Brahim Hamid

Laboratory of Model driven engineering for embedded systems

INTRODUCTION

The development of embedded systems [START_REF] Zurawski | Embedded systems in industrial applications -challenges and trends[END_REF]] needs to address non-functional requirements such as memory, timeliness, or limited energy. If these systems are safety-critical, the development also need to address additional safety and security as well as dependability (S&D1 ) [START_REF] Ravi | Security in embedded systems: Design challenges[END_REF] requirements. Thus, non-functional requirements become more important, since accidents may be caused not only by "wrong" actions but also by "right" actions that are executed too late. Some non-functional requirements have a large impact on the software as well as hardware architecture, for instance an availability requirement can only be guaranteed with a replication of hardware and a suitable allocation of software blocks on this hardware. In addition, safety norms demand that requirements are traced, i.e. systematically captured and covered by elements within the system architecture.

Thus, development processes need to the demands of S&D systems into account. Component-based software engineering (CBSE) [START_REF] Crnkovic | Component-based software engineering for embedded systems[END_REF]] helps to capture some facets of the requirements, notably a hierarchical decomposition of the system and explicit allocation of software to hardware components. Still, the integration of S&D features requires the availability of both application domain specific knowledge and S&D expertise at the same time. We propose to capture this expertise through S&D patterns as well as integrating these patters into the development process.

The collaborative project SIRSEC2 , within which this work takes place, has the objective to apply safety design patterns to the development of component-based embedded systems supporting railway signaling functions such as CBTC (Communication Based Train Control). The safety functions of the CBTC system are implemented on a set of safety equipments. The hardware and software platform hosts both the safety software application and the middleware with high dependability capabilities. The system has to fulfill safety integrity levle 4 (SIL4), as determined by the safety analysis of the system according to the standards EN 50126, EN50128 and EN 50129 [CENELEC 2000] [CENELEC 2011] [CENELEC 2003].

A design pattern may provide a suitable solution for the constraints or properties of the hardware and software platform, since it captures a proven solution along with its advantages and inconveniences. The pattern thus guides the adaptation of a model based design to this platform. However, the lack of formalization introduces potential risks on the system safety. Hence, the definition and the use of design patterns should be adapted according to safety requirements and assessments, to meet several issues. An important issue is to (partly) automate the use of design pattern in the software development process. This requires the formalization of design patterns. Whereas diagrams sketch the structure or behavior of a solution, the underlying notation is often not or not well formalized. Semi-formal languages such as UML are a good starting point, since these are typically also used for application development, in the context of model driven engineering.

Existing approaches using UML also support the application of a pattern. However, the latter results merely in copying a solution into a model. In general, it is then necessary to adapt the copied solution to the system constraints, naming conventions, etc. However, if there is no trace of the original roles within the pattern definition, it is possible to modify the elements of copied solution in an arbitrary way after the pattern has been applied. Thus, the properties of the solution, for instance with respect to safety, might not be valid within the system although a pattern guaranteeing these has been used. In our work, we propose a model and pattern instantiation approach allowing the application designer to trace pattern application and thus preserve the safety properties of the pattern along its use.

In our previous work [START_REF] Hamid | Enforcing S&D pattern design in RCES with modeling and formal approaches[END_REF], we proposed methods to model security and dependability aspects in patterns and to validate manually whether these still hold in RCES (Resource Constrained Embedded Systems) after pattern application. A meta-model serves as language for describing these patterns. A set of S&D patterns is organized in a pattern system and stored in a repository within the Semco platform3 .

In this paper, we present a new UML profile to model S&D patterns providing new capabilities for pattern application and traceability within the profile. To validate the results, we are developing an MDE tool chain to assist the developers of S&D pattern-based component-based applications. The MDE tool chain was implemented as an extension of the UML model editor Papyrus4 . We also validate the results by applying our approach to model secure and dependable embedded system in the context of SIRSEC project: the CBTC System. The target audience of this paper are on the one side people working on pattern formalization and on the other those working on process and tools supporting the application of patterns, i.e. integrating the use of patterns into a development cycle.

The paper is structured as follows. In the next section (Section 2), we examine related work including both academic papers as well as design pattern support in existing modeling tools. Section 3 gives an overview of our approach which is detailed in the following sections. In Section 4, we propose a modeling language-neutral meta-model and a UML profile that enables the specification of design patterns. This presentation is focused on a simplified example of a design pattern (Section 4.1), which serves as a running example throughout the rest of the paper. The use of patterns within the development of a system is addressed in Section 5. This section provides details on how a pattern is applied to an existing UML architecture in a way that it keeps a trace of pattern application. The next section outlines a tool that supports the proposed approach. The paper is concluded in Section 7 by a summary and outlook for future work.

RELATED WORK

In this section, we examine the state-of-the art of modeling design patterns, chiefly the aspect how to represent a pattern and how to support the use of a design pattern focusing on S&D patterns. Some existing approaches [START_REF] Foote | Pattern Languages of Program Design 4[END_REF] propose specific languages to formalize the pattern description, however, the solutions are still not generic enough or are too complex to be easily applied on every system. For instance, in [START_REF] Taibi | An Integrated Approach to Design Patterns Formalization[END_REF]], the author proposes a balanced pattern specification language (BPSL) to describe both structural and behavioral aspects of patterns using formal specifications. This approach enables users to know when and how to apply a pattern, however, it does not provide support for pattern application.

Section 17.5 of UML 2.0 [START_REF] Omg | OMG. A UML Profile for MARTE: Modeling and Analysis of Real-Time Embedded Systems,beta 2. OMG[END_REF] proposes to model patterns in form of collaborations in combination with a template signature. The collaboration diagram focuses on the relationship between objects, enabling to visualize the way objects collaborate together. The template signature is a list of formal template parameters, which can be substituted by actual parameters when binding the collaboration to an actual system.

Existing UML tools support the application of design patterns, notably Netbeans and StarUML5 using the proposal of the UML standard. The main critic of these tools is that no trace of the pattern application remains in the application model. Thus, it is possible to make modifications to the pattern without being aware that these may break some of the pattern's properties. This is particularly important in the context of patterns that should guarantee certain safety and security properties.

In the context of verifiability, in [START_REF] Mapelsden | Design pattern modelling and instantiation using DPML[END_REF], the authors propose to use DPML (Design Pattern Modeling language) with a tool support DPTool. In DPML, only solutions of design patterns are modeled, i.e., consequences and others pattern specifics are not included in the model. It introduces a notation for visually representing design pattern solution, then, at pattern instantiation. It provides a process that transforms the DPML-specific notation into the UML model of the system and proposes a list of candidates for each role of the solution. This process enables correct and consistent application of the solution on a UML object model. In the case that users incorrectly bind the pattern solution to their UML model, a verification mechanism generates error messages.

In LePUS [START_REF] Nicholson | Automated verification of design patterns with lepus3[END_REF]] (LanguagE for Patterns Uniform Specification, Version 3), the authors propose a visual tool supported modeling language for design pattern that enables formal specification of design pattern solutions using first order predicate logic. LePUS includes visual notation for LePUS formulas, consisting of icons (ellipses, squares and triangles). It also enables verifying whether a Java program satisfies the pattern specification. The main constraint of LePUS is that it is based on formal logic, it accredits the verification with formal basis however it makes difficult for the average software developers to work with as the tool-support is still at the prototyping stage.

Another alternative for the specification of patterns is the use of pattern primitives [START_REF] Zdun | Modeling architectural patterns using architectural primitives[END_REF]. An interesting approach used to reason about design decision in terms of precise modeling element in a model which represents a pattern. The approach was applied in [START_REF] Zdun | Modeling architectural patterns using architectural primitives[END_REF] for specifying architectural patterns and in [START_REF] Zdun | Modeling process-driven and service-oriented architectures using patterns and pattern primitives[END_REF] for specifying process patterns. For the first concern, a set of pattern primitive (e.g., Callback,Indirection,Grouping,Layering, Virtual Connector, ... ) are used as a basic construct for software architectural pattern specification, and then illustrated how software architectural pattern such as broker is built using these primitives. For the second concern, a set of pattern primitives (eg. process flow refinement, process flow steps, Synchronous service invocation,.. ) for process patterns in the context of process-oriented integration of services are captured and then used for specifying a set of patterns of process-driven SOAs (eg. Microflow integration service).

Several approaches exist in the S&D design pattern literature [START_REF] Yoder | Architectural patterns for enabling application security[END_REF][START_REF] Giacomo | Using security and dependability patterns for reaction processes[END_REF][START_REF] Yoshioka | A survey of security patterns[END_REF][START_REF] Daniels | The reliable hybrid pattern: A generalized software fault tolerant design pattern[END_REF][START_REF] Tichy | Design of self-managing dependable systems with uml and fault tolerance patterns[END_REF]. They allow to solve very general problems that appear frequently as sub-tasks in the design of systems with security and dependability requirements. These elementary tasks include secure communication, fault tolerance, etc. Particularly, [START_REF] Yoder | Architectural patterns for enabling application security[END_REF] presents a collection of patterns to be used when dealing with application security. The proposed catalog includes secure access layer, single access point, check point, etc.. [START_REF] Daniels | The reliable hybrid pattern: A generalized software fault tolerant design pattern[END_REF]] describes a set of patterns for the development of fault-tolerant software applications. These patterns are based on classical fault tolerant strategies such as N -Version programming, recovery block, consensus, voting and acceptance tests. In addition, the paper proposes patterns that combine several strategies. These patterns are therefore called hybrid patterns. The expressiveness of the technique is demonstrated through the support of the advanced software voting techniques. Extending this framework, [START_REF] Tichy | Design of self-managing dependable systems with uml and fault tolerance patterns[END_REF]] proposed a framework for the development of dependable software systems based on a pattern approach. They reused proven fault tolerance techniques in form of fault tolerance patterns. The pattern specification consists of a service-based architectural design and deployment restrictions in form of UML deployment diagrams for the different architectural services. The work is illustrated with an application to guide the self-repair of the system after the detection of a node crash.

In [START_REF] Harrison | On the impact of fault tolerance tactics on architecture patterns[END_REF], the authors studied the interaction of fault tolerance tactics and architectural patterns. They proposed an empirical study on how to add fault-tolerance tactics, such as fault-detection and replication, to software architectural pattern, such as brokers, pipes and filters, for S&D engineering. The study shows the advantages/disadvantages of modifying these patterns by adding the tactic to the pattern before or after its integration.

To summarize, in software engineering, design patterns are considered as effective tools for the reuse of specific knowledge. However, a gap between the development of the system and the pattern information still exists. This becomes more exciting when dealing with specific concerns namely security and dependability for several application sectors.

OVERVIEW OF A PATTERN ENABLED DEVELOPMENT PROCESS

In our work, we promote the development of secure and dependable systems by means of patterns, as shown in Fig. 1. It includes the development of a pattern and its storage as well as its use within a system development process. The pattern development process includes tasks such as the representation, the organization and the definitions of relationships between patterns. The patterns usage focus on the problem of selecting and integrating patterns into an application. A suitable storage, e.g. in form of a central repository facilitates the pattern usage, but this aspect is out of the scope of this paper.

The left side of Fig. 1, i.e. the representation and development of patterns, is addressed in section 4 providing a modeling framework to capture S&D expertise for component-based development in the form of UML profiles and Patterns. The latter are also specified through dedicated UML profiles. The componentbased development using the resulted patterns and UML profiles (right part of Fig. 1) is addressed in section 5.

SPECIFYING PATTERNS -METAMODEL AND PROFILE

Design patterns have a certain number of elements that need to be captured by means of a pattern specification language. Our proposition is based on GoF [START_REF] Gamma | Design Patterns: Elements of Reusable Object-Oriented Software[END_REF]] specification, and its adaptation for security engineering [START_REF] Schumacher | Security Engineering with Patterns -Origins, Theoretical Models, and New Applications[END_REF]]. As we shall see, we refined it in order to fit with the non-functional needs. Adapting the definition of security pattern of [START_REF] Schumacher | Security Engineering with Patterns -Origins, Theoretical Models, and New Applications[END_REF]], we define a security and dependability pattern as a description of a particular recurring security and dependability problem that arises in specific contexts and presents a well-proven generic scheme for its solution. Therefore, a security and dependability pattern system is a collection of security and dependability patterns, together with guidelines for their implementation, combination and practical use in security and dependability engineering.

For our purpose, we propose to combine two well known approaches in MDE: a domain specific language (DSL) and a UML profile enabling pattern-specific information in UML models. The basic idea is that the former defines problem, objectives and constraints while the latter, the modeling-language specific part defines roles and solutions. The objective behind this separation is that the roles and solution defined in the pattern can only be integrated (without losing information) into the application architecture, if both are specified in the same modeling language, e.g. in UML. Conversely, problem statement and objectives are independent of a modeling language. The separation enables that solutions defined in different modeling languages share the same problem definition. This is useful, since we are storing a library of design patterns in a common repository. A pattern might eventually have multiple solutions defined in different modeling languages. The pattern discovery, i.e. the mechanisms to browse or search patterns within the repository are based on the modeling language independent part.

In the sequel we shortly present both specification languages: the modeling-language UML-independent part (SEPM) and a UML profile. We begin with a motivating example.

Motivating Example

Before formalizing design patterns, we illustrate patterns from a case study from the the railway domain: a simplified communication based train control (CBTC) system. It consists of wayside equipments and ground equipments and on-board equipment and communication lines. The application is a set of SW components providing the safety functions of the CBTC that will be replicated N times inside the equipments according to availability requirements and considered safe if M replica are constantly valid. This is namely the M out of N, MooN, architectural concept [START_REF] Parhami | Voting Algorithms[END_REF]]. Wayside as well as ground as well as on-board equipment consist of replicated cards, typically 3 times. The communication is done via replicated lines (typically) two.

In case of MooN replication, the objective is to enhance the availability of a system while decreasing the probability of errors. MooN is not a single pattern, but merely an S&D pattern system that have different scopes: "node replication", "Voter" and "Communication protection". In Figure 2, the responsibility for safety is shared between the safe application (which is replicated 3 times), the voter and the communication protection. In terms of safety, they shall present, i.e. they are allocated, the same SIL level. Now, we describe the pattern system and its constituent parts using a simple template.

MooN pattern system can be described as the following:

-Intent: manage dependability and communication for distributed functions.

-Context: use selected platforms with known availabilities of components and replication capabilities -Solution: assemble and parametrize pre-designed reference architectures as pre-qualified solutions.

-Pattern language: it is composed of three S&D patterns: node replication, voter and communication protection patterns.

Node replication pattern This pattern allows the used of set of processing resources for the same task. It can be described as the following pattern:

-Intent: assure a high required availability with a set of hardware components. The individual failure rate of each of these component would not guarantee alone the required availability. The balance in the replication decision is in the amount of communication traffic. -Context: safety applications with high availability -Solution: replicate hardware, typically by using an equipment with multiple processing cards. Each card may either run the same or a diversified application software. The latter is used to protect against software faults. Results (including intermediate results) need to be synchronized between the cards by means of a voter.

Voter pattern In addition, each replica should receive identical inputs and outputs are voted. Intermediate results can be, but do not need to be voted. The voter pattern is a safe arbitrator of replica outputs which uses the safety strategy of the platform and returns to the application its conforming status. So, the replica can decide to isolate itself definitely as invalid data producer. The voter pattern can be described as the following pattern:

-Intent: evaluate a set of data inputs and make a majority vote, either accept only identical values or also those within a predefined error range. The balance in the decision must respect safety integrity level and performance constraints -Context: either a hardware device or a pure software function.

-Solution: interface the hardware voter or spread the voter function between the hardware cards. Manage the quality of service with the voter parameters.

Communication protection pattern This pattern provides a service which ensures that the data from the sender arrives to the receiver in an ordered way and been prepared to correct a fault in the message, avoiding any kind of resending. This is achieved by build a safety interface in both sides of the channel and will comply EN 50159 [CENELEC 2010]. This pattern has multiple objectives:

(1) managing throughput: if different parts of a message are sent over the communication lines,

(2) enhanced availability and response time: when multiple identical messages are sent and depending on the validity check strategy or

(3) enhanced safety: the message can only be decoded, if different parts of it are received via both lines.

The communication protection pattern can be described as the following pattern:

-Intent: assure integrity of data passed over a communication link. The balance is between the portability (without re-qualification on each platform), conformity with standards, and the continuous possibility to upgrade while in operation The equipment communication is providing the external exchange facilities, usually a redounded IP communication through Ethernet and Radio; it is not modeled as a pattern.

The outlined patterns do not only address software, but also hardware and allocation. Software and hardware components are enriched with non-functional properties that describe the requirements on the software side and capabilities on the hardware side (e.g. reliability of processing modules or data link). Thus, we can only reason about the replication architectures (and patterns), if the modeling language is sufficiently rich to represent the properties of roles that are identified within a pattern. In section 4.3 we tackle the use of a suitable system modeling language that supports component-based architectures with non-functional properties.

Another aspect is the importance of validation: a major added value of applying the example patterns is to assure that a desired property, for instance a required availability or the protection of the communication channel is actually achieved. Thus, we need to trace pattern application and execute validation rules defined within the patterns, as addressed in section 5.

System and Software Engineering Pattern Metamodel -SEPM

Our pattern specification language is described using a meta-model which we call System and Software Engineering Pattern Metamodel (SEPM). It constitutes the base of our pattern modeling language, describing the concepts (and their relations) required to capture all the facets of patterns.

The principal classes of the metamodel are described with ecore notation -a core element of the Eclipse modeling framework6 notation in Fig. 3 and the link with the property models. Security and Dependability (S&D) and resource models are used as model libraries to define the S&D and resource properties and constraints of the pattern. The reader is referred to [START_REF] Ziani | Towards a unified meta-model for resources-constrained embedded systems[END_REF]] for a full description of the properties metamodel. Note, however, that in concept such a modeling part is similar to the one proposed in [START_REF] Omg | OMG. A UML Profile for MARTE: Modeling and Analysis of Real-Time Embedded Systems,beta 2. OMG[END_REF]].

In addition to defining pattern concepts, the pattern metamodel provides an instantiation mechanism that enables the separation between the domain independent and domain specific on the one hand, and between the level of design on the other hand. The elements of the meta model are described in the sequel through the example of communication protection pattern presented previously. Note, however, that for the sake of clarity we only detail those elements related to S&D concerns. -DIPattern. This block represents a modular part of a system that encapsulates a solution of a recurrent problem. A DIPattern defines its behavior in terms of provided and required interfaces. As such, a DIPattern serves as a type whose conformance is defined by these provided and required interfaces. A DIPattern may be manifest by one or more artifacts, and in turn, that artifact may be deployed to its execution environment. The DIPattern has some fields to describe the related recurring design problem that arises in specific design contexts. These fields are based on the GoF [START_REF] Gamma | Design Patterns: Elements of Reusable Object-Oriented Software[END_REF]]. This is the key entry artifact to model pattern at domain independent level. -Interface. DIPattern interacts with its environment via interfaces that have a modeling-specific representation.

-Property. Is a particular characteristic of a pattern. Each property of a pattern will be validated and the used assumptions will be compiled as a set of constraints. For our example, we define the following properties:

-integrity of data. whenever some data d is received by the application receiver R, that same data d is send out by the application sender S. -data freshness. it is often desired that transmitted data d is fresh in terms of recentness. This property states that whenever an application receiver R receives some data d, the same data was sent by the application sender S at most Delta t ago. -non duplication. given some data, that is sent by the application sender S, a receiver R will get this data at most the same number of times it was sent. -Constraint. A set of requisites of the pattern. If the constraints are not met, the pattern will not be able to deliver its properties. For our example, we may specify constraints on the CRC computation/checking algorithms, on the correct/incorrect transmission over the network and on the maximal network delay. -Internal Structure. Constitutes the implementation of the solution proposed by the pattern. Thus the InternalStructure can be considered as a white box which exposes the details of the DIPatterns. In our case, the internal structure is given by a means of a UML model, UML diagrams presenting the solution are presented in the next section.

Profile

As explained at the end of the example section, a modeling language for dependable systems with replication needs to be sufficiently rich to capture properties of the domain, such as hardware capabilities or interaction properties. Since UML is extensible via profile and widely used, we choose it as modeling language for application development. It is enriched via the profile MARTE for non-functional properties, and the profile FCM providing a flexible component model that enables us to refine ports, connectors and containers. For more information on FCM, consult [START_REF] Jan | Flex-eWare: a flexible model driven solution for designing and implementing embedded distributed systems[END_REF], in the scope of this paper it is sufficient that FCM enables us to precise how interactions between components are realized. A further profile allows us to state whether a component is replicated and which replication schema (passive, active with vote, ...) shall be used.

Since UML is the base modeling language, we define a specification language for S&D pattern by means of a UML profile. The resulting profile allows pattern authors to use UML to specify S&D patterns. In addition to the concepts of the meta-model, we provide new capabilities for pattern application and traceability within the pattern specification language. In the next section, we show (1) how these techniques are developed and integrated into the UML editor Papyrus7 , and (2) how a pattern is applied during an engineering process for modeling applications with S&D requirements. In the sequel, we describe the most important elements of the profile.

-Pattern -description. the design pattern is principally a (named) holder for the description of problem, the solutions and the properties of these solutions. -modeling solution. a suitable and intuitive option is to map it to a UML package, i.e. to extend the UML meta-model element "package" with a stereotype "Pattern". All elements that further characterize the pattern are elements within this package. Fig. 4 shows the definition of the MooN pattern system by means of UML and the design pattern profile. The MooN pattern itself is a UML package, problem and intention are stereotyped comments. Global properties, such as the reference level are specified by means of the profile. The sub patterns appear as nested packages. -modeling solution. We model properties via profiles dedicated to safety-critical systems. The mentioned hardware capability is a stereotype with two attributes: availability and error rate. Values for those are specified using MARTE's value specification language. We do not enter into more details, as this is not the focus of this paper. -Constraint -description. A constraint that is defined over the roles within a pattern.

-modeling solution. A UML constraint specified either via OCL or Java. This constraints references the associated roles via its constrained elements link. An example of a constraints is the calculation of the availability in function of the number of replicas. -Role -description. Identify a role within a collaboration -modeling solution. We use the standard UML mechanism of a role within a UML collaboration, as shown in the state of the art in section 2. Roles are attributes within the collaboration, i.e. named and typed parts within the collaboration (similar to a composite class). The type may be used to characterize the role, e.g. by defining obligatory ports or associations. Fig. 5 shows the formalization of two patterns, on the left-hand side the voter pattern, on the righthand side the protection of communication between equipments. The former identifies two communicating safety-applications (application1 and application2) as roles, the latter in addition the hardware equipments (equipment1 and equipment2, each containing a fixed number of replicated cards) on which the applications are allocated. Please note that we use a generalization relationship between the solution class and the collaboration defining roles. Whereas a solution is not a specific variant of a collaboration capturing roles, the main objective is to provide a pragmatic way to enable referencing (inherited) roles within a solution. Please note that we show a variant of the patterns dedicated to two collaborating applications, in general, an arbitrary number of applications can be modeled via the cardinality of the roles. Please also note, that this formalization only holds in the context of component-based development (and not e.g. object-oriented development), in which hardware elements are also represented by parts in a certain way in the system model. Whereas it is possible to specify roles and solution in the same collaboration, we often separate these two, letting the solution inherit from the collaboration. This enables the specification of multiple solutions for the same set of roles. If separated, the solution refines the role collaboration via inheritance, enabling the reuse of the roles that are already defined. In many cases, roles re-appear directly in a solution with new connections or associations, as in case of the inter equipment communication: the equipment roles have a dual connection and the applications pass data to/from a protection and selection component, respectively. Note that the connections between equipment1 and equipment2 represent physical links.

-Trace -description. We need to identify two different kinds of traces. One links an element of the application model to a role defined within a pattern. The constraints defined within a pattern use the binding information to validate the bound application model elements. The second kind of trace is a link between the pattern and requirements. Their modeling is not in the scope of this paper. -modeling solution. Use a stereotyped UML collaboration-use. The stereotype attributes store information when and by whom the pattern has been applied. The collaboration use has several role binding relationships to roles defined in the pattern. This is shown in Fig. 6 for the example of a CBTC system: the collaboration-use element in the middle contains the binding relationships, e.g. from cbtcApp to swComp1. In the used UML modeler, the targets of the role binding are only shown by their name. Therefore, we added stereotyped dependencies to the elements of the pattern solution (in the right hand side of the figure 6) for illustration purposes -we did that for the two software components only, the other elements are bound as well in the model. We do not need extra specification of traceability such as proposed by [START_REF] Mirakhorli | A pattern system for tracing architectural concerns[END_REF], since this binding to a role within a pattern serves as traceability link. An interesting aspect is that one of the patterns proposed by Mirakhorli and Cleland-Huang enriches the semantics of a traceability link by mapping it to a common proxy instead of distinguishing several kinds of trace relationships. The same is true for establishing a binding with a role within the pattern, since this role provides an implicit semantics for the traceability link behind the binding.

INTEGRATING DESIGN PATTERNS INTO THE DEVELOPMENT PROCESS

This section focuses on the use of safety patterns. We sketch the user guide in order to identify the requirements to adapt tools such as the Eclipse platform. The user shall follow the steps selection, instantiation, integration and validation. The usage context is the design of the software application, in our case a component model for a CBTC equipment. The MooN pattern is the upper part of the middleware that is hosting the application component; it is mainly a container providing availability. The rest or lower part of the middleware has to provide the vote between safe replicas and safety protected communication between replica and the voter and from/to the outside of the equipment. Fig. 7 shows a development process with design patterns, starting with an initial architecture (which may be quite incomplete). The use of a pattern is an iterative process in which the user has to perform a set of actions: the first is to select a pattern from a set of available patterns. This choice may be filtered in a suitable way by the tool, as shown in section 5.1. It is followed by the integration of the selected pattern into the application model in section 5.3. Integration consists in copying elements of the pattern into the application model or binding existing elements to roles within the pattern. It is important to keep the role binding information to enable a trace that the pattern has been applied. Since a pattern is not a fixed solution, the application is typically adapted after pattern integration. Therefore, we need to ensure that these modifications do not violate assumptions that are made by the pattern. This is done by validation mechanisms, outlined in section 5.4.

Pattern selection

The selection of a design pattern is a primarily a choice of the developer. There are different aspects that may narrow and thus simplify the choice. The first is the objective of the pattern application. While it can not be formalized in general, some patterns address requirements that are defined by safety standards. If these requirements are stored in a model library and the pattern definition references the requirements, the pattern selection could be driven by the selection of a (safety) requirement. The second aspect is that patterns can be classified with respect to several properties. One is the reference level identified in section 4: a pattern may be relevant for the system, its architecture, its design or implementation aspects. Thus, it must be possible to filter available patterns with respect to this classification.

Role binding

As shown in the preceding section (paragraph trace), a binding between elements of the application architecture and a role defined in the pattern needs to be established. The developer is supported by the integration tool in two different ways. The first is to show only a filtered selection of possible elements for binding, in case of the equipment only those with replicated cards are candidates for binding. The second is to create bindings completely automated, for instance if application components affected by replication can be identified via the allocation to an equipment that has replicated cards. If a role remains unbound during integration, the developer indicates that no element of the application corresponds to it and the element must thus be created in the application model.

Pattern integration

Pattern integration means to apply a solution that is proposed by a design pattern in an existing application architecture. We may not simply copy such a solution into the architecture, but need to take the binding (previous section 5.2) of elements already existing in the application to roles identified in pattern into account. The challenge of this task is that relationships (e.g. connections, associations or inheritance) defined between roles in the pattern definition must be established in the application model as well. For example, the solution of the MooN pattern defines that the communication between a producer and a consumer is done by means of a dedicated interaction component that takes care of passing exchanged data to the voter, as shown in Fig. 5. However, application1 and application2 might already be connected via a different interaction component that is conflicting with the proposition in the pattern. Currently, applying a pattern adds new connections, associations, etc. and the user has to resolve potential conflicts. We aim to automate the detection of conflicts and propose solutions in a similar way as merge tools work.

Pattern validation

Design patterns have certain constraints that must hold while allowing a certain degree of modifications. For instance, the MooN pattern requires that software parts with a required availability need to be allocated to an equipment with a suitable number of replicated cards. This number needs to be calculated the moment the pattern is integrated, but the developer may exchange the hardware after the pattern integration has been done. The new hardware might have different capabilities that change the number of required replicas. Thus, there is a need to assure that properties of the pattern remain valid while not preventing modifications (such as for instance a renaming). The basis for traceability are the binding relationships between elements of the application architecture and roles identified in the pattern.

A verification rule associated with the pattern assures that invariants of the pattern can be checked after the pattern has been applied. In case of the MooN pattern, we implemented several constraints compatible with the Eclipse EMF validation framework. An example of such a rule is a check that the model element that is bound to the "equipment role" identified in the pattern is a hardware node containing the required number of replicated cards. The validation rules are currently implemented in Java, alternatively, a constraint language such as OCL could be used. However, the realization of such rules is not in the focus of this paper. The system development tool supports the pattern application. Fig. 9 shows a screen-shot of the pattern selection (on the left) and role-binding dialog (on the right) supported by our tool. The example is based on the communication protection pattern. Once a pattern is selected, roles need to be bound. The tool shows the available roles and displays candidates for binding. Roles can be bound automatically, if the pattern definition provides a Java function with this support. If a pattern is applied, an associated collaboration role containing role bindings is added to the system model.

After pattern allocation and deployment, a further model-to-model transformations support the expansions of connectors to interaction components and the code is finally deployed on a middleware such as DDS or MyCCM. Both aspects are out of scope for this paper.

CONCLUSIONS

Traditionally, design patterns are advantageous for solution reuse, however, they are hardly used when it comes to safety. This paper shows that safety design patterns have specific challenges related to the integration of safety requirements within the design pattern and their respect all along the process of system design. Since a solution proposed by a pattern is typically manually adapted to the concrete application context, we need to assure that this adaptation does not break the pattern's leitmotiv. Therefore, invariants of the pattern are checked by associated validation rules. To this aim, we propose the meta-model SEPM that enables to organize design patterns into a library easing their classification and their search. We further propose a UML profile that focuses on the description of pattern solutions with UML.

Some stereotypes in the profile contain information that is already present in the SEPM modeling-language, for instance the problem statement. We allow this duplication in order to enable a pattern developer to specify a complete pattern in a single environment. A transformation (in our case implemented with the OMG standard QVT -Query/View/Transformation) synchronizes the information, e.g. the problem statement between the UML model and the above-introduced SEPM modeling language, neutral pattern repository.

As a proof of concept, we evaluate our framework through the example of the MooN pattern for building systems having safety requirements as CBTC. As continuity to our present work, we envision to extend our tools in order to automate the whole process of design pattern definition, storage, search and application and offer a complete framework that supports pre-certified, safety-oriented design patterns. The application of such design patterns lightens certification steps that safety systems have to undergo.

Fig. 1 .

 1 Fig. 1. Overview of a pattern enabled development processes

Fig. 2 .

 2 Fig. 2. Functions of a CBTC platform spread over two equipments and using MooN pattern

-

  Context: distributed communication between equipments -Solution: use a message transformation architecture -assemble a set of fixed transformations in a specific order. A transformation could piggyback additional data (notably CRC data) to messages or perform more complex transformations such as encryption and splitting. Each transformation has a proven, unchangeable solution complying with EN50159 [CENELEC 2010].

Fig. 3 .

 3 Fig. 3. The (simplified) SEPM metamodel

  Fig. 4. The MooN design pattern modeled with UML and the design pattern profile -Property -description. An intrinsic property of a pattern along with a value. It might reference a safety property defined by a standard, for instance the safety integrity level. Further examples are properties of the referenced model elements, such as a hardware capability.-modeling solution. We model properties via profiles dedicated to safety-critical systems. The mentioned hardware capability is a stereotype with two attributes: availability and error rate. Values for those are specified using MARTE's value specification language. We do not enter into more details, as this is not the focus of this paper. -Constraint -description. A constraint that is defined over the roles within a pattern.-modeling solution. A UML constraint specified either via OCL or Java. This constraints references the associated roles via its constrained elements link. An example of a constraints is the calculation of the availability in function of the number of replicas. -Role -description. Identify a role within a collaboration -modeling solution. We use the standard UML mechanism of a role within a UML collaboration, as shown in the state of the art in section 2. Roles are attributes within the collaboration, i.e. named and typed parts within the collaboration (similar to a composite class). The type may be used to characterize the role, e.g. by defining obligatory ports or associations. Fig.5shows the formalization of two patterns, on the left-hand side the voter pattern, on the righthand side the protection of communication between equipments. The former identifies two communicating safety-applications (application1 and application2) as roles, the latter in addition the hardware equipments (equipment1 and equipment2, each containing a fixed number of replicated cards) on which the applications are allocated. Please note that we use a generalization relationship between the solution class and the collaboration defining roles. Whereas a solution is not a specific variant of a collaboration capturing roles, the main objective is to provide a pragmatic way to enable referencing (inherited) roles within a solution. Please note that we show a variant of the patterns dedicated to two collaborating applications, in general, an arbitrary number of applications can be modeled via the cardinality of the roles. Please also note, that this formalization only holds in the context of component-based development (and not e.g. object-oriented development), in which hardware elements are also represented by parts in a certain way in the system model.

Fig. 5 .

 5 Fig. 5. Two patterns of the MooN pattern system: vote and communication protection -Solution -description. This element is a description of structure (or behavior) of a solution to the problem stated in the design pattern. For our context, the focus is to show the structure of a solution. -modeling solution.The solution is a stereotyped collaboration. An example is shown in Fig. 5.

Fig. 6 .

 6 Fig. 6. Achieve traceability via role binding for the communication protection example

Fig. 7 .

 7 Fig. 7. The development process when using patterns

Fig. 8 .

 8 Fig. 8. Developed tool-chain

Fig. 9 .

 9 Fig. 9. Example of a pattern selection and application dialog including role binding

In the sequel, we explicitly include functional safety when we talk about S&D.

SIRSEC: Safe Distributed Information System (Système d'Information Réparti Sécuritaire).

http://www.semcomdt.org

http://eclipse.org/papyrus/

netbeans: http://netbeans.org/ StarUML: http://staruml.sourceforge.net/en/

http://www.eclipse.org/modeling/emf/

http://eclipse.org/papyrus/

Acknowledgment. This work was partially supported by the FUI (Fond Unique Interministeriel) project SIRSEC, the Systematic and i-Trans clusters and FEDER. We like to thank our shephard Uwe Zdun and the participants of the Europlop writers workshop for their constructive critic and valuable hints for improvement of this paper.


Martín I Idiart

Pierre-Guy Vincent

A generalized-secant homogenization scheme for viscoplastic polycrystalline solids under imposed deformations

Keywords: polycrystals, plasticity, homogenization, softening polycristaux, plasticité, homogénéisation, adoucissement

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

This work is concerned with homogenization techniques for correlating the macroscopic viscoplastic response of polycrystalline solids with the flow rules governing microscopic viscoplastic slip. We consider polycrystals consisting of a random aggregate of perfectly bonded single crystals (i.e., grains) of a similar size, much smaller than the specimen size and the scale of variation of the applied loads, distributed in a statistically uniform and ergodic fashion. In the current configuration of the aggregate at a generic stage of deformation, the grain orientations are assumed to take on a set of N discrete values, characterized by rotation tensors Q (r) (r = 1, ..., N ). All grains with a given orientation Q (r) occupy a possibly disconnected domain and are collectively referred to as 'phase' r. For definiteness, we focus on material systems made up of single crystals deforming along K slip systems according to microscopic flow rules of the form

D = ∂u ∂σ (x, σ) with u(x, σ) = N r=1 χ (r) (x)u (r) (σ), u (r) (σ) = K k=1 ψ (r) (k) σ • µ (r) (k) , (1)
where D and σ are the Eulerian strain rate and Cauchy stress tensors, χ (r) are the characteristic functions of each phase r, ψ

(k) are convex viscoplastic slip potentials, and µ

(k) are the Schmidt tensors indicating slip directions. The macroscopic homogenized response of the polycrystal is then given by (e.g., [START_REF] Liu | Second-order theory for the effective behavior and field fluctuations in viscoplastic polycrystals[END_REF])

D = ∂ u ∂σ (σ) with u(σ) = min σ∈S(σ) u(x, σ) = min σ∈S(σ) N r=1 c (r) u (r) (σ) (r) , (2)
where D = D and σ = σ , • and • (r) denote volume averages over the aggregate and over phase r, respectively, c (r) is the volume fraction of phase r, and S(σ) is the set of statically admissible stress fields with average σ. Amongst the various quasi-analytical techniques available to estimate the macroscopic potential u in terms of the microscopic properties, the so-called 'generalized-secant technique' proposed by Liu & Ponte Castañeda [START_REF] Liu | Second-order theory for the effective behavior and field fluctuations in viscoplastic polycrystals[END_REF] seems to deliver the most accurate estimates to date -see, for instance, refs. [START_REF] Lebensohn | Dilatational viscoplasticity of polycrystalline solids with intergranular cavities[END_REF][START_REF] Liu | Homogenization estimates for the average behavior and field fluctuations in cubic and hexagonal viscoplastic polycrystals[END_REF][START_REF] Liu | Variational self-consistent estimates for texture evolution in viscoplastic polycrystals[END_REF]. This technique is based on the concept of 'linear-comparison medium' whereby the variational problem (2) 2 is rewritten in terms of linearized microscopic slip potentials so that linear homogenization techniques, such as the well-known Self-Consistent technique [START_REF] Willis | Variational and related methods for the overall properties of composites[END_REF], can be used to approximate the nonlinear macroscopic potential. The resulting estimates are computationally inexpensive relative to full-field simulations, but they still require the numerical resolution of a large set of nonlinear algebraic equations. This fact can become an issue when simulating mechanical processess where deformations are imposed, which require inversion of the above constitutive description in order to express stresses in terms of strain rates; this can be particularly crucial in problems where the material exhibits softening.

The purpose of this work is to derive generalized-secant estimates for the inverted stress-strain-rate relation by applying the strategy of Liu & Ponte Castañeda [START_REF] Liu | Second-order theory for the effective behavior and field fluctuations in viscoplastic polycrystals[END_REF] directly to the dual problem of (2). This problem was not tackled in ref. [START_REF] Liu | Second-order theory for the effective behavior and field fluctuations in viscoplastic polycrystals[END_REF] because the dual potential of u (r) does not exhibit the additive form (1) 2 on which the linearization strategy hinges. However, well-known results of convex analysis (e.g., [START_REF] Van Tiel | Convex Analysis[END_REF]) do permit to write the inverted microscopic flow rule as

σ = ∂w ∂D (x, D) with w(x, D) = N r=1 χ (r) (x)w (r) (D), w (r) (D) = min γ (r) (k) ∈Γ (r) (D) K k=1 φ (r) (k) γ (r) (k) ,( 3
)
Email addresses: martin.idiart@ing.unlp.edu.ar, pierre-guy.vincent@irsn.fr (Pierre-Guy Vincent).

2

where

φ (r) (k) (γ) = sup τ τ γ -ψ (r) (k) (τ ) (4)
is the Legendre transform of the slip potentials ψ (r) (k) and

Γ (r) (D) = γ (r) (k) (k = 1, ...K) such that K k=1 γ (r) (k) µ (r) (k) = D , (5)
and to invert the macroscopic constitutive relation [START_REF] Idiart | Macroscopic behavior and field statistics in viscoplastic composites[END_REF] to

σ = ∂ w ∂D (D) with w(D) = min D∈K(D) w(x, D) = min D∈K(D) N r=1 c (r) w (r) (D) (r) , (6)
where K(D) is the set of kinematically admissible strain-rate fields with average D. Thus, the form (3) 2 for the dual potential w (r) exhibits an additive form analogous to that of u (r) , except for an additional minimum operation. This fact is exploited next to derive generalized-secant estimates for the potential w.

The accuracy of the resulting estimates is then preliminarily assessed in the context of a model material system.

2. A strain-rate formulation of the generalized-secant scheme

An estimate for the effective potential

Following the strategy of Liu & Ponte Castañeda [START_REF] Liu | Second-order theory for the effective behavior and field fluctuations in viscoplastic polycrystals[END_REF], we begin by expressing the slip potentials φ

(r) (k) in the alternative form φ (r) (k) (γ) = stat α (r) (k) ≥0 φ(r) (k) γ; α (r) (k) + v (r) (k) α (r) (k) , (7)
where the functions φ(r) (k) denote comparison slip potentials given by φ(r)

(k) γ; α (r) (k) = φ (r) (k) γ(r) (k) + φ (r) ′ (k) γ(r) (k) γ - γ(r) (k) + 1 2 α (r) (k) γ - γ(r) (k) 2 , (8)
and

v (r) (k) α (r) (k) = stat γ(r) (k) φ (r) (k) (γ (r) (k) ) - φ(r) (k) γ(r) (k) ; α (r) (k) . (9)
In these expressions, α

(k) and γ(r) (k) represent uniform-per-phase slip viscosities and reference slip rates, respectively, the stat denotes a stationary operation, and the prime denotes differentiation. Expression ( 7) is valid provided the correct stationary point is chosen in v (r) (k) . The reader is referred to [START_REF] Liu | Second-order theory for the effective behavior and field fluctuations in viscoplastic polycrystals[END_REF] for details on the derivation of analogous expressions in terms of the stress potentials ψ

(r) (k) .
Introducing the representation [START_REF] Liu | Second-order theory for the effective behavior and field fluctuations in viscoplastic polycrystals[END_REF] for the slip potentials in expression (3) we obtain the alternative representation for the phase potentials

w (r) (D) = stat α (r) (k) ≥0 ẘ(r) D; α (r) (k) + K k=1 v (r) (k) α (r) (k) , (10)
where the functions ẘ(r) are comparison phase potentials given by ẘ

(r) D; α (r) (k) = min γ (r) (k) ∈Γ (r) (D) K k=1 φ(r) (k) γ (r) (k) . (11)
In deriving [START_REF] Van Tiel | Convex Analysis[END_REF] we have commuted the stationary and the minimum operations based on the same arguments of ref. [START_REF] Liu | Second-order theory for the effective behavior and field fluctuations in viscoplastic polycrystals[END_REF]. Introducing expression [START_REF] Van Tiel | Convex Analysis[END_REF] in ( 6) and commuting, once again, the stationary and minimum operations gives the approximate stationary estimate

w(D) = stat α (r) (k) ≥0 ˚ w(D; α (r) (k) ) + N r=1 K k=1 c (r) v (r) (k) α (r) (k) , (12)
where ˚ w(D; α

(r) (k)
) is the effective potential of a comparison polycrystalline solid with the same microstructure as the original solid but with slip potentials φ(r) (k) as given by ( 8). Thus, this expression provides a nonlinear estimate given any linear homogenization estimate for the comparison potential ˚ w.

The comparison polycrystal

The potential (8) can be written in the alternative form

φ(r) (k) γ; α (r) (k) = 1 2 α (r) (k) γ 2 + e (r) (k) γ + f (r) (k) , (13) where e (r)
(k) = φ (r) ′ (k) γ(r) (k) -α (r) (k) γ(r) (k) and f (r)
(k) = φ (r) (k) γ(r) (k) -φ (r) ′ (k) γ(r) (k) γ(r) (k) + 1 2 α (r) (k) γ(r) 2 (k) . (14)
Performing the minimization in [START_REF] Willis | Variational and related methods for the overall properties of composites[END_REF] we obtain

ẘ(r) D; α (r) (k) = 1 2 D • L (r) D + τ (r) • D + f (r) , (15)
where

L (r) = K k=1 (α (r) (k) ) -1 µ (r) (k) ⊗ µ (r) (k) -1 , (16)
τ (r) = L (r) K k=1 (α (r) (k) ) -1 e (r) (k) µ (r) (k) , (17)
f (r) = 1 2 τ (r) • (L (r) ) -1 τ (r) + K k=1 f (r) (k) - 1 2 (α (r)
(k) ) -1 (e (r) (k) ) 2 . ( 18
)
Thus, the effective potential ˚ w can be written as

˚ w(D; α (r) (k) ) = ˚ w(D; α (r) (k) , e (r)
(k) , f (r) (k) ) = 1 2 D • LD + τ • D + f (19)
where L, τ and f are the effective properties of the linear comparison polycrystal. Their expressions in terms of the local properties L (r) , τ (r) and f (r) will depend on the linear homogenization scheme employed.

The stationarity conditions

The stationarity conditions in ( 9) and ( 12) lead to a system of nonlinear equations for the set of variables α (r) (k) and γ(r) (k) given by

φ (r) ′ (k) (γ (r) (k) ) -φ (r) ′ (k) (γ (r) (k) ) = α (r) (k) (γ (r) (k) - γ(r) (k) ), (20) (γ (r)
(k) - γ(r) (k) ) 2 = 2 c (r) ∂ ˚ w ∂α (r) (k) (D; α (r) (k) ) ≡ (γ (r) (k) - γ(r) (k) ) 2 (r) , (21)
with k = 1, ..., K and r = 1, ..., N . The first set of equations (20) states that the optimal slip viscosities α

(k) are given by generalized secant linearizations of the nonlinear functions φ (r) ′ (k) passing through the points γ(r) (k) and γ(r) (k) , while the second set of equations states that the optimal γ(r) (k) are related to the intraphase fluctuations of the slip rates γ (r) (k) about γ(r) (k) in the linear comparison polycrystal. The last identity follows from well-known results for field statistics in heterogeneous media (e.g., [START_REF] Idiart | Field statistics in nonlinear composites[END_REF]). We refer to [START_REF] Liu | Second-order theory for the effective behavior and field fluctuations in viscoplastic polycrystals[END_REF] for further discussions on these type of conditions.

The reference slip rates

The estimate (12) is valid for any choice of reference strain rates γ(r) (k) . Thus far, no stationarity condition has been found for these parameters, and only physically motivated prescriptions are considered.

The simplest choice is

γ(r) (k) = 0. (22)
In this case, the linearization (20) becomes a secant condition through the γ(r) (k) , and the estimate (12) can be shown to reduce to the dual version of the secant estimate of deBotton & Ponte Castañeda [START_REF] Debotton | Variational estimates for the creep behavior of polycrystals[END_REF]. These estimates are only exact to first order in the heterogeneity contrast.

Another possible choice is to identify the reference slip rates with the corresponding phase averages of the slip rates in the linear comparison polycrystal:

γ(r) (k) = γ (r) (k) (r) ≡ γ (r) (k) , (23)
which can be computed from ˚ w making use of the identity (e.g., [START_REF] Idiart | Field statistics in nonlinear composites[END_REF])

γ (r) (k) = 1 c (r) ∂ ˚ w ∂e (r) (k) (D; α (r) (k) , e (r) (k) , f (r) (k) ). ( 24
)
This is analogous to the choice employed by Liu & Ponte Castañeda [START_REF] Liu | Second-order theory for the effective behavior and field fluctuations in viscoplastic polycrystals[END_REF] in their stress formulation, and can be shown to deliver estimates that are exact to second order in the contrast. Despite the analogy, it can be shown that there is a duality gap between the resulting estimate (12) and its stress formulation, in general. However, the results provided below show that this gap is very small and can even vanish in some limiting cases. With the choice (24), expressions (20), ( 21) and (24) constitute a system of 3N × K nonlinear algebraic equations for the variables α (r) (k) , γ(r) (k) and γ (r) (k) , which must be solved numerically, in general.

Other prescriptions are certainly possible but will not be considered here for brevity.

Alternative form of the estimate

Making use of the stationarity conditions (20) and ( 21), it can be shown that the estimate (6) admits the alternative form

w(D) = N r=1 K k=1 c (r) φ (r) (k) (γ (r) (k) ) -φ (r) ′ (k) (γ (r) (k) ) γ(r) (k) -γ (r) (k) , (25)
which proves more convenient for computational purposes.

Sample results for a model crystalline solid with second-phase inclusions

Problem setting and formulae

By way of example we consider a special class of two-phase crystalline solids with 'particulate' microstructures, consisting of aligned cylindrical inclusions (r = 2) that are distributed randomly and isotropically in a viscoplastic monocrystalline matrix phase (r = 1). It is assumed that the cylindrical inclusions are aligned with the e 3 direction, and that the crystalline matrix deforms along slip systems with Schmid tensors

µ (k) = 1 2 (n (k) ⊗ e 3 + e 3 ⊗ n (k) ) with n (k) = cos θ (k) e 1 + sin θ (k) e 2 , (26)
where {e 1 , e 2 , e 3 } forms an orthonormal basis. The slip potentials are taken to be of the power-law form

ψ (k) (τ ) = γ0 τ 0 1 + n τ τ 0 1+n ⇒ φ (k) (γ) = γ0 τ 0 1 + m γ γ0 1+m , (27)
where τ 0 and γ0 denote the flow stress and the reference strain rate of the slip system, n is a nonlinearity exponent, and m = 1/n is the strain-rate sensitivity such that 0 ≤ m ≤ 1. The limiting values m = 1 and m = 0 correspond to a linearly viscous and a rigid-perfectly plastic behavior, respectively. For simplicity, we assume that all slip systems have the same constitutive constants n, τ 0 and γ0 . The two-phase crystal is subjected to anti-plane loadings so that the relevant viscoplastic boundary value problem becomes a vectorial, two-dimensional problem, where the non-zero components of the stress and strain-rate vectors, namely, σ 13 , σ 23 , D 13 and D 23 , are functions of x 1 and x 2 only.

In order to assess the sensitivity of the predictions on material anisotropy, we consider three different matrix materials with sets of angles θ (k) given by {0, π/2}, {0, ±π/3}, and {0, ±π/4, π/2}, which correspond to square (K = 2), hexagonal (K = 3), and octagonal (K = 4) symmetry, respectively. In the linear case, the anti-plane response of the matrix is actually isotropic for the three families of slip systems. In the nonlinear case, however, the response is anisotropic, such that in the ideally plastic limit it defines a polygonal yield surface in the σ 13 -σ 23 stress space, as shown in figure 1. Note that as the number of slip systems K increases, the potential approaches an isotropic yield surface with flow stress τ 0 .

For brevity, we restrict attention to material systems with either voided or rigid inclusions, which correspond to the cases of extreme heterogeneity contrast and, as such, are particularly relevant for testing the capabilities of the new scheme. In these cases, the macroscopic potential w can be shown to be of the form

w(D) = τ 0 (θ) γ0 1 + m D e γ0 1+m , (28)
where D e = (D

2 13 + D 2 23
) 1/2 and θ = tan -1 (D 23 /D 13 ) are the macroscopic strain rate magnitude and direction, respectively. Thus, the macroscopic response can be completely characterized by the effective flow stress τ 0 (θ) only. The generalized-secant estimate (25) for w with the prescription (23) leads to the estimate

τ 0 τ 0 (θ) = (1 -c) K k=1      γ (1)
(k) D e   1+m -(1 + m)   γ (1) (k)
D e   m   γ (1)
(k) D e - γ (1) (k)
D e      (29)
for the effective flow stress of the material systems under consideration, where c denotes the volume fraction of inclusions. For the case of macroscopic loadings along the direction of a slip system (i.e., θ = θ (k) ) and the effective potential of the linear comparison medium computed by means of the Hashin-Shtrikman estimates of Willis [START_REF] Willis | Variational and related methods for the overall properties of composites[END_REF], the system of equations for the quantities γ(1) (k) /D e and γ

(k) /D e can be written as γ(1) where

(k) D e = γ (
λ -1 = K k=1 cos 2 θ (k) α (k) , λ -1 ⊥ = K k=1 sin 2 θ (k) α (k) , a = λ λ ⊥ , η = K k=1   1 α (k)   γ (1) (k) D e   m - γ (1) (k) D e   cos θ (k) , (31)
α (k) = γ(1) (k) /D e m -γ (1)
(k) /D e m γ(1) (k) /D e -γ (1)
(k) /D e , (32)
and the coefficients A and B depend on the inclusion type. For the case of voided crystals:

A = 1 + η 1 + c √ a 2 and B = 1 + η 1 + c √ a ; ( 33
)
while for the case of rigidly reinforced crystals:

A = a -1 (1 -c) 2 and B = 1 (1 -c) + η. (34)

Results and discussion

Figure 2 shows plots for the effective flow stress of voided and rigidly reinforced crystals loaded along the direction of a slip system, as a function of the strain-rate sensitivity m, for the choice c = 0.25. The new generalized-secant estimates (GSEC-γ) of the Hashin-Shtrikman type are compared with the elementary bounds of Taylor and Reuss, the corresponding secant estimates (SEC) of deBotton & Ponte Castañeda [START_REF] Debotton | Variational estimates for the creep behavior of polycrystals[END_REF], and the stress-based generalized-secant estimates (GSEC-τ ) of Liu & Ponte Castañeda [START_REF] Liu | Second-order theory for the effective behavior and field fluctuations in viscoplastic polycrystals[END_REF]. Analytical expressions for various estimates applied to this model problem can be found in refs. [START_REF] Idiart | Macroscopic behavior and field statistics in viscoplastic composites[END_REF][START_REF] Idiart | Variational linear comparison bounds for nonlinear composites with anisotropic phases. II. Crystalline materials[END_REF]. In addition, exact results are given for material systems with the infinite-rank, transversely isotropic, sequentially laminated microgeometries (LAM) of Idiart [START_REF] Idiart | Modeling the macroscopic behavior of two-phase nonlinear composites by infinite-rank laminates[END_REF], with matrix behavior given by ( 26)-( 27). It is recalled that the secant estimates provide rigorous upper bounds for all the other estimates considered. It is also recalled that the sequentially laminated microgeometries attain the linear Hashin-Shtrikman estimates, so that any difference between the LAM results and the linear-comparison estimates of the Hashin-Shtrikman type are solely due to the linearization procedure. We emphasize that the GSEC-τ and GSEC-γ are different estimates which can be independently used to estimate material behavior under arbitrary loading conditions.

The main observation in the context of this figure is that the new GSEC-γ estimates give very similar predictions to the dual GSEC-τ estimates for all cases considered; that is, the duality gap is small. Moreover, this duality gap vanishes not only in the linear case (m = 1) but also in the strongly nonlinear limit of ideal plasticity (m = 0). For intermediate values of m, the duality gap is virtually zero except for some range around m = 0.1 in the case of voided crystals. Within that range, the GSEC-γ are found to be less accurate than their GSEC-τ counterparts relative to the exact LAM results. Note that this range seems to widen with increasing number of slip systems.

However, in view of the fact that the material systems considered here exhibit extreme heterogeneity contrasts, it is expected that differences between the GSEC-γ and GSEC-τ estimates will be smaller in the context of fully dense polycrystals with realistic microstructures, even for relatively high crystal anisotropies. Moreover, it is expected that the additional inaccuracies incurred by the use of GSEC-γ estimates in lieu of GSEC-τ estimates, if any, will be entirely compensated by the concomitant computational simplifications for modeling mechanical processes under imposed deformations. Efforts to evaluate this compromise are currently under way and will be reported upon completion.

Figure 1 .

 1 Figure 1. Yield surfaces for square (K = 2), hexagonal (K = 3) and octagonal (K = 4) symmetries.

2 sin 2 θk = 1 ,

 221 (k) + a cos 2 θ (k) ..., K,(30)

Figure 2 .

 2 Figure 2. Effective flow stress τ 0 , normalized by the slip flow stress τ 0 , for a two-phase monocrystal with K slip systems: (a-c) voided inclusion, (d-f) rigid inclusions. The volume fraction of inclusions is c = 0.25.

Acknowledgements

The work of M.I.I. was funded by the Agencia Nacional de Promoción Científica y Tecnológica (Argentina) through grant PICT-2011-0167, with additional support from the Universidad Nacional de La Plata through grant I-2013-179.

**/**/****; accepted after revision **/