Véronique Ginouvès
email: veronique.ginouves@univ-amu.fr

In France and Europe, academic archivists

The sound archive at Aix was founded in 1979 by scholars specialized in Mediterranean Studies

The aims of the MMSH sound archives -To preserve the sources documenting research in the field: the recorded interviews -A potential re-use of the recordings for new research.

A new guideline appeared after France's ratification of the Convention for the Safeguarding of Intangible Cultural Heritage (1973) supported by UNESCO, which involves the managment of the cultural heritage of these archives.

Incentive practices lead to new deposits

The MMSH sound archives set up best practices and rules to receive new sound archives. The center created a complete methodological package from the collection to the dissemination of the sound archives. Preparing an interview for archival purposes: Taking care of the material aspects Be aware of : -The place of where the interview will be held, -Its length, -Your behaviour as an interviewer, -Take care of surrounding and interfering sounds and noises! (telephone, outside conversations, pets, open windows...).

Archives vs libraries

-Check your technical setup (electric plugs, taking notes, ...)

Recording sound -Quality of the recording device and the microphone, -Quality of the act of recording sound (orientation of the microphone, mastery of the recording device, verification of levels), -Quality of the recording format, -Quality of sound card, -Staying alert for sound disturbances during the interview, -Staying alert for electric charge on the recording device (battery ou transformer) -Systematic transfer of digital files and verification of their integrity as soon as possible after the end of each interview.

Always ask permission to record

By asking your interviewee for her/his permission to record, you change the status of her/his words: you transform private speech (between the witness and you) into a public one, potentially audible by a third party, and thus, usable, quotable.

Some ethical rules

-Never record without a person's knowledge, -Explain the context and objective of the survey to the interviewee, -Interrupt the recording if she/he asks for it, -Ask for permission to take photographs, -Never disclose the discussion with the interviewee to her/his acquaintances, -Sign the necessary agreement for the recordings, just like those used for images.

The introductory announcement for the interview

The introductory announcement identifies the file and avoids any kind of attribution error.

It indicates:

-the name of the interviewee, -the name of the interviewer (her/his details, role, job), -the date and time of the interview -the place of the interview -the purpose of the interview, and its framework (heritage survey for a deposit in an archive).

Digital preservation strategies for the unpublished sound archives

Many digital preservation strategies have been proposed. There is no single and ideal strategy is fitting all data types, situations or institutions.

What are the current options for the sound archives ?

Preservation strategies for the unpublished sound archives üBit-stream copying üDurable/persistent media üPreservation on the long term Remember: in the field of the sound archives we have to be careful to preserve all the sound players devices to listen to the archives (analog tapes and digital recorders).

Bit-stream copying

Is more commonly known as "backing up your data" and refer to the process of making an exact duplicate of a digital object.

Though a necessary component of all digital preservation strategies, bit-stream copying in itself is not a long-term maintenance technique, since it deals only with the question of data loss due to hardware and media failure whether resulting from normal malfunction and decay, malicious or natural disaster.

Bit-stream copying is often combined with remote storage so that the original and the copy are not subject to the same disastrous event. The digital information is copied from one long-term storage medium to another of the same type, with no change. Bit-stream copying should be considered the minimum maintenance strategy for even the most lightly valued, ephemeral data.

May reduce the need refreshing, and help diminish losses from media deterioration, as do careful handling, controlled temperature and humidity and proper storage

We choose WAVE because we are sure that this format is always valid, or we have to do a migration.

Migration theoretically goes beyond addressing viability by including the conversion of data to avoid obsolescence not only of the physical storage medium, but of the encoding and format of the data. However, the impact of migration has not been widely tested… In each case, the aim is to enhance the span life of digital documents while maintaining their authenticity and integrity through copying and the use of multiple storage locations (3 copies is the rule). • Those who fund its production?

• The researcher who created the project?

• The technicians who have recorded the archive? • The witnesses?

• Those who are cited in the interviews?

• The communities where the documents were created? • The institution where the sound is archived? • The website that hosts the data?

Bedouin wedding Jordania songs, recorded by [START_REF] Jenkins | The World Of Islam : Strings / Flutes and trumpets[END_REF][START_REF] Jenkins | The World Of Islam : Strings / Flutes and trumpets[END_REF], published in Music In The World Of Islam : Strings / Flutes and trumpets (1994). Telemeta CREM database, CNRSMH_E_2003_015_001_001_04.

List the stakeholders to understand how to respect the property right and ethics rules WHAT IS AN ORAL HISTORY IDEAL PROJECT?

-Careful attention to copyright and other legal and ethical issues and take care of the rights of present users as well as of future users -Use of high quality audio or video equipment, with available tools and standard formats to simplify storage. -Implement a meticulous structured analysis, using standards and cataloguing rules (ISAD-G, EAD, RDF...) with a high level of contextualisation. -Ensure that interviews are available in an archival repository and be vigilant about the integrity of the collection.

  8000 hours -4500 hours online respecting ethical and legal rules: on a data base Ganoub http://phonotheque.mmsh.humanum.fr & a Scholarly blog https://phonotheque.hypotheses.org The MMSH sound archives content : oral literature, ethnomusicology, techniques and know-how 0ral history & collective memory Language and cultural Identity Epistemology and Methodology: workshops, seminars, courses, seminars,

•

  The researcher (scientist, interviewer, student,…) • The informant (witness, interviewed, performer, musician ...) • The beneficiaries • The holders of related rights (sound engineer accompanying the researcher or witness ...) • Composer, arranger, lyricist of the work performed in the recording • The individuals mentioned in the recording • The institution which has set and/or funded the recording • The institution where the sound is archived • The depositary • The librarian/archivist who has catalogued the record • The communities who were interviewed • The social network which held the file. KEEP THE METADATA FREE… With the Open Archives Initiative Protocol for Metadata Harvesting (OAI-PMH) -a mechanism for repository interoperability -you expose structured metadata via OAI-PMH and Service Providers harvest them. Dedicate your metatada in the Public Domain: Creative Commons CC0 "No Rights Reserved"It ensures that all metadata aggregated can be published by any plateform under the same terms and used by anyone for any purpose without any restrictions.

  What is the MMSH sound archive or « Phonothèque de la MMSH » ?

	Please, introduce yourself and tell us about:
	-Your studies and your work experiences;
	-Your speciality at work;
	-What do you know about oral historiy & sound
	archive? Did you participate in the workshop last MMSH is a research and training year? campus for Humanities & Social
	Sciences with a focus on
	Mediterranean Studies. Its sound
	archive center preserves researchers'
	archives and disseminates them based
	on the principles of Open Science for
	sharing and reusing by researchers
	and civil society.

Libraries and Archives: Differences Archives Libraries and Some Special Collections

	Objective elements Traditional mandate for an Archives is to
	-A unique document: when it is
	not produced for commercial
	purposes, it does not refer to
	Closed stacks -your material will be retrieved for any standard or rules making ; Open stacks -you can browse and take items off the
	you; storage is secure and humidity controlled -Recorded on analog or digital shelf on your own
	To consult sound archives online you need the rights of all the stakeholders media	To consult a book online you need the rights of the publisher
	Organized by fonds / provenance, often containing -The main information that	Organized by subject containing for a single book
	individual items of various media, sharing a common origin, or provenance describe it are provided by the
	Group of material is described on a number of individual(s) who have	Material is described on an individual level (e.g.
	different levels: fonds level, series level and item recorded it: the packaging of catalogue record for a single book) level (hierarchy for context) You search the finding aid (listing of everything in the fonds) associated with the creator to find You search for materials on your subject using an online catalogue the box when there is one, the WHAT IS A SOUND ARCHIVE? naming of the file attachments.
	relevant records

acquire, appraise, select, preserve and make available records of enduring value for

  How will you organize the sound archives Fonds of our oral history project?

	use, memory, research, or evidence -records include all media types from public and/or private organizations, families, or persons Archives as record •created in the conduct of affairs or projects •residue of their creator(s) functions or activities •deemed to have enduring value: information, evidence, legal, historical SAA Glossary An isolated sound archive is mute Fonds Serie Serie Serie Sub-serie Sub-serie Sub-serie Sub-serie Sub-serie File File File File File File item item File File File File Levels of arrangements in a fonds =a conceptual whole that reflects the process of the production or accumulation of records that share a common function or activity and exhibit a natural unity Fonds Don't forget the juridical entity of the project Necessity of Jordanian Oral Create the [corporate name -Main Entry Marc21] a hierarchical description: the Fonds Memory Narratives in the 21st century Serie 1 -2018 World War One in Jordan Serie 2 -2019 Oral History & Sites of Memory Sub-serie: The Allawi district in karak by a long-time resident of several generations Sub-serie Sub-serie File Item: Picture of Mohammed Ibrahim Mubaideen and the interwiver Sub-serie Sub-serie Sub-serie File File Sub-serie Sub-serie File File Necessity of a hierarchical description Fonds The Fonds The project would not have been possible without the description cooperation of form -the Institut Francais de Jordanie (IFJ), the French -Title/Subtitle Institute for the Near East (Ifpo) and the Goethe--Dates (begining/end) Institut -Provenance/History of the Fonds -in partnership with the National Library of Jordan as -Sponsors/Creators well as -Medium/Formats -four Jordanian universities: Mutah University, Yarmouk -Language University, the University of Jordan and Al Hussein Bin -Location Talal University. -Conditions/restrictions regarding its use -supported by the European Union National Institutes -Keywords (people, locations, periods… mentioned in the whole Fonds) for Culture (EUNIC)

What are you going to mention ?

Recording an interview to contextualize a Fonds

	The recording
	device
	A Digital recording device that allows the sound recording in the WAVE format < Waveform audio format> = minimum 44.1Hzt, 16 bits since 96Hzt/24 bits.
	> Re name your files and copy them after an interview
	> Never use the original file, use copies
	> Check your device in order to not to interrupt during recording
	> Beware of human error leading to files erasing!

What wil you ask and how ? WAVE : uncompressed audio file format standard for storing audio on PC's with maximum audio quality

Thank you for listening and sharing Contacts: Véronique Ginouvès, MMSH -veronique.ginouves@univ-aix.fr Jean-Christophe Peyssard, Ifpo -jc.peyssard@ifporient.org

Director of a Masters Degree Programme about archival and library professions, including a specialization in the mediation of history and digital humanities. -Here in Beirut for 3 months to work on the archives of the French institute of the Middle-East (

Preservation on the long term

Migration is a set of organized tasks designed to achieve the periodic transfer for example one generation of computer technology to a subsequent generation. The purpose of migration is to preserve the integrity of digital objects.

The reference model is OAIS Open Archival Information System.


A C Sparavigna

Varro's Roman Seasons

Keywords: Chronology, Roman Chronology, Julian Calendar, Celtic festivals

come   L'archive ouverte pluridisciplinaire

adding other quotations, Friedrich Ritschl came to list 74 works in about 620 books [START_REF] Ritschl | Die Schriftstellerei des M. T. V[END_REF].

Varro is also known for his compilation of the Roman chronology, an attempt to determine an exact year-by-year timeline of Roman history up to his time. Varro's chronology is based on the traditional sequence of consuls of the Roman Republic.

Called "the most learned of the Romans" by Quintilian [START_REF] Quintilian | Chapter 1. Institutio Oratoria. Book X. Verse[END_REF], Varro was seen as an important source to be referred to by many ancient authors. His only complete work extant, the Rerum rusticarum libri tres (the Three Books on Agriculture), has been described as "the well digested system of an experienced and successful farmer who has seen and practised all that he records" [START_REF] Harrison | Roman farm management; the treatises of Cato and Varro done into English, with notes of modern instances by a Virginia farmer[END_REF]. As stressed in [START_REF] Harrison | Roman farm management; the treatises of Cato and Varro done into English, with notes of modern instances by a Virginia farmer[END_REF], during his whole life, Varro "amused the leisure snatched from his studies with intelligent supervision of the farming of his several estates". Let us also remember that Varro wrote his treatise on Rerum Rusticarum in his eightieth year.

In [START_REF] Harrison | Roman farm management; the treatises of Cato and Varro done into English, with notes of modern instances by a Virginia farmer[END_REF], we find the description given by Varro of the seasons as seen by Romans. Varro uses the Julian Calendar, the calendar of Julius Caesar that reformed the Republican Roman Calendar. As we will see, the four seasons start on days which differ from those that we use today. Moreover, we can find an interesting subdivision of the year in eight seasons.

Here are Varro's words [START_REF] Harrison | Roman farm management; the treatises of Cato and Varro done into English, with notes of modern instances by a Virginia farmer[END_REF].

XXVII. We have two standards of time, the first that of the revolution of the year, because in it the sun completes his circuit, the other the measure of the month, because it includes the waxing and the waning of the moon.

Of the solar measure of the year: First I will speak of the sun, whose recurring journey is divided with reference to the pursuits of agriculture into four seasons of three months each, or more accurately into eight seasons of a month and a half each. The four seasons are Spring, Summer, Autumn and Winter. In Spring certain crops are sown and the sod fields are broken up, [82] so that the weeds in them may be destroyed before they have seeded themselves again, and the clods, by drying out in the sun, may become more accessible to the rain and when broken down by its action easier to cultivate. Such land should be ploughed not less than twice, but three times is better [83].

The Summer is the season of the grain harvest; the Autumn, when the weather is dry, that of the vintage: and it is also the fit time for thinning out the woods, when the trees to be removed should be cut down close to the ground and the roots should be dug up before the first rains to prevent HAL, Submitted 30 November 2019 them from stooling. In Winter the trees may be pruned, provided this is done at a time when the bark is free from frost and rain and ice. By a more exact definition of the seasons, the year is divided into eight parts, the first of forty-five days from the date of the rising of the west wind (February 7) to the date of the vernal equinox (March 24), the second of the ensuing forty-four days to the rising of the Pleiades (May 7), the third of forty-eight days to the summer solstice (June 24), the fourth of twenty-seven days to the rising of the Dog Star (July 21), the fifth of sixty-seven days to the Autumn equinox (September 26), the sixth of thirty-two days to the setting of the Pleiades (October 28), the seventh of fifty-seven days to the winter solstice (December 24), and the eighth of forty-five days to the beginning of the first. [85].

XXVIII. Spring begins when the sun is in Aquarius, Summer when it is in

In Latin [START_REF] Rustici | Varrone Dell'agricoltura con note[END_REF] .... Of the influence of the moon on agriculture. XXXVII. The lunar seasons also must be considered. They are divided into two terms, that from the new moon to the full, and that from the full moon to the next moon, or until that day which we call intermenstruus, or the last and the first HAL, Submitted 30 November 2019 of a moon, whence at Athens this day is called [Greek: henae kai nea] (the old and the new), though the other Greeks call it [Greek: triakas] the thirtieth day. Some agricultural operations may be undertaken with more advantage during the increase of the moon, others during the decrease,

[88] as, for example, the harvest or cutting of wood."

Of footnotes in [START_REF] Harrison | Roman farm management; the treatises of Cato and Varro done into English, with notes of modern instances by a Virginia farmer[END_REF] here we report about two. Footnote 84 stresses that the Julian calendar had been in use only eight years when Varro was writing and Footnote 85 tells that some scholars have attempted to emend the enumeration of the days in this succession of seasons, but Harrison Fairfax follows the advise made by Heinrich Keil: "As we do not know what principle Varro followed in establishing these divisions of the year, it is safer to set them down as they are written in the codex than to be tempted by uncertain emendation."

Further observations on the problems concerning the enumeration of the days are given in [START_REF] Rustici | Varrone Dell'agricoltura con note[END_REF].

Varro's Seasons

The year when Varro wrote the book was about 37 or 36 BC. At the time the Romans were using the Julian Calendar, which was running erroneously because the leap year was applied on a cycle of three years, instead of four. A correction was ordered by Augustus only in 8 BC. If we consider that the Julian Calendar began on 2 January 45 BC (astronomical Julian day) [START_REF] Sparavigna | The First Calends of the Julian Calendar[END_REF], in 37 or 36 BC there was a difference of a day with respect to the astronomical dates. That is, the days of the Julian Calendar were one day away with respect to the astronomical Julian counting of them.

As told by Varro, the year was subdivided into four seasons, beginning as follow: Spring on the seventh day before the Ides of February, Summer on the seventh day before the Ides of May, Autumn on the third day before the Ides of August, and Winter on the fourth day before the Ides of November. Using the table in [START_REF] Sparavigna | The First Calends of the Julian Calendar[END_REF], we can easily understand the inclusive manner the Romans used to count the days. So, the starting days of seasons are given in modern terms as: Spring, February As explained by the item on St. Martin day in Wikipedia, like the word "Christmas", the term Martinmas has the meaning of "Mass of Martin", that is of the day when the Saint is honoured in the Mass. "Martinmas, as a date on the calendar, has two meanings: in the agricultural calendar it marks the beginning of the natural winter, but in the economic calendar it is seen as the end of autumn. The feast coincides not only with the end of the Octave of All Saints, but also with harvesttime, the time when newly produced wine is ready for drinking".

Cross Quarter-days As we have seen, Varro's Roman seasons are different from our seasons, in the sense that they start on days different from those that we are using today. Varro's seasons were starting on those that we can consider the four Cross Quarter-days of the year according to the Roman tradition.

Who knows the Celtic calendar and its holidays is not surprised by this fact. In particular, the Martinmas is not new for sure. In [START_REF]The Christian's monthly magazine and universal review[END_REF], Martinmas is told to be one of the Cross Quarter-days of the year. Whitsuntide was formerly the first of these cross-quarters, Lammas the second, Martinmas Johannistag.

We have noted previously that Martinmas was the end of farming agreements. Here, for what concerns Johnmas, let us stress that, in Piedmont, the mountain farming and the vertical transhumance (alpeggio, in Italian) starts from Johnmas and ends at Michaelmas, that is, "da San Giovanni a San Michele".

HAL, Submitted 30 November 2019

Let us note that local variations of the dates of the Cross Quarter-days exist.

The Encyclopedia Britannica explains that the Cross Quarter-days are the days on which it is usually contracted that rents should be paid and houses or lands entered upon or quitted. In Scotland November are of little importance to European crop-growers, but of great importance to herdsmen.

It is at the beginning of summer that cattle are driven to the upland summer pastures and the beginning of winter that they are led back. Thus, Frazer suggests that halving the year at 1 May and 1 November dates from a time when the Celts were mainly a pastoral people, dependent on their herds" [11,[START_REF] Frazer | The Golden Bough: A Study in Magic and Religion[END_REF]. As we have previously seen, the Cross Quarter-days of May and November were important to Romans too, because they had a society based on agriculture and the breeding of animals.

Candlemas Roman and Celtic calendars used Cross Quarter-days, but it seems that evidences exist favouring the use of intermediate calendrical dates also in prehistoric times [START_REF] Krupp | Echoes of the Ancient Skies: The Astronomy of Lost Civilizations[END_REF]. Roman festivals Varro is the source of information about the Roman festivals too [START_REF] Peter | Le feste tradizionali dell'anno romano[END_REF]. Let us consider the dates given in the Table of Page 4 and see if we have some holidays close to them.

February 7 is the beginning of Roman spring. It is between the Februalia and the Lupercalia. The Februalia were the Calends of February, February 1, the Roman Festival of Purification [START_REF] Peter | Le feste tradizionali dell'anno romano[END_REF], today the Candlemas. The Lupercalia were on the Ides of February, 13-15 February. The Nones were on February 5 (see [START_REF] Sparavigna | The First Calends of the Julian Calendar[END_REF] for the Roman calendar).

About the Spring equinox, we can find the Tubilustrium (March 23), which involved a series of rites to cleanse and favour trumpets. This festival was inaugurating the season of wars. Hilaria (March 25) was the festival in honour of Cybele.

According to Varro, May 9 was the beginning of summer. In [START_REF] Peter | Le feste tradizionali dell'anno romano[END_REF], we find that in the Julian calendar the days of 9, 11, and 13 May were the feast of Lemuria. The origin of this ancient festival is, according to Ovid, in the Remuria, a festival instituted by Romulus to appease the spirit of Remus. The Lemuria then was a feast during which the Romans performed rites to exorcise the ghosts or the restless spirits, the lemures or larvae, from their homes.

About the summer solstice, we find the festival of Fors Fortuna (June 24). The autumn starts on August 11, with sun in Leo, between the Opalia (August 10) and the Vertumnalia (August 13). The equinox is close to Venus Genitrix Populi Romani (September 26). The winter starts on November 10, sun in Scorpio. About the winter solstice, we find the Saturnalia (December 17-21).

Halloween It seems that the term Halloween is first attested from the sixteenth century, and represents a Scottish manner to indicate the eve, that is the night, before the Feast of All the Saints (in archaic English All Hallows Day). The feast is a solemnity that celebrates the glory and honour of the canonized and non-canonized Saints. Today, the Catholic feast, Festabant Omnium HAL, Submitted 30 November 2019

Sanctorum, falls on 1 November.

In [START_REF]La Storia Viva[END_REF] it is told that this festival has a "mobile" history linked to the celebrations of the martyrs of the Church. The commemoration of the martyrs began to be celebrated as early as in the fourth century. The first traces of a general celebration are attested in Antioch, and refer to the Sunday following Pentecost. This custom is also mentioned by John Chrysostom and is preserved until today by the Eastern churches. Ephrem the Syrian also speaks of this feast, and places it on May 13th [START_REF]La Storia Viva[END_REF]. A confirmation of this date can be seen in the Roman festival of the dedicatio Sanctae Mariae ad Martyres, that is, the anniversary of the dedication of the Pantheon to the Blessed Virgin and to all the martyrs. The Pantheon was dedicated on 13 May 609 by Pope Boniface IV.

As we have previously seen, the date of May 13 is one of those of the Roman festival of Lemuria.

So, it seems that the festival of the martyrs had replaced the Roman festival of restless spirits of the dead.

The transfer of the date from 13 May to 1 November was motivated by some scholars, such as James Frazer, as a choice by the Church to create a Christian continuity with Samhain, the ancient Celtic festival of the new year, following the requests in this sense from the Irish monastic world [START_REF]La Storia Viva[END_REF]. These scholars maintained that, according to Celtic beliefs, during the Samhain festival the dead could return to the places they frequented when they were alive, and that this day was requiring for joyful celebrations to be held in their honour. This aspect of the feast was not eradicated by the advent of Christianity and the dead are celebrated on November 2.

"That night [between the first and the second day of November] the dead return home to quench their thirst and eat, to drive away the wickedness or to play cards, to attend Mass or to pray the Rosary along the streets of the village. There are many beliefs in different areas of Italy. All of them, however, have a basic inspiration: to feel always close to the world of the dead." [START_REF] Mucci | Italian Traditions: Halloween in Italy[END_REF] In Piedmont, on the evening of All Saints' Day, that is on the eve of the day of the dead, after the dinner, the table is not spawned: it remains laid down with some food so that the dead will come and eat it.

However, as told in [START_REF]La Storia Viva[END_REF], there is no total agreement about the explanation given above, of Halloween as the Christian version of Samhain. The historian Ronald Hutton, for example, has questioned the thesis, observing how Ognissanti was celebrated for several centuries (before being a feast of precept), in discordant dates in various countries: for the church of Rome it was May 13, in HAL, Submitted 30 November 2019

Ireland (country of Celtic culture) was April 20, while November 1 was a widespread date in England and Germany (countries of Germanic culture) [START_REF]La Storia Viva[END_REF][START_REF] Hutton | Halloween? It's more than trick or treat, 28 Oct 2014[END_REF].

"It is commonly asserted" -tells Hutton [START_REF] Hutton | Halloween? It's more than trick or treat, 28 Oct 2014[END_REF] -"that the feast was the pagan festival of the dead. In reality feasts to commemorate the dead, where they can be found in ancient Europe, were celebrated by both pagans and early Christians, between March and May, as part of a spring cleaning to close off grieving and go forth into the new summer. On the other hand, the medieval Catholic church did gradually institute a mighty festival of the dead at this time of year, designating 1 November as the feast of All Saints or All Hallows, initially in honour of the early Christian martyrs, and 2

November as All Souls, on which people could pray for their dead friends and relatives. This was associated with the new doctrine of purgatory, by which most people went not straight to hell or heaven but a place of suffering between, where their sins were purged to fit them for heaven. ... The two new Christian feasts were, however, only developed between the ninth and the twelfth centuries, and started in Germanic not Celtic lands."

What is interesting is a fact stressed by Hutton in ending his article [START_REF] Hutton | Halloween? It's more than trick or treat, 28 Oct 2014[END_REF]: "On the whole, though, the As we can see this is a subdivision strongly linked to astronomy, in particular to the rising and setting of the Pleiades, the Vergiliae in Latin. Moreover, another interesting fact can be observed, HAL, Submitted 30 November 2019 that the end of the autumn and the beginning of the winter is closer to the date of the Celtic calendar, that is to Samhain. In the following Table, the starting days of the eight seasons are listed. Sir Norman Lockyer, at the beginning of XIX century, suggested the existence of a widespread calendrical practice in Neolithic and Bronze Age, that required the division of the year into eight equal parts [START_REF] Plunket | The Nineteenth Century and After. XIX-XX[END_REF] (let us stress that in the case of Varro's calendar, the length of the seasons is different). If we assume the year was divided by the Quarter-and the Cross Quarter-days of the year, the echoes of this original calendar, which are commonly devised in the Celtic calendar, can also be found in the Varro's books, and in the Roman calendrical practice.

  Taurus, Autumn when it is in Leo, and Winter when it is in Scorpio. Since the beginning of each of the four seasons is the twenty-third day after the entrance of the sun in these signs respectively, it follows that Spring has ninety-one days, Summer ninety-four, Autumn ninety-one and Winter eighty-nine: which, reduced to the dates of our present official calendar,[84] makes the beginning of Spring on the seventh day before the Ides of February (February 7), of Summer on the seventh day before the Ides of May (May 9), of Autumn on the third day before the Ides of August (August 11), and of Winter on the fourth day before the Ides of November (November 10).

  the next and Candlemass the last. The Quarter-days of the year are equinoxes and solstices. In England, they are March 25 (Lady Day), June 24 (Midsummer Day), September 29 (Michaelmas Day), and December 25 (Christmas Day) [10]. June 24 is the Christian feast day celebrating the birth of John the Baptist. This day is also know colloquially as Johnmas or (in German)

  there are two legal terms, May 15 (Whitsunday) and November 11 (Martinmas), and these, with the two conventional terms, February 2 (Candlemas) and August 1 (Lammas), make up the Scottish quarter days. Therefore, as previously told, people familiar with Celtic traditions are not surprised by Varro's seasons starting on Cross Quarter-days. The fact that the days are slightly different is obviously due to the different climatic conditions linked to the different geographic areas.In Gaelic Ireland, the four seasonal festivals linked to the Cross Quarter-day are [11]: Samhain (~1 November), the name of the festival marking the beginning of winter, Imbolc (~1 February), Bealtaine (~1 May) and Lughnasadh or Lammas (~1 August). As told in [11], Samhain and Bealtaine, "at opposite sides of the year, are thought to have been the most important. Sir James George Frazer wrote in The Golden Bough: A Study in Magic and Religion that 1 May and 1

  "They are preserved in traditional holidays still observed in Britain": Candlemas, May Day, Lammas and Martinmas. "All of these derive from an earlier Celtic tradition and marked the beginning of each season. For example, what is called the first day of summer in the United States, the summer solstice, is considered to be midsummer in Britain." In Christian societies, we have the festivals linked to the winter solstice, Christmas, and the spring equinox, the Easter. As we have seen, we have Johnmas and Michaelmas too for the summer solstice and the autumn equinox. However, we have also other festivals that happen close to the HAL, Submitted 30 November 2019 Cross Quarter-days subdividing the year into four seasons. On February 2 we have the Candlemas (also spelled Candlemass), Candelora in Italian, also known as the Feast of the Presentation of Jesus Christ and the Feast of the Purification of the Blessed Virgin Mary. It commemorates the presentation of Jesus at the Temple. About Martinmas we have already discussed. However, what happened in ancient Rome? Had the Romans some specific festival close to the Quarter-and the Cross Quarter-days of the year?

  ancient feast of Winter's Eve has regained its ancient character, as a dual time of fun and festivity, and of confrontation of the fears and discomforts inherent in life, and embodied especially in northern latitudes by the season of cold and dark." It is interesting that Hutton defines the beginning of November as the Winter's Eve. If we consider the different latitude, November 10 was representing the eve of the Winter for Romans.Eight seasons According to Varro, a more exact definition of the seasons exists, which requires the year to be divided into eight parts. The first season lasts forty-five days from the date of the rising of the west wind (February 7) to the date of the vernal equinox (March 24). The second season lasts forty-four days from the vernal equinox to the rising of the Pleiades (May 7). The third season lasts forty-eight days to the summer solstice (June 24), the fourth lasts twenty-seven days to the rising of the Dog Star (July 21), the fifth sixty-seven days to the Autumn equinox (September 26), the sixth thirty-two days to the setting of the Pleiades (October 28), the seventh fifty-seven days to the winter solstice (December 24), and the eighth forty-five days to the beginning of the first.

I, February 7 (

 7 45 days) -II, March 25 (44 days) III, May 7 (48 days) -IV, June 25 (27 days) V, July 22 (67 days) -VI, September 27 (32 days) VII, October 29 (57 days) -VIII, December 25 (45 days) It seems difficult to imagine a calendar composed by eight seasons. However, such a kind of calendars probably existed in very ancient time. Again, we find a link to ancient people in Britain:

  MartinmasIn this table we can immediately note a very interesting day. It is November 10, the HAL, Submitted 30 November 2019 day before our St. Martin's Day, November 11. Saint Martin's day, also known as Martinstag or Martinmas, as well as Old Halloween and Old Hallowmas Eve,[START_REF] Henderson | Scottish Fairy Belief: A History[END_REF] is the Funeral day of Saint Martin of Tours. On this day, many hiring fairs were held during which the farm labourers would seek new posts. "Fare San Martino" is an expression used in the Pianura Padana, meaning "change jobs" or "move house". It is possible that November 10, the beginning of winter in the Roman calendar, was also the conventional date for the end of farming agreements in the Roman world, and that this date evolved into the traditional date of the Martinmas.

	7, sun in Aquarius	Summer, May 9, sun in Taurus
	Autumn, August 11, sun in Leo	Winter, November 10, sun in Scorpio


Pascal Béger
email: pascal.beger@enac.fr

Sébastien Leriche
email: sebastien.leriche@enac.fr

Daniel Prun
email: daniel.prun@enac.fr

A Survey of Papers from Formal Methods for Interactive Systems (FMIS) Workshops

Keywords:

Our research team is specialized in human-computer systems and their engineering, with focus on interactive software systems for aeronautics (from cockpits to control towers). This context stands out by the need for certification, such as DO-178 or ED-12. Today, formal methods are pushed forward, as one of the best tools to achieve the verification and validation of properties, leading to the certification of these systems. Interactive systems are reactive computer systems that process information from their environment and produce a representation of their internal state. They offer new rich interfaces with sophisticated interactions. Their certification is a challenge, because the validation is often a human based process since traditional formal tools are not always suitable to the verification of graphical properties in particular. In this paper, we explore the scientific work that has been done in formal methods for interactive systems over the last decade, in a systematic study of publications in the International Workshop on Formal Methods for Interactive Systems. We describe an analytical framework that we apply to classify the studied work into classes of properties and used formalisms. We then discuss the emerging findings, mainly the lack of papers addressing the formal specification or validation of perceptibility properties. We conclude with an overview of our future work in this area.

Introduction 1.Aim and scope of the article

Interactive systems are reactive computer systems that process information (mouse clicks, data entries, etc.) from their environment (other systems or human users) and produce a representation (sound notification, visual display, etc.) of their internal state [START_REF] Beaudouin-Lafon | Designing interaction, not interfaces[END_REF][START_REF] Myers | Survey on user interface programming[END_REF]. They now have an increasingly important place among modern systems in various sectors such as aeronautics, space, medical or mobile applications. These systems offer new rich human machine interfaces with sophisticated interactions.

The preferred method for the verification and validation (V&V) of properties on interactive systems remains largely based on successive testing sessions of prototypes, performed through various experimentations involving representative end-users. For a long time, formal methods have not been very used to the verification of interactive properties. Indeed, historically, formal methods have been developed for distributed and embedded systems. The first properties studied for software and computer systems concerned safety (e.g. absence of unwanted events, boundedness) as well as program liveness (e.g. return to a given state, deadlock freedom) [START_REF] Owicki | Proving liveness properties of concurrent programs[END_REF]. The main methods used to verify and validate properties of systems are model verification by model checking [START_REF] Bérard | Systems and Software Verification: Model-Checking Techniques and Tools[END_REF], mathematical proof [START_REF] Boldo | Formalization of Real Analysis: A Survey of Proof Assistants and Libraries[END_REF], static analysis [START_REF] Gosain | Static analysis: A survey of techniques and tools[END_REF] and test processes driven by a formal model of the system under tests.

However, more and more work is being done on the development of formal methods to interactive systems. The objective is to study how these methods can be adapted to the modelling and the verification of properties involving human related characteristics. In particular, in the scope of critical domains such as aeronautics, recent updates of standards used for certification strongly recommend to use formal methods for the verification and validation of requirements of new software for aircraft cockpits ( [START_REF]SC-205 and EUROCAE (Agency)[END_REF][START_REF]SC-205 and EUROCAE (Agency)[END_REF]).

In this context, the objective of this survey is to study research activities that have been done in formal methods for the modeling, verification and validation of interactive systems, over the last decade. The aim is to draw a faithful picture of formalisms that are used to model interactive systems, set of properties that are verified and formal methods applied. From this picture, the objective is to identify strengths and weaknesses of formal approaches for interactive systems and to identify ways of improvements. More precisely, the survey highlights several points: What interactive related properties are studied? Which ones are more covered and which ones are least addressed? Are there formalisms that are widely used to model systems and study their properties? Are there any new formalisms that have emerged? Are they used on industrial critical systems or only on small academic case studies?

Methodology

Through this survey we explore the scientific work that has been done in formal methods for interactive systems over the last decade. For this purpose, we perform a systematic study of publications from a specific workshop, the International Workshop on Formal Methods for Interactive Systems (FMIS). We have selected this workshop because it covers exactly our problematic: the articles from this workshop address issues of how formal methods can be applied to interactive system design and verification and validation of their related properties. The workshop also focuses on general design and verification methodologies, and takes models and human behavior under consideration. Moreover, FMIS has reached a critical mass that makes the analysis more significative and reliable. It has taken place seven times from 2006 to 2018. Our study is based on an exhaustive review of the literature from FMIS representing 43 articles.

As we focus on the formal study of properties related to the graphical scene of interactive systems, this survey is based on a table of our choice that classifies the work that has been done about formalisation and verification of properties for interactive systems.

Plan of the article

Before reviewing the work from FMIS, we present our analytical framework [START_REF] Bargh | The Four Horsemen of Automaticity: Awareness, Efficiency, Intention, and Control in Social Cognition[END_REF]. It is composed by definitions of properties we have sorted in different classes. We also set up a nomenclature of formalisms that have been used for the studies of the properties. From this basis, we propose an analytical grid that allows us to synthesize the review. Then the 43 articles from all the FMIS workshops are presented and analysed (3), analysis mainly directed by the studied properties and the ways of studying them.

The section 4 provides a synthesis of the review and highlights the issues in the research of formal methods for interactive systems. Finally, the section 5 concludes the discussion and presents ongoing work related to the previously highlighted issues.

Analytical framework

The purpose of this section is to define a framework for the analysis of the properties that have been studied for interactive systems. In order to do that, three basic questions must be considered.

• "What properties are studied?" This question concerns the nature of properties that have been studied and is the center of our work to determine if some properties have not been studied.

• "What formalism is being used?" This question allows us to show what formalisms can be used to study the properties.

• "What is the case study?" This question concerns the system used as the case study to illustrate the use of formal methods and its particularities.

We focus on these questions in order to highlight the range of interactive systems properties covered. It provides the means used to cover these properties. Through this survey, we explore these questions by sorting the articles by the properties studied and the means used to study those. We also provide the case study used to illustrate the studies.

Properties

As stated in the analytical framework, we firstly drive our analysis according to the studied properties. This paper organises interactive systems properties in four classes of our choice: user behavior [START_REF] Bargh | The Four Horsemen of Automaticity: Awareness, Efficiency, Intention, and Control in Social Cognition[END_REF], cognitive principles [START_REF] Cartwright-Finch | The role of perceptual load in inattentional blindness[END_REF], human-machine interfaces [START_REF] Beaudouin-Lafon | Designing interaction, not interfaces[END_REF], security [START_REF] Sabelfeld | Language-based information-flow security[END_REF]. We detail these classes below.

Several articles do not directly address interactive properties and so cannot be classified in one of these 4 classes. For these specific papers, we have defined two additional categories:

• specification/formal definition: gather papers dealing with the formal modeling of a system, and possibly addressing properties related to the model itself, and not centered on the interaction.

• testing: gather papers related to the modeling of interactive systems with the objective to generate test cases from the study of the model.

User behavior

This user behavior class considers the properties related to a human user. The properties from this class are about user's actions, user's expectations about the system, user's objectives and restrictions.

• A user goal is a list of sub objectives that a user has to perform to achieve a greater objective related to the purposes of the system used. This goal can consist on a single task or an overall use case. "Insert the card", "authenticate" and "choose the amount of money" are subgoals of "withdraw money".

• User privileges are a way to prevent a user with an unauthorized level of accreditation to perform goals the user should not. Example: It is only possible to access our e-mails if we are connected to our e-mail system.

• The user interpretation can be seen as the set of assumptions of the user about the system. It can lead users to adapt their behavior in accordance with these assumptions.

For example, we are used to the shortcut Ctrl+C in order to copy some text. A novice user of a terminal could use it to copy text and close the running application because the functionality is not the same.

• The user attention is defined as the ability of the user to focus on a specific activity without being disturbed by irrelevant informations. This can be seen when driving a car, the driver is focused on traffic signs, on road traffic, etc.

• The user experience concerns the knowledge of the user about the system. This knowledge can come from a previous use of the system or a study of the system before using it. This experience can have an impact on user interpretation. The example given in user interpretation also illustrates the user experience: an experienced user of a terminal would not make mistakes with the Ctrl+C functionality.

Cognitive principles

This cognitive principles class considers the properties related to cognitive sciences. The properties from this class are about the human user cognitive salience and load.

• The cognitive load is related to the task performed by the user and more specifically to its complexity. It is possible to define two types of cognitive load: intrinsic (complexity of the task) and extraneous (complexity due to the context and distractors).

For example, a user may lose attention while interacting with too rich a graphical scene.

• The cognitive salience represents a user's adherence to an idea. While performing an action, it depends on the action sensory salience, its procedural cueing and the cognitive load related to the task. A user will be more focused on an action more in line with his convictions.

Human-machine interfaces

In the human-machine interfaces properties class we consider the new properties that have arrived with these new systems. These properties are mainly specific to the problems induced by the display such as verifying the right display of informations or being aware of the latency that can appear between user actions and the display of informations.

• The latency is a well-known issue in rich interfaces. It concerns the delay between interactions with an application and the return of informations from it. If a computer processes several actions at the same time, it will take a few seconds to start a web browser.

• the consistency represents a system constant behavior whether for a display or a functionality regardless the current mode of the system. It can be seen as the use of same terminology for functions ("Exit" or "Quit" in order to define a function "close a window").

• The predictability is the user's ability to predict the future behavior of the system from its actual state and the way the user will interact with it.

When closing a word processor with an unsaved document, a user knows that a pop-up will show to ask what to do between saving the document, canceling the closing or closing without saving.

• ISO 9241-11 [START_REF] Standardization | Ergonomic Requirements for Office Work with Visual Display Terminals (VDTs): Part 11: Guidance on Usability[END_REF] defines the usability as "the extent to which a product can be used by specified users to achieve specified goals with effectiveness, efficiency and satisfaction in a specified context of use." It is possible to improve the usability of an "accept/decline" window by adding symbols related to the two notions such as for accept and × for decline.

• The visual perceptibility is based on different properties such as the superposition of components, the distinction of shapes and colours. For example, even if a red text is above a red shape, the text will not be perceptible.

Security

This security class considers the properties related to computer security such as the prevention of threats and the link between the user behavior and the possible threats.

• The integrity property states that, for a system that may be exposed to threats, hypothesis of the user about the application are correct and the reverse is also true.

When we log in interfaces with two text fields, if the fields username and password are not in the expected locations, we could type the password in the clear field.

• The threats property focuses in defining the differents threats that may be a risk for the system. We can note, for example, data leaking or data manipulation.

Nomenclature of formalisms

This section will introduce formalisms and formal methods that have been used by FMIS authors in order to formalize and apply verification techniques on the properties defined in the last section. We will define the basic semantic and the properties inherent to these formalisms.

Process algebra

Baeten [START_REF] Baeten | A brief history of process algebra[END_REF] gives the history and the definition of process algebra. The author also gives examples of some formalisms from process algebra such as Calculus of Communicating Systems (CCS) or Communicating Sequential Processes (CSP). We can resume from this paper that process algebra is a set of algebraic means used to study and define the parallel systems behavior. Authors from the FMIS workshop used formalisms from process algebra such as the CWB-NC [START_REF] Cleaveland | The concurrency workbench of the new century. User's manual[END_REF] syntax for the Hoare's CSP notation [START_REF] Hoare | Communicating Sequential Processes[END_REF], Language Of Temporal Ordering Specification (LOTOS) [52], probabilistic π-calculus [START_REF] Norman | Model checking the probabilistic π-calculus[END_REF], applied π-calculus [START_REF] Ryan | Applied pi calculus[END_REF], Performance Evaluation Process Algebra (PEPA) [START_REF] Hillston | A Compositional Approach to Performance Modelling[END_REF].

Specification language

A specification language [START_REF] Sannella | Specification languages. Algebraic Foundation of Systems Specification[END_REF] is a formal language that can be used to make formal descriptions of systems. It allows a user to analyze a system or its requirements and thus to improve its design.

Authors from the FMIS workshop used specification languages such as SAL [START_REF] De Moura | Sal 2[END_REF], Z [START_REF] Spivey | The Z Notation: A Reference Manual[END_REF], µCharts [START_REF] Goldson | µ-chart-based specification and refinement[END_REF], Spec# [START_REF] Barnett | The spec# programming system: An overview[END_REF], Promela [START_REF] Holzmann | The SPIN Model Checker: Primer and Reference Manual[END_REF], PVS [START_REF] Shankar | Pvs: Combining specification, proof checking, and model checking[END_REF], Higher-Order Processes Specification (HOPS) [START_REF] Dittmar | Hops: A prototypical specification tool for interactive systems[END_REF].

Refinement

A program refinement consists in the concretisation of a more abstract description of a system. The aim of this method is to verify properties in an abstract level of the description then to concretise this level while conserving the verified properties. These steps have to be done until the concrete description of the system is obtained.

Authors from the FMIS workshop used refinements processes with models such as B-method [START_REF]The B-book: Assigning Programs to Meanings[END_REF] or with specification languages such as Z and µCharts.

Transition systems

Transition systems [START_REF] Baier | Principles of Model Checking (Representation and Mind Series)[END_REF] consist in directed graphs composed of states, represented by nodes, and transitions, represented by edges. A state represents an instant in the system behavior or for a program the current value of all the variables and the current state of the program. Crossing a transition involves a change of state.

Authors from the FMIS workshop used transition systems formalisms such as UPPAAL [START_REF] Behrmann | A Tutorial on Uppaal[END_REF], Petri nets (PN) [START_REF] David | Discrete, Continuous, and Hybrid Petri Nets[END_REF], ICO models [START_REF] Navarre | Icos: A model-based user interface description technique dedicated to interactive systems addressing usability, reliability and scalability[END_REF], finite state automata (FSA), Input/Output labeled transition system (IOLTS).

Temporal logic

Properties to be verified are often expressed in the form of temporal logic formulas [START_REF] Goranko | Temporal logic. The Stanford Encyclopedia of Philosophy[END_REF]. These formulas are based on Boolean combiners, time combiners and for some logics on path quantifiers. Authors from the FMIS workshop used temporal logics such as computation tree logic (CTL) and linear temporal logic (LTL) [START_REF] Bérard | Systems and Software Verification: Model-Checking Techniques and Tools[END_REF].

Review

Here, we review the state of the art of formal methods applied to interactive systems. We consider research work that have been presented in the International Workshop on Formal Methods for Interactive Systems.

Our aim is to present the properties that have been studied with formal methods. From this and the questions that we asked in the section 2, we base our analysis on the grid presented in the table [START_REF] Arapinis | Towards the verification of pervasive systems[END_REF].

This grid highlights the coverage of properties depending on the formalisms. The categories formal definition/specification and testing are not interactive systems properties. However, we want to present how articles address those with formal methods. This explains the fact that there is a double vertical line in the grid. Our work addresses the visual perceptibility property from the HMI class. We highlight this by setting the perceptibility in italic beside the HMI class, separated by a dashed line.

User behavior

The table 1 summarizes the studies of the user behavior class of properties. It sorts the papers according to the properties studied (goals, privileges, interpretation, attention, emotion and experience) and formalisms used.

User goals

Cerone and Elbegbayan [START_REF] Cerone | Model-checking driven design of interactive systems[END_REF] define user goals in the use of a web-based interface that features a discussion forum and a member list. Those are defined with the CWB-NC syntax for CSP from process algebra. These definitions allow authors to model more precisely the attended and unattended use cases. Rukšėnas et al. [START_REF] Rukšėnas | Detecting cognitive causes of confidentiality leaks[END_REF] address the use of an authentification interface with two textboxes (user name and password). They define user goals with the specification language SAL through the definition of a cognitive architecture of user behavior. It allows authors to define the actions a user can do. Rukšėnas et al. [START_REF] Rukšėnas | Formal modelling of salience and cognitive load[END_REF] further explore the notion of user goals through their cognitive architecture.

Cerone [START_REF] Cerone | Closure and attention activation in human automatic behaviour: A framework for the formal analysis of interactive systems[END_REF] bases his work on the study of two use cases: a driving user and a user interacting with an ATM. He models the user goals with the Hoare's notation for describing CSP (process algebra). It allows him to study cognitive activities such as closure.

Dittmar and Schachtschneider [START_REF] Dittmar | Lightweight interaction modeling in evolutionary prototyping[END_REF] use HOPS (specification language) models to define user tasks and actions while solving a puzzle.

User privileges

Cerone and Elbegbayan [START_REF] Cerone | Model-checking driven design of interactive systems[END_REF] define user privileges with the CWB-NC syntax for CSP. Thus, authors can model wich actions logged or non-logged users are allowed to do. This allows authors to constrain the user behavior by adding new properties in the web interface model.

User interpretation

Rukšėnas et al. [START_REF] Rukšėnas | Detecting cognitive causes of confidentiality leaks[END_REF] address the user interpretation of an authentification interface. They define it with SAL through the definition of a cognitive architecture of user behavior. It allows authors to highlight the risk for the user of misunderstanding the interface depending on the display of the two textboxes. Rukšėnas and Curzon [START_REF] Rukšėnas | Abstract models and cognitive mismatch in formal verification[END_REF] study the plausible behavior of users interacting with number entry on infusion pumps. They assume that users have their own beliefs about the incremental values. They separately model the users behavior depending on their interpretation and the constraint on cognitive mismatches with LTL and the SAL model checker.

User attention and user experience

Su et al. [START_REF] Su | Performance of reactive interfaces in stimulus rich environments, applying formal methods and cognitive frameworks[END_REF] study the temporal attentional limitation in the presence of stimuli on stimulus rich reactive interfaces. The cognitive model of human operators is defined with LOTOS (process algebra). The model of SRRI is based on studies of an AB task [START_REF] Raymond | Temporary suppression of visual processing in an rsvp task: An attentional blink? Journal of experimental psychology[END_REF]. This work presents simulation results focusing on the performance of the interface in user attention.

Cerone [START_REF] Cerone | Closure and attention activation in human automatic behaviour: A framework for the formal analysis of interactive systems[END_REF] addresses user's expectations, which relies on user attention and user experience. He studies cognitive activities such as closure, contention scheduling and attention activation. He models those with the Hoare's notation for describing CSP (process algebra).

Cerone and Zhao [START_REF] Cerone | Stochastic modelling and analysis of driver behaviour[END_REF] use the process algebra PEPA to model a three-way junction with no traffic lights and a traffic situation. They study the user experience in driving in such junctions. They use the PEPA Eclipse plug-in to analyse the model and determine for example the probability of possible collision.

Cerone [START_REF] Cerone | Towards a cognitive architecture for the formal analysis of human behaviour and learning[END_REF] proposes a cognitive architecture for the modelling of human behavior. This work presents the Human Task Description Language (HTDL). He uses it to model properties related to user behavior such as the automatic (everyday tasks) and deliberate (driven by a goal) control and the human learning, attention and experience.

User emotion

Bonnefon et al. [START_REF] Bonnefon | A logical framework for trust-related emotions[END_REF] use their logical framework, an ad-hoc formalism, to model several emotions and the notion of trust. Among the emotions there is joy/distress, hope/fear, satisfaction/disappointment and fear-confirmed/relief. They also model the relation between trust and emotions.

Cognitive principles

The table 2 summarizes the studies of the cognitive principles class of properties. It sorts the papers according to the properties studied (salience and load) and formalisms used. Rukšėnas et al. [START_REF] Rukšėnas | Formal modelling of salience and cognitive load[END_REF] define two cognitive principles, salience and cognitive load. They add those to their SAL cognitive architecture. The authors also define the link between these two principles. They illustrate these principles through the case study of a Fire Engine Dispatch Task.

Huang et al. [START_REF] Huang | Capturing the distinction between task and device errors in a formal model of user behaviour[END_REF] try to see if their Generic User Model (GUM) can encapsulate all the cognitive principles presented in the Doughnut Machine Experiment [START_REF] Mga Ament | Working memory load affects device-specific but not taskspecific error rate[END_REF].

Human machine interfaces

The table 3 summarizes the studies of the HMI class of properties. It sorts the papers according to the properties studied (consistency, predictability, latency and usability) and formalisms used.

Consistency

Bowen and Reeves [START_REF] Bowen | Formal models for informal gui designs[END_REF] use their presentation models and refinement processes with Z to check the equivalence and the consistency between two UI designs. The presentation models allow them to ensure that controls with the same function have the same name and conversely. Beckert and Beuster [START_REF] Beckert | Guaranteeing consistency in text-based human-computer-interaction[END_REF] provide an IOLTS model of a text-based application to guarantee consistency constraints. Their first model does not satisfy consistency constraints. They refine this model in order to satisfy the consistency constraints.

Campos and Harrison [START_REF] Campos | Modelling and analysing the interactive behaviour of an infusion pump[END_REF] provide consistency a formal definition of consistency of the Alaris GP Volumetric Pump interface in CTL. The global consistency includes: the role and visibility of modes, the relation between naming and purpose of functions, consistency of behavior of the data entry keys. They also present a part of a MAL specification of the Alarais GP infusion pump.

Harrison et al. [START_REF] Michael | Automated theorem proving for the systematic analysis of an infusion pump[END_REF] explore the consistency in the use of the soft function keys of infusion pumps through the use of MAL models translated into PVS. They define consistency properties with CTL and translate those into PVS theorems.

Harrison et al. [START_REF] Michael | Formal modelling as a component of user centred design[END_REF] create a model of a pill dispenser from a specification in PVS. They use this specification with the PVSio-web tool to study the consistency of possible actions.

Predictability

Masci et al. [START_REF] Masci | On formalising interactive number entry on infusion pumps[END_REF] analyse the predictability of the number entry system of Alaris GP and B-Braun Infusomat Space infusion pumps. They use SAL specifications to specify the predictability of the B-Braun number entry system.

Latency

Leriche et al. [START_REF] Leriche | Towards handling latency in interactive software[END_REF] explore the possibility of using Worst-Case Execution-Time [START_REF] Puschner | A review of worst-case execution-time analyses[END_REF] based on trees to study the latency for interactive systems. They also present some works that have been done with graphs of activation to model interactive systems.

Usability

Rukšėnas et al. [START_REF] Rukšėnas | Detecting cognitive causes of confidentiality leaks[END_REF] use their user behavior model in SAL to check usability properties of an authentification interface. They check that the property "the user eventually achieves the perceived goal" is satisfied. Rukšėnas et al. [START_REF] Rukšėnas | Formal modelling of salience and cognitive load[END_REF] further explore the use of their user model with SAL and LTL properties. They check that the property "the user eventually achieves the main goal" is satisfied in the Fire Engine Dispatch Task.

Bowen and Reeves [START_REF] Bowen | Refinement for user interface designs[END_REF] present a way of applying the specification language µCharts and refinement processes to UI designs. They use presentation models to compare two UI designs and if these UI maintain usability. They also informally describe the refinement process related to UI design.

Security

The table 4 summarizes the studies of security class of properties. It sorts the papers according to the properties studied (integrity, usability errors and threats) and formalisms used. Rukšėnas et al. [START_REF] Rukšėnas | Detecting cognitive causes of confidentiality leaks[END_REF] check the risk of security breach in the authentification interface with SAL properties. This highlights the fact that user interpretation can impact the security by entering the password in the wrong textbox for example.

Beckert and Beuster [START_REF] Beckert | Guaranteeing consistency in text-based human-computer-interaction[END_REF] produce a generic IOLTS (transition system) model of a text-based application. They use LTL to describe the properties of components and interpret them with IOLTS. The model is refined to guarantee integrity and to consider the problem of multi-input (if the user enters again a data if the system has not yet processed the last one) risking security breaches.

Arapinis et al. [START_REF] Arapinis | Towards the verification of pervasive systems[END_REF] present security properties related to the use of the MATCH (Mobilising Advanced Technology for Care at Home) food delivery system. They define these properties by using different formalisms such as the access control language RW and temporal logic (LTL, TCTL, PCTL).

Johnson [START_REF] Johnson | Using assurance cases and boolean logic driven markov processes to formalise cyber security concerns for safety-critical interaction with global navigation satellite systems[END_REF] studies security properties in terms of threats that may occur on Global Navigation Satellite Systems (GNSS). He models GNSS with Boolean Driven Markov Processes (BDMP) and integrate security threats to the model.

Specification/formal definition and testing

The table 5 summarizes the studies of the specification/formal definition and testing classes. It sorts the papers according to the case (specification/formal definition and testing) and formalisms used. This section allows us to present different systems used as case studies.

The references concern the articles that address the formal definition or specification of systems. These articles do not cover the properties previously presented. We only present in this section these articles.

Specification/formal definition

We sort the articles only focused in specification/formal definition by formalism used.

Process algebra Barbosa et al. [START_REF] Marco | Towards a coordination model for interactive systems[END_REF] represent an air traffic control system with a control tower and three aircrafts as CNUCE interactors. They use ad-hoc formalism, a generic approach to process algebra, to define this representation. Anderson and Ciobanu [START_REF] Anderson | Markov abstractions for probabilistic pi-calculus[END_REF] builds a Markov Decision Process abstraction of a program specification expressed with a probabilistic process algebra (using π-calculus). The abstraction is then used to check the structure of specification, analyze the long-term stability of the system, and provide guidance to improve the specifications if they are found to be unstable.

Bhandal et al. [START_REF] Bhandal | A process algebraic description of a temporal wireless network protocol[END_REF] present the language TCBS', strongly based on the Timed Calculus of Broadcasting Systems (TCBS). They give a formal model of a coordination model, the Comhordú system, in this language.

Specification language Calder et al. [START_REF] Calder | Tightly coupled verification of pervasive systems[END_REF] study the MATCH Activity Monitor (MAM), an event driven rule-based pervasive system. They model separately the system behavior and its configuration (rule set) with Promela. They derive Promela rules in LTL properties to check redundant rule with the model checker SPIN.

Bowen and Hinze [START_REF] Bowen | Supporting mobile application development with model-driven emulation[END_REF] present early stages work using presentation models to design a tourist information system. This system displays a map on a mobile support (smartphone).

Bass et al. [START_REF] Bass | Formal modeling and analysis for interactive hybrid systems[END_REF] specify in SAL the three subsystems of the A320 Speed Protection: automation, airplane and pilots. This interactive hybrid system has the potential to provide an automation surprise to a user.

Masci et al. [START_REF] Masci | Modelling distributed cognition systems in pvs[END_REF] specify the DiCoT's information flow model by using PVS. They use three modelling concepts (system state, activities, task) for this specification. The authors use the example of the London Ambulance Service to illustrate their work.

Refinement Cansell et al. [START_REF] Cansell | Refinement: A constructive approach to formal software design for a secure e-voting interface[END_REF] specify an interface of e-voting corresponding to the Single Transferable Vote model without the counting algorithm. This is done by using the B method and a refinement process.

Rukšėnas et al. [START_REF] Rukšėnas | Developing and verifying user interface requirements for infusion pumps: A refinement approach[END_REF] study the global requirements related to data entry of infusion pumps. They use Event-B specifications and refinement processes with the Rodin platform to specify these requirements. These refinement processes allow the authors to check if the Alaris GB infusion pump number entry specification validate the global requirements.

Geniet and Singh [START_REF] Geniet | Refinement based formal development of human-machine interface[END_REF] study an HMI composed by graphical components in form of widgets. They use the Event-B modelling language and refinement processes to model the system and analyse its behavior.

Transition system Harrison et al. [START_REF] Michael | Exploring an option space to engineer a ubiquitous computing system[END_REF] model the GAUDI system [START_REF] Kray | Adaptive navigation support with public displays[END_REF] with UPPAAL. Through the UPPAAL model, the authors can explore use cases scenario and check reachability properties for example.

Westergaard [START_REF] Westergaard | A game-theoretic approach to behavioural visualisation[END_REF] uses game transition systems to define visualisations of the behavior of formal models. The example of an interoperability protocol for mobile ad-hoc networks to highlight the use of visualisations.

Thimbleby and Gimblett [START_REF] Thimbleby | Dependable keyed data entry for interactive systems[END_REF] model the interactions possibilities with key data entry of infusion pumps. They use FSM and specify those with regular expressions to model the interactions.

Silva et al. [START_REF] Silva | Analysis of wimp and post wimp interactive systems based on formal specification[END_REF] formally define a system and its WIMP and Post-WIMP interactions with ICO models and colored Petri nets. These models allow them to analyse the properties inherent to the formalisms: place transitions invariants, liveness and fairness, and reachability.

Turner et al. [START_REF] Turner | Using Abstraction with Interaction Sequences for Interactive System Modelling: STAF 2018 Collocated Workshops[END_REF] generate presentation models describing tasks and widgets based interactions sequences of an infusion pump. It is composed by five buttons (Up, Down, YesStart, NoStop, OnOff) and a display allowing interactions with the user. They use FSA to model these sequences.

Others Bhattacharya et al. [START_REF] Bhattacharya | Some issues in modeling the performance of soft keyboards with scanning[END_REF] model soft keyboards (on-screen keyboards) with scanning and use the Fitts-Digraph model [START_REF] Soukoreff | Theoretical upper and lower bounds on typing speed using a stylus and a soft keyboard[END_REF] to evaluate the performance of their model and the system.

Sinnig et al. [START_REF] Sinnig | Towards a common semantic foundation for use cases and task models[END_REF] describe a new formalism based on sets of partially ordered sets. They use it to formally define use cases and task models.

Dix et al. [START_REF] Dix | Modelling devices for natural interaction[END_REF] use an ad-hoc formalism to model physical devices (switches, electric kettle, etc.) logical states and their digital effects in another model.

Oladimeji et al. [START_REF] Oladimeji | Pvsio-web: a tool for rapid prototyping device user interfaces in pvs[END_REF] present PVSio-web, a tool which extends the PVSio component of PVS with a graphical environment. They demonstrate its use by prototyping the data entry system of infusion pumps.

Banach et al. [START_REF] Banach | Application of formal methods in the inspex smart systems integration project[END_REF] consider using an Event-B model in conjunction with an SMT solver in order to proof some invariants on a hardware based components, dedicated to the acquisition and fusion of inputs from various sensors to a visually impaired and blind person's white cane (INSPEX project).

Testing

Silva et al. [START_REF] José | Model-based user interface testing with spec explorer and concurtasktrees[END_REF] highlight a way of testing model-based graphical user interfaces. The testing process presented is as follows: a FSM model called Presentation Task Sets (PTS) is generated from a task model (CTT) with the TERESA tool [START_REF] Mori | Design and development of multidevice user interfaces through multiple logical descriptions[END_REF], a Spec# oracle is generated from the FSM model with their Task to Oracle Mapping (TOM) tool, then a testing framework is used to test the system against the oracle.

Bowen and Reeves [START_REF] Bowen | Ui-design driven model-based testing[END_REF] use the specification language Z for specifying a calendar application. They explore the way to apply testing processes on this application. They use their presentation and interaction models to derive tests such as ensuring that the relevant widgets exist in the appropriate states and ensuring that the widgets have the required behaviors.

Findings

Through this survey, we have explored the study of interactive systems with formal methods. Several classes of properties have been studied and cover different aspects of interactions.

The table 6 summarizes the studies of the articles from the International Workshop on Formal Methods for Interactive Systems that has taken place seven times from 2006 to 2018. It gives a distribution of the articles in our analytical grid. We note: : 1-5 articles;

: 6-10 articles; : 10+ articles.

High proportion of works on formal definitions and specifications

We highlight the high proportion of articles that address the formal definition and the specification of interactive systems (classified in "Formal def." column of table 6). Among the 43 articles from the FMIS workshops, 34 are related to this aspect (representing approximately 80%). More than the half of those specifically address the formal definition of properties inherent to the formalisms used (invariant for B, reachability for transition systems, etc.).

Perceptibility unstudied

We can note that even if several properties related to HMI have been studied, no paper addresses perceptibility properties (cf. "Perceptibility" column). In the FMIS workshops, we have not spotted studies addressing visual, sound or haptic based interactions.

Common formalisms

If we look at the formalisms used (table 5), it appears that some are in the majority. We can see that PVS and SAL are the most widely used specification languages. Over the 14 articles that use specification languages, we find that SAL is the most used with 5 articles using it. PVS is also widely used with 4 articles using it. Those two cover more than the half of the articles using specification language.

B and event-B models are still the most used for refinement processes. 6 articles present refinement processes and half of those use B and event-B models. We find 2 articles using Z and 1 article using µCharts.

New formalisms

During this analysis, we have seen some formalisms close to the nomenclature we have set (see section 2.2). But other formalisms could not be easyly classified in one of the proposed families. We identified 8 papers that use ad-hoc formalisms or formalisms out of the nomenclature.

In those we find, for example, the formal definition of task models and use cases by using an ad-hoc formalism based on sets of partially ordered sets. We also find the modelling of several physical devices with a new and ad-hoc formalism. Another paper presents the formal definition of different emotions by using an ad-hoc formalism. An article presents security properties and the different means (access control language RW, ProVerif's query language, applied π-calculus) of formalising those.

Maturity of case studies

A main case study is frequently presented: the "infusion pump" system. Other systems are presented and considered as "textbook" cases, representing more than half of the papers.

The infusion pump is a safety critical medical device and is used by 7 out of 43 articles. 3 of those study the data part of the whole system by modelling it and validate some properties on a sub-system only. 3 other articles study the full system. They model the final device or its specification in order to check whether the device or its specification validate the global requirements of infusion pump. The last article studies the possible interactions between a user and the system. They model those in the form of interaction sequences corresponding to the human user tasks.

This approach demonstrated the feasibility of the proposed methods but remains limited. We note that even if an infusion pump is a safety critical system, the studies made for this system do not necessarily address safety critical aspects. Indeed, only 3 articles focus on the full system and its certification oriented requirements. Only those demonstrate the scalability of the formalisms used.

16 out of 43 articles focus on "textbook" cases and address the user interface part (web application, smartphone application, e-voting system, etc.). Those allow authors to easily illustrate the use of several formal methods and the properties inherent to those. The systems are modelled, several properties, inherent to the formalisms or to the systems, are studied. However, these articles only illustrate the formal methods and do not allow authors to demonstrate the potential scalability of these formal methods.

Conclusion Aim and contribution of this article

The aim of this article is to review different research work on formal methods applied to interactive systems. The overall contribution is to provide a review of the literature, 43 articles, from the International Workshop on Formal Methods for Interactive Systems. This workshop took place seven times from 2006 to 2018. First we propose an analytical framework based on a few questions. Then we present several properties of interactive systems and classify them. We set a classic nomenclature of formalisms. This analytical framework is provided with an analysis grid of our own. Those highlight the following points: formalisms used, properties studied, case study used to illustrate the analysis. Finally, we highlight the findings and the outgoing issues.

Discussion

Interactive systems are increasingly used in several sectors and propose several kinds of interactions with human users. The interactions can be from the system to the user by using sound notifications or display notifications in order to provide information to the user about the actual internal state of the system. They can also be from the user to the system with many interaction solutions such as mouse clicks, data entries with keyboards or buttons on the system or soft keyboards and buttons on the display of the system interface. All these interactions are source of new challenges when when the objective is to perform the formal verification and validation of their related properties.

During the last decade, a substantial work has been done in order to study how formalisms and methods can be applied to interactive system. A lot of them have demonstrated that it is possible to take into account a lot of classes of properties. High level properties such as those related to the tasks the user may accomplish or those related to the abstract interface have been studied. The classical formalisms relying on state and transition paradigm can be easily used to model these elements. However, properties related to the concrete part of the interface (involving characteristics of the graphical scene) remain largely uncovered by studies. As we highlighted in the section 4, we note that the properties related to the perceptibility have not yet been studied. This is not a real surprise: these properties require to model characteristics of the system which are not traditionaly handled by formal models: color of graphical objects, forms, dimension, visibility, collision etc. Modeling them remains a big challenge.

Perspectives

Our research team works in the aeronautics sector. Thus, we focus on interactive and critical systems related to this sector. Interfaces with a very rich graphical scene are becoming increasingly important in aircraft cockpits. In this context, we develop a reactive language, Smala1 , allowing us to develop interfaces and interactions at the same level.

The issue related to visual perceptibility properties is then important in our opinion. In Béger et al. [START_REF] Béger | Contribution à la formalisation des propriétés graphiques des systèmes interactifs pour la validation automatique[END_REF] we propose elements for formalising graphical properties. We set three basic properties that compose the node of our formalism: the display order depending on the display layer of graphical elements, the intersection depending on the domain of graphical elements and the colour equality. We also present a scene graph we extract from the Smala source code. It models interactive systems and their graphical interface in a new way. It also gives information about graphical elements and their variables (position, colour, opacity, etc.).

From those, we can formally define graphical requirements for an aeronautic system specified in a standard (ED-143 [START_REF]Ed 143 -minimum operational performance standards for traffic[END_REF]). The formalism defines requirements such as the colour equality/inequality, the authorized/unauthorized positions and the display order. The scene graph defines requirements we can not write with our formalism such as the shape of graphical elements.

We aim at defining new graphical properties in order to express with our formalism requirements related to the shape and the relative positions of graphical elements. In order to automatically validate the requirements, we want to link our formalism to the Smala source code by using code annotations.

Table 1 :

 1 Study of the user behavior class of properties in the FMIS workshops

		Goals	Privileges Interpretation Attention Emotion Experience
	(PA) CWB-NC	[32]	[32]
	(PA) CSP	[30]	[30]	[30]
	(PA) LOTOS		[81]
	(PA) PEPA			[33]
	(SL) SAL	[65] [66]	[65] [67]
	(SL) HOPS	[37]
	(other) HTDL		[31]	[31]
	ad-hoc formalism		[19]

Table 2 :

 2 Study of the cognitive principles class of properties in the FMIS workshops

		Salience	Load
	(SL) SAL	[66] [51] [66] [51]
	(other) GUM	[51]	[51]

Table 3 :

 3 Study of the HMI class of properties in the FMIS workshops

		Consistency Predictability Latency Usability Perceptibility
	(SL) SAL	[57]	[65] [66]
	(SL) PVS	[46] [47]
	(SL/Re) µCharts		[22]
	(SL/Re) Z	[21]
	(TS) IOLTS	[14]
	(TL) LTL	[14]	[66]
	(TL) CTL	[46] [27]
	(other) Tree based WCET	[55]

Table 4 :

 4 Study of the security class of properties in the FMIS workshops

		Integrity Usability errors Threats
	(SL) SAL		[65]
	(TS) IOLTS	[14]
	(TL) LTL	[14]
	(other) BDMP		[53]
	others/ad-hoc	[6]	[6]

Table 5 :

 5 Study of the specification/formal definition and testing classes in the FMIS workshops

		Formal definition	Testing		Formal definition Testing
	(PA) CSP	[30]		(TS) GTS	[84]
	(PA) LOTOS	[10]		(TS) FSA	[83]
	(PA) π-calculus	[6]		(TS) Event act. graph	[55]
	(PA) Prob. π-calc.	[5]		(TS) ICO	[76]
	(PA) PEPA	[33]		(TL) LTL	[6] [26]
	(PA) TCBS'	[16]		(TL) CTL	[46]
	(SL) SAL	[57] [12]		(other) SAT	[26]
	(SL) Spec#		[75]	(other) Mark. proc.	[5]
	(SL) PVS	[56] [46] [62] [47]		(other) MAL	[27] [46]
	(SL) Promela	[26]		(other) GUM	[51]
	(SL) HOPS	[37]		(other) BDMP	[53]
	(SL/Re) µCharts	[22]		(tool) Spec explorer	[75]
	(SL/Re) Z	[21] [23]	[23]	(tool) FEST	[75]
	(Re) B/event-B	[28] [68] [41]		(tool) SMT solver	[23]
	(TS) FSM	[82]		(tool) PVSio web	[62] [47]
	(TS) UPPAAL (TS) Colored PN	[45] [76]		others / ad-hoc	[77] [17] [39] [6] [30] [20] [82] [9]

Table 6 :

 6 Study of interactive systems properties in the FMIS workshops

	User behavior Cognitive pr.	HMI Perceptibility	HMI Others	Security	Formal def. Testing
	Process algebra
	Spec. language
	Refinement
	Transition systems
	Temporal logic
	Other / ad-hoc

http://smala.io/

Acknowledgments

This work is partly funded by the ANR project FORMEDICIS, ANR-16-CE25-0007.