Bertrand Delamotte

Matthieu Tissier

Nicolás Wschebor

Scale invariance implies conformal invariance for the three-dimensional Ising model

Using Wilson renormalization group, we show that if no integrated vector operator of scaling dimension -1 exists, then scale invariance implies conformal invariance. By using the Lebowitz inequalities, we prove that this necessary condition is fulfilled in all dimensions for the Ising universality class. This shows, in particular, that scale invariance implies conformal invariance for the three-dimensional Ising model.

I. INTRODUCTION

Conformal symmetry plays a considerable role both in high energy and condensed matter physics. There has been a renewed interest in recent years, particularly because of the AdS/CFT conjecture [1] and the successful use of conformal methods in three-dimensional critical physics [2][3][4][5][6][7]. The groundbreaking papers of the 1970s and 1980s [8][9][10][11][12][13] solved two fundamental issues in two dimensions: First, scale invariance implies conformal invariance under mild assumptions [12,13] and, second, conformal symmetry enables us to solve most of the scale invariant problems that is, to determine critical exponents and correlation functions [START_REF] Di Francesco | Conformal field theory[END_REF].

An important ingredient for the exact solution of twodimensional conformal models is the existence of an infinite number of generators of the conformal group. In higher dimensions, the number of generators is finite, and we could naively conclude that symmetry arguments alone are not sufficient to solve a model in the critical regime. However, it is well-known that scale-invariant theories are in a one-to-one correspondence with the fixed points of the Wilson Renormalization Group (RG) [START_REF] Wilson | [END_REF], and that the fixed point of a theory completely determines all the correlation functions of a critical model for sufficiently small wavenumbers. Therefore, at the level of principles, scale (and a fortiori conformal) invariance is sufficient to determine all the universal critical properties of a model. Of course, in practice, the computation of these critical properties requires us to solve the functional Wilson RG equations. This is a formidable task that we do not know how to carry out without approximations. Any supplementary information, even if redundant, is therefore welcome and this is what conformal invariance could provide. A breakthrough in this direction has been achieved these last years with the conformal bootstrap program [2][3][4], which led to the exact (although numerical) computation of the critical exponents of the Ising model in three dimensions assuming, among other things, conformal invariance.

In parallel, a large activity has been devoted to understanding the relation between scale and conformal invariance in -or close to -four dimensions. It has been proven to all orders of perturbation theory that scale invariance implies conformal invariance [16] in four-dimensional uni-tary and Poincaré invariant theories. Moreover, there are strong indications that a non-perturbative proof could be at reach in this dimension [17][18][19].

Despite decades of effort, it is still an open question to know whether a typical statistical model is conformally invariant at criticality in three dimensions. The aim of this article is twofold. First, we derive a sufficient condition which, when fulfilled, ensures that scale invariance implies conformal invariance. In the second part of the paper, we prove that this condition is fulfilled in any dimension for the euclidean Z 2 model.

The rest of the paper is organized as follows. In Sect. II, we make a brief review of the nonperturbative renormalization-group. We then recall in Sect. III the relation between scale invariance and the NPRG. By using the same methods, we generalize these considerations to the case of conformal invariance in Sect. IV. In Sect. V, we finally derive a sufficient condition for the validity of conformal invariance in scale invariant models. We show, on general arguments that this condition is expected to be fulfilled in O(N ) models (and in generalizations thereof). In Sect VI, these considerations are made rigourous for the Ising universality class. We give our conclusions in Sect VII.

II. NONPERTURBATIVE RENORMALIZATION-GROUP FORMALISM

The proof of conformal invariance in all dimensions presented below is intimately related to the deep structure of the Wilson RG1 and scale invariance. We therefore start by recalling, in the case of the Z 2 model, the formalism of the modern formulations (sometimes called Nonperturbative RG, or functional RG) of the Wilson RG [22][23][24][25][26]. The coarse-graining procedure at some RG scale k is implemented by smoothly decoupling the long-wavelength modes ϕ(|q| < k) of the system, also called the slow modes, by giving them a large mass, while keeping unchanged the dynamics of the short-wavelength/rapid ones ϕ(|q| > k). This decoupling is conveniently implemented by modifying the action or the Hamiltonian of the model:

S[ϕ] → S[ϕ] + ∆S k [ϕ] where ∆S k [ϕ]
is quadratic in the field and reads, in Fourier space, ∆S k [ϕ] = 1/2 q R k (q 2 )ϕ(q)ϕ(-q). The precise shape of R k (q 2 ) does not matter for what follows as long as it can be written as

R k (q 2 ) = Z k k 2 r(q 2 /k 2 ) (1)
where Z k is the field renormalization factor and r is a function that, (i) falls off rapidly to 0 for q 2 > k 2 -the rapid modes ϕ(|q| > k) are not affected by ∆S k -and (ii) goes to a constant for q 2 = 0 -the slow modes ϕ(|q| < k) acquire a mass of order k and thus smoothly decouple. The partition function, which now depends on the RG parameter k, reads:

Z k [J] = Dϕ exp -S[ϕ] -∆S k [ϕ] + x Jϕ (2)
where the field J is a source term which corresponds to the magnetic field in the Ising model and where the ultraviolet (UV) regime of the functional integral is assumed to be regularized at a momentum scale Λ, see for instance [27] for a lattice regularization in this formalism. It is convenient to define the free energy

W k [J] = ln Z k [J]
and its (slightly modified) Legendre transform by

Γ k [φ] + W k [J] = x Jφ - 1 2 xy R k (|x -y|) φ(x)φ(y), (3) with φ
(x) = δW k /δJ(x), R k (|x -y|) the inverse Fourier transform of R k (q 2
) and where the last term has been added for the following reason. When k is close to Λ, all modes are completely frozen by the ∆S k term because, for all q, R Λ (q 2 ) is very large. Thus, Z k→Λ can be computed by the saddle-point method and it is then straightforward to show that the presence of the last term in Eq. (3) leads to Γ Λ [φ] ≃ S[ϕ = φ]. On the contrary, when k = 0, the definition of R k implies that R k=0 (q 2 ) ≡ 0 and the original model is recovered:

Z k=0 [J] = Z[J] and Γ k=0 [φ] = Γ[φ],
with Γ[φ] the usual Gibbs free energy or generating functional of one-particle-irreducible correlation functions. The exact RG equation for Γ k reads [23][24][25]:

∂ t Γ k [φ] = 1 2 xy ∂ t R k (|x -y|)G k,xy [φ], (4)
where t = ln(k/Λ), and G k,xy [φ] is the field-dependent propagator:

G k = (Γ (2) k + R k ) -1 , Γ (2)
k,xy [φ] = δ 2 Γ k [φ] δφ(x) δφ(y) . (5)

III. SCALE INVARIANCE

We now discuss how scale invariance emerges in the NPRG formalism. We first consider a scale-invariant model described by an action S scal . As we discuss in the following, the existence of such a model is not necessary for our proof but it is convenient to imagine that it exists to motivate the form of the expected Ward identity (WI) of scale invariance. If such a model existed, this WI would be obtained by performing the following infinitesimal change of variables ϕ(x) → ϕ(x) + ǫ(D φ + x µ ∂ µ )ϕ(x) in the functional integral, with D φ the scaling dimension of the field, usually written in terms of the anomalous dimension η as D φ = (d -2 + η)/2. Actually, the analysis of this model and of its WI faces both UV and infrared (IR) problems. In the IR regime, non-analyticities are present and, in the UV, it is difficult to control mathematically the continuum limit: Λ → ∞. Let us first discuss the IR aspect. Since ∆S k [φ] acts as an IR regulator, the Wilson RG offers a solution to the IR problem: the regularized model, Eq. (2), is not scale invariant even if the original model associated with S scal were and, thus, all Γ (n) k>0 ({p i }) are regular contrarily to Γ (n) k=0 ({p i }). The price to pay for regularity is the breaking of scale invariance that manifests itself through a modification of the WI [see [28,29] for situations where R k breaks symmetries]. By enlarging the space of cutoff functions R k to arbitrary functions R k (x, y) that are neither constrained to satisfy (1) nor to be invariant under rotations and translations [as also done in [30]], this modified WI for scale invariance, obtained from Eqs. (2,3), reads

xy (D x + D y + D R )R k (x, y) δΓ k δR k (x, y) + x (D x + D φ )φ(x) δΓ k δφ(x) = 0 (6)
where D x = x µ ∂ x µ and D R = 2d -2D φ is the scaling dimension of R k which implies that the field renormalization in Eq. (1) behaves as Z k ∝ k -η . By constraining R k (q) to be of the form (1), Eq. ( 6) can be conveniently rewritten (following [29]):

∂ t Γ k [φ] = - x (D x + D φ )φ(x) δΓ k [φ] δφ(x) . (7)
Introducing dimensionless and renormalized quantities (denoted with a tilde)

x = k -1 x (8) φ(x) = k D φ φ(x) (9) Γk [ φ] = Γ k [φ] (10)
Eq. ( 7) rewrites:

∂ t Γk [ φ] = 0. ( 11
)
Eq. ( 11) means that an hypothetical scale-invariant action S scal would lead, in its regularized and not scaleinvariant version S scal + ∆S k , to a RG flow where Γk [ φ] would be at a fixed point Γ * [ φ] for all values of t:

∂ t Γ * [ φ] = 0.
The very structure of the Wilson RG (or NPRG) also solves the UV problem. Actual models have a natural UV cutoff Λ (e.g. a lattice spacing) at which is defined their microscopic action S. The momentum integrals are therefore cut-off at Λ and are thus UV finite. At scales of order Λ (i.e., if we consider correlation functions, in the regime where at least one external momentum or k or the magnetic field in appropriate units, is of the order of Λ), the model is not scale invariant. In fact scale invariance is an emergent property that appears in the IR when some parameter (such as the temperature) has been fine-tuned. We call S crit the corresponding action. In the RG formalism, scale invariance emerges in the IR regime when integrating the RG flow starting at Γ Λ [φ] = S crit [ϕ = φ] because Γk gets close to a fixed point for large negative t, that is, k ≪ Λ. As discussed above, the fixed-point condition coincides with the WI for scale invariance in presence of a regulator, see Eqs. (7,11). As a consequence, if the RG flow is attracted towards an IR fixed-point, then scale invariance emerges in the universal, long-distance regime 2 . We stress that this discussion does not rely on the actual existence of a well-defined continuum limit associated with a scale-invariant action S scal which is, per se, an interesting issue, but that we do not need to address in the present work.

When the microscopic action is slightly different from the critical one (e.g. choosing a temperature slightly away from the critical one), the RG trajectory approaches the fixed point and then stays close to it for a long RG "time", before departing. In this situation, the correlation length ξ is finite but large and the WI is almost fulfilled for momenta Λ ≫ p ≫ ξ -1 . This defines the critical regime of the theory. The closer the microscopic action is tuned to the critical one, the larger the correlation length ξ, and the better the WI is fulfilled.

Let us now make two comments. First, when k → 0, ∂ t Γ k [φ] becomes negligible compared to any kindependent finite scale and Γ k → Γ. In this limit, Eqs. (7,11) become the usual WI of scale invariance, as expected. Second, the above analysis shows that among the continuous infinity of solutions of the fixed point equation ∂ t Γk [ φ] = 0, only those that are regular for all fields are acceptable since they must be the limit when k → 0 of the smooth evolution of Γk

[ φ] from S crit [ φ].
There is generically only a discrete, often finite, number of such physical fixed-points. 3A characteristic feature of the physical fixed-points is that the linearized flow around them has a discrete spectrum of eigenvalues from which some critical exponents can be straightforwardly obtained [START_REF] Wilson | [END_REF]. The discrete character of the eigenperturbations around a fixed point has been studied intensively by perturbative means. As for the Wilson RG, it has been studied in detail in the particular case of the O(N ) models in [34][35][36]. Although obtained within the derivative expansion of the exact RG flow (4), its discrete character certainly remains true beyond this approximation. The eigenvalues λ are obtained from the flow by substituting Γk [ φ] → Γ * [ φ] + ǫ exp(λt)γ[ φ] and retaining only the O(ǫ) terms. (With our definition of t, a relevant operator has a negative eigenvalue.) This leads to the eigenvalue problem

λ γ[ φ] = x(D x + D φ ) φ(x) δγ δ φ(x) - 1 2 xi [(D x + D R )r(x -ỹ)] G * xz γ(2) z w G * w ỹ . ( 12
)
where xi = {x, ỹ, z, w}, G * [ φ] is the dimensionless renormalized propagator at the fixed point: G * = ( Γ * (2) +r) -1 and r(x) is the dimensionless inverse Fourier transform of r(q 2 /k 2 ) defined in Eq. ( 1). We conclude from the above discussion that regularity selects among all the fixed-point functionals Γ * [ φ] those that are physical, that is, that can be reached by an RG flow from a physical action S crit and that have a discrete spectrum of eigenperturbations.

IV. SPECIAL CONFORMAL TRANSFORMATIONS

Let us now study conformal invariance by following the same method as above. As in the case of scale invariance, to motivate the form of the WI we imagine that a conformally-invariant model, associated with an action S conf [ϕ] written in terms of a primary field ϕ, exists. We put aside for now the problem of the existence of this model since, as discussed below, we do not need that it actually exists for our proof. If such a model existed, the modified WI would follow from performing the infinitesimal change of variables ϕ (2). By considering general cutoff functions as in Eq. ( 6), we find that it reads:

(x) → ϕ(x) + ǫ µ (x 2 ∂ µ -2x µ x ν ∂ ν + 2αx µ )ϕ(x) in Eq.
xy (K x µ -D R x µ + K y µ -D R y µ )R k (x, y) δΓ k δR k (x, y) + x (K x µ -2D φ x µ )φ(x) δΓ k δφ(x) = 0, (13)
with

K x µ = x 2 ∂ x µ -2x µ x ν ∂ x ν .
By specializing R k to functions of the form Eq. ( 1) and requiring again that Z k ∝ k -η , Eq. ( 13) can be rewritten

0 = Σ µ k [φ] ≡ x (K x µ -2D φ x µ )φ(x) δΓ k δφ(x) - 1 2 xy ∂ t R k (|x -y|) (x µ + y µ ) G k,xy . (14)
Again, this identity boils down to the usual WI of conformal invariance in the limit k → 0 where R k → 0. At any fixed point, the scaling dimension of Σ µ k [φ] is fixed by Eq. ( 14) to be -1. We thus define Σµ

k [ φ] = k Σ µ k [φ]
. Its flow equation reads:

∂ t Σµ k [ φ] -Σµ k [ φ] = x(D x + D φ ) φ(x) δ Σµ k δ φ(x) - 1 2 xi (D x + D R )r(x -ỹ) Gk,xz Σµ (2) k,z w Gk, w ỹ , ( 15
)
where Σµ

k

[ φ] is the second functional derivative of Σµ k . An important property of Σ µ k is that, at the fixed point, it is the integral of a density with no explicit dependence on x µ . Indeed, observe that the left-hand-sides of Eqs. ( 6) and ( 13) can be interpreted as the action of the generators of dilatations D and conformal transformations K µ on Γ k .

DΓ k = x (D x + D φ )φ(x) δΓ k δφ(x) + xy (D x + D y + D R )R k (x, y) δΓ k δR k (x, y) (16)
K µ Γ k = x (K x µ -2D φ x µ )φ(x) δΓ k δφ(x) + xy (K x µ -D R x µ + K y µ -D R y µ )R k (x, y) δΓ k δR k (x, y) , (17)
that is, Σ µ = K µ Γ k . Similar expressions can be obtained for the generators of translations P µ and rotations J µν :

P µ Γ k = x ∂ µ φ(x) δΓ k δφ(x) + xy (∂ x µ + ∂ y µ )R k (x, y) δΓ k δR k (x, y) (18)
J µν Γ k = x x µ ∂ ν φ(x) δΓ k δφ(x) + xy (x µ ∂ x ν + y µ ∂ y ν )R k (x, y) δΓ k δR k (x, y) -[µ ↔ ν] (19)
It can easily be checked that the generators satisfy the algebra of the conformal group. In particular, applying [P µ , K ν ] = 2δ µν D + 2J µν to a translation, rotation and dilatation invariant Γ k yields

P µ Σ ν k = 0. ( 20
)
Thus, at the fixed point, Σ µ k is the integral of a density that does not have an explicit dependence on x. This density only depends on the field and its derivatives. This proof generalizes trivially to other scalar models.

V. A SUFFICIENT CONDITION FOR CONFORMAL INVARIANCE

Let us now consider a physical model at criticality. At the scale Λ, Γ Λ = S = S crit and the model is neither conformally nor scale invariant. However, when k ≪ Λ, the regularized model gets close to a fixed point and thus Gk ≃ G * and Σµ

k [ φ] ≃ Σµ * [ φ].
The key point of our proof is that at the fixed point, Eq. ( 15) is identical to (12) with γ[ φ] → Σµ * [ φ] and λ = -1 although these two equations have different physical meanings. A sufficient condition for proving conformal invariance is therefore to show that there is no integrated vector eigenperturbation

V µ = x V µ of Γ * [ φ] of scaling dimension D V = -1.
If no such eigenperturbation exists, the conformal WI is satisfied, which means that the system is conformally invariant at criticality in the long distance regime. Moreover, the form of the conformal WI ( 14) fixes the transformation law fulfilled by ϕ, which is the one of a primary field.

To understand how conformal invariance is related with the scaling dimension of the vector eigenperturbations, it proves useful to consider three simple examples. The first one is the Ising model in d = 4. The fixed point being gaussian, the eigenvalues are trivially given by the canonical dimensions. By using the fact that Σµ k is Z 2and translation-invariant, see Eqs. ( 14) and ( 20), we find by inspection that the vector operator with lowest dimension reads x φ ∂ µ φ(∂φ) 2 . It has therefore dimension +3. Note that there exists local vectors operators with lower scaling dimensions [φ∂ µ φ, φ 3 ∂ µ φ and φ∂ µ φ(∂ ν φ) 2 )]. However these are total derivatives and are not associated with integrated vector operators. In the absence of vector operator of dimension -1, we retrieve the wellknown property that this model is conformally invariant at criticality in the long distance regime [13,16]. Using standard methods, we can compute the corrections to the scaling dimension of the vector operator x φ ∂ µ φ(∂φ) 2 in a systematic expansion in ǫ = 4 -d. We performed the calculation at one loop and found that the correction vanishes. The scaling dimension is therefore 3 + O(ǫ 2 ). This analysis can be extended to the O(N ) models. In d = 4, there exists now two independent integrated vector operators,

x φ a (∂ µ φ a )(∂ ν φ b ) 2 and x φ a (∂ ν φ a )(∂ µ φ b )(∂ ν φ b )
, with lowest scaling dimension 3. As in the Ising case, there exist local operators with lower scaling dimensions, that are however total derivatives. Our sufficient condition is again fulfilled and we recover the well-known fact that these models are conformally invariant in the critical regime for d = 4. At one loop the degeneracy of the scaling dimensions is lifted and we obtain 3 + O(ǫ 2 ) and 3 -6ǫ N +8 + O(ǫ 2 ). The third example involves a vector field A µ (x) and is described by the (euclidean) action

S = x 1 4 (∂ µ A ν -∂ ν A µ ) 2 + α 2 (∂ µ A µ ) 2 . ( 21
)
This model is interesting because it is scale invariant In these cases, conformal invariance can be broken.

but generically not conformally invariant, except for α = α c = (d -4)/d [37,38]. This situation can be understood in our context by considering the contraposition of our sufficient condition, which states that, assuming that A µ is a primary field [38], a necessary condition for having scale invariance without conformal invariance is that there exists an integrated vector operator with scaling dimension -1. It is actually easy to find such an operator (which is unique, up to a normalization):

C x A µ (∂ ν A ν ).
We can understand the particular case α = α c by an explicit calculation of Σ µ k [A ν ] from Eq. ( 14). This shows that C = αd + 4 -d which, as expected, vanishes when α = α c .

To conclude this section, we discuss the plausibility of not having conformal invariance d = 3 for the O(N ) models at criticality. The only possibility would be to have a vector eigenperturbation with eigenvalue -1 in this dimension, see Fig. 1. This would mean that the d = 3 model has an integer critical exponent, a property that is highly improbable. Let us anyhow suppose that one of these eigenvalues crosses -1 right in d = 3, as in curve (c) of Fig. 1. Then, for any dimension infinitesimally smaller or larger than three, there would exist no eigenperturbation of dimension -1. The critical system would exhibit conformal symmetry above and below d = 3. Since correlation functions of the critical theory are expected to be continuous functions of d, we conclude that, even in this highly improbable situation, the model would exhibit conformal invariance at criticality in d = 3. We are thus led to the more stringent necessary (but not sufficient) condition: for a critical model not to be conformally invariant, there must exist a vector perturbation of scaling dimension -1 in a finite interval of dimensions containing d = 3. This could happen either because a discrete eigenvalue is independent of the dimension in some range of dimension around three or because there exists a continuum of eigenvalues, see Fig. 1. Such a behavior is, to say the least, not standard. To our knowledge, this has never been observed in any interacting model.

The previous arguments are compelling but not mathematically rigorous. In particular, assuming that the theory can be properly defined in noninteger dimensions, which is standard but not obvious, it is hard to control the analytic structure of the critical exponents in d. In the next section, we give a proof in the physically important case of the Ising model in d = 3 which does not rely on such arguments.

VI. PROOF IN THE ISING UNIVERSALITY CLASS

We concentrate here on the Ising universality class and show that, in this case, the smallest eigenvalue D V associated with an integrated vector perturbation is larger than -1 for d < 4. Using our necessary condition, this proves that, for the Ising universality class, the critical regime is conformally invariant.

For simplicity, we consider a lattice version of the Ginzburg-Landau model whose dynamics is described by the hamiltonian (or action)

S = -J ij ϕ(i)ϕ(j) + i U (ϕ(i)). ( 22
)
where the index i labels the lattice sites, the ϕ(i) take in the real domain and U (ϕ) is an even function that diverges for |ϕ| → ∞. We choose here a hypercubic lattice with lattice spacing a. The original Ising model can be recovered by considering a potential U (ϕ) strongly peaked around ϕ = ±1 but the Ginzburg-Landau model which is in the Ising universality class for a generic potential is more convenient for what follows.

The use of Ginzburg-Landau model has another advantage. In the case of a quartic potential,

U (ϕ(i)) = r 0 2 ϕ 2 (i) + u 0 4! ϕ 4 (i) ( 23
)
and for d < 4, the model is super-renormalizable. Its ultraviolet behaviour is therefore controlled by a Gaussian fixed-point. In this case, the existence of a controlled scaling limit seems to be under control even if, to the best of our knowledge, there is no mathematical proof of its existence [39]. To compare different models in the Ising universality class we assume below that this scaling limit does exist in the following precise sense. Let us consider two local operators O 1 (i, a) and O 2 (i, a). Let us also introduce (i) a smooth interpolating field φ interp (x) with x ∈ R d that coincides on the lattice points with φ(i) and (ii) two interpolating operators O interp 1,2 (x, a) defined by: O interp i = O i (φ interp ). Of course the construction of these interpolating operators is not unique. We now consider the particular case where O 1 and O 2 are such that O interp 1 → O interp 2 when a → 0. (We notice that this limit is independent of the choice of interpolation used to define φ interp ). Our assumption, that we call for short "scaling limit", is that there exists a multiplicative factor Z O (a) depending on the lattice spacing such that the correlation functions of the operators O 1 (x, a) and Z O (a)O 2 (x, a) are the same for distances much larger than a:

O 1 (x, a)O 3 (y 3 ) . . . O n (y n ) ∼ Z O (a) O 2 (x, a)O 3 (y 3 ) . . . O n (y n ) (24)
where {O 3 , . . . , O n } are arbitrary local operators and where the equivalence occurs for a ≪ min{|y 3 -x|, . . . , |y n -x|}. This hypothesis is a pre-requisite of all Monte Carlo simulations, and is, of course, satisfied to all orders of perturbation theory in any renormalizable theory. We assume here that it is also valid nonperturbatively.

Our strategy is to study correlation functions of local vector operators V µ (x) and use their critical behavior to find a bound on the scaling dimension of the integrated operator V µ = a d i V µ (i). We rightaway mention two difficulties.

First, there are local vector operators that are total derivatives and which are therefore not associated with an integrated one. As discussed before, the vector operator ∂ µ (ϕ 2 ) is such an operator. Note that its scaling dimension near d = 4 is lower than that of the vector operators which are not total derivatives (such as

∂ µ (ϕ) 2 (∂ ν ϕ) 2 ).
Second, operators with the same quantum numbers typically mix together in the calculation of correlation functions. As a consequence, the critical behavior of a two-point function of some vector operator is governed by the lowest scaling dimension of the class of operators with which it mixes. To be more precise, let us call V (n) µ the local vector eigenoperator of scaling transformations with scaling dimension

D (n) V (ordered such that D (0) V ≤ D (1)
V ≤ • • • ). The associated two-point correlation function behaves, in the critical regime, as:

V (n) µ (x)V (n) µ (y) c ∼ 1 |x -y| 2D (n) V , (25)
where the subscript c indicates connected correlation functions, defined as:

X(x)Y (y) c = X(x)Y (y) -X(x) Y (y) (26)
and where an appropriate normalization has been chosen. In d = 4, the eigenproblem can be solved and the scaling dimensions are the canonical dimensions. In particular, the eigenoperators with lowest scaling dimensions are:

V (0,d=4) µ ∝ ∂ µ φ 2 D (0,d=4) V = 3 (27)
V (1,d=4) µ

∝ ∂ µ φ 4 D (1,d=4) V = 5 (28) V (2,d=4) µ ∝ ∂ µ (∂ ν φ) 2 D (2,d=4) V = 5 (29)
V (3,d=4) µ

∝ (∂ µ φ 2 )(∂ ν φ) 2 D (3,d=4) V = 7 (30)

• • •

where ∂ µ is a lattice discretization of the partial derivative. (Note that the first three operators are total derivatives.) In dimension d < 4, although we do not know the explicit form of the eigenoperators, we can, in principle, decompose any vector operator on the basis {V (n) µ } and generically, there is a nonvanishing overlap with each of the eigenoperators:

V µ = n α n V (n) µ . (31)
a consequence, the critical regime of the two-point correlation function is dominated by the smallest critical dimension

V µ (x)V µ (y) c ∼ α 2 0 |x -y| 2D (0) V . ( 32
)
We stress that the list of quantum numbers must include those associated with lattice isometries. For example, we require scalar (respectively vector) operators defined on the lattice to be even (respectively odd) under parity transformations.

The proof is organized as follows. Using Lebowitz inequalities [40,[START_REF] Glimm | Quantum Physics: A Functional Integral Point of View[END_REF], we derive a lower bound for D (0)

V from which follows a lower bound for the scaling dimension of the integrated vector operators. The proof that the scaling dimension D V of any integrated vector operator is different from -1 for d ≤ 4 is then a direct consequence of this bound.

As a first step, we derive a bound for the correlation function ϕ 2 (x)ϕ 2 (y) c . We use here the Lebowitz inequalities [40] which state that, considering two decoupled copies of the ferromagnetic system (that we note ϕ and ϕ ′ ), both described by the action (22), and considering two sets A and B of lattice points, i∈A,j∈B

[ϕ(i) + ϕ ′ (i)][ϕ(j) -ϕ ′ (j)] ≤ i∈A [ϕ(i) + ϕ ′ (i)] j∈B [ϕ(j) -ϕ ′ (j)] , (33)
i∈A,j∈B

[ϕ(i) + ϕ ′ (i)][ϕ(j) + ϕ ′ (j)] ≥ i∈A [ϕ(i) + ϕ ′ (i)] j∈B [ϕ(j) + ϕ ′ (j)] . (34)
In particular, this implies that:

(ϕ(x) + ϕ ′ (x)) 2 (ϕ(y) -ϕ ′ (y)) 2 ≤ (ϕ(x) + ϕ ′ (x)) 2 (ϕ(y) -ϕ ′ (y)) 2 . ( 35
)
Expanding the binomials, we readily obtain the following identity:

ϕ 2 (x)ϕ 2 (y) c ≤ 2G 2 (x -y) (36)
where we have used the fact that the average of an odd number of fields vanishes for temperatures higher than (or equal to) the critical temperature. This implies that the connected correlation function ϕ 2 (x)ϕ 2 (y) c cannot decrease more slowly than the square of the propagator at long distances. This inequality can be generalized to arbitrary even powers of the fields:

0 ≤ ϕ m (x)ϕ n (y) c ≤ C G 2 (x -y) (37)
where C is a positive constant (that depends on m and n) as shown in the Appendix A.

In the critical regime, scale invariance implies that connected two-point correlation functions behave as powerlaws. In particular:

ϕ m (x)ϕ n (y) c ∼ A |x -y| ℵm+ℵn (38)
with A a positive constant (see, for example [START_REF] Di Francesco | Conformal field theory[END_REF]). The inequality (37) implies that ℵ n ≥ d -2 + η. We can then deduce the asymptotic behavior of the matrix of second derivatives of this correlation function:

∂ x µ (ϕ m (x))∂ y ν (ϕ n (y)) c ∼ 1 |x -y| ℵm+ℵn+2 Bδ µν + C (x -y) µ (x -y) ν (x -y) 2 . ( 39
)
where B and C are some constants. We now consider two local vector operators that are the product of one power of ∂ µ ϕ(x) and an odd (finite) number of fields evaluated at points in a finite neighborhood of x:

W (1) µ (x) = 1 2 [∂ µ ϕ(x)] s=±1 m-1 i=1 ϕ(x + s e (1)
i ). ( 40)

W (2) µ (x) = 1 2 [∂ µ ϕ(x)] s=±1 n-1 i=1 ϕ(x + s e (2)
i ).

where e

(1) i and e

(2) i are some constant lattice vectors 4 . The operators W (1) µ (x) and W

(2) µ (x) are, up to a multiplicative constant, other discretizations of, respectively, the operator ∂ x µ (ϕ m (x)) and ∂ x µ (ϕ n (x)). According to the assumption of the existence of the scaling limit, Eq. ( 24), the connected correlation function W

(1) µ (x)W (2)
ν (y) c has the same asymptotic behavior as in Eq. ( 39) up to a multiplicative factor depending on the lattice spacing. Indeed, when |x -y| is much larger than the lattice spacing a, the vectors e µ are then proportional to ∂ µ (ϕ m ) and ∂ ν (ϕ n ) respectively as explained before. Now, any local vector operator V µ on the lattice is a linear combination of vector operators of the form (40). For instance, a discretization of the operator ∂ µ (φ 2 )(∂ ν φ) 2 is given by:

φ(x) 16a 3 (φ(x + μ) -φ(x -μ)) ν (φ(x + ν) -φ(x -ν)) 2 (42)
where the sum runs over all the nearest neighbors of x.

Using the triangular inequality, we conclude that:

| V µ (x)V ν (y) c | ≤ Z µν |x -y| 2(d-1+η) . ( 43
)
where Z µν is a positive constant. Using Eq. ( 32) this implies that, for all n:

D (n) V ≥ d -1 + η (44)
We conclude that the scaling dimension D V = D V -d of any integrated vector operator is not smaller than -1+η. 5Using the unitarity of the Minkowskian φ 4 theory, one can prove that η ≥ 0 [START_REF] Zinn-Justin | [END_REF] for the Ising universality class. Moreover, an interacting massless theory such as the critical Ising model for d < 4, has a non-zero η [43]. As a consequence, our necessary condition is fulfilled and we conclude that scale invariance implies conformal invariance for the Ising universality class for all d ≤ 4.

VII. CONCLUSIONS

Let us now point out some directions of research for the future. It is clear that the condition of conformal invariance [START_REF] Di Francesco | Conformal field theory[END_REF] can be straightforwardly extended to other theories (involving scalar, fermionic or vector fields) and it would be interesting to conclude on the fate of conformal invariance in this wider class of models. In these systems, it is much more difficult to find rigorous bounds on correlation functions (that would generalize the Lebowitz inequalities). It would then prove useful to approach the problem by computing the scaling behavior of vector operators by Monte-Carlo simulations.

Another promising line of investigation consists in making use of the conformal invariance in the Wilson framework to perform actual calculations of universal quantities. On the one hand, and in the best case, this would lead to closed and numerically tractable equations for the critical exponents. On the other hand, the approximation schemes currently used for solving the Wilson RG flow equation being incompatible with exact conformal invariance, we can expect that constraining them to be conformally invariant at the fixed point would improve their accuracy.

Notice finally that, at first sight, our approach could seem similar to the one based on the energy-momentum tensor and on the analysis of the virial current. This is not the case although there is perhaps a relationship between the two. Σ µ k is a functional of φ and not of ϕ; it is built from Γ k and not from S; what matters is that its density vanishes up to a surface term and not that it is conserved. Moreover, as we already explained, we only deal with a regularized theory which enables us to consider only the analytic candidates for Σµ * contrary to what should be done in a nonregularized theory. In any case, a clarification of the relation between the two approaches would be welcome. In this respect, our proof of the non-existence of local vector operator of scaling dimension d-1 (conserved or not) might be of interest also when applied to a hypothetical conserved virial current. The first term involves the product of a correlation function with odd powers of the fields and a positive constant.

The second sum involves either a product of two correla-tion functions, one with even and one with odd powers of the fields, or the product of a correlation function with odd powers of the fields and a positive constant. In all cases, the correlation functions that appear in the righthand side fulfill the conditions of our hypothesis. We therefore conclude that ϕ m (x)ϕ n (y) c satisfies property (A1) for m and n odd (see Footnote 6). This concludes the proof of the induction hypothesis.

Using the fact that the property (A1) is valid for a = b = 1, it is easy to check, by applying several times the induction property, that (A1) and (A2) are valid for any a and b.

1 FIG. 1 :

 11 FIG. 1: Possible behavior of the lowest eigenvalue DV associated with a vector perturbation as a function of dimension. Left panel: (a) and (b) correspond to typical behavior, (c) to the exceptional case where DV = -1 right in d = 3. In the three cases, conformal invariance holds. Right panel: the shaded area represents a continuum of eigenvalues and the curve an eigenvalue DV having a plateau at -1 around d = 3.In these cases, conformal invariance can be broken.

  expansion and the positivity of (connected and disconnected) correlation functions to obtain the following inequality:ϕ m (x)ϕ n (y) c ≤ a∈{0,2,••• ,m-1} b∈{1,3,••• ,n-1} m -1 a n b × ϕ a (0) ϕ m-a-1 (0) ϕ(x)ϕ b (y) c ϕ n-b (0) + a∈{1,3,••• ,m-2} b∈{0,2,••• ,n} m -1 a n b × ϕ a+1 (x)ϕ b (y) ϕ m-1-a (x)ϕ n-b (y) (A8)

The history of the relation between conformal invariance and Wilson RG is long, see for example[20,

21].

A running anomalous dimension can be defined by η k = -∂t log Z k . It is only around the fixed point that η k approaches a fixed-point value which is nothing else than η.

Two well-known exceptions to this rule are the line of fixed points of the O(2) model in d = 2[31] and the discrete infinity of (multicritical) Z 2 -invariant fixed points in d = 2[32,33].

Since Σµ, defined in Eq. (14), is odd under parity, it is important in what follows to consider only vector operators that are also odd. This is the reason why the sum over s is necessary in the definitions(40) and[START_REF] Glimm | Quantum Physics: A Functional Integral Point of View[END_REF].

This bound also applies for correlation functions of more general operators.

We use here the fact that, on the lattice, G is bounded by some positive constant (G(r) < D). Consequently, we can further use the bound G 2n (r) ≤ CG 2 (r) where n is a positive integer and C a positive constant.

Acknowledgments

The authors acknowledge financial support from the ECOS-Sud France-Uruguay program U11E01, and from the PEDECIBA. BD and MT also thank the Universidad de la República (Uruguay) for hospitality during the completion of this work, and NW the LPTMC for hospitality during his sabbatical year 2012-2013. We thank A. Abdesselam, L. Messio, T. Morris, V. Rivasseau and V. Rychkov for useful discussions. We thank O. Rosten for pointing out the reference [43] and V. Rychkov for pointing out an error in a previous version of the manuscript.

Appendix A: Bound for correlation functions ϕ m (x)ϕ n (y)

In this appendix, we derive bounds on the correlation functions ϕ m (x)ϕ n (y) c , in the symmetric phase (T ≥ T c ), with m and n arbitrary integers with the same parity (otherwise the correlation function vanishes).

We want to show that:

where C 1 and C 2 are some strictly positive constants and

Note that for odd a and b, the connected and disconnected correlation functions are equal, see Eq. 26.

Property (A1) is obvious for a = b = 1. The proof of (A2) for {a = 2, b = 2} is presented in the core of the article. For general a and b, the proof is made by induction. Assuming that the inequalities (A1) and (A2) are fulfilled for {a ≤ m, b ≤ n} \ {a = m, b = n}, we have to prove that these properties are also valid for a = m and b = n.

We first consider the case where m and n are even. Using the Lebowitz inequality [40] [see Eq. ( 33)]

as well as translation invariance and the binomial expansion, we obtain:

Writing explicitly the terms with a ∈ {0, m} and b ∈ {0, n}, we get the following bound:

where we have used the fact that connected correlation functions, as well as ϕ m (0) are non-negative [44,45] to eliminate the terms with even b. We observe that there appears in the right-hand side only connected correlation functions with at most m -1 powers of ϕ(x) and at most n -1 powers of ϕ(y). By hypothesis, properties (A1) and (A2) are thus valid for these correlation functions. Furthermore, we observe that the right-hand side involves a sum of terms that are a product of two correlation functions with odd powers of the fields. In both cases, by using properties (A1) and (A2), this quantity is bounded by some positive constant times G 2 (x -y). 6 This concludes the proof of the induction hypothesis in the case of even m and n.

We now turn to the case where m and n are odd. We now make use of the Lebowitz inequality

which is of interest if m > 1 (we can obviously derive a similar inequality with {m, x} ↔ {n, y} which can be applied in the case m = 1). We again use the binomial


David Lesens

From system functional definition to software code

Keywords: Model Driven Engineering, SysML, Automatic Code Generation, COTS, DSL

This paper addresses the classical problem of system to software engineering following a Model Driven Engineering (MDE) approach. Even if this approach is now widely used in the industry, some issues remain: Long term availability of the tools (for projects with duration of several decades), use of standards and Commercial Of The Shelf (COTS) tools versus Domain Specific Language (DSL), different modelling tools for the system and the software, quality and mastering of automatically generated code. This paper shows how it is possible to take simultaneous benefit of COTS (low price), DSL (adapted to specific needs) and in-house tools (which can be maintained for very long periods of time) to develop complex critical systems.

Introduction

Since several years, Model based System Engineering (MBSE) has been shown efficient to improve the capture of system requirements. Airbus Defence and Space -Space Systems has for instance successfully deployed SysML modelling to support the functional definition of the avionics sub-system of a launcher such as Ariane 5 Mid-life Evolution ( [START_REF]Ariane 5 program[END_REF]) or of a spacecraft such as the European Service Module (ESM) of the Multi-Purpose Crew Vehicle (MPCV, [START_REF]MPCV program[END_REF]). The functional part of the system definition is formalised by a SysML ( [START_REF]SysML standard[END_REF]) model developed in co-engineering by the system experts and the modelling experts. Several documents are thus partially automatically generated from this single model: The system Definition Files, the digital Interface Control Documents (ICD) and the software Technical Specification. MBSE improves the communication between the teams and improves the generated documentation quality.

This paper shows how Airbus Defence and Space -Space Systems has defined a process and a set of tools to extend this approach to the software development (Model Driven Engineering or MDE). The objective of this work is to generate from a single model shared between the system and the software the three previously mentioned documents and a part of the software code.

After this introduction, the section 2 will quickly present the system functional modelling today deployed for the development of space launchers. The section 3 will summarize previous studies on software modelling and explain why these approaches have finally not been selected for the development of future space launchers. The section 4 will describe the specific multithreading design used for space launchers and how it has been decided to model it. Finally, the section 5 will show how an important part of the flight software can be automatically generated from these models. The section 6 will compare the proposed solution with the ones presented in section 3 and the section 7 will present the conclusion.

System functional modelling

The avionics subsystem of a space launcher is mainly responsible for (1) the flight control (navigation, guidance and control) and (2) the mission management (ground / board protocol, ignition and stop of engines, release of stages…). It is made up of a centralised on-board computer hosting the flight software (or potentially several computers working in a redundant mode to ensure the fault tolerance) and a set of avionics sensors (gyroscopes, accelerometers…) and actuators (valves, pyrotechnic commands, electro-mechanical actuators…) linked by a communication network.

The system is then cyclically executed: Measurement acquisition, flight control algorithm, execution of commands by actuators, and so on. The needs of the flight control toward the launcher system is translated into a set of blocks (hardware or algorithmic) communicating through data-flows. This functional architecture is modelled by SysML Internal Block Diagrams (IBD). The content of the algorithm blocks is textually specified or modelled in Matlab and then coded in Ada. The mission management describes the acyclic behaviour of the system. The phases of the launcher mission (ground phase, motor ignition and then lift-off or emergency stop in case of failure) are thus modelled by finite state machines in SysML and by a textual DSL (Domain Specific Language) adapted to the description of a space launcher mission.

Sensor Navigation

The use of a COTS modelling tool (e.g. Rhapsody [START_REF]Rhapsody tool[END_REF]) allows decreasing the costs: COTS tools are generally very mature and require only light customization. However, one of the main drawbacks of COTS is the difficulty of maintenance for a very long period of time. The use of a widely used standard ensures that editors will always be available in the future.

SysML has thus been selected because it is a standard widely used in the industry and in the academic world and because it provides the two kinds of diagrams needed to describe the functional architecture and the flight software of space launchers: Internal Block Diagrams and Finite State Machines.

The semantics of the modelling (SysML + DSL) is the one of Synchronous Languages such as Lustre ( [START_REF]Lustre[END_REF]) or Signal ([17]):

• The system is cyclically activated at a constant frequency.

• The inputs of the system are supposed to be available at the beginning of each cycle of execution.

• The outputs computed by the system are provided at the end of the cycle.

This approach is well known to ensure a full determinism of the system and allow simple compositions of elements with a predictable memory usage.

Here is an example of the DSL describing the execution in parallel of two commands and inspired by the notion of On Board Control Procedure (OBCP, [START_REF]Spacecraft on-board control procedures[END_REF], also called "functional sequences"):

sequence Lift-off is fork Cmd_Pyro; wait 5 ms; Valve_Cmd; wait end of Cmd_Pyro; Start_Control; end;

Figure 3: DSL describing a functional sequence

This example is valid with respect to the synchronous semantics only if the duration "5 ms" is a multiple of the basic cycle of the system.

The communication network (related to the avionics system design) and the middleware and the threads (related to the software real-time design) are abstracted in this phase of development.

Previous studies on software design modelling

In parallel to the deployment of SysML modelling to capture the system functional definition, several modelling approaches have been assessed in order to capture the software design and to potentially generate automatically part of the flight software:

• SCADE Suite ( [START_REF]SCADE Suite tool[END_REF]) was a promising track thanks to its certified code generator ensuring a high quality of the generated code. It has however several limitations o The SCADE modelling is partially redundant with the SysML modelling (especially for what concerns the finite state machine and the functional architecture). The development cost of these two models removes the benefits of the approach o SCADE does not model today the multithreading architecture. Developing multithreading software with SCADE requires thus the independent modelling of each thread in SCADE and then the manual development of a real-time sequencer responsible for the activation of each thread. The SCADE model becomes then a design model distinct from the functional model. This decreases greatly the advantages of the modelling o The code generated from SCADE has not been designed to be manually maintained. This implies the need to maintain the SCADE modelling tool and the code generator during the complete life of the project (up to 30 years for a space launcher). The cost of this maintenance removes on the long term the saving of automatic code generation • AADL ( [START_REF]AADL standard[END_REF]) allows modelling the avionics and the software multithreading architecture. As for SCADE, this modelling is partially redundant with the SysML modelling selected for the system functional description. Moreover, AADL is able to capture any kind of software multithreading architecture, even the more complex. The flight software of a space launcher being critical, its multithreading architecture is very simple and based on the Rate Monotonic Scheduling (RMS [START_REF] Liu | Scheduling algorithms for multiprogramming in a hard real-time environment[END_REF], see section 4). AADL is thus too complex for the needs. • MARTE ( [START_REF]MARTE standard[END_REF]) has the advantage of being close from SysML and UML. However, it has the same drawbacks than AADL. • UML ( [START_REF]ERTS 2016 -David Lesens[END_REF]) is a modelling language especially well-suited for object oriented software design. As the flight software of future launchers will be partially developed in an object oriented manner (with the Ada 2012 [START_REF][END_REF] programming language), UML seems a good choice. However, the object oriented approaches of UML and Ada 2012 are not fully compatible (see [START_REF]From Ada 83 to Ada 2012[END_REF]). For instance: o The UML notion of "class" is replaced in Ada by the notions of "package" (to define the naming space) and of "tagged type" (to define the inheritance) o Ada has a restricted set of "visibility" compared to UML o … Moreover, as for SCADE, the UML modelling is partially redundant with the SysML modelling. It has thus been decided that UML models will be developed to describe the principle of design, but not for the detailed design (except for some specific parts) and will not be used for automatic code generation.

As a conclusion of these studies, it appears that all the studied software modelling languages have two drawbacks: The redundancy with SysML (selected for the system functional description) and the cost to maintain the toolsets during a long period of time. Airbus Defence and Space has thus decided to rely mainly on SysML completed by a DSL (Domain Specific Language) to model the design of launcher's flight software (the same DSL being used for the system functional behaviour (see section 2) and the software design).

Software design modelling

Defining a DSL requires an accurate definition of the objectives of the modelling. This section describes the flight software design used today on space launchers and which has been the basis to define the DSL.

The software design is composed of the static design (definition of the hierarchical architecture of the software, definition of classes and of objects, definition of the interfaces of components) and of the real-time design (definition of threads, of their scheduling, of the communication between the threads and of the communication between the software and the communication network). The main drivers of the flight software design are:

• The functional and real-time determinism ensuring the representativeness and the reproducibility of the qualification tests • The decrease of the development and validation costs

The determinism of the multithreading design is ensured by using an extension of a Rate Monotonic Scheduling:

• The software is composed of cyclic threads (no acyclic threads)

• Each thread has a period multiple of the period of the thread just faster (harmonic threads)

• The scheduling is pre-emptive with constant priority (a thread with a shorter period has the priority over a thread with a longer period) • The communications between the threads are performed during time triggered rendezvous

The Figure 5 provides the example of two communicating threads (a slow one in blue and a quick one in yellow).

Slow thread

Fast thread

Figure 5: Time triggered communication between threads

The period of the slow thread is a multiple of the one of the quick thread. The quick thread has the highest priority. It can pre-empt the execution of the slow thread. The communications between the two threads are performed at the end of the period of the slow thread (in a protected section): even if the execution of the slow thread is quicker than expected, the communication will be performed at the same date. Thus, provided that each thread respects it worst case execution time, this design ensures the strict determinism of the software behaviour.

The decrease of the development costs is achieved by mapping the functional architecture and the software static design. This result is obtained by a co-engineering work between the system team (responsible for the functional architecture, see section 2) and the software team. The functional architecture shown Figure 1, which defines a set of functions and their communications, is thus directly used to generate the code (see section 5).

The work remaining at software design level is thus:

• To define the set of threads and their periods • To map each function on a thread. Depending of the reactivity needs, a function at 10Hz can for instance be executed either at each cycle on a thread at 10Hz or at one cycle among two on a thread at 20Hz.

A simple DSL has been defined to describe this software design choices.

thread T1 is period (100 ms); functions (F1; F2); end; thread T2 is period (50 ms); functions ( when 0 => (F3; F4); when 1 => (F3)); end; • A major frame of 100 ms has been defined

• F1 and F2 are executed at 10 Hz (on the thread T1)

• F3 is executed at 20 Hz (on the thread T2)

• F4 is executed at 10 Hz (one cycle among two on the thread T2)

This real-time design is an extension of the synchronous language approach (on which the functional modelling described section 2 is based). The DSL describing the functional view (section 2) and the one describing the real-time design (section 5) rely thus on the same paradigm and are thus naturally compatible.

Automatic code generation

The multithreading design of the software (the definition of threads and the mapping of functions on the threads) remains today a manual activity which is formalised by a dedicated model using the DSL. All the remaining coding activities related to this multithreading design have been automated in an in-house tool generating Ada 2012 code from the SysML model and the DSL.

This automatic generation of code relies on a generic reusable library implementing:

• A scheduler of threads and of applicative software elementary blocks,

• An interpreter of a mission management (described by finite state machines and the DSL shown Figure 3).

Considering this generic reusable library, the following artefacts are automatically generated by the in-house tool:

• Configuration tables in Ada 2012 for the generic reusable library from the SysML finite state machine and the DSL describing the functional sequences (Figure 3) and for the definition of threads (Figure 6).

• Ada 2012 code for the skeleton of the functions (Figure 1) and the scheduling of these functions (Figure 6).

configuration table automatic generation

There is no certification for space launchers similar to certification for civil aircraft. However, the quality of generated code remains a major issue: a failure of the flight software implies generally the loss of the launcher and of its payload (the satellites to be put in orbit) and in the worst possible case the destruction of the launch pad. The ECSS-E-ST-40C ( [START_REF]European Cooperation for Space Standardization[END_REF]), the standard applicable to the development of space software in Europe, requires the classical reviews (of specification, of design, of code…) and test activities. The in-house code generator being not qualified according to this standard, reaching the same level of quality than for a manual code forbids suppressing any of these V&V activities. Reviews of code are for instance performed on the generated code.

The obligation of performing such reviews is often considered as a reason for not using automatic code generation because (1) the generated code is not enough readable to perform such review and (2) even a light modification in the source model may imply huge modifications in the generated code which makes mandatory a complete review of the generated code for each evolution. These two aspects were major requirements for the development of the in-house code generator: (1) the generated code is strictly equivalent of a manually written code and (2) the impact of a local model modification has a local modification on the generated code (allowing performing efficient comparisons between two versions of generated code and thus simplifying the code review).

The long term availability of the specific SysML modelling tool remains also an issue which has been solved in two ways: First, the notions of data-flows diagrams and of finite state machines have been also defined in the textual DSL; second, the code generator has been designed in order that the generated code is equivalent to a manual code, meaning that it can be easily manually maintained. During the development phase of a project, the SysML modelling tool will thus be used to decrease the development cost. After some years (5 to 10 years), i.e. during the maintenance phase, this tool will be potentially not any more maintained by the tool provider; the code will then be automatically generated from the textual DSL generated from the SysML model. If it is decided to not maintain any more the in-house code generator, it will still be possible to maintain manually the generated code.

The Figure 8 shows this three phases of maintenance:

1. The SysML model and the DSL are both maintained. The code is automatically generated. A DSL corresponding to the SysML model is generated for backup.

Synthesis

The

Conclusion

Refining a system model to a software model and then to code remains an issue for critical system with a long duration: the tools are not maintained for the whole duration of the project and have generally a too large scope to generate code which can be manually maintained.

This paper has presented a solution taking benefit of the available modelling tools during the development, able to go smoothly from system functional definition to the code. This approach relies on the use of COTS (Commercial Of The Shelf) associated to DSL (Domain Specific Language) and in-house tools:

• The COTS tools are used to take benefit from mature and already widely deployed technologies • DSL and in-house tools are used to take into account the specificities of the field

The quality and the long term maintenance issues are tackled by a specific effort on the code generator: the generated code is strictly equivalent to a manual code, can be reviewed and manually maintained.

The next step of improvement will be the harmonization of toolsets between the functional analysis (for instance with the use of the MEGA tool [START_REF]MEGA tool[END_REF]), the system functional definition and the software (for instance with the Rhapsody tool [START_REF]Rhapsody tool[END_REF]) and the physical architecture (for instance with Capella ( [START_REF]Capella tool[END_REF]).

Figure 1 :Figure 2 :

 12 Figure 1: Functional data-flow architecture modelled in SysML IBD

Figure 4 :

 4 Figure 4: Multithreading modelling in SCADE

Figure 6 :

 6 Figure 6: Multithreading architecture described by a DSL On the example of Figure 6:• A major frame of 100 ms has been defined• F1 and F2 are executed at 10 Hz (on the thread T1)• F3 is executed at 20 Hz (on the thread T2)• F4 is executed at 10 Hz (one cycle among two on the thread T2)

Figure 7 :

 7 Figure 7: Code and configuration table automatic generation

  following table summarizes the advantages and drawbacks of different modelling approach.

	Approach	Finite State Machine	Functional view Data flow	Functional sequences	Multithreading view	Safety	Long term maintenance
	SCADE	Yes	Yes	At a low level of abstraction with finite state machine	No	Certified code generator	Rely on a proprietary tool
					Yes, but too
	AADL	Yes but textual	More service oriented	No	complex for an extended RMS	No certified code generator	Standard
					approach
					Yes, but too
	MARTE	See UML	See UML	See UML	complex for an extended RMS	No certified code generator	Standard
					approach
	SysML (alone)	Yes but asynchronous	Yes (IBD)	Yes, but not formal enough	No	No certified code generator	Standard
	UML	Yes, but asynchronous	No	Yes, but not formal enough	See MARTE	No certified code generator	Standard
						No certified code	Standard SysML
	SysML + DSL	Yes in SysML, with an adapted synchronous semantics	Yes in SysML (IBD) with an adapted synchronous and multithreading semantics	Yes in the DSL with the required synchronous semantics	Yes in the DSL, with an extended RMS approach	generator, but the automatically generated code is strictly equivalent to a manually	In-house tool The generated code can be manually
						written code	maintained
	ERTS 2016 -David Lesens -Airbus Defence and Space

ERTS 2016 -David Lesens -Airbus Defence and Space

The SysML model is not maintained any more. The initial DSL and the DSL previously generated from SysML are maintained. The code is automatically generated.

The code generator is not maintained any more. The software code is manually maintained.ERTS 2016 -David Lesens -Airbus Defence and Space