Aya Attia
email: aya.attia@laas.fr

Clément Foucher
email: clement.foucher@laas.fr

Luiz Fernando

Lavado Villa

Benchmarking formalisms for dynamic structure system Modeling and Simulation

Modeling and simulation of complex systems is key to explore systems dynamics. Many scientific approaches were developed to represent dynamic structure systems but most of these approaches are efficient for some kinds of systems and inefficient for others. Which approach can be adopted for different dynamic structure systems categories is a topic of interest for many researchers and until now has not been fully resolved. Therefore it is essential to explore the existing approaches, understand them, and identify gaps. To fulfil this goal, we identified criteria at stake for a smooth flow from model creation to its simulation for dynamic structure systems. Using these criteria, we benchmark the existing modeling formalisms focusing more on DEVS extensions, and use the results to identify approaches gaps and discuss them.

Introduction

Modeling and Simulation (M&S) is a research field aiming at bringing a scientific approach to the creation of system models and the production of simulation results. M&S offers a mathematical frame to represent systems as models and make these models evolve over time within a simulation environment. Models and simulators are powerful tools used in many scientific areas. Also, modeling is a critical concept in system design either for static systems or dynamic structure systems. This makes M&S a cornerstone of many scientific and industrial fields.

Static systems are characterized by a fixed structure in which all possible events can be treated and fully described. Dynamic structure (or variable structure) systems are systems in which there is the possibility to add, change, remove parts of the system or modify coupling relations between them during simulation. In such systems, the conformity of the model regarding the real system is far more difficult to ensure than when dealing with static structure systems. This makes modeling dynamic structure systems among the most difficult challenges in M&S, making them a specific topic of interest to researchers.

A formalism gives a frame to build models using a certain syntax and semantics as well as a set of rules allowed for their state changes during a simulation. A dynamic structure formalism needs to address the allowed ways of modifying the model structure and define a behavior to deal with these changes. The system changes should be made according to specified rules in the formalism. A great deal of research has been devoted to this goal. Many approaches developed for dynamic structure systems were reliable for some systems but inefficient for others.

In M&S theory as defined by Zeigler [START_REF] Bernard | Theory of modeling and simulation[END_REF], there are three main ways to describe models and simulators: using discrete time, using differential equations or using discrete events. From these, he proposes a mathematical descriptions for each one of these categories: Discrete Time System Specification (DTSS), Differential Equation System Specification (DESS) and Discrete Event System Specification (DEVS). These three are mathematically formal descriptions that are intended as being root of any other modeling and simulation technologies. Moreover, he proposes that DESS and DTSS can both be expressed using DEVS, which makes the later the equivalent of assembly language for simulators. DEVS is considered as the root in which all languages can be translated, but is often hidden behind more high-level languages.

DEVS offers a modular and hierarchical description of systems' dynamics using components. A system is represented as a set of connected components that can be atomic or coupled and react to external environment according to a set of rules. This approach ensures the reuse of models, thus minimizing rework and improve productivity.

Initial research work on variable structure systems based on DEVS was DSDEVS made by Barros [START_REF] Barros | Abstract simulators for the dsde formalism[END_REF]. A special component called the executive network is responsible for changing structure and giving structure data of the systems. Many enhanced approaches were proposed to tackle the issues met with initial formalisms, such as DynDEVS [START_REF] Uhrmacher | Dynamic structures in modeling and simulation: A reflective approach[END_REF], its parallel version ρDEVS [START_REF] Adelinde | Introducing variable ports and multi-couplings for cell biological modeling in DEVS[END_REF] or Cell-DEVS [START_REF] Gabriel | Advanced cell-devs modeling applications: A legacy of norbert giambiasi[END_REF]. These efforts aimed mainly at supporting system dynamics at all its levels and help system adaption with internal or external environments automatically.

Therefore, our contribution consists of analyzing existing formalisms and creating or updating a formalism that deals with issues encountered with the existing formalisms.

In this work, we focus our attention on deterministic dynamic structure systems literature, we try to extract and analyze formalism parameters used to handle dynamic structure systems. To do so, we need to extract main criteria that ensure the dynamic reconfiguration support.

The remaining of this article is organized as follows: a presentation of the basis of DEVS formalism is done in section 2. The dynamic structure DEVS benchmarking is presented in section 3, in this section we search for blocking reasons, determine main benchmarking criteria and present the benchmarking results. The benchmarking analysis are presented in section 4. Our concluding remarks and future works are contained in section 5.

Context of DEVS formalism

In this section we introduce the concepts used along this article. We first introduce the main concepts of DEVS formalism, then we represent some modeling formalisms including DEVS extensions and approaches outside of DEVS.

DEVS

DEVS [START_REF] Zeigler | Theory of Modeling and Simulation: Discrete Event & Iterative System Computational Foundations[END_REF] is a framework for modeling and simulation of complex systems using discrete events. It offers a framework based on mathematical concepts such as sets and systems theory to describe the structure and the behavior of a system. DEVS is able to represent complex real-world systems using a description of components hierarchically related and connected to each other following rules defined into the formalism. Components can either be atomic or coupled. Atomic components present a behavior which depends on its internal state, that can evolve spontaneously with time passing, or in reaction to events on its inputs. Coupled models combines atomic and/or coupled models to represent the relationships between different system components and propagate events between them. Figure 1 gives a simple overview of atomic and coupled models and its connections. When viewed from outside, coupled components act indistinctly from atomic, allowing to use coupled components the same way as atomics. This includes using them in other coupled, allowing for a hierarchical system description.

A CDEVS (Classic DEVS) atomic model [START_REF] Zeigler | Theory of Modeling and Simulation: Discrete Event & Iterative System Computational Foundations[END_REF] is described by Equation 1: In DEVS, a model is defined by a set of inputs X and outputs Y. Each element of these sets is defined by a pair of key and value and represent a potential event v on a port p. In the DEVS formalism, components state belong to the S set and can be changed using transition functions. When an input event occurs, δ ext the external transition function is executed to change the component's state. If no external event occurs, the component will stay in its state until the period of time returned by time advance function ta(s) is reached, then it will change its state using the internal transition. When the state change, either as a result of internal or external event, the result of ta(s) will change accordingly. The component whose ta is minimal amongst all components is said to be imminent. The output function λ is executed when the state changed as a result of a component being imminent. After delivering the output, the imminent component list of the simulator is updated.

DEV S =< X, Y, S, δ ext , δ int , λ, ta > (1)
A DEVS coupled model [START_REF] Zeigler | Theory of Modeling and Simulation: Discrete Event & Iterative System Computational Foundations[END_REF] is described by Equation 2: Coupled models dictate the system composition by describing how components will interact during simulation. In a coupled model a set of the network inputs X and outputs Y are defined. The D set contains the names of the components contained into this model. A coupled model connects the components to each other thanks to connections defined into EOC, EIC, and IC sets. The select function is used for tie-breaking if there is more than one imminent component at a given time.

N =< X, Y, D, {M d | d ∈ D}, EIC, EOC, IC, Select > (2)
CDEVS does not support multiple simultaneous inputs, so it was essential to develop a parallel approach. PDEVS was developed to tackle this problem and provide more flexible alternative. PDEVS [START_REF] Chow | Parallel DEVS: a parallel, hierarchical, modular modeling formalism[END_REF] is a parallel version of DEVS that replaces the select function with another mechanism to handle parallel execution. It allows many components to evolve simulta-neously and execute concurrent events. δ con is a function added to PDEVS, this function deals with confluent situation while simulating a system.

A PDEVS atomic model is described as [START_REF] Zeigler | Theory of Modeling and Simulation: Discrete Event & Iterative System Computational Foundations[END_REF]:

DEV S =< X + M , Y + M , S, δ ext , δ int , δ con , λ, ta > (3)
Where:

δcon : Q × X + M → S is the confluent transition function
In the PDEVS formalism, X + M and Y + M represent multiple inputs and outputs of the model, the + indicates that multiple events can be present instead of a single event at a time with CDEVS. PDEVS allows to receive multiple inputs and treat them simultaneously. Inputs received when a component is imminent (i.e e = ta(s)) result in collisions. δ con is there to handle collisions, this function processes collision behavior and handles them by defining instructions that should be applied in these situations. Most of the time, δ con calls δ int and/or δ ext in a specific order, but can also be more complex. Thanks to this function, models are fully controlled in collision. A PDEVS coupled model is the same as in DEVS except for the select function which is removed [START_REF] Zeigler | Theory of Modeling and Simulation: Discrete Event & Iterative System Computational Foundations[END_REF].

DEVS Simulation

The previous formalism gives a formal representation of the system that is based on mathematical sets and functions. This representation should be simulated to show system behavior.

In the abstract simulator concept [START_REF] Chow | Parallel DEVS: a parallel, hierarchical, modular modeling formalism and its distributed simulator[END_REF], the simulation of atomic and coupled components is carried out by processors called respectively simulator and coordinator. Additionally, a root coordinator schedules the system simulation. These processors support the representation of model behavior. Figure 2a presents the general hierarchy of a simulation and Figure 2b shows a concrete example for the DEVS model described into Figure 1. The simulation begins by an order of initialization delivered by the root coordinator to its subordinates. Later, its role is to activate imminent components. The root coordinator then advances the simulation time to match the ta of the imminent(s) component(s) [START_REF] Zeigler | Theory of Modeling and Simulation: Discrete Event & Iterative System Computational Foundations[END_REF]. An activated imminent component will produce an output event just before changing its state. The coordinator is in charge of gathering output events from its inner components, and deliver them as input event to connected components. In addition, the coordinator updates a list of imminent components, the time of last event t last and computes time of next event t next . Furthermore the simulator supports other tasks: it computes variables like the time of last event t last , time of next event t next , elapsed time e and update model's state.

Modeling formalisms

In this section we give a brief description of modeling formalisms extended from DEVS and other approaches.

DEVS extensions

Many extensions for DEVS were proposed to enhance existing approaches. As an example, DEVS is limited to modeling deterministic systems. To overcome this, an extension was developed to support stochastic models is the STochastic Discrete Event System Specification (STDEVS) [START_REF] Kofman | STDEVS, a novel formalism for modeling and simulation of stochastic discrete event systems[END_REF][START_REF] Castro | A formal framework for stochastic discrete event system specification modeling and simulation[END_REF]. This approach performs stochastic space calculations to determine next states. STDEVS was powerful for many systems such as Wind farms [START_REF] Pérez | A stochastic DEVS wind turbine component model for wind farm simulation[END_REF] and load-balancing system [START_REF] Castro | A formal framework for stochastic discrete event system specification modeling and simulation[END_REF]. In this article, we will focus on dynamic structure extensions.

Despite the ability of existing static approaches to represent system execution, it is difficult to deal with dynamic structure changes of the system. This problem makes proposed formalisms inefficient for some cases. Therefore, many research works focus on creating efficient approaches for dynamic structure systems.

The first formalism proposed for modeling dynamic structure systems is Variable DEVS [START_REF] Barros | Variable DEVS-variable structure modeling formalism: an adaptive computer architecture application[END_REF]. This formalism is composed from atomic DEVS models and coupled models which contain a couple named χ = (M, C) which itself contains models (M ) and their connections (C). But in this approach, structure decision maker is not defined therefore it isn't considered efficient.

To represent and simulate systems that undergo structural changes, Barros then proposed the DSDEVS formalism [START_REF] Barros | Dynamic structure discrete event system specification: A new formalism for dynamic structure modeling and simulation[END_REF]. This formalism is composed of an atomic and network executive components (a modified atomic model that specifies structural changes). The network executive has a global overview of all possible architectures of the system, it stores all possible states of structural changes and their corresponding component sets in each structural state [START_REF] Shang | A simulation algorithm for dynamic structure DEVS modeling[END_REF]. A weakness of the DSDEVS is that it can not support multiple simultaneous events, so a parallel DSDEVS named DSDE [START_REF] Barros | Abstract simulators for the dsde formalism[END_REF] was proposed. Thanks to parallelism, the system can deal with multiple inputs and is able to provide outputs simultaneously.

DynDEVS [START_REF] Uhrmacher | Dynamic structures in modeling and simulation: A reflective approach[END_REF] and ρDEVS [START_REF] Adelinde | Introducing variable ports and multi-couplings for cell biological modeling in DEVS[END_REF] are well used in the fields of biology. DynDEVS is an extension of the DEVS formalism adding model transition functions that allow structural changes by both atomic and coupled components (as opposed to DSDEVS where structure changes are only possible at the coupled level). DynDEVS cannot support multiple simultaneous inputs therefore ρDEVS was proposed which adds dynamic ports to formalism and allows parallelism. These formalisms are used in different fields like biology [START_REF] Adelinde | Introducing variable ports and multi-couplings for cell biological modeling in DEVS[END_REF] or Agents modeling using JAMES [START_REF] Uhrmacher | The role of reflection in simulating and testing agents: An exploration based on the simulation system james[END_REF].

Cell-DEVS [START_REF] Gabriel | Advanced cell-devs modeling applications: A legacy of norbert giambiasi[END_REF] is among well used formalisms. It is an extension of Cellular Automata and DEVS that are combined together to take advantage of both. This formalism has efficient strategy to represent system dynamics, it divides systems into cells that represent the atomic models and grid that contains cells related to each other which represent coupled models.

Cell-DEVS is commonly used: among its applications are modeling of residential neighborhood, commercial neighborhood [START_REF] Wainer | Application of the Cell-DEVS Paradigm for Cell Spaces Modelling and Simulation[END_REF], evacuation and crowd modeling, bacteria [START_REF] Gabriel | A survey on the application of the cell-DEVS formalism[END_REF], surface tension [START_REF] Gabriel | Advanced cell-devs modeling applications: A legacy of norbert giambiasi[END_REF], pedestrian movement in a building or computer malware [START_REF] Gabriel | Advanced cell-devs modeling applications: A legacy of norbert giambiasi[END_REF].

Another approach, hybrid-DEVS [START_REF] Pawletta | DEVS-based modeling and simulation in scientific and technical computing environments[END_REF], suggests that discrete event system simulation cannot effectively simulate systems, so it combines discrete and continuous phenomena. The main goal of this formalism is to represent the dynamic structure in discrete event/continuous systems. This formalism was notably used in semiconductor manufacturing supply chain systems [START_REF] Huang | Flexible experimentation and analysis for hybrid DEVS and MPC models[END_REF] or elevator controller [START_REF] Saadawi | Hybrid systems modeling and verification with devs (wip)[END_REF].

Sometimes it is good to combine some existing formalisms to derive the full features. A formalism named Extended Dynamic Structure DEVS (EDEVS) [START_REF] Hagendorf | Extended dynamic structure DEVS[END_REF] was proposed on the basis of existing DEVS formalisms. In this formalism, the missing elements in DEVS found in other formalisms extended from DEVS were exploited like PDEVS, DSDEVS and CDEVS.

Formalisms outside of DEVS

DEVS is not the only tool used for Modeling and Simulation. In this work, we include some approaches outside of DEVS for comparison methodology. For example SysML [START_REF] Hause | The OMG Modelling Language (SYSML)[END_REF][START_REF] Graves | Using formal methods with SysML in aerospace design and engineering[END_REF][START_REF] Gauthier | A SysML formal framework to combine discrete and continuous simulation for testing[END_REF] was also used for many fields. SysML is a modeling language that extends UML which provides formal semantics and support various levels of complex systems development. This M&S tool was used for embedded mechatronic system domain [START_REF] Ambert | Applying a def-use approach on signal exchange to implement sysml model-based testing[END_REF], also in Intelligence, Surveillance and Reconnaissance design [START_REF] Graves | Using formal methods with SysML in aerospace design and engineering[END_REF].

Another approach named Variable Structure System Specification (VSSS) [START_REF] Ho | A methodology for variable structure system specification: Formalism, framework, and its application to atm-based network system[END_REF] was proposed to deal with variable structure systems. This approach had a similar mindset of DEVS, but it differs in how the specification of system structure is made. Two characteristic functions are defined in the compositeVSSS named f and g which represent state transition and mapping functions which map models under given state to specify system structure.

Dynamic structure formalisms benchmarking

Each of the approaches presented in previous section was efficient for some dynamic structure systems and inefficient for others. Indeed, an efficient dynamic approach should cover all possible dynamic structure system problems. As result, it is essential to understand these approaches, analyze it to find gaps and extract main criteria. In this section, we present a benchmarking of dynamic structure DEVS systems.

Benchmarking motivation

In dynamic structure systems, on one hand, it is important to understand the dynamical nature of the components and interactions. On another hand, it is essential to have knowledge about the development of the underlying network topology and the hierarchy of component dynamics. Variable structure systems are characterized by dynamic individual and collective behaviors that should be expressed using the formalism.

One problem is that the rules in the existing modeling approaches restrict the evolution of component dynamics. In some cases, the approach rules does not support some kinds of events that aren't described into the formalism. So it becomes impossible to update the influenced components and support the dynamic structure changes.

As inputs to the dynamic structure systems are varied and sometimes it is hard to identify them, connection strengths change and learning takes place [START_REF] Gorochowski | Evolving dynamical networks: A formalism for describing complex systems[END_REF] but this is not possible with almost all existing approaches because these approaches contain predefined rules and do not have the ability to deal with blocking situations except if concrete behavior is added to these approaches which is not the case currently.

In addition, one type of structure representation optimized for one field of expertise does not necessarily holds for other fields. Thus, a generalized approach is needed to handle this variety when describing systems whose structure changes over time. A generalized approach should offer a common description for many types of complex dynamic structure systems in applied science and engineering.

Furthermore, DEVS presents a well defined formalism based on mathematical rules which are strictly correct and clear. With a formalism purely based on mathematical rules, the correctness of the transformation from a mathematical model to an executable model can present a challenge. Errors can then emerge due to the programmer, to the simulator itself, or to the impossibility to exactly match the formal model to an executable model. For example in some cases, additional variables will be introduced for temporary computations. Or some specific details from the formalism will be lacked by the simulator. It can even be that the language used by the simulator will allow for shortcuts that break the formalism such as changing the model state outside of delta function in DEVS.

Problems encountered include the transformation from abstract models (mathematical/ formal models) to executable models, this transformation may not comply with rules in the abstract model. Indeed we find that variables definition in abstract model is widely different from its definition in executable model. In abstract model, variables are introduced as sets of allowed values, without a name. But in the executable model, each variable should be fully defined using a name and, depending on language, a type. For instance, in C++ programming language variables have an immutable type. In python, variables have a name, but the type can change dynamically and thus not match the definition set. This creates gaps between abstract and executable models. So, dynamic structure systems need a formalism that define the set of components or agents, the interactions that take place between them and, the main ingredients of dynamic system, capture and describe the types of changes that can occur.

Therefore, to represent dynamic structure systems, a fully detailed approach will be necessary. As a step toward this goal, a benchmarking of dynamic structure formalisms is made in the next section in order to analyze the existing approaches and extract important features that manage the dynamic behavior.

Benchmarking

To do our benchmarking, we need to identify benchmarking criteria and criteria weights used in dynamic structure systems benchmarking.

Benchmarking criteria

Several possible criteria were suggested to describe system dynamics during all phases of its development and interactions with external events. In this section, we define our main criteria for dynamic structure systems benchmarking, namely, distribution of decision-making authority, structure information, ports and port modification.

Decision-making authority takes an important part in describing system dynamics. The centralization strategy was considered in many existing approaches as an important criterion that is responsible to take decisions making authority. Some formalisms give this authority to all components and in others it is restricted to special components, this affect system interactions with external world.

Structure information is important to provide a detailed representation of system composition, interactions, dynamics. To better represent the structure changes, it is essential to provide detailed description of different elements in the system such as components information like their names, types, rules to create, update or remove components. Furthermore the description of components behavior using transition functions give an overview of different system interactions.

Port declaration is essential to specify if the approach defines ports into its formalism. This criteria help developers to allocate ports, assign inputs, understand the mechanism of system flows. Furthermore the port specification gives an overview of system development flows. Specifying different components interface facilitate the manipulation of the system with external and internal environment and help to manage it correctly.

Finally, ports modification helps to show adaption of the system with structural changes. Ports with variable property support structure updates and deals with coupling changes. The ports modification allows to change dynamically models interface which improve the dynamic adaption during system structural changes. In addition, this gives high level of compatibility in the description of abstract model in relation to the modelization of real time systems. Indeed, real time systems endure multiple changes according to their current state, received inputs at real time that can be deleted, added or updated.

These criteria are used to benchmark the existing variable structure approaches in which we attribute a value between 0 and 1 for each criterion. This value represents the conformity of the approach with the mentioned criterion as follows:

• 0 means no conformity • Values in ]0; 1[ means that the approach tackles some details of the criteria but not all • Value 1 means that the approach tackles all details of the criteria The value obtained for each criterion is then multiplied by the criterion weight.

Benchmarking weights

Each criterion used in the benchmarking should have a weight reflecting its importance according to our goals. Using this benchmarking, we specified which approach is the most suitable according to dynamic structure systems criteria. To do so, we assign a score to each benchmark criteria as mentioned below: distribution of Decision-Making authority: 3 points, structure information: 3 points, existence of ports: 4 points, ports modification: 1 point.

Indeed the existence of ports criterion has most important weight because it specifies the different flows during the simulation of the system. Then distribution of Decision-Making authority strategy and structure information criteria have also an important weight because these criteria give an idea about system's execution mechanism during all levels. The criterion of ports modification has low weight because this information is detailed in system's structure information and modeling and simulating system can be well defined without this criterion.

Benchmarking Results

After specifying the score of each criterion, we compute the score of the presented approaches. Figure 3 presents results of our benchmarking.

After computing scores, we find that Variable-DEVS, DynDEVS, ρDEVS, EDEVS, Cell-DEVS, DynDEVS and SysML are the most interesting approaches thanks to their scores which range between 5.5 and 10.25. Based on these scores, we select ρDEVS and Cell-DEVS as most helpful formalisms. They can be used as a base to create another efficient formalism for dynamic structure systems. Note that, while DynDEVS has a higher score than Cell DEVS, we didn't select it as its evolution, ρDEVS was already selected. Also EDEVS, Cell-DEVS and SysML have the same score but we select Cell-DEVS thanks to its description and its details found into the formalism, it is more used than EDEVS and we aim to draw upon DEVS.

Benchmarking analysis

In this section we analyze the benchmarking results which help us to identify Modelization problems.

Identified modelization problems

The previous section presented a benchmarking of a set of formalisms for dynamic structure systems. Although these formalisms deal with some variable structure systems, many types of inconsistency and conflict are possible. In this section, we show the main reasons that generate theoretical issues raising the need for a reconsideration of the existing dynamic structure DEVS formalisms. Issues come from formalism gaps such as the centralization strategy. Centralized systems give structure changes authority to coupled models only like with Variable DEVS [START_REF] Barros | Variable DEVS-variable structure modeling formalism: an adaptive computer architecture application[END_REF], DSDEVS [START_REF] Barros | Dynamic structure discrete event system specification: A new formalism for dynamic structure modeling and simulation[END_REF], DSDE [START_REF] Barros | Abstract simulators for the dsde formalism[END_REF] in which structure changes authority is limited only to the executive model (the executive model presents a hybrid form between atomic and coupled models and is responsible for structure changes and storing it). Centralization allows to have a single reference and avoids decision conflicts but it presents a single point of system bottleneck. To avoid centralization risks, many approaches trend to distribute this authority to multiple components. Atomic and coupled models can collaborate and make structure decisions like in DynDEVS approach [START_REF] Uhrmacher | Dynamic structures in modeling and simulation: A reflective approach[END_REF], ρDEVS [START_REF] Adelinde | Introducing variable ports and multi-couplings for cell biological modeling in DEVS[END_REF] and D-HFSS [START_REF] Barros | On the representation of dynamic topologies: The case for centralized and modular approaches[END_REF] in which atomic and coupled models have the right to change system's structure by adding, updating and deleting models. This strategy offers several benefits, including improved reliability, scalability and performance.

Among criteria that is not well defined in many approaches is the system's structure data. Indeed, it is essential to define some details about system structure like the allowed components and their relationships. System structural change rules should be detailed such as component addition, removal, replacement, and network reorganization. Initialization takes part of most important structure change details which should be considered from the beginning. One of the reasons that explain the importance of it is because of the need of initialization when restarting a simulation run after it was interrupted. The state has to be re-initialized to the last know state, from which simulation can subsequently resume as if it was never interrupted [START_REF] Van | Extending the devs formalism with initialization information[END_REF]. DynDEVS [START_REF] Uhrmacher | Dynamic structures in modeling and simulation: A reflective approach[END_REF] is considered among the most clear approaches, in this formalism initial state was defined in which we find the detailed minimal composition of the network thanks to m init set. But having a static definition of the initial state cannot be sufficient for all cases. Indeed, initial state can be changed depending on the current state of other components and at the same time a new component is added, its composition and time i.e the initialization in booting system differ from initialization after executing some parts of the system. In reality the initial state of added components at execution time differ from the component's initial state during booting the system. This problem was ignored by the existing approaches which explain the complexity of the implementation of these approaches in some cases. In addition, the initialization is highly required when the simulation is interrupted due to some system condition, the model is altered, re-initialized to a consistent state, and the simulation resumed [START_REF] Van | Extending the devs formalism with initialization information[END_REF]. Therefore, the initial state should be computed dynamically depending on current system values.

The system's structure data is not limited to initial state but there are many important details that should be detailed into the formalism. It is essential to know how the structure changes are made and the description of its different possible use cases while defining transition functions and the state set description. The DynDEVS formalism [START_REF] Uhrmacher | Dynamic structures in modeling and simulation: A reflective approach[END_REF] describes how structure changes are made: to change structure model transition function is executed but this function does not describe all changes that can be made.

Cell-DEVS [START_REF] Gabriel | Advanced cell-devs modeling applications: A legacy of norbert giambiasi[END_REF] presents clear descriptions for atomic and coupled models: atomic models are presented as cells in which each cell has its interface that defines the number of cells and describes the connections between cells and its neighbours. The same concept is used for coupled models and adds extra elements like C set which represents the cell space also the B set which contains details about borders. This information gives a global overview about the system dynamics which help to understand how system can be simulated and fix problems but these are insufficient because some other important details (initial state, ports types, components descriptions) should be specified into the formalism. The description of system's structure may lead to structural and behavioral problems: inaccuracy in the definition of states, how states are computed after each transition, how states are exactly introduced like its types, values that can be present, system's composition, relations between components. Also, the specification of domain of variables is of real significance for system dynamics guidance but it is ignored by many approaches.

Furthermore, in the definition of ports which is important to specify the type of different flows and have organized knowledge about system flows. Indeed, we found that the most of formalisms don't define ports and its types which lead to problems of inconsistency in some simulation cases. Ports definition is important to give an overview about possible flows while receiving inputs or returning outputs. Many approaches ignored ports concept like DSDEVS [START_REF] Barros | Dynamic structure discrete event system specification: A new formalism for dynamic structure modeling and simulation[END_REF], DSDE [START_REF] Barros | Abstract simulators for the dsde formalism[END_REF], VSSS [START_REF] Ho | A methodology for variable structure system specification: Formalism, framework, and its application to atm-based network system[END_REF] and other approaches, which explain the faced conflicts during some simulations. Also, in some cases we found inaccuracy in the definition of domain of variables.

In addition, it is notable that the transformation from abstract model to executable model may be inconsistent because developers face many difficulties in translating abstract model to executable code. The majority of approaches doesn't specify the variable type for inputs or outputs which lead to difference between what exist in abstraction and in execution. Also, in some cases developers are forced to add some details like internal variables, add functions and other additional parts or removing some elements like in ADEVS [START_REF] Nutaro | Adevs: A Discrete EVent System simulator[END_REF] simulator in which the I set that represents the influencers is not defined and there is an added function named route function which guide Inputs/Outputs of each component. These changes generate inconsistency between abstraction and execution. ADEVS [START_REF] Nutaro | Adevs: A Discrete EVent System simulator[END_REF] is not the only approach that take freedom during the transformation from abstract model to executable model, in CD++ [27] [START_REF]CD++ -extended states[END_REF] some functions are ignored and others are added. The same problem with PythonPDEVS simulator [34] in which ModelTransition function is used instead of the C χ component.

Issues come from formalism gaps such as the specification of structure decision making authority, poorly defined structure data, ports definition and inconsistent transformation from abstract model to executable model.

Discussion

Considering existing formalisms, we find many gaps for critical points: because it is easier to implement, centralization concept was preferred by most of formalisms like Variable DEVS [START_REF] Barros | Variable DEVS-variable structure modeling formalism: an adaptive computer architecture application[END_REF], DSDEVS [START_REF] Barros | Dynamic structure discrete event system specification: A new formalism for dynamic structure modeling and simulation[END_REF], DSDE [START_REF] Barros | Abstract simulators for the dsde formalism[END_REF] in which structure changes authority is limited only to the executive model, also in hybrid-DEVS [START_REF] Pawletta | DEVS-based modeling and simulation in scientific and technical computing environments[END_REF], EDEVS [START_REF] Hagendorf | Extended dynamic structure DEVS[END_REF]. A fewer number of approaches adopt opposite strategy by sharing this authority like DynDEVS [START_REF] Uhrmacher | Dynamic structures in modeling and simulation: A reflective approach[END_REF], its parallel version ρDEVS [START_REF] Adelinde | Introducing variable ports and multi-couplings for cell biological modeling in DEVS[END_REF] and D-HFSS [START_REF] Barros | On the representation of dynamic topologies: The case for centralized and modular approaches[END_REF]. The trend to centralization for many approaches explain blocking reasons in some situations, the only authority that guide simulator during its execution is blocked so the whole is blocked. Therefore, few number of approaches process this issue and try to find solution by sharing this authority between its components like DynDEVS [START_REF] Uhrmacher | Dynamic structures in modeling and simulation: A reflective approach[END_REF] in which atomic and coupled models share this right and are able to take structure decisions that decrease the problem of single point of failure in simulator and decrease the risk of error.

Considering system's structure data, almost all approaches give information about structure which offers an overview about system simulation. This information was presented by most of approaches like DSDEVS [START_REF] Barros | Dynamic structure discrete event system specification: A new formalism for dynamic structure modeling and simulation[END_REF], DSDE [START_REF] Barros | Abstract simulators for the dsde formalism[END_REF], hybrid-DEVS [START_REF] Pawletta | DEVS-based modeling and simulation in scientific and technical computing environments[END_REF], EDEVS [START_REF] Hagendorf | Extended dynamic structure DEVS[END_REF], DynDEVS [START_REF] Uhrmacher | Dynamic structures in modeling and simulation: A reflective approach[END_REF], Cell-DEVS [START_REF] Gabriel | Advanced cell-devs modeling applications: A legacy of norbert giambiasi[END_REF], HFSS [START_REF] Barros | On the representation of dynamic topologies: The case for centralized and modular approaches[END_REF] and ignored by a very few number of approaches like BM-DEVS [START_REF] Ho | Simulation methodology-based context-aware architecture design for behavior monitoring of systems[END_REF]. This information is very important to understand system dynamics. Given insufficient system's structure data leads to incoherence in the transformation from abstract to executable model. To effectively simulate the system additional elements are added during the flow from abstract to executable model for example in Cell-DEVS [START_REF] Gabriel | Advanced cell-devs modeling applications: A legacy of norbert giambiasi[END_REF] simulator there are some additional functions like setLocalTransition or inverseNeighborhood in simulator code. In addition, some information in the formalism are considered as extra data in simulation and are ignored. For example, in the same simulator mentioned above, the select function and the borders set do not exist in the simulator code although borders set is considered important thanks to its ability to provide an overview of influencers and influencees and which differ effectively while computing transition functions. Among identified inconsistencies the description of DSDEVS [START_REF] Barros | Dynamic structure discrete event system specification: A new formalism for dynamic structure modeling and simulation[END_REF] formalism in which some details aren't mentioned into abstract model but are found into executable model like the input and output sets description of these two kinds of models. Indeed the input and output of abstract models are described that are sets of values without specifying ports but into executable model we found the declaration of ports. Also in the same example, we found some functions into simulator that does not described into the formalism like addModel, removeModel, replace, link, unlink, find, clear and replace.

In most cases, the transformation from abstract model to executable model is done by a manual procedure. The formalism itself is transformed into executable code as simulators. The description of transition functions, output function are described into simulator but in some cases the simulators need to introduce additional variables or functions that help the simulator to achieve desired goal. This produces executable models that do not respect all rules set into the abstract model which reduces confidence in this transformation. Some other approaches try to cover this issue by suggesting translators like VSSS [START_REF] Ho | A methodology for variable structure system specification: Formalism, framework, and its application to atm-based network system[END_REF] approach in which a translator is proposed in order to ensure vertical transformation from abstract model to executable model. This transformation ensures similarity in abstract and executable model.

The definition of ports is important knowledge to have about system flows. This concept was treated by some approaches like Variable DEVS [START_REF] Barros | Variable DEVS-variable structure modeling formalism: an adaptive computer architecture application[END_REF], DynDEVS [START_REF] Uhrmacher | Dynamic structures in modeling and simulation: A reflective approach[END_REF], its parallel version ρDEVS [START_REF] Adelinde | Introducing variable ports and multi-couplings for cell biological modeling in DEVS[END_REF], EMF-DEVS [START_REF] Hessam | Emf-devs modeling[END_REF], Cell-DEVS [START_REF] Gabriel | Advanced cell-devs modeling applications: A legacy of norbert giambiasi[END_REF] and SysML [START_REF] Gauthier | A SysML formal framework to combine discrete and continuous simulation for testing[END_REF] and ignored by others like DSDEVS [START_REF] Barros | Dynamic structure discrete event system specification: A new formalism for dynamic structure modeling and simulation[END_REF], DSDE [START_REF] Barros | Abstract simulators for the dsde formalism[END_REF], VSSS [START_REF] Ho | A methodology for variable structure system specification: Formalism, framework, and its application to atm-based network system[END_REF], HFSS [START_REF] Barros | On the representation of dynamic topologies: The case for centralized and modular approaches[END_REF] and D-HFSS [START_REF] Barros | On the representation of dynamic topologies: The case for centralized and modular approaches[END_REF]. Indeed these approaches don't specify if there are ports specification or not.

Ports types is only supported by Cell-DEVS [START_REF] Gabriel | Advanced cell-devs modeling applications: A legacy of norbert giambiasi[END_REF] but the other approaches do not take attention about the type of variables received into its ports. Few number of approaches take care of the definition of ports at root like in Variable DEVS [START_REF] Barros | Variable DEVS-variable structure modeling formalism: an adaptive computer architecture application[END_REF], Cell-DEVS [START_REF] Gabriel | Advanced cell-devs modeling applications: A legacy of norbert giambiasi[END_REF] and SysML [START_REF] Gauthier | A SysML formal framework to combine discrete and continuous simulation for testing[END_REF].

Systems that change dynamically need to have dynamic equipment like ports. Indeed, it is highly required to have ports that can be changed dynamically i.e ports can be added when the system dynamics need additional ports to continue its execution, can be deleted also when the existing ports are not useful, in some other cases ports definitions need to be changed like updating ports value type. This concept was treated only by ρDEVS [START_REF] Adelinde | Introducing variable ports and multi-couplings for cell biological modeling in DEVS[END_REF] and EMF-DEVS [START_REF] Hessam | Emf-devs modeling[END_REF]. The ports modification is an additional part to DynDEVS to create ρDEVS and which make ρDEVS more useful than DynDEVS. The other approaches do not take attention to this concept, this explain the trend to apply ρDEVS for many systems according to other existing approaches. So it is useful that the approach suggest port modification i.e the approach suggest if there are ports added, removed or updated dynamically.

Using analytical results in Figure 3, we can observe that no single formalism covers the whole criteria for modeling dynamic structure systems. Although none of the existing formalisms implements all the required features, a combination of different formalisms can be operated to extract useful elements of the modeling process and create an efficient formalism. In search for a proper formalism, perhaps the most important aspect to consider is the balance between simplicity and expressiveness [START_REF] Machado | Modeling formalisms in systems biology[END_REF]. To fulfil this goal, the state set, formalism functions, all useful details of the system should be expressive and simple. This helps to create efficient modeling approach. Efficient modeling approach use a distributed strategy that avoid blocking risk, also it is important that all structure details are mentioned into the formalism. Giving all modelization details gives an overview about system dynamics and helps developers to create the executable model. We find also that it is essential to specify ports and describe its characteristics. Providing good formalism enables to have strong system description and ensures efficient simulation.

Conclusion and future work

The main objective of our research is to understand the strategy used in the existing approaches for dynamic structure systems, identify gaps and provide an adaptive formalism for dynamic structure systems. To do so we extracted the main criteria for the development of dynamic structure systems used in literature then we used these criteria to present dynamic structure system formalism benchmarking. The benchmarking was helpful to understand the strategy used by the existing approaches and analyze it.

By analyzing the benchmarking results we identified that among reasons for dynamic structure systems inefficiency is forgetting details in the description of the formalism, ports existence and its description. For future work, we intend to provide a proof of correctness in the description of each variable in the formalism by providing the maximum of important details of system description as possible. This helps to avoid this kind of problems. The consistency between these two kinds of models should be included among the formalism rules. To do so, the formalism should be fully defined up to the executable model and its execution, and strict rules should be fixed in order to ensure vertical transformation that will be a part of our future works.

Using these analysis, we are able to select efficient strategy to develop or update an efficient formalism for dynamic structure systems. The research works to have efficient formalism for dynamic structure systems will continue because so far the existing formalisms still has a lot of gaps and this type of formalisms is highly needed in real world. Furthermore our research works will try to provide tools that facilitate the M&S process and promote the adoption of formal M&S approaches by a wider community of practitioners and researchers.

Figure 1 :

 1 Figure 1: DEVS atomic and coupled models

  set of the component names, For each d ∈ D, {M d } is a DEVS model, External input coupling connects external inputs to component inputs: EIC ⊆ {((N, ip N ), (d, ip d ) | ip N ∈ IP orts N , d ∈ D, ip d ∈ IP orts d } External output coupling connects component outputs to external outputs: EOC ⊆ {((d, op d ), (N, op N ) | op N ∈ OP orts N , d ∈ D, op d ∈ OP orts d } Internal coupling connects component outputs to component inputs: IC ⊆ {((a, opa), (b, ip b ) | a, b ∈ D, opa ∈ OP ortsa, ip b ∈ IP orts b } Select : 2 D → D the tie-breaking function

Figure 2 :

 2 Figure 2: Simulation abstraction and concrete example

Figure 3 :

 3 Figure 3: Benchmarking of dynamic structure systems


Abdelwaheb Hafs
email: abdelwaheb.hafs@universite-paris-saclay.fr

Dorian Verdel
email: dorian.verdel@universite-paris-saclay.fr

Jawher Jerray
email: jawher.jerray@telecom-paris.fr

Olivier Bruneau
email: olivier.bruneau@ens-paris-saclay.fr

Nicolas Vignais
email: nicolas.vignais@universite-paris-saclay.fr

Bastien Berret
email: bastien.berret@universite-paris-saclay.fr

Laurent Fribourg
email: fribourg@lsv.fr

Convergence and robustness of the Hopf oscillator applied to an ABLE exoskeleton: reachability analysis and experimentation

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Active exoskeletons are wearable robotic devices, developed to assist human movement [START_REF] Ajoudani | Progress and prospects of the human-robot collaboration[END_REF][START_REF] Gopura | Developments in hardware systems of active upper-limb exoskeleton robots: A review[END_REF]. Their versatility makes it possible to consider numerous applications, in particular to improve rehabilitation protocols [START_REF] Frisoli | Arm rehabilitation with a robotic exoskeleleton in Virtual Reality[END_REF][START_REF] Frisoli | Positive effects of robotic exoskeleton training of upper limb reaching movements after stroke[END_REF][START_REF] Just | Human arm weight compensation in rehabilitation robotics: efficacy of three distinct methods[END_REF][START_REF] Milot | A crossover pilot study evaluating the functional outcomes of two different types of robotic movement training in chronic stroke survivors using the arm exoskeleton BONES[END_REF][START_REF] Jose | Rehabilitation exoskeletal robotics[END_REF] and to prevent musculoskeletal disorders in workers [START_REF] Bogue | Robotic exoskeletons: a review of recent progress[END_REF][START_REF] Michiel | Exoskeletons for industrial application and their potential effects on physical work load[END_REF][START_REF] Luke M Mooney | Autonomous exoskeleton reduces metabolic cost of human walking during load carriage[END_REF][START_REF] Sylla | Ergonomic contribution of ABLE exoskeleton in automotive industry[END_REF]. The implementation of exoskeletons for these different applications is nevertheless constrained by the impossibility of completely predicting human movement intention [START_REF] Ajoudani | Progress and prospects of the human-robot collaboration[END_REF][START_REF] Jarrasse | How can human motion prediction increase transparency[END_REF]. Several approaches have been proposed in the literature to solve this problem. The first approach relies on controllers based on bioelectric signals such as electromyography [START_REF] Teramae | EMG-based model predictive control for physical human-robot interaction: application for assist-as-needed control[END_REF][START_REF] Treussart | Controlling an upper-limb exoskeleton by EMG signal while carrying unknown load[END_REF] or electroencephalography [START_REF] Dindorf | Using the bioelectric signals to control of wearable orthosis of the elbow joint with bi-muscular pneumatic servo-drive[END_REF]. Other biological signals such as gaze were also included in the control strategies to detect human intention [START_REF] Nili | Intent prediction based on biomechanical coordination of EMG and vision-filtered gaze for end-point control of an arm prosthesis[END_REF]. All these strategies rely on the appearance of the signals considered before the appearance of the movement kinematics, which is called electromechanical delay in the case of myoelectrical signals. Another proposed approach was to learn the human movement [START_REF] Jarrasse | How can human motion prediction increase transparency[END_REF], which led to a significant reduction of unwanted interaction efforts in reaching movements. In the case of periodical movements, approaches based on adaptive oscillators have been proposed and successfully experimented [START_REF] Righetti | Programmable central pattern generators: an application to biped locomotion control[END_REF][START_REF] Righetti | Dynamic hebbian learning in adaptive frequency oscillators[END_REF][START_REF] Righetti | Adaptive frequency oscillators and applications[END_REF][START_REF] Ronsse | Human-robot synchrony: flexible assistance using adaptive oscillators[END_REF]. At the theoretical level, the authors of [START_REF] Righetti | Dynamic hebbian learning in adaptive frequency oscillators[END_REF] proved the stability of the model of one of these oscillators: the Hopf oscillator. The proof uses the classical "perturbation method" that consists in introducing an infinitesimal perturbation ε in the model, expressing the solution as a power series in ε, and showing the positiveness of the radius of convergence of the series. The Hopf oscillator is also considered here, but the stability is proven by introducing a bounded perturbation w (instead of an infinitesimal perturbation ε) taking its values non-deterministically in a given set W of the form [-c; c] with c > 0. In order to show the stability of the system in presence of such perturbations, we make use of a recent development of the method of "reachability analysis" (see [START_REF] Althoff | Set Propagation Techniques for Reachability Analysis[END_REF] for a survey). Given an initial set of states S 0 , this method constructs iteratively by "set-based integration" the set S 1 of the states reached at the end of one time step, then S 2 at the end of a new time step, etc. These sets S 1 ; S 2 ; ... are over-approximations of the exact sets of solutions of the system, for any initial state in S 0 and for any admissible perturbation taking its values in W . When one succeeds in generating a finite representation of the set I := ∪ ∞ i=0 S i , one obtains a description of a superset of all the states that can be reached from S 0 . The set I is an invariant set of the system: the trajectory from any point of I remains in I indefinitely (see [START_REF] Blanchini | Set invariance in control[END_REF]). We explain here how to successfully generate such a set I for the Hopf oscillator. In the present paper, this previously defined oscillator [START_REF] Ronsse | Human-robot synchrony: flexible assistance using adaptive oscillators[END_REF] is applied to an upper-limb exoskeleton to design a transparent control. Transparency is defined as the interaction between the human and the exoskeleton with minimum efforts. Our primary contributions lie in formally proving the convergence and stability of the oscillator and validating this proof through experimental results. The theoretical development allows a priori evaluation of whether the system converges to a limit cycle and is robust to non-deterministic bounded amplitude disturbances. In particular, the experiments have confirmed the invariance property of the set I : once a first experimental datum relative to the arm position lies in I , all the subsequent data also lie in I . In the present study, the transparent control mode is chosen to experimentally evaluate the stability of the oscillator, independently from model errors that can appear when using assistance control modes and that can lead to instability [START_REF] Ronsse | Human-robot synchrony: flexible assistance using adaptive oscillators[END_REF]. In this control mode, the human movement should be impacted as little as possible by the exoskeleton [START_REF] Ajoudani | Progress and prospects of the human-robot collaboration[END_REF][START_REF] Bastide | Interacting with a "transparent" upperlimb exoskeleton: a human motor control approach[END_REF][START_REF] Jarrasse | How can human motion prediction increase transparency[END_REF][START_REF] Verdel | An identification-based method improving the transparency of a robotic upper limb exoskeleton[END_REF]. The experiments are conducted on elbow flexion/extension with an upper-limb exoskeleton called ABLE [START_REF] Garrec | an Innovative Transparent Exoskeleton for the Upper-Limb[END_REF][START_REF] Sylla | Ergonomic contribution of ABLE exoskeleton in automotive industry[END_REF] (see Section 2.2 for details).

Material and methods

Adaptive oscillators

As mentioned in the introduction, human intention prediction may be achieved by adaptive oscillators for periodic movements. These oscillators allow to estimate the fundamental parameters (amplitude and frequency) of arbitrary rhythmic signals in a supervised learning framework. Among different types of adaptive oscillators, we focus here on the Hopf oscillator, which is one of the most widely used types in the field of robotics and assistive technology [27] [25] [34] [START_REF] Zhu | A backward control based on σ -Hopf oscillator with decoupled parameters for smooth locomotion of bio-inspired legged robot[END_REF].

The Hopf oscillator is defined by a system of two differential equations (Eq. ( 1)).

ẋ(t) = γ(µ -r 2 )x(t) -ω(t)y(t) + νe(t) ẏ(t) = γ(µ -r 2 )y(t) + ω(t)x(t) (1)
With r = x 2 + y 2 , where x(t) and y(t) are the orthogonal coordinates of the oscillator, e is the oscillator's external force, ν the coupling gain, µ and γ are the amplitude and attractiveness of the oscillator respectively [START_REF] Righetti | Adaptive frequency oscillators and applications[END_REF]. For this study γ = 1 (as in [START_REF] Righetti | Dynamic hebbian learning in adaptive frequency oscillators[END_REF][START_REF] Righetti | Adaptive frequency oscillators and applications[END_REF][START_REF] Ronsse | Human-robot synchrony: flexible assistance using adaptive oscillators[END_REF]), and µ = 1 (so that the intrinsic amplitude of the oscillator is equal to 1).

The input of the oscillator is the real position θ . In this case the external force of the oscillator e represents the difference between the real position θ of the human elbow and the estimated position θ .

Righetti and Ijspeert [START_REF] Righetti | Programmable central pattern generators: an application to biped locomotion control[END_REF] augmented this oscillator to learn the frequency ω, amplitude α 1 and offset 2)

           ω(t) = -νe(t) sin(φ (t)) φ (t) = ω(t) -νe sin(φ (t)) α1 (t) = ηcos(φ (t))e(t) α0 (t) = ηe(t) θ (t) = α 0 (t) + α 1 (t) cos(φ (t)) (2)
Where η is the integrator gain and φ the output phase. Finally the estimated position θ is used to compute the torque generated by the exoskeleton to assist the human movement (see Section 2.2 for details).

Exoskeleton modeling

ABLE is an upper limb exoskeleton. This exoskeleton is based on a screw and cable transmission allowing high levels of reversibility and transparency [START_REF] Garrec | an Innovative Transparent Exoskeleton for the Upper-Limb[END_REF][START_REF] Garrec | Screw and Cable Acutators (SCS) and Their Applications to Force Feedback Teleoperation, Exoskeleton and Anthropomorphic Robotics[END_REF]. It has four active degrees of freedom (see Fig. 2). The first three correspond to rotations of the human shoulder, the fourth correspond to rotation of the elbow (flexion/extension). The physical interfaces between the exoskeleton and the user include passive rotations and translation to minimize undesired efforts due to the connection hyperstatism [START_REF] Jarrasse | Connecting a Human Limb to an Exoskeleton[END_REF][START_REF] Schiele | Influence of attachment pressure and kinematic configuration on pHRI with wearable robots[END_REF]. Additional settings are available to adapt the exoskeleton to the user. The robot is mounted on a fixed frame with a winch to adapt its height.

The proposed method consists of using the joint position and velocity estimated by the oscillator instead of the measured position and velocity. As we focus on the last axis (elbow), the inverse dynamic model of the robots elbow axis is computed upon the basis of classical robot dynamics [START_REF] Verdel | An identification-based method improving the transparency of a robotic upper limb exoskeleton[END_REF][START_REF] Ngoc | Dynamic model identification for industrial robots[END_REF]. and represented in Eq. ( 3). τm = (g(-x m cos( θ )y m sin( θ ))

+ θ µ v + sign( θ )µ c ) 1 r (3)

Reachability Analysis

We focus here on sinusoidal inputs (corresponding to sinusoidal movements of the users) with bounded uncertainty.

The stability of the Hopf oscillator was proved in [START_REF] Righetti | Dynamic hebbian learning in adaptive frequency oscillators[END_REF] using the "perturbation method". The perturbation method was developed in the 19th century by Laplace and others to show, for example, the orbital stability of the moon around the Earth despite the influence of the sun. Roughly speaking, the equation of the ideal motion (without perturbation) is modified by injecting an infinitesimal value ε, and the solution of the modified equation is expressed as a power series in ε. The stability is demonstrated by showing that the radius of convergence of the series is non-zero. We prove here the stability of the Hopf oscillator using the method of "reachability analysis". Reachability analysis has been developed since a couple of decades in the community of formal methods and model checking (see [START_REF] Althoff | Set Propagation Techniques for Reachability Analysis[END_REF] for a recent review). In this method, one is given a set S 0 of initial points and a perturbation w, which is not infinitesimal as in the perturbation method, but of bounded amplitude (typically w ∈ W = [-c, c] with c > 0). Reachability analysis then constructs by "set-based integration" first the set S 1 of the states reached at the end of one time step, then S 2 at the end of a new time step, etc. These sets S 1 , S 2 , . . . are over-approximations of the exact sets of solutions of the system, for any initial state in S 0 and for any admissible perturbation taking its values non-deterministically in W . The set K k=0 S k characterises a superset of all the states on the time interval [0, Kh], where h is the time-step size. This set is often referred to as the "reachability tube".

In the case where we can detect that at a time t = Lh for some L ∈ N, the set of states S L is contained in the tube currently generated (S L ⊂ L-1 k=0 S k ), we obtain a finite representation of a superset of all the states that can be reached from S 0 . The set I = L k=0 S k is an invariant set of the system: the trajectory from any point of I remains in I indefinitely (see [START_REF] Blanchini | Set invariance in control[END_REF]).

For an oscillatory system, this invariant set is shaped like a tube rounding on itself (a "doughnut" in 3D). In [START_REF] Fribourg | Euler's method applied to the control of switched systems[END_REF], we represented the set S k as a ball B(y k , δ (k)) of centre y k and radius δ (k). The centre y k of the ball B(y k , δ (k)) is the value computed by Euler's explicit method at the k-th step. The radius δ (k) is determined by an analytical formula giving an upper bound on the error introduced by Euler's method (see [START_REF] Fribourg | Euler's method applied to the control of switched systems[END_REF]). The detection of the inclusion S L ⊆ L-1 k=0 S k , is done by finding a value K such that

B(y L , δ (L)) ⊆ B(y K , δ (K))
with L = K + ℓh for some integer ℓ. The value T = ℓh is the estimated value of the system period (see [START_REF] Jerray | Robust optimal periodic control using guaranteed Euler's method[END_REF] for details). The invariant set I = L k=0 S k is here a looping tube, centred on a set of values y 0 , y 1 , . . . , y L corresponding to the "limit cycle" C of the system.

The main advantage of the reachability analysis over the perturbation method is its ability to take into account perturbations of a given amplitude, and to construct an invariant set I in which the state of the system is guaranteed to be confined. This allows us to characterize the "robustness" of the system against bounded perturbations.

Our method of reachability analysis has been implemented in Python in a software called ORBITA-DOR. The method has been successfully applied to various systems, for example we have shown the stability of a parametric Van der Pol system in [START_REF] Jerray | Determination of limit cycles using stroboscopic set-valued maps[END_REF] and a biochemical process model in [START_REF] Jerray | Robust optimal periodic control using guaranteed Euler's method[END_REF]. We also studied the stability of hybrid systems such as the passive biped model in [START_REF] Jerray | Orbitador: A tool to analyze the stability of periodical dynamical systems[END_REF]. Here ORBITADOR is applied to the system Eq. ( 2) for W = [ -2π 4000 , 2π 4000 ](which corresponds to the true sensitivity of the optical sensors embedded in the exoskeleton), h = 10 -3 (which corresponds to the real time sampling frequency of exoskeleton control), δ 0 = 0.084, and the initial condition x 0 = (α 1 (0), α 0 (0), φ (0), ω(0), θ (0)) = (0.059 rad, 0.059 rad, 0.123 rad, 0.062 rad/s, 0.117 rad). It automatically finds that, for T = 5.168 s, with L = 10336 and K = 5168. The associated limit cycle C and controlled invariant set I are depicted on Fig. 4 and Fig. 5 respectively, according to various 2D projections. In Fig. 5, the ball B(y K , δ (K)) is represented in orange, and the ball B(y L , δ (L)) in green (we see B(y L , δ (L)) ⊂ B(y K , δ (K))). 4 Experimental results

B(y L , δ (L)) ⊆ B(y K , δ (K)),

Participants

One healthy right-handed adult took part in the experiments. A written consent was signed by the participant, and obtained as required by the Helsinki declaration [START_REF]World Medical Association. World Medical Association Declaration of Helsinki. Ethical principles for medical research involving human subjects[END_REF]. The study was validated by a research ethics committee of Paris-Saclay (Université Paris-Saclay, 2021-303).

Kinematics

The kinematics of the human movement are measured by the opto-electronic motion capture device called "Qualysis". This system is composed of 10 cameras to capture the human movement at 179 Hz. There are 7 reflecting markers placed on the participant forearm, which allow the construction of plans based on the recommendations of Ge Wu et al [START_REF] Wu | Isb recommendation on definitions of joint coordinate systems of various joints for the reporting of human joint motion-part ii: shoulder, elbow, wrist and hand[END_REF]. The identification of the 7 markers is carried out using an AIM (Automatic Idenfication Markers) model on the Qualysis Track Manager software. In order to make the participant do oscillatory movements, a sinusoidally moving target is projected on a screen in front of the subject.

Data acquisition

The code which controls the exoskeleton, also allows us to obtain its position as well as the parameters of Hopf oscillator. This allows to analyze the convergence of the oscillator. The data is first cleaned up, keeping only the part where the experiment starts.

Motor task

The participant is first placed in the robot at a distance from the targets corresponding to 2 times the size of his arm. The first three axis of the exoskeleton were mechanically blocked to avoid unwanted movement. Then a moving target is projected in a big screen in front of the participant. The target moves vertically with a varying sinusoidal trajectory. The participant is asked to follow the target by performing only the flexion/extension of the elbow. The pointing position is computed as the intersection between the line of the index and the plan of the screen, it is then projected in real time in the screen as a visual feedback for the participant. The subject starts with the forearm pointed at the fixed target in the middle (starting target) and then starts the experiment when the target starts to move as shown in Fig. 6.

The target follows the following sinusoidal trajectory :

x(t) = A sin(ωt) , A = 0.3 rad, ω = 5 rad.s -1 . (4)

Experimental data

This section presents the behaviour of the set of states obtained in the experiment where we used the control scheme presented in Section 2.2. Fig. 7 represents the real position θ (also the oscillator input)

and the estimated position θ computed by the oscillator. We can see that the estimation follows the desired position θ . We now compare the location of the experimental data with the invariant set I where W = [ -2π 4000 , 2π 4000 ] constructed by reachability analysis in Section 3. Fig. 8 represents the set I together with 5000 points chosen randomly within the set of experimental data. At the beginning of the movement at t < 4.918 s, we see on Fig. 8 that the experimental points (black) are outside of the invariant set I ; then at t ≥ 4.918 s the points (blue) are all located inside I .

More precisely, there are in total 10336 experimental data points: 4918 points for t < 4.918 s and 5418 points for t ≥ 4.918 s. All the 5418 points at t ≥ 4.918 s are located inside the invariant set I . For t < 4.918 s, the average of the distance between the experimental data and the limit cycle C is 0.0493 and the standard deviation 0.0255; for t ≥ 4.918 s, the distance average is 0.0028 and the standard deviation 0.0023. Fig. 9 shows the evolution of the distance between the experimental data and the limit cycle.

Figure 9: Evolution of the distance between the experimental data and the limit cycle.

As a conclusion, the experimental results allowed us to verify the efficiency of the Hopf oscillator on a complex robot such as ABLE.

Conclusion

We have described a methodology for 1. formally guaranteeing the convergence and robustness of the controlled system, at the model level, using a recent method of reachability analysis of periodic movements [START_REF] Jerray | Robust optimal periodic control using guaranteed Euler's method[END_REF], and 2. verifying all these properties at the experimental level, via a protocol on human subjects.

In this pilot study we have verified that all the data of the experiments (after a possible transient phase) are located within the controlled invariant set I found, at the theoretical level, by reachability analysis (see Section 3). We are presently enriching the model by taking into account additional axes of movement, and considering more sophisticated adaptive oscillators than the Hopf oscillator. We think that the methodology presented here (relying on control with adaptive oscillators, and formal verification via reachability analysis) is still well-suited to the validation of such extensions.

Figure 1 :

 1 Figure 1: Example of oscillator's adaptation. Top panel: the oscillator's input. Bottom panel: evolution of the learned frequency

Figure 2 :

 2 Figure 2: Exoskeleton ABLE

Figure 3 :

 3 Figure 3: Exoskeleton Control scheme

Figure 4 :

 4 Figure 4: 2D projections of the limit cycle C .

Figure 5 :

 5 Figure 5: Evolution of the size δ (t) of the controlled invariant set I (top), followed by 2D projections of I for W = [ -2π 4000 , 2π 4000 ].

Figure 6 :

 6 Figure 6: Description of the experimental setup. A: Markers on the forearms (human and exoskeleton). B: Target tracking example.

Figure 7 :Figure 8 :

 78 Figure 7: Evolution of the estimated position