Virginie Deniau

Philippe Massy

Antonio Kung

Renaud Comte

Marie-Hélène Bonneau

SECRET : SECurity of the Railway network against Electromagnetic ATtacks

The European railway network is in significant evolution with the deployment of ERTMS. In particular, the level 2 of ERTMS which is based on the transmission of the signaling information through the GSMR network mobilizes all the railway stakeholders to maintain an optimal security level.

Due to the increasing terrorism threat, various aspects and in particular electromagnetic attacks need to be taken into account. The harmonisation of the European railway network results in a harmonized electromagnetic vulnerability which need to be addressed at European level and especially the resilience of ERTMS against potential malicious actions which could be implemented in order to disturb the railway network. Knowing that some information will be transmitted via wireless solutions, the issue of the Intentional ElectroMagnetic Interferences (IEMI) naturally occurs.

The European project SECRET co-funded by the European Commission within the FP7 program was then initiated in order to study the potential impact of such interferences and to implement solutions to avoid any disruption. SECRET consortium involves 10 partners from 5 European countries. The project is coordinated by IFSTTAR which is the French institute of science and technology for transport, development and network. The project SECRET assesses the risks and consequences of EM attacks on the rail infrastructure, works on preventive and recovery measures and develops protection solutions to reinforce the security of the rail network, subject to intentional electromagnetic (EM) interferences, which can disturb command-control, communication or signalling systems.

During this project, several scenarios were studied in order to identify the potential vulnerable situations. Regarding the interferences considered in this project, we did not identify direct potential dangerous situations for the persons. However, such interferences can impact seriously the good operation of the rail and the capacity of the network.

The project is then oriented in four major contributions.

The first contribution is oriented on the definition and realization of susceptibility tests performed on specific railway components in presence of interferences corresponding to specific intentional interferences. This work is linked with an issue larger than the railway domain. Indeed, the International Electrotechnical Commission (IEC) Subcommittee (SB) 77C works on the standards to protect civil systems against man-made high power electromagnetic threats. Initially, this subcommittee considered mainly very high power electromagnetic threats and progressively the definition of the considered intentional interferences evolved. Indeed, with the proliferation of the emission devices accessible to general public and with the deployment of the application ensured by wireless communication technologies, the threat is in permanent evolution. The test methodologies developed in SECRET and the definition of the EM attack signal were then discussed with members of IEC SC77C in order to contribute to the evolution of the international standardisation concerning the civil infrastructure.

The second contribution is focused on the research of solutions to detect the presence of IEMI. Indeed, in the case that IEMI would be generated in the space dedicated to the railway network, the priority is to diagnosis the situation. The detection can permit us to involve an adequate countermeasure and to not confuse an attack with a technical failing. Different detection methods were studied in order to identify what can be the more efficient solutions according to the context (on board train, along the track or in railway station).

A first detection approach is based on the analysis of the spectrum occupation to distinguish "normal" distributions, corresponding to the absence of attack signal, from "abnormal" distributions corresponding to the presence of attack signal in the spectrum. For this spectrum distribution approach, two different methodologies were studied: the supervised detection or the attack signal classification. The supervised detection consists in learning and modelling the "normal" environment. In that case, the detection application consists in recognizing an environment which does not belong to the "normality". The attack signal classification method consists in learning the environment in presence of different attack devices and to extract distribution models for each device. In that case, the detection consists in comparing the environment with the different models and to recognize the presence of one of the models. In SECRET, measurements were performed in different situations (on board train, along track and in train stations) in order to define the laws corresponding to all these "normal" situations. In parallel, different attack devices were characterized and modelled, optimizing the model definition in order to facilitate the detection without being affected by over fitting. The spectrum approach can allow monitoring several communication systems in adapting the frequency bands monitored and in using adequate antennas.

Another detection approach is based on the in phase and quadratic (IQ) data received by the GSM-R terminal and consists in analysing the GMSK IQ constellation with and without attack signal. The Error Vector Magnitude (EVM) which corresponds to the sum of the errors on the sample positions is calculated for each GSM-R time slot. The values reached by the EVM and the evolution of these values over the time permits to efficiently detect the presence of IEMI. We noticed that the variation of the EVM is really significant in presence of attack signal even if the power of the attack signal is 20 dB lower than the GSM-R signal. Then, the jamming signal could be detected even if the communication is not affected and the reaction to have could be anticipated.

The third contribution of the project consists in designing an ICT communication architecture resilient to EM attacks. It integrates a detection system (DS), a redundant multipath communication system (MCS), and a management capability in charge of acting upon attack. The DS detects in real-time EM attacks and to be able to take over manual or automatic actions to overcome them. The MCS can harden for instance an ETCS (European Train Control System) communication between the RBC (Radio Block Centre) and the train using multiple paths simultaneously. The management system consists of distributed components called health attack managers (HAMs): a central HAM located at the command center level, HAMs at the track level and HAMs at the train level.

The architecture is specified to take into account configuration flexibility requirements and interoperability requirements. Different configurations are possible: DS only, MCS only, DS and MCS together. Interoperability interfaces are defined, e.g. between a central HAM and a HAM, between a HAM and an MCS. Examples of configurations could be the following: an ETCS solution over a non IP based communication, with a DS at the track level; an ETCS solution over an IP based communication (e.g. GPRS-R, WiMAX, LTE, Tetra) with one of the three options (DS only, MCS only, DS and MCS together).

The architecture was evaluated with a modelling and simulation tool with different scenarios of attacks. Examples of parameters were attack position, train position, strength and duration of attack. Simulation showed that under different conditions and scenarios the railway communication is resilient against EM attacks. For practical reasons the architecture will be demonstrated through a different use case: a railways worker will have an alert equipment on himself (inside his coat) which is connected through Bluetooth to his GSM mobile. Upon attack detection, an alert is sent from the detecting equipment to the mobile. The mobile connects to the control centre to inform that there is an attack.

During the architecture specification work, it was realised that the use of different risk analysis methods and tools created a terminology problem. For instance the concept of threat was different in each method. Consequently an unification work is being carried out. It is based on ontologies and can lead in the future to automatic generation of rules to be used by health attack managers.

The fourth action is about the dissemination of the project results to key players and contributing to the improvement of standardisation. Because the project wants to make the whole railway community hoarding on its outcomes, contributions to Technical Recommendations (TecRec) will be proposed in link with the UNISIG/UNIFE normalization process. Meanwhile, fearing the TecRec process duration, a parallel activity consists in porting those outcomes to more specialized normalization commitees, as well at hardware level with committes like CENELEC (European Committee for Electrotechnical Standardization), CEN (European Committee for Standardization, except electrotechnical and telecom) or ETSI (European Telecommunications Standards Institute) with providing some EMC recommendations but also at system level like UNISIG with discussing more resilient architectures.

Cyber threats are an increasing concern for every business. Barely a week goes by without new reports of sophisticated IT systemseven of the largest organisations or intelligence servicesfalling victim to cyber attacks. It was therefore important to check what further precautions could be taken within the railway sector should the need arise. The SECRET project addresses this issue for electro-magnetic attacks targeting infrastructure and will then contribute to reinforce the signalling systems.

Figure 1 -

 1 Figure 1 -The SECRET Consortium


Jean-Marc Bardet
email: bardet@univ-paris1.fr

Yakoub Boularouk
email: y.boularouk@centre-univ-mila.dz

Khedidja Djaballah

Asymptotic behavior of the Laplacian quasi-maximum likelihood estimator of affine causal processes

Keywords: AMS 2000 subject classifications: Primary 62M10, 62M10; secondary 60G10 Laplacian Quasi-Maximum Likelihood Estimator, Strong consistency, Asymptotic normality, ARMA-ARCH processes

We prove the consistency and asymptotic normality of the Laplacian Quasi-Maximum Likelihood Estimator (QMLE) for a general class of causal time series including ARMA, AR(∞), GARCH, ARCH(∞), ARMA-GARCH, APARCH, ARMA-APARCH,..., processes. We notably exhibit the advantages (moment order and robustness) of this estimator compared to the classical Gaussian QMLE. Numerical simulations confirms the accuracy of this estimator.

Introduction

This paper is devoted to establish the consistency and the asymptotic normality of a parametric estimator for a general class of time series. This class was already defined and studied in [START_REF] Doukhan | Weakly dependent chains with infinite memory[END_REF], [START_REF] Bardet | Asymptotic normality of the Quasi-Maximum likelihood estimator for multidimensional causal process[END_REF] and [START_REF] Bardet | Detecting multiple change-points in general causal time series using penalized quasi-likelihood[END_REF]. Hence, we will consider an observed sample (X 1 , • • • , X n ) where (X t ) t∈Z is a solution of the following equation:

X t = M θ0 (X t-1 , X t-2 , • • • ) ζ t + f θ0 (X t-1 , X t-2 , • • • ), t ∈ Z, (1.1)
where

• θ 0 ∈ Θ ⊂ R d , d ∈ N *
, is an unknown vector of parameters, also called the "true" parameters;

• (ζ t ) t∈Z is a sequence of centred independent identically distributed random variables (i.i.d.r.v.) with symmetric probability distribution, i.e. ζ 0

L = -ζ 0 , satisfying E[|ζ 0 | r ] < ∞ with r ≥ 1 and E[|ζ 0 |] = 1. If r ≥ 2, denote σ 2 ζ = Var(ζ 0 ); • (θ, (x n ) n∈N ) → M θ ((x n ) n∈N ) ∈ (0, ∞) and (θ, (x n ) n∈N ) → f θ ((x n ) n∈N ) ∈ R are two known applications. For instance, if M θ0 (X t-1 , X t-2 , • • • ) = 1 and f θ0 (X t-1 , X t-2 , • • • ) = α 0 X t-1 with |α 0 | < 1 then (X t
) is a causal AR(1) process. In [START_REF] Doukhan | Weakly dependent chains with infinite memory[END_REF] and [START_REF] Bardet | Asymptotic normality of the Quasi-Maximum likelihood estimator for multidimensional causal process[END_REF], it was proved that all the most famous stationary time series used in econometrics, such as ARMA, AR(∞), GARCH, ARCH(∞), TARCH, ARMA-GARCH processes can be written as a causal stationary solution of (1.1). In [START_REF] Bardet | Asymptotic normality of the Quasi-Maximum likelihood estimator for multidimensional causal process[END_REF], it was also established that under several conditions on M θ , f θ and if E[|ζ 0 | r ] with r ≥ 2, the usual Gaussian Quasi-Maximum Likelihood Estimator (QMLE) of θ is strongly consistent and when r ≥ 4 it is asymptotically normal. This estimator was first defined by [START_REF] Weiss | Asymptotic theory for ARCH models estimation and testing[END_REF] for ARCH processes, and the asymptotic study of this estimator was first obtained by [START_REF] Lumsdaine | Consistency and asymptotic normality of the quasi-maximum likelihood in IGARCH(1, 1) and covariance stationary GARCH(1, 1) models[END_REF] for GARCH(1, 1) processes, [START_REF] Berkes | GARCH processes: structure and estimation[END_REF] for GARCH(p, q) processes, [START_REF] Francq | Maximum likelihood estimation of pure GARCH and ARMA-GARCH processes[END_REF] for ARMA-GARCH processes, [START_REF] Straumann | Quasi-maximum-likelihood estimation in conditionally heteroscedastic time series: A stochastic recurrence equations approach[END_REF] for general heteroskedastic models, and [START_REF] Robinson | Pseudo-maximum likelihood estimation of ARCH(∞) models[END_REF] for ARCH(∞) processes. The results of [START_REF] Bardet | Asymptotic normality of the Quasi-Maximum likelihood estimator for multidimensional causal process[END_REF] devoted to processes satisfying almost everywhere (1.1) as well as its multivariate generalisation, provide a general and unified framework for studying the asymptotic properties of the Gaussian QMLE. However, the definition of the Gaussian QMLE is explicitly obtained with the assumption that (ζ t ) is a Gaussian sequence and even if it could be applied when the probability distribution of (ζ t ) is non-Gaussian, it keeps some drawbacks of this initial assumption. Indeed, the computation of this estimators requires the minimization of a least squares contrast (typically

n t=1 M -2 θ (X t -f θ ) 2
) and this induces that r = 2 is required for the consistency and r = 4 for the asymptotic normality (and therefore confidence intervals or tests). For numerous real data such requirement with f t θ := f θ (X t-1 , . . . , X 1 , u) and M t θ := M θ (X t-1 , . . . , X 1 , u) , where u = (u n ) n∈N is a finitely non-zero sequence (u n ) n∈N . The choice of (u n ) n∈N does not have any consequences on the asymptotic behaviour of L n , and (u n ) could typically be chosen as a sequence of zeros. Finally, if it exists, a Quasi-Maximum Likelihood Estimator (QMLE) is defined by:

θ n := Argmax θ∈Θ log QL θ (X 1 , • • • , X n ) .
Usually, the "instrumental" probability density h is the Gaussian density, i.e.

h(x) = 1 √ 2π e -1 2 x 2 for x ∈ R
and this provides the Gaussian-QMLE of θ.

Here, we chose as instrumental probability density the Laplacian density, i.e., h(x) = 1 2 e -|x| for x ∈ R, (2.1) and this implies E |ζ 0 | = 1. Therefore, we respectively define the Laplacian-likelihood and Laplacian-quasi-likelihood by:

L n (Θ) = - n t=1 q t (Θ) with q t (Θ) = log |M t θ | + |M t θ | -1 |X t -f t θ | (2.2) L n (θ) = - n t=1 q t (θ) with q t (θ) := log | M t θ | + | M t θ | -1 |X t -f t θ |.
(2.3) Hence, if it exists, a Laplacian-QMLE θ n is a maximizer of L n :

θ n := arg max θ∈Θ L n (θ).
We restrict the set Θ in such a way that a stationary solution (X t ) of order 1 or 2 of (1.1) exists. Additional conditions are also required for insuring the consistency and the asymptotic normality of θ n . More details are given now.

Existence and stationarity

As it was already done in [START_REF] Doukhan | Weakly dependent chains with infinite memory[END_REF] and [START_REF] Bardet | Asymptotic normality of the Quasi-Maximum likelihood estimator for multidimensional causal process[END_REF], several Lipschitztype inequalities on f θ and M θ are required for obtaining the existence and r-order stationary ergodic causal solution of (1.1). First, denote g θ Θ = sup θ∈Θ g θ with m ∈ N * and • the usual Euclidean norm (for vectors or matrix). Now, let us introduce the generic symbol K for any of the functions f or M . For k = 0, 1, 2 and some subset Θ of R d , define a Lipschitz assumption on function K θ :

Assumption (A k (K, Θ)) ∀x ∈ R ∞ , θ ∈ Θ → K θ (x) ∈ C k (Θ) and ∂ k θ K θ satisfies ∂ k θ K θ (0) Θ < ∞ and there exists a sequence α (k) j (K, Θ) j of nonnegative numbers such that ∀x, y ∈ R N ∂ k θ K θ (x) -∂ k θ K θ (y) Θ ≤ ∞ j=1 α (k) j (K, Θ)|x j -y j |, with ∞ j=1 α (k) j (K, Θ) < ∞
For ensuring a stationary r-order solution of (1.1), for r ≥ 1, define the set

Θ(r) := θ ∈ R d , (A 0 (f, {θ})) and (A 0 (M, {θ})) hold, ∞ j=1 α (0) j (f, {θ}) + (E[|ζ 0 | r ]) 1/r ∞ j=1 α (0) j (M, {θ}) < 1 .
Then, from [START_REF] Doukhan | Weakly dependent chains with infinite memory[END_REF], we obtain:

Proposition 2.1. If θ 0 ∈ Θ(r) for some r ≥ 1, then there exists a unique causal (X t is independent of (ζ i ) i>t for t ∈ Z) solution X of (1.1), which is stationary, ergodic and satisfies

E |X 0 | r < ∞ .
The following lemma insures that if a process X satisfies Proposition 2.1, a causal predictable ARMA process with X as innovation also satisfies Proposition 2.1. We first provide the classical following notion for a sequence (u n ) n∈N of real numbers:

(u n ) n∈N is an exponentially decreasing sequence (EDS) ⇐⇒ there exists ρ ∈ [0, 1[ such as u n = O(ρ n ) when n → ∞.
Lemma 2.1. Let X be a.s. a causal stationary solution of (1.1) for θ 0 ∈ R d . Let X be such as

X t = Λ β (L) X t for t ∈ Z with Λ β0 (L) = P -1 β0 (L) Q β0 (L)
where (P β0 , Q β0 ) are the coprime polynomials of a causal invertible ARMA(p, q) processes with a vector of parameters

β 0 ∈ R p+q . Denote Λ -1 β0 (x) = Q -1 β0 (x) P β0 (x) = 1 + ∞ j=1 ψ j (β 0 )x j .
Then X is a.s. a causal stationary solution of the equation

X t = M θ0 ( X t-i ) i≥1 ζ t + f θ0 ( X t-i ) i≥1 ) for t ∈ Z,
where f θ0 and M θ0 are given in (5.1) and θ 0 = (θ 0 , β 0 ). Moreover, for i = 0, 1, 2 and with K = f or M and K = f or M ,

• if α (i) j (K, {θ 0 }) = O(j -β ) and β > 1, then α (i) j ( K, { θ 0 }) = O(j -β ); • if α (i) j (K, {θ 0 }) is EDS, then α (i) j ( K, { θ 0 }) is EDS.
imsart-ejs ver. 2014/10/16 file: ArticleBBD4.tex date: February 20, 2017 2.3. Assumptions required for the convergence of the Laplacian-QMLE

The Laplacian-QMLE could converge and be asymptotically Gaussian but this requires some additional assumptions on Θ and functions f θ and M θ :

• Condition C1 (Compactness) Θ is a compact set.

• Condition C2 (Lower bound of the conditional variance) There exists a deterministic constant M > 0 such that for all θ ∈ Θ and x ∈ R N , then M θ (x) > M . • Condition C3 (Identifiability) The functions M θ and f θ are such that: for all θ 1 , θ 2 ∈ Θ, then M θ1 = M θ2 and f θ1 = f θ2 implies that θ 1 = θ 2 .

3. Consistency and asymptotic normality of the estimator

Consistency and asymptotic normality

First we prove the strong consistency of a sequence of Laplacian-QMLE for a solution of (1.1). The proof of this theorem, is postponed in Section 5, as well as the other proofs.

Theorem 3.1. Assume Conditions C1, C2 and C3 hold and θ 0 ∈ Θ(r) ∩ Θ with r ≥ 1. Let X be the stationary solution of (1.1). If (A 0 (f, Θ)) and (A 0 (M, Θ)) hold with

α (0) j (f, Θ) + α (0) j (M, Θ) = O(j -ℓ ) for some ℓ > 2 min(r , 2) (3.1)
then a sequence of Laplacian-QMLE ( θ n ) n strongly converges, that is θ n a.s.

-→

n→∞ θ 0 .
Of course, the conditions required for this strong consistency of a sequence of Laplacian-QMLE are almost the same than the ones required for the strong consistency of a sequence of Gaussian-QMLE except that r ∈ [1, 2) is proved to be possible in Theorem 3.1 and not in case of Gaussian-QMLE (see [START_REF] Bardet | Asymptotic normality of the Quasi-Maximum likelihood estimator for multidimensional causal process[END_REF]). Moreover, if r = 2, the condition (3.1) on Lipshitzian coefficients is weaker for Laplacian-QMLE than for Gaussian-QMLE. As we will see below, many usual time series can satisfy the assumptions of Theorem 3.1; for example, an AR(∞) process can be defined for satisfying the strong consistency of Laplacian-QMLE while the conditions given in [START_REF] Bardet | Asymptotic normality of the Quasi-Maximum likelihood estimator for multidimensional causal process[END_REF] do not ensure the strong consistency of Gaussian-QMLE. Now we state an extension of Theorem 1 established in [START_REF] Davis | Least Absolute Deviation Estimation for Regression with ARMA Errors[END_REF] which will be an essential step of the proof of the asymptotic normality of the estimator.

Theorem 3.2. Let (Z t ) t∈Z be a sequence of i.i.d.r.v such as Var

(Z 0 ) = σ 2 < ∞, with common distribution function which is symmetric (F (-x) = 1 -F (x) for x ∈ R) and is continuously differentiable in a neighborhood of 0 with derivative f (0) in 0. Denote F t = σ(Z t , Z t-1 , • • • ) for t ∈ Z and let (Y t ) t∈Z and (V t ) t∈Z two stationary processes adapted to (F t ) t and such as E Y 2 0 V 2 0 < ∞. Then n t=1 V t-1 |Z t -n -1/2 Y t-1 | -|Z t | D -→ n→∞ N f (0) E V 0 Y 2 0 , E V 2 0 Y 2 0 (3.2)
Then, the asymptotic normality of the Laplacian-QMLE can be established using additional assumptions:

Theorem 3.3. Assume that θ 0 ∈ • Θ ∩Θ(r)
where r ≥ 2 and

• Θ denotes the interior of Θ. Let X be the stationary solution of the equation (1.1). Assume that the conditions of Theorem 3.1 hold and for i = 1, 2, assume (A i (f, Θ)) and (A i (M, Θ)) hold. Then, if the cumulative probability function of ζ 0 is continuously differentiable in a neighborhood of 0 with derivative g(0) in 0 and if matrix Γ F or Γ M , defined in (5.21), are definite positive symmetric matrix, then As it was already proved for the median estimator (see [START_REF] Van Der Vaart | Asymptotic Statistics, Cambridge Series in Statistical and Probabilistic Mathematics[END_REF]) or for least absolute deviations estimator of ARMA process (see [START_REF] Davis | Least Absolute Deviation Estimation for Regression with ARMA Errors[END_REF]), it is not surprising that the probability density function g of the white noise (ζ i ) i impacts the asymptotic covariance of (3.3). However, when f θ = 0, this is not such the case and this is what happens for GARCH processes see [START_REF] Francq | Two-stage non Gaussian QML estimation of GARCH models and testing the efficiency of the Gaussian QMLE[END_REF] where the probability density g does not appear in the asymptotic covariance.

√ n θ n -θ 0 D -→ n→∞ N d 0 , Γ M + 2g(0) Γ F -1 σ 2 ζ -1 Γ M + Γ F Γ M + 2g(0) Γ F -1 . ( 3
3.2. Comments on these limit theorems

Essentially, these limit theorems could appear close or even very close to the results of 3 other references we chronologically list below but also from which we highlight the differences:

• The first related paper is [START_REF] Davis | Least Absolute Deviation Estimation for Regression with ARMA Errors[END_REF] which is cited many times. The framework of this paper is restricted to the LAD (similar to the Laplacian-QMLE) of the parameters of ARMA[p, q] process or residuals of least-square estimation with ARMA[p, q] errors. If the framework (1.1) is clearly more general since it includes for instance GARCH, ARMA-GARCH or APARCH process, the proof we used for establishing the asymptotic normality of the Laplacian estimator is clearly inspired by the one of [START_REF] Davis | Least Absolute Deviation Estimation for Regression with ARMA Errors[END_REF]. Thus our results could appear as extensions of this paper. • The second and certainly closest paper, [START_REF] Bardet | Asymptotic normality of the Quasi-Maximum likelihood estimator for multidimensional causal process[END_REF]. The considered framework is exactly the same, i.e. general causal affine models and the estimation method is the same, i.e. the quasi-maximum likelihood estimation (QMLE). However in [START_REF] Bardet | Asymptotic normality of the Quasi-Maximum likelihood estimator for multidimensional causal process[END_REF] the QMLE is based on an "instrumental" Gaussian density instead of a Laplacian one. As it is such the case for instance by comparing quantile with least square regression, this implies three main differences:

1. The moment conditions r of both the limit theorems (strong consistency and asymptotic normality) are weaker with Laplacian QMLE than with the Gaussian one. Indeed, the absolute value of conditional log-density q t (θ) is bounded by an affine function of |X t | in the Laplacian case while it is bounded by a quadratic polynomial of X t in the Gaussian case. As a consequence, r = 1 (respectively r = 2) could be required for the strong consistency (resp. asymptotic normality) of the Laplacian QMLE while r = 2 (resp. r = 4) is required for the Gaussian QMLE. This gain on moment condition can be crucial for instance in an econometric framework where the Kurtosis of data is sometimes infinite.

2. The proof of Theorem 3.1 is simpler and sharper than the proof of strong consistency in [START_REF] Bardet | Asymptotic normality of the Quasi-Maximum likelihood estimator for multidimensional causal process[END_REF]. Indeed, in our new proof, we use a condition of almost sure uniform consistency based on a general and powerful result established in [START_REF] Kounias | An inequality and almost sure convergence[END_REF] while a Feller-type condition was "only" used in [START_REF] Bardet | Asymptotic normality of the Quasi-Maximum likelihood estimator for multidimensional causal process[END_REF]. This difference leads to a very sharp condition on the decreasing rate of the Lipshitzian coefficients (α

(0) k ) for Laplacian QMLE, ℓ > 1 in (3.1), while ℓ > 3/2 is required for Gaussian QMLE.
3. The proof of Theorem 3.3 is totally different to the one for Gaussian QMLE since the conditional logdensity is no more differentiable with respect to the parameters. A kind of proof similar to the one used for establishing the asymptotic normality of the median is required. Hence, in a first step we had to prove an extension of a central limit for adapted processes established in [START_REF] Davis | Least Absolute Deviation Estimation for Regression with ARMA Errors[END_REF], i.e. our Theorem 3.2, and we used it in a second step for establishing the asymptotic normality of the Laplacian QMLE. Note also that the conditions on the derivatives of functions f θ and M θ are clearly weaker with Laplacian than with Gaussian QMLE.

• The third related paper is [START_REF] Francq | Two-stage non Gaussian QML estimation of GARCH models and testing the efficiency of the Gaussian QMLE[END_REF]. The framework of this paper is restricted to linear causal models (X t = σ t (θ) ξ t ) in contrast with the affine causal models (X t = M t θ ξ t + f t θ ) considered in (1.1). Hence ARMA but also ARMA-GARCH or ARMA-APARCH processes are not considered in this framework. Moreover the required moment is r = 4 (instead of r = 2 in our conditions) and the condition on the approximation of σ t (θ), i.e. sup θ |σ t (θ)σt (θ)| ≤ C 1 ρ t is clearly weaker than our Lipshitzian condition (for instance ARCH(∞) processes with Riemanian decay of the coefficients could satisfy our conditions but not their conditions). In imsart-ejs ver. 2014/10/16 file: ArticleBBD4.tex date: February 20, 2017 [START_REF] Francq | Two-stage non Gaussian QML estimation of GARCH models and testing the efficiency of the Gaussian QMLE[END_REF], a large family of instrumental probability densities, i.e. generalized Gaussian densities, including Laplace density, but their proof of asymptotic normality mimics the proof using derivatives of Gaussian QMLE since the "shift" component f t θ typically present for ARMA processes, is not considered in their models. Note also that [START_REF] Francq | Risk-parameter estimation in volatility models[END_REF] also studies non-Gaussian QMLE but their assumption A9 implies that the Laplace density is not considered in their asymptotic normality of the QMLE.

Finally it appears that our results provide an original extension or counterpart of these three related references.

Examples

In this section, several examples of time series satisfying the conditions of previous results are considered. Like it could be boring to state the results for all sufficiently famous processes, we refer, mutatis mutandis, to [START_REF] Bardet | Asymptotic normality of the Quasi-Maximum likelihood estimator for multidimensional causal process[END_REF] and [START_REF] Bardet | Detecting multiple change-points in general causal time series using penalized quasi-likelihood[END_REF] for ARCH(∞) and TARCH(∞).

1/ APARCH processes. APARCH(δ, p, q) model has been introduced (see [START_REF] Ding | A Long Memory Property of Stock Market Returns and a New Model[END_REF]) as the solution of equations

   X t = σ t ζ t , σ δ t = ω + p i=1 α i (|X t-i | -γ i X t-i ) δ + q j=1 β j σ δ t-j , (3.4)
where δ ≥ 1, ω > 0, -1 < γ i < 1 and α i ≥ 0 for i = 1, . . . , p, β j ≥ 0 for j = 1, . . . , q with α p , β q strictly positive and q j=1 β j < 1. Hence, we denote here θ = δ, ω, α 1 , . . . , α p , γ 1 , . . . , γ p , β 1 , . . . , β q . Using L the usual backward operator such as LX t = X t-1 , 1 -q j=1 β j L j -1 exists and simple computations imply for t ∈ Z:

σ δ t = 1 - q j=1 β j L j -1 ω + p i=1 α i (1 -γ i ) δ (max(X t-i , 0)) δ + α i (1 + γ i ) δ (-min(X t-i , 0)) δ = b 0 + i≥1 b + i (max(X t-i , 0)) δ + i≥1 b - i (max(-X t-i , 0)) δ .
where b 0 = w(1 -q j=1 β j ) -1 and the coefficients (b + i , b - i ) i≥1 are defined by the recursion relations

   b + i = q k=1 β k b + i-k + α i (1 -γ i ) δ with α i (1 -γ i ) = 0 for i > p b - i = q k=1 β k b - i-k + α i (1 + γ i ) δ with α i (1 + γ i ) = 0 for i > p (3.5) with b + i = b - i = 0 for i ≤ 0. As a consequence, for APARCH model, f t θ ≡ 0 and M t θ = σ t . It is clear that α (0) j (f, Θ) = 0 and simple computations imply α (0) j (M, Θ) = sup θ∈Θ max |b + j (θ)| 1/δ , |b - j (θ)| 1/δ
. Therefore A 0 (f, Θ) holds and q j=1 β j < 1 implies that a sequence defined by u n = q k=1 β k u n-k for n large enough is such as (u n ) n∈N is an exponentially decreasing sequence and therefore A 0 (M, Θ) holds. Thus for r ≥ 1, the stationarity set Θ(r) is defined by

Θ(r) = θ ∈ R 2p+q+2 E |ζ 0 | r 1/r ∞ j=1 max |b + j | 1/δ , |b - j | 1/δ < 1 . (3.6)
Now the strong consistency and asymptotic normality of the Laplacian-QMLE for APARCH models can be established (see the proof in Section 5):

Proposition 3.1. Assume that X is a stationary solution of (3.4) with θ 0 ∈ Θ where Θ is a compact subset of Θ(r) defined in (3.6). Then,

1. If r = 1, then θ n a.s.
-→ n→∞ θ 0 .

2. If r = 2, and if Γ M defined in (5.21) is a definite positive symmetric matrix, then

√ n θ n -θ 0 D -→ n→∞ N 2p+q+2 0 , (σ 2 ζ -1) Γ -1 M .
imsart-ejs ver. 2014/10/16 file: ArticleBBD4.tex date: February 20, 2017

To our knowledge, this is the first statement the asymptotic properties of Laplacian-QMLE for APARCH processes.

2/ ARMA-GARCH processes. ARMA(p, q)-GARCH(p ′ , q ′ ) processes have been introduced by [START_REF] Ding | A Long Memory Property of Stock Market Returns and a New Model[END_REF] and [START_REF] Ling | Asymptotic theory for a vector ARMA-GARCH model[END_REF] as the solution of the system of equations

   P θ (L) X t = Q θ (L) ε t , ε t = σ t ζ t , with σ 2 t = c 0 + p ′ i=1 c i ε 2 t-i + q ′ i=1 d i σ 2 t-i (3.7)
where

• c 0 > 0, c i ≥ 0 for i = 1, . . . , p ′ , d i ≥ 0 for i = 1, . . . , q ′ , q ′ i=1 d i < 1 and c p ′ , d q ′ positive; • P θ (x) = 1 -a 1 x -• • • -a p x p and Q θ (x) = 1 -b 1 x -• • • -b q x q are coprime polynomials with p i=1 |a i | < 1 and p i=1 |b i | < 1. Let θ = (c 0 , c 1 , . . . , c p ′ , d 1 , . . . , d q ′ ,
a 1 , . . . , a p , b 1 , . . . , b q ). We are going to use Lemma 2.1. Since (ε t ) is supposed to be a GARCH(p ′ , q ′ ), then f ε θ = 0 and

M ε θ = 1 - q ′ j=1 d j L j -1 c 0 + c 1 ε 2 t-1 + • • • + c p ′ ε 2 t-p ′
1/2 and direct computations imply that the Lipshitz coefficients of (ε t ) are such as α (0) [START_REF] Berkes | The efficiency of the estimators of the parameters in GARCH processes[END_REF]). Thus (A 0 (f ε , {θ 0 })) and (A 0 (M ε , {θ 0 })) hold. Considering the ARMA part and denoting (ψ j ) such as 1

j (f ε , {θ 0 }) = 0 and α (0) j (M ε , {θ 0 }) = |β j | with 1 + ∞ j=1 β j x j 1 - q ′ j=1 d j x j = p ′ j=0 c j x j . Therefore (α (0) j (f ε , {θ 0 })) j and (α (0) j (M ε , {θ 0 })) j are EDS (see for instance
+ ∞ j=1 ψ j x j 1 - ∞ j=1 a j x j = 1 - ∞ j=1 b j x j ,
then from Lemma 2.1 we deduce that:

α (0) j (f, {θ 0 }) = |ψ j | α (0) j (M, {θ 0 }) ≤ j k=1 |ψ k | × |β j-k | .
Then we deduce that (α (0) j (f, {θ 0 })) j and (α (0) j (M, {θ 0 })) j are EDS, (A 0 (f, {θ 0 })) and (A 0 (M, {θ 0 })) hold, and X is a.s. a solution of (1.1) for θ included in the r-order stationarity set Θ(r) defined by

Θ(r) = θ ∈ R p+q+p ′ +q ′ +1 ∞ i=1 |ψ i (θ)| + E |ζ 0 | r 1/r ∞ j=1 j k=1 |ψ k | × |β j-k | < 1 .
(3.8)

Now the strong consistency and asymptotic normality of the Laplacian-QMLE for ARMA-GARCH processes can be established:

Proposition 3.2. Assume that X is a stationary solution of (3.7) with θ 0 ∈ Θ where Θ is a compact subset of Θ(r) defined in (3.8). Then,

1. If r = 1, then θ n a.s.
-→ n→∞ θ 0 .

2. If r = 2, and if Γ f and Γ M defined in (5.21) are definite positive symmetric matrix, then the asymptotic normality

(3.3) of θ n holds.
This result is a new one and extends the previous results already obtained with Gaussian-QMLE for such processes (see for instance, [START_REF] Ling | Asymptotic theory for a vector ARMA-GARCH model[END_REF] and [START_REF] Bardet | Asymptotic normality of the Quasi-Maximum likelihood estimator for multidimensional causal process[END_REF]).

3/ ARMA-ARCH(∞) processes. ARMA(p, q)-ARCH(∞) processes are a natural extension of ARMA-GARCH processes. They are the solution of the system of equations

   P θ (L) X t = Q θ (L) ε t , ε t = σ t ζ t , with σ 2 t = c 0 + ∞ i=1 c i ε 2 t-i (3.9)
where

• c 0 > 0, c i ≥ 0 for i ≥ 1;
imsart-ejs ver. 2014/10/16 file: ArticleBBD4.tex date: February 20, 2017

• P θ (x) = 1 -a 1 x -• • • -a p x p and Q θ (x) = 1 -b 1 x -• • • -b q x q
are coprime polynomials with p i=1 |a i | < 1 and p i=1 |b i | < 1. ARCH(∞) processes were introduced by [START_REF] Robinson | Testing for strong serial correlation and dynamic conditional heteroskedasticity in multiple regression[END_REF] and the asymptotic properties of Gaussian-QMLE were studied in [START_REF] Robinson | Pseudo-maximum likelihood estimation of ARCH(∞) models[END_REF], [START_REF] Straumann | Quasi-maximum-likelihood estimation in conditionally heteroscedastic time series: A stochastic recurrence equations approach[END_REF] or [START_REF] Bardet | Asymptotic normality of the Quasi-Maximum likelihood estimator for multidimensional causal process[END_REF]. Hence, we assume that there exists β = (β 1 , • • • , β m ) such as for all i ∈ N, c i = c(i, β), with c(•) a known function. Let θ = (β, a 1 , . . . , a p , b 1 , . . . , b q ). We are going to use Lemma 2.1. Since (ε t ) is supposed to be an ARCH(∞), then

f ε θ = 0 and M ε θ = c(0, β) + ∞ i=1 c(i, β)ε 2 t-i
1/2 and direct computations imply that the Lipshitz coefficients of (ε t ) are such as α (0)

j (f ε , {θ 0 }) = 0 and α (0) j (M ε , {θ 0 }) = c(j, β 0
). Therefore we assume that there exists ℓ > 1 such as c(j, β 0 ) = O j -ℓ ) when j → ∞.

(3.10)

Thus (A 0 (f ε , {θ 0 })) and (A 0 (M ε , {θ 0 })) hold.
Considering the ARMA part and denoting (ψ j ) such as 1

+ ∞ j=1 ψ j x j 1 - ∞ j=1 a j x j = 1 - ∞ j=1 b j x j
, then from Lemma 2.1 we deduce that:

α (0) j (f, {θ 0 }) = |ψ j | α (0) j (M, {θ 0 }) ≤ j k=1 |ψ k | × c(j, β 0 ) .
Then we deduce that (α

(0) j (f, {θ 0 })) j is EDS and (α (0) j (M, {θ 0 })) j = O j -ℓ ). Then (A 0 (f, {θ 0 })) and (A 0 (M, {θ 0 }))
hold, and X is a.s. a solution of (1.1) for θ included in the r-order stationarity set Θ(r) defined by

Θ(r) = θ ∈ R p+q+m ∞ i=1 |ψ i (θ)| + E |ζ 0 | r 1/r ∞ j=1 j k=1 |ψ k | × c(j, β 0 ) < 1 . (3.11)
Now the strong consistency and asymptotic normality of the Laplacian-QMLE for ARMA-ARCH(∞) processes can be established:

Proposition 3.3. Assume that X is a stationary solution of (3.9) where (3.10) holds and with θ 0 ∈ Θ where Θ is a compact subset of Θ(r) defined in (3.11). Then, 1. If r ≥ 1 and ℓ ≥ 2/ min(r, 2), then θ n a.s.

-→ n→∞ θ 0 .

2. If r = 2, ℓ > 1 and if ∂ i β c(j, β) = O j -ℓ for i = 1, 2, and if Γ f and Γ M defined in (5.21) are definite positive symmetric matrix, then the asymptotic normality (3.3) of θ n holds. This result is a new one. Note that ℓ > 1 and r = 2 is required for the asymptotic normality of Laplacian-QMLE while r = 4 and ℓ > 2 is required for Gaussian-QMLE for such processes (see for instance [START_REF] Bardet | Asymptotic normality of the Quasi-Maximum likelihood estimator for multidimensional causal process[END_REF]). This confers a clear advantage to Laplacian-QMLE.

4/ ARMA-APARCH processes. The ARMA(p, q)-APARCH(p ′ , q ′ ) processes have been also introduced by [START_REF] Ding | A Long Memory Property of Stock Market Returns and a New Model[END_REF] as the solutions of the equations

   P θ (L) X t = Q θ (L) ε t , ε t = σ t ζ t , with σ δ t = ω + p ′ i=1 α i (|ε t-i | -γ i ε t-i ) δ + q ′ j=1 β j σ δ t-j
(3.12)

where:

• δ ≥ 1, ω > 0, -1 < γ i < 1 and α i ≥ 0 for i = 1, . . . , p ′ -1, β j ≥ 0 for j = 1, . . . , q ′ -1, α p ′ , β q ′ positive real numbers and p ′ j=1 α j < 1;

• P θ (x) = 1 -a 1 x -• • • -a p x p and Ψ θ (x) = 1 -b 1 x -• • • -b q x q are coprime polynomials with p i=1 |a i | < 1 and q i=1 |b i | < 1 .
Let θ = (δ, ω, α 1 , . . . , α p ′ , γ 1 , . . . , γ p ′ , β 1 , . . . , β q ′ , a 1 , . . . , a p , b 1 , . . . , b q ). Then, as for ARMA-GARCH processes, we are going to use Lemma 2.1. Thanks to the computations realized for APARCH processes, we obtain α

(0) j (M ε , {θ 0 }) = max(|b + j | 1/δ , |b - j | 1/δ ) with (b + i , b - i ) i≥1 defined in (3.5). Then, we have α (0) j (f, {θ 0 }) ≤ |ψ j | α (0) j (M, {θ 0 }) ≤ j k=1 |ψ k | × max |b + j-k | 1/δ , |b - j-k | 1/δ . (ψ j ) such as 1 + ∞ j=1 ψ j x j 1 - ∞ j=1 a j x j = 1 - ∞ j=1 b j x j .
From Lemma 2.1, (A 0 (f, Θ)) and (A 0 (M, Θ)) hold since (α (0) j (f ε , {θ 0 })) j = 0 and (α (0) j (M ε , {θ 0 })) j are EDS. As a consequence, for r ≥ 1, the stationarity set Θ(r) is defined by

Θ(r) = θ ∈ R p+q+p ′ +q ′ +2 ∞ j=1 |ψ j | + E ζ 0 | r 1/r ∞ j=1 j k=1 |ψ k | × max |b + j-k | 1/δ , |b - j-k | 1/δ < 1 .
Now, we are able to provide the asymptotic properties of QMLE for ARMA-APARCH models.

Proposition 3.4. Assume that X is a stationary solution of (3.12) with θ 0 ∈ Θ where Θ is a compact subset of Θ(r) defined in (3.8). Then,

1. If r = 1, then θ n a.s.
-→ n→∞ θ 0 .

2. If r = 2, and if Γ f and Γ M defined in (5.21) are definite positive symmetric matrix, then the asymptotic normality (3.3) of θ n holds.

This result is stated for the first time for Laplacian-QMLE. The case of Gaussian-QMLE for ARMA-APARCH could be also obtained following the previous decomposition and the paper [START_REF] Bardet | Asymptotic normality of the Quasi-Maximum likelihood estimator for multidimensional causal process[END_REF]. Once again, the asymptotic normality of Laplacian-QMLE only requires r = 2 while this requires r = 4 for Gaussian-QMLE.

Numerical Results

To illustrate the asymptotic results stated previously, we realized Monte-Carlo experiments on the bevarior of Laplacian-QMLE (denoted θ LQL n ) for several time series models, sample sizes and probability distributions. A comparison with the results obtained by Gaussian QMLE (denoted θ GQL n ) is also proposed. More precisely, the considered probability distributions of (ζ t ) are:

• Centred Gaussian distribution denoted N ; • Centred Laplacian distribution denoted L; • Centred Uniform distribution denoted U; • Centred Student distribution with 3 freedom degrees, denoted t 3 ; • Normalized centred Gaussian mixture with probability distribution 0.05 * N (-2, 0.16)+N (0, 1)+0.05 * N (2, 0.16) and denoted M.

All these probability distributions are normalized such as E[|ζ 0 |] = 1, required for Laplacian-QMLE. For using Gaussian-QMLE requiring σ 2 ζ = 1, it is necessary to consider the model with

M ′ θ = E[|ζ0|] σ ζ M θ instead of M θ .
Several models of time series satisfying (1.1) and the assumptions of Theorem 3.1 and 3.3 are considered:

• a ARMA(1, 1) process defined by X t = φ X t-1 + ζ t + θζ t-1 with φ = 0.4 and θ = 0.6;

• a ARCH(1) process defined by X t = ζ t ω + αX 2 t-1
with ω = 0.4 and α = 0.2;

• a GARCH(1, 1) process defined by X t = ζ t σ t where σ 2 t = α 0 + α 1 X 2 t-1 + βσ 2 t-1 with α 0 = 0.2, α 1 = 0.4 and β = 0.2; • a ARMA(1, 1)-GARCH(1, 1) process defined by X t = φX t-1 + ε t + θε t-1 where ε t = ζ t σ t and σ 2 t = α 0 + α 1 ε 2 t-1 + βσ 2 t-1 with φ = 0.4, θ = 0.6, α 0 = 0.2, α 1 = 0.4 and β = 0.1; • a ARMA(1, 1)-APARCH(1, 1) process defined by X t = φX t-1 + ε t + θε t-1 where ε t = ζ t σ t and σ δ t = α 0 + α 1 |ε t-1 |γε t-1 δ + βσ δ t-1 and φ = 0.4, θ = 0.6, α 0 = 0.2, α 1 = 0.4, γ = 0.5, β = 0.1 and δ = 1.2. for ARMA(1, 1), ARCH(1) and GARCH(1, 1) processes. Hence we computed the root-mean-square error (RMSE) from 1000 independent replications of θ LQL n and θ LQL n for those processes and the results are presented in Table 1 on page 10 and 2 on page 11.

L N t 3 U M n θ GQL n θ LQL n θ GQL n θ LQL n θ GQL n θ LQL n θ GQL n θ LQL n θ GQL n θ LQL n ARMA(1,

Conclusion of the numerical results:

On the one hand, it is clear that the RMSE decreases as the sample size increases, which validates the theoretical results (consistency of the estimators). On the other hand, Table 1 and2 show that the Laplacian-QMLE provides more accurate estimation than the Gaussian-QMLE for several types of noise, except of course in the case of a Gaussian distribution (even in this case the RSME of both the estimators are almost the same).

Proofs

Proof of Lemma 2.1. First, as X is a stationary process and the ARMA(p, q) process is causal invertible then X is also a stationary process (the coefficients of Λ β0 are EDS). Moreover, it is well known that (ψ j (β 0 )) j∈N is EDS. Then we have: for ARMA(1, 1)-GARCH(1, 1) and ARMA(1, 1)-APARCH(1, 1) processes. Finally, for i = 0,

X t = Λ β0 (L) M θ0 (X t-i ) i≥1 ζ t + f θ0 (X t-i ) i≥1 X t + ∞ j=1 ψ j (β 0 ) X t-j = M θ0 (Λ -1 β0 (L) X t-i ) i≥1 ζ t + f θ0 (Λ -1 β0 (L) X t-i ) i≥1 X t = M θ0 ( X t-i ) i≥1 ζ t + f θ0 ( X t-i ) i≥1 with M θ0 (x t-i ) i≥1 = M θ0 (Λ -1 β0 (L)x t-i ) i≥1 f θ0 (x t-i ) i≥1 = f θ0 (Λ -1 β0 (L)x t-i ) i≥1 - ∞ j=1 ψ j (β 0 )x t-j . ( 5
L N t 3 U M n θ GQL n θ LQL n θ GQL n θ LQL n θ GQL n θ LQL n θ GQL n θ LQL n θ GQL n θ LQL n ARMA(1,
f θ0 (x t-i ) i≥1 -f θ0 (y t-i ) i≥1 ≤ ∞ j=1 α (0) j (f, {θ 0 }) (Λ -1 β0 (L)x t-j-i ) i≥1 -(Λ -1 β0 (L)y t-j-i ) i≥1 +|ψ j (β 0 )| |x t-j -y t-j | ≤ ∞ j=1 α (0) j (f, {θ 0 }) ∞ k=0 |ψ k (β 0 )| |x t-k-j -y t-k-j + |ψ j (β 0 )| |x t-j -y t-j | ≤ ∞ j=1 |ψ j (β 0 )| + j k=1 α (0) k (f, {θ 0 })ψ j-k (β 0 ) |x t-j -y t-j =⇒ α (0) j ( f , { θ 0 }) ≤ |ψ j (β 0 )| + j k=1 α (0) k (f, {θ 0 }) ψ j-k (β 0 ) . (5.2)
Moreover, we also have:

M θ0 (x t-i ) i≥1 -M θ0 (y t-i ) i≥1 ≤ ∞ j=1 α (0) j (M, {θ 0 }) (Λ -1 β0 (L)x t-j-i ) i≥1 -(Λ -1 β0 (L)y t-j-i ) i≥1 =⇒ α (0) j ( M , { θ 0 }) ≤ j k=1 α (0) k (M, {θ 0 }) ψ j-k .
(5.

3)

The same kinds of computations could also be done by considering the first and second derivatives of f and M with respect to θ. Note, and this is important, that the first and second derivatives of Λ -1 β with respect to θ are also EDS. Finally,

• if when j → ∞, α (0) j (K, {θ 0 }) = O(j -β
) with β > 1 and ψ j = O(ρ j ) with 0 ≤ ρ < 1, then there exists C > 0 such as

j k=1 α (0) k (K, {θ 0 }) ψ j-k ≤ C j k=1 k -β ρ j-k ∼ -C(log ρ) -1 j -β and therefore α (0) j ( K, { θ 0 }) = O(j -β ).
• if when j → ∞, α (0) j (K, {θ 0 }) = O(r j ) with 0 ≤ r < 1 and ψ j = O(ρ j ) with 0 ≤ ρ < 1, then there exists C > 0 such as

j k=1 α (0) k (K, {θ 0 }) ψ j-k ≤ C j k=1 r -k ρ j-k = O(j max(r, ρ) j ) and therefore α (O) j ( K, { θ 0 }) is EDS.
The same kind of computation can be also done for (α (i) j ( K, { θ 0 })) j since the derivatives and second-derivatives of Λ -1 β0 with respect to β and therefore to θ are also EDS. Now we remind two lemmas already proved in [START_REF] Bardet | Asymptotic normality of the Quasi-Maximum likelihood estimator for multidimensional causal process[END_REF]:

Lemma 5.1. Assume that θ 0 ∈ Θ(r) for r ≥ 1 and X is the causal stationary solution of the equation (1.1).

If (A 0 (K, Θ)) holds (with K = f or K = M ) then K t θ ∈ L r (C(Θ, R m ))
and there exists C > 0 not depending on t such that

E K t θ -K t θ r Θ ≤ C E |X 0 | r j≥t α j (K, Θ)
r for all t ∈ N * .

(5.4) Lemma 5.2. Let D (2) (Θ) denote the Banach space of 2 times continuously differentiable functions on Θ equipped with the uniform norm

h 2,Θ = h Θ + ∂h ∂θ Θ + ∂ 2 h ∂θ∂θ ′ Θ .
Let θ 0 ∈ Θ(r) (r ≥ 1) and assume that for i = 0, 1, 2, (A i (f, Θ)) and

(A i (M, Θ)) hold. Then f t θ ∈ L r D (2) (Θ) and M t θ ∈ L r D (2) (Θ) .
Now, we begin with the proofs of Theorem 3.1, 3.2 and 3.3.

Proof of Theorem 3.1. The proof of the theorem is divided into two parts and follows the same kind of procedure than in [START_REF] Jeantheau | Strong consistency of estimators for multivariate arch models[END_REF]. In (i), a uniform (on Θ) strong law of large numbers satisfied by 1 n L n (θ) converging to L(θ) := -E[q 0 (θ)] is established. In (ii), it is proved that L(θ) admits a unique maximum in θ 0 . Those two conditions lead to the strong consistency of θ n (from Jeantheau (1998)).

imsart-ejs ver. 2014/10/16 file: ArticleBBD4.tex date: February 20, 2017 (i) In the same way and for the same reason in the proof of Theorem 1 of [START_REF] Bardet | Asymptotic normality of the Quasi-Maximum likelihood estimator for multidimensional causal process[END_REF], the uniform strong law of large numbers satisfied by the sample mean of ( q t ) t∈N * (defined in (2.3)]) is implied by establishing E[ q t (θ) Θ ] < ∞. But new computations have to be done in case of Laplacian conditional log-density q t (θ). From Lemma 5.1, for all t ∈ Z,

|q t (θ)| = (M t θ ) -1 |X t -f t θ | + log(M t θ ) ≤ |X t -f t (θ)| M + log(M ) + M t θ =⇒ sup θ∈Θ |q t (θ)| ≤ 1 M |X t | + f t (θ) Θ + log(M ) + M t θ Θ . With r ≥ 1, we have ∀t ∈ Z, E[|X t |] < ∞ from Proposition 2.1 and E f t θ r Θ + M t θ r Θ < ∞ from Lemma 5.1, implying E f t θ Θ + M t θ Θ < ∞. As a consequence, for all t ∈ Z, E q t (θ) Θ < ∞.
Hence, the uniform strong law of large numbers for (q t (θ)) follows:

L n (θ) n -L(θ) Θ a.s.
-→ n→∞ 0.

(5.5)

Now, we are going to establish

1 n L n (θ) -L n (θ) Θ a.s.
-→

By Corollary 1 of [START_REF] Kounias | An inequality and almost sure convergence[END_REF], the proof is achieved if there exists s ∈ (0, 1] such as

t≥1 1 t s E q t (θ) -q t (θ) s Θ < ∞. (5.6) Let us prove (5.6) with s = r/2 when r ∈ [1, 2].
From Cauchy-Schwarz Inequality and assumptions A 0 (f, Θ) and A 0 (M, Θ),

E q t (θ) -q t (θ) r/2 Θ ≤ C E (1 + |X t | + f t θ Θ ) r 1 2 E ( M t θ -M t θ Θ + f t θ -f t θ Θ ) r 1 2 .
Using Lemma 5.1 and previous proved results implying E

[|X t | r ] < ∞, E[ f t θ r Θ + M t θ r Θ ] < ∞, we obtain E q t (θ) -q t (θ) r/2 Θ ≤ C j>t α (0) j (f, Θ) + α (0) j (M, Θ) r 2 ≤ C t -(ℓ-1)r 2 ,
where the last inequality is obtained from the condition (3.1) of Theorem 3.1. Hence, we have which is finite when r ℓ > 2. When r ≥ 2, it is sufficient to consider the case r = 2. As a consequence, we obtain

t≥1 1 t r/2 E | q t (θ) -q t (θ)| r/2 Θ ≤ A t≥1 t -r ℓ/
1 n n t=1 q t (θ) -q t (θ) Θ a.s. -→ n→∞ 0 and 1 n L n (θ) -L n (θ) Θ a.s.
-→ n→∞ 0, (5.7) and therefore, using (5.5),

1 n L n (θ) -L(θ) Θ a.s.
-→ n→∞ 0.

(5.8)

M t θ > 0 (> 0 is replaced by = 0 if M θ = M θ0
). This implies from Condition C3 (Identifiability) that L(θ 0 )-L(θ) > 0 almost surely for all θ ∈ Θ, θ = θ 0 . Hence a supremum of L(θ) is only reached for θ = θ 0 which is the unique maximum.

Proof of Theorem 3.2. We follow the same scheme of proof than in [START_REF] Davis | Least Absolute Deviation Estimation for Regression with ARMA Errors[END_REF]. Hence, denote

S n = n t=1 V t-1 |Z t -n -1/2 Y t-1 | -|Z t | = -n -1/2 n t=1 V t-1 Y t-1 sgn(Z t ) +2 n t=1 V t-1 (n -1/2 Y t-1 -Z t ) 1 0<Zt<n -1/2 Yt-1 -1 n -1/2 Yt-1<Zt<0 = A n + B n . Since E V t-1 Y t-1 sgn(Z t ) | F t-1 = E[sgn(Z t )] E V t-1 Y t-1 = 0 and E V 2 0 Y 2 0
< ∞, we can apply a central limit theorem for stationary martingale difference sequence (see [START_REF] Billingsley | Convergence of Probability Measures[END_REF]) and

A n D -→ n→∞ N 0 , E V 2 0 Y 2 0 .
(5.9) Then,

I 1 (v) = n -1/2 n t=1 (M t θ0 ) -1 v ′ ∂M t θ ∂θ θ0 |ζ t | -1 + 1 2n with θ t M in the segment [θ 0 , θ 0 + n -1/2 v].

First we have:

2/ Now, we consider the approximation W n (v) of W n (v) defined by:

W n (v) = - n t=1 q t (θ 0 + n -1/2 v) -q t (θ 0 ) for any v ∈ R d .
From the assumptions of Theorem 3.1 and (5.7) we have

1 n n t=1 q t (θ) -q t (θ) Θ a.s. -→ n→∞ 0. Then we have W n (v) = W n (v) + R n (v) with sup v∈R d |R n (v)| ≤ 2 n t=1 q t (θ) -q t (θ) Θ a.s.
-→ n→∞ 0 and then:

W n (v) D -→ n→∞ W (v) (5.22)
with W defined in (5.20).

3/ Now, from (5.22), the proof of Theorem 3.2 and the same arguments than in the proof of Theorem 2 of [START_REF] Davis | Least Absolute Deviation Estimation for Regression with ARMA Errors[END_REF], we deduce that finite distributions ( W n (v 1 ),

• • • , W n (v k )) converge to (W (v 1 ), • • • , W (v k )) for any (v 1 , • • • , v k ) ∈ (R d ) k
. Moreover, always following the proof of Theorem 2, (W n (v)) v converges to (W (v)) v as a process on the continuous function space C 0 . As a consequence, a maximum v of W n (v) satisfies:

v = Γ M + 2g(0) Γ F -1 N,
with N defined in (5.21) and this implies (3.3).

Proof of Proposition 3.1. First, Condition C2 is satisfied since b 0 > 0. Other conditions on Lipschitz coefficients are also satisfied from Lemma 2.1 (see the arguments above). The identifiability condition C3 is also satisfied from the following which are divided into two parts. In (i) we proof that δ, b 0 , (b + i (θ), b - i (θ)) i≥1 (defined in (3.5)) are unique, thereafter in (ii) we proof that θ = ω, (α i ) 1≤i≤p , (γ i ) 1≤i≤p , (β i ) 1≤i≤q is also unique. (i) The proof of this result follow the same reasoning in [START_REF] Berkes | GARCH processes: structure and estimation[END_REF]. ). In one hand, since x ∈ (0, ∞) → x δ is a one-to-one map and since P(X t = ±1, ∀t ∈ Z) = 0, we have δ = δ ′ . In the other hand, by definition of m, we have

(b + ′ m -b + m )(max(X t-i , 0)) δ + (b -′ m -b - m )(max(-X t-m , 0)) δ = b 0 -b ′ 0 + i≥m+1 (b + i -b + ′ i )(max(X t-i , 0)) δ + i≥m+1 (b - i -b -′ i )(max(-X t-i , 0
+ ′ m -b + m )σ δ t-m ) -1 i≥m+1 (b + i -b + ′ i )(max(X t-i , 0)) δ when ζ t-m ≥ 0 or (-ζ t-m ) δ = ((b -′ m -b - m )σ δ t-m ) -1 i≥m+1 (b - i -b -′ i )(max(X t-i , 0)) δ when ζ t-m < 0
Since σ δ t-m > b 0 > 0, ζ δ t-m is well defined. Let F k be the F -algebra generated by (ζ i , i < k). The causal representation of tha APARCH(δ, p, q) shows that X j is F j -measurable and thus the right-hand side of the above equations (and imsart-ejs ver. 2014/10/16 file: ArticleBBD4.tex date: February 20, 2017 consequently also ζ δ t-m in the case ζ t-m ≥ 0 or the case ζ t-m < 0) is a real-valued random variable, measurable with respect to F t-m-1 . Since (ζ j ) is a sequence of independent random variables, this implies that ζ t-m is a.s. constant when ζ t-m ≥ 0 or when ζ t-m < 0, contradicting the hypothesis saying ζ δ 0 has a non-degenerate distribution. This achieves (i).

(ii) The representation (5.23) is the same as σ δ t = b 0 + Ψ + (L)(max(X t , 0)) δ + Ψ -(L)(max(-X t , 0)) δ .

with Ψ + = Υ -1 θ1 ∆ + θ2 , Ψ -= Υ -1 θ1 ∆ - θ2 and ∆ + θ2 (L) = p i=1 α i (1γ i )L i , ∆ - θ2 (L) = p i=1 α i (1 + γ i )L i and Υ θ1 (L) = q i=1 β i L i , where (∆ + θ2 , Υ θ1 ) and (∆ - θ2 , Υ θ1 ) respectively coprime and θ 1 = (β i ) 1≤i≤q , θ 2 = (α i ) 1≤i≤p , (γ i ) 1≤i≤p , then θ = (ω, θ 1 , θ 2 ). Suppose that there exist others polynomials ∆ +

θ ′ 2 = p i=1 α ′ i (1 -γ ′ i )L i , ∆ - θ ′ 2 = p i=1 α ′ i (1 + γ ′ i )L i , Υ θ ′ 2 = q i=1 β ′ i L i satisfying Ψ + = Υ -1

  ε , {θ 0 }) = 0 imsart-ejs ver. 2014/10/16 file: ArticleBBD4.tex date: February 20, 2017 and α

  First we haveσ δ t = b 0 (θ) + i≥1 b + i (θ)(max(X t-i , 0)) δ + i≥1 b - i (θ)(max(-X t-i , 0)) δ .(5.23)We prove the result by contradiction. Suppose that there exist two vectorsβ = δ, b 0 , (b + i ) i≥1 , (b - i ) i≥1 and β ′ = δ ′ , b ′ 0 , (b + ′ i ) i≥1 , (b -′ i ) i≥1 verifying (5.23). Let m > 0 be the smallest integer satisfying b + m = b + ′ m or b - m = b -′ m (if b + i = b + ′ i and b - i = b -′ i ∀i ≥ 1 then b 0 = b ′ 0

  we have X t-m = σ t-m ζ t-m , therefore (b + ′ mb + m )(max(X t-m , 0)) δ + (b -′ mb - m )(max(-X t-m , 0)) (-ζ t-m ) δ when ζ t-m <0 Moreover (5.24) and the fact that b + m = b + ′ m or b - m = b -′ m implies that at least one of the following equalities hold        ζ δ t-m = ((b

  Root Mean Square Error of the components of θ LQL

imsart-ejs ver. 2014/10/16 file: ArticleBBD4.tex date: February 20, 2017 Table 1 n and θ GQL n

imsart-ejs ver. 2014/10/16 file: ArticleBBD4.tex date: February 20, 2017

Acknowledgements. The authors are grateful to the referees and associated editor for their comments which helped to improve the contents of this paper.

Now, considering B n , define also W nt = V t-1 (n -1/2 Y t-1 -Z t ) 1 0<Zt<n -1/2 Yt-1 . Using the same arguments as in [START_REF] Davis | Least Absolute Deviation Estimation for Regression with ARMA Errors[END_REF], we also obtain

Then we deduce

(5.10)

The proof is achieved from (5.9) and (5.10).

Proof of Theorem 3.3. We follow a proof which is similar to the one of Theorem 2 in [START_REF] Davis | Least Absolute Deviation Estimation for Regression with ARMA Errors[END_REF] or [START_REF] Li | Least Absolute Deviation Estimation for Fractionally Integrated Autoregressive Moving Average Time Series Models with Conditional Heteroscedasticity[END_REF].

Then we are going to prove in 2/ that maximizing L n (θ) is equivalent to maximizing L n (θ) which is equivalent to maximizing

with respect to v. As a consequence, there exists a sequence (

. In 1/ we will provide a limit theorem satisfied by W n (v). Then we are going to prove in 3/ that (W n (•)) n converges as a process of C(R d ) (space of continuous functions on R d ) to a limit process W . Hence ( v n ) n converges to the maximizer of W .

1/ First, we are going to study the asymptotic behavior of W n (v). We have

We have:

Using Taylor expansions, we deduce that for each t ∈ {1, • • • , n}, there exists θ t 1 and θ t 2 in the segment [θ 0 , θ 0 +n -1/2 v] such as:

Thus, Condition C3 is established and the proof of proposition is achieved.

Proof of Proposition 3.2. Since we prove that Lemma 2.1 implies that conditions on Liptshitzian coefficients (α (i) j (f, Θ)) j and (α (i) j (M, Θ)) j , it remains to prove conditions C2 and C3. Condition C2 holds since c 0 is supposed to be a positive number. Finally, condition C3 also holds since f θ = f θ ′ implies ψ j (θ) = ψ j (θ ′ ) for all j ∈ Z. Therefore the parameters of the ARMA part of the process are identified and then the identification of the parameters GARCH can be deduced from the proof of Proposition 3.1.

Proof of Proposition 3.4. This proofs mimics exactly the proof of Proposition 3.2.


PhD Marc Sango
email: marc.sango@ifsttar.fr

A Component-Based Model-Driven Approach with traceability of concerns: Railway RBC Handover Case Study

Keywords: Traceability, Model, Verification, RBC handover, ERTMS/ETCS

    A Component-Based Model-Driven Approach with traceability of concerns: Railway RBC Handover Case Study

Introduction

Traceability and verification of requirements are key activities in the development process of safety-critical software systems, such as railway control and protection software, because these systems emphasize high qualities in term of Safety Integrity Level (EN-50128, 2011). For this reason certification agencies conduct reviews on the entire range of system development process to get the traceability information. To establish relationships between elements specified as requirements and elements implemented in the final system, software developers and testers are usually asked to provide accurate traceability information in order to guarantee that critical requirements are properly designed and implemented. In addition, information obtained from the traceability management can be used in different activities, such as change impact assessment [START_REF] Zhao | Change impact analysis to support architectural evolution[END_REF]. Unfortunately, traceability information becomes obsolete very quickly during software development without the automatic or semiautomatic support to maintain traceability links among software artefacts [START_REF] Mäder | Enabling automated traceability maintenance through the upkeep of traceability relations[END_REF].

The advent of Model Driven Engineering (MDE) [START_REF] Schmidt | Model-driven engineering[END_REF], which principles are to enhance the role of models and to increase the level of automation, provides a new landscape for dealing with traceability of concerns in software development process [START_REF] Santiago | Modeldriven engineering as a new landscape for trace-ability management: A systematic literature review[END_REF]. Indeed, the trace maintenance can be seen mainly as links between the elements of those models at different abstraction levels, from the user requirements, the architecture design specification and the source code. In the literature, there are several established traceability techniques [START_REF] Galvao | Survey of traceability approaches in model-driven engineering[END_REF][START_REF] Konigs | Traceability in systems engineering -review of industrial practices, state-of-the-art technologies and new research solutions[END_REF][START_REF] Wen | Formalizing the transition from requirements' change to design change using an evolutionary traceability model[END_REF]. For example, Wen et al. propose a traceability model by comparing multiple versions of software, by visualizing the evolution of architecture components in a graphical form, and by tracing the design evolution back to the requirement evolution [START_REF] Wen | Formalizing the transition from requirements' change to design change using an evolutionary traceability model[END_REF]. Their traceability model is designed specifically for the behaviour engineering approach, which first constructs a formal specification from requirements and then derives the design model.

In contrast, our approach is based on software Component-Based Model-Driven Development (CBMDD) [START_REF] Chen | Refinement and verification in component-based model-driven design[END_REF], which provides an intermediate language for representing requirements in an architectural fashion. CBMDD is based on MDE and Component-Based Software Engineering (CBSE) [START_REF] Szyperski | Component Software: Beyond Object-Oriented Programming[END_REF], which has been acknowledged as a fruitful technology to improve the separation of concerns and to enhance reusability. Particularly, the use of domain-specific software component model allows to abstract domainspecific concerns, whether functional or non-functional, to address special industrial needs [START_REF] Lau | Domain-specific software component models[END_REF]. Although there are many general-purpose and domain-specific component-based approaches [START_REF] Crnkovic | A classification framework for software component models[END_REF][START_REF] Pop | Comparison of component frameworks for real-time embedded systems[END_REF], very few papers address the traceability challenge in software component [START_REF] Gao | Monitoring software components and componentbased software[END_REF][START_REF] Chanda | Traceability between service component and class: A model based approach[END_REF]. As CBMDD spreads to specific critical domains, like aeronautical, automotive or railway control systems (Chess Project, 2012), the traceability challenge must require more attention in this development approach in order to guarantee that critical requirements are properly implemented as proposed in the European INESS Project (INESS Project, 2007) and national projects, such as the French scientific project named PERFECT for Performing Enhanced Rail Formal Engineering Constraints Traceability.

Although the take-up of CBMDD has been particularly evident in the aeronautical and automotive engineering domains, the railway sector lagged behind, partly due to out-dated standards and lack of awareness [START_REF] Favaro | Model-based software design in rail -an European perspective[END_REF]. But the situation is now changing rapidly, and the environment in recent works (e.g., Chess Project, 2012) is representative of the European awareness and push toward implementation of model-based approaches in railway engineering [START_REF] Favaro | Model-based software design in rail -an European perspective[END_REF]. In this way, in our previous works, we have proposed a domain-specific component-based model named SARA, dedicated to SAfetycritical RAilway control applications (Sango et al., 2014a). Then, we have translated this model into Time Automata model over Inputs and Outputs actions (TAIO) [START_REF] Sango | Component-Based Modeling and Observer-Based Verification for Railway Safety-Critical Applications[END_REF]. Beyond this proposal, in this article, we demonstrate the traceability value of our approach and provide a more objective evaluation.

The remainder of the paper is structured as follows. In Section 2, we leverage the literature reviews and briefly present a background on traceability. In Section 3, we give an overview of our approach and our conceptual meta-models for traceability. Then, in Section 4, through an RBC handover case study, we provide a process to apply the meta-models defined. We also analyse the requirement change impact in the modelling and verification process of our case study. Finally, we discuss our approach in Section 5 before concluding and drawing future directions of our research in Section 6.

Background on traceability

Our interest is the traceability of concerns based on component-based model driven approaches. Traceability has been discussed in various domains. The IEEE provides the following definition of traceability (IEEE-Glossary, 1990): "Traceability is the degree to which a relationship can be established between two or more products of the development process, especially products having a predecessor-successor or master-subordinate relationship one another". This definition is adopted in the railway standard of software for railway control and protection system (EN-50128, 2011).

In requirements engineering, a lot of works has been done for tracing requirements from the stakeholders and in the design process [START_REF] Gotel | An analysis of the requirements traceability problem[END_REF][START_REF] Ramesh | Requirements traceability: Theory and practice[END_REF]. Gotel and Finkelstein define requirements traceability as "the ability to describe and follow the life of a requirement, in both a forward and backward direction, i.e. from its origins, through its specification and development, to its subsequent deployment and use, and through periods of on-going refinement and iteration in any of these phases" [START_REF] Gotel | An analysis of the requirements traceability problem[END_REF]. With requirement traceability, we want to understand the impact of software requirement evolution on software design artefacts, particularly in the context of the European system for railway signalling called ERTMS/ETCS system (ERTMS/ETCS, 2014). These system requirements have been specified to replace the many incompatible different Automatic Train Control (ATC) systems used in different countries at different times. However, the specification is not yet stable as illustrate in the different versions of the ERMS/ETCS documents.

As already mentioned in the introduction, without the automatic or semi-automatic support to maintain traceability links among software artefacts, traceability information becomes obsolete very quickly during software development [START_REF] Mäder | Enabling automated traceability maintenance through the upkeep of traceability relations[END_REF]. For this reason, in [START_REF] Galvao | Survey of traceability approaches in model-driven engineering[END_REF], a traceability taxonomy is presented for model driven engineering, which principles are to enhance the role of models and to increase the level of automation [START_REF] Aizenbud-Reshef | Model traceability[END_REF]. Based on this survey, we combine the main advantages of component-based model-driven development [START_REF] Chen | Refinement and verification in component-based model-driven design[END_REF], i.e., domain abstraction, automated refinement and separation of concerns to drive a traceability model based on our domain-specific component-based model-driven approach.

Our component-based model-driven approach

The Overview

Figure 1 shows an overview of our component-based model-driven development process. It is included to the "V development Lifecycle" (V-Lifecycle) prescribed by the CENELEC standard of railway safety-critical software for control and protection systems (EN-50128, 2011). In this V-Lifecycle, we highlight the part of V-Lifecycle that strictly concerns the software development activities, i.e., the surrounded part of the figure. It is based on our component-based development and evolution process named SARA. The SARA approach is a simple domain-specific component based approach, which is firstly dedicated for the modelling and verification of SAfety-critical RAilway control applications (Sango et al., 2014a[START_REF] Sango | Component-Based Modeling and Observer-Based Verification for Railway Safety-Critical Applications[END_REF]. As the V-Lifecycle, the SARA process includes two activities:

1. The component-based software design activities (the left branch of the surrounded part). From the phase of software requirement specifications, we want to separate functional requirements from safety and temporal requirements in software component-based architecture in order to facilitate the traceability of requirement concerns. 2. The verification activities performed at the model level (the right branch of the surrounded part). These verification activities performed at the model level are separated to other verification activities performed at the source code and the system level. They include both a test of individual components and their impact on the overall composite system. With these activities, we want to link back verification results ("ok" or "ko") to initial requirements or intermediated models to ensure that specifications are properly implemented.

The SARA process is based on the core meta-model, which is illustrated with grey colour in the overview Figure 1. This meta-model is used for modelling software requirement concerns, component elements and the traceability links among elements in different abstractions levels, from design level to implementation level and verification level.

The meta-model

Figure 2 shows our component-based meta-model with traceability of concerns. The ConcernModel consists of ConcernGroup, ComponentModel and TraceabilityModel. A ConcernGroup assembles a set of concerns to be modelled. We focus here on ERTMS/ETCS requirement concerns. Each requirement is identified by a unique identifier (Id) and can be described in different ways (natural language, diagram like UML, mathematical expression, etc.). Requirements are either functional requirements or non-functional requirements. A concern-based taxonomy of requirements and traceability between requirements are not detailed here but we are based on taxonomy and relations among system requirements [START_REF] Dubois | A model for requirements traceability in a heterogeneous model-based design process: Application to automotive embedded systems[END_REF]. As our main focus in this paper is the traceability of requirements through multiple abstraction levels of software component-based development process, we focus our discussion on some specific non-functional requirements for our case study. In this context, we focus on safety requirements subjected to real-time constraints (named TSRequirement in Figure 2), which are separated from other non-functional requirements (named OtherNonFunctional in Figure 2). A TraceabilityModel links component units to requirements and vice versa. The linked component units and requirements form a set of traceable elements. Traceable elements are modelled explicitly by a trace, which links one or more source elements to one or more target elements. A Trace link is either an intra view trace link or an inter view trace link as shown in the Figure 2. Indeed, in our traceability context, important information are transformation relationships within or across models in the different abstraction levels. A model could be modified or transformed to another model. As a consequence, an intra view trace link can be a composition relation or dependency relation, while, an inter view trace link can be refinement relation or refactoring relation through the model abstraction levels. Furthermore, to represent explicitly trace links, an explicit trace query is defined within or across views. A Trace can be stored and managed in the traceability matrix, see the meta-model in Figure 2. For this, we characterize each requirement with a verification type (VerifType) and a validation status (ValidStatus). The verification type is a characteristic used to indicate whether the verification used is model or code verification, a test or a formal proof. While, the validation status characterizes the status of the verification process. Initially, the status is unchecked and can be changed to passed, failed or inconclusive, depending on the verification process result.

Case study

We evaluate the applicability of our approach through one relevant and concrete case study of ERTMS/ETCS specification.

A brief presentation of ERTMS/ETCS

The case study presented in this paper is parts of ERTMS/ETCS (ERTMS/ETCS, 2014). The ERTMS is the European Rail Traffic Management System and the ETCS is the European Train Control Sub-system. Figure 3 shows the system architecture of ETCS and its interfaces with the Global System for Mobile communications for Railway (GSM-R) system and other signalling systems, such as specific national systems, interlocking and control centre. The ETCS consists of two parts: the On-board part and the Trackside part. The detail of each part can be found in the specification. As shown in Figure 3, two types of interface specifications have been identified. The first category is the harmonized interfaces, such the interface between the Eurobalise and Eurobalise reader, which is called the Balise Transmission Module (BTM). This category ensures that systems from different suppliers, which meet this specification, can work together without any further precautions. The second category is the non-harmonized interfaces, such as the interface between Radio Block Centre (RBC) and interlocking. This category will depend on the type of interlocking or national systems to be used on an ERTMS project or experimentation. For our experimentation, we add a virtual Computer-Based Interlocking (CBI), as shown in Figure 3, which communicates with interlocking, RBC, Eurobalise and Euroloop to provide the track occupancy information for the RBC handover case study.

RBC handover case study

The ERTMS/ETCS specification defines five application levels to express the possible operating scenarios between Trackside and On-board train sub-systems. These operating scenarios, such as start of mission, RBC handover, level crossing and so on, describe the behaviours and the expectative running modes of train control system. Here, we took the RBC handover scenario as a first case study. The handover procedure is called in order to transfer the train communication from the Handing Over RBC (HO RBC for short) to an Accepting RBC (AC RBC for short) and to avoid communication termination when the train gets outside the range of the HO RBC, as illustrated in Figure 4. In the specification, which can be found in paragraph §5.15 of (ERTMS/ETCS, 2014), there are two kinds of communication methods when the handover is announced: (i) two communication sessions can be handled simultaneously between the train and the both HO RBC and AC RBC, and (ii) only one communication session can be handled between the train and the HO RBC or AC RBC, exclusively. Here, we consider the second method.

Time delay requirements

We focus on non-deterministic time delay performance. For this, we report in Figure 4 the delay scheme to deliver the track occupancy information. In the view of HO RBC, the minimum delivering time delay is d min = AC -CBI2 -Tran -Gen -CBI1 -HO, and the maximum delivering time delay is d max = d min + 3*d position_report . In fact, "in case a communication session is established and no request to terminate the session is received from the HO RBC within a fixed waiting time after sending the position report, the position report shall be repeated with the fixed waiting time after each repetition" ( §5.15.4 of ERTMS/ETCS, 2014). For our evaluation, we allow 3 possible repetitions of position report and each position report takes 60 s, as illustrated in Figure 4. This non-deterministic time delay from d min to d max is exactly what we concerned, and we want to check whether the response of the designed system can meet the time limit of the handover process at any time. At any time, the active handover process requirements considered as the following.

• R1: If an RBC receives track occupancy information during the current MA, it must send to the On-board system a Conditional EMergency stop (CEM) message immediately and it do not need acknowledge;

• R2: If an RBC receives track occupancy information of first section outside the current MA, the RBC determines with time delay d wait if the train must be stopped before this first section to respect safety margin. If not, RBC will send Shorten MA (SMA) message. This message needs to be answered by the train in the delay d ack ;

• R3: If an RBC receives track occupancy information of other section (except the first section) outside the current MA, the RBC will send SMA to train and this message need be answered in d ack ;

• R4: In addition, if an RBC has not received the SMA response message ACK, but receives another track occupancy state information, it will no longer send CEM order to the train, but it will send an upgrade order Unconditional EMergency stop (UEM).

Models: SARA model and TIAO model

The conceptual meta-model of our approach presented in Section 3.2 is implemented with DTD/XML presentation for human-readability and for machine-readability. In addition, DTD/XML implementation can be easily translated in any other implementation language and vice versa. For example, the Ada programming language, which is one of the recommended languages in the development of railway safety-critical applications, can be translated into XML file by using ada-to-xml converter. Figure 5 shows the model abstraction levels of our RBC handover use case, implemented in the RBC-model-views.xml file. It is a 3-layer abstraction levels: SARA component modelling view for the model design level (line 4 of Figure 5), its UPPAAL TAIO analysis view for the model analysis level (line 5 of Figure 5) and its ADA implementation view for the model implementation level (line 6 of Figure 5). By always keeping in mind the separation of concerns, each layer is defined in separate files: RBC-sara-model-view.xml, RBC-Uppaal-verification-view.xml and LC-Adaimplementation-view.xml as shown in Figure 5. In this paper, we focus only on the design layer and the analyse layer for the traceability of the system design specifications to the verification results and vice versa.

Based on the general architecture of Figure 3, which includes RBC component, the SARA model of RBC handover contains three main components: CBI, EVC and RBC. Here, we hide the implementation detail. In the left-hand of Figure 6, we only show its graphical representation in accordance with the requirement specifications presented in Section 4.3. Then, based on our transformation process presented in [START_REF] Sango | Component-Based Modeling and Observer-Based Verification for Railway Safety-Critical Applications[END_REF], the SARA model is translated into the TIAO model. The generated TIAO model is composed with the observer of requirement to be verified. Here, we focus on requirement R2 of Section 4.3. One part of the composition result is given in the right-hand of Figure 6, where, we focus on some specific states relevant for the test realised for this paper.

We realize manually 10 independent testing with UPPAAL-TRON framework [START_REF] Larsen | Testing real-time embedded software using uppaal-tron: An industrial case study[END_REF]. By using the trace query between elements of design and analysis view of Figure 5, the results of testing are linked to requirement specification (R1, R2, R3 and R4) defined in Section 4.3. The left-hand of Figure 7 shows a traceability matrix in Excel file. The verification fails for the requirement R2. The detail of this requirement verification is shown in the right-hand of Figure 7. This means that with input action during the time window (148; 171), the expected state is OK and the output action must be ACK, but we get a KO state with unexpected output UEM.

In deed, at each testing, we specified the four common delay strategy for track occupancy information (TOcc): proceeding delay (PDelay_Of_TOcc), queuing delay (QDelay_Of_TOcc), transmission delay (TDelay_Of_TOcc) and propagation delay (PPDelay_Of_TOcc). But during all the process, the maximum time unit for track occupancy information is set at 200 seconds (T_Delay_Max@200) in order to observe the influence of trans-boundary interlocking message delay.

Analysis of model verification results

This evaluation showed that the time delay parameters in our initial RBC handover specification of Section 4.3 were inconsistent with the designed system. The cause of failure may be various. For example, the interlocking can transfer track occupancy information with a delay so long that exceeds the allowed time limit. Based on the analysing of the last good states and the message delivering time sequence set before the failure, we concluded in the system under verification automata (right-hand of Figure 6) the following failure path:

T1Occ_Out_MA!TWait:SMA?TAck:TOcc_In_MA!UEM?

In the subsequent experiments, we modified the time parameters in the requirement specification model by widening the upper and lower limit value of the delay, and the failure was no longer occurred. Note that our experimentation is realized based on an RBC scenario, which sounds theoretical because we only focus on software control part of RBC handover architecture shown in Figure 4. A concrete implementation must also involve hardware concerns. As a consequence, some statistics are strongly recommended to determine the suitable parameter values (e.g., TWait). In addition, when dealing with the traceability management and the requirement change impact, a rigorous safety risk assessment is required to meet the high Safety Integrity Level (SIL) [START_REF] Beugin | A SIL quantification approach based on an operating situation model for safety evaluation in complex guided transportation systems[END_REF]. For example, in France, when railway functionality is replaced, modified or updated, the well-known safety principle, named GAME for "Globalement Au Moins Equivalent" in French, meaning "globally at least as good", has to be fulfilled.

Related work and discussion

We already introduced some related works [START_REF] Aizenbud-Reshef | Model traceability[END_REF][START_REF] Galvao | Survey of traceability approaches in model-driven engineering[END_REF] in Section 2. However some other specific related works [START_REF] Ledang | Towards a trace-ability model in a marte-based methodology for real-time embedded systems[END_REF][START_REF] Anquetil | A model-driven traceability framework for software product lines[END_REF][START_REF] Wen | Formalizing the transition from requirements' change to design change using an evolutionary traceability model[END_REF] have not yet been discussed. For example, in [START_REF] Ledang | Towards a trace-ability model in a marte-based methodology for real-time embedded systems[END_REF], a traceability management in the context of Accord-UML, a MARTE-based methodology, is proposed and tested in the context of an automobile system design [START_REF] Dubois | A model for requirements traceability in a heterogeneous model-based design process: Application to automotive embedded systems[END_REF]. The traceability facilities provided by the SysML language enable to manage traceability links between requirements concerns and model elements. These works have been one of ours key sources of inspiration. While the technique to link requirement concerns among them and to link requirement concerns to model elements is the same, our approach enable in addition traceability links between model elements in the same design artefact. We have also investigated the feedback of verification results and design artefact evolution to the requirement evolution. The idea is to define a relationship between requirements and verification test cases that can determine whether a system fulfils requirements in our model transformation and verification approach [START_REF] Sango | Component-Based Modeling and Observer-Based Verification for Railway Safety-Critical Applications[END_REF].

The problem of traceability has also been addressed in product lines engineering [START_REF] Anquetil | A model-driven traceability framework for software product lines[END_REF]. In this paper, the main traceability tools (CaliberRM, DOORS, GEARS, SCADE suite, etc.) were evaluated in terms of five criteria: (i) traceability links, (ii) traceability queries, (iii) traceability views, (iv) extensibility, and (v) support for Software Product Line Development (SPLD) and Model-Driven Development (MDD). Their conclusions show that none of the investigated tools had built-in support for the three-mentioned development approaches. In addition, a vast majority of tools is closed, so they cannot be adapted to deal with the issues raised by these development approaches.

In [START_REF] Wen | Formalizing the transition from requirements' change to design change using an evolutionary traceability model[END_REF], an evolutionary traceability model is proposed. They compare multiple versions of software and report the feedback of design evolution to the requirement evolution. Their traceability model is designed specifically for the behaviour engineering approach. In contrast, our approach is based on domain-specific software component-based model-driven development [START_REF] Chen | Refinement and verification in component-based model-driven design[END_REF], which provides a language for representing requirements in an architectural fashion. In addition, as our approach is based on domain engineering, which is the first phase of product lines engineering [START_REF] Alayed | Towards component-based domain engineering[END_REF], our approach can be enhanced to go towards a model-driven traceability framework for software product lines.

Conclusion and future work

The main challenge we face in this paper is how to handle the traceability of requirements in the component-based development process in order to improve the analysis of requirements change impact on software modelling and verification. To face this challenge, we have presented a traceability meta-model, which highlights the separation of concerns provided by component-based development process. The meta-model can be used for modelling the requirement concerns, the component elements and the traceability links within or across different abstraction levels, e.g., component model design level, model analysis levels and model implementation level. The first purpose of our approach is to help to maintain traceability links consistency while software artefacts are evolving. For this, we propose to represent explicitly traceability links in the early development stage. The second purpose is to guarantee that the models used at different stages in the development process correctly fulfil the initial requirement expression. For this, we translate our high-level model to the low-level timed automata model for which we use the appropriate model checker tool for verification tasks. Depending on verification results, the traceability model allows going back in the model or in the specification to update or to change component or requirement parameters.

To evaluate our approach, we experiment the RBC handover use case of the ERTMS/ETCS specification. Although the approach has been shown applicable in this use case and the railroad level crossing use case, not presented in this paper, our approach can be enhanced in different directions. As a consequence, we are following several directions for future work. The first direction is the application of our approach to several use case scenarios to demonstrate the efficiency and the scalability of our approach. The second direction is to enable the automatic connection between our transformation approach and traceability mechanisms in order to update automatically the target models in the case of changes in the source models. In this direction, we also want to take advantage of model driven techniques and traceability of concerns in tooling in order to have validation feedbacks on source models. Concretely, in future work, we will focus on an integrated tool-chain demonstrator that will highlight several main results of this research work.

Figure 1 .

 1 Figure 1. Our SARA component-based development process included in the V-Lifecycle

Figure. 2 .

 2 Figure. 2. Our conceptual traceability meta-model

Figure 3 .

 3 Figure 3. System architecture of the ERTMS/ETCS and its interfaces

Figure 4 .

 4 Figure 4. Example of RBC-RBC handover topography

  Figure 4 shows the main functional steps needed for running from one RBC area to another one: (1) pre-announcement of the transition by the HO RBC; (2) HO RBC requests the track information from AC RBC; (3) generation of Movement Authorization (MA) including the border information and track information from both HO RBC and AC RBC; (4) announcement of the transition (5) transfer of train supervision to the AC RBC.

Figure 5 .

 5 Figure 5. The RBC handover model: the 3-layer abstraction views

Figure 6 .

 6 Figure 6. (Left) The RBC handover scenario; (Right) The RBC handover UPPAAL TAIO model

Figure 7 .

 7 Figure 7. (Left) The requirement validation results; (Right) Focus on requirement R2