M Frayssines

D Hantz

Modelling and back-analysing failures in steep limestone cliffs

Keywords: Rock bridge, back-analysis, toppling, sliding, limestone cliff

The observation of 12 rock fall scars in steep limestone cliffs has shown that the fallen masses were stable as a result of relatively small rock bridges. These results demonstrate that consideration of rock bridges is necessary for a realistic evaluation of stability. Limit equilibrium methods of analysis are presented for sliding and toppling, for both isostatic and hyperstatic conditions. These methods are illustrated with four case histories. The results of 9 back-analyses of rock falls with volumes between 24 m 3 and 3500 m 3 are presented. The rock cohesion obtained from back-analysis appears to be significantly lower than the cohesion obtained from classical laboratory tests. This discrepancy can be attributed to several factors including: a spatial and temporal scale effect, the oversimplified modelling (two-dimensional limit equilibrium) and some uncertainties affecting the geometrical data. When analysing the stability of a cliff with a limit equilibrium method, the authors suggest dividing the cohesion by a "scale and method" factor of 3.

Introduction

Anaclinal slopes in hard sedimentary rocks can be very steep and can have large overhangs, which can be natural or due to the construction of mountain roads. Rock falls in these steep cliffs are due to either slide or topple. A survey of 25 rock falls that have occurred in the French Subalpine ranges, with volume from 20 m 3 to 30,000 m 3 [START_REF] Frayssines | Failure mechanisms in calcareous cliffs of the Subalpine range (French Alps)[END_REF], has made it possible to identify typical failure configurations for these anaclinal slopes (Fig. 1).

Figure 1 shows 3 typical failure configurations observed between the surveyed 25 rock fall events. Where the beds dip less than 30°, A and B failure configurations have been observed. In the first one (A), the unstable rock mass rests on a steep joint plane, which is roughly perpendicular to the bedding (cross-joint), on which sliding is possible in a translational mode. Toppling is also possible depending on the size of the overhang. In the second configuration (B), the cross-joint is not sufficient to constitute a failure surface and another joint (less inclined and generally shorter than cross-joints) makes up the low bound of the unstable block, on which sliding is possible. Sliding may occur on this singular joint in a translational mode (with opening of the cross-joint) or in a more complex mode (compound slide). Toppling requires opening of both joints. Where the beds dip more than 30° opposite the slope, the C configuration has been observed. The main joint set is perpendicular to the bedding and it defines a potential sliding surface. This failure surface is stepped where the bedding planes form overhangs. For the two first configurations, it is often difficult to know which of the two mechanisms will occur: sliding or toppling, if no precise cliff topographical model is available. In this case, both sliding and toppling must be considered in the analysis.

Twelve failure surfaces were closely observed (generally using rappelling): in these latter fresh intact rock fracture surfaces were visible, representing a small percentage of the whole failure surface (0.2 to 5%). In the case of toppling failures, these surfaces are due to fracturing of the rock bridges which had kept the rock mass in equilibrium for several decades. In the case of sliding they may also be due to fracturing of prominent bumps on the sliding surface.

Stability analyses of the configurations described above are necessary for a better assessment of rock fall hazard, which is usually qualitative [START_REF] Hantz | An historical, geomechanical and probabilistic approach to rock-fall hazard assessment[END_REF], and for mitigation studies (bolting, mining). As the size and location of the rock bridges inside the rock mass are hardly accessible to observation, these are usually neglected. This is acceptable in rock slope design because it leads to a conservative design [START_REF] Hoek | Rock Slope Engineering[END_REF][START_REF] Hantz | Ingénierie des pentes rocheuses naturelles et artificielles[END_REF]. Should the rock bridges be neglected in hazard assessment, the analysis would conclude that cliffs which have existed for several centuries have very low safety factors. A realistic hazard assessment needs to consider the rock bridges which exist on the potential failure surfaces. Methods for stability analysis of potential translational rock slides (planar slides and stepped slides) have been proposed [START_REF] Call | Prediction of step path failure geometry for slope stability analysis[END_REF][START_REF] Einstein | The effect of discontinuiuty persistance on rock slope stability[END_REF][START_REF] Glynn | The probabilistic model for shearing resistance of jointed rock[END_REF][START_REF] Kemeny | The time dependent reduction of sliding cohesion due to rock bridges along discontinuities: a fracture mechanics approach[END_REF][START_REF] Scavia | Metodo meccanico-probabilistico per l'analisi della stabilità dei pendii in roccia[END_REF]. The methods were applied to a priori analyses of potential rock slides, but they were not validated by back-analyses of actual rock slides. Paronuzzi and Serafini [START_REF] Paronuzzi | The influence of rock bridges in block fall processes[END_REF] back-analysed rock slides and topples involving rock bridge failure to determine the intact rock cohesion and tensile strength. However, they did not compare the values obtained to laboratory test results.

Stability analyses with rock bridges need to know their strength parameters. Classical laboratory tests on intact rock specimens can be used, but the scale effect can be high and does not work on the side of safety. The authors undertook back analyses of cliff failures to determine the in situ rock bridge strength [START_REF] Frayssines | Contribution à l'évaluation de l'aléa éboulement rocheux (rupture)[END_REF]. The methods used for both sliding and toppling analyses are described in this paper. Since the static conditions may be isostatic or hyperstatic, two different methods have been applied for both sliding and toppling. These are presented with four case studies; in addition the results of nine back-analyses are given and discussed.

Morphological and geological setting

The 25 rock falls which were surveyed to identify typical failure configurations occurred in the French Subalpine Ranges, which represent part of the sedimentary cover of the External Crystalline Massifs of the French Alps, and belong to the Dauphinoise (or Helvetic) zone (Fig. 2). The front ranges are made of limestone and marls of the upper Jurassic and Cretaceous. Typically, valley walls consist of a succession of steep calcareous cliffs and marly slopes. The calcareous cliffs belong to Tithonian, Valanginian, Barremian (Urgonian facies), and Campanian-Maastrichtian stages. The highest cliffs are up to 450m high. The back-analyzed rock falls occurred in Urgonian limestone cliffs.

Survey methodology

The rock falls have been easily identified thanks to the bright scar they left (in contrast with the patina of the cliff), and the damage they produced in the forest. The scars have been surveyed, roping down in the cliff, in order to collect geometrical and structural information: dimensions of the scar, of the intact rock fractures, discontinuities making up the failure surface (orientation, extension, roughness, cover). This information is given in a previous paper [START_REF] Frayssines | Failure mechanisms in calcareous cliffs of the Subalpine range (French Alps)[END_REF]. Intact rock fracturing is indicated by the colour of fresh intact rock, which is light beige to light rosy for Urgonian limestone. Fresh fracture surfaces usually contrast with the rest of the scar, which is often coated with a calcite crust, whose colour may vary from white to orange, according to the quantity of iron oxide in the calcite. These surfaces usually represent a very small part of the scar area (usually less than 1%). They may result from fracturing of rock bridges, or bumps in the case of sliding planes. Bumps fracturing may be caused by either the initial failure or the subsequent friction of the moving mass. Slip evidences are rarely observed on very steep sliding planes (A configuration in Fig. 1), probably because the normal forces are to low in these cases. In the absence of slip evidences, the observation of fracture surfaces doesn't allow distinguishing a shear from a tensile failure. So the failure mechanism is usually derived from the reconstruction of the original cliff surface.

Mechanical characterisation

Porosity and density measurements, uniaxial and triaxial compression tests, and Brasilian tests were carried out in the laboratory, on Urgonian limestone in order to evaluate the intact rock's physical and mechanical parameters [START_REF] Frayssines | Contribution à l'évaluation de l'aléa éboulement rocheux (rupture)[END_REF] (Table 1). The friction angle and cohesion values for the intact rock were derived from triaxial compression tests, using the Coulomb failure criterion. However, this criterion would give an overestimated strength in the field of normal tensile stresses [START_REF] Goodman | Introduction to Rock Mechanics[END_REF]. Instead, a bilinear criterion is assumed, which defines a "tensile friction angle" as the slope of the failure criterion for tensile normal stresses (Fig. 3). Our test results give a ratio of cohesion to tensile strength equal to 3.3. Hoek [START_REF] Hoek | Strength of jointed rock masses[END_REF] has shown that a rock is characterized by the shape of the intact rock failure criterion, which is not affected by the scattering of the rock strength from one sample to another. It means that the cohesion and the tensile strength are not independent and the uncertainty affecting the tensile friction angle is much smaller than those affecting these parameters.

Mechanical characteristics of Urgonian limestone joints have been determined from direct shear tests on 0.40 m x 0.25 m specimens [START_REF] Ramirez-Rascon | Analyse géotechnique des glissements de versants sédimentaires sur des plans de stratification[END_REF] (Table 1). These tests produced peak friction angles between 30 and 43°. However the roughness observed at the scale of the scar (> 10 m²) is higher than that of the samples due to large scale steep ondulations. It ensues that the scale effect could be either positive or negative (according to [START_REF] Bandis | Experimental studies of scale effects on the shear behaviour of rock joints[END_REF]), although an identical roughness at both scales would lead to a lower friction angle at the larger scale [START_REF] Barton | Effects of block size on the shear behaviour of jointed rock[END_REF]. A negative scale effect was observed by Locher et al. [START_REF] Locher | Shear tests on layered Jurassic limestone[END_REF], who obtained an in situ peak friction angle 5° higher than that measured in the laboratory on smooth limestone joint samples.

Back analyses

Back analyses of toppling and sliding were carried out in two dimensions using the limit equilibrium method. As the analysed rock falls were not linked to any noticeable seismic or hydrological event, the only acting force which was considered was the weight of the falling mass. All forces acting on the rock mass were assumed to be in a vertical plane containing its centre of gravity, parallel to the displacement vectors. This implies that the centres of the rock bridges belong to this plane. So the only moments which were considered are perpendicular to this plane. Otherwise, moments belonging to this plane should be considered and a mode III fracture (referring to fracture mechanics theory, [START_REF] Atkinson | Introduction to fracture mechanics and its geophysical applications[END_REF]) could occur.

Zero tensile strength and cohesion values were assumed for discontinuities and the bridges were assumed to have the properties of intact rock. We considered that their friction angle was less affected by the scale effect than their cohesion, and then we took the value of 54° given by the laboratory tests (Table 1). Based on our in situ observations of the joint roughness, the most relevant value for the friction angle of the discontinuities is 43°.

Sliding

Isostatic model

Figure 4 shows the method of analysis applied for the isostatic condition modelling. The resisting force required for equilibrium, is determined by the equilibrium equations. Different values for the mechanical parameters of the rock bridges and the joints can give this resisting force. We considered that the friction angles were given by the laboratory tests and we determined the rock bridge cohesion which gave the required resisting force. By using the limit equilibrium method in the X and Y directions, equations 1 and 2 are obtained:

On the X axis :

Wcos N (1) On the Y axis : Wsin T ( 2
)
Where W is the weight of the unstable rock mass, N and T are normal and tangential components of the resisting force and α is the dip of the sliding plane.Assuming that the normal stress is uniformly distributed on the sliding plane and that this plane has no cohesion outside the rock bridges, the tangential resisting force is:

rb rb rb rb d rb A c tan a )tan a - (1 N T ( 3
)
Where d is the friction angle of the sliding plane, a rb is the surface proportion of intact rock bridges on the sliding plane, c rb and rb are the cohesion and friction angle of the rock bridges and A rb is the total area of the rock bridges.

The in situ cohesion of the rock bridge, which explains the failures observed, is obtained using Eq. ( 1) to (3):

rb rb rb d rb rb A tan a tan a - 1 cosα - sin W c (4)

Case history

The Pas du Fouillet rock fall occurred on July 1998 in the South-West part of the Vercors massif (Fig. 2), involving a volume of 24 m 3 . The failure is located in the middle part of a 200 m high urgonian limestone cliff striking N10° and dipping 85° to the West. Two major joint sets N10°/81°W (J1) and N114°/81°SW (J2) cut sub-horizontal limestone beds. The sliding plane is about 10 m high and 4 m wide and it is made up of a joint N0-5°/80°W belonging to the J1 set (Fig. 5). It is bounded to the North by a joint N110°/90° belonging to the J2 set, which opened when sliding occurred. A fresh fracture surface with an area of 0.08 m 2 is due to a rock bridge fracture (Fig. 5B). The cohesion of the rock bridge as determined by back analysis is 6.6 MPa.

Hyperstatic model

Hyperstatic sliding occurs when resisting forces act not only on the sliding plane, but also on the rear opening plane. This case occurs when rock bridges exist in the rear opening plane.

Figure 6 shows the method of analysis applied for the hyperstatic conditions modelling. By using the limit equilibrium method in the X and Y directions, equations 5 and 6 are obtained:

On the X axis :

) - cos( R Wcos N 2 1
(5) On the Y axis :

) - sin( R - Wsin T 2 1 (6)
Where N 1 , T 1 are the normal and tangential components of the resisting force on the sliding plane, R 2 is the resisting force on the opening plane (with N 2 and T 2 its normal and tangential components), and are the dips of the sliding plane and the opening plane, and is the angle between R 2 and N 2 .

The normal and tangential components N 2 and T 2 are:

cos R - N 2 2 (7) sin R T 2 2 (8)
The sliding plane undergoes a compression (N 1 is positive) and the failure criterion is:

rb1 rb rb rb d rb 1 1 A c tan a )tan a - (1 N T (9)
Where A rb1 is the total area of the rock bridges on the sliding plane.

The opening plane undergoes a tension (N 2 is negative) and the failure criterion is:

rb2 rb 2 2 A c tan N T ( 10
)
Where A rb2 is the total area of the rock bridges on the plane 2 and tan is the ratio between the cohesion and the tensile strength of the rock bridge (Fig. 3). Introducing Eq. ( 7) and (8) in Eq. ( 10), the failure criterion becomes: [START_REF] Frayssines | Contribution à l'évaluation de l'aléa éboulement rocheux (rupture)[END_REF] Contrary to the isostatic case, the resisting forces required to ensure equilibrium are not determined by the equations of equilibrium and the rock bridge cohesion cannot be determined without an additional assumption. Indeed, the equilibrium Eq. ( 5) and ( 6), and the failure criteria Eq. ( 9) and [START_REF] Frayssines | Contribution à l'évaluation de l'aléa éboulement rocheux (rupture)[END_REF], give 4 equations and the number of unknowns is 5 (N 1 , T 1 , R 2 , , c rb Following Panet and Rotheval [START_REF] Panet | Stabilité des masses rocheuses[END_REF], we make the additional assumption that the resisting force R 2 is parallel to the direction of sliding. Then, the angle is known and the problem can be solved. The in situ cohesion of the rock bridge, which explains the observed failure, is given by the expression:

tan cos sin A c R rb2 rb 2
tan cos sin A tan a a - 1 ) - cos( ) - sin( A tan cos sin tan a a - 1 cos - sin W c rb1 rb rb d rb rb2 rb rb d rb rb tan tan (12)

Case history

The Dent du Loup rock fall, with a volume of 6000 m 3 , occurred during the night of 4th January 2001, in the Vercors massif, 8 km North-West of the town of Grenoble (Fig. 2). The major part of the fragmented rock mass stopped near the toe of the cliff, destroying 0.5 hm 2 of wood. One block stopped 150 m from houses located in the valley. The rock fall broke away from the top of a 180 m high limestone cliff striking N50° and dipping 85-90° to the north-west. The scar is roughly 60 m high and 15 m wide. From analysis of aerial photographs, four main subvertical joint sets were detected: N0° (J1), N50-70° (J2), N80-100° (J3) and N140-160° (J4). In the scar, bedding planes (N0°/30°E) form several overhangs (Fig. 7A). The failure surface is made up of bedding planes, a main irregular sliding surface N60/70-85°NW which belongs to joint set (J2) and two lateral planes in the upper part of the scar: N145°/75°SW (on the North-East side) and N145/90° (on the South-West side), belonging to the joint set (J4) (Fig. 7B). The main sliding surface can be approximated by two planes: a lower plane (1) dipping 70° and an upper plane (2) dipping 75° (Fig. 7). According to the block theory [START_REF] Goodman | Block Theory and its Application to Rock Engineering[END_REF], the failure mechanism was a wedge slide on the two planes N60/70°NW and N145°/75°SW. However, the normal stress was mainly applied on the plane N60/70°NW and there was no cohesion on the lateral plane N145°/75°SW (no fresh fracture). Thus the resisting force on the lateral plane was neglected and a planar slide was assumed on the plane N60/70NW. Fresh fracture surfaces cover 4.7m 2 on the plane 1 and 4.3 m 2 on the plane 2. The total scar area was 1000m 2 . The cohesion of the rock bridges determined by back analysis was 12.4 MPa.

Toppling

Isostatic model

In the observed cases of isostatic toppling, the rock bridges were concentrated in the lower part of the scar. In the model the zone where the rock bridges are concentrated, was considered as a unique equivalent rock bridge, with equivalent strength properties (Fig. 8B).

Figure 8A shows the equilibrium conditions of forces and moments described by equations (13 -15):

On the X axis :

Wsin N ( 13
)
On the Y axis : Wcos T (

On the Z axis : Wd M fz [START_REF] Bandis | Experimental studies of scale effects on the shear behaviour of rock joints[END_REF] Where N and T are the normal and tangential components of the resisting force on the rock bridge, M fz is the resisting moment on the Z axis, due to the rock bridge, is the angle between the rock bridge plane (Y axis) and a vertical line, and d is the moment arm of the weight W of the unstable rock mass.In limit equilibrium sliding analysis, stresses are usually considered to be constant along the sliding planes [START_REF] Hoek | Rock Slope Engineering[END_REF]. In toppling analysis, it can be seen in Figure 8A that the force equilibrium needs the total normal resisting force to be compressive, but the moment equilibrium implies that tension exists in the upper part of the rock bridge. It ensues a non-constant normal stress distribution in the rock bridge. As in structural engineering, a linear distribution of the normal stress along the rock bridge is assumed (Fig. 9A). The difference between the minimal (tensile) normal stress ( min ) and the mean (compressive) normal stress ( ) is:

f 2 rb fz min l H 6M σ σ ( 16
)
Where H rb is the height of the equivalent rock bridge (Fig. 8) and l f is the width of the failure surface (Fig. 8).

The mean normal and shear stresses and τ are given by:

f rb l H N σ ( 17
) f rb l H T ( 18
)
The shear stress is assumed to be constant along the fracture plane. From Eq. ( 13), ( 15), ( 16) and ( 17), the minimal normal stress in the rock bridge, which explains the observed failure, is given by:

f 2 rb rb min l H 6d sinα H W σ ( 19
)
Note that for design purposes, the hypothesis of a linear distribution of the normal stress (Fig. 9A) is more conservative (or more pessimistic) than the hypothesis of a rectangular distribution (Fig. 9B), which is adopted, for example, in the UDEC code [START_REF]Itasca. Universal distinct element code (UDEC) version 3.10[END_REF]. For the second hypothesis the calculation would lead to the following Eq. ( 20):

f 2 rb rb min l H 2d sinα H W σ (20)
The above calculated stresses correspond to equivalent (or apparent) stresses acting on an equivalent rock bridge. Assuming that the total width of the rock bridge is constant on the height of the equivalent rock bridge, the actual stresses σ are proportional to the equivalent stresses σ' and they are given by:

rb rb A' σ' σA ( 21
)
Where A rb is the total area of the actual rock bridges (Fig. 8B) and A rb ' is the area of the equivalent rock bridge (Fig. 8B). At failure, the normal and shear stresses meet the failure criterion of the rock. From the values of the critical normal and shear stresses (Eq. ( 18) and ( 19)), which occur at the upper tip of the rock bridge, the in situ tensile strength and cohesion can be estimated.

Case history

The Ranc rock fall occurred on 30th January, 2004, 50 Km SW of Grenoble (Fig. 2). 2200 m 3 of rock collapsed onto the road, killing two people in a car. The cliff is 150 m in height, strikes N80 and dips 85-90° to the South. The fall occurred where the cliff formed an overhang due to the construction of the road 150 years ago (Fig. 10B). The limestone beds strike N0°, dip 15° to the East, and they are cut perpendicularly by 2 joint sets N100°/90° (J1) and N33°/75°SE (J2). The scar is 50 m wide, about 20 m high and the mean thickness of the fallen mass was approximately 2.5 m. The failure surface is made up of a bedding plane N0°/15°E and two planes, N90/80-85°S and N40°/85°NW belonging respectively to the joint sets (J1) and (J2) (Fig. 10A). In the major part of the scar, the rock is coated by a calcite crust (yellowish-orange colour). Intact rock fracture surfaces have been observed in the lower part of the plane N90°/80-85°S (Fig. 10). These fresh fracture surfaces, which cover an estimated area of 52 m 2 (5% of the whole scar area), are due to the failure of rock bridges. The equivalent rock bridge considered in the analysis has a height of 3.5 m and a width of 35 m. We obtained tensile strength and cohesion values equal to 3.2 MPa and 10.5 MPa respectively.

Hyperstatic model

Figure 11 shows the equilibrium conditions of forces and moments described by equations (22 -24):

On the X axis :

0 ) - /2 cos( R - T 2 1 (22)
On the Y axis :

0 W - ) - /2 sin( R - N 2 1 (23)
On the Z axis :

0 Wd - d R 1 2 2 (24)
Where N 1 and T 1 are the normal and tangential components of the resisting force R 1 on the point 0, R 2 is the resisting force on the rock bridge (N 2 and T 2 : normal and tangential components), d 1 is the moment arm of the weight W, d 2 is the moment arm of R 2, is the angle between R 2 and the normal to the rock bridge surface and is the angle between the rock bridge surface and a horizontal plane.

The failure criterion for the rock bridge is given by equation ( 9) and shown in Figure 3.

This hyperstatic problem has 5 unknowns (N 1 , T 1 , R 2 , , C rb and 4 equations (Eq. 22 to 25). The angle δ was determined using the maximum work principle in order to calculate the resisting force in a rock bolt [START_REF] Panet | Renforcement des fondations et des talus à l'aide d'ancrages actifs et passifs[END_REF]. This principle is illustrated in Fig. 12. In a normal versus shear force diagram, the end of the resisting force R 2 on rock bridge, must be located on the failure criterion, in such a way that the scalar product of the displacement vector u  and the opposite of force R 2 is maximum (the opposite of R 2 is the force exerted by the moving mass, on the stable rock mass). Introducing Eq. ( 26) and ( 27) into Eq. ( 25), the cohesion of the rock bridge is:

rb rb A tan cos sin R c 2 (25)
Note that the verification of the shear failure criterion on point 0 (Eq. ( 29)) is needed for the validation of the cohesion obtained.

1 1 tan N T 1 (26) If this criterion is not fulfilled, then T 1 = N 1 tan 1 is imposed.

Case history

The Goule Blanche rock fall, with a volume of about 30 m 3 , occurred in the upper part of a 200 m high cliff, striking N30°, at an unknown date around the year 2000. Beds are horizontal and cut by two steeply dipping joint sets which strike N64° (J1) and N152° (J2). The failure surface is about 7 m high. It is made up first by a wedge defined by two surfaces N65°/80-90°SE and N150°/85-90°SW belonging respectively to sets J1 and J2 (Fig. 13A). These two surfaces are coated with a calcite crust. In the lower part of this wedge, there is a singular plane N30°/75°NW, which includes a fresh intact rock fracture surface (Fig. 13B). This fracture surface has an area of 0.2 m 2 (0.8 % of the scar area). The base of the block is made up of a horizontal bedding plane. The lower part of the fallen mass was overhanging, allowing for a toppling mechanism (Fig. 13C). According to the maximum work principle, the stress in the rock bridge was a pure shear stress (Fig. 12). With a friction angle of 30° for the base of the block, the failure criterion (Eq. 9) is fulfilled. The estimated in situ cohesion and tensile strength values are respectively 14 MPa and 4.2 MPa.

Other analyses

Five other cases have been back-analysed using the methods described above [START_REF] Frayssines | Contribution à l'évaluation de l'aléa éboulement rocheux (rupture)[END_REF]. The mechanical parameters obtained for all cases are given in Table 6.

Discussion

Importance of rock bridges

International Journal of Rock Mechanics & Mining Sciences 46, 1115-1123.

10

The back-analyses of nine rock falls have shown that the compartments had been stable for a long time thanks to rock bridges and that the proportion of rock bridges in the failure surfaces was very small. It means that compartments with the same geometrical configuration but with a significantly higher proportion of rock bridges are very stable. It ensues that classical stability analyses, which does not usually take rock bridges into account, often lead to pessimistic results and to unnecessary mitigation measures. It is therefore very important to develop geophysical methods to investigate rock bridges, and convincing results have been obtained with ground penetrating radar [START_REF] Dussauge-Peisser | Investigation of a fractured limestone cliff (Chartreuse Massif, France) using seismic tomography and ground penetrating radar[END_REF][START_REF] Jeannin | Multi-configuration GPR measurements for geometrical fracture characterization in limestone cliffs (Alps)[END_REF][START_REF] Deparis | On the potential of Ground Penetrating Radar to help rock fall hazard assessment of a limestone scale[END_REF].

Back analysis and laboratory mechanical parameters

It can be seen in Table 2 that the rock bridge cohesion obtained from back analysis is always lower (2 to 9 times lower) than the average cohesion obtained from laboratory tests. This discrepancy could be due to the natural dispersion of the rock strength, but in that case, it would not be always in the same way. It may be due to scale effects or to an oversimplified modelling (these two points are developed hereafter), but also to uncertainties affecting the data used for modelling. These uncertainties mainly concern the pre-failure cliff morphology and the rock bridge fracture area. The pre-failure cliff morphology is well known when a pre-failure, digital elevation model (DEM) or photographs were available. In these cases (Dent du Loup and Ranc rock falls), a postfailure DEM was achieved and the exact shape of the fallen compartment could be determined. In the other cases, the pre-failure cliff morphology was reconstructed by extrapolating the adjacent cliff surfaces. In these cases, prominent overhangs could have been omitted, leading to an underestimation of the rock bridge strength. In sliding cases, some fresh fracture areas could be due to bump fracturing, occurring after the initial failure, and due to sliding of the rock mass. Taking into account such fracture areas leads also to underestimate the rock bridge strength. Note that the three lowest values in Table 6 could be affected by both types of error. Moreover, the lowest value corresponds to the case where the uncertainty affecting the pre-failure morphology appears to be the most important. On the other hand, the cohesion values obtained using the exact shape of the rock compartments (Dent du Loup and Ranc rock falls) are greater than 10 MPa. From these considerations, it appears that the rock bridge cohesion obtained from back analysis is 2-3 times lower than the average cohesion obtained from laboratory tests. The authors propose that the cohesion obtained from classical laboratory tests must be divided by this "scale and method" factor, when evaluating the stability of a cliff.

Spatial and temporal scale effects

The size of the rock bridge fracture surfaces is one to two orders of magnitude greater than that of the tested specimen. The spatial scale effect has been analysed for limestone by Bieniawski and Van Heerden [START_REF] Bieniawski | The significance of in situ tests on large rock specimens[END_REF]. For specimens sized between 10 cm and 1 metre, the cohesion is divided by 3. The temporal scale effect is due to the fact that a more or less constant stress had been applied for a long time (at least several tens of years) in rock bridges, whereas in the laboratory, the stress increases in some minutes from zero to the instantaneous strength. Creep tests on limestone have shown that the long term strength can be 0.61 to 0.78 times the instantaneous strength for tests lasting only several days [START_REF] Goodman | Introduction to Rock Mechanics[END_REF][START_REF] Lama | Handbook on Mechanical Properties of Rocks[END_REF]. Lower values can be expected for loading lasting several decades. These results can not be directly applied to the analyzed cases because they have been obtained from different limestones and from uniaxial compression tests, in which the stress state is quite different from that acting in the analyzed rock bridges (uniaxial tension or quasi-pure shear). However they yield a semi-quantitative explanation of our results.

Oversimplified modelling

The limit equilibrium method assumes that the strengths of the different parts of the failure surface are mobilised simultaneously. The method does not take into consideration that the rock bridges probably have a higher stiffness than that of the joints and thus undergo higher stresses than those assumed in the model. In the case of sliding, this leads to an underestimation of the rock bridge cohesion. Stress-strain modelling should be used to overcome this drawback. It would also give more realistic results for hyperstatic mechanisms. Moreover, shear or tensile stress concentrations at the joint tips have not been considered. This also leads to an underestimation of the rock bridge cohesion or tensile strength. Fracture mechanics methods should be used to take this phenomenon into account [START_REF] Kemeny | The time dependent reduction of sliding cohesion due to rock bridges along discontinuities: a fracture mechanics approach[END_REF][START_REF] Scavia | A method for the study of crack propagation in rock structures[END_REF][START_REF] Castelli | Fracture mechanics approach to the study of failure in rock[END_REF]. Also, the use of a two-dimensional model does not make it possible to simulate the possible torsion of rock bridges, which can lead to a mode III rupture. This also underestimates the rock bridge cohesion.In engineering practice, the authors suggest that the proposed method could be used as a preliminary tool to determine what cases need a more sophisticated modelling. For example, when the stability is ensured while applying a large reduction factor, more precise modelling is not necessary. In the context of natural hazard assessment, the proposed modelling appears to be sufficient to assess the present state of stability of potentially unstable rock compartments, accounting for the uncertainty affecting the prediction of their future behaviour.

Conclusion

The observation of 12 rock fall scars has shown that the fallen masses had been stable due to relatively small rock bridges. It ensues that taking into account rock bridges is necessary for realistic stability evaluation. However, 9 back analyses with limit equilibrium methods have shown that the rock cohesion obtained from classical laboratory tests must be divided by 2 or 3 to explain the observed failures. This discrepancy is due largely to two factors: a spatial and temporal scale effect and the oversimplified modelling (two-dimensional limit equilibrium).However, the authors propose using the limit equilibrium method as a preliminary tool in engineering practice and suggest dividing the cohesion by a "scale and method" factor of 2 or 3. Where a mode III rupture [START_REF] Atkinson | Introduction to fracture mechanics and its geophysical applications[END_REF] is possible, a three-dimensional analysis appears to be necessary. The authors consider that using fracture mechanics methods could improve modelling of rock bridge fracture. Finally, the development of geophysical methods to investigate the continuity (and the rock bridges) of potential failure surfaces is encouraged.

FIGURE CAPTIONS.

Fig. 1 .Fig. 2 .Fig. 3 .

 123 Fig. 1. Typical failure configurations in steep limestone cliffs, with beds dipping less than 30° (A and B) or more than 30° (C)

Fig. 4 .

 4 Fig. 4. Description of the forces for the isostatic sliding model. W: weight ; N and T: normal and tangential resisting forces

Fig. 5 .Fig. 6 .

 56 Fig. 5. (A) Scar of the Pas du Fouillet rock slide, (B) sketch of the scar with the rock bridge (white) and (C) cross-section A-A before failure

Fig. 7 .

 7 Fig. 7. (A) schematic cross-section of the Dent du Loup rock slide and (B) sketch of the scar with the rock bridges (white)

Fig. 10 .

 10 Fig. 10. (A) view of the scar of the Ranc rock fall, with the rock bridges in white and (B) cross-section A-A of the cliff before failure with the position of the equivalent rock bridge. W: weight of the unstable block ; H rb : height of the equivalent rock bridge.

Fig. 11 . 2 Fig. 12 .

 11212 Fig. 11. Description of the forces for the hyperstatic toppling model. W: weight ; N 1 and T 1 : normal and tangential resisting forces on the basal plane ; N 2 and T 2 : normal and tangential resisting forces on the rock bridge ; R 2 : resultant of N 2 and T 2

Fig. 13 .

 13 Fig. 13. (A) Sketch of the scar of the Goule Blanche rock fall, (B) focus on the zone of the intact rock fracture and (C) cross-section of the cliff before failure

  Figure 1 Click here to download high resolution image

  Figure 7 Click here to download high resolution image

Acknowledgement

The authors would like to thank the "Pôle Grenoblois Risques Naturels" and the "Région Rhône-Alpes" for their funding.


Clément Houtmann
email: clement.houtmann@loria.fr

∆ Contrl

∆ ⊥r

Superdeduction in λµ μ

Keywords: Classical sequent calculus, Superdeduction, λµμ-calculus UMR 7503

Superdeduction is a method specially designed to ease the use of first-order theories in predicate logic. The theory is used to enrich the deduction system with new deduction rules in a systematic, correct and complete way. A proof-term language and a cut-elimination reduction already exist for superdeduction, both based on Christian Urban's work on classical sequent calculus. However Christian Urban's calculus is not directly related to the Curry-Howard correspondence contrarily to the λµμ-calculus which relates straightaway to the λ-calculus. This short paper is my first step towards a further exploration of the computational content of superdeduction proofs, for I extend the λµμ-calculus in order to obtain a proofterm langage together with a cut-elimination reduction for superdeduction. I also prove strong normalisation for this extension of the λµμ-calculus.

Introduction

Superdeduction is an extension of predicate logic designed to ease the use of first-order theories by enriching a deduction system with new deduction rules computed from the theory. Once the theory is presented as a rewrite system, the translation into a set of custom (super)deduction rules is fully systematic. Superdeduction systems [START_REF] Brauner | Principles of superdeduction[END_REF] are usually constructed on top of the classical sequent calculus LK which is described in Figure 1. New deduction rules are computed from a theory presented as a set of proposition rewrite rules, i.e. rewrite rules of the form P → ϕ where P is some atomic formula. Such rewrite rules actually stand for equivalences ∀x.(P ⇔ ϕ) where x represents the free variables of P . The computation of custom inferences for the proposition rewrite rule P → ϕ goes as follows. On the right, it decomposes (bottom-up) the sequent ϕ using LK\{Cut, ContrR, ContrL} (indeterministically) until it reaches a sequence of atomic sequents 1 (Γ i ∆ i ) 1 i n and side condition C therefore yielding the inference rule for introducing P on the right

(Γ, Γ i ∆ i , ∆) 1 i n Γ P, ∆ C .
On the left, it similarly decomposes ϕ until it reaches a sequence of atomic sequents (Γ j ∆ j ) 1 j m and side condition C yielding similarly the inference rule (Γ, Γ j ∆ j , ∆) 1 j m

Γ, P ∆ C .
As remarked in [START_REF] Houtmann | Axiom directed focusing[END_REF], this indeterministic process may yield several inference rules for introducing P respectively on the right or on the left. One must add all the possible inference rules in order to obtain a complete superdeduction system.

Definition 1 (Superdeduction systems) If R is a set of proposition rewrite rules, the superdeduction system associated to R is the system obtained by adding to LK all the inferences which can be computed from the elements of R.

The paradigmatic example for superdeduction is the system associated to the proposition rewrite rule A ⊆ B → ∀x.(x ∈ A ⇒ x ∈ B). This rewrite rule yields inference rules

Γ, x ∈ A x ∈ B, ∆ Γ A ⊆ B, ∆ x / ∈ FV(Γ, ∆)
and

Γ, t ∈ B ∆ Γ t ∈ A, ∆ Γ, A ⊆ B ∆ .
As demonstrated in [START_REF] Brauner | Principles of superdeduction[END_REF], superdeduction systems are always sound w.r.t. predicate logic. Completeness is ensured whenever right-hand sides of proposition rewrite rules do not alternate quantifiers2 . Cut-elimination is more difficult to obtain: several counterexamples are displayed in [START_REF] Houtmann | Représentation et interaction des preuves en superdéduction modulo[END_REF]. I have proved in [START_REF] Houtmann | Axiom directed focusing[END_REF] that whenever right-hand sides of proposition rewrite rules do not contain universal quantifiers and existential quantifiers at the same time3 , cut-elimination in superdeduction is equivalent to cut-elimination in deduction modulo [START_REF] Dowek | Theorem proving modulo[END_REF].

In the original paper introducing superdeduction [START_REF] Brauner | Principles of superdeduction[END_REF], a proof-term language and a cut-elimination reduction are defined for superdeduction, both based on Christian Urban's work on classical sequent calculus [START_REF] Urban | Classical Logic and Computation[END_REF]. The reduction is proved to be strongly normalising on well-typed terms when the set of proposition rewrite rules R satisfies the following hypothesis.

Hypothesis 1

The rewriting relation associated to R is weakly normalising and confluent and no first-order function symbol appear in the left-hand sides of proposition rewrite rules of R. Christian Urban's calculus is not directly related to the Curry-Howard correspondence contrarily to the λµμ-calculus which relates straightaway to the λ-calculus. In order to explore the computational content of superdeduction inferences, I will define in section 2 an extension of the λµμ-calculus for superdeduction systems and prove the same strong normalisation result using Hypothesis 1. But before doing so, let us recall the definition of λµμ.

The λµμ-calculus is defined as follows. In order to avoid confusion between first-order variables and λµμ variables, I will use sans-serif symbols for firstorder variables (x, y . . . ) and first-order terms (t, u . . . ). Commands, terms and environments are respectively defined by the grammar in Figure 2(a). The type system is described in Figure 2(c). Reduction rules are depicted in Figure 2(b). I have added a constant environment f in order to realise falsity. I also have added constructions λx.π and t • e in order to realise universal quantifications respectively on the right and on the left. Implication, universal quantification and falsity are sufficient to express all the connectives in LK. The typing rules Notations. Sequences (a i ) 1 i n may be denoted (a i ) i or just ā when the upper bound n can be retrieved from the context (or is irrelevant). I may even combine both notations: (ā i ) i represents a sequence of sequences ((a j,i ) 1 j mi ) 1 i n . Finally if Γ = (A i ) i and x = (x i ) i are respectively a sequence of n formulae and a sequence of n variables, then x : Γ denotes the (typed) context x 1 : A 1 , x 2 : A 2 . . .

Extending λµ μ

In the LICS'07 paper introducing superdeduction [START_REF] Brauner | Principles of superdeduction[END_REF], Christian Urban's calculus is presented as a better choice than λµμ for a basis of a proofterm language for superdeduction. In this section, I demonstrate that λµμ can be extended for superdeduction as easily as Christian Urban's calculus. Such an extension is my first step towards a computational interpretation of superdeduction, since the λµμ-calculus relates directly to the Curry-Howard correspondence. An imprecision of the LICS'07 paper is also corrected in the process. The extension of λµμ that I will present corrects this mistake. The imprecision concerns first-order quantifications. Indeed a superdeduction inference represents an open derivation which may contain several quantifiers destructions. The structure of these destructions is essential to the definition of the underlying cut-elimination mechanisms. For instance a sequence ∀∃ on the right corresponds to the creation of an eigenvariable, say x, followed by an instanciation by some first-order term, say t, which may contain x as a free variable. A sequence ∃∀ on the right corresponds to an instanciation by some first-order term, say t, followed by the creation of an eigenvariable, say x. In this latter case, t is not allowed to contain x as a free variable. This distinction is completely erased in the syntax of the LICS'07 extension. It results in an imprecision of the scope of eigenvariables in extended proofterms: the scope is not explicit in the syntax. In my extension of λµμ, I will correct the syntactical imprecision by introducing a notion of trace which represents the correct syntax for a precise syntactical representation of the scopes of eigenvariables in extended proofterms. Then I will present a correct cut-elimination procedure by introducing a notion of interpretation for the constructs of the extended λµμ relating such constructs to λµμ proofterms in a correct way. At the end of the section, a pathological example is depicted to illustrate the imprecision of the LICS'07 extension and the correction of the present extension. First, let us consider any derivation in LK, potentially unfinished, i.e. with open leaves. Since such a derivation is a tree, there exists a natural partial order on its inferences: an inference precedes another if the former is placed under the latter. Such a partial order can easily be extended into a total order (in an indeterministic way). Considering only instances of ∀R, ∀L, ∃R and ∃L, such a total order yields a list L of such instances. Each instance of ∀R or ∃L corresponds to the use of an eigenvariable, say x, that I denote x?. Each instance of ∀L or ∃R corresponds to the instanciation of some first-order variable by a first-order term, say t, that I denote t!. The list L becomes a list whose elements are either of the form x? or of the form t!. Such a list is called a trace for the derivation.

Let us consider a proposition rewrite rule r : P → ϕ leading to the superdeduction inferences

(Γ, Γ i ∆ i , ∆) i Γ P, ∆
(c i Γ, x i : Γ i α i : ∆ i , ∆) i Γ r(L, (µ i (x i , α i ).c i ) i ) : P | ∆ C
Similarly we obtain a corresponding trace L for the superdeduction inference introducing P on the left which is turned into the typing rule rL (c j Γ, y j :

Γ j β j : ∆ j , ∆) j Γ | r(L , (μ j (y j , β j ).c j ) j ) : P ∆ C .
For example, the inference rules for ⊆ are turned into

c Γ, x : x ∈ A α : x ∈ B, ∆ Γ r(x?, µ(x, α).c) : A ⊆ B, ∆ x / ∈ FV(Γ, ∆)
and

c 1 Γ, x : t ∈ B ∆ c 2 Γ α : t ∈ A, ∆ Γ, r(t!, μ1 (x).c 1 , μ2 (α).c 2 ) : A ⊆ B ∆ .
We must now define how cuts of the form Open λµμ is obtained by trivially extending cut-free λµμ to such judgements and by adding the typing rule Open Θ; X S X S .

r(L, (µ i (x i , α i ).c i ) i ) | r(L
For example, Figure 3 A typing derivation in open λµμ obviously corresponds to a derivation in LK (with open leaves) and whenever L is a trace for the latter derivation, I will say that it is a trace for the typed command, term or environment. Let us reconsider our extended terms r(L, (µ i (x i , α i ).c i ) i ) and r(L , (μ j (x j , α j ).c j ) j )

and their respective typing rules rR and rL. Since such rules logically come from decomposing ϕ respectively on the right and on the left, the sets (Y j (y j : Γ j β j : ∆ j )) j e : ϕ well-typed in open λµμ and L is a trace for e are both non-empty. Therefore we choose indeterministically one π and one e in these sets. This term and this environment are called the respective interpretations of r(L, (µ i (x i , α i ).c i ) i ) and r(L , (μ j (x j , α j ).c j ) j ). The command π|e reduces (using the reduction in Figure 2(b)) to normal forms. Cut-elimination on extended terms is defined by adding to the reduction relation defined in Figure 2(b) the rule

π (X i (x i : Γ i α i : ∆ i )) i π : ϕ well-typed in
(µr(L, (µ i (x i , α i ).c i ) i )|r(L , (μ j (y j , β j ).c j ) j ) → c[(c i /X i ) i , (c j /Y j ) j ]
for each normal form c of π|e (where delayed substitutions

reduces to c[t/x][(µβ.c 2 )/x][μy.c 1 /α] and c 1 [µα.c[t/x][(µβ.c 2 )/x]/y] .
If R is a set of proposition rewrite rule, I will denote λµμ R the type system resulting of extending the type system of Figure 2(c) with the typing rules for R. I will denote → λµμ R the reduction relation of Figure 2(b) extended by the reduction rules for R.

Theorem 1 (Subject Reduction) For all R, typability in λµμ R is preserved by reduction through → λµμ R .

Proof. The only case worth considering is a reduction from r(L, (µ i (x i , α i ).c i ) i )|r(L , (μ j (y j , β j ).c j ) j )

to c[(c i /X i ) i , (c j /Y j ) j ].
By definition, c is a normal form of π|e where π and e are the respective interpretations of r(L, (µ i (x i , α i ).c i ) i ) and r(L , (μ j (y j , β j ).c j ) j ). (X i (x i : Γ i α i : ∆ i )) i π : ϕ and (Y j (y j : Γ j β j : ∆ j )) j e : ϕ are well-typed in open λµμ. Therefore by subject reduction in open λµμ

(X i (x i : Γ i α i : ∆ i )) i ; (Y j (y j : Γ j β j : ∆ j )) j c
is also well-typed in open λµμ. This demonstrates that whatever the type of r(L,

(µ i (x i , α i ).c i ) i )|r(L , (μ j (y j , β j ).c j ) j ) is, the command c[(c i /X i ) i , (c j /Y j ) j ]
has the same type.

Theorem 2 (Strong Normalisation) For all R satisfying hypothesis 1, → λµμ R is strongly normalising on commands, terms and environments that are well-typed in λµμ R .

Proof. Hypothesis 1 implies that any formula ϕ has a unique normal form for R that we denote ϕ ↓ p . Let us denote → e the rewrite relation defined by replacing extended terms for superdeduction by their interpretations. r(L, (µ i (x i , α i ).c i ) i ) → e π r(L , (μ j (y j , β j ).c j ) j ) → e e . . . Such a rewrite relation is strongly normalising and confluent, therefore yielding for any extended command c, term π or environment e a normal form denoted c ↓ e , π ↓ e of e ↓ e . Such normal forms are raw λµμ commands, terms or environments. Strong normalisation of our extended cut-elimination reduction comes from the facts that 1. c Γ ∆ well-typed in our extended type system implies that c ↓ e (Γ ) ↓ p (∆) ↓ p well-typed in λµμ ; 2. Γ π : A | ∆ well-typed in our extended type system implies that (Γ ) ↓ p π ↓ e : A ↓ p | (∆) ↓ p well-typed in λµμ ; 3. Γ | e : A ∆ well-typed in our extended type system implies that

(Γ ) ↓ p | e ↓ e : A ↓ p (∆) ↓ p well-typed in λµμ ; 4. c → c implies c ↓ e → + c ↓ e 5. π → π implies π ↓ e → + π ↓ e 6.
e → e implies e ↓ e → + e ↓ e . The hypothesis on first-order function symbols (see Hypothesis 1) is crucial in establishing points 1 to 3: indeed for any formula ϕ and any first-order substitution σ, it must be the case that (ϕ ↓ p )σ = (ϕσ) ↓ p . These six points demonstrate that through ↓ e and ↓ p , the λµμ-calculus simulates our extended calculus. Strong normalisation of λµμ therefore implies strong normalisation of our extended reduction.

The end of this section is dedicated to a pathological example for superdeduction: the proposition rewrite rule r : P → (∃x 1 .∀x 2 .A(x 1 , x 2 )) ∨ (∃y 1 .∀y 2 .B(y 1 , y 2 )) whose most general superdeduction rules are

Γ A(t, x 2 ), B(u, y 2 ), ∆ Γ P, ∆  x2 / ∈ FV(Γ, ∆, u) y2 / ∈ FV(Γ, ∆) and Γ A(t, x 2 ), B(u, y 2 ), ∆ Γ P, ∆  x2 / ∈ FV(Γ, ∆) y2 / ∈ FV(Γ, ∆, t) .
The LICS'07 proofterm extension transforms these two inferences into a unique proofterm rR(λx 2 .λy 2 .(λα.λβ.m), t, u, γ). It is obviously inaccurate with respect to the scope of x 2 and y 2 : in the proofterm there is no mention that either t is not in the scope of y 2 or u is not in the scope of x 2 . This fact is not reflected in the pure syntax but in the typing rules m Γ α : A(t, x 2 ), β : B(u, y 2 ), ∆ rR(λx 2 .λy 2 .(λα.λβ.m), t, u, γ) Γ γ : P, ∆

 x2 / ∈ FV(Γ, ∆, u) y2 / ∈ FV(Γ, ∆)
and m Γ α : A(t, x 2 ), β : B(u, y 2 ), ∆ rR(λx 2 .λy 2 .(λα.λβ.m), t, u, γ) Γ γ : P, ∆

 x2 / ∈ FV(Γ, ∆) y2 / ∈ FV(Γ, ∆, t) .
Let us see now this mistake is corrected in our extension of λµμ. Traces for the superdeduction inferences are respectively u! y 2 ? t! x 2 ? and t! x 2 ? u! y 2 ?. These traces clearly specify whether t is not in the scope of y 2 or u is not in the scope of x 2 . My extension of λµμ translates these superdeduction inferences into the typing rule

c Γ α : A(t, x 2 ), β : B(u, y 2 ), ∆ Γ r(u! y 2 ? t! x 2 ?, µ(α, β).m) : P | ∆  x2 / ∈ FV(Γ, ∆, u) y2 / ∈ FV(Γ, ∆) and c Γ α : A(t, x 2 ), β : B(u, y 2 ), ∆ Γ r(t! x 2 ? u! y 2 ?, µ(α, β).c) : P | ∆  x2 / ∈ FV(Γ, ∆) y2 / ∈ FV(Γ, ∆, t) .
The proofterms (and the typing rules) reflect the scope of the eigenvariables. The interpretation of r(u! y 2 ? t! x 2 ?, µ(α, β).m) is by definition a term well-typed in λµμ whose trace is u! y 2 ? t! x 2 ? and the interpretation of r(t! x 2 ? u! y 2 ?, µ(α, β).c) is by definition a term well-typed in λµμ whose trace is t! x 2 ? u! y 2 ?. This trace restriction implies that r(u! y 2 ? t! x 2 ?, µ(α, β).m) and r(t! x 2 ? u! y 2 ?, µ(α, β).c) behave differently with respect to cut-elimination. This extension of the λµμ-calculus is my first step towards a computational interpretation of superdeduction. Indeed it refutes the idea [START_REF] Brauner | Principles of superdeduction[END_REF] that Christian Urban's calculus is a better basis for a proofterm language for superdeduction: it is as easy to extend λµμ syntax, typing and reduction for superdeduction. However the extension presented in this short paper is a mechanical transcription of the LICS'07 extension. It does not explore any further the computational content of cut-elimination for superdeduction.

I believe that one of the key ingredients towards this goal is pattern-matching. Indeed superdeduction systems historically come from supernatural deduction [START_REF] Wack | Typage et déduction dans le calcul de réécriture[END_REF], an extension of natural deduction designed to type the rewriting-calculus (a.k.a. ρ-calculus) [START_REF] Cirstea | The rewriting calculus --part i and ii[END_REF] (The first rule is an introduction rule and the second is an elimination rule.) The rewriting calculus is an extension of the λ-calculus where rewrite rules replace lambda-abstractions. The idea underlying the relation between supernatural deduction and rewriting calculus is that the proposition rewrite rule r corresponds to a specific pattern r(x, x 1 . . . x n ). The introduction rule types an abstraction on this pattern (i.e. a rewrite rule) Γ, x 1 : A 1 . . . x n : A n π : C Γ r(x, x 1 . . . x n ) → π : P

x / ∈ FV(Γ )

.

Dually the elimination rule types an application on this pattern Γ π : P (Γ π i : A i [ t/x]) i Γ π r( t, π 1 . . . π n ) : C .

Supernatural deduction systems (in intuitionnistic natural deduction) have later been transformed into superdeduction systems (in classical sequent calculus) in order to handle more general proposition rewrite rules. This transformation from supernatural deduction to superdeduction systems should not break the relation with pattern matching. Indeed cut-elimination in sequent calculus relates to pattern matching [START_REF] Cerrito | Pattern matching as cut elimination[END_REF]. Recent analysis shows that the duality between patterns and terms reflects the duality between phases in focused proof systems [START_REF] Zeilberger | Focusing and higher-order abstract syntax[END_REF]. Finally I demonstrated [START_REF] Houtmann | Axiom directed focusing[END_REF][START_REF] Houtmann | Représentation et interaction des preuves en superdéduction modulo[END_REF] that superdeduction systems share strong similarities with focused proof systems such as LKF [START_REF] Liang | Focusing and polarization in intuitionistic logic[END_REF][START_REF] Liang | A unified sequent calculus for focused proofs[END_REF], a focused sequent calculus for classical logic. Answers should naturally arise from the study of the computational content of such focused systems [START_REF] Munch-Maccagnoni | Focalisation and classical realisability[END_REF][START_REF] Curien | The duality of computation under focus[END_REF].

Fig. 1 .

 1 Fig. 1. Classical Sequent Calculus LK

FocusR

  Γ π : A | ∆ π|α Γ α : A, ∆ and FocusL Γ | e : A ∆ x|e Γ, x : A ∆ are admissible in the type system of Figure 2(c). Replacing the Cut rule by FocusR and FocusL yields a type system that I will call cut-free λµμ. It is obviously not equivalent to the original type system in Figure 2(c). The reduction relation defined in Figure 2(b) is strongly normalising on well-typed terms as demonstrated in [4].

cFig. 2 .

 2 Fig. 2. The λµμ-calculus

.

  Γ j ∆ j , ∆) j Γ, P ∆ C Let us consider the first one. Since it is derived from inferences of LK, there exists a derivation of ϕ with open leaves (Γ i ∆ i ) i in LK [8, Property 6.1.3]. Let L be a trace for this derivation. Then the superdeduction inference introducing P on the right is turned into the typing rule rR

Fig. 3 .

 3 Fig. 3. Typing in open λµμ

  open λµμ and L is a trace for π and e

  , (μ j (y j , β j ).c j ) j ) are reduced. Such reductions are computed using open λµμ, a type system for derivations with open leaves in λµμ. An open leaf is represented by a variable command (symbols X, Y . . . ). The types of such variables have the same shape as the types of usual commands in λµμ-calculus: full sequents Γ ∆. Therefore typing in open λµμ is performed in a context Θ which contains a list of typed variable commands of the form X Γ ∆. As usual, variable commands are allowed to appear only once in such contexts. Typing judgements are denoted

		Θ c Γ ∆	when typing a command;
		Θ Γ π : A | ∆	when typing a term
	and	Θ Γ | e : A ∆	when typing an environment.

  The environment t•(µβ.Y )•(μy.Z) is a potential interpretation of r(t!, μ1 (y).c 1 , μ2 (β).c 2 ). The cut λx.λx.µα.X|t • (µβ.Y ) • (μy.Z)

	has two normal forms, namely
	X{t/x}{(µβ.Y )/x}{μy.Z/α}	and	Z{µα.X{t/x}{(µβ.Y )/x}/y} .
	Therefore a cut
	r(x?, µ(x, α).c)|r(t!, μ1 (y).c 1 , μ2 (β).c 2 )

{•/•} are replaced by primitive substitutions [•/•]).

Let us reconsider the inclusion example. The term λx.λx.µα.X is a potential interpretation of r(x?, µ(x, α).c).

  . Supernatural deduction turns proposition rewrite rules of the form r : P → ∀x.((A 1 ∧ A 2 . . . A n ) ⇒ C) into inference rules for natural deduction Γ, A 1 . . . A n C Γ P

	x / ∈ FV(Γ )	and	Γ P	(Γ A i [ t/x]) i Γ C[ t/x]	.

Γ ϕ1 ∧ ϕ2, ∆ ∧L Γ, ϕ1, ϕ2 ∆ Γ, ϕ1 ∧ ϕ2 ∆ ∨R Γ ϕ1, ϕ2, ∆ Γ ϕ1 ∨ ϕ2, ∆ ∨L Γ, ϕ1 ∆ Γ, ϕ2 ∆ Γ, ϕ1 ∨ ϕ2 ∆ ⇒R Γ, ϕ1 ϕ2, ∆ Γ ϕ1 ⇒ ϕ2, ∆ ⇒L Γ ϕ1, ∆ Γ, ϕ2 ∆ Γ, ϕ1 ⇒ ϕ2 ∆ ∀R Γ ϕ, ∆ Γ ∀x.ϕ, ∆ x / ∈ FV(Γ, ∆) ∀L Γ, ϕ[t/x] ∆ Γ, ∀x.ϕ ∆ ∃R Γ ϕ[t/x], ∆ Γ ∃x.ϕ, ∆ ∃L Γ, ϕ ∆ Γ, ∃x.ϕ ∆ x / ∈ FV(Γ, ∆)

Formulae such as (∀x.ϕ) ∧ (∃y.ψ) are allowed.

Formulae such as (∀x.ϕ) ∧ (∃y.ψ) are not allowed.

→ c[π/x] λx.π|t • e → π[t/x]|e (b) Reduction Γ, x : A x : A | ∆ Γ | α : A α : A, ∆ Γ, x : A π : B | ∆ Γ λx.π : A ⇒ B | ∆ Γ π : A | ∆ Γ | e : B ∆ Γ | π • e : A ⇒ B ∆ Cut Γ π : A | ∆ Γ | e : A ∆ π|e Γ ∆ Γ | f : ⊥ ∆ c Γ α : A, ∆ Γ µα.c : A | ∆ c Γ, x : A ∆ Γ | μx.c : A ∆ Γ π : A | ∆ Γ λx.π : ∀x.A | ∆ x / ∈ FV(Γ, ∆) Γ | e : A[t/x] ∆ Γ | t • e : ∀x.A ∆ (c) Type System