Jan Paulus
email: jan.paulus@cs.fau.de

Georg Michelson
email: georg.michelson@uk-erlangen.de

Marcus Barkowsky
email: marcus.barkowsky@univ-nantes.fr

Joachim Hornegger
email: joachim.hornegger@cs.fau.de

Bjorn Eskofier
email: bjoern.eskofier@cs.fau.de

Michael Schmidt
email: michael.schmidt@lpt.uni-erlangen.de

Björn Eskofier

Measurement of Individual Changes in the Performance of Human Stereoscopic Vision for Disparities at the Limits of the Zone of Comfortable Viewing

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

3D displays enable immersive 3D impressions by providing images for each eye separately. Depth is encoded by disparity, the offset between the projections of the same real world 3D point acquired by both eyes [START_REF] Howard | Perceiving in Depth -Volume 2: Stereoscopic Vision[END_REF].

But still the impact of simulated depth on the human perception which can even lead to visual discomfort is not completely understood. Several impacts have been discovered as potential disturbances [9]. One of the main problems is the convergence-accommodation (C-A) conflict [5]. Convergence describes the eyes' alignment mechanism to map points onto corresponding areas in both retinas. Accommodation describes the lenses' mechanism to re-adjust their focus for a sharp image. Naturally the distance to a certain point connects those two mechanisms. For simulated 3D content the convergence mechanism is related to the distance of the virtual object outside of the screen plane while the accommodation mechanism is related to the distance of the screen plane. This results in an unnatural offset influencing the human perception and potentially even in visual discomfort.

Approaches have been proposed based on the depth of focus and Panum's area [16] providing a zone of comfortable viewing where no visual discomfort is present. The depth of focus describes the distance change in which a re-accommodation of the lenses is not required but still a sharp image is obtained. Panum's area is the small region around the surface containing points that are mapped on corresponding areas on both retinas due to convergence, but where still no double image is perceived. The idea is to select the maximum disparity and thus the depth in the simulated images related to the depth of focus and Panum's area (≤ 1 • ). More recent studies recommend an even lower maximum value of 0.2 diopters (D) [4]. Also, studies about definitely annoying conditions for 3DTV consumption have been made [START_REF] Li | Study on visual discomfort induced by stimulus movement at fixed depth on stereoscopic displays using shutter glasses[END_REF].

There have been published various methods to describe and analyze the impact of simulated 3D content on the human perception and potential visual discomfort. Performance tasks [3] have been used as well as subjective questionnaires [8] or measurements of Electroencephalograms (EEG) [START_REF] Ukai | Visual fatigue caused by viewing stereoscopic motion images: Background, theories, and observations[END_REF]. Recently, stereo acuity, the minimum perceivable disparity, before and after consuming 3D content was evaluated on an autostereoscopic display [2].

We assumed the impact of simulated 3D content on the visual system to be individual as visual perception is as well. The goal of this study was to analyze the individual performance of human stereoscopic vision and its change while being affected by increased disparities. Therefore, we evaluated performance tasks at disparities inside and out-side of the zone of comfortable viewing. We assumed a decrease of performance for excessively increased disparities. Our focus was set on the in literature defined performance aspects of stereoscopic vision [7, 12]:

1. Stereo acuity: A quantitative measurement describing the minimum perceivable disparity.

2. Speed: A qualitative measurement describing the time until the depth stimulus is detected.

Robustness:

A qualitative measurement describing the repeatability of the performance results.

We measured estimates of the above listed items by presenting disparity stimuli at different base depth levels and measuring the response times as well as the correct decision rates.

In this study we decided for a polarized 3D-TV as its eyewear is of less weight than eyewear of active shutter technologies and thus more comfortable. Further, polarized technology is less dependent on the viewing position than autostereoscopic displays without expensive head/pupil tracking [15]. Disadvantages like reduced vertical resolution were not of interest for our study as we were interested in the impact of horizontal disparities.

Methods

We provided a four-alternative forced choice (4AFC) setup. Our stimuli consisted of four disks equally rendered in front of a background on the screen plane presented in multiple iterations (Fig. 1). Three disks were rendered in each iteration with the same crossed disparity, further called base disparity, to appear on the same depth plane in front of the screen plane. One of the disks was randomly chosen in each iteration to have a higher crossed disparity and thus to appear closer to the subject. The difference between the crossed disparity of this front disk and the base disparities of the other disks will be further denoted as disparity difference. The subject's task was to identify this front disk in each iteration as fast as possible.

We presented three disparity differences (19 arcsecs, 57 arcsecs, 95 arcsecs) on three base disparities (19 arcsecs, 2280 arcsecs, 4294 arcsecs) in seconds of arc (arcsecs) (Fig. 2). The three disparity differences were classified as simple, medium and difficult performance task levels in decreasing order. The three base disparities were related to the zone of comfortable viewing known from literature [4]. 19 arcsecs equated to 0.002 D. It was classified as a reference value for natural viewing conditions. 2280 arcsecs equated to 0.180 D and was located inside the limits of the zone of comfortable viewing. 4294 arcsecs equated to 0.340 D and was located outside of the zone of comfortable viewing (Fig. 3). We detected three possible issues for the monocular detection of the front disk for which we implemented the following solutions:

1. Size: In perspective projection disks appearing nearer in 3D would appear larger in their projections. In order to eliminate this depth cue, all disks were rendered with the same radius of 180 pixels in their 2D projections.

Disparity offset:

The enlarged disparity would add an offset to the horizontal distances of the disks in one eye's view. Therefore, we applied a random offset to the horizontal offset of each disk's projections individually. The random offset for one disk's projections was the same resulting in a slight shift to the left or right side. The offset could be positive or negative and varied in the range of the largest presented disparity difference.

3. Ghosting: Ghosting added a shimmering ring to each disk showing the amount of disparity monocularly. Therefore, we applied a background to the disks masking the ghosting effect.

Correct decision rate

Each disparity difference was presented in 16 repetitions on each base disparity. A disparity difference was classified as detected if at least 10 out of 16 repetitions in the 4AFC setup were correctly identified. This equated to a correct decision rate threshold of 0.625 and corresponded to the psychometric threshold (PT) [13]. It is calculated by modelling a sigmoid function with a decision rate of 1.000 as upper bound and the guessing rate as lower bound. The threshold is assumed to be located at the steepest position. For a guessing rate of 0.250 this yields to:

P T = 1.000 -0.250 2 + 0.250 = 0.625 (1)
The probability P g of guessing at least 10 out of 16 times correctly is below a significance level of 0.01 and can be calculated as follows:

P g = 16 i=10 B(i|16, 0.25) ≤ 0.01 (2)
where B(•|n, p) is the binomial distribution with n = 16 as total number of iterations and p = 0.25 as the probability for a correct guess. The correct decision rate for each disparity difference was an estimate of stereo acuity and thus indicated a quantitative performance measurement.

Response time

In each repetition we measured the response time starting with the image onset and stopping with a button press by the subject. This resulted in 16 response times for each combination of disparity difference and base disparity. Each response time is an estimate of speed while each set of 16 response times gives information about the robustness.

Final test procedure

The basic test procedure for one repetition consisted of presenting a pair of base disparity and disparity difference. The subject had to select the front disk (forced decision) by pressing a corresponding button on an input device (Fig. 1).

We presented three disparity differences on three base disparities in 16 repetitions each (3 × 3 × 16 stimuli in total). This results in a total number of 144 presentations. The order of the presented base disparities and disparity differences was randomized. At the beginning of a test for each subject each base disparity and disparity difference combination was presented once without being measured and without being included in the 144 presentations.

Experiments and Results

Subjects and Setup

We measured 17 subjects including 13 males and four females (Table 1). Their visual acuities were measured with the "Freiburg Visual Acuity Test" [START_REF] Bach | The freiburg visual acuity test -automatic measurement of visual acuity[END_REF]. The subjects' ages ranged from 17 to 40 (29.2 ± 5.3). If subjects had supporting eyewear (contact lenses, glasses, etc.) they were asked to wear them during all tests. The subjects were told to evaluate a new strategy for stereo acuity tests. They were instructed to wait for the exposure of the stimulus. After exposure they were told to press the corresponding button as fast as possible. Each subject had the possibility to pause the test by leaving one of the buttons pressed down. We used a circularly polarized 3D-TV (Philips 7000 series, SMART LED TV) with a resolution of 1920 × 1080 (Full HD) and a diagonal of 81 cm. The frame rate was 60 Hz.

Evaluation

We compared the response times between the different base disparities at a certain disparity difference using significance tests at a level of 0.05 and of 0.01. We performed a Wilcoxon signed rank test instead of e.g. ANOVA as not all response times per subject and per base disparity could be verified to be normal distributed according to a Lilliefors test with a significance level of 0.05.

Results

For a disparity difference of 95 seconds of arc eight subjects showed significant differences in response times between base disparities of 19 and 2280 seconds of arc and between base disparities of 19 and 4294 seconds of arc. Three subjects only showed significant differences between 19 and 4294 seconds of arc and four subjects showed no significant differences at all compared to 19 seconds of arc. Two subjects showed only significant results between 19 and 2280 seconds of arc (Tab. 2, Fig. 4).

For a disparity difference of 57 seconds of arc eight subjects showed significant differences in response times between base disparities of 19 and 2280 seconds of arc and between base disparities of 19 and 4294 seconds of arc. Six subjects only showed significant differences between 19 and 4294 seconds of arc and three subjects showed no significant differences at all compared to 19 seconds of arc (Tab. 3, Fig. 5).

For a disparity difference of 19 seconds of arc nine sub- jects showed significant differences in response times between base disparities of 19 and 2280 seconds of arc and between base disparities of 19 and 4294 seconds of arc. Four subjects only showed significant differences between 19 and 4294 seconds of arc and two subjects showed no significant differences at all compared to 19 seconds of arc. Two subjects showed only significant results between 19 and 2280 seconds of arc (Tab. 4, Fig. 6).

For a disparity difference of 95 and of 57 seconds of arc all subjects were able to correctly identify all stimuli at each base disparity except of one subject. For a disparity difference of 19 seconds of arc six subjects were able to correctly identify all stimuli at each base disparity. Two subjects had a stereo acuity of higher than 19 seconds of arc as they were not able to correctly identify this disparity difference at any base disparity.

Table 5 summarizes the number of subjects that were able to correctly identify a certain disparity difference at a certain base disparity.

Discussion and Conclusion

We expected that increased base disparities lead to decreased stereoscopic visual performance. As 19 seconds of arc as base disparity was close to natural viewing conditions we assumed those performance results as reference values. We considered significant differences in the response times to be an indicator for a decrease in performance as the qualitative measure "speed" degrades significantly. Thus, subjects required significantly more time to resolve a certain disparity difference into a recognized depth impression for comparison. We considered unsuccessful detection rates to be an indicator for an even stronger decrease in performance as the quantitative measure "stereo acuity" degrades. Thus, subjects were not able to resolve a certain disparity difference into a recognized depth impression for comparison although they have been able at a lower base disparity.

For a disparity difference of 95 seconds of arc we assumed that for those eight subjects showing only significant differences they had a decline in performance inside and outside the zone of comfortable viewing. For those four subjects with no significant differences we assumed that their performance did not change even outside the zone of comfortable viewing. Two subjects are outliers due to their significant differences at the higher base disparities but not at the lower ones. This would mean that their reference performances under natural conditions were lower. For the rest of the subjects the performance progress seemed to correspond to the zone of comfortable viewing as no performance decline appeared inside the zone of comfortable viewing but outside.

For a disparity difference of 57 seconds of arc we assumed that the performance progress corresponded with the zone of comfortable viewing for six subjects. Eight subjects showed a performance decline already inside the zone of comfortable viewing. Three subjects showed no decline in performance.

For a disparity difference of 19 seconds of arc four subjects showed a strong decline in performance as they could not detect disparity differences inside and outside the zone of comfortable viewing. For five subjects the performance progress in terms of detection rates corresponds with the zone of comfortable viewing, for three of them this also holds for the response time differences. Six subjects did not show a strong decline in performance in terms of detection rates inside and outside the zone of comfortable viewing. For one of them the performance progress in terms of response time differences corresponds with the zone of comfortable viewing.

Our findings showed that for most subjects an increased base disparity corresponded to decreased performances. The higher the base disparity the higher the decline in performance. The harder the performance task the stronger the decline in performance for higher base disparities. There might be various reasons for this decline. One might be an increased visual discomfort due to the excessive C-A conflict. Connecting the zone of comfortable viewing with the performance task results would yield to the requirement of an individual zone of comfortable viewing as the performance declines were highly subject dependent. The proposed method shows promising results to be used to measure such individual zones of comfortable viewing but currently there is no connection to visual discomfort as correlations to feedback by the subjects about visual discomfort were missing in this study. This is a requirement for future work.

Future Work

We presented a new method to quantify stereoscopic visual performance at different base disparity levels inside and outside the zone of comfortable viewing. The combined analysis of stereo acuity and response time could enable the measurement of an individual zone of comfortable viewing for a given task complexity assuming comfortable viewing is connected with stereoscopic performance under natural viewing conditions. It could allow to adjust individual zones of comfortable viewing where disparities at their limits either do not change quantitative components of stereoscopic performance or also do not change qualitative components of stereoscopic performance. Our vision is to evaluate the connection between this task performances and visual discomfort and then to integrate tests based on this approach into commercially available 3D displays. Thus, users could run the tests initially on their own so that the display automatically and individually adjusts settings for a 3D television consumption without visual discomfort according to performance levels.

Figure 1 .

 1 Figure 1. Left: A subject performing our stereo vision performance task. Right: The presented stimuli and the used interface. Subjects are asked to identify the front disk by pressing the corresponding button in a four-alternative forced choice (4AFC) test.

Figure 2 .

 2 Figure 2. Disparity is given as angle φ, the difference between the angle β enclosing the eyes and the screen and the angle α enclosing the eyes and the virtual object.

Figure 3 .

 3 Figure 3. The setup of the presented base disparities of the disks indicated by dashed lines with a zone of comfortable viewing of 0.2 diopters (D) or 2475 seconds of arc (arcsecs).

Figure 4 .

 4 Figure 4. Comparison of the response times in ms of one subject for one base disparity against another base disparity (in arcsecs) at a disparity difference of 95 arcsecs using Wilcoxon signed rank test. The values show the differences of the medians computed using all response times respectively. Red colored background indicates that the correct decision rate at one or at both base disparities for the given disparity difference was below the psychometric threshold of 0.625. (*) indicates significance at a significance level of 0.05. (* *) indicates significance at a significance level of 0.01.

Figure 5 .

 5 Figure 5. Comparison of the response times in ms of one subject for one base disparity against another base disparity (in arcsecs) at a disparity difference of 57 arcsecs using Wilcoxon signed rank test. The values show the differences of the medians computed using all response times respectively. Red colored background indicates that the correct decision rate at one or at both base disparities for the given disparity difference was below the psychometric threshold of 0.625. (*) indicates significance at a significance level of 0.05. (* *) indicates significance at a significance level of 0.01.

Figure 6 .

 6 Figure 6. Comparison of the response times in ms of one subject for one base disparity against another base disparity (in arcsecs) at a disparity difference of 19 arcsecs using Wilcoxon signed rank test. The values show the differences of the medians computed using all response times respectively. Red colored background indicates that the correct decision rate at one or at both base disparities for the given disparity difference was below the psychometric threshold of 0.625. (*) indicates significance at a significance level of 0.05. (* *) indicates significance at a significance level of 0.01.

Table 1 .

 1 Table containing all measured subjects with visual acuities, ages, and genders. Visual acuities were measured with the "Freiburg Visual Acuity Test"[START_REF] Bach | The freiburg visual acuity test -automatic measurement of visual acuity[END_REF]. Some visual acuities reach even 4.00/2.00 which is not unusual for young normal subjects according toRassow et al. [11] who measured 5.00/2.50 as a median value. The used visual acuity test is especially designed to also measure those ranges.

		Visual acuity in
	Subject minutes of arc	Snellen	Age Gender
	1	0.50	4.00 / 2.00	29	male
	2	0.50	4.00 / 2.00	23	female
	3	0.60	4.00 / 2.40	30	female
	4	0.60	4.00 / 2.37	32	male
	5	0.50	4.00 / 2.00	34	male
	6	1.03	4.00 / 4.12	29	male
	7	0.93	4.00 / 3.74	40	male
	8	0.50	4.00 / 2.00	32	male
	9	0.65	4.00 / 2.60	27	male
	10	0.50	4.00 / 2.00	27	male
	11	0.50	4.00 / 2.00	26	male
	12	0.50	4.00 / 2.00	17	female
	13	0.53	4.00 / 2.14	27	female
	14	0.95	4.00 / 3.81	25	male
	15	0.50	4.00 / 2.00	31	male
	16	0.55	4.00 / 2.19	30	male
	17	0.68	4.00 / 2.72	37	male

Table 4 .

 4 Comparison of the response times in ms of one subject for one base disparity against another base disparity (in arcsecs) at a disparity difference of 19 arcsecs using Wilcoxon signed rank test. The values show the differences of the medians computed using all response times respectively. Bold values indicate that the correct decision rate at one or at both base disparities for the given disparity difference was below the psychometric threshold of 0.625. (*) indicates significance at a significance level of 0.05. (**) indicates significance at a significance level of 0.01.

	Subject	19 vs 2280	19 vs 4294	2280 vs 4294	Subject	19 vs 2280	19 vs 4294	2280 vs 4294
	1	1192.32**	1524.93**	332.61	1	2233.19**	1650.04**	-583.15
	2	41.51	250.09**	208.57**	2	141.70**	391.74**	250.05**
	3	199.97*	233.39	33.43	3	858.35*	1391.50**	533.15
	4	1266.66*	3383.31**	2116.65*	4	-283.30	2516.64**	2799.94*
	5	116.90*	191.58*	74.68	5	83.31	216.64**	133.33
	6	8.34	208.32	199.98	6	66.74	274.99	208.26
	7	1058.40*	1400.05**	341.66	7	433.32	3483.19**	3049.86*
	8	-116.68*	-91.59	25.09	8	158.18	149.93	-8.25
	9	724.91**	658.32**	-66.60	9	1200.01**	1258.23**	58.22
	10	333.27**	449.94**	116.68	10	374.91**	683.21**	308.30**
	11	16.65	191.69**	175.04	11	125.08*	341.69**	216.61*
	12	-24.92	-91.60	-66.68	12	116.82	108.47	-8.35
	13	175.02*	374.96**	199.94	13	308.40**	633.27**	324.87
	14	524.20*	1908.21**	1384.01*	14	975.02**	4316.73**	3341.71*
	15	-91.56	75.02	166.58*	15	0.09	249.35**	249.26**
	16	158.32**	316.59**	158.27**	16	33.24	241.65**	208.41**
	17	-49.87	166.67**	216.54*	17	25.00	216.71**	191.71

Table

3

. Comparison of the response times in ms of one subject for one base disparity against another base disparity (in arcsecs) at a disparity difference of 57 arcsecs using Wilcoxon signed rank test. The values show the differences of the medians computed using all response times respectively. Bold values indicate that the correct decision rate at one or at both base disparities for the given disparity difference was below the psychometric threshold of 0.625. (*) indicates significance at a significance level of 0.05. (**) indicates significance at a significance level of 0.01.

Acknowledgment

The authors gratefully acknowledge funding of the Erlangen Graduate School in Advanced Optical Technologies (SAOT) by the German National Science Foundation (DFG) in the framework of the excellence initiative.


Guillaume Gaillard

Dominique Barthel

Fabrice Theoleyre
email: theoleyre@unistra.fr

Fabrice Valois
email: fabrice.valois@insa-lyon.fr

Service Level Agreements for Wireless Sensor Networks: a WSN Operator's Point of View

.

Introduction

Implementation of Wireless Sensor Networks (WSNs) solutions with Quality of Service (QoS) becomes a necessity if a company aims at differentiating itself by providing guaranteed connectivity and performances. Moreover, because of the increasing traffic demands and the complexity of deploying multiple superimposed WSN, the use of shared infrastructure among multiple clients will be common sense. Thus, a WSN operator that provides wireless sensor connectivity as a resource to several clients, should be able to quantify the resource usage to establish contract-based business strategies.

In particular, smart cities radio environment is ever denser, and the use of non dedicated frequency bands makes it complex for clients and providers to contract guarantees on the quality of the communication process.

There exists a framework for this kind of contract: the Service Level Agreements (SLAs) [START_REF] Verma | Service level agreements on IP networks[END_REF]. SLAs settle the terms of breach, degradation, and compliance of the contracted clauses a client and an operator agree upon. They also include the financial and tech-nical obligations (repayment, human interventions on the WSN) corresponding to all the situations that can occur.

We claim that a WSN operator will reduce cost by sharing its infrastructure among several clients. Yet, in order to manage all the clients applicative traffics, this sharing requires a SLA architecture that includes all the necessary functions for SLA Management. Clients must obtain guarantees in terms of network capacity, reliability, and delay.

The task is harder than in traditional wired networks because the radio medium is shared and no longer static, and because of the constraints of the sensor node (energy, memory, and processing capacity). Frequent changes in the network have to be monitored, and we must consider all layers at the same time, because they are strongly dependent. Management of SLAs requires features such as admission control or QoS monitoring, with more complex models and algorithms.

Moreover, sensor nodes are energy-constrained. The traffic load impacts the consumption of the nodes and their longevity. When a WSN operator connects new client nodes, it must be watchful in balancing the traffic load: it has to avoid the depletion of nodes for both itself and its clients.

We introduce a new SLA architecture, in which WSN operator monitors, manages, visualizes and grants its clients a personalized view on its network behavior. It may detect, anticipate, and correct the possible incidents. Non contracted usage of the resource can be controlled to preserve the others flows and the energy of the nodes.

In this paper, we go in depth in the architecture description and the functional entities. We highlight the scientific issues concerning our SLA architecture for WSNs. We also illustrate this architecture with examples based on IEEE 802.15.4e [START_REF]IEEE Standard for Local and metropolitan area networks-Part 15.4: Low-Rate Wireless Personal Area Networks (LR-WPANs) Amendment 1: MAC sublayer. IEEE Std[END_REF].

Wireless links in a changing environment are unreliable [START_REF] Baccour | Radio Link Quality Estimation in Wireless Sensor Networks: A survey[END_REF]. The technology must be robust to guarantee durable levels of service. We propose the use of IEEE802.15.4e Time Slotted Channel Hopping (TSCH) where it is easy to differentiate flows, and to have a relationship between the duty cycle of the nodes (i.e. energy consumption) and the usage of the network. The Internet Engineering Task Force (IETF), gathering expertise from academia and industry, is currently working on integrating this technology into the IP world, and take advantage of its experience (e.g. monitoring mechanisms). Our contribution fits in this context, defined by the IETF Working Group 6TiSCH [START_REF] Thubert | An Architecture for IPv6 Over Time Slotted Channel Hopping[END_REF].

The contribution of this paper consists in providing a formal view of the implementation of our new SLA architecture proposal:

• We define the basic entities and their interactions, that are requested to support SLA in the context of WSN;

• We explain how to deal with the admission of new flows on the WSN. We provide corresponding heuristics;

• We discuss the real-time monitoring design and we detail a framework for measures;

• We identify technology-dependent vs generic items. We provide implementation examples in the IETF 6TiSCH [START_REF] Thubert | An Architecture for IPv6 Over Time Slotted Channel Hopping[END_REF] open standard context (IPv6 over IEEE 802.15.4e TSCH).

Next Section will provide the State-of-the-Art in terms of SLAs, and especially on WSNs. We provide the scenario and challenges that we address in Section 3. We highlight the main features of our SLA architecture, and a recommended implementation in Section 4. Then, each functional entity is precisely detailed in Section 5 before we conclude and evoke future implementation perspectives.

Related work 2.1 Service Level Agreements in a nutshell

When a client buys services from a Service Provider, he expects them to be performed with the quality they have been sold for. This is particularly true in telecommunications, (e.g. on IP networks) where the services need to be precisely defined between the operator and the client. The contract describing technical and financial commitments of each party is named a Service Level Agreement [START_REF] Verma | Service level agreements on IP networks[END_REF]. It also states the penalties the operator has to pay in case of a breach. Network operators, when signing SLAs, agree on collecting performance metrics that will prove that the contracted Quality of the Service is maintained. Different strategies exist [START_REF] Verma | Service level agreements on IP networks[END_REF]:

• Static SLA: the operator does not change its system; it takes a statistical risk of breaching the SLA in the future, as in the insurance prediction models;

• Provisioned SLA: the operator reserves resource for each SLA, and guarantees the resource will always have the requested characteristics;

• Adaptive SLA: the operator is able to change the network configuration. It handles both incidents and degradations of the network performance. SLAs are dynamically maintained.

This last approach implies that the SLA defines the maximum time of degradation of the service. This duration of degraded SLA [START_REF] Fawaz | Service Level Agreement and Provisioning in Optical Networks[END_REF] must be short: the operator must rapidly act on its infrastructure to restore its normal performance. The life cycle of the SLAs is illustrated in Fig. 1. IBM has focused part of its research on the Web Services, and for this purpose, Keller and Ludwig have updated the notion of SLAs by proposing a formal framework [START_REF] Keller | The WSLA Framework: Specifying and Monitoring Service Level Agreements for Web Services[END_REF]. They propose an XML-based decomposition of SLAs, that we have used as an inspiring model in the context of WSNs.

SLAs decompose themselves into Service Level Objectives (SLOs), namely logical sub-parts corresponding to a QoS requirement. For instance, At least one gas index shall be collected each week for 99% of the client meters. The SLOs are defined during a time frame, e.g. each working day from 7 a.m. to 8 p.m..

QoS mechanisms for maintaining SLAs

In order to fulfill the requirements of the SLAs, the operator will necessarily use QoS mechanisms, and particularly on a wireless technology [START_REF] Xu Yang | Resource Management for Service Providers in Heterogeneous Wireless Networks[END_REF]:

• Call Admission Control (CAC);

• Resource Control (e.g. Radio Resource Management in radio networks);

• Network Monitoring;

• QoS Prediction;

• Configuration Management.

In wireless networks, the broadcasting nature of the channel mandates that the nodes control their transmissions in order to avoid collisions or interference. In WSNs, one can schedule the communications, according to algorithms such as the Traffic-Aware Scheduling Algorithm (TASA) [START_REF] Palattella | On Optimal Scheduling in Duty-Cycled Industrial IoT Applications Using IEEE802.15.4e[END_REF], which uses matching and coloring heuristics to find a communication solution, given the nodes topology and the required traffic load.

In WSNs, radio link quality estimation is crucial to predict if the agreed-upon QoS will be met [START_REF] Baccour | Radio Link Quality Estimation in Wireless Sensor Networks: A survey[END_REF]. It permits, alongside with other raw measures (e.g. remaining energy of the nodes [START_REF] Li | Energy-efficient task allocation with quality of service provisioning for concurrent applications in multi-functional wireless sensor network systems[END_REF], traffic statistics), to elaborate the composite metrics defined in the SLOs. Some of these metrics prove that the QoS requirement of each SLO is met, and guide the real-time control actions on the network. Others are defined as Key Performance Indicators (KPIs), and sent to the clients and the WSN operator to show them high level statistics of the network.

The communication protocols for WSNs have for long been studied and implemented with the goal of meeting QoS constraints. A classification of the MAC layer mechanisms is proposed in [START_REF] Yigitel | QoS-aware MAC protocols for wireless sensor networks: A survey[END_REF]. At the routing layer, the IETF ROLL RPL [START_REF] Winter | RPL: IPv6 Routing Protocol for Low-Power and Lossy Networks[END_REF] proposes the construction of the routing topology based on Objective Functions (OFs). The OFs include QoS constraints that the topology must meet at buildup. IETF CORE CoAP [START_REF] Shelby | Constrained Application Protocol (CoAP)[END_REF] is an application level protocol based on UDP and adapted for constrained nodes.

Finally, one may design WSNs applicative behavior in order to provide easier resource allocation for concurrent applications [START_REF] Li | Energy-efficient task allocation with quality of service provisioning for concurrent applications in multi-functional wireless sensor network systems[END_REF].

SLA management architectures

More than separate mechanisms, the SLA Management requires that all the above-listed functionalities be combined into a complete SLA architecture. [START_REF] Snoeck | Quality of Service Monitoring in the Low Voltage Grid by using Automated Service Level Agreements[END_REF] is an example of such an SLA architecture, dedicated to electricity distribution grids. Similarly, we intend to specify a SLA architecture for urban operated WSNs. Some works have already considered similar ideas for generic WSNs. Del Cid et al. proposes a lightweight middleware platform, to manage flexible SLAs over WSNs [START_REF] Javier | DARMA: adaptable service and resource management for wireless sensor networks[END_REF], whereas the VITRO project [START_REF] Navarro | VITRO Architecture: Bringing Virtualization to WSN World[END_REF] publicizes a software abstraction layer that enables virtualization in order to share sensor resource among various users. Finally, Octopus [START_REF] Jurdak | Octopus: monitoring, visualization, and control of sensor networks[END_REF] is an open source, TinyOS-specific tool enabling monitoring (visualization) and human control of WSNs.

However, these approaches do not bridge the gap between the monitoring of network resources and node resources and the SLA Management: giving QoS guarantees for WSNs, at network level, is not their concern. We propose a complete and generic architecture for SLA Management over operated WSNs. The next section gives the general context on which we apply the proposed SLA Management architecture.

A general scenario for the SLA architecture

We describe the physical topology on which the proposed SLA architecture is based. We consider a running operated WSN. The network infrastructure is composed of two types of nodes (Fig. 2):

• client nodes that may be installed by the client himself (e.g. gas sensors);

• operator relay nodes owned by the WSN operator. They will forward all the client traffic between the source nodes and the sink(s).

WSN Operator

Clients The implementation of the client firmware impacts the global energy consumption: this must be incorporated in the SLA. The amount of traffic the client nodes offer to the relays (and which ones) is a main part of the contract. This infrastructure permits flexibility: the WSN operator is able to manage the life cycle of the various SLAs, i.e. it controls the lifetime of the relay nodes by balancing the traffic on them, according to the SLAs setup times (when new flows appear) and terminations.

Client B Client C Client A
Our concerns are:

• what occurs when a new client comes with his nodes and asks to use the operator connectivity to access the data of his sensors?

• what amount of additional traffic is the relay network currently able to stand?

To answer this, the operator must have an infrastructure that:

• collects information about the network performance and current capacity;

• allows it to decide to admit or not the new client flows.

If this infrastructure was incorrectly implemented, the WSN operator could admit a new client without the necessary resource: the QoS would be degraded for all the clients, and the lifetime of the relays would decrease. When new relaying nodes are needed to accept a new client, the WSN operator must have access to all information that would help a human engineer to determine how many new nodes would have to be deployed, and where. The WSN operator must face two challenges:

SLA Admitter

• to cover the largest zone possible;

• to densely cover zones of high traffic.

Thus, the strategy of the WSN operator consists in a tradeoff between the number and the load of its clients. The initial deployment choices are crucial (re-deploying a lot of relays is onerous).

Finally, some new routes and configurations must be automatically computed to reflect the new requirements. Moreover, the WSN operator needs to monitor the energy remaining in its nodes in order to anticipate a failure (it is important to change depleted relays before a breach of service appears).

In this scenario, the architecture introduced in Fig. 3 allows the WSN operator to succeed in all previously described challenges.

Big picture of the SLA architecture for WSNs

We highlight the generic details of the SLA architecture illustrated in Fig. 3. Then, an overview of a possible implementation in a 6TiSCH context [START_REF] Thubert | An Architecture for IPv6 Over Time Slotted Channel Hopping[END_REF] is given.

Architecture steps and motivations

The SLA architecture is divided into three temporally-distinct parts :

• the human part, that consists in the (re-)negotiation of the terms of the SLAs;

• the offline part that deals with the admission of new services on the WSN;

• and the executive part (i.e. the online part) that manages the online processes of services on the WSN (this part must control and monitor the WSN parameters and maintain the QoS).

In this way, the SLA architecture encompasses all the aspects of the SLA Management: the left part of Fig. 3 supports week-scale or month-scale changes in human business decisions, whereas the right part promptly reacts to WSN changes.

Human processes

the negotiation of a SLA between the WSN operator and a client is the first step of the whole process.

The client describes his high level applicative needs. He provides the location of the collection points, the characteristic of the traffic. The client selects the duration of the contract, and he specifies the KPIs. The clauses of the SLA are defined accordingly.

The WSN operator processes the SLA in its information system. The SLA decomposition into SLOs is described in Section 4.2. The set of SLOs is then transmitted to the SLA Admitter (See details in Section 5.3).

Admission Process

the SLA Admitter extracts the composite metrics from the submitted SLOs, their combination, their period of validity. It evaluates how much WSN resource the corresponding new SLA would use. Then, it consults the WSN state information in the Service Registry (See details in Section 5.2). It compares the current WSN availability with the global needed resource, including the requirements of the previously admitted SLAs. It concludes and informs the operator about the feasibility of the new submitted SLA.

If the current configuration of the WSN doesn't meet the new traffic requirements, the WSN can adopt new rules (self-adaptation), e.g. a new route setting, to make better use of the WSN resource and make the admission possible.

If the SLA Admitter rejects a new SLA request, we go back to the human part: a human manager should take appropriate business decisions (e.g. make the admission of strategic clients possible by deploying complementary devices). Else, it sends the new flow requirements to the SLA Manager (See details in Section 5.4).

Integration into the online process

the SLA Manager merges the requirements of the new flows with the information it already has in memory.

It will use this input parameter as a base for its realtime analysis. This analysis leads to a set of instructions it will send to the SLA Enforcer (See details in Section 5.5). For instance, Give node [25-35] 2 daily opportunities to transmit 200 B of data to sink C, in less than 300 s.

The SLA Manager consults the Service Registry in real-time to get an up-to-date view of the network state. The Service Registry is fed by the SLA Observer (Section 5.1) whose role is to monitor the WSN. The analysis of the SLA Manager consists in:

• composing raw measures into composite metrics;

• comparing the composite metrics with the flows requirements;

• computing appropriate actions on the nodes configuration.

The SLA Manager reports some of the composite metrics, specified as KPIs in the SLOs, then in the SLA, to both the WSN operator and the clients. Finally, the SLA Enforcer updates in realtime the WSN nodes configuration, according to the SLA Manager's instructions.

We introduced five main functional entities, each one corresponding to a specific role, and interacting with the others via well defined interfaces. Future work will prove the efficiency of the contribution.

Proposal of SLA decomposition

A SLA is for the operator a logical composition of SLOs. A typical SLO is illustrated in Listing 1. It expresses the requirement of GasComp, a gas company: 95% of its gas meter indexes must be collected each day. In this example, the SLO contains:

• A complex metric or a parameter: DayCollectRatio;

• A threshold (the required objective of service, e.g. 95%): the Value marker;

• An internal comparison operator (between bound and metric value): Greater;

• An external composition operator (how to combine this SLO with the other ones to form the full SLA);

• A temporal frame:

periods of applicability: Validity;

evaluation frequency and evaluation mode: EvaluationEvent;

maximum duration of the degradation of the SLO: DegradedTolerance.

Some SLOs should define the clients' obligations: the behavior of the applications must be contracted in the SLAs, and checked in real-time, in order to avoid abusing the WSN.

The complex metric is a high level view of the client requirement. It will be decomposed into a set of network composite metrics by the SLA Admitter (Section 5.3).

Application to a 6TiSCH environment

We argue that IEEE 802.15.4e technology is a good basis for the implementation of a SLA framework for WSNs. Indeed, the standard is designed for addressing QoS requirements of a large number of application schemes [START_REF]IEEE Standard for Local and metropolitan area networks-Part 15.4: Low-Rate Wireless Personal Area Networks (LR-WPANs) Amendment 1: MAC sublayer. IEEE Std[END_REF].

Context

IEEE 802.15.4e has several defined modes, depending on the application requirements. We will here focus on the Time Slotted Channel Hopping (TSCH) mode. The industry world has already used channel hopping technologies such as WirelessHart, and ISA100.11a. TSCH mode of IEEE 802.15.4e MAC standard is newer, not application-specific, and more flexible than its ancestors [START_REF] Palattella | On Optimal Scheduling in Duty-Cycled Industrial IoT Applications Using IEEE802.15.4e[END_REF]. It gives a reliable base for the implementation of QoS mechanisms.

6TiSCH [START_REF] Thubert | An Architecture for IPv6 Over Time Slotted Channel Hopping[END_REF] is working on integrating these WSN in the IP world. This context is advantageous because all the standard mechanisms and protocols of the IP stack may be adapted to our needs (e.g. monitoring, storing the information, etc.).

Definition

if we consider the Channel Hopping mode of IEEE 802.15.4e, the communication is divided into time-slots during which nodes can communicate on a defined frequency. Time-frequency blocks are named cells of communication. Nodes are scheduled to receive or transmit packets on dedicated cells. The schedule may also include shared cells where the nodes participate in a contention if they need to communicate. The schedule is applied on a certain quantity of time-slots, namely a slot-frame, and is periodically repeated. The nodes sleep during unscheduled cells (See Fig. 4).

In the centralized approach of 6TiSCH, the Path Computation Element (PCE) [START_REF] Thubert | An Architecture for IPv6 Over Time Slotted Channel Hopping[END_REF] can change the schedules of the nodes. Whereas in a distributed scheme, the nodes may run multiple instances of RPL [START_REF] Winter | RPL: IPv6 Routing Protocol for Low-Power and Lossy Networks[END_REF], and autonomously update the topology.

Application

In 6TiSCH context, the monitoring function is distributed in each node: each node transmits the raw measures toward the Service Registry, using a protocol for the exchange of the monitoring information, e.g. the IETF CORE CoAP [START_REF] Shelby | Constrained Application Protocol (CoAP)[END_REF]. RPL routing metrics are also a useful information to monitor. The values can be passively collected by the system. The monitoring may be integrated in the communication schedule: some cells may be used to collect the measures.

The enforcement can be addressed in two ways:

• A central PCE may generate the cell allocation schedule (the scheduling algorithm being for instance the Traffic-Aware Scheduling Algorithm (TASA) [START_REF] Palattella | On Optimal Scheduling in Duty-Cycled Industrial IoT Applications Using IEEE802.15.4e[END_REF]) according to the service requirements;

• inside the RPL routing protocol, the DODAG roots would initiate distributed updates of the routing topology.

Guaranteed flows would be assigned dedicated cells, but the WSN operator can give some permeability to non-guaranteed traffic by installing shared cells. Finally, the 6TiSCH context simplifies the admission process. The knowledge of the schedules of the nodes simplifies the QoS predictions, since it gives a clear view on unoccupied remaining cells. Note that it is also easier to predict the node energy consumption.

We will now get into formal descriptions of the generic details of each functional entity, and their interfaces with the rest of the architecture.

Algorithms for the different building blocks

We explain here in details how the different processes work together, and we separate generic algorithms from technology-dependent implementations.

SLA Observer: monitoring of WSNs and applications

In order to manage the network, the WSN operator needs to collect precise information about the performance of the nodes. The SLA Observer (Fig. 5) aims at measuring this information and to transmit it to the Service Registry.

When designing such a monitoring algorithm for WSNs, a tradeoff between the energy consumption and the precision of the measure has to be found. The client traffic is so heterogeneous, (the applications can generate from one transmission a day to several packets each hour [START_REF]Spectrum Requirements for Short Range Device, Metropolitan Mesh Machine Networks (M3N) and Smart Metering (SM) applications[END_REF]), that the measure payload can exceed the data payload at some relay nodes. Hence, the measure algorithms have to be well designed not to waste energy.

What we measure

raw measures are locally built on each node. The SLA Observer typically depends on the node technology, because the measurement will take place in the firmware (not all nodes can measure the same Link Quality Indicators (LQI)) or on the software (average packet delivery ratio (PDR) may be differently computed) [START_REF] Baccour | Radio Link Quality Estimation in Wireless Sensor Networks: A survey[END_REF]. Measures take place at different protocol layers (e.g. MAC single-hop delay, routing topology information, packet queue state of the nodes).

The SLA architecture requires the following endto-end or local generic metrics:

• delay;

• packet loss rate;

• residual energy;

• traffic load.

How we measure

some measurements may be periodically driven. The period impacts the granularity of the measure: large sampling (e.g. one measure every hour) is more energy-efficient than short sampling but does not give precise information. Clients may need a specific measure precision, and that could be a reason for differentiation among providers: the WSN operator should monitor precisely enough its network performance, to satisfy the client requirements.

Other measurements should only be held in specific occasions (e.g. when the application layer requests a specific parameter) or depending on previous measurements (e.g. react when a previous value has reached a threshold, or when no change has been seen for long).

How measures are collected

the SLA Observer has to store the local measures in the Service Registry (See details in Section 5.2). Depending on the technology, it can:

• use a dedicated channel of communication (outof-band) with independent protocol stack. This requires that the nodes support multiple technologies. For instance, the measures could be placed in dedicated CoAP messages [START_REF] Shelby | Constrained Application Protocol (CoAP)[END_REF];

• use passive monitoring: no explicit traffic is generated on the WSN, a server in the WSN operator core network centrally observes all the transiting packets;

• use active monitoring: either send dedicated monitoring packets, or piggyback the measures onto the data packets. When piggybacking, the WSN operator may need to inspect data packets of the client. Thus, confidentiality should be handled carefully;

• measures may be retrieved either on-demand (with a specific request message) or periodically.

For instance, the DSME mode of IEEE 802.15.4e provides periodic link status reports to a central entity;

• use hybrid monitoring: in order to save bandwidth, the SLA Observer can use passive monitoring for normal activity, and reactive dedicated packets in case of incidents or specific applicative needs.

Service Registry: a database for raw measures

The Service Registry contains all the information about the network performance. The raw measures produced by the SLA Observer can't be stored in the WSN nodes, that are memory-constrained (they can only keep the current local information). Moreover, the raw measures must be consulted by the other entities of the architecture (SLA Manager, SLA Admitter), without occupying the WSN resource. Hence, the Service Registry must be centralized (e.g. a database in the WSN operator core network). We keep the raw measures all along the SLA duration. Thus, if the WSN operator changes the algorithms of the SLA Manager and SLA Admitter, new policies can be applied taking into account the whole history of the WSN.

Given that we monitor various sensor nodes, during long periods, the measures have to be accurately identified and classified. We propose the following log format for the raw measures:

• timestamp: the time of the measure;

• measurer (id): the producer of the measure;

• entity (ids): which entities have been measured;

• type: abstract unit (See Section 5.1.1);

• mode: how it has been measured (See Section 5.1.2);

• value: the measure itself.

Producing the timestamp is challenging since measures are done locally, with local, distributed clocks. Nodes may be synchronized (e.g. in IEEE 802.15.4e TSCH). The impact of the clock drift on the precision of the measure is then limited, while the energy cost increases. Passive monitoring, held outside of the WSN, does not suffer synchronizing issues, but the measures are less precise. Note that if the WSN operator updates the SLA Observer, new Measure Types can be directly written if needed. A more detailed example of how raw measures may be collected from the Service Registry is given in the following XML-based formalism:

SLA Admitter: Controling the Admission of new clients

The SLA Admitter (Fig. 6) acts as the interface between the human decisions and the SLA architecture.

It answers the new SLA installation requests by analyzing their feasibility, regarding current WSN state. Hence, the installation of unfeasible SLAs should be forbidden.

The SLA Admitter first manages the translation of the SLOs into resource needs for each relay node. The result of this translation includes:

• the set of relay nodes connecting the client (e.g. kind of virtual source nodes, owned by the operator);

• the amount of traffic the new SLA guarantees on the WSN operator source nodes;

• the delay requirements of the new client flows;

• the time frame of these guarantees (e.g. working hours) and their duration.

Once the traffic shape is determined, the SLA Admitter consults the Service Registry. Based on the raw measures, it computes the current estimation of the network state:

• the remaining capacity of the WSN operator source nodes;

• the physical topology information (e.g. the connectivity graph of the WSN);

• the delay each route induces;

• the variations of this information during the time frame of the composite metrics.

The analysis has to predict the impact of the new traffic flows on the relay nodes (energy, occupation, etc.). It must consider changes in the WSN configuration (e.g. new routing paths, load balancing on the relays, etc.). These QoS predictions on WSNs are complex, given the variability of the parameters, and still represent a research challenge [START_REF] Li | Energy-efficient task allocation with quality of service provisioning for concurrent applications in multi-functional wireless sensor network systems[END_REF][START_REF] Yigitel | QoS-aware MAC protocols for wireless sensor networks: A survey[END_REF].

Note that the granularity of the SLO may vary according to the cost strategy of the WSN operator. Moreover, the WSN technology impacts the precision and form of the raw measures. Hence, the SLA Admitter is technology-dependent. In cases where the analysis fails to install the new SLA, the SLA Admitter must give a complete report of the reject to the WSN operator. The report permits to determine where are the hard points that have prevented the admission, and what can be done about it (e.g. deployment of new relays).

The SLA Admitter accepts the SLA request by giving the corresponding node requirements to the SLA Manager. Indeed, the output of the analysis is the set of requirements implied by the SLA installation, for all the relay nodes.

SLA Manager: Controlling and reporting the WSN state

The SLA Manager represents the intelligence of the system. It interfaces the offline part and the online part of the SLA architecture.

interface with the SLA Admitter

the SLA Manager stores for each relay node and each client flow the new incoming resource requirements:

• the expected traffic load;

• the requirements;

• the time frame of application (i.e. the time bounds during which the requirements apply).

analysis of performance

it collects the raw measures from the service Registry, and aggregates them into composite metrics that correspond to the set of requirements it has stored. For instance, it evaluates the end-to-end delay from the MAC single hop delay values on the path, taking into account the Packet Delivery Ratio (PDR) and the buffer state of the nodes. Then the SLA Manager compares the measured state of the network (i.e. the composite metrics) with the set of requirements: if the requirements are not met, the corresponding SLA is considered degraded. With such analysis, the SLA Manager may autonomously change the configuration to resolve the incident. If no parameter can be thwarted to meet the contracted QoS, an alarm is raised for human decisions to be taken (manual intervention, renegotiation, etc.). QoS provisioning mechanisms in WSNs still constitute a research challenge [START_REF] Palattella | On Optimal Scheduling in Duty-Cycled Industrial IoT Applications Using IEEE802.15.4e[END_REF].

The SLA Manager must also monitor the energy level of the relay nodes. It reports an alarm to the WSN operator when necessary (when a threshold is reached).

reporting

besides the alarms, the SLA Manager reports some of the composite metrics, denoted as KPIs, to the clients and the WSN operator to show them specific views on the behavior or the state of the WSN. For instance, a client may want to supervise the applicative delay for packet on specific nodes, in order to write its own commercial offer, or for troubleshooting purpose on specific sensors. The message exchange between the SLA Manager and the SLA Enforcer depends on the nature of the SLA Enforcer.

SLA Enforcer: set up networking configuration

The SLA Enforcer controls the actual configuration: it provides each node its routing and MAC instructions, translating the SLA Manager requirements. This entity is consequently technology dependent.

While the SLA Manager gives generic requirements, the SLA Enforcer translates them in protocoldependent instructions. For instance, the SLA Enforcer will construct a DODAG with an objective function and some routing metrics directly translated from the requirements of the SLA Manager. Note that these changes may impact one specific relay, a group of nodes, or even the whole operated WSN. Fig. 8 illustrates an implementation of the SLA Enforcer in a 6TiSCH context [START_REF] Thubert | An Architecture for IPv6 Over Time Slotted Channel Hopping[END_REF]. The node schedules are directly modified in the PCE, according to the generic instructions. Then the PCE transmits the schedules to the nodes.

Note that the SLA Enforcer can also behave independently of the SLA Manager instructions. For instance, it may decide to locally balance the traffic over some nodes, or to carry out local Admission Control on unexpected traffic flows. In this case, configuration loops between the SLA Manager and the SLA Enforcer have to be avoided.

Conclusion

Future increase in the Internet of Things area, particularly in urban environment, will dynamize the WSN market. Specific actors denoted in this paper as WSN operators will sell wireless connectivity that will be shared among various clients. They will gain profitability by positioning themselves on specific market sectors: this differentiation will be based on their business strategy, i.e the price policy, and on the QoS guarantees they offer. They will use the SLA framework to settle contractual clauses about these guarantees.

We propose a complete roadmap to build an architecture for SLA management on WSNs. We distinguish five functional entities: the SLA Observer, the Service Registry, the SLA Admitter, the SLA Manager and the SLA Enforcer. We argue that they are necessary mechanisms for guaranteeing QoS, thus maintaining contracted levels of service. Our SLA architecture defines efficient interactions between these entities, and provide the formal algorithms they apply / run. We focus our examples of implementation on existing standards, particularly on the robust IEEE 802.15.4e TSCH technology.

As a future work, we plan to provide an entire implementation. We will evaluate the efficiency of the admission and management heuristics, the composition of network measures and the monitoring energy cost.

Figure 1 :

 1 Figure 1: The lifecycle of Service Level Agreements.

Figure 2 :

 2 Figure 2: Nodes infrastructure of an operated WSN.

Figure 3 :

 3 Figure 3: The SLA architecture for WSNs: main entities and their interactions.

<S e r v

  i c e L e v e l A g r e e m e n t name="GasComp"> <S e r v i c e L e v e l O b j e c t i v e name="GasDayCR"> <V a l i d i t y> <S t a r t> 2016-01-01 </ S t a r t> <End> 2030-12-31 </End> </ V a l i d i t y> <E x p r e s s i o n> <P r e d i c a t e x s i : t y p e=" G r e a t e r "> <SLAParameter> D a y C o l l e c t R a t i o </ SLAParameter> <Value> 0 . 9 5 </ Value> </ P r e d i c a t e> </ E x p r e s s i o n> <E v a l u a t i o n E v e n t> D a i l y </ E v a l u a t i o n E v e n t> <D e g r a d e d T o l e r a n c e> 2 </ D e g r a d e d T o l e r a n c e> </ S e r v i c e L e v e l O b j e c t i v e> <S e r v i c e L e v e l O b j e c t i v e name="GasWeekCR"> . . . </ S e r v i c e L e v e l A g r e e m e n t> Listing 1: XML source code of a Service Level Objective.

Figure 4 :

 4 Figure 4: Duty cycle of a TSCH node.

Figure 5 :

 5 Figure 5: The SLA Observer.

Figure 6 :

 6 Figure 6: The SLA Admitter.

Figure 7 :

 7 Figure 7: The SLA Manager.

5. 4 .

 4 4 action command the SLA Manager triggers changes in the technologydependent configuration of the WSN operator relay nodes (e.g. Give node [25-35] 2 daily opportunities to transmit 200 B of data to sink C, in less than 300 s). The generic set of instructions includes: • the IDs of the nodes concerned by the change;• the generic characteristics of the change;

Figure 8 :

 8 Figure 8: The SLA Enforcer.


Jinna Qin
email: jinna.qin@ensam.eu

L Éonard
email: leonard@enim.fr

Gabriel Abba
email: gabriel.abba@ensam.eu

NON-LINEAR OBSERVER-BASED CONTROL OF FLEXIBLE-JOINT MANIPULATORS USED IN MACHINE PROCESSING *

This paper proposes to use a non-linear observer to build the state and the external force of flexible manipulator robots during their machining (composite materials) processes or Friction Stir Welding (FSW) processes. These two different processes have a problem in common: the flexibility of the robot can not be neglected, that is to say, the errors due to the deformation of the links should be taken into account. However, in most industrial robots, the real positions and velocities of each link are not measured, so in this study, an observer is proposed to reconstruct the real angular positions and velocities of links by using the measured angular positions and the velocities of actuators. A simulation by Matlab/Simulink has been carried out with a 2 axis Robot during its machining processes: the proposed observer showed great performances in estimating the state of the robot (position and velocity). Then, in order to improve the tracking accuracy in the tool frame, the state of the external force along the forward direction (x) and its normal direction (y) are required, while they are also not measured by our robot. A disturbance observer has been added to reconstruct the processing force. A good precision during the proposed processes have been obtained using the latter. This study contributes to solve the problem from the point of

INTRODUCTION

Manufacturing processes such as machining and welding are widely applied in production industry. This study focus on two special processes: machining of composite materials and the Friction Stir Welding (FSW) process. These two applications have an innovative character: the first one concerns an application of composite materials, and the second one is a new development of welding. Composite materials are used extensively for their high specific properties of strength and stiffness, however, these materials are difficult to machine due to nonhomogeneous, anisotropic and reinforced by very abrasive components. The FSW is a solid state welding technology that can be used for many joining applications. The process uses a nonconsumable rotation tool consisting of a pin extending below a shoulder, plunges into the work piece such that both the pin and the shoulder are in contact with the piece [START_REF] Zimmer | Contribution à l'industrialisation du soudage par friction malaxage[END_REF][START_REF] Bres | Simulation of friction stir welding using industrial robots[END_REF]. The technical and economic performances of some manufacturing processes can be greatly improved by using a manipulator or a robotic system as holder of the production tooling. However, using robot to do these two processes is a challenge: the natural rigidities of industrial robots are not sufficient to perform the tasks in the requirements of the processes. Actually, those processes are carried out by some special developed machines which need a great investment. In the sector of aeronautic industry, these two processes need to be strongly applied. New technologies are demand to reduce the investment and to improve the quality of the products. Due to a strong external force during the operations, the deformations of the robot cannot be neglected, therefore, the real angular positions and velocities of links are different from those determined by the geometric model of the robot. Moreover, to make an accurate machining or welding, the forces exerted on the material should be measured. Unfortunately, most of the industrial robots have only motor side measurements, thus a new approach to estimate link side states as well as the external force is required. Nevertheless, in case of welding, a force sensor is added to get at least the axial effort to the work plan, but the path effort F x and normal effort F y are still unknown.

There are many control methods available for the flexible robots [START_REF] Moberg | On modeling and control of flexible manipulators[END_REF] such as iterative learning control, adaptive control, backstepping, sliding mode control, neural networks, singular perturbations, composite control, pole placement, input shaping, passivity-based control, robustification by Lyapunov's second method, model-based feedforward control [START_REF] Grotjahn | Model-based feedforward control in industrial robotics[END_REF]. A good description of these control methods can be found in [START_REF] Khalil | Modeling, Identification and Control of Robots[END_REF][START_REF] Spong | Robot Modeling and Control[END_REF][START_REF] Siciliano | Springer Handbook of Robotics[END_REF][START_REF] Siciliano | Robotics: Modelling, Planning and Control[END_REF].

Disturbance observer technique is widely used in mechanical servo systems and observers are often used for the state estimations [START_REF] Jankovic | Observer based control for elastic joint robots[END_REF][START_REF] Besanc ¸on | Nonlinear Observers and Applications[END_REF]. An adaptive robust control of FSW and an observer-based adaptive robust control (ARC) approach is discussed in [START_REF] Davis | Observerbased adaptive robust control of friction stir welding axial force[END_REF] where it is proved that the axial force can be also estimated by an observer. An application of disturbance observers to nonlinear systems is reported in [START_REF] Kravaris | Nonlinear observer design for state and disturbance estimation[END_REF]. An accelerationbased state observer is presented in [START_REF] De Luca | An acceleration-based state observer for robot manipulators with elastic joints[END_REF]. Subrahmanya and Shin [START_REF] Subrahmanya | Adaptive divided difference filtering for simultaneous state and parameter estimation[END_REF] propose a method of state estimation. There are a lot of observer methods proposed by other researchers such as highgain observers, sliding mode observers [START_REF] Spurgeon | Sliding mode observers: a survey[END_REF], extended state observers, Kalman Filter and the Luenberger observer. In order to realize these operations, we propose an improved observer which can estimate not only the unmeasured states but also the external force.

This paper is organized as follows: a simplified model of flexible manipulators and the model of processing force for the two processes that mentioned above will be presented in the first part. The second part proposes a new observer which uses motor side measurements to reconstruct the state of robot as well as the external force. In the third part, a simulation is carried out by Matlab/Simulink to verify the tracking performance with the proposed observer. And finally, a conclusion and some further applications of this study will be presented.

MODELING OF ROBOT AND PROCESSES

Robotic manipulators are highly nonlinear and coupled dynamic systems, there also subjected to different external disturbances. This study is a part of the project COROUSSO (see acknowledgment). The objective of this project is to realize ma- chining process and FSW process with industrial robots. In a first step, in order to simplify the approach, the tool is considered to stay in a horizontal plan during the machining process, the considered robot is a Scara robot which has two joint axis in parallel. The necessary parameters are taken from a robot IBM7545 that presents in [START_REF] Yao | Model-based motion planing for robotic assembly of non-cylindrical parts[END_REF]. It is a robot not well adapted to this task, but we will study firstly the problems addressed.

Hereafter, the flexibility of joints, the efforts applied by the robot, the gravity and the frictions are taken into account.

A. Model of two axis flexible joint robot

The model parameters of two-link flexible manipulator used in the simulations are given in Table 1. It is supposed that the tool is fixed at the end of the second axis and its rotation axis is assumed perpendicular to the work plan (x, y), and the tool moves only in the plan (see Figure 1). Assuming that the links are rigid and only the joints have torsional stiffness due to the gearbox that are taken into account.

The position of the tool (x 2 , y 2 ) is calculated with the articular positions of each link q = [q 1 q 2 ] T by using the geometric model: According to [START_REF] Spong | Robot Modeling and Control[END_REF], a flexible joint robot can be modeled as follows: D(q) q = K(q mq) -H(q, q)f q q -J T (q)F (2)

{ x 2 = l 1 cos(q 1 ) + l 2 cos(q 1 + q 2 ) y 2 = l 1 sin(q 1 ) + l 2 sin(q 1 + q 2 ) (1)
J m θ = Γ m -N v Γ -f m θ (3)
where J T (q) is the Jacobian matrix of the tool axis position, F represents the effort applied by robot on external process, Γ m is the vector of motor torques, θ represents rotor positions and q m is defined as the positions after the gear reduction, i.e.

q m = N v θ , N v = diag[1/N 1 , 1/N 2 ], D(q)
is the symmetric, uniformly positive definite and bounded inertia matrix. H(q, q) represents the contribution due to centrifugal, Coriolis and gravitational forces, f q , f m and J m are diagonal matrices with

f q = diag[ f q1 , f q2 ], f m = diag[ f m1 , f m2 ] and J m = diag[J m1 , J m2 ].
It is supposed that the links are rigid and the flexibilities are only localized at the reduction gears and are represented by a stiffness

K = diag[K 1 , K 2 ].
Therefore, the torque due to the flexibility can be expressed:

Γ = K(N v θ -q) (4)

B. Modeling of machining process

The machining process concerned in this part is called a contour milling of composite materials, Dumas discussed this operation in her thesis [START_REF] Dumas | Développement de méthodes robotisées pour le parachèvement de pièces métalliques et composites[END_REF]. The piece is machined within one pass which means that the end of the tool is out of material and the helicoidal angle of the tooth is small, so the axial force F z can be considered as null. The model of cutting force developed by Tlusty and Macneil [START_REF] Tlusty | Dynamics of cutting forces in end milling[END_REF] can be applied in this case:

There are three assumptions: 1. The tangential cutting force F t due to the passage of one tooth is proportional to the cut section:

F t = K t ha p ( 5
)
where h is the thickness of the chip in mm, depth of cut a p in mm and the specific cutting force K t expressed in N mm -2 . The cut surface is equal to ha p . 2. The radial cutting force F r due to the passage of one tooth is proportional to the tangential cutting force.

F r = K r F t (6)
where K r is a dimensionless coefficient of proportionality essentially depends of the friction effect on the tool.

3. The chip thickness (see Figure 3) can be expressed as follow:

h(ϕ) = f z sin(ϕ) (7)
with ϕ, the angle between the tooth and the normal of the advance direction (between F r and F y ), then :

δ F t = K t a p f z sin(ϕ)dϕ (8)
Because the rotation speed of the tool is high, the harmonics of the force spectrum acted on the robot has little influence. Therefore, the effort F t and F r is calculated as the average effort of each period of rotation. The projection of the radial and tangential forces in the (x, y) frame gives the following equations [START_REF] Dumas | Développement de méthodes robotisées pour le parachèvement de pièces métalliques et composites[END_REF]:

F x = 2 π ϕ e ϕ s [ δ F t cos(ϕ)+ δ F r sin(ϕ)] dϕ F y = 2 π ϕ e ϕ s [-δ F t sin(ϕ)+ δ F r cos(ϕ)] dϕ (9)
Figure 3 shows the geometric model of clipping and defines the angles ϕ e and ϕ s . x m and y m are denoted as the position of the piece edge, and (x 2 , y 2 ) is the axis position of the rotation axis of the tool.

The machining process can be divided into 3 phases: Phase 1: Relative tool position to the piece with 0

<(x m -x 2 ) ≤ Rt and (x m -x 2 ) 2 + (y m -y 2 ) 2 > R 2 t : ϕ e = π 2 -cos -1 x m -x 2 R t ( 10
)
ϕ s = π 2 + cos -1 x m -x 2 R t ( 11
)
Phase 2: Relative tool position to the piece with

(x m -x 2 ) 2 + (y m -y 2 ) 2 ≤ R 2 t and (x m -x 2 ) > 0: ϕ ϕ ϕ ϕ Ω FIGURE 3.
Geometric position of the tool during machining process.

ϕ e = π 2 -sin -1 y m -y 2 R t ( 12
)
ϕ s = π -sin -1 x m -x 2 R t ( 13
)
The efforts during phase 1 and phase 2 can be written as follows:

F x = K t a p f z 2π [-cos(2ϕ s ) + 2K r ϕ s -K r sin(2ϕ s ) (14)
+cos(2ϕ e ) -2K r ϕ e + K r sin(2ϕ e )]

F y = K t a p f z 2π [sin(2ϕ s ) -2ϕ s -K r cos(2ϕ s ) -sin(2ϕ e ) (15)
+2ϕ e + K r cos(2ϕ e )]

Phase 3: Relative tool position to the piece with (x mx 2 ) < 0, supposing that displacement on direction y is small enough that the angle ϕ s can be considered as constant during the process:

ϕ e = π/2 -sin -1 y m -y R t ( 16
)
ϕ s = π ( 17
)
F x = K t a p f z 2π [2K r (π -ϕ e ) + cos(2ϕ e ) -1 + K r sin(2ϕ e )] ( 18
)
F y = K t a p f z 2π [2(ϕ e -π) -sin(2ϕ e ) + K r cos(2ϕ e ) -K r ] (19)
This cutting force model can simulate the change of the effort during the operation. Note that the parameters K r and K t need to be identified from the measurements of the average force obtained during a machining operation.

C. Modeling of FSW process

The advantage of FSW is to avoid the problems met in classical welding by melting the metals. For this reason, FSW process has been implemented, primarily in the transportation industries that use aluminum to reduce the weight of mechanical structures [START_REF] Bres | Simulation of friction stir welding using industrial robots[END_REF]. This process can be divided into three phases: diving, welding and removing the tool. This paper focus on the welding phase which is similar to our machining process. To simplify the process, it is supposed that the tool is always perpendicular to the plan during the operation. In order to improve the tracking performance, the axial effort F z , path effort F x and normal effort F y (see Figure 4) are needed. Control of the external weld force is desirable to improve the weld quality. However, not all the external forces are measured in industrial applications due to the high price of these force sensors and some of them are not measurable.

The axial force in FSW process is the pressure produced by the pin and shoulder of the tool. The path force is the force imposed on the tool along the welding direction. The normal force is the force imposed on the tool in the plane of the part and perpendicular to the path direction, this force is typically directed from the weld retreating side to the weld advancing side and is caused by the unbalance of the material flow on the two sides.

Based on static model of [START_REF] Zhao | Design and implementation of a nonlinear axial force controller for friction stir welding processes[END_REF], the expression of efforts can be written as follows:

F z = K z d α z v β z Ω λ z (20) F x = K x v β x Ω λ x ( 21
)
F y = K y d α y v β y Ω λ y ( 22
)
where Ω is the spindle rotation speed, ν is the travel speed along the path, d is the plunge depth, and the unknown parameters K i , α i , β i , λ i ; i ∈ [x, y, z] can be estimated using the Least Squares method.

OBSERVER DESIGN

Disturbance observer technique is widely used in control for improving disturbance rejection and robust performance [START_REF] Park | Disturbance observer based robust control for industrial robots with flexible joints[END_REF]. The unknown input observer (UIO) method is one of the most well known approach to estimate states [START_REF] Xiong | Unknown disturbance inputs estimation based on a state functional observer design[END_REF]. Hereafter, assuming that the articular position and velocity of motor axis and the effort F z are measured by sensors. A reduced order high-gain observer is then proposed to reconstruct the articular position and velocity of links and the process efforts F x and F y . The new observer proposed in this paper, is based on a nonlinear observer introduced in [START_REF] Jankovic | Observer based control for elastic joint robots[END_REF], which reconstructs the articular position and velocity of links thanks to the measures of the position and velocity of motor axis. Observer described in [START_REF] Jankovic | Observer based control for elastic joint robots[END_REF] is then modified in order to get also an estimation of efforts by adding more state variables function of this force.

If the state variables x i are defined as:

x 1 = q = [q 1 q 2 ] T , x 2 = q = [ q1 q2 ] T , x 3 = q m = [q m1 q m2 ] T , x 4 = qm = [ qm1 qm2 ] T , q m = N v θ and the gear factor N = diag[N 1 , N 2 ]
the following state space model can be obtained:

⎧ ⎪ ⎪ ⎨ ⎪ ⎪ ⎩ ẋ1 = x 2 ẋ2 = q = D(q) -1 [K(q m -q) -H(q, q) -f q q -J T (q)F] ẋ3 = x 4 ẋ4 = qm = (J m N 2 ) -1 [NΓ m -Γ -( f m N 2 ) qm ] (23)
The measured variables are now denoted y and the following change of coordinates is considered:

⎧ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎩ z 1 = [(J m N 2 ) -1 K] -1 x 4 = K -1 (J m N 2 )x 4 z 2 = x 1 = q z 3 = x 2 = q z 4 = J T (z 2 )F y 1 = x 3 = q m y 2 = x 4 = qm (24) Moreover, if u = NΓ m and f m N 2 = F m , then: ⎧ ⎪ ⎪ ⎨ ⎪ ⎪ ⎩ ż1 = z 2 + K -1 (J m N 2 ) ẋ4 = K -1 u -y 1 -K -1 F m y 2 ż2 = z 3 ż3 = q = z 4 + ψ(z 2 , z 3 , y 1 , F) ż4 = d dt [J T (z 2 )F] ( 25
)
where ψ is equal to:

ψ = D(z 2 ) -1 [K(y 1 -z 2 )-H(z 2 , z 3 )-f q z 3 -J T (z 2 )F]-z 4 (26)
If A and C are defined as following (I is the 2 order identity matrix and 0 is the 2 × 2 zero matrix ):

A = ⎛ ⎜ ⎜ ⎝ 0 I 0 0 0 0 I 0 0 0 0 I 0 0 0 0 ⎞ ⎟ ⎟ ⎠ and C = (I 0 0 0) (27)
then:

ż = Az + g(z, y, u) + d(z, F, Ḟ) (28)
with

g = ⎧ ⎪ ⎪ ⎨ ⎪ ⎪ ⎩ K -1 u -y 1 -K -1 F m y 2 0 ψ(z 2 , z 3 , y 1 , F) 0 (29) and d(z, F, Ḟ) = [0 0 0 d dt (J T (z 2 )F)]
T . Define now the following matrix of high gains, with G a constant ≥ 1:

Γ G = ⎛ ⎜ ⎜ ⎝ GI 0 0 0 0 G 2 I 0 0 0 0 G 3 I 0 0 0 0 G 4 I ⎞ ⎟ ⎟ ⎠ (30)
and matrix L such as (A -LC) has all its eigenvalues in the left half of the complex plan, then the following new observer is proposed:

˙ẑ = (A -Γ G LC)ẑ + g(z, y, u) + Γ G Ky 2 (31)
where

K = LK -1 (J m N 2 ) and ⎧ ⎪ ⎪ ⎨ ⎪ ⎪ ⎩ z2 = y 1 -y 1 -ẑ 2 y 1 -ẑ 2 N s sat( y 1 -ẑ 2 N s ) z3 = ẑ3 ẑ3 M s sat( ẑ3 M s ) z4 = ẑ4 ẑ4 F s sat( ẑ4 F s ) (32)
with sat(.) is the saturation function:

sat(x) = x if | x | ≤ 1 1 i f | x | > 1 (33)
and M s , N s , F M , F d , J M and F s are known positive physical constant bounds:

⎧ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎩ x 2 < M s x 1 -x 3 < N s F < F M Ḟ < F d J T (z 2 ) < J M F s = J M F M (34)
Figure 5 shows the diagram of the proposed observer where A c = A -Γ G LC. For only one axis, L = [L 1 L 2 L 3 L 4 ] T and:

det[λ I -(A -LC)] = λ 4 + L 1 λ 3 + L 2 λ 2 + L 3 λ + L 4 ( 35
)
where λ is an eigenvalue of matrix A -LC. A possible choice for L is then: 3 and L 4 = a 4 . In this case, matrix A -LC has four stable eigenvalues in λ = -a, where a is a positive real fixing the dynamics of the proposed observer.

L 1 = 4a, L 2 = 6a 2 , L 3 = 4a
The estimation error e = zẑ satisfies the following differential equation:

ė = A c e + g(z, y, u) -g(z, y, u) + d(z, F, Ḟ) (36)
Because of the form of disturbance d(z, F, Ḟ) the following stability theorem can be proven for the proposed observer: Theorem 1 : There exists a constant G 0 such that error e(t) is bounded for any gain G > G 0 .

The proof is given in Appendix A. This observer is compatible with the FSW and machining processes mentioned before.

OBSERVER PERFORMANCE AND ROBUSTNESS ANALYSIS

A simulation is carried out with Matlab/Simulink to analyze the performance and robustness of the observer. The essential parameters are taken from a robot IBM7545 as shown in Table 1. The results estimated by observer are compared with the results of the system. The Figure 6 shows the block diagram of industrial control system dividing in two parts: the first part is an internal loop with a PI controller for the velocity of the rotor and the second part is an external loop with a PID controller for the position of the motor [START_REF] Qin | Commande robuste d'un robot d'usinage flexible: analyse de la précision[END_REF]. The flexibility and external force are also added in this control system as showed in Figure 6. The controllers of IBM robot are designed as independent axis. The controllers are solved axis by axis, e.g. for axis 1: PI and PID are tuned in order to fix the bandwidth of velocity loop to ω 01 = 1800 rad/s and the bandwidth of position loop to ω 1 = 600 rad/s, the corresponding tuning rules can be found in [START_REF] Qin | Commande robuste d'un robot d'usinage flexible: analyse de la précision[END_REF], and are remained hereafter. The gains of PI controller:

K i1 = ω 2 01 J m1 /K e1 K p1 = (2ξ ω 01 J m1 -f m1 )/K e1 (37)
and the gains of PID controller: For observer gains, a = 2000 and G = 1 are sufficient to guarantee the stability of proposed observer (31), (32). Moreover, a noise of quantization is added to the measures of the proposed observer. The quantum size h = 2π/4096 is implemented since sampled data are stored as 12 integers. The workpiece was milled along about 500 mm linear path with the machining conditions of the simulation presented in Table 2. The machining force in direction y is about 60 N. Simulation results are presented in the Figures 7 to 17, where it could be seen that the observer can overcome process disturbances and model errors. Figures 7 and8 present the tracking performance of the system, e.g. for a given desired trajectory in Figure 7, the tracking error is about 10 -4 rad in the machining direction and 10 -6 rad in its normal direction. Then, Figures 9 to 14 present the evaluations of q, q and F during the process and the estimate error of our observer. Finally, Figures 15 to 17 demonstrate the obtained errors with adding quantization on the measured position θ .

⎧ ⎪ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎪ ⎩ K ip1 = N 1 ω 4 1 ω 2 01 K d p1 = 6ω 2 1 ω 2 01 -1 K pp1 =
The results show that observer is fast enough to follow the system and has a good accuracy and sensibility. It can realize not only the state reconstruction but also the effort estimation. Even with a big disturbance at the beginning, when the tool is entering the material, an precision of 10 -7 rad for the joint position, 10 -4 rad/s for the joint velocity and 1N for the effort is obtained. Even with a noise of quantization, the results still show good performances with errors of about 10 -5 rad, 10 -2 rad/s and 5 N.

CONCLUSION

In this paper, two models of machining and FSW are presented and a non-linear disturbance observer is proposed for the control of flexible joints industrial robots. A simulation has also been carried out with Matlab/Simulink for a machining process which demonstrates that the proposed observer is fast enough to follow the system and shows a good accuracy and sensibility. Even with a noise of quantification, our observer still provides satisfactory results in both state and force estimations.

This method can also be applied to FSW process. In any case, the robot parameters are needed to implement the proposed observer. For instance, in our laboratory, numerous experiments have been carrying out to identify all the parameters of a KUKA KR500-2MT in order to weld pieces by using FSW process, meanwhile, the same characterization on another robot KUKA KR270 used for machining of composites materials has been carrying out by some partners of COROUSSO project [START_REF] Dumas | Développement de méthodes robotisées pour le parachèvement de pièces métalliques et composites[END_REF]. Moreover, using the measured state of motors and the estimated state of robot links in the control of flexible robots can lead to more stable and robust feedback control as shown in [START_REF] Spong | Robot Modeling and Control[END_REF][START_REF] Qin | Commande robuste d'un robot d'usinage flexible: analyse de la précision[END_REF].

FIGURE 1 .FIGURE 2 .

 12 FIGURE 1. Geometric model of robot

FIGURE 4 .

 4 FIGURE 4. Efforts on the tool during the FSW operation

FIGURE 5 .

 5 FIGURE 5. Diagram of the observer

FIGURE 6 .

 6 FIGURE 6. Principal block diagram of an industrial robot control

FIGURE 7 .

 7 FIGURE 7. Desired trajectory X d and real trajectory X l [m]

FIGURE 8 . 2 FIGURE 9 .

 829 FIGURE 8. Error of tracking trajectory [m]

TABLE 1 .

 1 Model parameters of the robot IBM7545.

	Name	Description (unit)	Value
	l 1 , l 2	length of link (m)	0.40 ; 0.25
	m 1 , m 2	mass of link (kg)	12.70 ; 4.35
	m l	mass of the spindle (kg)	1.34
	N 1 , N 2	gear transmission factor	157 ; 80
	K 1 , K 2	elasticity constante (N m -1 )	3.67 10 4 ;
			8.90 10 3
	r 1 , r 2	distance between axis	0.153 ;
		and center of gravity (m)	0.084
	K e1 , K e2 motor torque constant	0.1099 ;
		(Nm V -1 )	8.90 10 3
	J m1 , J m2 motor inertia (kg m 2 )	1.50 10 -4 ;
			0.0496
	f m1 , f m2 coefficients of viscous friction	7.18 10 -5 ;
		on the motor side (Nm s rad -1 ) 2.58 10 -5
	f q1 , f q2 viscous friction of the joints	10 ; 10
		(Nm s rad -1 )

TABLE 2 .

 2 Machining conditions of the simulation.

	Name	Value	Unit
	material	Aluminium alloy
	tool diameter	20	mm
	cut depth (a p )	2	m m
	cut width (a e )	5	m m
	specific cutting coefficient (K t ) 1.9	G P a
	forward speed ( ẏ)	0 .06	m/s
	rotation speed (N r )	18000	rpm
	number of teeth	4

ACKNOWLEDGMENT

This research is sponsored by the French National Agency of Research as a part of the program ANR-ARPEGE, project ANR-2010-SEGI-003-01-COROUSSO.

* THIS WORK IS SUPPORTED BY

) For this new system, define Lyapunov function V (η) = η T Pη where P is the positive definite solution of Lyapunov matrix equation:

(A -LC) T P + P(A -LC) = -I (40) Taking the derivative of V (η), one can obtain:

(41) From relation (32) and (34) by using [START_REF] Jankovic | Observer based control for elastic joint robots[END_REF], the saturation condition can be written:

Moreover, as D -1 , H, J T , z 3 , z3 , F, z 4 and z4 are bounded then: Error of q 1 [rad]

where α 2 and α 3 are positive constants. As:

and η = Γ -1 G e then the following inequalities hold:

with α m = sup(α 2 , α 3 ) as G ≥ 1. Now:

)) depend on z 2 only through sine and cosine functions and Ḟ and ż2 are bounded, one can find a positive bound d m for ∥d(z, F, Ḟ)∥ :

Now reporting ( 46) and ( 47) in (41) provides:

where G 0 = 4∥P∥α m .

If G > G 0 , V < 0 for ∥η∥ > r(G) where:

what means after a finite time τ, ∥η∥ ≤ r(G) and:

which proves that e(t) is bounded if G > G 0 .


Nicolas Moro
email: nicolas.moro@cea.fr

Karine Heydemann
email: karine.heydemann@lip6.fr

Amine Dehbaoui
email: a.dehbaoui@serma.com

Bruno Robisson

Emmanuelle Encrenaz

Fault attacks on two software countermeasures

Injection of transient faults can be used as a way to attack embedded systems. On embedded processors such as microcontrollers, several studies showed that such a transient fault injection could corrupt either the data loads from the memory or the assembly instructions executed by the circuit. Some countermeasure schemes which rely on temporal redundancy have been proposed to handle this issue. Among them, several schemes add this redundancy at assembly instruction level. In this paper, we perform a practical evaluation for two of those countermeasure schemes by using a pulsed electromagnetic fault injection process on a 32-bit microcontroller.

I. INTRODUCTION

In this paper, we experimentally evaluate the robustness of two software countermeasure schemes against fault injection on embedded programs. Both countermeasures are designed at assembly code level and rely on providing some replacement sequences to strengthen some sensitive instructions. To perform this evaluation, we use a pulsed electromagnetic fault injection technique. This fault injection technique has turned out to be an effective way to inject transient faults in a circuit's computation [START_REF] Dehbaoui | Electromagnetic Transient Faults Injection on a Hardware and a Software Implementations of AES[END_REF]. Figure 1 shows an architectural view of the electromagnetic fault injection platform used in this paper. It is similar to the one presented in [START_REF] Moro | Electromagnetic Fault Injection: Towards a Fault Model on a 32-bit Microcontroller[END_REF].

Generator control

Debug via Keil ULINKpro

Pulse

Trigger signal

Pulse generator Motorized X Y Z stage Control computer

Motorized stage control

Fig. 1. Electromagnetic fault injection bench

The chosen target is an up-to-date 32-bit microcontroller designed in a CMOS 130 nm technology based on the ARM Cortex-M3 processor [START_REF] Yiu | The Definitive Guide To The ARM Cortex-M3[END_REF]. Its operating frequency is set to 56 MHz without any cache memory, and no prefetch buffer is activated. Cortex-M3 processors use a Harvard architecture and run the ARM Thumb-2 instruction set [START_REF] Arm | ARM Architecture Reference Manual -Thumb-2 Supplement[END_REF], which contains both 16-bit and 32-bit instructions. Some 16-bit instructions can be forced to a 32-bit encoding by using a specific syntax.

II. EVALUATION OF THE COUNTERMEASURES

A. Evaluation approach

We need to define a relevant metric to evaluate the efficiency of the countermeasures. Since the countermeasure This work was done while Amine Dehbaoui was with École Nationale Supérieure des Mines de Saint-Étienne, F-13541 Gardanne, France sequences add some instructions, the time to execute a full countermeasure sequence becomes longer than the time to execute the initial instruction. Thus, the number of vulnerable points, i.e. the injection times for which a fault injection attempt is successful, may also increase. Comparing the percentage of faulty outputs could appear to be a solution to compare two data sets with different numbers of measurements. Nevertheless, we assume that the most meaningful metric for such a comparison is the number of faults that have been obtained on the destination register. The countermeasure is really effective if it can overcome the fact that some new vulnerable points are added and if it can decrease this number of vulnerable points. Thus, comparing the number of faulty outputs is probably the most relevant metric for an attacker since it indicates the number of potential vulnerabilities on an embedded code.

B. Fault tolerance countermeasure

This countermeasure aims at providing a fault-tolerant replacement sequence for most of the instruction of an instruction set [START_REF] Moro | Formal verification of a software countermeasure against instruction skip attacks[END_REF]. Such a countermeasure has been designed to be tolerant to any single instruction skip and does not provide any protection to the data flow. An example of the use of this countermeasure is given in Listing 1. We performed some fault injection experiments on four codes: a bl instruction without countermeasure (100 ns time interval by steps of 200 ps), a bl.w instruction with forced 32bit encoding without countermeasure (100 ns), the replacement sequence presented in Listing 1 (400 ns) and this replacement sequence with forced 32-bit encoding (400 ns). Several values were used for the pulse voltage, from -210 V to -170 V and from 120 V to 150 V by steps of 5 V. The target circuit crashes for voltages over 150 V. In this experiment, the subroutine that is called only modifies r0. Thus, we analyze the number of faults in r0 at the end of the experiment to evaluate the efficiency of the countermeasure. The faults on any register curves correspond to an output in which at least one register contains a faulty value.

The fault injection results are shown on Fig. 2. We can observe that applying the countermeasure without forced 32bit encoding does not seem to be efficient. Indeed, this countermeasure has not been designed to be resistant to two consecutive instruction corruptions. Because of the memory alignment in the experiment, in the replacement sequence the first two adr instructions and later the last two b instructions are loaded in a single fetch stage. Thus, it seems that such double corruption happened. Moreover, we can also observe that no faulty output has been obtained for pulses with a negative voltage on a single 32-bit bl.w instruction. Nevertheless, such an instruction could still be faulted by using pulses with a positive voltage. An explanation for such result can be found in the way instructions are encoded. The 16-bit subset of the instruction set is very compact (most of the 16-bit values correspond to one instruction) while the 32-bit subset is very sparse: very few bit flips can change a 16-bit instruction into another instruction, but this assertion is not true for a 32bit encoding. Finally, for the experiment with a fault tolerance countermeasure and a forced 32-bit encoding, very few faults on r0 have been obtained. Even if some faults on some other registers can still be obtained, this countermeasure appears to be very effective for both positive and negative glitches.

Applying the countermeasure scheme with a forced 32-bit encoding is a necessary condition to guarantee its efficiency.

C. Fault detection countermeasure

This countermeasure aims at detecting any single fault, including instruction skips, some cases of instruction replacements and faults on the data flow. As an example, the countermeasure for a ldr instruction is given in Listing 2. In this code example, a value is loaded from the Flash memory. The address of this value is relative to the program counter. We performed some fault injection experiments on four codes: a single ldr instruction (150 ns time interval by steps of 200 ps), a single ldr.w instruction with a forced 32bit encoding (150 ns), the replacement sequence presented in Listing 2 (300 ns) and the same replacement sequence with a forced 32-bit encoding for every instruction (500 ns). The fault injection results are presented in Fig. 3. The detected faults curves show the number of calls to the error subroutine. From a black box approach, we can observe that applying the countermeasure without forced 32-bit encoding creates more vulnerable injection times than the initial single ldr instruction and does not bring any security for negative glitches. Nevertheless, this countermeasure seems to work very well for positive glitches. Finally, the countermeasure scheme appears to be very effective with a 32-bit encoding of the instructions.

III. CONCLUSION

We have provided a first attempt of practical study of two assembly-level software countermeasure against fault injection attacks. Even if those countermeasures are theoretically secure, it turns out that the level of security they add could be nullified if their implementation on a target platform is not performed in the right way. The fault tolerance countermeasure has been very effective to protect an isolated subroutine call instruction. Thus, it seems such a sensitive instruction can be significantly reinforced against fault attacks. Since this countermeasure has been formally proven resistant to instruction skips, its main limitation appears to be due to its considered fault model which might be too simplistic. Otherwise, the fault detection countermeasure has been designed to protect a smaller set of instructions and it has been very effective on the considered test cases.

Listing 1 . 6 b

 16 Fault tolerance countermeasure for a bl <function> instruction 1 adr r1 , <r e t u r n l a b e l > 2 adr r1 , <r e t u r n l a b e l > 3 add l r , r1 , #1 ; Thumb mode requires the 4 add l r , r1 , #1 ; last bit of LR to be set 5 b <f u n c t i o n > <f u n c t i o n > 7 r e t u r n l a b e l :

Fig. 2 .

 2 Fig. 2. Fault injection results for the fault tolerance countermeasure

Listing 2 . 3 cmp r0 , r 1 ; comparison between r0 and r1 4 bne

 2314 Fault detection countermeasure for a ldr instruction 1 l d r r0 , [ pc , #40] ; initial load instruction 2 l d r r1 , [ pc , #38] ; duplicated load instruction <e r r o r > ; if r0 != r1, raise an error

Fig. 3 .

 3 Fig. 3. Fault injection results for the fault detection countermeasure