Sana Ben Nasr
email: sana.ben-nasr@inria.fr

Nicolas Sannier
email: nicolas.sannier@inria.fr

Mathieu Acher
email: mathieu.acher@inria.fr

Benoit Baudry
email: benoitbaudry@inria.fr

Moving Toward Product Line Engineering in a Nuclear Industry Consortium

Keywords: J.7 [Computer Applications]: Computer in other Systems; D.2.1 [Software Engineering]: Requirements Legal Aspects, Experimentation requirements variability modeling, regulations, product line engineering, variability mining

Nuclear power plants are some of the most sophisticated and complex energy systems ever designed. These systems perform safety critical functions and must conform to national safety institutions and international regulations. In many cases, regulatory documents provide very high level and ambiguous requirements that leave a large margin for interpretation. As the French nuclear industry is now seeking to spread its activities outside France, it is but necessary to master the ins and the outs of the variability between countries safety culture and regulations. This sets both an industrial and a scientific challenge to introduce and propose a product line engineering approach to an unaware industry whose safety culture is made of interpretations, specificities, and exceptions.

This paper presents our current work within the French R&D project CONNEXION, while introducing variability modeling to the French nuclear industry. In particular, we discuss the background, the quest for the best variability paradigm, the practical modeling of requirements variability as well as the mapping between variable requirements and variable architecture elements.

INTRODUCTION

Nuclear power plants are some of the most sophisticated and complex energy systems ever designed. Nuclear safety clear regulatory requirements landscape and discuss the lack of variability awareness of the nuclear industry. Section 3 presents research background. Section 4 gives an overview of the proposed approach. Sections 5 and 6 describe the overall variability approach. Section 7 describes the different techniques used to implement our method and their applications in the context of the CONNEXION project. Section 8 presents related work while Section 9 concludes the paper and describes future work.

INDUSTRIAL BACKGROUND

In this section, we introduce the context of our research work (the CONNEXION project) as well as industrial and academic challenges.

The CONNEXION Project

Since 2011, the CONNEXION1 project is a national work program to prepare the design and implementation of the next generation of I&C systems for nuclear power plants, with an international compliance dimension. The CON-NEXION project is built around a set of academic partners (CEA, INRIA, CNRS / CRAN, ENS Cachan, LIG, Telecom ParisTech) and on collaborations between large integrators such as AREVA and ALSTOM, EDF and "technology providers" of embedded software (Atos Worldgrid, Rolls-Royce Civil Nuclear, Corys TESS, Esterel Technologies, All4Tec, Predict).

For the specific concern of having a high level and global perspective on requirements and architecture variability modeling, the working group started on November 2013 and was constituted of CEA, Inria, AREVA, EDF, Atos Worldgrid, Rolls-Royce Civil Nuclear, and All4Tec engineers and researchers. The group size varies from 3 to 14 persons depending of the individual or collective task to perform. In the group, Inria and All4Tec are considered as variability experts while the rest of the participants have neither academic nor industrial variability culture. Between November 2013 and April 2014, the group has organized a dozen of half-day to full day workshops as well as several regular or ad hoc telephone meetings, which ensures a high level of interactivity.

On the Regulation Heterogeneity and Variability

Safety critical systems must comply with their requirements, where regulatory requirements are first class citizens. These requirements are from various natures, from regulations expressed by national and international bodies, to national explicit or implicit guidance or national practices. They also come from national and international standards when they are imposed by a specific regulator [START_REF] Sannier | Increment: A mixed mde-ir approach for regulatory requirements modeling and analysis[END_REF].

In the specific context of nuclear energy, one applicant has to deal with very heterogeneous regulations and practices, varying from one country to another. This heterogeneity has a huge impact in the certification process as the regulators safety expectations, evidences and justification to provide can vary [START_REF] Sannier | Defining and retrieving themes in nuclear regulations[END_REF][START_REF] De La Vara | Safetymet: A metamodel for safety standards[END_REF].

At this level, the main concern comes from the difference between national practices and the set of documents (regulatory texts ans standards) to comply with. The nuclear industry has an unstable and growing set of safety standards. Worse, the set of safety standards is increasing within two main standards areas. On the one hand, there are the IEEE/ISO standards that are mainly applied in the US and eastern Asia. On the other hand, the IAEA/IEC standards and recommendations followed in Europe2 . This heterogeneity and lack of harmonization of the different nuclear safety practices has been highlighted by the Western Europe Nuclear Regulators Association (WENRA)in 2006 [START_REF] Rhwg | Harmonisation of Reactor Safety in WENRA Countries[END_REF].

Proposing one system, when having to perform a safety function, in different countries then leads to a huge problem of variability that concerns, not only the set of requirements to comply with and the certification process, but also the system's architecture itself.

Lack of Product Line Culture

Rise and Fall of the EPR reactor out of France. In France, EDF owns and operates 58 nuclear power units, following four different designs or series (same design but specific projects). Born from a European program, the Evolutionary Pressurized Reactor (EPR) design represents the new power plant generation and has been expected to be built on several countries: France, Finland, the United-Kingdom, China, and later, in the USA. The British safety authorities reference the same set of IEC standards as in France. However, their acceptable practices differ on some significant points. US authorities provide detailed written regulatory requirements and guidance but endorse but IEEE documents.

As a consequence, the concept of series that enabled to design and maintain the nuclear power plants in France can no longer be applied as such for export. Thus, since 2008, in the five most advanced EPR projects (construction in Finland, France and China, certification in progress in the USA and UK), EDF and Areva have been with four different I&C architectures and five different and ad hoc certification processes, specific to each country.

Conforming to different regulations. Comparing each IEC standard (and their interpretations) with its approximately relevant IEEE corresponding standard is difficult, time consuming and does not ensure to have the correct interpretation of the different standards. Though the domain owns a very precise and established vocabulary, ambiguities [START_REF] Pohl | Requirements Engineering -Fundamentals, Principles, and Techniques[END_REF] and interpretations are legions. Legal documents and standards contain intended and unintended ambiguity [START_REF] Breaux | A systematic method for acquiring regulatory requirements: A frame-based approach[END_REF][START_REF] Kamsties | Understanding ambiguity in requirements engineering[END_REF], causing interpretations, misunderstandings and negotiations between stakeholders. Scope of regulations may also differ as there is no direct mapping from one standard to another but many overlaps and differences.

Though the task is very difficult, formalizing the requirements variability and finding the common core that will enable the next I&C architecture generation is more than necessary from the industrial perspective. In the context of the CONNEXION Project, a product line approach consists to define a generic foundation that is refined for a given project by taking into account the specific requirements. This is an important challenge for building I&C systems on EPR units or other types of reactors in several countries in order to avoid the questioning of the initial design principles.

RESEARCH BACKGROUND

The Common Variability Language (CVL) [START_REF]Common Variability Language (CVL)[END_REF] is a domainindependent language for specifying and resolving variability. We present here the three pillars of CVL and introduce some terminology that will be used in our approach.

Variability Abstraction Model (VAM ) expresses the variability in terms of a tree-based structure. Inspired by feature and decision modeling approaches [START_REF] Czarnecki | Cool features and tough decisions: a comparison of variability modeling approaches[END_REF], the main concepts of the VAM are the variability specifications, called VSpecs. CVL distinguishes three types of VSpecs, essentially linked to their types: choice (Boolean), variable (other primitive types) and classifier (multiple instanciations).

Base Models (BMs) is a set of models, each conforming to a domain-specific modeling language (DSML). The conformance of a model to a modeling language depends both on well-formedness rules (syntactic rules) and business, domain-specific rules (semantic rules). The Object Constraint Language (OCL) is typically used for specifying the static semantics. In CVL, a base model plays the role of an asset in the classical sense of SPL engineering. These models are then customized to derive a complete product.

Variability Realization Model (VRM ) contains a set of Variation Points (VP). They specify how VSpecs (i.e., Choices) are realized in the base model(s). An SPL designer defines in the VRM what elements of the base models are removed, added, substituted, modified (or a combination of these operations) given a selection or a deselection of a choice in the VAM. 1 depicts the approach we developed to tackle the variability issues. The long term goal is to configure a robust I&C architecture from features related to regulatory requirements. The gap between textual regulatory requirements and the architecture is obviously important and variability cross-cuts both parts. Therefore the key idea is to exploit architectural design rules as an intermediate between the regulatory requirements and the architecture.

OVERVIEW OF THE APPROACH

Intensive interactions between all the involving partners and numerous workshops and meetings lead to the adoption of the approach (see also Section 7.3 for more details). Two separate areas of variabilities are part of the approach (1) variability among requirements (the main focus of the paper) led by Inria and (2) variability among the architecture led by another partner.

Regarding the requirements variability, it can take place at two levels: the variability of one particular requirement and the variability of a set of requirements within a product line.

A first key task is to determine the variabilities within the set of requirements we want to satisfy. At the same time, the other key task is related to the adaptation of these variable elements by orchestrating the possible configurations from the architecture perspective.

The first stage aims at handling the multiple interpretations of ambiguous regulations using mining techniques. The second stage addresses the impact of requirements variability on the architecture and its certification through the variability in design rules. In Section 5, we address more precisely the mining and modeling of variability in nuclear standards. In Section 6, we describe how we model variability of design rules and the brige between variability in both requirements and architecture.

HANDLING VARIABILITY IN REGULA-TORY REQUIREMENTS

In this section, we present how we manage variability with nuclear regulatory requirements and its modeling with the OMG Common Variability Language (CVL) [START_REF]Common Variability Language (CVL)[END_REF]. This domain is complex because of the variety of documents one has to handle; the number of requirements they contain; their high level of abstraction and ambiguity, etc. We proposed to analyze variability in regulatory documents with the smaller scope of topics (A topic is a concern within a corpus (e.g., "independence", "safety Classification", etc.)), on different corpora and on the same abstraction level: regulatory text, regulatory guidance or standards (see Section 5.3).

Our industrial partners proposed to model variability in IEC and IEEE standards for each of these two topics: independence (see Table 1) and safety classification (see Table 2).

I&C Architecture Concepts.

In order to ease the understanding of the following sections, we briefly describe the main concepts of a classic I&C architecture. An I&C architecture can be decomposed into systems that perform functions. Systems and functions are classified with respect to their safety importance. These systems and functions are organized within lines of defense (LDs) and many constraints drive the organization of the architecture in order to prevent common cause failures. These constraints mainly deal with communication or independence (physical separation and/or electrical isolation) between lines of defense or systems with respect to their safety classification.

Requirements Similarity Identification

The first step of Fig. 1 is based on the intuition that features are made of clusters of related requirements. In order to form these clusters, requirements are considered related if they concern similar matters. Thus, the subject matter of the requirements has to be compared, and requirements with similar subject matter will be grouped. For example, in Table 1, the following safety requirements IEC 60709.1, IEC 60709.11, IEC 60709.12, IEEE 384.1 and IEEE 384.5 are similar because all of them are addressing the independence between systems. In particular, IEC 60709.1, IEC 60709.11 and IEC 60709.12 are dealing with preventing system degradation, while IEEE 384.1 and IEEE 384.5 specify how this must be achieved.

Feature clustering

The feature clustering step creates a feature tree based on the similarity measures from the previous stage. Requirements which are semantically similar, i.e., have the most in common, are "clustered" to form a feature. These smaller features are then clustered with other features and requirements to form a parent feature. 3 reports the global traceability between identified features and standards requirements.

Modeling Regulatory Requirements Variability with CVL

We propose to illustrate the complexity of safety requirements corpus through the manual search of similar requirements dealing with similar matter. As a reminder, this requirements analysis will be made on three different corpora, France, UK and US and on two standards: IEC and IEEE for each of these two topics: independence (see Table 1) and safety classification (see Table 2).

Fig. 2 shows an extract from the requirements model and its related variability model. Standards and regulatory texts concerns can be organized as variably concepts and properties like ICFunction, Independence between Systems (see Fig. 2), Independence between Functions and Communication Separation (see Fig. 3) which correspond to mandatory features.

In Fig. 2, ICSystem and ICFunction are two classifiers having an instance multiplicity [1..*] (i.e., at least one instance of ICSystem and ICFunction must be created). Each ICSystem is associated with a Safety Class (See IEC 60964.11 in Table 2) and each ICFunction is associated with a Safety Category. Each ICFunction is allocated to at least one IC-System while Safety Category must be lower or equal to Safety Class. See the OCL constraint attached to ICFunction and IEC 61513.3 in Table 2.

There are two alternatives for Safety Class: IEC Class and IEEE Class form an Xor-group (i.e., at least and at most one feature must be selected). Similarly, IEC Category and IEEE Category form two alternatives of Safety Category. Independence between Redundant Parts, Independence between Systems of Different Classes and Prevent System Degradation are mandatory child features of Independence.Sys. On the other hand, in Fig. 3, Independence between Functions of Different Categories is a mandatory child feature of Independence between Functions (See IEC 61226.18 in Table 2).

In a previous work, Sannier and Baudry [START_REF] Sannier | Increment: A mixed mde-ir approach for regulatory requirements modeling and analysis[END_REF] proposed a formalization of nuclear regulatory requirements into a requirements model using Domain specific languages (DSLs). We rely on this DSL in our work. Yet, it is worth noticing that instead of representing only requirements within a linear organization, they represent a corpus of different kinds of documents, which contains different kinds of fragments with different semantics.

Fig. 2 depicts an excerpt of a standards BM that contains the minimal subset to formalize IEC 60709.1 requirement. From IEC 60709 standard, we present some transformation elements into text fragments and the traceability to requirements that are created and will be the analyzed elements. Moreover, this figure illustrates bindings between standards BM and the standards VAM. For instance, the "object existence" variation points against the IEC 60709.1 Section refer to the choice Independence.Sys, IEC Class and IEC Category meaning it will exist only when these choices are decided positively. The "object existence" variation point against the IEC 60709.1.b Standard Requirement is bound to the choice Independence between Systems of Different Classes.

MAPPING BETWEEN REQUIREMENTS

AND ARCHITECTURE

Modeling Variability in Design Rules

Design Rules to Bridge Requirements and Architecture Elements.

Modeling requirements variability is useful, however there is no direct mapping from requirements to the architecture. To brige the gap between textual regulatory requirements and the architecture, we move towards variability in design rules. Design rules, edited by EDF and endorsed by the French safety authority, are intermediate elements to bridge the gap between an architecture and the regulatory or normative requirements. Our industrial partners rely on these rules to validate the architecture against regulations. A design rule can satisfy fully or partially one or more requirements: in

Identifying and Modeling Variability in Design Rules.

Similarly to requirements, the identification of features in deign rules consists in comparing the subject matter of rules followed by a clustering step. For instance, SA10, SA12 and SA54 are similar because they are dealing with the separation of systems of different classes. In particular, SA10 and SA12 deal with communication without perturbation between systems of different classes whereas SA54 forbids the communication between them (see Table 1). Table 3 reports the traceability between identified features and design rules.

Comparing design rules interpretations in the three countries leads to the variability specification in Fig. 4. The concept of design rules are decomposed into the following mandatory features: ICFunction, Communication Separation in Fig. 3 and the two kinds of communication: Functions Communication (communication between functions) and Systems Communication (Communication between Systems). Similarly in standards VAM, each ICFunction is allocated to at least one ICSystem and only one Line of Defense.

France and UK allow the communication between systems of different classes only if it will not cause systems perturbation using isolation devices (see SA10 and SA12 in Table 1), however USA forbids it (see SA54 in Table 1). In Fig. 4, Communication without Perturbation and No Communication between Systems of Different Classes are two alternatives for Separation between Systems of Different Classes. Moreover, decouplingType is an optional classifier of Systems Communication. The latter has an OCL constraint written in its context comparing the Sender Class and the Receiver Class. If a Sender Class is lower than its Receiver Class, it requires isolation: the function non Empty() is used to state that there is at least one instance of the decouplingType classifier. The design basis for information systems, including their measurement devices, shall take into account their importance to safety. The intended safety function of each system and its importance in enabling the operators to take proper pertinent actions . . .

SA5

Every system and sensor is associated with safety class.

US, France and UK IEC 61513 .3 d) Each IC system shall be classified according to its suitability to implement IC functions up to a defined category.

SA8

Function with safety category n can be allocated only on systems of safety classes n or >n.

US, France and UK IEC 61226.18

There shall be adequate separation between the functions of different categories.

FA11

A lower classified function can not send information to a higher classified function.

US, France and UK IEC 61226.3a

An IC function shall be assigned to category C if it meets any of the following criteria and is not otherwise assigned to category A or category B: a) plant process control functions operating so that the main process variables are maintained within the limits assumed in the safety analysis not covered by 5.4.3 e).

SA57 SA58

The FA6 function associated category B. The FA5 function associated category A.

France The three countries forbid the communication from lower to higher classified functions (see FA11 in Table 2). An OCL constraint is attached to Functions Communication, requiring that the Sender Category must be higher or equal than Receiver Category. Furthermore, a function allocated to a line of defense shall not communicate with a function allocated to another line of defense. Consequently, a second OCL constraint, attached to Functions Communication is added.

Mapping Between the Standards VAM and the Design Rules VAM

Since design rules represent intermediate elements between the requirements and the architecture, the design rules VAM acts like a pivot between the standards VAM and the architecture variability model (VM). Fig. 3 depicts two extracts from both standards VAM and design rules VAM; and also the mapping between them. For instance, Separation between Systems of Different Classes in design rules VAM is related to Independence between Systems of Different Classes in standards VAM. This mapping is due to the fact that SA10 satisfies IEC 60709.1 and IEC 60709.

Mapping between the design rules VAM and the I&C architecture

An architecture metamodel is defined by one partner: the CEA, based on the different elements that characterize an I&C system of a nuclear power plant through a SysML profile. CEA uses the SysML modeler Papyrus with the Sequoia add-on for managing I&C architecture product line (see Fig. 4c). As mentioned earlier, industrial partners rely on design rules to validate the architecture against regulations. However, they do it for each derived architecture. Thus, we propose to consider both of the design rules VAM and the architecture VM during the derivation of a particular architecture.

Fig. 4 illustrates, first the binding between the architecture product line model and the corresponding feature model and then, the impact of the design rules VAM on the derived architecture. For instance, if we select Communication Without Perturbation in Fig. 4b, then we allow the communication between systems of different safety classes. Yet, the communication from a lower classified system to a higher classified system requires isolation: decouplingType (see OCL constraint). As shown in this figure, System communication architecture block in the derived architecture contains the following links: 1. from higher to lower classified system :from SICS (Class 1) to DSS (Class 2). 2. from lower to higher classified system: from PICS (Class 3) to RCSL (Class 2) by isolation means. 3. between equal classified systems: from PS A (Class 1) to SICS.

Considering the two OCL constraints in Fig. 4a left-hand side, we forbid the communication between functions of different lines of defense or from lower to higher classified function. As a result, Functional communication architecture block in the derived architecture contains a link from Monitoring LCO(Category: C NCAQ and Line of Defense: L1) to Elaboration signal control C2 (Category: NC and Line of Defense: L1).

APPLICATION OF THE APPROACH 7.1 Implementation

As mentioned earlier, we use CVL language and tool support for modeling variability in requirements and design rules, while CEA address modeling variability in the architecture using Sequoia tool. The goal of the Sequoia approach [START_REF] Deelstra | Product derivation in software product families: a case study[END_REF], developed by the CEA LIST is to help designers to build product lines based on UML/SysML models. Variability in Sequoia is defined through a UML profile [START_REF] Tessier | Using variation propagation for model-driven management of a system family[END_REF].

To specify an optional element, the designer simply adds the stereotype VariableElement to the item. The stereotype ElementGroup introduces additional information through its properties, such as constraints between variable elements. In Sequoia, the decision model is used as a guide enabling to analyze all available variants and paths leading to a completely defined product. Once the derivation activity is launched, the choices described by the decision model are proposed to the user as a series of questions. The output of this process is a completely defined product and the user is not able to make any kind of modification to the initial model until the derivation step is over. Table 4 summarizes the input data in the illustrative example provided by the industrial partners to implement our proposed method. The use case contains one generic project which includes all common element in the product line and three other projects containing the variable elements, specific for these three countries (products): France, UK and USA. In particular, it describes the following information for each country: 1. Safety Requirements: excerpts from national regulations and international standards. 2. Design rules with their corresponding OCL constraints implemented in the architecture 3. I&C Functions with with their various properties (safety category, line of defense, number of redundancies, etc). 4. Functions communications: describes the different communications between functions (unidirectional and bidirectional) 5. I&C Systems and their different characteristics (safety class, I&C level, line of defense, number of redundancies) 6. Systems communications: a derivation of functional communications on the system architecture. To complete the use case, our industry partners provided us an association matrix that maps requirements and design rules.

Use Cases

Metric

Requirements VAM Design Rules VAM #Features 64 46 # OCL Constraints 5 5

Table 5: Variability Models Properties Table 5 describes the main properties of the obtained variability models specific for our use case. Most of the features in both VAMs are mandatory. In fact, the challenge of our partners is not a customization of products, but, to maximize the common core to gain in terms of money and time during I&C systems certification.

Lessons Learned and Discussion

How to introduce variability modeling to nuclear engineers? In the group, Inria and All4Tec are considered as variability experts. Though the concepts of similarities and variabilities were roughly understood by our partners, we first had to introduce them to variability and, more specifically variability modeling. The aim of this introduction is to lay the foundation of the concepts but also identify the boundaries of the discipline. We set up several half to full-day workshops to allow our industry partners to localize where there will be valuable variability to model, and elicit what they expect from the variability modeling. From these inputs, we had been able to propose a dedicated variability training performed by one of the author, to build the bridge between initial industrial assumptions and current product line engineering practices.

What is the best variability modeling paradigm accordingly to the domain practices? We presented several different modeling paradigms, analysis capabilities, current limitations, etc. We discussed the choice of the modeling paradigm and the format of data that we will have to handle. Interestingly, CVL avoids the feature model (FM) terminology, while retaining FODA-like concrete syntax of FM. Since CVL is domain independent, it supports a broad range of types, including multiple instances, and a constraint language for expressing dependencies over these types. This terminology avoids the confusion caused by the ambiguous meaning of the term feature. Moreover, mapping to artifacts is a core objective of CVL and CVL stores the variability outside the base model, which allows the construction of an explicit common core for regulations.

How to deal with the search space in regulatory corpora and what is the right granularity level for modeling requirements variability?

As mentioned earlier, nuclear domain is complex because of the variety of documents one has to handle, the number of requirements they contain, their high level of abstraction and ambiguity, etc. Following a naive method leads to variability models with fine granularity, verbose, and as a result, hard to understand and maintain by our industrial partners. To narrow this problem space, the first idea was to analyze variability in regulatory documents by topic on different corpora and on the same abstraction level. Thus, our industrial partners proposed to apply this approach on two standards and for different topics. Furthermore, using traceability matrix improves the understandability and the maintainability of variability models.

How to address the requirements variability on the architecture? Modeling requirements variability is useful, however there is no direct mapping from requirements to the architecture. Therefore, we propose heading toward modeling variability in design rules since they act as a pivot between requirements and the architecture. The industrial partners rely on these rules to validate the architecture against safety requirements because they claim to satisfy one or several requirements. This idea allowed us to investigate the robustness of the architecture against regulatory requirements variability not considered by the product line and identify its impact on the architecture. Therefore, our industrial partners proposed a use case to implement our CVL approach for modeling variability in requirements and design rules and mapping them to the architecture.

RELATED WORK

Requirements and Variability Modeling.

Goaloriented approaches like Tropos [START_REF] Bresciani | Tropos: An agent-oriented software development methodology[END_REF], i* [START_REF] Yu | Towards modelling and reasoning support for early-phase requirements engineering[END_REF], KAOS [START_REF] Van Lamsweerde | Requirements Engineering -From System Goals to UML Models to Software Specifications[END_REF] or URN [START_REF] Ghanavati | Towards a Framework for Tracking Legal Compliance in Healthcare[END_REF] have been used to address legal and regulatory requirements and their mapping to the system elements. However, though goal models explicitely describes influences on requirements, they lack of a concrete variability understanding. As stated by Siena et al. [START_REF] Siena | Capturing variability of law with nomos 2[END_REF], goals applied to laws and regulations are useful when the complexity of the statements is little enough to be reduced to goal relations.

Mining Variability. Alves et al. [START_REF] Alves | An exploratory study of information retrieval techniques in domain analysis[END_REF], Niu et al. [START_REF] Niu | Concept analysis for product line requirements[END_REF], Weston et al. [START_REF] Weston | A framework for constructing semantically composable feature models from natural language requirements[END_REF] and Chen et al. [START_REF] Chen | An approach to constructing feature models based on requirements clustering[END_REF] applied information retrieval techniques to abstract requirements from existing specifications, typically expressed in natural language. Ferrari et al. [START_REF] Ferrari | Mining commonalities and variabilities from natural language documents[END_REF] applied natural language processing techniques to mine commonalities and variabilities from brochures. Our industrial context exhibits characteristics that makes the problem of mining variability difficult. Topic overlaps, absence of an ontology, intrinsic heterogeneity and ambiguity. Consequently, we have introduced lightweight manual techniques to gradually support participants. The question to determine whether automated techniques can provide a reliable support to the consortium is still open.

Analysing (Regulatory) Requirements Variabilities. Siena et al. proposed to address variability of law with Nómos 2 [START_REF] Siena | Capturing variability of law with nomos 2[END_REF]. The proposed metamodel mainly aims to understand influences or margins within selected "norms" (text fragments from laws). Zhang et al. [START_REF] Zhang | A Feature-Oriented Approach to Modeling Requirements Dependencies[END_REF] propose "specialization, characterization, decomposition" links for their requirements refinements; "require, mutex, excludes" links for the constraints, as well as influence and interaction depen-dencies. Maxwell et al. [START_REF] Maxwell | A legal cross-references taxonomy for identifying conflicting software requirements[END_REF] propose a taxonomy of crossreferences dedicated to the identification of conflicts between requirements. In both cases, the analysis remains manual and focused on selective and already defined sets of elements. One possible solution toward multiple jurisdictions can be to have the most constrained system possible. To this end, Gordon and Breaux [START_REF] Gordon | Reconciling multi-jurisdictional legal requirements: A case study in requirements water marking[END_REF] have developed a watermarking approach in order to determine the most constrained statement. Our goal is rather to capture all possible variations and keep flexibility.

CONCLUSION

With the renewal of the nuclear industry, the French nuclear energy industrials are aimed to sell and develop products outside France. A major challenge is the conformance of products to multiple different and heterogeneous regulations, which introduce a necessary product line perspective.

In this paper, we proposed an approach to model variability in safety requirements and I&C architectural design. Our approach provides a variability-aware bridging of these two levels of abstraction in order to derive a complying architecture. We instantiated our approach on a realistic use case. Participants of the nuclear consortium can now map the variability of regulatory requirements onto architecture elements. We provided some lessons learned about the introduction of variability into this particular domain.

We are currently improving the different variability modeling tools, based on the Common Variability Language, of both parts -requirements and architecture -of the project. As future work, we aim to investigate the use of automated techniques to mine variability in regulatory requirements. We also plan to further exploit traceability links in order to reason about the conformance between regulatory requirements and the architecture of the CONNEXION project.

Figure 1 :

 1 Figure 1: A two-stages approach (overview)

Figure 2 :

 2 Figure 2: Mapping between standards BM and standards VAM

  11 and SA54 satifies IEEE 384.1 and IEEE 384.5, at the same time, SA10 and SA54 are related to Separation between Systems of Different Classes (see

Figure 3 :

 3 Figure 3: Mapping between the standards VAM and the design rules VAM

Figure 4 :

 4 Figure 4: Mapping between Design Rules VAM and I&C Architecture

  To return to our previous examples of Section 5.1, in standards, IEC 60709.1, IEC 60709.11, IEC 60709.12, IEEE 384.1 and IEEE 384.5 are clustered to form Independence between Systems. IEC 60709.1, IEC 60709.11 and IEC 60709.12 are clustered to create Prevent System Degradation feature, while IEEE 384.1 and IEEE 384.5 are clustered to give Electrical Isolation feature. Table

Table 1

 1 SA10 (resp. SA54) completely satisfies IEC 60709.1 and IEC 60709.11 (resp. IEEE 384.1 and IEEE 384.5).

Table 1 :

 1 Mining variability in Independence topic

	Index	Information sample from IEC and IEEE standard Verbatim	Index	Rule	Design Rules	Countries
	IEC 60709.1	Systems performing category A functions shall be protected from con-sequential physical effects caused by faults and normal actions within	SA10	A lower classified system can not send information to a higher classified system	France and UK
		a) redundant parts of those systems, and b) systems of a lower category.		or at least it should not disturb any of
	IEC 60709.11	Failures and mal-operations in the non-category A systems shall cause		these features.
		no change in response, drift, accuracy, sensitivity to noise, or other
		characteristics of the category A system which might impair the ability
		of the system to perform its safety functions.
	IEC 60709.12	Where signals are extracted from category B or C systems for use in	SA12	A higher classified system can not directly	France
		lower category systems, isolation devices may not be required; however,		send information to a lower classified sys-	and UK
		good engineering practices should be followed to prevent the propaga-		tem.
		tion of faults.
	IEEE 384.1	Physical separation and electrical isolation shall be provided to main-tain the independence of Class 1E circuits and equipment so that the	SA54	different classes. No communication between systems with	US
		safety functions required during and following any design basis event
		can be accomplished.
	IEEE 384.5	1) Non-Class 1E circuits shall be physically separated from Class 1E cir-
		cuits and associated circuits by the minimum separation requirements
		specified in 6.1.3, 6.1.4, . . . 2) Non-Class 1E circuits shall be electrically
		isolated from Class 1E circuits and associated circuits by the use of iso-
		lation devices, shielding, and wiring techniques or separation distance.

Table 2 :

 2 Mining variability in Safety Classification topic

	Index	Information sample from IEC and IEEE standard Verbatim	Index	Rule	Design Rules	Countries
	IEC 60964.11

Table 3 :

 3 Identification of features from IEC and IEEE standards and design rules

	Features	IEC	IEC	IEC	IEEE	IEEE	IEC	IEC	IEC	IEC
		60709.1	60709.11	60709.12	384.1	384.5	60964.11	61513.3	61226.18	61226.3a
	ICSystem
	ICFunction
	Safety Classes
	IEC Classes
	IEEE Classes									Features	SA5 SA8 SA10 SA12 SA54 FA11 FA13
	Safety									Safety
	Categories									Classes
	IEC Categories									Sender Class
	IEEE									Receiver Class
	Categories									Safety
	Independence.									Categories
	Sys.									Sender Category
	Independence.									Receiver Category
	Sys.Diff.Classes									Sender LD
	Independence.									Receiver LD
	Redundant.									Separation.Sys.
	Parts									Diff.Classes
	Independence.									Separation.Func.
	Func.									Diff.Categories
	Diff.Categories									Separation
	Prevent System									.Func.Diff.LD
	Degradation									Communication.
	Prevent									Without. Pertur-
	Physical Effects									bation
	Prevent									No.Communication.
	Failure Effects									Sys.Diff.Classes
	Communication
	Separation
	Physical
	Separation
	Electrical
	Isolation

Table 3

 3 right-hand side) while IEC 60709.1, IEC 60709.11, IEEE 384.1 and IEEE 384.5 refer to Independence between Systems of Different Classes (seeTable 3 left-hand side).

Table 4 :

 4 Use Cases Data Description

	Data	Common Elements	Variable Elements France UK US
	# Requirements	21	13	15	9
	# Design rules	3	4	4	4
	# Functions	11	2	2	5
	# Functions Communications	9	2	2	4
	# Systems	19	0	0	1
	# Systems Communications	33	15	15	27

http://www.cluster-connexion.fr/

More details are provided in the following and in a previous work[START_REF] Sannier | Defining and retrieving themes in nuclear regulations[END_REF]

Acknowledgements

This work is partially supported by the French BGLE Project CONNEXION.


Dominique Guyonnet
email: d.guyonnet@brgm.fr

Mariane Planchon

Alain Rollat

Victoire Escalon

Stéphane Vaxelaire

Johann Tuduri

Primary and secondary sources of rare earths in the EU-28: results of the ASTER project

The ASTER project aims at establishing flows and stocks of certain critical rare earth elements at the scale of the EU-28, considering both primary and secondary sources. Material flow analyses were performed taking into account processes along the value chain (separation, manufacture, use, waste management) and including also lithospheric (geologic) stocks. While this paper focuses on fluorescent lamp phosphors (Tb, Eu, Y), a paper by Planchon et al. (this conference) addresses permanent magnets and batteries (Nd, Pr, Dy). Results suggest that given the magnitude of flows in the EU-28, the development of a mining project in Sweden and/or Greenland would contribute significantly to reducing heavy rare earth; e.g. Tb, criticality.

Introduction

Member state and European policies with respect to the safe supply of mineral raw materials aim at improving eco-efficiency [START_REF] Com | Roadmap to a resource efficient Europe[END_REF] . The objective of eco-efficiency is to increase the quantity of services per unit mass of raw material, while decreasing environmental impacts. One of the pillars of eco-efficiency is recycling. In order to efficiently position the development of innovative recycling processes, it is important to have a clear picture of flows of stocks of mineral raw materials all along the value chain. The on-going ASTER project, started in 2012 for a period of three years, aims at applying material flow analysis (MFA) to selected rare earth elements (REEs) for the EU-28. Certain rare earth elements are deemed "critical", as they combine importance for strategic sectors of the economy with risks of supply shortage [START_REF] Nrc | Critical Minerals, and the U.S. Economy[END_REF][START_REF] Ec | Critical raw materials for the EU[END_REF] . The recent JRC report [START_REF] Moss | Critical metals in the path ERES2014: 1 st European Rare Earth Resources[END_REF] identifies six critical REEs (Dy, Eu, Tb, Y, Pr and Nd) that are precisely the REEs that were selected for the ASTER project.

Given the importance of recycling, the ASTER project combines an "application" approach with an "element" approach. Table 1 shows the correspondence between the two. These three applications were selected because of their importance in terms of use of the selected REEs, and also because recycling processes for these applications either already exist or else are currently under development [START_REF] Binnemans | Recycling of rare earths: a critical review[END_REF] .

Methods

A systemic appoach

For the case of fluorescent light phosphors, the system that was analysed is described schematically in Figure 1. The figure illustrates a certain number of processes with, starting upstream in the value-chain: separation (S) of rare earth concentrates, fabrication (F) of trichromatic phosphor powders, manufacture (M) of fluorescent lamps (LFL and CFL; resp., linear and compact fluorescent lamps), use (U) of these lamps in the economy, waste management (WM) of end-of-life products and final elimination (landfill and/or dissipation in the environment). These various processes are linked by arrows that represent flows from one to another. Differences between flows into or out of a process imply an addition or subtraction to stock within the process. The dashed line in Figure 1 represents the limits of the studied system (the EU-28). However, an additional "process" appears in Figure 1 indicated as "L" (lithosphere). The lithosphere represents geological potentialities in the form of potential REE resources (as opposed to reserves 7 ). For geological and economic reasons, the limits of this process were taken as continental Europe (including the Scandinavian shield and the Kola Peninsula) plus Greenland. Therefore this process straddles the limits of the EU-28.

ERES2014: 1 st European Rare Earth Resources Conference|Milos|04-07/09/2014 3

It is important to note that the system analysed in this study is an "open" system: there are inflows and outflows to and from the system all along the value chain. This is in contrast with most previous REE MFA studies which have addressed global flows and hence a "closed" system 8 . In the latter case, flows can be "constrained" by world mining production, as reported by, e.g., the USGS. Flows were estimated over a number of years exceeding the expected average lifetime of the considered products (taken as 6 years for fluorescent lamps), in order to obtain estimates of in-use stocks. Year 2010 was selected as the reference year for the final results of the calculations.

Information sources

Data mining constitutes the main task of any MFA. Sources of information included statistical custom data (EUROSTAT, Global Trade Atlas, …), specialized reports [START_REF] Roskill | Rare Earths & Yttrium: Market Outlook to[END_REF][START_REF] Schüler | Study on rare earths and their recycling[END_REF] , USGS data [START_REF] Usgs | Mineral commodity summaries[END_REF] , company reports on product sales, etc. With respect to the upstream portion of the value chain, the same HS codes (listed in Table 2) were used as in the Öko-Institut report [START_REF] Schüler | Study on rare earths and their recycling[END_REF] . GTA data for Chinese exports based on 8-digit HS codes that are specific to individual REEs were also used.

These HS codes represent raw products that contain mixtures of REEs. In order to obtain data on individual REEs, a disaggregation method was applied [START_REF] Goonan | Rare earth elements -End use and recyclability[END_REF] . The method Certain data from EUROSTAT had to be corrected to account for the fact that Austria no longer reports its REE-related data after 2008. GTA data for Austria were disaggregated into imports and exports from intra-and extra EU-28, considering averages calculated over the pre-2008 period.

For the evaluation of geological potentialities in the lithosphere, over 350 deposits or occurrences located within the EU-28 were analysed [START_REF] Charles | Rare earth elements in Europe and Greenland: a geological potential? An overview[END_REF] . The mineralogical characteristics of these deposits and occurrences provide information regarding potential resources, the reliability of which depends largely on the state of progress of exploration projects. However, the objective was to provide orders of magnitude for potential resources (lithospheric stocks), that could be compared with the magnitude of flows in the EU economy.

Uncertainties and reconciliation

Information collected in the course of a MFA for critical metals is inevitably fraught with uncertainty. This uncertainty is typically of an "epistemic" (reflecting incomplete knowledge) rather than a "stochastic" (reflecting random variability) nature. Uncertainty implies that MFAs do not balance and therefore reconciliation methods are used [START_REF] Kelly | Techniques for solving industrial nonlinear data reconciliation problems[END_REF] . Such methods generally assume that uncertainty can be represented in the form of Gaussian probability distributions (see, e.g., the STAN software [START_REF] Brunner | Practical Handbook of Material Flow Analysis[END_REF] ).

However, epistemic uncertainty (such as typically ensues from expert-opinion) is more faithfully represented by the nested intervals (or fuzzy sets) of possibility theory [START_REF] Dubois | Possibility Theory: An Approach to Computerized Processing of Uncertainty[END_REF] . Therefore, as part of the ASTER project, a methodology was developed for reconciling MFAs under fuzzy constraints [START_REF] Dubois | A fuzzy constraint-based approach to data reconciliation in material flow analysis[END_REF][START_REF] Dubois | Data reconciliation under fuzzy constraints in material flow analysis[END_REF] . This methodology was presented in 2014 at a workshp on data reconcililation in MFA, the proceedings of which can be obtained upon request (e-mail on 1 st page of this paper).

ERES2014: 1 st European Rare Earth Resources Conference|Milos|04-07/09/2014 5

Some results to-date

Results presented herein are preliminary as the project is still on-going. An important deliverable of the project will be Sankey diagrams for the considered REEs. These diagrams are described qualitatively below for the case of REEs in fluorescent light phosphors.

A first step of the disaggregation procedure consisted in converting tons of products corresponding to the customs data for the HS codes of Table 2, into tons of rare earth oxide mixtures (REOs). The conversion factors were selected based on data from USGS [START_REF] Usgs | Mineral commodity summaries[END_REF] . For the metals and alloys (codes 280530), the conversion factor is 1.2 based on stoichiometric considerations. For codes 284610 and 284690, conversion factors were taken as, resp., 0.67 and 0.72.

Application of these conversion factors to historical imports and exports of raw products containing REEs in the EU-28 yields Figure 2. The significant decrease in imports observed in 2009 is interpreted as a consequence of the 2008 financial crisis. Application of the disaggregation methodology to these data provides information relative to flows F1 and F2 of Figure 1, which can then be compared with information provided by SOLVAY, the only company in the EU-28 to perform separation of REEs for trichromatic phosphors. Separation is also performed in Estonia by SILMET, but not for phosphor applications (mainly for Nd). Further to separation, SOLVAY produces phosphor precursors that are sent to process "F" (Figure 1) to produce ERES2014: 1 st European Rare Earth Resources Conference|Milos|04-07/09/2014 6 phosphors. Information relative to imports and exports of phosphors is obtained based on HS code 320650 (inorganic products of a kind used as luminophores, whether or not chemically defined). Expert information was necessary to define the typical composition of these phosphors, taking into account that the composition is different for imported versus exported phosphors (in and out of the EU).

Further down the value chain, data was collected for manufactured products containing trichromatic phosphors. two HS codes of Table 3 were used. Results of the analysis suggest that the orders of magnitude of Tb, Eu and Y flows in the EU-28 related to fluorescent lamp phosphors are resp., 10, 15 and 180 tons.

Taking into account the history of flows into use in the EU-28 over a period exceeding the expected average lifetime of the fluorescent lamps, in-use stocks for Tb, Eu and Y in 2010 are estimated as, resp., 140, 220 and 2300 tons. The annual additions to inuse stock in 2010 are estimated to be resp., +8, +13 and +140 tons/yr for these elements.

With respect to flows F13 and F14 in Figure 1 (recycling), there was no recycling in 2010 in the EU-28, as SOLVAY started its recycling operations (in Saint-Fons and La Rochelle, France) in 2012. As an indication, the order of magnitude of Tb recycled each year is a few tons per year.

These figures can be compared to geological potentialities derived based on the analysis of three important REE projects: the Norra Kärr project in Sweden and two exploration projects in Greenland (Kvanefjeld and Kringlerne). The Norra Kärr project is well advanced and has recently received the authorization to operate from the Swedish government. We estimate the resource of Tb at this site to be on the order of 2 000 tons. The potentials of Kvanefjeld and especially Kringlerne are far superior (resp. 10 000 and 110 000 tons Tb), however, the likelihood of these projects entering into production is much lower, due in particular to environmental constraints and social acceptability. Nevertheless, these figures suggest that if just one of these projects enters the production phase (with Norra Kärr as the most likely candidate), the criticality with respect to certain heavy REEs such as Tb will be significantly reduced. Detailed results of the ASTER project are currently in the process of being published. It is anticipated that the approach of associating both primary and secondary sources in the systemic analysis of critical metals will be applied to other substances (e.g., In, Ge, Ga, …), as is the case for projects that have already been initiated. It should be noted however that, as for REEs, data regarding such "small" metals are hard to come by. On the one hand, there is very little information available regarding reliable estimates of resources [START_REF] Wall | Rare earth elements[END_REF] for substances that are essentially by-products of carrier metals [START_REF] Verhoef | Process knowledge, system dynamics, and metal ecology[END_REF] . Also, considerable effort is still needed to quantify the quantities of these substances in products, where they may be present in very low concentrations (on the order of a ppm). Such information is crucial in order to evaluate the economic feasibility of recycling processes.

Figure 1 :

 1 Figure 1: Schematic of the system investigated in the case of fluorescent-lamp trichromatic phosphors. LFL = linear fluorescent lamps; CFL = compact fluorescent lamps

Figure 1 :

 1 Figure 1: EU-28 imports and exports of REOs based on EUROSTAT (and GTA for Austria post-2008 correction)

Table 1 :

 1 Correspondence between applications and REEs addressed in the ASTER project Nd are used in a variety of other applications, it was considered of lesser importance to examine, e.g., flows of Nd in ceramics, as there are currently no realistic prospects of recycling Nd contained in these products. In this paper, we adopt the following distinction between light (LREE) and heavy (HREE) rare earth elements

	Application	REEs
	Phosphor powders	Eu, Tb, U
	Permanent magnets Nd, Pr, Dy
	NiMH batteries	Nd
	While REEs such as

[START_REF] Wall | Rare earth elements[END_REF]

: -LREE : La, Ce, Pr, Nd, Sm ; -HREE : Eu, Gd, Tb, Dy, Ho, Er, Tm, Yb, Lu (plus Y).

Table 2 :

 2 the relative market shares of products containing REEs (e.g., auto catalysts, magnets, batteries, polishing powders, etc.) and the composition of the REE mixtures in each product. HS codes used for REE-containing products in the upstream portion of the studied system

	HS code	Description in EUROSTAT
	28053010	Intermixtures or interalloys of rare-earth metals, Scandium and Yttrium
	28053090	Rare-earth metals, Scandium and Yttrium (Excl. intermixtures or interalloys)
	28461000	Cerium compounds
	28469000	Compounds, inorganic or organic, of rare-earth metals, of Yttrium or of
		Scandium or of mixtures of these metals (Excl. Cerium)

ERES2014: 1 st European Rare Earth Resources Conference|Milos|04-07/09/2014 4 considers

Table 3 :

 3 HS codes for fluorescent lamps

	HS code	Description in EUROSTAT
	31501530	Fluorescent hot cathode discharge lamps (excluding ultraviolet lamps, with double ended cap)
	31501510	Fluorescent hot cathode discharge lamps, with double ended cap (excluding ultraviolet lamps)

  ConclusionsResults of the on-going ASTER project provide estimates of flows and stocks of certain REEs considered as critical. This paper addresses the results relative to REEs in fluorescent lamp phosphors, while another paper (Planchon et al., this conference) addresses Nd and Dy.The data collected to-date suggest a somewhat "reassuring" picture with respect to criticality of Tb, Eu and Y. It is the opinion of the authors of this paper that the crisis regarding REEs that was experienced in 2011 is essentially over. It is reminded that in july 2011, peak prices of Dy and Tb exceeded average prices over the period 2002-2009 by factors on the order of, resp., 20 and 10, as a result of stricter quotas on Chinese exports. Several factors have contributed to reducing the pressure on these substances. On the one hand, countries that import REEs have diversified their sources of supply of LREEs (e.g., Mount Weld in Australia and Mountain Pass in the U.S.). Also, there are currently considerable efforts devoted to optimizing the quantities of REEs used in products, as for example Dy in permanent magnets. Substitution is also an important issue. Regarding Tb, the development of LED lighting, which use very little REEs and virtually no Tb, will contribute in the future to reducing the pressure on this element.

	ERES2014: 1	st European Rare Earth Resources Conference|Milos|04-07/09/2014	7

Acknowledgments

The material presented herein was developed within the ASTER project, supported by the French National Research Agency; ANR (project ANR-11-ECOT-002).