Sahar Ghannay

Christophe Servan

Sophie Rosset

Neural Networks approaches focused on French Spoken Language Understanding: application to the MEDIA Evaluation Task

In this paper, we present a study on a French Spoken Language Understanding (SLU) task: the MEDIA task. Many works and studies have been proposed for many tasks, but most of them are focused on English language and tasks. The exploration of a richer language like French within the framework of a SLU task implies to recent approaches to handle this difficulty. Since the MEDIA task seems to be one of the most difficult, according to several previous studies, we propose to explore Neural Networks approaches focusing of three aspects: firstly, the Neural Network inputs and more specifically the word embeddings; secondly, we compared French version of BERT against the best setup through different ways; Finally, the comparison against State-of-the-Art approaches. Results show that the word embeddings trained on a small corpus need to be updated during SLU model training. Furthermore, the French BERT fine-tuned approaches outperform the classical Neural Network Architectures and achieves state of the art results. However, the contextual embeddings extracted from one of the French BERT approaches achieve comparable results in comparison to word embedding, when integrated into the proposed neural architecture.

Introduction

Spoken language understanding (SLU) module is a key component for a spoken language dialogue system. It consists on semantically analyse user queries and identifies text spans that mention semantic concepts. SLU task can fall into three sub-tasks: domain classification, intent classification, and slotfilling (Tur and Mori, 2011). The latter is the task that interests us in this study.

Over the past five years, the studies developed for SLU task are based on neural network architectures [START_REF] Yao | Spoken language understanding using long short-term memory neural networks[END_REF][START_REF] Mesnil | Using recurrent neural networks for slot filling in spoken language understanding[END_REF][START_REF] Guo | Joint semantic utterance classification and slot filling with recursive neural networks[END_REF][START_REF] Zhang | A joint model of intent determination and slot filling for spoken language understanding[END_REF][START_REF] Dinarelli | Label-dependency coding in Simple Recurrent Networks for Spoken Language Understanding[END_REF][START_REF] Simonnet | ASR error management for improving spoken language understanding[END_REF][START_REF] Korpusik | A comparison of deep learning methods for language understanding[END_REF][START_REF] Ghannay | What is best for spoken language understanding: small but task-dependant embeddings or huge but out-of-domain embeddings?[END_REF]. Recent approaches take benefit from contextual or language model embeddings such as BERT [START_REF] Devlin | BERT: Pre-training of deep bidirectional transformers for language understanding[END_REF]. [START_REF] Korpusik | A comparison of deep learning methods for language understanding[END_REF] investigated the transfer ability of a pre-trained BERT representation for English SLU tasks. But, as far as we know, there are no such studies on a French SLU task.

Following [START_REF] Ghannay | What is best for spoken language understanding: small but task-dependant embeddings or huge but out-of-domain embeddings?[END_REF]'s study, many avenues can be explored. In their study, the word embeddings have been frozen during training (are not updated), since [START_REF] Lebret | Is deep learning really necessary for word embeddings?[END_REF] show that finetuned word embeddings show very similar performance and provide comparable results. However, the evaluation of whether updating the embeddings during SLU model training improves or not the results, for SLU task, is less studied. In addition, their SLU model is fed only with word embeddings, and they did not use any additional features, thus there are some rows for improvements. Finally, [START_REF] Béchet | Benchmarking benchmarks: introducing new automatic indicators for benchmarking spoken language understanding corpora[END_REF] benchmarked several SLU tasks and proposed a difficulty hierarchy in which the MEDIA evaluation [START_REF] Bonneau-Maynard | Results of the French Evalda-Media evaluation campaign for literal understanding[END_REF] seems to be the most difficult SLU task.

Contributions: This study focuses on a French SLU task: the MEDIA evaluation, in which we firstly propose the evaluation of whether updating the word embeddings during training can improve the results, according to several scenarios. Secondly, we propose to use a BiLSTM-CNN architecture [START_REF] Ma | End-to-end sequence labeling via bi-directional lstm-cnns-crf[END_REF] that integrates character embeddings as additional features, using a convolution layer. Finally, we propose to evaluate the performance of BERT approaches against the BiLSTM-CNN architecture and State-of-the-Art on the MEDIA task [START_REF] Simonnet | Deep learning applied to spoken langage understanding[END_REF] through different ways: i) We propose to fine-tune BERT on SLU task using two french models: CamemBERT [START_REF] Martin | Camembert: a tasty french language model[END_REF] and FlauBERT [START_REF] Le | Flaubert: Unsupervised language model pre-training for french[END_REF]. ii) based on the results of i) we propose to integrate the extracted BERT contextual embeddings to the BiLSTM-CNN architecture and compare it to word embeddings.

SLU Model descriptions

This section describe the SLU models used in this study. The first two models are based on BiLSTM and its update: the BiLSTM-CNN. The NeuroNLP2 implementation1 was used for both BiLSTM implementations. The third model is based on the BERT models.

BiLSTM (Bidirectional long short-term memory) architecture has been proven to be relevant to model output dependencies on SLU tasks [START_REF] Yao | Spoken language understanding using long short-term memory neural networks[END_REF][START_REF] Mesnil | Using recurrent neural networks for slot filling in spoken language understanding[END_REF].

To further improve the performance of our SLU model, we propose to use a BiLSTM-CNN (convolutional neural network) architecture [START_REF] Ma | End-to-end sequence labeling via bi-directional lstm-cnns-crf[END_REF] that integrates character embeddings using a convolution layer, in addition to the word embeddings.

Finally, we propose to fine-tune BERT [START_REF] Devlin | BERT: Pre-training of deep bidirectional transformers for language understanding[END_REF] on SLU task using two french models: CamemBERT [START_REF] Martin | Camembert: a tasty french language model[END_REF] and FlauBERT [START_REF] Le | Flaubert: Unsupervised language model pre-training for french[END_REF]. The CamemBERT model is trained on the French part of the OSCAR corpus [START_REF] Javier | Asynchronous pipeline for processing huge corpora on medium to low resource infrastructures[END_REF] composed of 138GB of raw text, and FlauBERT [START_REF] Le | Flaubert: Unsupervised language model pre-training for french[END_REF] on 71GB of heterogeneous French corpora.

Experiments

In this section, we present the experiments we performed using our approaches and their setup2 . For both BiLSTM and BiLSTM-CNN, we made some hyper-parameters tuning by varying the number of layers l ∈ {1, 2, 3}, the size of the BiLSTM hidden layers n ∈ {128, 256, 512} and the batch size b ∈ {16, 32, 64}. For BiLSTM-CNN, in addition to the other parameters, the window size is set to 3 and the number of filters (dimension of character embeddings) is set to s ∈ {30, 50, 100}.

Data

Experiments are conducted on the French MEDIA3 corpus, composed of 1258 transcribed dialogues, which is about hotel reservation and information [START_REF] Bonneau-Maynard | Results of the French Evalda-Media evaluation campaign for literal understanding[END_REF]. The corpus was manually annotated, following a BIO model, with semantic concepts characterized by a label and its value. The corpus is split into three parts: a training corpus composed of 13k sentences, a development corpus composed of 1.3k sentences, and a test corpus composed of 3.5k sentences.

Word embeddings training

One of the aim of our experiments is to see whether the update of the word embeddings during training of the SLU model (update) improves or not the results by mainly varying the data used to train the word embeddings and the hyper-parameters of the SLU model.

Following [START_REF] Ghannay | What is best for spoken language understanding: small but task-dependant embeddings or huge but out-of-domain embeddings?[END_REF]'s results, we propose to use CBOW word embeddings approach from word2vec [START_REF] Mikolov | Efficient estimation of word representations in vector space[END_REF], which is trained using the default parameters using three different corpora setup. The first one is a small and task-dependent corpus: training set of MEDIA corpus is used, by keeping all the words due to the small data size. A huge and out-of-domain corpus was used as second setup: the French Wikipedia dump (WIKI), which is composed of 573 million words using a vocabulary size of 923k words. Finally, both corpora (noted WIKI+MEDIA).

The common parameters used to train our word embeddings are: window size=5, negative sampling=5, dimension=300. They have been selected based on previous studies [START_REF] Pennington | Glove: Global vectors for word representation[END_REF][START_REF] Bojanowski | Enriching word vectors with subword information[END_REF]. Note that the out of vocabulary (OOV) words are represented by null vectors.

Results

Embeddings update

Those experiments aim to observe the impact of the update (noted update) of CBOW word embeddings or their freeze (noted freeze) while training of SLU module. We proposed different training setups for the word embeddings (MEDIA, WIKI and WIKI+MEDIA), presented in section 3.2. Also, the BiLSTM number of layers is set from 1 to 3.

Results summarized in Table 1 show that when the word embeddings are trained on MEDIA data, the update of the word embeddings is helpful and improves the results in terms of F1 score, whatever the size of the architecture. However, when the embeddings are trained on WIKI or WIKI+MEDIA data the update of the embeddings while training is not helpful and degrades the results. Thus, the best results are obtained using the BiLSTM architecture composed of 3 hidden layers, using one of the CBOW embeddings trained on WIKI or WIKI+MEDIA corpora, that obtain comparable results in terms of F1 score (86.40 vs. 86.69).

Character embeddings evaluation

In this section, we propose to use a BiLSTM-CNN architecture [START_REF] Ma | End-to-end sequence labeling via bi-directional lstm-cnns-crf[END_REF]) that integrates character embeddings as additional features, using a convolution layer. We experiment the use of different character embeddings dimensions, and different numbers of BiLSTM layers. Based on the results in section 3.3.1, for those experiments, we used the embeddings trained on both WIKI and WIKI+MEDIA corpora, which are frozen during the BiLSTM-CNN training.

Results summarized in table 2, show that the use of character embeddings as additional features was helpful and improves the performance in comparison to the results in table 1. We observe that, both embeddings trained on WIKI and WIKI+MEDIA achieve comparable results. This shows that, we don't need to use both a task-dependent corpus and another out-of-domain corpus to train the word embeddings. Note that, we observed the same thing, when the embeddings trained on WIKI data are fine-Tuned on MEDIA data. The best results (F1=87.40) achieved using the embeddings trained on WIKI data, using the appropriate parameters: 3 BiLSTM layers and character embeddings dimension of 100. Note that, beyond these values the performance of the system drops slightly.

Comparison to French BERT

In this section, we propose to evaluate the performance of BERT approaches on the MEDIA task through two different ways. The experimental results are summarized in table 3 using F1 score and the Concept Error Rate (CER), which is estimated like the Word Error Rate (WER). The CER is used to compare our approach with the State-of-the-Art proposed by [START_REF] Simonnet | Deep learning applied to spoken langage understanding[END_REF] and noted biRNN-EDA. We also reported the results of the best system presented in table 2.

i) We propose to fine-tune BERT on SLU task using two French models: CamemBERT [START_REF] Martin | Camembert: a tasty french language model[END_REF] and FlauBERT [START_REF] Le | Flaubert: Unsupervised language model pre-training for french[END_REF] base models. Results in table 3 show the performance of BERT's models on SLU task. The best results achieved using CamemBERT base model trained on ccnet data. It yields 29.35% of relative improvement in terms of CER reduction in comparison to the baseline (7.56 vs 10.7). In addition, it outperforms the proposed BiLSTM-CNN system and improves the prediction of some tags: "nom, chambre-fumeur, objet, ...". We observe that the models CamemBERT base (trained on OSCAR data) and FlauBERT obtain competitive results in terms of F1 and CER scores. Note that CamemBERT and FlauBERT base models achieve better results than the large models.

ii) Last, we propose to integrate the extracted BERT's contextual embeddings to the BiLSTM and BiLSTM-CNN architectures, instead of CBOW word embeddings. Based on the results of i) we used the embeddings extracted from CamemBERT base model trained on ccnet data. After tokenizing the ME-DIA corpus, the CamemBERT model was applied on the resulting data to extract the embeddings of 768 dimensions, for each sub-word from the last transformer layer. The token embeddings corresponds to the sum of its sub-word embeddings. A new CBOW embeddings is trained on WIKI data with dimension 768 to have comparable results. Results (last 2 lines) show that the use of CamemBERT contextual embeddings achieves competitive results in comparison to CBOW embeddings whatever the architecture used (BiLSTM or BiLSTM-CNN). Those results corroborate the results reported by Ghannay et al. (2020), in which, CBOW andELMo (Peters et al., 2018) embeddings obtained comparable results in terms of F1 score (86.06 vs. 86.42). Last, the results with BiLSTM and BiLSTM-CNN architectures reveals the importance of character embeddings, even when they are combined with contextual embeddings.

Conclusions and future work

The paper presented a study focuses on French Spoken Language Understanding (SLU) task using the MEDIA corpus. First we proposed the evaluation of whether updating the word embeddings during training improves or not the results, according to several scenarios.Second, we proposed to use a BiLSTM-CNN architecture that integrates character embeddings as additional features. Last, we proposed to evaluate the performance of BERT approaches on the MEDIA task through different ways.

Experimental results show, that the word embeddings needed to be updated during SLU model training are the ones trained on small corpus like MEDIA. However, It is better for word embeddings trained on huge and out-of-domain to be frozen, since those word embeddings have captured enough general semantic and syntactic characteristics relevant to SLU task. More, The word embeddings trained on WIKI and WIKI+MEDIA achieve comparable results. This shows that, we don't need to use both a task-dependent corpus and another out-of-domain corpus to train the word embeddings. In addition, we observed the usefulness of character embeddings when added as additional features. Regarding the evaluation of the performance of BERT approaches, the fune-tuning of CamemBERT and Flaubert base models show that the best results are achieved using CamemBERT base model trained on ccnet data. It yields to 29.35% of relative improvement in terms of CER reduction in comparison to the baseline (7.56 vs 10.7). Finally, the integration of the extracted CamemBERT's contextual embeddings to the BiLSTM and BiLSTM-CNN architectures reveal that contextual embeddings achieves competitive results in comparison to CBOW word embeddings whatever the architecture, and confirm the importance of character embeddings.

For future work, we propose to evaluate the performance of Bert's contextual embeddings extracted from different encoder's layers, and to make in-depth error analysis for the different systems.

Table 1 :

 1 Performance on Test MEDIA in terms of F1 score of CBOW word embeddings approach trained on three corpora (MEDIA, WIKI and WIKI+MEDIA), using the BiLSTM architecture.

	Config.		Update			Freeze
	Train	#nb. BiLSTM layers	#nb. BiLSTM layers			WIKI		WIKI+MEDIA
	Emb.	1	2	3	1	2	3	#Layer		Character embeddings dimensions
	MEDIA	84.18	84.18	85.35	72.36 79.57 80.69		30	50	100	30	50	100
	WIKI	84.73	85.82	86.47	84.11 86.06 86.40	1	84.38 84.59 84.85	84.13 84.47 84.73
	WIKI +MEDIA	84.84	85.35	86.00	84.08 85.74 86.69	2 3	85.88 86.43 86.18 87.02 87.05 87.40	86.20 86.75 86.34 87.29 87.01 87.30
								Table 2: Results on Test MEDIA in terms of F1
								score using embeddings trained on both wiki and
								wiki+MEDIA corpora, using the BiLSTM-CNN
								architecture. (The word embeddings are frozen)

Table 3 :

 3 Performance on Test MEDIA in terms of F1 and CER scores of the proposed systems ( † is the best system presented in table 2).

	Architecture	Embed. Training data	Embed.'s approach	F1	CER
	biRNN-EDA	-	-	-	10.7
	BiLSTM-CNN	WIKI	CBOW (dim=300) † CBOW (dim=768)	87.40 9.88 86.80 10.11
		oscar 138 GB	CamemBERT-base	89.18 7.93
	FineTune BERT (i)	ccnet 135 GB	CamemBERT-base	89.37 7.56
		heterogeneous corpus 71 GB FlauBERT-base	89.04 8.13
	BiLSTM BiLSTM-CNN	ccnet 135GB (ii)	CamemBERT-base (dim=768) 86.59 10.45 CamemBERT-base (dim=768) 87.15 10.11

This work is licensed under a Creative Commons Attribution 4.0 International Licence.Licence details: http://creativecommons.org/licenses/by/4.0/

https://github.com/XuezheMax/NeuroNLP2

the code an data needed to run the experiments are available here: https://github.com/saharghannay/MEDIA Eval

MEDIA is publicly available for academic use: https://catalogue.elra.info/en-us/repository/browse/ELRA-S0272/

Acknowledgements

This work has been partially funded by the LIHLITH project (ANR-17-CHR2-0001-03), and supported by ERA-Net CHIST-ERA, and the "Agence Nationale pour la Recherche" (ANR, France).


Hassan Sabbah

Mario Commodo

Francesca Picca

Gianluigi De Falco

Andrea D'anna
email: anddanna@unina.it

Patrizia Minutolo

Christine Joblin
email: christine.joblin@irap.omp.eu

Molecular content of nascent soot: Family characterization using two-step laser desorption laser ionization mass spectrometry

Keywords: SOOT, NANOPARTICLES, PAH Soot, early growth, carbonization, molecular composition, polycyclic aromatic hydrocarbons, fullerenes, laser mass spectrometry

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

INTRODUCTION

Soot nucleation and early growth in flames has been subject of intense discussion for a long time.

The elusive nature of the soot formation mechanism is due to the complexity of the involved chemical and physical processes; these include high-temperature pyrolysis and gas-phase oxidation chemistry, polycyclic aromatic hydrocarbon (PAH) formation, particle nucleation followed by particle growth through coagulation/coalescence and heterogeneous surface reactions. Particle agglomeration, in addition to carbonization/dehydrogenation and oxidation reactions, further contributes to the final shape and structure of the generated particles. As a result, soot particles evolve in flames by changing size, chemical composition and structural order.

The term nascent soot refers to the soot particles during the early stages of the formation process [1], which includes just-nucleated (incipient) to just-grown soot particles. In a laminar premixed flame of an aliphatic hydrocarbon, soot nucleates right after the flame front [2], resulting in the formation of a unimodal particle size distribution (PSD) with a maximum number density for particles of 2-3 nm [3][4][5][6]. Once formed, incipient soot undergoes size growth via coagulation/coalescence processes and surface chemical reactions with gas-phase molecules. This next step results in the formation of a second, and larger in size, particle mode whose mean diameter increases as a function of residence time [3][4][5][6]. During the growing/aging process in flame, soot is known to carbonize, thus resulting in a lowering of H/C ratio down to the very low value of 0.1 typically associated to mature soot [7,8].

Mass spectrometry techniques (in situ and ex situ) have contributed significantly to our understanding of the chemistry involved in soot formation and growth [9,10]. Laser desorption/ionization (LDI) techniques [11,12], particularly sensitive to PAHs [13], succeeded to give a comprehensive view of the soot molecular composition during the transition from gaseous phase to solid particles. In order to follow the evolution of the molecular constituents of the particles during the early stages of particle transformation, we have performed two-step laser desorption laser ionization mass spectrometry (L2MS) of the nascent soot particles collected from a slightly sooting ethylene/air laminar premixed flame. The study is aimed at shedding light on the molecular content and its variation with evolving chemical and physical conditions.

EXPERIMENTAL

Flame and soot sampling

Soot particles were sampled from an ethylene/air laminar premixed flame stabilized on a McKenna burner. The cold gas velocity was set to 9.8 cm/s (STP) and the carbon to oxygen (C/O) ratio was 0.67. The particle sampling system for on-line and off-line soot analysis has been described in earlier works [3,14,15]. Briefly, soot was sampled from the flame through an orifice (diameter=0.2 mm, thickness = 0.5 mm) in a tubular dilution probe (outer diameter=1 cm), positioned horizontally in the flame. The sampled mixture was immediately diluted with N2 to quench chemical reactions and minimize particle aggregation [5]. For the off-line analysis, a stainless-steel aerosol filter holder containing a 25 mm pure silver membrane filter (Millipore-AG4502550) was positioned on-line downstream of the dilution tubular probe for soot nanoparticles collection.

Mass Spectrometry Analysis

AROMA (Aromatic Research of Organics with Molecular Analyzer) is an experimental setup that combines laser desorption ionization techniques (LDI) to a segmented linear quadrupole ion trap connected to an orthogonal time of flight mass spectrometer (LQIT-oTOF). [16]. A sketch of the AROMA system (Fig. S1) as well as detailed experimental conditions and performances are reported in the supplementary materials. Mass spectrometry data and chemical analysis tools for all the studied samples are made publicly available in the AROMA database: http://aroma.irap.omp. AROMA was successfully used to characterize, with high sensitivity (down to attomole), PAHs molecular distribution in Murchison meteorite [16]. Recently [17,18], we have shown the ability of AROMA to track the chemical evolution of carbonaceous molecules involved in the formation of cosmic dust analogues produced from a carbon vapor (C, C2) and in the presence of H2 or C2H2.

For this work, particles collected on the filter have been analyzed using the well-established and optimized two-step laser mass spectrometry (L2MS) scheme. In this scheme, desorption and ionization are clearly separated and optimized in time and space and performed with two different pulsed (5 ns of pulse duration) lasers. During the desorption step, an infrared laser (Nd:YAG at 1064 nm) is focused on the sample with a spot size of 300 µm producing a fluence of desorption Ed = 150 mJ/cm 2 . As discussed in the supplementary materials, these conditions ensure thermal desorption avoiding ablation and chemistry in the plume. This implies that the detected molecules come from the surface of the particles with contribution from their volume if these particles consist of loosely bound components. Ionization is performed by intercepting perpendicularly the expanding plume of the desorbed molecules using an ultraviolet laser (fourth harmonic of an Nd:YAG at 266 nm). This scheme presents a high selectivity and sensitivity for species that can undergo (1+1) resonance-enhanced multiphoton ionization (REMPI) such as PAHs and fullerenes [19,20]. The used laser ionization fluence is Ei=16 mJ/cm 2 .

RESULTS AND DISCUSSION

The evolution of the particle size distributions in number concentrations for the flame herein investigated, measured along the flame at different burner-to-probe separation distances (Z), has been reported in Ref. 15 (Fig. 1). In the present work three different conditions, i.e., different Z, have been selected for soot sampling and characterization via L2MS-TOF, namely 8, 10 and 14 mm, whose corresponding size distributions in volume are reported in Fig. S2 in the supplementary materials.

The PSD in volume develops from a single mode with the most abundant particles having a size of 3.5 nm at Z = 8 mm, to a bimodal size distribution where in addition to such incipient particle mode a larger mode made of just-grown soot particles with mobility diameter in the range of 5-15 nm is present at Z = 10 mm, and finally to a condition in which most of the mass is in the second mode with a maximum corresponding to particles with mobility diameter of approximatively 20 nm at Z = 14 mm. It is worth noticing that for this last condition, the PSD is bimodal if plotted in number, with a first particle mode centered at approximatively 2.4 nm (roughly as the ones measured at 8 and 10 mm). However, this mode is not observable in Fig. S2 because of the very low mass of such particles [3].

The mass spectra of the three soot samples are reported in Fig. 1 for the 100-2000 m/z range. Three different inset zoom graphs are also sketched with different mass ranges. Molecular mass for the incipient soot particles (Z = 8 mm) spans over all the studied range, with the most intense peaks falling in the 200-700 m/z range with a mean weighted mass of m/z = 447. Several early studies have led to the observations that nascent soot particles are mainly composed by PAHs of moderate size (about the size of ovalene) [14,15,21], a result which is also consistent with other previous mass spectrometric investigations in similar flame conditions [13,22]. Although, the measurements herein presented are in good agreement with these previous observations, they indicate slightly larger value of the mean molecular mass distribution of the aromatic constituents (C36 on average); a result however in closer agreement with the recent LD-MS investigation of soot reported by Jacobson et al. [11]. The PAH distribution obtained in our study spans a large size range with detected species up to about 90 carbon atoms. In addition, peaks corresponding to PAHs having an odd number of carbon atoms from C9 to C91 are measured, some with a strong intensity (e.g., C19H11, C21H11, C23H11). The mass spectrum for soot collected at Z=14 mm exhibits significant differences. The PAH distribution is shifted to lower mass with a mean at m/z=300 compared to m/z=447 at Z=8 mm. In addition, a series of peaks attributed to pure carbon species (Cx) clearly appears. In the low mass range they are found for each carbon atom numbers, e.g., C9, C10, C11 up to C21. This is followed by a jump to C30 from which a series starts separated by 2C up to C160. The most intense peaks are found for C60 (m/z=720), C50, C52 and C70, which suggest that they correspond to fullerenes [23].

C clusters have been reported by Dobbins et al. [24] for high heights above the burner, using LDI in single step with a 266 nm-laser and an irradiance of 1-20 MW/cm 2 . Homann [25], has detected fullerenes in premixed low-pressure flames by on line analysis. The author reported that the formation of fullerenes relative to soot can be so low that these species can only be detected with the most sensitive analytical techniques. Our L2MS technique uses a REMPI scheme, which provides very high sensitivity and was also the one used in Homann's experiments [25]. Our detection is not surprising from this point of view. In addition, we report an evolution with increasing Z both in chemical complexity and in molecular families. The data at position Z = 10 mm show an intermediate case in which carbon clusters start to be representative in the mass spectrum. We note that Jacobson et al. [11] could not observe these species, possibly pointing to different sampled flame conditions.

It is worth to note, that the overall intensity of the mass spectra lowers as Z increases. This factor is respectively 1.8 and 3.5 for Z=10 and 14 mm compared to Z=8 mm. This likely reflects a change in the molecular components of the particles, which results in a lower production of molecules upon laser desorption as also noticed in our previous study [15]. In addition, a number of 684, 591 and 463 species have been identified for Z=8, 10 and 14 mm respectively, which shows that the molecular diversity is changing as well. We will discuss in the following that the probed molecules have been subject to processing which favors the most stable species such as fullerenes.

Some chemical species with one or two oxygen atoms have been observed for samples at Z = 8 and Z = 10 mm. In each sample about 20 peaks of molecules containing oxygen are identified with an average m/z precision <0.01 (see Table S4). The total ion signal from oxygenated compounds represents 1% from the total ion signal at Z=8 and 3% at Z=10 mm. This low level is consistent with LDI-MS measurements of soot extracted from a diffusion flame [11]. One has to be careful though not to translate this number into an abundance ratio due to the bias of our technique. We note though that evidences of few atomic oxygen percentages in nascent soot were observed by photoemission experiments [26].

In order to obtain a more in-depth evaluation of the aromaticity of the molecular constituents of the nascent soot particles we performed the double bond equivalent (DBE) analysis [16] of the species on the bases of the measured mass spectra. The DBE value is defined by DBE = C# -H#/2 + N#/2 + 1 with C#, H# and N#, the numbers of C, H and N atoms inside the molecules. It is representative of the unsaturation level of the molecules and thus corresponds to a direct measure of their aromaticity.

More details about DBE are provided in the supplementary materials.

Colored map plots presenting the calculated DBE/C# values as a function of C# are reported in Fig. 2 for the three samples. The color scale is the relative intensity (normalized to the highest peak in the spectrum) of each species in the mass spectrum. At Z=8 mm, the DBE/C# values are mainly distributed below the planar aromatic limit line (green line), based on the classification of petroleum components [START_REF] Marshall | Petroleomics: Chemistry of the underworld[END_REF][START_REF] Lobodin | Compositional space boundaries for organic compounds[END_REF]. For a given number of C atoms, a quite narrow distribution of H atoms is measured with a relevant fraction of aromatic molecules having a molecular structure with a number of H-atoms larger than that corresponding to the most peri-condensed structure (magenta line). Still all species stay close to this line, which shows that their structures are compact and do not contain much aliphatic bonds. This statement is strictly valid for PAHs containing 6-membered rings only. Indeed, the introduction of 5-membered rings increases the unsaturation. For instance, the formula C24H12 can correspond to the most peri-condensed structure coronene, but also to a less compact structure with 2 pentagonal rings as imaged by Commodo et al. [15].

Our results differ from those of earlier studies that concluded about the importance of aliphatic components in the PAH population [START_REF] Cain | Molecular characterization of organic content of soot along the centerline of a coflow diffusion flame[END_REF] but is consistent with the more recent study of Jacobson et al. [11].

The DBE/C# values, corresponding to the chemical composition of just-grown soot particles at Z = 14 mm, mainly stand above the planar aromatic limit showing an increase of the degree of unsaturation and even the formation of structures with very low hydrogen content. Another important change in the molecular composition between Z=14 and Z=8 mm concerns the highest mass range.

From C#=50 and above, 326, 185 and 59 species are detected at Z=8, 10 and 14 mm, respectively. These large species are exclusively fullerenes at Z=14 mm, but none of them are fullerenes at Z=8 mm.

The DBE method allows us to segregate the derived molecular formulas into families. We consider the value of DBE/C# = 0.9 as the limit of planar aromatics as defined in Ref. [START_REF] Lobodin | Compositional space boundaries for organic compounds[END_REF]. DBE/C# values below 0.9 correspond to aromatic species with less condensed structures, including potential crosslinked aromatics, and/or the presence of aliphatic CH bonds. DBE/C# values above 0.9 and below 1 correspond to less hydrogenated species that we call HC clusters. In addition, we consider a family of C clusters for C#<30 and fullerenes above [23]. Fig. 3. Evolution of the molecular families derived from the mass spectra after DBE analysis.

Our results show that molecular constituents associated with soot particles change in the passage from the first particle mode at 3.5 nm to the second mode at 9 nm (see Fig. S2). The analysis in molecular families suggests a transition in the population from PAHs to HC clusters and even to fullerenes along the flame (Fig. 3). Indeed, when just-grown soot particles are formed, i.e., Z=14 mm, the few large molecules (C#≥50) detached from the particles are found in fullerenes indicating that soot transformation is accompanied by a strong dehydrogenation process of large carbonaceous molecules.

To further explore the molecular family change across the particle growing process we have analyzed in more details the DBE/C# vs C# at Z=8 mm and 14 mm as reported in Fig. S3. At Z=8 mm, the dominant PAH species contain C# = 20-24 (see Fig. 2) and a typical number of hydrogens of 10 or 12, which points to a dominant population of compact structures and structures with a few pentagonal rings as discussed above for C24H12. As C# increases in the PAH species, the number of hydrogens only slightly increases reaching a maximum of 20 for species larger than 40 carbons. This leads to a growth scheme by a global C2/C2H addition, which can be obtained by C2H2/C2H addition and hydrogen removal as postulated in the HACA mechanism [START_REF] Frenklach | Detailed modeling of soot particle nucleation and growth[END_REF].

The formation of species with an odd number of C atoms is expected to arise from reactivity with oxygen [25] and also addition of C/CH as suggested in [START_REF] Joblin | Simulation of Interstellar Aromatic Hydrocarbons Using Ion Cyclotron Resonance. Preliminary Results[END_REF][START_REF] Wornat | Cyclopenta-fused polycyclic aromatic hydrocarbons from brown coal pyrolysis[END_REF]. These processes can form pentagonal cycles at the periphery of PAHs. An analysis of the odd-numbered species was performed amongst the population of planar aromatics (DBE/C#≤0.9). At Z=8 mm, the odd C number species represent 49% of the peak numbers of which 67% are odd H containing species. The latter number is significantly larger than the total of 48% for these species in the sample. This is consistent with odd C containing PAH species with odd H number corresponding to π radicals. The delocalization of the charge in these ions further contributes to their stability. These odd-numbered structures can include both species with pentagonal ring(s) and some made solely of six-membered rings [25]. At Z = 14 mm, the odd hydrogen-containing species sum up to 48% of all the intensity but up to 70% when only odd C containing species (44% of the population) are considered. These numbers appear to be consistent with the value at Z=8 mm suggesting that π radicals constitute a significant fraction of the molecular population.

Concerning the even C number species, mildly dehydrogenated species are observed at Z=8 mm.

For instance, the intensity of C24H10 is significant (0.45 that of C24H12) The presence of less hydrogenated species is confirmed also for large PAHs (see Fig. S3). For instance, for C#=42, the most compact peri-condensed structure would correspond to circumpyrene (C42H16). Still species corresponding to a lower number of H, in particular C42H14 and C42H12 are observed. Similarly, circumcoronene (C54H18) is detected together with C54H16 and C54H14. At Z = 14 mm, the intensity of C24H10 is 1.5 times higher compared to coronene and we observe much strongly dehydrogenated species (e.g. C24H4, C24H6).

Pure PAHs are expected to exhibit only minor fragmentation during the analysis with AROMA [16]. We therefore consider that these species which contain less hydrogens are intrinsic to the sample and not formed in our analysis. The addition of C2 can form pentagonal cycles mainly leading to acenaphthylene-type compounds, which can also be found in dehydrogenated form (1,2-dehydroacenaphthylene; C12H6). In the Z=8 mm sample the ratio C12H6/C12H8 is equal to 2.3. This might be an explanation for the large intensity of species with mild dehydrogenation (typically 2H below the H number of the most compact peri-condensed structures). The presence of pentagonal rings inside the carbon structure is also expected. C20H10, which would correspond to the bowl-shaped corannulene molecule, has a similar peak intensity as C20H12, which would correspond to the full sixmembered rings. Therefore, the observed population with low hydrogen content likely reveals the formation of species containing an increasing number of pentagonal cycles. Structures containing several pentagonal cycles are predicted to be the most abundant structures at high temperatures in thermodynamic equilibrium (e.g. C30H10 with 6 pentagonal rings and 5 hexagonal rings as predicted by [START_REF] Pope | Thermodynamic limitations for fullerene formation in flames[END_REF]). These pentagonal structures induce some strain that can be release by closing the structure towards fullerenes [START_REF] Galué | Decoding the infrared signatures of pyramidal carbons in graphenic molecular nanostructures of interstellar origin[END_REF].

The formation of fullerenes in flames was earlier modeled with a gas-phase chemical network taking into account competition between growth and destruction reactions [START_REF] Pope | Thermodynamic limitations for fullerene formation in flames[END_REF][START_REF] Howard | Fullerenes synthesis in combustion[END_REF]. These involved the formation of pentagonal cycles by chemical reactivity as well as by thermal isomerization at the flame temperatures. Homann [25] suggested that the chemistry can proceed via the formation of aromers. Interestingly, our molecular analysis from just nucleated to the just-grown soot, allows us to isolate two regimes. One in which there is a rich chemistry of PAHs leading to the formation of large PAHs containing pentagonal cycles. Another one in which "carbonization" with a significant hydrogen loss seems to govern the chemical evolution of the large carbonaceous molecules. It is interesting to note that for C#≥50, fullerenes are observed at Z=14 mm but neither PAHs nor HC clusters. For C#<50, a much larger diversity of species are present with HC clusters spanning all possible H numbers.

The transition from PAHs to fullerenes is an interesting topic in astrochemistry that leads to experimental and modeling work [START_REF] Zhen | Laboratory Formation of Fullerenes from PAHs: Top-Down Interstellar Chemistry[END_REF][START_REF] Berné | Top-down formation of fullerenes in the interstellar medium[END_REF]. Berné et al. [START_REF] Berné | Top-down formation of fullerenes in the interstellar medium[END_REF] have evaluated in their photochemical model, the possibility to convert C66H20 (i.e. circumovalene) into C60 fullerene upon irradiation by ultraviolet photons. In this scenario, the formation of pentagonal cycles is expected after that PAH has lost all its hydrogen atoms and the carbon cluster rearranges to fold into a fullerene structure, while loosing C2 until it reaches the most stable fullerene structure of C60. Although the authors concluded about the viability of such a scenario in astrophysical environments, it relies on reaction rates which are poorly constrained especially the ones concerning the folding process for which there is no experimental data. From this study we can however keep the idea of a precursor "PAH-like" population evolving towards fullerenes by energetic processing. In the oxidative environment of flames, the formation of pentagonal cycles during the chemistry of formation of PAHs can favor the formation of fullerene precursors. Further dehydrogenation and isomerization processes associated to carbonization would then be the key step controlling the transition towards fullerenes. It is striking that a simple calculation using Fig. 3 suggests that this process is very efficient. From Z=8 mm to Z=10 mm, 1.2 10 5 (arbitrary units) large PAHs have been converted into 7 10 3 HC clusters and 1.6 10 4 fullerenes. An additional stock of 8.3 10 4 is available from Z=10 mm to Z=14 mm which would lead proportionally to 5 10 3 HC clusters and 1.1 10 4 fullerenes. Assuming a similar detection efficiency for both large HC clusters and fullerenes, we conclude that all these produced HC clusters have been converted into fullerenes. The exact fraction of large PAHs that were converted into fullerenes is difficult to assign because of the unknown relative detection efficiency between both populations. Even without considering the detailed numbers, our work suggests that large PAHs are converted into large HC clusters which efficiently produce fullerenes.

CONCLUSION

The molecular constituents of soot have been analyzed using two-steps laser desorption laser ionization mass spectrometry in the transition zone from incipient to just-grown soot particles.

Fullerenes only appear in the last stage, which implies that they are not involved in soot nucleation.

From the analysis of the obtained mass spectra, we came to the following conclusions:

• Molecular constituents of incipient/just-nucleated soot (particles at Z=8 mm) are mostly planar aromatics, not only peri-condensed but also in the form of less compact structures (more H atoms with respect to the most peri-condensed PAHs) and of structures containing pentagonal cycles (same number of H atoms or less with respect to the most peri-condensed PAHs). A large number of radicals are also detected among these aromatic molecules mainly in the form of odd C# with odd H# corresponding to π radicals.;

• Just-grown soot particles (Z = 14 mm) contain a population of H-poorer molecules (less than 49 C#), with a similar fraction of the population in radicals than for incipient soot. From sizes 50 C# and above, only fullerenes are observed;

• The evolution of the molecular families within the nascent soot particle zone suggests an efficient conversion of the large PAH population into fullerenes involving intermediate large HC clusters with very fast evolution. This is consistent with a carbonization scheme in which thermal processing induces a series of dehydrogenation and isomerization processes to form the fullerenes.

AROMA capabilities to probe PAHs, carbon clusters and fullerenes from soot particles:

Using the AROMA setup with a two-step laser mass spectrometry (L2MS) scheme (see Figure S1), we showed the capability of the instrument to detect PAHs with high sensitivity (down to attomole)

and almost no fragmentation from pure PAHs and fullerenes C60 samples 1 . We reported experiments in which the laser desorption fluence was varied by a factor of 20 and no aggregation nor fragmentation was observed 1 . We illustrated also our ability of detecting the PAH distribution in Murchison meteorites and found a distribution similar to the one earlier published. In two recent laboratory studies 2,3 of the carbon chemistry in the dust formation zone of evolved stars, we have shown that in the presence of C/C2 and H2, the formed dust samples contain C and HC clusters with no fullerenes and only traces of aromatics, whereas with C2H2 added instead of H2, PAHs are favored but still with no fullerenes.

We applied the L2MS scheme to analyze the molecular constituents of the collected soot particles. In the first step, a pulsed (5 ns) infrared laser (Nd:YAG at 1064 nm) is focused on the sample with a spot size of 300 µm. This causes a high heating rate of 10 11 -10 12 K/s, which favors desorption over decomposition 4,5 . The desorption laser fluence (Ed) and irradiance (Id) used for this work are respectively 150 mJ/cm 2 and 30 MW/cm 2 . This fluence is one to two order of magnitudes lower than the explosive vaporization threshold that results in plasma formation during ablation processes 6 . It is also lower than the sublimation threshold (300 mJ/cm 2 for a 1064-nm laser) measured during laserinduced incandescence (LII) experiments on soot particles 7,8 . In these conditions, we do not observe any signal from a highly-ordered pyrolitic graphite (HPOG) sample. We need to double the fluence (Ed = 300 mJ/cm 2 ) to start observing carbon clusters, with a distribution from C10 to C25. In our conditions, no fullerenes are generated even for Ed as high as 1 J/cm 2 . In the second step, a pulsed (5 ns) ultraviolet laser (fourth harmonic of an Nd:YAG at 266 nm) intercepts perpendicularly the expanding plume of the desorbed molecules. This leads to selectively ionize fullerene and aromatic species that are present in the plume and can undergo (1+1) resonance-enhanced multiphoton ionization (REMPI). The ionization laser fluence (Ei) and irradiance (Ii) used for this work are respectively 16 mJ/cm 2 and 3 MW/cm 2 . These values fit in the range reported to correctly probe PAHs in soot collected particles 9 . The laser energy per pulse is optimized to have parent ions and not fragments dominating the mass spectra. Ions produced at low pressure (10 -6 mbar) are collimated by a set of DC high-voltage lenses and are thermalized in a radio-frequency (RF) octapole. Generated ions are then monitored with the orthogonal time of flight mass spectrometer (oTOF). For each m/z range scan, the amplitude and RF frequency applied on the electrodes of the linear quadrupole ion trap (LQIT) are optimized to maximize ion signal in this mass range. Each scan is the result of 50 laser shots. The interaction of the desorption laser with the sample is controlled with a mechanical shutter. The laser hits the sample once every 2 seconds. The sample is then moved so that the next laser shot hits a fresh spot.

Laser desorption mass spectrometry techniques are powerful tools and are widely used to analyze complex hydrocarbon mixtures with high sensitivity, selectivity and microscale spatial resolution 9- 12 . In addition of L2MS, single laser desorption/ionization (LDI) (with or without matrix) is often used. Laser desorption irradiance in L2MS is much lower than in LDI 13,14 . This gives L2MS higher sensitivity and reduce substantially fragmentation as well as eliminate aggregation in the expanding plume 15-17 . LDI and L2MS have been widely used to analyze molecular contents of soot samples 10,18 .

REMPI in the ultraviolet (UV) domain is the most used technique in the L2MS scheme to probe aromatics down to sub-femtomoles sensitivity levels 19 . It is also employed in flame studies to detect neutral large aromatics and fullerenes 20,21 .

Particle size distribution:

Particle size distribution (PSD) were measured in a previous study 22 . The data are reported as normalized volumetric particle distributions in Fig. S2 for the three sampling conditions investigated in the current study using the AROMA setup. For PSD measurements, a differential mobility analyzer (DMA) was used: the aerosol sample passed through an X-ray charger (TSI Model-3088) first, and was then selected in an electrostatic classifier (DMA Model-TapCon 3/150), and counted by a Faraday cup electrometer 22 . of each graph. Green and magenta curves show the aromatic limits as defined in Fig. 2 in the 604 manuscript.

Fig. 1 .

 1 Fig.1. Mass spectra at three burner-to-probe distances, i.e., Z = 8 mm, Z = 10 mm and Z = 14 mm, characteristic of the transition from incipient to just-grown soot particles. Fluences of Ed = 150 mJ/cm 2 and Ei = 16 mJ/cm 2 have been used for the desorption (1064 nm) and ionization (266 nm) lasers, respectively. Peak annotations are given for corresponding neutral species. Inset zoom graph at Z = 8 mm presents some of the species detected over the (200-400) m/z range. At Z =10 mm the inset zoom graph shows the co-existence of aromatic species with carbon clusters. At Z = 14 mm the inset zoom graph presents the detection of fullerenes over the (700-840) m/z range. 13 C isotopologs are clearly seen in this zoom.

Fig. 2 .

 2 Fig.2. Colored map plots of DBE/C# vs. carbon number (C#) constructed from the molecular formulas which have been derived from the mass spectra of soot sampled at Z = 8, 10 and 14 mm. The color scale is representative of the relative intensity (normalized to the highest peak in the spectrum) for each identified species. Black line refers to carbon clusters (DBE = n(C) + 1); green line refers to the planar aromatic limit (DBE = 0.9*C#) [28], and magenta line refers to the purely peri-condensed PAHs (most compact structures made of 6-member rings) with DBE = -3.24 + 0.92*C#.

Fig. 1 .

 1 Fig.1. Mass spectra at three burner-to-probe distances, i.e., Z = 8 mm, Z = 10 mm and Z = 14 mm, characteristic of the transition from incipient to just-grown soot particles. Fluences of Ed = 150 mJ/cm 2 and Ei = 16 mJ/cm 2 have been used for the desorption (1064 nm) and ionization (266 nm) lasers, respectively. Peak annotations are given for corresponding neutral species. Inset zoom graph at Z = 8 mm presents some of the species detected over the (200-400) m/z range. At Z =10 mm the inset zoom graph shows the co-existence of aromatic species with carbon clusters. At Z = 14 mm the inset zoom graph presents the detection of fullerenes over the (700-840) m/z range.13 C isotopologs are clearly seen in this zoom.

Fig. 2 .Fig. 3 .

 23 Fig.2. Colored map plots of DBE/C# vs. carbon number (C#) constructed from the molecular formulas which have been derived from the mass spectra of soot sampled at Z = 8, 10 and 14 mm.The color scale is representative of the relative intensity (normalized to the highest peak in the spectrum) for each identified species. Black line refers to carbon clusters (DBE = n(C) + 1); green line refers to the planar aromatic limit (DBE = 0.9*C#)[START_REF] Lobodin | Compositional space boundaries for organic compounds[END_REF], and magenta line refers to the purely peri-condensed PAHs (most compact structures made of 6-member rings) with DBE = -3.24 + 0.92*C#.

Fig. S1 .

 S1 Fig. S1. Schematic diagram of the AROMA setup highlighting the L2MS principle and the principal components of the instrument.

Fig. S2 .

 S2 Fig. S2. PSDs at the three selected probe-to-burner distances, i.e., Z = 8 mm, Z = 10 mm, and Z = 14 mm, characteristic of the transition from incipient to primary soot particles. Black dots are experimental data by DMA measurements; red lines are the results of the lognormal fit.

Table 1 .

 1 Evolution of the family composition as a function of Z derived from a DBE analysis of the mass spectra in Fig. 1. Sum of relative peak intensities and mean mass (m/z) weighted by peak intensities in parenthesis.

			Family composition
	Sample	Planar aromatics	HC Clusters	C Clusters	Fullerenes
	Z = 8 mm	0.96 (447.30)	0.04 (376.16)	0.00	0.00
	Z = 10 mm	0.79 (432.15)	0.13 (338.90)	0.05 (164.22)	0.03 (805.02)
	Z = 14 mm	0.38 (300.83)	0.33 (337.36)	0.13 (178.14)	0.16 (874.30)

ACKNOWLEDGMENTS

This work was supported by the PRIN-project 2017PJ5XXX:-"MAGIC DUST". The research leading to these results has received funding from the European Research Council under the European Union's Seventh Framework Programme (FP/2007-2013) ERC-2013-SyG, Grant agreement N°610256 NANOCOSMOS.

DBE method and family analysis:

For each detected m/z peak with a signal-to-noise ratio (S/N) greater than 10, a chemical formula is assigned using the mMass software 23 , an open source mass spectrometry tool. We then calculate the double bound equivalent (DBE) for each molecular formula. The DBE value is defined by DBE = C# -H#/2 + N#/2 + 1 with C#, H# and N#, the numbers of C, H and N atoms inside the molecules. The DBE is equal to the number of rings plus double bonds involving carbon atoms (because each ring or double bond results in a loss of two hydrogen atoms). An increasing number of H atoms in a molecule decreases unsaturation and hence leads to lower DBE values. The DBE method is used, for example, in petroleomics to separate and sort petroleum components 24 . Empirical factors 25 and DBE boundaries 26 have been set for hydrocarbons to contain or not aromatic moieties in complex natural organic matter. This method allows us to sort the detected ions into families of compounds.


Yandika Sirgabsou
email: yandika.sirgabsou@renault.com

Claude Baron
email: claude.baron@laas.fr

Cyril Bonnard
email: cyril.bonnard@renault.com

Laurent Pahun
email: laurent.pahun@renault.com

Lorenzo Grenier
email: grenier@etud.insa-toulouse.fr

Philippe Esteban
email: philippe.esteban@laas.fr

"New advances and challenges for sustainable and smart industries" 1 INVESTIGATING THE USE OF A MODEL-BASED APPROACH TO ASSESS AUTOMOTIVE EMBEDDED SOFTWARE SAFETY

Keywords: Automotive, embedded software, safety-critical systems, model, software engineering, MBSA, MBSE

With autonomous driving, vehicles are undergoing tremendous and multiple innovations in a variety of areas of automotive expertise. In particular, the amount of software used in embedded safety-critical systems is increasing at a rapid rate to implement new features. It is therefore essential today to guarantee the safety of software by carrying out safety analyses in accordance with automotive standards. These analyses allow engineers assessing the design with regard to safety and to determine the modifications if needed to meet safety objectives. However, the traditional approach to perform these analyses is cumbersome and limited when faced with the complexity of today's automotive software architectures. Safety analyses are currently performed manually, and the results are dependent on the experience of the safety expert. As a result, they are highly subjective and are not guaranteed to be exhaustive and error-free. To overcome these issues, this paper explores the use of a model-based safety approach in the context of safety-critical automotive embedded software. It makes a methodological proposal that relies on the software architecture model to build a dedicated safety model from which safety analyses can be automatically derived. The method is experimented on an automotive case study, an embedded software that assists the driver in following the lane.

INTRODUCTION

In our society undergoing deep technological and societal changes, vehicles (cars, drones…) are becoming more and more autonomous. Their architecture involves several cyber-physical systems that massively embed software components in order to allow this autonomy. In this context, there is a societal need to ensure and guarantee the vehicles safety, therefore the systems and software safety. In the automotive domain, software safety analyses are currently based on traditional manual techniques. Generic quality-oriented standards are used as references, and the quality of the analyses mostly depends on the experience of safety experts. Safety analyses are not really formalized, do not allow even a partial reuse and sometimes offer approximate guarantees of safety. With regard to this evolving context, it is therefore necessary to improve current industrial practices in order to better respond to the societal and economic issues. On another side, the current trend in engineering is to adopt model-based approaches. They enable formalizing analyses, a better communication and collaboration between interdisciplinary teams, rapid prototyping and simulation, and improve reuse. Using model-based approaches to assess software safety thus seems promising as it would help addressing the current issues that are related to safety-critical software analysis. Therefore, the objective of this paper is to explore the possibility of using a model-based approach to perform safety analyses on embedded automotive software. To this goal, this paper first gives an overview of model-based methods and underlines their interest in software engineering and safety assessment. It compares the state of scientific knowledge with respect to the state of industrial practices in the field of automotive software engineering in order to identify areas for improvement, in the practice of software safety analysis. We make a methodological proposal, which consists in automating the production of software safety analyses from a purposely built safety model. Then we give the results obtained from the application of the proposal on a real-world case study, the lateral control software component which is part of the autonomous driving software and whose role is to keep the vehicle in lane. We finally indicate some interesting research avenues to further develop this work.

MODEL-BASED APPROACHES IN SOFTWARE ENGINEERING AND SAFETY

The growing systems complexity requires the implementation of development methods to keep costs, time and quality under control. Traditional, document-centric and MOSIM'20 -November 12-14, 2020 -Agadir -Morocco 2 test-based approaches are not sufficient enough for the development of multi-disciplinary and distributed smart systems. Model-based (or model-driven) approaches address this complexity with a model-centric, frontloaded engineering methodology that focuses on creating and exploiting domain models as the primary means of information exchange between engineers, rather than on documentbased information This section quickly reminds the principles and interests of model-based approaches in software engineering then presents their use in the context of safety analyses.

Model-Based Software Engineering

Model-Based Systems Engineering (MBSE) is defined as "the formalized application of modeling to support system requirements, design, analysis, verification and validation activities beginning in the conceptual design phase and continuing throughout development and later life cycle phases [1][2]. This definition is also applicable to software engineering, where MBSE 1 has been proposed as a promising software development methodology to overcome limitations of traditional programming-based methodology [START_REF] Van | Model-Based Software Engineering: Methodologies for Model-Code Synchronization in Reactive System Development[END_REF]. MBSE promotes the use of modeling languages for describing software in an abstract way; it is used for modeling requirements, functional and physical architectures, but it also supports simulation, code generation and verification by providing means for automatically generating different development artifacts, e.g. code and documentation, from models.

Model-Based Safety Assessment

According to Joshi et al. [START_REF] Joshi | A proposal for model-based safety analysis[END_REF], Model Based Safety Analyses (MBSA 2 ) is the application of the MBSE techniques to support safety analysis. However, whereas MBSE models the nominal (non-failure) functional behavior of a system, MBSA models its fault (dysfunctional) behavior. Indeed, safety analyses aim at identifying whether the system, as modeled, has weak points. They can be performed either to analyze if a system component failure can induce a serious failure at the system level, or to determine what are the possible root causes of a system failure. To this goal, the safety engineers draw their conclusions from traditional models such as respectively FMEA 3 s or FTA 4 s that they manually elaborate from the available system specification and design artefacts resulting from design stage. Adopting a model-based approach in safety engineering consists in building a dysfunctional model of the system that shows the system behavior in case of a failure (reasoning by failure propagation), from which the traditional analyses (minimum cuts 5 , FTAs and FMEAs) can be derived [START_REF] Fenelon | An integrated tool set for software safety analysis[END_REF]. This notably allows an easy and quick generation of new safety analyses in case the system architecture 1 In this paper, the S in MBSE would either stand for System or Software. 2 The A in MBSA either means Analyses or Assessment. 3 Failure Modes and Effects Analysis. FMEAs are systematic bottom-up safety analyses to study the effects of every single failure condition (a feared event) on the whole system. 4 Fault Tree Analysis. FTA is a graphical tool to explore the causes of system level failures. It uses Boolean logic to combine a series of lower level events and it is basically a top-down approach to identify the evolves, therefore reduces the cost and improves the quality of the safety analysis process.

MBSA Methods

MBSA methods can be classified according to two main criteria, the dysfunctional model construction and the semantics of component interfaces. The first criterion is related to the process for defining the safety model and its relationship with the system design model: the dysfunctional model can either be an extension of the design model or a dedicated model [START_REF] Lisagor | Model-based safety assessment: Review of the discipline and its challenges[END_REF]. We find in [START_REF] Joshi | A proposal for model-based safety analysis[END_REF] an example of an extended model, where a nominal functional model is first constructed during design to which failure modes are added for the purpose of safety analysis. The key advantage of the model extension approach is the consistency, by construction, of the safety analyses and the design model of the system. Furthermore, development and safety processes can share a common modeling environment, languages and tools [START_REF] Lisagor | Model-based safety assessment: Review of the discipline and its challenges[END_REF].

However, it has some drawbacks. One is that it does not allow independence between the system and safety models. In the case of a dedicated model, a distinct 'standalone' dysfunctional model is built by the safety engineer based on his understanding of available information from design documents and functional models.

The key advantages of this approach are that it is more pragmatic to implement, as it ensures independence and separation of concern (between safety and engineering disciplines). However, one of its drawbacks is that it requires supplementary means for ensuring consistency with the design model. The second criterion is related to the dysfunctional model semantics (components behavior) and the type of information that is conveyed through the component interfaces, either nominal or failure flows [START_REF] Lisagor | Model-based safety assessment: Review of the discipline and its challenges[END_REF]. This criterion leads to distinguishing Failure Logic Modeling (FLM) [START_REF] Fenelon | An integrated tool set for software safety analysis[END_REF][8] (that uses failure flows) and Failure Effect Modeling (FEM) [START_REF] Fenelon | An integrated tool set for software safety analysis[END_REF] (that uses nominal flows). Early proposals adopted the FEM approach [START_REF] Joshi | A proposal for model-based safety analysis[END_REF] but, as the discipline evolved, FLM has gained prevalence and most of the pioneering MBSA methods such as FPTN [START_REF] Fenelon | An integrated tool set for software safety analysis[END_REF], HiP-HOPS [START_REF] Papadopoulos | Hierarchically Performed Hazard Origin and Propagation Studies[END_REF] and AltaRica [START_REF] Point | AltaRica: Constraint automata as a description language[END_REF] rely on it. Several modeling languages support MBSA. Some are dedicated to safety such as AltaRica [START_REF] Bieber | Safety Assessment with Altarica[END_REF], SAML [START_REF] Gudemann | A Framework for Qualitative and Quantitative Formal Model-Based Safety Analysis[END_REF] or Figaro [START_REF] Bouissou | Knowledge Modelling and Reliability Processing: Presentation of the Figaro Language and Associated Tools[END_REF]. Others are multipurpose modeling languages (such as UML) and architecture description languages (such as AADL [START_REF] Feiler | An Overview of the SAE Architecture Analysis & Design Language (AADL) Standard: A Basis for Model-Based Architecture-Driven Embedded Systems Engineering[END_REF] or EAST-ADL [START_REF] Blom | EAST-ADL: An Architecture Description Language for Automotive Software-intensive Systems in the Light of Recent use and Research[END_REF]) that extend their core semantics and syntaxes to support safety analyses trough profiles and error annexes [START_REF] Delange | Architecture Fault Modeling with the AADL Error-Model Annex[END_REF] .

AltaRica language

AltaRica [START_REF]AltaRica Association[END_REF] is a high-level modeling language dedicated to risk analysis that supports safety, reliability and component level failures (basic event) that cause the system level failure (top event) to occur. 5 Minimum cuts represent the smallest combination in which basic events can possibly cause a system failure; they are used intermediately in the generation of certain FTAs. Cut sets are the unique combinations of component failures that can cause system failure. A cut set is said to be minimal if, when any basic event is removed from the set, the remaining events collectively are no longer a cut set [START_REF] Kececioglu | Reliability Engineering Handbook[END_REF].

performance analyses [START_REF] Point | AltaRica: Constraint automata as a description language[END_REF]. In AltaRica, model elements are expressed in terms of nodes. Each node is composed of states, events, transitions and assertions [START_REF] Bozzano | Symbolic Model Checking and Safety Assessment of Altarica models[END_REF]. States are declared using domains. A domain is an enumerate comprising several states. Several tools currently support Al-taRica: OCAS [START_REF] Bieber | Safety Assessment with Altarica[END_REF], Simfia and SimfiaNeo [START_REF] Machin | Sim-fiaNeo, Complex Systems, yet Simple Safety[END_REF], Open Al-taRica [START_REF]OpenAltaRica[END_REF] and AltaRica Studio [START_REF]AltaRica Project | MEthods and Tools for AltaRica Language[END_REF].

In conclusion, among the current MBSA methods, we found that using a dedicated model and FLM approaches reveals to be the most interesting, as it adopts a safety oriented modeling; when combined with a dedicated model, this ensures independence between system design and safety (which is an important criterion in the certification of critical systems). For the case study analysis, we chose AltaRica for its simplicity and proven usefulness in the system context. However, if AltaRica is well-adapted to software failure modeling remains to be clarified.

AUTOMOTIVE PRACTICES IN SOFTWARE ENGINEERING AND SAFETY ASSESSMENT

A document-based software development process

The automotive software development process is centered around two standards: ASPICE [32] (for quality) and ISO 26262 [33] (for functional safety). ASPICE (Automotive Software Performance Improvement and Capability dEtermination) is a standard that provides guidelines to improve software development processes and to assess suppliers. ISO 26262, the "Road Vehicles-Functional safety" is the standard for functional safety of electrical and/or electronic systems in automotive production. It provides a reference for the automotive safety lifecycle. It also defines the Automotive Safety Integrity Level (ASIL), representing the degree of automotive hazard and the degree of rigor to apply in specifying and implementing safety requirements and safety measures. ASILs range from A to D, with D representing the most stringent and A the least stringent level, while QM (Quality Management) is allocated to items that have no impact on safety. ISO26262 is divided into 11 parts; Part 6 addresses the product development at software level (which is more specific to software engineering context).

Figure 1 shows the ISO26262 phase model for the product development at the software level. The left side of the cycle covers the 'Specification of the software safety requirements', the 'Software architectural design', and the 'Software unit design and implementation' phases. The software safety requirements usually are non-formalized, expressed in natural language and managed through tools such as Rational DOORS. At the software architectural design phase, the use of semi-formal modeling language (such as UML) to support design and analysis remains quite immature and unmastered. As a result, the software architectural design process mostly relies on informal models and natural language descriptions. However, at the software unit design phase, tools like Simulink are effectively used for prototyping, simulation and code generation. Traceability is maintained between related phases as shown by the arrows on Figure 1.

A document-based safety assessment process

In the current practices in automobile, a document-based safety assessment process is conducted as the integral part of the design process and is done in compliance with ISO 26262. The process comprises the manual construction of safety cases and safety analyses in document templates (in Excel, Word, PowerPoint format). Unfortunately, these analyses are highly subjective and dependent on the skill of the engineer. Their traceability back to design artifacts is mainly maintained through naming conventions and sometimes hyperlinks in collaborative tools. The final FTAs are often produced through a process of review and consensus building between the system and safety engineers [START_REF] Joshi | Mod-elBased Safety Analysis: Final Report[END_REF]. Even after a consensus is reached, it is unlikely that the analysis results will be complete, consistent, and error free due in part to the informal models used as the basis of the analysis. In fact, the lack of precise models of the system architecture and its failure modes often forces the safety analysts to devote much of their effort to gathering information about the system architecture and system behavior and embedding this information in the safety artifacts such as FTAs. In these conditions, it is difficult to ensure rigorous safety analyses and traceability. Ideally, this situation could be significantly improved, for instance if engineers produced formal models of the system under development, then extended this model with a dysfunctional model, and then performed safety analyses by deriving FMEAs and FTAs from this latter. However, as currently design models are not formalized enough to be exploited, we think that a first step to bridge the gap towards this ideal situation could consist in a manual but traceable building of the dysfunctional model. The achievement of this objective constitutes the motivation for our methodological proposal.

METHODOLOGICAL PROPOSAL

Our proposal consists in building a dysfunctional model of the software from which minimum cuts, FTAs and FMEAs could be automatically generated. Referring to what section 2.2.1 clarified, it relies on the use of a dedicated model [START_REF] Lisagor | Model-based safety assessment: Review of the discipline and its challenges[END_REF] and the use of a failure logic modeling technique [START_REF] Fenelon | An integrated tool set for software safety analysis[END_REF] and supporting languages.

A synopsis of the proposal is presented in Figure 2. It proceeds into 3 steps:  Dysfunctional Modeling,  Functional to Dysfunctional Logic Translation and  Safety Analysis.

Figure 2. Synopsis of the proposed methodology

Step  consists in building a dysfunctional hierarchical architecture of the software from the software functional architecture. For each software component, Step  translates the software functional logic into a failure propagation logic. This step allows writing the output state of each component taking in consideration not only the internal state of the components but also the states of the inputs.

Step  results in a dysfunctional model that is used at

Step  to perform safety analysis and generate classical safety models (such as minimum cut sets, FTAs and FMEA) from failure conditions and constraints.

Step 1: Dysfunctional modeling

We propose building a formal dysfunctional model from the software functional architecture in order to capture the fault behavior of the software. Using various information captured from the software architecture documents (containing informal designs models as well as their functional description), we define and assign abstract states (e.g. active, failed or temporarily failed) and associated transitions6 (e.g. failure, partial failure, deactivation, cancel) to software components. We do the same for the interface (inputs and outputs) between the components to which we assign abstracts states (e.g. ok, no data, loss, erroneous data). This results in a dysfunctional model featuring the software components and how they are connected by failure dependency links. Thanks to its graphical representation, this model is easy to understand; as formal, it can be used for simulation, analysis and evidence. To build this model, several formalisms can be used, including state/transition diagrams as well as other dedicated safety modeling languages such as AltaRica or AADL.

To illustrate this proposal, an example is given in Figure 3. It shows three software components A, B and C, to which internal state variables (representing their possible states) are assigned. Each component has 2 states (nominal or failed). The inputs and outputs are also expressed using states (ok, no-data, erroneous). In this example, if the software component B fails (due to its internal state or erroneous input), its output can replicate this failure to the C software component which in turn can relay it to the Failure Condition. The completion of Step  results in a dysfunctional architecture comprising software components (whose behavior is modeled using states) and their interconnections.

Step 2: Functional to dysfunctional logic translation

To complete the dysfunctional model, the goal of Step  is to express the dependencies between the component inputs and outputs, that is how failures can propagate through the software architecture. To ensure the consistency between the functional and dysfunctional models, we propose to translate the functional logic into a dysfunctional logic. Therefore, we proceed by using failure truth tables. We call 'failure truth table' (FTT) one table that systematically maps the normal flows (from the functional logic) into failure flows (dysfunctional logic).

To build the failure truth tables, we first analyze the functional logic of a component. Then using the states (nominal, erroneous, loss), defined in Step , we set the inputs (to nominal, erroneous or loss) and deduce the corresponding output (nominal, erroneous, loss). Repeating this process allows building the FTT with all the possible combinations of the inputs and the corresponding outputs in dysfunctional flows. To illustrate the construction of an FTT, Figure 4 presents a simple example of functional logic of a software component (in the rectangle). It is a simple function that returns an output based on the value of two inputs labeled 1 and 2. Using our proposal, we set the internal states to the inputs and report to the table the corresponding output states. We reiterate this for all the possible combinations of the input's states.

Table 1. Failure truth table

This results in the FTT shown on Table 1. In the case of this example, if both inputs are 'nominal', then the output is 'nominal'. If either one of the inputs is 'loss' then, the output state is 'loss'. Otherwise, the output state is 'erroneous'.

In order to obtain a computable expression of this logic, we then translate the information of the FTT into a dysfunctional logical expression of outputs: The advantage of this FTT is that it allows changing the point of view (from functional to dysfunctional) and expressing the failure behavior in a syntactic and formal manner that can be used to write logical expression of the output (for software engineers) as well as in natural language (to communicate). Furthermore, when the design logic evolves, the FTT can be updated accordingly, helping in this way to maintain consistency. They could also be reused in the long run to capture more complex logics. The completion of Step  produces a well-expressed failure logic resulting from the FTTs and a complete dysfunctional model that can be used in Step  to perform safety analyses.

Step 3: Safety analysis This step consists in exploiting the dysfunctional model resulting from Step  for simulation and generation of safety analyses such as FMEAs, Minimum cut sets and FTAs. To this goal, failure conditions, that represent the violation of safety software associated goals, are added to the architecture. In conclusion, Step  can help in the evaluation of the system safety through simulations and the generation of classical models (Minimum cut sets, FTAs, FMEAs). This saves time and helps the safety engineers in their task.

Discussion

The proposal offers several interests and significantly improves current practices, mainly thanks to the adoption of a model-based approach. By automating the generation of safety analyses from a dysfunctional model of the software, it allows quickly processing new analyses if ever a modification occurs on the model, at low effort. Assuming that the dysfunctional model is correctly established from the functional model, this methodology prevents from the introduction of bias in manually building FTAs or FMEAs due to potential interpretations of the safety analyst. To perform the functional to dysfunctional model transformation at best, the consistency and traceability between models is ensured thanks to the failure truth tables. In addition, the methodology allows maintaining the safety analyses whenever the design evolves. However, the proposal still has some limitations. First the manual modeling could be improved if some behavioral attributes of the software component had already been elucidated in the design model. In this case, a partial import could be considered. This highlights the need of improving model-based practices on the design side. A second limitation lies in the manual logic translation through failure truth tables, that could be improved if a form of automation was used, based on a kind of automatic model transformation.

CASE STUDY

In an automobile, the Advance Drivers Assistance System (ADAS) and Autonomous Driving (AD) implement software-based functions that assist the driver and improve their driving experience. The chosen case study is a subsystem of the AD software system. As presented in Figure 5, it consists of three main software components: The Hands-Off Detection (HOD), the Longitudinal Control and the Lateral Control. This case study being part of a broader system, we also consider other components of the system (such as the Status Input) that must be included to perform the analysis and to position the software components with respect to their environment.

Choosing tools to support the methodology

Let us remember that we chose using a dedicated dysfunctional model and the FLM approach. This allows us to have a more safety-oriented point of view of the system and enforces independence and separation of concern (functional features vs safety considerations). We chose AltaRica based solution for its simplicity but also for its formal aspects. AltaRica allows expressing a dysfunctional behavior through a well-defined semantic. Moreover the language has been proven useful in many contexts (for instance for systems safety assessments in aeronautics) as outlined in [START_REF] Bieber | Safety Assessment with Altarica[END_REF]. Among AltaRica based tools we chose SimfiaNeo for its more innovative features and friendly eclipse-based user interface. SimfiaNeo has a built-in step-simulator offers an FMEA generator, and a built-in model checker that is used to directly generate minimum cut sets and FTAs from the dysfunctional architecture.

Applying the methodology

We then applied the different steps of the methodology: first, in Step , we defined and modeled the software components states and basic failures, then in Step , we modeled the failure propagation using logical expressions linking outputs to inputs as well as internal states; finally in Step , we used the resulting dysfunctional architecture to perform safety analysis.

Step 1: Dysfunctional modeling

We used the information from the AD software functional architecture (documents and informal models) to build our basic dysfunctional model. First, using SimfiaNeo graphical modeling interface, we modeled the software components with model bricks.

Figure 6. Top level view of the case study model

Then, using AltaRica, we defined domains (cf. section 2.2.2) for components and inputs / outputs, states and associated transitions (expressed as events in AltaRica) for each component. A top-level view of the model is shown in Figure 6. The red rectangle delimits the perimeter of the case study. We now need to complete this dysfunctional model with a failure propagation logic to be able to perform safety analysis.

Functional to dysfunctional logic translation

A logic translation is used to assist in the building of the failure propagation and ensure a better consistency of the dysfunctional model with the design model. For that, logic retrieved from Simulink models are translated into Al-taRica logic using FTTs. The goal of the functional to dysfunctional logic translation is to go from this functional point of view to a dysfunctional point of view. For that, we assign the states (predefined in Step ) to the inputs (on the functional logic), and we write the corresponding output states on the FTT. We reiterate this process for all possible combinations of input states. This creates the corresponding failure table, with all possible output states, as shown in Fig. 7. Using the FTT, we can now write the output expression (of the corresponding dysfunctional brick) in AltaRica. This step is repeated for all the software components of AD. The tables can be used as templates to model more complex components and systems. This can help save time through reuse. Overall, Step  completes the dysfunctional model initiated in Step . Thanks to this, the dysfunctional model is more consistent with the functional model and can be used for safety analysis in Step .

Step 3: Safety Analysis

This step consists in generating classical safety models such as FMEAs, minimum cut sets and FTAs from the dysfunctional model, using the SimfiaNeo model checking capabilities. To this goal, we used the dysfunctional model from Step  and the failure conditions identified in earlier stages of the safety lifecycle. We proceeded by adding failures conditions using AltaRica observers 8 via direct connections from the software components outputs or through a combination of assertions expressed in Al-taRica. Once this is done, we can now perform safety analysis. First, we performed simulations. Then we directly generate FMEAs from the dysfunctional architecture. After that, we compute the minimum cuts sets, from which we were able to immediately generate FTAs. To perform simulation, we used the SimfiaNeo built-in step simulator. It allows us to interactively assess the dysfunctional behavior of the system. For that, we manually trigger basic failure events (at component level) and observe their effect, through change in colors, on other components and failure conditions (earlier added through Al-taRica observers). SimfiaNeo offers the automatic generation and export of FMEA tables directly from the software dysfunctional model. Given the complexity of the software architecture and the multiple basic failures (at component level), this results in a plethoric number of failure modes (in FMEA tables). For this reason, we found that in our case, the FMEA tables were less pertinent in comparison to minimum cuts and FTAs, that are more compact and synthetic. However, whereas generating FMEA is immediate, generating FTAs requires a (somehow quick and easy) configuration. Preliminary to the creation of FTAs, minimum cut sets are first generated. To generate a minimum cut, we specify the failure condition for the top event, the maximum order (of the computation) and a few other parameters such as the type of generation (stochastic, permutation or combination). We can also add to the configuration some constraints representing any conditions we want to check (e.g. 'No single point of failure'). Once the computation is launched, it returns a table (as shown in Figure 8) listing the basic failure events ('Elements' column), the order (number of basic events contributing to the top event) as well as their probabilities. FTAs basically contain the same information as minimum cut sets but have the advantage of presenting them in a more visual and intuitive way. Figure 9 shows an example 8 An AltaRica observer is an indicator that can be associated to failure condition that we want to watch out for. of FTA. It is constructed from the minimum cut sets of events leading to the ADAS 'Lateral control loss' feature.

Figure 9. Loss of lateral control status Fault Tree

At the top of the tree stands the top event (Lateral control loss). In the leaves, we see the basic failure events and their probabilities (that are not useful in our case). The FTA graphically shows that the lateral control loss can be caused by the single failure of the lateral control component (Lateral_Ctrl.failure) or a combination of the HOD (HOD.HODStateFinal) with either the Fusion (Fusion.failure) or Statut Input (Status_IN.failure) software component failures. Additionally, the FTA can be useful in capturing inconsistencies in the ASIL decomposition that are not visible through the functional view. For example, the lateral control component is rated ASIL B whereas one of the contributing basic events (Status_IN.failure) in this FTA does not bear any ASIL requirement. So, using FTA can be useful to check if, for a given safety goal, the ASIL of the combination of the triggering event is inconsistent. This step showed how the classical safety models can be generated from the dysfunctional architecture we built in Step  and Step .

Case study conclusion

The results from the case study show that using the methodology we propose, it is possible to apply and benefit from a model-based safety analysis approach for software in the automotive industry. It also demonstrates the usefulness and efficiency of using basic and pragmatic tools features such as simulation and failure cause and consequence that are available in tools. Additionally, this approach makes safety analysis more accessible to engineers through a tool-based generation of traditional safety analyses. Overall, the methodology enforces safety by allowing engineers to focus on getting a right model and spending less effort in generating analyses, therefore improving the quality of these automatically generated analyses. The possibility to generate FTA in one click is interesting. Indeed, if the software functional model changes, the dysfunctional model can be updated, and FTAs can be regenerated without additional effort. This means that the dysfunctional model should be maintained. However, given that the dysfunctional model construction and logic translation are done manually, there are some limitations. First, the manual modeling and logic translation make impractical the application of the methodology to large and complex software systems. This manual modeling approach can certainly be improved to ensure a better consistency of our model with the design model. Secondly, the AltaRica language is system oriented and lacks semantics for certain categories of software failures. It was difficult to express and simulate failures related to timing and values. For example, we were not able to model and observe failures such as the temporary deactivation of lateral control or out-of-range values. In this regard, we consider that the use of AltaRica needs to be reassessed. Nevertheless, the proposed methodology answers our current needs as it is a clear improvement from the manual techniques.

PERSPECTIVES AND CONCLUSION

This paper made a methodological proposal for using MBSA for automotive software safety analysis. It consists in building a dysfunctional architecture of the automotive software from the functional high-level software nominal architecture, using compatible semantics and syntaxes, and a translation of a functional to a dysfunctional logic. Then, from this dysfunctional model, the safety engineer can automatically generate minimal cut sets, FTAs and FMEAs for interpretation and as safety proofs if required. We applied this methodology on a real-world industrial case study that involved the use of SimfiaNeo and Al-taRica. We concluded on the implementability and usefulness of the methodology. Coupled with the languages and tools we used, it brings added value and improves current manual safety analysis practices. Limitations that we identified will be addressed in future work. This will include improving the dysfunctional modeling for which we will consider a partial automation of the model building and logic translation. We will also explore languages that have better semantics for software failures (AADL EMV2 for example). Finally, we will work on aligning the proposed model-based software safety analysis methodology with model-based software development to ensure better consistency and higher quality of safety analysis.

Figure 1 .

 1 Figure 1. Reference phase model for the product development at the software level from [33] On the right side of the cycle feature the 'Software unit verification", 'Software integration and verification' and 'Testing of the embedded software' phases. Each of these phases aim to verify and validate if the corresponding left side (design stage) phases are implemented as required. Traceability is maintained between related phases as shown by the arrows on Figure 1.

Figure 3 .

 3 Figure 3. Illustration of a dysfunctional architecture

Figure 4 .

 4 Figure 4. Simple functional logic of a software component

  if (input_1 = Nominal AND input_2 = nominal) then {Output := Nominal ;} else if (input_1 = Loss OR input_2 = loss) then {Output := loss;} else {Output := Erroneous;} end if;

Figure 5

 5 Figure 5 Synopsis of the case study software architecture At autonomy level 1 (corresponding to assisted driving 7 ), the drivers are required to keep their hands on the wheels even though AD features are activated. In this context, the role of the Hands-Off Detection (HOD) is to detect if the

Figure 7

 7 illustrates this transformation. The functional logic is from a subcomponent of the HOD software component. From a functional point of view, this logic returns a status (HODConsolidationHandsOn) based on whether the two signals (HandsOff and HandOff_mirror) are equal. The output (HandsOffState) captures this status.

Figure 7 .

 7 Figure 7. Functional to dysfunctional logic translation using truth failure tables

Figure 8 .

 8 Figure 8. Loss of lateral control minimum cut set

A transition is a passage from one state to another.

There are 6 levels of autonomy ranging from 0 (no automation) to 5 (full automation)

ACKNOWLEDGEMENTS

This work was sponsored by Renault Software Labs and the ANRT (Association National de la Recherche et de la Technologie). We thank them for their financial support.