Oleg Garasym
email: oleg.garasym@irccyn.ec-nantes.fr

Ina Taralova
email: ina.taralova@irccyn.ec-nantes.fr

High-speed encryption method based on switched chaotic model with changeable parameters

Keywords: chaotic generator, security, encryption, switched chaotic model, NIST, Lyapunov exponent, dynamical system I

In this paper an improved chaotic switching algorithm based on modified Lozi system is applied. Generally speaking, the main advantage of the switched encrypted model is its robustness to the noise, while the main drawback is the slow processing speed. In this article we propose to gain model productivity by adjusting parameter in Lozi chaotic generator. Chaos generator is sensitive to any structure, therefore the solution shouldn't influence the pseudo randomness which is required for encryption. We provide the results of switched chaotic model based on Lozi chaotic generator with changeable parameter studied for chaoticity and pseudo-randomness with NIST, largest Lyapunov exponent, auto-correlation, cross-correlation and cumulative distribution.

INTRODUCTION

The current cryptographic methods of processing information aim at increasing keys length that in turn reduce the cryptographic transformations performance in terms of processing time. This is especially critical to ensure a given level resistance to the implementation in special systems and devices with existing restrictions on the amount of memory and dimensions in cases where there is no possibility to use powerful processing devices. This fact determines the importance and relevance of the search for methods to improve cryptosystem security level, robustness and speed performance.

Pseudo random number generators (PRNG) play very important cryptographic role. They are used for information encryption, to generate the encryption keys and the initialization vectors authentification requests, for the formation of a common key generating prime numbers. If PRNG is hacked, in most cases, the entire security of the system can be under threat.

Chaotic systems that generate pseudo random sequences are attracting attention, due to their complex, aperiodic and chaotic behavior and because they are sensitive to small changes in initial values and control parameters. However, using a digital system to generate chaos has many difficulties. For example, chaos is restrained by the finite precision of the system and even small errors introduced in each iteration will have a big effect on the implementation of chaos [START_REF] Lau | Chaos-based digital communication systems[END_REF]. Consequently, the accumulation of the error will result in a deviation of the orbit and greatly affects the characteristics of the system. Due to the reactiveness of the chaos to initial conditions and parameters, chaotic key stream is easily affected by environmental conditions [START_REF] Kazuyuki | Chaos and Its Applications[END_REF].

Chaotic sequences are produced by nonlinear dynamic systems that increase PRNG complexity. Nowadays many random number generators in use do not always produce sequences that are sufficiently random and usually generate very repetitive patterns, if lots of runs are required. Randomness' tests in data evaluation are used to analyze the distribution pattern of a data set. In stochastic modeling, as in some computer simulations, the expected random input data can be verified to show that tests were performed using randomized data [START_REF]Random Number Generation and Testing[END_REF]. Chaos-based PRNG is interesting application for the control theory development but always take around on open problem how to satisfy each of the requirements: robustness, security and speed performance.

II. CHAOS-BASED ENCRYPTION SHEMES

There are three basic encryption schemes: CS (Chaotic Switching), CMI (Chaotic Mixing) and CMA (Chaotic Masking) [START_REF] Koronovskii | On the use of chaotic synchronization for secure communication[END_REF]. In CS the message is encoded by switching the transmitter between two states. CMI is based on the modulation of chaotic carrier generated by the transmitter. Finally in CMA the encoding is achieved by adding the message to the chaotic transmitter output.

A. Chaotic masking (CMA)

Figure1. Chaotic masking On the transmitting side (fig. 1) information signal m is mixed to the carrier signal generated by the emitting chaotic system Z, and then transmitted over the communication channel.

The receiver Zr is performing a full chaotic synchronization of the chaotic generator and the receiver, resulting in a dynamic host generator behavior that becomes identical to the transmission dynamics.

a) Advantages

This hidden communication model works quite efficiently. It allows the transmission of information to be qualitatively performed and the detection of its output in the absence of noise in the channel when the power of the signal generated by the transmitter system exceeds the power of the information signal.

b) Disadvantages Adding noise to the communication channel leads to a sharp deterioration in the quality of transmitted information, requiring a high signal / noise ratio at which the scheme is working. Furthermore, the control parameters mismatch between identical chaotic generators (but located on different sides of the communication channel) also leads to additional noise at the output of desynchronization and makes information transfer difficult to fulfill. Moreover, there is the issue of confidentiality of information transfer. z . As a result of passing the feedback (provided by mutual generators coupling) the signal undergoes nonlinear changes. Thus, the communication channel is the transmitted signal y obtained by nonlinear mixing of information signal to the chaotic. The receiving device, as in the above scheme, contains a chaotic generator Zr, identical to the ones in the transmitter. The receiver synchronizes the generator in case of transmission of binary bits 0 (and does not synchronize the transmission of binary bits 1). a) Advantages An important advantage of such schemes to the scheme based on chaotic masking is the ability to vary the level of the input data message, allowing to control the quality of information transfer.

B. Chaotic mixing(CMI)

b) Disadvantages Increasing the quality of communication entails a loss of confidentiality that is a significant drawback. In addition, this model is characterized by a low resistance to noise in the communication channel and mismatch control parameters of the initially identical chaotic generators. The need to ensure the identity of the three generators of chaos, two of which are located on opposite sides of the communication channel is an intractable technical problem and, therefore, is another drawback of this scheme.

C. Switched chaotic model(CS)

a) Advantages

The switched encrypting model is more resistant to the noise in the communication channel than the chaotic masking scheme or the nonlinear signal mixing model [START_REF] Lozi | Noise-resisting ciphering based on a chaotic multistream pseudo-random number generator[END_REF].

b) Disadvantages

The principal drawback of this model is the occurrence of switching transients (the length of which can be quite timeconsuming), that is manifested in the delay time in the synchronous mode of the receiving generator. Therefore, these schemes can be quite slow and also they have weak security [START_REF] Yang | Breaking chaotic switching using generalized synchronization: examples[END_REF].

III. PROBLEM STATEMENT

Hereafter we propose an improved version of switched encryption model (CS) that ensures better speed performances and robustness. The two chaotic generators Z1 and Z2 used for encryption are analyzed to setter: long-cycle length; high complexity; auto-correlation, cross-correlation near to zero; balance on [-1 1]; largest Lypunov exponent; successful NIST test [START_REF] Andrew | Chaotic Generation OF PN Sequences: AVLSI Implementation[END_REF]. In theory there are an endless number of sequences, for Z1or Z2 chaotic system, each realizable by changing the initial conditions. A slight difference in the initial conditions between transmitter and receiver will produce very different modulation and demodulation codes, which is an advantage of a secure chaos-based communication system.

The problem is that noise in the communication channel leads to the errors on the receiver part. Thus there is no perfect model of using chaotic generator for secure transmitting message.

The proposed model to use for secure information transmission is CS that has better resistance to the noise in the communication channel than other models. The security problem that is considered in [START_REF] Yang | Breaking chaotic switching using generalized synchronization: examples[END_REF] will be solved in the next paper by using CS in combination with other models.

To construct the model we consider a new Lozi alternate system with auto-coupling and ring-coupling proposed in (2011) [START_REF] Lozi | Noise-resisting ciphering based on a chaotic multistream pseudo-random number generator[END_REF] and described in [START_REF] Espinel | New alternate ring-coupled function for random number generation[END_REF] that has highly sufficient chaotic properties on the p-dimensional tours, is the tent map. To avoid divergence, the following conditions have to be fulfilled.

p R x p p T ] 1 , 1 [  by the map p p p T T M  : .                            ) ) 1 (( 2 1 1 ) 2 2 3 ) 1 1 (( 2 2 2 1 2 1 ) 1 1 2 ) 1 1 (( 1 1 2 1
If 1 ) 1 ) 1 (( 2 1 1          j n x p e j n x j e j k j n x j n x then add 2 If 1 ) 1 ) 1 (( 2 1 1         j n x p e j n x j e j k j n x j n x then substract 2
However another problem with chaotic systems is autonomy and any modification in the system could lead to the loss of randomness. Hence the aim is to simplify the applied model while maintaining security and increasing work-speed.

IV. SOLVING THE PROBLEM

We suggest that instead of switching between two different generators, to change only the parameters of the same generator (structurally speaking) depending on the message bit (0 or 1). The chaotic system sensitivity allows us to slightly change parameters in order to create generators with new dynamical properties. The question is if the new generator will have the same good characteristics of randomness and chaoticity. We investigated the system (1) and propose to add a switching parameter a.

      0 , 1 . 0 1 , 1 n m n m a
where n m is a bit of a message and equal to 1 or 0. The parameter a is added to the system (1):

) 1 ) 1 (( 2 1 1 ) 2 2 3 ) 2 1 (( 2 2 2 1 2 1 ) 1 1 2 ) 1 1 (( 1 1 2
                   (2) If 1 ) 1 ) 1 (( 2 1 1          j n x p e j n x j e j ak j n x j n x then add 2 If 1 ) 1 ) 1 (( 2 1 1         j n x p e j n x j e j ak j n x j n x then substract 2
where a is a parameter of the chaotic system that switches depending on a bit of a message n m . For encrypting bit '1' of the binary message a=1 (Lozi system) and for bit '0' a= 0.1 (modified Lozi system). Adding additional parameter allows to increase the size of the encryption key. It was noticed that the lozenges have been removed in the modified Lozi system (Z1') where a= 0.1 (fig. 6). The same plotting parameters were taken to analyze Z1' system. 10 iterations the new system exhibits very few scattered empty points on the plane that implies flat distribution and chaotic behavior and the lozenges with smaller density have been removed.

After deteining system with new complex behovior we need to know if the randomness has been preserved. In addition to confirm obtained system complexity we use largest Lyapunov exponent.

The latter is used to prove chaos existence in the system [START_REF] Iasemidis | Phase space topography and the Lyapunov exponent of electrocorticograms in partial seizures[END_REF]. A positive largest Lyapunov exponent indicates chaos and value of this index defines the chaos degree. Lyapunov exponent characterizes the average rate of exponential divergence of close phase trajectories. If d0 is an initial distance between two initial points of the phase trajectories in time t distance between trajectories, that go out of this points will be:

t e d t d  0 ) ( 
, where λ is called the Lyapunov exponent. Each dynamical system is characterized by spectrum Lyapunov exponent

) , , 2 , 1 ( n i i   
where n is an equation number needed for system description.

The aforementioned examination methods for randomness give the possibility to determine chaotic generators quality and security.

To check the system for chaos exsistence Larges Lyapunov Exponent (LLE) approach is applied by using free software package TISEAN [START_REF] Hegger | Practical implementation of nonlinear time series methods: The TISEAN package[END_REF]. The sequence must be saved in ASCII format and after that is called the function by lyap _r from matlab:

system([tiseanPath, 'lyap_r -s20 -o lyapunov.dat Lozi_m.dat']);

The LLE for Lozi system is equal 0.6599, for modified Lozi system is 0.7232.

Another advantage of such modification is that the output systems Z1 and Z1' (where a=1 and a = -0.1) trajectories don't converge to each other (fig. 7). To plot sequences has been taken for instance interval from 500 000 to 500 100 iterations. Thus the appropriateness of adding switched parameter a to Lozi system is demonstrated and although modeled by deterministic map, the analyzed chaotic generator with new parameter exhibits excellent random properties.

V. RANDOMNESS TESTS FOR SWITCHED ENCRYPTING MODEL BASED ON MODIFIED LOZI SYSTEM

Randomness sequences statistical properties are displayed as graphical dependencies in appearance that drive conclusions about the sequence properties. This group consists of different set tests such as a histogram of distribution, autocorrelation function, cross correlation function, distribution of elements on the plane that are applied to analyze M2. M2 is the switched chaotic model (fig. 3) where Z1 and Z1' generators are used (fig. 4).

Autocorrelation function is described as equation ( 3) and is used as a qualitative tool for checking randomness. The random sequence has autocorrelations near zero for any and all time-lag. If one or more of the autocorrelations strongly deviate from zero, it indicates non-randomness.

    N i j i x i x N j x R 1 1 ) ( (3)
    N i j i x i x N j x x R 1 2 1 1 ) ( 2 1
(4) The iteration M2' from 500 000 to 1000 000 possess such features: Each of the models encrypts 4 million bits of the message. To generate the message, "Bernoulli Binary Generator" block of the Simulink with 0.5 probability of a zero has been used. The initial 1 mln points were cut off as transients out of 4 mln.

NIST requires binary form values hence for efficient parsing randomness we need to make binarization of the sequences according to IEEE-754 standard for 32 bit form.

bit binarization has not been used because

] 1 1 [  i x
, so that mantisa in binary form for integer part is the same and takes 11 bits information that are non-changeable and it leads to faulty verification for randomness. to IEEE-754 standard for 32 bit were taken. The Matlab function quantizer ([32,31]) for reservation 32 cells is used, where the first bit for the sign is kept. Consequently function num2bin(q,data) makes binarization, where q -32 'cells' and datavalue which we want to binarieze. For example: data = -0.4893 bin = 11000001010111101001111000011011 data = 0.8087 bin = 01100111100000110111101101001010 Where first bit is 0 when 'data'-value is positive and 1 whennegative. After binarization of the tested systems, NIST tests have been applied.

NIST statistical tests are used as a tool to verify sequences produced by generator for randomness. For each test it received conclusion about acceptance or refusal. Each of the tests is based on calculation value test statistic that is data function. This statistics takes weighted Р-value which determines if the sequence is random.

The NIST package includes 15 statistical tests, aim of which is the estimation of randomness measure for binary sequences: Frequency, BlockFrequency, CumulativeSums, Runs, LongestRun, Rank, FFT, NonOverlappingTemplate, OverlappingTemplate, Universal, ApproximateEntropy, RandomExcursions, Serial, LinearComplexity [START_REF] Koronovskii | On the use of chaotic synchronization for secure communication[END_REF]. As seen in the table [START_REF] Lau | Chaos-based digital communication systems[END_REF] the results of the two systems are different, that means that chaotic behavior has changed and we succeeded to obtain new sequences while maintaining randomness, what was our aim. The performances of the switched M2(Z1-Z1') model have been studied for autocorrelations, cross-correlations, NIST tests and Lyapunov exponents.

VII. RESULTS AND FUTURE WORK TO BE UNDERTAKEN

The proposed transformation in the Lozi system allows us to switch a parameter (depending on the bit of a message) to receive quickly splitting trajectories and improved randomness. The speed of execution by classical switched two independent chaotic generators (M1) is worse. Encrypting time for 400000 bit information is 2.9866e+04 matlab's time units, for the switched M1 model between two generators and 2.1755e+04 for the proposed model M2 with switched parameter.

We received new chaotic behavior that passed several tests better and the largest Lypunov exponent is higher than the standard form of Lozi system. But we made studies only with one parameter and the new system should be more precisely studied. Future questions: if the system with new parameter is better or not; is it possible to increase chaoticity of the switched chaotic model; observers need to be designed for the decrypting model as well.

VIII. SUMMARY

The switching chaos-based encrypted model was achieved by using Lozi chaos system with adding switched parameter a depending on 0/1 bit of the message. The modified Lozi system was verified for randomness by auto-correlation, crosscorrelation, and distribution. It successfully passed NIST tests, and largest Lyapunov exponent has been increased showing strong chaotic behavior. The execution speed has been increased. Such method offers to have larger encryption key and allows us in the future research to make different modification to improve security and robustness.

Figure 2 .

 2 Figure 2. Nonlinear mixing of information signal to chaotic The transmitting side contains two identical chaotic generators, 1 z and 2 z (fig.2). The information signal m is mixed with the signals produced by 1 z and output is mixed

Figure 3 .

 3 Figure 3. Switched chaotic model The transmitting device consists of two chaotic generators

1 Figure 4 .

 14 Figure 4. Trasmitter parametersThe Lozi system (Z1and Z2) is recognizable due to its lozenges after plotting where points are fall in less frequently

Figure 5 .

 5 Figure 5. Lozi system phase space (x1,x2)

Figure 6 .

 6 Figure 6. Modified Lozi system plotting (x1,x2) where a= -0.1 After 610 iterations the new system exhibits very few scattered empty points on the plane that implies flat distribution and chaotic behavior and the lozenges with smaller density have been removed.

Figure 7 .

 7 Figure 7. Trajectories of the Lozi and the modified Lozi systems don't converge to each other

Figure 8 .

 8 Figure 8. Autocorrelation The cross correlation function (4) however measures the dependence of the values of one signal x1 of Z1 generator on another signal x1' of Z1' generator.

Figure 9 .

 9 Figure 9. Cross correlation Distribution is the secure demonstration of randomness in cryptography. This quantifier has been chosen as being more informative than the histogram. In the random case x is uniformly distributed on the interval. Distribution histograms allow us to estimate samples partition in the studied sequence, and to determine the frequency of occurrence of a specific value. For the random sequences the frequency character

Figure 10 .

 10 Figure 10. Cumulative distribution function (cdf), of the output of M2 (Z1-Z1')

  Minimum value: -1.0 Maximum value: 1.0 Sample mean: -1.7167e-04 Sample median (50th percentile): -9.9044e-04 Sample standard deviation: 0.5739 The modified Lozi system with new parameter has sufficiently good results: high complexity; auto-correlation (fig. 8) and cross-correlation (fig. 9) near to zero, normal distribution (fig. 10), balance on {-1, 1}. Thus it seems that sequences are really chaotic, but we need to perform additional tests. To verify more precisely randomness statistical NIST test and largest Lyapunov exponent are used. VI. TWO MODELS COMPARISON Two switched encrypting models based on Lozi and modified Lozi systems have been compared. For the first model M1 we take two generators Z1 and Z2 with different evalue (fig. 4) while the other parameters are the same: 2  p (two-dimensional systems), x0 is randomly chosen. For the second model M2 we take two generators Z1 and Z1'(fig. 4).

TABLE I

 I

		.	TWO MODELS COMPARISATION
		Test Name	Two Lozi generators	Modified Lozi and Lozi
					generators
	Frequency			100 /100	99/100
	BlockFrequency		98 /100	96/100
	CumulativeSums		100 /100	99/100
	Runs			99 /100	100/100
	LongestRun			97/100	100/100
	Rank			99/100	98/100
	FFT			99/100	99/100
	NonOverlappingTemplate 99/100	100/100
	OverlappingTemplate		98/100	98/100
	Universal			98 /100	100/100
	ApproximateEntropy		99 /100	99/100
	RandomExcursions		63/63	66/66
	RandomExcursions		63/63	66/66
	Variant
	Serial			98/100	99/100
	LinearComplexity		96/100	99/100
	largest	Lyapunov	0. 3005	0.4609
	exponent Time executing -4mln	2.9866e+04	2.1755e+04
	bits


Guido Bacciagaluppi
email: guidob@univ-paris1.fr

A Conceptual Introduction to Nelson's Mechanics *

Nelson's programme for a stochastic mechanics aims to derive the wave function and the Schrödinger equation from natural conditions on a diffusion process in configuration space. If successful, this programme might have some advantages over the better-known deterministic pilot-wave theory of de Broglie and Bohm. The essential points of Nelson's strategy are reviewed, with particular emphasis on conceptual issues relating to the role of time symmetry. The main problem in Nelson's approach is the lack of strict equivalence between the coupled Madelung equations and the Schrödinger equation. After a brief discussion, the paper concludes with a possible suggestion for trying to overcome this problem.

Introduction

Within the foundations of quantum mechanics, Nelson's stochastic mechanics [START_REF] Nelson | Derivation of the Schrödinger equation from Newtonian mechanics[END_REF][START_REF] Nelson | Quantum Fluctuations[END_REF] is generally less well-known than other approaches, and is often presented as a stochastic variant of de Broglie's [START_REF] De Broglie | La nouvelle dynamique des quanta[END_REF] and Bohm's [START_REF] Bohm | A suggested interpretation of the quantum theory in terms of 'hidden' variables, I and II[END_REF] pilot-wave theory. It is true that the two theories have striking similarities; in particular, in both theories the motions (in configuration space) are described using a velocity field of the form 1 m ∇S. This is the deterministic velocity field for a particle in de Broglie-Bohm theory, and the current velocity of the diffusion process in Nelson's theory. Nevertheless, there is a crucial conceptual difference between de Broglie-Bohm theory or its stochastic variants and Nelson's approach as it was originally conceived: in de Broglie-Bohm theory the function S is assumed from the start to be the phase of Schrödinger's wave function, which obeys the Schrödinger equation. Instead, Nelson's original aim was to assume only that the particles obey a diffusion process in the configuration space and to derive a wave function and the Schrödinger equation by imposing natural conditions on the diffusion. Nelson's original approach, in apparently not assuming the wave function to be part of the ontology of the theory, is thus highly unusual (as compared not only to de Broglie-Bohm but also to spontaneous collapse theories and especially to Everett), and in this respect might provide an interesting comparison to the otherwise very different approaches that seek to understand the quantum state in purely epistemic terms, including entanglement and other supposedly typical quantum features (Spekkens [START_REF] Spekkens | In defense of the epistemic view of quantum states: A toy theory[END_REF]), and that derive or seek to derive quantum mechanics from simple, usually information-theoretic, principles (for example Hardy [START_REF] Hardy | Quantum theory from five reasonable axioms[END_REF] and Fuchs [START_REF] Fuchs | Quantum mechanics as quantum information (and only a little more)[END_REF]).

In Section 2 we shall focus on this special feature of Nelson's approach and spell out in more detail the potential advantages of Nelson's original approach over de Broglie-Bohm theory (and its stochastic variants).

The main section of this paper, Section 3, is devoted to reviewing the approach itself in some detail. We shall try to isolate various issues of conceptual interest, in particular the role of time symmetry, which is not immediately intuitive in the context of stochastic processes. Indeed, the idea of irreducible indeterminism (and by extension that of probability) is often thought of in terms of an 'open future' and a 'fixed past', and transition probabilities are thought of as law-like in the forward direction of time but as merely epistemic in the backward direction. (For an explicit articulation of this position, see Arntzenius [START_REF] Arntzenius | Indeterminism and the direction of time[END_REF].) One can equally well, however, have a picture that does not privilege one direction of time, namely a picture of individual trajectories with the evolution along them subject to stochastic laws in both directions of time. Nelson uses such a picture, since (as we shall see) he takes it that the external forces acting on a system constrain in a law-like way both the forward and the backward transition probabilities of the process. (For a related discussion in the context of decoherent histories, see Bacciagaluppi [START_REF] Bacciagaluppi | The arrow of time and decoherent histories, accepted for publication in Stud[END_REF]. I also hope to give a fuller philosophical discussion of time symmetry in stochastic processes, both in general and with specific reference to Nelson's theory, in further publications.)

In Section 4 we then turn to the question of whether Nelson's approach, as stated so far, achieves its aim. As a matter of fact, it is rather well-known that it has not been entirely successful. The reason for this (as was detailed in print by Wallstrom [START_REF] Wallstrom | Inequivalence between the Schrödinger equation and the Madelung hydrodynamic equations[END_REF]), is the lack of strict equivalence between the Schrödinger equation and the Madelung equations, seen as coupled equations for two abstract functions R and S. We assess the achievements of Nelson's programme in the light of these considerations.

In Section 5 we return to the comparison between Nelson's approach, as characterised in Section 4, and the Nelson-type variants of de Broglie-Bohm theory mentioned above. We conclude with some speculations on how it might still be possible, despite the known difficulties, to complete Nelson's original programme. 1

Comparison with Pilot-wave Theory

The pilot-wave theory of de Broglie and Bohm is one of the better-known and best-understood approaches to the foundations of quantum mechanics. It is also one of the oldest. The mature version of de Broglie's theory was presented in October 1927 at the Fifth Solvay Congress [START_REF] De Broglie | La nouvelle dynamique des quanta[END_REF]. The theory presented there is a new dynamics for systems of n particles (described in configuration space), where the motion of the i-th particle is determined by a velocity field of the form 1 m i ∇ i S(x 1 , . . . , x n ), S being the phase of the Schrödinger wave function. (S is defined in units of h, that is, ψ = Re iS/h . One finds also the convention ψ = Re iS , in which case the velocity field has the form h m ∇S.) At least as regards particle detections, it is clear that the theory can easily predict both interference and diffraction phenomena. Indeed, around the nodes of the modulus R of the wave function, the phase S will behave very irregularly, so one can at least qualitatively expect that the particles will be driven away from regions of configuration space where R is small. (Using second-order concepts, this corresponds to a large additional 'quantum potential' around the nodes.) Therefore, for instance, interference bands in the two-slit experiment should appear. And, indeed, it was the qualitative prediction of electron diffraction and its experimental detection that established the significance of de Broglie's matter waves even before the detailed theory of 1927 was worked out. Also quantitatively, as de Broglie remarks, the velocity field preserves the form of the particle distribution if at any time this is given by R 2 .

Although de Broglie's paper and the related discussions include various applications, the measurement theory for quantum observables other than functions of position was worked out in general only when Bohm rediscovered and revived the theory a quarter of a century later [START_REF] Bohm | A suggested interpretation of the quantum theory in terms of 'hidden' variables, I and II[END_REF]. Indeed, it ought to be puzzling at first how such a theory of particles in motion could have even qualitatively anything to do, for instance, with incompatible observables, with the projection postulate and with the rest of the full phenomenology of quantum mechanics. In modern terminology, what Bohm showed in general is that in situations such as measurements, the wave function of the total system decoheres in such a way that the non-interfering components are in fact separated in configuration space by regions with very small R (very large quantum potential), so that the representative point of the system is effectively trapped inside one of the components. This component alone (barring 'conspiratorial' reinterference) will be relevant at later times for the dynamics of the system, so that the particles behave as if the wave function had collapsed. Assuming that the behaviour of the particles comprising the apparatus is macroscopically different depending on which component is effectively guiding the (total) system, one can perform a selection of a corresponding sub-ensemble from an ensemble of (object) systems. Also quantitatively, if the original distribution is given by R 2 , the particles comprising the sub-ensemble will be distributed according to the usual quantum mechanical Born rule (see [START_REF] Dürr | Quantum equilibrium and the origin of absolute uncertainty[END_REF] for a detailed discussion of this point). It is further straightforward to see that in the case of two (maximally) entangled particles, decoherence induced by a measurement on one of the particles forces the other particle and the relevant apparatus to produce the correlated outcome. Less than perfect correlations are quantitatively reproduced given an initial R 2 distribution.

At the individual level, de Broglie-Bohm theory is a new particle mechanics. At the statistical level, for (time-dependent) equilibrium ensembles, it reproduces the statistical predictions of quantum mechanics, and the analogy with the statistical mechanical underpinning of thermodynamics can be pursued in great detail. The theory is explicitly non-local and recovers in this way the quantum mechanical violations of the Bell inequalities. The theory can be easily modified to include spin, and various generalisations aiming to cover QED and other field theories have been proposed. For fuller details, apart from the original papers mentioned above, the following textbook treatments are recommended: Holland [START_REF] Holland | The Quantum Theory of Motion[END_REF], Bohm and Hiley [START_REF] Bohm | The Undivided Universe: An ontological interpretation of quantum theory[END_REF], Dürr [START_REF] Dürr | Bohmsche Mechanik als Grundlage der Quantemechanik[END_REF] and the forthcoming one by Valentini [START_REF] Valentini | Pilot-Wave Theory[END_REF]. In Nelson's theory, as mentioned earlier, the current velocity for the distribution in configuration space is equal to the de Broglie-Bohm velocity. This means that although the particle trajectories in Nelson's theory in general will not be the same as in de Broglie-Bohm theory, the most probable trajectories will oscillate randomly around the typical trajectories of de Broglie-Bohm theory. In terms of recovering the predictions of quantum mechanics, and essentially of all the aspects just mentioned, Nelson's theory will thus share the features of de Broglie-Bohm theory. Often one is interested only in this aspect, and one can formulate Nelson-type theories that preserve the quantum distribution as defined by the Schrödinger wave, assumed as given, and one can study these as stochastic variants of de Broglie-Bohm (the present author is no exception [START_REF] Bacciagaluppi | Nelsonian mechanics revisited[END_REF][START_REF] Bacciagaluppi | Derivation of the symmetry postulates for identical particles from pilot-wave theories[END_REF]).

We shall now spell out the difference between Nelson's original approach and de Broglie-Bohm theory (or its stochastic variants), with reference to some commonly raised questions about de Broglie-Bohm. No attempt will be made to assess the merits or demerits of these supposed criticisms, which are only briefly sketched, but which are listed roughly in increasing order of the attention they deserve. It should also be emphasised that, by common consensus, the situation as regards non-locality is the same in Nelson as it is in de Broglie-Bohm (irrespective of the approach to Nelson chosen). Indeed, it appears that Nelson himself would have hoped that his theory should be fundamentally local, and that he abandoned it because of its non-local features [START_REF] Nelson | Quantum Fluctuations[END_REF]. The question of locality and non-locality, in particular of at what stage and how the non-locality is implemented, of course deserves a detailed discussion, but will not be considered in this paper.

A first group of questions raised about de Broglie-Bohm theory relates to the notion of equilibrium: (a) how to justify why particles in laboratory ensembles should be distributed according to R 2 ; (b) if particles in such ensembles are always distributed according to R 2 , individual trajectories would appear to be unobservable (notice there is some tension between (a) and (b)). It should be clear that in a stochastic theory such as Nelson's (or stochastic variants of de Broglie-Bohm), there is no lingering question of justifying equi-librium, while at the same time one will have ever so small but well-defined fluctuations.

The second group of questions focuses on the tension between the configurationspace perspective and the Hilbert-space perspective. As such it is a rather heterogeneous group, comprising: (a) the idea that de Broglie-Bohm theory breaks the symmetry of the Hilbert space (that is, that configurations play an unjustified privileged role in the theory); (b) objections to the fact that waves act on particles but are not acted back upon; (c) the status of 'empty waves', that is, of those components of the wave function that no longer contribute to guiding the particles after the relevant separation in configuration space due to decoherence; (d) the detailed arguments, recently put in print by Brown and Wallace [START_REF] Brown | Solving the measurement problem: de Broglie-Bohm loses out to Everett[END_REF], for the conceptual redundancy of particle positions and the pilot-wave picture if one admits the possibility of an Everett interpretation (this should be taken seriously as a criticism of de Broglie-Bohm).

If Nelson's approach is successful, the Hilbert-space concepts are all derived concepts. Arguably then: question (a) would disappear because the Hilbert space is not in fact fundamental; (b) because there would only appear to be waves acting on particles; similarly for (c); and (d) because the Everett interpretation is no longer motivated if the wave function is not fundamental. (If one holds functionalist views in philosophy of mind, however, even the existence of the decohering wave function as a derived feature will allow for a many-minds version of the Everett interpretation.)

Notice also that one can use configuration-space trajectories to formulate conditions that rule out parastatistics for indistinguishable particles [START_REF] Bacciagaluppi | Derivation of the symmetry postulates for identical particles from pilot-wave theories[END_REF][START_REF] Dürr | Bosons, fermions, and the topology of configuration space in Bohmian mechanics[END_REF]. This is a case in which symmetry considerations at the level of the configuration space can play a non-trivial role.

Thirdly, it should be clear, even from the few remarks above, that the phenomenon of decoherence is crucial in order for de Broglie-Bohm theory to reproduce the phenomenology of the collapse of the wave function, and in fact of the whole 'classical regime' of quantum mechanics in the sense of the theory of decoherence. However, it appears to be merely a contingent fact that decoherence tends to produce separation of wave-function components in configuration space. If decoherence produced separation of components in momentum space, or if the pilot-wave kinematics and dynamics were defined with respect to momentum space, there would be no such distinguished regime in the theory, nor any effective collapse. While decoherence undoubtedly 'breaks the symmetry' of the Hilbert space, it does so purely contingently, and there appears to be no explanation why this matches the fundamental choice of configuration space in pilot-wave theory.

In the non-relativistic particle case this coincidence is not so immediately striking, maybe because historically both de Broglie's guidance equation and Schrödinger's wave equation derived their respective forms from the opticomechanical analogy (as spelled out, respectively, in de Broglie's thesis [START_REF] De Broglie | Recherches sur la Thorie des quanta[END_REF] and in Schrödinger's second paper on quantisation [START_REF] Schrödinger | Quantisierung als Eigenwertproblem (zweite Mitteilung)[END_REF]). In the field-theory case, however, it is not obvious what the 'correct' configuration space of a pilot-wave theory should be, and it is striking that if a configuration space is chosen that does not match up with decoherence, the right phenomenology will not emerge. A further, methodological, disadvantage is that it appears that pilot-wave theory has to feed on the results of decoherence for any successful generalisation to field theories. (These criticisms are essentially due to Saunders [START_REF] Saunders | The 'beables' of relativistic pilot-wave theory[END_REF].)

On the other hand, at least in the point-particle case, if Nelson's derivation is successful, the form of the quantum Hamiltonian is actually derived from the form of the particle dynamics (see Section 3 and the discussion in Section 4). The connection between decoherence and configurations is therefore immediate. Insofar as it appears that de Broglie-Bohm theory can be generalised to encompass the known field theories (see for instance Valentini [START_REF] Valentini | Pilot-Wave Theory[END_REF][START_REF] Valentini | Pilot-wave theory of fields, gravitation and cosmology[END_REF]), and if these generalisations should indeed manage in conjunction with decoherence to recover the correct phenomenology, one can speculate that analogous Nelson-type theories might be able to explain also in the general case the otherwise mysterious connection between the choice of the configuration space and the form of the decoherence Hamiltonian.

A final, independent motivation for a renewed interest in Nelson's research programme has been provided by its use in the completely different context of quantum gravity, in a recent paper by Markopoulou and Smolin [START_REF] Markopoulou | Quantum theory from quantum gravity[END_REF]. Here, the idea that the wave function is indeed a derived concept is again of crucial importance.

Nelson's Strategy

We now turn to the description and analysis of Nelson's strategy. In the main, we shall follow Nelson's original paper [START_REF] Nelson | Derivation of the Schrödinger equation from Newtonian mechanics[END_REF]. We have mentioned above that Nelson's theory is defined in terms of a diffusion process in the configuration space of the system. More precisely, Nelson suggests considering a stochastic differential equation of the following form:

dx(t) = b(x(t), t)dt + dw(t). (1)
The vector b(x(t), t) is called the mean (forward) velocity (see also (33) below). w(t) is a Wiener process; the dw(t) are Gaussian with mean 0, independent of the dx(s) for s ≤ t, and

E t [dw i (t)dw j (t)] = 2νδ ij dt, (2)
ν > 0 being the diffusion coefficient and E t denoting the expectation value at time t. For simplicity (and since we are not discussing non-locality) we can specialise to the case of a single particle, but the formalism and derivation are quite general. Formally, ( 1) is the same equation as in the Einstein-Smoluchowski theory of Brownian motion. Nelson, however, emphasises that the context is different: the Einstein-Smoluchowski theory describes macroscopic Brownian motion in a fluid in the limit of infinite friction, while Nelson postulates the equation for elementary particles in the vacuum. The corresponding Fokker-Planck equation for the distributions has the form

∂ρ ∂t = -div(bρ) + ν∆ρ. (3)
Nelson's aim is to impose natural constraints on the diffusion process such that (1) takes the form

dx = 1 m ∇S + ν ∇R 2 R 2 dt + dw (4)
(possibly, as will be discussed in more detail below, up to additional terms in b that will not contribute to the divergence in ( 6)), where the functions S and R satisfy the so-called Hamilton-Jacobi-Madelung equation,

∂S ∂t = - 1 2m (∇S) 2 -V + h2 2m ∆R R . (5)
If one inserts ρ = R 2 into the Fokker-Planck equation ( 3), with b defined as in (4), one obtains

∂R 2 ∂t = -div 1 m (∇S)R 2 . (6)
Equation ( 6) has the form of the usual quantum mechanical continuity equation. Equations ( 5) and ( 6) are called the Madelung equations and can be standardly derived from the Schrödinger equation setting ψ = Re iS/h . If one can find natural conditions on (1) such that ( 5) and ( 6) hold, this may suggest that it is (1) that is fundamental, the Schrödinger equation being only a convenient mathematical way of writing ( 5) and [START_REF] Hardy | Quantum theory from five reasonable axioms[END_REF]. Of course the problem can be trivialised by imposing as condition precisely that the current velocity be given through the gradient of the Schrödinger wave function, or some such ad hoc condition. A non-trivial solution to the problem should not make reference to the Schrödinger wave and equation in the formulation of the relevant conditions. We shall see below, mainly in Section 3.2, how Nelson proposes to do this. At first sight, however, this strategy appears conceptually puzzling. It appears that the distribution R 2 itself contributes to determining the particle trajectories via (4). But how can an individual trajectory be affected by the distribution of other particles in an ensemble? This, however, is a red herring. Take a stochastic differential equation of the form (1) and consider any solution ρ of the corresponding Fokker-Planck equation (3). At least formally, one can always associate with ρ a so-called osmotic velocity

u ρ := ν ∇ρ ρ , (7)
and we can define a corresponding current velocity,

v ρ := b -u ρ , (8)
so that

dx = v ρ + ν ∇ρ ρ dt + dw. (9)
The Fokker-Planck equation for this ρ then reduces to a continuity equation:

∂ρ ∂t = -div v ρ + ν ∇ρ ρ ρ + ν∆ρ = = -div(v ρ ρ), (10)
so that v ρ is indeed the current velocity corresponding to the distribution ρ.

If u ρ and v ρ are not too singular, the corresponding stochastic differential equation has indeed well-defined solutions (see also the related discussion by

Carlen [START_REF] Carlen | Conservative diffusions[END_REF]). This choice of representation, in which some distribution enters explicitly, does not affect the time evolution of an individual particle as given by ( 1): one could as well use a different solution ρ ′ of (3) and write

dx = v ρ ′ + ν ∇ρ ′ ρ ′ dt + dw. (11)
We see that reference to some specific distribution can be thought of as defining a convenient way of writing the mean velocity b. As we shall presently see, however, the choice of the distribution ρ is connected to the choice of a time reversal of equation (1).

Time reversal of diffusion processes

Take again the stochastic differential equation ( 1):

dx = bdt + dw. (12)
Such an equation essentially describes only the forward transition probabilities of a stochastic process (in the sense of a measure over all possible trajectories), and the process is in general underdetermined by equation [START_REF] Nelson | Derivation of the Schrödinger equation from Newtonian mechanics[END_REF]. Indeed, suppose an arbitrary Markov process is defined on a time interval [t 1 , t 2 ]. Given all the forward transition probabilities from a time s to a time t > s for any s, t ∈ [t 1 , t 2 ], one can define as many processes as one has possible initial distributions at time t 1 . Therefore, the backward transition probabilities that one can obtain for a process (by conditionalising on future states) are also underdetermined. As opposed to a deterministic equation, (1) has no well-defined time reversal, and specifying such a time-reversal will amount to a further condition on the process. 2 A time reversal of (1) will be a diffusion with the same diffusion coefficient ν (since the size of the fluctuations does not depend on the time direction), that is, it will have the form

dx = b ′ d(-t) + dw * , (13)
2 Notice that if one considers the process to be defined on ]-∞, +∞[, and if one invokes the asymptotic properties of such processes, then the convergence of the distribution in both directions of time will generally enforce a unique distribution ρ and therefore a unique time reversal. Since however ρ and b, though related, are still unspecified, the rest of our discussion in Section 3.2 will apply. We choose our mode of presentation because it is closer to Nelson's own and because it is more self-contained.

with some suitable mean velocity b ′ , and where the dw * (t) are again Gaussian with mean 0, and with

E t [dw * i (t)dw * j (t)] = 2νδ ij dt, (14)
but now the dw * (t) are independent of the dx(s) for s ≥ t. The Fokker-Planck equation corresponding to [START_REF] Bohm | The Undivided Universe: An ontological interpretation of quantum theory[END_REF] is

∂ρ ∂(-t) = -div(b ′ ρ) + ν∆ρ. (15)
Now let us choose a representation ( 9) of ( 1):

dx = v ρ + ν ∇ρ ρ dt + dw. (16)
The time reversal of ( 16) will have the form (13), as mentioned, but more specifically, since ρ(t) is manifestly invariant under time reversal, it will take the form

dx = v ′ ρ + ν ∇ρ ρ d(-t) + dw * , (17)
with a suitable current velocity v ′ ρ . But now, analogously to (10), ρ will satisfy also the continuity equation

∂ρ ∂(-t) = -div(v ′ ρ ρ). (18)
If ( 18) is meant to be the time reversal of ( 10), then we should further set

v ′ ρ = -v ρ , (19)
that is, we have uniquely fixed b ′ . One generally defines b * := -b ′ and writes

dx = b * dt + dw * (20)
rather than [START_REF] Bohm | The Undivided Universe: An ontological interpretation of quantum theory[END_REF]. The corresponding Fokker-Planck equation [START_REF] Valentini | Pilot-Wave Theory[END_REF] becomes

∂ρ ∂t = -div(b * ρ) -ν∆ρ (21)
(the so-called backward Fokker-Planck equation).

We see that there is indeed a one-to-one correspondence between the choice of a solution ρ to the Fokker-Planck equation in the representation (9) of ( 1) and the choice of a time reversal for [START_REF] Nelson | Derivation of the Schrödinger equation from Newtonian mechanics[END_REF]. Now, if we make such a choice and write down the pair of stochastic differential equations

dx = v ρ + ν ∇ρ ρ dt + dw (22)
and

dx = v ρ -ν ∇ρ ρ dt + dw * , (23)
this fixes ρ uniquely as the single-time distribution of the process, even if we take the process to be defined only on an interval [t 1 , t 2 ]. The intuitive reason is that any distribution has to get closer to ρ in both directions of time, but then it has to be ρ for all times. (In the following, we shall drop the index ρ from v ρ and u ρ .) Since the process is Markov, this also fixes uniquely the entire process. The equations ( 22) and ( 23) thus fix the process uniquely, while it is underdetermined if only one of the two equations is given.

Lest one be worried by the fact that the process is entirely fixed, let us emphasise again that a stochastic process is defined as a probability measure over a space of trajectories. Which trajectory is actually realised is a contingent matter, and so is the actual single-time distribution in any collection of sub-systems. Therefore, fixing the distribution at the level of the process does not fix the distribution in any actual such collection; rather, if one will, it is just a reflection of the fact that transitions along trajectories are governed in both directions of time by stochastic differential equations. What is fixed are the probabilities for distributions of sub-systems, and an actual distribution of sub-systems that is far from 'equilibrium' can be interpreted as a fluctuation, which is most likely both to evolve towards equilibrium in the time direction we label 'future' and to have evolved from equilibrium in the time direction we label 'past'.

Dynamical time symmetry and derivation of the Madelung equations

The framework for the derivation of the Madelung equations is now in place.

Nelson takes the pair of equations

dx = (v + u)dt + dw, dx = (v -u)dt + dw * , ( 24
)
where u is expressible as ν ∇ρ ρ in terms of the common distribution of the two evolutions. Thus far, ( 24) is merely a kinematical representation of a diffusion process in time-reversible notation: v and u (or ρ) are quite arbitrary, if coupled through the continuity equation

∂ρ ∂t = -div(vρ). ( 25
)
The question of whether the process is time-symmetric is a dynamical question. We need to determine the process by some further dynamical law that together with (25) will fix v and u (or equivalently, b and b * ). One can both imagine laws that will do this in a time-symmetric way (for in-

stance, v = 1 m ∇S and u = h 2m ∇R 2 R 2
, where ψ = Re iS/h satisfies a timesymmetric equation such as the Schrödinger equation), and laws that will do it in a time-asymmetric way (v and u the same as above, but ψ satisfies some time-asymmetric equation, as are some non-linear variants of the Schrödinger equation; compare for instance [START_REF] Doebner | Introducing nonlinear gauge transformations in a family of nonlinear Schrödinger equations[END_REF]). Nelson's aim is to recover the time-symmetric Schrödinger equation, so he will essentially seek to impose constraints on v and u in the form of a time-symmetric dynamical law (which however should not make reference to Schrödinger's equation in its formulation!).

Before discussing that, however, let us consider in more detail the continuity equation ( 25). This will turn into an equation of the same form as the usual quantum continuity equation if we define R 2 := ρ and impose

v = 1 m ∇S + ṽ, ( 26
)
where ṽ is a term satisfying

div(ṽR 2 ) = 0. ( 27
)
That is, ṽ does not contribute to the divergence. This can be expressed equivalently also as

ṽ = rot(t) R 2 , ( 28
)
for some function t, or, using u = ν ∇ρ ρ , as

div(ṽ) + 1 ν ṽ • u = 0. ( 29
)
(The treatment of such additional terms is somewhat different in Nelson's original approach and in Nelson-type pilot-wave theories; see below, Section 5. Notice also that Guerra and Morato [START_REF] Guerra | Quantization of dynamical systems and stochastic control theory[END_REF] use a variational principle to define the dynamics of Nelson's theory. This approach would appear to justify setting v equal to a gradient, thus excluding the extra term ṽ altogether.) Under these constraints then,

∂R 2 ∂t = -div 1 m ∇SR 2 , (30) as desired.
Given the definition of R and the condition [START_REF] Doebner | Introducing nonlinear gauge transformations in a family of nonlinear Schrödinger equations[END_REF], we return to the question of whether we can impose a dynamical law that will fix v and u such that S and R now obey also the Hamilton-Jacobi-Madelung equation [START_REF] Spekkens | In defense of the epistemic view of quantum states: A toy theory[END_REF]. At this point, Nelson considers the so-called forward and backward stochastic derivatives of the process, which he defines, respectively, as

Dx(t) x(t)=x = lim ε→0 + E t x(t + ε) -x(t) ε x(t) = x (31)
and

D * x(t) x(t)=x = lim ε→0 + E t x(t -ε) -x(t) -ε x(t) = x . (32)
Here E t [ . |x(t) = x] is the expectation value at time t conditional on the value of the process being x. Thus, the definition of Dx(t) involves the forward transition probabilities from time t to times t + ε, while the definition of D * x(t) involves the backward transition probabilities from time t to times tε. One sees easily that Dx(t)

x(t)=x = b(x, t) and D * x(t) x(t)=x = b * (x, t) (33)
(thus justifying the terminology of mean velocities). Also, if ν = 0 and therefore u = 0, both Dx(t) and D * x(t) equal v, and the stochastic derivatives reduce to the usual derivative.

Nelson points out that applying D or D * to an arbitrary random variable f (x(t), t), one obtains Df (x(t), t)

x(t)=x = ∂ ∂t + b(x, t) • ∇ + ν∆ f (x, t), (34)
and

D * f (x(t), t) x(t)=x = ∂ ∂t + b * (x, t) • ∇ -ν∆ f (x, t). (35)
He introduces the quantity a := 1 2 (Db * + D * b), which he calls the second stochastic derivative of x (or mean acceleration). One can easily calculate the quantity a by applying (34) and ( 35) to the components of b * and b. This yields

a = 1 2 ∂ ∂t + b • ∇ + ν∆ b * + 1 2 ∂ ∂t + b * • ∇ + ν∆ b = = 1 2 ∂ ∂t (b + b * ) + 1 2 (b • ∇)b * + 1 2 (b * • ∇)b - 1 2 ν∆(b -b * ) (36) (understood componentwise), or, using b = v + u and b * = v -u, a = ∂v ∂t + 1 2 [(v + u) • ∇](v -u) + 1 2 [(v -u) • ∇](v + u) -ν∆u = = ∂v ∂t + (v • ∇)v -(u • ∇)u -ν∆u. (37)
Let us provisionally ignore the term ṽ in [START_REF] Doebner | Introducing nonlinear gauge transformations in a family of nonlinear Schrödinger equations[END_REF] and insert v = 1 m ∇S and

u = ν ∇ρ ρ = ν∇ ln ρ into (37), yielding a = 1 m ∇ ∂S ∂t + 1 m 2 (∇S • ∇)∇S -ν 2 (∇ ln ρ • ∇)∇ ln ρ -ν 2 ∆∇ ln ρ. ( 38
)
One can use the fact that

(∇S • ∇)∇S = 1 2 ∇(∇S) 2 , (39)
and similarly that

(∇ ln ρ • ∇)∇ ln ρ + ∆∇ ln ρ = 1 2 ∇(∇ ln ρ) 2 + ∇∆ ln ρ = = 2∇ (∇R) 2 R 2 + ∆ ln R (40)
(where one also uses ln ρ = 2 ln R). Since

∆ ln R = R∆R -(∇R) 2 R 2 , (41) (40) becomes
(∇ ln ρ • ∇)∇ ln ρ + ∆∇ ln ρ = 2∇ ∆R R , (42)
and (38) simplifies to

ma = ∇ ∂S ∂t + 1 2m (∇S) 2 -2mν 2 ∆R R . (43)
In order to obtain the Hamilton-Jacobi-Madelung equation we can therefore impose

ν = h 2m (44)
and ma = -∇V,

where V is the external potential. (The integration constant from (43) will induce only an irrelevant global gauge transformation.)

If we set v = 1 m
∇S + ṽ, we obtain some additional terms in (38), which we must set equal to zero. Explicitly, we have to impose

∂ ṽ ∂t + (ṽ • ∇) 1 m ∇S + ( 1 m ∇S • ∇)ṽ + (ṽ • ∇)ṽ = 0. ( 46
)
The crucial condition on the process that allows Nelson to recover the Madelung equations (apart from the assumption that v is essentially a gradient) is (45): a law-like statement (indeed, a stochastic analogue of Newton's second law!) that is entirely time-symmetric and involves both the forward and the backward transition probabilities of the process in an essential way.

Postulating (45) is very suggestive, of course, but it is not peculiar to Nelson's theory. As he points out, (45) holds in the Ornstein-Uhlenbeck theory of Brownian motion, and his theory thus combines the kinematics of the Einstein-Smoluchowski theory with the dynamics of the Ornstein-Uhlenbeck theory.

Notice also that while choosing (45) as the crucial condition on b and b * yields precisely the Hamilton-Jacobi-Madelung equation, just about any condition would yield an equation coupling v and u in a non-trivial way. One especially interesting condition is mDb = -∇V (which does not involve mixing forward and backward transition probabilities). If v is a gradient (not in general), it is straightforward to show that

mDb = mD * b * = m 1 2 (Db + D * b * ). ( 47
)
This yields

∂S ∂t = - 1 2m (∇S) 2 -V -2mν 2 ∆R R . (48)
For ν = h 2m , this is exactly the Hamilton-Jacobi-Madelung equation, except for the sign of the quantum potential, and it corresponds to a non-linear and non-linearisable wave equation. Notice, however, that by taking a real linear combination of conditions ( 45) and (47) of the form

αm 1 2 (Db * + D * b) + βm 1 2 (Db + D * b * ) = -∇V, (49)
with α + β = 1 and αβ > 0, one can again obtain the Hamilton-Jacobi-Madelung equation by imposing

ν = 1 √ α -β h 2m . (50)
The diffusion coefficient ν can therefore take any positive value for an appropriate choice of α and β. Such a result was first derived by Davidson [START_REF] Davidson | A generalization of the Fényes-Nelson stochastic model of quantum mechanics[END_REF].

Inequivalence of the Madelung equations and the Schrödinger equation

The conditions to be imposed on the system of stochastic differential equations [START_REF] Markopoulou | Quantum theory from quantum gravity[END_REF] in order to relate them to the Madelung equations, as we have seen, are that ma = -∇V and that b + b * should be a gradient (or a slightly more general expression where the additional term satisfies some supplementary conditions). It is, however, not the case that the Madelung equations for two functions S and R imply the Schrödinger equation for the corresponding function ψ = Re iS/h (although the converse is true). This, as was emphasised by Wallstrom [START_REF] Wallstrom | Inequivalence between the Schrödinger equation and the Madelung hydrodynamic equations[END_REF], requires a supplementary condition on S, in fact one that appears rather ad hoc.

The problem is that v = 1 m ∇S defines v locally as the gradient of a function, but does not specify whether S is a single-valued or multi-valued function. The equivalence of the Madelung equations and the Schrödinger equation, however, depends extremely sensitively on the multi-valuedness properties of S. Indeed, both the assumption of single-valuedness and that of multi-valuedness (without further constraints) are problematic.

If S is assumed to be single-valued, then one can derive a Schrödinger equation from the Madelung equations, but this case does not capture the full generality of the Schrödinger equation, namely it does not include wave functions with angular momentum, for which S is indeed multi-valued. If instead one allows S to have an arbitrary multi-valued behaviour, then, as Wallstrom shows by example, there are solutions of the Madelung equations that do not correspond to any solution of the relevant Schrödinger equation.

The dilemma is between allowing too few or too many solutions of the Madelung equations than those necessary to recover all and only solutions of the Schrödinger equation. In order to do so, one has to assume that S is generally multi-valued, but that the difference in value acquired along a closed curve is restricted to an integer multiple of the Planck constant h. Obviously, this means assuming from the start that S is the phase of a complex function.

As Wallstrom puts it, in order to derive the Schrödinger equation from the Madelung equations, one has to impose a quantisation condition just like the Bohr-Sommerfeld condition of the old quantum theory. More neutrally, one could say that, given the non-trivial assumption that the current velocity of the process is given by some 'phase waves', Nelson shows there are natural conditions under which the complex function defining the waves obeys a Schrödinger equation and the distribution of the particles is given by the squared amplitude of this complex function, as well as fixing the form of the Hamiltonian.

This may not quite be Nelson's original aim, but it is a striking and non-trivial result. To illustrate just how striking it is one might resort to a historical fable. One could imagine that de Broglie had a yet younger brother, Édouard, who, starting from his brother's ideas on phase waves determining particle motions, connected them with ideas about Brownian motion and arrived to the Schrödinger equation a couple of years ahead of its actual discovery.

Conclusion

In Section 1, we mentioned that Nelson's stochastic mechanics is often presented as a theory in which one assumes the Schrödinger wave and Schrödinger equation as given. In these theories one constructs certain diffusion processes in such a way that the (asymptotic) distribution of the process is always given by R 2 . In the previous section, we have suggested that Nelson's own approach to his theory can rather be seen as one in which one assumes that the phase of a complex function (defined on configuration space) describes the current velocity of a diffusion process, and one formulates conditions directly on the process that turn out to imply that this complex function obeys the Schrödinger equation. Some of the differences between the two approaches are worth spelling out in more detail. If one assumes that the complex function ψ obeys the Schrödinger equation, then one can define v and u directly in terms of S and R under fewer constraints. In particular, while in Nelson's approach the diffusion coefficient ν is equal to h 2m , in the alternative approach it can be arbitrary. This is not an essential difference, however, since, as mentioned, Davidson [START_REF] Davidson | A generalization of the Fényes-Nelson stochastic model of quantum mechanics[END_REF] has shown that it is possible to have Nelson-style derivations of the Madelung equations using diffusion coefficients other than h 2m . Another constraint that no longer applies is the supplementary condition (46) on the additional velocity term ṽ.

More importantly, the Nelson-type pilot-wave theories need not assume the time-reversed equation ( 23) as an equation of the theory, nor the associated unique distribution ρ as the distribution for the particles. This line is taken explicitly for instance by Bohm and Hiley [START_REF] Bohm | The Undivided Universe: An ontological interpretation of quantum theory[END_REF]. Therefore, such stochastic variants of de Broglie-Bohm theory are not committed to considering the time reversed transitions as law-like (and they often omit them entirely from the presentation). For large times, both approaches to the theory will agree that there is a well-defined probability measure over the positions (namely the asymptotic distribution R 2 ). For early times, however, before the forward transitions have driven the distribution close to the asymptotic one, the stochastic variants of de Broglie-Bohm theory are not committed to any particular particle distribution. Of course one can use the R 2 -measure to define which trajectories should be considered as typical also for early times. This, however, should not be interpreted as a law of nature about the distributions to be expected in the world. Rather, it has to be argued for independently, as in the case of deterministic theories such as classical statistical mechanics or de Broglie-Bohm theory itself.

An approach that takes the Schödinger wave and equation as given, of course, is open to any of the criticisms listed in Section 2 as applying to de Broglie-Bohm theory (insofar as one accepts them, and with the qualified exception of the criticisms relating to equilibrium). The approach in which one assumes the existence of phase waves without assuming the Schrödinger equation, however, falls short of Nelson's original aim, and does not seem to fare much better. Indeed, if one assumes the existence of some phase waves and therefore the corresponding complex waves, and shows that these waves obey the Schrödinger equation, then in terms of ontological commitment this approach is just as problematic.

In order to make a difference to the interpretational debate in the sense sketched in Section 2, Nelson's approach would have to be developed truly along the lines of Nelson's original aim. I wish to conclude this paper by sketching a speculative strategy that might lead to meeting Wallstrom's criticism, and which I believe is new.

This strategy relies on the idea that by varying the potential V , one should be able to eliminate those nodes of R around which S accumulates terms other than hn. More precisely, by varying V , one wishes to make the complement of the nodal set of R simply connected in a neighbourhood of a certain time t. If this is true (the nodes dictated by antisymmetrisation of fermion wavefunctions are ineliminable, but the complement set of these nodes is simply connected if space has at least three dimensions), one could allow S to be multi-valued, but it would have to be single-valued in a neighbourhood of t, so that equivalence with the Schrödinger equation is ensured in that neighbourhood. Equivalence then follows for all times, even for those times when S might become multi-valued: the multi-valuedness will be automatically restricted to that obtainable when a Schrödinger wave acquires a multi-valued phase, as when one imparts angular momentum to a system. Thus, one would allow S to be multi-valued but discount the 'non-Schrödinger' solutions of the Madelung equations on the grounds that they are not globally well-defined in time, at least if V is time-dependent.

I wish to record my special thanks to Shelly Goldstein for long and fruitful discussions of the main topics of this paper, in particular the kinematics of time reversal, the comparison with pilot-wave theory, and the work byDavidson.

Acknowledgements

As mentioned above, I particularly wish to thank Shelly Goldstein for his time and enthusiasm in discussing matters relating to this paper, as well as both Shelly and Antony Valentini for spotting some errors in the originally published version of this paper. I would also like to thank Nico Giulini, Jerry Goldin, Gerard Milburn, Carlo Rovelli, Simon Saunders, the audience in Bielefeld and audiences in Sydney and Paris. I have written this paper while holding a research contract with CNRS.