Yejiao Wang

Prof Yu-Jun Cui
email: yu-jun.cui@enpc.fr

Anh Minh Tang

Chaosheng Tang

Nadia Benahmed

Changes in thermal conductivity, suction and microstructure of a compacted lime-treated silty soil during curing

Keywords: thermal conductivity, suction, microstructure, lime-treated soil, curing time, mercury intrusion porosimetry

An experimental study was conducted to investigate changes of thermal conductivity, suction and microstructure of a lime-treated silty soil during curing. The soil samples were prepared with 2% lime and compacted dry (17%) and wet (22%) of optimum. The thermal conductivity, total suction and pore size distribution were determined at various curing times. Results show that the thermal conductivity of samples compacted on the dry side decreases slightly with curing time, while the curing time effect on the samples compacted on the wet side is insignificant. The total suction generally increases with curing time even though the soil water content was kept constant. The pore size distribution characteristics are mainly related to its moulding water content. As the samples are compacted on the dry side, the pore size distribution shows typical bi-modal characteristics, with a population of macro-pores and a population of micro-pores. By contrast, as the samples are compacted on the wet side, the pore size distribution shows typical uni-modal characteristics. It is found that the modal size of both the large and small pores decreases with curing time.

INTRODUCTION

Lime treatment is widely applied in geo-engineering constructions such as highway and railway embankments, levees and slopes. This technique effectively improves the workability and mechanical behaviour of soils, because lime can significantly modify soil properties through a series of physical-chemical reactions, including hydration, cation exchanges and pozzolanic reaction [START_REF] Bell | Lime stabilization of clay minerals and soils[END_REF][START_REF] Boardman | Development of stabilisation and solidification in lime-clay mixes[END_REF]Prunsinski and Bhattacharja, 1999;Umesha et al. 2009). Generally, lime hydration takes place shortly after adding lime into the soil, and this process consumes a large amount of water. The main products of this first step reaction is Ca(OH) 2 . The followed ionization of hydration products provides sufficient Ca 2+ ions, and induces cation exchanges that lead to soil flocculation/agglomeration. Note that the cation exchanges and the consequent flocculation process occur rapidly after lime addition, resulting in changes in aggregate size distribution, plasticity and workability of soil [START_REF] Bell | Lime stabilisation of clay soils[END_REF][START_REF] Russo | Water retention curves of lime stabilised soil[END_REF]. Pozzolanic reaction usually takes a longer time and plays the major role in improving soil geotechnical behaviour, by increasing soil stiffness and shear strength [START_REF] Bell | Lime stabilization of clay minerals and soils[END_REF][START_REF] Consoli | Key parameters for the strength control of lime stabilized soils[END_REF][START_REF] Tang | Effects of the maximum grain size and cyclic wetting/drying on the stiffness of a lime-treated clayey soil[END_REF][START_REF] Dong | Investigation of aggregates size effect on the stiffness of lime and/or cement treated soil: from laboratory to field conditions[END_REF]. Due to the time-dependence of lime-soil reactions, the geotechnical behaviour of lime-treated soil depends significantly on curing time [START_REF] Locat | Laboratory investigations on the lime stabilization of sensitive clays: shear strength development[END_REF][START_REF] Bell | Lime stabilization of clay minerals and soils[END_REF][START_REF] Little | Evaluation of structural properties of lime stabilized soils and aggregates[END_REF][START_REF] Al Mukhtar | Microstructure and geotechnical properties of lime-treated expansive clayey soil[END_REF][START_REF] Di Sante | Time of reactions in a lime treated clayey soil and influence of curing conditions on its microstructure and behaviour[END_REF]. [START_REF] Brandl | Alteration of soil parameters by stabilization with lime[END_REF] and [START_REF] Liu | Variations in strength of lime-treated soft clays[END_REF] reported that the strength of lime-treated soil increased with increasing curing time. By performing bender element tests on lime-treated soils, [START_REF] Dong | Investigation of aggregates size effect on the stiffness of lime and/or cement treated soil: from laboratory to field conditions[END_REF] showed that there was a two-stage development for the shear modulus over time: stage 1 related to cation exchanges and stage 2 to pozzolanic reaction.

In most cases, lime-treated soils are exposed to natural environment or placed in shallow depth. They are unavoidably subjected to long-term cyclic climate loadings, i.e. temperature variations, drying and wetting, which can significantly affect their durability. Recent studies mainly focus on the effect of wetting and drying cycles on the mechanical behaviour of lime-treated soil [START_REF] Khattab | Long-term stability characteristics of a lime-treated plastic soil[END_REF][START_REF] Cuisinier | Impact of cyclic wetting and drying on the swelling properties of a lime-treated expansive clay[END_REF][START_REF] Le Runigo | Duability of the lime-treated Jossigeny silt under different hydraulic stresses: assessment of the mechanical, hydraulic microstructural, microstructural behavior[END_REF][START_REF] Tang | Effects of the maximum grain size and cyclic wetting/drying on the stiffness of a lime-treated clayey soil[END_REF], and little attention has been paid to the effect of temperature, which is also an important factor related to climate. Actually, temperature can also significantly affect the geotechnical properties of soil, such as Atterberg limits, stiffness, strength and volume change behaviour [START_REF] Ctori | The effects of temperature on the physical properties of cohesive soil[END_REF][START_REF] De Bruyn | The influence of temperature on mechanical characteristics of Boom clay: the results of an initial laboratory programme[END_REF][START_REF] Sultan | Temperature effects on the volume change behaviour of Boom clay[END_REF][START_REF] Liu | Variations in strength of lime-treated soft clays[END_REF][START_REF] Islam | Effects of Curing Environment on the Strength and Mineralogy of Lime-GGBS-Treated Acid Sulphate Soils[END_REF][START_REF] Consoli | Effect of Curing Temperature on the Strength of Sand. Coal Fly Ash, and Lime Blends[END_REF]). To assess the temperature effect, it appears essential to investigate soil thermal properties like thermal conductivity. Indeed, thermal conductivity is an important parameter in the modelling of the coupled thermo-hydro-mechanical behaviour of lime-treated soil under climate changes. It takes an important role in the heat transformation between the soil and the atmospheric air. However, most studies on thermal behaviour of treated soil involved cement stabilization in the past decades. [START_REF] Farouki | Thermal properties of soils[END_REF] reported that the addition of Portland cement into sand increased the thermal conductivity of the mixture in both wet and dry states. Adam and Jones (1995) observed that the thermal conductivity of cement stabilized soil was higher than that of lime-stabilized soil, and they explained that the former enhanced soil density while the later reduced it. Nevertheless, [START_REF] El Rawi | Strength and thermal properties of plain and reinforced soil-cement[END_REF] indicated that the thermal conductivities of both soil-cement mixture and concrete decreased with curing time. [START_REF] Lee | Thermo-mechanical properties and microfabric of fly ash-stabilized gold tailings[END_REF] tested the mixtures of the gold tailings and fly ash, showing a decrease of thermal conductivity of the mixtures with curing time. From these studies, it appears that the changes in thermal conductivity of lime-treated soil and especially the effect of curing time have not been well understood yet.

Due to the climate effect, field lime-treated soils are usually at unsaturated state. Thus, suction is a basic parameter to describe the state of soil-water-air system. For lime-treated soils, it was found that the cation exchanges and the induced flocculation can modify the water retention capacity of soil. [START_REF] Russo | Water retention curves of lime stabilised soil[END_REF], Tedesco and Russo ( 2008) observed an increase in water retention capacity by lime addition. [START_REF] Russo | Water retention curves of lime stabilised soil[END_REF], [START_REF] Cecconi | Prediction of soil-water retention properties of a lime stabilised compacted silt[END_REF] attributed this phenomenon to the reduced interconnection between pores. [START_REF] Khattab | Effect of initial suction on the swelling pressure and porosity of lime stabilized clays[END_REF] compared the water retention curve of a lime-treated clay with that of untreated one, and showed that the small increase of suction for the treated clay was due to water consumption by lime hydration. In longer term, pozzolanic reaction becomes dominant in lime-treated soils, creating cementitious compounds and giving rise to the modification of both microstructure and water retention capacity of soil.

To better understand the observed macroscopic behaviour of soil such as thermal conductivity, water retention capacity and stiffness, it is often required to perform soil microstructure investigation. Mercury intrusion porosimetry (MIP) is one of the most widely used techniques for this purpose. For lime-treated soils, due to the time-dependence of lime-soil interactions, their microstructure is time-dependent. [START_REF] Russo | Microstructure of a lime stabilised compacted silt[END_REF] performed MIP tests on lime-treated silt cured at different times, and highlighted the time-dependency of microstructure changes: the cation exchanges and pozzolanic reaction reduced the porosity and increased the quantity of small pores. [START_REF] Khattab | Long-term stability characteristics of a lime-treated plastic soil[END_REF] also studied the microstructure changes of a lime-treated expansive soil under wetting/drying cycles, and found that the total pore volume of treated soil increased drastically with wetting/drying cycles.

The above-mentioned studies show that different soil properties have been investigated for different cement/lime-treated soils, and there is no study on different soil properties with a fixed soil and a fixed treatment. This appears however essential to well understand different mechanisms involved in the treatment processes. In this study, the changes of thermal conductivity, suction and microstructure of a lime-treated unsaturated silty soil were analysed during curing time. Two groups of soil samples were prepared at dry and wet sides of optimum. The thermal conductivity, water retention capacity and pore size distribution of the samples at various curing times (from 1 to 90 days) were determined. Results allowed the coupled thermo-hydro-mechanical behaviour and the microstructure characteristics to be analysed.

MATERIALS AND METHODS

Test materials

The soil tested was taken from a site near Héricourt, France. This soil has a fine fraction (< 80 µm) of 65 %. Its geotechnical properties are reported in Table 1. According to French/European standard NF P 11-300 (1992), this soil belongs to category A2. It corresponds to a silt of high plasticity (MH) following the Unified Soil Classification System (USCS). The main minerals are quartz (55%), kaolinite (12%), feldspaths (11%), illite (10%), goethite (6.5%), montmorillonite (4%), chlorite (1%) and rutile (0.5%) [START_REF] Deneele | Evaluation de la durabilité des sols -Effet de la circulation d'eau sur la durabilité du limon traité_Approche multi -échelle, Livrables du projet TerDOUEST[END_REF]. In Figure 1, both grain size distribution of natural soil and aggregate size distribution of soil powder used in this study are presented. The grain size distribution was obtained on the natural soil by the wet sieving method (NF P 94-056, for particles larger than 80 µm, and by the hydrometer method (NF P 94-057, for particles smaller than 80 µm). Natural soil was first air-dried, ground and then passed through the target sieve of 0.4 mm (D max ). The larger soil aggregates which could not pass through this sieve were ground again, until all soil passed through [START_REF] Tang | Effects of the maximum grain size and cyclic wetting/drying on the stiffness of a lime-treated clayey soil[END_REF]. Then the "aggregate size distribution" was determined by dry sieving method.

Quicklime was used as additive. It is the same lime used in the embankment construction at Héricourt, France. The main properties of this lime are presented in Table 2. In accordance with the lime treatment in the embankment construction at Héricourt, 2 % lime by dry weight of soil was chosen as the lime dosage.

Sample preparation

After the soil powder was prepared (D max = 0.4 mm), 2% quicklime powder was first mixed with dry soil. Then the soil-lime mixture was humidified by distilled water to reach different target water contents. According to the compaction curves of lime-treated soil determined from standard Proctor test (NF P 94-093, 1999) in Figure 2 (where the curve of untreated soil is also shown), both the dry side (w dry = 17%) and the wet side of optimum water content (w wet = 22 %) with the same dry density (ρ d = 1.65 Mg/m 3 ) were considered. The water contents and dry density were chosen according to the values applied in the field for the embankment construction in Héricourt, France. After a mellowing period of 1 hour, static compaction by 3 layers was performed to reconstitute the samples at the target dry density and different sizes to satisfy the requirements of different tests. For instance, the samples for thermal conductivity test had 50 mm in diameter and 75 mm in height; the samples for suction measurement had 38 mm in diameter and 100 mm in height; the samples for MIP test had 50 mm in diameter and 20 mm in height. Immediately after compaction, sample was carefully covered by plastic membrane and wrapped in a film. Then the sample was enveloped by scotch tape, confined in a hermetic box and cured in a chamber at a relative humidity of 100% and a temperature of 20±2°C.

Thermal conductivity tests

A thermal properties analyzer, KD2 (Decagon Devices Inc.) was used to measure the thermal conductivity of samples. Its principle is based on the transient hot-wire method. The thermal probe is a single-needle (KS-1) with a size of 1.3 mm diameter and 60 mm length. Its accuracy is 5% and the measurement range is 0.02 -2 W/mK. This device meets the requirements of ASTM Standards (ASTM D5334-00, 2000). In order to install the thermal probe into the soil, a hole of 1.3 mm diameter and 60 mm depth was drilled in the centre of each compacted sample. As shown in Figure 3, a layer of thermal grease was first applied on the surface of the probe to ensure a good contact between the soil and the probe. Then, the thermal probe was installed inside of the soil sample. Before starting the measurement, about 10 min was needed for the temperature inside of the sample reaching stability. After that, the measurement was started by pressing the key "Enter" on the device. It took about 1 -2 min for one measurement. Note that the measurement was performed in the laboratory at a temperature of 20±2°C. This measurement was being conducted during the whole curing time of t = 90 days for each soil sample.

Suction measurement

Once the samples were compacted, they were covered in watertight plastic films and stored for 24 h for water homogenization. Then the samples were cut into 6 or 8 small pieces (38 mm in diameter and 8 mm in height) which were well covered to prevent water evaporation during curing time. At a given curing time, one small piece was put into the dew point PotentiaMeter (WP4) to measure its suction. Immediately after the suction measurement, the water content was determined by oven-drying.

The dew point PotentiaMeter (WP4) measures the total suction in a sample. The total suction (ψ) of the sample was determined through Kelvin's equation:

RH M RT ln = ψ (1)
where R is the gas constant (8.31 J/mol K), T is the Kelvin temperature of the sample, M is the molecular mass of water, RH is the relative humidity.

As RH is dependent on temperature [START_REF] Tang | Controlling suction by the vapour equilibrium technique at different temperatures and its application in determining the water retention properties of MX80 clay[END_REF], it is important to measure the temperature for each RH measurement. In the dew point PotentiaMeter, the dew point temperature of air is measured by a dew point sensor and the sample temperature is measured by an infrared thermometer.

Microstructure investigation

For the MIP tests, one small piece (around 1.1 g of dry soil) was cut carefully from the compacted sample (50 mm in diameter and 20 mm in height) at a certain curing time (t = 1, 28 and 90 days). Each small piece was freeze-dried immediately following the procedure proposed by [START_REF] Delage | Influence de la lyophilisation sur la structure d'une argile sensible du Québec[END_REF], and then subjected to MIP test. Autopore IV 9500 mercury intrusion porosimeter which has both low-pressure and high-pressure systems was used. The pressure started from a value of 3 to 4 kPa in the low-pressure part up to around 230 MPa in the high-pressure part. With increasing pressure, mercury gradually intruded into the sample starting from a maximum entry diameter of 355 µm to a minimum value of 0.006 µm according to Laplace's law:

⎟ ⎟ ⎠ ⎞ ⎜ ⎜ ⎝ ⎛ + = 2 1 1 1 cos r r p θ σ (2)
where r 1 and r 2 are the curvature radii -in the case of spherical interface, r 1 = r 2 ; σ is the surface tension (taken equal to 0.485 N/m); θ is the contact angle (taken equal to 130°); p is the applied pressure.

Since the mercury cumulative intrusion can be assimilated to the air intrusion process, the following equation can be deduced:

w w w m m m p p d θ σ θ σ cos 4 cos 4 = - = (3)
where d is the diameter of intruded pore (assumed to be cylindrical), σ is the surface tension, θ is the contact angle, p is the intrusion pressure, subscript m denotes mercury while subscript w denotes water. In this study, the following values were taken: σ m = 0.485 N/m, σ w = 0.073 N/m, θ m = 130° and θ w = 0°.

The relationship between matric suction (u a -u w ) and mercury intrusion pressure p m can be deduced from Eq. ( 3):

( )

m m m w w w a p u u θ σ θ σ cos cos - = - (4)
The water content w and degree of saturation S r can be determined using the following equations by considering the residual water content w r [START_REF] Romero | Thermo-hydro-mechanical behaviour of unsaturated Boom clay: an experimental study[END_REF]:

( )( ) r r sat rm w w w S w + - - = 1 (5) ( ) rm sat r rm r S w w S S + - = 1 (6)
where S rm is the degree of saturation of mercury, w sat is the water content at saturation.

EXPERIMENTAL RESULTS

Thermal conductivity tests

Figure 4 shows the thermal conductivity of lime-treated samples versus curing time on a semi-logarithmic scale. It can be seen that, for the samples compacted on the wet side, the curing effect on the thermal conductivity is negligible, the value remaining around 1.50 W/mK. For the samples compacted on the dry side, the thermal conductivity decreases slightly during curing. At t = 1 day, the thermal conductivity is about 1.36 W/mK; it decreases by 5.1% to about 1.29 W/mK at t = 90 days. The decreasing thermal conductivity with curing time was also reported for soil-cement mixture and concrete (El-Rawi and Al-Wash, 1995), gold tailings and fly ash mixtures [START_REF] Lee | Thermo-mechanical properties and microfabric of fly ash-stabilized gold tailings[END_REF], cement paste [START_REF] Hansen | Thermal properties of hardening cement paste[END_REF]. [START_REF] Mojumdar | Thermal, spectral and AFM studies of calcium silicate hydrate-polymer nanocomposite material[END_REF] measured the thermal conductivity of synthetic calcium silicate hydrate (C-S-H), the main cementitious product of lime treatment, and a value of 0.1012 W/mK at 25°C was found. Note that the value for water is 0.6 W/mK, much higher than that of C-S-H (Van Wijk, 1963;[START_REF] Farouki | Thermal properties of soils[END_REF]. This explains why wet samples (w = 22%) always have higher thermal conductivity than the dry samples (w = 17%).

Suction measurement

The suction variations with curing time are shown in Figure 5a. As expected, at given curing time, the suction of dry side samples (w = 17 %) is generally higher than that of wet side samples (w = 22%). It is also observed that the suction of all samples increases with curing time. For the samples compacted dry of optimum, the suction is 270 kPa at t = 2 days; then it gradually increases to 500 kPa at t = 90 days. Similarly, for the samples compacted wet of optimum, the suction increases from 170 kPa at t = 4 days to 300 kPa at t = 90 days.

Interestingly, these suction changes occur in almost constant water content conditions. Indeed, Figure 5b shows that the measured water contents remain almost constant with curing time:

the water content of the wet side samples is about 22 %, and that of dry samples is about 17 % during the whole curing time. Note that the dry density was monitored during curing and a variation of 0.119 -0.850% was recorded. This variation is very small and its effect on suction changes can be ignored. It can be deduced that the lime treatment increases the water retention capacity of soils. This is consistent with the observations made by [START_REF] Russo | Water retention curves of lime stabilised soil[END_REF], [START_REF] Cecconi | Prediction of soil-water retention properties of a lime stabilised compacted silt[END_REF][START_REF] Cecconi | Prediction of soil-water retention properties of a lime stabilised compacted silt[END_REF]Tedesco (2007), suggesting that the water retention capacity of lime-treated soils is improved over time.

Microstructure investigation

The derived curves and the corresponding cumulative curves are presented in Figure 6 for the samples compacted on dry side, and in Figure 7 for the samples compacted on wet side. It is observed that the derived curves of the samples compacted on dry side (Figure 6a) show typical bi-modal characteristics, indicating the presence of two populations of pores: macro-pores and micro-pores, while the samples compacted on the wet side illustrate typical uni-modal characteristics, indicating the presence of only one population of pores (Figure 7a).

These observations are in agreement with those of [START_REF] Delage | Microstructure of a compacted silt[END_REF] on compacted silt and [START_REF] Russo | Microstructure of a lime stabilised compacted silt[END_REF] on lime-treated silt. In Figure 6a, each curve corresponds to a curing time (t = 1, 28, and 90 days). It appears that the average entry diameters of both macro-pores and micro-pores slightly decrease with curing time. Specifically, the size of macro-pores decreases from 5.27 µm to 4.18 µm after 90 day curing; for the population of micro-pores, its modal size also decreases from 0.23 µm to 0.07 µm after 90 curing days. Similar results are obtained on the samples compacted on wet side. The single peak of pores shifts from 0.28 µm at 1 day to 0.13 µm at 90 days (Figure 7a).

The cumulative curves are plotted in a semi-logarithmic scale, in terms of mercury intruded void ratio as a function of entrance pore diameter as indicated in Figure 6b and Figure 7b.

With curing time, the final intrusion void ratio of the samples compacted on the wet side continues to decrease and does not stabilize (Figure 7b); this decrease is more obvious for the samples compacted on dry side (Figure 6b).

According to the pore size distribution curves shown in Figure 6a and Figure 7a, the water retention curves can be determined as explained in section Materials and Methods, and they are presented in Figure 8. Note that the suction determined from MIP curve corresponds to capillary suction or matric suction. The corresponding measured total suction values are also presented for comparison. On the dry side, at w = 17% (Figure 8a), the matric suction obtained from the curves increases from about 400 to about 1000 kPa when the curing time increases from 1 to 90 days. Similarly, on the wet side, at w = 22% (Figure 8b), the matric suction also increases from about 180 to 300 kPa when the curing time increases from 1 to 90 days. In comparison with the direct measurements, the matric suction seems to be higher than the total suction -the direct measurement points are located beneath the curves from the MIP tests. This seems to be weird and will be discussed in the following section. On the whole, both the direct and indirect measurement data illustrate that the water retention capacity of lime-treated samples is improved gradually with curing time. This is in good agreement with the results of [START_REF] Russo | Water retention curves of lime stabilised soil[END_REF], [START_REF] Cecconi | Prediction of soil-water retention properties of a lime stabilised compacted silt[END_REF][START_REF] Cecconi | Prediction of soil-water retention properties of a lime stabilised compacted silt[END_REF]Tedesco (2007).

DISCUSSION

Soil effective thermal conductivity is significantly controlled by the volumetric components.

Generally, soil consists of solid particles which contain various minerals with different thermal properties. They are surrounded by pore-air and pore-water. It was reported that the thermal conductivity of most soil minerals is around 2.7 W/mK [START_REF] Farouki | Thermal properties of soils[END_REF]. However, the thermal conductivity value of the main hydration product (C-S-H) of lime is 0.1012 W/mK, much lower than that of water (0.6 W/mK) [START_REF] Mojumdar | Thermal, spectral and AFM studies of calcium silicate hydrate-polymer nanocomposite material[END_REF][START_REF] Farouki | Thermal properties of soils[END_REF].

Thus, the presence of pozzolanic products during curing decreases the effective thermal conductivity of the whole system.

Soil thermal conductivity also significantly depends on soil structure defined by soil porosity, pore size distribution, particle contacts, etc. In general, soil compacted at different water contents presents different microstructures [START_REF] Delage | Microstructure of a compacted silt[END_REF]. As shown in Figure 6 and Figure 7, the soil compacted dry of optimum (degree of saturation of about 67%) presents aggregated structure with large macro-pores, which are usually filled with continuous air phase and discontinuous water phase in case of low degree of saturation, most water being in the small pores inside the aggregates. By contrast, the soil compacted wet of optimum (degree of saturation of about 87%) presents a dispersed structure with continuous water phase in the pores and air phase in mostly occluded state [START_REF] Delage | Microstructure of a compacted silt[END_REF]Wroth and Houlsby, 1985;[START_REF] Alonso | Special problem soils-General report[END_REF]Tedesco, 2007). These two different microstructures result in different thermal contacts among soil grains. It is therefore reasonable that the thermal conductivity of lime-treated soil is largely dependent on its initial compaction water content as shown by the results in Figure 4. On the dry side, the thermal conductivity of samples is dominated by the solid contacts between aggregates. But because in this case the macro-pores are filled with continuous pore air and discontinuous pore water, the thermal conductivity is relatively lower.

The cementitious compounds mainly coat the surface of aggregates [START_REF] Deneele | Microstructural evolution and physico-chemical behavior of compacted clayey soil submitted to an alkaline plume[END_REF], and therefore modify the thermal contact conditions. Due to the relative low thermal conductivity of cementitious compounds, the overall thermal conductivity of treated soil decreases with increasing amount of cementitious compounds. As a result, the measured thermal conductivity of dry side samples decreases with curing time (Figure 4). On the wet side, the dispersed structure has more solid contacts between soil particles than aggregated structure of dry side samples. Moreover, the liquid phase in pores is continuous and dominates the heat transfer process in soil. As indicated above, the thermal conductivity of water is about 6 times higher than cementitious compounds of lime. Consequently, the effect of cementitious compounds on the overall thermal conductivity of soil becomes negligible. This explains the observation in Figure 4 with the thermal conductivity of the wet side samples remaining almost unchanged during curing.

The suction determined by both direct and indirect measurements increases over curing time (Figure 8), while the water content dose not decrease (Figure 5). This is due to the fact that water consumption of lime mainly takes place in the first step of hydration and becomes negligible in the later pozzolanic reactions [START_REF] Prusinski | Effectiveness of Portland cement and lime in stabilizing clay soils[END_REF]Umesha et al. 2009). The increase of suction can be attributed to the pozzolanic reaction which changes the soil microstructure. The results of MIP tests illustrate that the sizes of both macro-pores and micro-pores decrease continuously with curing time (Figure 6 and Figure 7). To some extent, the creation of cementitious compounds with a porous character would contribute to the increase in the quantity of micro-pores [START_REF] Cerny | Effect of pozzolanic admixtures on mechanical, thermal and hygric properties of lime plasters[END_REF][START_REF] Deneele | Microstructural evolution and physico-chemical behavior of compacted clayey soil submitted to an alkaline plume[END_REF]. Besides, the cementitious compounds are mainly coating on the surface of soil particles, blocking some entrances of micro-pores and increasing the occluded pores. Furthermore, cementitious products which occur at the clay edges, could bind the soil particles together, resulting in a reduction of macro-pore size and modifying the interconnection of macro-pores. All these changes would increase the water retention capacity of soil. As far as the difference of suction between the direct measurement and the indirect measurement is concerned, the water retention curves determined from MIP data correspond to the drying path, while the direct measurement points corresponds to a state between the drying path and the wetting paththey are located in a scanning curve. It is thereby logical to have the direct measurement points below the curves from the MIP data (Figure 8).

CONCLUSION

A series of laboratory tests were performed on lime-treated silty soil samples compacted dry and wet of optimum. Emphasis was put on the effects of curing time on thermal conductivity, suction and microstructure. The obtained results allow the following conclusions to be drawn:

1) The samples compacted dry of optimum show typical bi-modal pore size distribution characteristics, while the samples compacted wet of optimum show typical uni-modal pore size distribution characteristics. With curing time, both the modal sizes of micro-pores and macro-pores shift to lower values, due to the cementitious compounds produced from pozzolanic reaction that fill the pores gradually over time.

2) The thermal conductivity of lime-treated soil over curing time significantly depends on the moulding water content: for the samples compacted dry of optimum, the thermal conductivity decreases slightly with increasing curing time; for the samples compacted wet of optimum, the effect of curing time on the thermal conductivity is insignificant. The slight decrease observed on dry side can be explained by the production of cementitious compounds with lower thermal conductivity that coat the aggregates, slightly modifying the thermal contact conditions over time. For the soil compacted wet of optimum, owing to the dispersed structure which has more solid contacts and a continuous liquid phase in pores, this effect of cementitious compounds becomes negligible.

3) Due to the modification of microstructure by the generation of cementitious compounds, the suction of lime-treated soil generally increases with curing time, regardless of the moulding water content.

The obtained results give an insight into the modifications of soil properties induced by lime treatment during curing, helping better understand the curing effect on the evolutions of thermal conductivity, suction and microstructure of the lime treated soil. These results can be further used to analyse the thermo-hydro-mechanical behaviour of lime-treated soil. Moreover, this study also provides useful elements to appreciate the durability of lime-stabilised soils. It will be extended to other stabilised soils like lime-treated clay in order to verify the conclusions drawn. Table 1 Geotechnical

List of Tables

Figure 1 Figure 2 Figure 3 Figure 4 Figure 8

 12348 Figure 1 Aggregate size distribution of soil with Dmax = 0.4 mm and grain size distribution of natural soil Figure 2 Normal proctor curve of lime-treated silt (after Dong, 2013) Figure 3 Setup of thermal conductivity measurement: (a) sketch of setup; (b) photo of setup Figure 4 Thermal conductivity of lime-treated soil during curing time Figure 5 (a) Suction changes of lime-treated soil during curing time and (b) water content variations of lime-treated soil during curing time Figure 6 (a) Derived pore size distribution curves of lime-treated samples compacted on the dry side and (b) cumulative curves of lime-treated sample compacted on the dry side (em: mercury intruded void ratio; d: entrance pore diameter and e: void ratio of the as-compacted sample) Figure 7 (a) Derived pore size distribution curves of lime-treated sample compacted on the wet side and (b) cumulative curves of lime-treated sample compacted on the wet side Figure 8 Water retention curves of lime-treated silt determined from MIP data: (a) at dry side; (b) at wet side

Figure 1 Figure 5 Figure 6 Figure 7 Figure 8

 15678 Figure 1 Aggregate size distribution of soil with D max = 0.4 mm and grain size distribution of natural soil

Table 1 Geotechnical properties of the studied soil

 1

	Property	Value
	Specific gravity, G s (NF P 94-054)	2.70
	Liquid limit, w L (%) (NF P 94-051)	51
	Plastic limit, w p (%) (NF P 94-051)	28
	Plasticity Index, I p (%) (NF P 94-051)	23
	VBS (g/100g) (NF P 94-068)	2.19
	CaCO 3 content (%) (ASTM D4373-02:2007)	1.4
	Optimum moisture content (%) (NF P 94-093)	17.9
	Maximum dry unit mass (Mg/m 3 ) (NF P 94-093)	1.76

Table 2 Parameters of the used lime

 2

	Chemical analysis
	CaO (%)	97.30
	CaO + MgO (%)	98.26
	MgO (%)	0.96
	CO 2 (%)	0.25
	SO 3 (%)	0.06
	Aggregate size analysis
	≤ 80 µm (%)	82.7
	≤ 200 µm (%)	95.2
	≤ 2 mm (%)	100.0

ACKNOWLEDGEMENTS

The authors wish to acknowledge the support of the European Commission via the Marie Curie IRSES project GREAT -Geotechnical and geological Responses to climate change: Exchanging Approaches and Technologies on a world-wide scale (FP7-PEOPLE-2013-IRSES-612665). The support from China Scholarship Council (CSC) and Ecole des Ponts ParisTech are also gratefully acknowledged.


Hamideh Sabouri

Ramtin Khosravi

Delta Modeling and Model Checking of Product Families

Software product line engineering focuses on proactive reuse to reduce the cost of developing families of related systems. A recently proposed method to develop software product lines is delta modeling where a set of deltas specify modifications that should be applied to a core product to achieve other products. The main advantage of this technique is its modularity and flexibility. In this paper, we propose an approach to model check delta-oriented product lines. To this end, we transform a delta model to a corresponding annotated model where an application condition is associated to each statement. An application condition specifies the set of products that a statement is included in them. We present the semantics of the resulting model in form of a featured transition system where each transition is annotated with an application condition. Featured transition systems are supported by a variability-aware model checking technique that can be used to verify the annotated model.

Introduction

Software product line (SPL) engineering enables proactive reuse by developing a family of related products instead of developing individual products separately. To this end, the commonalities and differences between products should be modeled explicitly [START_REF] Pohl | Software Product Line Engineering: Foundations, Principles and Techniques[END_REF]. Feature models are widely used to model the variability in SPLs. A feature model is a tree of features containing mandatory and optional features as well as other constraints among them, e.g., mutual exclusion. A product is defined as a valid combination of features, and a family is the set of all possible products [START_REF] Kang | Feature-oriented domain analysis (FODA) feasibility study[END_REF] (section 3).

Delta modeling [START_REF] Schaefer | Delta-oriented programming of software product lines[END_REF] is a modular, flexible, and expressive modeling approach that is recently proposed to develop SPLs. In this approach, an SPL is represented by a core product and a set of deltas. Deltas represent modifications that must be applied to the core product to derive other products of the product line. Each delta has an application condition that specifies the feature configurations on which the modifications are applicable.

As SPL engineering is increasingly used in the development of mission-critical and safety-critical systems such as embedded systems [START_REF] Ebert | Embedded software: Facts, figures, and future[END_REF], formal verification of software product lines is essential. Recently, a number of approaches has been proposed to deductively verify delta-oriented SPLs using theorem proving [START_REF] Bruns | Verification of software product lines with delta-oriented slicing[END_REF][START_REF] Thüm | Family-based deductive verification of software product lines[END_REF][START_REF] Hähnle | A Liskov principle for delta-oriented programming[END_REF][START_REF] Damiani | A transformational proof system for delta-oriented programming[END_REF]. However, to the best of our knowledge, there is no approach applying model checking technique [START_REF] Clarke | Model Checking[END_REF] to verify delta-oriented models of software product lines. On the other hand, in [START_REF] Classen | Model checking lots of systems: efficient verification of temporal properties in software product lines[END_REF] model checking algorithm is adapted to be applicable to SPLs (which we refer to it as variability-aware model checking). The drawback of this approach is that it does not support modular modeling of SPLs as the underlying formal model of product family is annotative. In annotative modeling approaches, each transition/statement of the model is annotated by an application condition to indicate the feature combinations that enable the transition/statement. The model checker uses the annotations to determine the set of products that satisfy/violate a property.

In this paper, we propose an approach to model check delta-oriented models of product families. Due to the compositional nature of delta models, developing a technique to analyze the entire family is not reasonable. A simple strategy is to generate all products of an SPL and model check each individually. However, this strategy may involve redundant computations due to similarities among the products. An alternative is to take benefit from the variability-aware model checking techniques. To this end, we transform a delta model to a corresponding annotative model. The annotated model can then be verified using variabilityaware model checking technique. We select Rebeca [START_REF] Sirjani | Modeling and verification of reactive systems using Rebeca[END_REF] for formal modeling which is an actor-based language with a formal foundation to model and verify concurrent and distributed systems (section 4.1). Recently, the ABS language [START_REF] Clarke | Modeling spatial and temporal variability with the hats abstract behavioral modeling language[END_REF] is developed to model the behavior of configurable and distributed systems using delta modeling. However it is not supported by a model checking tool yet. Therefore, we choose Rebeca which is supported by an accessible model checker Afra [START_REF]Rebeca research group: Afra integrated verification environment for Rebeca[END_REF]. Due to modularity, object-based nature, and Java-like syntax of Rebeca, its adaptation to support delta modeling is straightforward (considering the work on delta-oriented modeling of object-oriented SPLs like Java [START_REF] Schaefer | Delta-oriented programming of software product lines[END_REF]).

To provide an approach to model check delta-oriented product families, we extend Rebeca to support delta modeling (section 4.2). We also introduce annotations in Rebeca and define the semantics of annotated Rebeca models using featured transition systems (FTS) [START_REF] Classen | Model checking lots of systems: efficient verification of temporal properties in software product lines[END_REF] to which the variability-aware model checking algorithm is applicable (section 4.3). In FTS, an application condition determines the feature combinations that enable a transition. Then, we propose a method to transform a delta model to a corresponding annotated model (section 5.1). We also justify the correctness of our proposed approach intuitively (section 5.2). There are two possible approaches to model check the resulting annotated Rebeca model: using its underlying FTS or generating a plain Rebeca model from it to use the existing model checker of Rebeca for verification (section 5.3).

The main contribution of our work is developing SPLs in a high-level and modular manner by employing delta-oriented modeling concept while taking advantage of variability-aware model checking which is currently only applicable to annotative models of product families. The contributions of our paper can be summarized as follows:

-We extend Rebeca to support delta modeling which enables us to model families of actor systems. -We extend Rebeca with annotations along with its semantics based on FTS to apply the existing variability-aware model checking techniques. -We propose a method to transform delta models to annotated models which enables us to use existing techniques for annotated models of SPLs.

The Coffee Machine Example. We use Coffee Machine family as the running example in the paper. A coffee machine may serve coffee or tea or both. Adding extra milk and extra sugar may be supported optionally. The payment method of a coffee machine is either by coin or by card.

Related Work

Several approaches has been proposed for formal modeling of SPLs using SMV [START_REF] Plath | Feature integration using a feature construct[END_REF], automata and transition based systems [START_REF] Larsen | Modal I/O automata for interface and product line theories[END_REF][START_REF] Classen | Model checking lots of systems: efficient verification of temporal properties in software product lines[END_REF][START_REF] Sabouri | An effective approach for verifying product lines in presence of variability models[END_REF][START_REF] Sabouri | Scheduling and analysis of real-time software families[END_REF], process algebra [START_REF] Gruler | Modeling and model checking software product lines[END_REF], Petri nets [START_REF] Muschevici | Feature Petri Nets[END_REF], and Promela [START_REF] Classen | Model checking software product lines with SNIP[END_REF]. These approaches capture the behavior of the entire product family in a single model by including the variability information in it using annotations. Annotating a transition/statement with an application condition indicates the configurations that enable the transition/statement. In [START_REF] Gruler | Modeling and model checking software product lines[END_REF], an operator is added to CCS to specify alternative processes.

To model check annotated models, model checking technique has been adapted in [START_REF] Classen | Model checking lots of systems: efficient verification of temporal properties in software product lines[END_REF] to verify featured transition systems. In FTS, an application condition determines the feature combinations that enable a transition. To explore the state space of an FTS, the track of products should be kept. Thus, a reachability relation is constructed while exploring the state space which is a set of pairs (s, px). Such couple indicates that state s is reachable by products in px.

Recently, a number of methods has been proposed to deductively verify deltaoriented SPLs. In [START_REF] Bruns | Verification of software product lines with delta-oriented slicing[END_REF], all derivable products of a delta-oriented SPL are verified incrementally using interactive theorem proving. In the first step, the core product is verified completely. Then, for each other product, the invalidated proofs and some new obligation proofs are proven. In [START_REF] Thüm | Family-based deductive verification of software product lines[END_REF], a family-based technique is proposed to reduce the cost of deductive verification for SPLs. For modular verification of software families, a Liskov principle is developed for delta-oriented programming in [START_REF] Hähnle | A Liskov principle for delta-oriented programming[END_REF]. In [START_REF] Damiani | A transformational proof system for delta-oriented programming[END_REF], a transformational proof system is developed for delta-oriented programs which supports modular verification.

3 Background: Software Product Lines Software product line engineering is a paradigm to develop software applications using platforms and mass customization. To this end, the commonalities and differences between products should be modeled explicitly. Feature models [START_REF] Kang | Feature-oriented domain analysis (FODA) feasibility study[END_REF] are widely used for this purpose. A feature model represents all possible products of a software product line in terms of features and relationships among them. A feature model is a tree of features that allows the mandatory, optional, or, and xor relationships among features. It also includes requires and excludes constraints between features. A product is derived from a feature set by making a decision to include/exclude each feature. A valid product conforms to the constraints that are specified in the feature model.

A configuration keeps track of including/excluding features. The root feature can be omitted in a configuration as it is included in all products. Having feature set F with n features, a configuration is defined as c ∈ {true, false, ?} n where c i = true/false represents inclusion/exclusion of the i th feature. The value '?' indicates that a feature is not included nor excluded yet. A configuration is decided if it does not contain any '?' values. In other words, a decision is made about inclusion/exclusion of all features. Otherwise, the configuration is partial.

Sets of products can be described using application conditions. An application condition ϕ is a propositional logic formula over a set of features F, defined by The Coffee Machine Example: Feature Model. The corresponding feature model of the coffee machine is depicted in Figure 1. Coffee and tea features have an or relationship implying that the machine serves one of these drinks at least. Adding extra milk and extra sugar is optional. However, when adding extra milk feature is available, the machine should be able to serve coffee because of the requires constraint between the milk and coffee features. Finally, the coin and card features have an xor relationship meaning that each product supports one and only one of them. A configuration that includes milk and excludes coffee is not a valid configuration. An example of a valid configuration is one that includes coffee, payment, and coin features and excludes the rest.

ϕ ::= true | f | ϕ 1 ∧ ϕ 2 | ¬ϕ where f ∈ F .

Modeling Product Families in Rebeca

In this section, we describe two approaches to model product families in Rebeca: delta-oriented approach and annotative approach.

reactiveclass Controller() { knownrebecs { CoffeeMaker cm; } statevars { int cash, change, cost; } msgsrv initial() { cash, change = 0; cost = 1; self.receivePayment(); } msgsrv nextOrder() { cm.makeCoffee(cash); } msgsrv receivePayment() { cash = ?(1,2,3); self.nextOrder(); } msgsrv returnChange(int c) { change = cash -c; cash = 0; self.receivePayment(); } } reactiveclass CoffeeMaker() { knownrebecs { Controller ctrl; } statevars { boolean addingCoffee; int cost; } msgsrv initial() { addingCoffee = false; cost = 1; } msgsrv makeCoffee(int cash) { addingCoffee = true; self.complete(); } msgsrv complete() { ctrl.returnChange(cost); addingCoffee = false; cost = 1; } } Fig. 2. Rebeca model of a coffee machine

Rebeca

Rebeca is an actor-based language for modeling concurrent and distributed systems as a set of reactive objects which communicate via asynchronous message passing. A Rebeca model consists of a set of reactive classes. Each reactive class contains a set of state variables and a set of message servers. Message servers execute atomically, and process the receiving messages. The initial message server is used for initialization of state variables. A Rebeca model has a main part, where a fixed number of objects are instantiated from the reactive classes and execute concurrently. We refer to these objects as rebecs. The rebecs have no shared variable. Each rebec has a single thread of execution that is triggered by reading messages from an unbounded message queue. When a message is taken from the queue, its corresponding message server is invoked.

The Coffee Machine Example: Rebeca Model. Figure 2 shows the Rebeca model of a product from the coffee machine family that only includes coffee, payment, and coin features. In this model, the controller manages the payment as well as incoming orders and sends message to coffee maker accordingly. In the first step, the payment is received which can be at most three coins. Then, the drink may be ordered (the only option is coffee in this product). The controller is informed of the completion of serving the requested drink as well as the final cost so it can return the change and prepare for another order. Note that the cost of a drink may increase by adding extra milk or sugar in those products that support the corresponding features.

Delta-oriented Modeling in Rebeca

In delta modeling, an SPL is represented by a core product and a set of deltas. The core product is a valid product and deltas represent the modifications that should be applied to the core product to derive other products. In [START_REF] Clarke | Abstract delta modeling[END_REF], the delta modeling technique is applied to object-oriented implementations of software product lines. Due to object-based nature of Rebeca language, we take a similar approach to [START_REF] Clarke | Abstract delta modeling[END_REF] to introduce delta modeling in Rebeca.

Core Product A core product is a Rebeca model that captures the behavior of a product for a valid and decided feature configuration. Therefore, it contains a set of reactive classes and the main part where rebecs are instantiated.

The Coffee Machine Example: Core Product. We consider the product depicted in Figure 2 as the core product. As we mentioned earlier, it includes coffee, payment, and coin features and excludes other features.

Deltas A delta represents the modification that must be applied to the core product to derive another product from the family. Deltas may add, remove, or modify reactive classes. Modifying a reactive class may add or remove known rebecs, state variables, and message servers. It may also change the behavior of an existing message server. Furthermore, an application condition is associated with each delta to specify the configurations for which the delta is applicable to the core product: In the above description of a delta, the when clause represents the application condition and the after clause is used to specify the order of applying deltas.

The Coffee Machine Example: Deltas. A number of deltas that can be defined to describe a family of coffee machines are: Delta δ 1 defines the products without the coffee feature. Delta δ 2 adds the facility to serve tea. Deltas δ 3 and δ 4 are applied when adding extra milk and sugar are supported.

Resolving Conflicts Conflicts among deltas may happen when they manipulate the same program entity in different ways. This leads to different implementations for one product when deltas are applied in different order. To achieve a unique product for a certain configuration, an order must be defined to apply deltas. A conflict-resolving delta δ ij should be introduced to avoid conflict between two unordered deltas δ i and δ j . The application condition of δ ij is the conjunction of the application conditions of δ i and δ j and δ ij is applied later than both conflicting deltas (δ ij has a higher priority than δ i and δ j ).

The Coffee Machine Example: Conflicts. Deltas δ 1 and δ 2 are unordered and they are both modifying the implementation of the nextOrder message server. Another conflict exists between δ 3 and δ 4 which both modify the makeCoffee message server. Assume that in I 3 we add milk to coffee and increase the cost of the drink. In I 4 sugar is added and the cost is increased. When both features are available, the ultimate behavior of makeCoffee is determined by the delta that is applied later. To handle these issues, two conflict resolving deltas should be defined as δ [START_REF] Clarke | Modeling spatial and temporal variability with the hats abstract behavioral modeling language[END_REF] In I 5 we add sugar and milk to coffee and determine the cost accordingly. Delta Model We define a delta model as a set of deltas along with their application conditions and priorities. A delta model is a triple (∆, Γ, ≺) where -∆ is a finite set of deltas, -Γ : ∆ → Φ F is function that associates an application condition with each delta, -≺⊆ ∆ × ∆ is a partial order on ∆. δ i ≺ δ j states that δ i should be applied before (not necessarily directly before) δ j , when both deltas are applicable.

In the above definition, Φ F is the set of all possible application conditions over feature set F. In our approach, we assume that we have an unambiguous delta model where all the conflicts among unordered deltas are resolved by defining appropriate conflict resolving deltas.

Annotated Rebeca Models

Syntax A fine-grained approach to represent variability in Rebeca model is to annotate the model with application conditions. We denote an annotation by @ϕ where ϕ represents an application condition. In a Rebeca model, we may annotate reactive classes, known rebecs, state variables, message servers, and statements (collectively referred to as model entities). Annotating an entity with an application condition specifies the set of products that include the entity. However, annotations on statements are enough to model SPLs. We can express annotations on other types of entities just by using annotations on statements, as shown below.

-A reactive class R annotated by @ϕ is modeled by associating @ϕ to every statement sending a message to a rebec r where r is an instance of R. -A known rebec r annotated by @ϕ is modeled by associating @ϕ to every statement that sends message to r. -A state variable v annotated by @ϕ is modeled by associating @ϕ to every statement that assigns to v or uses the value of v. -A message server m annotated by @ϕ is modeled by associating @ϕ to every statement that sends the message m.

Hence, in the rest of this paper, we assume that only statements of message servers are annotated with application conditions when presenting the semantics of annotated Rebeca models.

The Coffee Machine Example: Annotations. We can annotate the Coffee maker reactive class as @coffee reactiveclass CoffeeMaker, to indicate that the reactive class is only available in the products supporting the coffee feature. An alternative way is to annotate the statement cm.makeCoffee(cash) with application condition @coffee. As a result, no message is sent to the coffee maker, thus it would be excluded from the model implicitly.

Semantics The semantics of annotated Rebeca models can be described using a featured transition system (FTS). In [START_REF] Jaghoori | Symmetry and partial order reduction techniques in model checking Rebeca[END_REF], Rebeca semantics is described in form of labeled transition systems (LTS). In this work, we extend such LTS to an FTS to capture the notion of variability within an annotated Rebeca model. An FTS [START_REF] Classen | Model checking lots of systems: efficient verification of temporal properties in software product lines[END_REF] is a transition system where the transitions are annotated using application conditions. Assuming that Φ F is the set of all possible application conditions over feature set F, we define the semantics of an annotated Rebeca model as a featured transition system (S, I, A, T, γ) where -S is a set of global states -I is the initial state -A is a set of actions (message servers) -T ⊆ S × A × S is a set of transitions -γ : T → Φ F associates an application condition to each transition Each rebec has a local state composed of the values of its variables and the state of its queue: ς = V, q . A Rebeca model consists of a number of rebecs executing concurrently. Thus, the global state is defined as the combination of the local states of all rebecs: s = ς i . In the initial state, all of the queues only contain the initial message and all of the state variables have their default values. Message servers in Rebeca are executed in one atomic step, therefore an action corresponds to the execution of a message server. Variability in the behavior of a model is realized through annotating the statements of message servers. The concept of variability is reflected in the semantics of Rebeca as follows.

We define message server m as a sequence of statements st 1 ; ...; st n where ϕ i is the application condition of st i . To describe the semantics of variability in message servers easier, we consider that a sub-transition labeled by a sub-action from a sub-state to another, represents the execution of a single statement. In state s, execution of statement st i has two possible outcomes. If ϕ i does not hold, st i is skipped without changing the local state of any rebecs. Otherwise when ϕ i holds, execution of st i may affect the local state of the currently executing rebec by changing the value of its state variables or putting a message in its queue (when the rebec sends a message to itself). Moreover, it may change the local state of other rebecs by putting messages in their queue. A possible path that denotes execution of m is:

s st 1 ,ϕ 1 ----→ α 1 st 2 ,¬ϕ 2 -----→ α 2 st 3 ,ϕ 3 ----→ ... st n ,ϕ n ----→ s .
Note that from each sub-state α i-1 , two sub-transitions with application conditions ϕ i and ¬ϕ i are possible: ----→ s to denote removing message m from the queue of a rebec and executing it. Consequently, execution of message server m with n annotated statements leads to 2 n potential transitions from the current state s. The application condition of t is the conjunction of the application conditions of sub-transitions that constitute the path that t represents. For example, four possible transitions that represent execution of m : st 1 , st 2 are: ------→ s , ands m,ϕ 1 ∧ϕ 2 ------→ s .

α i sti,ϕi ----→ α i+1 and α i sti,¬ϕi -----→ α i+1 .
s m,¬ϕ 1 ∧¬ϕ 2 --------→ s , s m,¬ϕ 1 ∧ϕ 2 -------→ s , s m,ϕ 1 ∧¬ϕ 2 -

Product Generation

Given a decided configuration c, a product can be derived from the model of the product family automatically. For this purpose, every application condition ϕ is evaluated by substituting all of its variables (each corresponds to a feature) by true/false based on c. By c ϕ we denote that configuration c makes application condition ϕ true, otherwise c ϕ.

Delta Model Having a core Rebeca model M 0 along with a delta model D = (∆, Γ, ≺), a product with configuration c is obtained by applying every delta δ ∈ ∆ such that c Γ (δ) to M 0 considering the application order of deltas specified by ≺. The result is a plain Rebeca model for configuration c.

We define ∆| c ⊆ ∆ to contain all deltas that are applicable in c:

∆| c = {δ i | δ i ∈ ∆ ∧ c δ i }.
Moreover, we assume that if i < j, either δ i ≺ δ j or δ i and δ j are unordered. Accordingly, we denote the model of the derived product corresponding to configuration c by

M ∆| c = δ c k (...(δ c1 (M 0 ))...) where ∆| c = {δ c 1 , ..., δ c k }.
Annotated Model The projection of an annotated Rebeca model R over a decided configuration c, denoted by R| c , is a plain Rebeca model where the application conditions of every annotated reactive class, known rebec, state variable, message server, and statement are evaluated and those entities that their application condition does not hold for c are removed.

Note that the result of product generation (for delta-oriented or annotated models) may be a model that is not syntactically correct. For example, a rebec may send a message to another rebec that does not exists in the current configuration because it is removed by a delta (in case of delta modeling) or it is annotated with an application condition that does not hold (in case of annotative modeling). These inconsistencies can be detected by analyzing the model of product family statically. In this paper, we assume that every product that is derivable from the model of the product family is syntactically correct.

Model Checking Delta-oriented Rebeca Models

A naive approach to model check SPLs is to generate the Rebeca model of every possible valid product (as we described in 4.4), then model check each product individually. This way, we lose the benefit of having commonalities among the products in the family. In this section, we propose an approach to transform a delta model to an annotated Rebeca model. Given the underlying FTS of an annotated Rebeca model, we can take benefit from variability-aware model checking technique proposed in [START_REF] Classen | Model checking software product lines with SNIP[END_REF] to model check delta-oriented actor systems. We can also use the late feature binding approach, proposed in [START_REF] Sabouri | Scheduling and analysis of real-time software families[END_REF] to handle variability in the model itself and use the existing model checker of Rebeca.

Transforming Deltas to Annotations

To transform delta model D = (∆, Γ, ≺) to the corresponding annotated model, we modify the core model M 0 (which is a plain Rebeca model), according to the deltas defined in D. We assume that deltas with smaller identifiers has lower priority than deltas with greater identifiers. We start by changing the core model M 0 based on the modifications specified by delta δ 1 which results in the model M 1 . Likewise, the model M i is obtained by applying δ i to M i-1 . Due to our earlier assumption on unambiguity and correctness of delta models, the transformation results in a unique annotated model. Moreover, it is not required to deal with cases such as removing an entity that does not exits.

We define a model to be the set of all entities that exist in it. An entity is a reactive class, message server, state variable, known rebec, or statement. Each entity e is represented by a pair e = (n, d) where n is the name of the entity and d guished by their annotations. Having an unambiguous delta model, only one of these definitions is applicable for a specific configuration. The effect of delta δ i+1 on model M i is captured in the annotated model as follows.

Adding an Entity Suppose δ i+1 adds entity e = (n, d) to the model. Note that M i may include one or more entities with the same name. This happens when for some j < i, δ j-1 adds an entity which is then removed by δ j and added again in δ j+1 . In this case, we compare definition d with every definition for n in M i . To handle adding an entity = (n, d) we consider the following cases:

-When e does not exist in M i (there is no entity in M i with name n), we add e to M i and annotate it with its corresponding application condition: We consider the definition of two message servers the same if they have the same parameters and the same sequence of statements. Two state variables/known rebecs with the same name are equal if they have the same type. Definitions of two reactive classes are equal if they have the same set of state variables, known rebecs, and message servers with identical definitions.

A i (e) = Γ (δ i+1 ). -If d is different
Removing an Existing Entity To handle removing an entity (n, d), we modify the annotation of all entities in M i with the name n. For each e k = (n, d k ) ∈ M i , we conjunct its annotation with ¬Γ (δ i+1 ):

A i (e k ) = A i-1 (e k ) ∧ ¬Γ (δ i+1 ).
Note that by the above conjunction, we preserve the higher priority of δ i+1 over previously applied deltas as when Γ (δ i+1 ) holds, it makes the entire formula false. On the other hand, if we apply another delta δ j later (j > i) to add an entity with the same name and definition again, the new annotation will be (A i-1 (e k ) ∧ ¬Γ (δ i+1 )) ∨ Γ (δ j ). Consequently, the entity would be included in the model if a delta with higher priority adds the entity again.

Modifying the Implementation of a Message Server We assume that I 0 is the initial implementation of message server m. We consider δ mi to be the i th delta that changes the implementation of m. By applying δ m k+1 , the implementation of m changes from I k to I k+1 . If δ m k+1 specifies I δ k+1 as the new implementation of m, then I k is obtained by the sequential composition of I k and I δ k+1 annotated by ¬Γ (δ m k+1 ) and Γ (δ m k+1 ) respectively. This way, I δ k+1 is executed only when Γ (δ m k+1 ) holds. Consequently, that the body of message server m is defined recursively as:

I k+1 = { @¬Γ (δ m k+1 )I k ; @Γ (δ m k+1 )I δ k+1 }
The Coffee Machine Example: Transformation. Figure 3 shows the annotated Rebeca model after applying the deltas δ 2 , δ 3 , δ 4 , δ 1 , δ 12 , and δ 34 . We omit the details of each implementation I i .

Justification

In this section, we explain how our proposed approach may be justified intuitively. Proving the correctness of the approach formally is in our future agenda. Note that the following arguments only holds for decided configurations.

A model of a product family consists of a core Rebeca model M 0 along with its corresponding delta model D. By applying the applicable deltas to M 0 with respect to their predefined order, M ∆| c is obtained which is the model of the individual product with configuration c. The semantics of the resulting Rebeca model can be described using an LTS which we denote it by M ∆|c . We may transform the delta-oriented model of the product family to its corresponding annotative model M a . The semantics of M a , denoted by M a , is defined using an FTS. Moreover, we may project M a over a configuration c to obtain the Rebeca model of an individual product which M a | c represents its semantics.

The correctness of the proposed transformation can be established by proving that the underlying transition systems of M ∆|c and M a | c are bisimilar: M ∆|c ≈ M a | c . According to the transformation rules, both transition systems have the same set of message servers with same the behaviors as their action set. Therefore, starting from the initial states, both transition systems have the same set of enabled actions where taking each action implies the same behavior in both transition systems.

The variability-aware model checking is applicable on the FTS M a . We can justify that such FTS includes the behavior of all products of the delta model by defining a refinement relation between two FTSs and proving that for every configuration c, M ∆| c M a . Given two featured transition systems T A and T B , we say T A refines T B , denoted T A T B , if and only if there is a relation R between the states of their underlying transition systems such that R(s A 0 , s B 0 ). Moreover, If R(s A , s B ) and there exist transition t : s A a -→ s A then there exists transition t : s B a -→ s B such that R(s A , s B ) and γ(t) ⇒ γ(t ). According to the proposed transformation rules and the presented semantics for annotated Rebeca models, M ∆|c M a can be justified intuitively for every configuration c. Note that every transition system (such as M ∆|c ) is trivially an FTS with γ(t) = true for every transition t.

Model Checking

We can use the model checking algorithm tailored for product families in [START_REF] Classen | Model checking software product lines with SNIP[END_REF] or use the late feature binding approach proposed in [START_REF] Sabouri | Scheduling and analysis of real-time software families[END_REF] to model check the resulting annotated model.

Variability Aware Model Checking In this approach, we use the underlying FTS of a Rebeca model to apply the variability-aware model checking technique developed to verify product families. This way, the model checker returns all the products that satisfy the given property along with counter-examples for those products that violate the property. To take benefit from such technique, we should alter the current compiler of Rebeca and adapt its model checker accordingly. This is one of our future work.

Traditional Model Checking To use the existing compiler and model checker of Rebeca, we transform the annotated model to a plain Rebeca model which handles variability within the model itself. Annotation @ϕ for a statement s can be modeled using conditional statement if(ϕ) s; itself. To decide on including or excluding feature f , we use the late feature binding approach proposed in [START_REF] Sabouri | Scheduling and analysis of real-time software families[END_REF] where such decision is made just before using a feature to optimize the number of generated states. For this purpose, we model each feature f using an integer variable v f where its value represent if it is included (v f = 1), excluded (v f = 0), or it is not included nor excluded (v f = -1) yet. We decide on the value of a feature variable by adding if(v f == -1) v f = ?(0,1), just before its usage in the application condition of a statement. Such statement non-deterministically includes or excludes f when no decision is made for it yet. After transforming the annotated Rebeca model to a plain model, we model check it using existing model checker.

Result We have applied our approach on an extended version of the coffee machine example presented in this paper. We verified the annotated model against deadlock by replacing annotations with conditional statements, then ing the existing model checker of Rebeca. Deriving every product from the delta model and model checking it separately leads to 20, 596 total states for all products. However, by transforming the delta model to an annotated model and applying the late binding technique, 1, 360 states are generated for the entire family.

Conclusion

In this paper, we presented an approach to model product families in a highlevel and modular manner, using delta-oriented modeling. To model check such a model, we transform it to a corresponding annotated model with its semantics defined by featured transition systems. Such transition systems can be verified using a variability-aware model checking technique to obtain the products that satisfy the given property. We may also apply the late feature binding technique to verify the entire family using existing model checking techniques. The result of applying our proposed approach on a coffee machine case study shows that it is more efficient to transform a delta model to an annotated one, then model check the entire family, rather than deriving each product from the delta model and verify them individually.

Fig. 1 .

 1 Fig. 1. The feature model of the coffee machine example

  Due to atomic execution of message servers, we can compactly represent each execution path of m as a transition t : s m,γ(t)

  from all existing definitions in M i (for the entities with name n), a new entity is added to M i along with its annotation A i (e) = Γ (δ i+1 ).-Otherwise, if there exists an entity e = (n, d ) where d and d are the same, we update the annotation of e as: A i (e ) = A i-1 (e ) ∨ Γ (δ i+1 ).

  and δ 34 :

	delta δ 34 after δ 3 , δ 4	delta δ 12 after δ 1 , δ 2
	when milk ∧ sugar {	when ¬coffee ∧ tea {
	modifies CoffeeMaker {	modifies Controller {
	modifies makeCoffee {I 5 }	modifies nextOrder {I 6 }
	}	}
	}	}

This research was in part supported by a grant form IPM. (No.CS1390-4-02).

reactiveclass Controller() { knownrebecs { CoffeeMaker cm; @tea TeaMaker tm; } statevars { int req, cash, change, cost; } msgsrv initial() { cash, change = 0; cost = 1; self.receivePayment();

ctrl.returnChange(cost); addingCoffee = false; cost = 1; } } @tea reactiveclass TeaMaker() { ... } Fig. 3. The annotated Rebeca model of the coffee machine family is its definition. For simplicity, we do not discuss the formal definition of d in this paper. Informally, known rebecs and state variables are defined by their types. A message server is defined by its parameters and its sequence of statements. Finally, a reactive class is defined by its set of state variables, known rebecs, and message servers. We assume unique names for every known rebec, state variable, and message servers. Unique names for these entities can be obtained by adding the name of their corresponding reactive class as a prefix to their names.

Having F as the feature set, we assume that function A i : M i → Φ F returns the application condition by which each entity is annotated in M i . Function A 0 returns true for all entities in M 0 . By applying δ i+1 on M i , we may add new entities to M i or change the annotations of existing ones. We do not eliminate any entity from M i as removing or modifying an entity is handled by updating its corresponding annotation. Thus, all the definitions of an entity specified by different deltas, coexist in the annotated model. These definitions are distin-