Gaël Pongnot
email: gael.pongnot@ens-paris-saclay.fr

Clément Mayet
email: clement.mayet@lecnam.net

Denis Labrousse
email: denis.labrousse@ens-paris-saclay.fr

Comparison of Different Braking Strategies to Improve the Energy Recovery of an Electric Vehicle based on Cascaded H-Bridge Inverter with Batteries

Keywords: electric vehicles, cascaded H-bridge inverter, battery system, simulation, control, braking energy management strategy, recovery of energy, Energetic Macroscopic Representation

This paper deals with the improvement of energy recovery in a battery electric vehicle (BEV) using a cascaded Hbridge inverter with integrated battery cells (CHB-IB). Different braking strategies are defined based on the power map of the overall traction system. These strategies are simulated on a specific driving cycle. The results are compared to select the best strategies in terms of energy consumption.

I. INTRODUCTION

Battery electric vehicles (BEV) are one of the solutions being considered to reduce greenhouse gas emissions from the transportation sector and address climate change [START_REF] Ehsani | Modern Electric, Hybrid Electric, and Fuel Cell Vehicles[END_REF], [START_REF] Chan | The State of the Art of Electric, Hybrid, and Fuel Cell Vehicles[END_REF]. Sufficient market penetration of BEV requires improvements in the range and cost of current BEV [START_REF] Paoli | Electric Vehicles[END_REF]. Increasing the energy density of batteries and improving the overall efficiency of the traction system are therefore sought. In this context, this paper follows two parallel axes of improvement: the use of an innovative battery subsystem based on a Cascaded H-Bridge inverter with Integrated Battery cells (CHB-IB) [START_REF] Quraan | Design and Control of Modular Multilevel Converters for Battery Electric Vehicles[END_REF]- [START_REF] Theliander | Battery Modeling and Parameter Extraction for Drive Cycle Loss Evaluation of a Modular Battery System for Vehicles Based on a Cascaded H-Bridge Multilevel Inverter[END_REF], and the development of an energy management strategy capable of increasing energy recovery during braking phases [START_REF] Murthy | Vehicle braking strategies based on regenerative braking boundaries of electric machines[END_REF]- [START_REF] Heydari | Optimal Brake Allocation in Electric Vehicles for Maximizing Energy Harvesting During Braking[END_REF].

An innovative topology based on a CHB-IB has recently been proposed to replace the conventional traction system of BEV. It consists of a series connection of several Hbridge converters with integrated battery cells. They supply the electric traction machine with a nearest level control. Previous papers have already described this new topology and its control [START_REF] Mayet | Energetic Macroscopic Representation and Inversion-Based Control of a Multi-Level Inverter with Integrated Battery for Electric Vehicles[END_REF]- [START_REF] Pongnot | Loss distribution in an Electric Vehicle Traction Chain using a Cascaded H-Bridge Inverter with Integrated Battery[END_REF]. The CHB-IB aims to fulfill the roles of voltage source inverter (VSI), battery management system (BMS) and charger. Significant improvements are expected compared to conventional topologies. A previous study evaluated the efficiency of the new topology [START_REF] Pongnot | Loss distribution in an Electric Vehicle Traction Chain using a Cascaded H-Bridge Inverter with Integrated Battery[END_REF]. A loss map was determined in the torque-speed plane of the electric traction machine. This paper has been achieved within IBIS project, funded by ADEME PIA.

The purpose of this paper is to study the braking management of a BEV equipped with CHB-IB technology. Therefore, the objective is to develop and evaluate several energy management strategies to improve the overall efficiency during brake energy recovery. Section II will present the generalities of the considered BEV, its model, control, and braking management. Section III will briefly present the topology of the electric drive and its energetic model. Then, section IV will focus on the development of different braking strategies. Finally, these strategies will be evaluated and compared in section V. The conclusion and perspectives will be drawn in section VI.

All models will be organized using the Energetic Macroscopic Representation (EMR) [START_REF] Bouscayrol | Graphic Formalisms for the Control of Multi-Physical Energetic Systems: COG and EMR[END_REF]. The EMR is a graphical tool to organize multi-scale and multi-physical models respecting the physical properties of the system, such as the principles of energy interaction and causality [START_REF] Bouscayrol | Graphic Formalisms for the Control of Multi-Physical Energetic Systems: COG and EMR[END_REF], [START_REF] Iwasaki | Causality and model abstraction[END_REF]. In addition, the control structure of the system under study, including the identification of degrees of freedom allowing the application of energy management strategies, can be deduced from the EMR according to specific inversion rules.

II. GENERAL MODEL OF THE BEV

The vehicle studied is a small segment BEV. It has a mass of 1.6 t including passengers. The vehicle consists of an electric drive (ED), which is connected to the mechanical transmission (MT). The ED consists of a permanent magnet synchronous machine (PMSM) powered by the CHB-IB. The MT consists of a mechanical gearbox and differential, wheels (including mechanical brakes), and the chassis of the BEV (fig. 1).

Fig. 1. Studied BEV

A. Model of the BEV

A simplified longitudinal model of the BEV is used in this subsection. The assumption of straight motion is considered, i.e., no curves are considered and, thus, the torques of the wheels (right and left) can be considered as perfectly equal. At the vehicle level, the EMR is shown in fig. 2. Three energy sources (green oval pictograms) represent the ED, the mechanical brake, and the environment, respectively. The MT is modeled and represented by several different EMR elements. All elements and sources are detailed below. The environment is a source that imposes the resistive force F res on the movement of the vehicle [START_REF] Ehsani | Modern Electric, Hybrid Electric, and Fuel Cell Vehicles[END_REF]. It depends on the rolling resistance F roll and the aerodynamic resistance F aero , depending on the longitudinal speed of the BEV v ev .

F res = F roll + F aero (v ev ) (1)
The vehicle speed v ev is calculated using the Newton's Law (2), with M ev the total mass of the vehicle and F tot the total traction/braking force applied by the vehicle on the chassis. It is represented by an accumulation element.

v ev = 1 M ev (F tot -F res ) dt (2)
The force F tot is the sum of the wheel force F wh and the mechanical brake force F bk [START_REF] Paoli | Electric Vehicles[END_REF]. A coupling element is used.

F tot = F wh + F bk (3)
An equivalent mechanical brake is represented by a source, which imposes the mechanical braking force F bk equal to its reference F bk ref , determined by the control of the BEV.

An equivalent wheel is considered according to the straight motion assumption. It is represented by a conversion element with equation (4), where r wh is the wheel radius, T wh is the torque applied on the equivalent wheel, and Ω wh its rotational speed.

F wh = T wh /r wh Ω wh = v ev /r wh (4)
The gearbox and differential are then represented by another conversion element. The model is described by [START_REF] Chang | Improving the Overall Efficiency of Automotive Inverters Using a Multilevel Converter Composed of Low Voltage Si mosfets[END_REF], with T ed the electromechanical torque and Ω ed the rotational speed of the drive, and with k g the reduction ratio and η g the efficiency.

T wh = T ed k g η sign(T ed Ω ed ) g Ω ed = k g Ω wh (5)
Finally, the ED is a reversible source of torque T ed , which is controlled via the control variable T ed ref . At the vehicle level, it is assumed that T ed = T ed ref . This source includes the PMSM and CHB-IB models, as well as the torque control. It requires the rotational speed of the drive as an input Ω ed . The objective of the ED model is to estimate the energy consumed in the cells of the battery, considering the various losses. It will be further detailed in Section III. A control is required to define the 2 tuning variables, namely the references of the force of the mechanical brake F bk ref and of the torque of the ED T ed ref . The control is explained in the next subsection.

B. Control of the BEV

A control (light blue elements) is deduced from the EMR using inversion rules. The objective is to control the velocity of the BEV by correctly determining the two available tuning variables. A tuning path is thus deduced to link the objective variable to the tuning variables. All EMR elements present on this path are inverted. Accumulation elements are indirectly inverted (closed loop control), while coupling and conversion elements are directly inverted.

The accumulation element ( 2) is inversed indirectly by a velocity controller C(s) (with s the Laplace variable). The objective is to track the velocity reference v ev ref according to the velocity measurement v ev and the rejection of the resistive force measurement F res , which is a disturbance [START_REF] Theliander | Battery Modeling and Parameter Extraction for Drive Cycle Loss Evaluation of a Modular Battery System for Vehicles Based on a Cascaded H-Bridge Multilevel Inverter[END_REF]. The output of this operation defines the total traction/braking force F tot ref to be produced by the BEV.

F tot ref = F res + C(s) (v ev ref -v ev ) (6)
Then, the coupling element (3) is inverted by [START_REF] Murthy | Vehicle braking strategies based on regenerative braking boundaries of electric machines[END_REF]. It is used to distribute the total reference traction/braking force between the wheel force F wh ref and mechanical brake force F bk ref references, especially during the braking phase. This allows the application of recovery braking energy management strategies by imposing the reference wheel force. During the braking, the brake is used to compensate the missing braking force. Of course, during the traction phase, the brake must be inhibited. The braking management strategy problem is introduced in the next subsection and will be more detailed in Section IV.

F bk ref = F tot ref -F wh ref (7)
Finally, the wheels (4) and gearbox and differential (5) are directly inversed to give the electric drive reference torque.

T wh ref = r wh ref F wh ref (8) T ed ref = T wh ref /k g (9)
C. Recovery braking energy management of the BEV Energy management must be developed to improve the recovery of braking energy and thus maximize battery recharging and reduce overall vehicle consumption, during the operating cycle. The role is therefore to define when the braking energy should be recovered by the ED or dissipated in the mechanical brake, and in what proportion. Of course, during the traction phase, the brake is inhibited, so F wh ref = F tot ref .

However, during the braking phase, different strategies can be applied [START_REF] Murthy | Vehicle braking strategies based on regenerative braking boundaries of electric machines[END_REF]. This is achieved by applying a certain recoverable braking force on the wheel F wh ref , negative sign during braking, which will induce a specific braking torque on the ED T ed ref .

The ED, being reversible, is therefore able to recover braking energy to the battery cells. However, the various constraints of the system must be respected, such as the torque and power limits of the ED and the state of charge (SoC) of the battery. The state of charge constraint will not be studied in this paper. Furthermore, the losses generated within the system during energy recovery must be considered in order not to produce unexpected additional losses, which could be higher than the recoverable energy. For this reason, and contrary to what would seem obvious, it is important to limit the possible (recoverable) braking force F lim rec according to these criteria, depending on the speed of the BEV [START_REF] Heydari | Optimal Brake Allocation in Electric Vehicles for Maximizing Energy Harvesting During Braking[END_REF].

F wh ref = max (F tot ref , F lim rec ) (10)
As an illustration, fig. 3 represents a driving cycle and the corresponding operating points in the torque-speed plane of the ED, in the case where braking is only regenerative (no activation of the mechanical brake). The objective of the braking energy management will therefore be to limit the torque, for negative power operating points (braking), to improve the consumption. The topology of the ED is presented in fig. 4. As previously mentioned, it consists of several H-bridge converters with integrated battery (CHB-IB) connected in series for each phase of the system. The CHB-IB is controlled to supply the PMSM and finally to control the torque produced by the ED T ed . The detailed model and control of the CHB-IB associated with the PMSM has already been presented in [START_REF] Mayet | Energetic Macroscopic Representation and Inversion-Based Control of a Multi-Level Inverter with Integrated Battery for Electric Vehicles[END_REF]- [START_REF] Pongnot | Loss distribution in an Electric Vehicle Traction Chain using a Cascaded H-Bridge Inverter with Integrated Battery[END_REF]. In [START_REF] Mayet | Energetic Macroscopic Representation and Inversion-Based Control of a Multi-Level Inverter with Integrated Battery for Electric Vehicles[END_REF]- [START_REF] Pongnot | Loss distribution in an Electric Vehicle Traction Chain using a Cascaded H-Bridge Inverter with Integrated Battery[END_REF], the EMR methodology was used to model, represent, and control the ED in detail. The losses were accurately modeled and took into account the internal losses of the battery, conduction and switching losses of the power electronic components, as well as the joule and iron losses of the machine.

In addition, the complete torque control of the ED was developed and presented. As can be seen in [START_REF] Pongnot | Loss distribution in an Electric Vehicle Traction Chain using a Cascaded H-Bridge Inverter with Integrated Battery[END_REF], the ED model and control relates the mechanical power of the ED (actual and reference torque and speed) to the chemical power (and thus stored chemical energy) of the battery.

This model allows for the simulation of different operating points where the actual rotation speed of the ED Ω ed , the reference torque of the ED T ed ref , and initial SoC of the battery are imposed. The results yield the actual chemical power that charges or discharges the battery cells according to the losses, control, and strategy of the ED.

B. Power map of the CHB-IB-based traction system

The detailed model has been used to derive a power map, which provides the chemical power recovered or supplied by the battery (in charge and in discharge) in a torque/speed plane (fig. 5) [START_REF] Pongnot | Loss distribution in an Electric Vehicle Traction Chain using a Cascaded H-Bridge Inverter with Integrated Battery[END_REF]. It can be observed that when the torque is negative (braking phase), the chemical power is mostly negative, which means that the battery cells are recharged, which is the normal expected behavior.

However, in some specific areas, the chemical power is positive although the BEV is braking. This means that the losses in the ED are greater than the recoverable braking energy. Therefore, the ED requires the battery to consume energy to maintain the expected operating point, i.e., the vehicle consumes battery energy to brake. These specific operating cases are absurd and should be avoided to improve overall energy consumption. Based on this map, the objective is therefore to propose an improved braking strategy that considers these specific operating points.

Chemical Power [kW]

IV. BREAKING ENERGY MANAGEMENT STRATEGIES

In this section, and based of the observation from the previous section, 4 different braking strategies are proposed and described (fig. 6). They will be compared in Section V. For reference, the first braking strategy consists in not recovering any energy. All braking energy is dissipated in the mechanical brake. Thus, the limit of the possible braking recovery force F lim rec is simply set to zero [START_REF] Mayet | Energetic Macroscopic Representation and Inversion-Based Control of a Multi-Level Inverter with Integrated Battery for Electric Vehicles[END_REF]. It corresponds to the purple line in fig. 6.

Chemical Power [kW]

F lim rec (v ev ) = 0 (11)

B. Braking Strategy 2 (BS2)

The second braking strategy is to recover all the braking energy as long as the braking power P ed max and braking torque T ed max limits of the ED are met. A torque limit T ed lim is determined in [START_REF] Pongnot | Modeling and Estimation of the Losses of a Multi-Level Inverter with Integrated Battery for Electric Vehicles[END_REF] depending on the rotation speed Ω ed and the above limits. Since the braking energy management is applied to the linear variables of the BEV (force and linear speed), the torque limit is converted from ( 4) and (5) to a force limit that depends on v ev (13). This limit is finally applied to the braking energy management [START_REF] Murthy | Vehicle braking strategies based on regenerative braking boundaries of electric machines[END_REF]. It corresponds to the blue line in fig. 6.

T ed lim (Ω ed ) = -min T ed max , P ed max Ω ed (12)
F lim rec (v ed ) = k g r wh η g T ed lim k g v ev r wh (13)

C. Braking Strategy 3 (BS3)

The third braking strategy considers the same limitations as the second strategy [START_REF] Bouscayrol | Graphic Formalisms for the Control of Multi-Physical Energetic Systems: COG and EMR[END_REF]. However, it also takes into account the chemical power map of the ED, where areas with positive chemical power during braking are completely prohibited.

A boundary line can be drawn to distinguish between positive and negative chemical power areas in the map (fig. 6). This line can be expressed as a new torque limit T ed lim (Ω ed ), as a function of the speed of the ED. This torque T ed lim (Ω ed ) is expressed in [START_REF] Bouscayrol | Graphic Formalisms for the Control of Multi-Physical Energetic Systems: COG and EMR[END_REF] as the result of a minimisation of the torque T ed with respect to the machine limits. This torque limit is also derived into a force limit using [START_REF] Pongnot | Loss distribution in an Electric Vehicle Traction Chain using a Cascaded H-Bridge Inverter with Integrated Battery[END_REF], from (4) and [START_REF] Chang | Improving the Overall Efficiency of Automotive Inverters Using a Multilevel Converter Composed of Low Voltage Si mosfets[END_REF]. It corresponds to the red line in fig. 6.

T ed lim (Ω ed ) = argmin T ed with T ed lim (Ω ed ) ≥ -min T ed max , P ed max

Ω ed P chem (Ω ed , T ed ) ≤ 0 (14)

D. Braking Strategy 4 (BS4)

The third strategy avoids consuming battery energy during braking by prohibiting certain nonsense operating points. However, when the operating points are limited by the boundary line (fig. 6), the chemical power of the battery is zero, which means that the PMSM is used in recovery mode, but no energy is actually stored in the battery due to losses.

Therefore, the fourth strategy aims to improve energy recovery by finding a maximum regenerated power line (MRPL) on the chemical power map. Indeed, in some specific operations, it is observed that reducing the braking torque of the ED results in more regenerated energy in the battery. Mechanical brakes compensate for torque difference.

The MRPL results in a new torque limitation T ed lim (Ω ed ), which also depends on the rotation speed of the ED. The torque limit is written as a minimisation of the chemical power according to the machine limits [START_REF] Iwasaki | Causality and model abstraction[END_REF]. It corresponds to the yellow line in fig. 6.

T ed lim (Ω ed ) = argmin P chem (Ω ed , T ed ) with T ed lim (Ω ed ) ≥ -min T ed max , P ed max Ω ed

V. SIMULATION RESULTS AND COMPARISONS The simulations are performed on the driving cycle presented in fig. 3 with the 4 strategies (see fig. 6). Figure 7 shows the torque as a function of time over the whole driving cycle. It can be observed that the positive torques are the same for all strategies, which is normal since the strategies only act during braking. However, during braking, some of the operating points of the ED are different. This can also be observed by plotting the operating points on the chemical power map in the speed/torque plane for all strategies (fig. 8). Depending on the different strategies, some of the regenerative braking points are limited by the different torque limiting curves from fig. 6. The first braking strategy is a worst case reference. The introduction of a naive regenerative mode with BS2 recovers 38 Wh, a 21% reduction in consumption. However, this braking strategy consumes energy from the batteries for some operating points, like at 9.65 min where fig. 9 show an increase in energy for BS2 whereas the mecanical power is still negative. This is the consequence of the positive chemical power area in fig. 5 since mechanical power is negative, located at low speed. Then, BS3 avoid this area by considering only negative chemical power for recovery mode, this gives 5% reduction in consumption compared to BS2. An optimal braking strategy is found by using BS4, by choosing the limit torque to maximise the chemical energy recovery. Nevertheless, the different between BS3 and BS4 is less than 1%. In the end, this means that 25% of the total energy consumed can be saved by using an appropriate braking energy management strategy. The other conclusion that can be drawn from these results is that 17% of the potentially recoverable energy can be lost in the system during braking if the system losses are not properly considered. Of course, these figures may vary from one driving cycle to another and for different SoC values and temperature. However, understanding the BEV losses during braking is critical to improving overall energy consumption by applying the correct braking strategy.

VI. CONCLUSION

This paper compares different braking energy management strategies of a battery electric vehicle (BEV) based on cascaded H-bridged converters with integrated batteries (CHB-IB), which supplies a permanent magnet synchronous machine. The system losses are considered to improve the braking strategy to increase the regenerated energy in the battery cells and thus reduce the overall energy consumption. The simulation results show that 25% of the traction energy can be saved by applying an appropriate braking strategy. The results also show that a good knowledge of the losses in the BEV power train during braking is essential to improve the overall energy consumption by applying the right braking strategy. Indeed, taking into account the losses in the braking strategy can improve the energy consumption by 6% over the studied BEV and driving cycle.

However, these results depend on the chosen driving cycle and on battery conditions : SoC and temperature. Further studies will need to find the sensibility of the braking strategy to these parameters. Moreover, complex braking strategies, such as BS3 and BS4, needs an accurate behaviour model of the traction chain. Other studies could think about the feasibility and the cost-benefit analysis of such strategies.

Fig. 2 .

 2 Fig. 2. EMR of the studied BEV

Fig. 3 .

 3 Fig. 3. Drive cycle and operating points in the torque-speed plane of the ED

Fig. 4 .

 4 Fig. 4. Studied ED

Fig. 5 .

 5 Fig. 5. Chemical power map of the ED

Fig. 6 .

 6 Fig. 6. Differents braking energy strategies considered

Fig. 7 .

 7 Fig. 7. Torque over time for the different strategies

Fig. 8 .

 8 Fig. 8. Operating points in the torque/speed plane

Fig. 9 .

 9 Fig. 9. Chemical energy consumption in the battery cells

Fig. 10 .

 10 Fig. 10. Energy consumption for the different strategies

  Finally, the amount of chemical energy consumed in the battery cells as a function of time is presented in fig.9. The results obtained with strategy 1 (no regenerative braking) show that 181 Wh of chemical energy are required during traction. This amount is reduced to 143 Wh with strategy 2, 136 Wh with strategy 3, and even 135 Wh with strategy 4.

	Energy [Wh]	200 50 100 150	BS1 BS2 BS3 BS4								135 Wh 136 Wh 143 Wh 181 Wh
		0 0	2		4	6	8		10		12	14
	Energy [Wh]	0 5 10				Time [min]
	Torque [N.m]	9.5 -100 0 100	9.55	9.6	9.65	9.7	9.75	9.8	9.85	9.9	9.95	10
						Time [min]


Gwénaël Toullelan
email: gwenael.toullelan@cea.fr

Raphaële Raillon
email: raphaele.raillon@cea.fr

Sylvain Chatillon
email: sylvain.chatillon@cea.fr

Vincent Dorval
email: vincent.dorval@cea.fr

Michel Darmon
email: michel.darmon@cea.fr

Sébastien Lonné
email: sebastien.lonne@extende.com

Results of the 2015 UT Modeling Benchmark Obtained with Models Implemented in CIVA

ouverte pluridisciplinaire HAL, est destinée au dépôt

Results of the 2015 UT modeling benchmark obtained

with models implemented in CIVA

INTRODUCTION

Every year the World Federation of NDE center proposes benchmark for the main NDE modalities (UT, ET, RT,…). On previous years UT benchmarks have mostly addressed pulse echo mode. This year the proposed benchmark concerns TOFD technique. TOFD is today commonly used for locating and sizing cracks from tip diffraction echoes. This technique relies on an arrangement of two probes with opposite beam directions. Experiments have been carried out on a planar block containing one vertical planar surface breaking flaw of 15mm height. L45°, L60° and L70° acquisitions of top and bottom tip diffraction echoes have been performed with various PCSs (Probe Centre Spacing), the PCS being an important parameter for the TOFD inspection performances. Experimental measurements were carried out at CEA LIST.

This communication presents the results of the 2015 UT benchmark obtained with the models implemented in CIVA [1]. In CIVA, the incident field on the defects is calculated by applying the so-called pencil-model and used, as an input for the beam/defect interaction model which may depend on the defect considered. In the present case diffraction on notch edges is modeled by using GTD (Geometrical Theory of Diffraction) [START_REF] Darmon | Simulation of disoriented flaws in a TOFD technique configuration using GTD approach[END_REF].

This work is done in the context of systematic experimental validation of the ultrasonic module of CIVA whose results are available on the EXTENDE website [2].

Up to now in CIVA the model applied was the so called "plane wave approximation" which amounts to simplify the description of the incident field inputted in the GTD calculation. A new version has been recently developed which overcomes this approximation [START_REF] Dorval | Improved semi-analytical simulation of UT inspections using a ray-based decomposition of the incident fields[END_REF]. We have in this study compared the results of these two versions of the CIVA model with the experimental results. Simulated results involving the plane wave approximation have been obtained with the current CIVA 2015 version of the software while the results overcoming this approximation are obtained with a version of CIVA under development.

DESCRIPTION OF THE 2015 ULTRASONIC BENCHMARK

For a complete description of the configurations studied, see [3]. Experimental measurements were carried out at CEA LIST. Acquisitions have been carried out using a pair of contact probes of 6.35mm diameter, working at 5MHz. Different wedges were used in order to generate longitudinal waves at 45°, 60° and 70°. The pair of probes was moved in two perpendicular directions over the top edge of the defect in the case of a backwall breaking notch, and over the bottom edge of the defect in the case of a surface breaking notch (Figure 1). During the displacement of the pair of probes, the waveforms received at each position were stored (experimental C-scans) and the maximum amplitude of the echo was also recorded for each Probe Centre Spacing (PCS). The reproducibility of the results has been checked and the confidence interval of the experimental data presented in this paper has been evaluated to +/-3dB.

Simulations were performed for the corresponding cases and measured and simulated amplitudes of the echoes were compared. The amplitude reference AREF for all the amplitudes given in dB is the maximum amplitude of the direct echo obtained in TOFD mode from a side drilled hole of 0.7mm diameter. The measured relative amplitude of the echo from a flaw is given in dB: 20 log (A / AREF) -(G -GREF), where G and GREF are the gains in dB used during the measurement carried out respectively on the current flaw and on the reference reflector.

Echoes from the side drilled holes were calculated with the SOV model [START_REF] Darmon | Modelling of scattering of ultrasounds by flaws for NDT[END_REF] the GTD model was used for the calculation of the top and bottom edge notch echoes [START_REF] Darmon | Simulation of disoriented flaws in a TOFD technique configuration using GTD approach[END_REF].

SIMULATION PROCEDURES Parameters Related to the Part

The reference block, of 30mm thickness, is made of steel and contains an artificial notch of 15mm of extension and height. The material homogeneity was experimentally checked and the specimen material was modelled as isotropic, homogeneous and the attenuation was ignored. The longitudinal (L) and transversal (T) velocities were measured using successive backwall echoes (VL = 5900m.s-1 and VT = 3230m.s-1). The density was 7.8g.cm-3.

Parameters Related to the Probes

Shape and wedge: the probes used were single element conventional probes with a center frequency of 5MHz and a diameter of 6.35mm. The probes are mounted on wedges designed to generate longitudinal waves at 45°, 60° and 70° in the specimen. The measured longitudinal and transversal velocities in wedges are respectively VL = 2730m.s-1 and VT = 1340m.s-1 and the density is 1.18g.cm-3.

Probe arrangement: three couples "transmitter-receiver" were used (L45°, L60° and L70°). For each couple, the TOFD inspection of the top or the bottom edge of the notch was performed for different PCSs, allowing various incidence angles of the L waves on the notch edge and various positions of the "L axis crossing point" (point where the L axis of the transmitter and receiver intersect) relative to that of the notch edge (Figure 2, case of the L60° top edge inspection). Calibration in pulse echo mode: the transmitter and receiver of each TOFD arrangement were used separately in a pulse echo mode to perform a calibration inspection over Ø2mm SDHs at different depths. The two experimental scanning echodynamic curves thus obtained were superimposed to check the probe resemblance in terms of sensitivity and L refraction angle. A good agreement was obtained. The refraction angle of the longitudinal waves in the specimen was estimated from this calibration: we obtained 44.5° with the wedge designed to generate L waves at 45° in the specimen, 59° with the L60° wedge and 70° with the L70° wedge. Another calibration block was used to measure the index point and the wedge height.

CIVA input signal: the probe input signal was a 5MHz synthetic signal generated by CIVA whose parameters (bandwidth and phase) were precisely adjusted so as to ensure a good matching of the experimental and simulated wave forms of a Ø2mm SDH L direct echo obtained in pulse echo mode (figure 3, case of a L60° probe).

Accounting for Artificial Notches Responses

Shape (manufacturer information): the artificial notch is rectangular of 15mm height and extension, with an aperture of 0.2mm in a U shape.

Echoes studied: during the TOFD inspection, the amplitude of the longitudinal echo coming from the top or the bottom edge echo of the 15mm notch was measured.

Model used to compute the L top edge echoes (TOFD mode): the appropriate model in CIVA to compute the diffraction echoes is based on the GTD (Geometrical Theory of Diffraction) [START_REF] Darmon | Simulation of disoriented flaws in a TOFD technique configuration using GTD approach[END_REF]. In this model, a quasi-null aperture of the defect is assumed. This null aperture assumption is particularly well-suited for the description of a real fatigue crack but does not describe exactly the aperture shape of artificial notches.

Before the beam/defect interaction computation with the GTD model, the field radiated by the probe on the notch edges was described with two different approaches:

• The current echo calculation available in the CIVA 2015 release (plane wave approximation)

• A ray-based method considering the whole description of the elastodynamics field as an input of the defect response model [START_REF] Dorval | Improved semi-analytical simulation of UT inspections using a ray-based decomposition of the incident fields[END_REF]. Accounting for the notch aperture: previous studies carried out at the CEA-LIST had shown that, in the case of artificial notches, the notch aperture is an important parameter that may affect the amplitude of the top edge echo. As such, to take this parameter into account, we have also computed the top edge echo with the module CIVA-ATHENA-2D, a hybrid module using both conventional semi-analytical methods of CIVA and the FEM (Finite Element method) code ATHENA from EDF. The connection with Finite Elements allows taking into account more complex flaw scattering phenomena that can occur during the echo formation (and not only the diffraction phenomena as the GTD does).

To illustrate the influence of the notch aperture on the longitudinal top and bottom edges echo amplitude, we have simulated in CIVA a symmetrical TOFD configuration studied by Ravenscroft [START_REF] Ravenscroft | Diffraction of Ultrasound by Cracks: comparison of Experiment with Theory[END_REF] and using circular contact probes of 10mm diameter and 5MHz center frequency. The amplitude of the top and bottom edge echoes were compared for two configurations with CIVA-ATHENA 2D:

• with a notch modeled by a rectangular defect of quasi null notch aperture • with a notch modeled by a multi-faceted defect composed by 3 facets, two vertical and one horizontal of 0.2mm length simulating the notch aperture. NB: In the two cases, the field and the flaw interaction are computed in 2D. The Ravenscroft configuration and the simulated results obtained with or without the notch aperture are presented Figure 4 in the case of the top edge echo and the bottom edge echo. They show that, at incident angles θ greater than 130°, the amplitude of the top edge echo is significantly more important in the case of the notch with the aperture of 0.2mm than in the case of that with a quasi-null aperture. This difference is attributed to an additional specular echo coming from the horizontal part of the notch top. The GTD model does not compute this specular echo. In the case of the bottom edge echo, the amplitude increase at incident angles θ lower than 60° when the aperture is taken into account. This increase is attributed to an additional creeping wave along the bottom edge.

These results show the necessity (in this case where this is not a real crack) of taking into account the aperture of the artificial notches in the simulation of longitudinal top and bottom edge echo amplitude depends on the L waves at some angles.

Reference for the Amplitude

The physical quantity considered for the comparisons is the echo amplitude. Previous experimental validation study concerning Side Drilled Holes reflectors of decreasing diameters from Ø3mm to Ø0.5mm (SDHs) inspected in TOFD mode had showed the reliability of CIVA predictions for L direct echoes of all SDHs [START_REF] Raillon | Validation of CIVA ultrasonic simulation in canonical configurations[END_REF]. So, the amplitude reference for all the results of the current study is the longitudinal echo of a SDH Ø0.7mm (precise information regarding this reference will be given for each graph).

RESULTS ON THE TOP EDGE OF THE NOTCH

Figure 5 shows the experimental and simulated amplitudes of the top edge echo obtained for the TOFD inspection of the 15mm height back-wall breaking notch performed with the three pairs of probes L70°, L60° and L45° in the specimen against the various PCSs (or incident angles). Predictions with CIVA are presented when the plane wave approximation of CIVA 2015 is applied to the field on the notch edge before defect interaction computation (CIVA_GTD in the legend) and when the ray-based method of the development version is used for the defect interaction computation (CIVA_GTD_RAYS in the legend). The reference for the amplitude is the L direct echo of a SDH Ø0.7mm indicated at the bottom of the figure for each pairs of probes. The blue line indicates the PCS where the crossing point of the L axes is on the top edge of the notch (see figure 2). Regarding L70° and L60° results, we have a good agreement between experiment and CIVA predictions obtained with the two approaches of CIVA (lower than the measurement uncertainty of 3dB). In these configurations, except the PCS35 with the L60° probes, no effect of the notch aperture is expected if we look at the results obtained with the corresponding incident angles θ shown Figure 4.

In the L45° case, we observe discrepancies when the effect of the notch aperture is expected i.e. for PCS from 25mm to 35mm according to the results obtained in the Ravenscroft configuration (θ>130°). For the PCS 40mm and 45mm, no effect of the notch aperture is expected, and a good agreement is obtained between experiment and the two methods of field description on the notch of CIVA. But for the large PCSs where no effect of the notch aperture is expected, discrepancies between experiment and simulation are obtained when the plane wave approximation is used. Those discrepancies are reduced when the ray based method is used. These results show the limitation of the plane wave approximation when the top edge goes away from the crossing point of the L axes of the probes.

RESULTS ON THE BOTTOM EDGE OF THE NOTCH

Figure 6 shows the experimental and simulated amplitudes of the bottom edge echo obtained for the inspection of the surface breaking notch performed with the three pairs of probes L70°, L60° and L45° in the specimen and for various PCSs. The incident angle θ is also displayed in the abscissa. The blue line indicates the PCS where the crossing point of the L axes is on the bottom edge of the notch. As for the top edge results, CIVA predictions are evaluated with the two approaches (plane wave approximation and ray-based method). A good agreement is obtained for the L70° probes for PCSs higher than 48mm. For the other PCSs a discrepancy higher than 3dB appears, due to the effect of the notch aperture, not taken into account with CIVA_GTD and CIVA_GTD_RAYS when θ<60° (figure 3). For the L60° probes, a good agreement is also obtained considering the experimental uncertainty of 3dB. With the L45° probes, the effect of the notch is expected for PCSs<48mm (θ<60°). For the other PCSs, a very good agreement is obtained with the Ray-based method while with the plane wave approximation, discrepancies are obtained. These results show the necessity to have a precise description of the field before the interaction computation for a configuration when the notch edge is out of the focal region.

CONCLUSION

The WFNDEC UT benchmark addressed TOFD case studies. More specifically, comparisons between simulation and experiments concerned diffraction echoes from top and bottom edges of artificial notches inspected in L mode. Simulations have been performed with the GTD model of CIVA. They were done with two different approaches to describe the field radiated by the probe on the notch edges before the defect interaction computation. The first approach is the plane wave approximation available in the CIVA 2015 release. The second approach is a method we called "ray-based method", allowing a better description of the beam on the notch edge before the defect interaction computation. This approach is currently available only on a development version of CIVA.

It has been shown that for some values of the incident angle on the top or bottom edge of the notch, the notch aperture (0.2mm) is an important parameter which cannot be neglected. Consequently in that cases we observe discrepancy between the GTD models, appropriate for diffraction echo computation in the case of realistic cracks of quasi null aperture, and experiment.

When notch aperture has no effect (representative of the case of real cracks) the comparisons between experimental and GTD predictions show a global good agreement. In the cases where the beam has to be precisely described (cases when the notch edge position is far from the focal region), the new ray-based method improve results compared to the plane-wave approximation. This ray-based method is planned to be made available in CIVA 2016 release.

FIGURE 1 .

 1 FIGURE 1. Description of the TOFD configurations.(a) top edge echoes (b) bottom edge echoes

FIGURE 2 .

 2 FIGURE 2. CIVA schematics of TOFD configurations with different PCSs, showing the variation of the L waves incident angle on the top edge of the notch (θ) and of the L axis crossing point position relative to that of the top edge with the PCS

FIGURE 3 .

 3 FIGURE 3. Superposition of measured and simulated L direct echoes of a SDH Ø2mm obtained in pulse echo mode with the L60° probe

FIGURE 4 .

 4 FIGURE 4. Ravenscroft configuration modeled with CIVA and simulated results. (a) top edge echoes (b) bottom edge echoes

FIGURE 5 .

 5 FIGURE 5. L70°, L60° and L45° TOFD inspection, top edge echoes. Compared experimental and simulated amplitudes of the L top edge echo versus the PCS and the incident angle θ

FIGURE 6 .

 6 FIGURE 6. L70°, L60° and L45° TOFD inspection, bottom edge echoes. Compared experimental and simulated amplitudes of the L bottom edge echo versus the PCS


domain: sdv shs

text:
Vincent Savolainen
email: v.savolainen@imperial.ac.uk

Nathan W Bailey

Lisa Diamond

Ashlyn Swift-Gallant

Sergey Gavrilets

Michel Raymond

Karin J H Verweij

A broader cultural view is necessary to study the evolution of sexual orientation

The causation of sexual orientation is likely to be complex and influenced by multiple factors1. We advocate incorporating a broader cultural view into evolutionary and genetic studies to account for differences in how sexual orientation is experienced, expressed, and understood in both human and non-human animals.

The data currently available to scientists studying sexual orientation are astounding in their breadth, complexity, and specificity. For example, in humans, sequenced genomes and surveys are available from hundreds of thousands of individuals, as well as decades of observations from brain scans, eye tracking, recordings of genital arousal, and daily digital diaries. If there were a single, simple explanation for differences in sexual orientation, it would likely have been discovered by now. The fact that it has not suggests that core assumptions about what causes variation in sexual orientation (e.g., occurrence, function, representation, genetic underpinning, stability, and gender) need to be revisited. Sexual orientation is likely to be shaped by a complex interplay of various factors. In this context, we will concentrate on the causes that contribute to variations in phenotype. Additionally, an area of research that remains relatively unexplored pertains to the reasons behind and consequences of aversion to same-sex sexuality, both at the individual and societal levels. Here we discuss these historic assumptions, the research that has overcome them, and possible directions for the future.

Assumption 1: Homosexual behaviour is rare

While, historically, homosexual behaviour has been described as rare or deviant2, homosexual expression is widespread in many animals and relatively common in some, demanding mechanistic and evolutionary explanations3,4. Homosexual behaviour has also been described as a 'Darwinian paradox', because, intuitively, a genetically influenced focus on non-reproductive sex to the detriment of reproductive sex should eventually lead to extinction. Breakthroughs have been made that illustrate the diversity of causation across the animal kingdom. For example, in insects, same-sex sexual behaviour may stem from indiscriminate sex recognition. In fruit flies, male courtship behaviour is controlled by one simple pathway5, and a glial amino-acid transporter genderblind controls whether Drosophila melanogaster males will attempt to mate with other males6. In others such as termites, however, same-sex sexual behaviour is observed as a result of flexible same-sex pairing with accurate sex discrimination7. In mice, the gut microbiome affects socio-sexual behaviour (including same-sex) and can be manipulated using antibiotics8.

Assumption 2: Homosexual behaviour is not adaptive

In non-human primates, exclusive homosexuality has not been described, but bisexuality occurs in some species. The latter can be adaptive, fostering alliances in rhesus macaques 9, or neutral with no concomitant decrease in reproduction. Female Japanese macaques who behave bisexually routinely choose same-sex partners even when motivated, oppositesex mates are available10. Bisexuality is also expressed in humans11, though in men, exclusive homosexuality is more common and decreases reproduction 1 . However, more research is needed to characterise same-sex sociosexual behaviour in animals. For example, it is still unknown how rhesus macaques, our closest relative routinely used in biomedical research, vary in sexual orientation over time (i.e., plasticity), to dissect both genetic and environmental influences on its expression.

Assumption 3: WEIRD societies are representative

In humans, most research on sexual orientation has been conducted in WEIRD ('Western', educated, industrialised, rich, and democratic) societies; little is known in other cultures, and data that are available provide conflicting results. A survey of cultures in the Human Relations Area Files, an internationally recognised resource for cultural anthropology curated at Yale University, found data on male homosexuality only in 52 of 135 cultures and almost no data on female homosexuality. In these data, homosexuality was either unknown or ignored in 8%, acceptable or well-accepted in 44%, and condemned in 48% of cultures12. One study found that variation in social stratification may play a role, with a positive relationship observed between the level of social stratification and the probability of observing homosexual orientation in a given society13. Social stratification might relate to operational sex ratios (e.g. via polyandry or polygyny, or even wealth), which in turn might affect tolerance to homosexuality. Social stratification refers to the hierarchical arrangement of individuals within a society based on factors like income, education, and social status. Operational sex ratios, on the other hand, refers to the ratio of sexually active men to women in a population. For instance, if an operational sex ratio became male-biased one might predict greater tolerance of male homosexuality, and vice-versa. Similar arguments have been proposed in birds such as Laysan albatross, in which operational sex ratio variation is associated with the expression of same-sex behaviour14. What are the causal factors driving differences in aversion/acceptance of homo/bisexuality across cultures worldwide? Developing more realistic models (e.g., multi-loci, societies with some degree of social inequality, and including variation of the extent to which different social norms are followed) combined with genomic analyses from distinct populations could eventually provide some clues to this question.

Assumption 4: There is a gene for sexual orientation

Although this assumption has a long and sometimes difficult history, the evidence is unequivocal that is has received no empirical support. Twin studies have shown that sexual orientation in humans is heritable, with heritability estimates of ~30%. In 2019, Ganna et al.1 published a well-powered genome-wide association study investigating the genetic causes of homosexual behaviour in 470,000 men and women. In line with other complex traits, its genetic architecture is highly complex, influenced by many variants with small individual effect sizes. These only partially overlapped between males and females. The genetic correlation between males and females is 0.63, lower than that observed in most other complex behavioural traits such as educational attainment and risk-taking behaviour15. Further, the genes differentiating between exclusively heterosexual individuals and those who have engaged in any kind of same-sex behaviour are not the same as the genes which differentiate between individuals engaging in bisexual versus exclusively same-sex behaviour. Such findings, alongside anthropological and sociological evidence for culture-, and context-dependent expressions of same-sex desire and behaviour, indicate that linear measures such as the Kinsey scale may not adequately capture the full range of phenotypes related to sexual orientation. Future studies should investigate the multivalent nature of sexual orientation by assessing levels of attraction/identity/behaviour separately for male versus female partners.

Assumption 5: Evolutionary maintenance of sexual orientation is stable through time

A recent large-scale genetics study in humans16 tested a theory that may explain the maintenance of homosexual orientation, despite apparent selection, namely antagonistic pleiotropy17. The hypothesis proposes that genetic variants associated with homosexuality in one sex may be associated with a mating advantage in the other. Using data from individuals, genetic effects associated with homosexual behaviour were found to predict a greater number of opposite-sex partners in exclusive heterosexuals16, although with the advent of contraception, the fitness relationship between number of sex partners and number of children is disappearing, reversing the genetic correlation with same-sex sexual behaviour18. Finally, substantial evidence points to the important role of epigenetic factors in homosexuality19,20. One idea is based on epigenetic marks laid down in response to the XX vs. XY karyotype in embryonic stem cells in humans19,21. These marks boost sensitivity to testosterone in XY foetuses and lower it in XX foetuses, thereby canalising sexual development. If a subset of these canalising epigenetic marks carry over across generations, they may lead to mosaicism for sexual development in opposite-sex offspring and a homosexual phenotype19,21. Despite the availability of technology to empirically evaluate this hypothesis, as suggested by Rice et al.21,such tests have yet to be conducted. How biological versus social context, especially epigenetics, affect the nature of sexual orientation remains unclear.

Assumption 6: Sex doesn't matter

Future research testing evolutionary hypotheses for the evolution of human sexual orientation must keep in mind the robust sex differences that have been observed in the expression of (and social constraints on) sexual orientation22,23. Consequently, different explanations may be needed to account for the development and evolution of male versus female sexual orientation. Indeed, the vast majority of research on sexual orientation (particularly within a biological and evolutionary framework) has been conducted with men, and studies increasingly suggest that the phenotypes and causal pathways for same-sex sexuality in women may be strikingly different from that of men. Yet this does not mean comparing samples of women and men lacks value; rather, determining which phenotypes (and causal pathways) are sexually dimorphic versus shared should be a priority. The evidence suggests this approach will yield compelling new insights about the evolution of human sexual behaviour. For example, men are usually genitally aroused to one, preferred sex, whereas most women, including heterosexual women, show some degree of genital arousal to both sexes, often outside of conscious awareness22. Cross-species comparisons offer promising possibilities for studying the ultimate and proximate mechanisms underlying sex differences in sexual orientation.

Future studies of sexual orientation

Homosexuality is illegal in 65 countries, punishable by death in 12 (https://www.humandignitytrust.org/), most recently including Uganda. Aversion to same-sex sexuality results from a blend of genetic and environmental influences, the latter primarily cultural: a twin study showed that variation in homophobia could be explained by additive genetic (36%), shared environmental (18%) and unique environmental factors (46%)24. Applying a conservative estimate of 10%25 of the world population being gay, lesbian or bisexual, this percentage translates into 800 million individuals who may directly suffer humans' vociferous and violent aversion to this form of sexuality. Noteworthy, such aversion might even be self-defeating. Firstly, genetic variants linked to homosexuality may have beneficial pleiotropic effect for closely related opposite-sex attracted kin by increasing their number opposite-sex sexual partners16. In theory, reducing the frequency of those genes could, in turn, result in diminished fecundity. Secondly, in some populations, homosexuality may provide further advantages through kin selection. For example, in Samoan and Istmo Zapotec populations, it has been documented that same-sex attracted third gender males known as fa'afafine and muxe invest more in their nieces and nephews than heterosexual men 26,27. Thirdly, one might expect that in societies where same-sex behaviour is punished and shamed, individuals desiring such behaviour will instead pursue traditional marriage and childrearing, thereby maintaining (or increasing) their prevalence in the local population. Therefore, we advocate for incorporating the scientific study of aversion to samesex sexuality into studies of sexual orientation, so that we can promote greater tolerance of sexual diversity.

Homosexual behaviour likely involves many different factors, especially cultural. Animal models and human studies can complement each other in this quest. For example, unlike Drosophila where a simple molecular pathway for courtship and homosexual behaviour has been identified5,6, the development of sexual orientation, identity and expression of behaviour in humans is most certainly much more complex and remains largely unknown. Further research on these fundamental processes would have lasting significance for understanding heterosexual, bisexual and homosexual orientation alike.

Acknowledgments

We thank the participants of a Royal Society-Theo Murphy scientific meeting on 'Genetics and evolution of sexual orientation' (27-28 March 2023) for the lively discussion that initiated this Comment, Gerulf Rieger, Paul Vasey, the Editor and two anonymous referees for comments on the manuscript, and the Royal Society, the American Institute of Bisexuality and the Evolution Education Trust for funding. For the purpose of open access, the corresponding author has applied a 'Creative Commons Attribution' (CC BY) licence to any Author Accepted Manuscript version arising.

Competing interests

The authors declare no competing interests


Céline Bellanger

Pierre-Loïc Garoche

Matthieu Martel

Célia Picard

Towards Proved Formal Specification and Verification of STL Operators as Synchronous Observers

Signal Temporal Logic (STL) is a convenient formalism to express bounded horizon properties of autonomous critical systems. STL extends LTL to real-valued signals and associates a non-singleton bound interval to each temporal operators. In this work we provide a rigorous encoding of non-nested discrete-time STL formulas into Lustre synchronous observers.

Our encoding provides a three-valued online semantics for the observers and therefore enables both the verification of the property and the search of counter-examples. A key contribution of this work is an instrumented proof of the validity of the implementation. Each node is proved correct with respect to the original STL semantics. All the experiments are automated with the Kind2 modelchecker and the Z3 SMT solver.

Introduction

In the context of autonomous critical systems, an undesirable behaviour can lead to significant material or human damage. Thus, the specification of properties and their formal verification play a paramount role in ensuring the safety, reliability and compliance of such systems.

Dynamical systems continuously respond to environmental changes. Signal Temporal Logic (STL) has emerged as a powerful formalism for expressing temporal properties within these systems [START_REF] Maler | Monitoring Temporal Properties of Continuous Signals[END_REF]. The main particularity of STL language is the association of each temporal operator with a finite, nonsingleton time interval, during which the operator is studied. Consider the temporal ◇ (Eventually) operator, which evaluates whether a property ϕ is satisfied or not at least once. A correct formalism for ◇ in STL is ◇ [a,b] ϕ, where a and b are times such that a < b. Most of the time, STL properties are assess offline: we execute the system from start to finish, and we observe after the end of the execution if the system behaviour and its outputs are compliant to specified requirements.

However, the complexity of certain autonomous dynamical systems may require runtime verification. This involves continuous assessment of the system's compliance to its specification throughout execution. Synchronous observers can be employed for this purpose. These specialized observers react when a property is satisfied or violated, providing instantaneous information about the system's state. This approach offers advantages such as consistent real-time information transmission and the ability to halt executions immediately upon property satisfaction or violation, without waiting for completion. Notably, this enables quicker reactions to external events, crucial for critical systems. For instance, let us admit that we wish to satisfy a property ϕ at least once during a time interval [a,b]. If the property is satisfied in the interval, then there is no need to wait for time b to affirm that the property is indeed verified.

This paper introduces preliminary works on the specification and verification of STL operators, using synchronous observers. The rest of the document focuses on discrete times, and non nested temporal Our main contribution concerns the formal verification of the correctness of STL operators. To this end, we provide a three-valued online STL semantics as well as the implementation of each STL operator in the synchronous language Lustre. The soundness of the implementation is expressed as a set of lemmas and automatically proved with the Kind2 model-checker.

(X ,t) ⊧ µ ⇔ µ(t) (1) (X ,t) ⊧ ¬ϕ ⇔ ¬((X ,t) ⊧ ϕ) (2) (X ,t) ⊧ ϕ 1 ∧ ϕ 2 ⇔ (X ,t) ⊧ ϕ 1 ∧ (X ,t) ⊧ ϕ 2 (3) (X ,t) ⊧ ϕ 1 ∨ ϕ 2 ⇔ (X ,t) ⊧ ϕ 1 ∨ (X ,t) ⊧ ϕ 2 (4) (X ,t) ⊧ ϕ 1 U [a,b] ϕ 2 ⇔ ∃t ′ ∈ t + [a,b] ∶ (X ,t ′ ) ⊧ ϕ 2 ∧ ∀t ′′ ∈ [t,t ′ ] ∶ (X ,t ′′ ) ⊧ ϕ 1 (5) (X ,t) ⊧ ◇ [a,b] ϕ ⇔ ∃t ′ ∈ t + [a,b] ∶ (X ,t ′ ) ⊧ ϕ (6) (X ,t) ⊧ ◻ [a,b] ϕ ⇔ ∀t ′ ∈ t + [a,b] ∶ (X ,t ′ ) ⊧ ϕ (7)
Section 2 covers the preliminary concepts, including the Signal Temporal Logic, the synchronous language Lustre, the model checker Kind2, and an introduction to three-valued logic. We formalise an online semantics for STL operators in Section 3, and detail its Lustre implementation in Section 4. Finally, Section 5 describes the formal correction of the operators implementation.

Preliminaries

Signal Temporal Logic

Let T denote a set of discrete times such that T = N and let X be a finite sets of signals. Let a,b ∈ T with a < b. Without loss of generality, we assume that all signals are defined as functions in T → R from time to real values. To simplify notations, we denote the set of time

[t + a,t + b] as t + [a,b].
Definition 1 (STL formal grammar). Let µ be an atomic predicate whose value is determined by the sign of a function of an underlying signal x ∈ X , i.e., µ(t) ≡ µ(x(t)) > 0. Let ϕ, ψ be STL formulas. STL formula ϕ is defined inductively as:

ϕ ∶∶= µ | ¬ϕ | ϕ ∧ ψ | ϕ ∨ ψ | ◻ [a,b] ψ | ◇ [a,b] ψ | ϕ U [a,b] ψ
Definition 2 (STL semantics). The semantics of a formula ϕ is defined at a time t ∈ T and for a set of signals X as (X ,t) ⊧ ϕ as described in the Figure 1.

µ is evaluated locally, at time t over the current values of the signals, Eq. (1). Equation (2) (Negation) is the logical negation of ϕ. Equation (3) (And) is the logical conjunction between ϕ 1 and ϕ 2 . Equation (4) (Or) is the logical disjunction between ϕ 1 and ϕ 2 .

It is worth mentioning that, in STL, all temporal operators have to be associated to a bounded, nonsingleton time interval. Equation (5) (Until) describes a temporal operator that is satisfied if Lustre [START_REF] Caspi | Lustre: A Declarative Language for Programming Synchronous Systems[END_REF] is a synchronous language for modeling systems of synchronous reactive components. A Lustre program L is a finite collection of nodes [N 0 ,N 1 ,...,N m ]. The nodes satisfy the grammar described in Table 1 in which td denotes type constructors, including enumerated types, and v either constants of enumerated types C or primitive constants such as integers i. Each node is declared by the grammar construct d of Table 1. A Lustre node N transforms infinite streams of input flows to streams of output flows, with possible local variables denoting internal flows. A notion of a symbolic "abstract" universal clock is used to model system progress. At each time step k, a node reads the value of each input stream and instantaneously computes and returns the value of each output stream. Note that all the equations of a node are computed at each time step. Therefore an if-then-else statement is purely functional and both of its branches are evaluated while only one of the computed value is returned.

Stateful constructs. Two important Lustre operators are the unary right-shift pre (for previous) operator and the binary initialization → (for followed-by) operator. Their semantics is as follows. For the operator Pre: at first step k = 0, pre p is undefined, while for each step k > 0 it returns the value of p at k -1. For the operator →: At step k = 0, p → q returns the value of p at k = 0, while for k > 0 it returns the value of q at k step.

For example, the Lustre equation y = x 0 → pre(u); will be defined for each time step k by:

y(k) = { x 0 (0) if k = 0 u(k -1) if k > 0

Specifying and verifying assume-guarantee contracts with Kind2

The annotation language CoCoSpec [START_REF] Champion | CoCoSpec: A Mode-Aware Contract Language for Reactive Systems[END_REF] was proposed for Lustre models to lift the notion of Hoare triple [START_REF] Hoare | An Axiomatic Basis for Computer Programming[END_REF] and Assume/Guarantee statements as dataflow contracts. A contract is associated to a node and has only access to the input/output streams of that node. The body of a contract may contain a set of assume (A) and guarantee (G) statements and mode declarations. First line of the contract (line 3) defines a local variable clk as an integer, which initially takes the value 0 and is then incrementing at each time. The assume at line 4 indicates to model checker that it has to prove the Lustre node only in the cases where the condition a ≥ 0 is satisfied. If another Lustre node is using timeab, Kind-2 also checks that this node could not provide an input a which runs counter to this assumption. Finally, Kind-2 must guarantee the equality, line 5, for all the inputs respecting the previous assumption, whatever the current time is. This equality compares the time output to value of the specification clock in a valid interval [a,b]. timeab shall calculate the same output with an internal clock bounded at time b. So here, we verify that bounding the clock has no effect on the provided output.

The Kind-2 model-checker [START_REF] Champion | The Kind 2 Model Checker[END_REF] implements various SMT-based model-checking algorithms such as k-induction [START_REF] Sheeran | Checking Safety Properties Using Induction and a SAT-Solver[END_REF] or IC3/PDR [START_REF] Bradley | IC3 and beyond: Incremental, Inductive Verification[END_REF] and allows to verify contracts with respect to nodes.

Three-valued logic

We present here the interest of three-valued logic, and introduce Kleene's three-valued logic, which we use in the next section to formalise an online version of STL operators.

For most tools, when performing monitoring of STL predicates, for a given value of simulation data, the trajectory is typically finite. It is produced by a simulation engine and stored in a data file. It is then loaded by the monitoring tool and analyzed with respect to the STL specification. In this offline setting, the final outcome indicates whether or not the input signal satisfies the specification. It is a boolean output.

Temporal operators are used to evaluate properties that change over time. Most of the time in these situations, we need to wait to decide whether a temporal property is satisfied or violated. Based on this observation, how to evaluate a property before being able to conclude, i.e. before the beginning of the time interval of a STL operator? Should we suppose that the operator is True or False before being able to decide?

Let us consider a property ◻ [0,10] P, a set of signals X and an initial time t 0 , e.g., t 0 = 0. We are interested in checking (X ,t 0 ) ⊧ ◻ [0,10] P. Let us assume that we are given with a trace for X of length

A and B B F U T A F F F F U F U U T F U T (a) AND Operation A or B B F U T A F F U T U U U T T T T T (b) OR Operation A ¬A F T U U T F (c) Negation Operation A ⇒ B B F U T A F T T T U U U T T F U T (d) Logical implication
Table 2: Truth Tables showing Kleene's 3-valued strong logic operations l < 10, e.g., l = 8, where the predicate P is valid along the whole trace. What is the validity of such a predicate? On the one hand, it is always valid, but on the other hand, it has no real definition within the time [l,10]. Indeed, P could be false at time t = 9 or t = 10 and the property would be violated.

Since STL semantics requires all temporal connectors to be associated with bounded intervals, any STL predicate has a bounded horizon limit, after which it is always possible to determine the validity of a formula. We can then use this limit to evaluate temporal operators from it, considering that the values returned before may be irrelevant. But, in some case, the validity of the predicate can already be determined. In the previous example, if P is not valid at time t = 2, we already know at this time that the operator will not be satisfied at the end of the time interval. Existing works regarding online semantics for STL [START_REF] Jyotirmoy | Robust online monitoring of signal temporal logic[END_REF] try to optimize the runtime evaluation of the predicate monitoring, detecting when one can conclude, positively or negatively.

Rather than optimizing execution time based on binary logic, Łukasiewicz proposed a three-valued logic [START_REF] Lukasiewicz | Selected Works[END_REF]. This logic introduces a third truth-value, Unknown (U), describing values for which we are not yet able to conclude if the property is satisfied or violated. Later, Kleene proposes a strong logic of indeterminacy [START_REF] Cole | Introduction to Metamathematics[END_REF] similar to Łukasiewicz logic. The main difference lies in the returned value for implication. Kleene's approach states that U ⇒ U is Unknown while Łukasiewicz considers that U ⇒ U should be True. In our use of three-valued logic, we base ourselves on Kleene strong logic.

Table 2 presents the truth tables showing the logical operations AND, OR, the logical implication, as well as the negation for Kleene's strong logic.

Online semantics for STL

To evaluate STL properties online, we rely on Kleene strong three-valued logic introduced in Table 2. In this section, we first introduce a way to obtain a three-valued output as proposed by Kleene, from two-valued outputs. Then, we provide an online and three-valued semantics for STL properties. Definition 3 (Positive, negative and indeterminacy logics). Each STL temporal operator can be expressed in a three-valued form. To implement it, we define three new concepts: 1. A Positive logic T returning True when the property is satisfied, and False when it is yet undetermined or negative. 2. A Negative logic F that acts like an alarm to underline a negative result, which means that a statement returns True when we are sure that the property is not satisfied, and it returns False otherwise (undetermined property or satisfied property situations). 3. An Indeterminacy logic U highlighting situations where it is not yet possible to conclude about the satisfaction or violation of the property. Definition 4. Let ϕ, ϕ 1 and ϕ 2 be STL properties. We denote by T t ϕ (resp. U t ϕ and F t ϕ ) the evaluation of (X ,t) ⊧ ϕ according to the positive (resp. indeterminacy and negative) logic. We denote by B ϕ the evaluation of ϕ according to the offline implementation introduced in Figure 1. Note that B ϕ does not depend on time instant t.

Property 1 (Complete and pairwise distinct). At any time instant t, exactly one of the three logic returns True for a given property.

T t ϕ ∨ U t ϕ ∨ F t ϕ (completeness) (10) ¬((T t ϕ ∧ F t ϕ ) ∨ (T t ϕ ∧ U t ϕ ) ∨ (U t ϕ ∧ F t ϕ )) (disjointness) (11)
Remark 2 (Deduction of the output of the third logic). According to Property 1, we only need the output of a given property in two of these three logics to determine its output in the last one. For example, if a property ϕ returns False in positive and negative logic, it means that ϕ is still Unknown (True in the indeterminacy logic).

Remark 3 (Property determination).

There exists an instant t d from which we cannot satisfy U t≥t d ϕ . For a non-nested temporal operator evaluated on time interval [a,b], t d corresponds at the latest to t + b.

∃t d ≤ t + b ∶ ∀t ′ ≥ t d ,¬U t ′ ϕ (12)
Property 2. From a specific time instant t f , the offline and online results are similar. Thus, the outputs of the offline B ϕ and online T t f ϕ versions are equivalent. In the same way, the negation of the offline operator is equivalent to the online negative version F t f ϕ . For a non-nested temporal operator evaluated on time interval [a,b], this time instant corresponds at the latest to t + b:

τ ≥ t + b ⇒ ((B ϕ ⇐⇒ T τ ϕ ) ∧ (¬B ϕ ⇐⇒ F τ ϕ )) (13)
Property 3 (Immutability: Positive and negative logics are final). If a property is satisfied in the positive (resp. negative) logic, it will remain so in the future.

∃t ∈ T ∶ T t ϕ ⇒ ∀t ′ ≥ t,T t ′ ϕ ( 14
) ∃t ∈ T ∶ F t ϕ ⇒ ∀t ′ ≥ t,F t ′ ϕ ( 15
)
From these three logics, we obtain easily a three-valued output. The property is: 1. True in threevalued logic if it is True in positive logic; 2. False in three-valued logic if it is True in negative logic; 3. Unknown in three-valued logic if it is True in indeterminacy logic.

Let us now characterize for each construct, the sufficient and necessary conditions to determine a positive, a negative, or a temporary indeterminate value.

In the case of a non-temporal property, the property validity can always be determined as either satisfied or violated. Let µ be an atomic proposition, ie. non temporal, and t ∈ T:

∀X ,∀t, (X ,t) ⊧ µ ⇐⇒ T t µ (X ,t) ⊧ ¬µ ⇐⇒ F t µ U µ = (16)
If the property is a combination of multiple predicates based on logical operators (∧,∨, ⇒ ,¬ϕ,...), the validity is obtained using Kleene's three-valued strong logic presented in Table 2.

In the case of STL temporal operators as described in Figure 1, we define a three-valued semantics describing when each operator is True, False or Unknown. For positive and negative logics, we also provide an explicit version obtained by enumerating all the terms in the time horizon t + a and t + b. The unknown explicit version for a property P can be obtained by combining the positive and negative explicit versions :

U τ P (explicit) ⇐⇒ (¬T τ P (explicit)) ∧ (¬F τ P (explicit)) (17)
Let us describe the positive, negative and indeterminate versions of each STL operator: Eventually ◇ [a,b] ϕ (Fig. 3) In the positive logic, Eq. ( 18), we need to wait for time t +a, the beginning of the time interval, to have a chance to conclude positively if a valid condition has been observed. From time t + b, if the condition was not yet valid, the positive eventually operator always returns False. For the negative logic, Eq. ( 19), invalidity requires to wait until the end of the time interval, otherwise one cannot conclude. Finally, the validity is unknown if we have not yet reached the end of the time interval but have not yet observed a suitable time, Eq. ( 20).

T τ P τ ≥ t + a ∧ ∃t ′ ∈ [t + a,min(τ,t + b)] ∶ (X ,t ′ ) ⊧ ϕ (18)
F τ P τ ≥ t + b ∧ ∀t ′ ∈ [t + a,t + b],(X ,t ′ ) ⊧ ¬ϕ (19)
U τ P (τ < t + a) ∨ (τ < t + b ∧ ∀t ′ ∈ [t + a,τ],(X ,t ′ ) ⊧ ¬ϕ) (20)
T τ P (explicit) ((X ,t + a) ⊧ ϕ) ∨ ((X ,t + a + 1) ⊧ ϕ) ∨ ... ∨ ((X ,t + b -1) ⊧ ϕ) ∨ ((X ,t + b) ⊧ ϕ) (21) F τ P (explicit) ((X ,t + a) ⊧ ¬ϕ) ∧ ((X ,t + a + 1) ⊧ ¬ϕ) ∧ ...∧ ((X ,t + b -1) ⊧ ¬ϕ) ∧ ((X ,t + b) ⊧ ∧¬ϕ) (22)
T τ P τ ≥ t + b ∧ ∀t ′ ∈ [t + a,t + b],(X ,t ′ ) ⊧ ϕ (23)
F τ P τ ≥ t + a ∧ ∃t ′ ∈ [t + a,min(τ,t + b)] ∶ (X ,t ′ ) ⊧ ¬ϕ (24)
U τ P (τ < t + a) ∨ (τ < t + b ∧ ∀t ′ ∈ [t + a,τ],(X ,t ′ ) ⊧ ϕ) (25)
T τ P (explicit) ((X ,t + a) ⊧ ϕ) ∧ ((X ,t + a + 1) ⊧ ϕ) ∧ ... ∧ ((X ,t + b -1) ⊧ ϕ) ∧ ((X ,t + b) ⊧ ϕ) (26) F τ P (explicit) ((X ,t + a) ⊧ ¬ϕ) ∨ ((X ,t + a + 1) ⊧ ¬ϕ) ∨ ...∨ ((X ,t + b -1) ⊧ ¬ϕ) ∨ ((X ,t + b) ⊧ ¬ϕ) (27)
The explicit positive version Equation ( 21) is obtained by considering each instant between t + a and t + b. One of these instants is supposed to satisfy the property. We use the disjunction between all the terms to check it. At the opposite, explicit negative version Equation ( 22) returns True if all the terms between t + a and t + b satisfy ¬ϕ. We therefore rely on the conjunction between all the terms.

Always ◻ [a,b] ϕ (Fig. 4) In the positive logic, Eq. ( 23), similarly to the negative case of the eventually operator, one needs to wait until the end of the interval to claim validity. For the negative logic. Eq. ( 24), we detect invalidity as soon as we observe an invalid time, within the proper time interval. Unknown cases are either before the time interval or within it, if the property ϕ is valid, up to now, Eq. (25).

The Always explicit positive version Equation (26) returns True if each instant between t + a and t + b satisfies ϕ. Similarly to the explicit negative version of Eventually, we use the conjunction to verify this point. For the explicit negative version to return True, it suffices that at one instant between t + a and t + b, the property ϕ is not satisfied. Thus, we check the disjunction of all the terms, searching if one of them violates ϕ.

T τ P (τ ≥ t + a) ∧ ( ∃t 1 ∈ [t + a,min(τ,t + b)] ∶ (X ,t 1 ) ⊧ ϕ 2 ∧ ∀t 2 ∈ [t,t 1 ],(X ,t 2 ) ⊧ ϕ 1 ) (28) F τ P (∃t 6 ∈ [t,min(τ,t + a)] ∶ (X ,t 6 ) ⊧ ¬ϕ 1 ) ∨ (τ ≥ t + a ∧ τ < t + b ∧ ∃t 7 ∈ [t + a,τ] ∶ (X ,t 7 ) ⊧ ¬ϕ 1 ∧ ¬(∃t 8 ∈ [t + a,τ] ∶ (X ,t 8 ) ⊧ ϕ 2 ∧ ∀t 9 ∈ [t,t 8 ],(X ,t 9 ) ⊧ ϕ 1 )) ∨ (τ ≥ t + b ∧ ¬(∃t 10 ∈ [t + a,t + b] ∶ (X ,t 10 ) ⊧ ϕ 2 ∧ ∀t 11 ∈ [t,t 10 ],(X ,t 11 ) ⊧ ϕ 1 )) (29)
U τ P (τ < t + a ∧ ∀t 3 ∈ [t,τ],(X ,t 3 ) ⊧ ϕ 1 ) ∨ (τ ≥ t + a ∧ τ < t + b ∧ ∀t 4 ∈ [t,τ],(X ,t 4 ) ⊧ ϕ 1 ∧ ∀t 5 ∈ [t + a,τ],(X ,t 5 ) ⊧ ¬ϕ 2 )
(30) Until ϕ 1 U [a,b] ϕ 2 (Fig. 5) Until operator is the most complex. We conclude positively when an event ϕ 2 occurred within the proper time interval, and until this moment ϕ 1 was always satisfied, Eq. (28). For the negative logic, there are multiple conditions that can lead to a violation of the property. First before the time interval, if ϕ 1 is not satisfied. Then inside the time interval, if (X ,τ) ⊧ ¬ϕ 1 before the moment when (X ,τ) ⊧ ϕ 2 , or if it was false before. Finally from t + b, if ϕ 2 is never reached inside the time interval or if it was false before, Eq. ( 29). About indeterminacy, we cannot yet conclude on the validity of the formula, if, for the moment the formula is neither validated nor violated. A first condition is that ϕ 1 holds from time t until now. A second is that, at the current time τ, we have not reach yet t + a or we always have ¬ϕ 2 . These condition only apply before reaching the end of the time interval t + b, Eq. (30).

T τ P (explicit) (( a ⋀ n=0 (X ,n) ⊧ ϕ 1 ) ∧ ((X ,t + a) ⊧ ϕ 2 )) ∨ (( a+1 ⋀ n=0 (X ,n) ⊧ ϕ 1 ) ∧ ((X ,t + a + 1) ⊧ ϕ 2 )) ∨ ...∨ (( b-1 ⋀ n=0 (X ,n) ⊧ ϕ 1 ) ∧ ((X ,t + b -1) ⊧ ϕ 2 )) ∨ (( b ⋀ n=0 (X ,n) ⊧ ϕ 1 ) ∧ ((X ,t + b) ⊧ ϕ 2 )) (31)
F τ P (explicit) ( a ⋁ n=0 (X ,n) ⊧ ¬ϕ 1 ) ∨ ( b ⋁ n 1 =a+1 ((X ,n 1 ) ⊧ ¬ϕ 1 ∧ ( n 1 ⋀ n 2 =a (X ,n 2 -1) ⊧ ¬ϕ 2 )))∨ ( b ⋀ n=a (X ,n) ⊧ ¬ϕ 2 ) (32)
As the Until operator depends at the same time to the satisfaction of a property inside the time interval, and the satisfaction of another one before and inside the time interval, the explicit versions are less trivial to obtain than for others operators. For the explicit positive version to return True, we need to satisfy the Until property at least once between t +a and t +b, so we proceed by disjunction. Each term of the disjunction is satisfied only if ϕ 1 is satisfied from time t until this time instant included (conjunction between all the terms between instant t and this time instant) and ϕ 2 is satisfied at this moment. Note that time t is represented by the 0 value in the Until temporal referential, in the same way that instants t + a or t + b correspond to time a or b inside Until. As there are several ways of violated the Until operator, explicit false version of Until is built differently as others explicit versions. Indeed, we have a disjunction between the three possibilities to not satisfy the Until operator, as described above. We verify if ϕ 1 is not satisfied before or at time t + a by relying on the disjunction between all the ϕ 1 terms from t until t + a. Then, inside the time interval after time t + a, the property is violated with certainty if there exist a moment where ϕ 1 is not True, and until the previous time, ϕ 2 was never satisfied. Indeed, if ϕ 2 was satisfied previously, either the property is satisfied, which means that explicit negative version must return False; either the property was already violated before, so there exist another anterior time where ϕ 1 was not satisfied before ϕ 2 was satisfied. Finally, explicit negative version must return True if ϕ 2 is never satisfy inside the time interval, which is studied by examining the conjunction of all the ¬ϕ 2 terms between t + a and t + b.

Operators implementation strategy

Based on this online semantics, we propose an implementation of Eventually, Always and Until in discrete time. We use the synchronous language Lustre. We recall that all the nodes are available at https://garoche.net/publication/2023_fmas_submission/.

Useful constructs for the implementation First, we define the basic nodes needed to implement the temporal operators. Node min returns the minimum value between two variables. Node exist(time :bool; prop: bool) returns True as soon as a property prop has been satisfied during the time interval represented by time. Node forall_a(time: bool ; prop: bool) returns True if a property prop has always been True during the time interval. All these nodes can easily be implemented in Lustre.

Regarding the implementation of the nodes detecting whether or not we are in the time slot t + [a,b], and since we work with finite intervals, we can optimize our clock, preventing it from incrementing to infinity. We can limit the counter until value b, ensuring the absence of overflow. We implement the node timeab, that returns True if the current time instant is inside the time interval, based on this bounded internal counter. As counter stops at b, end of the time interval is intercepted looking at the counter previous value. If it was already b, we know that we exceeded the end of the time interval.

We are now able to implement our nodes for each version of each operator. In the case of the Positive and Negative versions, we want to stay as close as possible to the definition proposed in the Section 3. We take two liberties in order to optimise the memory management. First, for each operator, we define a bounded internal clock as described above. The same strategy as for the counter is used to determine the end of the time interval, comparing the previous value of the internal node counter with b. Secondly, we want to have a bounded number of memories, not dependent on the trace-length or on the length of the time interval. We proceed as described in the literature [START_REF] Donzé | Robust Satisfaction of Temporal Logic over Real-Valued Signals[END_REF], by reusing the outputs obtained at the previous time instant to obtain the outputs at the current one. For example, here is the implementation of the Until False node: Figure 6. Others Positive and Negative versions are obtained based on the same principle. Last, we deduce the Unknown version from the Positive and Negative versions, as described in the Property 1. Remark 4. The case where both Positive and Negative versions of the operator are True at the same time is never supposed to happen and would result in an error. Indeed, it would mean that the property is both satisfied and violated, which is impossible. This result comes directly from Property 1.

Note that these implementations can only represent non-nested STL operators. That is to say that we only consider ◇ [a,b] ϕ, ◻ [a,b] ϕ and ϕ 1 U [a,b] ϕ 2 with ϕ, ϕ 1 and ϕ 2 being non-temporal predicates.

Formal verification of STL operators

In this section, we demonstrate by model checking that the operators implementation described in Section 4 corresponds to the given specification, as presented in Section 3. We first introduce the formalizing of each STL operator proof node for positive, negative and three-valued versions. Then, we present the use of Kind2 to concretely verify these proof nodes.

Induction on time interval size

To demonstrate the correctness of the positive and negative versions of the operators, we compare the outputs of our implementation proposition for each operator and an explicit equivalent, as provided in Equations ( 21), ( 22), ( 26), ( 27), ( 31) and (32). We remind that the explicit version is obtained by enumerating all the terms in the time horizon t + [a,b]. This allows to check directly the value of each term of the operator, and hence, to be sure to understand the obtained output. We have to show that our implementation and the explicit one are equivalent for any time interval. We prove this property by strong structural induction on the time interval size.

We proceed as follows. In a first time, we demonstrate that a statement is true for the smallest possible STL time interval, cf. base case of Eq. ( 33). Then, we demonstrate that if the statement is true for a given time interval size, it is also true when we increase the size interval by 1, cf. Eq. (35). By verifying these two properties, we demonstrate the correctness of our operators for all intervals [a,b] such that a,b ∈ T ∧ a < b.

Base case: [a,a + 1] Let Op be a version of a temporal operator, and Op exp its explicit representation as described in Section 3.

∀a ∈ T,Op [a,a+1] ϕ ⇐⇒ Op exp [a,a+1] ϕ (33)
For the base case proof, we create a new Lustre node P_at_k, cf. Fig. 7 that checks if a property is satisfied at a specific time or was satisfied before. This allows us to implement the explicit case. Let us take the example of the Positive version of the Eventually. For the [a,a + 1] time interval, its explicit version is Eq. ( 34) and its implementation corresponds to the lines 13 and 14 of the Figure 8 ◇

[a,a+1] ϕ ≡ ((X ,a) ⊧ ϕ) ∨ ((X ,a + 1) ⊧ ϕ) (34)
Inductive case: [a,b + 1] Let Op be a version of a temporal operator and Op exp its explicit representation as described in Section 3.

(Op [a,b] ϕ ⇐⇒ Op exp [a,b] ϕ) ⇒ (Op [a,b+1] ϕ ⇐⇒ Op exp [a,b+1] ϕ) (35)
In our implementation, Op exp [a,b+1] is obtained thanks to the previous value of Op [a,b] , that we assume equivalent to Op exp [a,b] . For example, inductive case of the explicit version of Eventually

Using Kind2 as a theorem prover

Each of the three temporal operators is defined in a separate file. They all rely on basic nodes mentioned in Sect. 4, in which only timeab is fitted with a contract. The following tables summarize all contract elements automatically proved by Kind2 model-checker. We recall that Kind2 relies on different model-checking algorithms that are executed in parallel. The method that succeeds first interrupt the proof process. In the table, PDR stands for Property-Direct-Reachability [START_REF] Bradley | IC3 and beyond: Incremental, Inductive Verification[END_REF] while k-induction specifies the number of steps of the k-induction process used to conclude. In both methods, Kind2 produces subproblems that are solved using Z3 [START_REF] Mendonc ¸a De Moura | Z3: An Efficient SMT Solver[END_REF].

As mentioned above, each operator op is defined using two underlying nodes op_false and op_true as well as a node op_3v that reconstruct the three-valued output. The nodes op_false and op_true are not directly associated to a contract but their soundness is expressed through the validity of another node: respectively proof_op_false and proof_op_true. These nodes are defining the base and inductive cases and associated to the main contract (cf. Fig. 8). Last, the final node op_3v is only fitted with an extra contract guarantying disjunctiveness of the output (cf. Fig. 9 encoding Eq. ( 11)).

Experiments were run with kind2 v2.0.0-7-gdcc7f6f on a 1,2 GHz Quad-Core Intel Core i7 with 16 GB of RAM. To build the table, each node is analyzed independently, but a quicker analysis of each file can be performed with all nodes analyzed at once. Note also results with the same execution time such as the elements of the node eventually_3v. Typically, in this case, they denote properties that were proved together k-inductive by the algorithm. We observe something similar with PDR for node proof_ev_false.

As a last remark, we have to say that, because of the parallel architecture of Kind2, it is difficult to obtain perfect reproductibility of the results. For example, one can observe that the runtime of the validity proof of the simple node timeab_tmp varies slightly between experiments while it is the exact same node. The difference can also appear in the number of unrolling of the k-induction engine.

Discussions and conclusion

Related Works. The use of three-valued logic has already been explored in the context of temporal logic, particularly in LTL, with the same division used in this paper: one value indicating the certainty of satisfaction of a property, another indicating the certainty of violation of a property, and a final value representing indeterminacy [START_REF] Bauer | Monitoring of Real-Time Properties[END_REF][START_REF] Hsi | Online Monitoring of Metric Temporal Logic[END_REF]. Formal verification of STL properties has also been studied. Roehm et al. [START_REF] Roehm | STL Model Checking of Continuous and Hybrid Systems[END_REF] propose to check STL properties on reach sequences, using hybrid model checking algorithms such as Cora [START_REF] Althoff | An Introduction to CORA 2015[END_REF] or SpaceEx [START_REF] Frehse | SpaceEx: Scalable Verification of Hybrid Systems[END_REF]. A first step consists in the transformation of STL properties into their reachset temporal logic (RTL) equivalent. This transformation comes close to the explicit development of each operator that we described in Section 3, requiring potentially a large set of memories.

Moreover, several examples of algorithms and online implementation of STL properties have been produced, using a finite number of memories, cf [START_REF] Maler | Monitoring properties of analog and mixed-signal circuits[END_REF][START_REF] Donzé | Robust Satisfaction of Temporal Logic over Real-Valued Signals[END_REF]. Thus, [START_REF] Donzé | Robust Satisfaction of Temporal Logic over Real-Valued Signals[END_REF] proposes an algorithm for quantitative online STL implementation, and show on different examples the time-saving benefits of using their online method compared to the offline one. Balsini et al. [START_REF] Balsini | Generation of simulink monitors for control applications from formal requirements[END_REF] propose a qualitative online implementation of STL in Simulink, which nevertheless has some limitations. In particular, since three-valued logic is not used in this implementation, we cannot be sure whether a property has been satisfied or violated until the end of execution. These proposals go further than ours, allowing operators to be nested, sometime with some limitations like [START_REF] Balsini | Generation of simulink monitors for control applications from formal requirements[END_REF] that can only contain one operator inside another. However the soundness of the encoding is not formally proven.

Conclusion.

In this paper, we propose an online discrete implementation of the STL semantics, in the continuity of Balsini's work [START_REF] Balsini | Generation of simulink monitors for control applications from formal requirements[END_REF]. Our contribution is twofold. First, we proposed an implementation based on Kleene's three-valued logic in order to be able to represent indeterminacy. Second, we formally demonstrated the soundness of our implementation, proving the validity of each operator with respect to its semantics.

Our approach was the following: we first defined the online STL semantics, and used it to build each STL operator as a synchronous observer in the Lustre language. Finally, we formally demonstrated the correctness of their implementation, using the Kind2 model-checker. We proceed by induction on the size of temporal intervals. We succeed to demonstrate all the proof objectives for each temporal operator implemented.

Future Work. They are mainly two directions to continue this work. A first one is to apply these operators to models and see how model-checkers such as Kind2 can verify properties or produce counterexamples. For example revisiting the use case of Roehm et al. [START_REF] Roehm | STL Model Checking of Continuous and Hybrid Systems[END_REF]. The other direction is to extend the set of STL formulas that can be encoded in our framework. While Balsini et al. [START_REF] Balsini | Generation of simulink monitors for control applications from formal requirements[END_REF] proposed a similar encoding (but without proof) of nested operators with restricted form and up to two levels, we would like to lift the restrictions and deal with more general formulas. The notion of propagation delays introduced in Kempa et al. [START_REF] Kempa | Embedding Online Runtime Verification for Fault Disambiguation on Robonaut2[END_REF] could also lead to an efficient encoding with memories, also associated with proof of the implementation.

Figure 1 :

 1 Figure 1: STL offline semantics

9 ) 1 .

 91 ϕ 1 holds from time t until ϕ 2 becomes True within the time horizon t + [a,b]. Equation (6) (Eventually) describes a temporal operator that is satisfied if ϕ is verified at least once within the time horizon t +[a,b]. Finally, Equation (7) (Always or Globally) describes a temporal operator that is satisfied if ϕ is always verified within the time horizon t + [a,b]. Note that the usual definitions of ◇ [a,b] and ◻ [a,b] based on U [a,b] still apply: ◇ [a,b] ϕ = True U [a,b] ϕ, and (8) ◻ [a,b] ϕ = ¬(◇ [a,b] ¬ϕ). (Remark While evaluation of predicates is performed at time t in (X ,t) ⊧ p ⇔ µ(t), all occurrences of time intervals [a,b] in the definitions of U [a,b] , ◻ [a,b] or ◇ [a,b] are used to delay the current time t: t + [a,b] = [t + a,t + b]. These times a and b are then relative times while t acts more as an absolute time. 2.2 Lustre td ::= type bt | type t = enum { C i ,...} bt ::= real | bool | int | enum ident d ::= node f (p) returns (p); vars p let D tel p ::= x ∶ bt;...;x ∶ bt D ::= pat = e;D | pat = e; pat ::= x | (pat,..., pat) e ::= v | x | (e,...,e) | e → e | op(e,...,e) | if e then e else e | pre e v ::= C | i

Figure 3 :

 3 Figure 3: Three-valued semantics of Eventually operator: P = ◇ [a,b] ϕ

Figure 4 :

 4 Figure 4: Three-valued semantics of Always operator: P = ◻ [a,b] ϕ

Figure 5 :

 5 Figure 5: Three-valued semantics of Until operator: P = ϕ 1 U [a,b] ϕ 2

Figure 6 :Figure 7 :

 67 Figure 6: Until Lustre node for the False version of the operator

Table 1 :

 1 A subset of Lustre syntax

int) returns (time: bool);

  Modes are named and consist of require (R) and ensure (E) statements. Assumes, guarantees, requires, and ensures node timeab (const a,b: ′ ) if it satisfies Historically(A) ⇒ G ′ , where G ′ = G ∪ {R i ⇒ E i } and Historically(A) when A is true at all time. Contracts can also define local flows, acting as ghost variables. These potentially stateful flows can then be used in guarantees and ensure statements. The following is an example of function timeab in Lustre using a local contract Figure 2. timeab is a Lustre node indicating whether the current time is inside a given time interval [a,b]. It takes as inputs the integers a and b, and returns a boolean value time that is True if the current time is inside [a,b].

	( * @contract
	var clk : int = 0 -> 1 + pre clk;
	assume a >=0;
	guarantee time = (clk >= a and clk <= b);
	* )
	Figure 2: Example of a Lustre contract implementation
	are all Boolean expressions over streams. In particular, assumptions and requires are expressions over
	input streams, while guarantees and ensures are expressions over input/output streams. A synchronous
	observer corresponds to such a contract with only a guarantee statement. A node satisfies a contract
	C = (A,G

Table 3 :

 3 Experiments for operator Eventually.

	Node name	# Property	Method	Proof time
	timeab	assume	PDR	0.339s
		assume	induction	0.351s
		guarantee	PDR	2.618s
	eventually_true	-	-	-
	proof_ev_true	assume	PDR	0.653s
		assume	2-induction	0.713s
		guarantee 2-induction	26.778s
		guarantee 2-induction	29.631s
	eventually_false	-	-	-
	proof_ev_false	guarantee	PDR	37.215s
		guarantee	PDR	37.215s
	eventually_3v	assume	PDR	0.677s
		assume	2-induction	0.688s
		guarantee 2-induction	0.688s
		guarantee 2-induction	13.216s
		guarantee 2-induction	18.855s

Table 4 :

 4 Experiments for operator Until.

	Node name	# Property	Method	Proof time
	timeab	assume	PDR	0.432s
		assume	2-induction	0.454s
		guarantee	PDR	2.855s
	until_true	-	-	-
	proof_until_true	assume	PDR	0.537s
		assume	2-induction	0.595s
		guarantee 2-induction	6.347s
		guarantee 2-induction	93.526s
		guarantee 2-induction	161.614s
	until_false	-	-	-
	proof_until_false	assume	induction	0.898s
		assume	induction	0.898s
		assume	induction	0.898s
		guarantee 2-induction	606.067s
		guarantee	PDR	1605.403s
	until_3v	guarantee	PDR	34.530s
	Node name	# Property	Method	Proof time
	timeab	assume	PDR	0.400s
		assume	induction	0.425s
		guarantee	PDR	3.375s
	always_true	-	-	-
	proof_alw_true	guarantee 2-induction	76.633s
		guarantee 2-induction	96.686s
	always_false	-	-	-
	proof_alw_false	guarantee 2-induction	19.407s
		guarantee	PDR	27.540s
	always_3v	guarantee	PDR	12.854s

Table 5 :

 5 Experiments for operator Always.

Acknowledgment

The authors would like to thank the Institute for Cybersecurity in Occitania (ICO) for partially funding this work.

True operator is obtained as described in Eq. ( 36) and its implementation corresponds to lines 16 and 17 of Figure 8 ◇

To concretely check these basic and inductive cases, we use the Kind2 model checker, cf Section 2.3. For each positive and negative version of STL operators, we express the base and inductive case as two properties, ie. two lemmas inside a contract to guarantee basic and inductive case, cf. Figure 8.

Finally, to obtain a three-valued output, we need to encode the result on two booleans. We combine the positive and negative outputs -previously verified -to determine the state of the operator. According to Property 1, Unknown is obtained if Positive and Negative outputs return False at the same time. As a complementary check, we ensure inside a contract that Positive and Negative versions are mutually exclusive as mentioned in the Remark 4. Figure 9 summarizes the implementation of this final node in Lustre.