Mathieu Nouazi Momo

Martin Yemefack

Paul Tematio

Anicet Beauvais

Jean-Paul Ambrosi

Spatial distribution of bauxitic duricrusted laterites on the Bamiléké plateau (West Cameroon): constrained GIS mapping and geochemistry

Keywords: Bauxite, Boolean modeling, Kriging, Bamiléké plateau, Cameroon

Estimation of the mineral resources potential is an important issue for most of developing countries. The spatial distribution of lateritic landsurfaces and bauxite on the Bamiléké plateau (West Cameroon) has been investigated with a Boolean modeling process into a GIS environment on the basis of geological constraints namely elevation, rock types, landscape morphology and soil types. Field observation and SRTM (Shuttle Radar Topographic Mission) data allowed the differentiation of two lateritic surfaces separated by a minimum altitude difference of about 60 m. These surfaces constrained by favorable rock types, slope steepness and soil types provided a potential lateritic bauxitic area of 381 km² (17.2% of the total study site), which matches the current bauxitic areas and evidences a large non-explored area in the north of the study site. Field validation and the integration of legacy spatial data resulted in an area of 60.1 km² for potential bauxitic ores, i.e. obviously duricrusted landsurfaces (with 47.8 km² in the upper surface and 12.3 km² in the lower surface). Geochemical data (mostly Al 2 O 3 wt.%) obtained from duricrust samples were treated by geostatistical methods and classical kriging interpolation to discriminate between bauxitic and ferruginous laterites. This highlighted a geochemical trend from higher alumina values on the upper surface (40-66 wt.%) to lower values on the lower surface (13-44 wt.%).

Finally, our study documents two indurated lateritic surfaces arranged in a staircase manner and having different geochemical characteristics. The total bauxitic-rich surface is distributed in five different spots throughout the study area and covers 56.2 km², while ferruginous laterites occupy a spot of 3.9 km². GIS mapping approach of lateritic landsurfaces, accounting for reliable constraints, might be promising for larger scale investigations of mineral resources in developing Countries.

Introduction

Many Third World Countries rely mainly on their natural resources to sustain their economic development. In Cameroon, the exploitation of mineral resources has traditionally been a significant component of the economy [START_REF] Ntép Gweth | Ressources minérales des arrondissements de la région de l'Ouest[END_REF]. However, knowledge on the real potential of these resources is generally limited by a lack of geo-exploration tool required for their reliable and comprehensive assessment and classification at the national-wide level. In this country, the most widespread ore deposits are lateritic bauxites, representing the 6 th reserve in the world. Bauxites occur in the Adamaoua and Western regions, and have been previously studied by many authors [START_REF] Eno Belinga | Etude pétrographique des bauxites de Ngaoundal et de Minim-Martap dans l'Adamaoua (Cameroun)[END_REF][START_REF] Eno Belinga | L'altération des roches basaltiques et le processus de bauxitisation dans l'Adamaoua (Cameroun)[END_REF][START_REF] Hiéronymus | Etude minéralogique et géochimique des formations bauxitiques de l'ouest Cameroun[END_REF][START_REF] Momo Nouazi | Multiscale organization of the Doumbouo-Fokoué Bauxites Ore Deposits (West Cameroun): Implication to the Landscape Lowering[END_REF][START_REF] Morin | Cuirasses et reliefs de l'ouest Cameroun[END_REF][START_REF] Nicolas | Contribution à l'étude de l'origine et de l'évolution des bauxites de l'Adamaoua (Cameroun)[END_REF][START_REF] Nyobe | A geological and geochemical study of the Fongo-Tongo and areally related bauxites deposits[END_REF] using classical approaches of field survey and laboratory analyses.

Nowadays, GIS and remote sensing tools permit more accurate mapping of such resources by integrating favorable geological constraints in a GIS-based model.

Our study aimed at satisfying the practical need for supporting bauxite exploration in Cameroon with up-to-date maps, by defining the relation between bauxitic deposits and their geological environment. For this purpose, we used a GIS-modeling approach, based on a well-established procedure previously tested in several studies on mineral potential assessment [START_REF] Bonham-Carter | Geographic Information Systems for Geoscientists[END_REF][START_REF] Boroushaki | Implementing an extension of the analytical hierarchy process using ordered weighted averaging operators with fuzzy quantifiers in ArcGIS[END_REF][START_REF] Carranza | Geologically-Constrained Mineral Potential Mapping (Examples from the Philippines)[END_REF][START_REF] Carranza | Geochemical anomalies and mineral prospectivity mapping in GIS[END_REF][START_REF] Carranza | Application of mineral exploration models and GIS to generate mineral potential maps as input for optimum land-use planning in the Philippines[END_REF][START_REF] Carranza | Knowledge-guided data-driven evidential belief modeling of mineral prospectivity in Cabo de Gata, SE Spain[END_REF][START_REF] Cheng | Fuzzy weights of evidence and its application in mineral potential mapping[END_REF][START_REF] Guha | Analysis of ASTER data for mapping bauxite rich pockets within high altitude lateritic bauxite, Jharkhand, India[END_REF][START_REF] Harris | Mineral Potential Modelling for the Greater Nahanni Ecosystem Using GIS Based Analytical Methods[END_REF][START_REF] Harris | Application of GIS processing techniques for producing mineral prospectivity maps -a case study: mesothermal Au in the Swayze Greenstone Belt, Ontario, Canada[END_REF][START_REF] Robinove | Principles of logic and the use of digital geographic information systems[END_REF][START_REF] Thiart | Linking spatial statistics to GIS: exploring potential gold and tin models of Africa[END_REF][START_REF] Thole | On the suitability of minimum and product operators for intersection of fuzzy sets[END_REF][START_REF] Varnes | The logic of geological maps, with reference to their interpretation and use for engineering purposes[END_REF][START_REF] Zadeh | Fuzzy sets[END_REF]. The approach deals with GISbased geologically constrained mineral potential mapping, a multistage strategy for delineating mineralized zones [START_REF] Reeves | Systematic mineral resource development in the '90s and the next century: new techniques, old challenges[END_REF]. Multivariate and multisource geo-exploration datasets were combined to enhance favorable geologic features indicative of mineral deposit [START_REF] Bonham-Carter | Geographic Information Systems for Geoscientists[END_REF][START_REF] Hodgson | Uses (and abuses) of ore deposit models in mineral exploration[END_REF]. Our interest was thus to know via the Boolean model of [START_REF] Varnes | The logic of geological maps, with reference to their interpretation and use for engineering purposes[END_REF] and [START_REF] Robinove | Principles of logic and the use of digital geographic information systems[END_REF], whether the spatial criteria linked to the genetic environment and landscape distribution of bauxites can be used to define predictive map of bauxite occurrence for further field exploration and geochemical survey.

Physiography of the study area

The study site lies between longitudes 09°56'-10°20'E, and latitudes 05°18'-5°45'N and covers an area of 2209 km 2 within the Bamiléké plateau extending between 09°44'-10°33'E, and 04°10'-05°56'N in West Cameroon (Figs. 1A andB). The main morphological features of this area is the Mount Bambouto, culminating at the altitude of 2725 m (Fig. 1B), which is the third most important and highest volcano of the Cameroon Volcanic Line [START_REF] Déruelle | The Cameroon Line: a review[END_REF]. It covers the southern part of the West Cameroon highland between the Bamoun plateau in the east, the Grassfields in the north and the Mbô plain in the south and west.

The climate of the Bamiléké plateau is sub-equatorial, influenced by high altitudes, with 1600-2000 mm mean annual rainfall and 18°C-20°C for the mean annual temperature.

The Cameroon Volcanic Line consists of a wide Cenozoic volcanic complex extruded on the Neoproterozoic Panafrican granito-gneissic basement, which is also intruded by mafic and felsic plutons [START_REF] Kwekam | Nature, Origin and Significance of the Fomopéa Pan-African High-K Calc-alkaline Plutonic Complex in the Central African Fold Belt (Cameroon)[END_REF]. The volcanic complex is known to be the parent material for the plateau Bamiléké bauxites. The new 40 K-40 Ar geochronological data showed three main periods of volcanic activity extending from the Miocene (Burdigalian) [START_REF] Marzoli | Silicic magmas from the continental Cameroon volcanic line (Bambouto and Ngaoundéré): 40Ar/39Ar dates, petrology, Sr-Nd-O isotopes and theirpetrogenetic significance[END_REF] to the Pliocene [START_REF] Nkouathio | Evolution tectono-magmatique et volcanologique de la Ligne du Cameroun: comparaison d'un volcanisme de graben (plaine de Tombel) et d'un volcanisme de horst (monts Bambouto)[END_REF], and uncommon lava spots extending up to ~0.5 My [START_REF] Kagou Dongmo | The discovery of Late Quaternary basalt on Mount Bambouto: implications for recent widespread volcanic activity in the southern Cameroon Line[END_REF]. Lavas geochemistry shows a trend extending from basanites to trachytes or phonolytes.

Methods

Conceptual model of bauxite occurrence

A conceptual and exploration model for evaluating the bauxite potential of the Bamiléké Plateau was built based on geological criteria [START_REF] Carranza | Geologically-Constrained Mineral Potential Mapping (Examples from the Philippines)[END_REF][START_REF] De Araújo | Multicriteria Geologic Data Analysis for Mineral Favorability Mapping: Application to a Metal Sulphide Mineralized Area, Ribeira Valley Metallogenic Province, Brazil[END_REF][START_REF] Hodgson | Uses (and abuses) of ore deposit models in mineral exploration[END_REF][START_REF] Reeves | Systematic mineral resource development in the '90s and the next century: new techniques, old challenges[END_REF]. Amongst the operators used for examining the spatial association of geological features is the Boolean model, which is based on a reclassification of the input maps into only two classes [START_REF] Bonham-Carter | Geographic Information Systems for Geoscientists[END_REF][START_REF] Carranza | Knowledge-guided data-driven evidential belief modeling of mineral prospectivity in Cabo de Gata, SE Spain[END_REF][START_REF] Harris | Application of GIS processing techniques for producing mineral prospectivity maps -a case study: mesothermal Au in the Swayze Greenstone Belt, Ontario, Canada[END_REF][START_REF] Robinove | Principles of logic and the use of digital geographic information systems[END_REF][START_REF] Thiart | Linking spatial statistics to GIS: exploring potential gold and tin models of Africa[END_REF][START_REF] Varnes | The logic of geological maps, with reference to their interpretation and use for engineering purposes[END_REF], i.e., the maximum and minimum evidential score classes (0 or 1). Reclassified maps are combined logically according to a set of steps so-called inference network (Fig. 2), which reflects the inter-relationships of processes controlling the occurrence of a geo-object and the spatial features indicating the presence of this geo-object [START_REF] Carranza | Geologically-Constrained Mineral Potential Mapping (Examples from the Philippines)[END_REF][START_REF] Carranza | Geochemical anomalies and mineral prospectivity mapping in GIS[END_REF]. Finally, the output of combined evidential maps via Boolean logic modeling is a two class map; the first class represents locations where all of the prospective recognition criteria are satisfied, whilst the second class represents locations where at least one is unsatisfied [START_REF] Carranza | Geochemical anomalies and mineral prospectivity mapping in GIS[END_REF].

The study was carried out with ILWIS GIS software (ITC ILWIS Unit, 2001) using a three step methodology including: (1) gathering spatial data into a GIS, (2) extracting spatial evidential data and creating derivative maps to be used as spatial evidence of bauxite mineralization, (3) integrating the spatial evidence map to create bauxitic potential map and validating the predictive map [START_REF] Bonham-Carter | Geographic Information Systems for Geoscientists[END_REF].

Analysis of constraints

In our study, the criteria or constraints from the rock types, landscape morphology (elevation ranges and slopes), and soil types were defined and linked to delineate favorable zones on the Bamiléké Plateau. These zones are potentially duricrusted landsurfaces areas with alumina-rich surface materials, which are characterized by deep and extremely leached soils [START_REF] Hiéronymus | Etude minéralogique et géochimique des formations bauxitiques de l'ouest Cameroun[END_REF][START_REF] Momo Nouazi | Multiscale organization of the Doumbouo-Fokoué Bauxites Ore Deposits (West Cameroun): Implication to the Landscape Lowering[END_REF][START_REF] Nyobe | A geological and geochemical study of the Fongo-Tongo and areally related bauxites deposits[END_REF].

Lateritic bauxites are known to form mainly by chemical weathering of rocks in which low silica content favors crystallization of gibbsite instead of kaolinite [START_REF] Tardy | Pétrologie des latérites et des sols tropicaux[END_REF]. However, many other studies have also described bauxite formation from a variety of parent materials including basic and acid rocks [START_REF] Bildgen | Contribution à l'étude de la genèse et de l'évolution des bauxites karstiques de Provence: géologie, minéralogie, géochimie des formations bauxitiques des Alpilles[END_REF][START_REF] Boulangé | Les formations bauxitiques latéritiques de Côte d'Ivoire. Les faciès, leur transformation, leur distribution et l'évolution du modelé[END_REF][START_REF] Boulangé | Laterites and Bauxites[END_REF][START_REF] Boulangé | Mineralogical and geochemical characteristics of two bauxite profiles, Fria, Guinea Republic[END_REF][START_REF] Boulangé | Rare earth element mobility during conversion of nepheline syenite into lateritic bauxite at Passa Quatro, Minais Gerais, Brazil[END_REF][START_REF] Chardon | Planation, bauxites and epeirogeny: One or two paleosurfaces on the West African margin?[END_REF][START_REF] Eno Belinga | L'altération des roches basaltiques et le processus de bauxitisation dans l'Adamaoua (Cameroun)[END_REF][START_REF] Momo Nouazi | Multiscale organization of the Doumbouo-Fokoué Bauxites Ore Deposits (West Cameroun): Implication to the Landscape Lowering[END_REF][START_REF] Soler | The Los Pijiguaos bauxite deposit (Venezuela): A compilation of field data and implications for the bauxitization process[END_REF].

Meanwhile, the geological substratum is an important factor contributing to the preservation of lateritic bauxites from surface stripping [START_REF] Boulangé | Les formations bauxitiques latéritiques de Côte d'Ivoire. Les faciès, leur transformation, leur distribution et l'évolution du modelé[END_REF]. On the Bamiléké plateau, a variety of rocks derived from complex magmatic and metamorphic events exist [START_REF] Dumort | Carte géologique de reconnaissance au 1/500[END_REF][START_REF] Kagou Dongmo | The discovery of Late Quaternary basalt on Mount Bambouto: implications for recent widespread volcanic activity in the southern Cameroon Line[END_REF][START_REF] Kwekam | Nature, Origin and Significance of the Fomopéa Pan-African High-K Calc-alkaline Plutonic Complex in the Central African Fold Belt (Cameroon)[END_REF][START_REF] Nkouathio | Evolution of volcanism in graben and horst structures along the Cenozoic Cameroon Line (Africa): implications for tectonic evolution and mantle source composition[END_REF], but the bauxites are formed exclusively upon volcanic rocks [START_REF] Momo Nouazi | Multiscale organization of the Doumbouo-Fokoué Bauxites Ore Deposits (West Cameroun): Implication to the Landscape Lowering[END_REF][START_REF] Morin | Cuirasses et reliefs de l'ouest Cameroun[END_REF][START_REF] Nyobe | A geological and geochemical study of the Fongo-Tongo and areally related bauxites deposits[END_REF].

Bauxitic laterites generally occur on high elevation, low relief planation landsurface remnants lying on flat or gently sloped surfaces [START_REF] Grandin | Les grandes surfaces continentales tertiaires des régions chaudes. Succession des types d'altération[END_REF][START_REF] Chardon | Planation, bauxites and epeirogeny: One or two paleosurfaces on the West African margin?[END_REF][START_REF] Beauvais | Modes, tempo, and spatial variability of Cenozoic cratonic denudation: The West African example[END_REF]. These morphological characteristics allow localizing bauxitic laterites from altitudinal levels and slope distribution [START_REF] Riis | On the magnitude of the late Tertiary and Quaternary erosion and its significance for the uplift of Scandinavia and the Barents sea[END_REF].

Bauxitic laterites are developed under a tropical climate that favors deep rock weathering and the development in soils of a thick B-horizon resulting from lixiviation process [START_REF] Boulangé | Rare earth element mobility during conversion of nepheline syenite into lateritic bauxite at Passa Quatro, Minais Gerais, Brazil[END_REF][START_REF] Grandin | Les grandes surfaces continentales tertiaires des régions chaudes. Succession des types d'altération[END_REF][START_REF] Maignien | Compte rendu de recherche sur les laterites[END_REF][START_REF] Pedro | Distribution des principaux types d'altérations à la surface du globe. Présentation d'une esquisse géographique[END_REF][START_REF] Tardy | Pétrologie des latérites et des sols tropicaux[END_REF]. Commonly, bauxites described on well-preserved landsurfaces show thickness extending up to 20 and 30 m [START_REF] Grandin | Les grandes surfaces continentales tertiaires des régions chaudes. Succession des types d'altération[END_REF][START_REF] Segalen | Les sols et la géomorphologie du Cameroun Cahier ORSTOM[END_REF]. The presence or absence of the B-horizon in soils was used to determine potential areas of bauxite development in the study area.

Results

Favorable constraints

Favorable rock types

Within the study site, volcanic rocks cover 64% of the total surface (Fig. 3A), comprising mainly basalts (64%), trachytes (28%) and ignimbrites (6%), which have been formed since 19 My covering an area of 1406 km² [START_REF] Marzoli | Silicic magmas from the continental Cameroon volcanic line (Bambouto and Ngaoundéré): 40Ar/39Ar dates, petrology, Sr-Nd-O isotopes and theirpetrogenetic significance[END_REF][START_REF] Nkouathio | Evolution of volcanism in graben and horst structures along the Cenozoic Cameroon Line (Africa): implications for tectonic evolution and mantle source composition[END_REF]. All these volcanic rocks currently show evidence of deep weathering process [START_REF] Tematio | Soils and their distribution on Bambouto volcanic mountain, West Cameroon highland, Central Africa[END_REF]. Phonolites and volcanic ashes cover limited areas (~1%) on the study site. These recent volcanic rocks range from 4 My for phonolites [START_REF] Nkouathio | Evolution of volcanism in graben and horst structures along the Cenozoic Cameroon Line (Africa): implications for tectonic evolution and mantle source composition[END_REF] to 0.48 My for volcanic ashes [START_REF] Kagou Dongmo | The discovery of Late Quaternary basalt on Mount Bambouto: implications for recent widespread volcanic activity in the southern Cameroon Line[END_REF]. The phonolites are found on elevated dykes with no evidence of weathering. Volcanic ashes are very little altered exhibiting a very thin non-differentiated profile [START_REF] Jiomeneck | Andosolization of Soils on a Strombolian Cone at Mount Bambouto, Cameroon[END_REF]. Taking into account all these data, basalts, trachytes and ignimbrites are rock types with potential to control bauxite occurrences in the study area.

Favorable morphological features: elevation and slope

On the Bamiléké plateau, legacy data and field observations have contributed to differentiate two lateritic surfaces with minimum elevation of 1520 and 1580 m for the lower and the upper surface, respectively (Fig. 3B). The 60 m height difference (Dh; Fig. 4) is a lithologically controlled feature marked by flow scarps separating two types of volcanic materials. These are reported on the central and the western part of the study site (Fig. 4) as a limit between the Mount Bambouto lava and the surrounding shield [START_REF] Nkouathio | Evolution of volcanism in graben and horst structures along the Cenozoic Cameroon Line (Africa): implications for tectonic evolution and mantle source composition[END_REF]; and on the southeastern part by the Bangam flow scarp. The lower surface is an undulated low relief landscape with few interfluves culmunating up to about 1580 m, corresponding mainly to the Doumbouo-Fokoué area (Fig. 3B; Fig. 4) between large remnants of the upper surface (Fig. 3B). The upper surface includes the so called Fongo-Tongo deposit, the Loung deposit and the Bangam deposit (Fig. 3B; Fig. 4) and a large unexplored area in the northern part of the study site (Fig. 3B), whose the maximum altitude is not actually well defined although laterites have been described up to about 1900 m.

Remnants of bauxitic surfaces on the Bamiléké plateau are most often highly dissected due to the combined effects of tectonic uplift, climate and drainage pattern [START_REF] Morin | Cuirasses et reliefs de l'ouest Cameroun[END_REF], and are incised by steep valleys. Landscape dissection results in two morphological features related to different incision stages.

The first one corresponds to isolated gently sloping interfluves (0 to 5°; Fig. 3C), which are covered by continuous duricrusted laterites (Fig. 5A) and limited by steep slopes up to 76° (Fig. 5B). The second feature corresponds to widespread elongated interfluves with convex summits showing slope classes ranging from 0 and 15° (Fig. 3C). Well-preserved duricrusts occur on the lowest slopes, but are stripped on increasing slopes steepness. This is obvious on a sequence at Doumbouo-Fokoué showing continuous duricrust on the top, discontinuous duricrust on summit shoulder, and gravelly horizon on 15° slopes marking the lower topographic limit of the lateritic surface (Fig. 5C). Landform units and slope classes derived from SRTM (Shuttle Radar Topographic Mission) data were thus potential morphological features for mapping bauxitic deposits. The favorable elevation ranges delineate a surface of 685 km² and 223 km² on the upper surface and lower surface, respectively (Fig. 3B). Favorable sloping land surface covers a total surface of 1702 km² with slopes ranging between 5-15° over a surface of 1176 km² (Fig. 3C).

Favorable soil classes

Three major soil classes are recorded in the area: andosols, andic-ferralitic soils and ferralitic soils [START_REF] Tematio | Etude cartographique et pétrographique des sols à caractères ferralitiques et andosoliques dans lesmonts Bambouto (Ouest Cameroun): influence de la nature lithologique et des facteurs du milieu sur la nature et la distribution des sols en regions de montagne tropicale humide[END_REF][START_REF] Tematio | Mineral and geochemical characterization of a leptic-aluandic soil and athapto-aluandic-ferralsol developed on trachytes in Mount Bambouto (Cameroon volcanic line)[END_REF][START_REF] Tematio | Soils and their distribution on Bambouto volcanic mountain, West Cameroon highland, Central Africa[END_REF] corresponding respectively to andosols, acrisols and ferralsols of the World Reference Base for soil classification (FAO-ISRIC, 2006;[START_REF] Jones | Soil Atlas of Africa[END_REF]. These soils form a toposequence extending from andosols at the upper part of the Bambouto volcano, to acrisols at the middle, and to ferralsols in lower part (Fig. 3D). The B-horizon is well developed except in the andosols of high altitudes where cool climate prevents clay formation and instead favors organo-metal complexes embedding Al and Fe [START_REF] Tematio | Etude cartographique et pétrographique des sols à caractères ferralitiques et andosoliques dans lesmonts Bambouto (Ouest Cameroun): influence de la nature lithologique et des facteurs du milieu sur la nature et la distribution des sols en regions de montagne tropicale humide[END_REF]. This results in the development of a thick organic horizon lying in most cases directly on the bedrock. These andosols are associated on either side of the Mont Bambouto caldera edge with lithosols, which were strongly eroded and reworked out by numerous landslides occurring from the top of the volcano to about 600 m altitudes westward.

Accordingly, only ferralsols and acrisols, which cover 1645 and 131 km², respectively, are considered for the modeling process.

Mapping the bauxitic potential

Spatial evidences of bauxitic potential were constrained successively from different geological features as described in section 3. First, the maps constrained by elevation and lithology displayed two main areas of bauxite potential, i.e., the northern area made up mainly of the upper surface and the southern area made up mainly of the lower surface (Fig. 6A). The total potential surface at this stage covers 682 km² (538 km² and 144 km² for the upper and the lower surface, respectively). This surface was further constrained with the favorable soil classes, and the resulting surface showed 422 km² with 291 km² for the upper surface and 131 km² for the lower surface. The spatial distribution pattern remains the same as the first potential map, except that the upper surface was reduced in the northern part of the study site (Fig. 6B).

Finally, the map derived from the altitudes, lithology, and soils was further constrained by the slope map that resulted in a predictive bauxitic map characterized by large blank areas with dissected pattern (Fig. 6C) corresponding to slopes ranging from 15 to 76°. The total potential surface is 381 km², i.e. 17.2% of the total studied zone. The slopes of 5-15° is the most represented (76%), showing that the dominant morphological features for bauxite occurrence are the convex shaped summit of elongated interfluves.

Validation of the predictive bauxitic laterites map

As shown in the inference network of Fig. 2, the map of the predictive bauxitic areas was an intermediate step of the modeling process. Comparing this map with data from previous studies and field campaigns was the final step to validate the efficiency of the model for evaluating the accuracy of bauxite mapping. The validation consisted in (i) gathering data from different sources to precisely delineate lateritic duricrusts, and (ii) integrating geochemical data interpolated by kriging to differentiate between ferruginous and bauxitic laterites. The first step in validating the output map was carried out by a rough comparison between the predictive map and the areas with previously studied bauxites deposits such as Fongo-Tongo, Djeu and Loung-Ndoh [START_REF] Morin | Cuirasses et reliefs de l'ouest Cameroun[END_REF][START_REF] Nyobe | A geological and geochemical study of the Fongo-Tongo and areally related bauxites deposits[END_REF], Doumbouo-Fokoué [START_REF] Hiéronymus | Etude minéralogique et géochimique des formations bauxitiques de l'ouest Cameroun[END_REF][START_REF] Momo Nouazi | Multiscale organization of the Doumbouo-Fokoué Bauxites Ore Deposits (West Cameroun): Implication to the Landscape Lowering[END_REF][START_REF] Morin | Cuirasses et reliefs de l'ouest Cameroun[END_REF], and Bangam [START_REF] Hiéronymus | Etude minéralogique et géochimique des formations bauxitiques de l'ouest Cameroun[END_REF][START_REF] Morin | Cuirasses et reliefs de l'ouest Cameroun[END_REF]. The predictive map perfectly matches these areas and highlights a large northern site for which legacy data are still lacking as shown on the figure 6C. Upon validation process, the predictive map delineate a surface of 60.1 km² of lateritic duricrusts on the Bamiléké plateau with 47.8 km² for the upper surface and 12.3 km² for the lower surface (Fig. 6D).

The second step aimed at differentiating between bauxitic laterites and ferruginous laterites. For this purpose, a total of 65 samples randomly distributed in the study area were collected, analyzed for geochemical data (Table . 1) and used for geostatistical analyses. The process of interpolation carried out in this step consisted in determining the distribution of alumina weight percentage on regularly distributed points (pixels) from randomly distributed analytical point values. The output of point interpolation is a raster map, whose pixel values are calculated by interpolation from input point values. The kriging method with a minimum mean interpolation error is currently used [START_REF] Theodossiou | Evaluation and optimization of ground water observation network using the Kriging methodology[END_REF]. In this study, the kriging process established a spatial correlation between the spatial input values at an optimal lag distance of 1 km. A spherical model fitted to the semi-variogram from this correlation was used as interpolation function. The figure 7 shows the kriging map differentiating three main geochemical areas. The first area is characterized by highest alumina values, confined on the upper surface (comprising localities of Fongo-Tongo, Djeu, Loung-Ndoh and Bangam). The geochemical trends are represented with alumina values decreasing from Fongo-Tongo to Djeu on the western part of the lateritic map, and on the eastern part with a slight increasing trend toward the SE (Bangam). These areas display interpolated alumina values extending from 44 up to 66 wt.% Al 2 O 3 . The second area is delineated in the southern part of the lower surface at Fokoué and Sa, where alumina values extend from 40 to 44 wt.% Al 2 O 3 with a slight decrease northward (Fig. 7). The third area is confined to the Doumbouo region where ferruginous laterites are characterized by alumina content less than 40 wt.%, varying from 39 to 13 wt.% Al 2 O 3 . The total bauxitic-rich surface of the Bamiléké plateau is then of 56.2 km², while ferruginous laterites cover a surface of 3.9 km².

Discussion

Spatial features evidence and predictive map of bauxite potential

The Boolean model applied in this study has resulted in an 82.8% reduction in the potential bauxite area to be considered. The predictive map has indicated that the bauxite potential covers 17.2% of the total study area, that perfectly matches known areas of bauxite deposits as derived from previous studies on the Bamiléké plateau [START_REF] Hiéronymus | Etude minéralogique et géochimique des formations bauxitiques de l'ouest Cameroun[END_REF][START_REF] Momo Nouazi | Multiscale organization of the Doumbouo-Fokoué Bauxites Ore Deposits (West Cameroun): Implication to the Landscape Lowering[END_REF][START_REF] Morin | Cuirasses et reliefs de l'ouest Cameroun[END_REF][START_REF] Nyobe | A geological and geochemical study of the Fongo-Tongo and areally related bauxites deposits[END_REF]. Out of the 17.2% bauxite potential from the predictive map, the total confirmed bauxitic area of the Bamiléké plateau derived from validation steps only covers about 3% of the total investigated area (56.1 km²). This reduced bauxitic surface can be explained by (i) the advanced stage of bauxitic landsurface dismantling [START_REF] Momo Nouazi | Multiscale organization of the Doumbouo-Fokoué Bauxites Ore Deposits (West Cameroun): Implication to the Landscape Lowering[END_REF], which induces the total stripping of duricrust on interfluves with favorable genetic characteristics (rock and soil) and favorable morphological criteria; and

(ii) the flat and gently sloped areas in the northern part of the predictive map covered by unaltered basaltic and trachytic flows. This methodology allows a regional scale evaluation of lateritic bauxites by highlighting the low preservation and increasing dismantling of these lateritic surfaces, which had already been noticed all over the remnants of the planation surfaces (see [START_REF] Momo Nouazi | Multiscale organization of the Doumbouo-Fokoué Bauxites Ore Deposits (West Cameroun): Implication to the Landscape Lowering[END_REF]. The criteria used in this study are quite similar to those used by [START_REF] Carranza | Geologically-Constrained Mineral Potential Mapping (Examples from the Philippines)[END_REF] for determining the predictive map of nickeliferous-laterites of the Isabela area in Philippines. The resulting map demonstrated the reliability of the method in large areas with a limited number of mineral prospects. It is thus a relatively effective, rapid, and cheap approach, which can be applied to assess a large number of mineral potential as described by [START_REF] Bonham-Carter | Geographic Information Systems for Geoscientists[END_REF]. It can then be considered as a promising approach applicable to other bauxitic regions of Cameroon such as the Adamaoua bauxitic landsurfaces with wide duricrusted and gently sloped plateaus (≤ 2°) developed on volcanic rocks (Eno Belinga, 1966;[START_REF] Vicat | Géosciences au Cameroun[END_REF] for a larger scale spatial regionalization.

Bauxites of the Bamileké plateau and its economic potential

Bauxites of the Bamiléké plateau are distributed in five main spots named Bangam, Doumbouo-Fokoué, Fongo-Tongo, Loung-Ndoh and Djeu with respectively 39.87 km², 8.44 km², 4.52 km², 1.78 km² and 1.59 km². They contain essentially 40-66 wt.% of alumina that is less than those of Minim-Martap (45-75wt%) but more than those of Ngaoundal-Ngaoundourou (46-48 wt.%) in the Adamaoua region (Eno Belinga, 1966;[START_REF] Vicat | Géosciences au Cameroun[END_REF]. The total bauxite reserve of the Bamiléké plateau is still not quantified. However, some attempts based on (i) thickness data from limited number of pits and (ii) surface evaluation by contouring have been performed on the Fongo-Tongo and the Doumbouo-Fokoué spots with 46 million tons [START_REF] Hiéronymus | Etude minéralogique et géochimique des formations bauxitiques de l'ouest Cameroun[END_REF] and 9 million tons [START_REF] Momo Nouazi | Multiscale organization of the Doumbouo-Fokoué Bauxites Ore Deposits (West Cameroun): Implication to the Landscape Lowering[END_REF], respectively. These values are lower than those of the Adamaoua region of Cameroun. The Bangam spot revealed by this study with the largest (39.9 km²) and richest bauxitic ore (45-66 wt.% alumina) has unfortunately not been evaluated so far. Further researches on vertical extent of bauxite in this spot are thus highly recommended here.

Summary and conclusion

This study has suitably combined spatial multisource data to define potential bauxitic laterites distribution on the Bamiléké plateau, and evaluate the usefulness of including field observations, and geochemical data processed by statistical method for improving the mineral mapping process. Genetic criteria and a regolith landform model were successfully used to predict and precisely delineate areas of bauxite occurrence, thereby highlighting a total bauxitic-rich surface of 56.2 km². The alumina content of these duricrusts is quite high, but the large spatial distribution into five spots may render their bauxitic exploitation quite expensive. However, results of this study can be considered as an important input into the assessment and classification of lateritic ores in Cameroon.

At the national-wide level, the bauxitic laterites potential has not yet been fully assessed. Using the approach developed in this study, the bauxite potential for the entire country could be achieved much more cheaply than the traditional methods. The whole Cameroon volcanic line with deep weathered and elevated volcanic shields provides most of the useful genetic and geomorphic criteria applicable for such study.

AFigure 1

 1 Figure 1. A: Localization and structure of the Cameroon volcanic line (from Ballentine et al., 1997; and Ngako et al., 2006); B: morphology of the Bamiléké plateau. Letters A to F mark the major morphological changes along the cross section in figure 4.

Figure 1 Figure 3 .

 13 Figure 1

Figure 4 .Figure 5 .Figure 5 Figure 6 .

 4556 Figure 4. Cross section showing the vertical and lateral distribution of lateritic surfaces. Section S1 on figure 1B

Figure 6 27

 6 Figure 6

Figure 7

 7 Figure 7

Table 1 .

 1 Alumina (wt.%) of diricrusted laterites on the Bamiléké Plateau

	442
	Lower surface				Upper surface
	Doumbouo-Fokoué	Fongo-Tongo	Bangam		Loung		Djeu
	Sample Al2O3 (wt%)	Sample Al2O3 (wt%)	Sample Al2O3 (wt%)	Sample Al2O3 (wt%)	Sample Al2O3 (wt%)
	DF1	31.3	FO1	50.8	BA1	51.1	LO1	57.3	DJ1	22.3
	DF2	35.1	FO2	59.7	BA2	47.1	LO2	39.1	DJ2	27.2
	DF3	52.6	FO3	34.0	BA3	48.4	LO3	54.7	DJ3	28.9
	DF4	38.7	FO4	43.1	BA4	38.4	LO4	44.3	DJ4	47.3
	DF5	37.6	FO5	44.4	BA5	38.3	LO5	53.7	DJ5	40.0
	DF6	42.0	FO6	47.2	BA6	60.3	LO6	46.9	DJ6	35.2
	DF7	44.5	FO7	49.4	BA7	60.4	LO7	54.9	DJ7	38.4
	DF8	28.7	FO8	51.6	BA8	59.7
	DF9	35.9	FO9	48.2	BA9	46.8
	DF10	36.0	FO10	37.4	BA10	43.5
	DF11	35.0	FO11	44.0	BA11	42.8
	DF12	47.5	FO12	49.8	BA12	40.0
	DF13	49.5	FO13	57.5	BA13	47.3
	DF14	36.0	FO14	44.9
	DF15	33.3	FO15	50.1
	DF16	37.7	FO16	49.9
	DF17	13.8	FO17	39.3
	443

Table 1 Click here to download Table: Table 1.pdf

 1

Acknowledgement

The financial support for geochemical data of this study was provided by the SCAC (Service de Coopération et d'Action Culturelle de la France au Cameroun). The geochemical analysis have been carried out at the Centre Européen de Recherche et d'Enseignement des Géosciences de l'Environnement (CEREGE), Aix Marseille University, OSU Pytheas, France.

Input spatial data

Extracting spatial geoinformation data

Building spatial database

S patial evidence features

Combining spatial evidence maps using

Boolean model

Geology


Loïc Besnard

Thierry Gautier

Clément Guy

Paul Le Guernic

Jean-Pierre Talpin

FDA Scholar at Brian R Larson

Formal Semantics of Behavior Specifications in the Architecture Analysis and Design Language Standard

In system design, an architecture specification or model serves, among other purposes, as a repository to share knowledge about the system being designed. Such a repository enables automatic generation of analytical models for different aspects relevant to system design (timing, reliability, security, etc.). The Architecture Analysis and Design Language (AADL) is a standard proposed by SAE to express architecture specifications and share knowledge between the different stakeholders about the system being designed. To support unambiguous reasoning, formal verification, high-fidelity simulation of architecture specifications in a modelbased AADL design workflow, we have defined a formal semantics for the behavior specification of the AADL, the presentation of this semantics is the aim of this paper.

I. INTRODUCTION

In system design, an architecture specification serves several important purposes. First, it breaks down a system model into manageable components to establish clear interfaces between them. In this way, complexity becomes manageable by hiding details that are not relevant at a given level of abstraction. Clear, formally defined, component interfaces allow us to avoid integration problems at the implementation phase. Connections between components, which specify how components affect each other, help propagate the effects of a change in one component to the linked components.

Second and most importantly, an architecture model is a repository to share knowledge about the system being designed. This knowledge can be represented as requirements, design artifacts, component implementations, held together by a structural backbone. Such a repository enables automatic generation of analytical models for different aspects relevant to system design, such as timing, reliability, security, performance, energy, etc. Since all the analyses are generated from the same source, the consistency of assumptions w.r.t. guarantees, of abstractions w.r.t. refinements, used for different analyses, becomes easier, and can be properly ensured in a design methodology based on formal verification and synthesis methods.

Several standards for modeling embedded architectures have emerged in recent years: the SAE Architecture Analysis and Design Language (AADL) 1 [1], SysML 2 , and UML MARTE [START_REF] Selic | Modeling and Analysis of Real-Time and Embedded Systems with UML and MARTE: Developing Cyber-Physical Systems[END_REF]. Each of them represents different design approaches, materialises different concepts, serves different purposes. We focus on the AADL, and the scope and precision of concepts defined by this standard, to define a formal semantics for a significant subset of its behavioral specification annex language. Just as non-functional properties (timing, performance, energy, security properties), such descriptions can be attached to threads, processes, or any object of the standard (bus, sensor, actuator, port) to formally specify its behavior, as specified in the standard (e.g. a bus), or refine it (e.g. as an AFDX bus).

Since it began being discussed in the AADL committee, the formal semantics defined in this article evolved from a synchronous model of computation and communication [START_REF] Besnard | Logically timed specifications in the AADL : a synchronous model of computation and communication (recommendations to the SAE committee on AADL)[END_REF] to a semantic framework for time and concurrency in the standard: asynchronous, synchronous or timed, to serve as a reference for model checking, code generation or simulation tools uses with the standard. This semantics is simple, relying on the structure of automata present in the standard already, yet provides tagged, trace semantics framework to establish formal relations between (synchronous, asynchronous, timed) usages or interpretations of behavior.

The remainder of this paper is organized as follows. Section II gives an overview of the Architecture Analysis and Design Language (AADL). Section III presents the constrained automata, that we use to specify the model of computation and communication of an AADL behavior specification. Section IV details the AADL behavior annex and its formalization using constrained automata. Section V discusses related work about formal specification of AADL models and finally Section VI concludes.

The extended version of this paper, [START_REF] Besnard | Formal Semantics of Behavior Specifications in the Architecture Analysis and Design Language Standard[END_REF], details the implementation of the present model using the synchronous modeling environment Polychony on Polarsys 3 and applies it to the high-fidelity functional and real-time model of an adaptative cruise control system, Fig. 1.

Figure 1. Overview of the Adaptive Cruise Control system modeled with AADL [START_REF] Besnard | Formal Semantics of Behavior Specifications in the Architecture Analysis and Design Language Standard[END_REF]. Double-lined rectangles represent devices, doublearrows buses and rectangles with rounded corners systems and subsystems.

II. THE ARCHITECTURE ANALYSIS AND DESIGN LANGUAGE

AADL [START_REF]Aerospace Standard AS5506A: Architecture Analysis and Design Language[END_REF] is a SAE International standard, dedicated to modeling embedded real-time system architectures. As an architecture description language, based on a component modeling approach, AADL describes the structure of systems as an assembly of software components allocated on execution platform components together with constraints and properties, including timing.

Architecture

In AADL, three distinct families of components are provided:

• software application components which include process, thread, thread group, subprogram, and data components, • execution platform components that model the hardware part of a system including (possibly virtual) processor, memory, device, and (possibly virtual) bus components, • composite components (systems). The AADL components communicate via data, event, and event-data ports. Each component has a type, which represents the functional interface of the component and externally observable attributes. Each type may be associated with zero, one or more implementation(s) that describe the contents of the component, as well as the connections between components.

Properties

AADL properties provide various information about model elements of an AADL specification. For example, a property Dispatch Protocol is used to provide the dispatch type of a thread. Property associations Figure 2. Control subsystem of the ACC system modeled with AADL specifying the main computational process and its associated ECU, bus and memory properties [START_REF] Besnard | Formal Semantics of Behavior Specifications in the Architecture Analysis and Design Language Standard[END_REF].

in component declarations assign a particular property value, e.g., Periodic, to a particular property, e.g., Dispatch Protocol, for a particular component.

Timing execution model

Threads are dispatched depending on the thread type: periodically; by the arrival of data or events on ports; or from the arrival of a subprogram call (from another thread). Three event ports are predeclared: dispatch, complete and error.

A thread is activated to perform a computation at start time, and has to be finished before the deadline. The thread send a complete event at the end of its execution. The received inputs are frozen at a specified time (Input Time), by default the dispatch time. This implies that the content of a dispatched port does not change between two consecutive Input Times, even though the sender may send new values in its input FIFO. Such new values arriving after a given Input Time will not be available through the port and thus will not be processed until the next Input Time. As a result, the performed computation is not affected by a new input arrival until an explicit request for input (another Input Time, such as the next dispatch time). Similarly, the output is made available to other components at a specified point of Output Time, by default at complete (resp., deadline) time if the associated port connection is immediate (resp., delayed) communication.

III. CONSTRAINED AUTOMATA

We define the model of computation and communication of a behavior specification by the synchronous, timed or asynchronous traces of automata with variables [START_REF] Skoldstam | Modeling of discrete event systems using finite automata with variables[END_REF]. These constrained automata are derived from polychronous automata defined within the polychronous model of computation and communication [START_REF] Le | Polychronous Automata[END_REF]. Automata define a behavior using transitions. A transition is composed of a source state, a guard, an action, a target state. The guard and action of a transition are defined using logical formulas. The logical formula of the guard must be true for the transition to occur.

Vocabulary

These multi-sorted logical formulas are defined on the vocabulary W of AADL constants and of the states S, variables V , connections and ports P defined in the lexical scope of the denoted AADL object. An identifier w in W has a type T = typeof (w) and is valuated on the corresponding domain D T , e.g., Booleans, integers or reals, D ⊇ B ∪ Z ∪ R. We write D x for the value domain of a typed identifier x. The domain of a port identifier p of type T is defined by

D p = D ⊥ T = D T ∪ {⊥}.
The bottom sign ⊥ denotes the absence of a value at the given step of execution. A port value is said absent if the port is not frozen and its value is neither read or written.

Formulas

The set of typed formulas F W on the vocabulary W is an algebraic set of terms that denotes the conditions, actions and constraints of an AADL object of vocabulary W . It is defined by induction from:

• Constants 0 (false), to mean "never", and 1 (true), to mean "always". Always is discrete, relative to the vocabulary W . • Atoms w of W , to mean the value of an identifier w.

• Unitary expressions:

-ˆp is the clock of p: a Boolean that denotes the presence of a value on a frozen port p, i.e., p = ⊥; -@p is the date of p: a real number that denotes the time of an event present on a port p; v denotes the next value of a variable v; -¬f denotes the complement of formula f , for all f in F W .

• Binary expressions f op g:

for all Boolean formula f , g in F W and Boolean operators ∨, ∧, ⇒, etc. (in particular, f -g = f ∧ ¬g); for all numerical formula f , g in F W and numerical operators +, -, * , /, %, =, <, etc. A formula f is the denotation of a well-typed AADL condition or action. It is hence assumed to be a well-typed, multi-sorted, logical expression. Ill-typed expressions do not define formula.

Model

A model m is a function W → D W from a vocabulary W to its domain of valuation D W that is true for a formula f of F W , written m |= f . A timed model m @ is a function W → R×D W associating also each event with a date, that the formula must satisfy as well.

Automaton

The meaning of a behavior annex is defined by an incomplete automaton with variables A = (S A , s 0 , V A , P A , T A , C A ) defined by:

• S A , the set of states of the automaton A, s 0 is the initial state. • V A , the set of local variables of the automaton A (V A designates the set of next values v for all v ∈ V A ). • P A , the set of ports of the automaton A, both inputs I A and outputs O A ,

P A = I A ∪ O A . • F A is the set of Boolean formulas of A, defined on the vocabulary W A = S A ∪ V A ∪ P A . • The transition function T A ∈ S A ×F A → F A ×S A
defines the transition system of A.

-The source formula of a transition is its guard g, defined on V A and I A . -The target formula of a transition is its action f , defined from V A and P A .

• C A ∈ F A is the constraint of A. It must always equal 0.
It is a formula that denotes the invariants (properties, requirements) of the denoted AADL object in a form of a logical formula. Since variables V are private to the automaton, a transition function

T A is equivalent to one in X A = Q A × F P → F P × Q A over extended states Q A = S A × D V A for all valuations D V A = v∈V A D v of the variables V A : for all transition (s, g, f, d) ∈ T A , for all model m ∈ (V A + V A ) → D V A , we have ((s, m(V A )), m(g), m(f ), (d, m(V A )) ∈ X A and, for all v ∈ V A undefined in f , m(v ) = m(v).
The role of a constraint formula such as ˆa ∧ ˆb = 0 is to guarantee a property by all models of the incomplete automaton.

Properties

• The control clock 1 A of an automaton A is defined by the sum (union) of its port clocks

1 A = p∈P A ˆp. • The trigger tick A (s) =
(s,g,f,d)∈T A (g) of a state s is defined by the upper bound of guard formulas g from s.

• The stuttering clock of a state s is defined by

τ A (s) = 1 A -((s * C A ) + tick A (s)).
= (S A , s 0 , V A , P A , T A , C A ) and B = (S B , t 0 , V B , P B , T B , C B ) is defined by A | B = (S AB , (s 0 , t 0 ), V AB , P AB , T AB , C AB ) with S AB = S A × S B , V AB = V A ∪ V B , P AB = P A ∪ P B , C AB = C A ∨ C B , T AB = {((s 1 , t 1 ), g 1 ∧ g 2 , f 1 ∧ f 2 , (s 2 , t 2 )) | (s 1 , g 1 , f 1 , t 1 ) ∈ T A ∧ (s 2 , g 2 , f 2 , t 2 ) ∈ T B }.
Product is commutative, associative, has neutral element ({s}, s, ∅, ∅, ∅, 0) and is idempotent for deterministic automata.

Small step

The model m of a transition in an automaton A consists of a pre-condition pre(m) defined on input ports I → D ⊥ I and state variables V → D V and a post condition post(m) defined on output ports

O → D ⊥ O and next values of variables V → D V .
A small step of an automaton A from state s to state t is defined by a model m of A that satisfies its constraint C A , written m |= ¬C A , and both the guard g and action f of a transition (s, g, f, t) of A, written m |= g ∧ f .

Big step

Let n > 1, q 1 = (s 1 , r 1 ) and q n = (s n , r n ) two extended states of an automaton A with complete states s 1 , s n ∈ S A and variable valuations r 1 , r n ∈ D V A V A → D V A (note that it may be the case that q n = q 1 ). A big step of automaton A from s 1 to s n is defined by a model m ∈ P A → D ⊥ P A that, for all 1 ≤ i < n satisfies:

• pre r i+1 (v) = post r i (v ) for all v ∈ V A • m i = r i m • m i |= ¬C A • (s i , g i , f i , s i+1 ) ∈ T A and m i |= g i ∧ f i • pre r i (v) = post r i (v ) for all v ∈ V A not occurring in f i and g i • s i is an execution state if 1 < i < n (an execution
state is a non observable, internal state-see Section IV). We write m, s 1 |= A, s n to mean that m is the model of a big step of A from s 1 to s n .

Synchronous and asynchronous trace

A synchronous trace B ∈ P A → (D ⊥ P A ) * of an automaton A is a finite sequence of valuation over P A obtained by concatenating the codomains of successive (big) steps. The length of B is denoted |B|. The set of synchronous traces of an automaton A from its initial state s 0 is defined as:

T (A, s 0 ) = {B ∈ P A → (D ⊥ P A ) * | 0 ≤ i < |B|, m i , s i |= A, s i+1 ∧ ∀x ∈ dom(B), (B(x)) i = m i (x)}
An asynchronous trace B # ∈ P A → (D P A ) * is the abstraction of a synchronous trace B ∈ P A → (D ⊥ P A ) * obtained by the removal of all absence marks ⊥. For a sequence s in (D ⊥ ) * , we denote by s /⊥ the projection of s on D * . The set of asynchronous traces of an automaton A from its initial state s 0 is defined as:

T # (A, s 0 ) = {B ∈ P A → (D P A ) * | C ∈ T (A, s 0 ) ∧ ∀x ∈ dom(B), B(x) = C(x) /⊥ }

Timed step and timed trace

A timed step of an automaton A from state s to state t is defined by a timed model m @ defined on W A that satisfies its constraint and the guard g and action f of a transition (s, g, f, t) of A. For all w in W A , m @ (w) refers to the value of w in m @ and m @ (@w) refers to the date of w in m.

A timed trace B @ ∈ P A → (R × D ⊥ P A ) * of an automaton A is the concatenation of the codomains of successive timed steps (m @ i ) i≥0 of A such that for all 0 ≤ i < j, for all x in dom(m @ i ), for all y in dom(m @ j ), m @ i (@x) < m @ j (@y). A timed trace B @ is therefore the refinement of a synchronous trace B ∈ P A → (D ⊥ P A ) * associating each event in B with a date.

IV. BEHAVIOR ANNEX MODEL

The behavior annex provides an extension to AADL to associate functional behavior specifications with AADL components. A behavior is expressed by transition systems with conditions and actions [START_REF]Aerospace Standard AS5506/2: SAE Architecture Analysis and Design Language (AADL) Annex Volume 2, Annex D: Behavior Model Annex[END_REF]. They can be refined to simulate and define the functional behavior of the AADL component using an imperative action language.

This section first presents how to formally express the meaning of a behavior annex using an automaton. Then, the constituents of the behavior annex are defined (transition system, action and expression language, etc.) and their formal semantics given.

A. Formalization using the constrained automata

The meaning of a behavior annex is defined by the axiomatic, denotational and operational interpretation of constrained, incomplete, automata with variables A = (S A , s 0 , V A , P A , T A , C A ) such as defined in Section III. The sets S A , V A , P A represent the states (including the initial state s 0 ), variables and ports of A. The guard, action and constraints of its transitions T A and constraints C A are denoted by multi-sorted logical formula F A .

F A is defined over the vocabulary W A available in the scope of a behavior annex: AADL value constants, port, state, and variable names. They are combined using AADL logical operators and numeric operators. Operators that are specific to the model of computation and communication of a given behavior annex are ˆp, a Boolean value to mean the presence of a value on port p under synchronous interpretation (i.e., p = ⊥); and @p, a numeric value to mean the time of an event on p, under timed interpretation.

The transition system of an automaton A is defined by the function T A ∈ S A × F A → F A × S A whose Figure 3. Overview of the ACC transition system with operation states, behavior conditions and variables [START_REF] Besnard | Formal Semantics of Behavior Specifications in the Architecture Analysis and Design Language Standard[END_REF] quadruples (s, g, a, t) define the source state s, guard formula g, action formula a and target state t of a specified transition.

B. Automaton

The AADL behavior annex defines an extended automaton BA described by three sections: variables declarations, states declarations, and transitions declarations. This automaton BA of the behavior annex is not to be confused with the automaton A interpreted to give its meaning to a behavior annex. On the one hand, we have BA, an automaton which is part of the behavior annex, and on the other hand A, an automaton which is used to express the meaning of the whole behavior annex.

As shown in Figure 4, the automaton BA of a behavior_annex instance is defined on the vocabulary consisting of its private variables behavior_variable, of its states behavior_state, and ports of its parent component. Its transition system T BA is the union of the transitions specified by a behavior_transition. 1) Variables section: The variables section of the transition system of a behavior annex declares identifiers that represent variables with the scope of the behavior annex subclause. Local variables can be used to keep track of intermediate results within the scope of the annex subclause. They may hold the values of out parameters on subprogram calls to be made available as parameter values to other calls, as output through enclosing out parameters and ports, or as value to be written to a data component in the AADL specification. They can also be used to hold input from incoming port queues or values read from data components in the AADL specification. They are not persistent across the various invocations of the same behavior annex subclause.

2) States section: The states section declares all the states of the automaton. Some states may be qualified as initial state (thread halted), final state (thread stopped), or complete state (thread awaiting for dispatch), or combinations thereof. A state without qualification is referred to as execution state. A behavior automaton starts from an initial state and terminates in a final state. A complete state acts as a suspend/resume state out of which threads and devices are dispatched. Complete states thus correspond (with initial and final states) to the observable states of the behavior, in which computations are "paused", inputs read and outputs produced. 3) Transitions section: The transitions section defines transitions from a source state to a destination state. Transitions in a behavior automaton represent an execution sequence within a thread. A transition out of a complete state is initiated by a dispatch once its condition is satisfied. Transitions can be guarded by dispatch or execute conditions, and can have actions. Figure 5 presents the syntax used in the behavior annex for transitions.

Dispatch conditions explicitly specify dispatch trigger conditions out of a complete state. A dispatch condition is a Boolean expression that specifies the logical combination of triggering events: arrival of an event or event data on an event port or an event data port, receipt of a call on a provided subprogram access, or timeout event.

Execute conditions specify transition conditions out of an execution state to another state. They effectively select between multiple transitions out of a given state to different states. These conditions are logical expressions based on component inputs, subcomponent outputs, and values of data components, state variable values, and property constants. They can also result in catching a previously raised execution timeout exception.

If transitions have been assigned a priority number, then the priority determines the transition to be taken. The higher the priority number is, the higher the priority of the transition is. If more than one transition out of a state evaluates its condition to true and no priority is specified, then one transition is chosen non-deterministically. For multiple transitions with the same priority value the selection is also non-deterministic. Transitions with unspecified priority have the lowest one.

Each transition can have actions. Actions can be subprogram calls, retrieval of input and sending of output, assignments to variables, read/write to data components, and time consuming activities. An action is related to the transition and not to the states: if a transition is taken, the sequence of actions is performed and then the state specified as the destination of the transition becomes the new current state.

4) Transition semantics: States of a behavior annex transition system can be either observable from the outside (initial, final or complete states), that is states in which the execution of the component is paused or stopped and its outputs are available; or non observable execution states, that is internal states. We thus define two kinds of steps in the transition system BA: small steps, that is non-observable steps from or to an internal state; and big steps, that is observable steps from a complete state to another, through a number of small steps (see Section III).

The semantics of the AADL considers the observable states of the automaton. The set S A of automaton A (used to interpret the behavior annex) thus only contains states corresponding to these observable states and set T A big-step transitions from an observable state to another (by opposition with small-step transitions from or to an execution state).

A transition behavior_transition has source state s = source_state_identifier. Its guard formula g is defined by the translation of the expression behavior_condition as a logical formula. Its target state d = destination_state_identifier is that of the transition system defined by the semantic function T (s, d) (defined Section IV-D) applied to its action block behavior_action_block.

A transition_identifier, if present, is represented by a label L that names the clock of the transition. It is a (virtual) event considered present and true iff the guard formula of that transition holds and the constraint of the automaton is enforced: the transition (L : s, g, f, d) is equivalent to the transition (s, g, f, d) with the constraint L ⇔ (s ∧ g).

A behavior_transition_priority, if present, enforces a deterministic logical order of evaluation among transitions. A pair of transitions (s[m], g1, f 1, s1) and (s[n], g2, f 2, s2) from a state s and such that m > n (to mean that m has higher priority than n) is equivalent to the transitions (s, g1, f 1, s1) and (s, g2 ∧ ¬g1, f 2, s2): the guard formula of a prioritized transition is subtracted to all transition in the same state of lower or no priority.

C. Behavior Conditions

Behavior conditions that cause transitions may be either execute conditions or dispatch conditions (see Figure 6 for the syntax).

Execute conditions are Boolean-valued expressions, and may only be used in transitions leaving an execution (or initial) state. State machines may never 'stall' in execution states; there must always be an enabled, outgoing transition from an execution state. The otherwise condition occurs when no other execute condition off an execution state is true.

Dispatch conditions can only be associated with transitions from a complete state. A thread scheduler evaluates dispatch conditions to determine when threads are dispatched. A dispatch trigger condition can be the arrival of events or event data on ports (expressed as a disjunction of conjunctions) or timeout.

Periodic dispatches are always considered to be implicit unconditional dispatch triggers on complete states and handled by dispatch conditions without dispatch trigger condition.

Dispatch can also be triggered by event arrival at the predeclared Stop port. Timeout catch is a dispatch trigger condition that is raised after the specified amount of time since the last dispatch or the last completion is expired.

Semantics:

A dispatch_condition is represented by a guarding formula g that is formed by referring to the clock p of the logical combination of ports specified as its dispatch_trigger_condition. An execute_condition is represented by a guarding formula that encodes its logical_value_expression using the current state of its persistent variables V . The otherwise clause is handled as the guard of least priority. It is hence defined by (ˆs -tick A (s)), which differs from the stuttering clock of s, τ A (s).

In the case of a time-triggered dispatch, when the dispatch trigger condition of an on dispatch clause is empty, the Boolean true is assumed, but only in the scope of the denoted object. It means that the dispatch condition is considered to be present as soon as time- triggered and an event is to be handled (otherwise, it can be regarded as silent, i.e., absent).

A timeout clause, if present, is denoted by the dispatch of the virtual event port timeout, whose trigger is associated with a real time constraint of the parent component behavior action block. It can be associated with a port list to reset timer from before timing out by arrival of an event at listed port. The parent component is responsible for triggering this event by respecting the real time constraint behavior time, if specified, as well as with the specified frozen ports list, if present.

D. Action language

The action language of the behavior annex defines actions performed during transitions. Actions associated with transitions are action blocks that are built from basic actions and a minimal set of control structures: sequences, sets, conditionals and loops (see Figure 6 for the syntax). Action sequences are executed in order, while actions in actions sets can be executed in any order.

Basic actions can be assignment actions, communication actions or time consuming actions. Assignments consist of a value expression and a target reference (local variables, data components acting as persistent state variables, or outgoing features such as ports and parameters) for the value assignment, separated by the assignment symbol ":=".

Communication actions can be freezing the content of incoming ports, initiating a send on an event, data, or event data port, initiating a subprogram call or catching a previously raised execution timeout exception.

Time consuming actions, or timed actions, can be predefined computation actions. Computation actions specify computation time intervals. An execution timeout exception can be raised after any behavior action block. Raising such a timeout event may trigger a transition with a timeout catch execute condition.

Semantics: Let us recall that the transition system T representing a behavior transition is defined by T = (s, g, true, s ) T . It has source state s and a guard formula g. Its target state d is that of the transition system T defined by the semantic function call encoding the behavior action block block as T(s , d)[behavior action block ] = T . T is constructed by recursively calling function T on the action block's sub-expressions.

The recursive function T(s, d)[behavior actions] = T associates the action block behavior actions guarded by a behavior condition of formula g, of source and target states s and d, to a transition system T . It is defined by case analysis on behavior actions: . . &a n where a i results from the substitution of j by the i th element value of e in a.

• for (j in e) { a } can be translated by the action sequence a 1 ;. . . ;a n where a i results from the substitution of j by the i th element value of e in a. A basic action is translated by case analysis of its grammar's sub-clauses: ) is a timing constraint imposed on the execution time of the action block. It can either be represented by a timing property of the parent thread object or simulated by a protocol interacting with the scheduler using two virtual ports ps (start) and pf (finish) to specify a delay of time between exclusive occurrences of ps and pf , and to translate the timing specification by T(s, d)(t 1 [..t 2 ])] = {(s, true, ps, c), (c, pf , true, d)} using a complete state c and the timed constraint @ps + t 1 ≤ @pf + t 2 .

E. Expression language

The expression language is used to define expressions, the results of which are used either as logical conditions of transitions or conditional statements, or as values for assignment actions. Expressions consist of logical expressions, relational expressions, and arithmetic expressions. Values of expressions can be variables, constants or the result of another expression. Variable expression values are evaluated from incoming ports and parameters, local variables, referenced data subcomponents, as well as port count, port fresh, and port dequeue. Constant expression values are Boolean, numeric or string literals, property constants or property values.

V. RELATED WORK

Many related works have contributed to the formal specification, analysis and verification of AADL models and its annexes, hence implicitly or explicitly proposing a formal semantics of the AADL in the model of computation and communication of the verification framework considered.

The analysis language REAL [START_REF] Gilles | Expressing and enforcing user-defined constraints of aadl models[END_REF] allows to define structural properties on AADL models that are checked inductively visiting the object of a model under verification. [START_REF] Cofer | Compositional verification of architectural models[END_REF] presents an extension of this language called LUTE which further uses PSL (Property Specification Language) to check behavioral properties of models as well as a contract framework called AGREE for assume-guarantee reasoning between composed AADL model elements.

The COMPASS project has also proposed a framework for formal verification and validation of AADL models and its error annex [START_REF] Bozzano | Formal verification and validation of AADL models[END_REF]. It puts the emphasis on capturing multiple aspects of nominal and faulty, timed and hybrid behaviors of models. Formal verification is supported by the nuSMV tool. Similarly, the FIACRE framework [START_REF] Berthomieu | Formal Verification of AADL models with Fiacre and Tina[END_REF] uses executable specifications and the TINA model checker to check structural and behavioral properties of AADL models.

RAMSES, on the other hand [START_REF] Borde | Architecture models refinement for fine grain timing analysis of embedded systems[END_REF], presents the implementation of the AADL behavior annex. Its implementation OSATE proceeds by model refinement and can be plugged in with Eclipse-compliant backend tools for analysis or verification. For instance, the RAMSES tools uses OSATE to generate C code for OSs complying the ARINC-653 standard.

Synchronous modeling is central in [START_REF] Peter Csaba Ölveczky | Formal semantics and analysis of behavioral aadl models in real-time maude[END_REF], which presents a formal real-time rewriting logic semantics for a behavioral subset of the AADL. This semantics can be directly executed in Real-Time Maude and provides a synchronous AADL simulator (as well as LTL model-checking). It is implemented by the tool AADL2MAUDE using OSATE.

Similarly, Yang et al. [START_REF] Yang | Two formal semantics of a subset of the AADL[END_REF] define a formal semantics for an implicitly synchronous subset of the AADL, which includes periodic threads and data port communications. Its operational semantics is formalised as a timed transition system. This framework is used to prove semantics preservation through model transformations from AADL models to the target verification formalism of timed abstract state machine (TASM).

Our proposal carries along the same goal and fundamental framework of the related work: to annex the core AADL with formal semantic frameworks to express executable behaviors and temporal properties, by taking advantage of model reduction possibilities offered thanks to a synchronous hypothesis, of close correspondence with the actual semantics of the AADL.

Yet, we endeavour in an effort of structuring and using them together within the framework of a more expressive multi-rate or multi-clocked, synchronous, model of computation and communication: that of polychrony. Polychrony would allow us to gain abstraction from the direct specification of executable, synchronous, specification in the AADL, yet offer services to automate the synthesis of such, locally synchronous, executable specification, together with global asynchrony, when or where ever needed.

CCSL, the clock constraint specification language of the UML profile MARTE [START_REF] Mallet | The clock constraint specification language for building timed causality models[END_REF], relates very much to the effort carried out in the present document. CCSL is an annotation framework to making explicit timing annotation to MARTE objects in an effort to disambiguate its semantic and possible variations.

CCSL actually provides a clock calculus of greater expressivity than polychrony, allowing for the expression of unbounded, asynchronous, causal properties between clocks (e.g. inf and sup).

While CCSL essentially is isolated as an annex of the MARTE standard for specifying annotations, our approach is instead to build upon the semantics of the existing behavior annex and specify it within a polychronous model of computation and communication.

Finally, the Behavior Language for Embedded Systems with Software (BLESS) [START_REF] Larson | BLESS: Formal specification and verification of behaviors for embedded systems with software[END_REF], [START_REF] Larson | Enabling safe interoperation by medical device virtual integration[END_REF] was derived from the behavior annex by adding non-executable assertions to behavior to become a proof outline. With human guidance, a proof engine transforms proof outlines into deductive proofs that every execution conforms to a formal behavior specification. Although the formal semantics defined for BLESS are expressed much differently than the semantics for behavior annex defined here, they are not incompatible. We are endeavoring to merge the semantics so that deductively proved BLESS behaviors can also be analyzed with polychronous tools such as Polychrony.

Our previous work demonstrated that all concepts and artefacts of the AADL could, as specified in its normative documents, be given a formal specification in the polychronous model of computation and communication [START_REF] Ma | System Synthesis from AADL using Polychrony[END_REF], [START_REF] Yu | System-level co-simulation of integrated avionics using Polychrony[END_REF], [START_REF] Ma | Toward polychronous analysis and validation for timed software architectures in aadl[END_REF], [START_REF] Yu | Polychronous modeling, analysis, verification and simulation for timed software architectures[END_REF], [START_REF] Yu | Exploring system architectures in AADL via Polychrony and SynDEx[END_REF], [START_REF] Besnard | Timed behavioural modelling and affine scheduling of embedded software architectures in the AADL using Polychrony[END_REF], implemented by mean of its import and simulation in the Eclipse project POP's toolset available from the Polarsys Industry Working Group4 .

VI. CONCLUSION

In this paper, we propose a formal semantics for a significant subset of the behavioral specification annex of the Architecture Analysis and Design Language (AADL). This annex allows one to attach a behavior specification to any components of a system modeled using the AADL, and can be then analyzed for different purposes which could be, for example, the verification of logical, timing or scheduling requirements.

The addressed subset includes the transition system (state variables, states and transitions), the conditions that can be attached to transitions, the action language allowing to describe actions to be computed when a transition is fired and the expression language, used for logical conditions and assignment actions.

The semantics we presented for this subset relies on constrained automata (automata with variables derived from polychronous automata) and supports unambiguous reasoning, formal verification and simulation of the modeled system.

In future work, we will provide semantics for the remaining subset of the behavior specification annex of the AADL (mainly the synchronization protocols allowing to send and receive execution request in a client-server configuration). We will also implement the semantics of the behavior specification annex through a model transformation from the annex to the Signal language, in which the constrained automata are already implemented.

  behavior_annex ::= [ variables { behavior_variable }+ ] [ states { behavior_state }+ ] [ transitions { behavior_transition }+ ]

Figure 4 .

 4 Figure 4. Constituents of the behavior annex syntax for the transition system.

Figure 5 .

 5 Figure 5. Elements of the behavior annex syntax for transitions.

|Figure 6 .

 6 Figure 6. Elements of the behavior annex syntax for conditions, actions and expressions

•

  a behavior action sequence is represented by concatenating the transition systems of its elements. For instance, T(s, d)[action 1 ; action 2 ] is translated by the union T 1 T 2 of its transition systems T 1 = T(s, e)[action 1 ] and T 2 = T(e, d)[action 2 ], by introducing a new execution state e; • a behavior action set is represented by composing the transition systems of its elements. For instance, T(s, d)[action 1 & action 2 ] is translated by the synchronous compositionT = (T 1 |T 2 )[(s 1 , s 2 )/s, (d 1 , d 2 )/d]of its transition systems T 1 = T(s 1 , d 1 )[action 1 ] and T 2 = T(s 2 , d 2 )[action 2 ], substituting the composed states (s 1 , s 2 ) and (d 1 , d 2 ) by s and d. A behavior action is translated by case analysis of its form:• if (b) a 1 else a 2 end if is translated by a guard formula g corresponding to logical expression and returning the unionT = T 1 T 2 {(s, g, true, s 1 ), (s, ¬g, true, s 2 )} of its transition systems T 1 = T(s 1 , d)[a 1 ] and T 2 = T(s 2 , d)[a 2 ]where the guard formula g is the translation of the logical value expression, b;• while ( b ) { a } is translated by the union T 1 T 2 of its transition systems T 1 = T(s 1 , s 2 )[a] and T 2 = {(s, h, true,s 1 ), (s, ¬h, true, d), (s 2 , h, true, s 1 ), (s 2 , ¬h, true, d)} where the guard formula h is the translation of the logical value expression, b; • do a until (b) is translated by the union T 1 T 2 of its transition systems T 1 = [a] and T 2 = (s 1 , h, true, s), (s 1 , ¬h, true, d) where the guard formula h is the translation of the logical value expression, b; • forall (j in e) { a } can be translated by the action set a 1 &.

•

  an assignment action to a variable v:=e is represented by updating v with e as T(s, d)[v := e] = {(s, true, v = e, d)} where v represents the next value of v; • an output port action port!(value) is represented by an action formula that binds value to port by T(s, d)[port!value] = {(s, true, port = value, d)}; • an input port action port?(target) is represented by an action formula that updates target to port by T[port?target] = {(s, true, target = port, d)}; 1 [..t 2 ]

  It means that an automaton A is silent in state s if and only if its model m satisfies the constraint C A in state s and no guard can be triggered from s with m.

	Product
	The	synchronous	product	of	two	au-
	tomata A

http://www.aadl.info/

http://www.omg.org/spec/SysML/1.4/ 978-1-5090-4270-8/16/$31.00 c 2016 IEEE

http://www.polarsys.org/projects/polarsys.pop

http://www.polarsys.org/projects/polarsys.pop

Acknowledgements

This work was partly funded by Toyota Information Technology Center (ITC) and by INRIA D2T's standardization support program. The authors wish to thank Pierre Dissaux and the SAE sub-committee on the AADL for supporting this work with valuable comments on the model and method presented in this paper.