Atsuyuki Inoue
email: atinoue@earth.s.chiba-u.ac.jp

Bruno Lanson

Maria Marques-Fernandes

Boris A Sakharov

Takashi Murakami

Alain Meunier

Daniel Beaufort

ILLITE-SMECTITE MIXED-LAYER MINERALS IN HYDROTHERMAL ALTERATION OF VOLCANIC ROCKS: I. ONE-DIMENSIONAL XRD STRUCTURE ANALYSIS AND CHARACTERIZATION OF COMPONENT LAYERS

Keywords: Alkylammonium-exchange, expandability, hydrothermal system, illite-smectite mixed layer minerals, one-dimensional XRD structure analysis

For a series of mixed-layer illite-smectite (I-S) minerals from a drill hole near the Kakkonda geothermal field, one-dimensional structure analysis by X-ray diffraction (XRD) was performed using Ca-saturated specimens at both air-dried and ethylene glycol solvated states. The expandability characteristics of component layers were also examined by means of alkylammonium exchange and Li-saturation. The K content in illite layer was almost constant at 1.5-1.7/O 20 (OH) 4 in the I-S series from 3% to 85% of I-layer content (% I). The layer charge of smectite layer varied slightly within the ranges of <0.5/O 10 (OH) 2 by alkylammonium exchange experiments and the expandability was independent of the beidellite content within a range of 0-0.5 by Li-saturation test. The degree of long-range ordering represented by Reichweite (R) parameters varied consecutively from R0 to R3 via R1 and R2 with increase of % I. The I-S samples contained <10% vermiculite as the third component and the vermiculite content tended to decrease with progressive illitization.

In contrast to the smectitic R0 samples (<10% I), more illitic R0 (e.g., 35% I) and >R1 I-S samples showed complicated expandability with alkylammonium exchange.

The XRD patterns of dodecylammonium exchanged I-S samples can be interpreted by random interstratification of several types of sub-units such as layer-doublets, layer-triplets and layer-quarutets present in the crystallites. This interpretation is consistent with the variation in the occurrence probabilities of layer-multiplets calculated from the junction probabilities and the proportions of layers. Because the interpretation indicates that I-S is a stack of various types of the sub-units, the smectite illitization can be described by a systematic change in the type and proportion of the sub-units constituting crystallites.

INTRODUCTION

Sequential smectite-to-illite reaction via their mixed-layer minerals (hereafter called smectite illitization) has been documented in low-temperature crustal environments and is commonly associated with burial diagenesis, low-grade metamorphism, contact metamorphism and hydrothermal alteration. Despite extensive investigation over the last several decades (see a recent review of [START_REF] Meunier | Illite[END_REF], many unresolved points remain, including the crystal chemical models of illite-smectite (I-S) mixed-layering structures and the illitization mechanism. Previous X-ray diffraction (XRD) studies of I-S minerals documented that smectite illitization occurs with a continuous variation in the proportions of smectite (S) and illite (I) layers regardless of geologic environments (e.g., [START_REF] Hower | Mechanism of burial metamorphism of argillaceous sediments: Mineralogical and chemical evidence[END_REF] for diagenesis; [START_REF] Inoue | Mineralogical properties and occurrence of illite/montmorillonite mixed layer minerals formed from Miocene volcanic glass in Waga-Omono district[END_REF] for hydrothermal alteration). The sequence of interstratified I-S minerals with different I/S ratios also includes a continuous change in the ordering of layer-stacking from smectite-rich R0 I-S to illite-rich R3 I-S, where R is the Reichweite parameter [START_REF] Jagodzinski | Eindimensionale fehlordnung in hristallen und ihr einfluss auf die Rontgeninterferenzen. I. Berechnung des fehlordnungsgrades au der Rontgenintensitaten[END_REF]. However, recent transmission electron microscopy (TEM) studies indicated that smectite, R1 and illite layers are abundant, whereas I-S with other types of orderings (i.e., R>1) are rare [START_REF] Dong | Phase relations among smectite, R1 illite-smectite, and illite[END_REF]Bauluz et al., 2000 and references therein). Thus the continuous change in proportion of S-and I-layers and the orderings indicated by XRD investigations is in contradiction with the discontinuous change revealed by TEM observations. [START_REF] Altaner | Comparison of structural models of mixed-layer illite/smectite and reaction mechanisms of smectite illitization[END_REF] and [START_REF] Plançon | Consistent modeling of the XRD patterns of mixed-layer phyllosilicates[END_REF] argued that there are two ways to describe the layer-stacking sequence of I-S interstratification from the crystallochemical points of view. That is, one is the interstratification of two individual 2:1 layers with respectively homogeneous smectite and illite compositions. This type of stacking model is called as a non-polar 2:1 layer model [START_REF] Altaner | Comparison of structural models of mixed-layer illite/smectite and reaction mechanisms of smectite illitization[END_REF]. The other way is to describe it on the basis of stacking of two interlayer-centered smectite and illite in which each 2:1 layer has heterogeneous composition, and it is called as a polar 2:1 layer model [START_REF] Altaner | Comparison of structural models of mixed-layer illite/smectite and reaction mechanisms of smectite illitization[END_REF]. It is still controversial which is the better way to describe the layer stacking sequence of I and S layers within a crystallite which acts as a coherent unit able to scatter X-rays. Furthermore, whether or not the third component layer, which is often called "vermiculite" or "high-charged smectite" layer, exists in I-S stacks and whether or not the formation acts as an essential step during smectite illitization are unresolved (e.g., Drits et al., 1997a;[START_REF] Meunier | Vermiculitization of smectite interfaces and illite layer growth as a possible dual model for illite-smectite illitization in diagenetic environments: a synthesis[END_REF].

Finally, since the illitization mechanism is deduced from these basic XRD and TEM data, the mechanistic relations between layer-by-layer, solid-state transformation (SST) and dissolution-crystallization (DC) models are major points of contention [START_REF] Altaner | Comparison of structural models of mixed-layer illite/smectite and reaction mechanisms of smectite illitization[END_REF].

Both the illitization process and the crystal chemistry of I-S depend on variables in different systems, which include temperature, compositions of fluid and rock and water/rock ratio in addition to geologic time. Among many geologic environments mentioned above, hydrothermal alteration is the most appropriate to investigate illitization because we can minimize the effects of precursor materials on illitization in hydrothermally altered volcanic rocks. Although the illitization in diagenesis of pelitic rocks is most common, the rocks contain precursor smectite, detrital illite and other phyllosilicates. Variability in the inherited characteristics of smectite formed in preceding weathering may influence on succeeding illitization during burial diagenesis. The factor of time may be ignored in the case of I-S formation in hydrothermal alteration because the formation generally took place over a geologically short period of time in contrast to burial diagenesis.

This study investigates an I-S series of hydrothermal alteration origin, i.e., I-S minerals from a drill hole (IT-2) near the Kakkonda active geothermal system, Japan. This field is characterized by constant, high geothermal gradients (15 o ~20 o C/100 m) at least up to 1700 m, neither boiling nor circulation of fluids, and no alteration overprint [START_REF] Inoue | Genesis of Na-series rock alteration widespread in the southeastern area of Hachimantai geothermal field: water-rock interactions driven by descending groundwater and fossil seawater[END_REF]. The I-S minerals are formed from Miocene to Pleistocene felsic volcaniclastic rocks with a limited range of composition under temperatures similar to the present temperature and nearly constant water/rock ratio [START_REF] Inoue | Genesis of Na-series rock alteration widespread in the southeastern area of Hachimantai geothermal field: water-rock interactions driven by descending groundwater and fossil seawater[END_REF][START_REF] Plançon | Consistent modeling of the XRD patterns of mixed-layer phyllosilicates[END_REF].

The occurrence, bulk mineralogy, fluid geochemistry and isotope characteristics were described in detail in these previous papers. More detailed XRD and high-resolution TEM (HRTEM) characterization of selected I-S minerals has been undertaken to elucidate the unresolved points mentioned above and to better understand the mechanism of I-S formation. This work consists of two parts; special attention in the first part is paid to characterize the expandability behavior of component layers in the Kakkonda I-S series based on one-dimensional XRD structure analysis and supplementary examinations by alkylammonium ions exchange and Li ion saturation techniques. The results of HRTEM study will be described in part 2 (Murakami et al., 2005, this issue).

SAMPLES AND EXPERIMENTAL METHODS

Samples

Eleven samples were selected from an I-S series in felsic volcaniclastic rocks from a drill core (Hole IT-2) near the Kakkonda active geothermal system, Japan. A summary of sample characteristics is provided in Table 1.

X-Ray diffraction structure analysis

Structure analysis of seven samples (435m, 580m, 635m, 645m, 690m, 700m and 756m) was carried out using Ca-saturated specimens to minimize the hydration heterogeneity of expandable interlayers. Separated clay fractions (<2µm) were first saturated with Ca ion and then the homoionic exchanged specimens were X-rayed in two states, air-dried (at controlled relative humidity of 40%) and ethylene glycolated (saturated with ethylene glycol (EG) atmosphere at 70 o C overnight). XRD patterns were recorded using a Bruker D5000 diffractometer equipped with a Kevex Si (Li) solid-state detector and Cu Kα radiation. Intensities were recorded at a 0.04 o 2θ interval, from 2-50 o , using 6 sec counting time per step.

A program developed by Drits et al. (1997a) and [START_REF] Sakharov | Determination of illite-smectite structures using multispecimen X-ray diffraction profile fitting[END_REF] was used to fit experimental XRD profiles. Many parameters necessary for simulating XRD profiles were set as done by [START_REF] Claret | Clay Minerals in the Meuse-Haute Marne underground laboratory (France): Possible influence of organic matter on clay mineral evolution[END_REF]. We assumed the existence of three component layers, illite (I), smectite (S) and vermiculite (V) composed of each non-polar 2:1 layer in the simulations. The S-layer is defined as a fully expandable interlayer with 2 H 2 O molecules at 40% relative humidity or 2 EG molecules when the interlayer site is occupied by homoionic Ca ions. The V-layer is defined as a partly expandable interlayer with 1 H 2 O or 1 EG molecules and the I-layer as a non-expandable interlayer without H 2 O or EG molecules (Drits et al., 1997a;[START_REF] Meunier | Vermiculitization of smectite interfaces and illite layer growth as a possible dual model for illite-smectite illitization in diagenetic environments: a synthesis[END_REF]. The amount and position of interlayer species such as H 2 O and EG molecules in addition to fixed K ion were considered as variable parameters during fitting process.

The iron contents of octahedral sheets were also optimized during fitting. The accuracy of profile fitting was assessed by means of the residual factor (R WP ) between experimental and simulated intensities at 2-50 o 2θ [START_REF] Howard | Profile fitting of powder diffraction patterns[END_REF].

Alkylammonium exchange

Expandability (or layer charge) characteristics of component layers in I-S were also examined using two C 12 -alkylammonium (dodecylammonium) and C 18 -alkylammonium (octadecylammonium) exchanged specimens. Following the protocol described by [START_REF] Wilson | X-ray powder diffraction methods[END_REF], about 15mL of pH-adjusted alkylammonium chloride solution (0.1M for C 12 -alkylammonium and 0.05M for C 18 -alkylammonium)

were added to about 20mg of Na-saturated, freeze-dried powder specimens and heated in an oil bath at 65 o C for three days. Excess alkylammonium chloride was removed by repeated washing with 1:1 ethanol/water and pure ethanol followed by centrifugation; the paste was spread over a glass slide and kept in a vacuum desiccator. The reproducibility was checked by two mutually-independent experiments. XRD patterns of alkylammonium (AL) exchanged specimens were recorded using a Rigaku RAD-IB diffractometer with monochromatized Cu Kα radiation.

Intensities were recorded at a 0.01 o 2θ interval, from 2-33 o , using 4 sec counting time per step. Peak decomposition was made on experimental XRD profiles of C 12 -AL exchanged specimens over 2-12 o 2θ using a DECOMPXR program developed by [START_REF] Lanson | Decomposition of experimental X-ray diffraction patterns (profile fitting): a convenient way to study clay minerals[END_REF].

For comparison, vermiculite (Palabora, South Africa), two rectorite samples (Goto and Ohara, Japan) and another I-S series (Shinzan, Japan) were examined. The average layer charge of the Palabora vermiculite is 0.83/O 10 (OH) 2 based on data of [START_REF] Inoue | Thermodynamic study of Na-K-Ca exchange reactions in vermiculite[END_REF]. The Goto rectorite is the same material as that studied by [START_REF] Lagaly | The "layer charge" of regular interstratified 2:1 clay minerals[END_REF], though our sample contains illite and pyrophyllite as impurities. The structure formula of Ohara rectorite is (K 0.92 Na 0.10 Ca 0.23 )(Al 3.86 Fe 3+ 0.07 Mg 0.09 Ti 0.01 )(Si 6.52 Al 1.48 )O 20 (OH) 4 (Y. Shinohara, unpublished data). The Shinzan I-S minerals are hydrothermal alteration products of Miocene volcaniclastic rocks, of which composition is similar to those of Kakkonda. The mineralogy of Shinzan I-S series has been described in [START_REF] Inoue | Mineralogical properties and occurrence of illite/montmorillonite mixed layer minerals formed from Miocene volcanic glass in Waga-Omono district[END_REF], [START_REF] Inoue | Further investigations of a conversion series of dioctahedral mica/smectites in the Shinzan hydrothermal alteration area, northeast Japan[END_REF] and [START_REF] Inoue | Chemical and morphological evidence for the conversion of smectite to illite[END_REF]. The XRD and TEM characteristics have also been reported in many studies (e.g., [START_REF] Keller | Morphology of clay minerals in the smectite-to-illite conversion series by scanning electron microscopy[END_REF]Inoue et al., 1990 for XRD;[START_REF] Veblen | Highresolution transmission electron microscopy and electron diffraction of mixed-layer illite/smectite: Experimental results[END_REF][START_REF] Amouric | Illitization of smectite as seen by high-resolution transmission electron microscopy[END_REF][START_REF] Olives | Mixed layering of illite-smectite: Results from high-resolution transmission electron microscopy and lattice-energy calculations[END_REF] for TEM). Thus the Shinzan I-S samples may be regarded as "a reference" of hydrothermal I-S minerals.

Li-saturation

Distinction between montmorillonitic and beidellitic components in smectite layers was made by Li-saturation [START_REF] Hofmann | Verlust der Austauschfahigeit von Lithiumionen an Bentonit durch Erhitzung[END_REF]. Li-saturated specimen, using a normal LiCl solution, was heated at 300 o C overnight in a ceramic crucible to avoid alkali-contamination from glass, then dispersed on a glass slide with water and glycerol-saturated after air-drying. The proportion of beidellitic component was estimated from comparison of experimental intensity ratios of 1.8-nm and 0.96-nm peaks with those of simulated XRD patterns assuming a segregation structure of beidellite and montmorillonite layers.

RESULTS

Interstratified structure analysis

Comparison of experimental and calculated XRD profiles at air-dried and EG-saturated states is illustrated in Figures 1~6, excluding the 580-m sample. The major structure parameters optimized by fittings are summarized in Table 2. For instance, in the 3-component layers system, the interstratified structure with R = 1 can be described by 9 junction probability parameters (e.g., P SS , P SV , P VS , P VV , and so on, where P SS denotes a junction probability of a S layer following a S layer) in addition to 3 parameters (W I , W S and W V ) of the proportion (or occurrence probability) of each component. Only essential parameters are listed in Table 2, and all the other parameters can be easily calculated from those given in the table [START_REF] Watanabe | The structure model of illite/smectite interstratified mineral and the diagram for its identification[END_REF][START_REF] Drits | X-Ray Diffraction by Disordered Lamellar Structures[END_REF]. The optimized d 001 value of I-layer was 0.998 nm for all the samples, those of S-layer were 1.52 nm at air-dried and 1.68 nm at EG-saturated, and those of V-layer varied from 1.23~1.25 nm at air-dried and from 1.29~1.40 nm at EG-saturated (Table 2). The K content of illite interlayer shows minimal variation and is 1.5-1.7/O 20 (OH) 4 in all samples. The optimized Fe contents are consistent with the electron microprobe analyses (Table 1), except for the 435-m sample. The samples studied contain small amounts of impurities as given in Table 1. We did not subtract the contribution of impurities from original XRD profiles, and thereby the resultant R WP values became apparently large from 8.9% to 28.2%. Nevertheless, taking into account agreement in terms of the peak positions and intensities of I-S minerals between the experimental and calculated XRD profiles in both the air-dried and EG-saturated samples, goodness of the fittings is satisfactory as seen in Figures 1~6.

Two samples, 435-m and 580-m are smectite containing ~10% in total of I-and V-layers (Figure 1 and Table 2). Assuming 1.40 nm for the d 001 value of vermiculite layer gave a better fitting for EG-saturated 580-m sample, though the value was greater than the other assumed value of 1.29 nm (Table 2). The reason of difference in d value is unknown. The optimized Fe content in the octahedral sheets in sample 435-m is noticeably greater than that of the previous chemical analysis (Table 1). [START_REF] Inoue | Illite-smectite mixed-layer minerals in felsic voclaniclastic rocks from drill cores, Kakkonda, Japan[END_REF] reported that I-S mineral coexists with siderite at 435 m. The difference in Fe content may be due to the contamination of siderite in microprobe-analyzed sample, whereas the major impurities of the sample used in the present XRD study are cristobalite and quartz. Calculating the occurrence probabilities of layer doublets, triplets and quartets from the junction probabilities and the proportions of component layers indicates that the SS doublet is mostly dominant within crystallites of 435-m and 580-m samples (Table 3). The occurrence probabilities of SIS and VIV triplets range around 0.02-0.04 in the 435-m and 0-0.02 in the 580-m. The mean number of layers (N) consisting of X-ray coherent domains is 10 for 435-m and 7 for 580-m.

Sample 635-m (Figure 2) is an I-S mixed-layer mineral with R = 0, W I = 0.35, W S = 0.65 at EG-saturation. The proportion of V-layer (W V ) was estimated to be 0.1 at air-dried state but it was negligible at EG-saturation. In general, the W V value tended to be equal at EG-solvated and air-dried states in the most samples studied. In some samples, the W V value at EG-solvated was smaller than air-dried state (Table 2). But the reason was not specified in the present study. In 635-m sample, the I-layer percentage (% I) or W I value determined by the present XRD analysis was underestimated in the order of about 10% compared to that determined previously by a convenient saddle/peak ratio technique of [START_REF] Inoue | Convenient technique for estimating smectite layer percentage in randomly interstratified illite/smectite minerals[END_REF] as shown in Table 1. The occurrence probability of an IS doublet (W IS ) and SIS triplet (W SIS ) increases to be 0.23 (=W I ・W S ) and 0.15 (=W S ・W I ・W S ) respectively, whereas that of SS doublet decreases to be 0.42 (Table 3) compared to those of the 435-m and 580-m samples. The mean number of layers is 15 at air-dried and 10 at EG-saturated state.

Sample 645-m (Figure 3) is a mixture of R0 and R1 ordered structures, of which proportions are 80% and 20% respectively (Table 2). The W V value in R0 phase was estimated to be 0.1, but that in R1 phase was negligible at EG-saturation. For the R0 phase, it is noted that the occurrence probability of II doublet increases and that of SS doublet decreases, compared to those of the 635-m sample. For the R1 phase, the occurrence probabilities of II and SS doublets decrease, while those of IS doublet and SIS triplet increase remarkably (Table 3). The estimated mean number of layer is smaller in R1 phase than in R0 phase (Table 2). This relation is distinct at air-dried, but becomes ambiguous at EG-saturated state as the mean number of layers is 8 for the R0 phase and 7 for the R1 phase.

Sample 690-m (Figure 4) is a R1 ordered structure with W I = 0.55, W S = 0.4, W V = 0.05 at EG-saturation. The occurrence probabilities of W IS (=W I ・P IS ), W IV (=W I ・P IV ) and W II (=W I ・P II ) were calculated to be 0.32, 0.03 and 0.20 respectively (Table 3). Comparing to the R1 phase in 645-m sample, the occurrence probabilities of IS doublet and SIS triplet decrease and those of II doublet, IIS triplet and IIIS quartet increase. The mean number of layers is 15 at air-dried and EG-saturated states.

Structures of samples 700-m and 756-m (Figures 5 and6) were determined to be R2 and R3 ordered structures respectively, assuming the arrangements of layers with maximum possible degree of ordering (MPDO) [START_REF] Drits | X-Ray Diffraction by Disordered Lamellar Structures[END_REF]. The proportion of V-layer is negligible in the two samples. In sample 700-m, the conditions of R2 ordering with R1 MPDO, W I = 0.6, W S = 0.4 at EG-saturation lead to P SS = 0 and result in W IS (=W I ・P IS ) = 0.40, W II (= W I ・P II ) = 0.20 and W SIS (=W S ・P SI ・P SIS ) = 0.10.

The occurrence probability of SIIS quartet (=W S ・P SI ・P SII ・P IIS ) is 0.11 in the 700-m sample (Table 3). The % I of 756-m sample was underestimated in the order of 10% compared to the previous estimate (Table 1) given in Figure 8. The basal spacing of smectite increased from 1.38 nm of 214-m to 1.72 nm of 580-m for C 12 -AL exchanged samples and from 1.77 nm of 214-m to 1.9 nm of 580-m for C 18 -AL exchanged samples. The XRD peaks of AL-exchanged smectite appear to be single and symmetric, suggesting a relatively homogeneous charge distribution. The change in basal spacing corresponds to the monolayer or bilayer arrangement of alkylammonium molecules due to increasing the mean layer charge [START_REF] Lagaly | Layer charge determination by alkylammonium ions. Pp. 1-46 in: Layer Charge Characteristics of 2:1 Silicate Clay Minerals[END_REF]. Extremely small d 001 values (1.38 nm by C 12 -AL exchange and 1.77 nm by C 18 -AL exchange) of 214-m sample are caused by the low-charged interlayer [START_REF] Inoue | Illite-smectite mixed-layer minerals in felsic voclaniclastic rocks from drill cores, Kakkonda, Japan[END_REF]. Excluding the 214-m sample, the mean values of layer charge tend to increase with increasing depth or the formation temperature, but the extent of the increase is extremely small. The mean layer charge of expandable interlayer in Kakkonda smectite ranges within 0.3~0.4/O 10 (OH) 2 , when the values were evaluated using the calibration curves of [START_REF] Olis | The rapid estimation of the layer charges of 2:1 expanding clays from a single alkylammonium ion expansion[END_REF]. The Palabora vermiculite exhibited symmetric, rational series reflections of 2.3 nm by C 12 -AL exchange and 3.1 nm by C 18 -AL exchange (Figure 8). The basal spacing of the Palabora vermiculite is brought about by a paraffin type of arrangement of alkylammonium ions (see the definition of [START_REF] Lagaly | Layer charge determination by alkylammonium ions. Pp. 1-46 in: Layer Charge Characteristics of 2:1 Silicate Clay Minerals[END_REF] in high-charge interlayer with >0.75/O 10 (OH) 2 according to [START_REF] Olis | The rapid estimation of the layer charges of 2:1 expanding clays from a single alkylammonium ion expansion[END_REF]. Although the XRD structure analysis recognized the V-layer of at maximum 9% at air-dried state in the 435-m and 580-m samples (Table 2), a discrete vermiculite phase was not detected by the AL-treatments.

The 635-m sample has a R0, 35% I structure by the present structure analysis.

A major peak at 1.8 nm is associated with a broad shoulder around 2.3 nm by C 12 -AL exchange, while the two peaks shifted to 3.7 nm by C 18 -AL exchange (Figure 7). Peak decomposition of the C 12 -AL exchanged sample gives two peaks at 1.8 and 2.0 nm (Figure 10). The 656-m sample with R1, ~60% I (Table 1) showed a 3.0-nm reflection for the C 12 -AL exchanged sample associated with the nearly rational higher order reflections. The C 18 -AL exchanged, 656-m sample showed a set of integral reflections of 3.3 nm (001), 1.65 nm (002) and 1.07 nm (003). The expandability behavior is similar to those of true rectorite samples from Goto and Ohara (Figure 8 and [START_REF] Lagaly | The "layer charge" of regular interstratified 2:1 clay minerals[END_REF], though the reflections of 656-m sample become broader and greater in d value than true rectorite. I-S samples with >R3, >85% I (756-m and 919-m) showed a discrete peak around 1 nm in addition to peaks at 2.45 nm and ~1.2 nm by C 12 -AL exchange.

The 2.45-nm peak is similar to that appeared in the 635-m sample. The I-S samples with >R1, >60% I displayed a basal spacing of 3.3~3.6 nm and the rational higher order reflections by C 18 -AL exchange, which is similar to the behavior of the 635-m sample but not similar to macroscopic vermiculite.

The Shinzan I-S series exhibited similar expandability behavior for C 12 -AL exchange (Figure 9) and C 18 -AL exchange (not presented) as functions of % I and Reichweite parameters to those of Kakkonda series mentioned above. Extra peaks by C 12 -AL exchange appeared at low-angle side of the main peak of about 1.8 nm in all R0 samples from Shinzan. Peak decomposition of the Shinzan R0 and R1 phases, together with the Kakkonda I-S minerals, indicates that the position of extra peaks shifts gradually toward the d 001 (2.8~3.0 nm) of R1 structure with increasing % I (Figure 10).

Li-saturation

In the Li-saturation test, the layer charge arising from octahedral substitution in montmorillonite is neutralized by migration of Li ions at heating, whereas the charge arising from tetrahedral substitution in beidellite is not neutralized by the Li-migration.

As a result, 1.8-nm and 0.96-nm peaks after glycerol-solvation are representative of beidellitic and montmorillonitic layers, respectively [START_REF] Wilson | X-ray powder diffraction methods[END_REF]. The result of the Li-saturation tests (Figure 11) indicates that the proportion of beidellite component increases from ~0.1 of the 320-m to 0.55 of the 580-m samples and the 214-m sample contains about 0.2 of beidellite component, which is consistent with the chemical analysis data (Table 1).

DISCUSSION

Characteristics of component layers in I-S

The one-dimensional XRD analysis of interstratification revealed that the Kakkonda I-S minerals are composed of three component (S, V and I) layers with variable proportions. Actually the V-layer content is very low through the I-S series.

The optimized d 001 value of I-layer is 0.998 nm and is similar to those for diagenetic I-S samples reported by Drits et al. (1997a) and [START_REF] Claret | Clay Minerals in the Meuse-Haute Marne underground laboratory (France): Possible influence of organic matter on clay mineral evolution[END_REF]. Drits et al. (1997b) indicated that the d 001 value of I-layer increases when the interlayer is occupied partly by NH 4 ions. The NH 4 ion was not detected in the Kakkonda I-S samples by preliminary FTIR measurements (not presented). The K content of I-layer is invariable around 0.75K/O 10 (OH) 2 regardless of % I. The K content is smaller than that of the hypothetical end member illite ~0.9K/O 10 (OH) 2 , which is extrapolated from a plot of fixed K content versus % I using bulk chemical analyses of I-S minerals from various origins [START_REF] Meunier | Solid Solution in illite/smectite mixed layer minerals and illite[END_REF][START_REF] Lanson | The I/S-to-illite reaction in the late stage diagenesis[END_REF][START_REF] Srodon | Chemistry of illitesmectite inferred from TEM measurements of fundamental particles[END_REF].

Particles of more illitic I-S samples (e.g., 756-m and 919-m samples) show a lath-shaped morphology [START_REF] Inoue | Illite-smectite mixed-layer minerals in felsic voclaniclastic rocks from drill cores, Kakkonda, Japan[END_REF]. In general, the K content of illite is smaller in lath-shaped than in hexagonal ones [START_REF] Meunier | Illite[END_REF]. The fixed K content of illitic interlayer in I-S, as well as that in the end member illite of smectite illitization, may warrant further discussion.

As for the response to alkylammonium exchange, the impurity illite present in the Goto rectorite sample did not expand with C 12 -AL exchange. It is known that micaceous illites react very slowly with alkylammonium ions [START_REF] Lagaly | Layer charge determination by alkylammonium ions. Pp. 1-46 in: Layer Charge Characteristics of 2:1 Silicate Clay Minerals[END_REF]. If the illitic interlayer in I-S is non-expandable with C 12 -AL exchange, sub-units of several I-layers such as III triplets and IIII quartets may behave as a segregated domain of illite present within a crystallite of I-S. This is related to the expandability behavior observed in C 12 -AL exchanged, 756-m and 919-m samples (Figure 7). However, the illitic interlayer expands partly by C 18 -AL exchange, and thus the C 18 -AL exchange is inappropriate for the characterization of expandability of component layers in I-S minerals.

The S-layer in the Ca-saturated Kakkonda I-S samples showed a constant expandability of 1.68 nm at EG solvation and 1.52 nm at air-dried (Table 2). They also showed constant behavior for AL-exchange so as to reflect the respective mean layer charges of 0.3~0.4/O 10 (OH) 2 . As described previously, on the other hand, two peaks at 1.8 nm and 2.0~2.3 nm were observed in R0 I-S minerals (e.g., 635-m sample) by C 12 -AL exchange as well as in the Shinzan R0 I-S minerals (Figures 7 and10). If the sample is a stack of layers with a homogeneous layer charge, the 1.8-nm value of major peak can be explainable either by the transition of monolayer to bilayer or by that of bilayer to pseudotrimolecular layer; the estimated layer charge is 0.38 or 0.47/O 10 (OH) 2 respectively according to [START_REF] Olis | The rapid estimation of the layer charges of 2:1 expanding clays from a single alkylammonium ion expansion[END_REF]. The layer charge values are within those (<0.5/O 10 (OH) 2 ) of fully expandable S-interlayer based on the data of [START_REF] Christidis | Determination of layer-charge characteristics of smectites[END_REF]. The second peak of 2.0~2.3 nm by C 12 -AL exchange corresponds to a range of layer charge from 0.56~0.71/O 10 (OH) 2 , assuming the transition of bilayer to pseudotrimolecular layer. The layer charge is classified into that of high charge smectite (Chiristidis and Eberl, 2003) or vermiculite. The above assignment of C 12 -AL exchanged XRD peaks is inconsistent with the previous XRD results in which the 635-m sample consists of 35% of I-layer and 65% of S-layer. The I-layer has 0.75K/O 10 (OH) 2 and a non-expandable interlayer with C 12 -AL exchange. Thus it is more likely that the 2.0~2.3 nm peak appearing by C 12 -AL exchange may be derived from random interstratification of IS doublets and S-layers within the crystallites. A rough estimation for the 635-m sample predicts a peak generated from the random interstratification of IS and SS doublets to appear around 2.2 nm (= (0.23/0.23 + 0.42) x 2.8 nm + (0.42/0.23 + 0.42) x 1.8 nm), assuming that the d 001 value of an IS doublet is 2.8 nm (= 1.0 nm + 1.8 nm), that of S-layer is 1.8 nm, W IS = 0.23 and W SS = 0.42. This value is close to the observed one. As shown in Figure 10, the extra peak by C 12 -AL exchange shifts toward larger d values with increasing % I, in other words, with increasing the proportion of IS doublet. This fact supports the above interpretation. The major 1.8-nm peak by C 12 -AL exchange is interpreted to be derived from the dominant smectitic interlayers.

The % I of 656-m I-S with R = 1, of which % I was estimated to be 62% by [START_REF] Inoue | Illite-smectite mixed-layer minerals in felsic voclaniclastic rocks from drill cores, Kakkonda, Japan[END_REF], is somewhat larger than 50% of perfectly ordered rectorite (i.e., Goto and Ohara samples). The 656-m sample contains much more II doublets and IIS triplets in crystallites compared to perfectly R1-ordered rectorite, inferring from the XRD data of the 690-m sample and the R1 phase in the 645-m sample (Table 3). This results in deviation of peak position by C 12 -AL exchang from that of true rectorite, as shown by [START_REF] Lagaly | The "layer charge" of regular interstratified 2:1 clay minerals[END_REF]. The expandability behavior of >R3 I-S phases (e.g., 756-m and 919-m samples) by C 12 -AL exchange cannot be explained by the assumption of vermiculite layer because of their negligible amounts by EG-saturation. Rather, the expanbability behavior may be interpreted by random interstratification of several types of multiplets organized by abundant I-layers and few S-layers. In conclusion there is considerable variability in the response in expandability of the component layers in I-S depending on the used reagents and the variability leads to ambiguity in the interpretation. We cannot obtain more accurate structural information on the AL-exchanged I-S minerals because the detailed arrangement of intercalated AL ions in the interlayer sites is unknown. Nevertheless, it is emphasized that the C 12 -AL exchange data, in combination with the structure data by usual H 2 O-and EG-saturation, provide useful information on the stacking sequence of component layers in I-S crystallites as discussed below.

The Li-saturation test of Kakkonda smectite and R0 I-S reveals that the expandability behavior of smectitic interlayer is independent of the content of beidellitic layer at least up to 0.5.

Layer stacking model of I-S

As mentioned previously, there are two models to describe the component layers constituted the I-S interstratification: non-polar and polar 2:1 layer models [START_REF] Altaner | Comparison of structural models of mixed-layer illite/smectite and reaction mechanisms of smectite illitization[END_REF]. [START_REF] Plançon | Consistent modeling of the XRD patterns of mixed-layer phyllosilicates[END_REF] demonstrated that there is not noticeable difference in simulated XRD patterns between the two models, unless the charge of 2:1 layer is derived from the Si-Fe substitutions in tetrahedral sheets. This suggests that the structure parameters obtained in the present study may be applied to either the polar 2:1 layer model or the non-polar 2:1 layer model, though the latter model was used actually in the simulation. Previous NMR investigation of rectorite supports the polar layer model [START_REF] Barron | Ordering of aluminium in tetrahedral sites in mixed-layer 2:1 phyllosilicates by solid-state high-resolution NMR[END_REF][START_REF] Altaner | Evidence from 29 Si NMR for the structure of mixed-layer illite/smectite clay minerals[END_REF][START_REF] Jakobsen | Sequences of charged sheets in rectorite[END_REF]. A first-principles calculation of Stixrude and Peacor (2002) demonstrated that the polar 2:1 layer structure has a total energy lower than the non-polar structure for rectorite. [START_REF] Lagaly | The "layer charge" of regular interstratified 2:1 clay minerals[END_REF] explained the expandability behavior of alkylammonium-exchanged rectorite on the polar layer model scheme. In contrast to the polar layer model, in theory, three types of interlayer sites are expected within a crystallite of I-S with 2-component layers in the non-polar layer model: a low-charge interlayer behaved as smectite, a high-charge interlayer as illite and an intermediate-charge interlayer as "vermiculite", because the interstratification is composed of chemically homogeneous smectite and illite layers that are electrically neutral in each layer [START_REF] Plançon | Consistent modeling of the XRD patterns of mixed-layer phyllosilicates[END_REF]. In fact, only negligible amounts of vermiculite layer were detected in the present XRD analysis of Kakkonda I-S minerals using the non-polar 2:1 layer model. Consequently, the interpretation of layer stacking in I-S minerals should be constructed consistently on the basis of the polar 2:1 layer model scheme regardless of % I values.

For the intention of describing the mode of layer stacking, we introduce a new symbol M, which is different from the Reichweite parameter. Following the polar layer model, and taking into account the occurrence probabilities of layer doublets, triplets and quartets (Table 3) and the expandability behavior by AL-exchange, an I-S crystallite stacked by several layers can be considered to consist of several types of sub-units (or modules) such as M0 (-SS-), M1 (-SIS-), M2 (-SIIS-), M3 (-SIIIS-), ….. Mn (-SI…..IS-), where the S and I stand for the smectitic and illitic interlayers on the basis of the polar 2:1 layer model. The -S and S-represent a half part of smectitic interlayer at the outermost surface and the n denotes the number of illitic interlayers sandwiched between two outermost smectitic surfaces. A similar model was applied to the interpretation of TEM images of I-S minerals by [START_REF] Bauluz | Transmission electron microscopy study of illitization in pelites from the Iberian Range, Spain: layer-by-layer replacement?[END_REF]. This module-stacking model may be useful to interpret the XRD patterns of alkylammonium-exchanged I-S minerals as discussed above, as well as the HRTEM images (Murakami et al., 2005, this issue). Since the ordering of I-S minerals (i.e., Reichweite) represents long-range ordering averaged over all layers that scatter X-ray radiation, direct application of the module-stacking model to XRD data may be inappropriate at present. Nevertheless we infer that for example, the occurrence probability of an IS doublet or a SIS triplet is related to that of M1 (-SIS-) type of module within an I-S crystallite. The actual modes of layer stacking will be provided by the HRTEM observations of the AL-exchanged samples (Murakami et al., 2005 this issue).

Transformation of I-S minerals

The Kakkonda I-S minerals studied here are constituents of sequential smectite illitization in hydrothermally alterated volcanic rocks as a function of temperature from 70 o C to 200 o C [START_REF] Inoue | Illite-smectite mixed-layer minerals in felsic voclaniclastic rocks from drill cores, Kakkonda, Japan[END_REF]. According to the present module-stacking model, the illitization can be described as follows. The smectite precipitated at temperatures of <140 o C from solution through hydrolysis reactions of volcanic glass with meteoric water. This interpretation is supported by the textural observations and oxygen isotope measurements [START_REF] Inoue | Illite-smectite mixed-layer minerals in felsic voclaniclastic rocks from drill cores, Kakkonda, Japan[END_REF]. The precipitate is a stack of M0 type of module. The mean layer charges of product smectite (or M0 modules) are 0.3~0.4/O 10 (OH) 2 . The V-layer contents are in the order of 10% at maximum. The I-layer contents also are very low but occurs as a M1 type of module in the crystallites with N < 10. Since it is assumed that the composition of original volcanic rocks and the water/rock ratio during the illitization are nearly constant at Kakkonda [START_REF] Inoue | Illite-smectite mixed-layer minerals in felsic voclaniclastic rocks from drill cores, Kakkonda, Japan[END_REF], the precipitation of modules is a function of temperature and fluid composition.

There are few occurrences of R0 I-S minerals in the studied drill hole [START_REF] Inoue | Illite-smectite mixed-layer minerals in felsic voclaniclastic rocks from drill cores, Kakkonda, Japan[END_REF]. R1, R2 to R3. On the other hand, a model of stepwise smectite illitization process was inferred from the TEM investigation of both diagenetic and hydrothermal I-S samples [START_REF] Dong | Phase relations among smectite, R1 illite-smectite, and illite[END_REF][START_REF] Bauluz | Transmission electron microscopy study of illitization in pelites from the Iberian Range, Spain: layer-by-layer replacement?[END_REF][START_REF] Masuda | Transmission electron microscopy study of conversion of smectite to illite in mudstones of the Nankai Trough: Contrast with coeval bentonites[END_REF][START_REF] Tillick | Genesis of dioctahedral phyllosilicates during hydrothermal alteration of volcanic rocks: I. The Golden Cross epithermal ore deposit[END_REF][START_REF] Yan | Genesis of dioctahedral phyllosilicates during hydrothermal alteration of volcanic rocks: II. The Broadlands-ohaaki hydrothermal system, New Zealand[END_REF][START_REF] Bauluz | Transmission electron microscopy study of smectite illitization during hydrothermal alteration of a rhyolitic hyaloclastite from Ponza, Italy[END_REF]. In their model, the transformation of smectite illitization is characterized by discontinuity from smectite → R1 I-S → illite without R0, R2, and R3 I-S, using the Reichweite parameter.

In another point of view, Drits et al. (1997a) noted from XRD study of pelitic rocks from North Sea that the proportion of V-layer remained constant at levels of W V = 0.04-0.08 in the latest stage of illitization. They proposed a single interlayer transformation (SIT) mechanism via K-fixation in vermiculitic interlayer and succeeding transformation to illitic interlayer, which is equivalent to a layer-by-layer SST mechanism. In the Kakkonda I-S series, the V-layer content was very small as a whole and rather tended to decrease at latest stage of illitization (Table 2). The 700-m sample has a R2 ordering, of which phase was considered to be relatively rare in smectite illitization [START_REF] Inoue | Further investigations of a conversion series of dioctahedral mica/smectites in the Shinzan hydrothermal alteration area, northeast Japan[END_REF][START_REF] Srodon | Illite[END_REF]. It is expected that illitization by layer-by-layer SST mechanism produces R3 structure directly from R1 structure without via R2 structure [START_REF] Drits | Mixed-layer minerals[END_REF]. Thus the layer-by-layer transformation model via the formation of vermiculite layers is difficult to apply to the smectite illitization mechanism in hydrothermal alteration of volcanic rocks at Kakkonda. The transformation mechanism from R1 to R3 will be discussed in more detail based on the module-stacking model in part 2 (Murakami et al., 2005, this issue).

SUMMARY AND CONCLUSIONS

In this study, we determined the one-dimensional layer stacking sequence of I-S including the quantification of occurrence probabilities of several types of layer-doublets, layer-triplets and layer-quartets, using an I-S series from hydrothermally altered volcanic rocks. Supplementary alkylammonium exchange and Li-saturation experiments, together with the above XRD data, provided information on the expandability and stacking characteristics of the component layers in I-S minerals. The results led to the following conclusions, (2) Some of the I-S minerals contained <10% vermiculite layer as the third component, but the content was small as a whole and tended to decrease with progressive illitization.

(3) The interlayer K content of illite layer was almost constant at 1.5-1.7/O 20 (OH) 4 through the illitization.

(4) The C 12 -alkylammonium exchange experiments indicated that the layer stacking of R0-type I-S minerals is composed of IS subunits and S layers, rather than individual I and S layers. The I layers within ≥R3 I-S crystallites behaved as segregated domains for the C 12 -alkylammonium exchange.

(5) The expandability behavior of smectite and R0 I-S is independent of the content of beidellitic layer at least up to 0.5.

  , probably due to different types of interlayer cations in specimens used in the two XRD measurements. In the 756-m sample, W IS = 0.13, W II = 0.70 and W IV = 0.03. The occurrence probabilities of III triplet and IIII quartet are extremely large compared to the other samples. The mean number of layers is 10 for 700-m sample and 20 for 756-m sample. Alkylammonium exchange XRD profiles of Kakkonda I-S series treated with C 12 -and C 18 -AL are illustrated in Figure 7. For comparison, XRD profiles of vermiculite and rectorite are

  With increasing temperature only slightly to 154 o C, a R0 I-S mineral with 35% I formed at 635 m depth. The mode of layer stacking in the 635-m R0 I-S sample may be described as a mixing of M0 and M1 units. The mean layer charge of smectitic interlayer increases slightly to 0.38~0.47/O 10 (OH) 2 but the K content of illitic interlayer is constant at 0.75/O 10 (OH) 2 . An I-S mineral with R1 ordering, ~60% I formed at 656 m (158 o C) via the occurrence of a two-phase mixture of R0 and R1 structures at 645 m depth. The 656-m I-S mineral may be characterized by a mixing of dominant M1 modules and small amounts of >M2 modules, and negligible amount of M0 module, inferring from the data of 690-m sample. With further increasing depth and temperature, R2 phase formed at 700 m (166 o C) and R3 phase at 756 m (175 o C). The 756-m sample with R3, 85% I is characterized by a mixing of dominant >M2 sub-units with non-expandable illite domains. It does not contain M0 modules, and the amount of M1 module is negligible. The K ion content in illitic interlayer of precipitating Mn (n≧1) modules is constant at 0.75/O 10 (OH) 2 at 70-175 o C. The above transformation is described by a stepwise precipitation of various types of modules as a function of temperature, which is compared with the consecutive change in the Reichweite from R0,

( 1 )

 1 The XRD analysis indicated that the smectite illitization in the Kakkonda I-S minerals series occurred with a consecutive change in the R parameter from R0 to R3 in the temperature range of 70-175 o C.

  Consequently, the layer stacking in I-S crystallites is consistently interpreted by introducing a new model in which the I-S crystallites consist of component modules such as M0, M1, …., Mn based on the polar 2:1 layer. The smectite illitization occurs with the appearance and disappearance of such modules as a function of temperature in hydrothermally altered volcanic rocks, but not by a layer-by-layer mechanism via K-fixation in vermiculite layer. But it is apparent that the XRD results alone cannot assess the proposed model, and it must be ascertained by different methods such as TEM investigation.

Figure captions Figure 1 .

 captions1 Figure captions

Figure 2 .

 2 Figure 2. Comparison of experimental (cross) and calculated (line) XRD patterns of 635-m sample at Ca-saturated, air-dried (a) and Ca-saturated, EG-saturated (b). qz: quartz, pl: plagioclase. The vertical scales are different in two parts of 2-12 o and 12-50 o 2θ. The numerical values stand for the d values in nm of experimental patterns.

Figure 3 .

 3 Figure 3. Comparison of experimental (cross) and calculated (line) XRD patterns of 645-m sample at Ca-saturated, air-dried (a) and Ca-saturated, EG-saturated (b). qz: quartz. The vertical scales are different in two parts of 2-12 o and 12-50 o 2θ. The numerical values stand for the d values in nm of experimental patterns.

Figure 4 .

 4 Figure 4. Comparison of experimental (cross) and calculated (line) XRD patterns of 690-m sample at Ca-saturated, air-dried (a) and Ca-saturated, EG-saturated (b). qz: quartz. The vertical scales are different in two parts of 2-12 o and 12-50 o 2θ. The numerical values stand for the d values in nm of experimental patterns.

Figure 5 .

 5 Figure 5. Comparison of experimental (cross) and calculated (line) XRD patterns of 700-m sample at Ca-saturated, air-dried (a) and Ca-saturated, EG-saturated (b). qz: quartz. The vertical scales are different in two parts of 2-12 o and 12-50 o 2θ. The numerical values stand for the d values in nm of experimental patterns.

Figure 6 .

 6 Figure 6. Comparison of experimental (cross) and calculated (line) XRD patterns of 756-m sample at Ca-saturated, air-dried (a) and Ca-saturated, EG-saturated (b). The vertical scales are different in two parts of 2-12 o and 12-50 o 2θ. The numerical values stand for the d values in nm of experimental patterns.

Figure 7 .

 7 Figure 7. XRD traces of alkylammonium-exchanged specimens from Kakkonda I-S series. (a) dodecylammonium, (b) octadecylammonium, cor: corrensite.

Figure 8 .

 8 Figure 8. XRD traces of alkylammonium-exchanged vermiculite and rectorite. Thin and thick lines correspond to XRD after dodecylammonium (C 12 ) and octadecylammonium (C 18 ) exchange, respectively.

Figure 9 .

 9 Figure 9. XRD traces of C 12 -alkylammonium-exchanged I-S series from Shinzan.Reichweite (R) and %I values were cited from[START_REF] Inoue | Chemical and morphological evidence for the conversion of smectite to illite[END_REF]. Ill: illite, chl: chlorite.

Figure 10 .

 10 Figure 10. Decomposition of XRD patterns of C 12 -alkylammonium exchanged I-S minerals from Kakkonda and Shinzan. Each peak of the experimental curves (cross) after subtracting the background was decomposed by 1-4 peaks (thin curves) assuming a Gaussian shape.

Figure 11 .

 11 Figure11. XRD traces of Kakkonda I-S samples after Li-saturation test[START_REF] Hofmann | Verlust der Austauschfahigeit von Lithiumionen an Bentonit durch Erhitzung[END_REF].

  Figure1

Figure 6 Figure 7

 67 Figure 6

Figure 8

 8 Figure 8

Figure 9 Figure 10

 910 Figure 9

Figure 11

 11 Figure 11

  spacing of a given layer N : mean number of layers Wi : proportion of i layer K : fixed K ions (/O20(OH)4) in illite interlayer Ca-AD : Ca-saturated, air-dried Fe : Fe content (/O20(OH)4) in octahedral sheet Ca-EG : Ca-saturated, EG-solvated RWP : residual factor 34) shadowed area: junction probabilities MPDO : maximum possible degree of order 35) 0.084(SIIS) all other probabilities are

Table 1 .

 1 Chemical composition, % I and formation temperature of Kakkonda I-S samples studied here (after[START_REF] Inoue | Illite-smectite mixed-layer minerals in felsic voclaniclastic rocks from drill cores, Kakkonda, Japan[END_REF] The temperatures are those observed at present *** pl: plagioclase, opal: opal-CT, cpt: clinoptilolite, qz: quartz, sid: siderite, ill: illite, ab: albite, cor: corrensite

	Samples	IT2-214 IT2-320 IT2-435 IT2-580 IT2-635 IT2-645 IT2-656 IT2-690 IT2-700 IT2-756 IT2-919
	Teterahedral Si 3.93	4.00	3.90	3.75	3.71	3.48	3.47	3.37	3.44	3.43	3.36
	Al 0.07	0.00	0.10	0.25	0.29	0.52	0.53	0.63	0.56	0.57	0.64
	Octahedral Al 1.37	1.33	1.32	1.62	1.66	1.83	1.77	1.84	1.84	1.79	1.70
	Fe 3+	0.32	0.26	0.35	0.19	0.13	0.08	0.10	0.08	0.06	0.01	0.10
	Mg	0.23	0.32	0.28	0.19	0.19	0.09	0.10	0.07	0.09	0.22	0.25
	Interlayer Ca	0.05	0.02	0.04	0.01	0.06	0.02	0.01	0.01	0.01	0.01	0.00
	Na	0.26	0.34	0.34	0.42	0.37	0.30	0.23	0.22	0.22	0.14	0.08
	K	0.04	0.08	0.05	0.03	0.17	0.26	0.44	0.44	0.46	0.59	0.68
	Layer charge	0.46	0.51	0.45	0.40	0.42	0.57	0.64	0.69	0.64	0.73	0.74
	[/O 10 (OH) 2 ]
	%I	5	13	2	4	45	45+60*	62	57	62	75	>95
	Formation Temp.	68	89	111	143	154	156	158	164	166	175	205
	(℃)**
	Impurities***	pl	opal, cpt opal, qz, sid	qz	pl, qz	qz	qz	qz	qz		qz, pl, cor
	* A mixture of two phases
	**

Table 2 .

 2 Optimized structural parameters of Kakkonda I-S mixedlayer minerals

		0.998 1.515	1.25
	WI	0.05
	WS	0.9	0.9	0.05	10	1.5	0.5	22.87
	WV	0.05	0.9	0.05
		0.998	1.68	1.29
	WI	0.05
	WS	0.9	0.9	0.05	10	1.5	0.5	17.11
	WV	0.05	0.9	0.05
		0.998	1.52	1.23
	WI	0.03
	WS	0.88	0.9	0.05	6.5	1.5	0.4	18.91
	WV	0.09	0.9	0.05
		0.998	1.68	1.4
	WI	0.03
	WS	0.92	0.92	0.05	7	1.5	0.4	19.13
	WV	0.05	0.92	0.05
		0.998 1.515	1.25
	WI	0.35
	WS	0.55	0.55	0.1	15	1.5	0.25	19.65
	WV	0.1	0.55	0.1
		0.998 1.675
	WI	0.35
	WS	0.65	0.65	0	10	1.5	0.25	13.35
	WV	0	0.65	0
		0.998 1.515	1.25
	WI	0.35
	WS	0.55	0.55	0.1	25	1.5	0.15
	WV	0.1	0.55	0.1
		0.998 1.515	1.25
	WI	0.5
	WS	0.4	0.12	0.03	8	1.5	0.15
	WV	0.1	0.12	0.03
		0.998 1.675
	WI	0.35
	WS	0.65	0.65	0	12	1.5	0.15
	WV	0	0	0
		0.998 1.675
	WI	0.5
	WS	0.5	0.15	0	7	1.5	0.15
	WV	0	0	0
		0.998 1.515	1.25
	WI	0.55
	WS	0.4	0.15	0.05	15	1.7	0.15	24.44
	WV	0.05	0.4	0.05
		0.998	1.68
	WI	0.55
	WS	0.4	0.15	0.05	15	1.7	0.15	16.13
	WV	0.05	0.4	0.05
	WI	0.6
	WS	0.35			10	1.7	0	28.22
	WV	0.05
	WI	0.6
	WS	0.4			10	1.7	0	17.52
	WV	0
	WI	0.85
	WS	0.125			19	1.5	0	18.23

ACKNOWLEDGMENTS

We are grateful to V. A. Drits for his help to simulate XRD patterns and Y.

Shinohara for his providing

Ohara rectorite with unpublished chemical analysis data. This manuscript was greatly improved by the comments of H. Dong, M. Krekeler, and D. McCarty. A part of the experimental works was carried out during a short stay in Poitiers University and A. Inoue is grateful to CNRS, France for providing the opportunity. B. Sakharov would acknowledge financial support from CNRS "poste rouge" for his stay in Grenoble. This work was partly supported by the Science Grant of the Ministry of Education, Science and Culture in Japan.


Thibaud Antignac
email: thibaud.antignac@inria.fr

Daniel Le Métayer
email: daniel.le-metayer@inria.fr

Privacy by Design: From Technologies to Architectures (Position Paper) ⋆

Existing work on privacy by design mostly focus on technologies rather than methodologies and on components rather than architectures. In this paper, we advocate the idea that privacy by design should also be addressed at the architectural level and be associated with suitable methodologies. Among other benefits, architectural descriptions enable a more systematic exploration of the design space. In addition, because privacy is intrinsically a complex notion that can be in tension with other requirements, we believe that formal methods should play a key role in this area. After presenting our position, we provide some hints on how our approach can turn into practice based on ongoing work on a privacy by design environment.

Introduction

Privacy by design is often held up as a necessary step to improve privacy protection in the digital society [START_REF] Langheinrich | Privacy by design -principles of privacy aware ubiquitous systems[END_REF][START_REF] Poullet | About the e-privacy directive, towards a third generation of data protection legislations[END_REF]. It will even become a legal obligation in the European Community 1 if the current draft of Data Protection Regulation [START_REF] European Commission | Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)[END_REF] eventually gets adopted. The fact that future regulatory frameworks promote or impose privacy by design is definitely a positive step but their adoption will take time, they are unlikely to be applicable in all regions of the world and the interpretation of the principle itself may vary greatly 2 among jurisdictions. Therefore, the possible adoption of privacy by design laws should obviously not be seen as the end of the story: the extent to which a true privacy by design will actually turn to reality will also depend on other factors such as social demand, economic conditions and of course the availability of technical solutions. Even though all these dimensions are essential and all possible means should be used to foster the adoption of privacy by design, we choose to focus on the technical issues in this paper.

As discussed by several authors [START_REF] Gürses | Engineering privacy by design[END_REF][START_REF] Hoepman | Privacy Design Strategies[END_REF][START_REF] Kerschbaum | Privacy-Preserving Computation (Position Paper)[END_REF][START_REF] Hafiz | A Pattern Language for Developing Privacy Enhancing Technologies[END_REF], a range of privacy enhancing technologies (PETs) are now available, which can provide strong privacy guarantees in a variety of contexts. Even if more research on PETs will always be needed, a question that arises at this stage is how to favor the uptake of these technologies. The position that we want to promote and bring forward for discussion in this paper is threefold:

1. Existing work in this area mostly focus on technologies rather than methodologies and on components rather than architectures. We advocate the idea that privacy by design should also be addressed at the architectural level and be associated with suitable methodologies. Among other benefits, architectural descriptions enable a more systematic exploration of the design space. 2. Because privacy is intrinsically a complex notion, which, in addition, often turns out to be (or seems to be) in tension with other requirements, formal methods should play a key role in this area. Among other benefits, formal descriptions make it possible to define precisely the concepts at hand and the guarantees provided by a solution, to reason about the design choices and ultimately to justify them rigorously, hence contributing also to accountability. 3. Because designers are generally not experts in formal methods, dedicated frameworks and user-friendly interfaces should be designed to hide the complexities of the models and make them usable in this context. Such frameworks should allow designers to express their requirements and to interact with the system to refine or adapt them until a satisfactory architecture is obtained.

The paper is organized as follows: We present our position and discuss it in more detail in Section 2. In order to illustrate this position, we proceed in Section 3 with an example of formal privacy logic which is applied in Section 4 to the design of smart metering systems. Section 5 discusses related work and Section 6 outlines directions for further research.

Position

A wide array of techniques have been proposed or applied to the definition of new PETs during the last decades [START_REF] Deswarte | Current and future privacy enhancing technologies for the internet[END_REF][START_REF] Goldberg | Privacy-enhancing technologies for the internet III: ten years later[END_REF][START_REF] Kerschbaum | Privacy-Preserving Computation (Position Paper)[END_REF][START_REF] Rezgui | Privacy on the web: facts, challenges, and solutions[END_REF], including zero-knowledge proofs, secure multi-party computation, homomorphic encryption, commitments, private information retrieval (PIR), anonymous credentials, anonymous communication channels, or trusted platform modules (TPM). These PETs have been used to provide strong privacy guarantees in a variety of contexts such as smart metering [START_REF] Garcia | Privacy-friendly energy-metering via homomorphic encryption[END_REF][START_REF] Lemay | Unified architecture for large-scale attested metering[END_REF][START_REF] Rial | Privacy-preserving smart metering[END_REF], electronic traffic pricing [START_REF] Balasch | PrETP: Privacy-preserving electronic toll pricing[END_REF][START_REF] Jonge | Privacy-friendly electronic traffic pricing via commits[END_REF][START_REF] Popa | Vpriv: Protecting privacy in location-based vehicular services[END_REF]), ubiquitous computing [START_REF] Langheinrich | Privacy by design -principles of privacy aware ubiquitous systems[END_REF] or location based services [START_REF] Damiani | The probe framework for the personalized cloaking of private locations[END_REF][START_REF] Kosta | Legal considerations on privacy-enhancing location based services using PRIME technology[END_REF][START_REF] Krumm | A survey of computational location privacy[END_REF]. Even if more techniques will always be needed to defeat new attacks in this eternal game between cops and robbers, there is now a need for serious thinking about the conditions for the adoption of existing PETs by industry. This reflection has started with convincing cases for the development of appropriate methodologies [START_REF] Gürses | Engineering privacy by design[END_REF][START_REF] Hoepman | Privacy Design Strategies[END_REF][START_REF] Tschantz | Formal methods for privacy[END_REF] or development tools [START_REF] Kerschbaum | Privacy-Preserving Computation (Position Paper)[END_REF] for privacy by design. In this paper, we pursue this line of thought in arguing that privacy by design should also (and firstly) be considered at the architecture level and should be supported by appropriate reasoning tools relying on formal models.

Let us consider the case for architectures first. Many definitions of architectures have been proposed in the literature. In this paper, we will adopt a definition inspired by [START_REF] Bass | Software architecture in practice[END_REF] 3 : The architecture of a system is the set of structures needed to reason about the system, which comprise software and hardware elements, relations among them and properties of both. The atomic components of an architecture are coarse-grain entities such as modules, components or connectors. In the context of privacy, as suggested in Section 3, the components are typically the PETs themselves and the purpose of the architecture is their combination to achieve the privacy requirements of the system. Therefore, an architecture is foremost an abstraction and "this abstraction is essential to taming the complexity of a system -we simply cannot, and do not want to, deal with all the complexity all the time" [START_REF] Bass | Software architecture in practice[END_REF].

Most of the reasons identified in [START_REF] Bass | Software architecture in practice[END_REF] to explain why architectures matter are very relevant for privacy by design:

-The architecture is a carrier of the earliest and hence most fundamental hardest-to-change design decisions: overlooking architectural choices may thus seriously hamper the integration of privacy requirements in the design of a system. -Architectures channel the creativity of developers, reducing design and system complexity: because they make it possible to abstract away unnecessary details and to focus on critical issues, architectures can help privacy designers reason about privacy requirements and the combination of PETs which could be used to meet them. -A documented architecture enhances communication among stakeholders:

documenting the design choices is especially important in the context of privacy to meet the obligations arising from Privacy Impact Assessments (PIA) and accountability (which are emphasized in the Data Protection Regulation draft [START_REF] European Commission | Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)[END_REF]). -An architecture can be created as a transferable, reusable model: architectures can therefore play a key role to increase the reusability of privacy friendly solutions, which could lead to significant cost reductions and better dissemination of knowledge and expertise among developers. Being able to go beyond case-by-case strategies and to factorize efforts is a key step for privacy by design to move from craft to industry.

If the choice is made to work at the architectural level, the next question to be answered is: "how to define, represent and use architectures ?" In prac-tice, architectures are often described in a pictorial way, using different kinds of graphs with legends defining the meaning of nodes and vertices, or semi-formal representations such as UML diagrams (class diagrams, use case diagrams, sequence diagrams, communication diagrams, etc.). The second point we want to make here is that, even though such pictorial representations can be very useful (especially when their use is standardized), reasoning about privacy requirements is such a subtle and complex issue that the architecture language used for this purpose must be defined in a formal way. By formal, we mean that the properties of the architectures must be defined in a mathematical logic and reasoning about these properties must be supported by a formal proof or verification system. Reasoning about privacy is complex for different reasons: first, it is a multi-faceted notion stemming from a variety of principles which are not defined very precisely. It is therefore of prime importance to circumscribe the problem, to define precisely the aspects of privacy which are taken into account and how they are interpreted in the design choices. The fact that not all aspects of privacy are susceptible to formalization is not a daunting obstacle to the use of formal methods in this context: the key point is to build appropriate models for the aspects of privacy (such as data minimization) which are prone to formalization and involve complex reasoning. Another source of complexity in this context is the fact that privacy often seems to conflict with other requirements such as guarantees of authenticity or correctness, efficiency, usability, etc. To summarize, formal methods should:

-Make it possible to define precisely the concepts at hand (requirements, assumptions, guarantees, etc.). -Help designers to explore the design space and to reason about the possible choices. Indeed, privacy by design is often a matter of choice [START_REF] Métayer | Privacy by design: a matter of choice[END_REF]: multiple options are generally available to achieve a given set of functionalities, some of them being privacy friendly, others less, and a major challenge for the designer is to understand all these options, their strengths and weaknesses. -Provide a documented and rigorous justification of the design choices, which would be a significant contribution to the accountability requirement. Accountability is defined in Article 22 of the current draft of the future Data Protection Regulation [START_REF] European Commission | Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)[END_REF] as the following obligation for data collectors: "The controller shall adopt appropriate policies and implement appropriate and demonstrable technical and organizational measures to ensure and be able to demonstrate in a transparent manner that the processing of personal data is performed in compliance with this Regulation..."

It should be clear however, that designers are generally not experts in formal methods and appropriate tools and user-friendly interfaces have to be made available to hide the complexities of the models. Such frameworks should allow designers to express their requirements, to get understandable representations (or views) of the architectural options, to navigate in these views, and to refine or adapt them until a satisfactory architecture is obtained.

Considering all these requirements, it should be clear that specific, dedicated formal frameworks have to be devised to support privacy by design. To make the discussion more concrete, we provide in the following sections some hints about such a framework and its application to a real case study.

Example of Formal Model

As an illustration of the position advocated in the previous section, we present now a subset of a privacy logic to reason about two key properties: the minimization (of the collection of personal data) and the accuracy (of the computations) . Indeed, the tension between data minimization and accuracy is one of the delicate issues to be solved in many systems involving personal data. For example, electronic traffic payment systems [START_REF] Balasch | PrETP: Privacy-preserving electronic toll pricing[END_REF][START_REF] Jonge | Privacy-friendly electronic traffic pricing via commits[END_REF][START_REF] Popa | Vpriv: Protecting privacy in location-based vehicular services[END_REF] have to guarantee both the correctness of the computation of the fee and the limitation of the collection of location data; smart metering systems [START_REF] Garcia | Privacy-friendly energy-metering via homomorphic encryption[END_REF][START_REF] Lemay | Unified architecture for large-scale attested metering[END_REF][START_REF] Rial | Privacy-preserving smart metering[END_REF] have also to ensure the correct computations of the fees and to limit the collection of consumption data; recommendation systems [START_REF] Mcsherry | Differentially private recommender systems: building privacy into the net[END_REF] need to achieve both the accuracy of the recommendations while minimizing the disclosure of personal preferences; electric vehicle charging systems [START_REF] Höfer | POPCORN: privacy-preserving charging for e-mobility[END_REF] also need to guarantee the accuracy of the bills and the protection of the location information of the vehicles.

Excerpt of a Privacy Epistemic Logic

Because privacy is closely connected with the notion of knowledge, epistemic logics form an ideal basis to reason about privacy properties. Epistemic logics [START_REF] Fagin | Reasoning About Knowledge[END_REF] are a family of modal logics using a knowledge modality usually denoted by K i (φ) to express the fact that agent i knows the property φ. However standard epistemic logics based on possible worlds semantics suffer from a weakness which makes them unsuitable in the context of privacy: this problem is often referred to as "logical omniscience" [START_REF] Halpern | Dealing with logical omniscience: Expressiveness and pragmatics[END_REF]. It stems from the fact that agents know all the logical consequences of their knowledge (because these consequences hold in all possible worlds). An undesirable outcome of logical omniscience would be that, for example, an agent knowing the commitment C (v) (or hash) of a value v would also know v (or the possible values of v). This is obviously not the intent in a formal model of privacy where commitments are precisely used to hide the original values to the recipients. This issue is related to the fact that standard epistemic logics do not account for limitations of computational power.

Therefore it is necessary to define dedicated epistemic logics to deal with different aspects of privacy and to model the variety of notions and techniques at hand (e.g. knowledge, zero-knowledge proof, trust, etc.). Let us consider for the sake of illustration the following excerpt of a privacy epistemic logic:

φ ::= φ 0 (1)

| ¬φ

(2)

| φ ∧ φ ′ (3) | K i (φ 0 ) (4) | X i (φ 0 ) (5)
φ 0 ::= receive i,j (x) (6)
| receive i,j (prim) (7) | trust i,j (8)
| compute i (x = t) (9)
| check i (eq) ( 10)

| has i (x) (11)
| prim | p | φ 0 ∧ φ ′ 0 ( 12
) prim ::= proof i,j (p) | att | prim ∧ prim ′ (13)
p ::= att | eq | p ∧ p ′ (14)
att ::= attest i (eq) ( 15)

eq ::= t rel t ′ (16)
rel

::= = | < | > | ≤ | ≥ (17)
t ::= c | x | F (t 1 , . . . , t n ) ( 18
)
This logic involves only two modalities: the usual knowledge operator K i and the "algorithmic knowledge" [START_REF] Fagin | Reasoning About Knowledge[END_REF][START_REF] Pucella | Deductive Algorithmic Knowledge[END_REF] denoted by X i , which represents the knowledge that an agent i can actually build. Properties φ 0 include both the basic properties p on variables of the system and properties used to characterize the architecture itself. More precisely, receive i,j (x) means that agent j can send the variable x to agent i, receive i,j (prim) means that agent j can send the property prim to agent i where prim can be a combination of (non interactive) zero-knowledge proofs and attestations. An attestation attest i (eq) is a simple declaration by agent i that property eq holds. This declaration is of no use to agent j unless j trusts i, which is expressed by trust j,i . The primitive proof i,j (p) means that agent i can make a proof of property p which can be checked by agent j 4 . The properties compute i (x = t) and check i (p) are used to express the fact that an agent i can respectively compute a variable x defined by the equation x = t or check a property p. Symbol F stands for the available basic operations (e.g. hash, homomorphic hash, encryption, random value generation, arithmetic operations, etc.), c stands for constants, and x for variables. Last but not least, has i (x) is the property that agent i can get the value of variable x (which does not, in itself, provide any guarantee about the correctness of this value).

Semantics and Axiomatization

The semantics of this logic can be defined using an augmented Kripke model M = (Arch, π, D 1 , . . . , D n ) where:

-Arch is a set of possible architectures (generally called worlds) of the system under consideration. In our setting, an architecture is defined as a property φ 0 which characterizes all the operations available to the agents. -π is an interpretation for the primitives prim and the relations eq. -D 1 , . . . , D n are the deductive systems associated with agents 1, . . . , n.

The deductive system associated with an agent i makes it possible to define the semantics of the X i operator (knowledge built by agent i). In other words, each agent i can apply rules ⊲ i to derive new knowledge. Typical rules of deductive systems include:

-receive i,j (prim) ⊲ i prim -attest j (eq) , trust i,j ⊲ i eq -proof j,i (p) ⊲ i p -check i (eq) ⊲ i p -compute i (x = t) ⊲ i x = t -hash (x 1 ) = hash (x 2 ) ⊲ i x 1 = x 2 -hhash (x) = hhash (x 1 ) ⊗ hhash (x 2 ) ⊲ i x = x 1 + x 2 -receive i,j (x) ⊲ i has i (x) -compute i (x = t) ⊲ i has i (x) -has i (x 1 ) , . . . , has i (x m ) , dep (x, {x 1 , . . . , x m }) ⊲ i has i (x)
with dep (x, {x 1 , . . . , x m }) a dependence relationship known by i stating that x can be derived from x 1 , . . . , x m .

In order to reason about architectures, we can use an axiomatization in the style of previous work on deductive algorithmic knowledge [START_REF] Fagin | Reasoning About Knowledge[END_REF][START_REF] Pucella | Deductive Algorithmic Knowledge[END_REF]. Typical examples of axioms and inference rules include:

TAUT: All instances of propositional tautologies. ( 19
)
MP: From φ and φ → ψ infer ψ (20)

Gen: From φ infer K i (φ) (21)
K: K i (φ → ψ) → (K i (φ) → K i (ψ)) (22)
T:

K i (φ) → φ ( 23
)
KC: K i (φ ∧ ψ) → (K i (φ) ∧ K i (ψ)) (24)
XD:

From X i (φ 1 ), . . . , X i (φ n ) and φ 1 , . . . , φ n ⊲ i φ infer X i (φ) (25)
XT:

X i (φ) → φ (26)
XC:

X i (φ ∧ ψ) → (X i (φ) ∧ X i (ψ)) (27)
A key difference between the properties of K i and X i is the lack of counterpart of axioms Gen and K for X i , which makes it possible to avoid the omniscience problem. In contrast, the knowledge built by an agent i depends on the associated deductive system ⊲ i as expressed by rule XD. Rules T and XT express the fact that an agent cannot derive false properties.

The axiomatization outlined in this section forms the basis for an inference algorithm which makes it possible to prove properties of architectures (expressed as φ 0 properties) as discussed in the next subsection.

Use of the Formal Model

The first functionality of a design environment is to make it possible for the designer to express the requirements that apply to the system and, optionally, the design choices which have already been made (or which are imposed by the environment or the client) as well as the possible trust assumptions.

Formally speaking, the requirements are made of three components:

-Functional requirements: the purpose of the system, which is expressed as a set of equations x = t. -Privacy and knowledge requirements: values that should not (respectively should) be known by certain actors, which is expressed by properties ¬has i (x) (respectively has i (x)). -Correctness (integrity) requirements: the possibility for certain actors to ensure that certain values are correct, which is expressed as X i (eq).

Generally speaking, other non-functional requirements could also be considered but the combination of privacy and correctness already provides a degree of complexity which is sufficient to illustrate the approach. The design choices, which add further requirements on the architecture, can be defined as φ 0 properties. They can express, for example, the fact that communication links are (or are not) available between specific components or certain computations (zero-knowledge, homomorphic hash, etc.) can (or cannot) be performed by certain components.

Several situations are possible when the designer has entered this first batch of information:

1. The requirements may be contradictory, for example because privacy requirements conflict with knowledge or architectural requirements or because architectural requirements themselves are not consistent (operations computed by components which cannot get access to the necessary parameters, checks which cannot be carried out because some values are not available to the component, etc.). The system returns the identified contradictions, which may provide some hints to the designer to modify his initial input. 2. The requirements may be consistent but not precise enough to characterize a unique architecture. In this case, the system can use a library of existing PETs to provide suggestions to the user. The user can then decide to apply a given PET (which is expressed formally by the addition of a new assumption, e.g. receive i,j proof j,i (p) for a zero-knowledge proof of property p sent by agent j to agent i. 3. The requirements may be precise enough to specify a unique (and correct architecture).

The first two cases lead to a new iteration of the procedure. In the last case, the designer has obtained a satisfactory architecture (which does not prevent him from performing a new iteration with different assumptions to further explore the design space).

Example of Application

Let us now illustrate the framework outlined in the previous section with a small smart metering case study. Privacy friendly smart grids and smart metering systems have been studied extensively [START_REF] Garcia | Privacy-friendly energy-metering via homomorphic encryption[END_REF][START_REF] Jawurek | Plug-In Privacy for Smart Metering Billing[END_REF][START_REF] Jawurek | Privacy Technologies for Smart Grids -A Survey of Options[END_REF][START_REF] Rial | Privacy-preserving smart metering[END_REF]. Our purpose here is neither to present a new solution nor to provide a comprehensive study of smart-metering systems but to show how a formal framework can help a designer to find his way among the possible options. We focus here on the billing functionality and the potential tensions between the privacy requirements of the clients and the need for the operator to ensure the correctness of the computation of the fee.

Let us assume in the first instance that the system is made of three components: the back-end system of the operator o, the computer of the user (customer) u and the meter m. The requirements for this case study are the following:

-Functional requirements: the purpose of the system is the computation of the fee which is expressed as the equation F ee = Let us assume in a first scenario that the designer considered a direct communication link between the meter and the operator, which means that the architecture would include the property receive o,m (C i ). This possibility would obviously conflict with the privacy requirement since receive o,m (C i ) ⊲ i has o (C i ). Two communication links are therefore necessary: from m to u and from u to o.

The next question is where the computation of P should take place: generally speaking, this could be at the back-office of the operator, on the meter, or on the computer of the user. Depending on his initial ideas about the architecture and the constraints imposed by the hardware, the designer can either enter directly the appropriate compute o , compute m or compute u property. Otherwise these options would be suggested in turn by the system.

-The first option turns out to conflict with the privacy requirements (because the operator would need the input values C i to compute F ee) unless homomorphic encryption can be used to allow the operator to compute F ee on encrypted values. -The second option can be further explored if it does not incur inacceptable additional costs on the meters. However, the system would then identify a trust requirement (which may or may not have been foreseen by the designer): the operator must trust the meter (trust o,m ) because the only information received by the operator would be an attestation of the meter (attest m (F ee = n i=1 (P (C i )))) and an attestation can turn into a true guarantee only in conjunction with a trust assumption (as expressed by the rule attest j (eq) , trust i,j ⊲ i eq).

-The third option will be more appealing if the role of the meters has to be confined to the delivery of the consumption measures. But this choice leads to another requirement: either the user can be trusted by the operator (which is excluded by assumption) or he has to be able to provide to the operator a proof of correctness of the computation of the fee [START_REF] Rial | Privacy-preserving smart metering[END_REF] (receive o,u proof u,o (F ee

= n i=1 (P (C i ))) ).
If none of these options is available, further actors need to be considered and involved in the computation of the fee. In general, these actors can either be pairs or trusted third parties. In both cases, further requirements would arise: a secure multi-party computation scheme would be necessary to ensure that the pairs do not learn each other's consumptions and trust assumptions would be necessary to ensure that computations can be delegated to the third party.

As discussed in Section 2, designers are usually not experts in formal methods. As a result, a design environment should provide alternative modes of interaction hiding the complexities of the formal model. Considering that designers are used to graphical notations, we have chosen to represent the different views of the architecture as annotated graphs. The interested reader can find in Annex 1 the "location views" showing, for the two successful scenarios described above, the architectures obtained at the end of the interaction process.

Related Work

This position paper stands at the crossroads of at least three different areas: software architectures, formal models for privacy and engineering of privacy by design.

Software architectures have been an active research topic for several decades [START_REF] Shaw | The Golden Age of Software Architecture: A Comprehensive Survey[END_REF] but they are usually defined using purely graphical, informal means [START_REF] Bass | Software architecture in practice[END_REF] or within semi-formal [START_REF] Booch | The Unified Modeling Language Reference Manual (2nd Edition[END_REF] frameworks. Formal frameworks have been proposed to define software architectures [START_REF] Allen | Formalizing Architectural Connection[END_REF][START_REF] Inverardi | Formal specification and analysis of software architectures using the chemical abstract machine model[END_REF][START_REF] Métayer | Software Architecture Styles As Graph Grammars[END_REF][START_REF] Perry | Foundations for the study of software architecture[END_REF] but they are usually based on process algebras or graph grammars and they are not designed to express privacy properties. One exception is the framework introduced in [START_REF] Métayer | Privacy by design: a formal framework for the analysis of architectural choices[END_REF] which defines the meaning of the available operations in a (trace-based) operational semantics and proposes an inference system to derive properties of the architectures. The inference system is applied to the proof of properties related to the use of spot checks in electronic traffic pricing systems. Even though the goal of [START_REF] Métayer | Privacy by design: a formal framework for the analysis of architectural choices[END_REF] is to deal with architectures, it remains at a lower level of abstraction than the framework sketched here (because of its operational underpinning, which contrasts with the epistemic logic used here) and can hardly be extended to other privacy mechanisms.

On the other hand, dedicated languages have been proposed to specify privacy properties [START_REF] Backes | Unification in privacy policy evaluation -translating EPAL into Prolog[END_REF][START_REF] Barth | Privacy and contextual integrity: Framework and applications[END_REF][START_REF] Becker | A practical generic privacy language[END_REF][START_REF] Jafari | Towards defining semantic foundations for purpose-based privacy policies[END_REF][START_REF] Métayer | A formal privacy management framework[END_REF][START_REF] Li | A semantics based approach to privacy languages[END_REF][START_REF] May | Privacy APIs: Access control techniques to analyze and verify legal privacy policies[END_REF][START_REF] Yu | A formal semantics for P3P[END_REF]] but the policies expressed in these languages are usually more fine-grained than the properties considered here because they are not intended to be used at the architectural level. Similarly, process calculi such as the applied pi-calculus [START_REF] Abadi | Mobile Values, New Names, and Secure Communication[END_REF] have been applied to define privacy protocols [START_REF] Delaune | Verifying Privacy-type Properties of Electronic Voting Protocols[END_REF]. Because process calculi are general frameworks to model concurrent systems, they are more powerful than dedicated frameworks. The downside is that protocols in these languages are expressed at a lower level and the tasks of specifying a protocol and its expected properties are more complex. Again, the main departure of the approach advocated in this paper with respect to this trend of work is that we reason at the level of architectures, providing ways to express properties without entering into the details of specific protocols.

Notions such as k -anonymity [START_REF] Li | Provably private data anonymization: Or, kanonymity meets differential privacy[END_REF][START_REF] Sweeney | k-anonymity: A model for protecting privacy[END_REF], l-diversity [START_REF] Machanavajjhala | l-diversity: Privacy beyond k-anonymity[END_REF] or ǫ-differential privacy [START_REF] Dwork | Differential privacy[END_REF][START_REF] Dwork | A firm foundation for private data analysis[END_REF] have also been proposed as ways to measure the level of privacy provided by an algorithm. Differential privacy provides strong privacy guarantees independently of the background knowledge of the adversary: the main idea behind ǫ-differential privacy is that the presence (or the absence) of an item in a database (such as the record of a particular individual) should not change in a significant way the probability of obtaining a certain answer for a given query. Methods [START_REF] Dwork | A firm foundation for private data analysis[END_REF][START_REF] Mcsherry | Privacy integrated queries: an extensible platform for privacypreserving data analysis[END_REF][START_REF] Mcsherry | Mechanism design via differential privacy[END_REF] have been proposed to design algorithms achieving privacy metrics or to verify that a system achieves a given level of privacy [START_REF] Tschantz | Formal verification of differential privacy for interactive systems[END_REF]. These contributions on privacy metrics are complementary to the work described in this paper. We follow a logical (or qualitative) approach here, proving that a given privacy property is met (or not) by an architecture. As suggested in the next section, an avenue for further research would be to cope with quantitative reasoning as well, using inference systems to derive properties expressed in terms of privacy metrics.

As far as the engineering of privacy is concerned, several authors [START_REF] Gürses | Engineering privacy by design[END_REF][START_REF] Hoepman | Privacy Design Strategies[END_REF][START_REF] Kerschbaum | Privacy-Preserving Computation (Position Paper)[END_REF][START_REF] Mulligan | Bridging the Gap between Privacy and Design[END_REF][START_REF] Spiekermann | Engineering Privacy[END_REF] have already pointed out the complexity of problem as well as the "richness of the data space" [START_REF] Gürses | Engineering privacy by design[END_REF], calling for the development of more general and systematic methodologies for privacy by design. [START_REF] Hoepman | Privacy Design Strategies[END_REF] has used design patterns to define eight privacy strategies5 called respectively: Minimise, Hide, Separate, Aggregate, Inform, Control, Enforce and Demonstrate. As far as privacy mechanisms are concerned, [START_REF] Kerschbaum | Privacy-Preserving Computation (Position Paper)[END_REF] points out the complexity of their implementation and the large number of options that designers have to face. To address this issue and favor the adoption of these tools, [START_REF] Kerschbaum | Privacy-Preserving Computation (Position Paper)[END_REF] proposes a number of guidelines for the design of compilers for secure computation and zero-knowledge proofs. In a different context (designing information systems for the cloud), [START_REF] Manousakis | Privacy in the Cloud: Bridging the Gap between Design and Implementation[END_REF] also proposes implementation techniques to make it easier for developers to take into account privacy and security requirements. In the same spirit, [START_REF] Pearson | A Decision Support System for Design for Privacy. Privacy and Identity[END_REF] proposes a decision support tool based on design patterns to help software engineers to take into account privacy guidelines in the early stage of development.

A recent proposal ( [START_REF] Kung | PEARs: Privacy Enhancing ARchitectures[END_REF]) also points out the importance of architectures for privacy by design. [START_REF] Kung | PEARs: Privacy Enhancing ARchitectures[END_REF] proposes a design methodology for privacy (inspired by [START_REF] Bass | Software architecture in practice[END_REF]) based on tactics for privacy quality attributes (such as minimization, enforcement or accountability) and privacy patterns (such as data confinement, isolation or Hippocratic management). The work described in [START_REF] Kung | PEARs: Privacy Enhancing ARchitectures[END_REF] is complementary to the approach presented here: [START_REF] Kung | PEARs: Privacy Enhancing ARchitectures[END_REF] does not consider formal aspects while this paper does not address the tactics for privacy by design.

Finally, even though we decided to focus on one (important) aspect of privacy by design here, namely data minimization, other aspects also deserve more attention, in particular the design of appropriate interfaces to allow users to take more informed decisions about their personal data [START_REF] Mulligan | Bridging the Gap between Privacy and Design[END_REF].

Directions for further work

The basic idea put forward in this paper is that privacy by design should be addressed at the architecture level and this should be done, at least for critical aspects such as minimization, in a formal way. As stated in Section 1, some aspects of privacy (such as proportionality or purpose) may be more difficult to formalize or impossible to formalize entirely. This should not be an obstacle to the use of formal methods for other aspects of privacy. Generally speaking, architectures are made of different views [START_REF] Bass | Software architecture in practice[END_REF]: some of them can be described informally or in a purely pictorial way while others are based on a formal model. In any case, working at the architectural level is a key success factor for privacy by design because architectures carry "the earliest and hence most fundamental hardest-to-change design decisions" [START_REF] Bass | Software architecture in practice[END_REF]. They should also play a key role to support accountability requirements because they can provide evidence that appropriate decisions have been taken and the reasons for taking them.

Obviously the design of an architecture meeting all privacy requirements is not the end of the story: because an architecture is set, by definition, at a fairly high level of abstraction, the remaining task is to use or devise appropriate mechanisms to implement it. In some sense, the architecture defines precise requirements on the techniques (PETs) to be used in the implementation. The approach presented here is therefore complementary to the work done on the improvement of the implementation of privacy mechanisms [START_REF] Kerschbaum | Privacy-Preserving Computation (Position Paper)[END_REF]. It is also complementary to the ongoing work on the conception of new PETs. In practice, a design environment should include a library of available PETs with their associated guarantees (in the privacy logic) and this library should follow the progress of the technologies. One challenge to this respect will be to ensure that the logical framework is general and versatile enough to allow the description of future mechanisms. We believe that epistemic logics provide a well-established and suitable framework to this aim but this claim has to be confirmed in practice.

As far as the formal framework itself is concerned, we have suggested a "logical" (or qualitative) approach in this paper. An avenue for further research in this area would be to study the integration of quantitative measures of privacy (such as differential privacy) into the framework. This extension would be required to deal with the (numerous) situations in which data cannot be classified into two categories (can or cannot be disclosed) but can be disclosed provided a sufficiently robust sanitization algorithm is applied. Further work on this issue will benefit from existing results [START_REF] Dwork | A firm foundation for private data analysis[END_REF][START_REF] Mcsherry | Privacy integrated queries: an extensible platform for privacypreserving data analysis[END_REF][START_REF] Mcsherry | Mechanism design via differential privacy[END_REF] on the design of mechanisms achieving differential privacy.

In this paper we provided some hints on how our approach can turn into practice based on ongoing work on a privacy by design environment. Needless to say, more work has to be done on the HCI front, to improve the interactions with designers. As suggested in Section 3, graphical means can be used to convey the essence of the properties in the logic and the architecture under construction, for example to picture data flows, the locations of the computations and the trust relationships. A key concept to this respect is the notion of view in software architectures. More experience is needed, however, to understand what will be the most useful views for a designer.

Last but not least, another interesting avenue for further research would be to apply this approach to other aspects of privacy (using combinations of formal and semi-formal methods) and to establish a link with the coarse-grain strategies defined in [START_REF] Hoepman | Privacy Design Strategies[END_REF] to drive the interactions with the system.

  n i=1 (P (C i )) where C i are the actual consumption values for the considered period of time (i ∈ [1, n]) and P is the cost function. -Privacy and knowledge requirements: ¬has o (C i ) and has o (F ee) respectively, to express the fact that the operator o should not obtain the individual consumption values C i but should get the fee. -Correctness (integrity) requirements: the operator must be sure that the fee is correct: X o (F ee = n i=1 (P (C i ))).

This definition is a generalization (to system architectures) of the definition of software architectures proposed in[START_REF] Bass | Software architecture in practice[END_REF].

In general a proof could be checked by several agents, which could be expressed using a set of agents names as second index.

Strategies are defined as follows in[START_REF] Hoepman | Privacy Design Strategies[END_REF]: "A design strategy describes a fundamental approach to achieve a certain design goal. It has certain properties that allow it to be distinguished from other (fundamental) approaches that achieve the same goal."

Acknowledgement. This work was partially funded by the European project PRIPARE / FP7-ICT-2013-1.5, the ANR project BIOPRIV, and the Inria Project Lab CAPPRIS (Collaborative Action on the Protection of Privacy Rights in the Information Society.)

Meter User Operator

Environment

trust o,m Fig. 2. Option 3 of Section 4: The user computes the fee and the operator has to trust the meter (for using the right value c i ). hhash is a homomorphic hash function which allows the operator to check that the hash of the global fee Fee is consistent with the hashes hcp i of individual fees p i . This architecture is an abstraction of the solution proposed by [START_REF] Rial | Privacy-preserving smart metering[END_REF].