Audrey Michard
email: audrey.michard@supelec.fr

Pietro Maris Ferreira

Jean-François Carpentier
email: jean-francois.carpentier@st.com

0.18-µm CMOS Driver Optimization for Maximum Data Rate under Power and Area Constraints

Keywords: Mach-Zehnder driver, logical effort, power-speedarea trade-off I

This paper presents a Mach-Zehnder-based transmitter in 0.18 µm CMOS. An asymmetric driver is proposed to achieve a large output swing on the optical modulator. The logical effort method was applied on each driver block in order to optimize the propagation delay. The driver characteristics are analyzed based on slew-rate limitation. The speed-power-area trade-off is highlighted and enables to adjust the driver design according to specified constraints. Driver performance obtained with early-design-stage equations is compared to post-layout simulations. Good agreement is demonstrated which validates the proposed sizing methodology.

INTRODUCTION

Silicon photonics is considered as a prime technology for communication and high-speed computing applications. Indeed photonic devices offer promising solutions for next-generation high-speed and high-density interconnects. Mach-Zehnderbased transmitters have been proposed to implement costeffective and energy-efficient optical links in order to meet power and bandwidth datacoms standards [START_REF] Marris-Morini | Recent progress in high-speed silicon-based optical modulators[END_REF][START_REF] Gill | Monolithic travelling-wave Mach-Zehnder transmitter with high-swing stacked CMOS driver[END_REF]. This work reports on the optimization of a silicon photonics transmitter based on a Mach-Zehnder interferometer and an asymmetric driver. We focuses particularly on the driver design which is demonstrated in a low-cost 0.18 µm CMOS process. The driver has to address the maximum data rate while ensuring low-power and area constraints.

Driver circuitry is often designed in the literature [START_REF] Gill | Monolithic travelling-wave Mach-Zehnder transmitter with high-swing stacked CMOS driver[END_REF], [START_REF] Rakowski | A 4×20Gb/s WDM ring-based hybrid CMOS silicon photonics transceiver[END_REF], [START_REF] Buckwalter | A monolithic 25-Gb/s transceiver with photonic ring modulators and Ge detectors in a 130-nm CMOS SOI process[END_REF], however transistors' sizing is rarely revealed. Our approach is based on the logical effort method. To the authors' knowledge, such an approach is reported in a paper for the driver design for the first time. The logical effort method enables designers to optimize digital circuits for speed [START_REF] Sutherland | Logical effort designing for speed on the back of an enveloppe[END_REF]. It shows how to reduce the overall delay and how to find the ideal number of gates in a logic chain. As a result, the fastest implementation of any given logic function is pointed out. This paper demonstrates that early-design-stage equations are quite accurate to derive driver performance. Equations show good agreement with post-layout simulation results. The paper is organized as follows. Section II reviews the Mach-Zehnder modulator operation. In section III, the driver architecture is described. The driver sizing is introduced by the means of the logical effort methodology. Following subsections discuss the trade-off between speed, power, and area which permits to design the driver to the targeted application. Section IV presents electrical and post-layout simulation results and summarizes driver performance along with comparison to analytic equations. Finally, Section V concludes the paper.

II. PHOTONICS APPLICATION

The architecture of a simplified Mach-Zehnder-based modulator is depicted in Fig. 1. It consists of an input waveguide, a splitter, two Mach-Zehnder arms and an output combiner. The splitter and the combiner are implemented with optical directional couplers and a phase shifter is integrated in one of the two arms. Another phase shifter is usually introduced in the second arm to obtain same optical losses, keeping a zero phase shift [START_REF] Marris-Morini | Recent progress in high-speed silicon-based optical modulators[END_REF]. The Mach-Zehnder interferometer enables to convert a phase modulation into an intensity modulation by recombining two light beams with different phases.

The variation of free carrier concentration is used to induce a modulation in the silicon. This variation creates a change in the optical index of the material which results in a phase shift of the light wave. In order to realize such a phase shifter, a PN diode is inserted into the arm of a Mach-Zehnder interferometer. When reversed biased, the diode enters in carrier depletion mode. This expands the space charge region and thus changes the carrier concentration. The bias is applied to the diode via the Driver Cathode of Fig. 1.

One can show that it is interesting to bias the PN junction not only in reverse but also in forward. Forward bias is made with the Driver Anode illustrated in Fig. 1. This solution benefits from a larger voltage swing on the modulator. However the forward bias must remain below the built-in potential to ensure that the diode does not enter in the carrier injection mode. The built-in potential is around 0.5 V depending on the junction doping.

From a device point of view, the lateral PN junction is defined in the center of a rib waveguide. A silicon layer of 300 nm thickness is formed with P and N implants as shown in the schematic cross section of Fig. 2 (a). AC simulations are performed in order to extract the capacitance of the device. C-V curve is illustrated in Fig. 2 (b) and exhibits a 300 fF capacitance for a 1mm long PN diode.

To connect the drivers to the diode, different integration technics can be considered. The literature reports mainly two methods: either the monolithic [START_REF] Gill | Monolithic travelling-wave Mach-Zehnder transmitter with high-swing stacked CMOS driver[END_REF][START_REF] Buckwalter | A monolithic 25-Gb/s transceiver with photonic ring modulators and Ge detectors in a 130-nm CMOS SOI process[END_REF] or the hybrid integration [START_REF] Rakowski | A 4×20Gb/s WDM ring-based hybrid CMOS silicon photonics transceiver[END_REF]. When monolithically integrated, photonic and electronic components are fabricated into the same CMOS node. On the contrary, hybrid integration benefits from separate optimization of Mach-Zehnder modulator and drivers. Electro-optic transmitter design requires to focus on this issue, however following sections will take an interest only on driver circuitry.

III. DRIVER OPTIMIZATION

This work aims to develop a driver for a Mach-Zehnderbased modulator in a 0.18 µm CMOS node. The driver design is optimized for the minimum propagation delay. The driver characteristics are then analyzed to verify if they satisfy data rate, power and area constraints.

A. Driver circuits

The driver architecture is inspired from the asymmetric driver used in [START_REF] Rakowski | A 4×20Gb/s WDM ring-based hybrid CMOS silicon photonics transceiver[END_REF]. It is composed of two distinct blocks, the Driver Anode and the Driver Cathode that drive respectively the anode and the cathode of the modulator's PN junction. The maximum voltage swing from 0 to V DD is allowed on the cathode whereas the forward bias on the anode has to be limited below the built-in potential.

The Driver Cathode enables to shape input signals and to drive high capacitive load. Its topology uses a chain of four inverters, namely (M p1 ; M n1 ) to (M p4 ; M n4 ). Following subsection highlights the transistors' sizing in order to optimize the propagation delay.

The Driver Anode's purpose is similar to those of Driver Cathode. Its topology is also based on an inverter chain but an additional circuit enables to reduce the high voltage level under the built-in potential. Fig. 3 shows the driver circuit. The main inverter chain is composed by the transistors M n1 , M p1 , M n2 , M p2 , M n3 , and M p3 . In order to be able to control precisely the voltage applied on the PN junction, the controller circuit formed by the two inverters M n4 , M p4 and M n5 , M p5 and by the PMOS transistor M p6 is introduced. This circuit enables to activate or deactivate the transistor M n6 working as a switch. M n6 is switched on when M p3 is activated, then the controller circuit switches M n6 off in order to limit the high level to a value close to the built-in potential.

B. Transistors sizing: the logical effort method

The logical effort method was introduced in [START_REF] Sutherland | Logical effort designing for speed on the back of an enveloppe[END_REF] in order to help designers to optimize any logic circuits for speed. When adapted to an inverter chain, the method leads to a sizing methodology to find both the ideal number of stages and all gates' sizes. In this section a sizing approach is proposed in order to minimize the drivers' propagation delays. The starting assumption is based on the knowledge of the output load that the driver must drive. Besides, all transistors gate lengths are imposed to be equal to the minimum .

When considering a multi-stage logic network, the first step consists in computing the product = called the path effort. is the path electrical effort and captures the effect of each gate's topology on its capability to produce output current. In the case of inverters, is one. is the path branching effort and enables to take into account the fan-out of the gates' chain.

is also one for proposed drivers. is the path electrical effort and describes how the electrical environment of the circuit affects its performance. is equal to where is the load of the last stage, i.e. the modulator capacitance. is the input capacitance of the first stage which can be calculated from the gate oxide area capacitance . As a consequence, the path effort is:

= = , , (1)
Then the optimal number of inverters stages can be estimated by the following expression:

= ( ) ( ) , (2)
where the optimum stage effort is defined as the solution of the equation (1 ln( )) + = 0 and is the parasitic delay of an inverter. has a fixed value independent of the gate's size and of its output load. The best number of stages is then the next integer above .

The logical effort method shows that the propagation delay is minimized when each stage in the path bears the same stage effort which results in:

Controller circuit Switch (a) (b) = (3)
In the case of an inverter chain, the stage effort is the ratio between inverters sizes. As a result, the transistors' sizing is easily made such as:

, = ,( ) ∀ = 1 … , = , (4)
The factor is introduced in order to achieve equal rising and falling times. Finally the propagation delay between the first and the last stage is derived according to:

= ( + ) , (5)
where is the delay of an ideal inverter that drives the same inverter.

Based on the logical effort method, sizing is carried out on both Driver Anode and Driver Cathode with a modulator load of 300 fF. The other parameters for the considered CMOS node are = 2.33, = 8 , = 0.18 μ and = 8.8 /μ ². The method shows that the optimal number of stages is 2.3. Therefore we choose = 3 for the Driver Anode and = 4 for the Driver Cathode since the two driver blocks must have a complementary logic function. Transistors' widths are given in Table I. They are calculated using ( 4) and a factor equal to 2.5.

Regarding the Driver Anode, it remains to size the inverters M n4 , M p4 and M n5 , M p5 and the two transistors M n6 and M p6 . For the inverters, we can also use the logical effort method. Their load capacitance corresponds to the M n6 input load which is quite small, so these inverters are relatively small. Transistor M n6 width is directly linked to the high level value of the output voltage while the transistor M p6 enables to smooth the output signal. Their sizing have been made in order to adjust the output signal to the specifications.

C. Area and power consumption compromises versus driver speed

After having sized both drivers, this section describes how to estimate the maximal data rate achievable by each driver and its power consumption. Indeed, the driver optimization leads to trade-off between speed, energy efficiency and area. These characteristics are analyzed below.

We assume that the data rate is limited by the inverters rising and falling times, based on slew-rate calculations of [START_REF] Buckwalter | A monolithic 25-Gb/s transceiver with photonic ring modulators and Ge detectors in a 130-nm CMOS SOI process[END_REF]. We .

Besides by using the slew rate formula, the falling time is connected to the load capacitance according to:

= + (6)
where is the parasitic capacitance of the last stage of the inverter chain (either Driver Anode or Driver Cathode). takes into consideration the total gate-drain capacitance and the total drain-body capacitance of both NMOS and PMOS transistors. For more convenience, this last expression is rewritten by introducing whose value is 0.9 fF/µm for 0.18µm technological node:

= , (1 + ) (7)
Finally the data rate limitation comes to the following expression where , is the current density of the NMOS transistor:

= 0.5 , , , ( ) (8)
The average power consumption can be estimated by considering the sum of the modulator capacitance and of the driver parasitic capacitance:

= + ∑ , + , (9)
Eq. ( 8) reflects the balance between the data rate and an estimation of the area represented by the NMOS width , of the last driver stage. In Fig. 4, the last NMOS width is plotted versus the data rate for , = 0.38 μ ⁄ , = 1.8 , and = 300 . In addition, Eq. (9) explains the power versus data rate trade-off but (9) depends on the number of stages and on all transistors sizes. That is why an upper and a lower limit of the power consumption is showed in Fig. 4. These limits depend only on the last stage's size and are calculated as:

= + , (1 + ) (10)
As a result, the two equations ( 8) and (9) enable us to illustrate the "speed-power-area" compromise for the driver. Thus these equations can be used to adapt the driver to a specific application constrained to data rate, power and area.

IV. SIMULATION RESULTS

In this section, post-layout simulations are carried out. To this end, driver layouts were done considering RF layout recommendations described in [START_REF] Cathelin | INVITED) Deep-submicron digital CMOS potentialities for millimeter-wave applications[END_REF]. Driver Anode area is 18.8 µm × 39.6 µm. Driver Cathode area is 19.2 µm × 39.9 µm. Due to paper space constraints, layout illustrations are not presented here.

A comparison between analytic results and simulation results (electrical and post-layout) is performed. Fig. 5 presents the transient responses of both driver stages. The input signal is in each case a periodic signal from 0 to V DD . The resulting data rate (5Gb/s in Fig. 5(a) and 7Gb/s in Fig. 5(b)) is the maximum for a correct bit transmission. The post-layout output signal is overall not deteriorated in comparison to electrical simulations, validating thus the drivers' layout. The main consequence of parasitic elements consists in increasing the propagation delays. However the Driver Anode high level value is also increased which can be problematic if it overpasses the built-in potential of the PN junction. This increase has to be taken into account in further designs.

Finally Tables II and III show an overview of Driver Anode and Driver Cathode performance. A really good accordance can be noticed between analytic results obtained with equations ( 5), (8), and (9) and simulations results. Note that for the Driver Anode, analytic results are obtained for a three inverters chain without the controller circuit and the switch transistor while simulations results take into consideration the complete driver. This can explain discrepancy observed in particular for power consumption.

V. CONCLUSIONS

In this paper, the optimization of a silicon photonic transmitter is demonstrated based on a Mach-Zehnder interferometer and an asymmetric driver implemented in a CMOS 0.18 µm technology. The logical effort method is employed to size both Driver Anode and Driver Cathode. The trade-off between data rate, power consumption and circuit area is explored via slew-rate limitation, in order to be able to adapt the driver design to specifications. Good agreement is shown between early-design-stage equations and post-layout simulation results. Therefore, such optimization technics can continue to be used to boost data rates with shrunk CMOS nodes and improved electro-optic modulators.

Fig. 1 .

 1 Fig. 1. Mach-Zehnder modulator architecture.

Fig. 2 .

 2 Fig. 2. (a) PN diode cross section; (b) Junction capacitance versus reverse bias.

Fig. 3 .

 3 Fig. 3. Driver Anode: transistor-level schematics.

  falling time (equal to the rising time) is about half the duration of a bit period. Hence we have = .

Fig. 4 .

 4 Fig. 4. "Speed-power-area" trade-off: last NMOS width (solid line) and power consumption (dotted and dashed lines) versus data rate

Fig. 5 .

 5 Fig. 5. Transient responses: (a) Driver Anode at 5 Gb/S; (b) Driver Cathode at 7 Gb/s

TABLE I .

 I DRIVER ANODE AND DRIVER CATHODE SIZING

TABLE II

 II . Analytic results are obtained for a chain of 3 inverters without Mn4, Mp4, Mn5, Mp5, Mn6, and Mp6.

	.	DRIVER ANODE: PERFORMANCES COMPARISON
	ANODE STAGE		Analytic results a		Electrical results	Post-layout results
	Data rate (Gb/s)		5.2		6		5
	Rising / falling times (ps)	96		t = 63 t = 50		t = 76 t = 46
	Propagation delays (ps)	133	τ τ	= 107 = 128	τ τ	= 132 = 158
	Power consumption (mW)	6.4		4.5		4.3
	Energy efficiency (pJ/bit)	1.2		0.75		0.86

a

TABLE III

 III

	.	DRIVER CATHODE: PERFORMANCES COMPARISON
	CATHODE STAGE	Analytic results		Electrical results	Post-layout results
	Data rate (Gb/s)		6.7		7		7
	Rising / falling times (ps)	74		t = 64 t = 56		t = 68 t = 62
	Propagation delays (ps)	151	τ τ	= 158 = 156	τ τ	= 182 = 180
	Power consumption (mW)	9.2		10		9.9
	Energy efficiency (pJ/bit)	1.4		1.5		1.4


Christophe Simon

Mohamed Sallak

Jean-François F Aubry

Sil

SIL allocation of SIS by aggregation of experts' opinions

teaching and research institutions in France or abroad, or from public or private research centers.

INTRODUCTION

The current society requirements impose that the industrial facilities present less possible risks during their use. The definition of the risk is found in various standards IEC61508 (IEC 1998), ISO 12100-1 (ISO 2003), ISO 14121 (ISO 1999). It is a combination of the occurrence probability of harm and its gravity. If we wish to reduce the risk, it is during the design step that we have to integrate the elements necessary to the reliability of the installations. Two approaches allow this risk reduction: prevention by minimizing the occurrence probability; protection by limiting the consequences of a malfunction. To reduce the occurrence probability of the risk, the Safety Instrumented Systems (SIS) are used to fulfil Safety Instrumented Functions (SIF) whose goal is the monitoring of parameters during operation and the implementation of actions to put the system in a safe state when some dangerous operating conditions were encountered. To design these SISs, two standards are used: ANSI/ISA S84. 01-199601- (ISA 1996) ) and the IEC 61508. These two standards are based on the evaluation of the necessary risk reduction to reach an acceptable level of risk. After a preliminary analysis of risks and a quantitative evaluation of the probability of occurrence of the identified risks, we need to evaluate the necessary risk reduction according to a required Safety Integrity Level (SIL). The IEC 61508 frames these steps and proposes the risk graph method or the risk matrix to allocate the level of SIL. This allocation is carried out by experts' opinions based on a combination of descriptive parameters of the risk. In this paper, we propose a process of subjective evaluation to collect imprecise and uncertain experts' opinions in the particular framework of possibility theory. Possibility distributions are thought to better reflect imprecision pervading expert judgment. They are weak substitutes to unreachable subjective probabilities [START_REF] Sandri | Elicitation, Assessment, and Pooling of Expert Judgements Using Possibility Theory[END_REF]. The main goal is to manage the imprecision and uncertainty in a SIL allocation process. Section 2 shows some basic elements of SIL allocation process. We discuss about qualitative methods and relations between the different approaches of risk evaluation and the natural subjectivity in expert judgements. In section 3, we show how to collect imprecise and uncertain experts' opinions in the framework of possibility theory with fuzzy numbers and how to adapt the questionnaire accordingly. Some examples are provided to show the behaviour of the adopted principle of aggregation. Section 4 details the fuzzy risk graph obtained by a fuzzy inference system. Section 5 is devoted to an application found in IEC61508.

SIL ALLOCATION SCHEME

In this section, we describe the general scheme to achieve the allocation of safety of a system in order to warrant the conformity to the safety standards ANSI/ISA S84. 01-199601- (ISA 1996) ) and IEC 61508 (IEC 1998). Then, we present various qualitative and quantitative methods used for the allocation of SIL. We discuss about the relation between these various methods. The imprecision and uncertainty in experts' opinion is pointed out.

Safety Instrumented Systems (SIS)

A SIS is a system that aims to put a process in a safe state (i.e. a stable state that does not present a risk for the environment or people), when the process involves in a real risk situation (explosion, fire…). A SIS is composed of three parts: SIL allocation of SIS by aggregation of experts' opinions

C. Simon

-A sensor part dedicated to verify the drift of a parameter (pressure, temperature…) towards a dangerous state. -A logic unit dedicated to collect the signal coming from the sensor, its treatment and to compute the actuator input. -An actuator part to put the process in a safe state and to maintain it. The average probability of failure on demand of a SIS is determined by computation of the average probabilities of failure of its components. These probabilities depend on the repair and failure rates of the components, on the factors of common cause … 2.2 Conformity to standards ANSI/ISA S84. and IEC 61508 ANSI/ISA S84.01-1996 and IEC 61508 lay down the requirements related to the specification, the design, the installation, the exploitation and the maintenance of a SIS, in order to have higher confidence in its capacity to bring and/or to maintain the process in a safe state. The basic steps to warrant the conformity to these two safety standards are:

1 Establish a target of safety (acceptable risk) of the system and evaluate the existing risk. 2 Identify the require safety functions and assign them to the protection levels. 3 Determine if the safety instrumented function is required. 4 Implement the safety instrumented function in a SIS and determine the SIL of the SIS. 5 Check that the SIS reaches the required safety level. Table 1 gives safety integrity level of a SIS according to the value of its average probability of failure avg PFD and its solicitation frequency. Table 1: Definition of SIL according to the IEC 61508

Methods for SIL determination

The determination of the SIL of a SIS can be obtained by various methods: 1 Qualitative methods (ISA 1996[START_REF] Bhimavarapu | Performance based safety standards: an integrated risk assessment program[END_REF]: they determine the level of SIL starting from the knowledge of the risks associated to the system.

2 Semi-quantitative methods (ISA 1996[START_REF] Bhimavarapu | Performance based safety standards: an integrated risk assessment program[END_REF]: The most widespread method is the matrix of risk. This matrix gives the level of SIL according to the gravity of the risk and the frequency of occurrence. 3 Quantitative methods [START_REF] Stavrianidis | Safety Instrumented Functions and Safety Integrity Levels (SIL)[END_REF][START_REF] Bhimavarapu | Performance based safety standards: an integrated risk assessment program[END_REF], ISA 2002): They compute the availability of a SIS starting from the failure rate and the repair rate of their components. The most widespread methods are: -Simplified equations; -Fault Trees; -Markovian approaches.

Risk evaluation

In the majority of risk evaluation methods, we find two attributes: The probability of occurrence and the gravity. They can be evaluated either in a direct manner, i.e. they are the input attributes of the method, or in an indirect manner, i.e. according to other attributes. For example, the probability of occurrence is a function of the probability of occurrence of the dangerous event, of the frequency of exposure of people and the possibility of avoidance. Thus, the risk is defined by two attributes, which can be divided to improve the evaluation of the dangerous situations. It should be noted that certain situations could require a more complex description. When the evaluation of the descriptive criteria of risk is obtained, the level of risk is determined by methods like risk matrices, risk graphs (IEC 1998) (which can be viewed like a risk matrix), numerical functions (ISSA 1998) and hybrid methods combining several of the previously quoted ones. Nevertheless, if a risk matrix is suitable to represent a relation between two input attributes and one output attribute, it becomes difficult to introduce more inputs (Figure 1). The risk graph allows a better representation with a greater number of input attributes (Figure 2). At last, the numerical functions are useful when the number of attributes or values describing each risk parameter is important. For example, a method quoted in [START_REF] Pilz | Chapter 4: Risk assessment, Pilz guide to machinery safety[END_REF]) uses the following formula to obtain the risk level:

DPH FE LO NP R * * * = (1)
With:

-NP : Number of persons exposed, -LO : Likelihood of occurrence, -FR : Frequency of exposure to the hazard, -DPH : Degree of possible harm As previously mentioned, it is also possible to translate the risk graph (Figure 2) in a corresponding risk matrix (Figure 3). The main difference between the general risk graph (Figure 2) and the IEC61508 risk graph is the output variable that directly characterizes the SIL allocation level for the SIS (

{ } 4 , 3 , 2 , 1 ∈ SIL
). This level corresponds to the necessary risk reduction that the SIS embedding the SIF should reach. Level a indicates that a SIF is not necessary and level b represents the situation where a SIF is not sufficient to ensure the risk reduction.

The use of experts' opinions

As explained previously, the different risk evaluation methods are based on the same concepts of gravity and occurrence with a more or less fine description of the risk parameters. These descriptions can be qualitative or quantitative. When the feedback is not sufficient, the experts' job is to estimate the quantitative values. In the case of the graph where the description of the risk is rather accurate and according to the IEC61508, the expert must estimate the values of the 4 parameters to allocate the SIL level. Let us note that the use of the other methods is equivalent as we mentioned in the previous section. These four parameters give a significant granularity of the risk and represent the key factors of the risk evaluation. In practice, the estimate of the risk parameters by only one expert is not suitable. The possibility to use a great number of experts sounds unrealistic. In addition, the expert opinions about the risk parameters are necessarily imprecise and uncertain since they are subjective [START_REF] Sandri | Elicitation, Assessment, and Pooling of Expert Judgements Using Possibility Theory[END_REF], Hsu1996, Lee 2002). Then, it is relevant to capture these imperfections to use the most of information from the expert opinions to achieve the SIL level evaluation more certainly and to help searching a consensus between the experts. For this purpose, we propose to use the formal framework of possibility theory and fuzzy set theory that can be found in [START_REF] Dubois | The three semantics of fuzzy sets[END_REF][START_REF] Sandri | Elicitation, Assessment, and Pooling of Expert Judgements Using Possibility Theory[END_REF], Zadeh 1965[START_REF] Ayyub | Elicitation of expert opinions for uncertainty and risks[END_REF]). Thus, we adapt the usual steps of risk estimation and the SIL allocation process. Note that other frameworks with different basic axioms like subjective probability [START_REF] Bedford | Probabilistic Risk Analysis: Foundations and Methods[END_REF], Evidence theory (Smets 1992) can be used.

COLLECTING THE EXPERTS' OPINIONS

To use imprecise and uncertain experts' opinions, we should realise a relevant collecting process. If we consider the risk graph on Figure 4, each expert must evaluate the four parameters (C, F, P and W). When an ordinal scale is proposed, a loss of dynamics in the opinion is encountered because the expert intuitively connects his evaluation to the consequence. In addition, a single value does not represent a subjective evaluation. The expert often prefers the use of an interval [START_REF] Sandri | Elicitation, Assessment, and Pooling of Expert Judgements Using Possibility Theory[END_REF]. Moreover, a single value does not allow to obtain easily a natural consensus between experts' opinions. With single values for opinion, the consensus is generally obtained with an average or a weighted average, which is not a suitable solution. Intervals help finding a natural consensus between opinions. For these reasons, it is more relevant to change the scales. The goal is to al-low the experts to express their fuzzy perception of the parameters. Of course, the questionnaires must be well prepared to obtain imprecise and uncertain experts' opinions.

Rating scale

The usual practice in capturing opinions based on a strict taxonomy is the check box form (Figure 5). In this case, the expert as well as the designer of a questionnaire can encountered several difficulties. If a strict taxonomy is used, the expert can only express his uncertain and imprecise perception by checking two boxes at least. This situation is difficult to handle in the risk graph because it shifts the decision problem directly on the conclusion space (level of SIL). If the expert does not want to use this technique, he should think about the relation between the parameter and the potential decision. This is not a suitable evaluation process. Finally, the questionnaire designer should pay attention to the taxonomy used. It must give a sufficient dynamic and prevents the status quo. The element of the form on Figure 5 is a solution usually suggested (even number of checkboxes for instance 4). The works on subjective evaluation brings a solution to these problems [START_REF] Sandri | Elicitation, Assessment, and Pooling of Expert Judgements Using Possibility Theory[END_REF], Zadeh 1965). Rather than evaluating the risk parameters on a digital scale of values, which can involve a distortion particularly at the ends, a continuous axis, calibrated by nouns and bounded by antagonistic qualifiers can be used as shown in Figure 6.

Subjective evaluation of the risk parameters

In order to allow the experts to express their imprecise perception of the risk graph parameters, we propose the use of a rating scale of each parameter like the one shown on Figure 7. To collect suitable evaluations, we propose the use of trapezoidal fuzzy numbers extensively used in works around fuzzy decision-making based on experts' judgements [START_REF] Sandri | Elicitation, Assessment, and Pooling of Expert Judgements Using Possibility Theory[END_REF], Hsu 199-, Lee 2002). Each expert gives his imprecise judgement by a possibility distribution defining the degree with which each value of the parameter universe can be the true value. A possibility distribution can be considered as nested interval. For simplicity, the expert is invited to define two nested intervals. The broadest interval (the support, Figure 7) corresponds to the subset of the axis of evaluation beyond which the expert is certain that the actual value cannot be. The narrowest interval defines the kernel and corresponds to the subset of the evaluation axis on which the expert thinks that the actual value has the strongest possibility to be. Let us give an evaluation example for the consequence C. The linguistic variables used are given by (see Figure 4): -Minor: minor harm.

-Low: serious harm affecting one or more persons.

-Medium: Death of several people.

-High: Several killed people. The same analysis step is carried out on parameters F, P and W.

7: Fuzzy evaluation of the consequence

Calibration

Each expert evaluates situations according to his perception, experience, and knowledge. The evaluation context may deteriorate its judgment. Thus, it is necessary to calibrate each expert. The calibration process is usual. The goal is to test the expert with perfectly known situations in order to evaluate the relevance of his opinions. In our case, the calibration function must be continuous according to possibility distributions. This benchmark of the expert allows establishing a functional relationφ between the imprecise expert's opinions and the risk parameters of the known situations. We obtain calibration functions for each couple expert/parameter, which is used to modify the opinion of the expert in a real situation.

Aggregation of the opinions

For each expert i e , we have a set of opinions given as possibility distributions . Within the possibility framework, several aggregation operators are possible [START_REF] Sandri | Elicitation, Assessment, and Pooling of Expert Judgements Using Possibility Theory[END_REF]. The first is the conjunctive operator. It is used when all experts are considered as reliable. It corresponds to the intersection of the opinions. This operator is very sensitive to unmatched opinions. In a perfect world, situation should not be encountered. When we consider that in a group of experts an unknown one is unreliable, we use the disjunctive operator. It corresponds to the union of the evaluations. This operator can lead to non-informative results [START_REF] Hsu | Aggregation of fuzzy opinions under group decision-making[END_REF]. Some other operators exist, read [START_REF] Sandri | Elicitation, Assessment, and Pooling of Expert Judgements Using Possibility Theory[END_REF][START_REF] Voisin | Evaluation of a sensory measurement fuzzy system for car seat comfort[END_REF]) for more information.

In our example, we try to aggregate opinions by taking account of the experience feedback available from each expert with the four risk parameters. Thus, the aggregation of opinions is carried out for each parameter according to experts' knowledge. The expertise level of an expert modifies the possibility distribution, which represents its opinion π by the following relation:

( ) ij c e c e w j i j i - ′ = ′ ′ 1 , max , , π π (2) Thus, if the expert is certain 1 = ij w
about his evaluation then its opinion is not modified. When the expert is less certain

1 0 ≤ ≤ ij w
, a level of uncertainty modifies the evaluation. It corresponds to the possibility that the true value is any value of the reference frame. Finally, if the expert is completely uncertain 0 = ij w then we obtain a possibility distribution equal to 1. This distribution represents complete ignorance of the expert due to a lack of confidence. This expertise level is a priori defined by the expert himself in relation with the application area. However, it is possible to design other adjustment processes, in particular with a supervisor who defines a weight according to the expert credibility [START_REF] Hsu | Aggregation of fuzzy opinions under group decision-making[END_REF][START_REF] Lee | Optimal consensus of fuzzy opinions under group decision making environment[END_REF]. Finally, the resulting distributions of experts' opinions considered as reliable are aggregated according to the following conjunctive rule proposed by [START_REF] Sandri | Elicitation, Assessment, and Pooling of Expert Judgements Using Possibility Theory[END_REF]

( )

j i i j c e e c n mi , π π ′ ′ = (3)
In the case of disagreement between experts' opinions, (3) cannot be normalized, i.e. In this example, we considered that the two experts are certain about their opinion. They agree and it is translated by a common intersection between their possibility distributions for the parameter values. The resulting distribution is more precise and concentrates more information [START_REF] Sandri | Elicitation, Assessment, and Pooling of Expert Judgements Using Possibility Theory[END_REF]. 2 nd case: the opinion of the first expert has decreased.

In this example, the two experts do not agree completely. Thus, the kernel of their opinions is lower than the one in the 1 st case. In shaded gray line, we see the not normalized aggregation distribution, which shows the opinion conflict. The result in black line after normalization shows uncertainty due to the conflict between the opinions. The resulting kernel is large, the natural agreement between experts is high, and the uncertainty value ε is low.

3 rd case: Opinion of expert 1 decreases In this example, the disagreement between the experts' opinions is more important. The kernels of the distributions are largely dissociated. There is an important conflict between the experts, which reveals a significant uncertainty in the common opinion about the risk parameter. Now, let us consider the three previous examples. This time the experts do not have the same level of certainty about their evaluation. First expert is uncertain while the second is a trustful expert. 1 st case: expert 1 opinion is in dotted gray line. Black line is the possibility distribution of his opinion taking into account his expertise level (see eq. 2).

ij w

The resulting distribution shows that more information is used from the trustful expert. In both other cases, we obtain the following results:

As we can see, the opinion of the trustful expert is preferably used, but when experts completely disagree, the uncertainty grows. This evaluation technique allows to collect an evaluation of each basic parameter of the risk graph. All evaluations take account the imprecise percep-tion and the confidence of each expert and their level of expertise as well as the uncertainty related to the disagreement of opinions. Finally, the evaluation of each parameter can be combined according to graph of risk logic or the risk matrix logic.

FUZZY RISK GRAPH

The risk graph according to the structure given on Figure 4 does not allow the use of the aggregated experts' opinions as possibility distributions. It is necessary to define a system that reproduces the graph risk logic by taking into account the possibility distributions provided by the experts. A fuzzy inference system offers this possibility and Ormos has proposed a system based on the propositional model of Mamdani [START_REF] Ormos | Soft computing method for determining the safety of technological system by IEC61508[END_REF]). This work is based on the same concept.

Fuzzy partition and fuzzyfication

To use the fuzzy inference system, we must define the fuzzy partitions of each parameters of risk (Figure 4) in the corresponding scales provided to the experts [START_REF] Bowles | Fuzzy logic prioritization of failures in a system failure mode, effects and criticality analysis[END_REF]. These fuzzy partitions allow the computation of the compatibility between the experts' opinions and the concepts characterized by the linguistic terms of the reference scales [START_REF] Dubois | The three semantics of fuzzy sets[END_REF]. Each partition was elaborate based on a statistical analysis of the perception of the values on the reference scales by a sampled population (Figure 9). Each partition respects the constraint

Fuzzy inference system

The risk graph logic connects the descriptors of risk parameters (linguistic terms) and those of the conclusion (level of risk or SIL). The fuzzy inference system establishes this relation between inputs fuzzy variables and the output, based on conjunctive (Tnorms) and disjunctive operators (T-conorms) (Du-bois 1996). In the case of binary logic, these operators are clearly defined. In the case of fuzzy logic, the definition of these operators is not unique (Zadeh 1965). In the literature, we find the min/max operators, the product/probabilistic sum … The min/max operator has the advantage of simplicity during computation, but it exhibits one variable. The product/probabilistic sum operator is more complex to compute but takes the values of the two variables into account. In this work the product/probabilistic sum operator is used. The fuzzy inference system translating the risk graph suggested by IEC61508 standard (Figure 4 This inference is based on the modus ponens principle, i.e. the compatibility evaluation between the aggregate opinions of the experts and the fuzzy partitions of the inputs (premises) gives the firing magnitude of each rule.

Output fuzzy partition and defuzzyfication

According to the risk graph and the reference scale of the output, two kind of fuzzy partitions are possible. The SIL levels define an ordinal scale from the set {a, SIL1, SIL2, SIL3, SIL4, b}. Then, the fuzzy partition can be a set of scalar proposition. However, the SIL levels refer to a continuous scale of probability, which corresponds to the risk reduction. In this case, the fuzzy partition corresponds to the intervals of probability as defined in Table 1. In this paper, we prefer the use of a continuous scale to better understand the impact of imprecision and uncertainty of experts' opinions. A decision can be obtained by the defuzzyfication operation. Several methods exist (Zadeh 1965), the centre of gravity is privileged in a research of consensus on a continuous scale. The method of the maximum is preferred in the case of an ordinal scale. Collecting imprecise and uncertain experts' opinions must lead to a decision process that takes these imperfections on the conclusion into account. Of course, there is much chance that the proposed risk reduction covers many SIL levels, and cannot be used directly. The goal of the defuzzyfication step is to give a level of risk reduction translated in SIL.

However, a natural agreement between experts' opinions should be searched by a supervisor during a discussion meeting. The goal is to obtain a change in experts' opinions to obtain just one SIL level with a high confidence (no uncertainty). 5 APPLICATION Let us consider an example from the standard (ISA 2002). A process composed of a pressurized vessel containing volatile flammable liquid (see Figure 11) can reject material in the environment. The acceptable risk is defined has an average level of gas rejection less than 10 -4 /year. An HAZOP analysis has shown that the current protection systems (alarm and protection layers) are insufficient to warrant the risk level. Our goal is to determine the SIL level of a safety integrated function that allows to reach the acceptable level of risk. This determination is based on the known risk about the vessel. -Medium: exposure from rare to frequent in a dangerous area -High: exposure from frequent to permanent in a dangerous zone -Significance of the membership functions of the possibility to avoid the dangerous events (P):

-Medium: Possible under some conditions -High: Almost impossible -Significance of the membership functions of the not desired occurrence probability (W):

-Low: A very weak probability that undesired events occur or only some undesired occurrences is probable -Medium: A weak probability that undesired events occur or only some undesired occurrences is probable -High: A high probability that undesired events occur or it is probable that undesired events frequently occur. According to this glossary, each expert defines for each risk parameter the possibility distribution corresponding to his opinion. The experts' opinions are aggregated according to the method previously defined.

According to the fuzzy inference system described in the previous section, a potential risk reduction (or SIL) level distribution is obtained. The output distribution is defuzzyfied to obtain a scalar value that represents the risk reduction factor or the SIL level. The main contribution of the suggested aggregation method is to get a risk reduction distribution according to the different risk parameters by taking account imprecision, uncertainty and disagreement in experts' opinions. The SIL level value obtained is only an index satisfying the standard that works with numerical value for the SIL. As mentioned before, it is of better interest to work with the distribution of the risk reduction computed by the fuzzy inference system. The experts' supervisor should use this distribution to manage the discussion meeting. The goal is to help experts defining better opinions in order to obtain only one SIL proposition that corresponds to a confident proposition from imprecise and uncertain opinions.

CONCLUSION

In this paper, we have proposed a qualitative method of SIL allocation using a fuzzy risk graph and a system of subjective evaluation to collect imprecise and uncertain experts' opinions. An aggregation process of experts' opinions based on the possibility theory has been proposed. We show the relation between the risk matrix and the risk graph allowing the applicability of the method. One of the interests of this method is the use of a collecting technique of opinions that allows each expert to use his own reference scale where he can express the imprecision and uncertainty of his perception of the risk parameters. This approach has been applied to an example found in the standards. However, it is an open approach, which can be adapted to different application area where new risk parameters can be introduced. This method has the advantage to collect imprecise and uncertain opinions and we can show the effect of these characteristics on the decision. Future works are now directed to tools for managing the discussion meeting.

Figure 1 :

 1 Figure 1: Example of the risk matrix in SUVA method

Figure 2 :

 2 Figure 2: Example of risk graph used by IRSST

Figure 3 :-Figure 4 :

 34 Figure 3: Equivalent risk matrix

Figure 5 :

 5 Figure 5: Usual form

Figure 6 :

 6 Figure 6: Continuous rating scale

  Figure 8: Calibration function

  an uncertainty due to experts' disagreement. The following examples show how the opinions given by two experts on a parameter are aggregated in different cases. 1 st case:

  aggregated opinions with the fuzzy partitions is measured by the min operator in order to determine the value of the premises of the fuzzy inference rules.

Figure 9 :

 9 Figure 9: Partitions of evaluation scales.

  ) is structured like a set of 'IF THEN' rules as shown on Figure 10.

Figure 10 :

 10 Figure 10: Fuzzy inference system

Figure 11 :

 11 Figure 11: Vessel under pressure