D Cébron
email: cebron@irphe.univ-mrs.fr

M Le Bars

P Meunier

Tilt-over mode in a precessing triaxial ellipsoid

Keywords: numbers: 47.32.Ef, 95.30.Lz, 47.20.Cq

The tilt-over mode in a precessing triaxial ellipsoid is studied theoretically and numerically. Inviscid and viscous analytical models previously developed for the spheroidal geometry by Poincaré [Bull. Astr. 27, 321 (1910)] and Busse [J. Fluid Mech., 33, 739 (1968)] are extended to this more complex geometry, which corresponds to a tidally deformed spinning astrophysical body. As confirmed by three-dimensional numerical simulations, the proposed analytical model provides an accurate description of the stationary flow in an arbitrary triaxial ellipsoid, until the appearance at more vigorous forcing of time dependent flows driven by tidal and/or precessional instabilities.

I. INTRODUCTION

The flow of a rotating viscous incompressible homogeneous fluid in a precessing container has been studied for over one century because of its multiple applications, such as the motions in planetary liquid cores and the generation of planetary magnetic fields [e.g. 1, 2]. In the spheroidal geometry, the early work of [START_REF] Poincaré | Sur la précession des corps déformables[END_REF] demonstrated that the flow of an inviscid fluid has a uniform vorticity. Later, viscous effects have been taken into account as a correction to the inviscid modes, in considering carefully the critical regions of the Ekman layer [START_REF] Stewartson | On the motion of a liquid in a spheroidal cavity of precessing rigid body[END_REF][START_REF] Busse | Steady fluid flow in a precessing spheroidal shell[END_REF][START_REF] Greenspan | The theory of rotating fluids[END_REF]. Indeed, the Poincaré solution is modified by the apparition of boundary layers, and some strong internal shear layers are also created in the bulk of the flow, which do not disappear in the limit of vanishing viscosity [START_REF] Busse | Steady fluid flow in a precessing spheroidal shell[END_REF]. Besides, at high enough precession rates, these shear layers may become unstable [START_REF] Malkus | Precession of the earth as the cause of geomagnetism[END_REF][START_REF] Vanyo | Experiments on precessing flows in the earth's liquid core[END_REF][START_REF] Noir | Experimental evidence of nonlinear resonance effects between retrograde precession and the tilt-over mode within a spheroid[END_REF], and in a second transition, the entire flow becomes turbulent: this is the precession instability. These experimental works have been completed by numerical studies in cylindrical, spherical and spheroidal geometries [START_REF] Hollerbach | Oscillatory internal shear layers in rotating an1d precessing flows[END_REF][START_REF] Quartapelle | On the spectral solutions of the 3-dimensional navier-stokes equations in spherical and cylindrical regions[END_REF][START_REF] Tilgner | Magnetohydrodynamic flow in precessing spherical shells[END_REF][START_REF] Tilgner | Fluid flows in precessing spherical shells[END_REF][START_REF] Noir | Numerical study of the motions within a slowly precessing sphere at low ekman number[END_REF], in particular for studying kinematic dynamo models in a spheroidal galaxy [START_REF] Walker | High resolution numerical dynamos in the limit of a thin disk galaxy[END_REF] or for geophysical applications [START_REF] Tilgner | Non-axisymmetric shear layers in precessing fluid ellipsoidal shells[END_REF][START_REF] Lorenzani | Fluid instabilities in precessing spheroidal cavities[END_REF][START_REF] Lorenzani | Inertial instabilities of fluid flow in precessing spheroidal shells[END_REF][START_REF] Schmitt | Numerical study of a rotating fluid in a spheroidal container[END_REF][START_REF] Wu | On a dynamo driven by topographic precession[END_REF].

However, in natural systems, both the rotation and the gravitational tides deform the celestial body into a triaxial ellipsoid, where the so-called elliptical (or tidal) instability may take place (see [START_REF] Kerswell | Tidal instability as the source for Io's magnetic signature[END_REF][START_REF] Lacaze | Elliptical instability in a rotating spheroid[END_REF][START_REF] Bars | Tidal instability in stellar and planetary binary system[END_REF][START_REF] Cébron | A systematic numerical study of the tidal instability in a rotating ellipsoid[END_REF][START_REF] Kerswell | Elliptical instability[END_REF] for details on this instability and its geo-and astro-physical applications). The elliptical instability takes place in any rotating fluid whose streamlines are elliptically deformed (see e.g. [START_REF] Waleffe | On the three-dimensional instability of strained vortices[END_REF] or [START_REF] Bars | Coriolis effects on the elliptical instability in cylindrical and spherical rotating containers[END_REF]). It comes from a parametric resonance of two inertial waves of the rotating fluid with the tidal (or elliptical) deformation of azimutal wavenumber m = 2 [START_REF] Kerswell | Elliptical instability[END_REF]. Similarly, it has been suggested that the precession instability comes from the parametric resonance of two inertial waves with the forcing related to the precession of azimutal wavenumber m = 1, which comes from the deviations of the laminar tilt-over base flow from a pure solid body rotation [START_REF] Kerswell | The instability of precessing flow[END_REF][START_REF] Kerswell | On the internal shear layers spawned by the critical regions in oscillatory ekman boundary layers[END_REF][START_REF] Lagrange | Instability of a fluid inside a precessing cylinder[END_REF]. But it has also been suggested that the precession instability is related to a shear instability of the zonal flows that appear in a precessing container [e.g . 18]. Clearly, the precise origin of the precession instability is still under debate, and is beyond the point of the present work. But since tides and precession are simultaneously present in natural systems, it seems necessary to study their reciprocal influence, in presence or not of instabilities. The full problem is rather complex and involves three different rotating frames: the precessing frame, with a period T p ≈ 26000 years for the Earth, the frame of the tidal bulge, with a period around T d ≈ 27 days for the Earth, and the container or 'mantle' frame, with a period T s = 24 hours for the Earth. As a first step towards the full study of the interaction between the elliptical instability and the precession, we consider the particular case where the triaxial ellipsoid is fixed in the precessing frame (T d = T p ), which allows the theoretical approach to be analytically tractable. We show in figure 1 a sketch of this configuration.

The paper is organized as follow. In section II, Poincaré and Busse analytical models are extended to precessing triaxial ellipsoids. Then in section III, our analysis is validated by comparison with a numerical simulation.

FIG. 1: Sketch of the problem under consideration. A hollow solid but deformable spheroid (i.e. 'the mantle') is filled with liquid and set in rotation at a constant angular velocity Ω versus its axis (Ox3). The spheroid axis is tilted at the precession angle θ and fixed on a rotating table, which rotates at the precession rate Ωp. Two fixed rollers aligned with (Ox3) then transform the spheroid into a triaxial ellipsoid by compression along the axis (Ox2), perpendicular to the rotation axis.

II. ANALYTICAL SOLUTION OF THE FLOW IN A PRECESSING TRIAXIAL ELLIPSOID

In this section, we consider firstly the case of an inviscid fluid and extend the Poincaré model to a precessing triaxial ellipsoid, which allows us to obtain explicit analytical solutions. We then tackle the viscous case in extending the Busse model, following the method of [START_REF] Noir | Experimental evidence of nonlinear resonance effects between retrograde precession and the tilt-over mode within a spheroid[END_REF]. As sketched in figure 1, we consider the rotating flow inside a precessing triaxial ellipsoidal container of principal axes (a 1 , a 2 , a 3 ). We define (Ox 1 , Ox 2 , Ox 3 ) in the frame of the tidal bulge which is also the precessing frame, such that Ox i is along the principal axis a i of the ellipsoidal container and (Ox 3 ) is the mantle rotation axis. We note Ω the imposed mantle angular velocity and use Ω -1 as a timescale. We also introduce the mean equatorial radius R eq = (a 1 + a 2 )/2, which is used as a lengthscale. Consequently, the problem is fully described by six dimensionless numbers: the eccentricity ǫ = (a 2 1 -a 2 2 )/(a 2 1 + a 2 2 ), the aspect ratio a 3 /a 1 , the Ekman number E = ν/ΩR 2 eq , where ν is the kinematic viscosity of the fluid, and the three components of the dimensionless precession vector Ω p in the inertial frame of reference, i.e. the angle θ between Ω p and e x3 , the angle θ 2 between Ω p and e x1 and the angular precession rate Ω p , which is positive for prograde precession and negative for retrograde precession.

A. Inviscid Poincaré tilt-over mode for a triaxial ellipsoid

We look for a base flow solution of the Euler equations, i.e.

∂u ∂t + u • ∇u = -∇p -2Ω p × u, (1)
∇ • u = 0, (2)
inside the triaxial ellipsoid in the precessing frame. In this frame, using the ellipsoid equation

x 2 1 a 2 1 + x 2 2 a 2 2 + x 2 3 a 2 3 = 1, (3)
we transform the ellipsoidal geometry into a sphere with the transformation (

x ′ k ) = x k a k k∈(1,2,3)
and we write the velocity field in this sphere as

(U ′ k ) = U k a k k∈(1,2,3) . ( 4
)
As suggested in [START_REF] Poincaré | Sur la précession des corps déformables[END_REF], we focus on the so-called 'simple motions' such that the velocity U(U 1 , U 2 , U 3 ) is described as linear combinations of the coordinates. This hypothesis leads to a solid body rotation in the sphere, i.e. U ′ = ω ′ × r ′ , where ω ′ (ω ′ 1 , ω ′ 2 , ω ′ 3 ) depends on time a priori. Equation 4 then gives the following velocity field in the ellipsoid:

U = (U k ) k∈(1,2,3) = a k a k-1 ω ′ k+1 x k-1 - a k a k+1 ω ′ k-1 x k+1 k∈(1,2,3) , (5)
where permutations k ∈ (1, 2, 3) are used. Now, we have to find the 'simple motions' solution of the Euler equations for the rotational part of the flow, taking into account the no-penetration boundary conditions for its irrotational part, which leads to the so-called Poincaré flow. We follow the method of [START_REF] Noir | Ecoulement d'un fluide dans une cavité en précession: approches numériques et expérimentales[END_REF] rather than the lagrangian method of Poincaré which is more laborious. We deduce the rotation rate vector ω from the velocity field [START_REF] Busse | Steady fluid flow in a precessing spheroidal shell[END_REF]:

ω = 1 2 ∇ × U = (ω k ) k∈(1,2,3) = 1 2 a k-1 a k+1 + a k+1 a k-1 ω ′ k k∈(1,2 ,3)
.

Note that ω ′ is independent of the space coordinates so that ω is uniform. Taking the rotational of (1), the inviscid equation for ω gives the following three scalar equations:

dω k dt + (α k+1,k -α k-1,k ) ω k-1 ω k+1 = α k-1,k Ω p,k-1 ω k+1 -α k+1,k Ω p,k+1 ω k-1 (7)
for permutations k ∈ (1, 2, 3), with the coefficients α i,j = 2 ηij +2 = 2 ηji+1 ηji+2 and the different ellipticities

η ij = a 2 i -a 2 j a 2
j of the container. The equations for a spheroidal geometry are recovered with a 1 = a 2 .

We focus on the stationary solutions of the problem. In this particular case, we solve the system (7) analytically, which gives:

ω 1 = ω 3 β 12 a 2 3 + a 2 2 γ 1 Ω p,1 , (8)
ω 2 = ω 3 β 12 a 2 3 + a 2 1 γ 2 Ω p,2 , (9)
where

β ij = a 2 i +a 2 j 2aiaj = β ji and γ i = ω3 β12 (a 2 i -a 2
3 ) + 2 Ω p,3 a 1 a 2 . The corresponding velocity field writes:

U 1 = a 1 ω 3 β 12 - x 2 a 2 + 2 a 1 Ω p,2 x 3 γ 2 , (10)
U 2 = a 2 ω 3 β 12 x 1 a 1 - 2 a 2 Ω p,1 x 3 γ 1 , (11)
U 3 = a 3 ω 3 β 12 2 a 3 Ω p,1 x 2 γ 1 - 2 a 3 Ω p,2 x 1 γ 2 . ( 12
)
Note that the choice of ω 3 is arbitrary here. Actually, ω 3 is determined by the boundary (Ekman) layer and thus has to be determined by a viscous study, following for instance the method of [START_REF] Busse | Steady fluid flow in a precessing spheroidal shell[END_REF], as described in the next section. Note also that this velocity field is divergent for γ 1 = 0 or γ 2 = 0: the inviscid study gives two resonances, which correspond to resonance between the frequencies of respectively the precessional forcing and the tilt-over (see [START_REF] Noir | Experimental evidence of nonlinear resonance effects between retrograde precession and the tilt-over mode within a spheroid[END_REF] for details). These linear resonances are reached for two specific precession rates (depending on the aspect ratio) which are

Ω p,3 = a 2 3 -a 2 i a 2 1 + a 2 2 ω 3 (13)
for i ∈ (1, 2). It is clear that oblate ellipsoids (a 1 , a 2 > a 3 ) have their resonance in the retrograde regime (i.e. in the range Ω p,3 < 0) whereas prolate ellipsoids (a 1 , a 2 < a 3 ) have their resonance in the prograde regime. Finally, compared to the spheroidal case, an important result here is the apparition of the second resonance created by the equatorial ellipticity of the container.

B. Viscous study of the tilt-over mode in a triaxial ellipsoid Following [START_REF] Busse | Steady fluid flow in a precessing spheroidal shell[END_REF], it is possible to take into account the viscosity in the study of the flow in a precessing triaxial ellipsoid. Here, we focus on the equivalent method of [START_REF] Noir | Experimental evidence of nonlinear resonance effects between retrograde precession and the tilt-over mode within a spheroid[END_REF], based on the equilibrium between the inertial torque Γ i , the pressure torque Γ p , and the viscous torque Γ v . Keeping the leading terms for these three torques, the general torque balance given in [START_REF] Busse | Steady fluid flow in a precessing spheroidal shell[END_REF] for a steady rotating flow q = ω × r in the precessing frame within a volume V with a surface Σ writes:

Γ i 2 V r × (Ω p × q)dV = Γp - Σ pr × ndΣ + Γv E V r × ∇ 2 qdV , ( 14
)
where r is the position vector and n is the unit vector normal to Σ pointing outward [see 9]. Now, we have to calculate these terms for a triaxial ellipsoid. At first order, the pressure gradient equilibrates the centrifugal force, which gives:

p = 1 2 3 i=1     (ω 2 i+1 + ω 2 i-1 ) x 2 i - 3 j=1 j =i ω i ω j x i x j     . ( 15
)
Hence in the limit of small ellipticities, i.e. at first order in η = 1 -a 3 /a 1 and η 2 = 1 -a 2 /a 1 , the pressure torque writes:

Γ p = -p r × n dΣ = (Γ p,k ) k∈(1,2,3) = I   (η -η 2 ) ω 2 ω 3 -η ω 1 ω 3 η 2 ω 1 ω 2   , ( 16
)
where I is the moment of inertia in the spherical approximation. Note that the expression of [START_REF] Noir | Experimental evidence of nonlinear resonance effects between retrograde precession and the tilt-over mode within a spheroid[END_REF] is recovered for the spheroid (i.e. a 1 = a 2 hence η 2 = 0). After little algebra, the precessional torque simply writes:

Γ i = IΩ p × ω. (17)
Finally, the equations ( 16) and [START_REF] Lorenzani | Fluid instabilities in precessing spheroidal cavities[END_REF] give Γ p • ω = 0 and Γ i • ω = 0, and thus with the equation ( 14) Γ v • ω = 0. Consequently, the fluid being in a stationary state, there is no differential rotation along ω:

ω • e 3 = ω 2 . ( 18
)
Indeed, in the rotating frame of the fluid, the angular rate of the container along ω is null: the only differential rotation between the fluid and the container is in the equatorial plane such that no spin-up process occurs. Note that this can also be recovered with a boundary layer analysis, in the same way as [START_REF] Busse | Steady fluid flow in a precessing spheroidal shell[END_REF], which shows that the volumic Ekman pumping is solution of the inviscid bulk equations provided that the so-called solvability condition ( 18) is verified. According to this equation, also named the no spin-up condition in [START_REF] Noir | Experimental evidence of nonlinear resonance effects between retrograde precession and the tilt-over mode within a spheroid[END_REF], the only relative motion between the interior and the boundary is a rotation given by ω eq = ω -Ω. Then, we need to calculate the viscous torque due this equatorial differential rotation. This calculation relies on the fact that in order to maintain the basic stationary state, the torque supplied to the fluid to counter balance the viscous friction is given by the decay rate that would occur if at a given time the precession is turned off. This decay rate is simply given by the rate at which energy is dissipated by the Poincaré mode in a free system at t = 0. This rate is given by the Greenspan's theory [START_REF] Greenspan | The theory of rotating fluids[END_REF], valid in the frame rotating with the fluid. Thus, this linear solution for the viscous decay of the spin-over mode in a rotating fluid leads to introduce a new Ekman number E f = E/ω and a new unit of time t = tω, scaled with the fluid rotation rate ω. According to [START_REF] Greenspan | The theory of rotating fluids[END_REF], the time evolution of ω eq in the non-rotating frame is:

ω eq ( t) = e λr t √ E f cos λ i t E f ω eq (0) -sin λ i t E f ω × ω eq (0) ω (19)
with λ r = -2.62 and λ i = 0.259. Note that strictly speaking in triaxial ellipsoids, the ellipticity modify the growth rate and eigenfrequency of inertial modes. However, in the limit of small ellipticities we consider here, this modification can be neglected. [START_REF] Noir | Experimental evidence of nonlinear resonance effects between retrograde precession and the tilt-over mode within a spheroid[END_REF]: the rotation rate of the container Ω = 207 rpm and a1 = 0.125 m (such that the Ekman number is E = 3 • 10 -5 ), θ = 9 • , a3/a1 = 0.96 and θ2 = 0 • . The spheroidal case corresponds to the plot ν = 10 -5 m 2 /s in figure 3 of [START_REF] Noir | Experimental evidence of nonlinear resonance effects between retrograde precession and the tilt-over mode within a spheroid[END_REF]. Note that even a very small tidal deformation significantly changes the obtained solution.

Using this equation, reintroducing the variables E and t, the equatorial viscous torque is:

Γ v = I dω eq dt t=0 = I √ ωE   λ r ω 1 + λ i ω 2 /ω λ r ω 2 -λ i ω 1 /ω λ r (ω 3 -1)   (20)
Then, the torque balance given by ( 14) projected onto the rotation axis of the fluid ω (the no spin-up condition (18)), as well as onto the principal axes e x1 and e x3 yields the following system of equations:

ω 2 1 + ω 2 2 = ω 3 (1 -ω 3 ) (21) Ω p,2 ω 3 -Ω p,3 ω 2 = (η -η 2 ) ω 2 ω 3 + λ r ω 1 ω 1/4 3 + λ i ω 2 ω 1/4 3 √ E (22) Ω p,1 ω 2 -Ω p,2 ω 1 = η 2 ω 1 ω 2 -λ r ω 1/4 3 (1 -ω 3 ) √ E. (23)
The supplementary terms compared to [START_REF] Busse | Steady fluid flow in a precessing spheroidal shell[END_REF] or [START_REF] Noir | Experimental evidence of nonlinear resonance effects between retrograde precession and the tilt-over mode within a spheroid[END_REF] do not allow to simplify the system of equations into only one, and the full system has to be solved numerically to obtain the rotation axis components of the fluid. This non-linear system can be solved in an efficient way with a continuation method (successive perturbations on the a 2 axis) starting from the Busse's solution in a spheroid. An example is shown in figure 2 where the solution in the spheroidal geometry (the case ν = 10 -5 m 2 /s in figure 3 of [START_REF] Noir | Experimental evidence of nonlinear resonance effects between retrograde precession and the tilt-over mode within a spheroid[END_REF], which gives a Ekman number of E = 3 • 10 -5 ) is compared to a slightly deformed triaxial ellipsoid (ǫ = 0.03) with the same ratio a 3 /a 1 . It can be noticed that even a very small tidal deformation ǫ radically changes the obtained solution.

III. NUMERICAL AND EXPERIMENTAL VALIDATION

Our purpose here is to validate and test the range of validity of our analytical solution by comparison with numerical simulations of the full non-linear Navier-Stokes equations in a precessing ellipsoid.

A. Numerical resolution

We consider the rotating flow inside a triaxial ellipsoidal container of principal axes (a 1 , a 2 , a 3 ), as sketched in figure 1. We work in the precessing frame of reference. Starting from rest, a constant tangential velocity U 1 -(x 3 /a 3 ) 2 is imposed from time t = 0 all along the outer boundary in each plane of coordinate x 3 perpendicular to the rotation axis (Ox 3 ), where U is the imposed boundary velocity at the equator. We introduce the timescale Ω -1 by writing the tangential velocity along the deformed outer boundary at the equator U = ΩR eq . We then solve the Navier-Stokes equations with no-slip boundary conditions, taking into account a Coriolis force associated with the precession Ω p , i.e. in the frame (Ox 1 , Ox 2 , Ox 3 ) of the tidal bulge which is also the precessing frame, we solve:

∂u ∂t + u • ∇u = -∇p + E △ u -2Ω p × u, (24)
∇ • u = 0. ( 25
)
In this work, the range of parameters studied is E ≥ 10 -3 and ǫ ≤ 0.32. Once a stationary or periodic state is reached, we determine the rotation rate in the bulk of the fluid, i.e. outside the viscous boundary layer. To do so, we introduce an interior homothetic ellipsoid, in a ratio κ, and we define the bulk rotation rate ω as the mean value of rotation rate over this homothetic ellipsoid. Following [START_REF] Owen | Flow and heat transfer in rotating disc systems[END_REF], we consider a dimensionless viscous layer thickness of δ ν ≈ 5 √ E and thus choose for the homothetic ratio κ ≈ 1 -δ ν ≈ 1 -5 √ E. Note that the spheroidal case can be efficiently solved by spectral methods (see e.g. [START_REF] Schmitt | Numerical study of a rotating fluid in a spheroidal container[END_REF] or [START_REF] Wu | On a dynamo driven by topographic precession[END_REF]). But for the triaxial ellipsoids we are interested in, there is no simple symmetry. Our computations are thus performed with a finite element method, which allows us to correctly reproduce the geometry and to simply impose the boundary conditions. The solver and the numerical method are described in details in [START_REF] Cébron | A systematic numerical study of the tidal instability in a rotating ellipsoid[END_REF].

B. Experimental set-up

The experimental set-up has been described in [START_REF] Lagrange | Instability of a fluid inside a precessing cylinder[END_REF][START_REF] Meunier | A rotating fluid cylinder subject to weak precession[END_REF] for a precessing cylinder and readers should refer to these papers for more details. For this paper, the experiment has been slightly modified in order to study the precession of a spheroid. This allows to validate the flow at small Ekman numbers, which is impossible numerically. Unfortunately, this set-up is limited to a spheroidal geometry (a 1 = a 2 ) and is not able to validate the theory for a tri-axial ellipsoid. Further modifications to the set-up, such as two rollers compressing the spheroid, would be needed to make the equatorial plane elliptical.

The home-made spheroid has been obtained by assembling two half-spheroidal cavities drilled in solid Plexiglas cylinders. The accuracy of the machines (10 microns) ensured that the step between the two parts would be smaller than the Ekman layer (of the order of 300 microns at E = 10 -5 ). This spheroid of equatorial diameter 17 cm and aspect ratio a 3 /a 1 = 0.85 is filled with water and mounted on a motor which is itself located on a rotating platform. The angular velocities of the spheroid and the platform are stable within 0.1% and the precessing angle θ between the two axes was varied from 5 • to 15 • with an accuracy of 0.1 • .

Pulsed Yag lasers are used to create a luminous sheet perpendicular to the axis of the rotating platform. A PIV (Particle Image Velocimetry) camera is located on the rotating platform, aligned with the axis of rotation of the spheroid. This allowed to obtain PIV measurements in a plane almost parallel to the equatorial plane (x 1 , x 2 ) and located at a distance x 3 = 5 cm above it. Since the Yag lasers are not located on the rotating platform, the measurement plane is tilted with an angle θ with respect to the equatorial plane, which introduces an error of up to 2cm (for θ = 15 • ) in the axial location of the velocity vectors. However, the measured velocity components exactly correspond to the x 1 , x 2 components of the velocity because the camera is aligned with the axis of the spheroid. There is no distortion of the images at the air-Plexiglas interface (because it is a plane) but there are distortions of the images due to the Plexiglas-water spheroidal interface. These deformations are small because the refractive index of the Plexiglas and the water are close. They were calculated analytically and checked experimentally using a grid. They are located mostly at the boundary of the spheroid and they introduce a maximum error of 15% on the radial displacement of the particles. This does not bias the measurements because only the central region of the velocity field was used for the treatment of the data. The PIV images were rotated numerically in order to remove the background rotation of the flow before being treated by a home-made cross-correlation PIV algorithm.

In the frame of reference of the spheroid, the 2D velocity field was found to be a nearly uniform translation flow whose direction and amplitude vary with the precession frequency Ω p . This mean flow is linked to the equatorial component of the angular rotation rate (ω 1 , ω 2 ) which creates a uniform translation flow (α 31 x 3 ω 2 , -α 32 x 3 ω 1 ) in the plane x 3 = 5 cm. This flow corresponds to the last terms found in equations ( 10) and [START_REF] Quartapelle | On the spectral solutions of the 3-dimensional navier-stokes equations in spherical and cylindrical regions[END_REF] in the case a 1 = a 2 .

The first terms of these equations correspond to the axial angular rotation (ω 3 ), which in the frame of reference of the spheroid is equal to ω 3 -1 in dimensionless form and is thus small outside of the resonances. The measurements of the mean velocity and of the mean vorticity thus give in a simple manner the three components of the rotation vector ω. Such measurements have been done for the first time in a precessing spheroid, and will be compared to theoretical and numerical results in the following.

C. Validation in the spheroidal case

Before dealing with the problem of precessing triaxial ellipsoids, a first step of this work has been to simultaneously check the validity of our numerical tool and the validity of the theoretical development of [START_REF] Busse | Steady fluid flow in a precessing spheroidal shell[END_REF] over an extended range in Ekman number. To do so, we combine numerical and experimental approaches.

In figure 3, the theory proposed in [START_REF] Busse | Steady fluid flow in a precessing spheroidal shell[END_REF] is validated over more than three decades of Ekman numbers for two different angles of precession. The interest of the presented results is twofold. Firstly, they validate our numerical model, which will now be used to study triaxial ellipsoids. Secondly, this completes the previous validations of Busse's theory [e.g. 9, 13], in particular for rather large Ekman numbers. Note that, as already noted in [START_REF] Tilgner | Fluid flows in precessing spherical shells[END_REF], the theoretical analysis requires that the angle between the rotation vector of the container and the rotation vector of the fluid is small since otherwise the Ekman boundary layer analysis is no longer valid. This could explain the differences between the experimental determinations and the theoretical predictions at the highest precessional forcing angle (θ = 15 • ). A supplementary confirmation of both the numerical model and Busse's theory at such Ekman numbers is given in figure 4 (a) where the components of the tilt-over rotation axis are in an excellent agreement for a large range of precession rate. At large precession rates, the inviscid results of [START_REF] Poincaré | Sur la précession des corps déformables[END_REF] are recovered.

D. Numerical simulations of precessing triaxial ellipsoids

A first series of simulations have been performed for a 3 /a 1 = 0.86, θ = 10 • , θ 2 = 45 • , E = 1/600, ǫ = 0.1 and various precession rates. Results are presented in figure 4 (b). An excellent agreement is found between the numerical simulations and the analytical viscous solution all along the explored range, which demonstrates the validity of our extended viscous theory. Note also that the triaxial Poincaré inviscid flow is recovered far from the resonances. As already noted above, an important feature of the triaxial geometry is the apparition of a second resonance. As already noted in the section II A, according to the equation [START_REF] Tilgner | Fluid flows in precessing spherical shells[END_REF], the two resonances are in the retrograde regime here because a 1 , a 2 > a 3 . Note also that as already described in the literature (see e.g. [START_REF] Noir | Experimental evidence of nonlinear resonance effects between retrograde precession and the tilt-over mode within a spheroid[END_REF]), the viscosity naturally smoothes the inviscid resonance peaks but also modifies their position.

The tilt-over mode is thus well described by our analytical model at relatively large Ekman number and relatively low precession rate and tidal eccentricity. However, two types of instabilities can be expected for more vigorous flows: the tidal or elliptical instability at relatively small Ekman and/or large eccentricity ǫ, and the precession instability at relatively small Ekman and/or large precession rate. Focusing on the tidal instability, we keep the Ekman number above the precession instability threshold, and we increase the eccentricity above the elliptical instability threshold.

The appearance and form of the tidal instability in the presence of a rotating tidal deformation aligned with the rotation axis have been studied elsewhere [START_REF] Bars | Tidal instability in stellar and planetary binary system[END_REF][START_REF] Cébron | A systematic numerical study of the tidal instability in a rotating ellipsoid[END_REF]. This case corresponds in our notations to the specific configuration θ = 0. The most well-known mode is the so called spin-over mode, which appears for low values of tidal bulge rotation. As shown in appendix V, a theoretical stability analysis demonstrates that this mode may grow upon the Poincaré flow. Note that the spin-over mode, which is an unstable mode of the tidal instability, and the tilt-over mode, which is the base flow of precession, are actually identical, hence should both be described by our stationary analytical solution. This is indeed the case, as shown in figure 5 (a) around Ω p = 0 where numerical and analytical solutions are in good agreement. Moreover, by comparison with the known results of the elliptical instability in the special case θ = 0 (see [START_REF] Bars | Tidal instability in stellar and planetary binary system[END_REF] and [START_REF] Cébron | A systematic numerical study of the tidal instability in a rotating ellipsoid[END_REF] for details), we expect the elliptical instability to lead to an unstationary mode for Ω p below the resonance band of the spin-over, and to no elliptical instability for Ω p above the resonance band of the spin-over. These results are also recovered in figure 5 (a), where oscillatory motions are indeed observed for Ω p ∈ [-0.5; -0.2], whereas good agreement is found for Ω p > 0 between analytical and numerical results. Finally, a systematic study of the excited mode frequency as a function of the Ekman number for Ω p = -0.4 is shown in figure 5 (b). As expected from the stability analysis presented in appendix V, the transition from a stationary flow to an unstationary one is found below E ≈ 1/300.

IV. CONCLUSION

This paper presents the first analytical solution and the first numerical simulations of the precessing flow inside a triaxial ellipsoid. The extension of Busse viscous solution to this more complex geometry is shown to provide an accurate description of the stationary flow, which may be destabilized by oscillating modes of the tidal and/or precession instabilities for more vigorous forcing. Clearly, the complete study of instabilities in such a system deserves more work and will be the subject of future studies with increased numerical power and a new experimental set-up. But the study of the stationary flow performed here already highlights the fact that even a very small tidal deformation significantly modifies the resulting flow. This conclusion is directly relevant to the dynamics of planetary cores and FIG. 5: We consider the case θ = 10 • , a3/a1 = 0.86, θ2 = 0 and ǫ = 0.317 (corresponding to (a1 + a2)/2 = a3). (a) Evolution of the rotation rate components of the flow with the amplitude of precession for a fixed value of the Ekman number E = 1/600. Legend is the same as in figure 4 (b). Filled symbols correspond to cases where the flow is oscillatory whereas empty symbols corresponds to a stationary flow. Note that the sign reversal at Ωp = 0 is due to the two possible symmetric orientations of the spinover mode of the tidal instability. (b) We now focus on the Ωp = -0.4 case where the flow is oscillatory at E = 1/600 as shown in (a), and we study the evolution of the pulsation f of the flow with the Ekman number. The flow is stationary for an Ekman number larger than E = 1/300, and then oscillates at a fixed pulsation f ≈ 0.67.

atmospheres, where precession and tidal deformation simultaneously take place.

V. APPENDIX: INSTABILITY OF THE INVISCID POINCAR É FLOW IN A TRIAXIAL ELLIPSOID

The work [START_REF] Naing | Local instability of an elliptical flow subjected to a coriolis force[END_REF] have recently studied the stability of a rotating flow with elliptical streamlines in the particular case where the rotation axis executes a constant precessional motion about a perpendicular axis. Using the WKB method, [START_REF] Naing | Local instability of an elliptical flow subjected to a coriolis force[END_REF] achieve to quantify both the influence of this particular precession on the elliptical instability, and the influence of the strain on the Coriolis instability for such an unbounded cylindrical base flow. In this appendix, we consider the stability of the inviscid Poincaré flow in triaxial ellipsoids against small inviscid perturbative rotations.

The theoretical expression of the growth rate for perturbations that are linear in space variables (i.e. corresponding to the classical spin-over mode) can be readily obtained with the same method as in [START_REF] Gledzer | Instability of bounded flows with elliptical streamlines[END_REF], but with the base flow U obtained in section II A, using an arbitrary value of ω 3 . As remind in [START_REF] Kerswell | Elliptical instability[END_REF], the most general perturbation-flow linear in the spatial coordinates is

u k -U k = K i+1 (t) a i a i-1 x i-1 -K i-1 (t) a i a i+1 x i+1 (26)
where the scalar amplitude K i of these small inviscid perturbative rotations can be written K i = ε k i e σt . The total flow u have to satisfy the inviscid vorticity equation. Then, U being solution flow at order 0, the solution flow at first order in ǫ is solution of

M k = 0 ( 27
)
where k = (k i ) i∈(1,2,3) and M is a 3 × 3 matrix given by

M =   A 12 -A 21 -B 12 σ C 1 B 13 σ D 12 -B 23 σ C 2 D 21   (28)
where

A ij = 2 Ω p,j a 3 a j γ i γ j , B ij = a 2 i + a 2 j a i a j , C i = γ i a 3 a i , D ij = -4 Ω p,i Ω p,3 a 2 j γ i .
The solution flow at first order is non-trivial if det(M ) = 0, and the growth rate σ is obtained in solving this equation. Actually, the 3 rd degree equation det(M ) = 0 writes in the simple form σ 3 + p σ = 0, and the growth rate is given by:

Note that the dimensionless base flow of [START_REF] Gledzer | Instability of bounded flows with elliptical streamlines[END_REF] is recovered for the particular value ω 3 = β 12 . It can also be noticed that the extension of the result of [START_REF] Gledzer | Instability of bounded flows with elliptical streamlines[END_REF] to the particular case of a rotating tidal bulge at Ω p = (0, 0, Ω br ) given in [START_REF] Cébron | A systematic numerical study of the tidal instability in a rotating ellipsoid[END_REF], is recovered:

σ = - C 1 C 2 B 13 B 23 = - (a 2 1 -a 2 3 + 2a 1 a 2 Ω br )(a 2 2 -a 2 3 + 2a 1 a 2 Ω br ) (a 2 1 + a 2 3 )(a 2 2 + a 2 3 ) . ( 30
)
Note finally that this method gives the theoretical inviscid growth rate, which has then to be corrected by a viscous surfacic damping term χ √ E [START_REF] Kudlick | On the transient motions in a contained rotating fluid[END_REF], where χ is a constant χ ∼ 2.62. The threshold is then given explicitly by

E c = 1 χ 2 A 12 B 13 D 21 + A 21 B 23 D 12 -C 1 C 2 B 12 B 13 B 23 B 12 (31)
For the case presented in figure 5, i.e. θ = 10 • , a 3 = (a 1 + a 2 )/2, θ 2 = 0 and ǫ = 0.317, we predict a critical Ekman number for instability around E c ≈ 1/300, and for E = 1/600, we predict an unstable spin-over mode in the range Ω p ∈ [-0.13; 0.12].

[1] W. Malkus, Lectures on Solar and Planetary Dynamos (Energy sources for planetary dynamos). Cambridge University Press, London, 1993. (ed. MRE Proctor, AD Gilbert).

FIG. 2 :

 2 FIG.2: Theoretical amplitude of tilt-over mode angular rotation rate ω for a spheroid (ǫ = 0) and for a slightly deformed triaxial ellipsoid (ǫ = 0.03). The other parameters used in this figure are those of[START_REF] Noir | Experimental evidence of nonlinear resonance effects between retrograde precession and the tilt-over mode within a spheroid[END_REF]: the rotation rate of the container Ω = 207 rpm and a1 = 0.125 m (such that the Ekman number is E = 3 • 10 -5 ), θ = 9 • , a3/a1 = 0.96 and θ2 = 0 • . The spheroidal case corresponds to the plot ν = 10 -5 m 2 /s in figure3of[START_REF] Noir | Experimental evidence of nonlinear resonance effects between retrograde precession and the tilt-over mode within a spheroid[END_REF]. Note that even a very small tidal deformation significantly changes the obtained solution.

FIG. 3 :FIG. 4 : 2 1 +a 2 2 2a 1 a 2 (

 34222 FIG. 3: Comparison of the theoretical rotation rate components of Busse's solution for a spheroid (continuous lines) with experimental PIV measurements and numerical simulations performed over a large range of Ekman numbers forΩp = -0.14 and a3/a1 = 0.85. (a) For a precession angle of 5 • . (b) For a precession angle of 15 • .

A 12 B

 12 13 D 21 + A 21 B 23 D 12 -C 1 C 2 B 12 B 13 B 23 B 12


Benoit Baudry
email: bbaudry@irisa.fr

Sudipto Ghosh
email: ghosh@cs.colostate.edu

Franck Fleurey
email: franck.fleurey@sintef.no

Robert France
email: france@cs.colostate.edu

Yves Le Traon
email: yves.letraon@enst-bretagne.fr

Jean-Marie Mottu
email: jmottu@irisa.fr

Barriers to Systematic Model Transformation Testing

Introduction

Model Driven Engineering (MDE) techniques [START_REF] Schmidt | Model-Driven Engineering[END_REF] support extensive use of models in order to manage the increasing complexity of software systems. Appropriate abstractions of software system elements can ease reasoning and understanding and thus limit the risk of errors in large systems.

Automatic model transformations play a critical role in MDE since they automate complex, tedious, error-prone, and recurrent software development tasks. Airbus uses automatic code synthesis from SCADE models to generate the code for embedded controllers in the Airbus A380. Commercial tools for model transformations exist. Objecteering and Together from Borland are tools that can automatically add design patterns in a UML class model, Esterel Technologies have a tool for automatic code synthesis for safety critical systems.

Other examples of transformations are refinement of a design model by adding details pertaining to a particular target platform, refactoring a model by changing its structure to enhance design quality, or reverse engineering code to obtain an abstract model. These software development tasks are critical and thus the model transformations that automate them must be validated.

A fault in a transformation can introduce a fault in the transformed model, which if undetected and not removed, can propagate to other models in successive development steps. As a fault propagates further, it becomes more difficult to detect and isolate. Since model transformations are meant to be reused, faults present in them may result in many faulty models.

Model transformations constitute a class of programs with unique characteristics that make testing them challenging. The complexity of input and output data, lack of model management tools, and the heterogeneity of transformation languages pose special problems to testers of transformations. In this paper we identify current model transformation characteristics that contribute to the difficulty of systematically testing transformations. We present promising solutions and propose possible ways to overcome these barriers.

Testing Transformations: A Small Example

A simple example of a model transformation consists of flattening a state machine. Figure 1 illustrates a transformation that takes a hierarchical state machine as an input and produces a flattened state machine as an output. The output is semantically equivalent to the input but all hierarchical states are removed. The sets of possible input and output models for a transformation are each described by a metamodel. A metamodel is a set of classes, relationships, and multiplicities that define the concepts and the structure of a modelling language. A metamodel can be thought of as a grammar for a language. A model transformation can thus be viewed as a grammarware program, that is a program whose input domain is defined by a grammar (e.g., compilers, static analyzers, and reverse engineering tools).

Figure 2 shows a metamodel for the structure of hierarchical state machines. A hierarchical state machine contains states that have a number of incoming and outgoing transitions. The metamodel distinguishes between two types of states, simple states that can be initial or final states, and composite states that can contain composite or simple states. This metamodel is a formal description of the language of statecharts. In addition to describing metamodels with classes, attributes, and associations, it is usually necessary to define constraints that relate the concepts in the metamodel more precisely. For example, the metamodel shown in Figure 2 does not constrain a composite state to contain only one initial state.

This constraint must be added to the metamodel but it cannot be defined using modelling languages such as EMOF. The Object Constraint Language (OCL) is commonly used to define these additional constraints. The constraint on the composite state could be written as follows: To test the transformation shown in Figure 1, we must perform the following activities:

1 Generate test data: We need to generate input models that conform to the input metamodel of the transformation. The input models that are generated as inputs for a transformation are called test models. In our example, this requires generating several state machines that conform to the metamodel of Figure 2. Test models are manually or automatically generated in the form of graphs of metamodel instances. Figure 3 displays one test model as a graph of instances of the hierarchical state machine metamodel classes shown in Figure 2. Other test models may also be needed, to satisfy test adequacy criteria, such as a state machine with two hierarchical states or one with no hierarchical state.

2 Define test adequacy criteria: Since it is clearly not possible to test a transformation with all possible input models, we must define criteria to efficiently and effectively select test models.

Test adequacy criteria drive the selection of a subset of test models that will be sufficient for testing. This helps reduce the time and effort spent on testing. In our example, a test criterion for the flattening transformation could require that each class of the metamodel is instantiated in at least one test model. No well-defined criteria exist for model transformation testing. This challenge must be tackled to make testing practical and systematic.

3 Construct an oracle: For software testing, the oracle determines if the result of a test case is correct. There are several ways to construct an oracle for a model transformation. If the expected model is available (e.g., from previous regression tests), the oracle can compare the output model with the expected model. If the expected model is not available (as is usually the case), a partial oracle that checks expected properties of the output model should be constructed. For example, such an oracle can check that the output model contains no composite states and has the same number of simple states as the input model.

We now analyze three major characteristics of MDE based model transformation that make these testing activities challenging. The structure of the graphs is constrained by a metamodel and the objects in the graphs are instances of the classes defined in the metamodel. The metamodels can themselves be large and complex structures. Moreover, additional constraints can be expressed in the metamodel, usually with the OCL. This increases the complexity of the metamodels; OCL is a rich language with which it is possible to define complex constraints relating a large number of elements in the metamodel.

The complexity of the data manipulated by a transformation affects the generation of test models.

Manual test generation is error-prone because of the large number of metamodel instances that must be created, and the relationships and attribute values that must be set. Automatic test data generation is a complex constraint solving problem because it requires synthesizing a graph that satisfies a large set of multiplicity and OCL constraints, and test adequacy criteria. The main challenge for automatic resolution of complex constraints is handling time and memory when exploring very large solution spaces.

Since the metamodel completely describes the input domain of a transformation, it provides a basis for defining test adequacy criteria. It is possible to define a large number of criteria, such as instantiate all the meta-classes, combine different values for the properties, and combine instances of different meta-classes. However, lack of historical data on the types of errors typically found in transformations makes it difficult to determine the effectiveness of these criteria and the fault models they can target.

The complexity of the output data complicates the oracle problem. It is difficult to manually or automatically build the expected test result. When the expected output model is available, the oracle needs to compare two models, i.e., two graphs of objects. In this case, the oracle problem is as complex as the graph isomorphism problem, which is NP-complete. If the oracle is specified by listing expected properties of the output model, the construction of this oracle is complicated by the complexity of the output metamodel that describes the output model. The tester must consider numerous concepts and relationships to define the expected properties of the output model.

b Model Management Environments

MDE is currently in the research stage and thus development environments lack adequate support for model manipulation [START_REF] France | Model-Driven Development of Complex Software: A Research Roadmap[END_REF]. For testing model transformations, support is needed for building, editing, visualizing, and analyzing models.

The construction of models involves either writing a program that builds the meta-class instances and sets all the properties, or using model editors generated from a metamodel (e.g., the default tree editor generated by EMF) to manually build the instances and set values for all attributes and references. Writing a program is error-prone. Using a generated editor instead of a tailor-made editor for a language is tedious because they do not provide language-specific icons, dialog boxes for setting attributes values or assistance for checking the completeness of the model (e.g., all attributes have been assigned a value). This makes the manual definition of test models difficult and error-prone.

Visualizing output models is difficult because graphical editors (e.g., for UML or domain-specific languages) often do not provide adequate support for layout of diagrams that are produced by a transformation or exported from another tool. A confusing layout complicates manual analysis of the model, and the visual comparison of two graphical representations. A possible solution is to query the output model and check some properties using OCL analyzers. Since it is impossible to know if any one of the many techniques will fit all the needs for model transformations, the testing techniques need to take this diversity into account. The diversity has a strong impact on the definition and the selection of effective white-box test adequacy criteria. We cannot choose one language as a reference and develop test criteria that are based on language elements.

Promising approaches to overcoming the barriers to model transformation testing a Complex input and output data

The complexity of constraints that define the input domain is the main challenge for automatic test model generation. A possible solution to address this problem is a constructive approach where models are built first and the constraints are checked afterwards. Following this idea, Brottier et al. [START_REF] Brottier | Metamodel-based Test Generation for Model Transformations: an Algorithm and a Tool[END_REF] consider only the class diagram definition of the input metamodel to generate objects and assemble them according to specific criteria in order to build complete models. Ehrig et al. [START_REF] Ehrig | Generating Instance Models from Meta Models[END_REF] analyze the metamodel to generate rules that create instances of all non-abstract classes and links between the instances. The major limitation of these approaches is that a large number of generated models do not satisfy the complete set of constraints and thus the transformation cannot process them for testing.

Another approach is to use SAT solvers to deal with a larger amount of constraints and generate instances that satisfy the constraints. This declarative approach reduces the burden on the test generation tool but in turn has the limitations of current automatic constraint solvers. To tackle the limitation of constraint solvers, a usual approach is to study heuristics and meta-heuristics to prune the search for a solution [START_REF] Korf | Space-efficient search algorithms[END_REF].

The definition of an oracle is challenging because even the simplest expected result can be complex and thus the description of this result can be error-prone. One solution that can be applied when the model transformation generates an executable model is to test the output model directly. Another approach is to have a partial oracle that checks only specific properties of the output instead of checking the result completely. This approach, similar to the JUnit approach for Java programs, has been studied by Solberg et al. [START_REF] Solberg | Developing Service Oriented Systems Using an Aspect-Oriented Model Driven Framework[END_REF] and Mottu et al. We need to develop techniques for the precise definition of requirements for model transformations.

Currently, the requirements tend to be very informal and cannot be processed by tools to automatically generate the expected result. Researchers in the requirements engineering community are currently exploring techniques to automatically extract logical formulae from natural languages. Another solution is to ask the modellers to express the expected behaviour as rules that could then be interpreted by an oracle.

b Model Management Environments

A number of ongoing work around model management, both in industry and academia, could be integrated or adapted for testing model transformations.

Work on model differencing can be used to develop an oracle that compares the model produced after execution of a test case with an expected model. As mentioned earlier, this can be very useful in regression testing of transformations. The EMFCompare tool, based on the algorithm proposed by Xing et al. [START_REF] Xing | UMLDiff: An Algorithm for Object-Oriented Design Differencing[END_REF], is now available in the Eclipse framework. It detects matches and differences between two models, based on the similarity of their types, their names, and the values of their attributes and relations.

Versioning of models can greatly benefit testing. It can be used to define an oracle that compares models and detects conflicts. These conflicts can in turn be used to track the error back to its source.

Also, versioning of input and output metamodels could be used for regression testing: if we know the parts of the metamodels that evolve, we could detect the test models that are still relevant and the ones that need to evolve. CVS Model is an open source initiative that proposes a tool for versioning of models. The conflict detection mechanisms are based on the work by Reiter et al. [START_REF] Reiter | Models in Conflict -Detection of Semantic Conflicts in Model-based Development[END_REF].

c Heterogeneity of Transformation Languages and Techniques

The heterogeneity of model transformation languages is particularly challenging for the definition of test criteria. There are two possible ways to tackle this issue: either have specific criteria and associated test generation techniques for each particular language or have black box techniques that ignore the actual language used for the transformation.

Fleurey et al. [START_REF] Fleurey | Towards Dependable Model Transformations: Qualifying Input Test Data[END_REF] proposes black-box test adequacy criteria to evaluate the quality of models used as test models. The benefit of this approach is that it can be used with any transformation language.

However, the criteria are based solely on the ability of test models to cover the structures defined by the input metamodel of a transformation. Although the criteria provide an initial measure of the quality of test models, this approach should be augmented to take into account the intent of the transformation.

A white-box approach can also be used to define test criteria. For example, Küster et al. [START_REF] Küster | Validation of Model Transformations -First Experiences using a White Box Approach[END_REF] define a template language to generate test models based on the structure of the rules used to implement the transformation. The drawback of this approach is that it is tightly coupled to the transformation language and would need to be adapted or completely redefined for another transformation language.

On the other hand, a white-box approach must cover the individual transformation steps that make up a transformation. This forces the tester to generate test models that exercise each step. Thus, the criteria are more detailed and effective than black-box criteria that do not capture the mechanics of a transformation.

Conclusion

We need to take the MDE-specific challenges into account when developing testing solutions for model transformations. We identified some of the major challenges in this paper.

Promising solutions to some of the testing problems exist, but more work is needed. In addition to the development of new and efficient solutions, there is a need for a benchmark of realistic models and model transformations in the model transformation community. This is needed to experimentally validate and compare solutions to the complex engineering issues associated with model transformation. We discussed the issues for testing, but there are other open problems related to the evolution, maintenance, debugging, and design of model transformations.

Figure 1 -

 1 Figure 1 -Model Transformation Example: Flattening a Hierarchical State Machine.

Figure 2 -

 2 Figure 2 -A Hierarchical State Machine Metamodel.

Figure 3 -

 3 Figure 3 -Test Model for the Flattening Transformation.

For

  regression testing, testers need to compare the output models produced by two versions of the transformation because a test model that was used in testing a previous version of the transformation should produce the same output model. Thus, we need sophisticated model comparison tools. c Heterogeneity of Transformation Languages and Techniques The OMG has defined a model transformation standard called QVT. However, there exist a large number of model transformation languages and techniques. Transformations can be implemented with general purpose programming languages (e.g., Java) or languages dedicated to model transformations (e.g., Query/View/Transformation -QVT)). The MTIP workshop [3] organized at MoDELS'05 was concerned with developing "an increased understanding of the relative merits of different model transformation techniques and approaches". The workshop organizers specified several model transformations and asked the authors to implement them. Eight papers presented 13 different techniques, which were divided into three categories: graph transformation related approaches, declarative and rule based approaches, imperative and related approaches. Moreover, there are several tool-specific model transformation languages, such as Objecteering, MetaEdit+, and XMF-Mosaic. The approaches presented in the workshop reflected the diversity of existing transformation languages and techniques.

  [START_REF] Mottu | Reusable MDA Components: A Testing-for-Trust Approach[END_REF].Solberg et al. propose patterns to express preand post-conditions for the transformation. These patterns are templates that describe expected features of input and output models and can be viewed as a specialization of the source and target metamodels.Mottu et al. propose to use Design by Contract™ when building a model transformation and illustrates how the contracts can be used as an oracle for model transformation testing.


Olivier Beaudoux
email: olivier.beaudoux@eseo.fr

Arnaud Blouin
email: arnaud.blouin@inria.fr

Olivier Barais
email: barais@irisa.fr

Jean-Marc Jézéquel
email: jezequel@irisa.fr

Active Operations on Collections

Collections are omnipresent within models: collections of references can represent relations between objects, and collections of values can represent object attributes. Consequently, manipulating models often consists of performing operations on collections. For example, transformations create target collections from given source collections. Similarly, constraint evaluations perform computation on collections. Recent research works focus on making such transformations or constraint evaluations active (i.e. incremental, or live). However, they propose their own solutions to the issue by the introduction of specific languages and/or systems. This paper proposes a mathematical formalism, centered on collections and independent of languages and systems, that describes how the implementation of standard operations on collections can be made active. The formalism also introduces a reversed active assignment dedicated to bidirectional operations. A case study illustrates how to use the formalism and its Active Kermeta implementation for creating an active transformation.

Introduction

The promise of model-driven engineering (MDE) is that the development and maintenance effort can be reduced by working at the model instead of the code level. Models define what is valuable in a system, and code generators produce the functionality that is common in the application domain. One of the main current issue for the MDE community is to support evolution in the stage of the software development process (e.g. to support incremental code generation). To address this issue, this paper works on formalizing operation on collections to support incremental models manipulation. Indeed, collections are omnipresent in the Model Driven Engineering field: collections of references can represent relations between objects, and collections of values can represent object attributes. Consequently, manipulating models often consists of performing operations on collections. Two essential model manipulations are constraint checking and model transformation: the former often uses (OCL) iterators to traverse collections, and the later generates target from source collections. This illustrates the importance of collections in Model Driven Engineering. However, whenever a model is modified, these operations are not efficient since they require a full re-execution as if the model was newly created. Many different solutions have been proposed to solve such an issue; they are all based on the concept of incremental [START_REF] Giese | From model transformation to incremental bidirectional model synchronization[END_REF], live [START_REF] Hearnden | Incremental model transformation for the evolution of model-driven systems[END_REF] or active [START_REF] Akehurst | Model Translation: A UML-based specification technique and active implementation approach[END_REF] model manipulation. Despite their omnipresence, collections are not the central piece of these approaches that are often tied to a specific language and/or system [START_REF] Cabot | Incremental evaluation of OCL constraints[END_REF][START_REF] Villard | An incremental XSLT transformation processor for XML document manipulation[END_REF], or use usual manipulations combined with merge strategies [START_REF] Xiong | Towards automatic model synchronization from model transformations[END_REF].

This paper proposes a formalism that makes standard operations on collections active, independently from languages and systems. It shows how active transformations can be reduced to active operations on collections, thus underlining the interest of collections as first class objects for model manipulation. It evaluates the approach by studying complexities of active operations, and by explaining how active operations can be written with Active Kermeta, an implementation of our formalism on top of Kermeta [START_REF] Muller | Weaving executability into objectoriented meta-languages[END_REF].

The remainder of this paper is structured as follows. Section 2 explains how standard operations on collections can be made active through active loops, thus showing the foundation of our proposal. Section 3 illustrates the use of the formalism and its Active Kermeta implementation for writing active transformations. Section 4 evaluates complexities of active operations, discusses the possible optimizations, and compares the approach with related works. Finally, section 5 concludes on our contribution and its perspective.

From Standard to Active Operations

This section explains the semantics of active operations by describing their active loops: usual binary operations, application, selection, sort, and reversed assignment. Such a set of operations has been mainly inspired by OCL [START_REF] Warmer | The object constraint language: getting your models ready for MDA[END_REF].

Preliminary: Definitions

The set of all collections is noted C. Its subsets U and O define collections that respectively manage uniqueness and order. The four combinations define usual collection types: order set (oset

= U ∩ O), set (set = U -O), sequence (seq = O -U), and bag (bag = C -U -O).
The following table introduces the minimal set of operations that is sufficient to express any other operation: The first two rows represent usual iterations throughout loops (symbol ∀): the iteration is performed once for all elements of the collection. The next two rows define an iteration throughout an active loop (symbol ∀ ) that is composed of two rules: the addition rule (∀ ... ∈ ...) immediately invokes procedure p a for each element e of C (similar to usual loops), and subsequently invokes p a each time a new element e is added into C; the removal rule (∀ ... / ∈ ...) subsequently invokes procedure p r each time element e is removed from C. The last two rows define the indexed active loop dedicated to ordered collections; such a loop can also be used in some situations with unordered collections (e.g. selection and sort, see sections 2.4 and 2.5). Active loops thus observe additions and removals performed on collections; they also observe replacements since a replacement is considered as a removal+addition pair (see section 4.2). Usual and active loops can use a predicate; for example, ∀e ∈ C | e = 1, p(e) calls p for each e different from 1.

Operation C / ∈ O C ∈ O |C| cardinality of C e ∈ C presence of e in C e ∈ i C n/a presence of e in C at position i ∈ [0..|C|[ C[i] n/a element in C at position i ∈ [0..|C|[ C[i..j] n/a sub-
Usually operation B = op(A 1 , ..., A n ) computes the resulting collection B from the source collections A i . The computation is based on a usual loop: changing A i collections afterward does not change B. Conversely, an active operation is based on an active loop, and thus reevaluates B each time an addition or a removal occurs on A i . One may find that using operator = is ambiguous since it suggests bidirectionality; however, a change on B does not affect A i . For this reason, operator := is used so that expression B := op(A 1 , ..., A n ) becomes unambiguous.

Union, Intersection and Difference

Usual binary operations, such as union, intersection and difference, have simple active loops. For example with operation C := A ∪ B, each time an element e is added into A or B, it is also added into C; conversely, each time e is removed for A or B, it is also removed from C:

Operation Order Active loop C := A ∪ B (A, B) / ∈ O 2 ∀ e ∈ A, C + e ∀ e / ∈ A, C -e ∀ e ∈ B, C + e ∀ e / ∈ B, C -e (A, B) ∈ O 2 ∀ e ∈ i A, C + i e ∀ e / ∈ i A, C-i ∀ e ∈ i B, C + |A|+i e ∀ e / ∈ i B, C-|A|+i
Union preserves uniqueness, i.e. (A, B) ∈ U 2 ⇒ C ∈ U, and order, i.e. (A, B) ∈ O 2 ⇒ C ∈ O. Active loops for intersection and difference have been defined similarly.

Application

Application B := A(f ) consists of applying f on each element of A. It preserves the order and guarantees |A| = |B|; it cannot preserve uniqueness since f may have introduced pairs.

Application allows the definition of navigation paths. For example, if elements e of A define property4 p, path B := A.p is equivalent to B := A(e → e.p). However, the result must be flattened since A(e → e.p) returns a collection of properties, i.e. a collection of collections.The following table gives the active loops for applications and paths:

Operation Order Active loop B := A(f ) A / ∈ O ∀ e ∈ A, B + f (e) ∀ e / ∈ A, B -f (e) A ∈ O ∀ e ∈ i A, B + i f (e) ∀ e / ∈ i A, B-i B := A.p A / ∈ O ∀ e ∈ A, ∀ e / ∈ A
k = j + n=i-1 n=0 |e[n].p|

Selection

Selection B := A[f ] consists of selecting elements of A that match predicate f . It preserves uniqueness and order since it filters A. Other operations can be derived from selection, such as operations reject, detect, exists and forAll defined by OCL [START_REF] Warmer | The object constraint language: getting your models ready for MDA[END_REF], or operation B := toU nique(A) that converts A ∈ C into B ∈ U.

Operation Order Active loop

B := A[f ] A / ∈ O ∀ e ∈ A | f (e), B + e ∀ e / ∈ A | f (e), B -e A ∈ O ∀ e ∈ i A | f (e, i), B + j e ∀ e / ∈ i A | f (e, i), B-j where j =| A[0..i][f ] |
As one can note, the previous active loops do not take into account any reevaluation of f required in some situations. For example, selection persons[p → p.age < 18] returns a collection of persons under 18. The active loop works fine whenever a person is added or removed from the collection; however, it fails whenever the age of a person goes above 18. Thus, we propose to reify (symbol ) predicate f into a predicate collection represented as a sequence of booleans. Let us consider that collection persons contains three people with ages 16, 42 and 12. Expression persons.age [a → a < 18] returns predicate collection (true, f alse, true) indicating that persons[0] and persons [START_REF] Hearnden | Incremental model transformation for the evolution of model-driven systems[END_REF] are below 18. Here we assume that all collections, including unordered ones, store their elements in an array (see section 4 Operation Order Active loop

P := A[f ] ∀ e ∈ i A, P + i f (e) ∀ e / ∈ i A, P -i B := A[P ] A / ∈ O ∀ p ∈ i P |p, B + A[i] ∀ e / ∈ i A | e ∈ B, B -e ∀ p ∈ i P |¬p, B -A[i] A ∈ O ∀ p ∈ i P |p, B + j A[i] ∀ e / ∈ i A | e ∈ j B, B-j ∀ p ∈ i P |¬p, B-j where j =| P [0..i][p → p] |
The addition rule of B := A[P ] is based on observing P but not A, which implies that P := A[f ] must be computed before B := A[P ]. The removal rule is based on observing A but not P , which allows retrieving element e of A that must be removed from B. Predicate collections can be combined through usual boolean operators:

Operation

Active loop P := ¬P ∀ p ∈ i P, P + i ¬p ∀ p ∈ i P, Pi P :

= P 1 ∧ P 2 ∀ p 2 ∈ i P 2 , P + i (P 1 [i] ∧ p 2 ) ∀ p 2 / ∈ i P 2 , P -i P := P 1 ∨ P 2 ∀ p 2 ∈ i P 2 , P + i (P 1 [i] ∨ p 2 ) ∀ p 2 / ∈ i P 2 , P -i
These active loops are simple. However, it is necessary to decide which collection P 1 or P 2 must be observed for operators ∧ and ∨. By convention, we fix that P 1 is defined before P 2 so that a change on P 1 is followed by a change on P 2 ; rules are thus based on observing P 2 , which guaranties that |P 1 | = |P 2 | when the rule is called (P 1 [i] can thus be used).

Sort

Sort B := A{f } consists of sorting A accordingly to the value returned by f assuming that its type defines operator <. The sort operation preserves uniqueness but, naturally, not the order.

Operation Order Active loop

B := A{f } A / ∈ O ∀ e ∈ A, B + j e ∀ e / ∈ A, B-j A ∈ O ∀ e ∈ i A, B + j e ∀ e / ∈ i A, B-j where j = |A[e → f (e ) < f (e)] |
As for selection, the previous active loops do not take into account any reevaluation required if f uses paths on e. For example, sort persons{p → p.name} returns a collection of persons sorted by their name. This works fine whenever a person is added or removed from the collection but fails whenever the name of a person changes.

Thus, we propose again to reify (symbol ) function f into an order collection represented as a sequence of integers that gives positions after the sort. Let us consider that collection persons contains three persons named "Emma", "Oliver" and "Alice". Expression persons.name{n → n} , abbreviated on {persons.name} , returns order collection (1, 2, 0), which means that persons[0] representing "Emma" will occupy position {persons.name} [0] = 1 after sorting. The order can then be used for sorting the collection:persons{{persons. name} }. The following table overrides the previous one where O := {A} returns an order collection and B := A{O} sorts A according to order O:

Operation Active loop O := {A} ∀ e ∈ i A, O + i j ∀ e / ∈ i A, O-i where j = |A[e → e < e] | B := A{O} ∀ j ∈ i O, B + j A[i] ∀ j / ∈ O, B-j
The active loop of O := {A} consists of adding or removing order j at/from position i. However, operation + andmust be refined for order collections to manage resulting positions correctly. For example, O + i j requires to increment (silently) all orders greater than j.

Moreover, the previous active loops do not allow sorting on multiple criteria. The full version is based on partial order collections that specify all possible positions; a partial order collection is represented by a sequence of sequences of integers. The previous example can be extended so that the persons are sorted by their last names and then by their first names: persons{{persons.lastN ame} ∧ {persons.f irstN ame} }. Let us now consider that collection persons contains three persons named "Emma G.", "Oliver B." and "Alice B.". We now have {person. lastN ame} that returns ((2), (0, 1), (0, 1)) and {person.f irstN ame} that returns ((1), ( 2), (0)): "Oliver B." and "Alice B." have the same possible positions (0 or 1) represented by the two sequences (0, 1), and final positions are given by combining the two partial order collections: {persons.lastN ame} ∧ {persons.f irstN ame} = ((2), ( 1), (0)).

Reversed Assignment

Previous operations are unidirectional: in operation B := op A, modifying A induces a change on B, but modifying B does not induce any change on A, thus motivating the use of operator := instead of =. Bidirectionality implies that op is reversible, i.e. A := op -1 B, so that a change on B impacts collection A. Union, intersection, difference, selection and sort are not reversible; the only operation that can be reverted is the application: B := A(f ) can be reverted as long as f -1 exists.

However, application B := A(f ) and its reversed version A := B(f -1 ) cannot be defined together since they both create a new resulting collection (respectively B and A). We thus introduce the reversed assignment operator (symbol =:) that can only be used on applications: application B := A(f ) creates B from A, while its reversed version B =: A(f ) (also written B(f -1 ) =: A) allows the reverse update. Since A is always initialized before the reversed assignment, its addition rule must only be called subsequently to additions. Having B =: A(f ) implies that B := A(f ): we use operator = so that B = A(f ) defines a bidirectional application. Active loops for reversed applications are defined as follows:

Operation Order

Active loop

B =: A(f ) (A, B) / ∈ O 2 ∀ e ∈ B, A + f -1 (e) ∀ e / ∈ B, A -f -1 (e) (A, B) ∈ O 2 ∀ e ∈ i B, A + i f -1 (e) ∀ e / ∈ i B, A-i
Navigation throughout collections is based on the flattening version of the application. In order to preserve the semantics of the active loop of path B := A.p (see section 2.3), the active loop of the reverse path assignment B =: A.p should define the following addition rule: ∀ e ∈ B, A + e n , e n .p + e where e n is the owner element of property p that contains e . Figure 1 helps in understanding this rule. The following case study includes such a reversed path assignment.

This section illustrates how previous active operations can be used for implementing active transformations. We first motivate the use of collections for representing any object property. We then give the active operations required for implementing an active transformation in the context of a user interface. We finally explains how the active transformation has been successfully implemented within Kermeta using our Active Kermeta framework.

Requirement: all Properties are Collections

An object property can be either a relation or an attribute, and is always represented by a collection. This means that, if the property has a cardinality 0..1 or 1..1, its representing collection is a singleton. In such a case, an empty collection represents a null property value. This requirement is implied by the use of paths that extends the dotted notation of OOP. For example, in expression B := o.p 1 .p 2 where |p 1 | ≤ 1, o.p 1 represents the dotted notation of OOP while p 1 .p 2 represents a path (see section 2.3). If p 1 is not considered as a singleton but as a value, the property value o.p 1 can be null, thus resulting in a null reference error within expression o.p 1 .p 2 . This requirement has no real impact on performance since observing a singleton is equivalent to observing changes on a value: in this last case, the value needs to be encapsulated within a dedicated class (e.g. a class ObservableValue<T>).

Active Transformation

Figure 2 gives the outline of the sample transformation: the left part represents source domain data, a directory of contacts; the right part represents the associated user interface (UI) that displays the contacts within a list widget, and allows editing contact properties throughout three text fields 5 .

Linking domain data to UI is usually performed using "UI bindings" that are platform dependent and offer limited features. Using active operations avoids such drawbacks, and addresses a more general problem than UI binding [START_REF] Beaudoux | Linking data and presentations: from mapping to active transformations[END_REF]. A comparison between UI bindings and active operations is however beyond the scope of this paper. A complex example is provided within the Active Kermeta framework.

In the example of figure 2, D2L transforms directory d into list l that displays the contacts sorted by their last name and first name: l.items := d.contacts{{d.contacts.lastN ame} ∧ {d.contacts.f irstN ame} }(C2I) C2I transforms each contact c into an item i that displays his/her first and last name, and also saves the link between c and i in reversed relation contact:

Kermeta Implementation

Active operations have been implemented on top of Kermeta by the Active Kermeta framework, freely available at http://gri.eseo.fr/software/activekermeta. The framework proposes two packages dedicated to the four collection classes Set, OrderedSet, Bag and Sequence. Package kermeta::observable defines the minimal set of operations and active loops for these classes; the following table gives the syntax of Kermeta active loops: Operation plus (line 15), not described in this paper, is an active operation that concatenates two string singletons; its companion operation plusValue concatenates the literal string with the string singleton. Relation contact is added through an aspect of class Item.

∀ e ∈ C,
As one may note, such a Kermeta code can be easily generated from the formal specification given in the previous section. collections, or a shifting of ordered collections. Note that the complexity of operation A.p is given considering |A.p| = n, but not |A| = n. Collections with uniqueness have O(n 2 ) operations because C + e must ensure the uniqueness. However, operations on row 2 do not require uniqueness from operation +: for example, selection B := A[f ] guaranties that B ∈ U if A ∈ U since it filters A; these operations can thus reduce their complexities (values surrounded by parenthesis). The last row has O(n 2 ) complexities: A ∩ B and A -B require presence tests that cost O(n), and {A} naturally requires two loops.

Discussion

The previous table illustrates that complexities for removals are always O(n). Consequently, replacing element e a by element e b in collection C costs O(n) since it performs a removal of e a and an addition of e b . This might be optimized for ordered collections since replacing one of its element only costs O(1). This optimization requires the introduction of a replace rule within active loops. Moreover, replace rule can be mandatory in some circumstances; for example, replacing the value of a property with cardinality 1..1 violates the minimal cardinality constraint if a removal if performed. The replace rules can be easily inferred from addition and removal rules; they have not been considered in this paper for clarity.

An active transformation that counts m operations constructs its initial result in between O(m × n) and O(m × n 2 ), and subsequently updates each individual resulting collection in between O(1) and O(n). However, operations are not independent: modifying one source collection can result in multiple chained updates. A simplified view of such dependencies consists of representing the operations in a two dimensioned space where height h counts the independent chains of operations, and w counts the operations involved in a chain: O(m) = O(h × w). The number of operations ∆w required to reify functions involved in selections and sorts (see sections 2.4 and 2.5) is included in number w. For example, single selection persons[p → p.age < 18] must be rewritten in active selection persons[persons.age[a → a < 18] ] that counts ∆w = 2 (path + predicate collection), i.e. w = 3.

Complexity of the initial construction varies from O(h × w × n) to O(h × w × n 2 ), and complexity of the subsequent chained updates varies from O(w) to O(w × n): their ratio λ thus varies from O(h) to O(h × n 2 ). This result illustrates the interest of active operations, especially for large models (n 1) and/or complex transformations (h 1). The active loops proposed in section 2 should be implemented in a way that depends on the context of use, thus allowing possible optimizations that would increase λ by reducing width w of the dependency chains. In the context of incremental constraint evaluation, Cabot and Teniente [START_REF] Cabot | Incremental evaluation of OCL constraints[END_REF] propose to take into account only changes that can induce constraint violation, thus defining a new specific context of use. Such a specific context requires that our model for observing collections should be refined so that addition and removal rules does not systematically invoke their associated procedures. Section 3 has presented the specific context of active transformations for user interfaces: the transformation binds the domain objects to their presentation. In such a context, the user works on a presentation that represents a (small) part of the full application model: this typically means that the transformation starts by a selection that filters the full model. Such a selection thus naturally "optimizes" the transformation by pre-filtering changes that do not impact the presentation. Moreover, the user can perform many changes on a single object in a short time-slot, thus resulting in many reevaluations of active operations. Once again, the observability model can be refined by using an asynchronous invocation of addition and removal rules, as done within Viatra [START_REF] Varró | The model transformation language of the viatra2 framework[END_REF]. This would improve performances by filtering any redundant modifications, such as multiple intermediate changes of a single property (only the last change should be considered).

Since it is centered on operations on collections, our approach is more suited to imperative transformations (e.g. Kermeta) than to declarative ones (e.g. ATL [START_REF] Jouault | Transforming models with ATL[END_REF]). However, we think that our formalism can help in making declarative transformations active. Moreover, mappings expressed with higher level languages, such as Malan [START_REF] Blouin | Malan: A mapping language for the data manipulation[END_REF], should be automatically converted into active operations.

Related Work

Many research have been done on incremental evaluation of constraints and incremental transformations. We herein only cite some of the most recent ones.

Blanc et al. propose an original approach for detecting model inconsistency (constraint violation): the detection is performed on the model considered as a sequence of elementary construction operations, rather than a model considered as a set of elements [START_REF] Blanc | Detecting model inconsistency through operation-based model construction[END_REF]. The approach is thus naturally incremental. It shares some similarities with active operations: their elementary construction operations match the elementary rules (addition and removal) of active loops, and our addition rules are also used to initially build the content of collections. However, their approach is dedicated to constraint evaluation only, and the implementation is based on Prolog which is not widely used and not well adapted to MDE.

Cabot et Teniente optimize OCL constraint evaluation by considering only constraint violations: model changes that cannot violate constraints are filtered [START_REF] Cabot | Incremental evaluation of OCL constraints[END_REF]. They also translate OCL contexts to better contexts. The proposed optimization is interesting and forms a specific context of use, as previously explained. However, users often temporally violate constraints when editing models (e.g. a user omits the type of a class attribute within an Ecore diagram): transition from state violated to state respected should not be ignored. The optimization, specific to constraint checking, cannot be used in the context of incremental transformation.

XSLT is probably the best known transformation language. Villard and Layaïda have developed incXLST, an incremental XSLT processor, thus showing the broader interest of incremental transformation [START_REF] Villard | An incremental XSLT transformation processor for XML document manipulation[END_REF]. The processor is based on re-instantiating transformation rules and merging the resulting fragments within the target document, and has limited featured. Framework eXAcT allows the transformation of DOM documents into DOM presentations (e.g. SVG presentations) [START_REF] Beaudoux | XML active transformation (eXAcT): transforming documents within interactive systems[END_REF]. However, eXAcT transformations are complex Java programs with limited features. Moreover, both incXSLT and eXAcT are not MDE tools.

QVT has established that incremental transformation is an important issue of MDE [START_REF]OMG: MOF QVT final adopted specification[END_REF], but no incremental QVT-based transformation engine has been implemented yet. Xiong et al. proposed SyncATL, an incremental ATL processor [START_REF] Xiong | Towards automatic model synchronization from model transformations[END_REF], on the same principle as incXSLT: elicited ATL rules are re-executed and their results are merged with the target. As for incXSLT with XSLT, the processor is dedicated to ATL only. Hearnden et al. propose an original based on the use of SLD resolution, where SLD trees store the transformation context and dependency tables record dependencies between the transformation and the source model [START_REF] Hearnden | Incremental model transformation for the evolution of model-driven systems[END_REF]. The drawback of the approach is the maintenance cost of the SLD trees and dependency tables.

The previous works make declarative transformations incremental by implementing new processors and/or algorithms tied to specific languages and/or systems. Using active operations on collections allows their direct execution on model instances, without requiring any specific processor or complex algorithm: definition of operations are directly executable in an active manner. We have shown that active operation can be easily used to implement Kermeta imperative transformations. We think that our formalism can help in making declarative transformation languages active, such as ATL [START_REF] Jouault | Transforming models with ATL[END_REF], by generating the active operations for a given "passive" transformation. Some authors considered that declarative transformations should be expressed as mappings [START_REF] Akehurst | Model Translation: A UML-based specification technique and active implementation approach[END_REF][START_REF] Giese | From model transformation to incremental bidirectional model synchronization[END_REF][START_REF] Blouin | Malan: A mapping language for the data manipulation[END_REF]. Here again, we think that active implementations of mappings, as defined by Akehurst [START_REF] Akehurst | Model Translation: A UML-based specification technique and active implementation approach[END_REF], can be achieved by active operations.

Conclusion and perspective

This paper proposes a formalism, based on active loops, for implementing active operations on collections. The standard set of operations, mainly inspired by OCL [START_REF] Warmer | The object constraint language: getting your models ready for MDA[END_REF], is supplemented by a reversed assignment that allows the definition of bidirectional operations. A case study, fully implemented in Kermeta, illustrates that making a transformation active by using such a formalism does not require to change much the usual (i.e. passive) transformation; it also gives a specific context that requires active transformations with bidirectionality features: user interfaces. The complexity study shows that running active operations results in an interesting gain when compared to running all the "passive" operations. Moreover, such a gain can be increased by reducing operation dependencies with optimization strategies that can be implemented depending of the contexts of use (e.g. transformation within UI or evaluation of constraint violation).

We first plan to create an active implementation of the Malan language [START_REF] Blouin | Malan: A mapping language for the data manipulation[END_REF] based on Active Kermeta, thus showing the ability of active operations to implement declarative mappings and transformations. We will secondly focus on the use of active operations for incremental constraint validation by extending the proposed set of active operations , and by defining active class invariants through

  .1), thus allowing the use of the indexed accessor C[i] and indexed loops ∀ e ∈ i C. By overriding operation B := A[f ] with B := A[P ] where P = A[f ] , the desired selection can be performed: persons[persons.age[a → a < 18] ].

Fig. 1 .

 1 Fig. 1. Path principle

Fig. 2 .

 2 Fig. 2. Transformation outline

  If C ∈ U, operations C + e and C + i e check the uniqueness of e within C: if e ∈ C before the insertion, operations have no effect. The following table gives the notation used to iterate on collections: for each element e of C ∀e ∈ i C, p(e, i) n/a calls p(e, i) for each element e at position i in C ∀ e ∈ C, p a (e) calls p a (e) each time an element e is added into C ∀ e / ∈ C, p r (e) calls p r (e) each time an element e is removed from C ∀ e ∈ i C, p a (e, i) n/a calls p a (e, i) each time e is inserted at position i ∀ e / ∈ i C, p r (e, i) n/a calls p r (e, i) each time e is removed from position i

	Iteration	C / ∈ O C ∈ O
	∀e ∈ C, p(e)	calls p(e)
			collection of C from pos. i to pos. j
	C + e	adds e into C appends e at the end of C
	C + i e	n/a	inserts e into C at position i ∈ [0..|C|]
	C -e	removes the first occurrence of e from C
	C-i	n/a	removes from C the element at pos. i ∈ [0..|C|[

  ... C.eachAdded{e|...} ∀ e ∈ i C, ... C.eachAddedAt{e,i|...}

		operation D2L(): List is do
	3	result := List .new
	4	result . items := contacts .sortedBy(
	5	contacts .path{c|c.lastName}.sortOrder (). and(
	6	contacts .path{c|c.firstName}. sortOrder ())
	7	). collect {c|c.C2I()}
	8	end
	9 }
	10
	11 aspect class Contact {
	12	operation C2I (): Item is do
	13	result := Item.new
	14	result . text := firstName. plusValue("␣"). plus (lastName)
	15	result . contact .add( self )
	16	end
	17 }
	18
	19 aspect class List {
	20	operation L2PhoneTF(): TextField is do
	21	result := TextField .new
	22	var contact : Set<Contact> init selection .path{i | i . contact}
	23	result . text := contact.path{c|c.phone}. collect (a|a. toString ())
	24	contact . assignPath{c|c.phone}.from(result . text . collect {t | t . toInteger ()})
	25	end
	26
	27	// ...
	28 }
		∀ e / ∈ C, ... C.eachRemoved{e|...} ∀ e / ∈ i C, ... C.eachRemovedAt{e,i|...}
		Package kermeta::active implements active operations based on the active
	loops presented in section 2; the following table gives the syntax of Kermeta
	active operations:

A property is either a relation or an attribute. As explained in section 3.1, all properties are considered as collections.

UI objects are rendered through a graphical server not represented in the figure. Adding a contact is achieved through the button "Add" of the user interface: clicking on the button creates a new contact in the source data directly..

aspect class Directory {

Kermeta aspects. We thirdly plan to optimize the collection observability model of Active Kermeta with filtering and asynchronous treatment capabilities. Finally, we will use active operations in the context of user interfaces to link each of their components [16,17].

Writing an active Kermeta transformation respects the same principle as writing a usual Kermeta transformation: aspects are used to add new transformation operations on Ecore models [START_REF] Muller | Weaving executability into objectoriented meta-languages[END_REF]. The transformation of figure 2 has been implemented with active operations as follows:

Evaluation

This section evaluates the worst case complexities of active loop rules, discusses the resulting performance in the contexts of both constraint evaluation and model transformation, and then compares the approach with related works.

Worst Case Complexities

The following table gives the worst case complexities of elementary operations on collections implemented as array lists:

Due to the choice of the elementary operations, these complexities cannot be better for linked lists, nor for sorted sets (C + e is even worse). Moreover, using hash sets should only improve the average-case complexities (e.g. e ∈ C is O(1) in average). We can thus infer worst-case complexities of active loops from the previous table.

Since active loops of ordered collections differ from those of unordered collections, we must study complexities for each of the four collection types (bag, seq, set and oset). Moreover, we distinguish three cases of the active construction of collections: the initialization ("i.") that invokes the addition rule n times; the addition ("a.") that invokes the addition rule on each addition performed in the source collection; and the removal ("r.") that invokes the removal rule on each removal performed in the source collection. The following table synthesizes complexities for each rule of action loops: bag seq set oset Operation i. a. r. i. a./r. i. a. r. i. a./r.

Complexity for an initialization is not necessarily equal to n×c where c is the complexity of its addition rule. For example, the addition rule of A ∪ B where (A, B) ∈ seq 2 is based on operation C + i e that costs O(n): the initialization would thus cost O(n 2 ); however, operation C + i e here appends e at the end of C, which costs only O(1): the initialization phase thus costs O(n).

Operations in the first four rows are mainly O(n): additions cost O(1) for unordered collections, but cost O(n) for ordered ones because of the required shifting; removals always cost O(n) since they require a search in unordered