Mauricio Alférez
email: mauricio.alferez@di.fct.unl.pt

Nuno Amalio
email: nuno.amalio@uni.lu

Selim Ciraci
email: ciracis@ewi.utwente.nl

Franck Fleurey
email: franck.fleurey@sintef.no

Jörg Kienzle
email: joerg.kienzle@mcgill.ca

Jacques Klein
email: jacques.klein@uni.lu

Max Kramer
email: max.kramer@student.kit.edu

Sébastien Mosser

Gunter Mussbacher
email: gunter@sce.carleton.ca

Nuno Amálio

Sebastien Mosser
email: sebastien.mosser@inria.fr

Ella Roubtsova
email: ella.roubtsova@ou.nl

Gefei Zhang
email: gefei.zhang@pst.ifi.lmu.de

Aspect-Oriented Model Development at Different Levels of Abstraction

Keywords: Aspect-oriented modeling, localization of concerns, composition, verification, localization of reasoning

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Separation of concerns is a key software engineering principle that helps to reduce complexity, improve reusability, and simplify evolution. Aspect-oriented software development (AOSD) takes traditional support for separating concerns a step further by allowing developers to modularize their descriptions along more than one dimension [START_REF] Tarr | N Degrees of Separation: Multi-Dimensional Separation of Concerns[END_REF].

Drawing inspiration from aspect-oriented programming research, AOM brings the aspect-orientation to design, analysis and requirements phases of software development. Aspect-oriented modeling (AOM) approaches, in particular, aim to provide means for localizing of crosscutting concerns at the level of models to guarantee traceability of concerns across the software development lifecycle and reuse of different realizations of a concern within and across software models; verification of models with crosscutting concerns; localizing of reasoning on models of concerns about the behaviour of the whole model. This paper surveys a set of AOM approaches working at different levels of abstraction. The aim is to compare the techniques of localization of aspects and the techniques of reasoning on aspect models and identify research challenges in AOM. Section 2 identifies the abstraction level of each of eight different AOM approaches and illustrates each of the approaches with a model of the same concern. All chosen approaches have demonstrated their scalability by taking the challenge of modelling the case study of a crisis management system (CMS) [START_REF] Kienzle | Crisis Management Systems: a Case Study for Aspect-Oriented Modeling[END_REF]. Section 3 discusses the approaches and identifies future directions for AOM research.

AOM at Different Levels of Abstraction

Authentication Concern

The description of the authentication concern is taken from the requirements for a Crisis Management System [START_REF] Kienzle | Crisis Management Systems: a Case Study for Aspect-Oriented Modeling[END_REF]. This concern is modelled and used for correctness analyses in all compared AOM approaches.

The system authenticates users on the basis of the access policies when they first access any components or information. If a user remains idle for 30 minutes or longer, the system shall require them to re-authenticate.

Feature Abstractions

In Variability Modelling Language for Requirements (VML4RE) [START_REF] Alférez | Multi-View Composition Language for Software Product Line Requirements[END_REF] the Authentication concern is localized as one reusable feature identified by its name "Authentication"(Figure 1). Feature model visualizes the dependencies between the Authentication feature and the Session Handling and Administration features. Authentication requires the UserAdministration feature because the system authenticates users on the basis of access policies associated to them. Feature model also identifies Authentication as an optional feature. The VML4RE specification is a good starting point for concern modelling. Different requirements models can be created to describe the features, using notations of UML2.0 or approaches presented in this overview. For example, if the Authentication feature is selected for a specific product according to the VML4RE specification in Figure 1, the requirements specification will include the specification concern called "Authentication" in the chosen specification notation (e.g. a use case specification or a sequence diagram). Also, according to combinations of more than one feature it is possible to apply concerns that modify or add new parts in the requirements specifications. Features do not specify system internals, they only capture requirements for a system, so the verification of the system's behaviour and any reasoning about it are not applicable at the level of feature modelling.

Use Cases

At the level of use case modelling the Authentication use case is described step by step. As it is recognized as a reusable unit, it should contain pointcut designators (instructing where, when, and how to invoke the advice) and join points (defining places in the model where an advice should be inserted) [START_REF] Filman | Aspect-Oriented Software Development[END_REF]. Such concepts do not exist in conventional use case notations.

Aspect-oriented User Requirements Notation (AoURN) [START_REF] Mussbacher | Extending the User Requirements Notation with Aspect-oriented Concepts[END_REF] supports conventional concepts of use case and workflow modelling techniques but also enables localizing of aspects. The primary goal of AoURN is to model any functional or non-functional concern of the system under development that can be expressed with scenarios.

Fig. 2 depicts the AoURN scenario model for the Authentication concern. The authentication scenario starts at the authenticate start point and ends either at The pointcut stub RequiresAuthentication represents all locations where the Authentication concern is to be applied. At one glance, it is apparent that the concern is to be applied before these locations since the concern-specific behaviour occurs before the pointcut stub. In this case, a simple sequential composition is desired, but AoURN scenario models can be composed in many different ways (e.g., as alternatives, optionally, in parallel, in loops, or in an interleaved way). The composition rules are exhaustive in that their expressiveness is only restricted by the AoURN scenario language itself.

Patterns define the actual locations where the concern is to be applied: in this case, each time there is an interaction between an actor and the System as shown in the two sub-models above the User component. The variable $User defined in the patterns allows the concern to reuse the matched component.

AoURN models involve neither detailed data nor message exchanges. This makes them well suited for the early stages of the software development process. AoURN scenario definitions can be analyzed, enabling regression-testing of the scenario model. AoURN combines aspect-oriented modeling with goaloriented modelling allowing to model the reasons for choosing a concern using goal models.

Use cases identify abstract actions coming from the environment and abstract responses of the system, driving the system from one state to another, but do not capture system local storage and the internal behavior. While it is possible to validate use case models, system verification and local reasoning on aspects about the whole system behaviour are not applicable at the level of use cases. Further system specification involves choices. Actions may become operations, messages, or events recognized by objects and aspects. Depending on these choices, different modelling techniques may be used.

Classes and Sequence Diagrams

Reusable Aspect Models (RAM) [START_REF] Kienzle | Aspect-Oriented Multi-View Modeling[END_REF] describes the structure and behaviour of a concern using class, state and sequence diagrams. Fig. 3 shows how the structural view of the Authentication concern associates Session objects with |Authenticatable objects.

The Authentication behavior is described in state views and message views. State views detail the method invocation protocol of objects using state diagrams. Message views specify the message passing between objects using sequence diagrams. For example, the login message view in Fig. 3 shows how a session object is instantiated upon a successful login attempt. The requireLogin message view demonstrates how method invocations of |methodRequiringLogin of an |Authenticatable object are disallowed if no session is currently established. To apply the authentication aspect, the mandatory instantiation parameters must be mapped to model elements of the base model. For instance, to enable user authentication, the mapping |Authenticatable → User, |methodRequiringLogin → * *(..) would ensure that no public method of a User object can be invoked before the user authentication.

Fig. 3. RAM model

To reuse structure and behavior of low-level aspect models in models that provide more complex functionality, the RAM approach supports the creation of complex aspect dependency chains. Blocking authentication and timed authentication are modeled by reusing the aspects Authentication, Blockable and Timing (see bottom of Fig. 3). GrACE (Graph-based Adaptation, Configuration and Evolution) approach expresses the base and concerns models as class and sequence diagrams. The specification also contains an activator action and the execution constraint, a sequence of method invocations, expressed with Computational Tree Logic (CTL). With this input, GrACE simulates the execution and the composition of the input diagrams starting from the activator action. The end result of this is the execution tree where each branch is a possible composition showing all the methods invoked in it [START_REF] Ciraci | A Graph-Based Aspect Interference Detection Approach for UML-Based Aspect-Oriented Models[END_REF]. Then, a verification algorithm verifies whether the input execution constraints is violated or not. In case it is violated, a feedback is provided to the user. In this way, the user can verify the behavior of the concerns in the composed model. For simulation, GrACE specializes graph-based model checking by defining a model called Design Configuration Model (DCM) for representing UML based AOMs with graphs, and modeling OO-and AspectJ-like execution semantics with graph-transformation rules over this model.

GrACE uses the mapping from Theme/UML [START_REF] Clarke | Generic Aspect-Oriented Design with Theme/UML[END_REF] to a Domain Specific Language. Hence, the concerns are modeled as "themes" in Theme/UML. Fig. 4 presents an excerpt from the sequence diagram of the theme Authenticate, which defines a pointcut to the template method fireStart. The advice for this pointcut is defined in the method beforeInvoke(), which checks if the user is already authenticated.

Fig. 4. GrACE:Sequence diagrams

The themes are converted to DCMs for verification. GrACE toolset includes a prototype tool which automates the conversion from Theme/UML to DCM. Fig. 5 shows the graph-based DCM of the theme Authenticate. The node labeled AspectType with the attribute name AuthenticateUser represents the template class AuthenticateUser. The node with the attribute toMethod set to fireStart that is connected to the aspect type node represents the template parameter of the theme Authenticate. Server.ScenarioBroadCastEvent(). In the activation bar of this method, the first action is a call action. Hence, the transformation rule findDecl matches at state S6 and identifies ScenarioOutSideEvent.fireStart() as the receiver of the call. Because the aspect AuthenticateUser defines a pointcut to this method, the transformation rule formBeforeJoinPoint matches and gives the execution to the advice.

Classes and State Machines

A UML Behaviour State Machine (BSM) usually presents behaviour of one classifier. Aspects extend the behaviour specified for classifiers. HiLA modifies the semantics of BSM allowing classifiers to apply additional or alternative behaviour. The High-Level Aspects (HiLA) approach [START_REF] Zhang | HiLA: High-Level Aspects for UML State Machines[END_REF] introduces AspectJ-like constructs into UML state machines. The basic static structure usually contains one or more classes. Each base state machine is attached to one of these classes and specifies its behavior. HiLA offers two kinds of aspects to modify such a model. Static aspects directly specify a model transformation of the basic static structure of the base state machines. Dynamic (high-level) aspects only apply to state machines and specify additional or alternative behaviour to be executed at certain "appropriate" points of time in the base machines execution. Fig. 7 presents the scenario of the Authentication concern. Modeling with HiLA is a top-down process. The main success scenario of a (behavioral) concern is modeled in the base machine: first the user enters his credentials (Enter-Credentials), which are then validated (in stateAuthenticate). The extension for authentication failures is modeled with the pattern whilst (stereotype whilst). State Authenticate is active. If the current event is wrong (tagged value "trigger = wrong", then the advice is executed, which forces the base machine to go to state EnterCredentials, where the user can try again.

The history-based extension, which allows the system to accept at most three trials to log in is modeled in Three Trials. The history property f 3 counts how often its pattern, which specifies continuous sequences containing three and no) final state occurrences, are contained in the execution history so far. The pointcut selects the points of time just before state EnterCredentials gets active. If f3 = 1 , is satisfied, which means that the user has already tried to log in three times unsuccessfully and now tries to authenticate again, the advice takes the base Aspects are composed together by the weaving process. Additional behaviors defined by whilst aspects are woven as additional transitions. History-awareness is achieved by entry actions to keep track of states activation; before (and after ) aspects are woven into transitions selected by the pointcut.

HiLA uses formal methods of model validation. The application of aspects to BSM results in another UML state machine which is analyzed using the model checking component of Hugo/RTmodel checking tools. Hugo/RT translates the state machine and the assertions into the input language of a back-end model checker SPIN. SPIN then verifies the given properties presented in Linear Temporal Logic.

Services

The Adore framework1 is an approach to support aspect-oriented business processes modeling, using the orchestration of services paradigm.

Models describing business-driven processes (abbreviated as orchestrations, defined as a set of partially ordered activities) are composed with process fragments (defined using the same formalism) to produce a larger process. Fragments realize models with little behavior and describe different aspects of a complex business process. Adore allows a business expert to model these concerns separately, and use automated algorithms to compose them.

Using Adore, designers can define composition units (abbreviated as composition) to describe the way fragments should be composed with orchestrations. The merge algorithm used to support the composition mechanism [START_REF] Mosser | Web Services Orchestration Evolution: A Merge Process For Behavioral Evolution[END_REF] computes the set of actions to be performed on the orchestration to automatically produce the composed process. When the engine detects shared join points, an automatic merge algorithm is triggered to build a composed concern. Adore also provides a set of logical rules to detect conflicts inside orchestrations and fragments (e.g., non-deterministic access to a variable, interface mismatch, lack of response under a given condition set).

We represent in Fig. 8 the initial orchestration dealing with the authentication concern. It represents the base success scenario, as described in the requirements. To model blocking the user after 3 failed attempts, we use the fragment depicted in Fig. 9. The composition algorithm produces the final behavior by integrating the fragment into the legacy orchestration.

Mixins

A Protocol Model [START_REF] Mcneile | Protocol Modelling. A Modelling Approach that Supports Reusable Behavioural Abstractions[END_REF] of a system is a set of protocol machines (PMs) that are composed to model the behavior of the system. Fig. 10 shows a protocol model of the security concern composed from PMs Employee Main, Clock, Singleton, Password Handler and Want Time Out. natural weaving algorithm for aspects. The alphabet of the composed machine is the union of the alphabets of the constituent machines; and the local storage of the composed machine is the union of the local storages of the constituent machines. When presented with an event the composed machine will accept it if and only if all its constituent machines, that have this event in their alphabet, accept it. If at least one of such machines refuses the event it is refused by the composed machine. The concept of event refusal is critical to implement CSP composition for composition of protocol machines. This allows for modelling of the situation when events occur and the system cannot accept them. Join points are often events. Password Handler specifies join points for the Authentication concern. A Session Event is accepted if the Password Handler is in state logged in, when both machines Employee Main and Password Handler may accept it.

Quantification on events is defined by generalized events, e.g. event Out = {LogOut, T imeOut}. Quantification on states is defined as derived states. State abstractions specified with derived states are allowed to be used in join point specifications. For example, the state logged In is derived as "If (Tries <= 4 && Password = Security Password)", and as a result the generic event Out representing events Time Out and Log Out becomes possible.

The CSP composition based algorithm is used for aspect weaving and simulation. It produces system traces from parts of traces of aspects with te Modelscope tool. This algorithm guarantees that the order of accepted events in traces of aspects is not changed in the result of their composition (see the proof in [START_REF] Mcneile | CSP Parallel Composition of Aspect Models[END_REF]). The aspect interference of composed aspects may block some traces of aspects, but it will not change the order of events in them. This property of local reasoning [START_REF] Mcneile | CSP Parallel Composition of Aspect Models[END_REF] provided by the PM approach prevents appearance of invasive aspects and eases the reuse and evolution of protocol models.

Contracts

The Visual Contract Language (VCL) [START_REF] Amálio | Modular Design by Contract Visually and Formally using VCL[END_REF][START_REF] Amálio | Using VCL as an Aspect-Oriented Approach to Requirements Modelling[END_REF] takes an approach to behaviour modelling that is based on design by contract. A VCL model is organized around packages, which are reusable units encapsulating structure and behaviour. Packages represent either a traditional module or an aspect. VCL's package composition mechanisms allow larger package to be built from smaller ones.

Figure 11 presents the VCL package Authentication, which localizes part of the authentication concern. Authentication extends package U sers. State structures of a package are defined in the package's structural diagram (SD); together they define the package's state space. The SD of package Authentication (Fig. 11(b)) says that a U ser of package U sers2 is associated with a Session through the relational-edge HasSession. In addition, the diagram includes an invariant HasSessionIfLoggedIn, stating that each session must be associated with a user that is logged-in [START_REF] Amálio | Using VCL as an Aspect-Oriented Approach to Requirements Modelling[END_REF]. Authentication operations (Login and Logout) are defined in VCL package AuthenticationOps, which extends package Authentication (Fig. 12). Operations that perform state changes are defined in contract diagrams, composed of a pre-and a post-condition. Figure 12(c) shows two contract diagrams for blob U ser. Operation LoginOk says in the pre-condition that a login is successful if the password given as input (pw?) matches the password of the user being authenticated (u?.pw); post-condition says that the status of the user is loggedIn, the number of passwords misses is 0, and the operation reports success (value loginOk) to its environment (output r!). Operation Logout says that provided the user status is logged in (pre-condition), then the user status is changed to logged-out (post-condition).

Figure 13 presents package Authorisation, which puts two aspects together: Authentication and AccessControl (see [START_REF] Amálio | Using VCL as an Aspect-Oriented Approach to Requirements Modelling[END_REF]). This package defines the observe operation U serLoggedInAndHasP erm, which checks whether a user is logged in and has the right permissions to execute some task; this puts together the observe operations U serHasP erm of AccessControl and U serIsLoggedIn of Authentication. VCL's contracts and assertions are modules that can be combined using logical operators.

Aspects are composed using join extension, which is illustrated in Fig. 14. In join extension, there is a contract that describes the joining behaviour of an aspect (a join contract ) that is composed with a group of operations placed VCL is designed with a formal Z semantics and so it has the potential for verification and global reasoning using theorem proving.

Discussion and Conclusion

Our overview shows how aspect-orientation is used at different levels of abstraction. All approaches achieved localization of concerns and better traceability of requirements in models. Each abstraction level supports its own composition technique and this technique defines the possibilities of reasoning on models. The modelling techniques that use the same composition techniques as programs, i.e. sequential compositional composition, alternative, cycle and inheritance have an execution tree as a result of model composition and need to use verification techniques for model analysis. The modelling techniques that use the ideas of design by contract need to rely on theorem proving for system analysis. In general, the localization of reasoning on aspects cannot be achieved with these composition forms as it cannot be achieved in programs [START_REF] Filman | Aspect-Oriented Software Development[END_REF]. The result of composition has to be analyzed to ensure correctness of behaviour. The modelling techniques with the mixins semantics and the CSP composition (used also in some programming languages [START_REF] Filman | Aspect-Oriented Software Development[END_REF]) localize reasoning on aspects and objects, and the behaviour of aspects survives in the result of composition. So, the choice of composition semantics is the major challenge of the AOM research.

The models in the presented approaches show that using aspects in models always increases fragmentation of models. This simplifies model construction, but does not simplify model understanding. However, fragmentation of complex models of real size applications is unavoidable. The experience of the presented approaches shows that any investment into tool support, allowing for search in sets of model fragments and model simulation, improves model understanding and transforms the fragmentation into an advantage.

Fig. 2 .

 2 Fig. 2. AoURN model

Fig. 5 .Fig. 6 .

 56 Fig. 5. GrACE:DSM Authenticate

Fig. 7 .

 7 Fig. 7. HiLA model

Fig. 8 .Fig. 9 .

 89 Fig. 8. Orchestration:cms:authUser

Fig. 11 .

 11  gives the global behaviour diagram of package Authentication with the global observe operation U serIsLoggedIn, which says whether a user is logged-in or not; this is described using a VCL assertion diagram (Fig.11(d)). VCL package Authentication, addressing the authentication concern

Fig. 12 .Fig. 14 .

 1214 Fig. 12. VCL package AuthenticationOps, addressing the authentication concern

Fig. 1. VML4RE model

		Crisis Management System Feature Model:		VML4RE Specification:
		Crisis Management System
	…	Session Handling		Administration …		variant for "Authentication" { includeConcern "Authentication"
		Authentication	requires	UserAdministration	…	} …
		Optional feature	Mandatory feature

Table 1 .

 1 AOM approaches at different levels of abstraction

	Abstraction	Localization	Verification Localization
		of concerns		of reasoning
	Features	VML4RE	n.a.	n.a.
	Use cases	AoURN	n.a.	n.a.
	Classes, sequence diagrams RAM. GrACE	+	-
	Classes, state machines	HiLA	+	-
	Services, orchestration	Adore	rule based -
	Mixins	Protocol Modelling +	+
	Contracts	VCL	+	-

http://www.adore-design.org

A blob defines a set of objects.

The graphical presentation is a secondary artefact; it does not contain all the elements of the specification. The specification of a PM includes its local storage and the alphabet of event types. The local storage is represented as a set of its attributes. For example, attribute Password Handler.Tries for the PM Employee Main. Each event type is specified by metadata. For example, event Set Password contains attribute Security Password: String.

An event instance comes from the environment and it is atomic. Instances of PMs are created with happening of events. PM instances can be included into other PMs. A PM instance behaves so that it either accepts or refuses an event from its alphabet, depending on its state and the state of other included machines. Events that are not in its alphabet are ignored. To evaluate the state a machine may read, but not alter, the local storage of the included machines.

The complete system is composed using CSP parallel composition [START_REF] Hoare | Communicating Sequential Processes[END_REF] extended by McNeile [START_REF] Mcneile | Protocol Modelling. A Modelling Approach that Supports Reusable Behavioural Abstractions[END_REF] for machines with data. This composition techniques serves as a


Tarek Merzouki

Eric Blond

Alain Gasser

Nicolas Schmitt

Pascal Prigent

Modeling of the thermo-chemo-mechanical behavior of SiC-based refractory used in waste-to-energy plants

Keywords: SiC based refractories, Coupling, Thermo-chemo-mechanics

This work provides a computational model that will help to predict the life-span of SiC based refractories used in waste to energy plant (WTE) linings. For this particular application, gas present in the atmosphere diffuse through the porosity and react with the refractory producing SiO 2 and CaSiO 3 solids. These new phases clog gradually the pores and cause swelling of the material and as a result irreversible deformation of the lining. The proposed thermo-chemo-mechanical model that simulates these phenomena is briefly summarized and some of the parameters are identified. Then, first results obtained with the model implemented in a F.E.M code are shown. They prove the ability of the model to reproduce qualitatively the swelling of post-mortem bricks taken from WTE linings.

Introduction

Refractories are often subjected to extreme solicitations: high temperature gradient, aggressive chemical environment and mechanical constraint. Consequently, refractory degradations result from these combined solicitations. The goal of this study is to furnish a first step to the development of a fully coupled thermo-chemo-mechanical computational model that will help to predict the refractory lining life-span and optimize the design of such linings. This model falls within the scope of previous works on steel ladle's refractory 1,2 . It is written in the framework of continuum thermodynamics of irreversible processes 3,4 , and focuses on modelling of the couplings between thermochemistry and thermomechanics. The observed degradations of silicon-carbide-based refractories used in waste-to-energy plants (WTE) are the support of this work. This study realised in the context of the French research program ANR DRuIDe, deals with four different SiC based refractories, two of them containing calcium aluminate binders provided by the manufacturer Calderys and two other containing nitrogen binders provided by the manufacturer Saint-Gobain. In WTE, the thickness of the lining is small (approximately 60 mm) to facilitate the heat transfer. The refractories are in contact with smoke and ashes on the hot face and with a metallic water wall -temperature approximately 250°C -on the cold face. The temperature in the combustion chamber at the bottom level in the hot flame is close to 1200°C. About 17 m higher, at the top of the chamber, it falls down to around 500°C. At the intermediate level (i.e. 7 m) SiC based refractories containing oxides binders slowly swell during service and, sometimes, fall down. Figure 1 illustrates the deformations of typical tile after a long period of use.

Herein, the refractory swelling is explained by the reactive transport of species (i.e. O 2 and gas species containing Ca) by diffusion in the gas present in the porosity space. Observations of microstructures of worn refractories have revealed the appearance of new phases (silica and wollastonite) mainly in the matrix binder and in the porosity 5 . So, it is assumed that a part of the SiO 2 produced by the oxidation of SiC and that a part of the CaSiO 3 produced by the reaction between Ca precursor and SiO 2 clog gradually the pores 5 . Firstly, it induces a decrease of the diffusion rate; secondly, the induced chemical strain causes the swelling of the structure. In the model currently developed, due to a lack of experimental data, only the SiC oxidation parameters have been identified. Then, even if the wollastonite formation is Proceedings of the 12 th Conference of the European Ceramic Society -ECerS XII Stockholm, Sweden -2011 2(4) implemented, only the SiC oxidation model will be developed herein.

The computation of the coupled thermo-chemomechanical model is made in three steps. The classical resolution of energy balance is made in the first step. Then, the reactive transport of species under thermal gradient is solved. Lastly, the mechanical problem is solved accounting for some effects induced by the formation of new phases. Herein, the equations of the model are shortly summarised and first qualitative results are presented.

Energy balance

The temperature field in the lining is obtained through the classical energy balance applied to the whole lining

(1)
where T is the temperature, the bulk density, the specific heat and the thermal conductivity of the refractory which depends only on the temperature. Moreover, in the rest of the text, bold type will refer to vector while normal type will refer to scalar. The effects induced by the thermochemical phenomena like the heat source (or well) linked to the enthalpy of reaction and the change of thermal characteristics are neglected. The convective energy transported by the gases is neglected too. These assumptions are mainly justified by the fact that the heat flux due to the thermal gradient is much higher than the other heat flux transfer or production involved previously. As a result, the computation of the thermal field can be made separately. The computed temperature fields in the thickness of the lining under service condition considering a quasistatic regime are presented on figure 2 considering different boundary conditions on the cold face, from perfect contact between the refractory part and the water wall to strongly insulate layer made by a one millimetre film of static air. The temperatures obtained from several thermocouples placed into the tiles of existing WTE are also reported. A satisfactory agreement is obtained considering a 0.1 mm-thick air film.

Mass balance

The mass balance is written for the two reactive gaseous species considered in the model (i.e., O 2 , Ca precursor) in term of the local fluctuation of their mass ratio i x ∑

(2)

where i denotes the species, i J the mass flux of component i, ir ν the stoechiometric coefficient for specie i in reaction r, i M the molar mass for i, r ξ the extent of reaction r and the dot denotes the time derivative of the quantity.

The extent is defined regard to the considering reaction. For example, in the case of SiC active oxidation, the extent rate is defined as 6

1

(3)

where k a is the rate constant which follows an Arrhenius law, Q a is the mass action value at the considered time and K a the equilibrium constant.

Let us underline that the equilibrium constant is equal to the mass action value at the equilibrium.

To account for the local formation of a silica layer, and so to passive oxidation, equation ( 3) is modified as

1 (4)
For little fluctuation of the oxygen partial pressure this expression permits to obtain the classical dependance of the extent to the square root of time.

The transition between active (index a) and passive (index p) oxydation under constant temperature and atmosphere is assumed to be linear in time. This point is debatable, but as the main goal is long term prediction, the effect of the transistion regime is negligible. However, the active oxydation could cover a large duration because of a possible combination of SiO(g) with other gaseous species than oxygen, preventing the formation of a passivation layer. So, the model may take into account this possibility. The flux of each species is assumed to result from diffusion into the gas in the porosity, which leads to (5) where D i is the diffusivity of species i. Due to lack of information, to account for progressive clogging up of the porosity by the product of reactions, it is assumed that the diffusivity changes linearly with porosity (6

)
where φ is the porosity (i.e., index 0 denotes initial value) and D is the initial diffusivity estimated with the Chapman-Enskog theory 7 . The porosity is assumed to be a linear function of the sum of the extent of the two reactions ( 7)

where s and w refer to the SiC oxidation which produce silica and to the reaction which produces wollastonite respectively. Then, the mass balance for each species is coupled by the expression of the extent of each reaction which influences the source term and the diffusivity.

Chemical swelling

In the framework of small deformation, strain partition is considered 3 . The total strain is the sum of the thermal strain, the mechanical strain and a chemical strain. Moreover, a linear dependence between chemical strain ε c and the extent of each reaction is assumed:

(8)
Where I is the second rank identity tensor.

Identification

The identification of all the parameters of the model is an ongoing work. Only the method and results for the SiC oxidation part is summarized hereafter. Moreover, for sake of proceeding length, only results for the SiC based concrete commercially denotes SF60 (60% wt. of SiC) produced by Calderys are presented.

The identification for the oxidation kinetics was done thanks to thermogravimetric analyses (TGA) made by Bahloul 8 . Two assumptions are made to proceed to the identification: first, transport phenomena of gases inside the specimen are neglected during TGA; second, the kinetic on little dense specimen is assumed to be representative of the local kinetic in a concrete. While the first assumption is roughly acceptable, the second is more questionable. It is important to underline that, for the "macroscopic" model, the necessary data concern the oxidation kinetic locally at each point in the castable, not on the global oxidation rate of a "large" dense specimen.

The identification of the parameters of the chemical strain requires to correlate the strain to the oxidation extent. Assuming a homogeneous oxidation in the dense samples during dilatometry, after the same duration, the extent should be the same that in TGA specimen. Thanks to the small size of dilatometry samples (9x9x15 mm 3 ) combined with a porosity of 17% this assumption may be acceptable. The simulation of the isothermal expansion test with the directly identified parameters proposed later (see figure 5) confirms the relevance of this hypothesis.

F.E.M. implementation and first results

The reactive transport equation ( 2), including the oxidation extent evolutions (3-4), is implemented in the software ABAQUS thanks to a UMATHT subroutine. To do this, equations have been re-written in function of partial pressure of gases in the pores. The chemical strain ( 8) is implemented in ABAQUS via the UEXPAN subroutine. As often for such unidirectional coupling, first, the uncoupled heat transfer is solved. Then, the calculated temperature field is prescribed for the reactive transport computation. Finally, the temperature and oxidation extent fields are prescribed as loading in the mechanical computation.

Before applying this model to the case of a WTE refractory lining, the isothermal expansion test on SF60 castable under air has been computed.

Figure 1 :

 1 Figure 1: New (top) and old (bottom) SiC based refractory tiles (oxides binders) in a WTE facility (tile height: 245mm)

Figure 2 :

 2 Figure 2: Normalized temperature versus localisation from hot face (x=0) to cold face (x=1) for different contact conditions at the cold face. Dot represent experimental measures on an industrial plant.

Figure 4 :

 4 Figure 4: Chemical strain versus extentFigure4shows the evolution of the chemical strain with the oxidation extent. After a delay which depends on temperature a linear relationship takes place between the oxidation strain and the oxidation extent. The slope does not seem to be temperature dependent. The apparent delay may correspond to the shrinkage induced by last stage of sintering of the matrix binder. Then, figure4confirms that it is reasonable to model in a first approximation the chemical expansion by a simple linear law function of the extent.

  Figure 5 and exp agreemen First thermo-ch elastic be done con SF60 ca simulatio (currently results ar of the til similar c easier to c in the fu from the

  Figure 5:

Figure

  Figure room tem predicted one year 1050°C. well rep underline by 10. In circular a real worn This larg reasons: oxides bi different (i.e. spec time spen currently year); t wollaston computat Despi the analy qualitativ better un thermal chemical swelling of the fum on comp