Christophe Mertens
email: chmerten@ulb.ac.be

Francis Grenez
email: fgrenez@ulb.ac.be

Franc ¸ois Viallet
email: francois.viallet@lpl-aix.fr

Alain Ghio
email: alain.ghio@lpl-aix.fr

Sabine Skodda
email: sabine.skodda@kk-bochum.de

Jean Schoentgen

Vocal tremor analysis via AM-FM decomposition of empirical modes of the glottal cycle length time series

Keywords: Parkinson's disease, vocal tremor, empirical mode decomposition

The presentation concerns a method that obtains the size and frequency of vocal tremor in speech sounds sustained by normal speakers and patients suffering from neurological disorders. The glottal cycle lengths are tracked in the temporal domain via salience analysis and dynamic programming. The cycle length time series is then decomposed into a sum of oscillating components by empirical mode decomposition the instantaneous envelopes and frequencies of which are obtained via an AM-FM decomposition. Based on their average instantaneous frequencies, the empirical modes are then assigned to four categories (intonation, physiological tremor, neurological tremor as well as jitter) and added within each. The within-category size of the cycle length perturbations is estimated via the standard deviation of the empirical mode sum divided by the average cycle length. The tremor frequency within the neurological tremor category is obtained via a weighted instantaneous average of the mode frequencies followed by a weighted temporal average. The method is applied to two corpora of vowels sustained by 123 and 74 control and 456 and 205 Parkinson speakers respectively.

Introduction

Fast, small and involuntary cycle-to-cycle perturbations of vocal cycle lengths are designated as vocal jitter and involuntary low-frequency modulations of the vocal cycle lengths are referred to as vocal tremor. The latter have physiological (breathing, cardiac beat and pulsatile blood flow) or neurological causes. Conventionally, vocal jitter and tremor are tracked in sustained speech sounds in which small cycle length perturbations are less likely to be masked by intonation, accentuation or segment-specific phenomena.

The objective of the presentation is to report estimates of the vocal tremor frequency and vocal tremor depth in vowels sustained by patients suffering from Parkinson disease and normal control speakers.

The analysis involves speech cycle features that are the cycle peak amplitudes and saliences, which generate candidate glottal cycle length time series. The final length time series is obtained via the selection by dynamic programming of a cycle length sequence the overall disturbance of which is a minimum.

The focus of the presentation is on the decomposition of the cycle length time series into sub time series that are respectively assigned to vocal jitter, neurological tremor, physiological tremor and a residual trend, which is due to intonation and declination, as well as the subsequent estimation of neurological tremor frequency and depth.

The break-up is based on empirical modes that are assigned to one of the four categories. Empirical modes are zero-mean alternating functions, which are obtained via empirical mode decomposition and the cycle length sub time series are obtained by summing the modes assigned to a same category.

The size of vocal jitter and of physiological and neurological tremor depths can so be estimated via the standard deviations of the corresponding sub time series.

Ideally, the typical tremor frequencies could be estimated via weighted averages of the instantaneous frequencies of the empirical modes that belong to the neurological or physiological tremor categories. However, one observes that due to mode mixing large frequency components may appear in two adjacent modes that together do not contribute much to the corresponding sub time series because they are out of phase. Computing arithmetic averages of mode frequencies would therefore assign undue weight to frequencies that exist in individual modes, but which do not contribute to the corresponding tremor category. The solution that is explored here consists in estimating the instantaneous phase and amplitude of each empirical mode. These then enable a complex mode to be assigned to each empirical mode and the weighted average of the instantaneous mode frequencies is defined in the complex plane so that only in-phase frequency components contribute to the final estimate.

Neurological tremor frequencies and depths are obtained for two corpora of vowels sustained by 123 and 74 control and 456 and 205 Parkinson speakers respectively. Parkinson's disease is a degenerative disorder of the central nervous system. Possible vocal symptoms of the disease are vocal frequency tremor and hoarseness [START_REF] Cnockaert | Low-frequency vocal modulations in vowels produced by parkinsonian subjects[END_REF]. In a study based on a large sample of patients with Parkinson disease, it has been reported that between 70% and 90% of patients have problems related to speech and voice impairments [START_REF] Logemann | Frequency and cooccurrence of vocal tract dysfunctions in the speech of a large sample of parkinson patients[END_REF].

Methods

Cycle length tracking

Vocal cycle length tracking is based on a temporal method, which does not rest on the assumptions that the signal is locally periodic and the average cycle length known a priori. The vocal frequency is assumed to be between 60Hz and 400Hz. The cycle length tracking relies on the amplitudes and saliences of the cycle peaks. Saliences are the lengths over which a cycle peak is a local maximum. The selection of the final length time series among several candidate series relies on dynamic programming that extracts a cycle sequence the length perturbations of which are minimal [START_REF] Mertens | Reliable tracking based on speech sample salience of vocal cycle length perturbations[END_REF]. The so obtained cycle length time series is then constant-step resampled for further processing.

Empirical mode decomposition

The vocal cycle length time series is analyzed via Empirical Mode Decomposition. EMD breaks up iteratively a time series x(t) into a sum of Intrinsic Mode Functions ci(t) and a residue r(t).

x(t) = I i=1 ci(t) + r(t) (1)
An IMF is a zero-mean function alternating with respect to the horizontal axis and the residue is monotonic. The first IMF contains the finest scale components of the original time series and the successive IMFs contain increasing longer cycle variations. A property of empirical mode decomposition is that the original time series can be exactly recovered by summing the empirical modes. Another property is that the method does not rely on basis functions that are fixed a priori. The orthogonality between consecutive IMFs is not guaranteed theoretically, however. Therefore, mode mixing may occur, which means that 2 successive IMFs may overlap substantially in the frequency domain.

Instantaneous frequencies of IMFs and AM-FM decomposition

Overview

Given that IMFs are narrow-band functions locally, the instantaneous amplitude and frequency can be estimated for each. Each mode function ci(t) is therefore rewritten as a product.

ci(t) = ai(t) cos(θi(t))

(2) The first factor, ai(t), is the time-varying IMF envelope (AM component or instantaneous amplitude) and the second, cos(θi(t)), is the FM component, or carrier, with unit amplitude and instantaneous phase θi(t). A necessary condition for (2) to be meaningful is that ci(t) is mono-component and narrowband so that the spectra of the AM and FM components do not overlap [START_REF] Huang | On instantaneous frequency[END_REF].

Empirical AM-FM decomposition

The empirical AM-FM decomposition is iterative and involves the following steps [START_REF] Huang | On instantaneous frequency[END_REF]. Residual y(t), which is the carrier, is requested to be ≤ 1 in absolute value because of identity [START_REF] Mertens | Reliable tracking based on speech sample salience of vocal cycle length perturbations[END_REF]. Result ai(t) corresponds to the time-varying envelope of ci(t) and the oscillating component cos(θi(t)) is obtained via a division.

cos (θi(t)) = ci(t) ai(t) (3)

Computation of the instantaneous frequency

Instantaneous frequency fi(t) is obtained by a numerical differentiation of instantaneous phase θi(t) after phase unwrapping.

The numerical phase differentiation relies on a 6 th -order polynomial [START_REF] Boashash | Estimating and interpreting the instantaneous frequency of a signal. ii. algorithms and applications[END_REF].

fi(t) = 1 2π dθi(t) dt (4)

Categorization of IMFs

The next step consists in grouping IMFs in four categories followed by summing : trend, physiological tremor, neurological tremor, and vocal jitter. Individual modes are assigned to one of the four categories on the base of their weighted instantaneous frequency averaged over the analysis interval. The weights are instantaneous amplitudes ai(t).

• The residue of the empirical mode decomposition is assigned to the trend, i.e. intonation and declination.

• The IMFs with weighted average instantaneous frequency < 2Hz are assigned to physiological tremor.

• The IMFs with weighted average instantaneous frequency ≥ 2Hz and ≤ 15Hz are assigned to neurological tremor.

• The remaining IMFs are assigned to jitter.

x(t) =   i J i=1 c i (t)   x jit (t) +   i N i=i J +1 c i (t)   xneur (t) +   I i=i N +1 c i (t)   x physio (t)
+ r(t)

x trend (t)

Lower limit of 2Hz enables to discard heart beat and breathing, and the upper limit of 15Hz includes the frequency interval of the great majority of tremor types [START_REF] Rubchinsky | Tremor[END_REF]. The categorization is illustrated in Figure 1.

Typical neurological tremor frequency

Here, only empirical modes assigned to the neurological tremor category are considered. The neurological tremor time series xneur(t) is given by the sum of the assigned modes ci(t). In the complex domain, each time series ci(t) may be described on the basis of a complex time series zi(t) characterized by instantaneous phase φi(t) and envelope ai(t) : ci(t) = ai(t) cos (φi(t)) = Re ai(t) e jφ i (t) = Re {zi(t)}

xneur(t) = i N i=i J +1 ci(t) (6)
As a consequence, a complex neurological mode zi(t) may be assigned to each empirical mode and a complex tremor time series zneur(t) is therefore assigned to real sum [START_REF] Rubchinsky | Tremor[END_REF].

zneur(t) = i N i=i J +1 zi(t) = |zneur(t)| e jφneur (t) (8)
The derivative of complex time series (8) is calculated to obtain instantaneous frequency 1 2π dφneur(t) dt . Assuming that the envelope evolves more slowly than the carrier, term dai(t) dt may be disregarded, and, after some manipulations, one obtains:

fneur(t) = 1 2π dφneur(t) dt ≈ i N i=i J +1 wi(t) fi(t) i N i=i J +1 wi(t)
with wi(t) = ai(t) cos φi(t) -φneur(t)

As a consequence, the typical neurological tremor frequency fneur(t) is given by the weighted sum of instantaneous empirical mode frequencies fi(t). The weights, wi(t) are obtained by projecting complex modes zi(t) on sum zneur(t). A large and positive weight is so assigned to empirical modes that are in phase with neurological tremor. Adjacent empirical modes that are out of phase (owing to mode mixing) zero each other and do not contribute to overall neurological tremor.

Vocal cues

Vocal frequency

Vocal frequency F0 is obtained via the inverse of the average of the trend.

Perturbation levels

Vocal jitter σjit, neurological and physiological tremor modulation depths, σneur and σ physio , total tremor depth σtre and total perturbation σpert are respectively the standard deviation of the jitter time series, the physiological and neurological tremor time series, the sum of the physiological and neurological tremor time series and the sum of the jitter and total tremor time series, divided by the average of the trend.

Typical neurological tremor frequency

Inspired by development ( 9), the typical neurological tremor frequency fneur(t) is estimated on the base of a weighted sum of individual mode frequencies fi(t).

fneur(t) = i N i=i J +1 wi(t) fi(t) i N i=i J +1 wi(t) (10)
Figure 2 illustrates a typical estimated neurological tremor frequency time series obtained for a stationary fragment of vowel [a]. One observes that the frequency fneur(t) can be locally negative. One reason is the occasional negativity of weights wi(t), which is the consequence of particular phase relations between the complex sum of the modes and individual modes.

Another reason is the negativity of instantaneous mode frequencies fi(t). The instantaneous frequencies of individual modes are positive given their definition, but negativity may appear because of the iteration involved in the empirical AM-FM decomposition that may turn a mode inflection point into a pair of a local maximum and minimum. A local non-negative minimun or non-positive maximum causes the instantaneous frequency to become locally negative.

The estimated neurological tremor frequency time series is therefore smoothed by means of a moving average filter of length 0.2s.

This instantaneous frequency time series is summarized by its temporal average µ fneur and standard deviation σ fneur weighted sample-by-sample by module |zneur(t)|.

Corpora

The corpora comprise vowels

Results and discussion

Table 1 reports the quartiles of the neurological and physiological tremor depths, the size of jitter, the size of the total tremor and of the total perturbations (all in %). The last three lines of the table report the tremor frequency, the tremor frequency standard deviation and the average F0 (all in Hz). Quartiles Q0 to Q4 report the feature values at 5%, 25%, 50%, 75% and 95% of the feature value range of the pooled data.

A two-way analysis of variance has been carried out for each feature with independent variables "gender" and "pathology". Physiological tremor depth σ physio , size of jitter σjit and neurological tremor frequency standard deviation σ fneur do not differ statistically significantly between control and Parkinson speakers or between male and female speakers. They are not discussed further.

The other features differed statistically significantly between control and Parkinson speakers. Neurological tremor depth σneur (< 0.05), neurological tremor frequency µ fneur (< 0.001) and F0 (< 0.001) also differed statistically significantly between male and female speakers. The interaction between variables "gender" and "pathology" was statistically significant for neurological tremor depth σneur (< 0.05) and F0 (< 0.001).

Interactions between "gender" and "pathology" were due to the following. A non-parametric Wilcoxon test showed that F0 differed statistically significantly between male control and Parkinson speakers only and that neurological tremor depth σneur differed between female control and Parkinson speakers only. In addition, F0 increased for male Parkinson speakers and decreased for female speakers compared to the control speakers (loose from any statistical significance).

The remaining features, total tremor σtre (in %), total perturbations σpert (in %) and neurological tremor frequency µ fneur (in Hz) increased for the Parkinson speakers compared to the control speakers, irrespective of the gender. 1: Quartiles of the neurological and physiological tremor depth, the size of jitter, the size of the total tremor and of the total perturbations (all in %). The last three lines of the table report the tremor frequency, the tremor frequency standard deviation over the analysis interval and the average F0 (all in Hz). Quartiles Q0 to Q4 report the feature values at 5%, 25%, 50%, 75% and 95% of the feature value range. Symbol refers to the statistical significance of the differences between control and Parkinson speakers [ : p < 0.05, : p < 0.01, : p < 0.001] within the framework of the two-way analysis of variance.

MALE

Figure 1 :

 1 Figure 1: Categorization : cycle length time series, vocal jitter, neurological tremor, physiological tremor and trend (in that order) for a fragment of vowel [a] sustained by a Parkinson speaker.

  [a] sustained by normal speakers and patients suffering from Parkinson's disease. The first corpus [74 controls (42♂,32♀), 205 Parkinson speakers (129♂,76♀)]

Figure 2 :

 2 Figure 2: Raw and smoothed typical estimated neurological tremor frequency time series for a fragment of vowel [a] sustained by a Parkinson speaker

  1. Initialization : y(t) = ci(t) and ai(t) = 1, ∀t. 2. Detection of the local maxima of the value of |y(t)|. 3. Cubic spline interpolation of the envelope e(t) of |y(t)| via the positions and amplitudes of the local maxima. 4. Update : ai(t) → ai(t) • e(t) and y(t) → y(t) e(t) . 5. Test whether all maxima of |y(t)| have amplitude ≤ 1. If yes, stop. If no, loop to step 2.


Jovan Radak

Bertrand Ducourthial
email: bertrand.ducourthial@utc.fr

Véronique Cherfaoui

Stéphane Bonnet

Detecting road events using distributed data fusion: experimental evaluation for the icy roads case

Keywords: event detection, distributed data fusion, belief function, VANET, V2V and V2I communication, road experiment

One of the main ideas in the area of intelligent transport systems is to use all possible information, coming from vehicles and infrastructure, in order to make the system "smarter" and avoid potentially dangerous situations -collisions, accidents, bottlenecks... However data is sometimes unreliable due to source and communication network quality, leading vehicles or even the whole system to wrong decisions. We present a generic method for detecting dangerous events on the road. To support unreliable data sources, it uses distributed data fusion. Moreover, to deal with network failures, it relies on a self-stabilizing generic distributed algorithm. Our method mixes measurements obtained from vehicle onboard sensors as well as wireless sensors placed close to the road and connected to road side units. Each vehicle computes how confident it is about a potential dangerous event using both local and remote data. To evaluate our approach, we implemented it using a specific hardware and software platform. Moreover, we instantiated a simple, yet efficient application to detect icy roads, based on temperature measurements. Thanks to both in-lab and actual on-the-road experiments, we demonstrate the possibility to deduce proper results from unreliable data and, consequently, the correctness and usefulness of our approach.

I. Introduction

A. Motivations

Data fusion of large amounts of data in the context of intelligent transportation systems is often a solution to the data source inaccuracy and unreliability problem. In general, data may come from different sources and is heterogeneous by nature. It is relatively easy to come up with a conclusion on how to mix two pieces of information together when their data sources are homogeneous, reliable and give similar readings. But, in order to process large amounts of heterogeneous data, some form of data fusion has to be applied. Many different data fusion techniques are proposed [START_REF] Luo | Multisensor integration and fusion in intelligent systems[END_REF], [START_REF] Luo | Multisensor fusion and integration: approaches, applications, and future research directions[END_REF], depending on the specific problem to be solved and the data sources [START_REF] Khaleghi | Multisensor data fusion: A review of the state-of-the-art[END_REF]. However, in the case of conflicting or missing data sources, it may be problematic to reach a decision. The properties of the theory of belief functions make it specially suitable in the presence of imprecise, uncertain and incomplete data [START_REF] Dubois | Evidence, knowledge, and belief functions[END_REF].

From another point of view, intelligent transportation systems rely on the smartness of each part of the system. Enabling vehicles and additional communication infrastructure with "smart" algorithms may help solving some of the major safety problems [START_REF] Faouzi | Data fusion in intelligent transportation systems: Progress and challenges -a survey[END_REF] in vehicular networks. In general, the intelligence of vehicles heavily depends on a large amount of gathered data, that is processed and then used to give drivers or vehicles useful information. Fusion of such information can be used in different applications, from various positioning problems [START_REF] Fogue | On the use of a cooperative neighbor position verification scheme to secure warning message dissemination in VANETs[END_REF] to detecting false nodes in networks [START_REF] Zoghby | Distributed data fusion for detecting sybil attacks in VANETs[END_REF]. It appears to be specially suitable for future smart cities equipped with a large number of sensors that may act as data sources not only for their citizens but for vehicles as well. However, it relies on unstable networks with very short useful communication times, especially between vehicles and road-side units. An approach supporting both unreliable data sources and network failures is then required.

B. Our approach

In this paper, we present a generic method to handle multiple data sources in unreliable vehicular networks, that can be used to design applications in the context of intelligent transportation systems for advance detection of dangerous events on the road. This work completes our previous paper [START_REF] Radak | Early detection of dangerous events on the road[END_REF]. It presents results from road experiments using sensors, road-side units (RSU) and vehicles equipped with on-board units (OBU) [START_REF] Radak | Design and implementation of the vehicular network testbed using wireless sensors[END_REF].

Our approach relies on distributed data fusion: it takes conflicting pieces of information into account and applies calculations on them until it reaches a decision. For this purpose, the theory of belief functions framework is used. The data sources are standalone sensors connected (wirelessly) to some road-side units. In-vehicle data sources, connected to on-board units, are also taken into account. OBUs and RSUs communicate when they are in range of each others. However, a moving vehicle may converge to an erroneous confidence because it considered data sent by sources which are now too far away to be pertinent. To prevent such a situation, data fusion is performed thanks to a self-stabilizing distributed algorithm, meaning it is able to converge after transient failures, including neighborhood updates [START_REF] Ducourthial | Self-stabilizing distributed data fusion[END_REF]. The algorithm is generic and is data-representation agnostic. Hence, many applications can be derived from our method.

To the best of our knowledge, no study is similar enough to our approach to be directly compared. Hence, the bulk of our effort is in implementing the whole system, including harware and software elements, to prove the validity and practicality of our approach through real-world, on-the-road experiments. To this aim, we instantiated our method to design a temperaturesensor-based icy-road detection application. A large part of our work is thus practical and dedicated to experiments. On-the-road experiments were carried out according to several predefined scenarios. They were supplemented by in-lab experiments, thanks to a network emulation program that allows road tests to be replayed and extended. We show that the application correctly assesses the risk of dangerous icy road conditions even in the presence of conflicting information sources and when blending stationary and moving sources. Hence, this technique surpasses a simple alert diffusion and is more robust to deficient sensors and to unstable neighborhoods.

The remainder of this article details the method and the practical development used for its validation. We start our presentation describing the related work (Section II). Next, we define the basic concepts and introduce our generic approach for detecting dangerous events. Then we explain how it can be instantiated, here as an application assessing the risk of encountering icy roads. (Section III). In Section IV we explain how this application is implemented using a detection system relying on sensors, road-side units, on-board units and dedicated software. Section V presents our experimental study. We did an extensive evaluation using both our testbed and a network emulator using real data obtained from the testbed. In Section VI, we conclude on our findings and a few directions for our future work.

II. Related work

The need for smart transportation systems, namely smart cars, has been noticed in early works [START_REF] Varaiya | Smart cars on smart roads: problems of control[END_REF]. The authors emphasized control of these devices as a main problem. The presence of numerous data sources are making decision problems even more complex. Different solutions were proposed to deal with large amounts of data sources in various applications [START_REF] Luo | Multisensor fusion and integration: approaches, applications, and future research directions[END_REF]. The area of information fusion has been especially well studied for various applications of wireless sensor networks [START_REF] Tapia | Wireless sensor networks for data acquisition and information fusion: A case study[END_REF], [START_REF] Daz-Ramrez | Wireless sensor networks and fusion information methods for forest fire detection[END_REF]. We are proposing a different approach using one or more wireless sensors within the range of exactly one road-side unit, avoiding multihop communication between sensors and allowing only RSUs to exchange information with sensors. In this way, we are simplifying communication requirements and using wireless sensors efficiently in terms of energy.

In the last few years, we have witnessed a great effort to standardize communication protocols aimed at vehicular networks. The IEEE 802.11p standard is especially suited to applications in vehicular networks [START_REF] Teixeira | Vehicular networks using the {IEEE} 802.11p standard: An experimental analysis[END_REF], in both vehicleto-vehicle (V2V) and vehicle-to-infrastructure communication (V2I) cases. Also, the ETSI has standardized vehicular wireless communications in the network and transport layers of the communication stack. It has proposed facilities that support vehicle safety through cooperative awareness and warning messages sent asynchronously to vehicles. These facilities include two specialized types of messages: CAM -cooperative awareness message and DEMN -decentralized environmental notification message [START_REF] Santa | Vehicle-toinfrastructure messaging proposal based on CAM/DENM specifications[END_REF].

An important aspect in the functioning of intelligent transport systems is the way drivers are alerted of possibly dangerous driving conditions on the road [START_REF] Fang | Dangerous driving condition analysis in driver assistance systems[END_REF] and the impact of drivers' behavior on the whole system [START_REF] Dressler | On the impact of human driver behavior on intelligent transportation systems[END_REF]. In [START_REF] Malta | A study of driver behavior under potential threats in vehicle traffic[END_REF], the authors demonstrated the importance of early alerts and appropriate signaling of the possibility of dangerous events on the road to drivers. An interesting solution that puts together in-car mobile applications, hazardous events and alerts signalling to drivers is presented in [START_REF] Orhan | Road hazard detection and sharing with multimodal sensor analysis on smartphones[END_REF]. The authors have developed a system that detects speed bumps and potholes based on synchronized sensor readings and extraction from a video feed taken simultaneously with these readings. Although an interesting solution, it is limited to usage of smartphones and specific capabilities of certain types of mobile phones. This study is also limited in terms of data dissemination, i.e. it is not clear how other users can make use of this data and if some calculations can be done cooperatively. In [START_REF] Schweiger | ElisaTMcar to infrastructure communication in the field[END_REF], the authors present a testbed enabling communication between vehicles and the infrastructure. This test infrastructure gives interesting results and shows the significance of the approach. However, due to the different scope of the article, the authors do not cover the possibility of equipping the infrastructure with sensors that may communicate with vehicles.

We are presenting a solution that links these two interesting points along with the problems presented in previous paragraphs. We investigate how to use multiple stationary and mobile sources of the same data type to deal with uncertainties and inaccuracies of these data sources. We show how to make use of inaccurate data sources, with the help of robust distributed datafusion algorithms. Finally, in order to evaluate our approach, a solution that gives an assessment of the risk of finding ice on the road is proposed. We discuss results and how this approach is suitable to generate early warnings to drivers even in the presence of erroneous sensors and disturbing vehicles.

III. Distributed data fusion for dangerous event detection

Data fusion can be described as a mechanism that combines data retrieved from different sources to reduce its uncertainty and/or to generate decisions. In general, data fusion is either centralized (collecting data and applying an algorithm in some kind of central unit) or distributed (each unit is capable of applying the algorithm on data gathered locally from its neighborhood). In the remainder of this section we present the basic concepts of the theory of belief functions (Section III-A), a generic distributed data fusion algorithm based on this framework (Section III-B) and its instantiation to detect icy roads (Section III-C).

A. Theory of belief functions

The theory of belief functions, or Dempster-Shafer theory, is one of the frameworks used in data fusion [START_REF] Khaleghi | Multisensor data fusion: A review of the state-of-the-art[END_REF]. This theory belongs to the probabilistic approaches for dealing with unreliable sources [START_REF] Ferreira | Probabilistic Approaches to Robotic Perception[END_REF]. The Bayesian approach can be used to solve a similar set of problems. There is a lot of controversy and different arguments about which approach is the best suited [START_REF] Pearl | Probabilistic Reasoning in Intelligent Systems: Networks of Plausible Inference[END_REF]. We use the theory of belief functions to model uncertainties and lack of information [START_REF] Smets | Data fusion in the transferable belief model[END_REF]. It generalizes both the set-membership approach and the probability theory. In the Dempster-Shafer theory, the set Ω = ω 1 , ..., ω n of mutually exclusive propositions is called the frame of discernment. The main difference relative to the probability theory is the fact that the mass of evidence is attributed not only to single hypotheses ω i , but to any subset of Ω, including the empty set.

Following the general framework for the belief representation [START_REF] Dubois | Evidence, knowledge, and belief functions[END_REF], we define the state of belief of the node v on the global frame of discernment Ω. A state of belief is assigned using basic belief assignment, most commonly represented as a mass function, denoted m Ω . A mass function m Ω is a mapping from 2 Ω (the set of subsets of Ω) to the interval [0, 1] ∈ R. The sum of all masses is equal to 1. A mass value is directly proportional to confidence: m Ω (A) increases as the node gets more confident in A ⊂ Ω. The masses can be combined with different types of operators such as the conjunctive operator, which emphasizes agreement when it combines two mass functions that are reliable and independent, or the Dempster's operator, which ignores conflict, spreading it to the other sets. These two operators are associative and commutative. In this work, we are using the cautious operator, denoted [START_REF] Denoeux | Conjunctive and disjunctive combination of belief functions induced by nondistinct bodies of evidence[END_REF]. This operator is associative, commutative and idempotent. Idempotency is an important property because it allows data coming from sources that are not independent to be combined.

In our explanations we use the term direct confidence to denote mass values of data obtained solely from the node itself, and the term distributed confidence to denote the combination of the mass values obtained from the node itself and those received from its neighbors. In this case, distributed confidence combines all data sources in the network. Moreover, we use the term discounting to denote the modification of a confidence so that it is less informative. In our algorithm it is used to prioritize confidences from closer nodes in comparison to confidences from nodes farther away. To calculate values that we can use in decision making, we are applying a pignistic transformation of the mass functions (given as direct and distributed confidences). This transformation computes the contribution of each subset W of Ω to a given hypothesis A knowing that W will contribute if A ∈ W. The pignistic transformation [START_REF] Smets | Decision making in the tbm: the necessity of the pignistic transformation[END_REF] of the mass function m Ω (A) for all subsets W of Ω containing A set is defined as:

BetP Ω (A) = W⊆Ω,A∈W 1 |W| m Ω (W) 1 -m Ω (∅) (1)

B. Distributed data fusion

We will now describe our generic approach for distributed data fusion. It relies on Algorithm 1, previously studied in [START_REF] Ducourthial | Self-stabilizing distributed data fusion[END_REF]. This algorithm is divided into two event-driven rules.

The first rule (Lines 1-3) handles data received from communication with other nodes. It is activated each time node v receives a message from one of its neighbors and its input memory IN v is updated with data sent by the neighbor (Line 3). A message contains the distributed confidence computed by the sender. This is done by the second rule.

The second rule does the distributed data fusion computation and sending (Lines 4-11). It is done periodically by each node. Nodes are not synchronized and each one of them starts calculations when its timer expires. This rule assumes that each node is able to compute its direct confidence from a local measurement obtained from an external data source (such as a sensor) using the function compute direct confidence (Line 5). The basic belief assignment is done using sigmoidlike functions that map the measurement to a mass function, spreading confidence on subsets of the frame of discernment Ω. This function depends on the targeted application; we give an example in the next subsection. Upon the arrival of a new message:

2 receive( dist conf ) from node u 3 IN v [u] ← dist conf 4
Upon the expiration of the timer of the node v:

5 OUT v ← compute direct confidence() 6 for each u in IN v do 7 OUT v ← OUT v r(IN v [u]) 8 end for 9 send( OUT v ) in the neighborhood 10 Remove old messages in IN v 11
Restart the timer

The distributed confidence is computed iteratively combining the direct confidence of the node (stored in OUT v ) with all data received from neighbors (Lines 5-8). It relies on the cautious operator and the discounting r (Line 7). Old data is removed from the input memory IN v so that if a node leaves the neighborhood, its data will not be taken into account anymore after a fixed number of timers (considering several timers is useful to prevent message loss). Finally, the result -the distributed confidence of the node stored in OUT v -is sent to the neighborhood (Line 9) and the timer is restarted to program the next computation (Line 11).

Each node computes its distributed confidences using those received from its neighbors. Thus, the direct confidence of a node will be taken into account by its neighbors, then by the neighbors of its neighbors and so on. In this way, each node is contributing to the computation of what we call the distributed confidence.

Discounting is applied to each distributed confidence received to give priority to closer sources over farther ones. Thus, a distant information source will still be taken into account in the computation of the distributed confidence of a given node but with decreasing importance as its output will be discounted at each hop (given as the r function at Line 7). As a consequence, the distributed confidence computed by each node may be different, as even though the same information sources (the direct confidences of each node of the network) are taken into account by each node, they are discounted differently depending on the position of the node in the network. The result reflects the local situation in the vicinity of the node without ignoring information from other, more distant nodes.

Data incest appears when a single piece of information, coming from a single source, is used in the fusion process more than once. Such a situation can appear with our distributed data fusion algorithm; however it is solved thanks to the idempotency of the cautious operator . The properties of the cautious operator and the discounting r both ensure convergence of the algorithm even in the presence of transient failure [START_REF] Ducourthial | Self-stabilizing distributed data fusion[END_REF].

This approach accepts any kind of frame of discernment and can be applied to a large set of applications in the

C. Application to the robust detection of icy roads

In this section, we explain how to instantiate our generic method to detect a given road hazard: icy roads. This consists in designing a model adapted to this problem and assigning direct confidences from measurements (function compute direct confidence in Algorithm 1).

While it is clear that the road is dangerous for some temperatures and not for others, there exists a range of temperatures where there is a doubt. We define three road states, corresponding roughly to three temperature ranges. These states lead to the definition of the following frame of discernment: Ω = {freezing, slippery, safe}.

We assign basic belief assignments from temperature sensor measurements using sigmoid-like functions defined for the subsets of the Ω set (Fig. 2). The idea is to give a large mass to the state corresponding to the measured temperature and smaller ones to the other subsets of Ω. As the measurement gets closer to a threshold between two states, the mass gets more and more spread over several subsets of Ω. Moreover, we do not completely trust sensors and a mass is always given to the subset Ω itself, representing their unreliability (given as α, 0 < α < 1). We chose not to consider the subset {freezing, safe} corresponding to disjoint events. When assigning masses for the direct confidence, there is no value for the subset ∅ because it represents the "conflict" proposition (some values may appear for ∅ after combination of several sources in the distributed confidence).

Thresholds and reference values that define road states are chosen in such a way that they correspond to real values. T cur is the current temperature -value read from the sensor, T ref , T thr1 , T thr2 and λ are the reference values chosen in such a way that sigmoids have appropriate shapes (Fig. 2) as well as to fit the values needed to describe icy roads. These parameters can be changed easily and we can create a model that can be tested with higher temperatures than those that produce an icy road (which is useful to perform tests during any season).

For our purposes, the road is safe for temperatures above 6 • C, between safe and slippery in the interval {3 • C, 6 • C}, most probably slippery in the temperature interval {-1 • C, 3 • C}, between freezing and slippery in the interval {-1 • C, -4 • C}, and most probably freezing for temperatures below -4 • C. α is fixed to 0.2; it corresponds to the belief of an incorrect temperature (unreliable sensor).

m({freezing}) = (1 -α) - 1-α 1+e -λ(Tcur -T ref +T thr2 ) m({ f reezing, slippery}) = 1-α 1+e -λ(Tcur -T ref +T thr2 ) - 1-α 1+e -λ(Tcur -T ref +T thr1 ) m({slippery}) = 1-α 1+e -λ(Tcur -T ref +T thr1 ) - 1-α 1+e -λ(Tcur -T ref -T thr1 ) m({slippery, sa f e}) = 1-α 1+e -λ(Tcur -T ref -T thr1 ) - 1-α 1+e -λ(Tcur -T ref -T thr2 ) m({sa f e}) = 1-α 1+e -λ(Tcur -T ref -T thr2 ) m({Ω}) = α
Fig. 2: Sigmoid-like functions definitions for subsets of Ω.

Note that instantiating our method on a given problem (here icy road detection) requires expertise in the related field to define the frame of discernment, the sigmoids-like functions and the thresholds.

IV. Implementation of the detection system In this section, we present the hardware and software implementation of our road event detection system. We present the system architecture, its hardware components, the framework used to implement the applications and the software components of the system. Its instantiation for icy road detection only impacts the type of sensors used and the software parameters.

A. System architecture

Our detection system (Fig. 1) relies on stationary and mobile measurements combined by using our distributed data fusion application, described in the previous section. Stationary measurements are performed by wireless sensors located close to the road, sending their measurements to solar-powered roadside units (Fig. 3). Road-side units communicate between themselves and with on-board units in their transmission range. Vehicles in the testbed are fitted with on-board units allowing them to communicate with road-side units and other vehicles.

RSUs and OBUs use WiFi to communicate between themselves. Messages that are exchanged in this communication are those of the distributed data fusion application, namely the distributed confidence that is computed periodically by each node. Communication with sensors relies on dedicated packets exchanged through Zigbee modules -that both wireless sensors and RSUs have. OBUs are not fitted with Zigbee modules and receive measurements directly from vehicle sensors.

B. Hardware components

The hardware part of the testbed consists of cheap off-theshelf wireless sensors and a dedicated embedded hardware platform, called the Airbox and developed in our laboratory, that is used in both RSUs and OBUs. The testbed, as deployed, features 3 RSUs and 3 Xbee sensors communicating wirelessly with the RSUs via the 802.15.4 protocol. Data is gathered using the serial ports of the RSUs. We have developed a support program that is used to connect computing units (RSUs or regular PCs) with wireless sensors and gather data through the Xbee modem connected to the serial port of the RSU [START_REF] Radak | Design and implementation of the vehicular network testbed using wireless sensors[END_REF].

The wireless sensors1 are equipped with a temperature sensor. We have deployed a simple topology -using exactly one sensor for each RSU. The support program allows more complicated scenarios with multiple sensors per RSU but this strictly depends on the application for which this testbed is used.

The Airbox units are based on the IGEP platform2 -a TI OMAP controller with 512 MB of RAM. They are running the Linux operating system and a specialized software suite, called Airplug and described in the next section. The driver part of the support program is responsible for establishing a connection between the Airbox serial port, the Xbee module and the Xbee sensor. The application exchanges binary packets between the RSU and the wireless sensors and decodes them upon reception. Decoded data is further transferred to other applications that may use them.

C. Airplug framework

The Airplug software distribution is a program suite aiming to fully support development, testing and deployment of dynamic networks. It relies on a simple framework based on a few development rules focusing on the implementation of portable software for highly dynamic networks. These rules are: (i) usage of the standard input/output system to ensure independence from the programming language used for implementation, (ii) usage of standard ASCII text messages to ensure portability (support of different operating systems), (iii) a simple message addressing scheme which includes addressing of applications with the value pair (app name, area), where area is a keyword determining the range of broadcast (LCH to broadcast to the localhost only, AIR to broadcast to the neighborhood) and (iv) reliance on broadcast and on managing message visibility with subscriptions to certain applications.

The Airplug software distribution supports several modes -independent implementations that complement each other. These modes include: the terminal mode -a standard UNIXcompatible command line implementation; the emulation mode -a network emulator that reproduces wireless communications using inter-process communication (IPC) while keeping upper layers identical to those used in experiments [START_REF] Buisset | Vehicular networks emulation[END_REF] and the live mode, an efficient implementation suitable for execution on constrained embedded systems used during real experiments. Currently, the Airplug software distribution is mainly written in C and Tcl/Tk; it can easily be extended by writing applications (in any programming language) that follow those guidelines. We used the terminal mode to develop and test the applications, the emulation mode to test our algorithms in a realistic environment and finally the live mode to perform experiments on the real testbed with vehicles.

D. Software components

The application that makes the connection between wireless sensors and RSUs is called XBE (Fig. 1). At the lower level, the XBE application enables communication and packet exchange using Digi International's proprietary format through a serial port and an Xbee module. At the higher level, the XBE application sends temperature data gathered from an Xbee sensor. The XBE application can be used in different scenarios. While its basic feature is to gather data from wireless Xbee sensors and transfer them to other applications, it can also be used to gather data and store it in a predefined log file, to read data from log files that were created in previous experiments and to read user-generated data files. Basic manipulation of gathered data is possible. For example, we can add an offset to data to simulate different environmental conditions (useful for recreating a specific type of environmente.g. winter temperatures during summer). Log files can be read at the rate that was used during recording or at a higher rate as specified by the parameters of the application. All these parameters can be used both in emulation and live modes [START_REF] Radak | Design and implementation of the vehicular network testbed using wireless sensors[END_REF].

We have developed the MET application to test and develop distributed data fusion algorithms. This application is a generic implementation of the belief function framework explained in Section III. MET is able to generate values needed to study Another feature of this application is to accept measurements coming from other applications. This functionality is used during experiments: XBE sends the gathered data and MET applies the data fusion algorithm to the received data (Fig. 1).

MET can apply any user-defined frame of discernment (Ω set) and the sigmoid functions defined for it. Independently of the data source, MET uses the sigmoid functions defined by user-supplied equations (Fig. 2), and calculates the direct confidences according to the received values and the defined frame of discernment. To ease the cautious computation, MET is applying calculations on the weights instead of mass functions, which are just a different representation of the basic belief assignment obtained through the commonalities [START_REF] Ducourthial | Self-stabilizing distributed data fusion[END_REF]. Data sets on which MET works are then vectors of discretized weights with one component for each subset of Ω, not including Ω. Each vector component has a value in (0, 1].

MET receives a measurement from XBE and then computes the local direct confidence as a mass function using the frame of discernment and the sigmoids (Fig. 2). It then converts these values to weight vectors and computes the distributed confidence merging weight vectors with those received from neighbors. It then proceeds with the calculation of the distributed confidence as explained in Section III and sends it to the neighbors.

V. Experiments and results

This section presents the experimental study of the icy road detection application designed to evaluate our method. We give a detailed explanation of both the methodology and experimental setup before presenting and commenting our results.

A. Methodology and setup

Methodology. Our aim is to show the practical interest of our method dedicated to the detection of dangerous events on the road, as well as its robustness against unreliable or misplaced sources of data. For this purpose, we have deployed our testbed (described in Section IV) to test the icy road detection application on a realistic situation. We focus on a limited number of vehicles and RSUs (as depicted in Figure 1) primarily to show how a single piece of information influences data fusion calculations. This way, we can observe how alert generation improves with new data sources. Moreover we compare the results between a regular and a misplaced sensor scenario, the latter being a variant with a temperature sensor placed indoor, in the garage of our laboratory, thus giving erroneous measurements of the road temperature.

Our experimental study relies on real-life experiments using both the hardware and the software platform described in Section IV. Additionally, these experiments have been replayed and supplemented using the Airplug network emulator. This tool replaces inter-vehicle communications by inter-process communications, keeping the programs as deployed on the Airboxes during road tests [START_REF] Buisset | Vehicular networks emulation[END_REF]. It is convenient to replay and extend real experiments while still offering accurate results. For some scenarios, we give the results both from on-the-road and in-lab emulation experiments for comparison purposes.

When using the Airplug network emulator, the GPS positions of the RSUs and the vehicles are the same as in the real experiment; they have been recorded during real tests and are replayed during emulation. There is no real sensor in the emulation; the XBE applications are then used in emulation mode: they output data coming from a log file recorded during the real tests.

Not every result can be shown here. We focus on the case of the first vehicle encountering an icy road. We show how our algorithm updates the distributed confidence about the icy road event while the vehicle is approaching. Results are displayed using the pignistic probabilities calculated using Equation 1. These probabilities can directly be used to warn the driver.

Scenarios. We divided our study into three groups of scenarios. The first group, called the single-vehicle scenarios, considers the three RSUs with their sensors and a single vehicle that is driving by the RSUs. The second group, called the twovehicle scenarios, completes the first one with a second vehicle driving behind the first one the same lane. Though this vehicle does not have more information about the icy road area, it may influence the result of the first one. Finally, the third group, called the three-vehicle scenarios completes the second one with a third vehicle moving in the opposite direction (Fig. 1). This vehicle has already encountered the icy road area and this may affect the result of the first vehicle.

Figure 4 is based on a screenshot of the Airplug emulator using OpenStreetMap tiles. It depicts the three-vehicle scenario and the testbed as deployed in the vicinity of the laboratory. The blue arrow shows the direction of the vehicles on the road, which are represented by blue circles. The RSUs are represented by black squares. The vehicles encounter RSU-L (for Library) first, then RSU-G (for Garage) and finally RSU-P (for car Park). Each element in the emulation features a small histogram showing the pignistic probabilities for the direct and the distributed confidences (see Equation 1). In our experiments, the dangerous icy road spot is located near RSU-P and shown as a red hexagon on Fig. 4.

Fig. 4: Map showing the positions of the road-side units (black squares) and of three vehicles (blue circles); their direction of movement is given by the blue arrows and the icy part of the road is marked with a red hexagon near RSU-P.

In each group of scenarios (featuring one, two and three vehicles), we considered two sub-cases differing in the placement of the wireless sensors. The first one is the regular case in which all sensors are placed close to the road and output correct temperature measurements. In the second case, one sensor, connected to RSU-G, is placed indoor in the garage and measures higher temperatures that do not reflect the road temperature. This is an example of a misplaced sensor, thus we refer to this sub-case as misplaced. Our aim is to study the behavior of our system in such a situation and to observe how it adapts to these kind of extreme cases. In total, we have six scenarios, namely 1R and 1M for the single-vehicle regular/misplaced ones, 2R and 2M for the twovehicle regular/misplaced ones, and 3R and 3M for three-vehicle regular/misplaced ones. Additionally, for clarity we add the suffix -road (as in 1R-road) when the scenario has been run on the road and -emu (as in 3M-emu) when it has been run in the network emulator.

Parameters. Our main aim in these scenarios is to demonstrate the possibility of detecting an icy road segment (the dangerous spot) before the vehicle actually reaches it. We want to show how data fusion is handling multiple sources of data, both stationary and mobile, and how, using this data, it properly assesses the state of the road. We also want to show that the alert linked to the possibility of icy roads is appropriately propagated to the vehicles even when a sensor outputs erroneous measurements. Thus, for the regular scenarios we have chosen road temperatures of 3 • C, -1 • C and -3 • C for RSUs L, G and P respectively. For the misplaced scenario, the temperature measured by the sensor of RSU-G is 21 • C -typical indoor temperature. The other sensors outputs are identical to the regular scenario.

In order to have realistic scenarios for both emulation and real experiments, vehicles are generating decreasing temperatures. The function for the temperature that the vehicle "measures" is constructed in such a way that the vehicle reports temperatures similar to those of the RSUs when it is passing near them. In the one-vehicle scenarios, the vehicle starts with a temperature of 7 • C that decreases linearly each second by 0.133 • C. For the two-vehicle scenarios, the leading vehicle starts with a temperature of 5.5 • C and the second vehicle with a temperature of 7 • C. Both measured temperatures are linearly decreasing each second by 0.133 • C. For the three-vehicle scenarios, the first two vehicles have the same measured temperature as in the two-vehicle scenarios while the third vehicle, driving in the opposite direction, starts with a temperature of -6.67 • C and linearly increases its temperature by 0.111 • C.

Timing. In the beginning of both one-vehicle scenarios, the vehicle is out of range of any RSU. The periods of communication between the vehicle and the different RSUs are: (i) the period during which the vehicle only communicates with RSU-L from t = 12 s to t = 28 s; (ii) the period during which the vehicle communicates with RSUs L and G from t = 28 s to t = 41 s; (iii) the period during which the vehicle communicates with all three RSUs from t = 41 s to t = 51 s; (iv) communication with RSUs G and P from t = 51 s to t = 70 s and; (v) communication with RSU P only from t = 70 s to t = 73 s. We consider that the vehicle enters the dangerous area (icy road) at t = 55 s.

Both two-vehicle scenarios start with vehicles communicating with each other, but both of them are out of range of any RSU. Vehicle 1 is starting closer to the RSUs, while Vehicle 2 is further away at a location similar to the starting point of the vehicle in the one-vehicle scenarios. Both vehicles are driving around the RSUs in the same direction and on the same paths as the vehicle in the one-vehicle scenarios, Vehicle 1 driving 10 seconds ahead of Vehicle 2. This means that timings given in the previous paragraph apply to Vehicle 2 in this scenario, while Vehicle 1 has exactly the same timings shifted by 10 seconds. For example, comparing this observation with the previous scenario, we can see that the leading vehicle (Vehicle 1) starts communicating with RSU-L at t = 12 -10 = 2 s, then starts communicating with RSU-G at t = 28 -10 = 18 s and with RSU-P at t = 41 -10 = 31 s.

In the three-vehicle scenarios the first two vehicles (with the numbers 1 and 2 on the Fig 4) have the same timings as in the two-vehicle scenarios. The third vehicle is moving in the opposite direction, it first starts to communicate with RSU-P at t = 12 s, then with RSU-G at t = 15 s and RSU-P t = 28 s, with all three RSUs and in the last two steps with RSU-G and RSU-L and finally only with RSU-L, before it loses connection at t = 76 s with any of them. Vehicle 3 is connected with Vehicle 1 from t = 17 s to t = 32 s and with Vehicle 2 from t = 22 s to t = 37 s. The timings given in the previous paragraphs are calculated from the emulation scenarios. In the real experiments these values were varying depending on the traffic in the part of the city where the experiments were conducted and the communication range between the vehicles.

B. Road experiments

We analyze here the on-the-road results obtained using either a single or two vehicles. This is a proof of concept for our method. Comparison with emulation results is discussed in the next section.

1R-road: single-vehicle on-the-road regular scenario. The vehicle-computed pignistic probability is drawn in Figure 5. We can see that the vehicle is getting an alert at t = 15 s, when it starts communicating with RSU-L and the value for the {slippery} state reaches the highest value of the three. We can observe that the value for the {slippery} state drops a few times. This is due to message losses during communication with the RSUs. By changing the timers values in the MET application, we may avoid such phenomena. However, the application may be less reactive. Hence we chose to keep this setting because it does not disturb the alert generation. 1M-road: single-vehicle on-the-road misplaced scenario. In this case, we show the influence of erroneous readings from one sensor and their impact on the generation of the icy road alert. We can see that the vehicle is alerted at t = 25 s, 10 seconds later than in the 1R-road case (Fig. 6). At this point, the vehicle is still only in the range of the first RSU. Hence, even if a sensor is erroneous, the vehicle still has a large-enough time to react (about 30 s before reaching the dangerous area).

2R-road: two-vehicle on-the-road regular scenario. Results are given in Figure 7. We observe that there are some fluctuations until t = 6 s, after that the vehicle is continuously alerted.

In this two-vehicle scenario, the first vehicle gets connected to RSU-L at t = 2 s. This graph should then be compared with Figure 5 at t = 12 s (see the timing description in Section V-A). Taking into account this 10 s shift, the first vehicle detects the danger approximately at the same date and the same position as in the 1R-road case 3 . This means that the second vehicle does not disturb the first vehicle while the information it announces may contradict the RSU (being located behind the first vehicle, and thus farther away from the danger area). Compared to the 2R-road case, the alert is generated approximately 14 seconds later (to be compared with the 10 s difference between the 1R-road and 1M-road cases). For comparison purposes with the 1M-road case, the timing of Vehicle 1 has to be shifted by 10 s (see the timing description in Section V-A), leading to an alert detection at t = 30 s, to be compared with the 25 s in the 1M-road case. Hence, the presence of the second vehicle adds an approximately 5 s delay in the case of the misplaced-sensor scenario.

This can be explained by the fact that the second vehicle stays under the influence of the RSU-G and its erroneous information for a long time. The first vehicle will then be influenced by the false measurement during a longer time, either directly by RSU-G or indirectly by the second vehicle, also under the influence of RSU-G.

It is worth noting that, even in this unfavorable case, our system still generates an alert in Vehicle 1 with a comfortable delay (about 25 s before reaching the danger area).

C. In-lab experiment using network emulation

For this part of our study, we rely on the Airplug network emulator which yields results that are very close to those obtained from on-the-road experiments. We begin by presenting the previously-studied two-vehicle scenarios for comparison purposes between on-the-road and in-lab experiments. We then extend our study with the three vehicles scenarios.

Validating the emulation using 2R-emu and 2M-emu. Figures 9 and 10 display the results obtained using the Airplug network emulator while replaying the regular and misplaced scenarios with two vehicles. These figures can be compared to Figures 7 and8 respectively, obtained with on-the-road experiments.

In contrast to results obtained during the on-the-road experiments, where the value for the {slippery} state dropped a few times, the emulation gives smooth curves. This is due to real communication conditions during the on-the-road tests. Nevertheless, the pignistic probabilities computed during on-theroad experiments show the same tendency as that observed in emulation. The icy part of the road is detected at approximately the same time as it is in the emulations. The differences are due to the events that occur in the real environment: vehicle speed variations, communication channel limitations (message losses and variation of transmission range), etc.

While some packet losses may generate small variations, the perturbation is generally short (a single timer). An alert generation mechanism can easily support them by adding a minimal delay after which the alert is effectively confirmed. Moreover, it is possible to avert packet losses from a neighbor that has already sent its data by reusing the previous one. But this would give a less reactive system, especially when taking the departure of a neighbor into account. That is why we chose to keep this setting.

This similarity between the on-the-road and the in-lab experiments confirm our previous results with one vehicle in [START_REF] Radak | Early detection of dangerous events on the road[END_REF]. In the following, we use network emulation to study a threevehicle scenario.

3R-emu and 3M-emu: three vehicles by emulation. In this scenario, a third vehicle that already learned about the danger is added, driving in the opposite direction lane. Results are presented in Figures 11 and12.

We can see that, in the regular scenario, the alert is generated as soon as Vehicle 1 communicates with the first RSU (RSU-L). This can be explained by the fact that, at this time, Vehicle 3 is in the icy road area and is already communicating with the RSUs, enforcing the confidence in the danger. Hence, Vehicle 1 receives a confidence in the danger that is larger than in the two-vehicle scenario (Fig. 9).

At the time when Vehicle 1 starts to communicate with Vehicle 3, we can see in Figure 11 a small drop of the value for the {slippery} state and an increase of the value for the {freezing} state. This is due to measurements that are coming from Vehicle 3 as it is driving on parts of the road that are colder than -3 • C. However, this change does not negatively impact a possible alert generation and we can actually conclude that it helps because of the additional decrease of the value for the {safe} state.

Regarding the misplaced scenario (Fig. 12), we can see that the freezing state (red curve) is detected later than in the two vehicles scenario (2M-emu case in Fig. 10). Indeed at this time (around t = 70 s) the third vehicle increases the confidence into slippery road. Compared to the regular scenario, we can see the influence of the misplaced sensor in the values of the probabilities for the slippery state (higher in Fig. 11 than in Fig. 12). However, the trend is globally the same, thus ensuring a good decision: the alert is generated in time.

VI. Conclusion

In this paper, we have presented a generic method for detecting events on the road. It relies on a robust distributed data fusion algorithm that can be instantiated with any frame of discernment. The architecture mixes stationary and mobile sources of data. The algorithm combines several sensor measurements and propagates a mass vector with confidences on every subset of the frame of discernment. The main advantage of this technique is its robustness to erroneous measurements and to the dynamics of the vehicular network.

This generic method can be instantiated for a large set of applications, by choosing adequate sensors, determining the appropriate frame of discernment and the correct mapping to build the direct confidence from the local measurements (using sigmoid-like functions). To show its usefulness in real applications and to evaluate its robustness, we instantiated an icy road detection application based on three states: freezing, slippery, safe.

We have designed a complete proof-of-concept featuring wireless sensors and solar-powered RSUs using WiFi to communicate between themselves and with vehicles. Extensive experiments have been done in various scenarios featuring a a varying number of vehicles, with and without erroneous measurements. Results show that the distributed data fusion application enables approaching vehicle to be advised earlier than with a simple alert broadcast generated when an average temperature falls under a threshold. Moreover, data fusion can generate an alert for approaching vehicles even when one of the sensors gives completely different measurements. We have to specially emphasize the good behavior of this application when it was used in scenarios with two and three vehicles and the way it adapted to inaccurate sensor readings.

Future work will include adaptation of our application to the detection of other hazards. Specifically, we are working on traffic bottleneck and heavy rain alerts as part of our involvement in the CoMoSeF project, as well as on compliance to standardized DENM messages.

Algorithm 1 :

 1 Distributed confidence calculation for the node v 1

Fig. 1 :

 1 Fig. 1: Testbed with Xbee sensors, road-side units and software support from Airplug platform

Fig. 3 :

 3 Fig. 3: Hardware elements of the detection system

Fig. 5 :

 5 Fig. 5: [1R-road] Pignistic probabilities for the distributed confidence computed in the vehicle.

Fig. 6 :

 6 Fig. 6: [1M-road] Pignistic probabilities in the vehicle.

Fig. 7 :

 7 Fig. 7: [2R-road] Pignistic probabilities in Vehicle 1.

Fig. 8 :

 8 Fig. 8: [2M-road] Pignistic probabilities in Vehicle 1.

Fig. 9 :

 9 Fig. 9: [2R-emu] Pignistic probabilities in Vehicle 1

Fig. 11 :

 11 Fig. 11: [3R-emu] Pignistic probabilities in Vehicle 1.

Fig. 12 :

 12 Fig. 12: [3M-emu] Pignistic probabilities in Vehicle 1.

http://www.digi.com/products/wireless-modems-peripherals/wirelessrange-extenders-peripherals/xbee-sensors

2 https://www.isee.biz/products/igep-processor-boards

The fluctuations before t = 6 s seem to correspond to the stabilization of the algorithm at the start of the scenario.

VII. Acknowledgments

This work was carried out and funded within the framework of the Labex MS2T. It was supported by the French Government, through the program "Investments for the future" managed by the National Agency for Research (Reference ANR-11-IDEX-0004-02). It has been partially supported by the Celtic Plus project CoMoSeF (Cooperative Mobility Services of the Future).