Frédéric Alexandre
email: frederic.alexandre@inria.fr

Maxime Carrere

Randa Kassab

Feature, Configuration, History : a bio-inspired framework for information representation in neural networks

Keywords: Information Representation, Computational Neuroscience, Pavlovian Conditioning

Artificial Neural Networks are very efficient adaptive models but one of their recognized weaknesses is about information representation, often carried out in an input vector without a structure. Beyond the classical elaboration of a hierarchical representation in a series of layers, we report here inspiration from neuroscience and argue for the design of heterogenous neural networks, processing information at feature, configuration and history levels of granularity, and interacting very efficiently for high-level and complex decision making. This framework is built from known characteristics of the sensory cortex, the hippocampus and the prefrontal cortex and is exemplified here in the case of pavlovian conditioning, but we propose that it can be advantageously applied in a wider extent, to design flexible and versatile information processing with neuronal computation.

INTRODUCTION

Artificial Neural Networks (ANNs) have proven to be an excellent formalism for adaptive information processing and have been successfully applied to an impressive range of application domains for such tasks as classification, control and prediction. One of the reasons for the undebatable success of ANNs is certainly its unique position between the fertile fields of Machine Learning and Computational Neuroscience. On the one hand, Computational Neuroscience irrigates ANNs with architectural and computational principles inspired from observation of the living brain. On the other hand, Machine Learning anchors in solid mathematical grounds the most prominent features of ANNs including learning algorithms.

Cross-fertilization from both domains explains most of the advances of ANNs in the past decades, even if some weaknesses remain. Among them, one of the most critical flaws of ANNs is certainly related to information representation. Basically, ANNs are mainly dedicated to unstructured information processing (their input is a 'flat' vector of data without structure), whereas most real-world applications require the elaboration and exploitation of complex structures for an adequate knowledge representation.

Several measures have already been proposed to overcome this problem. Firstly, input vectors can be built according to a structured representation of information proposed a priori, but this cannot be adapted by learning and cannot be applied to the inner representation of ANNs. Secondly, in opposition to the connectionist approach, the symbolic approach is generally more efficient at defining and processing elaborated knowledge representations and it has been proposed accordingly to associate both paradigms in the so-called Connectionist-Symbolic Integration approach [START_REF] Sun | Connectionist -Symbolic Integration: from Unified to Hybrid Approaches[END_REF] but here also, the two kinds of modules are generally too independent. Thirdly, some interesting attempts have been made to propose fully connectionist solutions to this problem.

Connectionist solutions to structured information processing are mainly centred on innovative architectures and propose to adapt existing learning algorithms to exploit them. One of the early models in this direction, the LRAAM network [START_REF] Sperduti | Supervised neural networks for the classification of structures[END_REF], explains how a recurrent elaboration of a network allows to encode graphs. More recently, deep neural networks [START_REF] Bengio | Representation learning: A review and new perspectives[END_REF] renew studies in which complex representations can be extracted from many-layered neural networks, as suggested by the architecture of the visual system in the brain [START_REF] Rousselet | How parallel is visual processing in the ventral path?[END_REF].

These solutions to build and manipulate complex representations in ANNs are diverse (recursive or iterative), but both are hierarchical : Complex represen-tations are seen as more and more abstract representations. In this position paper, we argue that these architectural solutions are not fully satisfactory because they miss an important dimension, the granularity of information representation. Taking inspiration from the brain, it can be remarked that hierarchical integration is not the only way to elaborate structured information representation : In the brain, specialized modules extract information in the data flow at various levels of granularity and mix them in heterogenous (and not only hierachical) systems for elaborated decisionmaking processes. As far as sensory information processing is concerned, we propose that these levels of granularity are of three kinds: 1. Feature : At a conceptual level, features can be extracted in the information flow and arranged in a hierarchical way; 2. Configuration : At the individual level, the agglomeration in a 'flat' vector of all the perceived sensory information allows for the representation of specific cases; 3. History : At the statistical level, overall trends can be extracted from the recent history of perception.

In the remaining of the paper, we first give some elements from neuroscience for the existence of such representations in the brain of mammals, then we propose to illustrate them and put them in situation in the case of pavlovian conditioning, before discussing the usefulness of such representations and of their association in heterogenous systems.

INFORMATION REPRESENTATION: A VIEW FROM NEUROSCIENCE

Information representation in a hierarchical way leading to abstraction of concepts has been extensively reported in the brain, for example in the visual cortex. This hierarchical view of knowledge representation has already inspired ANNs like deep networks, as evoked in section 1. From Hubel and Wiesel initial idea that neurons selective to orientation in the primary visual cortex are built from the activity of contrast-sensitive cells in a receptive field in the thalamus [START_REF] Hubel | Receptive fields, binocular interaction and functional architecture in the cat visual cortex[END_REF], further experiments along the ventral visual pathway have identified neuronal areas responding to a hierarchy of concepts [START_REF] Rousselet | How parallel is visual processing in the ventral path?[END_REF] captured in increasingly large receptive fields, from simple shapes to complex patterns like faces. In that respect, the ventral pathway of the cortex is proposed as the locus of semantic memory, with a cascade of neurons extracting a hierarchy of concepts. Here we will speak about feature representation.

Nevertheless, hierarchy is probably not the main characteristic to be evoked when characterizing information processing in the brain, but rather modularity and heterogeneity. Indeed, the brain is organized along complementary learning systems, as it has already been captured in early modeling approaches [START_REF] Doya | What are the computations of the cerebellum, the basal ganglia and the cerebral cortex?[END_REF][START_REF] Alexandre | Biological Inspiration for Multiple Memories Implementation and Cooperation[END_REF].

Particularly, learning mode and information representation in the hippocampus have been contrasted with that of the cortex described above [START_REF] Mcclelland | Why there are complementary learning systems in the hippocampus and neocortex: insights from the successes and failures of connectionist models of learning and memory[END_REF]. Whereas the cortex learns slowly to elaborate a semantic memory as a hierarchy of concepts that will be exploited in generalization, the hippocampus receives as sensory input a summary sketch of current cortical activity and learns in one shot an episodic memory of a specific event in its spatial and temporal context. Contrarily to the cortical case, this memory process is not prone to generalization; instead, when faced to a similar episode, the recall process will rebuild the original episode: the representation in the hippocampus is consequently unitary, storing configural representations of specific events [START_REF] O'reilly | Conjunctive Representations in Learning and Memory: Principles of Cortical and Hippocampal Function[END_REF]. Here we will speak about representation of configuration.

Though complementary, these memories are also in cooperation : The hippocampus is fed with sensory inputs encoded with cortical features and reciprocally participates to the slow cortical learning through the phenomenon of consolidation : Specific cases stored in the hippocampus during some task are sent back to the cortex for the extraction of new features, pertinent to the task (O' Reilly and Rudy, 2001). Whereas the cortex can work in generalization, the task is more difficult for the hippocampus : Faced to an episode similar to a stored one, the hippocampus can only choose between pattern completion (supposing that the episodes are equivalent, the stored one will be recalled) and pattern separation (supposing that the episodes must be distinguished one from the other, the new one will be stored as a different pattern) [START_REF] O'reilly | Conjunctive Representations in Learning and Memory: Principles of Cortical and Hippocampal Function[END_REF].

As far as task execution is concerned, the prefrontal cortex is certainly one of the most involved cerebral structures [START_REF] Fuster | The Prefrontal CortexAn Update : Time Is of the Essence[END_REF], since it supports the temporal organization of behavior, i.e. selecting at each moment, the best action (or decision) to trigger, depending on the external (perceptive) and internal (emotional and motivational) sensory information. Most of the time this decision is not purely reactive (not depending directly on current stimuli) but deliberative (depending on a more complex evaluation, also based on past experience). To that end, the prefrontal cortex builds task sets and maintains them active in a working memory mechanism, for comparison and selection (by a loop with subcortical structures, the basal ganglia) of the most adapted solution. In short, task sets are collections of recent cases of associations between actions (or decision) that have been triggered in certain sensory and temporal contexts, together with their performance in reaching the goal that was expected.

The prefrontal cortex is organized, from its premotor to its anterior part, in a hierarchy of levels of control [START_REF] Koechlin | The Architecture of Cognitive Control in the Human Prefrontal Cortex[END_REF] depending on the nature of the sensory and temporal context (and on the structure that sends this information). This cascade of control is made according to the perceptual context, the episodic context and the motivational and emotional context [START_REF] Kouneiher | Motivation and cognitive control in the human prefrontal cortex[END_REF]. At each level of description, the decision to engage an action is taken, based on its recent history of success in this context. This statistical analysis makes us describe the prefrontal cortex as a locus for the representation of history.

To better understand the way these representations are elaborated in a concrete case, their association and their impact on cerebral processes, we propose an illustration in the case of pavlovian conditioning.

CASE STUDY: PAVLOVIAN CONDITIONING

Pavlovian or respondent conditioning is the learning process by which an animal is able to associate an Unconditional Stimulus (US = biologically significant stimulus announcing pain or pleasure, e.g. an electric shock) to a conditional stimulus (CS, a neutral event like a tone, that predicts the US). This learning has been extensively studied in so-called fear conditioning experiments and is reported to be acquired quickly if the electric shock is given subsequently to the tone [START_REF] Herry | Switching on and off fear by distinct neuronal circuits[END_REF]. Later on, the animal exhibits fear behavior (ex: freezing) when solely exposed to the auditory CS. This can be explained as an anticipation or a preparation to the forthcoming pain. This response will disappear if the electric shock is no longer given (extinction process) and get re-activated by a new association (renewal process). As such, this simple description could assimilate pavlovian conditioning to an elementary associative learning where, for example, an hebbian learning rule could increase and decrease a weight between two neurons standing for the CS and the US. But reality is much more complex, as shown by many behavioral studies that required to refine our understanding on pavlovian conditioning.

One of the most famous paradigms is the blocking paradigm : In an early step, an association CS1-US is acquired. Then CS1 is paired with CS2 to announce the US. Here it could be said that CS2 becomes also a faithful predictor of US and, from a purely associative learning point of view, it should acquire also a predictive power. This is not confirmed by experiments: CS2 alone triggers no conditioned response. This paradigm has be interpreted as a parsimonious learning (CS1 is sufficient to predict US; no need to perform a new learning about CS2) and led to propose a non purely associative learning rule in the early 70's, the competitive Rescorla-Wagner learning rule [START_REF] Rescorla | A theory of pavlovian conditioning: Variations in the effectiveness of reinforcement and nonreinforcement[END_REF]. This rule states that the modification of the strength of association (the weight, considering a neuronal implementation with an input layer of CS connected to an output layer of US) between CSi and US is proportional to the error of prediction, i.e. the difference between what actually happens (the US) and what was expected (the sum of the predictive values of all present CSi). Two other multiplicative terms in the rule are defined as the associability (saliency) of the CS and the effectiveness (behavioral importance) of the US and are often defined as constant (but cf. below). Now comes the question of the nature of the CS and here also behavioral experiments are confusing: CS often corresponds to a salient stimulus (a tone, a flashing light), but sometimes as in the case of extinction and renewal, the pertinent element is the context in which conditioning occurs. This makes often modelers add a specific neuron in the CS layer standing for 'the context', even if this is not fully satisfactory, concerning representation of information. Another problem is about configural learning : In a prototypical case, CS1 or CS2 alone predicts US, whereas the occurrence of both predicts no US. This is difficult to explain with representation of single CSs because in this case CS1 and CS2 will acquire a strong predictive strength and the conjunction of both should add these strengths and predict the US. A practical solution to this classical problem is to create a new representation for CS1+CS2, seen as a new configural stimulus [START_REF] Schmajuk | Stimulus configuration, classical conditioning and the hippocampus[END_REF] but this raises again the question of building by hand the representation of sensory information during pavlovian conditioning.

All the models of pavlovian learning evoked so far are said US-processing models because their main goal is to predict the US from current CSs and consequently the same rule of predictive strength modification is applied to each CS, whatever its history, which is not realistic, as other behavioral experiments indicate (Le [START_REF] Pelley | The role of associative history in models of associative learning: a selective review and a hybrid model[END_REF], hence the need for CSprocessing models.

On the one hand, the Pearce-Hall model [START_REF] Pearce | A model for Pavlovian learning: variations in the effectiveness of conditioned but not of unconditioned stimuli[END_REF] tries to capture the fact that a CS often associated with US learns less quickly than a not well known CS and proposes that the term of associabilility of the CS could change in time and depend on the level of surprise (absolute value of error of prediction) and also on its own current value.

On the other hand, the Mackintosh model (Mackintosh, 1975) maintains a high associability for reliable CS, to explain the fact that assigning a CS to a new US is quicker after an overtaining of the CS with the previous US. Both cases underline the need to take into account the recent history of conditioning. They also raise new problems since it is obvious that the Pearce-Hall and Mackintosh models are somewhat contradictory, respectively proposing to decrease and increase the associability of a frequent CS.

Confronting abstract models to behavioral observations is also an incitation to integrate more realistic constraints in the models. This is for example the case with uncertainty : Our word is stochastic (real CSs do not always reliably predict US) and non stationary (a CS-US association rule valid at one time can be obsolete the time after). Classical of pavlovian conditioning generally address poorly this kind of constraints, which is a strong incentive to develop more realistic models, for example including bayesian approaches [START_REF] Yu | Uncertainty, neuromodulation, and attention[END_REF][START_REF] Deco | The dynamic brain: From spiking neurons to neural masses and cortical fields[END_REF].

In summary, this brief overview of pavlovian conditioning shows that, more than one hundred years after its identification, pavlovian conditioning is still not fully understood. We have mentionned several observations non consistent with the current understanding of this learning mechanism and, for each of them, a model yielding the corresponding behavior, but at the moment, there is no complete model integrating all these mechanisms. We think that going deeper in the understanding of the underlying cerebral substrate is an excellent way to design such a complete model.

CEREBRAL SUBSTRATE TO PAVLOVIAN CONDITIONING

The amygdala is the core cerebral structure for pavlovian conditioning [START_REF] Holland | Amygdala circuitry in attentional and representational processes[END_REF] but it cannot be considered in isolation for two reasons. On the one hand, the amygdala receives from other cerebral structures, sensory information about the CS and the US, for their association, but also other kinds of information needed at various steps of the conditioning. On the other hand, pavlovian conditioning results in a series of effects, that are transmitted to other regions in the brain. These effects are of course the pavlovian response itself, but also other attentional and representational effects.

Amygdala is in fact a complex and heterogenous structure [START_REF] Ledoux | The amygdala[END_REF], composed of several subdivisions and it can be convenient to distinguish three regions with specific functions and connectivities :

1. The lateral amygdala (LA) receives sensory information about the US and the CS from the thalamus and the cortex. This region is responsible for learning the CS-US association.

2. The central nucleus of the Amygdala (CeA) is in charge of the three aspects of the pavlovian response: the motor aspect (e.g. in the case of fear, freezing), the autonomic aspect (e.g. physiological changes like heart beat or temperature increase) and the hormonal aspect (release of stress hormones and neuromodulators like acetylcholine, norepinephrine, dopamine, etc.).

3. The basal amygdala (BA) has a major representational role. It receives from LA information about CS-US association, modulates this information with contextual inputs coming from the hippocampus and prefrontal, to elaborate a representation about the sensory nature of the US [START_REF] Cardinal | Emotion and motivation: the role of the amygdala, ventral striatum, and prefrontal cortex[END_REF]. This information is sent to the CeA to produce the pavlovian response but also to the sensory cortex (attentional affect) and to the prefrontal cortex-basal ganglia system (emotional evaluation of stimuli has also strong effect in decision making and operant conditioning).

This very rough description of the amygdalar circuitry allows to put into context all the mechanisms and observations about pavlovian conditioning evoked in section 3. We posit a general computational principle with this circuitry : Sensory thalamic and cortical inputs to LA (generic features) should be sufficient to reliably predict US but other sensory information coming from the hippocampus to BA will possibly propose CS-US association rules corresponding to more specific cases. Later on, these specific cases could be 'compiled' from the hippocampus, in the creation of new features in the cortex.

The LA and BA regions project in CeA to trigger the good pavlovian response. The choice between the corresponding CS-US rules will be learned from a monitoring of their performance in predicting US, evaluated in the orbitofrontal cortex (OFC). This anterior region of the prefrontal cortex has very dense relations with all regions of the amygdala and builds an history of errors of US prediction, depending on the sensory context (in the cortex and in the hippocampus) in which they occurred [START_REF] Pauli | Expectancy, Ambiguity, and Behavioral Flexibility: Separable and Complementary Roles of the Orbital Frontal Cortex and Amygdala in Processing Reward Expectancies[END_REF]. These errors of prediction are of two kinds.

A positive error of prediction corresponds to the case where an US is received whereas it was not predicted by LA neither by BA : in this case BA will send a signal to the hippocampus to make this structure learn by heart the current episode [START_REF] Paz | Measuring correlations and interactions among four simultaneously recorded brain regions during learning[END_REF]. On the next occurrence of this episode the hippocampus will be able to recall the corresponding US and send a configural representation to BA. If this is often repeated, this will result in consolidation in the cortex and in the emergence of a feature representation in the cortex, leading to a reliable rule in LA.

When a negative error of prediction occurs (from the current sensory context, an US has been predicted and doesn't occur), several causes can be evoked :

1. The rule is valid but the specific context corresponds to an exception which must be stored in the hippocampus as associated to no US (case of an extinction). If this happens again in this context, the rule in BA based on this hippocampal input will be favored in this specific case with regard to the general rule coming from LA.

2. The rule is stochastic and not fully reliable. In this case the level of stochasticity of the rule has to be updated in OFC. This case and the previous case also result in an increase of the level of acetylcholine [START_REF] Yu | Uncertainty, neuromodulation, and attention[END_REF], which favors learning in BA, in the hippocampus and in the cortex, with the aim of making more precise the rules currently under consideration.

3. The rule is no longer valid because the world is non stationary but it could be valid again in the future. The rule is consequently conserved without modification but inhibited by OFC that triggers a release of norepinephrine [START_REF] Yu | Uncertainty, neuromodulation, and attention[END_REF]. This neuromodulator acts on the thalamocortical inputs of LA, to look for a new rule [START_REF] Johnson | Regulation of the Fear Network by Mediators of Stress: Norepinephrine Alters the Balance between Cortical and Subcortical Afferent Excitation of the Lateral Amygdala[END_REF].

These causes have to be distinguished from the history of performance in US prediction stored in OFC.

A corresponding algorithm has been proposed by [START_REF] Yu | Uncertainty, neuromodulation, and attention[END_REF], to evaluate the decision threshold between stochasticity and non stationarity : When the rule is highly stochastic, many examples are needed before deciding for a new rule; conversely when the rule is very reliable, this change will be made more easily. This alternative is also useful to propose a way to release the seamingly contradictory effects between the Pearce-Hall and Mackintosh models : The Mackintosh model could apply only when the rule is judged valid and stable (no error of prediction), to evaluate its level of reliability, whereas the Pearce-Hall model could apply only in the early stages of selection of the rule, to explore and detect candidate CS.

DISCUSSION

In this paper, we have laid emphasis on the fact that different levels of granularity of information are represented and processed in different brain regions and can be manipulated in ANNs as well : Multi-layered ANNs can extract a set of features, as a hierarchy of concepts, with some analogy to the sensory cortex. Associative memories like the Hopfield model have been shown to learn by heart configuration of features representing specific cases in a recurrent architecture, as it is the case in the hippocampus. In addition to these cases, history of the statistical tendencies of certain information flows is believed to be captured in the prefrontal cortex.

Though not yet mature in ANNs, early models implementing this latter kind of processing are proposed [START_REF] Kouneiher | Motivation and cognitive control in the human prefrontal cortex[END_REF].

In this paper, we have also shown, through the example of pavlovian conditioning, why mixing these levels of granularity is so powerful. On the one hand, the combination of associative rules involving features and configurations is of central importance in this learning and is more generally reminiscent of the principle of mixing generic rules and specific cases. On the other hand, it seems possible to reconcile different cases where pavlovian conditioning works differently by performing a statistical analysis that allows to distinguish different functioning modes. Selecting strategies and switching between procedures seem to be a major role of the prefrontal cortex [START_REF] Fuster | The Prefrontal CortexAn Update : Time Is of the Essence[END_REF][START_REF] Koechlin | The Architecture of Cognitive Control in the Human Prefrontal Cortex[END_REF], fed by contextual and episodic information from the sensory cortex and the hippocampus respectively, and operated through its control on many cerebral structures, sometimes by the release of neuromodulators.

Pavlovian conditioning was chosen here to exemplify these principles but many characteristics of the cerebral system support the fact that computing with these different levels of representation is more general than this only case. In addition, we are deeply convinced that computing with these levels of representation might be advantageously exported to the domain of ANNs. It could provide this domain with an efficient way to combine generic rules and specific cases and to make decisions based on the evaluation of performances of such heterogenous modules, which seems to underlie an important part of our cerebral system and its emergent cognitive capabilities.

ACKNOWLEDGEMENTS

This work was partly supported by the Keops ANR project.


Keywords: landfill expansion, settlements, liner system, geosynthetics, stability

Use of geosynthetics in piggy-back landfills : development of an iterative methodology for the design of the lining system over old unlined waste F. Tano, F.

INTRODUCTION

Landfill sites are becoming increasingly technical works in which various materials interact: natural materials (clay, sand, gravel), synthetics materials (geosynthetics) and waste, whose behavior can be variable both in time and space. The technical nature of these facilities has increased in recent years with new landfills being built over older cells. This new "piggy-backing" design was implemented for the first time in 1987 on a landfill site close to New York City [START_REF] Bouthot | Landfill extension using the piggy-backing technique: discussion and case study in Quebec[END_REF] before being taken up and developed during the last two decades in North America, China and more recently in Europe and in France, where there are now a dozen such sites.

With the increasing difficulty in identifying suitable sites for the establishment of new landfills, the implementation of these piggy-back landfills is considered more and more often: a simple review of recent landfill projects confirms an increase in the number of such projects and their number is expected to remain high in the medium term, regardless of their governance (public or private). Indeed, although the quantities of waste sent to landfill sites are slightly decreasing as a result of public policies for the reduction and the recycling of waste, the stabilization of waste treated through valorization processes (biogas production, composting, ...) often remains incomplete while other processes lead to waste residues requiring a final disposal. For all these reasons, landfill sites will remain necessary, being the last treatment process for waste residues.

From the perspective of real estate, piggy-back landfills have the advantage of limiting the spreading of existing facilities, hence favoring the preservation of agricultural land as well as simplifying site opening procedures for site operators (since the acquisition of new land is not necessary or very limited) and rationalizing equipment and structure expenditure (economy of scale). Moreover, when a landfill site operator has developed a good relationship with the local residents, it goes without saying that it will be easier to promote an extension on the same site rather than in an area where he doesn't have any connection yet.

However, storage of waste over older waste leads to the reactivation of their settlement, which may result, without the implementation of appropriate reinforcement structures, to large deformations within mineral and synthetic impervious barriers. In addition, in the case of piggy-back landfill projects partly es-Use of geosynthetics in piggy-back landfills: development of an iterative methodology for the design of the lining system over old unlined waste F. Tano Ecogeos, Arras, Irstea, HBAN unit, Antony & LTHE, Grenoble, France

F. Olivier

Ecogeos, Arras, France ABSTRACT: Given the difficulties in identifying suitable sites for the establishment of new sanitary landfills, the extension of existing sites is considered more and more often as a solution. This increasing interest is also linked to the possibility of increasing the waste storage capacity and using the operating infrastructures over a longer period, thus allowing savings. Beyond the benefits associated to this rather new landfill concept, it is necessary to carefully consider the integrity of the liner system considering the important settlements (reactivated under the new cell load) that can develop. Indeed, the settlements can alter the sealing and the drainage functions of the liner system. An iterative method inspired mainly from the Incremental Settlement Prediction Model [START_REF] Olivier | Tassement des déchets en CSD de classe II : du site au modèle[END_REF] was developed to look deeper into this issue. Applicable to various geometric configurations, this method helps designing the barrier reinforcement using high-performance geogrids. In addition to this aspect, the proposed methodology also helps designing bottom liner system slopes to guarantee free drainage and avoid leachate accumulation.

tablished on side slopes, large-scale instabilities can also appear, favored by the presence of geosynthetic interfaces, which can easily become sliding surfaces. Therefore, it is crucial to integrate all the components of the geotechnical analysis, in order to ensure not only the overall stability of the sites but also the long-term performance (impermeability, drainage) of their bottom passive and active liner system.

CHARACTERISTICS OF PIGGY-BACK LANDFILL PROJECTS AND RELATED ISSUES

As discussed above, piggy-backing or landfill expansion consists in creating one or more new landfill cells partly or completely supported on older closed cells. Beyond this definition, landfill expansion encompasses a wide range of configurations and associated issues, particularly regarding [START_REF] Olivier | Utilisation des géosynthétiques dans la conception de projets d'extension verticale d'ISDND : enjeux, méthodes et techniques mises en oeuvre[END_REF]:  Geometry of the older cell and of the newer one (see Figure 1): -Raise of the landfill in a valley or a quarry and supported on the side slope -Raise of the landfill in tumulus and entirely supported on the old waste cell -Raise of the landfill supported totally or partially on the side slope of the old cell  Characteristics of older waste: -Nature of the waste (household waste, industrial waste, bulky waste, organic waste, etc.) -Height of the waste (usually between 5 and 50 m) -Age of the waste (0 to 30 years) -Water content of the waste  Type of safety equipment of older cells: -No passive and active liner system (such as in old landfills) -Existing liner system but not strictly in conformity with the current regulations (especially in terms of hydraulic equivalence) -Liner system meeting all current regulations  Possible retaining and reinforcement structures related to the landfill expansion: -Soil improvement / reinforcement of the foundation (PVD, jet grouting, soil mixing) -Reinforced wall (reinforced earth, gabions, etc.) -Heavy retaining wall By the possible combination of the above factors, piggy-back landfill projects present various characteristics, which should be approached with method. Under these conditions, it is more important to develop a general analysis approach than turnkey design solutions. In addition, special attention is necessary in terms of design, dimensioning and implementation of the piggy-back liner system (Table 1) which is of crucial importance with regard firstly to its role for containing leachate and secondly to its mechanical properties (rather medium or low interface friction that make it a preferential sliding surface).

PROPOSED METHOD FOR THE DESIGN OF A LANDFILL EXPANSION

3.1 Basis of the method: settlement of the existing waste under the new waste

Settlement of waste: what are we talking about?

The proposed method (Figure 2) primarily consists in taking into account the settlement of waste which may cause disturbances for the piggy-back cell following the surcharge load. To anticipate at best the predictable distortions in the waste in place (under the piggy-back liner system) but also at the top of the piggy-back cell, both structural and localized settlements which may appear in the waste mass must be considered.

Structural (or "large-scale") settlements arise primarily from:  Mechanical actions (mainly related to the application of surcharges causing distortion and rearrangement of waste components)  Biochemical actions (due to the decomposition of the organic part of the waste)  Physicochemical actions (corrosion of ferrous materials, oxidation phenomena , etc.)  Sieving of degraded particles through macro-pores of the waste These mechanisms interact, overlapping one another in a complex way over time. Their association may nevertheless be represented on the basis of two distinct components [START_REF] Olivier | Tassement des déchets en CSD de classe II : du site au modèle[END_REF]:  Primary (short-term) settlements resulting from the surcharge induced by the overlying waste and the cap cover. This short-term component (a few days to a few weeks) is generally assumed to be independent of time  Secondary (long-term) settlements assumed to be independent of the surcharge and possibly continuing over several decades The amplitude of these settlements can reach cumulative levels of several meters after 30 years. Also, taking into account the inevitable spatial variations depending on the type, height and age of the buried waste, significant differences in settlement (differential settlements) may occur from one area to another in the same cell. In a piggy-back context, these settlements may result in a potential loss of integrity of the intermediate barrier and in the breaking of gravity water channels.

Unlike structural settlements, localized settlements result from collapses that can sometimes occur in a waste mass. Indeed, although composed mainly of a fine matrix of moderately variable mechanical behavior (for a given age and level of compression), municipal solid wastes can be very heterogeneous due to the presence of large items (mattresses, scrap metal, etc.) which can act as hard spots within the material structure or, on the contrary, as softer pockets in the presence of highly degradable waste and/or waste of malleable consistency (sludge, putrescible waste, etc.). In the case of bioreactor landfills (with leachate reinjection), these phenomena can be amplified in case of a non-homogeneous distribution of moisture in the waste.

Evaluation of the effects of landfill expansion on settlements

In order to anticipate future (structural) movements of piggy-back liner system, it is proposed to use the Incremental Model Prediction of Settlements (ISPM model) [START_REF] Olivier | Tassement des déchets en CSD de classe II : du site au modèle[END_REF], ADEME (2005)]. Indeed, compared to traditional models, this model has advantages both fundamental (determination of compression coefficients inherent to the waste) and practical (increased reliability of predictions). In addition, its incremental nature (analysis by elemental waste layer) gives it a great flexibility of use, predestining it to the study of waste bodies whose height and age often vary in space. Finally, this model presents the advantage of having been calibrated on fifty or so landfill sites in France and abroad, giving it a reliability that other models do not have.

Moreover, in addition to the traditional study of structural (large scale) settlements, it is appropriate, in order to anticipate (conservatively) the maximum deformations that can occur within a waste mass, to also take into account the risk of occurrence of localized settlements. In the absence of a mathematical model, this risk is estimated on the basis of feedback acquired on several landfill sites around the world. Figure 2 summarizes the successive steps of the suggested method. Following the preparation of the study (step 1), further investigations (step 2) may be required depending on the quality of available data. Once the data is considered sufficient, it is used to complete the working hypotheses that must be fixed before proceeding to step 3 (calculating settlements). Based on the first set of hypotheses considered, settlements of both the old waste and the new waste are estimated over the entire hold of the studied cell, with a mesh sufficiently narrow to allow the assessment of maximum differential settlements. The time scale taken into account in these calculations naturally differs depending on whether are only taken into account the settlement of the waste at passive and active liner system or the settlement of the whole waste column (old + new waste) at the cover of the new cell. In any case, the most unfavorable conditions for the project shall be taken into account, generally at the end of the post-operation period of the site. Once all the calculations are made, step 4 can begin, consisting primarily in verifying the continuity of flow streamlines along the liner system as well as the cap cover of the new cell (in order to avoid the formation of rainwater stagnation zones).

Process and main steps of the proposed method

After these verifications, the initial hypotheses, generally revealing to be perfectible, will require several adaptations to ultimately lead to a satisfactory technical solution. It is therefore necessary to go back to the previous step (3) as many times as necessary until approaching (with successive approximations) the optimal technical solution. For each iterative loop, an exchange with the project owner or his representative is desirable in order to refine the working hypotheses in a way that remains consistent with future operating constraints of the site. As shown in Figure 3, this especially necessitates spatial adaptation:  Of the thickness of the subgrade layer (variable thickness at all points of the cell)  Of piggy-back liner slopes  ) , ( y x   Of the cap cover of the new cell  ) , ( y x  Given the reliability of the settlement prediction method (which guarantees a minimal uncertainty regarding the magnitudes and distribution of post-operation settlements), it is also possible within the framework of the proposed design (Figure 3):  To reduce cover slopes ) , ( y x  of the piggy-back cell.  And possibly to raise the maximum upper level of the waste of H  height (Figure 3) in anticipation of post-operation settlements, while ensuring the top cover elevation to be back under a certain level at a given date (determined on a case by case basis). In addition to the previous issues, other technical questions are raised within the framework of step 4 (geogrid reinforcement, leachate and biogas drainage …). These are detailed below ( § 3.3 and 3.4). Once the project is considered viable, and possible alternatives exhausted, we can finally move to the overall project evaluation (step 5) followed by the detailed project (step 6) if it is considered acceptable.

Existing cell

Piggy-back cell

Reinforcement geogrid In order to avoid any loss of integrity (by cracking or breakage) of the active and passive piggy-back liner system as a result of the differential settlements that will inevitably occur under the new cell, a mechanical reinforcement ought to be provided, including a reinforcement geosynthetic that can withstand significant tensions while deforming as little as possible both on short and long term (material nit hardly sensitive to creep). The geosynthetic shall be placed between the passive mineral barrier and the attenuation layer in order to fully play its role.

Active liner system Passive liner system

Design of the geosynthetic reinforcementabove a cavity

The geosynthetic reinforcementmust be able to withstand both the occurrence of significant (and spatially and highly variable) overall settlements and the potential formation of localized collapse zones. This second phenomenon is here discussed in more detail. [START_REF] Giroud | Design of soil layer-geosynthetic systems overlying voids[END_REF] were the first to propose, in the presence of a cavity under a bottom barrier system, an analytical method for the evaluation of the required tensile strength, taking into account the induced membrane effect. This method was adapted to allow consideration of the barrier slope by means of a successive approximation method. This design method includes six steps (a to f) from the definition of calculation hypotheses to a performance evaluation of preselected geosynthetic (Figure 4).

Design calibration based on real cases

As part of the calculation process illustrated on Figure 4, it is first necessary to establish an acceptable strain corresponding to the nominal tensile strength of the geomembrane and of the geosynthetic reinforcement tested. Regarding the vertical surcharge, taking into account the entire height of the piggy-back waste would be quite unrealistic, due to "fiber cohesion" (entanglement) and friction phenomena that have the effect of retaining waste elements one to another, which reduces the surcharge load at the base of the column where the collapse occurred. A calculation taking into account the thickness of the bottom liner system, the earth pressure coefficient and the internal friction angle of waste can determine this load.

Besides, caution leading to consider the most potentially penalizing conditions, a series of correction coefficients is applied for the design of the geosynthetic, including a weighting factor (consistent with Eurocodes), a series of reduction coefficients linked to risks of mechanical damage (during installation), environmental risks (mainly related to the chemical inertness of the geosynthetic) and creep risks (depending on the nature of the geosynthetic, of the duration considered for the service life of the construction and of the eventual certification of envisaged geosynthetic) and at last, a general safety factor. Finally, the value of nominal strain considered for the product is generally assessed for 20°C. If a medium temperature of 40 to 50°C is considered at the heart of the waste as well as an increase of the ultimate strain depending on temperature, it is necessary to proportionally reduce the nominal strain of the product so as not to exceed its ultimate value.

The ultimate strain of GCL and treated soils (corresponding to the passive barrier) are generally sufficient to withstand effective deformations. As for clays, their resistance to deformation in unconfined conditions is generally quite low as attested by several laboratory and field tests. However, the work carried Step c

• Calculation of the induced tension in the reinforcement geosynthetic depending on the liner system slope and on the diameter of the cavity

Step d

• Calculation of the geosynthtic strain from the length of the deformed fiber above the cavity

Step e

• Inter-comparison of the effective strain and the allowable strain (consideration of the reduction factors particulary the creep factor )

Step f

• Assessment of the geosynthetic performances in the considered configuration

If result is satisfactory

End of calculations otherwise return to the initial steps with other geosynthetics (iterations)

out by [START_REF] Jessberger | Subsidence effects on clay barriers[END_REF], [START_REF] Viswanadham | Requirements for the design of geogrid reinforced clay liners of landfills[END_REF] and more recently [START_REF] Camp | Comportement sous flexion d'une argile : application à la couverture d'une ISD TFA[END_REF], in confined conditions, largely put in perspective the risks of tensioning because when pressure increases due to overload, tension mechanisms are gradually replaced by shear phenomena comparatively less penalizing (especially in the presence of geosynthetic reinforcement).

Other technical considerations

In addition to the previous issues, other problems may arise during the design of a piggy-back cell, such as the question of the installation of geosynthetics. All these issues cannot be discussed here in detail. However, two specific points may for instance be briefly mentioned:  Drainage of leachate and biogas from older waste under the piggy-back liner system: in some cases, waste degradation coupled with rainwater infiltration in old cells is likely to result in an important humidification of the waste in place, which can be accentuated by the surcharge applied on the older waste (due to the decrease of the pore size of the waste). Also, in the presence of initially very wet waste (possibly with presence of perched leachate table) and/or biogas insufficiently drained, our approach calls for the establishment of drainage trenches possibly coupled with drainage geocomposites (Figure 3) under the subgrade layer as is also done under the concrete slabs of buildings built on contaminated soil in order to avoid any risk of leachate / biogas rise in contact with the passive barrier. Indeed, clay and GCL even more are materials sensitive to humidification / desiccation cycles and, as such, must be maintained in a water conditions as stable as possible. If required, the previous equipment can thus be designed as single or mixed (leachate / biogas) networks.  Stability on slopes: in the presence of steep slopes, it is important to carefully consider the interface (residual) properties of synthetic and mineral materials. Indeed, the interface friction angles between the materials most commonly used generally vary within a range of 6 to 20°, depending on the surface condition of geosynthetics considered, their surface moisture, their deformation, etc. [START_REF] Bergado | Evaluation of interface shear strength of composite liner system and stability analysis for a landfill lining system in Thailand[END_REF][START_REF] Eid | Shear strength of geosynthetic composite systems for design of landfill liner and cover slopes[END_REF]. Moreover, according to the surface state (more or less smooth or rough) of each geosynthetic, the transfer of lateral loads (in case of slight slope deformation) may occur along different interfaces. Therefore, it is important before installing the piggy-back barrier to conduct a study of interface or block stability in order to avoid any risk of instability.

FROM DESIGN TO IMPLEMENTATION: FIELD FEEDBACK

To date, the authors have worked on seven vertical expansion projects such as the Crépy-en-Valois landfill site (Figure 5) located 60 km from Paris. An assessment of the project design and the work carried out has been made. Despite a somewhat complex site configuration (combination of configurations 1 to 3 shown in Figure 1) and a relatively significant height of waste in place (up to 45 m), maintaining the long-term flow streamlines at the bottom of new cells did not raise any particular difficulty, given the direction of the initial slopes which settlements were only going to accentuate over time. It thus was not necessary to specifically increase the subgrade layer. Given the height of old and new waste (up to 35 m locally), primary settle-ments between 0.5 and 2 m and secondary settlements between 1 and 3.5 m were predicted 30 years after the end of the site operation. As a direct consequence of these settlements, a general stretching of the barrier with an average order of magnitude of 0.2 to 0.5% was estimated. Based on the detailed results of the study, it was decided to install a Fortrac ® R MPT type, made of polyvinyl alcohol (PVA) fibers with polyamide coating. Presenting a very low creep deformation compared to polyester or HDPE fibers, PVA fibers have been selected for optimum long-term performance of the product. In this regard, the dimensioning of the geogrid was made on the basis of a 100 year creep. Given the cost of geogrid reinforcement, special attention was given to the layout plan of the geogrid in order to limit the longitudinal overlaps (and thus product "loss"). Retrospectively, this proved to be all the more important that the cell showed irregular shapes (Figure 5). Finally, given the high stiffness of the geogrid, it appeared that longitudinal overlaps were more fitting than conventional anchor trenches. A first attempt of double anchor trench made on a trial section confirmed that such implementation was likely to lead to the weakening of anchor trenches but also to the tension of GCL. Thereafter, the geogrid strips were therefore systematically laid flat. When the slope geometry allows it, a temporary anchorage solution using big-bags or concrete blocks can also prove to be interesting.

CONCLUSIONS

Facing the difficulties of identifying suitable sites for the implementation of new landfill sites, it was reminded that the current trend was to focus on the expansion of existing sites (piggy-backing). Beyond the benefits that this type of installation represents, carefully taking account the settlement phenomena (reactivated as a result of surcharge loads) however proves to be necessary so as to ensure the long-term drainage and sealing functions of the active and passive barrier systems (as well as the cap cover of the new cell). An iterative design method inspired by the ISPM model was developed, adapted to different site configurations. In addition to setting the slopes of the piggy-back liner system, this method also contributes to the design of the geosynthetic reinforcement required under the mineral (passive) sealing layer. Applied to date to seven landfill sites in France and abroad, the proposed approach has proven to be reliable and helps rationalizing the construction of piggy-back cells. Without doubt, improvements are however still possible. Given the importance of the issue, a research project was launched in 2013, in collaboration with two major French public laboratories, a geosynthetic producer and landfill operators.

Figure 1 .

 1 Figure 1. Example of the main configurations of piggy-back landfill (possibly in combination).

Figure 2 .

 2 Figure 2. General methodology proposed for designing a piggy-back cell.

Figure 3 .

 3 Figure 3. Proposed design vs. usual design for a landfill expansion.

  Design of geosynthetic reinforcement to maintain the functions and the integrity of the piggy-back liner system

Figure 4 .

 4 Figure 4. Steps of the iterative process for the design of geosynthetic reinforcement (above a cavity).

••

  Calculation assumptions: width of the cavity / transfert of stresses induced by the waste mass on the geosynthetic reinforcement Step b Application of the Giroud et al. (1990) method: calculation of the corrected load applied on the top of the liner sytem from the theoretical load and the membrane effect

Figure 5 .

 5 Figure 5. Crépy-en-Valois landfill expansion site. (a) Implementation of geogrid reinforcement under the passive barrier. (b) Cross section of the existing cell and of the piggy-back cell showing the expected evolution of the geometry of the piggy-back lining system after settlements.

Table 1 .

 1 Constitution of safety barriers on existing waste

	Containment	Function	Cell bottom	Material	Function	Cell side slopes	Material
			Granular materials
	Active liner system	Drainage Active permeability	(+ drainage geocompo-sites : optional) Geomembrane 1	Drainage Active permeability		Geosynthetic 1 Geomembrane 1
	Passive liner	Passive permeability	Clay only (thickness : 1 m) or clay associated with GCL 2 or treated soil (SBP 3 for exam-ple)	Passive permeability	GSB 2 or treated soil and 0,5 m of clay on the lower 2 m from cell bottom
	system	Mechanical	Reinforcement geogrid or geo-	Mechanical		Reinforcement geogrid or
		reinforcement		synthetic 4	reinforcement		geosynthetic 4
		Attenuation + subgrade layer	Local materials	Attenuation + subgrade layer		Natural materials existing on the site
	1 Geotextile necessary on the upper face of the GMB for protection 2 GCL: Geosynthetic Clay Liner 3 SBP: Sand-Bentonite-Polymer

4 Structural element not yet routinely part of piggy-back landfill projects

10th ICG (International Conference on Geosynthetics) 21/09/2014 -24/09/2014

AKNOWLEDGEMENTS

The authors particularly wish to thank the Crépy-en-Valois landfill operator (K2O, Sita Suez Environment subsidiary) for making available the site data. Special thanks are also given to Nathalie Touze-Foltz (Irstea, HBAN unit) and Daniel Dias (LTHE, University of Grenoble) for their guidance and advices throughout the preparation of this paper and for their involvement in the research project.


Albert Cohen

Valentin Perrelle

Dumitru Potop-Butucaru
email: dumitru.potop_butucaru@inria.frelie.soubiran@transport.alstom.comzhen.zhang@irt-systemx.fr

Elie Soubiran

Zhen Zhang

Mixed-criticality in Railway Systems: A Case Study on Signaling Application

I. INTRODUCTION

Since the early 2000's almost every new metro project in the world make use of a standardized railway signalling system called Communication Based Train Control (CBTC) (IEEE 1474). Previously to CBTC, conventional signalling train control systems were relying almost exclusively on track circuits, wayside signals and operating procedures to ensure train protection and operation. In order to ensure better operational performance (e.g. effective utilization of the transit infrastructure), CBTC systems rest on three pillars: "Automatic train control (ATC) based on high-resolution train location determination, independent of track circuits"; "high-capacity and bidirectional train-to-wayside data communications"; and "train-borne and wayside computing units that execute vital functions". Functions are classified within three families that are: Automatic Train Protection (ATP), Automatic Train Operation (ATO) and Automatic Train Supervision (ATS). The level of criticality differs from a family to another and without loss of generality, one can state that ATP functions are mostly safety critical functions (SIL4 regarding CENELEC 50126), whereas ATO and ATS gather functions of low criticality (from SIL0 to SIL2). As a matter of fact, CBTC systems are in essence Mixed-critical systems. Furthermore, the mainstream evolution of those systems tends toward more functional integration on more powerful computing units. ATP and ATO functions that were traditionally distributed on different computing units (both on wayside and train-borne) tends now to be deployed on the same computing units and thus sharing resources.

FSF 1 is an IRT SystemX project positioned on two topics, the first one is about the conception of signalling applications (typically ATO/ATP application) that contain both critical and non-critical parts and the second one is on execution platforms that execute those applications while offering high guarantee of safety and availability. Industrial expectations around the execution platform include the use of multi-core COTS, the use of modern RTOS that offer spatial and temporal isolation, the use of safety and availability architectural patterns (e.g. voting and redundancy), and the whole being finally hidden behind a "system abstraction layer". On top of this platform, a tooled framework is prototyped and allows one to develop, verify 1 FSF is a French project name acronym standing for "safe and reliable embedded systems" and deploy component based applications where components may arbitrary contains both vital (SIL4) and non-vital (SIL0) code. The project has started in May 2013, the aim of this communication is to propose a first return of experience and a positioning on how mixed critical issues will be addressed in FSF.

Alstom Transport has defined an applicative case study that, while being limited to one single ATC function, is representative of the complexity in term of vital/non-vital code interweaving, operational performance and availability constraints. The system function is called "Passenger Exchange" (PE). This function takes control on the train when this one is safely docked at a station; it organizes the exchange of passengers (train and station doors opening/closing) while protecting them from any untimely train movement or non-aligned doors opening and finally gives the departure authorization when all safety conditions are met. The functional specification is made of more than 300 requirements (natural language + SysML), and the functional structure is made of about twenty sub functions.

PE is designed as a system component containing both vital and non-vital parts. At this level a component is roughly a packaging unit that exposes to the exterior world a set of ports (in or out) and that is characterized by a set of behaviours that depend on the operational environment. This component is then broken down into a set of atomic software components which are this time exclusively vital or non-vital. An important remark is that there are no restrictive design constraints on data dependency between the vital and nonvital atomic components.

To illustrate this fact, let us consider a simplified example from the case study, depicted in Fig. 1. The vital components, in red, are in charge of controlling operations. This can be summarized by computing which doors are safe to open (e.g. because they are not aligned) and by preventing train departure if safety conditions are not met (e.g. the doors are open or opening). The non-vital components are in charge of operating doors with respect to a mission protocol and a time table .  In this example we can identify two occurrences of vital to non-vital communications. First, in order to ensure that doors commands (non-vital) do not lead to an accident, they must be checked against the enabled set of doors (vital). This is the role of the "Process output" atomic component. Second, the departure authorization (vital) must be computed regarding door commands to ensure that no opening commands will be executed after the authorization has been given. This is a simplified example. Such communication patterns are quite common in the complete case study.

II. SYNCHRONOUS APPROACHES

A. Synchronous languages

Data-flow synchronous languages, such as LUSTRE [START_REF] Caspi | Lustre: A declarative language for real-time programming[END_REF] or SIGNAL [START_REF] Benveniste | Synchronous programming with events and relations: The signal language and its semantics[END_REF] have been designed in the 80's for program realtime safety critical embedded systems. Since then, they have been widely used in industrial applications [START_REF] Benveniste | The synchronous languages 12 years later[END_REF]. These languages emphasize a correct-by-construction approach, ensuring bounded memory and execution time. Moreover, they are praised for their predictable behaviour and formally defined semantics.

Recently, the problem of scheduling multi-rate, mixedcritical synchronous programs have been addressed, at first for uni-processor [START_REF] Baruah | Semantics-preserving implementation of multirate mixedcriticality synchronous programs[END_REF] then for multi-processors [START_REF] Yip | Relaxing the synchronous approach for mixed-criticality systems[END_REF]. Outside the scope of mixed-criticality there were also several attempts to distribute synchronous data-flow languages [START_REF] Aubry | On the desynchronization of synchronous applications[END_REF], [START_REF] Caspi | From simulink to scade/lustre to tta: A layered approach for distributed embedded applications[END_REF], [START_REF] Delaval | A type system for the automatic distribution of higher-order synchronous dataflow programs[END_REF]. Recent work have been done to develop these languages to target multi-core platforms through the programming of parallelism [START_REF] Cohen | Programming parallelism with futures in lustre[END_REF]. This work introduces futures in LUSTRE-like languages giving the guarantee that the sequential semantics is preserved.

B. Automatic allocation, partitioning, and scheduling

Due to their use in the avionics industry, synchronous languages have been considered early on as an input formalism for the automatic or semi-automatic synthesis of realtime implementations. Most significant in this direction are previous results by previous work by Sorel et al. [START_REF] Marouf | Schedulability analysis for a combination of non-preemptive strict periodic tasks and preemptive sporadic tasks[END_REF] on the AAA/SynDEx methodology and tool for distributed, but not time-triggered, real-time implementation of multi-periodic synchronous specifications, previous work by Caspi et al. on the use of Lustre/Scade in the real-time implementation of Simulink over multi-processor platforms based on the timetriggered partitioned bus TTA [START_REF] Caspi | From Simulink to SCADE/Lustre to TTA: a layered approach for distributed embedded applications[END_REF], and previous work by Forget et al. [START_REF] Pagetti | Multitask implementation of multi-periodic synchronous programs[END_REF] on the specification and implementation of multi-periodic applications over a time-triggered platform using the Prelude language.

But none of these approaches allow us to take into account all the characteristics of our case study in order to allow automatic mapping. In particular, none of them has support for ensuring the time and space separation between application parts with different criticalities.

This is why we considered in this project a new tool, named LoPhT [START_REF] Carle | From dataflow specification to multiprocessor partitioned time-triggered real-time implementation[END_REF], [START_REF] Carle | Predicate-aware, makespan-preserving software pipelining of scheduling tables[END_REF], which allows the automatic mapping of applications onto platforms following the ARINC 653 time and space partitioning mechanisms. The LoPhT tool takes as input deterministic functional specifications provided by means of synchronous data-flow models with multiple modes and multiple relative periods. (Cf. the LoPhT part of Fig. 2) These specifications are extended to include a real-time characterization defining task periods, release dates, and deadlines. Task deadlines can be longer than the period to allow a faithful representation of complex end-to-end flow requirements. The specifications are also extended with allocation constraints and partitioning information meant to represent the criticality of the various tasks, as well as information on the preemptability of the various tasks. Starting from such specifications, the LoPhT tool performs a fully automatic allocation and offline scheduling onto partitioned time-triggered architectures. Allocation of time slots/windows to partitions can be fully or partially provided, or synthesized by LoPhT. The mapping algorithms of LoPhT take into account the communication costs. The off-line mapping algorithms of LoPhT use advanced mapping techniques such as software pipelining and precomputed preemption to improve schedulability and minimize the number of context switches.

III. CASE STUDY

The PE case study has been implemented and a first demonstrator has been produced. The challenge for this first demonstrator was to propose a framework for on the one hand the design and implementation of components and on the other hand the design of signalling application its partitioning and scheduling.

Choice of software modelling language. We chose to use the language HEPTAGON, very similar to LUSTRE and featuring novel constructions and novel optimizations. Two criteria have influenced the choice of the language. First, the functional specification defined at system level and allocated to software components have been written in a reactive and mostly equational way. It was thus very natural to implement it in a synchronous data-flow language. Second, the normative referential (CENELEC 50128) recommends the use of formal methods for the development of vital software while making no restrictive assumption on the language used for the non vital part. Synchronous languages are a good trade-off since they enable the use of formal methods (for instance model checking or abstract interpretation) while providing a sufficient power of expression to implement non-vital components. Finally, having a single language to develop both vital and non-vital components allows not only the early simulation of functional behaviour without integration effort but also the rationalization of competence in the software development team. Technical realization. We developed the Passenger Exchange sub-components following a five step process depicted in Fig. 2: 1) In a SysML environment, we produced a component design that realizes the Passenger Exchange function. System requirements are traced and refined to define atomic components that correspond to software components and that are either vital or non-vital. 2) We mapped every atomic component to a HEPTAGON node realizing its functional behaviour. 3) Depending on the SIL of the component, verification activities have been conducted, but these are outside the scope of this communication. 4) We built a small signaling application composing multiple components into a realistic full-system scenario. These components include the PE itself, train/station interfaces, and a simulation of other system functions (such as train driving and passenger behavior). In HEP-TAGON, the application is an assembly of nodes. At this stage, a first executable code is produced to simulate the application behaviour, however no insurance is given on spatial isolation. 5) In LOPHT, the atomic components are allocated to three partitions, which are "P0: vital", "P1: non-vital" and "P2: environment". Meanwhile the execution durations are given. Five windows are created. The scheduling result, presented in the Fig. 3, is consistent with the block diagram presented in Fig.

IV. CONCLUSION

We presented the work conducted in the FSF project to handle mixed criticality. We used a synchronous design framework to implement a simplified signaling application and to deploy it on a partitioned OS.

We are continuously working towards a better integration of the tools composing the framework.

In the passenger exchange use case, mixed criticality resides at the application level, or even at function level, rather than the system level. On the other hand, the approach proposed in IMA and ARINC meets the needs of a system integrator. The main constraint highlighted by this case study is that there may be, even within a single system function, many communications between its vital and non-vital subcomponents. When generalized to the whole set of system functions, this pattern induces a large number of communications between the vital and non-vital parts. Furthermore, if we want to preserve the synchronous semantics (e.g. no additional delay) the number of windows may explode. The overall cost of communications and context-switch become prohibitive for systems global performance. Executing mixed-critical signaling applications on the same platform remains a challenging problem considering the state of the art in real-time operating systems.

Finally, the vital/non-vital dichotomy traditionally used in signaling application proved to be insufficient with respect to the operational availability of the system. It would be more appropriate to consider at least three levels, safetycritical, mission-critical, and non-critical, and to exploit this information in the partitioning and scheduling. ACKNOWLEDGMENT This research work has been carried out under the leadership of the Technological Research Institute SystemX, with partial support from the French Program "Investissements d'Avenir". The research leading to these results also received funding from the ARTEMIS Joint Undertaking project EMC2 (grant agreement 621429) and from the French Ministry of Industry.

Figure 2 .

 2 Figure 2. The global flow of the use case.

Figure 3 .

 3 Figure 3. The partitional scheduling result of LOPHT.

  1. Using LOPHT, AR-INC 653 dependent code is generated and linked to the component code generated by HEPTAGON. The resulting application is executed on POK OS [15].

				MTF = 40
	P2 / Dur8	P0 / Dur7	P1 / Dur4	P0 / Dur4	P2 / Dur18
	-Train and platform	-Proc. inputs		-Non-vital door	-Dep authorization	-Display
	-Simulation	-Doors aligned	command		-Proc. ouputs	-......
	-......	& enabled		-......		-......
		-......
	Doors state				Dep auth
	Train kinematic state ......	Enabled doors .....	Non-vital cmd ......	Vital doors cmd ......