Antoine Chaillet

Hiroshi Ito

Disturbance rejection in iISS feedback nonlinear systems: a sensitivity trade-off

This note investigates the trade-off arising in disturbance attenuation for nonlinear feedback systems in the framework of integral input-to-state stability. Similarly to the linear case, we show that if a gain tuning on one subsystem is used to drastically reduce the effect of its exogenous disturbances, then the other subsystem's disturbance attenuation is qualitatively the same as in open loop.

I. INTRODUCTION

The objective of the present paper is to provide some insights on how the well-known sensitivity / co-sensitivity trade-off arising for feedback linear time-invariant (LTI) systems extends to nonlinear plants. More precisely, consider two feedback nonlinear subsystems and assume that the nonlinear gain of one subsystem can be made smaller by a convenient control design. Then the nonlinear loop gain becomes smaller and the small-gain stability criterion is satisfied with a larger margin. A natural question is then whether this induces stronger robustness to disturbances for the overall feedback system. We give an answer to this question in the dissipative formulation for input-to-state stability (ISS, [START_REF] Sontag | Smooth stabilization implies coprime factorization[END_REF]) and integral ISS (iISS, [START_REF] Sontag | Comments on integral variants of ISS[END_REF]) systems.

The results presented along this paper rely on small gain arguments. More precisely, we make use of recent results on Lyapunov-based small gain theorems for iISS [START_REF] Ito | Necessary and sufficient small gain conditions for integral input-to-state stable systems: A Lyapunov perspective[END_REF], which include ISS as a special case. Compared to other nonlinear small gains existing in the literature such as [START_REF] Jiang | Small gain theorems for ISS systems and applications[END_REF], [START_REF] Jiang | A Lyapunov formulation of nonlinear small gain theorem for interconnected systems[END_REF], [START_REF] Teel | A nonlinear small gain theorem for the analysis of control systems with saturation[END_REF], [START_REF] Angeli | A tight small gain theorem for not necessarily ISS systems[END_REF], [START_REF] Dashkovskiy | Small gain theorems for large scale systems and construction of ISS Lyapunov functions[END_REF], this result allows both to deal with not necessarily ISS systems, and to provide an explicit construction of a Lyapunov function for the overall interconnection in the presence of exogenous inputs, which are two helpful features for this work.

Instead of relying on the exact knowledge of differential equation models, we employ iISS dissipation inequalities to describe nonlinear systems in feedback loop. Compared to the frequency analysis for LTI systems (cf. classical textbooks such as [START_REF] Franklin | Feedback Control of Dynamic Systems[END_REF]), iISS dissipation inequalities do not provide an equality between the input and its response, but rather an inequality that provides only a "worst-case" estimate (sometimes not very tight) of the input influence on the overall system: no distinction can be made between A. Chaillet is with L2S -EECI -Univ. Paris Sud 11 -Supélec, France (chaillet@ieee.org). H. Ito is with Kyushu Institute of Technology (Japan) and his work is supported in part by Grant-in-Aid for Scientific Research of JSPS under grant 19560446 and 22560449 (hiroshi@ces.kyutech.ac.jp).

systems that are strongly sensitive to inputs, and those for which the dissipation inequality is simply too loose.

In order to overpass this difficulty, we proceed in two different manners. The first one (Section IV) consists in building, for a given pair (α, γ) of iISS supply rates, an iISS system ẋ = f (x, d) for which these estimates are tight, in the sense that all disturbances that may act on that system have a negative impact on the system's performance and that this effect is not compensated by a dissipation rate stronger than the prescribed one. Roughly speaking, this is done by imposing (at least in some relevant state regions)

∂V ∂x (x)f (x, d) = -α(|x|) + γ(|d|) ,
where V denotes a given Lyapunov function candidate. The equality sign in this equation guarantees the sought tightness of the estimates. We show that, given an iISS supply pair (α, γ), Lyapunov-based small gain arguments always authorize the existence of such a system and consequently the non-rejection of some disturbances. Of course, this first approach is of purely theoretical interest, as the constructed system has typically no practical relevance. The second approach (Section V) demonstrates this trade-off without introducing such fictitious subsystems. Assuming that one subsystem admits a bounded disturbance that does have a negative effect on its performance, we show that, in feedback, this effect cannot be attenuated by the gain tuning of the other subsystem.

Notation. Given x ∈ R n , |x| denotes its Euclidean norm. Given a set A ⊂ R n , |x| A := inf z∈A |x -z|. Given a constant δ > 0, B δ := {x ∈ R n : |x| ≤ δ}. Given a set A ⊂ R and a constant a ∈ R, A ≥a := {s ∈ A : s ≥ a}. sat δ : R n → R n is defined, for all x ∈ R n , by sat δ (x) := (δsat(x 1 /δ), . . . , δsat(x n /δ))
T , where sat(s) := min(|s|, 1)sign(s) for all s ∈ R. Given a function σ : R m → R n , ker(σ

) := {x ∈ R m : σ(x) = 0}. A continuous function α : R ≥0 → R ≥0 is said to be of class PD if it is positive definite. It is said to be in class K if, in addition, it is increasing. It is said to be of class K ∞ if it is of class K and α(s) → ∞ as s → ∞. A function β : R ≥0 × R ≥0 → R ≥0 is said to be of class KL if β(•, t) ∈ K
for any fixed t ≥ 0 and β(s, •) is continuous non increasing and tends to zero at infinity for any fixed s ≥ 0. It is well known that, when Σ 1 and Σ 2 are LTI, the sensitivity / co-sensitivity tradeoff impedes the disturbance rejection of both d 1 and d 2 at the same frequency. To sketch out this tradeoff, consider single input -single output systems and let H i denote the transfer function of

Given α ∈ K, α(∞) ∈ R ≥0 ∪ {∞} is defined as lim s→∞ α(s). Given α, γ ∈ K, α(∞) > γ(∞) means that either α ∈ K ∞ , or α(∞) = c α ∈ R ≥0 and γ(∞) = c γ ∈ R ≥0 with c α > c γ . U m is
Σ i , i ∈ {1, 2}. If H 1 is tuned in such a way that H 2 H 1 (1-H 2 H 1 ) -1 → 0 at a given frequency, then one cannnot avoid (1-H 1 H 2 ) -1 → 1. This results in H 2 (1-H 1 H 2 ) -1 → H 2 ,
meaning that the d 1rejection imposes that the effect of d 2 is similar to the openloop. This fundamental obstruction to control design was first studied in [START_REF] Bode | Network analysis and feedback amplifier design[END_REF]. It imposes, in particular, a compromise between precision / output disturbance rejection and sensor noise attenuation. See [START_REF] Freudenberg | Frequency domain properties of scalar and multivariable feedback systems[END_REF], [START_REF] Maciejowski | Multivariable feedback design[END_REF], [START_REF] Seron | Fundamental limitations in filtering and control[END_REF], [START_REF] Freudenberg | Fundamental design limitations of the general control configuration[END_REF] for an in-depth analysis. The aim of this paper is to analyze to what extent this result can be adapted to nonlinear plants. The feedback interconnection considered in this note is

ẋ1 = f 1 (x 1 , x 2 , d 1 , θ) (1a) ẋ2 = f 2 (x 2 , x 1 , d 2 ) , (1b)
where

(x T 1 , x T 2 ) T =: x ∈ R n1+n2 denote the sate of each subsystem, (d T 1 , d T 2 ) T =: d ∈ U m1+m2
are exogenous disturbances, and θ ∈ Θ ⊂ R p is a free parameter as, for instance, a vector of tuning gains. We stress that this structure does not necessarily require that the subsystems (1a) and (1b) are connected through their whole states, but rather authorizes output feedback interconnection as f 1 (resp. f 2 ) may involve only part of x 2 (resp. x 1 ) or a function of its entries.

While the above LTI reasoning does not require any stability assumption on Σ 1 and Σ 2 when considered individually, the small-gain approach we follow in this note imposes that each subsystem is iISS with a class K dissipiation rate [START_REF] Sontag | Comments on integral variants of ISS[END_REF].

Assumption 1 There exist α 1 , γ 1 , ϕ 1 ∈ K, α 1 , α 1 ∈ K ∞ , and a C 1 function V 1 : R n1 → R ≥0 satisfying α 1 (|x 1 |) ≤ V 1 (x 1 ) ≤ α 1 (|x 1 |
) with the property that, given any λ > 1, there exist θ ∈ Θ such that, for all (x 1 , x 2 ) ∈ R n1+n2 and all

d 1 ∈ R m1 , ∂V 1 ∂x 1 f 1 ≤ -α 1 (|x 1 |) + 1 λ [γ 1 (|x 2 |) + ϕ 1 (|d 1 |)] . (2)
This first assumption not only guarantees iISS for the x 1subsystem (1a), but also that the disturbance rejection for this subsystem can be tuned at will by a convenient choice of the parameter θ. More precisely, considering u 1 := (x T 2 , d T 1 ) T as the exogenous input of (1a) and relying on classical reasonings for iISS systems (cf. [2, Corollary IV.3]), Assumption 1 naturally yields the following trajectory estimate for (1a):

|x 1 (t)| ≤ β( x 0 1 , t)+η Ç 1 λ t 0 γ1 (|u 1 (τ )|)dτ å (3)
where

x 1 (•) := x 1 (•; x 0 1 , x 2 , d 1 , θ), x 2 (•) := x 2 (•; x 0 2 , x 1 , d 2 ), γ1 (•) := 2 max{γ 1 (•), ϕ 1 (•)
} and η and β denote respectively class K and KL functions. Thus, once the exogenous signals x 2 and d 1 are given, the above estimate illustrates the possibility to arbitrarily reject their effect on the behavior of the x 1 -subsystem by conveniently tuning θ (i.e. by increasing λ). Note that the dissipation rate α 1 is assumed to belong to class K rather than simply PD as in [START_REF] Angeli | A characterization of integral input to state stability[END_REF]. This is motivated by the small gain argument [START_REF] Ito | Necessary and sufficient small gain conditions for integral input-to-state stable systems: A Lyapunov perspective[END_REF] we invoke in the sequel. Hence, Assumption 1 actually imposes iISS plus ISS with respect to small inputs1 with an assignable supply rate. Even though Assumption 1 may be hard to achieve in practice, this note aims precisely at showing that, despite such a strong stabilizability assumption, disturbance rejection cannot be expected to be arbitrary in a feedback interconnection. Nonetheless, we stress that, under specific matching conditions, Assumption 1 can be ensured by control designs available in the literature such as [16, Lemma 3]. The results in [START_REF] Teel | On assigning the derivative of a disturbance attenuation Control Lyapunov Function[END_REF], [START_REF] Liberzon | Universal construction of feedback laws achieving ISS and integral-ISS disturbance attenuation[END_REF] may also be inspiring. For instance, the following result easily follows from [START_REF] Praly | Stabilization in spite of matched unmodelled dynamics and an equivalent definition of input-to-state stability[END_REF]Lemma 3].

Proposition 1 (Actuation errors) Let f : R n1 → R n1 and g i : R n1 → R n1 , i ∈ {1, . . . , p}, be locally Lipschitz functions and assume that the system

ẋ1 = f (x 1 ) + p i=1 g i (x 1 )u i is globally asymptotically stabilizable by a continuous state feedback u = κ • : R n1 → R p , satisfying κ • (0) = 0, with associated C 1 Lyapunov function V 1 satisfying, for each i ∈ {1, . . . , p}, ∂V 1 ∂x 1 (0)g i (0) = 0 .
Then there exists a continuous state feedback κ : R n1 × R ≥0 → R p such that the system

ẋ1 = f (x 1 ) + p i=1 g i (x)(κ(x 1 , θ) + x 2 + d 1 ) ,
where θ denotes a scalar gain, satisfies Assumption 1 with this function V 1 .

On the other hand, the x 2 -subsystem is assumed to be iISS, with a fixed supply rate.

Assumption 2 There exist α 2 , γ 2 , ϕ 2 ∈ K, α 2 , α 2 ∈ K ∞ , and a C 1 function V 2 : R n2 → R ≥0 such that, for all (x 1 , x 2 ) ∈ R n1+n2 and all d 2 ∈ R m2 , α 2 (|x 2 |) ≤ V 2 (x 2 ) ≤ α 2 (|x 2 |) (4) ∂V 2 ∂x 2 f 2 (x 2 , x 1 , d 2 )≤-α 2 (|x 2 |) + γ 2 (|x 1 |) + ϕ 2 (|d 2 |). (5)
Here also the dissipation rate is assumed to be of class K rather than PD [START_REF] Angeli | A characterization of integral input to state stability[END_REF]. This assumption is necessary for the application of the small gain theorem [START_REF] Ito | Necessary and sufficient small gain conditions for integral input-to-state stable systems: A Lyapunov perspective[END_REF] on which we base this study.

III. TUNING FOR d 1 -REJECTION

We state the following result, which formally shows that, as expected, the tuning of θ allows for arbitrary attenuation of d 1 .

Proposition 2 Let Assumptions 1 and 2 hold and assume that the following implication holds true for each i ∈ {1, 2}:

γ 3-i ∈ K ∞ ⇒ α i ∈ K ∞ . (6)
Assume also that the small gain condition2

c 2 γ 2 • α -1 1 • α 1 • α -1 1 • c 1 γ 1 (s) ≤ α 2 • α -1 2 • α 2 (s) , ∀s ≥ 0 (7)
holds for some constants c 1 > 0 and c 2 > 1. Then, there exist β ∈ KL, α, γ, ζ ∈ K ∞ , and ∆ > 0 and, given any > 1, there exist θ ∈ Θ such that, for all x 0 ∈ R n1+n2 , all d 1 ∈ U m1 and all d 2 ∈ U m2 , the feedback interconnection ( 1) is iISS and ISS with respect to small inputs, and its solution satisfies

α(|x(t)|) ≤ β( x 0 , t) + t 0 γ (|d 1 (τ )| / ) dτ + t 0 γ(|d 2 (τ )|)dτ , ∀t ≥ 0 . (8)
and, for all

d 1 ∈ U m1 ≤ ∆ and all d 2 ∈ U m2 ≤∆ , |x(t)| ≤ β( x 0 , t) + ζ( d 1 / ) + ζ( d 2 ). (9)
It is worth noting that the upper and lower bounds on V i (namely, α i and α i ), i ∈ {1, 2} involved in (7) could be removed if (2) and ( 5) were replaced by dissipation inequalities involving only V i rather than x i . We keep the original small-gain condition [START_REF] Freudenberg | Fundamental design limitations of the general control configuration[END_REF] of [START_REF] Ito | Necessary and sufficient small gain conditions for integral input-to-state stable systems: A Lyapunov perspective[END_REF] as the bounds (2) and ( 5) are usually easier to establish in practice.

We also stress that small-gain condition in [START_REF] Ito | Necessary and sufficient small gain conditions for integral input-to-state stable systems: A Lyapunov perspective[END_REF] requires both c 1 and c 2 to be greater than 1. Relaxing to only c 1 > 0 in ( 7) is made possible by the fact that, in the context of the present article, the constant λ multiplying the supply rate γ 1 is tunable at will through the parameter θ (cf. Assumption 1).

Apart from these details, the iISS and ISS with respect to small inputs of the feedback interconnection (1) under ( 6)-( 7) directly follows from previous results of the second author [START_REF] Ito | Necessary and sufficient small gain conditions for integral input-to-state stable systems: A Lyapunov perspective[END_REF]. See Section VII-A for the complete proof. Let us recall that the small-gain condition ( 7) is not symmetric. We have chosen to assume [START_REF] Freudenberg | Fundamental design limitations of the general control configuration[END_REF] rather than its counterpart:

c 1 γ 1 • α -1 2 • α 2 • α -1 2 • c 2 γ 2 (s) ≤ α 1 • α -1 1 • α 1 (s)
, in order to allow for the interconnection of not necessarily ISS subsystems. See [START_REF] Ito | Necessary and sufficient small gain conditions for integral input-to-state stable systems: A Lyapunov perspective[END_REF] for details.

Compared to [START_REF] Ito | Necessary and sufficient small gain conditions for integral input-to-state stable systems: A Lyapunov perspective[END_REF], the novelty of Proposition 2 stands in the explicit estimate of the disturbance attenuation allowed by the tuning gain θ. Indeed, since the functions α, β, γ and ζ in ( 8)-( 9) are independent of , Proposition 2 guarantees that the effect of the exogenous disturbance d 1 over the solutions' behavior can be made arbitrarily small provided a convenient tuning of θ (i.e., corresponding to sufficiently large λ and ). In addition, since (9) ensures ISS with respect to all d 1 of amplitude smaller than ∆, with ∆ independent of , the class of ISS-tolerated disturbances can be enlarged at will. These constitute two interesting features for the rejection of the d 1 disturbance. However, no such d 2 -disturbance attenuation appears in the trajectory estimates (8)-( 9). This fact could either be due to an intrinsic property of feedback interconnections, or simply to the looseness of the upper bounds (8)- [START_REF] Ito | Towards uniform linear timeinvariant stabilization of systems with persistency of excitation[END_REF]. The rest of the paper shows that this property is indeed intrinsic and that no such d 2 -attenuation can be expected in general.

IV. SENSITIVITY TO d 2 : A "WORST CASE" SYSTEM In contrast to the previous section, we now show that the increase of λ, by a convenient tuning of the gain θ, is in general of no help in reducing the influence of d 2 over x 2 . The proof of this result is provided in Section VII-C.

Theorem 1 Let Assumption 1 hold, let d min 2 < d max 2
be two positive constants, and let α 2 , γ 2 , ϕ 2 denote some given K functions. Let V 2 : R n2 → R ≥0 be any Lyapunov function candidate satisfying

∂V 2 ∂x 2 (x 2 ) = 0 , ∀x 2 = 0 . ( 10
)
Then one can always find class K functions ν 2 and η 2 , and a vector field

f 2 : R n2 × R n1 × R m2 → R n2 , continuous on R n2 ×R n1 ×(R m2 \ {0}
), satisfying Assumption 2 with these prescribed functions α 2 , γ 2 and ϕ 2 , and such that, given any θ ∈ Θ, any initial state x 0 2 ∈ R n2 and any disturbance

d 1 ∈ U m1 and d 2 ∈ U m2 satisfying d min 2 ≤ d 2 (t) ≤ d max 2 , (11)
all forward complete solutions of (1) starting with

x 0 2 ≥ η 2 ( d 2 ) satisfy |x 2 (t)| ≥ ν 2 (ess inf τ ≥0 |d 2 (τ )|), ∀t ≥ 0. ( 12
)
Theorem 1 shows that the only knowledge of the dissipation inequality associated to each subsystem cannot guarantee, in general, an arbitrary d 2 -disturbance attenuation even when control gains can be tuned in order to decrease the sensitivity of the x 1 -subsystem with respect to its inputs. Indeed, it guarantees that such an interconnection may always yield, for some particular systems, the existence of an incompressible lower bound [START_REF] Jiang | A Lyapunov formulation of nonlinear small gain theorem for interconnected systems[END_REF] whose size is somewhat "proportional" to the minimal value of |d 2 |, for solutions starting sufficiently far from the origin. The crucial point is that this lower bound holds regardless of the chosen gain θ. It is therefore hopeless to expect arbitrary d 2 -disturbance rejection for this system by relying only on the associated dissipation inequalities.

Remark 1 If in addition to the assumptions of Theorem 1, the small gain condition (7) holds, then the assumptions of Proposition 2 are satisfied and consequently the feedback interconnection ( 1) is iISS and ISS with respect to small inputs (cf. ( 8)-( 9)) if λ is made small enough by a convenient choice of θ. In particular, (1) results forward complete and the lower bound [START_REF] Jiang | A Lyapunov formulation of nonlinear small gain theorem for interconnected systems[END_REF] holds at all times.

The property stated as Theorem 1 is quite intuitive once the inequality ( 5) is sufficiently tight. The contribution of this result is, in fact, to show that such a dissipation inequality is always tight for some particular systems. More precisely, the proof of Theorem 1 relies on the following lemma, that may have interest on its own. It is similar in spirit to [10, Lemma 1], but applies to any given Lyapunov function candidate. Its proof is provided in Section VII-B.

Lemma 1 Given m, n ∈ N ≥1 , let ϕ : R n × R m → R be any continuous function satisfying |x| ≤ σ(u) ⇒ ϕ(x, u) ≥ 0 , (13)
for some continuous function σ : R m → R ≥0 . Consider any Lyapunov function candidate

V : R n → R ≥0 satisfying ∂V ∂x (x) = 0 , ∀x = 0 . ( 14
)
Then, there exists a vector field f :

R n × R m → R n , continuous on R n ×(R m \ ker(σ)), such that, for all x ∈ R n and all u ∈ R m , ∂V ∂x (x)f (x, u) ≤ ϕ(x, u) (15)
|x| ≥ σ(u) ⇒ ∂V ∂x (x)f (x, u) = ϕ(x, u) . (16)
This lemma shows that, under mild assumptions, the dissipation inequality (5) is always "tight" for what we refer to as a worst-case system. In other words, any Lyapunov function candidate constitutes a tight iISS/ISS estimate of the behavior of these systems. This can be seen by taking ϕ as an iISS or ISS supply pair for this system. Here we refer to a "worst case" situation as, for this system, the application of any input signal works against the convergence of the associated Lyapunov function, and that it can be compensated by no greater dissipation rate than α(|x|).

Remark 2

The right-hand side f of the constructed system may not be locally Lipschitz. However, depending on the choice of the function ϕ, the existence of solutions may be guaranteed at all time. For instance, the application of the comparison lemma guarantees forward completeness for any function ϕ satisfying, at least for large |x|,

ϕ(x, u) ≤ cV (x) + η(|u|) ,
where c ∈ R and η : R m → R denotes a continuous function. See [START_REF] Ito | Towards uniform linear timeinvariant stabilization of systems with persistency of excitation[END_REF] for further discussions on how forward completeness of feedback systems can be guaranteed. Also, the fact that f is not necessarily continuous in u = 0 is not a crucial issue as Lemma 1 will typically be used for inputs lower-bounded away from zero.

V. SENSITIVITY TO d 2 : IMPEDING DISTURBANCES In most situations, exogenous inputs do not systematically work against the convergence of the associated Lyapunov function, as opposed to the worst-case systems developed in Section IV. For instance, for the scalar system ẋ = -x + d, any positive signal d tends to slowing down the convergence of x to zero for positive values of the initial state x 0 , but it actually speeds it up if x 0 ≤ 0. This observation suggests that no tight Lyapunov function, in the sense of Lemma 1, exists for most dynamical systems of practical relevance, nor can a Lyapunov function candidate

W satisfying Ẇ ≥ -α(|x|) + γ(|u|) , ∀x ∈ R n , ∀u ∈ R m ,
with α, γ ∈ K, be expected in general. On the other hand, in many cases, disturbances do induce an increase of the associated Lyapunov function at least in some regions of the state space. It is also reasonable to assume that their size is bounded for bounded states. This motivates the following assumption, which can be seen as a destabilizing counterpart of the small control property, cf. e.g. [START_REF] Sontag | A "universal" construction of Artstein's theorem on nonlinear stabilization[END_REF], [START_REF] Freeman | Robust Nonlinear control design: State-space and Lyapunov control techniques[END_REF].

Assumption 3 There exists a Lyapunov function candidate

W 2 : R n2 → R ≥0 , a K function Υ 2 and a continuous 3 function d 2 : R n1+n2 → R m2 such that, given any x = (x T 1 , x T 2 ) T ∈ R n1+n2 , |d 2 (x)| ≤ Υ 2 (|x|) (17)
∂W 2 ∂x 2 (x 2 )f 2 (x 2 , x 1 , d 2 (x)) > 0 .
This assumption ensures that at least one disturbance, whose size is somewhat "proportional" to the norm of the state, tends to destabilize the x 2 -subsystem with x 1 as an input.

For feedback systems satisfying Assumption 3, the following result shows that the tuning of the gain θ cannot be expected to induce arbitrary d 2 -disturbance rejection.

Theorem 2 Let Assumption 3 hold. Then there exists Υ ∈ K such that, given any δ > 0, there exists a signal

d 2 ∈ U m2 satisfying d 2 ≤ Υ(δ) (18)
such that, given any θ ∈ Θ and any d 1 ∈ U m1 , the set R n \B δ is globally attractive for the feedback interconnection (1) (i.e., lim inf t→∞ x(t; x 0 , d) ≥ δ) if the latter is forward complete.

The above result establishes that, for all systems satisfying Assumption 3, either the resulting interconnection is not forward complete (in which case disturbance rejection is obviously not achieved), or any ball centered at the origin can be made repellent for the overall interconnection, regardless of the choice of the tuning gain θ, by a bounded disturbance d 2 whose amplitude is "proportional" to the size of the chosen ball. This means that the maximum disturbance rejection is purely a function of the applied disturbance d 2 and that the tuning of θ has no effect on it. We stress that, in the above result, the larger the upper bound in ( 18) is, the further away from origin solutions will asymptotically go to (as B δ grows larger).

Remark 3 If, in addition, the vector fields f 1 and f 2 are chosen according to Assumptions 1 and 2 and the small gain condition (7) holds, then Proposition 2 ensures that the overall system is iISS (hence, forward complete).

VI. CONCLUSION

Motivated by the observation that the smaller the loop gain is, the larger the internal stability margin is for a feedback system, this paper has investigated the effect of decreasing the loop gain on external stability, and established a natural trade-off between rejection of disturbances entering in different places in the feedback loop. If one subsystem's parameters are tuned to reduce the effects of its disturbances, then the other subsystem eventually has been shown to behave as if it were in open-loop. While this trade-off is quite natural, the dissipation formulation of this paper enables to confirm the property for nonlinear systems, thus without relying on transfer functions. This iISS framework employed in this paper also allows to encompass subsystems whose solutions are not necessarily bounded for bounded inputs.The extension to the interconnection of more than two subsystems cas be envisioned based on large-scale small gain theorems such as [START_REF] Dashkovskiy | Small gain theorems for large scale systems and construction of ISS Lyapunov functions[END_REF].

VII. PROOFS

We start by recalling the following lemma, whose proof can be found along the lines of [START_REF] Ito | Necessary and sufficient small gain conditions for integral input-to-state stable systems: A Lyapunov perspective[END_REF].

Lemma 2 For each i ∈ {1, 2}, let V i : R ni → R ≥0 be a C 1 function satisfying, for all x i ∈ R ni , α i (|x i |) ≤ V i (x i ) ≤ α i (|x i |) with α i , α i ∈ K ∞ ,
and assume that there exist α i , γ i , ϕ i ∈ K such that (6) holds and, for all s ≥ 0,

c 2 γ 2 • α -1 1 • α 1 • α -1 1 • c 1 γ 1 (s) ≤ α 2 • α -1 2 • α 2 (s) (19) with c 1 , c 2 > 1. Then there exist ρ 1 , ρ 2 , α, γ ∈ K such that, for all (x 1 , x 2 ) ∈ R n1 × R n2 , 2 i=1 ρ i (V i (x i )) -α i (|x i |)+γ i (|x 3-i |)+ϕ i (|d i |) ≤ -α(|x|) + γ(|d|) .
This lemma provides an explicit construction of a Lyapunov function for the feedback interconnection of iISS systems under the small gain condition [START_REF] Sontag | A "universal" construction of Artstein's theorem on nonlinear stabilization[END_REF]. It is instrumental for the proof of Proposition 2.

A. Proof of Proposition 2

First notice that ϕ 1 can be assumed to be of class K ∞ without loss of generality (if it is not, just consider any K ∞ function greater than ϕ 1 ). In view of [START_REF] Sontag | Comments on integral variants of ISS[END_REF]Corollary 10], there exist K ∞ functions ϕ 0 and φ1 such that ϕ 1 (rs) ≤ φ1 (r)ϕ 0 (s) for all r, s ≥ 0. Given any d 1 ∈ R n1 and any λ > 0, pick r = |d 1 | /ϕ -1 0 (λ) and s = ϕ -1 0 (λ). We then conclude from the above expression that

ϕ 1 (|d 1 |) λ ≤ φ1 Ç |d 1 | ϕ -1 0 (λ) å . ( 20
)
Given any arbitrary > 1, pick any λ satisfying λ > max {ϕ 0 ( ); 1} .

Observing that the supply rate for (1a) with respect to x 2 is [START_REF] Freudenberg | Fundamental design limitations of the general control configuration[END_REF] ensures that the small gain condition [START_REF] Sontag | A "universal" construction of Artstein's theorem on nonlinear stabilization[END_REF] in Lemma 2 is fulfilled for some c 1 > 0. Assumptions 1 and 2 are then enough to apply Lemma 2 and conclude the existence of

1 λ γ 1 ,
ρ 1 , ρ 2 , α ∈ K and γ ∈ K ∞ such that, given any x = (x T 1 , x T 2 ) T ∈ R n1+n2 and any d = (d T 1 , d T 2 ) T ∈ R m1+m2 , 2 i=1 ρ i (V i (x i )) -α i (|x i |)+γ i (|x 3-i |)+φ i (|d i |) ≤ -α(|x|) + γ(|d|) , (22)
where, for notation homogeneity, φ2 := ϕ 2 . Similarly to [START_REF] Ito | Necessary and sufficient small gain conditions for integral input-to-state stable systems: A Lyapunov perspective[END_REF], consider the function V defined as

V (x) := V1(x1) 0 ρ 1 (s)ds + V2(x2) 0 ρ 2 (s)ds . (23)
It easily follows from Assumptions 1 and 2 that its derivative along the trajectories of (1) yields

V ≤ ρ 1 (V 1 ) Å -α 1 (|x 1 |) + γ 1 (|x 2 |) λ + ϕ 1 (|d 1 |) λ ã +ρ 2 (V 2 ) -α 2 (|x 2 |) + γ 2 (|x 1 |) + ϕ 2 (|d 2 |) .
By ( 20) and ( 21), it then follows that

V ≤ ρ 1 (V 1 ) (-α 1 (|x 1 |) + γ 1 (|x 2 |) + φ1 (|d 1 | / )) +ρ 2 (V 2 ) -α 2 (|x 2 |) + γ 2 (|x 1 |) + φ2 (|d 2 |) ,
which, in view of [START_REF] Teel | On assigning the derivative of a disturbance attenuation Control Lyapunov Function[END_REF], implies that

V ≤ -α(|x|) + γ Å Å d 1 / d 2 ã ã . ( 24
)
Using the fact that γ(a + b) ≤ γ(2a) + γ(2b) for all a, b ≥ 0 (since γ ∈ K ∞ ) and integrating this inequality with [2, Corollary IV.3] along the solutions of (1) yields

V (x(t)) ≤ β(V (x(0)), t) + 2 t 0 γ (2 |d 1 (τ )| / ) dτ +2 T 0 γ(2 |d 2 (τ )|)dτ , ∀t ≥ 0 ,
where β denotes a KL function. Moreover, exploiting (23) and the bounds on V 1 and V 2 guaranteed by Assumptions 1 and 2, V results a Lyapunov function candidate, which guarantees the existence of

K ∞ functions α, α ∈ K ∞ such that, for all x ∈ R n , α(|x|) ≤ V (x) ≤ α(|x|). We obtain that α(|x(t)|) ≤ β( x 0 , t) + 2 t 0 γ (2 |d 1 (τ )| / ) dτ + 2 t 0 γ(2 |d 2 (τ )|)dτ ,
where β is the KL function defined as β(s, t) := β(α(s), t) for all s, t ≥ 0. This establishes (8) with γ(s) := 2γ(2s) for all s ≥ 0. Finally, let ∆ > 0 be any constant satisfying ∆ ≤ γ(∞). Then, recalling that

|(d 1 / , d 2 )| ≥ max {|d 1 / | , |d 2 |}, the quantity α -1 • 1 2 γ(|(d 1 / , d 2 )|) is finite for all |d 1 | ≤ ∆ and all |d 2 | ≤ ∆, and it holds from (24) that |x| ≥ α -1 • 1 2 γ Å d 1 / d 2 ã ⇒ V ≤ - 1 2 α(|x|).
Classical ISS reasonings then ensures ISS with respect to all d 1 ∈ U m1 ≤ ∆ and all d 2 ∈ U m2 ≤∆ , and establishes (9) for some KL function β and some K ∞ function ζ. The conclusion follows by noticing that β and β can be taken the same by considering the KL function β(s, t) := max ¶ β(s, t), β(s, t) © for all s, t ≥ 0.

B. Proof of Lemma 1

Let c : R ≥0 → R ≥0 denote the function defined for all s ≥ 0 as

c(s) := min |x|=s ∂V ∂x (x) . ( 25
)
Since V is C 1 , c is continuous and, in view of ( 14), it is positive definite. Now, let ζ : R ≥0 × R m → R ≥0 denote the function defined, for all s ≥ 0 and all u ∈ R m , as

ζ(s, u) := ß sc(s) 2 if s ≤ σ u σ(u)c(σ(u)) 2 if s > σ u . (26)
Note that ζ is continuous on R ≥0 × R m and that ζ(s, u) > 0 for all s = 0 and all u / ∈ ker(σ). We claim that the result holds with the vector field f defined as f (0, u) := 0 and, for all x = 0,

f (x, u) := ϕ(x, u) ξ(x, u) ∂V ∂x (x) 2 Å ∂V ∂x (x) ã T ,
where ξ : R n × R m → R ≥0 denotes the function defined as

ξ(x, u):=    1 if |x| ≥ σ(u) a(u) |x| + b(u) if |x| ∈ [σ(u)/2; σ(u)) sat(ζ(|x| , u)) if |x| < σ(u)/2 , with a(u) := 1 -sat(ζ(σ(u)/2, u)) σ(u)/2 b(u) := 2 sat(ζ(σ(u)/2), u) -1 .
Note that, with this choice of a and b and recalling the properties of ζ, the function ξ is continuous on R n × (R m \ ker(σ)) and satisfies Exploiting the obvious continuity of f in any x = 0 for any u ∈ R m \ ker(σ), it follows that f is continuous on

0 ≤ ξ(x, u) ≤ 1 , ∀x ∈ R n , u ∈ R m . ( 27
R n × (R m \ ker(σ)).
Furthermore, for any x ∈ R n and u ∈ R m satisfying |x| ≥ σ(u), it holds that

f (x, u) = ϕ(x, u) 1 ∂V ∂x (x) 2 Å ∂V ∂x (x) ã T . Consequently ∂V ∂x f (x, u) = ∂V ∂x (x) ϕ(x, u) ∂V ∂x (x) 2 Å ∂V ∂x (x) ã T = ϕ(x, u) ,
which establishes [START_REF] Praly | Stabilization in spite of matched unmodelled dynamics and an equivalent definition of input-to-state stability[END_REF]. Finally, if |x| < σ(|u|), then [START_REF] Khalil | Nonlinear systems[END_REF] guarantees that ϕ(x, u) ≥ 0. In view of (27), it follows that

∂V ∂x (x)f (x, u) ≤ ϕ(x, u) ∂V ∂x (x) 2 ∂V ∂x (x) 2 ≤ ϕ(x, u) ,
which, together with ( 16) establishes [START_REF] Maciejowski | Multivariable feedback design[END_REF] and thus ends the proof.

C. Proof of Theorem 1

First of all, notice that, since V 2 is a Lyapunov function candidate, (4) holds for some

α 2 , α 2 ∈ K ∞ . Let u 2 := (x T 1 , d T 2 ) T and consider ϕ(x 2 , u 2 ) = -α 2 (|x 2 |) + γ 2 (|x 1 |) + φ2 (|d 2 |) ,
where φ2 is the class K function defined as

φ2 (s) := 1 2 min {ϕ 2 (s); α 2 (s)} , ∀s ≥ 0 .
This construction of φ2 ensures that the function α -1 2 • φ2 is well defined over R ≥0 . Also, this function satisfies [START_REF] Khalil | Nonlinear systems[END_REF] for any continuous nonnegative function σ such that, for all

u 2 ∈ R n1+m2 , σ(u 2 ) ≤ α -1 2 • φ2 (|d 2 |).
In particular, this condition is fulfilled with σ(u 2 ) = σ 2 (|d 2 |), if σ 2 is the K function defined as

σ 2 (s) := α -1 2 • φ2 Å d min 2 s 2d max 2 ã
, ∀s ≥ 0.

Applying Lemma 1 to V 2 with the above functions ϕ and σ ensures the existence of a vector field f 2 such that V2 :

= ∂V2 ∂x2 (x 2 )f 2 (x 2 , x 1 , d 2 ) ≤ -α 2 (|x 2 |) + γ 2 (|x 1 |) + φ2 (|d 2 |),
for all x ∈ R n and all d 2 ∈ R n2 . This makes Assumption 2 fulfilled by noticing that φ2 (s) ≤ ϕ 2 (s) for all s ∈ R ≥0 . Lemma 1 also guarantees that, for all x and d 2 satisfying

|x 2 | ≥ σ 2 (|d 2 |), V2 = -α 2 (|x 2 |) + γ 2 (|x 1 |) + φ2 (|d 2 |) ≥ -α 2 (|x 2 |) + φ2 (|d 2 |) . ( 29
) Note that, since σ(u 2 ) = σ 2 (|d 2 |) and σ 2 ∈ K, ker(σ) = R n1 × (R m2 \ {0}). Lemma 1 thus ensures that f 2 is continuous over R n2 × R n1 × (R m2 \ {0}
Let θ ∈ Θ be any arbitrary tuning gain, let d 1 ∈ U m1 , and consider any forward complete solution of (1) starting with an initial condition x 0 = (x 0 1

T , x 0 2 T ) T ∈ R n1 × R n2 satisfying x 0 2 ≥ α -1 2 • φ2 (d 2 ) . (31)
In view of (28), this ensures in particular that

x 0 2 > σ 2 ( d 2 ) . (32)
Let t 1 ∈ R ≥0 ∪ {∞} be defined as

t 1 := sup {t ≥ 0 : |x 2 (τ )| ≥ σ 2 ( d 2 ) ∀τ ∈ [0, t)} . (33)
In view of (32) and invoking the continuity of solutions, it holds that t 1 ∈ R >0 ∪ {∞} and, for all t ∈ [0, t 1 ), it holds from ( 4) and (29) that

v2 (t) ≥ -α 2 (|x 2 (t)|) + φ2 (|d 2 (t)|) ≥ -α 2 • α -1 2 (v 2 (t)) + φ2 (d 2 ) , (34)
where v 2 (•) := V 2 (x 2 (•)). We then rely on the following lemma, proved in Section VII-E.

Lemma 3 Let α be a class K locally Lipschitz function and let a ∈ R ≥0 . Let [0, t) ⊂ R ≥0 be the maximum interval of existence of a diffentiable function v whose derivative satisfies v(t) ≥ -α(v(t)) + a for all t ∈ [0, t). Then the following implication holds:

α(v(0)) ≥ a ⇒ α(v(t)) ≥ a, ∀t ∈ [0, t).
Recalling that the function α

2 • α -1 2 is invertible over [0, φ2 (d 2 )
] by construction of φ2 , Equation (34) together with Lemma 3 ensure that

v 2 (0) ≥ α 2 • α -1 2 • φ2 (d 2 ) ⇒ v 2 (t) ≥ α 2 • α -1 2 • φ2 (d 2 )
, ∀t ∈ [0, t 1 ) , which yields, in view of (4),

x 0 2 ≥ η 2 (d 2 ) ⇒ |x 2 (t)| ≥ ν 2 (d 2 )
, where the functions η 2 , ν 2 ∈ K are defined as

η 2 := α -1 2 • φ2 ν 2 := α -1 2 • α 2 • α -1 2 • φ2 . (35)
Equation (31) guarantees that the left-hand side of this implication holds true. Hence

|x 2 (t)| ≥ ν 2 (d 2 ) , ∀t ∈ [0, t 1 ) . (36)
In other words, Theorem 1 is proved if we show that t 1 = +∞. If it were not the case, then it would mean, in view of (33), that

|x 2 (t 1 )| = σ 2 ( d 2 ) . (37)
Consider the greatest time t 2 ≥ 0 for which

|x 2 (t)| ≥ ν 2 (d 2 ) , ∀t ∈ [0, t 2 ] . (38)
In view of (36), we necessarily have that t

∈ R n2 , a 2 (|x 2 |) ≤ W 2 (x 2 ) ≤ a 2 (|x 2 |) . (39)
Given any δ ≥ 0, let δ := a -1 2 • a 2 (δ). Note that δ ≥ δ. Define also

d 2 (x) := sat Υ2( δ) d 2 (x) ∀x ∈ R n1+n2 . (40)
Given any θ ∈ Θ, any d 1 ∈ R n1 and any x 0 ∈ R n , let x(•) := x(•; x 0 , d 1 , d 2 , θ) denote the solution of (1) and let d 2 (t) := d 2 (x(t)) for all t ≥ 0. Note that, if the system (1) is forward complete, then d 2 (t) exists for all t ≥ 0. Also, in view of ( 17) and ( 40) and recalling that a -1 2 • a 2 (s) ≥ s for all s ≥ 0, d 2 satisfies (18) with Υ = Υ 2 . In addition,

|x(t)| ≤ δ ⇒ d 2 (t) = d 2 (x(t)) .
In view of Assumption 3, the derivative of W 2 along the solutions of (1) then satisfies

|x(t)| ≤ δ ⇒ Ẇ2 (x 2 (t)) > 0 . (41)
Hence, with (39) and the continuity of x(•),

|x(s)| ≤ δ, ∀s ∈ [0, t) ⇒ |x 2 (t)|>a -1 2 • a 2 ( x 0 2 ). (42)
We prove the following two facts: Note that such an ε exists as Ẇ2 is continuous and the considered set is compact and non empty (since a -1 2 •a 2 ( δ) ≤ δ). In view of (41), it holds that ε > 0 and Ẇ2 (x 2 (t)) ≥ ε as long as |x(t)| ≤ δ. Integrating this inequality and exploiting (39) then guarantees that, as long as x 2 (•) remains inside Bδ, |x 2 (t)| ≥ a -1 2 a 2 ( x 0 2 ) + εt .

x 0 2 > δ ⇒ |x 2 (t)| ≥ δ, ∀t ≥ 0 (43)
This establishes (44). Finally, for x 0 2 > δ, either |x 2 (t)| > δ at all times in which case the right-hand side of (43) holds, or there exists a time t at which |x 2 (t )| = δ. Exploiting the above inequality by considering x 2 (t ) as the initial condition then shows that, as long as x 2 (•) remains inside Bδ, |x 2 (t)| ≥ a -1 2 a 2 ( δ) + εt ≥ δ, which establishes (43) and thus ends the proof.

E. Proof of Lemma 3

We distintiguish between two cases. Case 1: a < α(∞). Consider the differential equation ẏ = -α(y) + a. Then letting z := y -α -1 (a) yields ż = -α(z) where α is the locally Lipschitz class K function defined as α(s) := α(s + α -1 (a)) -a. By [START_REF] Khalil | Nonlinear systems[END_REF]Lemma 4.4], z(•) exists over R ≥0 and satisfies z(t) = β(z(0), t), where β ∈ KL, for all z(0) ≥ 0, and all t ≥ 0. In terms of y, this reads y(t) = β(y(0) -α -1 (a), t) + α -1 (a) for all y(0) ≥ α -1 (a). But [START_REF] Khalil | Nonlinear systems[END_REF]Lemma 3.3] guarantees that, if v(0) ≥ y(0), then v(t) ≥ y(t) for all t ∈ [0, t). It follows that, for all v(0) ≥ α -1 (a), v(t) ≥ α -1 (a) for all t ∈ [0, t).

Case 2: a ≥ α(∞). In this case, v(t) ≥ 0 for all t ∈ [0, t) , which makes the claim trivial.

VIII. ACKNOWLEDGEMENT

The author warmly thank an anymous reviewer of a previous version of this work, who greatly helped improving the clarity and readability of this document. The authors also thank W. Pasillas-Lépine and L. Greco for fruitful comments.

  the set of measurable locally essentially bounded signals d : R ≥0 → R m . Given u ∈ U m , u := ess sup t≥0 |u(t)|. Given ∆ ≥ 0, U m ≤∆ := {u ∈ U m : u ≤ ∆}. V : R n → R ≥0 is called a Lyapunov function candidate if it is C 1 , positive definite and radially unbounded. II. PROBLEM STATEMENT We consider two dynamical systems Σ 1 and Σ 2 interconnected in a feedback configuration through their outputs y 1 and y 2 , and subject to exogenous disturbances d 1 and d 2 , cf. Fig. 1.

Fig. 1 .

 1 Fig. 1. Feedback interconnection.

2 ≤ 0 .

 20 )Moreover, in view of (25) and (26), given any u ∈ R m \ ker(σ), it satisfies Since ξ is a nonnegative function, it follows that, given any u ∈ R m \ ker(σ), and consequently, for each u ∈ R m \ ker(σ), lim (x,u)→(0,u ) f (x, u) = 0 = f (0, u ) .

x 0 2 ≤

 2 δ ⇒ ∃t ≥ 0 : |x 2 (t)| ≥ δ . (44)These combined properties establish that, in any cases, the solution x 2 (•) (and consequently x(•)) eventually leaves the ball B δ and never goes back into it, i.e., for allx 0 ∈ R n1 × R n2 , lim t→∞ |x 2 (t)| R n 2 \B δ = 0 ,which indeed establishes the result. In order to establish (43)-(44), consider any x 0 2 ∈ Bδ and letε := min ¶ Ẇ2 (z) : a -1 2 • a 2 ( x 0 2 ) ≤ |z| ≤ δ© .

  ). Now, consider any disturbance d 2 ∈ U m2 satisfying[START_REF] Jiang | Small gain theorems for ISS systems and applications[END_REF] and let d

2 := ess inf τ ≥0 |d 2 (τ )|. Note that it holds that d 2 ≥ d min 2 , d 2 ≤ d max

2

.

  2 ≥ t 1 . But (28) and (35) ensure that σ 2 (d 2 ) < ν 2 (d Let Υ 2 , W 2 and d 2 be generated by Assumption 3. Since W 2 is a Lyapunov function candidate, there exist a 2 , a 2 ∈ K ∞ such that, for all x 2

2 ). The continuity of solutions together with (33), (37) and (38) then impose that t 2 < t 1 , which induces a contradiction. Thus, t 1 is infinite, which makes (36) valid for all t ≥ 0 and concludes the proof.

D. Proof of Theorem 2

This combination is sometimes referred to as Strong iISS.

Condition[START_REF] Freudenberg | Fundamental design limitations of the general control configuration[END_REF] requires in particular that either γ 1 (∞) is finite or α 1 ∈ K∞. In both cases, Assumption 1 guarantees that a convenient tuning of θ makes (1a) ISS with respect to x 2 . More details can be found in[START_REF] Ito | Necessary and sufficient small gain conditions for integral input-to-state stable systems: A Lyapunov perspective[END_REF].

The continuity requirement on d 2 may probably be relaxed by relying on Arstein-type constructions[START_REF] Sontag | A "universal" construction of Artstein's theorem on nonlinear stabilization[END_REF] to get a continuous destablizing feedback. Since such a construction is of little interest in the context of this note, we assume continuity of d 2 for simplicity.


Fabio Tango
email: fabio.tango@crf.itluca.minin@unimore.itraghav.aras@gmail.com

Luca Minin

Raghav Aras

Olivier Pietquin
email: olivier.pietquin@supelec.fr

Automation Effects on Driver's Behaviour when integrating a PADAS and a Distraction Classifier

The FP7 EU project ISi-PADAS aims at conceiving an intelligent system, called PADAS, to support drivers, which intervenes continuously from warning up to automatic braking in the whole longitudinal control of the vehicle. However, such supporting systems can have some unwanted sideeffect: due to the presence of automation in the driving task, less attention and reaction are needed by the drivers to intervene in the longitudinal control of the vehicle. Such a paper aims at investigating the effects of the level of automation on drivers, in particular on their Situation Awareness, when the user is supported by a specific PADAS application, integrated with a driver's distraction classifier.

Introduction

The FP7 EU project ISi-PADAS (Integrated Human Modelling and Simulation to support Human Error Risk Analysis of Partially Autonomous Driver Assistance Systems) aims at conceiving an intelligent system called PADAS (Partially Autonomous Driver Assistance System) which aids human users to drive safely, by providing them with pertinent and accurate information in real time about the external conditions and by acting as a co-pilot in emergency situations. The system interacts with the driver through a Human-Machine Interface (HMI) installed on the vehicle using an adequate Warning and Intervention Strategy (WIS). Such a system intervenes continuously from warning up to automatic braking in the whole longitudinal control of the vehicle [START_REF] Alsen | Integrated Human Modelling and Simulation to support Human Error Risk Analysis of Partially Autonomous Driver Assistance Systems: the ISI-PADAS Project[END_REF]. Recent data have identified inattention -and in particular distraction -as the primary cause of accidents [START_REF] Beirness | The Road Safety Monitor: Driver Distraction[END_REF]. The ISI-PADAS project has developed a model, able to detect and classify driver's distraction, which has then been integrated into the PADAS, in order to avoid or mitigate the negative effects and make the system "smarter" and more adaptive [START_REF] Tango | Learning optimal control strategies from interactions for a Partially Autonomous Driver Assistance System[END_REF].

This paper addresses the problem of evaluating the effects of the automation on driver's Situation Awareness when using a PADAS integrating a Distraction (DIS) classifier.

Fabio Tango, Luca Minin, Raghav Aras, Olivier Pietquin

The Context and the Problem Addressed Systems like the Adaptive Cruise Control (ACC) can (partially) automate the longitudinal driving task and thus support users in this perspective, but -on the other way -they can cause also less attention and reduced reaction time from drivers, especially in case of unexpected events. Ward found that ACC appeared to improve driving safety by reducing instances of unsafe headway distance in following tasks [START_REF] Ward | Automation of task processed: an example of intelligent transportation systems[END_REF]. However, he also highlighted a relevant impairment of situation awareness (SA) because of a reduced attention dedicated to positioning and slower response times to unexpected events. In addition, other studies have proved the influence of ACC automation on performance, workload and attention allocation, e.g. [START_REF] Parker | Adaptive cruise control and driver workload[END_REF]. Despite of the indubitable advantages, drivers may direct their attention away from the driving task when using ACC, creating an unsafe situation due to a loss of situation awareness. The study of Rudin-Brown confirms such results, with an unexpected increase in accidents from driver distraction due to the interaction with the secondary task [START_REF] Rudin-Brown | Behavioral adaptation to adaptive cruise control[END_REF].

The PADAS Concept

The choice to focus the attention on longitudinal driving control task derived by a preliminary in-depth accident analysis, conducted to derive hypotheses about causes of driver's errors responsible for crashes [START_REF] Briest | In welchen Situationen machen Fahrer welche Fehler? Ableitung von Anforderungen an Fahrerassistenzsysteme durch[END_REF]. In this context, many studies have shown the benefits of supporting systems in reducing accidents [START_REF] Tango | Learning optimal control strategies from interactions for a Partially Autonomous Driver Assistance System[END_REF]. Therefore, the project has developed a PADAS called "Advanced Adaptive Cruise Control" (ACC+) with the following functionalities. In normal condition, the system can use the "traditional" ACC. Then when the driver acts on the brake pedal, thus indicating the will to brake, the AB function is able to modulate the braking action automatically. Finally, if the driver ignored warning and AB did not intervene on the brakes, EB acts autonomously in order to minimise the effects in case this is not avoidable anymore.

The MDP Approach

Consider a system that assists the driver by applying corrective controls to the vehicle (giving the driver warning signals and intervening in the braking) so that collisions may be avoided. When a collision is imminent, there is no doubt about what controls to apply: a clear collision warning must be given to the driver, and brakes must be applied as hard as possible to bring the host vehicle to a halt as quickly as possible. When there is a safe distance between the two vehicles, it is not clear what the optimal controls are. Should no warnings, no braking interventions occur? It could be, for example, that not giving a warning when the vehicle is at a certain "safe distance" leads (eventually) to a situation where a collision is unavoidable whereas a warning leads to an avoidance of the eventual collision. Deciding what corrective controls to exercise in order to avoid an eventual collision is essentially a problem of "credit assignment": suppose an outcome is a consequence of a sequence of decisions. How do we decide what part each of decisions plays in the outcome? In other words, the credit assignment problem calls for a system for associating decisions to their Automation Effects on Driver's Behaviour when integrating a PADAS and a Distraction Classifier 3 long-term outcomes. One of the most important theories for formulating and solving credit assignment in sequential decision-making problems is the Markov decision process (MDP) theory ( [START_REF] Tango | Learning optimal control strategies from interactions for a Partially Autonomous Driver Assistance System[END_REF] for details). In modelling a problem as an MDP, we contemplate a decision-maker who is required to take decisions over a sequence of discrete time periods. In each period, the problem occupies one of N possible states and the decision maker is called upon to choose from K possible alternatives. Such a decision and the state of the problem together determine, according to fixed probabilities P, the state occupied by the problem in the next period. Each choice is evaluated by an immediate cost c which is a function only of the state in which the choice is made (Markovian Property). The immediate cost tells the decision maker how good or bad a choice is in the short turn (i.e., its immediate consequence). It can use the immediate costs to determine the long-term desirability of a sequence of decisions. The objective of the decision maker to make such decisions that minimize his long-term expected cost. The solution to a sequential decision making problem is of course a sequential decision making policy. A policy is a function which assigns to each state an alternative. If the decision maker is following the optimal policy, it is the case that in any period, whatever be the state occupied by the problem, the decision the policy dictates will lead to long-term expected cost that is as small as or smaller than any other decision he could have made [START_REF] Pietquin | Batch Reinforcement Learning for Optimizing Longitudinal Driving Assistance Strategies[END_REF]. Thus the MDP approach applied to conceiving an optimal PADAS consists of two elements: modelling the problem as an MDP; solving the (possibly unknown) MDP.

Modelling a PADAS Target Application as an MDP

First, the state of the MDP in the collision avoidance problem has to be defined. In this problem, the decision maker is the warning and intervention system (of the PADAS). The relevant factors that determine if a collision with the leading vehicle can occur are: time to collision; headway; velocities of the host and leading vehicles; accelerations of the host and leading vehicles; brake and gas pedals position; driver's distraction level. So, the state in the proposed MDP can be considered as a 10-vector. However, the number of states of such an MDP would be too large for solving the MDP. If each element of the state is allowed to take only 3 possible values (a very conservative estimate, indeed most elements would take continuous values), we would end up with 3 ଵ states! For the sake of computational tractability, we must determine which of these elements contains most information relevant to collision avoidance. With this in mind, the time to collision1 and driver's distraction variables are two good candidates.

Distraction Model as an MDP State to improve the PADAS

A distraction classifier has been developed in the ISI-PADAS project and integrated into the optimal WIS for the PADAS, with the aforementioned MDP Fabio Tango, Luca Minin, Raghav Aras, Olivier Pietquin approach. The distraction model has been implemented following also in this case a Machine Learning approach, which constitutes a quite common method to detect human visual distraction in a non-intrusive way, based on the vehicle dynamic data ( [START_REF] Liang | Real-time Detection of Driver Cognitive Distraction Using Support Vector Machines[END_REF], [START_REF] Salvucci | Modeling tools for predicting driver distraction[END_REF]). Concerning the distraction classifier developed by the project, a broad explanation is outside the scope of this paper, but some details are provided as following (the interested reader can see [START_REF] Tango | Non-intrusive Detection of Driver Distraction using Machine Learning Algorithms[END_REF]). In particular, a Support Vector Machines based model (SVM, well-known data-mining methods) has been selected, since achieving the best performances [START_REF] Tango | Non-intrusive Detection of Driver Distraction using Machine Learning Algorithms[END_REF]. So, to sum up, the PADAS is conceived as an MDP, including an SVM-distraction classifier in the states defining the MDP.

The experimental Set-up Description

The scope of this experiment was twofold. On one hand, to assess the effect of automation on driver's situation awareness; on the other hand, to compare the effects of the ACC+ solutions in reducing the risk of collision and on system acceptability from a driver perspective. Therefore the following phases have been considered:

• ACC+ with a starting (initial) MDP policy p0 including a model for drivers distraction; • ACC+ with a MDP running p* policy (that is, the optimal policy developed by solving the MDP problem), including a model for driver distraction detection • ACC+ with a policy based on deceleration (pDec policy, described in [25]); • Without supporting systems (reference line).

Concerning the reference policy pDec, it provides the driver with the same kind of information of the p* policy, but the approach is different. The main idea of pDec is to give the needed acceleration for the host vehicle, in order to reach the same speed of the lead vehicle within a certain distance. Then, if the value is over certain thresholds, a corresponding warning or action is provided [25]. This policy represents a traditional algorithm for the implementation of a longitudinal distance control/warning system.

For each of the above configurations, ten participants in the age between 21 and 45 years (M = 31.0, SD = 9.0) were asked to complete 12 driving sessions: each condition consisted in a car-following task on a highway road where unexpected braking events of the leading car have been reproduced. Hence, each of the 10 subjects performed 36 driving sessions, divided as follows:

• 12 with the ACC+ working with the p* policy;

• 12 with the ACC+ working with the pDec policy;

• 12 without any supporting system Two different levels of road visibility (low, LV; high, HV) have been reproduced, combined with the activation of the secondary task and the level of automation of the vehicle longitudinal control. LV (200m) has been introduced with fog effect to force low situation awareness situations. LV condition has been compared with the HV condition (7000m).

Automation Effects on Driver's Behaviour when integrating a PADAS and a Distraction

Classifier 5

The secondary task adopted is the SuRT (Surrugate visual Research Task [24]). Drivers were asked to interact with SuRT every time the task was presented on the lateral (right hand side) touch screen installed in the simulator cabin. A high level of SuRT difficulty has been set: high number of distractors with a reduced time to task completion (i.e. the SuRT screen was updated each 3-6 seconds). The secondary task has been activated in 6 conditions out of 12 for each driver.

SA has been measured at the end of each session by means of a self reporting questionnaire called SART (Situation Awareness Rating Technique [23]) submitted to participants: we expected a decrease of situation awareness when scenarios are critical (i.e. low visibility and secondary task on) and the level of automation is low.

The number of occurred collisions has been also calculated, to evaluate the effects of highly automated longitudinal control in particular while dealing with low situation awareness conditions. Finally, in order to verify the influence of the different ACC+ system automation on performance, workload and attention allocation ( [START_REF] Briest | In welchen Situationen machen Fahrer welche Fehler? Ableitung von Anforderungen an Fahrerassistenzsysteme durch[END_REF] and [START_REF] Liang | Real-time Detection of Driver Cognitive Distraction Using Support Vector Machines[END_REF]), additional investigations have been conducted on specific indicators: NASA-Tlx and Steering Entropy (SE).

The experiment has been conducted on the static driving simulator of the University of Modena and Reggio Emilia (see www.scaner2.com).

Data Processing and Results

During the experiment, several data on drivers' behaviour were recorded from the simulator network at a sample rate of 20Hz (1 data-point each 0.05s).

Indicators and Indexes of Performance

SA has been measured by means of the SART questionnaire. It is a quick and easy self-rating measurement technique [23]. As a result of the interviews provided by the questionnaire, 10 dimensions were derived and used to measure SA. For each basic driving condition (4 in total) and for each driving session (3 in total, 2 with ACC+ and 1 without) the following measures have been analysed:

• Number of accidents occurred, allowing the evaluation of drivers' longitudinal performances with reference to the level of longitudinal automation and the scenario complexity • Steering Entropy [28] has been computed to evaluate drivers' impairment in lateral control for each of the above mentioned situations. SE is a measure of randomness in a driver's steering control: it is higher when drivers make larger erratic steering movements, indicating potentially unsafe behaviour. • Nasa-Tlx [29] has been used to analyse, in order to have a general understanding of the level of cognitive and physical effort required by drivers while coping with concurrent tasks (car-following and secondary task interaction).

Fabio Tango, Luca Minin, Raghav Aras, Olivier Pietquin

Finally, participants were asked to fill up the subjective questionnaire defined by the ISI-PADAS consortium to assess both ACC+ running p* and ACC+ running pDec policies.

Results for Automation Effects on Driver's Behaviour

SART questionnaire has been submitted to each subject four times for each of the three automation conditions. The aim of the evaluation conducted on collected data was to compare the average values of SART indicator of the aggregated SART scales between subjects for each level of automation and basic driving conditions. According to [23] the 10-scales of the SART have been aggregated: Demands on attentional resources (D), Supply of attentional resources (S) and Understanding of the situation (U).

SART indicator is computed as: U-(D-S), where U, D, and S are the sum of the answers to the SART scales belonging to these aggregations:

Fig. 1. Average values of SART computed on the whole sample

In the figure, it is shown the quantitative variation of situation awareness among the driving (x-axis) and the automation conditions. Variations among automation conditions are relevant between automated (ACC+) and not-automated situations and there is a general positive increment of SA for the former conditions. Moreover, it is possible to see the effect of the driving conditions (SuRT and visibility) on the perceived SA: the absence of the secondary task and fog clearly increases the level of perceived situation awareness. A t-Test analysis of SART values was conducted for each driving condition and (in pairs) between the three automation configurations, in order to evaluate whether there are significant differences between the correspondent SART levels. Significant differences (p < 0.05) between average values of SART with and without automation have been found for all driving conditions but the "SURT + Visibility low" one. All in all, no significant differences were found comparing the average values of SART computed for the ACC+ p* and ACC+ pDec.

Concerning the lateral driving behaviour, the average values of steering entropy (SE) were computed for all subjects for the two automation types: ACC+ with p* and ACC+ with pDec. As anticipated, SE revealed steering impairments due to factors influencing the vehicle lateral control. In this case, these factors are the interaction with SuRT and the low visibility. The t-Test analysis conducted on SE values showed that there is a significant statistical difference (p < 0.05) in SE performances between For each driving condition, again a t-Test has been also conducted to compare the average values of SE in the two automated conditions to highlight potential statistical differences. No statistical differences between these values, however, were found in each of the driving conditions.

Average SART indicator for each automation level and driving codition

Finally, the automation effects on driver's workload are analyzed. The NASA-Tlx questionnaire has been submitted to each participants after each of the last four driving conditions for each driving session (ACC+ p*, ACC+ pDec and without supporting systems). The following figure shows the average values of NASA-Tlx computed for each driving condition (x-axis) and for each automation type:

Fig. 3. NASA-Tlx average values

In general, the level of workload perceived by drivers was higher in the conditions where SuRT was active, lower when no secondary task was present and visibility was high. Significant differences among workload levels measured for each automation type in the four driving conditions were not found, except for the "SuRT OFF + Visibility high" where participants stated that driving without longitudinal assistance induced high workload. In this case, the NASA scales showing this pattern are physical effort (because drivers have to module the speed autonomously) and effort (physical and mental demand).

Moreover, the level of NASA-Tlx was higher in the ACC+ pStar conditions if compared to ACC+ pDec: the NASA scale contributing to the increase of the level of workload perceived by drivers is "Frustration". Drivers stated they were annoyed by a continuous warning signal provided by the ACC+ pStar also in conditions where they did not perceive a risk of collision and where they were able to modulate the speed by themselves in case that more deceleration was needed.

Results for PADAS Performances

Some preliminary results on the performances of PADAS applications, integrating the Distraction classifier are pointed out in this section. The benefits of the ACC+ running the p* policy are evident: besides some userinteraction issues discussed in the previous sections, the WIS, developed following an MDP approach, allows drivers to intervene in time on the brakes and avoid collision with the lead vehicle when it suddenly stopped. All in all, drivers found ACC+ with p* policy more cautious, in the sense that the system provided warning signals also in conditions where the lead vehicle braking was smoother than the sudden one and where they did not perceive an imminent risk of collisions. This "learning effect" of the system induced drivers to be prepared to brake before the sudden stop event. Figure 4 (bottom) also reveals drivers impairment, for each driving condition, in coping not only with longitudinal control but also with secondary tasks activation and road visibility (i.e. conditions where SA was critical, in particular without the support of longitudinal automation). situation awareness reveal a relevant impact of the ACC+ (indifferently p* or pDec) in providing the driver with a better understanding of the situation, particularly while dealing with concurrent tasks like monitoring the driving environment and executing secondary task. Effects of the ACC+ p* and pDec on lateral vehicle control have been also assessed using the SE indicator, revealing that the two automation solutions did not generate different lateral control impairments while significant different levels of lateral impairments have been measured among driving conditions because of the presence of the secondary task and low visibility conditions.

Drivers' feedbacks on the different NASA scales revealed an overall workload increase in conditions where the secondary task was active and the visibility was obstructed, as expected. Within these conditions, we did not found relevant workload differences among the two ACC+ solutions, but for most of these conditions driver workload was higher in the conditions without automation then with ACC+. This can be linked to the difficulty of performing secondary task like SURT in a harsh environment (low visibility conditions). So, we can conclude that high-automated systems, such as ACC+, did not reduce neither the impairment of drivers in controlling the vehicle, nor their situation awareness; moreover, driver's workload did not enhance, due to system use.

Another very interesting aspect was the evaluation of PADAS performances, in particular considering its efficacy in avoiding extremely dangerous situations. From preliminary results presented here, considering the number of collisions occurred when using ACC+ with p* or pDec, compared with the situation when no supporting system is used, results pointed in favour of the ACC+ p* system. In fact, this solution proved to be the most effective in avoiding accidents, if compared to the numbers measured for the other automation solution and for the driving condition without automation. The major benefit introduced by the ACC+ p* was the cautious warning information and assistance strategy that allowed the driver to anticipate a potential sudden brake of the lead car.

Although these good results, from internal acceptance questionnaires, drivers were annoyed by this cautious strategy providing AB signals (hap-tic + acoustic in particular) frequently along the test session.

This research represents a feasibility study for an innovative approach to PADAS applications development, based on MDP and integrating a SVM driver's distraction classifier. Of course, all these methods, taken separately, are not new in literature, but at the best of authors' knowledge, their use in this kind of domain and with this type of integrated approach is quite innovative. With respect other traditional algorithms used for implementing the WIS of ADAS applications (i.e. pDec), our approach is based on learning the "behaviour" directly from the interaction between driver and system (vehicle + automation) in the specific environment; therefore we regard it as more appropriate to provide the right information in the right time (this has been proved by the drastic reduction in the number of collisions). On the other hand, such a system needs to be refined, since users assessed it as too conservative; however, due to that direct interaction between human and system, we are strongly confident to tune appropriately this kind of PADAS. So, next steps will involve the refinement of cost function, a more precise definition of the parameters constituting the state of the MDP, new possible technique for the MDP problem solution and -last but not least -

Fig. 2 .

 2 Fig. 2. SE variations in the 4 driving conditions, w.r.t. the two kinds of automation

Steering

  Entropy in the four bas ic driving condition w .r.t. autom ation

Figure 4 (Fig. 4 .

 44 Fig. 4. Total collision using different PADAS configurations: cumulative collisions for all subjects in the top figure; collisions occurred for each subject in every driving session

defined as the time it would take for a collision to occur if the leading and follower vehicles maintain their current velocities, that is the distance rated by their relative speed.

Discussion and Conclusions

This paper has presented the evaluation of the impact on driver's behaviour, caused by supporting systems with high level of automation. In addition, also the system performances have been illustrated. We have focused on the following aspect: situation awareness, lateral behaviour and workload. Concerning the automatic system, we have developed the PADAS application following a MDP approach. Experiments have been carried out in a static driving simulator.

Concerning SA, the SART questionnaires showed significant benefits between automated and not automated driving conditions. In the former, higher values of