Pauline Chenin
email: chenin@unistra.fr

Gianreto Manatschal

Luc L Lavier

Duncan Erratt

Assessing the impact of orogenic inheritance on the architecture, timing and magmatic budget of the North Atlantic rift system: a mapping approach

To investigate the impact of orogenic inheritance on the characteristics of the North Atlantic rift system we develop new mapping methods that highlight the first-order architecture and timing of rifts, as well as the distribution of heterogeneities inherited from the Palaeozoic Caledonian and Variscan orogenies. These maps demonstrates major differences in the behaviour of the North Atlantic rift system relative to both orogens, with the Variscan front appearing to be an important boundary. Indeed, the rift cuts through the Caledonian orogen and parallels its structural grain to the north, while it circumvents the core of the Variscides to the south. In addition, rifting is protracted and polyphase with breakup being magma-rich north of the Variscan front, as opposed to the south where a single, apparently continuous extensional event led to magma-poor breakup in less than 50 Myr. Besides, the North Atlantic rift system reactivates sutures corresponding to large (> 2,000 km) former oceans, while sutures of small (< 500-1,000 km) oceanic basins are little affected in both the northern and southern North Atlantic. These observations point to a major influence of orogenic inheritance on the characteristics of rift systems. 1

Introduction

Pre-existing orogenic structures are widely believed to exert significant controls on the development of subsequent rift systems. For example [START_REF] Wilson | Did the Atlantic close and then re-open?[END_REF] emphasized that the North Atlantic rift follows the ancient Appalachian and Mauritanian sutures, [START_REF] Dunbar | How preexisting weaknesses control the style of continental breakup[END_REF], [START_REF] Piqué | The central Atlantic rifting: Reactivation of Palaeozoic structures?[END_REF], [START_REF] Ring | The influence of preexisting structure on the evolution of the Cenozoic Malawi rift (East African rift system)[END_REF] and [START_REF] Tommasi | Continental rifting parallel to ancient collisional belts: an effect of the mechanical anisotropy of the lithospheric mantle[END_REF] correlated changes in the onshore geology with along strike changes in architecture and segmentation of rifted margins, and [START_REF] Withjack | Development of the passive margin of eastern North America: Mesozoic rifting, igneous activity, and breakup[END_REF] described most of Mesozoic sedimentary basins bordering the North Atlantic Ocean as formed by extensional reactivation of contractional structures from the previous Alleghanian Orogeny. However these examples are often specific and / or local and there is no general agreement on how inheritance controls subsequent extensional events. The complexity of these interactions is well-illustrated by the very different behaviour of the North Atlantic rift system with respect to the Caledonian (in the north) and Variscan (in the south) orogenic lithosphere (Figure 1). Indeed, the rift cuts through the former Caledonides and parallels its structural grain, whereas it circumvents the core of the Variscan-affected area. Furthermore, final rifting leading to breakup is magma-rich in the north, whereas it is magma-poor in the south.

The aim of this paper is firstly to map orogenic inheritance and characteristics of rift systems at the scale of the whole North Atlantic, and secondly to assess the impact of inherited structures and / or heterogeneities on the architecture, timing and magmatic budget of rift systems that went beyond the point of necking (i.e localized attenuation of the continental crust, e.g. Péron-Pinvidic and [START_REF] Péron-Pinvidic | The final rifting evolution at deep magma-poor passive margins from Iberia-Newfoundland: a new point of view[END_REF]; [START_REF] Sutra | Quantification and restoration of extensional deformation along the Western Iberia and Newfoundland rifted margins[END_REF]). We develop new mapping approaches driven by observations that highlight: (1) the distribution of major inherited features; (2) the structural architecture of rift systems; and (3) the time lag between the onset of necking and lithospheric breakup.

Geological setting

The Norwegian, Irish, Scottish and Greenland margins formed by Mesozoic rifting and Eocene breakup [START_REF] Mjelde | Magmatic and tectonic evolution of the North Atlantic[END_REF] of lithosphere affected by the Siluro-Devonian Caledonian orogeny (Figure 1). The Caledonides resulted from the Late Ordovician closure of the Tornquist Seaway and from suturing of the larger (> 3,000 km) Iapetus Ocean [START_REF] Torsvik | The Tornquist Sea and Baltica-Avalonia docking[END_REF].

Note that the subduction of the Iapetus Ocean produced a magmatic arc, which is now obducted in western Norway and eastern North America [START_REF] Rey | The Scandinavian Caledonides and their relationship to the Variscan belt Contractional tectonics[END_REF][START_REF] Roberts | The Scandinavian Caledonides: event chronology, palaeogeographic settings and likely modern analogues[END_REF]. The Caledonian orogen is characterized by the polyphase stacking of thin and far-travelled very extensive thrust nappes [START_REF] Andersen | Extensional tectonics in the Caledonides of southern Norway, an overview[END_REF][START_REF] Rey | The Scandinavian Caledonides and their relationship to the Variscan belt Contractional tectonics[END_REF]. After the termination of convergence, the Caledonian range underwent extensional collapse that led to the formation of normal faults and low-angle detachment systems associated with exhumation of high pressure rocks. No significant magmatism occurred north of the Elbe lineament [START_REF] Stephens | Granitoid plutonism in the Caledonian orogen of Europe[END_REF][START_REF] Milnes | Contraction, extension and timing in the South Norwegian Caledonides: the Sognefjord transect[END_REF][START_REF] Andersen | Extensional tectonics in the Caledonides of southern Norway, an overview[END_REF], therefore remnants of the Caledonian orogenic wedge are well-preserved [START_REF] Meissner | Terrane accumulation and collapse in central Europe: seismic and rheological constraints[END_REF].

In contrast, the Bay of Biscay and Iberian margins developed during Jurassic rifting and early Cretaceous breakup [START_REF] Péron-Pinvidic | The final rifting evolution at deep magma-poor passive margins from Iberia-Newfoundland: a new point of view[END_REF] of lithosphere affected by the Variscan orogeny (Figure 1). The Variscides have a much more complex orogenic history than the Caledonides in that they resulted from the closure of several small (< 500-1,000 km) immature oceanic basins -namely the Rhenohercynian, Saxothuringian and Medio-European oceanic basins -in addition to the closure of the larger (> 2,000 km) Rheic Ocean [START_REF] Matte | The Variscan collage and orogeny (480-290 Ma) and the tectonic definition of the Armorica microplate: a review[END_REF][START_REF] Mckerrow | The late Paleozoic relations between Gondwana and Laurussia[END_REF][START_REF] Franke | The Variscan orogen in Central Europe: construction and collapse[END_REF]. Note that subduction of these immature oceanic basins failed to produce associated magmatic arcs, unlike the subduction of the Rheic ocean [START_REF] Franke | The Variscan orogen in Central Europe: construction and collapse[END_REF].

Following the termination of convergence, the Variscan range underwent an orogenic collapse that led to crustal extension, formation of intramontane basins and widespread magmatic intrusion and underplating [START_REF] Rey | The Scandinavian Caledonides and their relationship to the Variscan belt Contractional tectonics[END_REF]. This intense magmatic event was responsible for the depletion of the upper mantle [START_REF] Müntener | Refertilization of mantle peridotite in embryonic ocean basins: trace element and Nd isotopic evidence and implications for crust-mantle relationships[END_REF][START_REF] Rampone | Mantle dynamics during Permo-Mesozoic extension of the Europe-Adria lithosphere: insights from the Ligurian ophiolites[END_REF], it overprinted the orogenic structures in the lower crust [START_REF] Meissner | Terrane accumulation and collapse in central Europe: seismic and rheological constraints[END_REF][START_REF] Schuster | Permian metamorphic event in the Alps[END_REF] and most likely welded the different parts of the orogen. 3 Mapping inheritance

Definition

We use the term inheritance to refer to the deviation between an ideal lithosphere with horizontally homogeneous physical properties ('layer-cake lithosphere') and a natural lithosphere (Figure 2 a; see also [START_REF] Manatschal | The role of inheritance in structuring hyperextended rift systems: Some considerations based on observations and numerical modeling[END_REF] for an extended definition). Inheritance includes (1) structural complexity (faults, suture zones or mylonitic shear zones); (2) thermal lateral heterogeneities and (3) compositional heterogeneities resulting from sedimentary, tectonic, magmatic, metamorphic and metasomatic processes (for example foreland basins, magmatic arcs, intrusions, underplating, ophiolite belts, hydrated mineral phases within faults and both enriched and depleted mantle lithosphere). Note that these three types of inheritance are usually strongly interrelated and cannot be readily dissociated.

Selection criteria and limitations

Because of their different ages, tectonic and thermal histories (e.g. section 2), we distinguish between two main orogenic domains, namely the Caledonides and the Variscides. We define each orogenic domain as the area limited by the trace of its corresponding deformation fronts at the present-day surface (Figure 2 b). Note that this location does not necessary reflect the maximum extent of the orogen since erosion may have erased part of the orogenic structures, however they remain a reasonable proxy at the scales under consideration. To limit our mapping to relevant first-order inheritance, we we consider only basin-scale features that have been preserved through time.

In western Europe, most structural heterogeneities result from the Caledonian and Variscan orogenies, therefore we select the corresponding sutures, fold-and-thrust belts and deformation fronts. Moreover, large-scale compositional heterogeneities include foreland basins, major magmatic additions as well as large-scale mantle heterogeneities.

The extent of the Variscan foreland basins is well-constrained to the north, but less so to the south where it has been extensively overprinted by the subsequent Alpine rifting and orogeny [START_REF] Neubauer | Variscan orogeny in the Eastern Alps and Bohemian Massif: How do these units correlate[END_REF][START_REF] Von Raumer | Gondwana-derived microcontinentsthe constituents of the Variscan and Alpine collisional orogens[END_REF]. The Caledonian foreland basin is likely to have had a large areal extent but, since it may not have been very thick [START_REF] Cederbom | Fission track thermochronology applied to Phanerozoic thermotectonic events in central and southern Sweden[END_REF] and associated inheritance (right) [START_REF] Huigen | Thermal effects of Caledonian foreland basin formation, based on fission track analysis applied on basement rocks in central Sweden[END_REF], large parts may have been extensively eroded during Cenozoic uplift [START_REF] Gee | Subduction along and within the Baltoscandian margin during closing of the Iapetus Ocean and Baltica-Laurentia collision[END_REF].

Major extrusive magmatic additions, which may reflect either pre-(volcanic arcs), syn-or post-collision (orogenic collapse) magmatic activity, have been extensively mapped over western Europe (e.g. for example [START_REF] Matte | Tectonics and plate tectonics model for the Variscan belt of Europe[END_REF][START_REF] Finger | I-type granitoids as indicators of a late Paleozoic convergent ocean-continent margin along the southern flank of the central European Variscan orogen[END_REF][START_REF] Timmerman | Timing, geodynamic setting and character of Permo-Carboniferous magmatism in the foreland of the Variscan Orogen, NW Europe[END_REF]. Conversely, magmatic intrusions and underplating as well as mantle heterogeneities are less well defined since this requires geophysical or geochemical studies. However, ECORS seismic lines published by [START_REF] Bois | Dating lower crustal features in France and adjacent areas from deep seismic profiles[END_REF] as well as the compilation of metamorphic-and magmatic-ages by [START_REF] Petri | Formation et exhumation des granulites permiennes : Établir les conditions prerift et déterminer l'histoire de l'exhumation syn-rift[END_REF] tend to show that the rejuvenated mafic lower crust related to post-orogenic collapse exists over the entire Variscan orogenic area (Figure 2 b). Therefore we can expect large parts of the mantle underlying this domain to be depleted, as well as the overlying crust to be intruded by the resulting melts (e.g. Ivrea in northern Italy; [START_REF] Schaltegger | Pre-Alpine geochronology of the Central, Western and Southern Alps[END_REF].

As thermal heterogeneities resulting from heat transport via convection and / or advection are erased by thermal re-equilibration with the encompassing material over time << 100 Myr [START_REF] Jaupart | Heat flow and thermal structure of the lithosphere[END_REF] we do not include them in our selection. Indeed, necking in the North Atlantic started approximately 100 Myr after the Variscan collapse and more than 200 Myr after the Caledonides. Alternatively, thermal heterogeneities coming from the higher concentration in radiogenic elements may last longer and merit consideration, yet such heterogeneities are usually related to the intrusion of major granitic bodies, which we have already cited as a major compositional heterogeneity (see above).

Furthermore, only features that are appropriately oriented with respect to stress direction [START_REF] Ring | The influence of preexisting structure on the evolution of the Cenozoic Malawi rift (East African rift system)[END_REF] and within a layer stiff enough to concentrate stress differentials [START_REF] Chenin | Influence of offset weak zones on the development of rift basins: Activation and abandonment during continental extension and breakup[END_REF] may have a chance of being reactivated. However, as these criteria cannot be determined a priori, we map inherited features without considering their orientation and position in-the depth domain.

Mapping method

Mapping of the selected inherited features described above is built on a compilation and reinterpretation of published data where available, and extrapolation based on published conceptual models where data are scarce or missing.

We consider the suture zones and deformation fronts as mapped by [START_REF] Franke | The Variscan orogen in Central Europe: construction and collapse[END_REF]; [START_REF] Ziegler | Crustal Evolution of Western and Central Europe[END_REF]; [START_REF] Ballèvre | Palaeozoic history of the Armorican Massif: Models for the tectonic evolution of the suture zones[END_REF] and [START_REF] Dadlez | Some key problems of the pre-Permian tectonics of Poland[END_REF] for the European Variscan domain and the southern Caledonian domain. Note that the extent of the Caledonian deformation south to the Variscan front is largely uncertain [START_REF] Woodcock | The Caledonian Orogeny: a multiple plate collision[END_REF] and may not include the Acadian / Ardenian and Brabantian orogenic domains [START_REF] Woodcock | A Rheic cause for the Acadian deformation in Europe[END_REF][START_REF] Sintubin | Early Palaeozoic orogenic events north of the Rheic suture (Brabant, Ardenne): A review[END_REF]. Location of the suture and deformation fronts in the northern part of Norway is after [START_REF] Asher | The millennium atlas of butterflies in Britain and Ireland[END_REF] and [START_REF] Mosar | Scandinavia-North Atlantic passive margin[END_REF], respectively, and the Variscan deformation front in northern Africa is from Frizon de Lamotte et al. (2011). The location of the Variscan foreland basin is after [START_REF] Franke | Tectonic settings of synorogenic sedimentation in the Variscan belt of Europe[END_REF] and [START_REF] Ziegler | Evolution of the Arctic-North Atlantic and the Western Tethys[END_REF]; the Caledonian foreland is mapped after [START_REF] Larson | Sveconorwegian and Caledonian foreland basins in the Baltic Shield revealed by fission-track thermochronology[END_REF]. Palaeozoic magmatic arcs are mapped after [START_REF] Edel | Tectonic evolution of the European Variscan belt constrained by palaeomagnetic, structural and anisotropy of magnetic susceptibility data from the Northern Vosges magmatic arc (Eastern France)[END_REF] and [START_REF] Roberts | The Scandinavian Caledonides: event chronology, palaeogeographic settings and likely modern analogues[END_REF]. Collapse-related intrusions and underplating are assumed to be present under the whole Variscan orogen as proposed by [START_REF] Petri | Formation et exhumation des granulites permiennes : Établir les conditions prerift et déterminer l'histoire de l'exhumation syn-rift[END_REF], as well as depleted mantle, which was the source of this magmatic event [START_REF] Müntener | Refertilization of mantle peridotite in embryonic ocean basins: trace element and Nd isotopic evidence and implications for crust-mantle relationships[END_REF][START_REF] Rampone | Mantle dynamics during Permo-Mesozoic extension of the Europe-Adria lithosphere: insights from the Ligurian ophiolites[END_REF].

Inheritance map: highlights

The map resulting from the compilation of these published data and models is presented on

Mapping rift domains

Definition

In order to highlight rift architecture we define three first-order domains (Figure 3 a) as a function of their lithology (i.e. continental crust, oceanic crust or mantle), their crustal thickness and the amount and type of extensional deformation (e.g. [START_REF] Lavier | A mechanism to thin the continental lithosphere at magma-poor margins[END_REF] for definition and extended discussion of rift deformation modes). In order to limit our mapping to the firstorder architecture defined with criteria as robust as possible, we use a simplification of the methodology developed by [START_REF] Sutra | Quantification and restoration of extensional deformation along the Western Iberia and Newfoundland rifted margins[END_REF] and [START_REF] Tugend | Formation and deformation of hyperextended rift systems: Insights from rift domain mapping in the Bay of Biscay-Pyrenees[END_REF].

On the one hand, the proximal domain is made of un-or barely thinned (∼ 30 km thick) continental crust and flat Moho. In this area, deformation is limited to, at most -the socalled stretching mode [START_REF] Lavier | A mechanism to thin the continental lithosphere at magma-poor margins[END_REF]. On the other hand, the oceanic domain corresponds to the homogeneous ∼ 6 to 7 km / ∼ 2 sTWT thick oceanic crust resulting from steady-state seafloor spreading after the onset of the so-called magmatic mode (e.g. [START_REF] Manatschal | The role of inheritance in structuring hyperextended rift systems: Some considerations based on observations and numerical modeling[END_REF]. Between these two lightly deformed domains, the distal domain encompasses most of the strain associated to rifting. It is comprised of more or less thinned continental crust and potentially of exhumed mantle and / or magmatic addition. It includes (Figure 3 a) the necking domain, the coupled (also called hyperextended, e.g. [START_REF] Doré | Research focus: Hyperextended continental margins-knowns and unknowns[END_REF] domain and the exhumation domain as defined by [START_REF] Sutra | Quantification and restoration of extensional deformation along the Western Iberia and Newfoundland rifted margins[END_REF], however mapping marginal domains with such an accuracy is beyond the scope of this study and requires development of further techniques.

Mapping method and limitations

The limit between the proximal domain and the distal domain corresponds to the necking point, a more or less abrupt thinning of continental crust (Péron-Pinvidic and [START_REF] Péron-Pinvidic | The final rifting evolution at deep magma-poor passive margins from Iberia-Newfoundland: a new point of view[END_REF]. The resulting deepening of top basement and shallowing of the Moho, which are usually well-imaged both on refraction and reflection seismic sections [START_REF] Mooney | Coincident seismic reflection/refraction studies of the continental lithosphere: a global review[END_REF], translates into a significant creation of total accommodation space (e.g. [START_REF] Sutra | Quantification and restoration of extensional deformation along the Western Iberia and Newfoundland rifted margins[END_REF]. However, these data are scarce and very local with regard to the scale of our mapping. In this sense, gravimetric analysis is a useful independent method revealing the necking zone and allowing its correlation between seismic sections [START_REF] Murray | Regional geological interpretation of a digital coloured residual Bouguer gravity image of eastern Australia with a wavelength cut-off of 250 km[END_REF]. We use the Bouguer anomaly of the World Gravity Map (The International Gravimetric Bureau, 2012), which we filter passing wavelengths < 200 km and removing wavelengths > 400 km in order to highlight local-scale events such as a necking zone with respect to large-scale Moho depth variations. Importantly, care should be taken to reconcile differences between predicted present-day Moho (corresponding to top 3.3 g.cm -3 peridotite) and top serpentinized peridotite as frequently observed on reflection seismic data.

The limit between the distal domain and the oceanic domain corresponds to the onset of steady state oceanic crust, which is commonly well-imaged on seismic sections as a regular 6 - 7 km / 2 s TWT thick layer on top of which sediments are deposited passively. As in most places this transition matches with the first magnetic anomaly [START_REF] Bronner | Magmatic breakup as an explanation for magnetic anomalies at magma-poor rifted margins[END_REF], thus we use the EMAG2 Earth Magnetic Anomaly Grid as a large-scale template to interpolate between seismic sections.

TGS + LG12

We rely on the work by [START_REF] Tugend | Formation and deformation of hyperextended rift systems: Insights from rift domain mapping in the Bay of Biscay-Pyrenees[END_REF] in the Bay of Biscay and Iberian Margin.

We use reflection seismic profiles from the BIRPS survey as well as interpretation of seismic (2013) and [START_REF] Welford | Lithospheric density variations and Moho structure of the Irish Atlantic continental margin from constrained 3-D gravity inversion[END_REF] in the Newfoundland-Flemish Cap region. Note that the Celtic Sea may have reached the point of necking, but as this hypothesis has not been asserted yet we do not include it in our map.

However, it is important to keep in mind that this approach is only rigorous for magmapoor margins. In the case of extensive magmatic additions as in northern North Atlantic, the architecture of the initial continental crust may be concealed on seismic data as well as in the gravimetric record. Therefore, we display on our map the location of extruded, intruded or underplated magmatic additions (Figure 3 b). This compilation is built from the studies by [START_REF] Meyer | The North Atlantic Igneous Province: A review of models for its formation[END_REF]; [START_REF] Blystad | Structural elements of the Norwegian continental shelf. part II: The Norwegian Sea region[END_REF]; [START_REF] Lundin | Hyperextension, serpentinization, and weakening: A new paradigm for rifted margin compressional deformation[END_REF][START_REF] Gernigon | The Norway Basin revisited: From continental breakup to spreading ridge extinction[END_REF]; [START_REF] Storey | Timing and duration of volcanism in the North Atlantic Igneous Province: Implications for geodynamics and links to the Iceland hotspot[END_REF]; [START_REF] White | Imaging and regional distribution of basalt flows in the Faeroe-Shetland Basin[END_REF]; [START_REF] Clift | Paleogene igneous underplating and subsidence anomalies in the rockall-Faeroe-Shetland area[END_REF] and [START_REF] Chalmers | Development of the continental margins of the Labrador Sea: a review[END_REF].

Rift domains map: highlights

The map resulting from this compilation is shown on Figure 3 5 Mapping rift timing

Definition

In the previous section we define rift domains associated with deformation modes. In this section, we aim to date the transition between stretching and necking and the transition between hyperextension / exhumation and seafloor spreading, which correspond to the proximal and distal limit of the distal domain, respectively.

The transition between stretching and necking is a localization process in that, the initially widely distributed extension starts to focus on a few faults, resulting in the abandonment and sealing of the most proximal sedimentary basins (Figure 4 a). This event is recorded by the deposition of the so-called necking unconformity (see [START_REF] Masini | The Alpine Tethys rifted margins: Reconciling old and new ideas to understand the stratigraphic architecture of magma-poor rifted margins[END_REF] in the proximal domain, which is usually well-imaged on reflection seismic sections as the transition between syn-tectonic / fan shape deposits and passive infill (e.g. right insert in Figure 4 a). In more distal settings, these surfaces often appear as major surfaces of passive onlap onto rotated and truncated strata -e.g. the approximate Base Cretaceous 'Late Cimmerian surface' of the North Atlantic domain, [START_REF] Erratt | The evolution of the Central North Sea Rift[END_REF].

The transition between hyperextension / exhumation and steady-state seafloor spreading referred to as the lithospheric breakup is also a localization process in the sense that extension via deformation of pre-existing material is replaced by accretion of newly-formed magmatic material.

Therefore, this event is also recorded as a transition from syn-tectonic deposits to passive infill, comparable to the necking unconformity. Thus, the breakup unconformity is younger than the latter and only exists in the distal domain. Note however that the existence of a unique breakup unconformity recording the onset of seafloor spreading is widely debated, since in several cases lithospheric breakup is pre-dated by the play of successive detachment delocalizing the deformation towards the rift axis, each step being associated with the formation of a discrete 'breakup unconformity' (e.g. Australian northwest shelf, [START_REF] Gillard | Tectonomagmatic evolution of the final stages of rifting along the deep conjugate australianantarctic magma-poor rifted margins: Constraints from seismic observations[END_REF].

Mapping method and limitations

Because of the scarcity of drilling at deep margins, thus of direct dating, we rely on published data to assign a necking and lithospheric breakup age to each distal domain. It is important to keep in mind that rifting may be polyphase, meaning that several independent extensional events may have succeeded and / or overlapped one another, leading to complex rift histories and associated sedimentary records.

Necking in Iberia-Newfoundland begins at 145 Ma and lithospheric breakup occurs at 112 Ma [START_REF] Sibuet | Early Cretaceous motion of Flemish Cap with respect to North America: implications on the formation of Orphan Basin and SE Flemish Cap -Galicia Bank conjugate margins M25-M0 (Late Jurassic -Early Aptian) extension[END_REF][START_REF] Bronner | Magmatic breakup as an explanation for magnetic anomalies at magma-poor rifted margins[END_REF][START_REF] Sutra | Quantification and restoration of extensional deformation along the Western Iberia and Newfoundland rifted margins[END_REF], while at 140 Ma and 110 Ma, respectively in the Bay of Biscay [START_REF] Thinon | Deep structure of the Armorican Basin (Bay of Biscay): a review of Norgasis seismic reflection and refraction data[END_REF]. Necking is late Jurassic -early Cretaceous in east and west Orphan Basin, Rockall Trough Porcupine Basin and Flemish Pass, and late Cretaceous in westernmost Orphan Basin and Labrador Sea [START_REF] Sibuet | Early Cretaceous motion of Flemish Cap with respect to North America: implications on the formation of Orphan Basin and SE Flemish Cap -Galicia Bank conjugate margins M25-M0 (Late Jurassic -Early Aptian) extension[END_REF]. Necking in Hatton Basin is late Jurassic -early Cretaceous [START_REF] Shannon | Structural setting, geological development and basin modelling in the Rockall Trough[END_REF] and breakup occurs at 53 -56 Ma [START_REF] Elliott | Influence of margin segmentation upon the break-up of the Hatton Bank rifted margin, NE Atlantic[END_REF]. For rifting between Goban Spur and Flemish Cap, necking is post-Barremian and lithospheric breakup late Albian [START_REF] De Graciansky | The Goban Spur transect: Geologic evolution of a sediment-starved passive continental margin[END_REF]. Necking begins during late Lower Cretaceous in Labrador Sea and breakup is dated at 61 Ma [START_REF] Chalmers | Development of the continental margins of the Labrador Sea: a review[END_REF][START_REF] Keen | The volcanic margins of the northern Labrador Sea: Insights to the rifting process[END_REF]. Necking is Latest Jurassic in the North Sea and Mid-Norway [START_REF] Erratt | The evolution of the Central North Sea Rift[END_REF] as well as between Greenland and Jan Mayen [START_REF] Lundin | A tectonic model for the Norwegian passive margin with implications for the NE Atlantic: Early Cretaceous to break-up[END_REF][START_REF] Melankholina | Tectonotype of volcanic passive margins in the Norwegian-Greenland region[END_REF], while it is Cretaceous along southern Greenland [START_REF] Péron-Pinvidic | Structural comparison of archetypal Atlantic rifted margins: A review of observations and concepts[END_REF]. Lithospheric breakup is Eocene between Norway and Greenland and between Norway and Jan Mayen [START_REF] Talwani | Evolution of the Norwegian-Greenland Sea[END_REF][START_REF] Roberts | Palaeozoic to Tertiary rift and basin dynamics: mid-Norway to the Bay of Biscay -a new context for hydrocarbon prospectivity in the deep water frontier[END_REF][START_REF] Péron-Pinvidic | Structural comparison of archetypal Atlantic rifted margins: A review of observations and concepts[END_REF], while it occurs in late Oligocene between Jan Mayen and Greenland [START_REF] Melankholina | Tectonotype of volcanic passive margins in the Norwegian-Greenland region[END_REF]. The amount of breakup related magma is another striking characteristic differentiating the northern from the southern part of the North Atlantic rift system. Indeed, north to the Variscan front breakup is magma-rich, leading to the formation a thicker-than-normal 'transitional oceanic crust' made of Seaward Dipping Reflectors (> 10 km, e.g. [START_REF] White | Oceanic crustal thickness from seismic measurements and rare earth element inversions[END_REF]) progressively evolving into a 'normal', steady-state, oceanic crust. In contrast, breakup is magma-poor to the south (Figure 3 b). It is interesting to note that, although magmatic additions in northern North Atlantic are not concomitant to the formation of the distal domain but are younger since they overlie it, magma-rich systems in this region seem to be characterized by a long time lag between necking and breakup. Therefore, we suggest that, in the case of the North Atlantic rift, protracted and / or polyphase extension may be responsible for, or a prerequisite to, magma-rich breakup. This idea could be tested in other rifted margins globally.

On the other hand, [START_REF] Roberts | Palaeozoic to Tertiary rift and basin dynamics: mid-Norway to the Bay of Biscay -a new context for hydrocarbon prospectivity in the deep water frontier[END_REF] described the opening of the North Atlantic in terms of one northward propagating rift terminating in the Porcupine basin and a southward propagating rift terminating in the North Sea (e.g. Figure 4 b). These two extended domains were subsequently abandoned when the two branches of the North Atlantic rift became coalescent offshore United-Kingdom. Here again, the Variscan front is precisely located between these two basins, supporting the proposition that it is a major limit.

Interestingly, the Charlie-Gibbs fracture zone seems to be the continuation offshore of the Variscan deformation front (or of the Rheic suture?) and marks a very sharp limit between magma-rich and magma-poor breakup (Figure 1).

However, regardless of whether it affects Caledonian or Variscan terranes, the North Atlantic rift reactivates the sutures corresponding to former large (> 2,000 km) oceans (e.g. Iapetus and Rheic Oceans), while sutures corresponding to former small (< 500-1,000 km) oceanic basins are little affected (e.g. Tornquist Seaway, Rhenohercynian, Saxothuringian and Medio-European oceanic basins). Besides, the contrasting behaviour of the North Atlantic rift relative to suture zones depending on the size of the corresponding former ocean strongly suggests that the pre-orogenic story -in particular the characteristics of intervening subduction(s) -have a major impact on subsequent rifting. Hypotheses to be tested include (1) the impact of the maturity (lithology and thermal state) of the slab; and (2) the duration of the subduction and associated tectonic, magmatic and metasomatic processes such as the existence of a magmatic arc, existence of a back arc basin, enrichment of the mantle by subducted fluids and sediments.

Areas for further research

Conclusion

Throughout this paper we present new large-scale mapping methods driven by observations that highlight the architecture and timing of rift systems, as well as the distribution of firstorder orogenic inheritance. Application of this approach to the North Atlantic rift system and adjacent Caledonian and Variscan orogenic domains shows that: (1) not all rift systems that go beyond necking achieve breakup (e.g. Rockall, Orphan, Porcupine basins); (2) breakup related magmatism is mostly restricted to the distal domain;

(3) the North Atlantic rift characteristics differ depending on the type of orogenic lithosphere it affects. In the case of the Caledonides, it cuts through the orogen and parallels its structural grain, has a protracted duration (> 80 Myr) and a magmatic breakup. Conversely the rift circumvents the core of the Variscan orogen, its duration is much shorter (< 50 Myr) and the breakup is magma-poor; (4) whether or not suture zones are reactivated during the North Atlantic rifting seems to be strongly influenced by the size of the corresponding former ocean: rifts tend to follow sutures resulting from the closure of large (> 2,000 km) oceans, while avoiding these associated to the closure of small (< 500-1,000 km) oceanic basins.

Acknowledgement

This research was supported by Exxon Mobil in the framework of the project CEIBA. We thank G. Karner and C. Johnson for discussion at several stages of this work. We acknowledge T. Doré and D. Frizon de Lamotte for constructive reviews and helpful comments.

Figure 1 :

 1 Figure 1: Overview of the main orogenic domains and associated major structures along the North Atlantic Ocean, and extent of breakup related magmatism. Sutures in North-America are after van Staal et al. (2012) and Connors and Pryer (2014) and deformation fronts after Arenas et al. (2014). See section 3.3 for references related to Europe and Greenland orogenic inheritance and magmatism extent.

Figure 2

 2 Figure2: a) Definition of orogenic inheritance as the deviation between an ideal, horizontally homogeneous, 'layer-cake'-type lithosphere and a real, heterogeneous, lithosphere (modified after[START_REF] Manatschal | The role of inheritance in structuring hyperextended rift systems: Some considerations based on observations and numerical modeling[END_REF]; b) Maps of the main Palaeozoic and Mesozoic orogenic domains (left)

  Figures 1 and 2 b and highlights the following: (1) the North Atlantic rift follows the sutures left by the closure of the large Iapetus (Caledonian) and Rheic (Variscan) Oceans;(2) conversely, the rift abandons the sutures corresponding to the smaller Caledonian Tornquist Seaway (after a phase of extension, which formed the Central Graben, e.g. section 4) and avoids those corresponding to the Variscan Rheno-Hercynian, Saxo-Thuringian and Medio-European oceanic basins.

Figure 3

 3 Figure 3: a) Definition of the rift domains used to map the North Atlantic rift system, based on the TGS and LG12 reflection seismic section of the Iberian margin and simplified after Sutra et al. (2013); b) Map of the rift domains and breakup related magmatism along the North Atlantic margins 10

  reflection and refraction data by[START_REF] White | Crustal structure of the Hatton and the conjugate East Greenland rifted volcanic continental margins, NE Atlantic[END_REF],[START_REF] Welford | Comparison of lithosphere structure across the Orphan Basin' Flemish Cap and Irish Atlantic conjugate continental margins from constrained 3D gravity inversions[END_REF],[START_REF] Klingelhöfer | Crustal structure of the NE Rockall Trough from wide-angle seismic data modeling[END_REF],[START_REF] Kimbell | Three-dimensional gravity and magnetic modelling of the Irish sector of the NE Atlantic margin[END_REF],[START_REF] Hopper | Structure of the SE Greenland margin from seismic reflection and refraction data: Implications for nascent spreading center subsidence and asymmetric crustal accretion during North Atlantic opening[END_REF] and[START_REF] Funck | A refraction seismic transect from the Faroe Islands to the Hatton-Rockall Basin[END_REF], and crustal thickness compilation by[START_REF] Ziegler | Crustal Evolution of Western and Central Europe[END_REF] along the Irish-United Kingdom margins. In the Norwegian sector, we build on seismic interpretations by[START_REF] Faleide | Structure and evolution of the continental margin off Norway and the Barents Sea[END_REF] and crustal thickness compilation by[START_REF] Ebbing | New compilation of top basement and basement thickness for the Norwegian continental shelf reveals the segmentation of the passive margin system[END_REF]. Definition of rift domains in the North Sea as well as in the Mediterranean area is based on the crustal thickness map by[START_REF] Ziegler | Crustal Evolution of Western and Central Europe[END_REF]. We build on the interpretation by[START_REF] Péron-Pinvidic | Structural comparison of archetypal Atlantic rifted margins: A review of observations and concepts[END_REF] for the Jan Mayen microcontinent. Along the east-Greenland margin we use refraction seismic models by[START_REF] Hopper | Structure of the SE Greenland margin from seismic reflection and refraction data: Implications for nascent spreading center subsidence and asymmetric crustal accretion during North Atlantic opening[END_REF] and[START_REF] Korenaga | Crustal structure of the southeast Greenland margin from joint refraction and reflection seismic tomography[END_REF], and use refraction and reflection seismic data published by[START_REF] Louden | The deep structure of non-volcanic rifted continental margins[END_REF] along southwest Greenland. Definition of rift domains in the Baffin Bay area is also based on seismic interpretation by[START_REF] Louden | The deep structure of non-volcanic rifted continental margins[END_REF], as well as on the study by[START_REF] Chalmers | Development of the continental margins of the Labrador Sea: a review[END_REF]. Finally, we build on the work by[START_REF] Funck | Crustal structure of the ocean-continent transition at Flemish Cap: Seismic refraction results[END_REF];[START_REF] Hopper | Continental breakup and the onset of ultraslow seafloor spreading off Flemish Cap on the Newfoundland rifted margin[END_REF];[START_REF] Shillington | Evidence for asymmetric nonvolcanic rifting and slow incipient oceanic accretion from seismic reflection data on the newfoundland margin[END_REF]; Péron-Pinvidic and Manatschal (2010); Sutra et al.

  b and highlights: (1) distal domains are not always associated with lithospheric breakup (e.g. North Sea, Rockall and Hatton Trough, Porcupine Basin and Flemish Pass); (2) the distal domain is comparably wide on both sides of the southern North Atlantic; conversely, the eastern distal domain of the northern North Atlantic is significantly wider than its conjugate and, unlike the latter, it contains ribbons of barely thinned continental crust (Rockall, Hatton and Porcupine banks); (3) the magmatic additions in the northern North Atlantic are broadly limited to the distal domain, in particular their most distal limit usually corresponds to the transition to oceanic crust.

Figure 4

 4 Figure 4: a) Definition of how the two major deformation mode shifts, namely the necking and lithospheric breakup, are recorded in the sedimentary sequence; b) Maps highlighting the timing of necking (top left), lithospheric breakup (top right) and time lag between these two events (bottom) for the North Atlantic rift system 14

  Differences in the architecture, duration and amount of breakup related magmatism in the North Atlantic are dependent on wether the rift system affects Caledonian or Variscan orogenic lithosphere. This observation supports the hypothesis that inheritance significantly impacts subsequent rifting phases. Possible controlling factors include: (1) the thermal state, which depends on the time lag between the last orogeny and the rifting (∼ 200 Myr for the Caledonides versus ∼ 100 Myr for the Variscides); (2) the number and size of the oceans involved in the orogen (essentially one large ocean in the case of the Caledonides versus multiple small oceanic basins in the case of the Variscides); and (3) the characteristics of the post-orogenic collapse (purely mechanical in the case of the Caledonides, while associated with significant magmatism in the case of the Variscides).


Dr Alain Deutsch
email: deutsch@polyspace.com

Session 2A: Testing NEXT GENERATION TESTING TOOLS FOR EMBEDDED APPLICATIONS

Keywords: run-time errors, static verification, software reliability

This paper is a tutorial on the principles and applications of static verification of dynamic properties to development, verification and validation of embedded applications. The topics covered include what static verification of dynamic properties is, how it works, how it can help in verification and validation activities. It will also present an industrial tool for the automatic detection of run-time errors.

INTRODUCTION

The principles of static verification of dynamic properties are based on a paradigm that is at the heart of other engineering activities. Activities such as designing a bridge, computing the trajectory of a satellite or optimizing the shape of a plane wing are all based on applied mathematics, whose use is facilitated by highspeed processors. If we want to formalize this statement, we would say that all these engineering activities are based on a central paradigm that consists of a three-step method:

Modeling a physical world system as a set of mathematical equations Solving these equations using highspeed processors Using the solutions to these equations to predict the behavior of the physical system However, there is one engineering activity that has not yet fully benefited from this paradigm when it comes to verification and validation: software engineering. Indeed, software validation is still often mostly based on test techniques which consist in enumeratively executing the application a high number of times. If you succeed in running a high enough number of executions without observing any error, then the software is considered validated. Unfortunately this does not imply that the software is free of run-time errors. Indeed, detecting a run-time error during tests requires:

1. Executing the right statement during tests … 2. … with the right combination of values (as mere execution of the statement may not be enough) … 3. …and detect the error if it occurs (as triggering the error may not be enough)

Even achieving 100% statement coverage during tests may not be enough to detect all errors.

We thus propose to adopt a new approach to software validation: the use of methods based on applied mathematics such as static verification of dynamic properties.

WHAT IS STATIC VERIFICATION OF DYNAMIC PROPERTIES?

Static verification of dynamic properties is a software analysis technique that is based on data-flow analysis. Data-flow analysis is a branch of computer science which aims to statistically compute program properties. It is basically done in two steps: translating programs into equations over lattices and then solving these equations by fixed-point iterations. It is now widely used in modern compilers for code optimization purposes. It was pioneered by Kildall in 1973 [START_REF] Kildall | A unified approach to global program optimization[END_REF].

Here are a few examples of program-point specific properties computable by data-flow analysis used in optimizing compilers: A first example is the computation of live variables. The basic idea is to determine a set of variables that will be possibly used in the future so as to be able to allocate the same register to variables that are not simultaneously live. A second example is constant propagation. Here the aim is to replace reads of variables which always have the same value at a given point by a constant. A third example is computing available expressions. It consists in determining a set of expressions that are always evaluated in the past and so to proceed to Common Subexpression Elimination (CSE). Similarly, determining very busy expressions -a set of expressions which will always be evaluated in the future allows loop invariant elimination and code motion.

Those are all examples of what is currently done through the use of traditional data-flow analysis. On the other hand, static verification of dynamic properties extends data-flow analysis by providing an additional theoretical framework that allows the mathematical justification of data-flow analyzers, the design of new data-flow analyses and the handling of particular infinite sets of properties ( [START_REF] Sintzoff | Calculating properties of programs by valuations on specific models[END_REF], [START_REF] Wegbreit | Property extraction in wellfounded property sets[END_REF] and [START_REF] Cousot | Systematic design of program analysis frameworks[END_REF]).

To further describe how static verification of dynamic properties works, we now consider a simple flowchart language as an example. This consists in: 32 bits integer variables and integers; arithmetic operations; assignments; conditionals and loops.

In this language, states are pairs consisting of: An integer representing the current flowchart instruction to be executed A vector of integers in a n-dimensional state where n is the number of variables in program P

We define what strongest global invariants SGI(k) are: SGI(k) is the set of all possible states that are at program point k and reachable in program P. For the flowchart language defined previously, it is a set of points in an n dimensional space. A run-time error is then triggered when SGI(k) intersects a forbidden zone.

SGI(k) is the result of formal proof methods, or it can be expressed as least fixed-points of a monotonic operator on the lattice of a set of states. SGI(k) may thus be seen as the solution of a system of equations whose unknowns are sets of states. We use the Floyd/Park/Clarke method [START_REF] Floyd | Assigning meaning to programs[END_REF], [START_REF] Park | Fixpoint induction and proofs of program properties[END_REF] and [START_REF] Clarke | Program invariants as fixedpoints[END_REF] as follows:

Step 1: Translate program P to a system:

X 1 = F 1 (X 1 ,…,X m ) X 2 = F 2 (X 1 ,…,X m ) … X m = F m (X 1 ,…,X m )
Step 2: Compute the least solution (

V 1 ,…,V m )
We do this by using a Kleene ascending sequence:

X i,0 =∅ X i,k+1 =F i (X 1,k ,…,X m,k )
We now define the result: SGI(p)=V p Let us consider an example of such a computation with the following program:

K=ioread_i32(); 1. I=2; 2. J=K+5; 3.
while (I<10) { 4. I=I+1; 5. J=J+3; 6. } 7.

… / (I-J)

Here the non-obvious risk is a divide-by-zero.

That is what we are going to check with the Floyd/Park/Clarke method.

Step 1: Translate program P to a system

We get the following set of equations:

X 0 ={(0,0,k) Ι k∈[-2 31 ,2 31 -1]} X 1 ={(2,j,k) Ι (i,j,k) ∈ X 0 } X 2 ={(i,k+5,k) Ι (i,j,k) ∈ X 1 } X 3 = X 2 ∪ X 6 X 4 ={(I+1,j,k) Ι (i,j,k) ∈ X 3, i<10} X 5 ={(i,j+3,k) Ι (i,j,k) ∈ X 4 } X 6 = X 5 X 7 ={(i,j,k) Ι (i,j,k) ∈ X 3, i ≥10} X 8 ={(i,j,k) Ι (i,j,k) ∈ X 7, i-j ≠0} X error ={(i,j,k) Ι (i,j,k) ∈ X 7, i-j =0}
Step 2: Compute the least solution

X 0 ={(0,0,k) Ι k∈ [-2 31 ,2 31 -1]} X 1 ={(2,0,k) Ι k∈ [-2 31 ,2 31 -1]} X 2 ={(2,k+5,k) Ι k∈ [-2 31 ,2 31 -1]} X 3 ={(i,j,k) Ι k∈ [-2 31 ,2 31 -1],i∈ [2,10],j=k+3i-1} X 4 ={(i,j,k) Ι k∈ [-2 31 ,2 31 -1],i∈ [3,10],j=k+3i-4} X 5 ={(i,j,k) Ι k∈ [-2 31 ,2 31 -1],i∈ [3,10],j=k+3i-1} X 6 = X 5 X 7 ={(10,j,k) Ι k∈ [-2 31 ,2 31 -1], j=k+29} X 8 ={(10,j,k) Ι k∈ [-2 31 ,2 31 -1], j=k+29, j≠0} X error ={(10,10,-19)}
Dividing by zero will occur at point 8 when K = -19. Observe that this constant does not appear in the source.

It can be represented graphically as follows:

However, for general purpose languages, SGI(k) is non-computable. Indeed, the halting problem (deciding if a program stops) is reducible to checking that SGI(k)=∅ but the halting problem has been proved undecidable [START_REF] Turing | Computability and λ-definability[END_REF]. Thus computing SGI(k)=∅ is undecidable, as shown in [START_REF] Hoare | Incomputability[END_REF].

Static verification of dynamic properties aims at computing approximate solutions to SGI(k) ( [START_REF] Wegbreit | Property extraction in wellfounded property sets[END_REF] and [START_REF] Cousot | Systematic design of program analysis frameworks[END_REF]). The seminal idea is to:

1. Replace the system of exact equations by its image with a closure operator ρ that is :

monotonic: x⊆y ⇒ ρ(x)⊆ρ(y) extensive : x⊆ρ(x) idempotent : ρ(ρ(x)) = ρ(x)
2. Solve this approximate system in the abstract lattice ρ(L), possibly aided with widening operators.

Thus, the solution of the approximate system is necessarily a superset of the solution of the exact system. This approach is thus semantically safe.

We now represent graphically how it works:

Let's take an example. We want to check the following C language statement:

A = x / (x-y);
The correctness condition to check to make sure that no zero division runtime error can occur is (x-y)≠0

We may encounter three different situations.

1. The intersection between the failure state and the state space of the program is not empty :

In this case, there is a potential error.

2. The state space of the program is completely included in the failure state:

In this case, there is a certain error.

3. The failure state is outside the state space of the program :

In this case, there is provably no zero-divide error for this program statement that can occur in any future execution of the program.

However, to efficiently analyze real-world programs, this framework is not enough. Indeed, real-world programming languages set other challenges, such as the use of functions/subprograms, pointers, data structures (arrays, records…), dynamic allocation or multitasking. Thus, other abstract lattices must be defined. For example, it may be necessary to define a lattice of unitary-prefix monomial relations ( [START_REF] Deutsch | Interprocedural May-Alias Analysis for Pointers: Beyond k-limiting[END_REF] and [START_REF] Eilenberg | Automate, Languages and Machines[END_REF]) to represent complex pointer aliasing patterns such as:

{(*(*(X+I) +4), *(Y+j)) Ι i ≥ 2j+1}
In this case, the principle of the solution is to reduce the problem of representing relations over regular language L∈ Σ* to that of finitely representing sets of points in Z n . To do so, we use Eilenberg's unitary-prefix (UP) decomposition that maps each L to a finite number of UP monomials. Each UP monomial is then mapped to a set of points through Parikh's mapping or through free modular group decompositions.

To summarize, the key properties of this approach are the following:

A real error will never be signaled as no error due to the fact that we take into account a superset of all possible states An instruction which is always correct will never be signaled as certain error Exhaustive analysis of run-time errors is done by examining only operations signaled as potential or certain errors. The others can be seen as proven to be error-free. There is no need to provide test cases as inputs: the analysis is totally automatic Diagnostics are valid for any future execution: only one analysis is needed

APPLYING STATIC VERIFICATION OF DYNAMIC PROPERTIES: POLYSPACE VERIFIER

Because the concepts of static verification of dynamic properties were developed in the seventies, one may wonder why it has not been industrialized earlier. The answer to this question is a lack of available computing power -it is now possible to use static verification of dynamic properties on a high-end PC -and the fact that precise and scalable analyses were simply not available. Indeed, many published methods were either too imprecise or too costly (not scaling to more than a few hundred lines of code) to be actually usable in an industrial context.

Before exploring how static verification of dynamic properties has been industrialized, let

us define what it cannot do. Indeed, it is essential to understand that it addresses the dynamic behavior of the program by essence. Static verification of dynamic properties doesn't check any syntactic properties (such as readability, testability, maintainability or portability), but instead focuses on semantics. Syntax is the domain of rule-checking tools, and static verification of dynamic properties is not applied in such tools. Semantics is the realm of static verification of dynamic properties.

Static verification of dynamic properties has been successfully applied to detect run-time errors. Run-time errors are a well-defined set of errors that may lead to non-determinism, incorrect results or processor stop. A study conducted by Sullivan and Chillarege at IBM Watson and Berkeley found that 26% of all observed software faults and more than 57% of the highest severity faults (causing system outage or major disruption) were due to run-time errors.

Detecting run-time errors statically and at compilation time, thanks to static verification of dynamic properties, allows shortening and/or replacing the following activities :

Debugging, by finding run-time errors automatically Robustness testing, by pinpointing exhaustively sources of run-time errors Functional testing, by allowing these tests to not be interrupted by the late detection of robustness issues (requiring further work to localize the bug, fix it and then run non-regression tests) Code reviews and documentation, by extracting control and data flow information Code acceptance review, by providing an objective, third-party, way of measuring the quality of a given code The first industrial tool for detecting runtime errors using static verification of dynamic properties is PolySpace Verifier. This tool has been commercially available since 1999 for the analysis of Ada programs and since 2000 for the analysis of ANSI C programs. This tool addresses two essential needs of embedded software development: Green: the operation will never trigger a run-time error for all possible executions of the program Red: the operation will always (i.e. at each execution of the program) generate a run-time error. Grey: the operation cannot be executed -it is a piece of dead code Orange: this is a warning -there may be an error, depending on the specific calling context of the function that contains the operation The following is an example of a color-coded source code provided by PolySpace Verifier:

As to control and data flow documentation and understanding, PolySpace Verifier builds the global data dictionary and a concurrent access graph for each shared variable of the program. The following figure is an example of concurrent access graph provided by PolySpace:

INDUSTRIAL USE OF STATIC VERIFICATION OF DYNAMIC PROPERTIES

Among static verification of dynamic properties first industrial uses is the static analysis of the embedded ADA flight software and inertial central of the Ariane 5 launcher and the ARD (Atmospheric Re-entry Demonstrator). The analyzer designed by the author was used on the Ariane 502 flight program [START_REF] Ph | ARIANE 5 -The Software Reliability Verification Process[END_REF]. Since then, it has been successfully used by CNES and Aerospatiale on Ariane flight programs. As described in [START_REF] Ph | ARIANE 5 -The Software Reliability Verification Process[END_REF], these software programs consist of about 70,000 lines of code with five interacting parallel tasks.

After this first successful industrial use, static verification of dynamic properties has been industrialized by our team and turned into commercially available tools. New users from several industry sectors have experienced the efficiency of these tools:

An end-user in the avionics industry analyzed a Flight Management System (FMS) of about 500,000 lines. The conclusion of this end-user was that "the cost savings allowed by the tool in the final phase of the project was between $150,000 and $250,000" as a consequence of several serious errors uncovered by the tool -including data races. CSEE, a railway signaling systems company, also reported successful use of static verification of dynamic properties in its development teams for the analysis of several embedded software programs in Ada and ANSI C with sizes between 20,000 and 80,000 lines of code. Triconex, a chemical industry company analyzed a fault-tolerant controller software for safety-critical units in petrochemical and chemical plants. Two applications of 70,000 lines of C code and 140,000 lines of Ada code were analyzed, yielding a savings of 10,000 man-hours of testing and a time-tomarket shortened by 6 to 12 months according to the user. A major international automotive supplier used static verification of dynamic properties to conduct a module-by-module analysis of 200,000 lines of diesel engine control software code. Several serious errors were found on a sample of 32 modules of a validated application despite 100% unittest coverage with automated test tools.

These examples are only a very partial list of industry sectors that benefit from static verification of dynamic properties. Indeed, more than 50 development teams all over the world have already adopted our tools and every embedded software developer which aims at reducing the cost of its testing effort and increasing the quality of its applications is a potential user of this kind of tool.

CONCLUSION

Static analysis to demonstrate the absence of run-time errors, once the domain of theoretical researchers, has come of age. Researchers gave it solid foundations. Yet using static verification of dynamic properties does not require any theoretical background. It is a radical breakthrough in software engineering that makes it possible to shorten the verification and validation cycle thanks to an earlier detection of run-time errors. It is a repeatable technique that may be used at any time, without any prior knowledge of the code to be analyzed. It also provides a strong improvement in reliability, as it is exhaustive by design.

  Static verification : it statically predicts specific classes of run-time errors and sources of non-determinism Semantic browsing: it statically computes data and control flow to improve program understanding, ease verification and demonstrate the compliance of the program with industry standards (SIL, DO178-B, MISRA, …) Run-time errors detected by PolySpace Verifier include: Dereferencing through null Out-of-bounds pointers Out-of-bounds array accesses Read access to non-initialized data Access conflicts on shared data (multithreaded applications and/or interrupt routines) Invalid arithmetic operations: division by zero, square root of a negative number … Overflow and underflow on integers and floating-point numbers Unreachable (dead) codeThe use of the tool is very simple. It takes as an input the code source of an application and produces as a result a color-coded source where each operation is classified according to the risk of run-time errors if it were executed. There are four categories:

-22 -23 January 2004

Acknowledgement. We thank Eric Pierrel for his editorial help.


Famantanantsoa Randimbivololona

Philippe Le Meur

Sébastien Lansiaux

Generalised simulation environment for software testing

come

Session 2A: Testing Title: Generalised simulation environment for software testing Authors:

Famantanantsoa RANDIMBIVOLOLONA (speaker) Philippe LE MEUR Sébastien LANSIAUX AIRBUS France AIRBUS France SOPRA Group EYYW EYYW e-mail: famanta.randim@airbus.com e-mail:philippe.lemeur@airbus.com e-mail: slansiaux@sopragroup.com phone: +33 561 930 825 phone: +33 561 183 049 phone: +33 561 008 500

Topics of the conference:

-Verification and validation

Abstract:

The cost of the verification process is certainly one of the major engineering issue in the domain of embedded safety-sensitive systems such as avionis. Test environments, made up of dedicated software and hardware means, are among the most significantly contributing factors. This paper reports about an alternative approach where test environments are totally simulated for all test phases. Simulation is not per se a new approach, the expected positive gap is expected from its generalisation. test phases coverage. Our works on this generalised simulation approach are part the on-going RNTL/ATLAS research project.

-Software testing in avionics domain

In the present verification engineering state-of-the-art, testing is the privileged verification technique. It is based on the execution of the software on a set of data selected on a requirements-driven basis. Manual techniques of reviews and inspection complete the tests. According to the DO-178B standards, the tests of an on-board software have two complementary objectives:

(a) The one is to demonstrate that the software satisfies its specifications (conformance with low level and high level requirements).

(b) The second objective is to demonstrate with a high degree of confidence that the errors, which could lead to unacceptable conditions of failure (as determined by the system safety analysis), have been eliminated.

Testing activities are structured in successive phases that are: unit test, integration test of sub-assemblies, integration test with the hardware, final integration test.

• Unit test address the verification of the properties of one decompositon unit of the software in the sense of verification (one verification unit corresponds to at least one realisation unit).

• Integration test of sub-assemblies address the correctness of units composition, the invariance of unit properties by composition, the correctness of a complex property by unit properties composition.

• Integration test with hardware address the correctness of the control of hardware resources by the software adn also some unit tests closely related with hardware characteristics of the target equipment.

• Final integration test address the conformity of the complete software running on the real target in a configuration that may require the presence of one, two or three target computers depending on the requirements points that have to be tested.

The ending of the whole testing activities is determined by the achievement of the test coverage which is defined by both functional and structural criteria.

This process supposes that in each of the test phases it is possible to control the execution of the program and to observe the changes of the relevant variables values. But neither embedded software, nor avionics have "natural" interfaces which enable/support these testability conditions. This can be achieved only with the use of test-oriented software and hardware means which are dedicated, intrusive, specific of each computer and its active environment. They are emulators, logic analysers, integration benches, test boards, test runtime/drivers, … Most of these means come from independent vendors so their mutual integration within a coherent test framewrok can rise difficult problems, sometimes unsolvable.

-The generalised simulation solution

In the generalised simulation approach, all the test environment are modelled and simulated by software. The main expected benefits are:

• Significant reduction of the test environments cost • Homogeneous, easy to use, dedicated-hardware-free test envronments ("all tests on a workstation"),

• Parallelisation of hardware cycle and software cycle,

• Non intrusive test,

• Debug capabilities for multiprocessors or distributed architectures However, there are some points that require extensive experiments and validation :

• Effective performances of the simulated computer/board,

• Accuracy of the simulated computer (notably for floating point),

• Address evenly all the test phases (unit, subassemblies integration, final integration)

• Qualification issues in a certified process

In this approach, only the relevant elements are taken into account in the model so that the simulation does not incur penalties due to test phase irrelevant extra-features (e.g. there is no need for a detailed micro-architecture model of a processor to deal with unit functional testing, an instruction set architecture model is sufficient). Typically for unit test, only a basic simulator -processor with memory-is needed. This basic simulator can be extended smoothly to include peripherals required for integration testing up to full equipment interacting with its active environment. This extension from simple to more complete model is done by component composition and reuse. The component are either basic components that are part of the tool (based on the CEA/CLAIRE tool) or userdefined models that have been stored in a components library.

-The current point

An industrial prototype of this tool is now available which handles a set of microprocessors among which the PPC 755 processor from Motorola and the SHARC 21060 DSP from Analog Devices. These processors are representative of current hardware that are used in avionics computers. Experiments with realistic avionics test workloads show that unit test as well integration test (including communication test) can be supported in a very simple way. More complex test environments are now under investigation.

The generalised simulation tool has three main functions:

• Graphical modelling. The real system of interest is asbtracted into a model that retains only the relevant characteristics. The model is expressed in terms of "typed" components interconnection.

• Then the simulator is built: description of the dynamics behavior of new user-components (in C code) and the executable simulator is generated automatically • The execution of the simulator with the target software can be done in an interactive mode with the use of gdb debugger, or in a "blind" batch mode for a totally automatic test process • The results of the execution are finally exploited using the trace analysis facilities that enable the verification of temporal properties over a finite execution trace.

ld d M Mo od de el ll li in ng g

	Real system	Système réel
	Components library MI IC CR RO OL LI IB B M	System model B Bu ui il Modelling interface
	Simulateur Test unitaire Unit test simulator	Simulateur pour l 'intégratio Integration test simulator	Simulation interface
		n
		R Ru un n	Analysis
			interface
	Trace	Trace
	C CL LA AI IR RE E

-22 -23 January 2004


Jean-Yves Brunel

Parades Alberto Ferrari

Eliane Fourgeau

Paolo Giusto

Session 2B: Development for Safety How Aerospace and Transportation Design Challenges can be addressed from Simulation-based Virtual Prototyping for Distributed Safety Critical Automotive Applications

Keywords: Embedded Software, Distributed Safety Critical Automotive Systems, Virtual Prototyping, Simula- tion, Fault Injection, Flight Control

The reduction of development and product costs for distributed and software dominated safety-critical automotive applications can only be achieved via novel methodologies and tool sets that address fault injection/analysis and integration testing via simulation-based virtual prototyping. In fact, earlier discovery of design errors and initial proof of safety in critical conditions should be addressed earlier using a system virtual prototype, before hardware and software implementations are available. In this paper, we propose a methodology that allows evaluating faulttolerant system architectures in the presence of errors caused by faults of hardware elements or interferences. We illustrate how the paradigm shift from physical to virtual integration platforms can be applied to Aerospace and Transportation domains effectively.

Introduction

The automotive industry has been adopting technologies such as by-wire, and new design and implementation paradigms such as distributed embedded software engineering and architectures, that are already familiar to aerospace engineers (e.g. fly-by-wire). On the other hand, we have also observed opposite phenomena such as the adoption by the airspace industry [START_REF] Tttech | Hamilton Sundstrand's Nord-Micro selects TTP® for Airbus A380 Cabin Pressure Control[END_REF] of serial bus protocols and time-triggered architectures, originally being defined for automotive applications. Essentially, the overall goals are common to both segments: from the OEMs standpoint, the need to manage new design complexities due to communicating sub-systems, time to market, and cost reductions, while from the driver/passenger's stand-point, the need for comfort and safety. Electronics is growing dramatically in both segments. It is expected that up to 90% of future vehicle innovations will be based on electronic embedded systems with the automotive semiconductor market expected to grow to 15.5 billion US dollars by 2010. As far as the aerospace segment is concerned, electronics has increased for on-board long and medium-range airliners. The major need that is emerging is navigation, control and tightly integrated communication resources on board, while providing increasingly sophisticated technologies and features to the passengers. Nowadays, airports and skies are increasingly congested thus airline crews are in major need of those resources. Comfort, just like in cars, plays a major role in determining the airline of choice and electronics enables airlines to provide passengers with improved and more sophisticated in-flight services. We also observe another interesting and common phenomenon. Both segments are looking for standards that facilitate the plug-and-play of functions and components in a modular architecture in order to favor re-use, better complexity management, streamlining of the design process and thus faster time to market. Automotive initiatives such as AutoOsar [START_REF]Home page[END_REF] and of course, in the past, OSEK [START_REF] Osek-Vdx | OSEK -Technical report[END_REF], are/have been aiming to make software functions inde pendent from the underlying hardware. As far as communication protocols are concerned, safety critical, failsafe/fault-tolerant, redundant and dependable protocols are being introduced, such as FlexRay [START_REF]Home page[END_REF], and TTP [START_REF]TTP/C specification V0.5. TTP Forum[END_REF]. These serial protocols provide the needed underlying safety services while hiding un-necessary details to the software developers 1 .Likewise, in the aerospace industry, Integrated Modular Electronics (IME), is key [START_REF]Growth Programme, Victoria: a new generation of aircraft electronic systems, Web Page[END_REF]. In a nutshell, this means that individual hardware and software modules can be removed and replaced interchangeably. Several projects have been and are under way such as PAMELA [START_REF] Pamela | Prospective analysis for modular electronic integration in airborne systems[END_REF] and VICTORIA [START_REF]Growth Programme, Victoria: a new generation of aircraft electronic systems, Web Page[END_REF]. "VICTORIA's main objective is to design, prepare and validate a new system that would integrate all on-board functions for commercial airliners, including both flight and passenger management systems" [START_REF]Growth Programme, Victoria: a new generation of aircraft electronic systems, Web Page[END_REF]. As far as safety analysis is concerned, as described in [START_REF] Amberkar | A SystemSafety Process for By-Wire Automotive Systems[END_REF] few methods for safety analysis exist already or have been defined. The methods pertain to: preliminary safety analysis (PSA), preliminary hazard analysis (PHA), detailed safety analysis (DSA), and safety integrity levels (SIL). "An example of a process used in the aerospace industry is DO-178B. The automotive industry is expected to use or develop a similar safety process" [START_REF] Pimentel | Designing safety-critical systems: A Convergence of Technologies[END_REF].

Another important aspect, common to both segments relates to the complex relationships and separation of tasks within the aerospace and automotive supply chains for electronics. The V-model is a popular formalism used to describe the development process of control software in the automotive domain. In our interpretation of the V-model, as showed in Figure 1, we envision at least 4 V-Cycles! The first top V-Cycle describes the partitioning into sub-systems, their integration into an overall distributed system implementing a complex distributed functionality, and validation of the integration of the distributed system as it is performed by a distributed system architect/integrator (OEM car manufacturer or a Tier1 supplier) -a typical example of such a complex system is an adaptive cruise-control sub-system interacting with a brake-by-wire, and a power train network. The sub-systems components are traditionally provided by the suppliers. At the bottom of the V-Cycle (orange triangle) all sub-systems are available, usually in form of prototyping boards. Next, the distributed system architect (now playing the role of the integrator) can oversee the integration of the sub-systems validating the overall functionality either in the test tracks (if it's safe to do so!) with man in the loop or in the lab with hardware in the loop systems simulating the controlled sub-systems (brakes, engine, etc…) and man in the loop. The second V-Cycle describes the sub-system development performed by a Tier1 supplier. In this case, the integration test pertains to the validation of the interaction between the electrical/electronic parts (ECUs, sensors, actuators) and the mechanical system being controlled (e.g. the brake). The development usually starts upon reception of functional and non-functional requirements provided by the car manufacturer in form of spreadsheets, and natural language documents. In the third V-Cycle, a simplified view of the ECU SW development process is described. The HW and SW development are performed in parallel, the SW development realized via emulation boards or instruction set simulators with hardware in the loop systems. Once the HW is available (4 th V-Cycle!), HW and SW integration takes place again with hardware in the loop systems simulating, for instance, the engine. We believe that, the same V-cycle, which in a nutshell, at each stage, pertains to partitioning of functionality and allocation of sub-functions to hardware resources, and verification of the sub-sequent integration, can be used to describe the development process of an integrated system in an aircraft. It is obvious that in an aircraft the subsystems are computers that are connected together with different redundancy schemes, rather than electronic control units. However, as we will see later in the paper, while many tools support the conventional V-Cycle development process and bring added value when introduced (e.g. automatic code generation), there is a need in both segments to reduce the cost of testing -nowadays estimated as up to 50% of the total development costs. We will describe in the next section how the concept of virtual integration platform can provide the required reduction in testing costs via early fault injection on a virtual prototype.

Distributed System Architect

Sub-System Engineer

ECU SW Architect

Distributed

The ARTIST [START_REF] Artist | Advanced Real Time Systems, Home Page[END_REF] Project main objective is "Co-ordinate the R&D effort in the area of Advanced Real-time Systems so as to • Improve awareness of academics and industry in the area, especially about existing innovative results and technologies, standards and regulations • Define innovative and relevant work directions identify obstacles to scientific and technological progress and propose adequate strategies for circumventing them." As part of its roadmap, the project focuses on "Design of Distributed Hard Real-Time Embedded Systems with particular emphasis on Software" [START_REF] Artist | Hard Real-Time Development Environments, Roadmap[END_REF]. In [START_REF] Artist | Hard Real-Time Development Environments, Roadmap[END_REF], a case study of a flight control system is described. In the initial phases of the design, high level system requirements are defined. Dependability issues are obviously part of the design in that fault containment techniques must be defined in order to guarantee the required safety. As described in the case study, this step is carried out via dedicated in-house modeling tools. In a next section of the paper, we will describe how fault injection on a virtual prototype can significantly reduce the cost of expensive tests in labs 2 . In summary, in this paper, we describe how the integration testing, usually taking place at the physical level, should be addressed earlier on a virtual prototype of the system, therefore making early discovery of design errors and, more importantly for safety critical systems, the proof that the system is safe, possible. For safety critical networks, high modeling effort is obviously justified because of safety requirements. This paper is organized as following. In the next section we describe the concept of virtual integration platform. In the section following next, we describe our fault injection and analysis capabilities. Then, we sketch some conclusions.

Virtual Integration Platform

We are continuing the work that has been described in [START_REF] Schiele | Rapid Design Exploration for Safety Critical Distributed Automotive Systems[END_REF]. Few years have past and the VCC technology [START_REF] Schiele | Rapid Design Exploration for Safety Critical Distributed Automotive Systems[END_REF] has taken shape as an automotive focused design environment called Cadence Automotive System Design Platform (hereafter called SysDesign), with foreseeable extensions to aerospace and transportation segments. The platform is an environment for contract-based design between the (distributed)-system architect and subsystem developer, and the system integrator. The main benefit of the solution is the formalization of the contract between, for instance the OEM system architect and the Tier1 sub-system provider [START_REF] Brunel | SoftContract: an Assertion-Based Software Development Process that Enables Design-by-Contract[END_REF]. The environment is based upon the following key points: • Top-Down constraint refinement from end-to-end constraints (e.g. "the response time from sensor to actuator must be less than 20ms") to finer grain constraints (e.g. SW task level) • Behavioral Model refinement from coarse grain models (e.g. simple C++ I/O function) to hierarchical and possibly imported models from third party tools such as Matlab/Simulink

• Communication Model refinement from abstract zero-time communications to protocol stack based communication models (e.g. CAN [START_REF] Bosch | CAN Specification Version 2.0[END_REF]). • Highly programmable and tunable/configurable architectural models: figures from the implementation world can be back-annotated (e.g. the SW task switching overhead) and/or used to re-assessed a different configuration (e.g. the measured bus traffic figure could be used to change the communication cycle layout of the network bus model). This is taking also into account some possible legacy sub-systems that have been already designed and are re-used within the overall application. • Design exploration by means of system level profiling and constraint annotation with usage of assertions and constraints to be used:

o Off-Line, as queries on the experiment and results data base (used by the system architect)

o On-Line, as simulation monitors (used for simulation based verification to check violations during simulation) o For Target, meaning to generate non-intrusive monitors for the downstream tools (e.g. SW monitors for the SW developer, bus monitors for the System Integrator performing the bus measurements, etc.)

Therefore, the comprehensive tool strategy for a virtual integration platform includes (Figure 2):

• A linkage with tools for the support of the specification of requirements, constraints and functionality

• A linkage with tools for functional model authoring

• A technology support for contract-based design exploration with provision of Soft Contract [START_REF] Brunel | SoftContract: an Assertion-Based Software Development Process that Enables Design-by-Contract[END_REF] capabilities for close loop refinement and interaction between system architect (exploring the system design space) and the ECU software developer and/or system integrator -this is SysDesign. • A linkage with tools for ECU Application SW generation In [START_REF] Giusto | Virtual Integration Platforms for Automotive Safety Critical Distributed Applications[END_REF], the concept of a virtual integration platform is described (Figure 3). In a nutshell, the platform supports a distributed model-based system design process based upon several orthogonal concepts:

• A design shift from physical integration to virtual integration of models • The extension of a single ECU model-based system design paradigm, in which the transformation from a design representation to its implementation is automatic

• The separation between executable models of control algorithms and the high level/abstract performance/functional models of the architectural resources including the network communication stack • A binding of control algorithm tasks to HW resources • A binding of functional abstract communications (signals and shared variables) to network protocol stack models • The automatic annotation of the control algorithm tasks and communications with timing performance formulae for dynamic computation (at simulation time) of the message transmission latencies over the network bus as well as the SW scheduling execution times due to shared resources (buses, CPUs) • The simulation of the bound virtual platform (e.g. representing a possible candidate distribution of functionality over the network) for verification purposes under regular conditions and/or with fault injection (e.g. data corruption, abnormal task delay, etc)

Notice that the virtual integration platform relies on the provision of library elements for both functionalities and architectural resources. The platform provides links with the most popular tools for algorithmic development and simulation, thus enabling the seamless import of such models and their composition in the overall distributed complex control function. The platform also provides models of popular communication protocols such as CAN. One important aspect, the XML-based programming capabilities provided by the platform constitutes the core of the linkage between the Cadence Automotive Platform itself and any other environment that utilizes XML-based data dictionaries. Should the schemas be different translations can be performed seamlessly via style sheets.

Simulation Based Fault Injection

Simulation based fault-injection and analysis is key in analyzing system resilience to faults before hardware set-ups are available. Not to mention, fault injection on a virtual prototype enables lower cost and repetitive tests and the system designer to inject faults in any architectural models of the simulated system at any given time, and then observe the performance and signal degradation, via a three-step process:

• Creation of fault models (by instrumenting architectural models)

• Definition of fault scenarios • Validation of the safety concept of the application via simulation

The following types of fault scenarios can be specified:

• Time Based

At "Time = 0.5ms" Inject Fault "BusX is Disconnected"

• State Based with conditional expressions

• Sequence Based (sequence of conditions to be evaluated true before injecting a fault) Faults can have the following attributes:

• Fault Type • Fault Absolute Time • Fault Duration • Fault Condition (Optional)
• Resource where the fault occurs (e.g. ECU2/CPU1) After running a 6 second clock-wall simulation, on a bus redundant ECU architecture for a drive and steer by wire system, the distributed system architect can discover that disconnecting faults have no impact on the signals, while, corrupted data faults have a huge impact, either in periodic or continuous mode, particularly on the brake actuators signals (Figures 45).

Conclusions

In this paper, we have described methodology and tool sets that enable the paradigm shift from physical integration testing to virtual model integration. The shift enables early discovery of design errors as well as has the potential to After "VariableX Set To 2 " Next "TaskY is Activated 1 to 3 Times" Next "CpuZ is Master " Inject Fault "BusX is Disconnected" When "CpuY is Master" Inject Fault "BusX is Disconnected" help designer to provide a first assessment that the application is safe and resilient to catastrophic faults (or at worse prove that it's not!). We do believe that similar techniques and approaches can be applied to other domains such as aerospace, which increasingly share with cutting-edge automotive applications, similar complexities, design challenges and times-to-market.

Figure 1 :

 1 Figure 1: V-Cycles for Distributed Systems

Figure 2 •

 2 Figure 2

Figure4

  Figure4: Fault Scenario Definition

1 CADENCE Automotive Team CONFIDENTIAL CADENCE AUTOMOTIVE TEAM FEATURE STRATEGY System Constraints Specification Functional Decomposition Functional Interface Definition Software Execution Architecture Definition Algorithm/Plant Development Constraint-Based Distributed Design Exploration with Fault Injection ECU Application Software Task Set-Up Generation ECU Application Software Code Generation ECU Communication Driver (Interface) Synthesis Unified Development Platform Regression Test Set-up Generation Model Interchange Format Architectural IPs ECU Application Software Development with HIL Network Bus Configuration Measurements and Analysis

-22 -23 January 2004

Note that in FlexRay the application software makes the final decision in case of critical situations, however, the software developer is using a software API.

The cost for setting up an experiment on a car is about $120-$500 per hour. The time needed to set it up is about 1 hour. The number of tests that can be performed every day is ~2[START_REF] Jutter | Current Trends in the Design of Automotive Electronic Systems[END_REF].

21 -22 -23 January 2004

Figure5: Brake Actuator Signals w/o and w/ fault injection