Dr V De Gennaro
email: degennar@cermes.enpc.fr

R Frank

Elasto-plastic analysis of the interface behaviour between granular media and structure

Keywords: soil-structure interface, elasto-plasticity, constitutive law, interface testing, modelling

It is well known that interfaces usually play a major role in the definition of the mechanical behaviour of engineering structures having interactions with the soil. In this paper the general framework of an elasto-plastic constitutive model developed on purpose for describing the interface behaviour is presented. The model is based on a Mohr-Coulomb failure criterion, including deviatoric hardening/softening, phase transformation state (compaction and dilatancy) and ultimate state. The choice of the constitutive parameters and their identification is first discussed. The predictions of the model are then presented and compared with available experimental data from various interface tests between sand and metal plates. The results of the numerical analyses emphasise the key role played by the volumetric behaviour of the interface (compaction and dilatancy), linked in some cases with the change in the normal stress acting on the structure surface and, consequently, controlling the shear resistance at the interface.

Introduction

The serviceability of a wide range of engineering structures involving interfacing between structural elements and soil is highly dependent on the behaviour of the layer of soil forming close to the structure surface. Interfacing between bodies of different stiffness is also encountered in rock mechanics in systems of jointed and faulted rocks. In this case the zone of fracture is generally filled by granular materials, that are often the results of previous degradations of block surfaces. This layer, commonly referred to as the "interface", acts as a transition zone between the stiffer structural element and the softer soil medium or between the two rock blocks as well. In general this transition zone is mainly strained in the tangential direction. However, in granular materials, the volumetric behaviour of this layer is often complex, leading to compaction as well as dilatancy with displacement in the normal direction.

Probably the first complete and systematic experimental investigation of the interface behaviour has been presented by Potyondy [START_REF] Potyondy | Skin friction between various soils and construction materials[END_REF]. In Potyondy's study experimental data are derived from tests performed with a modified direct shear box, obtained by replacing the half bottom part of the classical Casagrande direct shear box with a material simulating the structure. Various materials and different roughness have often been employed to highlight the factors controlling the interaction between the two media. This laboratory equipment (modified direct shear box) has been the object of several modifications, especially related to the possibility of reducing its principal deficiencies ([2] - [START_REF] Tabucanon | Interface tests to investigate pile skin friction in sands[END_REF]). In this respect it is worth noting that a wide range of increasingly sophisticated testing devices are available to date. Among others, let us quote: the pull out apparatus ( [START_REF] Brumund | Experimental study of static and dynamic friction between sand and typical construction materials[END_REF]), the ring torsion apparatus ( [START_REF] Yoshimi | A ring torsion apparatus for evaluating friction between soil and metal surface[END_REF], [START_REF] Boulon | Contribution à la mécanique des interfaces sol-structures. Application au frottement latéral des pieux[END_REF], [START_REF] Boutrif | Mesure du comportement d'interface sol-structure à la boîte de cisaillement direct annulaire et modélisation[END_REF]), the simple shear apparatus ( [START_REF] Uesugi | Influential factors of friction between steel and dry sands[END_REF]) and more recently the cyclic three-dimensional simple shear interface apparatus ( [START_REF] Fakharian | An automated apparatus for three-dimensional monotonic and cyclic testing of interfaces[END_REF]), and the ring simple shear apparatus ( [START_REF] Lerat | Etude de l'interface sol-structure dans les milieux granulaires à l'aide d'un nouvel appareil de cisaillement annulaire[END_REF], [START_REF] Lerat | Nouvel appareil de cisaillement annulaire pour l'étude des interfaces matériau granulaire-structure[END_REF]). One basic phenomenological aspect is however common to all the apparatuses for interface testing: the observable kinematic state variables required for the description of the interface behaviour are the relative displacements, rather than deformations like as for a standard continuum medium.

From a numerical viewpoint, a number of models have been presented recently for the description of the behaviour of interfaces. Most of them mainly concentrate on the behaviour of interfaces between granular soils and metal.

In a first class of models, on the basis of results concerning the modelling of rock joints, the material of the interface is supposed to be linear elastic, or non-linear with a stressdisplacement relationship of hyperbolic type in the normal and tangential directions ( [START_REF] Desai | Thin-layer element for interfaces and joints[END_REF]).

Hardening is not taken into account and the condition of failure, in terms of shear strength, is brought back to the traditional relation dictated by the Mohr-Coulomb failure criterion. More complex models, incorporating the concepts of dilatancy, compaction and damage, have been also proposed within this theoretical framework ( [START_REF] Patton | Multiple modes of shear failure in rock[END_REF] - [START_REF] Goodman | Duplication of dilatancy in analysis of jointed rocks[END_REF]).

A second class refers to the theory of elasto-plasticity. Formulations relate as well to the assumptions of a perfect plasticity as to those of an hardening material (inter alia: [START_REF] Desai | Thin-layer element for interfaces and joints[END_REF], [START_REF] Ghaboussi | Finite element for rock joints and interfaces[END_REF] - [START_REF] Shahrour | An elastoplastic constitutive relation for soil-structure interface under cyclic loading[END_REF]), permitting also the analysis of particular conditions such as cyclic loading and softening ( [START_REF] Aubry | A consitutive model fro cyclic behavior of interfaces with variable dilatancy[END_REF] - [START_REF] Leong | Finite element modelling of rock-socketed piles[END_REF]). Along with a new definition of the kinematic state variables, stresses are related to displacements, and the theoretical structure of these models remains identical to that of the majority of the elasto-plastic models suggested for the description of soil behaviour. Finally, also the use of polar continua ( [START_REF] Tejchman | Scale effect in pile model tests[END_REF]) and of directionally dependent rate type laws ( [START_REF] Boulon | Le comportement d'interface sol-structure: aspects expérimentaux et numériques[END_REF], [START_REF] Boulon | Simulation numérique 3D du frottement solinclusion en chambre d'étalonnage par équations intégrales aux frontières[END_REF]) has been attempted. Given the results of previous studies already published in the literature, the research presented herein addresses the possibility to model in a unified and simple way the behaviour of an interface subjected to monotonic loading using a purposely developed elasto-plastic constitutive model. The model has direct links with the Mohr-Coulomb failure criterion, includes deviatoric hardening/softening behaviour, and integrates the phase transformation state (concept of compaction-dilatancy). An original treatment of the ultimate state condition at large tangential displacements (parallel to the direction of shear) is proposed, allowing to account for the modification of the granular assembly structure during shear. The choice of the constitutive parameters and their identification is discussed. The potential of such an approach to describe the response of a real interface is assessed through the comparisons of model predictions with various laboratory interface test results performed either at constant normal stress or at constant volume.

The elasto-plastic stress-displacement law

Before starting the formulation of the elasto-plastic law adopted for the description of the behaviour of the granular soil-structure interfaces subjected to monotonic loading, the following assumptions and definitions are adopted:

1. The interface represents the remoulded zone of soil adjacent to the surface of the structural element. In granular materials, in absence of a direct measurement, the thickness "t" of this layer can be estimated as being a multiple of the average diameter D 50 of the grains with values ranging between 5 to 10 D 50 for a rough interface ( [START_REF] Hoteit | Contribution à l'étude du comportement d'interface sable-inclusion et application au frottement apparent[END_REF] - [START_REF] Zong-Ze | A study of deformation in the interface between soil and concrete[END_REF]).

2. The formulation will be limited to the two-dimensional case (case of problems in plane strain or having a symmetry of revolution). Following the general approach of incremental elasto-plasticity the kinematic state variables are the normal relative displacement of the interface, u n , and the tangential relative displacement of the interface, u t . The associated stress variables are the normal stress, σ n , and the shear stress, τ, parallel to the direction of the interface; Σ = (σ n , τ) T is the stress vector and U = (u n , u t ) T is the relative displacement vector.

3. Stresses and relative displacements are taken as positive in compression, and considered homogeneous within the interface layer. The soil is assumed to be dry, so that the analysis can be performed in terms of total as well as effective stresses.

In the following the general formulation briefly outlined, based on experimental evidence, will be applied to the specific problem of the soil-structure interface.

Elastic response

The elastic behaviour of the interface is given by the following linear relation:

⎥ ⎦ ⎤ ⎢ ⎣ ⎡ = = Σ t n e e e K 0 0 K ; dU d K K (1)
The K e is the matrix containing the stiffness of the interface in the normal (K n ) and tangential (K t ) directions, which might be considered dependent on the initial normal stress and the initial density. For instance, possible expressions are:

N ni t t N ni n n k K ; k K σ = σ = (2)
where k n , k t and N are three constitutive parameters of the model, σ ni is the initial normal stress acting on the interface. Note that this choice of the elastic stiffness matrix implies uncoupled behaviour of the interface in the normal and tangential directions.

Stresses: yield criterion and hardening/softening law

Experimental evidence show that during interface tests under various conditions (i.e. constant normal stress, constant volume, constant normal stiffness) the relationship between normal and shear stresses at failure is well approximated by the Mohr-Coulomb failure criterion.

Therefore, neglecting cohesion, the failure condition is given by:

n f n f f tan σ µ = σ δ = τ (3)
where δ f is the friction angle of the interface at failure and µ f = tan δ f is the coefficient of friction. In perfect analogy with granular soils, rough interfaces experience during loading (shear) progressive hardening behaviour and significant reduction in shear stiffness until failure is reached. Such a hardening phase could either tends to a plateau (loose interfaces) or evolves into strain-softening and then lean towards a final plateau corresponding to the ultimate state (dense interfaces).

A schematic sketch of such a response, in terms of evolution of the stress ratio µ = τ/σ n and normal displacements u n versus tangential displacements u t , is presented in Fig. 1. Continuous hardening, typical of loose interfaces, leads to a progressive mobilisation of the coefficient of friction µ, which increases until reaching the limit value µ f at failure. The latter coincides with the ultimate value µ r at large tangential displacements (ultimate state). In the case of a loose interface compaction is predominant (see u n L Fig. 1).

The hardening/softening response of the dense interface, on the other hand, corresponds to increasing values of the coefficient of friction µ, which grows towards µ p , and then decreases to the asymptotic ultimate value µ r corresponding to the coefficient of friction at constant volume (ultimate state). In the plane σ n -τ such an evolution of the stress state during hardening, in agreement with the frictional failure criterion (3), corresponds to a counterclockwise rotation of the locus τ = µσ n , starting from the initial position coinciding with the axis τ = 0, until the failure line (µ f = µ p ) defined by equation [START_REF] Desai | Cyclic testing and modelling of interfaces[END_REF]. The softening phase is well represented by a clockwise rotation of the same locus until the ultimate state (µ f = µ r ). For a loose interface, dilation is preponderant and appears at the beginning of the loading process (see u n D Fig. 1), after a reduced initial phase of compaction.

Consequently the yield mechanisms, whatever hardening or softening, are obtained by a generalisation of the Mohr-Coulomb failure criterion, as suggested by the deviatoric hardening concept ([30] - [START_REF] Bencheikh | Interaction sol-structure: modélisation et résolution numérique[END_REF]). The rotation of the yield surface in the σ n -τ stress plane due to deviatoric hardening/softening is assumed to be a function of the plastic tangential relative displacements p t u generated within the interface layer during shearing.

The yield surface F is governed by the standard Mohr-Coulomb failure criterion; the equation adopted is (see dot line Fig. 2):

0 ) u ( F n p t = σ µ - τ = (4)
In this equation ) u ( p t µ is the hardening/softening function, giving the evolution of the mobilised friction coefficient during loading.

Based on the schematic diagram shown in Fig. 1, for a loose interface in the hardening regime the function ) u ( p t µ is assumed of hyperbolic type; it can be defined explicitly as:

p t o ni p t o f o p t u t p A u ) ( ) u ( + ⎟ ⎟ ⎠ ⎞ ⎜ ⎜ ⎝ ⎛ σ µ - µ + µ = µ (5)
The plastic tangential relative displacement p t u is the hardening parameter of the model.

In equation ( 5) µ f is the coefficient of friction at failure, µ o = tan δ o is the friction coefficient delimiting the initial elastic region (δ o is the initial mobilised friction angle). Inside this wedge-shaped region (Fig. 2) only reversible relative displacements are permitted, given by inverting relation [START_REF] Potyondy | Skin friction between various soils and construction materials[END_REF]. The parameter t is the thickness of the interface layer, A is a parameter of the model governing the shape of the hardening fonction, σ ni is the initial normal stress acting on the interface, and p o is a reference pressure ensuring a dimensionless expression of equation [START_REF] Hoteit | Contribution à l'étude du comportement d'interface sable-inclusion et application au frottement apparent[END_REF]. We have assumed p o = 1 kPa in all our calculations. The introduction of t (thickness of the interface layer) into equation ( 5) allows to consider an internal length parameter for the interface. The ratio o ni p σ is introduced in order to take into account the effect of the initial normal stress σ ni on the shape of the curves of mobilised shear stress. Indeed, as for parameter A, a modification of this ratio via σ ni modifies the shape of the hardening function ) u ( p t µ (eq. ( 5)).

As already observed in Fig. 1 in the case of a dense interface, the initial hardening phase with increasing values of ) u ( p t µ

, after a peak of maximum mobilised friction at failure (µ f = µ p ), evolves into strain-softening until a final plateau corresponding to the ultimate state (µ f = µ r ).

Thus, in the softening regime it is assumed that the evolution of the yield surface is governed by the following equation:

( ) There is no doubt that many factors are at the origins of this phenomenon, for instance shear banding instability ( [START_REF] De Gennaro | A model for the behaviour of the soil-structure interface[END_REF]) or other various aspects that have been fully described elsewhere and will be not be investigated here ( [START_REF] Desai | Modelling of joints and interfaces using the disturbed-state concept[END_REF], [START_REF] Leong | Finite element modelling of rock-socketed piles[END_REF], [START_REF] Boulon | Rate-type elastoplastic approaches for soil-structure interface behaviour: a comparison[END_REF]).

p tf p t p tf p t o r f r p t u u and u u t A h sec ) ( ) u ( > ⎥ ⎦ ⎤ ⎢ ⎣ ⎡ - µ - µ + µ = µ (6)

Displacements: plastic potential and flow rule

Plastic relative displacements appear if the condition F = 0 and the condition of consistency dF = 0 are simultaneously fulfilled. Their magnitude and direction are given by the definition of the plastic potential function Q and of the flow rule. The pertinent choice of the plastic potential function, Q, is essential to reproduce the typical volumetric behaviour observed during interface tests (Fig. 1). Consequently, its expression should be suitable for the description of the following phenomena:

1) the presence of an initial compaction (du n >0) in a test with constant normal stress, or correspondingly a reduction of the stress σ n , normal to the interface layer, in a test with imposed constant volume or constant normal stiffness;

2) the existence of a threshold corresponding to the phase transformation from compaction (du n >0) to dilatancy (du n <0), which corresponds, in a test with imposed constant volume or constant stiffness, to an increase of the normal stress σ n ;

3) the stabilisation of the normal relative displacement u n , or the normal stress σ n , on an asymptotic value for large relative tangential displacements of the interface (i.e. du n = 0 or dσ n = 0). This corresponds to the salient features of the critical state theory, where constant volume conditions are assumed at failure.

Compaction (i.e. du n > 0 or dσ n < 0) due to grain crushing at very large tangential displacements and/or high normal stresses is not considered in the present version of the model.

In order to describe the above-mentioned phenomena (points (1) to ( 3)), non-associated elasto-plasticity has been assumed. The plastic potential function is:

⎟ ⎟ ⎠ ⎞ ⎜ ⎜ ⎝ ⎛ σ σ σ µ + τ = o n n c ln Q (7)
where the parameter µ c is the slope of the phase transformation line τ = µ c σ n and σ o is defined by the current state of stress acting on the interface. Taking into account equation [START_REF] Brumund | Experimental study of static and dynamic friction between sand and typical construction materials[END_REF], σ o can be expressed as:

⎟ ⎟ ⎠ ⎞ ⎜ ⎜ ⎝ ⎛ µ µ σ = σ c n o exp (8)
The plastic potential function introduced is analogous to the original formulation proposed by Schofield and Wroth [START_REF] Schofield | Critical state soil mechanics[END_REF] in the Cam Clay model. In this respect, it is worth mentioning that Nova [START_REF] Nova | On the hardening of soils[END_REF] first introduced in an elasto-plastic theoretical framework the modelling of the phase transformation state in soils, using the same form of the plastic potential. Typical plots of the function Q in the σ n -τ plane are presented in Fig. 2. This function describes a series of continuous surfaces which expand progressively during deformation, changing in size but not in shape (i.e. with the same derivatives on points having the same coefficient of mobilised friction). Differentiating equation ( 7) and rearranging using equation ( 8), the plastic increments of relative displacement are:

⎥ ⎦ ⎤ ⎢ ⎣ ⎡ µ - µ λ = ⎥ ⎦ ⎤ ⎢ ⎣ ⎡ 1 d du du c p t p n (9)
Thus compaction holds if µ < µ c ( p n du > 0) and dilatancy takes place if µ > µ c ( p n du < 0). The phase transformation state corresponds to the condition µ = µ c , as a result p n du = 0 (points A, B, C in Fig. 2). The dilatancy of the interface, D, is given by the following relation:

µ - µ = = c p t p n du du D (10)
It is worth noting that dilatancy at large relative tangential displacements is constant and tends towards the asymptotic value D = µ c -µ r (µ r = µ f in a loose interface). Therefore, ultimate zero rate of volumetric deformation of the interface at large tangential displacements, in agreement with experimental observations (i.e. ultimate state), cannot be reproduced if equation ( 7) is considered.

In order to introduce this further important feature of the volumetric behaviour of the interface, a modified form of the potential function is now proposed.

Behaviour at ultimate state

We examine now the conditions that allow to introduce the required zero dilatancy rate at the interface associated to the ultimate state. From equation ( 10) such a requirement is fulfilled if

u t → ∞ ⇒ D = (µ c -µ) → 0 (11)
In addition, at ultimate state, we also know that:

u t → ∞ ⇒ µ → µ r = tan δ r = constant ( 12
)
and µ r = µ f in the case of continuous hardening until ultimate state condition. From equations [START_REF] Fakharian | An automated apparatus for three-dimensional monotonic and cyclic testing of interfaces[END_REF] and ( 12) it can be deduced that:

u t → ∞ ⇒ D = (µ c -µ r ) → 0 ( 13
)
and condition ( 13) is fulfilled if

µ c → µ r (14)
Consequently, the condition of zero dilatancy at the interface at ultimate state can be obtained if the coefficient µ c , the stress ratio at phase transformation state, increases after phase transformation towards the final value µ r (i.e. towards the stress ratio at ultimate state).

Condition [START_REF] Desai | Thin-layer element for interfaces and joints[END_REF] corresponds to an evolution of the size of both compaction and dilation regions in Fig. 2. The mechanism is described in Fig. 3, on a typical stress path involving initial compaction, phase transformation and dilatancy (e.g. interface tests at constant volume), without taking into account for the time being softening behaviour (towards µ f = µ r ).

Following the indicated path, at point C, for a friction coefficient µ = µ co there is a transition from compaction (µ < µ co ) to dilatancy (µ > µ co ). At a generic point M, in the dilation region, two different potential surfaces are plotted. The first (Q' o ) is given by the family of functions in equation ( 7), admitting µ co constant. The second (Q 1 ) has been plotted admitting an increase of the coefficient µ c from the initial value µ co to µ c1 according to condition [START_REF] Desai | Thin-layer element for interfaces and joints[END_REF]. By comparing the direction of the plastic displacement vector at point M, it can be argued that dilatancy at the interface can be substantially reduced assuming Q 1 as the current potential function. The minimum value of dilatancy is obtained when the phase transformation surface τ = µ c1 σ n is close to the failure locus τ = µ f σ n , so that D = (µ c1 -µ f ) → 0 (condition (13) with µ r = µ f ). This is associated to a progressive shrinkage of the dilation region. If softening is expected (µ f = µ p ), after reaching the maximum value µ p , the coefficient of friction reduces to µ r while the dilation region slightly expands (Fig. 2). In this case the minimum value of dilatancy is obtained when the phase transformation surface is close to the ultimate locus τ = µ r σ n , so that D = (µ c1 -µ r ) → 0. Such a mechanism has a direct physical interpretation.

Yield of dense interface layers due to shearing causes plastic dilation, resulting in an increase of the voids in the sample (shrinkage of the dilation region). On the other hand, shearing on loose interface layers causes an opposite effect, leading to an overall compaction of the interface and a reduction of the void ratio (shrinkage of the compaction region).

It is noticed that, within the theoretical framework of the model, this is equivalent to a change in shape of the surfaces given by the plastic potential function Q (equation ( 7)), which is implicitly taken into account by allowing for an evolution of parameter µ c . It is then admitted that the parameter µ c in equation ( 7) is not a constant during deformation but is a function of plastic tangential displacement p t u (hardening parameter), so that:

) u ( p t c c µ = µ (15)
After that, the equation of plastic potential function can not be a function of the plastic displacement. However, in the specific case where the form of the yield surface is always linear (equation ( 4)) with the hardening/softening functions as in equations ( 5) and ( 6), the direction of plastic flow at any point of the stress space remains path-independent.

In order to reproduce the condition of shearing at constant volume at large tangential displacements (i.e. ultimate state), the following expression is proposed for the

parameter ) u ( p t c c µ = µ : ( ) ) u ( ) u ( p t co co p t c D µ - µ + µ = µ (16)
The rate of dilatancy at the interface is controlled by the function D( p t u ), defined as

⎥ ⎦ ⎤ ⎢ ⎣ ⎡ ⎟ ⎟ ⎠ ⎞ ⎜ ⎜ ⎝ ⎛ σ - = p t o ni p t u p t B h sec 1 ) u ( D ( 17
)
In equations ( 16) and ( 17 In the case of a dense interface dilation is predominant (see u n D in Fig. 4). The coefficient of friction µ first increases towards µ p and then decreases towards µ r (equations ( 5) and ( 6), hardening/softening response), while D(e) increases towards unity (equation ( 17)). Therefore equation ( 16) at ultimate state can be written: [START_REF] Ghaboussi | Finite element for rock joints and interfaces[END_REF] and on the basis of equation ( 11) D = 0.

µ = µ ) u ( p t c
In the case of a loose interface, compaction appears from the beginning of the loading process (see u n L in Fig. 4). The coefficient of friction µ increases progressively until the limit value µ r (equation ( 5)) and, as in the case of a dense interface, D( p t u ) increases towards the unity (equation ( 17)). Again, based on a similar discussion, condition ( 18) is fulfilled at large tangential displacements and D = 0. It must be noted that for a loose interface the value of L co µ (Fig. 4) is close to the limit value µ r . This leads to a reduced rate of mobilised dilatancy during shear and an overall compressive volumetric behaviour of the interface.

Identification of constitutive parameters of the model

As formulated the model requires fourteen parameters; these are: k n , k t , N, µ o , µ p , p tf u , µ r , µ co , A, A o , B, σ ni , t and p o . Eleven among the fourteen parameters mentioned need to be determined with a specific procedure. Indeed, the value of σ ni is given by the initial condition of the test (in terms of initial normal stress acting on the interface), the value of t (thickness of the interface layer) is assumed proportional to the value of the D 50 of the granular medium and p o is a reference pressure (assumed equal to 1 kPa in this work).

For the determination of the remaining eleven constitutive parameters one can use results of interface tests at constant normal stress or constant volume and, if available, the results of oedometric or isotropic compression tests. In the following, the methodology of parameters determination is briefly examined.

Elastic parameters: k n , k t and N

On the basis of relation ( 1), the normal and tangential stiffness of the interface depend on the values of parameters k n , k t and N. These relations are similar to existing empirical relationships proposed for the Young's modulus of granular materials. Both k n and k t are introduced in order to take into account the dependence of the stiffness on density, whereas the coefficient N allows to consider a possible dependence on the normal stress. If N = 0, the dependence on the normal stress is neglected, in this case k n and k t are directly the normal and tangential stiffness of the interface, respectively.

The value of parameter N is obtained through curve fitting of the values of the initial tangential stiffness plotted against the applied initial normal stresses σ ni . As it will be discussed later in this section, due to the difficulty in the estimation of K n , we have considered for N the usual value 0.55 obtained for the Young's modulus of silica sands (Fontainebleau sand) from triaxial tests on samples at various density ( [START_REF] Gennaro | Etude du comportement mécanique des interfaces sol-structure. Application à l'analyse du comportement des pieux[END_REF]).

The parameter k t is found knowing the initial slope of the curve of mobilised shear stress (τ)

versus tangential displacement (u t ) of the interface. Such a slope, corresponding to the ratio t u τ , is the value of the tangential stiffness K t . The determination of the initial slope is rather delicate and often imprecise. In practice, one can either consider a secant stiffness or, if available, the slope of the unloading branch of the shear stress versus tangential displacement curve. For instance, in the first case it can be assumed that:

to f t u K τ = ( 19
)
where u to is the tangential displacement when 2

f τ = τ
, τ f is the maximum shear strength and σ ni is the value of the initial normal stress acting on the interface. From equation (1) it can be deduced that:

N ni t t K k σ = (20)
The parameter k n depends on the compressibility of the interface. Its determination is thus possible from oedometric compression tests on the interface material. Obviously, this type of test is not easy to perform, because of the difficulty to reconstitute samples having small thickness at a given initial density. Moreover this determination is systematically biased by the effect of the remaining part of the undisturbed (not sheared) soil sample. Other factors, such as the density state, the normal stress level, the type of test (constant normal stress, constant volume) and the type of apparatus also affect the determination of interface normal stiffness. When appropriate, it is proposed to deduce k n from standard eodometric compression tests. Volume changes during oedometric compression are:

i i i h dh e 1 de v dv = + = (21)
where v i is initial specific volume, h i is the initial height of the sample and e i is the initial void ratio. In oedometric compression:

v v ' s d C v d σ σ - = (22)
where C' s is the swelling index giving the slope of the unloading branch of the vertical (normal) stress (σ v ) versus the specific volume change curve. Then, from equations ( 21) and ( 22):

( )

dh h C e 1 d i ' s i v v + σ - = σ (23)
Equation ( 23) allows to identify the normal stiffness of the interface, admitting that during the direct shear test the behaviour of the interface in the normal direction is of "oedometric type" with same elastic soil properties. We obtain:

( ) t C e 1 K ' s i ni n + σ = ( 24
)
where σ ni is the normal stress acting on the interface and t is the thickness of the interface. It

is then possible to evaluate k n N ni n n K k σ = ( 25
)

Plastic parameters: µ o , µ p , p tf υ , µ r and µ co

The value of the parameter µ o = tan δ o defines the extension of the initial elastic region of the interface, where δ o is the minimum friction angle mobilised at the interface (Fig. 2).

The parameters µ f and µ r are the coefficients of friction of the interface at peak and at ultimate state, respectively. Usually µ f = µ r in loose interfaces and µ f = µ p > µ r in dense interfaces.

They can be determined easily from interface tests at different constant normal stresses by linear interpolation of points (σ n , τ) at peak failure and at ultimate state. Their values correspond to the slope of the Mohr-Coulomb peak failure line (µ f ) and the ultimate linear envelope at ultimate state (µ r ), as shown in Fig. 2. It should be mentioned that, due to the amplification of dilation characteristics of granular materials at low imposed normal stress levels, such a determination could lead to a small underestimation of µ f .

As mentioned, the value of p tf u defines the position of peak shear resistance in the diagram u t -τ (Fig. 1) and is adjusted in order to have the best curve fitting. We emphasise that here the aim is not to give a criterion to detect the instability point corresponding to the peak shear resistance. For a first estimation of p are the shear stress and the tangential relative displacement at the peak of shear resistance, respectively (Fig. 1). Obviously, if no peak is present in the u t -τ curve (case of a loose interface, Fig. 1), p tf u value is assumed large enough to avoid the occurrence of the peak.

The parameter µ co is the coefficient of friction at the points of phase transformation (Fig. 2).

At these points, the rate of the normal relative displacement or the variation of the normal stress are zero (Figs. 3 and4). The value of µ co can be identified much easier from an interface test at constant volume: it can be determined at the point of inversion of the stress path in σ n -τ plane (point C in Fig. 3).

Parameters: A, A o and B

The parameter A appears in the expression of the hyperbolic hardening function [START_REF] Hoteit | Contribution à l'étude du comportement d'interface sable-inclusion et application au frottement apparent[END_REF]. It allows for the control of the shape of the curve of mobilised friction at the interface. Differentiating equation ( 4), it is possible to write:

( ) ( )

t p A ; u du d o ni 2 p t o f ni p t σ = β + β β µ - µ σ = τ ( 28
)
Where t is the thickness of the interface layer, assumed to be a multiple of the average grain diameter D 50 . The value of A can be obtained imposing the continuity of the value of the initial slope of the experimental curve (u t , τ) with the value of the analytical tangent p t du dτ given in equation ( 28), calculated when 0 u p t = . The initial slope of the experimental curve (u t , τ) is the tangential stiffness K t , so that ( )

t o f ni K = β µ - µ σ ( 29
)
As a result, the parameter A is applied before shearing. These tests show clearly the influence of the normal stress level on the behaviour of the interface, involving: higher values of maximum shear stress (Fig. 6a) and decreasing at the interface when σ ni increases (Fig. 6b)

The second set of experimental data examined are taken from the two interface tests presented by Tabucanon and Airey [START_REF] Tabucanon | Interface tests to investigate pile skin friction in sands[END_REF]. The tests were performed in a modified direct shear box on samples of siliceous Sidney sand and rough interface. This sand has physical characteristics similar to Fontainebleau sand (Table 1). Details of the experimental procedure can be found in Numerical computations of the interface tests on Fontainebleau sand have been performed

with the set of parameters determined from test SB3 at σ n = 100 kPa (Table 2). Other tests have been simulated just changing the initial conditions in terms of imposed normal stress σ ni .

The results of the simulations are also presented in Fig. 6. The comparison between the experimental results and simulations is satisfactory with regard to the evolution of the shear stress (τ) and the normal displacement (u n ) versus the tangential displacement of the interface (u t ). As it can be noted, there is a slight underestimation of the maximum peak shear stress predicted by the model for the tests carried out at low levels of normal stress. As evoked, this divergence between simulations and the experiments translates the effect of σ n on the value of µ p (i.e. non-linearity of Mohr-Coulomb failure line in the σ n -τ plane for low values of σ n ).

With regard to the evolution of the normal relative displacement (u n ) versus the tangential relative displacement (u t ), it can be observed that the transition from compaction to dilatancy reproduced by the model is more gradual than the observed experimental response. It should be mentioned, however, that the shapes of the experimental curves are rather singular. Indeed, where dilatancy appears (i.e. at low normal stress levels), the experimental results also show an extended initial phase where the change of normal relative displacement is zero (test SB1

with σ n = 25 kPa), or a very prolonged phase where the rate of normal relative displacement is zero (test SB2 with σ n = 50 kPa).

It is emphasised that the transition from compaction (test SB3, For the simulations of interface test on Sidney sand, the complete set of parameters used has been obtained from the experimental results of test A (Table 2). For such computations, due to the lack of experimental data, we have assumed k n = 2 k t . The comparison between the experimental results and simulations is presented in Fig. 7. The predictions are again satisfactory; as it is possible to observe, the softening phase present in test B is well captured by the numerical computations, as well as the response in terms of volumetric deformations due to the transition from a loose state to a dense state.

Test at constant volume

In order to check the model predictions on different stress path conditions, the results of interface tests at constant volume between Fontainebleau sand and rough metal plate (R n = 1) are now analysed. These tests have been carried out on a ring simple shear apparatus ( [START_REF] Lerat | Etude de l'interface sol-structure dans les milieux granulaires à l'aide d'un nouvel appareil de cisaillement annulaire[END_REF], [START_REF] Lerat | Nouvel appareil de cisaillement annulaire pour l'étude des interfaces matériau granulaire-structure[END_REF]). A detailed description of this apparatus, showing its advantages and its shortcomings can be found in the given references and is discussed by De Gennaro [START_REF] Gennaro | Etude du comportement mécanique des interfaces sol-structure. Application à l'analyse du comportement des pieux[END_REF]. In the ring simple shear apparatus the shear stress is applied to the internal surface of a thin-walled cylinder of granular material (Fontainebleau sand in this study) via a cylindrical inclusion subjected to torsion. Rigid steel platens at the top and the bottom of the soil sample allow to reproduce plane strains conditions, and a glass window, integrated into the bottom steel platen, allows for the visualisation of grain motion at the interface ( [START_REF] Zervos | Numerical investigation of granular interfaces kinematics[END_REF]). Therefore for these tests it has The numerical computations have been performed assuming the set of parameters given in Table 3, determined from the results of test CS1 at σ n = 100 kPa. The definition of this new set of parameters has been necessary although the same sand (Fontainebleau sand) has been used for both tests carried out with the ring simple shear apparatus and the modified direct shear box (Table 2). This is due to the dependency of the mechanical characteristics of the interface on the different boundary conditions imposed by the two testing devices.

It can be seen that the computed responses match quite well the observed experimental results (Fig. 7), although the computed restrained contractancy predicted by the model (local reduction of σ n ) for the higher levels of normal (radial) stress acting on the interface seems to be overestimated.

As a concluding remark, it should be mentioned that the difference between the thickness of the sand samples (100 mm) and the average grain size of the sand (0.2 mm) being quite large, the state of stress inside the sample can not be assumed to be rigorously homogeneous. As a consequence the mechanical response of the sample in terms of evolution of the external radial pressure should be considered in a qualitative way. As a matter of fact, it does not correspond to the real (local) behaviour of the interface in the normal (radial) direction. From a computational viewpoint it is believed that this is not of major trouble, in the sense that the right trends of the mechanical behaviour of the interface should be well captured by the model, which is the case.

Test at constant normal stiffness

The final set of interface tests considered in order to validate the capability of the model is the one presented recently by Fakharian and Evgin [START_REF] Fakharian | Elasto-plastic modelling of stress-path-dependent behaviour of interfaces[END_REF]. Tests were conducted on a Cyclic 3-Dimensional Simple Shear Interface (C3DSSI) apparatus between samples of medium Silica sand and steel plates having variable range of roughness. The only relevant physical characteristic reported by the authors is a D 50 of 0.6 mm (Table 1). Also in this case details of the experimental procedure can be found in the original reference. We have considered three 2), the values of the stiffness K n and K t which are those proposed by Fakharian and Evgin [START_REF] Fakharian | Elasto-plastic modelling of stress-path-dependent behaviour of interfaces[END_REF]. These parameters were consequently used to predict the results of tests Test 2 and Test 3 at constant normal stiffness of 400 kPa/m and 800 kPa/m, respectively. The results of the simulations presented in Fig. 9 seem to be qualitatively and quantitatively in agreement with the experimental results. This agreement is obviously good for the Test 1, which served for the parameter calibration.

Closure

This work addresses the description of the mechanical behaviour of granular soil-structure interfaces. To this purpose, the formulation of an elasto-plastic model able to describe the main features of the behaviour of the interface is proposed. The model allows for the description of the basic aspects identified in the interface tests, such as: hardening/softening mechanical response, phase transformation and ultimate state. It also includes the effect of the normal stress level on the mobilised dilatancy at the interface.

It is believed that the major advantages of the proposed constitutive law lie in the fact that:

1) parameters have a direct meaning and are relatively easy to found;

2) behaviour at ultimate state is introduced in a simple way, and reflect the relevant physical mechanisms involved (compaction and dilation).

With respect to point (1), the number of parameters of the model is somewhat limited and a methodology for their determination has been briefly outlined. Concerning point (2), as already discussed in section 2, the mechanism associated to the modelling of the interface behaviour at ultimate state is fully consistent with the choice of the plastic potential function and its evolution.

The validation of the proposed approach has been carried out on the experimental results of interface tests achieved by means of a modified direct shear box, a ring simple shear apparatus and a Cyclic 3-Dimensional Simple Shear apparatus (C3DSSI). However, other stress paths or boundary conditions could be considered in future works. The model provides satisfactory predictions of the behaviour of the interface for tests at imposed constant normal

TABLES AND FIGURE CAPTIONS

Tables and Figures

  Here three more parameters are introduced, namely: A o , µ r and p tf u . The parameters A o controls the shape of the softening function (6), µ r defines the ultimate friction coefficient of the interface at large tangential displacements, i.e. at constant volume or ultimate state. The value p tf u is related to the plastic tangential displacement at peak of maximum mobilised friction, and corresponds to the value of the hardening parameter p t u at failure. As a matter of fact the value of p tf u defines the position of the peak of shear resistance. It has to be mentioned that softening behaviour has been considered in this work only with a view of modelling simplicity.

  ), B is a constitutive parameter of the model, µ is the coefficient of friction mobilised during shearing, σ ni is the initial normal stress, t is the thickness of the interface and p o is the reference pressure. Again, the ratio o ni p σ is introduced in order to take into account the observed reduction in dilatancy at higher normal stresses. Obviously, at phase transformation µ = µ co , and equation (16) is thus written evolution of µ, µ c and dilatancy D = µ c -µ versus the hardening parameter p t u (plastic tangential displacement).

  the original reference. Both tests were carried out at constant normal stress σ n = 150 kPa; the authors considered two different densities, namely I D = 0.15 (e o = 0.790, test A) and I D = 0.96 (e o = 0.580, test B). As a consequence these tests allow to assess the influence of the material density on the mechanical response of the interface, as well as the capability of the model in reproducing it.

  Fig. 6b) to dilatancy (test SB1) is associated exclusively to the change in normal stress σ n . This behaviour is well depicted by the model via the ratio o ni p σ introduced in equation (17) in order to control the rate of dilatancy, which increases when σ ni decreases.

  been possible to estimate by direct visualisation the thickness of the interface layer, assumed equal to 10 D 50 (2 mm). The dimension of the annular sample are: 100 mm in height, 100 mm of inner radius, 200 mm of external radius. The sample is contained into a latex membrane and confined externally using a pressure-volume controller (GDS); the constant volume condition is obtained by a servo-mechanism allowing the control of the pressure of water injected or ejected as a function of the volume target (initial volume of the sample). Obviously this is a "global" constant volume condition, obtained all over the sample, and not restricted at the interface layer. Three test results ([36]) corresponding to initial external radial pressure of 100 kPa (test CS1), 200 kPa (test CS2) and 400 kPa (test CS3) are simulated. The sand samples tested have an initial density index I D of about 0.49 (e o = 0.743), and the normalised roughness of the surface of the cylinder is R n = 1.

  tests carried out between dense Silica sand (I D = 0.88) and rough steel plate. One test has been performed at constant normal stress σ n = 100 kPa (Test 1, Fig.9). The other two tests (Test 2 and Test 3) were conducted with the same initial conditions given in test Test 1 (σ n = 100 kPa, I D = 0.88), but imposing during the test a constant normal stiffness as a new boundary condition (i. e. dσ n /du n = K). The calibration of model parameters have been achieved using the results of the constant normal stress test Test 1 at σ n = 100 kPa (Table

Fig. 1 .Fig. 2 .Fig. 3 .Fig. 4 .Fig. 5 .Fig. 6 .Fig. 7 .Fig. 8 .

 12345678 Fig. 1. Typical mechanical response of the interface

Fig. 1 .Fig. 2 .Fig. 3 .Fig. 4 .uFig. 5 .Fig. 6 .Fig. 7 .Fig. 8 .Test 3 (

 123456783 Fig. 1. Typical mechanical response of the interface

Table 1 .

 1 Physical characteristics of the tested sands

Table 2 .

 2 Values of the constitutive parameters used for the numerical study of interface tests carried out on a modified direct shear box and C3DSSI apparatus at constant normal stress (N = 0.55, for Silica sand N = 0).

Table 3 .

 3 Values of the constitutive parameters used for the numerical study of interface test between Fontainebleau sand and rough metal plate carried out on a ring simple shear box at constant global volume (N = 0.55).

Table 1 .

 1 Physical characteristics of the tested sands

	Sand	γ dmin (kN/m 3 )	γ dmax (kN/m 3 )	γ s (kN/m 3 )	e max	e min	D 50 (mm)	C U
	Fontainebleau	13.8	17.2	26.7	0.94	0.54	0.23	1.78
	Sidney (1)	-	-	26.5	0.84	0.54	0.30	2
	Silica (2)	-	-	-	-	-	0.60	-
				(1) Tabucanon and Airey (1992), (2) Fakharian and Evgin (2000)

Table 2 .

 2 Values of the constitutive parameters used for the numerical study of interface tests carried out on a modified direct shear box and C3DSSI apparatus at constant normal stress (N = 0.55, for Silica sand N = 0).

	Sand	k n (m -1 )	k t (m -1 )	µ o	µ f	µ r	µ co	A	A o	B (m) u tf p (mm) t (mm)
	Fontainebleau 0.86x10 5 0.37x10 5	0	0.78	0.7	0.67 0.00045	4	0.05	1.4 10 -3	2
	Sidney	0.6x10 6	0.3x10 6	0	0.7#0.96 0.7	0.46 0.00011	20	0.08	4.7 10 -4	3
	Silica	6x10 6	1x10 6	0	0.81	0.6	0.49 0.00006	12	0.05	4.3 10 -4	6

Table 3 .

 3 Values of the constitutive parameters used for the numerical study of interface test between Fontainebleau sand and rough metal plate carried out on a ring simple shear box at constant volume (N = 0.55).

	Sand	k n (m -1 )	k t (m -1 )	µ o	µ f	µ r	µ co	A	A o	B (m) u tf p (mm)	t (mm)
	Fontainebleau 0.24x10 5 0.14x10 5	0	0.45 0.45 0.34	0.0003	-	0.08	5 10 -3	2

The parameters A o and B can be deduced following a procedure of optimisation by successive adjustments. A o controls the shape of the softening function in equation ( 6), B controls directly the shape of the evolution rule of the parameter µ c (equation ( 17)) and indirectly the rate of mobilisation of dilatancy at the interface (equation ( 10)).

Comparison between model predictions and experimental results

The validation of the proposed approach for interface modelling has been performed

considering three classes of tests on the interface: tests at constant normal stress, tests at constant volume and tests at constant normal stiffness. We present in the following the results of the comparison between model predictions and experimental results.

Test at constant normal stress

Two different sets of experimental results of direct shear tests on the interface have been considered in order to validate the model on a constant normal stress path.

The first set of experimental data ( [START_REF] Gennaro | Etude du comportement mécanique des interfaces sol-structure. Application à l'analyse du comportement des pieux[END_REF]) has been obtained performing interface tests in a modified direct shear box between a loose Fontainebleau sand and a rough metal plate (R n = 1 as defined in [START_REF] Uesugi | Influential factors of friction between steel and dry sands[END_REF]). The physical characteristics of this sand are summarised in Table 1. Loose

Acknowledgements

The authors would like to express grateful appreciation for the support offered by the European Commission Programme "ALERT Geomaterials". The precious collaboration of Dr. G. Bosco and Dr. A. Tarantino (University of Trento, Italy) is also acknowledged.


Emilie Balland

Pierre-Etienne Moreau

Antoine Reilles
email: .reilles@loria.fr

Antoine Moreau

ByteCode

In this paper, we present a term rewriting based library for manipulating Java bytecode. We define a mapping from bytecode programs to algebraic terms, and we use Tom, an extension of Java that adds pattern-matching facilities, to describe transformations. An originality of Tom is that it provides a powerful strategy language to express traversals over trees and to control how transformation rules are applied. To be even more expressive, we use CTL formulae as conditions and we show how their satisfiability can be ensured using the strategy formalism. Through small examples, we show how bytecode analysis and transformations can be defined in an elegant way. In particular, we outline the implementation of a ClassLoader parameterized by a security policy that restricts file access.

Motivations

Bytecode transformation is an example of a late code modification technique, targeting an executable program after compilation. Traditional late code modification systems suffer from lacking certain useful information available only to source code. However, Java classfiles keep symbolic information that makes this approach viable, and thus enables a wide range of transformations [START_REF] Lindholm | The Java Virtual Machine Specification[END_REF]. Bytecode transformations consist in adding or removing fields, methods, or constructors; changing the superclass, changing the types or signatures of fields or methods, redirecting method invocations to new targets (for example to call secured methods), and inserting new code into methods. This approach can be used to specify security properties or to adapt code to an embedded JVM.

There exist several libraries for manipulating Java bytecode, among them SERP [START_REF] White | Serp[END_REF], BCEL [1] and ASM [START_REF] Bruneton | ASM: a code manipulation tool to implement adaptable systems[END_REF] are the most well-known. Although they are powerful, a deep knowledge of the API may be needed to use them effectively. In this paper we propose to introduce an abstraction level, based on terms and rewriting, to make the definition of high-level transformations and analysis easier. Using the notion of algebraic view, we have extended the ASM library such that a bytecode program can be seen as a term. This gives us the possibility to directly express transformation rules without knowing the API, and thus to reduce the gap between the user's wishes and the language expressiveness. This approach can be considered similar to a domain specific language (DSL) for bytecode transformations.

In this article, we consider the language Tom, an extension which adds pattern matching and strategic programming primitives to existing languages such as Java, and we show how it can be extended to easily express bytecode transformations. Indeed, pattern-matching is directly related to the structure of objects and therefore is a very natural construct, commonly found in functional languages, to recognize a pattern and retrieve information. In addition, Tom provides a powerful strategy language that can be used to control rule applications. The separation of concerns between rules and strategies introduces well founded constructs and allows us to reason about transformations. This improves reusability, expressiveness, and thus helps to avoid introducing programming errors when implementing a complex transformation. These two features are particularly well-suited to describe transformations of structured entities like, for example trees, terms, or programs.

After presenting the Tom language and its connexion to ASM in Section 2, we show in Section 3 why it is apt to express bytecode analysis. In this section we consider a simple optimization example to outline our ideas. In particular, we introduce Tom strategies as a very elegant way to express temporal properties on the code of a method. In Section 4 we give an example of bytecode transformation that ensures a given security policy.

2 Java classes as terms of Tom language

Representing a Java bytecode program

The BCEL library has been introduced to modify Java bytecode programs. Given a class, it provides an object representation in memory. The ASM framework [START_REF] Bruneton | ASM: a code manipulation tool to implement adaptable systems[END_REF] is a similar tool, which uses a different model to avoid constructing the whole representation of the bytecode class in memory at once. ASM's design is based on an event-driven model and uses a visitor design pattern to avoid representing visited structures with objects. Visitors receive events for particular pieces of the structure from the event generator corresponding to the ClassReader class, which knows how to parse Java bytecode from existing classes and how to fire appropriate events to the underlying visitors.

In our setting, the notion of term is essential because this is the only datastructure that can be handled by a rewriting rule. For this reason, we developed Gom [START_REF] Reilles | Canonical abstract syntax trees[END_REF], a generator of typed tree structures. Given an algebraic signature, it generates a Java implementation that is efficient in time and space.

In order to represent bytecode programs, we have defined an algebraic signature that allows us to represent any bytecode program by a typed term. Given a Java class, we use ASM to read the content and build an algebraic representation of the complete Java class. This approach is similar to BCEL. This permits multi-pass or global analysis. However, by using hash-consing techniques, we obtain a data structure with maximal sharing, ensuring a minimal memory footprint.

For example, to represent a Java class as an algebraic term we have defined the following signature: The real signature contains more than 250 different constructors. Due to lack of space we cannot list them in detail. The given signature shows that a class is represented by a constructor Class, which contains information such as name, packages, and imports. It also contains a list of fields and a list of methods. The latter is encoded using an associative operator MethodList whose arity is not fixed. As illustrated below, it is used to model lists and will be useful to describe the search of one or several elements in the list. Similarly, a list of instructions is represented by the associative operator InstructionList. A method contains an info part and a code part. The code part is mainly composed by local variables and a list of instructions. Each bytecode instruction is represented by an algebraic constructor: Nop, Iload, etc.

Given this signature, Gom generates an efficient Java implementation (one class for each constructor) that allows us to represent and manipulate the representation of a Java class. As illustrated in Figure 1, given a Java class C, ASM is used to build an algebraic representation TC. Using the expressive rule based framework provided by Tom, this term can be rewritten into another one (TC'), which is later being dumped back to a new Java class C'.

Retrieving information by pattern-matching

Tom is a language extension that adds pattern matching primitives to existing imperative languages such as C and Java. Pattern matching is usually found in functional and logic languages, where it is used to analyse the composition of aggregated data, and express transformations of those structured data. The main originality of the Tom system is its language and data-structure independence [START_REF] Moreau | A Pattern Matching Compiler for Multiple Target Languages[END_REF]. From an implementation point of view, it is a compiler which accepts different host languages and whose compilation process consists in translating the matching constructs into the underlying native language. Since Gom generates Java implementations of terms, in the following, we consider Java as the host language.

On the practical side, Tom provides two interesting features: a "%match" construct to match objects and a "'" construct to build objects. The %match construct adds pattern matching facilities similar to functional languages. The action part is written in Java, providing flexibility. For example, considering the algebraic signature given previously, we can express the function that modifies the indexes of an Istore or an Iload in the following way:

Instruction updateIndex(Instruction i, int oldI, int newI) { %match(i) { Istore(x) -> { if('x==oldI) return 'Istore(newI); } Iload(x) -> { if('x==oldI) return 'Iload(newI); } } }
Note the use of "'" to build a new term such as Istore(newI) or to access a variable instantiated by pattern matching such as x. The "'" construct can be used anywhere a Java expression is allowed.

In addition to syntactic matching (a la ML), the language provides associative matching with neutral element (also known as list-matching). This is particularly useful to model the exploration of a search space and to perform list based transformations. For example, let us consider the statement t='InstructionList(Istore(3),Istore(2),Iload(3)); which builds the term representing a sequence of three bytecode instructions.

To illustrate the expressiveness of list-matching we will first define a function that checks whether an Istore is performed by a list of instructions. This can be expressed as follows:

boolean hasIstore(InstructionList l) { %match(l) { InstructionList(a*,Istore(index),b*)-> { return true; } } return false; } In this example, list variables annotated by a * are instantiated by a (possibly empty) list. Therefore, for the sequence t, Istore(index) will be found in first position, and the Java variable index will be instantiated by the integer 3. The variables a and b are respectively instantiated by the empty list InstructionList() and InstructionList(Istore(2),Iload(3)).

Non linearity can be used to search for a variable that is both stored and loaded:

boolean hasStoreAndLoad(InstructionList l) { %match(l) { InstructionList(_*,Istore(index),_*,Iload(index),_*)-> { return true; } } return false; } Note the multiple use of index to enforce that a found Iload corresponds to a previous Istore. Note also the use of _* to denote anonymous variables. When applied to t, the answer is

Bytecode Analysis and Transformation

As an example of transformation, we want to eliminate store instructions which are not necessary in a program. Considering the following bytecode program:

Istore(3);Istore(2);Iload(3);Istore(2);Iload(2)
We want to detect every store in the control flow graph such that there is no load instruction with the same index before another store. In the previous example, the first instruction Istore(2) can be removed.

In [START_REF] Lacey | Program Transformation using Temporal Logic Specifications[END_REF], D. Lacey has introduced an original method for describing transformations of programs based on rewriting and computational tree logic [START_REF] Clarke | Automatic verification of finite-state concurrent systems using temporal logic specifications[END_REF](CTL). This formalism inspired us to offer in Tom facilities to express CTL formulae on terms. In this section we will present the strategy language provided by Tom and show how any CTL formula can be translated into a strategy expression. The evaluation mechanism of the strategy language gives us a procedure to check that a CTL formula is true: an unfailing terminating strategy ensures that the CTL formula is true.

CTL logic for bytecode analysis

As well as usual logical operators like ¬ or ∧, CTL formulae can be composed of temporal operators. These operators are composed by one path operator followed by a state operator [START_REF] Huth | Logic in Computer Science: modelling and reasoning about systems[END_REF].

• Path operators state whether the formula φ should hold for all possible execution paths of the system (Aφ) or only for at least one execution path (Eφ). Those operators are specific to CTL.

• State operators come from LTL (linear temporal logic), and state facts about the future of paths:

• Xφ -Next: φ has to hold at the next state,

• Gφ -Globally: φ has to hold on the entire subsequent path,

• F φ -Finally: φ eventually has to hold (somewhere on the subsequent path),

• φU φ ′ -Until: φ has to hold until at some position φ ′ holds. This implies that φ ′ will be verified in the future.

For example, invariants in the code are represented by the CTL formula AG(p) where p is the predicate we want to be always verified. Fatality properties can be defined using the combination of A and F . For a method, we can for example verify that it always returns a result if it is not a void method. That means that if the predicate IsReturn verifies that an instruction is of type Return, the corresponding CTL formula is AF (IsReturn). Considering again our initial example, the search of unused stores can be translated into the formula IsStore(i) ∧ AX(AU (¬IsLoad (i), IsStore(i))) where IsLoad (i) is the predicate that is true if the current node of the control flow graph corresponds to a Load(i) (similar for IsStore(i)). This example shows that CTL formulae are an easy way to define bytecode analysis. We will explain how the Tom language is wellsuited for defining such specifications. Indeed, strategies can be clearly interpreted in term of CTL formulae.

From CTL formulae to Strategy expressions

In the rewriting community, the notion of strategy has been introduced to describe, in an elegant way, how to apply a set of rules. They add higher-order features to first-order term rewriting rules.

An elementary strategy can be either a transformation rule, the Identity(does nothing), or a Fail(always fails): they are the basic ingredients. In our system, an elementary strategy is type-preserving and is defined by extending a default strategy:

%strategy IntToDouble() extends Fail() { visit Instruction { Istore(i) -> { return 'Dstore(i); } Iload(i) -> { return 'Dload(i); } } }
An elementary strategy contains an implicit %match: when applied to a node of sort Instruction, a transformation is performed if a pattern matches the node. Otherwise, the default strategy is applied (Fail in the example).

On top of elementary strategies, more complex strategies can be built, involving basic combinators such as Sequence(s1,s2), Choice(s1,s2), All(s), One(s), etc. as presented in [START_REF] Visser | Building program optimizers with rewriting strategies[END_REF][START_REF] Visser | Visitor combination and traversal control[END_REF].

The basic combinators can be separated in two categories: the traversal combinators (All, One) and the control combinators (Sequence, Choice, Not,etc.).

• Traversal combinators describe how to rewrite in a direct subterm:

• When applied to a term f (t 1 , . . . , t n ), All(s) returns f (t ′ 1 , . . . , t ′ n ), where t ′ i corresponds to the application of s to t i . All(s) fails if it fails on at least one t i . • One(s) is similar to All(s) but s is applied to only one subterm t i . It fails if s cannot be applied on at least one subterm (i.e. it fails when applied to a constant).

• Control combinators describe how to compose different strategies, depending on their results:

• Sequence(s1,s2) denotes a sequential composition of s1 and s2: it fails if s1 or s2 fails, otherwise it results in the application of s2 on the result of s1. • Choice(s1,s2) denotes a left-to-right choice: if s1 succeeds, the result is returned, otherwise s2 is applied. • Not(s) performs Identity if s fails and fails otherwise.

• If(s1,s2,s3) starts by applying s1. If it succeeds, it returns s2, otherwise s3.

The result obtained with s1 is just used for the test as a conditional expression.

By combining elementary strategies and basic combinators, it becomes possible to define higher-level constructs. For example, the fix-point operator can be expressed by Repeat(s) △ = µx.Choice(Sequence(s,x),Identity()), where µ denotes a recursion operator (similar to rec in ML), x a variable, and s a parameter of the strategy. This strategy will apply the strategy s repeatedly until it fails, and then return the last result obtained before failure, thus Repeat will never fail.

Verification of CTL formulae by Strategies

In CTL there is a minimal set of operators. All CTL formulae can be transformed to use only those operators. One minimal set of operators is {false, ∨, ¬, EG, EU, EX}. Other operators can be defined with this set:

EF φ = ¬EU (true, ¬φ) AXφ = ¬EX(¬φ) AGφ = ¬EF (¬φ) AF φ = ¬EG(¬φ) AU (φ 1 , φ 2 ) = ¬EU (¬φ 1 , ¬(φ 1 ∨ φ 2 )) ∨ EG(¬φ)
The classical strategy operators can be combined in an interesting way to obtain temporal strategy aliases. The main idea is to represent a predicate p as a basic strategy s (defined by a %strategy) and the CTL operators by strategy aliases. Instead of using a model-checker like SPIN to verify a temporal formula on the method code, a specific strategy is applied to the list of instructions. If the visit fails, the formula is false. Otherwise, it is considered as true.

The boolean values false and true are represented by the strategies Fail and Identity. If we only consider the minimal set of operators, they can be defined using Tom strategy combinators. We consider the interpretation function from formulae to strategies defined as follows:

/* Use storeNotUsed to remove unused stores in ins */ 'BottomUp(If(storeNotUsed,Remove(),Identity())).visit(ins);

where ins is a variable of type InstructionList and BottomUp is a traversal from leaves to root.

This traversal can be defined as Bot-tomUp(s) △ = µx.Sequence(All(x),s). The execution of this code will remove all unused store instructions due to the elementary strategy Remove() that removes the first instruction of the list. You can notice that storeNotUsed is not defined as an elementary strategy (construction %strategy) but by composition.

Simulation of control flow by Strategies

Up to now, we have just defined traversals on the list of instructions without considering the control flow. Obviously, the use of strategies as temporal formulae is only interesting in a control flow context. A first idea is to construct explicitly the control flow graph from the list of instructions but the memory cost in case of complex methods cannot be disregarded. Our suggestion is to use strategies in order to simulate the control flow during the traversal of the list of instructions. In this way, a memory representation of the control flow graph is not necessary. In a list of instructions, the control transits from an instruction to the following in the list and we do not care of Goto instructions or possible exceptions that can disturb the control flow.

In the Tom language, the rules and the control are completely separated so an alternative for representing control flow graphs (CFG) is to use the control to indicate what is the possible following instruction. We have seen in the previous section that to apply a strategy to children, there exist two generic congruence operators All and One. We can redefine these two combinators such that they behave as if the children were the following instructions in the CFG.

For example, suppose we have the following Java code, and the corresponding bytecode:

int i = 0; while (i < 100) { i++; } 0 Iconst_0() 1 Istore_1() 2 Goto(8) 5 Iinc(1,1) 8 Iload_1() 9 Bipush(100) 11 If_icmplt(5)
The All strategy is adapted for a CFG run, the full definition is given in Figure 3. For example, the Goto instruction has one child with respect to the control flow graph (the instruction corresponding to the label). An If_XX instruction has two children: the one which satisfies the expression, and the one that does not. Figure 2 corresponds to the traversal of the bytecode program above.

This strategy is parameterized by a map that associates to every label the sublist of instructions that starts with the labelled instruction. To simplify, we do not consider in the definition of the All the case for exception handling, but it is resolved in a similar way. It can be interesting in the future to use this formalism to associate to every bytecode instruction the corresponding frame with the meaning of the current state.

Secure class loading by bytecode rewriting

In this section, we present an application of bytecode rewriting for secure class loading by redirecting method invocations to new targets. In particular, we will enforce the use of a safe API for file accesses. The use of defensive class loading instead of defensive virtual machine is argued in [START_REF] Rudys | Enforcing Java Run-Time Properties Using Bytecode Rewriting[END_REF]. This is done by defining a ClassLoader, which will automatically verify whether the code of the class to load contains unsafe pieces of code (in our example we are looking for statements like new FileReader(nameFile).read() and replace them by a call to a secure method).

The core of our program is the class SecureClassLoader which is a subclass of the standard Java ClassLoader. The variables before* and after* are instantiated by a list of instructions. The terms between the variable-stars (New(...), Dup(),. . . ) are the Gom terms corresponding to bytecode representation of the new FileReader(nameFile).read() is loadclass. Our transformation is applied to the bytecode before the standard ClassLoader defineClass method is called, which converts an array of bytes into an instance of a class: public synchronized Class loadClass(String name) throws ClassNotFoundException { byte[] scode = transform(name); Class sClass = defineClass(name,scode, 0, scode.length); return loadClass(name,true); } Using this class loader, we can make sure no class using the unchecked file access method can be loaded, but instead will be transformed at load time to use the safe wrapper class. For simplicity sake, we have only presented the search of the new FileReader(nameFile).read() pattern. Analysing the control flow graph is necessary to find the creation of a FileReader followed by a call to the method read().

Conclusion

We have presented a library that enables bytecode transformations by strategic rewriting. This library allows us to view a Java class as an algebraic term, formed by the tree representation of the bytecode. Transformations can then be described as rewriting rules, using strategies to control their application and explore bytecode expressions.

Moreover, we have demonstrated how those strategies can be used to examine the control flow graph of a method. A particularity of this technique is that it is not necessary to build the control flow graph in memory in order to traverse it. We then show that it is possible to encode the verification of temporal logic conditions over this control flow graph using strategy operators.

Finally, we illustrate the use of this library in the context of defensive execution of classes. We define a specific class loader that redirects classic I/O functions to a safe API to access files. The class loader uses bytecode rewriting to ensure only secured classes are loaded in the JVM. This transformation is defined in an abstract and concise way, thus leading to improve the confidence we can place in the code, by reducing the gap between the transformation to describe and the actual code.

This work is a first attempt to express bytecode transformations with a more abstract approach. A next step will be to better integrate the definition of rewrite rules conditionned by temporal properties [START_REF] Lacey | Program Transformation using Temporal Logic Specifications[END_REF] in the language, and apply these techniques to program analysis.

module

  Bytecode imports int long float double String abstract syntax TClass = Class(info:TClassInfo, fields:TFieldList, methods:TMethodList) ... TMethodList = MethodList(TMethod*) TMethod = Method(info:TMethodInfo, code:TMethodCode) TMethodCode = MethodCode(instructions:TInstructionList, localVariables:TLocalVariableList, tryCatchBlocks:TTryCatchBlockList) ... TInstructionList = InstructionList(TInstruction*) TInstruction = Nop() | Iload(var:int) | Ifeq(label:TLabel) | Invokevirtual(owner:String, name:String, methodDesc:TMethodDescriptor) ...

Fig. 1 .

 1 Fig. 1. Bytecode transformations in Tom

  This class contains Tom code. Like in previous examples, we define a strategy containing transformation rules:

	%strategy FindFileAccess() extends Identity() {
	visit TInstructionList {
	/* match new FileReader(nameFile).read() */
	InstructionList(before*,
	New("java/io/FileReader"),
	Dup(),
	Aload(number),
	Invokespecial[owner="java/io/FileReader",name="<init>"],
	Invokevirtual[owner="java/io/FileReader",name="read"],
	Pop(),
	after*) -> {
	/* replace it with new SecureAccess(nameFile).sread() */
	return
	'InstructionList(before*,
	New("SecureAccess"),
	Dup(),
	Aload(number),
	Invokespecial("SecureAccess","<init>"),
	Invokevirtual("SecureAccess","sread"),
	Pop(),
	after*);
	}
	}
	}

Acknowledgments: We sincerely thank Jeremie Delaitre for the initial development of bytecode rewriting in Tom and Pauline Kouzmenko for her work on the secure loading. We also would like to thank the anonymous referees for their valuable remarks and suggestions.

EX(p) ≡ One( p )

In the example of unused store search in Section 3.1, three predicates were used. For each, a basic strategy can be defined using the construction %strategy of Tom. To represent indexes, strategies cannot directly be parameterized by an Integer because integers are immutable and we need to modify its value during the traversal. A solution consists in using an Integer wrapper.

IsLoad(w) succeeds only if the term visited is of type Load and when its index is equal to the index of wrapper w.

%strategy IsLoad(w:

In this example, @ corresponds to an annotation mechanism for keeping a reference to a matched subterm. Here, the variable c is instantiated with the redex and used in the right hand side part.

The code of IsStore(w) is similar to IsLoad(w). IsStore(w) succeeds only if the term visited is of type Store and if its index is equal to the index of the wrapper w. IndexStore(w) succeeds only if the term visited is of type Store and set the corresponding index in the wrapper w.

%strategy IndexStore(w:

We can now define our analysis with the following composed strategy: This rule obviously does not capture all semantically equivalent sequences, as for example when the instantiation of the FileReader and the call to read are separated by some code. Such a situation could be handled by the search of a read call following the control flow using the EF strategy.

Using Tom list-matching, we apply this strategy for all the methods of the given class:

public TClass fileAccessVerify(TClass aclass) { TMethodList methods = aclass.getmethods(); TMethodList secureMethods = 'MethodList(); %match(methods) { MethodList(_*, x, _*) -> { TInstructionList ins = 'x.getcode().getinstructions(); TInstructionList secureInstList = 'TopDown(FindFileAccess()).apply(ins); TMethodCode secureCode = 'x.getcode().setinstructions(secureInstList); TMethod secureMethod = 'x.setcode(secureCode); secureMethods = 'MethodList(secureMethods*,secureMethod); } } return aclass.setmethods(secureMethods); }

The getmethods and setmethods methods are defined in the Tom library and are used to get and set methods for a given TClass. Similarly getcode and setcode, applied to a term of sort TMethod, get and set code, while getinstruction and setinstruction, applied to a term of sort TMethodCode, get and set code instructions. TopDown is a high-level strategy which traverses a term starting from the root, and is defined using a combination of the elementary strategies described in Section 3 as TopDown(s) △ = µx.Sequence(s,All(x)). The method fileAccessVerify will be called by the transform method: This method illustrates the transformation process described in Figure 1. After getting the Gom term of type TClass from the class file given as parameter, we apply the transformation using BytecodeReader and return the array of bytes corresponding to the transformed class, generated by BytecodeGenerator.

In our custom class loader SecureClassLoader, the only method we redefine