Rachel Levy Lereps
email: rachel.levy@iut-tlse3.fr

Damien Talbot
email: damien.talbot@u-bordeaux4.fr

Control by Proximity: Evidence from the "Aerospace Valley" Competitiveness Cluster

Keywords: Proximities, controls, clusters, collaborative R&D projects, aerospace industry. JEL classification: L14, L62, R38, R58

This article is concerned with the links that exist between control of interorganisational relationships and effects of proximity. We propose a theoretical framework which explains how geographical and organisational proximities reinforce formal and informal control mechanisms. This framework is then used to analyse mechanisms of control by proximity in a French aerospace cluster. We observe that formal and informal control is concentrated in a small number of groups located near the majority of the establishments members of the cluster. We also show that informal control mechanisms require a stronger geographical proximity than formal control mechanisms in order to operate.

Introduction

Approaches dealing with the control of relationships between organisations and with the role of proximity in the dynamics of interactions between organisations still appear to remain separate from one other. They have, nevertheless, numerous points in common. Work on control of relationships throws light on the necessity of controlling the risks inherent in any relationship in order to ensure its durability. The proximity approach on the other hand tries to determine the conditions which exist at the inception or the reinforcement of a relationship.

The sharing of standards, beliefs and values is a control mechanism (e.g. [START_REF] Ouchi | A conceptual framework for the design of organizational control mechanisms[END_REF][START_REF] Das | Trust, Control, and Risk in Strategic Alliances: An Integrated Framework[END_REF], whereas proximity-orientated authors insist on the sharing of a common cognitive framework as a pre-requisite for any coordination (e.g. [START_REF]Proximity and localization[END_REF][START_REF] Boschma R | Proximity and innovation. A critical assessment[END_REF]CARRINCAZEAUX et al., 2008a;RYCHEN and ZIMMERMANN, 2008). On the one hand, trust is perceived as an instrument of control [START_REF] Dekker | Control of inter-organizational relationships: evidence on appropriation concerns and coordination requirements[END_REF], on the other, as an essential ingredient of proximity (DUPUY and TORRE, 2004). The particular objective of control is to orientate interactions, which are themselves largely fashioned by their social and geographical integration as shown by the proximity-orientated analysis.

These common points suggest that a convergence of the two strands of research could be fruitful. For example, the question of the possible influence of geographical proximity on inter-organisational control mechanisms has yet to be posed: in other words, does geographical proximity favour control over a partner? More generally, this line of questioning can be extended to the non-spatial dimension of proximity, to investigate the role of proximity, in all its dimensions, in control mechanisms. The principal objective of this work is to respond to this question and to construct, in an original way, a theoretical framework allowing an understanding of control mechanisms in terms of proximity. This question of the link between control and proximity is particularly pertinent in the case of cooperation between organisations operating in the same locality where the aim is innovation.

The theoretical framework will thus be used to analyse the case of collaborative Research and Development (R&D) projects undertaken within clusters set up in France and known as competitiveness clusters 1 . Centres for the creation and exchange of knowledge, the relationships within clusters are often studied from the point of view of sharing and of the necessary recombination of complementary knowledge, linking innovation and proximity with the objective of learning by the partners from one another. Now, this link between innovation and proximity must also be examined in terms of the control exercised by one partner on another: in effect, the control of a relationship which necessitates the exchange of existing knowledge in order to produce new, common knowledge is a condition sine qua non of its durability. Particularly sensitive to opportunist behaviour, the process of joint innovation and the sharing of the results of such innovation must be controlled, the different types of proximity playing a role in this control and in the probability of the success of the innovation.

We propose to study the Aerospace Valley cluster, located in the southwest of France, specialising in aerospace activities. Like all competitiveness clusters, its objective is to favour collective innovation between co-localised partners by profiting from the positive effects of proximity. To do this, it gives financial support to collaborative R&D projects between close partners. Now, these projects are characterised by the significant domination, and thus control, by big industrial groups. More precisely, we evaluate the different forms of control and of proximity within different Strategic Business Units (SBUs) of this cluster using in particular the methodology of analysis of social networks.

This study is presented in three parts. In the first part, we present our theoretical framework, describing mechanisms of control by proximity. In the second part, we present our empirical and methodological choices. Finally, we present and discuss our principal results in the third part.

1 Theoretical framework: control by proximity

We present successively the principal mechanisms of the two categories of control which are traditionally distinguished, next we characterise the dimensions of proximity and finally we suggest how these approaches articulate with one another by defining control by proximity.

Controls: definitions and mechanisms

There are at least two major categories of reasons to explain the failure of a relationship between two organisations: opportunist behaviour by the partners and/or a lack of coordination [START_REF] Dekker | Control of inter-organizational relationships: evidence on appropriation concerns and coordination requirements[END_REF]. Control of the relationship thus aims to prevent such failure and, more generally, to reduce the risks and the costs inherent in any relationship based on an exchange. From a behavioural point of view, control becomes a particular type of relationship through which an individual or an organisation influences the action of another individual or organisation to the benefit of the former [START_REF] Nogatchewsky | L'exercice du control dans la relation client-fournisseur[END_REF]. By dissuading opportunist behaviour and by maintaining the convergence between actions, control helps organisations to achieve their objectives [START_REF] Kirsch | The Management of Complex Tasks in Organizations: Controlling the Systems Development Process[END_REF].

The question of the control of an inter-organisational relationship, the case which concerns us here, is approached in the literature from different angles: shared control [START_REF] Arend R | Implications for Including Shared Strategic Control in Multi-party relationship Models[END_REF],strategic alliances [START_REF] Das | Trust, Control, and Risk in Strategic Alliances: An Integrated Framework[END_REF][START_REF] Dekker | Control of inter-organizational relationships: evidence on appropriation concerns and coordination requirements[END_REF], networks [START_REF] Kajuter | Open-book accounting in networks. Potential achievements and reasons for failures[END_REF]KULMALA, 2005), joint-ventures (CHALOS and[START_REF] Chalos | Determinants of the use of various control mechanisms in US-Chinese joint ventures[END_REF][START_REF] Kamminga | Management control patterns in joint venture relationships: a model and an exploratory study[END_REF], control of the supply chain (DONADA and NOGACHEWSKY, 2006;[START_REF] Mudambi R | Location, control and innovation in knowledge-intensive industries[END_REF], etc 2 . The majority of these studies distinguish two complementary types of control: formal and informal. Formal control is based on contractual engagements between partners and on objectifiable, explicit mechanisms. The sanctions applicable in the case of inappropriate behaviour are essentially legal. It aims:

-firstly, to control results with the help of various highly codified mechanisms. These control mechanisms may be ex ante or ex post in relation to the objective of the control [START_REF] Dekker | Control of inter-organizational relationships: evidence on appropriation concerns and coordination requirements[END_REF]. Ex ante, includes, for example, the establishment of objectives which clarify the expectations of the partners. Ex post, the disparity between actual and expected performance is measured using evaluation systems drawn, for example, from management control (CAKER, 2008); -secondly, to orientate behaviour via standardised ex ante procedures specifying expected behaviour, schedules, rules. The conformity of these behaviours in relation to these same procedure and rules [START_REF] Ouchi | A conceptual framework for the design of organizational control mechanisms[END_REF] is then evaluated ex post.

Formal control supposes that the results are easily measurable and the behaviours relatively programmable. If this is not the case, one can associate with it informal control founded essentially on tacit mechanisms, that is to say self-regulation dependent on the psychological and social characteristics of those who draw them up [START_REF] Grosseti | Interacting individuals and organizations: a case study on co-operations between firms and research laboratories[END_REF]. In the case of inappropriate behaviour, the sanctions tend to be moral. Trust 3 proves to be a particularly efficient informal control instrument in inter-organisational relationships [START_REF] Dekker | Control of inter-organizational relationships: evidence on appropriation concerns and coordination requirements[END_REF]. Ex ante, this informal control mechanism allows the user to select a partner in terms of its supposed capacity to satisfy common interests and of the skills which it can deploy, in other words, its reputation. Ex post, it emerges over time with repeated and successful interactions (achievement of objectives, resolution of problems, loyalty, etc.) but also because each partner becomes more familiar with the skills and expectations of the other.

Formal and informal control are related by links of a complementary nature. Whereas formal control reduces the motivation to adopt opportunist, or simply less effective, behaviour, trust reduces, in a complementary fashion, the fear that such behaviour will arise in the first place [START_REF] Das | Trust, Control, and Risk in Strategic Alliances: An Integrated Framework[END_REF]. [START_REF] Bornarel | Relations de confiance and renforcement du contrôle[END_REF] notes that trust curbs opportunist behaviour without resorting to formal mechanisms because loss of such trust carries a high cost.

Resorting to trust would appear to be more justified in very uncertain situations with strong interdependence: when formal control of behaviour and results are limited, trust becomes an informal, implicit means of ensuring control. Furthermore, excessive use of formal control can destroy any trust that may have built up during interactions, thus giving the impression that one partner distrusts the other [START_REF] Das | Between trust and control: developing confidence in partner cooperation alliances[END_REF].

Above and beyond trust, the convergence of interests and the sharing of standards, beliefs and values within a social group are also strong informal control mechanisms, phenomena called "clan control" by [START_REF] Ouchi | A conceptual framework for the design of organizational control mechanisms[END_REF]. The author is referring here to the social pressure which is exerted on each member of an organisation and which orientates his behaviour in favour of the interests of the group and in accordance with its common values. Respect for the rules is rewarded by the fact of belonging to a community whose members have been selected [START_REF] Kirsch | The Management of Complex Tasks in Organizations: Controlling the Systems Development Process[END_REF].

Once set up, control mechanisms allow the process of social interactions to get under way, which in turn nourishes the trust between the partners thus becoming self-reinforcing. The control mechanisms are no longer regarded as a curb on interactions; on the contrary they play a strategic role in their perpetuation, securing exchanges of information and of knowledge and the learning processes necessary, for example, for collective innovation. Next we question whether these two forms of control are exercised by the same actors and whether proximity has an impact on the exercise of these two forms of control.

Proximity: definitions and mechanisms

The proximity approach starts from the principle that geographical location and the position in a network of interactions condition the economic activities of organisations, in the sense that the characteristics of social and geographical integration have for vocation "the conditioning of the probability of the emergence of a relationship or of the reinforcement or weakening of an existing relationship" (PECQUEUR and ZIMMERMANN, 2004, p. 20).

The approach aims to determine what conditions are necessary for the emergence and/or the reinforcement of a relationship.

According to this approach, a participant in a network is present both "here and elsewhere".

Here because it is located in a geographical space within which it has "neighbourly" relationships, elsewhere because the participant obviously has long-distance relationships with other participants. It is true that one can be "close" to someone while being geographically remote from them: proximity then presents, besides the geographical dimension, a non-geographical dimension allowing one to pose at the same time the question of location and of organisation. Even if the number of dimensions distinguished may vary according to the author, all agree that there is a seminal distinction between geographical and non-geographical dimensions of proximity (CARRINCAZEAUX et al., 2008b). This is the case in France where the debate concerning the different forms of proximity has crystallised around the question of whether it is necessary to conserve a distinction between institutional proximity and organisational proximity, alongside geographical proximity. In our case, proximity will be understood as an institutional fact presenting two dimensions, geographical and organisational (TALBOT, 2010). In the same way, whatever the theoretical position adopted concerning the different forms of proximity, all the authors of the "proximity school" agree that in the majority of cases proximity favours the emergence and the development of innovation: "The more proximity between actors (in whatever form), the more they interact, the more they learn to innovate" (BOSCHMA, 2005, p. 15).

Geographical proximity

Geographical proximity tackles the question of the conditions of localisation of activities [START_REF] Pecqueur | Introduction. Les fondements d'une économie de proximités[END_REF]. It is not the inverse of the metric distance.

Distance, which leads one to think of separation, is a quantitative expression of the relationship between two objects and/or two individuals. Proximity is a qualitative judgement, necessarily subjective and difficult to measure, of a small geographical distance. Qualitative, it becomes a unit of social measurement with two fundamental values: "to be close to", "to be far from", constituting the extremities of a single continuum [START_REF]Proximity and localization[END_REF].

Through its effects geographical proximity favours the emergence and/or the reinforcement of a relationship in at least two ways. In the first place, geographical proximity facilitates faceto-face interactions, which themselves facilitate the exchange of knowledge, particularly of tacit knowledge [START_REF] Polanyi | The tacit dimension, Edition Library of Congress[END_REF][START_REF] Gertler | Tacit knowledge and the economic geography of context, or the tacitness of being (there)[END_REF]. We come back to the classical idea according to which physical space is structured by transport and telecommunication infrastructures. It then constitutes a physical framework favouring the circulation of information, of physical goods and of individuals and facilitating face-to-face interactions. In the case of permanent geographical proximity, it is possible to organise face-to-face interaction at very short notice. Sometimes the need for geographical proximity can vary over the period of the interactions. This need may be intense in order to start the relationship and/or during the first phases of learning between actors who are innovating together: in this case it may be satisfied by the mobility of the actors in order to enable the face to face interactions which at certain moments remain essential. This need for temporary geographical proximity may be satisfied in various places: the company of course (meetings, technical platform teams) but also in temporary clusters (salons, conferences). TORRE (2008) thus insists on the importance of not confusing a need for geographical proximity with permanent co-location.

Secondly space constitutes a cognitive reference. All the participants live within groups situated in the same geographical space and associate values, perceptions, customs, lifestyles, a history, a name, physical and administrative boundaries, a memory of previous co-ordinated actions (successful or otherwise), conflicts, etc., with a geographical area. Thus the place participates in the process of construction -or of destruction -of identities inasmuch as it is a component of the relationship to others since the local participants make it exist in the eyes of others. It is then at the origin of a sense of belonging: claiming to come from a particular place equates, by association, to claiming to come from a particular social group [START_REF] Giddens | The Constitution of Society[END_REF]. Space becomes a more or less important ingredient of collective action, inasmuch as it permits or inhibits coordination.

However, the fact of feeling geographically "close" should not be interpreted as an assurance that a relationship is necessarily established between the participants, even if it opens the way.

It simply means that the existence of a strong geographical proximity between participants is not neutral: it makes the possibility of a relationship more likely, it is a resource that is still latent.

Geographical proximity only plays a role in terms of its articulation with a proximity of an organisational nature, which it supports, reinforces, compensates, or destroys by proving to be a source of conflicts.

Organisational proximity

Organisational proximity is deployed between individuals or between. It is built over a short social distance, in the same way as geographical proximity is built over a short physical distance. Social distance refers to the attributes of the participants in terms of cognitive and material resources, their age, their sex, etc., in fact the whole set of objective criteria which allow us to classify individuals into more or less homogeneous groups. Social distance also concerns organisations, for example companies in the same sector of activity which share the same markets, the same technologies, the same products, etc. This small social distance can take a more organisational form when two establishments adopt a similar structure: two research laboratories, two small firms or two subsidiaries of industrial groups have more or less identical constraints, objectives, interests, legal statuses which facilitate a priori the future mutual understanding necessary to the emergence of a relationship.

A small social distance is not sufficient to create an organisational proximity: thus two companies within the same industry may have no relationship apart from the simple, direct one of being competitors. In this sense, proximity is not simply the inverse of distance and cannot be reduced to simple similarity of characteristics. One is close to someone else when one not only resembles the other but when one shares various resources with him. One can speak of organisational proximity between organisations when they share, above and beyond a similarity in their legal structure, a language, perceptions, knowledge, know-how and a collective project signifying common strategic thinking as for example between two establishments of the same industrial group. When they are shared, these cognitive resources allow the acquisition, conservation and transmission of knowledge, know-how, experience, in other words to activate an inter-organisational relationship: in this way we move from a resemblance to a positive connection.

But the sharing of cognitive resources is not the only condition for the establishment of an inter-organisational relationship. When these resources take the form of moral values, social standards, rules or routines as between two public laboratories or two SMEs, they also act as regulatory tools for the relationship. In effect, it is necessary in addition to give coherence to contradictory interests, regulate conflicts which remain latent, prioritise problems, arbitrate, for example, the share of profits to which the parties aspire as a result of the interaction, or work out compromises. In other words, for a relationship to develop, it is necessary, alongside cognitive resources, to share coordinated regulatory tools. Sharing of regulatory tools, desired or imposed, is the second condition for the establishment of an interaction. In reality, these tools, like rules, are most often indistinguishable from cognitive resources inasmuch as they fulfil both roles simultaneously.

Control by the two types of proximity

The link between control and proximity, particularly in terms of the analysis of the process of the emergence of innovations, has not yet been directly studied in the literature. The question posed in this part is the following: in terms of relationships, what is necessary to exercise control? Our response: proximity. We distinguish control by geographical proximity from control by organisational proximity.

Control by geographical proximity

Participants can use two of the effects of geographical proximity to exercise their control.

Firstly, face-to-face interaction is the occasion to improve the efficiency of formal control of productive relations because it allows, on the one hand, discussions to be interactive and, on the other, a reduction in the uncertainty leading from the tacit dimension inherent in all knowledge and in the risks of opportunism [START_REF] Boschma R | Proximity and innovation. A critical assessment[END_REF]. In the same way, informal control, being based on mechanisms of shared standards, values, beliefs and trust, develops thanks to frequent meetings [START_REF] Langfield-Smith | Management control systems and trust in outsourcing relationships[END_REF]) made all the easier when the different parties are geographically close.

Secondly, geographical proximity indirectly favours informal control. It is known that social networks are often based in one locality. As GROSSETI and BES (2001) make clear, the creation and maintenance of social relationships pre-supposes frequent face-to-face interactions of a relatively routine nature which cannot be too dispersed. This explains why a significant proportion of social networks are spatially concentrated. Now, certain economic relationships are embedded [START_REF] Granovetter | Economic action and social structure: the problem of embeddedness[END_REF] in these localised social networks, in the sense that the economic activity is dependent on the personal relationships between those who carry it out. Informal control benefits from this embedding: it is more difficult to adopt an opportunist strategy to the detriment of a neighbour with whom one shares the same social network. In a way, geographical proximity seals the relationship between agents who would have to pay in terms of their personal relationship any opportunist behaviour adopted in the economic sphere.

Control by organisational proximity

OUCHI (1979) lists a certain number of pre-requisites to the exercise of control: these include rules, values and beliefs defining adequate behaviour, a legitimate hierarchical structure into which everyone must fit: these constitute cognitive resources and regulatory tools which must be shared. In other words, in the same way that organisational proximity conditions the emergence and/or the reinforcement of a relationship in general, it conditions the effectiveness of inter-organisational control in particular.

More precisely, organisational proximity allows the setting up of formal control mechanisms.

We have seen that the latter operate thanks to mechanisms which regulate behaviour (fixing of objectives, procedures, systems for monitoring and evaluating results and behaviour) thus making the relationship possible by securing it, each party being able to assure itself that the actions of its partners conform to its objectives and interests [START_REF] Nogatchewsky | L'exercice du control dans la relation client-fournisseur[END_REF]. Now, these mechanisms cannot exist unless the controllers and the controlled already have a minimum quantity of perceptions, knowledge and rules in common. In the same way, informal control is based on auto-regulatory mechanisms which require shared standards, values and beliefs [START_REF] Ouchi | A conceptual framework for the design of organizational control mechanisms[END_REF], sharing which, for proximity authors, equates to the very definition of organisational proximity. Moreover, organisational proximity creates trust towards others (DUPUY and TORRE, 2004) because of the similarities shown by close partners and because of the spirit of loyalty which can be generated by the fact of belonging to one and the same organisation: resemblance and belonging are sources of trust.

In the end, organisational proximity conditions control. It may possibly be reinforced by a geographical proximity between controllers and controlled. In return, as in any relationship, control will nourish proximities, via the mechanisms which are put into place, in a cumulative process. Thus the causal distinction made here between proximity and control is above all analytical, given the fact that it is so difficult in reality to separate out the causal links between the two concepts. To conclude this first section, the table below synthesises our vision of the concepts of proximity and of control, as well as the different mechanisms of control by proximity.

INSERT TABLE 1: Forms of control and proximity

In the following section, we test the way in which the parties to collaborative projects under the aegis of the Aerospace Valley cluster control their relationships using proximity. More precisely, we first examine whether informal and formal controls are practised by the same actors or if they are dispersed inside the cluster. Secondly, we look for the role of the two types of proximity in facilitating the two forms of control: can we observe any correlations between a form of proximity and a form of control? 2 Data and methodology: evaluation of the forms of control and proximity within the Aerospace Valley competitiveness cluster 2.1 The data: collaborative R&D projects in the Strategic Business Units of the

Aerospace Valley cluster

As in other countries, French government policy concerning business and research clusters (competitiveness clusters) finds its roots in the notion of clusters [START_REF] Porter | Clusters and the new economics of competition[END_REF], which showed that permanent geographical proximity between participants, when it is desired, is a factor which favours the creation and the diffusion of knowledge. Indeed, in this way government policy aims to accentuate, through cluster-labelled mechanisms, the agglomeration of participants likely to innovate jointly, in the hope that geographical proximity, as a facilitator of face-to-face interactions, will play a beneficial role in terms of supporting organisational proximity. Since the launching of the policy in 2005, 71 clusters have been labelled as competitiveness clusters, including 14 world clusters. But, this policy has another aspect: it supports, through labelling mechanisms but also through public financial aid, collaborative R&D projects bringing together major firms, small and mediumsized businesses and research laboratories. The policy seeks to create progressively, as different interactions take place, a memory of successful cognitive coordination and policies and thus to build up trust between private and public organisations. Despite being specialised in the aeronautical and space industries (48% of jobs), the Aerospace Valley cluster includes a wide spectrum of activities. The collaborative R&D projects undertaken in this cluster are in fact grouped into 9 Strategic Business Units (SBUs) representing the principal technological domains studied, from aeronautical activities to the design and production of satellites, and including embedded systems (cf. table 2 for details of the SBUs).

For several reasons, the aeronautical industry represents a field of observation which is relevant to our line of questioning. This cluster specialises in the aerospace industry has been chosen because of the strength of the control exercised by principals over contractors [START_REF] Kechidi | Institutions and coordination: what is the contribution of a proximity-based analysis? The case of Airbus and its relations with the subcontracting network[END_REF][START_REF] Wink R | Restructuring European aeronautics SMEs: Examination knowledge and its role in medium-technology innovation[END_REF], the former seeking to control the latter, whereas the latter aim to free themselves from the former. The strategies of externalisation developed by the aircraft manufacturers have led to the emergence of equipment manufacturers possessing specific skills: they are theoretically able to adopt opportunist behavior which calls for control. In addition to this strong asymmetry between the participants comes the question of joint innovation in a high technology industry: high R&D costs and the widening of the spectrum of skills necessary for the design of aircraft products encourage collaboration based on proximity [START_REF] Talbot | Hub firms and the dynamics of regional innovation: case studies of Thales and Liebherr in Toulouse[END_REF]. Thus, whether it relates to the transfer of knowledge or to the sharing of results of joint innovation, the question of control by proximity becomes meaningful.

Methodology for the evaluation of proximity within SBUs

The methodology must allow us both to reveal the existing instances of proximity between the partners in collaborative projects within the SBU and to evaluate the control relationships which exist between them. In order to achieve this, the weight of organisational and geographical proximity is evaluated using simple statistical tools, whereas we use social network analysis to reveal formal and informal control relationships. We can thus compare the 9 SBUs in terms of the weighting of the different forms of proximity and control exercised.

Following the methodology used for example by VICENTE et al., 2010, in the sector of GNSS industry, we consider each SBU as a set of dyadic relationships between two establishments working together within the framework of a collaborative research project (cf. table 2). Indeed, even if all the participants in a single project have not the same degree of interaction, we could suppose that all the actors of a same project collaborate together even punctually. We propose to evaluate, using a binary variable equal to 0 or 1, the existence of different forms of proximity between two participants, then to calculate the mean and standard deviation of the number of dyadic relationships between two close participants within each of these SBUs 5 .

In order to evaluate organisational proximity, we have used three indicators which signify the sharing of cognitive resources and regulatory tools (cf. table A in the annex):

-organisational proximity varies in intensity depending on whether the two partners are members of the same organization (as industrial group) or not. We distinguish the case where dyadic relationships develop between two establishments from the same organisation and that in which such relationships develop between different organisations; -two establishments share different statutes, legal and hierarchical rules, knowledge, know-how, values, collective projects depending on whether they are members of an industrial group or of a research laboratory. Here it is the organisational forms, revealing varying degrees of organisational proximity, which are different. Five organisational forms are distinguished: small and medium-sized firms (fewer than 200 employees), companies with 200 to 1000 employees, industrial groups of more than 1000 employees, public research laboratories and non-profit organisations. This indicator focuses in the first place on two similarities in character, legal structure and size: what is evaluated is thus the small social distance more than the organisational proximity in its entirety, even if the former is an essential component of the latter; -operating in the same sector of activity pre-supposes sharing of cognitive resources such as technical knowledge, know-how and perceptions 6 . We thus propose in a third stage to differentiate the establishments of the cluster according to their sector of activity. In order to do this we have used the classification into 21 categories 7 derived from the nomenclature of the activities of French companies drawn up by INSEE: the French National Institute of Statistics and Economic Studies. First of all, the establishments of the cluster belong for the most part to 3 fields of activity. 88 companies specialise in industrial activities ("Manufacturing Industries" sector): this category brings together in particular the principal aeronautical architect-integrator and major suppliers. Next, 220 establishments belong to the "Specialised Scientific and Technical Activities" sector: these are public research laboratories, but also companies carrying out research and development activities and engineering activities.

Finally 39 establishments belong to the "Information and Communication" sector: these are companies which carry out programming and information technology consulting.

Geographical proximity, as we have seen in the first part, is a judgment made about a small distance. If it is difficult to measure a judgment, the next best approach consists of integrating into the analysis the small geographical distance which separates the participants, considering that this is a necessary condition for the construction of a geographical proximity. A short geographical distance is considered here as signalling a possible geographical proximity: if face-to-face interactions are really facilitated in the case of a short geographical distance, nothing indicates on the other hand that a strong sentiment of belonging to a group also exists from the fact of being associated with a place. This method allows us to take into account only one of the mechanisms of facilitation of relationships that is exercised by geographical proximity. In order to do this, we thus consider that two participants are all closer geographically when they are situated in the same urban area 8 .

A measure of control by the analysis of interaction networks

SBUs and collaborative projects are not exempt from control, on the contrary, it is necessary to control the way in which this knowledge is disseminated. Control also concerns the sharing of the results of the collaboration and in a general manner the way in which the interactions take place.

Network analysis offers a method of measuring control in the form of individual scores of centrality resulting from the position of the participant in the system of relationships [START_REF] Lazega | Analyse de réseaux et sociologie des organisations[END_REF]. These different measurements of the centrality of participants were in fact developed with the intention of measuring the relationships of power -and thus of controlwithin groups of individuals [START_REF] Degenne | Les Réseaux sociaux[END_REF]. This methodology is used, for example, in financial literature to measure the control exercised by board members through their places in the networks of boards of the major international groups (PICHARD- [START_REF] Pichard-Stamford | Légitimité et enracinement du dirigeant par le réseau des administrateurs[END_REF][START_REF] Borgatti | The network paradigm in organisational research: a review and typology[END_REF][START_REF] Guieu | CA et réseaux d'administrateurs en Europe[END_REF]. It is also used to measure potential organisational power viewed as a structural position [START_REF] Brass | Potential Power and Power Use: An Investigation of Structure and Behavior[END_REF].

In order to determine whether participants are in a position to exercise a form of control, we propose to construct networks of interactions and thus characterise their positions within each SBU. As is shown in figure 1 in the annex, we have constructed undirected networks: each establishment represents a node of the network and each link represents the common participation in a collaborative project between two participants. Then, in order to measure the position of control of the different participants within this network, we use indicators of the position of the participants (in our case establishments) within the networks represented and more precisely the indicators of centrality. Two forms of centrality can be identified:

-degree centrality measures the number of links maintained by a participant in a network divided by the number of possible links 9 . A high indicator of degree centrality thus represents an above-average level of collaboration with all the other participants in the network. We have previously highlighted the fact that informal control takes place in particular by means of a mechanism of development of trust. We suppose that a participant who collaborates more strongly with all the other participants of the network will inspire more trust because, as we have already said, such trust emerges as a result of repeated, successful interactions. Moreover, the subject's multiple relationships allow him to disseminate the beliefs and values of the network and thus to exercise a social pressure allowing him to orientate behaviour in favour of the collective interest. He is thus in a better position than others to exercise an informal control. Degree centrality will thus be used as an indicator of the degree of informal control of a participant in the network; -betweenness centrality is an index which allows one to measure the fact that a participant in the network is an intermediary between two other participants of the network 10 . Thus it is also a measure of informal control exercised by the participants of the network and more precisely of the control exercised by a participant on the relationships between the other participants. As before, a participant positioned between the other participants of the network will have been able to progressively establish trust, whereas this role of intermediary allows him to disseminate the beliefs and the values of the social group that makes up the network. Thus we use betweenness centrality as a complementary indicator of the informal control exercised by a participant.

In order to compare the degree of control within each of the 9 SBUs, we have presented, in table 2, information on the mean of these different indicators of centrality within each SBU, as well as the maximum degree of centrality. Thus, just like other contributors to this special issue [START_REF] Balland | Theoretical perspectives in Economic Geography, Regional Studies[END_REF]BOUBA-OLGA and FERU, 2013), we have chosen to use the methodology of social networks to study the role of proximity in the interactions between actors in the innovation process. Nevertheless our approach stands apart from the rest of these contributions in the sense that we use this methodology as a measure of the control that one actor can exercise upon another 11 .

Within an SBU control can equally be exercised in a more formal manner through the management of the SBU. This management activity consists essentially of defining the objectives of collaborative projects and of verifying that they are consistent with the common strategy that prevails within the SBU. The definition of these objectives takes place during regular meetings. The institution of common rules in order to decide which sources of finance to apply for when seeking funds for a research project contributes to the development of a collective strategy. This management activity thus allows partial characterisation of formal control, previously defined as a form of control whose aim is to control results and behaviour by the definition of objectives, the setting up of standardized procedures, of schedules and of rules.

To summarise, we propose to compare, on the one hand, informal control evaluated through the central position in the active network (whatever means are used to calculate centrality) and, on the other hand, formal control via the management of the SBU. The result of this comparison is given in the following table and will be discussed in the following section.

INSERT TABLE 2: measurement of control and proximity within the SBUs of the Aerospace

Valley cluster 3 Results and discussion

Tables 1 andfigure 1 in the annex allow us to see different forms of dispersion of formal and informal control depending on the SBU. This leads us to propose a typology of the SBUs in four categories according to the form of control exercised. We will then study the weighting of the different forms of proximity within these four groups of SBUs.

Intensity and dispersion of the forms of control within the SBUs

The first group is composed uniquely of the SE SBU. It is characterised by the fact that the formal and informal controls are exercised by the same dominant participants: two big industrial groups and a research laboratory of the University of Toulouse 3 which are at the same time managers of the SBU and present very high degrees of centrality within the network of participants of this same SBU. Here, the control is tight and concentrated on a few participants. Here we find an expression of control exercised by the aeronautical industry's prime manufacturers.

For the NPT, AMS and ATSS SBUs (group 2), a major aeronautical company undertakes both formal control (managing the SBU) and informal control (high degree of centrality). But the management of the SBU is equally undertaken by medium-sized companies or public research organisations which, at the same time, are only rarely included in the collaborative projects of the SBU: they thus exercise a control which is above all formal.

For the EPEE, ASOI and AI SBUs (group 3), one can again see that a major industrial company manages the SBU and occupies a central position in the network. One also notes, as in the previous group, companies or universities which exercise formal control dissociated from any process of informal control. But these SBUs also include participants, mainly research organisations, situated in the centre of the network but which do not participate in the management activities of the SBU: in this last case, formal control is not accompanied by informal control. Thus in this group 3, control is tight but very dispersed and exercised by a great variety of participants. Moreover, informal control is more dispersed in this group of SBUs than in group 2 because it is sometimes exercised, outside the big industrial groups, by public research establishments.

Finally, two small SBUs -LES and MST (group 4) -show total dissociation between the indicators of formal control (management of the SBU) and informal control (centrality of the network). These SBUs bring together a small number of heterogeneous projects and do not appear to be established around a common strategy. It is notable that control is very dispersed.

In particular, informal control is exercised by a great variety of participants and a strongly centralised network does not appear (cf. table B in the annex).

The following table synthesises our results by recalling the coordination mechanisms between formal control (management of the SBU) and informal control (centrality in the network) in the different groups of SBUs identified above. With respect to the theoretical discussion, we note that formal and informal control may, in certain cases, be dispersed among different actors, which justifies the distinction proposed in the first part between formal and informal control. We will now look for the role of proximity on this control.

INSERT TABLE 3: Intensity and dispersion of forms of control within the SBUs of the Aerospace Valley cluster

Proximity and control within the SBUs

The comparison between the groups of SBUs proposed in the preceding paragraph and the importance of the different forms of proximity does not reveal any correlation between the forms of proximity and the forms of control. Nevertheless, our results illustrate the existence of control by proximity. Table 3 shows different examples of SBUs which illustrate the four combinations presented in table 1. However a detailed analysis of the type of participants who exercise control within each group of SBUs associated with empirical, detailed knowledge resulting from the numerous interviews carried out allows us to shed some light on certain particular forms of control by proximity in the Aerospace Valley business and research cluster. We have obtained three types of results.

Firstly, our analysis of the different forms of control shows the existence, for the SBUs of groups 1 to 3, of a small number of big industrial companies exercising both formal and informal control (cf. third column of table 3). We thus note a concentration of control in the hands of characteristic participants. In fact, the relationships established within the framework of collaborative projects are embedded in two other types of relationship, reinforcing this control:

-on the one hand, the relationships relating to projects are embedded in localized social networks. These big industrial groups are practically all situated in Toulouse and thus share geographical proximity with the majority of the members of the Aerospace Valley cluster. Geographical proximity reinforces the formal control exercised in terms of the management of the SBU by facilitating meetings with these participants.

It may also be noted that geographical proximity reinforces control not only inside the SBU, but also inside industrial groups, and particularly in the case of the ES SBU. For example, the number of links between establishments belonging to the same groups is significantly higher between establishments localised in the same area (31 links) than between establishments which are distant from each other (12 links).This geographical proximity equally favours informal control through the establishment of informal meeting opportunities (for example during breakfasts organised between members of the cluster) which provide the occasion to develop the local social networks within which economic relationships are already embedded (the networks of former members of the prestigious Toulouse engineering schools specialised in aeronautics being very active). Thus informal control develops via localised social networks; -on the other hand, recent relationships created by collaborative projects managed by the Aerospace Valley cluster are embedded in sub-contracting networks which are often long-established. These same big groups are the prime contractors of the aerospace industry and on this basis share an organisational proximity with industrial companies of different sizes (research laboratories are excluded in this case) forming part of the supply chain [START_REF] Kechidi | Institutions and coordination: what is the contribution of a proximity-based analysis? The case of Airbus and its relations with the subcontracting network[END_REF][START_REF] Talbot | Hub firms and the dynamics of regional innovation: case studies of Thales and Liebherr in Toulouse[END_REF]). In the supply chain the prime contractors exercise intense formal and informal control over suppliers of inferior rank. Collaborative projects thus associate companies which are otherwise clients or suppliers, i.e. controllers vs controlled: in this situation, the control mechanisms used within the framework of the supply chain and more generally the sharing of cognitive resources and regulatory tools (organisational proximity) have an influence on the controls exercised in collaborative projects. The control relationships which operate in the context of collaborative projects are dependent on the control relationships already operating elsewhere: the story of coordinations which have succeeded or failed, standards which have already been established, representations already shared, rules already imposed, fashion the interactions of today. Moreover, the context of a supply chain is not without effect: the asymmetrical positions of the parties involved mean that the sub-contracting SMEs cannot escape from the control of the prime contractors without the risk of paying for such behaviour in their relationships outside collaborative projects. In such a situation this causality maybe reversed: according to our interviews, collaborative projects are sometimes seen by the prime contractors as a new opportunity to exercise an additional control over the skills, the know-how and the knowledge of their suppliers.

Secondly, groups 2 and 3 bring together establishments which exercise formal control by participating in the running of the SBU but which do not appear to exercise informal control (cf. fourth column of table 3). These are establishments which are geographically distant from the other members of these SBUs 12 . More precisely, while the majority of the participants in the AMS, NPT, ATSS and AI SBUs are situated in Toulouse and run by big Toulouse industrial groups, we note that formal control is exercised by establishments which this time are located in the Bordeaux region. These are public establishments (an engineering school in the case of the AI SBU), small companies (NPT SBU) or big industrial groups (ATSS and AMS SBUs): even if Bordeaux and Toulouse are only 220 km apart, geographical proximity could be stronger. On the other hand, the EPEE SBU, the majority of whose members are located around Bordeaux, is run jointly by a major Bordeaux group and a company located in the Toulouse region. It thus appears that formal control can be exercised in the context of weak geographical proximity. Even if geographical proximity could favour interorganisational relationships as explained in the theoretical part (cf. table 1), this type of control is still based on contractual engagements and codified mechanisms which necessitate less geographical proximity. Nevertheless, tacit knowledge is often associated with individual people, the fact of being physically close will have a positive effect on the transfer of such knowledge [START_REF] Audretsch | R&D spillovers and the geography of innovation and production[END_REF], reinforcing the constraint of geographical proximity. This is true even if the technologies have evolved by facilitating the informal interactions necessary to the sharing of tacit knowledge and if the physical interaction does not necessarily imply permanent proximity of the individuals [START_REF] Grosseti | Interacting individuals and organizations: a case study on co-operations between firms and research laboratories[END_REF][START_REF]Proximity and localization[END_REF]. One can thus understand why we observe, in the last column of table 3, that informal control is exercised by public research establishments playing the role of intermediary 13 , establishments located for the most part near the other establishments of the SBUs. In our case, exercise of informal control necessitates stronger geographical proximity than formal control.

Thirdly and finally, as far as the articulation of the forms of proximity is concerned, it may be noted from table 2 that with the exception of the ES SBU, all the SBUs may be characterised by the fact that the two forms of proximity can be substituted for each other, at least in part.

More precisely, participants who are geographically distant are generally closer from the point of view of their activities and vice-versa. Thus two SBUs, NPT and ATSS, are distinguished by a strong degree of geographical proximity between the participants, but a weaker degree of organisational proximity. For example, 19 of the 27 establishments of the ATSS SBU are located around Toulouse, but on the other hand these establishments (research laboratories, small and medium-sized businesses and major companies) are specialised in various domains around the theme of the safety and the security of air transport. For all the other SBUs, the participants are less geographically concentrated but share a strong organisational proximity. This is, for example, the case of the AI SBU, in which the participants are geographically dispersed notably in the Aquitaine (12 establishments out of 37) and Midi-Pyrénées (18 establishments out of 37) regions, but also throughout the rest of France. On the other hand these establishments (research laboratories and small and medium-sized businesses) are for the most part specialised in activities close to technical and scientific research. It thus appears that the closer the participants are from the point of view of their activities, the more easily they can develop spatially-dispersed relationships. The fact of sharing common knowledge bases, of being subject to identical technical constraints, of having representations which are relatively similar or which have even been co-developed during possible past interactions, of sharing rules of competition and financing particular to an industry, creates mutual understanding. This facilitates remote interactions and allows the removal of part of the constraint of geographical proximity that joint innovation may require. On the other hand, if the activities of the participants are relatively heterogeneous, frequent meetings will be necessary to remove the misunderstandings and ambiguities arising from different fields of activity. Finally, it should be noted that our results do not show that the substitution of geographical proximity for similar activities can be extended to the other two indicators of organisational proximity (belonging to the same organisation and organisational structure).

Conclusion

Having proposed a typology for the Strategic Business Units of the Aerospace Valley cluster, depending on the intensity and the dispersion of the forms of control, several results have been updated. First of all, it has emerged, unsurprisingly, that formal and informal control is generally exercised by a small number of major industrial groups located near the majority of the establishments which are members of these SBUs and which are also the prime contractors in the supply chain. In this case collaborative R&D projects become new occasions for the deployment of the control relationships which already operate. Next, we have also been able to note that formal control based on formalised mechanisms does not require as much geographical proximity as informal control. Our results concerning the substitution noted between the forms of proximity have also confirmed the hypothesis according to which geographical proximity compensates for weak organisational proximity.

These results have consequences in terms of public policy. Thus, the public policy of competitiveness clusters seeks, in financing projects, seeks to encourage collaboration between participants who are geographically close, heterogeneous in terms of organizational structure and complementary in terms of knowledge. This study shows that certain participants control the operation of the exchange and the achievement of the objectives, which allows the partners to feel secure and thus allows the exchange to take place. But hierarchies which are observed elsewhere are reproduced in collaborative projects. Thus, control has the disadvantage of reproducing existing a symmetrical modes of co-ordination which can inhibit collective innovation which calls for new combinations supposed to favour the evolution of established positions. From the point of view of public action, the key is to strike a balance between letting control become established in order to generate sufficient confidence and allowing relaxation of this same control in order to facilitate the emergence of new interactions, by their very nature less controllable.

More generally, this study has not enabled us to specifically analyse the role of local institutions in terms of the manner in which they take part in control: we have used a theoretical framework specific to companies which does not take into account the specificities of public bodies, for example in terms of their objectives of regional development. This question may, moreover, be extended to other types of organisation, such as research institutions for which objectives of production of public knowledge can come into conflict with the strong requirements of confidentiality of companies.

This study has other limitations. In theoretical terms, our study has not permitted the analysis of potentially negative effects [START_REF] Boschma R | Proximity and innovation. A critical assessment[END_REF][START_REF] Zuindeau | Spatial approach to sustainable development: challenges of equity and efficacy[END_REF] that too great a proximity can have on control mechanisms. In effect, proximity can generate conflicts which can limit all forms of control. A possible development of our work would thus be to study the limiting role of conflicts on control mechanisms. Finally, analysing the role of proximity on the control of inter-firm relationships should lead us to question the efficiency of the control.

Without replying directly to this question, our results show that in the case observed, the proximities are widely used in order to make the formal and informal control effective. Thus proximities and controls contribute to the existence and the durability of collaborative projects. It would probably be useful to tackle this question more directly in a future study linking proximities, controls and performances of collaborations, for example by following the methodology used by [START_REF] Bengtsson | Climate of competition, clusters and innovative performance[END_REF].

Moreover, the intertemporal comparison of collaborative R&D projects within the same cluster would allow the introduction of dynamic elements into the analysis in order to observe the evolution of control relationships by proximity. In terms of methodology, other measures of control are possible. In particular, formal control could be measured through a study of the research contracts drawn up by the members of collaborative projects. Such a study would consist of analysing the degree of formalisation of the role of each of the participants in the collaborative projects, both in terms of the operation of exchanges during the research process and of the sharing of intellectual property of the results of the research. We could also include a more qualitative analysis of the objectives of the projects in order to see if the forms of control by proximity are different between theoretical and applied projects, but also between projects with different degrees of uncertainty or risk. In empirical terms, the choice of an industry in which the major groups occupy a predominant place led us to analyse relationships in which control was concentrated. Finally, this study should be extended to new activities in which control is more dispersed (mechanical engineering, photonics, etc.), by looking at other competitiveness clusters which are orientated towards innovation, but also by offering an analysis of control by proximity, this time between establishments collaborating in several competitiveness clusters. http://www.insee.fr/fr/methodes/default.asp?page=definitions/aire-urbaine.htm). We have also verified that two organisations situated in two different urban areas are not situated in urban areas which have a common border (in which case they could be considered as being geographically close). 9. Centrality of degree is defined as:

1 ) ( ) (   n i d i CD
, where d(i) represents the degree, i.e. the number of links of an individual i in the network, and n the number of individuals in the network.

10. Betweenness centrality is defined as:

       n j n h jh jh I n i n n n i C 1 1 ) ( ) 2 )( 1 ( 2 ) (
, where njh is the number of geodesics linking the individuals j and h and njh(i) the number of geodesics (minimum links) linking the individuals j and h involving the individual i, with i≠j≠h.

11. This methodology for measuring the two forms of control -formal and informal -as well as the information that we present afterwards concerning the management of the SBUS has been validated through interviews. These interviews were carried out between September 2008 and February 2010 as part of a research contract co-financed by the Aquitaine and Midi-Pyrénées Regions whose aim was to analyse organisational changes in the regional aerospace supply chain. In total, 38 interviews were carried out with companies, research laboratories and local authorities which support innovation. Carried out in a semi-directive fashion, these interviews were done with people who are responsible for different SBUs. These interviewees were generally senior managers from major groups (Airbus, Thales, Safran) made available for the occasion. These interviews provided the opportunity to collect concrete data concerning formal control. We thus sought to understand what were the formal control mechanisms set up (objectives, procedures, schedule, rules for evaluation) by these senior managers. Beyond the description of the tools, interviewing offers the advantage of being able to evaluate, by comparison and cross-referencing of the information collected, the effectiveness and the intensity of their use. Fuller information concerning these results has been given in another study [START_REF] Talbot | Hub firms and the dynamics of regional innovation: case studies of Thales and Liebherr in Toulouse[END_REF] 12. With the exception of the ASOI SBU which is highly specialised in the space industry, which is itself historically highly concentrated on Toulouse. Cf.. [START_REF] Dupuy | Industrial groups and territories: the case of Matra-Marconi-Space in Toulouse[END_REF] on this last point. Legend: The first three columns of the table give information on the overall structure of each SBU: the themes of each SBU, the number of establishments which are members of each SBU, as well as the number of collaborative projects belonging to each SBU. The next column gives the number of dyadic links analysed in terms of this network as well as, in brackets, information on the density of the network, i.e. the number of links divided by the number of possible links. The next two columns allow the evaluation of the weight of the informal control through measures of centrality of the two networks. For each of the two forms de centrality (degree, betweenness), we indicate the mean degree of centrality of all the participants in the SBU, as well as the maximum degree of centrality. The next column allows the evaluation of the weight of formal control by representing the number of establishments leader of the SBU and, in brackets, the number of establishments leader which do not participate in a single collaborative project of this SBU. The next column refers to situations where formal and informal control are cumulative: the + (and, in the negative sense, the -) represent the greater or lesser

  The AESE (Aeronautics, Space & On-board Systems) cluster, more often referred to as the "Aerospace Valley Cluster" is one of the world clusters created in 2005 in the Aquitaine and Midi-Pyrénées regions (in southwest France).In 2007, the cluster brought together 340 establishments and employed 64 421 people 4 . Unlike the majority of the clusters in France, this cluster is dominated by establishments controlled by industrial groups (203 establishments out of 340) and principally French groups (170 establishments), even if it does also include small and medium-sized firms and specialised research and training centres.

  13. Cf. VICENTE et al.(2010) for similar results in the GNSS (

TABLE 3 :

 3 between the coordinators of the SBU and the central participants of the networks. The last four columns give information about the weight of the different forms of proximity within each of these SBUs. For each form of proximity, we indicate the mean number (with the standard deviation in brackets) of relationships (in the sense of a joint collaborative project between two establishments) for which the participants are considered as being close.NB: * In the AI and ES SBUs, unlike all the other SBUs, the same establishments do not have the highest levels of degree and betweenness centrality. In the case of the AI SBU, two research establishments show the highest levels of degree centrality and betweenness centrality. In the case of the ES SBU, it is a major aeronautical group located in Toulouse which has the highest level of degree centrality and a university laboratory which has the highest level of betweenness centrality. And despite this dispersion, the levels of centrality of these four participants remain very high for the two SBUs. ** In the MST SBU, four companies of equivalent size show maximum (and equal) levels of centrality (according to the three forms of calculation). Thus these companies share the informal control of this SBU. *** The value 0 in the case of organisational proximity in terms of belonging to a group or an university or public research organism indicates that, in the MST and LES SBUs, each participant belongs to a distinct group or university or public research organism. Intensity and dispersion of forms of control within the SBUs of the

FIGURE 1 :

 1 FIGURE 1 : networks of collaborative projects in the SBUs of the Aerospace Valley cluster

TABLE 2 :

 2 measurement of control and proximity within the SBUs of the Aerospace Valley cluster Source: authors, following the description of the collaborative projects of the Aerospace Valley cluster in June 2009.

					Informal control:	Informal control:	Formal	Similarity		Orga.
		N o .							Geo.	Orga.	Orga.
			N o .	N o . links	Degree centrality	betweenness	control:	formal and		Proxi
	Themes	participa							Proxi.	Proxi	Proxi
			projects	(density)	(mean/	centrality	Running	informal		manager/
		nts								structure	activity
					maximum)	(mean/maximum)	of SBU	control		group
				884	2.11	1.14		+++	34.73%	2.38%	29.30%	39.71%
	Embedded systems (ES) 111	27				3
				(7.24%)	(13.90*)	(22.11*)		(group 1)	(0.48)	(0.15)	(0.45)	(0.49)
	Aero-mechanics,
				1628	3.25	0.91		++/-	14.68%	2.52%	30.96%	43.55%
	materials and structures	131	21				3
				(9.55%)	(13.59)	(28.83)		(group 2)	(0.35)	(0.16)	(0.46)	(0.50)
	(AMS)
	Navigation, positioning
					4.25	1.42		++/-	49.62%	0.50%	29.57%	36.34%
	and telecommunications	69	16	399			4 (1)
					(26.10 )	(37.57)		(group 2)	(0.50)	(0.07)	(0.46)	(0.48)
	(NPT)			(8.50)%
	Air transport safety and			129	12.25	0.04		++/-	58.14%	6.20%	22.48%	32.56%
		27	5				2
	security (ATSS)			(17.06%)	(35.90)	(0.11)		(group 2)	(0.49)	(0.24)	(0.42)	(0.47)
	Access to space and			48	27.50	0.71		+/-	12.50%	6.25%	39.58%	58.33%
		16	4				2
	orbital infrastructures			(20%)	(53.33)	(11.43)		(group 3)	(0.33)	(0.24)	(0.49)	(0.50)

Acknowledgement:

The nodes with an M in the centre are the establishments which manage the SBU.


Jean-Claude Bermond

Charlotte Huang

Alexander Rosa

Dominique Sotteau

Decomposition of complete graphs into isomorphic subgraphs with five vertices

come


Yves Ledru
email: yves.ledru@imag.fr

Yoann Blein
email: yoann.blein@imag.fr

Lydie Du-Bousquet
email: lydie.du-bousquet@imag.fr

Roland Groz
email: roland.groz@imag.fr

Arnaud Clère
email: arnaud.clere@minmaxmedical.com

Fabrice Bertrand
email: fabrice.bertrand@blue-ortho.com

Requirements for a trace property language for medical devices Short Paper

Keywords: Software and its engineering → Specification languages, Formal software verification, Monitoring, Parametric Events, Temporal Specification, Trace analysis, Medical devices

The verification of software intensive medical devices can largely benefit from the analysis of their execution traces. Trace points can easily be added to the software, and traces can be used at several stages of the development and maintenance process. In this paper we focus on the TKA system and identify 15 representative properties that should be fulfilled by its traces. We also identify several stages in the product lifecycle where these properties should be evaluated. These properties put requirements on what should be expressible in a trace property language for medical devices.

INTRODUCTION

A new generation of software-intensive medical devices (MD) arises, which benefit from various sensors to help physicians perform difficult surgeries with increasing precision. The development of such systems must follow national rules, based on standards such as ISO IEC 62304 1 . These standards don't prescribe the use of formal verification methods, as required for the railways or the air and space industries. To favour a transition towards more rigorous development processes, the formal methods community has advocated for the advent of "lightweight formal methods" [START_REF] Jones | Formal Methods Light[END_REF]. The MODMED project, funded by the French National Research Agency (ANR), gathers a University team with a MD company, BlueOrtho (BO), and a company specialized in software for MD, MinMaxMedical. This project adopts the monitoring of traces of surgeries as a lightweight approach to the verification of their properties.

There are several reasons to adopt a verification approach based on traces. First, software is usually instrumented with trace points which are easily improved to record sensor data, interactions with the surgeon and the medical team, and important events in the execution of the software. Also, traces can be produced during the development, but also during exploitation of the MD in real surgeries. Exploitation traces play an important role in post-market surveillance of the product.

Producing such traces was standard practice for BO, before the MODMED project started. But effective exploitation of the traces requires adequate tools to monitor properties of the traces. Therefore, the main goal of the MODMED project is to design a Trace Property language, named ParTraP (Parametric Trace Property language), to express properties of medical devices.

In this paper, we report on our process to identify requirements for a trace property language adapted to the TKA product, and explain how trace analyses can be used by BO at several stages of software development. Although our study is based on a single medical device, we rely on the experience of our industrial partners to check that the requirements for a trace property language apply to a larger range of medical devices.

Section 2 presents the TKA Medical device. Section 3 identifies 15 representative properties for MD traces. Section 4 extracts their main characteristics. Section 5 provides classification of properties based on their mandatory character. Section 6 studies when these properties should be checked in the development and maintenance lifecycle. Finally section 7 draws the conclusions and perspectives of this study.

TKA

TKA is a system to guide Total Knee Arthroplasty surgeries, i.e. the replacement of both tibial and femoral cartilages with implants. TKA is composed of software, mechanical and electronical components. TKA supports the following sequence of operations:

(1) Digitization (acquiring a digital model of patient's anatomy) using sensors (trackers and pointer) (2) Decision (adjusting the preoperative planning of implant sizes and position, according to the surgeon preferences) (3) Action (positioning tracked cutting guides to cut bones)

The sensors include a set of trackers, firmly attached to the bones of the patient, whose position and orientation can be detected by a 3D camera. The camera also detects a pointer device, which is used to acquire the position of some anatomical points. The pointer can be used to acquire a single point, or it can be tracked to acquire several points (i.e. a cloud of points). The surgeon interacts with the product through a touch screen, and using the pointer device. When the system has acquired all anatomic information, the surgeon can plan several cuts in order to place the prosthesis. The system will then help them to precisely position cutting guides.

Every sensor acquisition or interaction with the surgeon is logged by TKA into a large trace (3000 events on average). This trace is initially designed to store sufficient information to understand what went on during a surgery. After each surgery, BO collects the corresponding trace. TKA has been used worldwide for a couple of years and 10 000 surgery traces have been collected by BO.

REPRESENTATIVE PROPERTIES

Currently, traces are analysed manually, but the large number of traces requires automating these analyses. In order to identify the kind of properties to check on these traces, we dedicated significant time to a detailed understanding of the traces. Two traces of actual surgeries selected by BO as representative were reviewed in detail, and a few others were provided to illustrate particular requirements. The members of the project also got access to confidential documents: the "FUNctional SPecification" (FUNCSP) document of TKA, which describes the specifications of the whole system, and the "TEChnical SPecification" (TECSP) focusing on the TKA software.

As a result, a list of 43 requirements in 11 functions described in TECSP was determined as relevant based on the interest expressed by the manufacturer. From this list, 15 properties were deemed "representative", based on the temporal relationships featured between events, the type of event data, and the operations performed on event data. They are now listed in arbitrary order:

P1. The trace contains a step "redo acquisitions". This step allows the surgeon to correct their previous acquisition. It is not part of the standard procedure flow and, therefore, interesting to detect.

P2. The temperature of the camera stays within a given interval. If used in proper conditions, the camera temperature should not deviate from the range where its precision is guaranteed.

P3. The distance between pairs of hip centres is less than d. This property asserts that the algorithm computing the hip centre is stable, i.e. gives similar results for consecutive acquisitions.

P4. The distance between the hip centre and the knee centre is greater than d. A violation of this property could reveal an abnormal positioning of the patient or the sensors.

P5. If the medial malleolus is farther from the camera than the lateral one, a warning is issued. A violation of this property may reveal that the 3D camera was installed on the wrong side of the patient.

P6. The user never skips a screen. The surgeon is expected to spend sufficient time to appreciate the information showed on the display before going to the next screen.

P7. The acquisition of a point succeeds if and only if the probe is stable. If the surgeon moves the probe tip during an acquisition, it should not be accepted.

P8. The protocol "redo acquisitions" proposes only already performed acquisitions. The system should not offer the user to redo acquisitions that were never performed.

P9. Detecting a new tracker produces a dialog asking for replacement confirmation.

P10. The state TrackersConnection is unreachable until the camera is connected. The system should not reach a state dependent on the camera until the camera is connected.

P11. A replaced tracker is not used until it is registered again. P12. The action "previous" cancels the current point cloud acquisition. Acquiring a cloud of points takes a few seconds and can be cancelled. In this case, the current acquisition should not succeed.

P13. All the necessary trackers are seen before entering the state TrackersVisibCheck. To proceed, the system requires a set of trackers depending on the profile in use. All these trackers should be seen at least once before entering the state TrackersVisibCheck.

P14. On the trackers connection screen, a tracker is shown if and only if it is necessary. Only required trackers are shown to the user.

P15. In the state TrackersConnection, not detecting any new tracker for 2 minutes produces an error message.

MAIN CHARACTERISTICS

We identified several characteristics of these properties listed here.

• Does it involve events of different types?

• Is it parametric, i.e. does it involve event parameters?

• Is it temporal, i.e. does it constrain the order of two or more occurrences of events, • Does it apply to a restricted scope of the trace?

• Has it geometric predicates on data?

• Has it GUI predicates on screenshots?

• Does it involve physical-time?

• Is it a required, assumed or usage property (see section 5).

Table 1 synthesizes the classification of the 15 properties presented in the previous section. In the following, we will detail this classification for a couple of properties.

Let us consider property P3, stating that the distance between pairs of hip centres is inferior to a given threshold. It involves several events of a single type, reflecting the acquisition of a new hip centre and that is parametrized with the acquired point. These events parameters must satisfy a geometric constraint. A violation of this property could indicate that the patient was not installed as expected (e.g. the surgeon should not use a "leg holder" which forces the leg position) or, if the patient was correctly installed, that the algorithm computing the hip centre is not stable.

Property P12 states that action "previous" cancels the ongoing points cloud acquisition. I.e. triggering action "previous" during an Property 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 No. of event types 1: Classification of the 15 properties acquisition prevents the success of this acquisition. This property involves three different event types, reflecting the action "previous", the beginning of an acquisition, and the success of an acquisition. No event parameter is needed, which makes the property nonparametric. However, it is temporal since the occurrence of the "acquisition success" event is constrained by other event occurrences.

1 1 1 2 3 2 2 2 2 2 3 3 4 2 4 Parametric X X X X X X X X X X X X Temporal X X X X X X X X X Restricted scope X X X X X X Geometric predicate X X X X GUI predicate X Physical time X X Required X X X X X X X X X X X Assumed X X X X Usage X X Table
The results of this classification are in accordance with our expectations: the properties are very diverse and rely heavily on data parameters. On the contrary, the physical time is rarely involved in the identified properties despite our expectations.

Based on these properties, we have designed the ParTraP language [START_REF] Blein | Extending Specification Patterns for Verification of Parametric Traces[END_REF], which is mostly influenced by the specification patterns proposed by Dwyer et al [START_REF] Matthew | Patterns in Property Specifications for Finite-State Verification[END_REF]. Although numerous languages exist for runtime verification, e.g. [START_REF] Barringer | Rule-Based Runtime Verification[END_REF][START_REF] Bauer | SALT -Structured Assertion Language for Temporal Logic[END_REF][START_REF] Hallé | Runtime Monitoring of Message-Based Workflows with Data[END_REF][START_REF] Smith | PROPEL: an approach supporting property elucidation[END_REF], none of them offers the combination of features required by our application context: support of parametric events, capability to express temporal properties and ease of use resulting from a verbose language. The interested reader may refer to [START_REF] Blein | Extending Specification Patterns for Verification of Parametric Traces[END_REF] for a detailed description of the language and a comparison with related work.

CLASSIFICATION OF PROPERTIES

The properties listed in Section 3 belong to three categories: Required, Assumed and Usage properties. Table 1 records the corresponding category for each property.

Required properties. Such properties must be ensured by the TKA system. These properties correspond to requirements on the system. For example, this is the case of property P7 "The acquisition of a point succeeds if and only if the probe is stable" which requires TKA to check probe stability before validating the acquisition of a point. 11 out of the 15 properties correspond to this kind of properties.

Checking these properties on the traces should always succeed, otherwise it would reveal a failure of the software or of its associated hardware. Ideally, these properties should be formally proven. This is why we refer to these as "required" properties. In the MD industry, a more pragmatic approach is to provide verified traces as evidences that they are fulfilled by the product, and not full proofs.

Assumed properties. These properties should be ensured by the environment of the TKA system, i.e. the medical team and the surgery room. They appear as assumptions on the behaviour of this environment. If the environment fails to fulfill these properties, the behaviour of the TKA system may be affected. For example, this is the case of property P2 "The temperature of the camera stays within a given interval". The camera temperature is influenced by the surgery room temperature. If the temperature is outside this range, the precision of the camera may be affected.

If the environment does not behave as expected, TKA is designed to stop assisting the surgery in the worst case. In any case, it ensures that the information displayed to the surgical team is correct, or stops displaying information if its correctness is not guaranteed.

Checking these properties on the traces is expected to succeed because the surgeon and their team are expected to use the system in the prescribed conditions. If one of these properties is not satisfied, it may be an explanation for difficulties arising during the surgery and it does not necessarily reveal a defect of the system.

These assumptions on the behaviour of the environment will be referred to as "Assumed" properties.

Please note that property P3 is marked as both required and assumed. P3 states that "The distance between pairs of hip centres is less than d". It can result from the use of a leg holder, which violates assumptions on the environment, or from a wrong calculation which reveals a software failure. Since the trace does not record that a leg holder was used, a violation of this property leaves two possible causes.

Usage properties. TKA can be used in several different ways, depending on the surgeon's choices. Properties can be checked to understand how the system was used.

For example, this is the case of property P1 "The trace contains a step 'redo acquisitions' ". The 'redo acquisition' step was triggered by the surgeon and may reveal that it is difficult to have all acquisitions right at the first attempt, or that the surgeon is not trained enough to use the system. Checking these properties helps understand the way the TKA system is used, but does not reveal a particular failure of the system or its environment. It can be exploited to identify potential evolutions of the TKA system (e.g. efforts should be done to facilitate acquisitions). This is why we refer to such properties as "Usage" properties.

Other examples of usage properties include cases where TKA leaves a choice to the surgeon, e.g. several kinds of prostheses may be selected, or the order of several operations is not fixed. Usage properties can check whether a given choice was adopted. Statistics can be computed on the number of traces satisfying a given usage property. At longer term, "quantitative usage properties" might be considered, reporting quantities instead of Boolean values like a number of occurrences of an event or the duration of a step or the distance between anatomic points.

WHEN SHOULD THESE PROPERTIES BE CHECKED?

Traces can be produced in four contexts during the MD lifecycle: development, qualification, manufacturing and exploitation.

The development context. It corresponds to all activities which will create or modify the TKA system. They correspond to the initial development, but also to corrections during the maintenance phase and evolutions of the system. In the development context, traces will be produced during tests. They will be used to evaluate the correctness of the system and hence required properties will be the most important ones at this stage.

The qualification context. It comes after development activities, it is aimed to demonstrate the correctness of the system and validate assumptions on its environment. Here again the focus will be on required properties, but in the qualification context, these properties are expected to be fulfilled by the system under qualification. The qualification phase also involves "Acceptance tests" typically performed by surgeons on corpses using a successfully verified MD. During these acceptance tests, one can expect that required properties will be satisfied but the focus will be on assumed and usage properties to check that the environment behaves as foreseen.

Manufacturing. Since TKA is composed of software and hardware, it involves a manufacturing phase where the system is assembled and tested. Here the tests check the hardware for manufacturing defects. Properties checked at this stage are required properties because they aim to check the system, and not its environment. Still, while in the development and qualification contexts failure could result from software defects, in the manufacturing phase, the software should be correct and failures only reveal hardware defects, or incorrect execution of the tests by the tester.

The exploitation context. corresponds to the operation of a qualified system during a real surgery. In this context, required properties should not fail. Checking these properties on traces of numerous surgeries brings additional evidence of the quality of the system.

Assumed and usage properties are mostly relevant to the exploitation context. Assumed properties correspond to assumptions on the way the system is operated. Checking the assumed properties on the traces of real surgeries will help detect cases where the environment of the system was not adequate. Detecting such traces may bring explanations on why something did not proceed smoothly, or require for more robustness of the system against the failure of these properties.

This exploitation context corresponds to the activities of postmarket surveillance, and misuse surveillance. Once the MD is certified for some market and actually used, BO still performs trace analyses that can be critical to ensure patient safety. But the large number of traces (10 000) requires that automated analyses, motivating the need for a trace property language and its toolset.

Misuse is also an important problem in the exploitation context. As a general usability principle, BO chooses to only block the user when the action would undoubtedly have direct consequences for the patient. Consequently, it is important to study how TKA is used in the market to detect misuses. This allows warning users about potential problems and advising them on how to avoid these problems in next surgeries. On the other hand it may denote usability problems that should be tackled by BO. In any case, BO feels this is a very relevant activity to improve TKA safety and effectiveness.

A typical example is to verify that TKA is used within intended operating temperature range because it affects the camera accuracy. TKA itself checks this prerequisite environment condition and the user is warned about possible accuracy problems but the user is left responsible for using it or waiting for camera warmup.

CONCLUSION

The verification of software intensive medical devices can largely benefit from the analysis of traces produced during their execution. Trace points can easily be added to the software, and traces can be used at several stages of the development and maintenance process. During post-market surveillance, they bring empirical evidence that the system exhibits the expected behaviour, and they allow to identify how the system is actually used.

Trace analysis should be automated. In this paper, we have identified a set of properties that should be expressible in a trace property language. These properties result from a thorough study of TKA, its traces, and specification documents. We identified 43 properties, and 15 of them were selected as representative. This paper lists these 15 properties, and performs their classification. This classification identifies expected characteristics of the property language. They constitute requirements for the ParTraP language [START_REF] Blein | Extending Specification Patterns for Verification of Parametric Traces[END_REF], but can also be used to evaluate the adequacy of existing languages to express such properties. Although this set of properties result from the analysis of a single MD, the experience of our industrial partners with the development of other MD leads them to believe that these properties are representative of a larger set of MD.

https://www.iso.org/standard/38421.html

ACKNOWLEDGMENTS

This work is funded by the ANR MODMED project (ANR-15-CE25-0010).