Simon Dauguet
email: simon.dauguet@math.u-psud.fr

Wadim Zudilin
email: wzudilin@gmail.com

ON SIMULTANEOUS DIOPHANTINE APPROXIMATIONS TO ζ(2) AND ζ(3)

Keywords:

Introduction It is known that the Riemann zeta function ζ(s) takes irrational values at positive even integers. This follows from Euler's evaluation ζ(s)/π s ∈ Q for s = 2, 4, 6, . . . and from the transcendence of π. Less is known about the values of ζ(s) at odd integers s > 1. Apéry was the first to establish the irrationality of such ζ(s): he proved [Apé79] in 1978 that ζ(3) is irrational. The next major step in the direction was made by Ball and Rivoal [BR01] in 2000: they showed that there are infinitely many odd integers at which Riemann zeta function is irrational. Shortly after, Rivoal demonstrates [Riv02] in 2001 that one of the nine numbers ζ(5), ζ(7), . . . , ζ(21) is irrational, while the second author [Zud01] reduces the nine to four: he proves that at least one of the four numbers ζ(5), ζ(7), ζ(9) and ζ(11) is irrational. Already in 1978, Apéry constructs linear forms in 1 and ζ(2), as well as in 1 and ζ(3), with integer coefficients that produce the irrationality of the two zeta values in a quantitative form: the constructions imply upper bounds µ(ζ(2)) < 11.850878 . . . and µ(ζ(3)) < 13.41782 . . . for the irrationality measures. Recall that the irrationality exponent µ(α) of a real irrational α is the supremum of the set of exponents µ for which the inequality |αp/q| < q -µ has infinitely many solutions in rationals p/q. Hata improves the above mentioned results to µ(ζ(2)) < 5.687 in [Hat95, Addendum] and to µ(ζ(3)) < 7.377956 . . . in [Hat00]. Then Rhin and Viola study a permutation group related to ζ(2) in [RV96] and show that µ(ζ(2)) < 5.441243. They later apply their new permutation group arithmetic method to ζ(3) as well and prove the upper bound µ(ζ(3)) < 5.513891. In an attempt to unify the achievements of Ball-Rivoal and of Rhin-Viola, the second author reinterpreted the constructions using the classical theory of hypergeometric functions and integrals [Zud04]. In his recent work [Zud13], he uses the permutation group arithmetic method and a hypergeometric construction, closely related to the one in this paper, to sharpen the earlier irrationality exponent of ζ(2) by proving that µ(ζ(2)) ≤ 5.09541178 . . . . In this paper, we construct simultaneous rational approximations to both ζ(2) and ζ(3) using hypergeometric tools, and establish from them a lower bound for Z-linear combinations of 1, ζ(2) and ζ(3) under some strong divisibility conditions on the coefficients. Namely, we prove

Theorem 1. Let η and ε be positive real numbers. For m sufficiently large with respect to ε and η, let (a 0 , a 1 , a 2 ) ∈ Q 3 \ {0} be such that Our proof of Theorem 1 heavily rests upon a general version of hypergeometric construction of linear forms in 1 and ζ(2) on one hand, and in 1 and ζ(3) on the other hand; some particular instances of this construction were previously outlined in [START_REF] Zudilin | Arithmetic hypergeometric series[END_REF]. More precisely, the linear forms r n = q n ζ(2)p n and rn = qn ζ(3)pn we construct in the proof are hypergeometric-type series that depend on certain sets of auxiliary integer parameters. Permuting parameters in the sets allows us to gain p-adic information about the coefficients q n , qn , p n and pn . In addition, a classical transformation from the theory of hypergeometric functions implies that q n = qn . The latter fact leads us to simultaneous rational approximations r n = q n ζ(2)p n and rn = q n ζ(3)-pn to ζ(2) and ζ(3), with the following arithmetical and asymptotic properties: Finally, executing the Gosper-Zeilberger algorithm of creative telescoping we find out a recurrence relation satisfied by the linear forms r n and rn . Together with a standard argument using the nonvanishing determinants formed from the coefficients of the forms, we then deduce Theorem 1 (some further computational details can be found in [START_REF] Dauguet | Généralisation du critère d'indépendance linéaire de Nesterenko[END_REF]). Note that τ 0 = 1 8 (32ϕρ) = 0.899668635 . . . and S = 1 8 (32ϕ + κ) = 6.770732145 . . . ,

Φ-1 n q n , Φ-1 n D 8n D 16n p n , Φ-1 n D 3 8n pn ∈ Z,
(1) and the integer m from Theorem 1 is essentially 8n.

In order to accommodate the atypical simultaneous approximations in Theorem 1 as well as to relate them to the context of previous results listed in the beginning of the section, we define a new diophantine exponent s τ (ξ 1 , ξ 2 ) of two real numbers ξ 1 and ξ 2 , a characteristic of simultaneous irrationality of the numbers which depends on an additional parameter τ . With this notion in mind, we restate Theorem 1 as s τ 0 (ζ(2), ζ(3)) ≤ S. Exploiting further the properties of the exponent, we demonstrate in Proposition 7 the unlikeness of linear dependence of 1, ζ(2) and ζ(3) over Q: the latter would imply S = 6τ 0 or the belonging of both ζ(2) and ζ(3) to a certain set of Lebesgue measure 0.

In § 2 we introduce hypergeometric tools which depend on some parameters that lead to Q-linear forms in 1 and ζ(2) on one hand, and in 1 and ζ(3) one the other, the forms having some common asymptotic properties.

In § 3 we specialise the parameters of the previous part to have the coefficients of ζ(2) and ζ(3) coincide. From this specialisation we derive the main theorem using recurrence relations satisfied by the linear forms and their coefficients.

In the final part, § 4, we introduce a new diophantine exponent. Some basic properties of this exponent are given, and it is compared to the irrationality exponents previously known. Then the main result is restated in terms of this diophantine exponent in Theorem 2, for consistency with previous results in the subject.

Hypergeometric series

In what follows, we always assume standard hypergeometric notation [START_REF] Lucy | Generalized hypergeometric functions[END_REF]. For n ∈ N, the Pochhammer symbol is given by

(a) n = Γ(a + n) Γ(a) = n-1 k=0 (a + k),
with the convention (a) 0 = 1, while the generalized hypergeometric function is defined by the series

p+1 F p a 0 , a 1 , . . . , a p b 1 , . . . , b p z = ∞ n=0 (a 0 ) n (a 1 ) n • • • (a p ) n n! (b 1 ) n • • • (b p ) n z n .
2.1. Integer-valued polynomials. We reproduce here some auxiliary results about integer-valued polynomials; the proofs can be found in [START_REF] Zudilin | Two hypergeometric tales and a new irrationality measure of ζ[END_REF].

Lemma 1. For ℓ = 0, 1, 2, . . . ,

1 2πi 1/2+i∞ 1/2-i∞ π sin πt 2 (t -1)(t -2) • • • (t -ℓ) ℓ! dt = (-1) ℓ ℓ + 1 . ( 2
)
Lemma 2. Given b < a integers, set

R(t) = R(a, b; t) = (t + b)(t + b + 1) • • • (t + a -1) (a -b)! . Then R(k) ∈ Z, D a-b • dR(t) dt t=k ∈ Z and D a-b • R(k) -R(ℓ) k -ℓ ∈ Z for any k, ℓ ∈ Z, ℓ = k.
Lemma 3. Let R(t) be a product of several integer-valued polynomials

R j (t) = R(a j , b j ; t) = (t + b j )(t + b j + 1) • • • (t + a j -1) (a j -b j )!
, where b j < a j ,

and m = max j {a j -b j }. Then R(k) ∈ Z, D m • dR(t) dt t=k ∈ Z and D m • R(k) -R(ℓ) k -ℓ ∈ Z (3) for any k, ℓ ∈ Z, ℓ = k.

Construction of linear forms in 1 and ζ(2).

The construction in this subsection is a general case of the one considered in [Zud07, Section 2]. For a set of parameters

(a, b) = a 1 , a 2 , a 3 , a 4 b 1 , b 2 , b 3 , b 4 subject to the conditions b 1 , b 2 , b 3 ≤ a 1 , a 2 , a 3 , a 4 < b 4 , d = (a 1 + a 2 + a 3 + a 4 ) -(b 1 + b 2 + b 3 + b 4 ) ≥ 0, (4)
define the rational function

R(t) = R(a, b; t) = (t + b 1 ) • • • (t + a 1 -1) (a 1 -b 1 )! • (t + b 2 ) • • • (t + a 2 -1) (a 2 -b 2 )! × (t + b 3 ) • • • (t + a 3 -1) (a 3 -b 3 )! • (b 4 -a 4 -1)! (t + a 4 ) • • • (t + b 4 -1) (5) = Π(a, b) • Γ(t + a 1 ) Γ(t + a 2 ) Γ(t + a 3 ) Γ(t + a 4 ) Γ(t + b 1 ) Γ(t + b 2 ) Γ(t + b 3 ) Γ(t + b 4 ) , (6)
where

Π(a, b) = (b 4 -a 4 -1)! (a 1 -b 1 )! (a 2 -b 2 )! (a 3 -b 3 )! .
We also introduce the ordered versions Decomposing R(t) into the sum of partial fractions, we get

a * 1 ≤ a * 2 ≤ a * 3 ≤ a * 4 of the parameters a 1 , a 2 , a 3 , a 4 and b * 1 ≤ b * 2 ≤ b * 3 of b 1 , b 2 , b 3 , so that {a * 1 , a * 2 , a * 3 , a * 4 } coincides with {a 1 , a 2 ,
R(t) = b 4 -1 k=a * 4 C k t + k + P (t), (7)
where P (t) is a polynomial of which the degree d is defined in (4) and

C k = R(t)(t + k) | t=-k = (-1) d+b 4 +k k -b 1 k -a 1 k -b 2 k -a 2 k -b 3 k -a 3 b 4 -a 4 -1 k -a 4 ∈ Z (8) for k = a * 4 , a * 4 + 1, . . . , b 4 -1. Lemma 4. Set c = max{a 1 -b 1 , a 2 -b 2 , a 3 -b 3 }. Then D c P (t) is an integer-valued polynomial of degree d. Proof. Write R(t) = R 1 (t)R 2 (t), where R 1 (t) = a 1 -1 j=b 1 (t + j) (a 1 -b 1 )! • a 2 -1 j=b 2 (t + j) (a 2 -b 2 )! • a 3 -1 j=b 3 (t + j) (a 3 -b 3 )! is the product of three integer-valued polynomials and R 2 (t) = (b 4 -a 4 -1)! b 4 -1 j=a 4 (t + j) = b 4 -1 k=a 4 (-1) k-a 4 b 4 -a 4 -1 k-a 4 t + k .
It follows from Lemma 3 that

D c • dR 1 (t) dt t=j ∈ Z for j ∈ Z and D c • R 1 (j) -R 1 (m) j -m ∈ Z for j, m ∈ Z, j = m. (9)
Furthermore, note that

C k = R 1 (-k) • R 2 (t)(t + k) t=-k = R 1 (-k) • (-1) k-a 4 b 4 -a 4 -1 k -a 4 for k ∈ Z,
and the expression in fact vanishes if k is outside the range

a * 4 ≤ k ≤ b 4 -1. For ℓ ∈ Z we have d dt R(t)(t + ℓ) t=-ℓ = d dt R 1 (t) • R 2 (t)(t + ℓ) t=-ℓ = dR 1 (t) dt t=-ℓ • R 2 (t)(t + ℓ) t=-ℓ + R 1 (-ℓ) • d dt R 2 (t)(t + ℓ) t=-ℓ = dR 1 (t) dt t=-ℓ • (-1) ℓ-a 4 b 4 -a 4 -1 ℓ -a 4 + R 1 (-ℓ) • d dt b 4 -1 k=a 4 (-1) k-a 4 b 4 -a 4 -1 k -a 4 1 - -ℓ + k t + k t=-ℓ = dR 1 (t) dt t=-ℓ • (-1) ℓ-a 4 b 4 -a 4 -1 ℓ -a 4 + R 1 (-ℓ) b 4 -1 k=a 4 k =ℓ (-1) k-a 4 b 4 -a 4 -1 k-a 4 -ℓ + k and d dt b 4 -1 k=a * 4 C k t + k • (t + ℓ) t=-ℓ = d dt b 4 -1 k=a 4 C k t + k • (t + ℓ) t=-ℓ = d dt b 4 -1 k=a 4 C k 1 - -ℓ + k t + k t=-ℓ = b 4 -1 k=a 4 k =ℓ C k -ℓ + k = b 4 -1 k=a 4 k =ℓ R 1 (-k) • (-1) k-a 4 b 4 -a 4 -1 k-a 4 -ℓ + k .
Therefore,

P (-ℓ) = d dt P (t)(t + ℓ) t=-ℓ = d dt R(t)(t + ℓ) - b 4 -1 k=a * 4 C k t + k • (t + ℓ) t=-ℓ = dR 1 (t) dt t=-ℓ • (-1) ℓ-a 4 b 4 -a 4 -1 ℓ -a 4 + b 4 -1 k=a 4 k =ℓ (-1) k-a 4 b 4 -a 4 -1 k -a 4 R 1 (-ℓ) -R 1 (-k) -ℓ + k ,
and this implies, on the basis of the inclusions (9) above, that D c P (-ℓ) ∈ Z for all ℓ ∈ Z.

Finally, define the quantity

r(a, b) = (-1) d 2πi C+i∞ C-i∞ π sin πt 2 R(a, b; t) dt, ( 10
)
where C is arbitrary from the interval -a * 2 < C < 1b * 2 . The definition does not depend on the choice of C, as the integrand does not have singularities in the strip

-a * 2 < Re t < 1 -b * 2 .
Proposition 1. We have

r(a, b) = q(a, b)ζ(2) -p(a, b), with q(a, b) ∈ Z, D c 1 D c 2 p(a, b) ∈ Z, (11)
where

c 1 = max{a 1 -b 1 , a 2 -b 2 , a 3 -b 3 , b 4 -a * 2 -1} and c 2 = max{d + 1, b 4 -a * 2 -1}.
In addition,

q(a, b) = (-1) b 4 -a * 4 -1 a * 4 -b 1 a * 4 -a 1 a * 4 -b 2 a * 4 -a 2 a * 4 -b 3 a * 4 -a 3 b 4 -a 4 -1 a * 4 -a 4 × 4 F 3 -(b 4 -a * 4 -1), a * 4 -b 1 + 1, a * 4 -b 2 + 1, a * 4 -b 3 + 1 a * 4 -a * 1 + 1, a * 4 -a * 2 + 1, a * 4 -a * 3 + 1 1 , ( 12
)
and the quantity r(a, b)/Π(a, b) is invariant under any permutation of the parameters a 1 , a 2 , a 3 , a 4 .

Proof. We choose C = 1/2a * 2 in (10) and write (7) as

R(t) = b 4 -1 k=a * 4 C k t + k + d ℓ=0 A ℓ P ℓ (t + a * 2 ),
where

P ℓ (t) = (t -1)(t -2) • • • (t -ℓ) ℓ! and D c A ℓ ∈ Z in accordance with Lemma 4. Applying Lemma 1 we obtain r(a, b) = (-1) d 2πi 1/2+i∞ 1/2-i∞ π sin πt 2 R(t -a * 2 ) dt = (-1) d ∞ m=1-a * 2 b 4 -1 k=a * 4 C k (m + k) 2 + d ℓ=0 (-1) d+ℓ A ℓ ℓ + 1 = ζ(2) • (-1) d b 4 -1 k=a * 4 C k -(-1) d b 4 -1 k=a * 4 C k k-a * 2 ℓ=1 1 ℓ 2 + d ℓ=0 (-1) d+ℓ A ℓ ℓ + 1 .
This representation clearly implies that r(a, b) has the desired form (11), while the hypergeometric form (12) follows from

q(a, b) = (-1) d b 4 -1 k=a * 4 C k
and the explicit formula (8) for C k . Finally, the invariance of r(a, b)/Π(a, b) under permutations of a 1 , a 2 , a 3 , a 4 follows from (6) and definition (10) of r(a, b).

Assume that the parameters (a, b) are chosen in the following way:

a 1 = α 1 n + 1, a 2 = α 2 n + 1, a 3 = α 3 n + 1, a 4 = α 4 n + 1, b 1 = β 1 n + 1, b 2 = β 2 n + 1, b 3 = β 3 n + 1, b 4 = β 4 n + 2, ( 13
)
where the fixed integers α j and β j , j = 1, . . . , 4, satisfy

β 1 , β 2 , β 3 < α 1 , α 2 , α 3 , α 4 < β 4 , α 1 + α 2 + α 3 + α 4 > β 1 + β 2 + β 3 + β 4 .
The quantities (11) in these settings become dependent on a single parameter n = 0, 1, 2, . . . , so we let r n = r(a, b), q n = q(a, b), p n = p(a, b) and identify the characteristics c 1 = γ 1 n and c 2 = γ 2 n of Proposition 1, where γ 1 and γ 2 are completely determined by α j and β j , j = 1, . . . , 4. The statement below is proven by standard techniques and is very similar to [Zud04, Lemmas 10-12].

Proposition 2. In the above notation, let τ 0 , τ 0 ∈ C \ R and τ 1 ∈ R be the zeroes of the cubic polynomial 4 j=1 (τα j ) -4 j=1 (τβ j ). Define

f 0 (τ ) = 4 j=1 α j log(τ -α j ) -β j log(τ -β j ) - 3 j=1 (α j -β j ) log(α j -β j ) + (β 4 -α 4 ) log(β 4 -α 4 ).
Then

lim sup n→∞ log |r n | n = Re f 0 (τ 0 ) and lim n→∞ log |q n | n = Re f 0 (τ 1 ). Furthermore, Φ -1 n q n , Φ -1 n D γ 1 n D γ 2 n p n ∈ Z with Φ n = p prime p≤min{γ 1 ,γ 2 }n p ϕ(n/p) , where ϕ(x) = max α ′ =σα:σ∈S 4 ⌊(β 4 -α 4 )x⌋ -⌊(β 4 -α ′ 4 )x⌋ - 3 j=1 ⌊(α j -β j )x⌋ -⌊(α ′ j -β j )x⌋ ,
so that the maximum is taken over all permutations

(α ′ 1 , α ′ 2 , α ′ 3 , α ′ 4 ) of (α 1 , α 2 , α 3 , α 4
), and we have

lim n→∞ log Φ n n = 1 0 ϕ(x) dψ(x) - 1/ min{γ 1 ,γ 2 } 0 ϕ(x) dx x 2 ,
where ψ(x) is the logarithmic derivative of the gamma function.

Here and in what follows, the notation ⌊ • ⌋ and ⌈ • ⌉ is used for the floor and ceiling integer-part functions.

Construction of linear forms in 1 and ζ(3).

The construction in this subsection depends on another set of integral parameters

(â, b) = â0 , â1 , â2 , â3 b0 , b1 , b2 , b3
which satisfies the conditions

1 2 b0 , b1 ≤ 1 2 â0 , â1 , â2 , â3 < b2 , b3 , â0 + â1 + â2 + â3 ≤ b0 + b1 + b2 + b3 -2. ( 14
)
To this set we assign the rational function

R(t) = R(â, b; t) = (2t + b0 )(2t + b0 + 1) • • • (2t + â0 -1) (â 0 -b0 )! • (t + b1 ) • • • (t + â1 -1) (â 1 -b1 )! × ( b2 -â2 -1)! (t + â2 ) • • • (t + b2 -1) • ( b3 -â3 -1)! (t + â3 ) • • • (t + b3 -1) (15) = Π(â, b) • Γ(2t + â0 ) Γ(t + â1 ) Γ(t + â2 ) Γ(t + â3 ) Γ(2t + b0 ) Γ(t + b1 ) Γ(t + b2 ) Γ(t + b3 ) , (16)
where

Π(â, b) = ( b2 -â2 -1)! ( b3 -â3 -1)! (â 0 -b0 )! (â 1 -b1 )! .
As in Section 2.2 we introduce the ordered versions â *

1 ≤ â * 2 ≤ â * 3 of the parameters â1 , â2 , â3 and b * 2 ≤ b * 3 of b2 , b3 .
Then this ordering and conditions (14

) imply that R(t) = O(1/t 2 ) as t → ∞, the rational function has poles at t = -k for â * 2 ≤ k ≤ b * 3 -1, double poles at t = -k for â * 3 ≤ k ≤ b * 2 -1, and double zeroes at t = -ℓ for max{⌈ b0 /2⌉, b1 } ≤ ℓ ≤ min{⌊(â 0 -1)/2⌋, â * 1 -1}. The partial-fraction decomposition of R(t) assumes the form R(t) = b * 2 -1 k=â * 3 A k (t + k) 2 + b * 3 -1 k=â * 2 B k t + k , (17)
where

A k = R(t)(t + k) 2 | t=-k = (-1) d 2k -b0 2k -â0 k -b1 k -â1 b2 -â2 -1 k -â2 b3 -â3 -1 k -â3 ∈ Z (18) with d = â0 + â1 + â2 + â3 -b0 -b1 , for k = â * 3 , â * 3 + 1, . . . , b * 2 -1 and, similarly, B k = d dt R(t)(t + k) 2 | t=-k for k = â * 2 , â * 2 + 1, . . . , b * 3 -1. The inclusions D max{â 0 -b0 ,â 1 -b1 , b * 3 -â 2 -1, b * 3 -â 3 -1} • B k ∈ Z (19)
follow then from standard consideration; see, for example, Lemma 3 and the proof of Lemma 4 in [START_REF] Zudilin | Arithmetic of linear forms involving odd zeta values[END_REF]. In addition,

b * 3 -1 k=â * 2 B k = -Res t=∞ R(t) = 0 (20)
by the residue sum theorem. The quantity of our interest in this section is

r(â, b) = (-1) d 4πi C+i∞ C-i∞ π sin πt 2 R(â, b; t) dt, ( 21
)
where C is arbitrary from the interval -min{â 0 /2, â * 1 } < C < 1 -max{ b0 /2, b1 }.

Proposition 3. We have

r(â, b) = q(â, b)ζ(3) -p(â, b), with q(â, b) ∈ Z, 2D ĉ1 D 2 ĉ2 p(â, b) ∈ Z, (22) where ĉ1 = max{â 0 -b0 , â1 -b1 , b * 3 -â2 -1, b * 3 -â3 -1, b * 2 -⌈â 0 /2⌉ -1, b * 2 -â * 1 -1}, ĉ2 = max{ b * 3 -⌈â 0 /2⌉ -1, b * 3 -â * 1 -1}. Furthermore, q(â, b) = 2â * 3 -b0 2â * 3 -â0 â * 3 -b1 â * 3 -â1 b2 -â2 -1 â * 3 -â2 b3 -â3 -1 â * 3 -â3 × 5 F 4 -( b2 -â * 3 -1), -( b3 -â * 3 -1), â * 3 -b1 + 1, â * 3 -1 2 b0 + 1 2 , â * 3 -1 2 b0 + 1 â * 3 -â * 1 + 1, â * 3 -â * 2 + 1, â * 3 -1 2 â0 + 1 2 , â * 3 -1 2 â0 + 1 1 , (23)
and the quantity r(â, b)/ Π(â, b) is invariant under any permutation of the parameters â1 , â2 , â3 .

Proof. Denote â * = min{⌈â 0 /2⌉, â * 1 } and choose C = 1/2 -â * in (21) to write r(â, b) = - (-1) d 2 ∞ m=1-â * d R(t) dt t=m = (-1) d ∞ m=1-â * b * 2 -1 k=â * 3 A k (m + k) 3 + (-1) d 2 ∞ m=1-â * b * 3 -1 k=â * 2 B k (m + k) 2 = ζ(3) • (-1) d b * 2 -1 k=â * 3 A k -(-1) d b * 2 -1 k=â * 3 A k k-â * ℓ=1 1 ℓ 3 - (-1) d 2 b * 3 -1 k=â * 2 B k k-â * ℓ=1 1 ℓ 2 ,
where equality (20) was used. In view of the inclusions ( 18 Similar to our choice in Section 2.2, we take the parameters (â, b) as follows:

â0 = α0 n + 2, â1 = α1 n + 1, â2 = α2 n + 1, â3 = α3 n + 1, b0 = β0 n + 2, b1 = β1 n + 1, b2 = β2 n + 2, b3 = β3 n + 2, ( 24
)
where the fixed integers αj and βj , j = 0, . . . , 3, satisfy

1 2 β0 , β1 < 1 2 α0 α1 , α2 , α3 < β2 , β3 , α0 + α1 + α2 + α3 = β0 + β1 + β2 + β3 ;
note that the equality is assumed in the latter relation (compare to ( 14 Furthermore,

Φ-1 n qn , 2 Φ-1 n D γ1 n D 2 γ2 n pn ∈ Z with Φn = p prime p≤min{γ 1 ,γ 2 }n p φ(n/p) , where φ(x) = min 0≤y<1 ⌊2y -β0 x⌋ -⌊2y -α0 x⌋ -⌊( α0 -β0 )x⌋ + ⌊y -β1 x⌋ -⌊y -α1 x⌋ -⌊( α1 -β1 )x⌋ + ⌊( β2 -α2 )x⌋ -⌊ β2 x -y⌋ -⌊y -α2 x⌋ + ⌊( β3 -α3 )x⌋ -⌊ β3 x -y⌋ -⌊y -α3 x⌋ , so that we have lim n→∞ log Φn n = 1 0 φ(x) dψ(x) - 1/ min{γ 1 ,γ 2 } 0 φ(x) dx x 2 .

Simultaneous diophantine properties of ζ(2) and ζ(3)

In this section we prove Theorem 1 stated in the introduction by combining the constructions of Subsect. 2.2 and 2.3.

Construction 1. If we specialize the set of parameters (a, b) of Subsect. 2.2 to be

a 1 = 8n + 1, a 2 = 7n + 1, a 3 = 10n + 1, a 4 = 9n + 1, b 1 = 1, b 2 = n + 1, b 3 = 2n + 1, b 4 = 15n + 2, ( 25
)
then Propositions 1 and 2 imply that

r n = r(a, b) = q n ζ(2) -p n , where Φ -1 n q n , Φ -1 n D 8n D 16n p n ∈ Z, (26)
and

q n = (-1) n (9n)! (10n)! n! (2n)! (3n)! (5n)! (8n)! 4 F 3 -5n, 10n + 1, 9n + 1, 8n + 1 3n + 1, 2n + 1, n + 1 1 . (27)
The corresponding function ϕ(x) which defines Φ n is

ϕ(x) =      1 if x ∈ 1 10 , 1 9 ∪ 1 7 , 2 9 ∪ 2 7 , 1 3 ∪ 2 5 , 1 2 ∪ 5 9 , 4 7 ∪ 2 3 , 5 7 ∪ 4 5 , 6 7 , 2 if x ∈ 1 9 , 1 8 ∪ 2 9 , 1 4 ∪ 1 3 , 3 8 ∪ 4
= 16n + 2, â1 = 8n + 1, â2 = 9n + 1, â3 = 10n + 1, b0 = 11n + 2, b1 = 1, b2 = 16n + 2, b3 = 16n + 2, ( 28
)
we obtain from Propositions 3 and 4 that

rn = r(â, b) = qn ζ(3) -pn , where Φ-1 n qn , 2 Φ-1 n D 3 8n pn ∈ Z, (29) and qn
= (7n)! (9n)! (10n)! n! (2n)! (4n)! (5n)! (6n)! (8n)! 5 F 4 -6n, -6n, 10n + 1, 9 2 n + 1 2 , 9 2 n + 1 2n + 1, n + 1, 2n + 1 2 , 2n + 1 1 . (30)
The corresponding function φ(x) assumes the form Connection between the constructions. Surprisingly -and this could be guessed from the asymptotics above, the coefficients in (26) of ζ(2) and in (29) of ζ(3) coincide: q n = qn . This follows from the following classical identity -Whipple's transformation [Sla66, p. 65, eq. (2.4.2.3)], in which we assume that b = -N is a negative integer:

φ(x) =      1 if x ∈ 1 10 , 1 8 ∪ 1 7 , 1 4 ∪ 2 7 , 1 3 ∪ 3 7 , 1 2 ∪ 5 9 , 4 7 ∪ 3 5 , 5 8 ∪ 2 3 , 5 7 ∪ 5 6 , 6 7 , 2 if x ∈ 1 3 , 3 8 ∪ 4 7 , 3 5 ∪ 5 7 , 3 4 ∪ 6 7 , 7
× 5 F 4 a, b, 1 + f -g, 1 2 f , 1 2 f + 1 2 h, 1 + f + a -h, 1 2 (1 + f + b -g), 1 2 (1 + f + b -g) + 1 2 1 . ( 31
)
The particular choices (25) and (28) correspond to taking a = b = -6n, f = 9n + 1, h = n + 1 and g → -n + 1 in (31). The equality q n = qn can be alternatively established by examining the recurrence equation satisfied by both q n and qn ; we outline the equation in our proof of Theorem 1 below. Note that we also have Φ n divisible by Φn in the construction above, so that we can 'merge' the corresponding arithmetic properties (26) and (29) as follows:

Φ-1 n q n , Φ-1 n D 8n D 16n p n , 2 Φ-1 n D 3 8n pn ∈ Z. (32)
In both situations we get Proof of Theorem 1. Using the notation above we define τ 0 and S in accordance with (1).

lim n→∞ log( Φ-1 n D 8n D 16n ) n = lim n→∞ log(2 Φ-1 n D 3 8n ) n = 24 -ϕ = 18.29830398 . . .
To prove the theorem, we use a recurrence relation satisfied by q n , p n and pn . We execute the Gosper-Zeilberger algorithm of creative telescoping separately for the rational function R n (t) = R(t) defined in (5) and specialised by (25), and for Rn (t) = R(t) defined in (15) with the choice of parameters (28). The results in both cases are polynomials P 0 (n), . . . , P 3 (n) ∈ Z[n] and rational functions S n (t), Ŝn (t) such that

P 3 (n)R n+3 (t) + P 2 (n)R n+2 (t) + P 1 (n)R n+1 (t) + P 0 (n)R n (t) = S n (t + 1) -S n (t), P 3 (n) Rn+3 (t) + P 2 (n) Rn+2 (t) + P 1 (n) Rn+1 (t) + P 0 (n) Rn (t) = Ŝn (t + 1) -Ŝn (t).
Applying then the argument as in the proof of Theorem 5.4 in [START_REF] Bailey | Hypergeometric forms for Ising-class integrals[END_REF] we find out that both the hypergeometric integrals

r n = 1 2πi i∞ -i∞ π sin πt 2 R n (t) dt and rn = 1 4πi i∞ -i∞ π sin πt 2 Rn (t) dt
satisfy the same recurrence equation 3) are irrational, we deduce that the coefficients q n , p n and pn satisfy the same equation. Using this fact we obtain that the sequence of determinants ∆ n = q n q n+1 q n+2 p n p n+1 p n+2 pn pn+1 pn+2 satisfies the recurrence equation P 3 (n)∆ n+1 +P 0 (n)∆ n = 0. The coefficients of P 3 (n) are all positive, while the coefficients of P 0 (n) are all negative; the details of this computation can be found on the webpage [START_REF] Dauguet | Généralisation du critère d'indépendance linéaire de Nesterenko[END_REF] of the first author. This implies that the nonvanishing of ∆ n for some n is equivalent to the nonvanishing of ∆ 0 . We have explicitly

P 3 (n)y n+3 + P 2 (n)y n+2 + P 1 (n)y n+1 + P 0 (n)y n = 0. Since r n = q n ζ(2) -p n , rn = q n ζ(3) -
q 0 = 1, q 1 = 12307565655, q 2 = 5669931265166541788415, p 0 = 0, p 1 = 199536684432021 9856 , p 2 = 6500408024275547867356589727409007 696970391040 , p0 = 0, p1 = 7953492001094261 537600 , p2 = 37762843816152998347068580008855083 5540664729600 , so that ∆ 0 = q 0 q 1 q 2 p 0 p 1 p 2 p0 p1 p2 = 288666665737256181552839214834819523 107268868422523551744000 = 0 .
Thus, ∆ n = 0 for any n ≥ 0. Now let ε, η > 0; for simplicity we may assume η ≤ ε. Let m be a sufficiently large integer as in the statement of Theorem 1. Let a 0 , a 1 , a 2 satisfy the hypotheses in Theorem 1. We take n = ⌈m/8⌉, so that 8n-7 ≤ m ≤ 8n. Since the determinant ∆ n does not vanish, there exists an ℓ ∈ {n , n + 1 , n + 2} such that a 0 q ℓ + a 1 p ℓ + a 2 pℓ = 0 . Now we have m ≤ 8n ≤ 8ℓ, so that D 2 8ℓ D 16ℓ a 0 ∈ Z and D 8ℓ a 1 ∈ Z. Letting e m,ℓ denote the least positive integer such that 2D 8ℓ | e m,ℓ D m , we get the property

D 2m D m e m,l D 16ℓ 2D 8ℓ ,
so that e m,ℓ D 16ℓ 2D 8ℓ a 2 ∈ Z. Therefore, using the arithmetic properties of q ℓ , p ℓ and pℓ we conclude that

e m,ℓ (D 2 8ℓ D 16ℓ a 0 )(Φ -1 ℓ q ℓ ) + e m,ℓ (D 8ℓ a 1 )(Φ -1 ℓ D 8ℓ D 16ℓ p ℓ ) + e m,ℓ D 16ℓ 2D 8ℓ a 2 (2Φ -1 ℓ D 3 8ℓ pℓ ) ( 33
) is a nonzero integer. Note that ℓ ≤ m 8 + 3, so that the asymptotic contribution of e m,ℓ is almost invisible: e m,ℓ ≤ 2(8ℓ) 24 = e o(ℓ) .

Let us bound the integer (33) from above. Writing hypothesis (ii) as

|a 0 + a 1 ζ(2) + a 2 ζ(3)| ≤ e -(S+η)m ≤ e -(32-ϕ+κ+8η)(n-1) ,
we obtain

|a 0 q ℓ + a 1 p ℓ + a 2 pℓ | ≤ |q ℓ | |a 0 + a 1 ζ(2) + a 2 ζ(3)| + |a 1 | |q ℓ ζ(2) -p ℓ | + |a 2 | |q ℓ ζ(3) -pℓ | ≤ e -(32-ϕ+8ε)n+o(n) ,
since ε ≤ η. On the other hand, the common denominator of the coefficients used above is e m,ℓ D 2 8ℓ D 16ℓ Φ -1 ℓ ≤ e (2•8+16-ϕ)ℓ+o(ℓ) = e (32-ϕ)n+o(n) . This means that the non-zero integer (33) has absolute value at most e -8εn+o(n) , which is not possible for a sufficiently large n, thus implying the truth of Theorem 1.

A new diophantine exponent

4.1. Definition and basic properties. We now introduce a new exponent that depends on some τ ∈ R and is related to Theorem 1. Definition 1. Let ξ 1 , ξ 2 ∈ R and τ ∈ R. We denote by s τ (ξ 1 , ξ 2 ) the infimum of the set E τ (ξ 1 , ξ 2 ) of all s ∈ R with the following property. Let ε > 0 and n be sufficiently large in terms of ε. Let (a 0 , a 1 , a 2 ) ∈ Q 3 \ {0} be such that: Then

(i) D 2 n D 2n a 0 ∈ Z, D n a 1 ∈ Z and
|a 0 + a 1 ξ 1 + a 2 ξ 2 | > e -sn . By convention, we set s τ (ξ 1 , ξ 2 ) = +∞ if E τ (ξ 1 , ξ 2 ) = ∅, and s τ (ξ 1 , ξ 2 ) = -∞ if E τ (ξ 1 , ξ 2 ) = R.
This definition allows us to restate Theorem 1 as follows.

Theorem 2. With τ 0 = 0.899668635 . . . and S = 6.770732145 . . . as in (1), we have

s τ 0 (ζ(2), ζ(3)) ≤ S.
To begin with, let us state and prove general results on this diophantine exponent s τ (ξ 1 , ξ 2 ) depending on the range when τ varies; it turns out that it carries diophantine information on ξ 1 and ξ 2 only if τ < 1.

Proposition 5.

(1)

If τ > 4, then s τ (ξ 1 , ξ 2 ) = -∞. (2) If 1 ≤ τ ≤ 4, then s τ (ξ 1 , ξ 2 ) = 4. (3) If τ < 1, then s τ (ξ 1 , ξ 2 ) ≥ 6 -2τ .
(4) If τ < 1 and at least one of ξ 1 or ξ 2 is rational, then s τ (ξ 1 , ξ 2 ) = +∞.

(5) If τ < 0 and the numbers 1, ξ 1 and ξ 2 are linearly dependent over Q, then

s τ (ξ 1 , ξ 2 ) = +∞. (6) If τ ≤ τ ′ , then s τ (ξ 1 , ξ 2 ) ≥ s τ ′ (ξ 1 , ξ 2 ).
Proof. (1) We see that whenever the coefficient a i is not zero, we must have

|a i | ≥ 1/(D 2 n D 2n ) = e -4n+o(n) if i = 0
, and an even larger estimate from below (namely, e -n+o(n) ) if i = 1 or 2. Therefore, having at least one triple (a 0 , a 1 , a 2 ) ∈ Q 3 \ {0} that satisfies both (i) and (ii) of Definition 1 means τ ≤ 4; having no such triple implies E τ (ξ 1 , ξ 2 ) = R.

(2) Assuming now 1 ≤ τ ≤ 4 in Definition 1 and choose n sufficiently large to accommodate D n < e (1+ε)n and D 2n /D n < e (1+ε)n . Condition (ii) implies that |a 1 | ≤ e -(τ +ε)n ≤ e -n-εn , so that the integer |D n a 1 | ≤ D n e -n-εn < 1 must be zero, a 1 = 0. Similar consideration shows that a 2 = 0, hence the only nonzero element in the triple (a 0 , a 1 , a n) with the equality possible by simply taking

2 ) ∈ Q 3 \ {0} is a 0 . Then condition (i) implies that |a 0 | ≥ 1/(D 2 n D 2n ) = e -4n+o(
a 0 = 1/(D 2 n D 2n ). Thus, s τ (ξ 1 , ξ 2 ) = 4 for all ξ 1 , ξ 2 whenever 4 ≥ τ ≥ 1. (3) Take s < 6 -2τ and define ε = 1 3 (6 -2τ -s), so that s = 6 -2τ -3ε > τ + ε/2 because of τ < 1. Let n be sufficiently large to have (D n D 2n ) 2 > e (6-ε)n = e -(s+2τ +2ε)n satisfied. Define the set K = {(x 0 , x 1 , x 2 ) ∈ R 3 : |x 1 |, |x 2 | ≤ e -(τ +ε)n , |x 0 + x 1 ξ 1 + x 2 ξ 2 | ≤ e -sn } ⊂ R 3 ,
which is compact, convex, symmetric with respect to 0 and has volume 8e -(s+2τ +2ε)n . Consider the lattice

Γ = 1 D 2 n D 2n Z ⊕ 1 D n Z ⊕ D n D 2n Z,
whose fundamental domain has volume

1 D 2 n D 2n • 1 D n • D n D 2n < e -(s+2τ +2ε)n .
By Minkowski's theorem, K contains a nonzero point (a 0 , a 1 , a 2 ) of the lattice Γ, for which we have

|a 0 | ≤ |a 1 | |ξ 1 | + |a 2 | |ξ 2 | + |a 0 + a 1 ξ 1 + a 2 ξ 2 | ≤ (|ξ 1 | + |ξ 2 |)e -(τ +ε)n + e -sn ≤ e -(τ +ε/2)n .
The estimate means that s / ∈ E τ (ξ 1 , ξ 2 ); as s τ (ξ 1 , ξ 2 ) is the infimum of the set E τ (ξ 1 , ξ 2 ), we get s τ (ξ 1 , ξ 2 ) ≥ 6 -2τ .

(4) Assume ξ 1 = p/q ∈ Q, take ε ∈ (0, 1τ ). By choosing a 0 = qξ 1 /D n , a 1 = -q/D n and a 2 = 0 we see that properties (i) and (ii) in the definition of E τ (ξ 1 , ξ 2 ) are satisfied for any n sufficiently large. In addition,

|a 0 + a 1 ξ 1 + a 2 ξ 2 | = 0 < e -sn for any s ∈ R, which means that E τ (ξ 1 , ξ 2 ) = ∅, hence s τ (ξ 1 , ξ 2 ) = +∞.
If ξ 2 = p/q ∈ Q, then the choice a 0 = qξ 2 D n /D 2n , a 1 = 0 and a 2 = -qD n /D 2n does the job.

(5) Assume now that there exist integers q 0 , q 1 and q 2 , not all zero, such that p 0 + p 1 ξ 1 + p 2 ξ 2 = 0. Setting a 0 = p 0 , a 1 = p 1 and a 2 = p 2 we see that properties (i) and (ii) are satisfied with any choice of τ < 0 and ε, for all n sufficiently large in terms of ε. At the same time

|a 0 + a 1 ξ 1 + a 2 ξ 2 | = 0 < e -sn for any s ∈ R, meaning that E τ (ξ 1 , ξ 2 ) = ∅, hence s τ (ξ 1 , ξ 2 ) = +∞. (6) Using (1), (2) and (3)
, we may assume that τ ′ < 1. Let s ∈ E τ (ξ 1 , ξ 2 ) meaning that for all ε > 0 and for all triples (a 0 , a 1 , a 2 )

∈ Q 3 \ {0} which satisfy D 2 n D 2n a 0 , D n a 1 , D 2n D n a 2 ∈ Z and |a 0 |, |a 1 |, |a 2 | ≤ e -(τ +ε)n , we have |a 0 + a 1 ξ 1 + a 2 ξ 2 | > e -sn .
For n be sufficiently large and (a 0 , a 1 , a 2 )

∈ Q 3 \ {0} such that D 2 n D 2n a 0 , D n a 1 , D 2n D n
a 2 ∈ Z and |a i | ≤ e -(τ ′ +ε)n , we also have |a i | ≤ e -(τ +ε)n . This means that |a 0 + a 1 ξ 1 + a 2 ξ 2 | > e -sn and s ∈ E τ ′ (ξ 1 , ξ 2 ), so that E τ (ξ 1 , ξ 2 ) ⊂ E τ ′ (ξ 1 , ξ 2 ), which leads to claim (6) by taking the infimum of both sets.

From now on we assume τ to be real < 1.

Remarks. Theorem 2 is nontrivial since τ 0 < 1. However, it does not imply that Definition 2. Let E be the set of all ψ : N * → N * with the following properties: for any q ≥ 1, ψ(q + 1) is a multiple of ψ(q), and the limit γ ψ = lim q→∞ log ψ(q) log q exists and belongs to the interval [0, 1). For ψ ∈ E and ξ ∈ R \ Q, denote by µ ψ (ξ) the supremum of the set M ψ (ξ) of all µ ∈ R such that there are infinitely many q ≥ 1 which are divisible by ψ(q) and satisfy ξ -p q ≤ 1 q µ for some p ∈ Z .

If M ψ (ξ) is not bounded from above, that is, if M ψ (ξ) = R, we get µ ψ (ξ) = +∞.

An equivalent way of defining µ ψ (ξ), is by letting µ ψ (ξ) be the infimum of the set of exponents µ such that for all q large enough with ψ(q) | q one has |ξp/q| > 1/q -µ , and taking µ ψ (ξ) = +∞ if the set is empty.

When ψ(q) = 1 for all q, the ψ-exponent µ ψ (ξ) coincides with the usual exponent of irrationality µ(ξ). It is known [Fis09, Corollary 3] that µ ψ (ξ) = +∞ if and only if ξ is a Liouville number, that is, µ(ξ) = +∞. If this is not the case, then

(1 -γ ψ )µ(ξ) ≤ µ ψ (ξ) ≤ µ(ξ).
Fischler proves in [START_REF] Fischler | Restricted rational approximation and Apéry-type constructions[END_REF] that µ ψ (ξ) ≥ 2γ ψ for any ψ ∈ E and any ξ ∈ R \ Q, with the equality holding for almost all ξ ∈ R in the sense of Lebesgue measure. More precisely, he shows that, given an η > 2γ ψ , the set of ξ such that µ ψ (ξ) > η has Hausdorff dimension (2γ ψ )/η.

The usual construction of a function ψ ∈ E is as follows. One takes ψ(q) = δ n with n = ⌊(log q)/(δα)⌋, where (δ n ) n≥1 is a sequence of positive integers such that δ n divides δ n+1 for each n ≥ 1 and δ n = e δn+o(n) as n → ∞, while α ∈ R is chosen to satisfy α < δ. In this construction, we have γ ψ = δ/(δα).

Definition 2 allows us deducing diophantine results involving only quantity, ξ 1 or ξ 2 , from a nontrivial upper bound for the exponent s τ (ξ 1 , ξ 2 ) from Definition 1. Proposition 6. Let ξ 1 , ξ 2 be real numbers and τ < 1. Define ψ 1 , ψ 2 : N * → N * by taking ψ 1 (q) = D n D 2n and ψ 2 (q) = D 3 n , where n = ⌊(log q)/(4τ )⌋. Then

µ ψ i (ξ i ) ≤ s τ (ξ 1 , ξ 2 ) -τ 4 -τ for i = 1, 2.
Proof. Let τ ′ ∈ R satisfy τ < τ ′ < 1. Take p ∈ Z and q ∈ N * sufficiently large, ψ 1 (q) | q, and m = ⌊(log q/(4τ ′ )⌋, so that ψ 1 (q) = D m D 2m . We may assume that

|p/q -ξ 1 | < 1. For an s > s τ (ξ 1 , ξ 2 ), choose ε > 0 such that ε < 1 2 min τ ′ -τ , (s -4)(τ ′ -τ ) 2s -τ ′ -4 ; part (3) of Proposition 5 implies s > 4. Take n = 4 -τ ′ 4 -τ -2ε (m + 1) + 1 < m, a 0 = p D 2 n D 2n and a 1 = -q D 2 n D 2n . Then D 2 n D 2n a 0 ∈ Z and D n a 1 = -q D m D 2m D m D 2m D n D 2n = -q ψ 1 (q) D m D 2m D n D 2n ∈ Z,
and q < e (4-τ ′ )(m+1) implying that |a 1 | ≤ e -(τ +ε)n ; for a 0 we have |a

0 | = |p|e -4n+o(n) . Therefore, |p| ≤ |p -qξ 1 | + |qξ 1 | ≤ q(1 + |ξ 1 |), which leads to |a 0 | ≤ q(1 + |ξ 1 |)e -4n+o(n) ≤ e (4-τ ′ )(m+1)-(4-ε)n ≤ e -(τ +ε)n
for q sufficiently large. Letting a 2 = 0 and using s > s τ (ξ 1 , ξ 2 ) we deduce that |a 0 + a 1 ξ 1 | > e -sn ; from the definition of a 0 and a 1 it follows that p q ξ 1 > e (4-s-ε)n q provided q is sufficiently large. The assumption on ε results in the estimate p q ξ 1 > q -(s-τ ′ )/(4-τ ′ ) , which implies µ ψ 1 (ξ 1 ) ≤ (sτ ′ )/(4τ ′ ). This upper bound holds for all s > s τ (ξ 1 , ξ 2 ); taking the infimum over s and then choosing τ ′ ∈ (τ, 1) sufficiently close to τ , completes the proof for i = 1. The proof for i = 2 is similar.

Since µ ψ i (ξ i ) ≥ 2γ ψ i with γ ψ i = 3/(4τ ) < 1, Proposition 6 implies the lower bound s τ (ξ 1 , ξ 2 ) ≥ 5τ , which is however weaker than the one from statement (3) of Proposition 5.

Corollary 1. For ξ 1 and ξ 2 real numbers and τ < 1, the following inequalities hold for the ordinary irrationality exponent:

µ(ξ i ) ≤ s τ (ξ 1 , ξ 2 ) -τ 1 -τ for i = 1, 2.
Proof. In the notation of Proposition 6, use (1γ ψ i )µ(ξ i ) ≤ µ ψ i (ξ i ).

4.3. Case of linear dependence. In this subsection, we prove a converse result to Proposition 6 above; namely, under the linear dependence of 1, ξ 1 and ξ 2 over Q, we deduce an upper bound on s τ (ξ 1 , ξ 2 ) from an upper bound on the irrationality exponent of either ξ 1 or ξ 2 .

Proposition 7. For ξ 1 , ξ 2 ∈ Q assume that 1, ξ 1 and ξ 2 are linearly dependent over Q. Take 0 ≤ τ < 1 and define ψ ∈ E by ψ(q) = D 2 n with n = ⌊(log q)/(4τ )⌋. Then µ ψ (ξ 1 ) = µ ψ (ξ 2 ) and

s τ (ξ 1 , ξ 2 ) ≤ 4 + (µ ψ (ξ i ) -1)(4 -τ ) for i = 1, 2.
In addition, s τ (ξ 1 , ξ 2 ) ≤ 6τ unless both ξ 1 and ξ 2 belong to a certain set of Lebesgue measure zero.

Note that the inequalities of this proposition do not hold if τ < 0, since s τ (ξ 1 , ξ 2 ) = +∞ in this case (see Proposition 5).

Proof. The equality µ ψ (ξ 1 ) = µ ψ (ξ 2 ) is trivially true for any ψ ∈ E.

Let α 0 , α 1 ∈ Q be such that α 0 + α 1 ξ 1 = ξ 2 and ψ the function defined in the statement of Proposition 7. Denote by A a common denominator of α 0 and α 1 . Take ε > 0, ν > 0, µ > µ ψ (ξ 1 ) and n be sufficiently large with respect to ε, ν and

µ. Let (a 0 , a 1 , a 2 ) ∈ Q 3 \ {0} satisfy |a i | ≤ e -(τ +ε)n and D 2 n D 2n a 0 , D n a 1 , D 2n D n a 2 ∈ Z; set η = |a 0 + a 1 ξ 1 + a 2 ξ 2 |.
To begin with, we claim that η = 0. Indeed, if η = 0, then a 0 = -α 0 a 2 and a 1 = -α 1 a 2 , since 1, ξ 1 , ξ 2 span a Q-vector space of dimension 2 -there is exactly one Q-linear relation among them, up to proportionality. As both

D n a 1 and A D 2n D n a 1 = -Aα 1 • D 2n D n a 2 are integral, we have δ n a 1 ∈ Z, where δ n = gcd(D n , AD 2n /D n ) = e o(n) as n → ∞.
If a 1 = 0, the latter asymptotics leads to the contradiction with δ n ≥ |a 1 | -1 ≥ e (τ +ε)n ≥ e εn , since τ ≥ 0. Therefore, a 1 = 0, implying a 2 = 0 because ξ 2 ∈ Q; finally, 0 = η = |a 0 |, which is impossible as (a 0 , a 1 , a 2 ) = 0. This completes the proof of the claim that η = 0. We write now η = |â 0 + â1 ξ 1 | with â0 = a 0 + α 0 a 2 and â1 = a 1 + α 1 a 2 . If â1 = 0, we have AD 2 n D 2n â0 ∈ Z and AD 2n â1 ∈ Z. Set ã0 =sign(â 1 )AD 2 n D 2n â0 ∈ Z and ã1 = AD 2 n D 2n |â 1 | ∈ D 2 n N. By the assumption, ã1 > 0 implying e 2n+o(n) ≤ ã1 ≤ e (4-τ -ε)n+o(n) ≤ e (4-τ )n . Thus, (log ã1 )/(4τ ) ≤ n which ensures that ψ(ã 1 ) | D 2 n | ã1 . Since ã1 ≥ e 2n+o(n) and n is sufficiently large in terms of µ > µ ψ (ξ 1 ), we deduce

AD 2 n D 2n η = |ã 0 -ã1 ξ 1 | > 1 ãµ-1
1 > e -(µ-1)(4-τ )n , so that η > e -(4+(µ-1)(4-τ )+ν)n for n sufficiently large.

If â1 = 0, we get η = |a ′ 0 |. Since η = 0, this implies AD 2 n D 2n η ∈ N * and thus η > e -4n+o(n) . Furthermore, from γ ψ ∈ [0, 1) we deduce that µ ψ (ξ 1 ) ≥ 2γ ψ > 1, so that (µ ψ (ξ 1 ) -1)(4τ ) > 0. Thus, we have η > e -(4+(µ-1)(4-τ )+ν)n for n sufficiently large in this case as well.

Therefore, in both cases 4 + (µ -1)(4τ ) + ν ∈ E τ (ξ 1 , ξ 2 ) for all µ > µ ψ (ξ 1 ) and all ν > 0. Taking the infimum of E τ (ξ 1 , ξ 2 ) we obtain the desired inequality for i = 1, and also for i = 2 in view of µ ψ (ξ 1 ) = µ ψ (ξ 2 ).

Finally, µ ψ (ξ) = 2γ ψ = 2 -2/(4τ ) for almost all ξ ∈ R with respect to the Lebesgue measure, completing the proof. Proposition 8 can be adapted to ζ(2); namely, we have µ ψ (ζ(2)) ≤ 1.92, where ψ(q) = D n D 2n with n = ⌊(log q)/(4τ 0 )⌋ and τ 0 as before. However, this result follows directly from Apéry's construction [Fis09]: Apéry's proof yields µ ψ′ (ζ(2)) ≤ 2, where ψ′ (q) = D 2 n with n = ⌊(log q)/(5(log(1 + √ 5)log 2))⌋. Using elementary methods (see [START_REF] Dauguet | Généralisation du critère d'indépendance linéaire de Nesterenko[END_REF]), this upper bound can be shown to imply µ ψ(ζ (2)) ≤ 1.26, which is sharper than the given one.

In the notation above, the upper bound of Proposition 8 and its analogue for ζ(2) imply µ ψ′ (ζ(2)) ≤ 15.33 and µ ψ ′ (ζ(3)) ≤ 8.73: these upper bounds are worse than the ones followed from Apéry's construction.

Proposition 8 means that ζ(3) does not belong to the set of ξ ∈ R \ Q satisfying µ ψ (ξ) > 1.92 . . .. This set has Hausdorff dimension equal to 0.0681457 . . .; this is smaller than the one obtained after Corollary 5 in [START_REF] Fischler | Restricted rational approximation and Apéry-type constructions[END_REF].

Finally, for the function ψ ∈ E in Proposition 8 we have that µ ψ (ξ) = 1.03 . . . for almost all ξ ∈ R. Therefore, Proposition 8 is still quite far from being optimal, since ζ(3) is presumably a 'generic' real number.

  (i) D 2 m D 2m a 0 ∈ Z, D m a 1 ∈ Z and D 2m D m a 2 ∈ Z, where D m denotes the least common multiple of 1, 2, . . . , m; and (ii) |a 0 |, |a 1 |, |a 2 | ≤ e -(τ 0 +ε)m hold with τ 0 = 0.899668635 . . . . Then |a 0 + a 1 ζ(2) + a 2 ζ(3)| > e -(S+η)m with S = 6.770732145 . . . . Theorem 1 contains the irrationality of both ζ(2) and ζ(3), because τ 0 < 1. Namely, taking a 0 = -p D m , a 1 = q D m and a 2 = 0 shows that ζ(2) = p/q, while the choice a 0 = -D m p D 2m , a 1 = 0 and a 2 = D m q D 2m implies that ζ(3) = p/q. The theorem does not give however the expected linear independence of 1, ζ(2) and ζ(3): it remains an open problem.

  5.70169601 . . . , where Φn is an explicit product over primes, and lim sup n→∞ log |r n | n = lim sup n→∞ log |r n | n = -ρ = -19.10095491 . . . , lim n→∞ log |q n | n = κ = 27.86755317 . . . .

  a 3 , a 4 } and {b * 1 , b * 2 , b * 3 } coincides with {b 1 , b 2 , b 3 } as multi-sets (that is, sets with possible repetition of elements). Then R(t) has poles at t = -k where k = a * 4 , a * 4 + 1, . . . , b 4 -1, zeroes at t = -ℓ where ℓ = b * 1 , b * 1 + 1, . . . , a * 3 -1, and double zeroes at t = -ℓ where ℓ = b * 2 , b * 2 + 1, . . . , a * 2 -1.

  ), (19) the found representation of r(â, b) implies the form (22). The hypergeometric form (23) follows from q(â, b) = (-1) the explicit formula (18) for A k . Finally, the invariance of r(â, b)/ Π(â, b) under permutations of â1 , â2 , â3 follows from (16) and definition (21) of r(â, b).

  )) to simplify the asymptotic consideration in Proposition 4. The quantities (22) then depend on n = 0, 1, 2, . . . ; we write rn = r(â, b), qn = q(â, b), pn = p(â, b) and identify the characteristics ĉ1 = γ1 n and ĉ2 = γ2 n of Proposition 3. Proving the analytical part of the following statement is again similar to what is done in [Zud04, Lemma 12 or Lemma 20], while the arithmetic part follows from the results in [Zud04, Section 7] (cf. [Zud04, Lemma 19]). Proposition 4. In the above notation, let τ0 , τ0 ∈ C \ R and τ1 ∈ R be the zeroes of the cubic polynomial (τ -α0 /2) 2 3 j=1 (ταj ) -(τ -β0 /2) 2 3 j=1 (τ -βj ). Define f0 (τ ) = α0 log(τ -α0 /2) -β0 log(τ -β0 /2) + 3 j=1 αj log(ταj ) -βj log(τ -βj ) -( α0 -β0 ) log( α0 /2 -β0 /2) -( α1 -β1 ) log( α1 -β1 ) + ( β2 -α2 ) log( β2 -α2 ) + ( β3 -α3 ) log( β3 -α3 ). Then lim sup n→∞ log |r n | n = Re f0 (τ 0 ) and lim n→∞ log |q n | n = Re f0 (τ 1 ).

  5.70169601 . . . , and the growth of rn and qn as n → ∞ is determined by lim sup n→∞ log |r n | n = -ρ = -19.10095491 . . . and lim n→∞ log |q n | n = κ = 27.86755317 . . . with the same letters ϕ, κ and ρ as in the introduction.

  n | n = κ = 27.86755317 . . . , so that both families of rational approximations to ζ(2) and ζ(3) are diophantine: lim sup n→∞ log | Φ-1 n D 8n D 16n r n | n = lim sup n→∞ log |2 Φ-1 n D 3 8n rn | n = 24ϕρ = -0.80265093 . . . < 0.

  pn and both ζ(2) and ζ(

  D 2n D n a 2 ∈ Z; and (ii) |a 0 |, |a 1 |, |a 2 | are bounded from above by e -(τ +ε)n .

  1, ζ(2) and ζ(3) are Q-linearly independent since τ 0 > 0. Part (3) of Proposition 5 yields s τ 0 (ζ(2), ζ(3)) ≥ 4.20, so that the statement of Theorem 2 is far from being best possible. The fact that s τ 0 (ζ(2), ζ(3)) < +∞ in Theorem 2 is already new. 4.2. Omitting one number. Recall the definition of the usual exponent of irrationality of µ(ξ) of a number ξ ∈ R from the introductory part. Here comes its generalisation, the ψ-exponent of irrationality, given by S. Fischler in [Fis09].

4. 4 .

 4 Rational approximation to ζ(3) only. Combining Theorem 2 with Proposition 6, we deduce the following result.Proposition 8. For ψ(q) = D 3 n with n = ⌊(log q)/(4τ 0 )⌋ and τ 0 defined in (1), we have the upper bound µ ψ (ζ(3)) ≤ 1.92357696 . . . . Let us conclude with a few remarks on this result. As shown in [Fis09], Apéry's proof of the irrationality of ζ(3) leads to the estimate µ ψ ′ (ζ(3)) ≤ 2, where ψ ′ (q) = D 3 n with n = ⌊(log q)/(4 log(1 + √ 2))⌋. Since 4 log(1 + (2)) > 4τ 0 , this implies µ ψ (ζ(3)) ≤ 2 with the function ψ in Proposition 8. Therefore, Proposition 8 is slightly sharper than what follows from Apéry's construction.

F 3 f, 1 + fh, ha, b h, 1 + f + ah, g 1 = (gf ) N (g) N


Xavier Etchevers
email: xavier.etchevers@orange.com

Gwen Salaün
email: gwen.salaun@imag.fr

Fabienne Boyer
email: fabienne.boyer@imag.fr

Thierry Coupaye
email: thierry.coupaye@orange.com

Noël De Palma
email: noel.depalma@imag.fr

Reliable Self-Deployment of Cloud Applications

Cloud applications consist of a set of interconnected software elements distributed over several virtual machines, themselves hosted on remote physical servers. Most existing solutions for deploying such applications require human intervention to configure parts of the system, do not respect functional dependencies among elements that must be respected when starting them, and do not handle virtual machine failures that can occur when deploying an application. This paper presents a self-deployment protocol that was designed to automatically configure a set of software elements to be deployed on different virtual machines. This protocol works in a decentralized way, i.e., there is no need for a centralized server. It also starts the software elements in a certain order, respecting important architectural invariants. This protocol supports virtual machine and network failures, and always succeeds in deploying an application when faced with a finite number of failures. Designing such highly parallel management protocols is difficult, therefore formal modeling techniques and verification tools were used for validation purposes. The protocol was implemented in Java and was used to deploy industrial applications.

INTRODUCTION

Cloud computing emerged a few years ago as a new approach based on virtualization for an efficient delivery of hardware resources and software applications over a network (typically the Internet). One of the main reasons organizations adopt cloud computing is to reduce IT costs by outsourcing hardware and software maintenance and support. Cloud computing is at the junction of several recent computing paradigms such as grid computing, virtualization, autonomic computing, peer-to-peer architectures, utility computing, etc. It allows users to benefit from all these technologies without requiring extensive expertise in each of them. Autonomic computing is particularly convenient for automating specific tasks such as on-demand resources provisioning or facing peak-load capacity surge (a.k.a., elas-. ticity management). Automation reduces user involvement, which speeds up the process and minimizes human errors.

In this paper, cloud applications are distributed applications composed of several virtual machines running a set of interconnected execution units called software elements. This type of cloud application can benefit from several services provided in the cloud such as database storage, virtual machine cloning, or memory ballooning. To deploy their applications, cloud users need first to build virtual images corresponding to the applicative software stacks (i.e., including operating system, middleware, binaries and data), to provision and instantiate them as virtual machines (VMs), and to indicate the software elements to be run on them. Then, they have to configure these software elements. This involves setting up the configuration parameters that depend on the runtime environment (e.g., IP address, port number). Finally, cloud users have to start the software elements. Both configuration and activation tasks are complex and error-prone if handled manually due to functional interdependencies between software elements. These dependencies between the software elements of a given application define the order which must be respected during the configuration and activation process. This order avoids the application reaching undesired inconsistent states where, for instance, a started software element is connected and sends requests to another element that is not started yet. Therefore, there is a need for management protocols to automate these deployment tasks. A few recent works, e.g., [START_REF] Goldsack | The SmartFrog Configuration Management Framework[END_REF][START_REF] Chapman | Software Architecture Definition for On-demand Cloud Provisioning[END_REF][START_REF] Etchevers | Self-Configuration of Distributed Applications in the Cloud[END_REF][START_REF] Fischer | Engage: A Deployment Management System[END_REF], have focused on this issue. The contribution presented in this paper goes one step further than these works, by designing a fault-tolerant deployment protocol capable of supporting VM and network failures.

This paper introduces a novel self-deployment protocol able to automatically deploy an application on a cloud. Beyond instantiating each VM, the protocol is also responsible for starting each element in a precise order according to the functional dependencies of the applicative architecture. This start-up process works in a decentralized manner, without requiring any centralized manager. Thus, each VM embeds a local configuration agent, named configurator, which interacts with other remote configurators (i.e., on other applicative VMs) to (i) solve dependencies by exchanging configuration information and (ii) determine when a software element can be started, i.e., when all the elements it depends on are started. This protocol is also able to detect VM and network failures occurring during the configuration and activation process. When such a failure occurs, the protocol informs the remaining VMs of what has happened to make the system restore a consistent state, and instantiates a new instance of the failed VM. The proposed protocol supports multiple failures and always succeeds in finally deploying the application and starting the corresponding components (assuming that the number of failures is finite).

Our management protocol involves a high degree of parallelism, which makes its design very complicated. Since correctness of the protocol was of prime importance, it was decided to specify the protocol using formal concurrent specification languages, namely the LNT value-passing process algebra [START_REF] Champelovier | Reference Manual of the LOTOS NT to LOTOS Translator (Version 5.4)[END_REF]. LNT is one of the input languages of the CADP verification toolbox [START_REF] Garavel | CADP 2010: A Toolbox for the Construction and Analysis of Distributed Processes[END_REF], which was used to verify that the protocol satisfies certain key properties, e.g., "when a VM fails, all the remaining VMs are notified of that failure" or "each VM failure is followed by the creation of a new instance of that VM". At the implementation level, we have proposed an XML-based formalism to describe the cloud applications to be deployed, and we have developed a Java tool chain, named Virtual Application Management Platform (VAMP), which includes the reference implementation of the self-deployment protocol [START_REF] Etchevers | Self-Configuration of Distributed Applications in the Cloud[END_REF]. For evaluation purposes, this implementation has been used to deploy realworld applications, e.g., multitier Web application architectures or the Clif load-injection framework [START_REF] Dillenseger | CLIF, a Framework based on Fractal for Flexible, Distributed Load Testing[END_REF].

Our main contributions with respect to existing results on this topic are the following:

• We propose and design an innovative, decentralized protocol to automatically deploy cloud applications consisting of interconnected software elements hosted on several VMs.

• The deployment process is also able to detect and handle VM and network failures, and always succeeds in configuring the application at hand.

• We verified that the protocol respects some key properties using formal specification languages and model checking techniques.

• We implemented the protocol in Java and applied it to industrial applications for evaluation purposes.

The outline of this paper is as follows. Section 2 introduces the protocol, with a specific focus on failure detection and handling. Section 3 first presents the formal specification and verification tasks, and then the implementation aspects. In section 4, related works are discussed before concluding in section 5.

SELF-DEPLOYMENT PROTOCOL

This section first introduces the model used to describe the application to be deployed. Then it presents the protocol participants, the protocol itself, and our solution to handle VM and network failures.

Application Model

An application model represents an abstraction of the target application to be deployed. This model consists of two levels: the runtime environment and the applicative architecture. At the runtime environment level, an application is modeled using a set of VMs. Each VM is characterized by its hardware characteristics (e.g., number of CPUs, size of memory) and a virtual image to be instantiated (e.g., the associated software stack including an operating system, middleware, applicative binaries and data). These VMs do not play any role per se, from a functional point of view, but each of them hosts a set of applicative software elements, where the functional part of the application resides. The description of the software elements involved in an application is modeled using the applicative architecture level, which is based on the Fractal component model [START_REF] Bruneton | The FRACTAL Component Model and its Support in Java[END_REF]. Each software element is abstracted as a component. A component can either provide or require services. Services are modeled using ports: an import port (shortened as import) represents a service required by a component, whereas an export port (shortened as export) represents a service provided by a component. An import on one component will be connected to an export on another component. This type of connection is called a binding. A component can import a service exported by a component hosted on the same VM (local binding) or hosted on another VM (remote binding). An import can be optional or mandatory. A component has three states: started, stopped, or failed. An import is satisfied when it is bound to a matching export and the component offering that export is started. A component can be started when all its mandatory imports are satisfied. Therefore, a component can be started even if its optional imports are not satisfied. A component moves to the failed state when its VM fails.

In the remainder of this paper, a three-tier Web application will be used as a running example. Figure 1 gives the application model, which consists of three VMs. The first one (VM1) hosts a front-end HTTP server (Apache). The second one (VM2) hosts a JEE application server (JOnAS). The third one (VM3) corresponds to the database management system (MySQL). These components are connected through remote bindings (e.g., Apache bound to JOnAS) on mandatory imports (m).

Protocol Participants

The self-deployment protocol involves a deployment manager and a set of VM configurators (shortened as configurators). The deployment manager (DM) guides the application's configuration by instantiating VMs and creating a new instance of a VM when a failure occurs. Each VM in the distributed application is equipped with a configurator responsible for connecting bindings and starting components once the VM instance has been created by the deployment manager. Communication between participants (DM and VM configurators) is asynchronous, involving FIFO buffers. Each VM is equipped with two buffers, an input buffer and an output buffer. When a VM configurator needs to post a message, it puts that message in its output buffer. When a configurator wants to read a message, it takes the oldest one in its input buffer. Messages can be transferred at any time from an output buffer to its addressee's input buffer. It is worth noting that buffers are not explicitly bounded. They are implicitly bounded by the communication system memory size, but the protocol does not involve looping tasks that would make the system send infinite messages to buffers.

Component Start-up

Protocol execution is driven by the configurators embedded on each VM. All configurators evolve in parallel, and each of them carries out various tasks according to a precise workflow, as summarized in Figure 3. In this figure, boxes identified using natural numbers (❶, ❷, etc.) correspond to specific actions (VM creation, component creation, etc.). Diamonds stand for choices, and each choice is accompanied by a list of box identifiers that can be reached from this point.

The start-up process begins when the DM instantiates the VMs (Figure 3). For each VM, it creates an image of this VM (❶) and the VM starts to execute. Each VM is equipped with a configurator, which starts when the DM instantiates the VM. A configurator is responsible for binding ports as described in the application model and starting components in a specific order: a component can be started only if all its mandatory imports are satisfied.

We will now explain how a newly instantiated VM binds its ports and starts its components. At instantiation time, the VM is aware of the binding information (for both local and remote bindings). Therefore, each configurator has explicit knowledge of how its components are supposed to be bound to local or remote components. First, local components are created (❷). Local bindings are handled by the configurator and do not require any interaction with other VMs (❸). For remote bindings, the configurator must perform two tasks. When an export of one of its components is involved in a binding, the configurator sends a message with its export connection information (e.g., IP address, port number) to the VM hosting the client component (❹). When an import of one of its components is involved in a binding, this VM will receive the connection details from the server VM (❼) at some point and, upon reception of that message, the configurator makes the binding effective (❽).

In terms of component start-up, a configurator can immediately start a component without imports or with only optional imports (❺). If a component involves mandatory imports, that component can only be started when all its mandatory imports are satisfied, i.e., when all its imports are bound to started components. When a component is started and that component is used by a remote component, the configurator of the first component must inform the configurator of the second component that the component has been started. To do this, the first VM sends a start message to the second VM (❻). Upon reception of this message (❼), the configurator updates an internal data structure storing the partner component states (export side) for each component. Every time a start message is received, the configurator checks if the corresponding component can be started, i.e., if all its mandatory imports are satisfied (❺). Note that the start-up process involves propagation of start messages along bindings across several VMs. Local bindings are handled directly by the configurator, and there is no need to exchange messages with other VMs either for binding or start-up purposes. The start-up process always terminates successfully because binding cycles over mandatory imports are forbidden. Failure handling (❾ in Figure 3) will be detailed in the next subsection. The corresponding configurators are launched and are aware of the whole application to be deployed (Figure 1). Then, each configurator creates its own components (not illustrated in Figure 4) and sends binding messages as required in the application model. For example, VM3 configurator knows that VM2 needs to connect its JOnAS component to the MySQL component, therefore the VM3 configurator posts a binding message with the information needed to connect to the database (e.g., IP address, port number, login and password) to VM2. Upon reception of this binding message, the configurator binds both components. Note that the VM3 configurator can start the MySQL component quite early in this scenario because this component does not require any service from other components (no imports). The VM3 configurator indicates to VM2 that its MySQL component has started. Upon reception of this start message, the VM2 configurator starts its JOnAS component, and sends a similar message to VM1. The VM1 configurator finally starts the Apache component and the application becomes fully operational.

Failures

The protocol presented in this paper is generic in the sense that it only addresses failures that are not specific to the application to be deployed. Such failures are therefore external to the application and can affect both the execution environment (i.e., the virtual and physical infrastructure) and the management system itself. Contrary to internal failures, which are specific to a given application, external failures can be detected and corrected without any knowledge of the application. This paper focuses on three kinds of failures that concern the execution environment:

• failure of an applicative VM: this interrupts the normal execution of the virtual machine, which becomes unusable; • failure of a configurator running on a VM: this type of failure alters the configurator's behavior, disrupting all exchanges to and from the configurator;

• transitory network failure: this kind of failure interrupts part of the network services for a finite period. These failures can result in message loss or connection closing, but are not definitive.

Self-repairing the rest of the bootstrapping configurators involved in the deployment system (e.g., the deployment manager) is beyond the scope of this paper. Each case of failure introduced above always involves a VM, thus we will use failure or VM failure indifferently in the remainder of this paper. only consider permanent failures: if a transitory failure is detected, it will be treated as a permanent failure.

Failure detection. This detection relies on a heartbeat mechanism. As soon as a configurator embedded on an applicative VM is activated, it launches a thread which periodically sends a synchronous beat to the deployment manager. The continuous reception of these beats by the deployment manager indicates that execution of the VM and network are correct. The deployment manager is configured to accept a maximum delay between two beats from a given configurator. Each time it receives a heartbeat, the manager resets the timer associated with that configurator and waits for the next beat. If it does not receive the next beat before the timer expires, it considers that the configurator/VM or network has failed and initiates a repair phase.

Failure repair. When a failure occurs and is detected, the DM creates a new instance of the failed VM, and indicates the identity of the failed VM and the identity of the newly created VM to the other VMs. When a new instance of a VM is created as a result of a VM failure, the new VM must receive acknowledgement messages from all the other VMs indicating that they have been informed of its creation. This part of the protocol is crucial to avoid erroneous behavior, e.g., the reception of messages by a VM from an unknown emitter.

We will now focus on the other VMs, that is, those that were instantiated before the VM failed and are still being deployed (Figure 5, where 7 stands for ❼ in Figure 3). Upon reception of a message indicating that a VM has failed and another instance of that VM has been created, the configurator first updates the list of known VM identifiers (❶). Then, it purges its buffers (❷), removing all messages coming from or destined for the failed VM, and updates its current state (❸), moving started components to a stopped state if they are connected to failed components and removing all bindings to failed components. When these updates have been completed, the configurator sends an acknowledgement message to the new VM indicating that it is aware of its presence in the application (❹). Finally, it re-sends the binding (❺) and start-up (❻) information details for all remote components (import side) connected to some of its components, and hosted on a re-instantiated VM.

Figure 5: VM Configurator Lifecycle Handling VM Failures

It is worth noting that several VM failures may occur, this can be due to failures of different instances of a single VM or failures of different VMs. A failure can also take place when a VM is already handling a failure involving another VM (cascading failures). If the number of VMs is finite and if there is no cycle of bindings through mandatory imports, the self-deployment protocol terminates successfully: all VMs are instantiated and components will be started.

Example. In Figure 6, we show an example of a VM failure (VM2), occurring when all the VMs have been instantiated and all the components started. When the DM detects VM2's failure, it first creates a new instance of VM2 (VM2') and alerts the other VMs. Upon reception of these messages, both remaining VMs (VM1 and VM3) behave as shown in Figure 5. Thus, the configurator for VM1 changes VM2's identifier, purges its two buffers, stops its Apache component, and unbinds Apache from JOnAS. The VM1 configurator also sends an acknowledgement message to VM2' indicating that it knows it and can receive messages from it. Nothing else is required of VM1, and the VM1 configurator returns to its normal behavior, i.e., ❼ (message reception), as illustrated in Figure 3. In the case of VM3, the configurator for VM3 changes VM2's identifier, purges its two buffers, and sends an acknowledgement message to VM2'. The VM3 configurator also needs to re-send binding information to VM2 and another message indicating that the MySQL component is started. Last but not least, after instantiation, when VM2' has received ack messages from all the other VMs, it behaves normally, as presented in Figure 3 and its JOnAS component can be started, as required in the application model. In this section, we first present the formal specification and verification of the protocol. Second, we introduce the Java implementation of the protocol.

EVALUATION

Verification

Specification. For validation purposes, we decided to specify the self-deployment protocol with the LNT valuepassing process algebra [START_REF] Champelovier | Reference Manual of the LOTOS NT to LOTOS Translator (Version 5.4)[END_REF]. We chose LNT because it is adequately expressive to describe data types, functions, and concurrent behaviors. In addition, LNT is one of the input languages for the CADP toolbox [START_REF] Garavel | CADP 2010: A Toolbox for the Construction and Analysis of Distributed Processes[END_REF], which provides a large variety of verification techniques and tools to automatically analyze LNT specifications.

The LNT specification for the self-deployment protocol consists of at least 2,500 lines of code. A part of the specification depends on the input application model, and is therefore automatically generated from a Python script we implemented. For instance, an application model with 6 VMs results in a 3,500-line LNT specification. Data types are used to describe the application model (VMs, components, ports, bindings), messages, buffers, etc. Functions apply to data expressions and are necessary for three kinds of computation: (i) extracting information from the application model, (ii) describing buffers and basic operations on them, (iii) keeping track of the started components to know when another component can be started (when all mandatory imports are satisfied). Processes are used to specify VMs (configurator, input and output buffer), failure injection, and the whole system consisting of interacting VMs possibly failing at some unpredictable point.

Properties. We identified 15 key properties for the protocol. These properties help to verify that architectural invariants are satisfied during protocol execution (prop. 1, 3 below), final objectives are fulfilled (prop. 2, 5, 7 below) or ordering constraints respected (prop. 4, 6 below). Let us give a few examples of such properties, with a particular focus on VM failure occurrences (prop. 3, 4, 5, 6, 7). For some of these properties, we also give their expression in the MCL language [START_REF] Mateescu | A Model Checking Language for Concurrent Value-Passing Systems[END_REF] used in CADP to formalize temporal properties:

1. There is no cycle of bindings in the component assembly through mandatory imports.

2. All components are eventually started.

3. No component can be started before the components it depends on through mandatory imports.

[ true* . {STARTCOMPO ?vm:String !"JOnAS"} .

(¬'{FAILURE !.*}')* .

{STARTCOMPO ?vm2:String !"MySQL"} ] false

In the running example, the JOnAS component is connected to the MySQL component through a mandatory import, therefore we will never find a sequence where JOnAS is started before MySQL except in case of a failure. This property is automatically generated from the application model because it depends on the component names and bindings in the model.

4. After a VM fails, all other VMs are informed of that failure.

5. Each VM failure is followed by re-creation of that VM. Termination is made explicit in the specification using the special FINISH action.

Experiments. To verify this specification, we used a database of 170 application models. For each input model, we used CADP exploration tools to generate the Labeled Transition System (LTS) corresponding to all possible executions of the protocol for this input. Then, we used the CADP model checker (Evaluator) to verify that this LTS satisfies the 15 properties of interest.

Table 1 summarizes the results obtained for our running example, with an increasing number of possible failures (|F|). We give the size of the LTS generated (before and after strong reduction) using CADP by enumerating all the possible executions of the system, as well as the time to obtain this LTS (generation and reduction) and verify all 15 properties. Experiments were carried out on a Xeon W3550 (3.07GHz, 12GB RAM) running Linux.

It is worth observing that increasing the number of failures induces a gradual growth in the LTS size and computation time. Since we use enumeration techniques, when there are, e.g., four failures during the deployment process, it means that all possible configurations are attempted (e.g., cascading failures of different VMs, successive failures of the same VM, etc.) and all these executions appear in the corresponding LTS. The other parameter increasing these numbers is the number of VMs, which generates more parallelism in the system, and the number of remote bindings in the application model, which augments the number of messages exchanged between VMs. We were able to analyze applications with up to 6 VMs and 10 remote bindings. However, huge applications were not required to detect issues in the protocol: most problems are usually found on small examples exposing corner cases. Issues detected. The formal verification of the protocol using model checking techniques helped to refine certain parts of the protocol and to detect subtle bugs. For instance, one important architectural invariant states that a started component cannot be connected to a stopped component. However, we encountered cases where optional imports violated this invariant, resulting in started components connected to and therefore submitting requests to stopped components. This problem was detected thanks to an extension of property 3 stating that "a component cannot be started and connected to another component, if that component has not been started beforehand". This invariant can only be preserved in the absence of failures: we cannot prevent a started component from being connected to a failed component.

Implementation

This section describes the principles and the assessment of the Java implementation of the protocol 1 .

VAMP Principles. We developed a reference implementation of the reliable self-deployment protocol using the Virtual Applications Management Platform (VAMP) system [START_REF] Etchevers | Self-Configuration of Distributed Applications in the Cloud[END_REF]. VAMP is a generic solution dedicated to the selfdeployment of distributed applications in the cloud. In its first version, VAMP relied on an unreliable deployment process [START_REF] Etchevers | Automated Configuration of Legacy Applications in the Cloud[END_REF]. Thus, the goal of this implementation is to replace the original deployment protocol by the reliable protocol presented in Section 2 so as to enable VAMP to deploy an application in the cloud, in finite time, even if a finite number of VM or network failures occurs 2 .

When receiving a deployment request from a user, VAMP creates a new VM in which a deployment manager is in-1 Although the protocol adopts a decentralized design, its capacity to deal with large scale architecture was previously discussed in [START_REF] Etchevers | Automated Configuration of Legacy Applications in the Cloud[END_REF]. This paper only focuses on its reliability. 2 Although the self-deployment protocol was implemented within a system dedicated to cloud applications (namely VAMP), it was also used within physical runtime environments providing on-demand machine allocation like grids. stantiated. This DM is in charge of deploying the application and therefore bootstraps the deployment by generating virtual images participating in the application and instantiating them as VMs in one or several IaaS platforms. The configurators are included in the virtual images at the generation stage. Once an applicative VM has completely booted, the corresponding configurator starts applying the self-deployment protocol by instantiating, configuring, and activating the local applicative software components.

All the participants in the deployment of a given application (i.e., a DM and the configurators) communicate through an asynchronous reliable distributed message oriented middleware (MOM), the AAA bus [START_REF] Bellissard | An Agent Platform for Reliable Asynchronous Distributed Programming[END_REF]. This middleware interconnects agents. An agent is a plain old Java object (POJO) that runs in a Java Virtual Machine. Each agent can send messages to other agents. When receiving a message, an agent behaves according to an event-action model. In the VAMP system, each management entity is an agent of the AAA middleware. AAA provides some noticeable properties. First, it is distributed within the agents, thus avoiding any centralized mechanism that might suffer from the bottleneck effect. Second, the reaction of an agent to an event is atomic, i.e., it is entirely executed. This mechanism relies on the agent's state persisting before and after each reaction. Third, due to the combination of message persistence and the asynchronous programming model provided by AAA, any agent is assured of the delivery of the messages it sends, even when a finite number of transitory failures occur. However, there is no guarantee of the time at which the messages will be dealt with by the target agent. Finally, AAA preserves message ordering, i.e., messages are received in the same order as they were sent.

Assessment. The evaluation process aims to measure the time to deploy a three-tier Web application (Fig. 1) while randomly injecting a number of failures that could affect any applicative VM. Each test was repeated 10 times. The application deployment was considered completed when all the software components were configured and started.

The underlying IaaS platform used to carry out these tests is an OpenStack Essex running on Linux Ubuntu 12.04 LTS 64 bits. It is deployed on a cluster of IBM HS22 blades (2 Intel Xeon E5504 3GHz quad-core, 32GB memory, 292 GB HDD) interconnected with a Gigabit ethernet network. Each computer node runs a KVM hypervisor to instantiate the virtual machines. 7 shows that the time to deploy the Web application increases linearly in accordance with the number of failures encountered. f (x) = 35,245x + 84,106 is the trend line associated with the mean time measured to deploy an application in the presence of x failures 3 . This equation highlights the 58% gain in time to deployment introduced by the reliable self-deployment protocol compared to its unreliable version. Effectively, replacement of a faulty VM by the protocol only induces about 35 seconds' delay compared to the 84 seconds required to re-deploy a full instance of the Web application.

RELATED WORK

We first focus on existing approaches relying on ADLbased approaches for deploying software applications. [START_REF] Goldsack | The SmartFrog Configuration Management Framework[END_REF][START_REF] Chapman | Software Architecture Definition for On-demand Cloud Provisioning[END_REF] propose languages and configuration protocols for distributed applications in the cloud. SmartFrog [START_REF] Goldsack | The SmartFrog Configuration Management Framework[END_REF] is a framework for creating configuration-driven systems. It has been designed with the express purpose of making the design, deployment and management of distributed component-based systems simpler and more robust. [START_REF] Chapman | Software Architecture Definition for On-demand Cloud Provisioning[END_REF] adopts a model driven approach with extensions of the Essential Meta-Object Facility (EMOF ) abstract syntax to describe a distributed application, its requirements towards the underlying execution platforms, and its architectural constraints (e.g., concerning placement and collocation). Regarding the configuration protocol, particularly the distributed bindings configuration and the activation order of components, contrary to us, [START_REF] Chapman | Software Architecture Definition for On-demand Cloud Provisioning[END_REF] does not work in a decentralized fashion, and this harms the scalability of applications that can be deployed.

[4] presents the design and implementation of an autonomic management system, TUNe. The main principle is to wrap legacy software pieces into components in order to administrate a software infrastructure as a component architecture. The authors also introduce high-level formalisms for the specification of deployment and management policies. This management interface is mainly based on UML profiles for the description of deployment schemas and the description of reconfiguration state diagrams. A tool for the description of wrapper is also introduced to hide the details of the underlying component model. ProActive [START_REF] Baduel | Grid Computing: Software Environments and Tools, chapter Programming, Deploying, Composing, for the Grid[END_REF] is a Javabased middleware (programming model and environment) for object and component oriented parallel, mobile and distributed computing. ProActive provides mechanisms in order to further help in the deployment and runtime phases on all possible kind of infrastructures, notably secure grid systems. ProActive is intended to be used for large scale grid applications. However, it does not handle fault occurrence and repair mechanisms.

[21] introduces Eucalyptus, an academic open source software framework for cloud computing that implements a IaaS solution, giving users the ability to run and control VM instances deployed across a variety of physical resources. Eucalyptus is a convenient solution for automated provisioning of virtualized hardware resources and for executing legacy applications. On the other hand, this platform has not been designed for monitoring and particularly deploying such applications. [START_REF] Chohan | AppScale: Scalable and Open AppEngine Application Development and Deployment[END_REF] presents AppScale, an open source extension of the Google AppEngine (GAE) PaaS cloud technology. These extensions facilitate distributed execution of GAE applications over virtualized cluster resources, including IaaS cloud systems such as Amazon's EC2 and Eucalyptus. App-Scale implements a number of different components that fa- 3 The linear correlation ratio of this trend is 0.9933. cilitate deployment of GAE applications using local (nonproprietary) resources. This solution has a specific focus on the deployment of Web applications whose code conforms to very specific APIs (e.g., no Java threads).

[ [START_REF] Etchevers | Self-Configuration of Distributed Applications in the Cloud[END_REF][START_REF] Salaün | Verification of a Self-configuration Protocol for Distributed Applications in the Cloud[END_REF][START_REF] Abid | Verification of a Dynamic Management Protocol for Cloud Applications[END_REF] present protocols that automate the configuration of distributed applications in cloud environments. These protocols work in a decentralized way as well, but do not support the possible occurrence of failures, nor the possibility to repair the application being deployed when a failure occurs. Another recent related work [START_REF] Fischer | Engage: A Deployment Management System[END_REF] presents a system that manages application stack configuration. It provides techniques to configure services across machines according to their dependencies, to deploy components, and to manage the life cycle of installed resources. This work presents some similarities with ours, but [START_REF] Fischer | Engage: A Deployment Management System[END_REF] does not focus on composition consistency, architectural invariants preservation, or robustness of the reconfiguration protocol.

[18] describes a peer-to-peer architecture to automatically deploy services on cloud infrastructures. The architecture uses a component repository to manage the deployment of these software components, enabling elasticity by using the underlying cloud infrastructure provider. The main added value of this framework is the incorporation of virtual resource allocation to the software deployment process. This framework is one the closest solution to ours. Yet the centralized architecture and the absence of fault-tolerance mechanisms (as all approaches presented in this section) are two important differences.

Last but not least fault tolerance and system reliability has been the subject of many works and studies in the last decades [START_REF] Zamojski | Introduction to the Dependability Modeling of Computer Systems[END_REF]. A system may fail first because of incorrect specification, incorrect design, design flaws, poor testing, or undetected fault. In such a case, a possible solution aims at improving system design and development using static analysis or specific programming models [START_REF] Saha | Software Based Fault Tolerance: A Survey[END_REF]. Another reason causing failures is the environment (e.g., network, human intervention), aging component, operator errors, or hardware failure. A classic approach intends to tolerate faults through redundancy techniques, either active ones (applying redundancy on processes) or passive ones (applying redundancy on data), see e.g., [START_REF] Lamport | The Implementation of Reliable Distributed Multiprocess Systems[END_REF][START_REF] Schneider | Implementing Fault-tolerant Services using the State Machine Approach: A Tutorial[END_REF][START_REF] Chérèque | Active Replication in Delta-4[END_REF][START_REF] Van Renesse | Replication Techniques for Availability[END_REF][START_REF] Elnozahy | A Survey of Rollback-recovery Protocols in Message-passing Systems[END_REF]. Here we preferred a lightweight approach for failure detection and recovery mechanisms, which was simple to develop and sufficient for ensuring fault-tolerance of our deployment solution.

CONCLUDING REMARKS

In this paper, we have presented a self-deployment protocol that aims to configure a set of software components distributed over a set of virtual machines. This protocol works in a fully automated way and in a decentralized fashion. To the best of our knowledge, this protocol is the first deployment protocol supporting VM failures, i.e., the protocol not only detects failures, but also creates a new instance for each failed VM, and restores a stable state for all the other VMs. The protocol always succeeds in starting all the components hosted on the different VMs, even in case of multiple failures. The protocol was formally specified and validated using up-to-date verification tools. The protocol was implemented in Java and applied to industrial applications for evaluation purposes.

A first perspective is to make use of co-simulation techniques to ensure that the specification and implementation conform to one another. Such techniques are not always required: when a bug is found during the specification analysis, it is reported, and in many cases, this is a real bug, i.e., a bug existing in the implementation. Co-simulation techniques would reduce the number of divergences between the specification and the implementation, and this would avoid reporting bugs that are in fact only specification errors. Second, we plan to consider failures of the deployment manager and propose a replication system to ensure reliability of this part of the deployment system. Our last perspective is to extend the protocol and widen the role of deployment managers, allowing them to dynamically reconfigure cloud applications, e.g., by removing or replacing a deployed VM. As a side effect, the configurator's behavior would need to be extended to incorporate those new features.

Figure 1 :

 1 Figure 1: A Three-tier Web Application Model

Figure 2 :

 2 Figure 2: Participants

Figure 3 :

 3 Figure 3: VM Configurator Lifecycle

Figure 4 :

 4 Figure 4: Web Application Start-up Scenario

Figure 6 :

 6 Figure 6: Web Application Failure Scenario

Figure 7 :

 7 Figure 7: Time to Deploy a Three-tier Web Application with VAMP while Injecting Failures

Figure

  Figure 7 shows that the time to deploy the Web application increases linearly in accordance with the number of

Table 1 :

 1 Experimental Results

		LTS (states/transitions)	Time (m:s)
	|F|	raw	minimized	Gen. Verif.
	0	233/565	233/565	0:5	0:10
	1	6,196/16,272	3,125/8,205	0:13	0:21
	2	61,548/175,796	21,980/62,042	0:14	0:31
	3	349,364/1,045,883	100,008/293,555	0:48	7:19
	4	1,489,515/4,601,552	366,269/1,097,990	3:34	26:29
	5	5,381,794/17,035,375 1,206,934/3,654,952	40:13 hours

Acknowledgements. This work was supported by the OpenCloudware project (2012-2015), which is funded by the French Fonds national pour la Société Numérique (FSN), and is supported by Pôles Minalogic, Systematic, and SCS.