.e., -g strongly monotone).

Then δ µ 0 (kh) → 0 as k → ∞ with a convergence rate r k . Proof. By Taylor-Lagrange's theorem, we find: δ 2 µ 0 ((k + 1)h) ≤ δ 2 µ 0 (kh)e λh + C 2 k h 3 /(3|λ|). (E.7)

Since C k = L∥g(y k )∥ → 0 as k → ∞ with rate r k , and e λh < 1, it follows that there exists ℓ ∈ N such that: δ 2 µ 0 ((k + 1)h) < δ 2 µ 0 (kh) for all k ≥ ℓ. Hence, the sequence Size Example E.2. 3 Let us consider the following function f : R 2 → R defined for t ≥ 0, by:

with w = (w 1 , w 2 ), a 1 = 1, a 2 = 2, b 1 = 5 and b 2 = 7. Let us compute its minimum w * = (w * 1 , w * 2 ) by gradient descent, with initial point w 0 = (w 0 1 , w 0 2 ) = (9, 10). Using the software ORBITADOR [START_REF] Jerray | Orbitador: A tool to analyze the stability of periodical dynamical systems[END_REF], we find: λ ≤ -0.187 and L < 7 (see Figures E.6 error to 0 (Theorem E.3). This can shed new light on the relationship between the convergence of continuous differential equations (such as the gradient flow) and their discretization (gradient descent algorithm). In particular, our analysis might be interesting in the framework of neural residual networks [START_REF] He | Deep residual learning for image recognition[END_REF], a continuous version of the classical neural networks for which the gradient descent algorithm is used in a basic way.