P Poli

M Campillo

H A Pedersen

Polenet / Lapnet

Seismic noise tomography in regions with small velocity contrasts and strong noise directivity: application to the northern Baltic Shield

Ambient noise tomography (ANT) is widely used to image strong velocity variations within the upper crust . Using careful processing, we obtained a 3-D model of shear velocities in the upper crust beneath northern Finland, where the lateral velocity variations are less than 3%. As part of the tomography, the noise field is analysed. It is strongly heterogeneous but the signal to noise ratio is sufficient to obtain stable dispersion curves for all profile azimuths. Our results show that the directions of dominant noise sources of Rayleigh and Love waves are the same, but the amplitude distribution with azimuth is different for the two types of waves. More intriguingly, the high frequency Love waves are dominated by a mixture of higher modes rather than the fundamental mode. The reconstructed 3-D model shows the Lapland Granulite Belt as a high velocity body with a limit at surface in excellent agreement with geological observations at surface. Following this interface at depth, our results are compatible with previous studies suggesting an archean north oriented subduction.

1-Introduction

Ambient Noise Tomography (ANT) is a recently developed branch of seismology for which one major application is crust and upper mantle surface wave tomography.

Instead of relying in the presence of transient sources, ANT is based on correlation of a

random wave-field to extract the Green's function [START_REF] Campillo | Long-range correlations in the diffuse seismic coda[END_REF][START_REF] Shapiro | Emergence of broadband rayleigh waves from correlations of the ambient seismic noise[END_REF], Sabra et al. 2005a[START_REF] Pedersen | Influence of the seismic noise characteristics on noise correlations in the Baltic shield[END_REF][START_REF] Gouédard | Cross-correlation of random fields: mathematical approach and applications[END_REF]. With this technique, it is possible to overcome a series of classical problems in surface wave tomography, in particular the lack of homogeneous distributed transient sources, and the difficulty of extracting the high frequency part of dispersion curves in the case of distant sources. ANT is however not free of difficulties, related to the distribution of the noise sources. Firstly, the sources are mainly located at the surface. This may actually be an advantage to ANT as the extracted records are dominated by surface waves.

Secondly, as the noise sources are unevenly distributed at the surface [START_REF] Stehly | A study of the seismic noise from its longrange correlation properties[END_REF] the observed surface wave velocities may be biased [START_REF] Pedersen | Influence of the seismic noise characteristics on noise correlations in the Baltic shield[END_REF][START_REF] Yao | Analysis of ambient noise energy distribution and phase velocity bias in ambient seismic noise tomography, with application to SE Tibet[END_REF], Froment et al., 2010). Spectacular applications can be fund all over the world (e. g. [START_REF] Shapiro | High-Resolution Surface-Wave tomography from ambient seismic noise[END_REF], Sabra et al., 2005b[START_REF] Stehly | Tomography of the Alpine region from observations of seismic ambient noise[END_REF][START_REF] Ritzwoller | Ambient noise tomography with a large seismic array[END_REF]. Most studies have focused on areas with strong velocity variations (typically up to ± 5-20%), as those observed between sediments and bedrock. In such cases the possible bias and/or lack of precision in dispersion measurements using estimated Green's functions is smaller than the retrieved velocity variations in the model, and high-resolution tomography is robust, as shown by the similar results obtained by the two independent studies of Sabra et al. (2005b) and [START_REF] Shapiro | High-Resolution Surface-Wave tomography from ambient seismic noise[END_REF].

In the absence of sediments or if the crustal rock composition does not vary significantly across the study area, seismic velocities typically vary less than ±3 %. Examples of such challenging areas are cratons, which are presently subject to much attention as a key to understanding the evolution of the early Earth, and due to their strategic role for ore exploration. In this case, the lateral velocity variations may be smaller than the errors associated with ANT, so particular care must be taken during all processing steps to achieve a good signal to noise ratio for a wide range of azimuths. Recently, [START_REF] Prieto | On the amplitude information carried by ambient seismic field[END_REF] and [START_REF] Poli | Emergence of body waves from cross-correlation of seismic noise[END_REF] demonstrated that using small time windows is a more efficient way to ensure a good Green's function estimation than using 1-day time windows. These studies show that there are still significant improvements in ANT through refining the processing methods.

In this article we use ANT to obtain a 3D Vs model of northern Fennoscandia. This zone is a stable cratonic area where velocity variations from previous models are in the range of ±3% or less [START_REF] Janik | Crust-mantle boundary in the central fennoscandian shield: Constraints from wide-angle p and s wave velocity models and new results of reflection profiling in Finland[END_REF]. The complex geometry of tectonic units at the surface, leading to a variety of models for the tectonic evolution of the area, does not translate into lateral major velocity variations in the crust. The only 'major' velocity contrast observed on 2-D active seismic profiles is created by a high velocity upper crustal body (+3%) which is interpreted as a remnant slice of Archean crust, related with an Archean subduction event (Janik et al., 2009, and reference therein).

We firstly present the processing that we apply, after which we analyse the directivity of the noise field and the modal composition of the extracted surface waves. Special attention was given to the extraction of Love waves, as they give complementary information to the Rayleigh waves through different sensitivity, and insight to radial anisotropy. In this study we bring some additional understanding of the origin of these difficulties as the absence of sedimentary basins facilitates the interpretation of the observed Love wave. We subsequently measure group velocities for all station profiles and calculate group velocity maps for a series of frequencies. These group velocity maps are used as input to an inversion aimed at the 3-D model of shear velocities.

2-DATA PROCESSING AND NOISE WAVE-FIELD

We analyse seismic data continuously recorded during the POLENET/LAPNET temporary experiment [START_REF] Kozlovskaya | POLENET/LAPNET-a multi-disciplinary geophysical experiment in northern fennoscandia during IPY 2007-2008[END_REF] in northern Fennoscandia. The array configuration (fig. 1) is approximately a 2D grid with station separations that span from ~50 km to ~600 km. We used records for the calendar year 2008 during which the array was fully operational. Standard preprocessing was applied, including removing mean and data trend, pre-filtering, resampling to identical sample rate (5 hz) and deconvolution of the instrumental responses. In this section we present in some detail the processing used to estimate the Green's function after which we present the characteristics of the noise field.

2.1-Green's function estimation

To be able to extract Rayleigh and Love waves we calculated ZZ and TT noise crosscorrelations using vertical-vertical and transverse-transverse (TT) components. Since our goal was to obtain a good estimation of the Green's function, we compared the result of a series of processing methods, for which we present the main results. [START_REF] Poli | Emergence of body waves from cross-correlation of seismic noise[END_REF] used a processing procedure which effectively made it possible to extract the body wave part of the Green's function. Different from standard noise correlation processing, they used short time windows (4 hours) and pre-whitening of the data. No time domain (e. g. one-bit) normalization was applied, but all time windows were statistically analyzed and removed if amplitudes larger than 10 times the standard deviation of the data were fund. This approach was used to reduce the effect of transient sources and instrumental problems while obtaining a broadband correlation.

To quantify the benefit of using this processing we compared the resulting noise correlations with noise correlations obtained using 1-bit normalization, and using linear correlation without pre-whitening. In both cases we used the same rejection criteria of windows with high amplitudes. We here show the results using vertical component data The Signal to Noise Ration ('SNR') defines how the Greens function's emerge from the remnant oscillations of the noise:

SNR( j) = max(signal( j)) rms(noise( j)) R( j) = !( j, ref ) !(ref , ref )!( j, j)
where Signal(j) is the correlation function within the time window delimited by group velocities 3 and 4 km/sec and Noise(j) is the 1000 sec tail of the correlation function. In both Signal(j) and Noise(j) the correlation function is stacked over months 1 to j. SNR is averaged over the causal and acausal part.

Figure 2 shows R(j) and SNR(j) for the different types of processing. Firstly, we evaluate the benefit obtained by using 4 hours time windows as compared to 24 hours time windows. For both R (fig. 2-a) and SNR (fig. 2-b) we observe that correlations calculated with shorter time windows (green lines) converge significantly more rapidly than for longer time windows (green dashed lines) and that the signal to noise ratio is improved approximately by a factor of two.

The comparison of R and SNR for the processing of [START_REF] Poli | Emergence of body waves from cross-correlation of seismic noise[END_REF] using 4 hour windows (green lines) with one-bit correlation (blue lines) and linear correlation (red lines), calculated using 4 hour windows shows that the former provides a faster rate of convergence, with a SNR twice the one observed for one-bit or linear correlations.

Following these results, we proceeded to the calculation of the noise correlation as in [START_REF] Poli | Emergence of body waves from cross-correlation of seismic noise[END_REF].

2.2-Directivity of seismic noise

Since the SNR of the correlations is an estimate of the coherent surface wave energy contained in the noise wave-field, we use SNR to provide insight to the azimuth distribution of the incoming noise in different frequency bands.

In figure 3, the SNR for Love (blue lines) and Rayleigh (red lines) waves is reported as a function of azimuth, and for the period ranges 10-20s (Fig. 3-a) and 2-10s (Fig. 3-b). The SNR value is evaluated every 10° of azimuth, by averaging the SNR over a sliding 10° wide non-overlapping azimuth window. Individual traces may therefore have a smaller SNR than that reported onto this figure. The overall low SNR towards the south can be explained by the large distance to possible oceanic sources [START_REF] Stehly | A study of the seismic noise from its longrange correlation properties[END_REF] so wave attenuation plays a substantial role in reducing the observed energy. On the other hand, the differences between Love and Rayleigh waves do not have a straightforward explanation.

In spite of the variable SNR as a function of period, we consider SNR to be overall good, as it is higher than 10 for all azimuths. We attribute the differences with Friederch et al.

(1998) and [START_REF] Pedersen | Influence of the seismic noise characteristics on noise correlations in the Baltic shield[END_REF], who mainly identified noise sources in the Atlantic Sea, to the inclusion of the summer months in the analysis, and to the processing using short time windows. The influence of the processing might explain the difference with [START_REF] Kohler | Directionality analysis and Rayleigh wave tomography of ambient seismic noise in southern Norway[END_REF] who analysed noise correlations and source distribution in southern Scandinavia. These authors used running absolute mean normalization over 15 minute windows, and they used data from a 20 months recording period.

When we measure group velocities in narrow frequency bands, a large scatter is however present for the azimuths with relatively low SNR. To avoid this problem, we add the correlation traces of positive and negative times for each profile, prior to group velocity analysis. Figure 4 shows that this procedure yields consistent group velocities for all profile orientations, with only a small number of outliers, mostly for N-S oriented profiles. There is no indication of systematic bias due to localized sources. The improvement as compared to [START_REF] Pedersen | Influence of the seismic noise characteristics on noise correlations in the Baltic shield[END_REF], who showed strong azimuth dependence for some frequencies, is likely to be due to a longer recording period in our study, as we use 12 months of data, while Pedersen et al. only had data available from the six months winter half year. The major implication of our noise directivity analysis and the good to excellent SNR is that we can measure reliable dispersion curves for all profile orientations.

In figure 5 we show the spectrogram of the correlations with the aim at understanding which modes dominate the noise field. We used the two profiles, oriented N-S and E-W, using the most distant stations available for these azimuths. For each profile we observe that the ZZ component (figs 5-a and 5-c) is dominated by fundamental mode Rayleigh waves. The TT component (figs 5-b and 5-d) shows a more complex behavior. At periods larger than 10 sec, the TT component is dominated by fundamental mode Love waves, while we observe a mix of higher modes at shorter periods. The sum of these higher modes could be interpreted as Lg waves (e.g. [START_REF] Campillo | Propagation and Attenuation of Crustal Phase Lg[END_REF]).

Due to frequency-time analysis smoothing, the mix of higher modes of the Love waves is not easily identified in more complex tectonic settings, so erroneous interpretation of apparently continuous dispersion curves could easily occur. Our results show that the use of Love waves at periods shorter than 10s may not be feasible in many cases. One implication of a misidentification of the mode associated with the high frequency part of the TT dispersion curve could be a Rayleigh-Love discrepancy, which would be interpreted as radial anisotropy of the upper crust. In our case, this apparent discrepancy would lead to approximately 4% anisotropy ((VSH-VSV)/ VSV) in the top 10km of the crust.

Once the periods shorter than 10s were discarded, the period interval over which we obtained reliable dispersion curves for the Love waves was too narrow to give any additional information to the inversion. We therefore focus the tomography on the analysis of the fundamental mode Rayleigh waves.

3-FROM NOISE CORRELATION TO GROUP VELOCITY MAPS

Once the periods shorter than 10s were discarded, the period interval over which we obtained reliable dispersion curves for the Love waves was too narrow to give any additional information to the inversion. We therefore here focus the tomography on the analysis of the fundamental mode Rayleigh waves as observed on the ZZ component. We firstly measure dispersion curves for all station pairs after which we invert these dispersion curves to obtain group velocity maps for the study region.

3.1-Dispersion measurements

Out of 861 ZZ correlation functions calculated, we retained the 745 with SNR ratio higher than 10 for either positive or negative times (or both). These correlations were averaged between the causal and acausal part prior to dispersion measurements. We used multiple filter analysis [START_REF] Levshin | Seismic surface waves in a Laterally inhomogeneous Earth[END_REF] to automatically measure the group velocity dispersion curve. The fundamental mode Rayleigh wave was isolated using a cosine time domain window centered on predicted group velocities from an average crustal model of the area [START_REF] Poli | Emergence of body waves from cross-correlation of seismic noise[END_REF].

Dispersion measurements were carried out in a period range of 1 to 50 sec. For each profile we excluded periods beyond which the profile length was smaller than two wavelengths. At periods longer than 25s, this criterion reduced the number of profiles to only the very longest ones, with a dominance of N-S oriented profiles, as the array dimension is bigger in this direction. We therefore decided to exclude periods longer than 25s from the tomography to avoid N-S smearing.

Finally, outliers where removed trough statistical analysis of the group velocity for each period. All velocity measurements that did not fall within two standard deviations of the mean (see also fig 4) were discarded.

3.2-Calculation of group velocity maps

We inverted our dispersion measurements following the tomographic approach proposed by [START_REF] Barmin | A Fast and Reliable Method for Surface Wave Tomography[END_REF], and we refer to this reference paper for a detailed description. The method is based on the minimization of a penalty function composed by a linear combination of data misfits, model smoothness and magnitude of perturbations.

A priori parameters are defined to regularize the solution. The spatial smoothing is controlled by two parameters α and σ where σ defines the width of a Gaussian smoothing function and α is the weight given to the spatial smoothing term of the misfit function. The magnitude of the model perturbations is controlled by the parameter β and λ, the latter defining the weight of path density.

As we only analyse the results in the areas with good path coverage, the smoothing was mainly controlled by α and σ. After verifying that λ and β did not affect the final solution in the well resolved parts of the model, they were set to respectively 1 and 0.4. The correlation length σ is defined to be of the same size of the cells used for the initial tomographic scheme, that is 25 km.

Finally, we chose the value of α based on the variation of the penalty function with α ('Lcurve'). Our preferred value of α was chosen to be near the maximum curvature of the L-curve.

Figure 6 shows the group velocity maps at 3, 8, 10 and 15 sec period. At 3 sec period, a high velocity anomaly is present in northeastern corner of the model while the central part of the map is dominated by homogeneous velocities. The limit of the high velocity anomaly coincides with the edge of the Lapland Granulite Terrane ('LGT'). At 5 (fig. 6-b) and 8 (fig. 6-c) sec period, the LGT is still present even though the velocity variations are smaller than at 3 sec period. At 15 sec period, the LGT is still visible, but with a small amplitude and shifted towards the NE.

The spatial resolution of the tomographic model was calculated using the method by [START_REF] Barmin | A Fast and Reliable Method for Surface Wave Tomography[END_REF]. Figure 7 show the spatial resolution for the group velocity map at 5 sec period. The maximum resolution is better than 50km in the center of the array. The resolution decreases towards the edge of the array. We will subsequently invert the group velocity maps in areas with a resolution better than 100km, but over most of the model the resolution is better than 50 km.

4.-3D Vs MODEL

Starting from the group velocity maps, we extracted a dispersion curve at each point of the model. All dispersion curves were then inverted to obtain S wave velocity, using a linearized inversion scheme (Hermann and Ammon, 2006). By combining the 1-D Vs(z) profiles we obtain a 3D Vs model.

4.1-Depth Vs inversion

Prior to the inversion at each grid point, we inverted the average group velocity b). During this inversion we used as input a slightly modified version of the model proposed by [START_REF] Poli | Emergence of body waves from cross-correlation of seismic noise[END_REF]. The difference resides in the discretisation of the upper crust, for which [START_REF] Poli | Emergence of body waves from cross-correlation of seismic noise[END_REF] did not have any resolution. We discretized the upper crust (down to 28 km depth) using 17 layers, of varying thickness from 1 km to 5 km as function of depth. Between 28 km depth and Moho, at 46 km depth, we use a single layer of 18 km thickness.

With the limited depth resolution of the fundamental mode Rayleigh waves, we impose smooth velocity variations with depth within the top 17 layers. The velocity is allowed to take a large range of values (± 0.2 km/sec) as long as the depth variation is smooth. This will lead, within the given model parametrisation, to a very well defined solution.

We only allowed for small velocity variations (± 0.02 km/sec) in the thick lowermost crustal layer while mantle velocities were kept constant at a value of 4.54 km/s. We verified that these constraints on the deep structure did not significantly change the upper crustal structure. In view of the subsequent inversion for Vs(z) in each grid point, we verified that small to moderate errors in Moho depth (± 5 km) did not influence the upper crustal structure.

The average model of figure 8-a was used as starting point for the inversion in each grid point. Even though the influence on upper crustal structure is negligible, we adapted Moho depth at each point using results from a receiver function study based on the LAPNET array (Silvennoinen et al., in prep.). Depth constraints were the same as those imposed for the inversion of the average dispersion curve. The data fit was good for all the grid points. The average data misfit over all grid points and periods is 0.01 km/sec.

4.2-Vs maps and sections

Our 3D shear velocity model is presented in figure 9 as horizontal slices at different depths and vertical cross sections. The overall velocity variations are smaller than ±3% with respect to the average velocity model, with lateral variations mainly present in the upper crust, in agreement with [START_REF] Janik | Crust-mantle boundary in the central fennoscandian shield: Constraints from wide-angle p and s wave velocity models and new results of reflection profiling in Finland[END_REF]. Due to the limited period interval, we will here focus our discussion to the upper 25 km of the crust. The main features of the Vs-model are the body of high velocities in the NE corner (up to +2.5%) and a less pronounced low velocity anomaly (reaching up to -1.5%), most pronounced towards the SE.

The limit of the dominating high Vs anomaly coincides at surface with the edge of the Lapland Granulite Terrane (LGT). The lower limit of the high velocity body is almost vertical at the edge, flattens at approximately 10-15km depth, and finally dips more steeply towards the N-NE. Despite limitations in our resolution, we observe that this geometry is in excellent agreement with results from an active seismic experiment approximately located along profile B-B' (e.g. [START_REF] Janik | Crust-mantle boundary in the central fennoscandian shield: Constraints from wide-angle p and s wave velocity models and new results of reflection profiling in Finland[END_REF]), while our results additionally provide insight on the 3-D geometry of the interface.

The southern low velocity anomaly does not bear direct link to the surface geology. On the other hand, within the same geological units (Karajok-Kittila Greenston Belt, Central Lapland Complex, Granitoid Complex), we observe resolved differences between the low velocity anomaly towards the south, and slightly higher velocities in the western part of the study area. The low velocity anomaly dips down beneath the high velocity body associated with the LGT. Our results are therefore compatible with recent tectonic models by [START_REF] Daly | The Lapland-Kola orogeny: Paleoproterozoic collision and accretion of the northern fennoscandian lithosphere; in European Litosphere Dynamics[END_REF] and [START_REF] Janik | Crust-mantle boundary in the central fennoscandian shield: Constraints from wide-angle p and s wave velocity models and new results of reflection profiling in Finland[END_REF].

5-CONCLUSIONS

Ambient Noise Tomography here provides constraints on the 3-D geometry of the Archean-Proterozoic contact in northern Finland, as defined at the surface by the edge of the Lapland Granulite belt. Our tomography is in agreement with recent active seismic imaging and tectonic models which imply a north oriented subduction as proposed by [START_REF] Daly | The Lapland-Kola orogeny: Paleoproterozoic collision and accretion of the northern fennoscandian lithosphere; in European Litosphere Dynamics[END_REF] and Janik et al. (2007). Our results demonstrate the value of ANT for seismic imaging also in areas with very small lateral velocity variations, such as cratons.

The robustness of the imaging is dependent upon careful correlation processing and analysis of the noise field. The use of short time windows [START_REF] Prieto | On the amplitude information carried by ambient seismic field[END_REF][START_REF] Poli | Emergence of body waves from cross-correlation of seismic noise[END_REF]Seats et al., 2012;this work) seems particularly adequate to improve the estimate of the Green's function, as it is possible to reject high amplitude signals without strongly decreasing the amount of data. With this approach it is no longer necessary to apply any time normalization such as 1-bit processing or dividing by the moving average of the signal amplitude. An additional advantage is that the output correlations are broadband, so it is relatively easy to retrieve a reliable and continuous group velocity dispersion curve.

To confirm the strong benefit of our processing, a presence of homogeneous coherent noise energy is systematically observed over all azimuths. Comparison between Rayleigh and Love waves yield compelling results that are not yet understood. A first important point is the complex behavior observed for short period Love waves. TT components are dominated by a mix of higher modes which could possibly be interpreted as Lg waves. Even though we cannot yet provide a satisfactory explanation for the observations, our results indicate that ANT cannot automatically be applied to the TT component of correlations at this stage.

Concerning the noise distribution, we observe that energy is incoming for similar azimuths for the two types of waves, but the amplitude is different between Rayleigh and Love waves. Noise generation of Rayleigh waves can be explained in terms of vertical pressure variations induced by nonlinear wave-wave interaction between ocean gravity waves [START_REF] Longuet-Higgins | A theory of the origin of microseisms[END_REF][START_REF] Hillers | Global oceanic microseism sources as seen by seismic arrays and predicted by wave action models[END_REF]. This mechanism is not directly applicable to the generation of Love waves. Love waves are excited in presence of horizontal forces [START_REF] Fukao | Seafloor topography, ocean infragravity waves, and background Love and Rayleigh waves[END_REF][START_REF] Saito | Love-wave excitation due to the interaction between a propagating ocean wave and sea-bottom topography[END_REF]

  from two stations located approximately 200 km apart. Two parameters were defined to estimate the quality of the obtained Rayleigh wave GF. The correlation coefficient ('R') provides the convergence rate in time (months) towards a reference correlation function ref: 109 where Θ (j,ref) is the correlation between correlation j and the reference correlation ref, and C(j,j) and C(ref,ref) are their autocorrelations. Here ref is the reference correlation (averaged over 12 months) and j the correlation function averaged over months 1 to j.

  At long period (fig 3-a), Rayleigh waves have high SNR for most azimuths, with a clear decrease of SNR towards the S-SE and a minimum SNR, of approximately ten, between 100° and 200°. The Love waves also have a minimum in this azimuth interval, but SNR is significantly higher towards the west than towards the east. At short period (fig 3-b), Rayleigh waves have a similar pattern as for long periods, but SNR are different by a factor of two towards south to west (SNR<150) as compared to the east (SNR<70). Love waves on the other hand have a pattern opposite to what is observed at long periods, with the highest SNR towards the east (SNR<50) and lowest towards the west (SNR<25).

  dispersion curve (fig 8-a) to define an average crustal Vs structure for the region (fig 8-

  Fig 1: Map of the study area: red triangles are the seismic stations.

Figure 2 :

 2 Figure 2: comparison of the different processing: a) R-value as function of time

Fig 3 :

 3 Fig 3: SNR as function of azimuth for the period range a) 20-10 sec b) 10-2 sec. Red

Fig. 4 :

 4 Fig. 4: azimuthal distribution of measured group velocity for Rayleigh waves (a-b) and

Fig 6 :

 6 Fig 6: group velocity map for different periods (indicated over each map). Black lines are

Figure 7 :

 7 Figure 7: resolution map for 5 sec period Rayleigh waves group velocity model.

Figure 8 :

 8 Figure 8: a) average shear velocity model of the area with the associated variance (red

Figure 9 :

 9 Figure 9: Vs velocity maps at 5 a), 10 b) and 15 km c) of depth. Dashed lines in figure a)

(programs No 5 and No 9). The Equipment for the temporary deployment was provided by: RESIF -SISMOB, FOSFORE, EOST-IPG Strasbourg Equipe sismologie (France), Seismic pool (MOBNET) of the Geophysical Institute of the Czech Academy of Sciences (Czech Republic), Sodankyla Geophysical Observatory (FINLAND), Institute of Geosphere Dynamics of RAS (RUSSIA), Institute of Geophysics ETH Zürich (SWITZERLAND), Institute of Geodesy and Geophysics, Vienna University of Technology (AUSTRIA), University of Leeds (UK). POLENET/LAPNET data were prepared and distributed by the RESIF Data Center. The POLENET/LAPNET working group consists of: Elena Kozlovskaya, Teppo Jämsen, Hanna Silvennoinen, Riitta Hurskainen, Helle Pedersen, Catherine Pequegnat, Ulrich Achauer, Jaroslava Plomerova, Eduard Kissling, Irina Sanina, Reynir Bodvarsson, Igor Aleshin, Ekaterina Bourova, Evald Brückl, Tuna Eken Robert Guiguet, Helmut Hausmann, Pekka Heikkinen, Gregory Houseman, Petr Jedlicka, Helge Johnsen, Elena Kremenetskaya, Kari Komminaho, Helena Munzarova, Roland Roberts , Bohuslav Ruzek, Hossein Shomali, Johannes Schweitzer, Artem Shaumyan, Ludek Vecsey, Sergei Volosov. velocity variation in % respect to the average model. LGT Lapland Granulite Terrane, KGB Karasjok-Kittila Greenstones Belt, CLC Central Lapland Complex, GC Granitoid complex.


Julien Deantoni

Frédéric Mallet

ECL: the Event Constraint Language

Keywords: CCSL, OCL, time constraints, semantics, MoC CCSL, OCL, contraintes temporelles, sémantique, MoC

In Domain Specific Modeling Languages, the metamodel captures the domain concepts and their relationships. The Object Constraint Language (OCL) can be used to add structural invariants or to describe pre and post conditions on method calls. However, both OCL and current metamodeling languages fail in specifying concurrency, causality relationships and timed behavior of the models. In this report, we present a model-driven approach to a formal and explicit specification of causal and timed relationships within models by extending the OCL. We describe our domain-specific modeling language dedicated to the definition of such behavioral invariants and illustrate its use on simple use cases.

Introduction

Models abstract away complex systems to focus on the relevant aspects only. An adequate abstractions should allow early validation/verification of the system. Consequently, the model and its underlying semantics are often specific and driven by the expected kinds of analyses and the nature of the properties to be verified. In many domains, models abstract the relative orderings of actions whose execution order are of prime importance: business process models, web services orchestrations, real-time/critical systems. . . Since the mid 70s, computer science has used various kinds of models to abstract systems and perform analyses [START_REF] Deremer | Programming-in-the-large versus programming-in-the-small[END_REF]. These models were first described by specific-purpose languages, now called Domain-Specific Languages (DSL). DSLs define relevant entities pertaining to the target domain. These entities are coupled by domain specialists with a formal behavioral semantics [START_REF] Faucou | An ADL centric approach for the formal design of real time systems[END_REF][START_REF]Definition of language for automotive embedded electronic architecture[END_REF][START_REF] Vestal | MetaH user's manual -version 1[END_REF][START_REF] Feiler | The SAE avionic architecture description language (AADL) standard: A basis for model-based architecture driven embedded systems engineering[END_REF][START_REF] Allen | A formal approach to software architecture[END_REF][START_REF] Farines | The Cotre project: rigorous development for real time systems in Avionics[END_REF].

Nowadays, creating a DSL is well accepted and has been popularized by the tooling facilities provided by the MDE technologies. A metamodel defines concepts and relations of A specific language and can be used to generate powerful editors and programming interfaces. However, the help is mainly provided for the definition of structural models (i.e., static models) but little help is given to ease the simulation/execution of the models. Among the approaches that provide tooling to specify the (meta)model dynamics [START_REF] Muller | Weaving executability into object-oriented meta-languages[END_REF][START_REF] Omg | Object Constraint Language, Version 2[END_REF][START_REF] Cariou | Contracts for model execution verification[END_REF], either the models can be executed/simulated only at the very last stage of the development process (once all model behaviors are encoded) or they fail to capture concurrency and loosely synchronized systems (like required for distributed or multi-core systems). Additionally, executable models often "implement" a specific solution while the problem could accept various ones. This is mainly related to the fine granularity of the description needed by existing tools to make the model executable.

An alternative to defining a DSL is the Unified Modeling Language (UML) [START_REF] Omg | Unified Modeling Language, Superstructure, Version 2[END_REF], a general-purpose modeling language. Several UML profiles have been defined to extend the UML with stereotypes that denote relevant domain-specific entities. Applying a stereotype to a model element maps this model element to a domain entity, therefore enforcing the commonly accepted domain entity semantics. Some tooling can then be reused (e.g., the graphical editors) but simulators/analysis tools still have to be developed according to the domain semantics.

What is missing in the current modeling approaches (DSL and UML-based) is an executable semantic model that captures within the same technological space and explicitly, the behavioral invariants to which the domain model must conform, i.e., the constraints under which the model is amenable to analyses. Such behavioral constraints on the model should not over restrict the future model refinement/implementation and should be given from the very first stages of the development process. They should encapsulate, formally and explicitly, the behavioral semantics of a model for a specific domain but should not be a programming language that encodes a specific usage of the domain concepts. In this paper, we propose to add the possibility to specify behavioral invariants on a model by slightly extending the Object Constraint Language (OCL [START_REF] Omg | Object Constraint Language, Version 2[END_REF]). Models built with the approach are amenable to formal analysis and can be used either in simulation to bring confidence in the developed model or used as a reference model when transformations are performed to other analysis-specific formal languages. The proposed behavioral invariants focus on event ordering but can be complemented by the already existing features of OCL like pre/post conditions.

The next section gives the rationale for this work. Section 3 discusses related approaches. Section 4 describes our proposal: a language dedicated to the definition of behavioral invariants, and its integration within OCL. The approach is illustrated by the specification of some behavioral invariants on a DSL and a UML model.

Motivations and prerequisites

Being able to constrain the relative execution ordering of actions in a model is of prime importance to conduct analysis. More precisely, depending on the execution constraints considered, some analyses are possible while others are not. The meaningful constraints as well as the associated analysis techniques have been largely studied in various domains [START_REF] Edwards | Design of embedded systems: formal models, validation, and synthesis[END_REF][START_REF] Grötker | System design with SystemC[END_REF][START_REF] Jantsch | Modeling embedded systems and SoC's: concurrency and time in models of computation[END_REF]. The so-called Models of Computations (MoC) largely focus on the events while data are very often left aside This is the case, for instance, for synchronous approaches where the clock calculus is at the center of the process [START_REF] Benveniste | The synchronous languages twelve years later[END_REF] that entirely depends on the synchrony hypothesis. This is also the case in real-time scheduling theory, where the hypotheses are quite different. Assuming regular execution of tasks (periodic, sporadic), the model can be analyzed with exact or approximate analytical approaches. Our goal is to provide a formalism to capture the hypotheses taken and the synchronization constraints as part of model driven engineering.

The Object Constraint Language (OCL [START_REF] Omg | Object Constraint Language, Version 2[END_REF]) is already largely used to capture constraints on (meta)models. The OCL is a declarative textual language that provides constraints and object query expressions on any MOF model or meta-model. These constraints can be either invariants or pre/post conditions on the behaviors. Invariants are used to specify structural restrictions on the instances of the model on which they are specified. The pre/post conditions are used to specify contracts on the state of the system before and after the execution of a specific behavior. The language intends to be simple enough to be used by any designer while being formally defined.

The OCL is said to be side effect free in the sense that the evaluation of constraints never modify the state of the system. However, it is possible in OCL to define new attributes and methods on (meta)classes. These definitions can then be used in the specification of constraints. For instance in the example 1, the number of children of a Person is stored in a new integer attribute, named nb_children for each Person object. The integer is initialized with the size of the children collection of the Person (meta)class: Such attributes can then be used in any constraints as if they were part of the (meta)model. It is also possible to define temporary variables to ease the reading of constraints. For instance, in the example 2, a temporary variable maxChildrenNumber is used in the invariant expression but cannot be used anywhere else. Additionally, in this constraint the attribute previously defined is used. Our motivation comes from the fact that some simple behavioral constraints cannot be expressed in OCL. Such constraints have to hold all along the execution and we call them behavioral invariants. A first example of behavioral invariant could be: "for all components, output data ports are always produced simultaneously". A second different example can be: "For concept C1,it is only possible to call one method at a time, i.e., methods cannot be called concurrently". This behavioral invariants may be applicable to every model of the domain and may be expressed at the metamodel level. These kinds of constraints cannot be specified in OCL while they are really important for the understanding of the metamodel behavior.

There also exists application-specific behavioral invariants. They can be related to performance issues (e.g., deadline) or to specific synchronization mechanisms dictated by the application (consider vehicle Inria indicators for instance). They can also reflect the good way to use a concept of the model. For instance, an application-specific behavioral invariant is: "The init() method must be called first, before any other method". If specified on a UML model, this last behavioral invariant can be expressed in OCL but by putting a precondition on every other method than init(). It makes this simple constraint difficult to understand and it reflects badly the goal of the constraint. Additionally, because the specification of this constraint in OCL has to use 'messages' it cannot be specified on a domain specific model.

In order to enable the specification of behavioral invariants, we want to slightly extend the OCL with the possibility to define event attributes and temporary events. These events specify interesting events in the (meta)model (e.g., the call of a behavior, the reception of a data on a port, or any other (meta)model specific events). They may not be specified in the metamodel because they are used only to specify the behavioral semantics of the model and are not concepts of the modeled domain. Adding them directly in the model would over complexify the model for no reason. By making events explicit, it is possible to specify behavioral invariants on them (and particularly the ones under which the system is amenable to analysis). These behavioral invariants must be specified by using a formal but intuitive language to stay aligned with the OCL.

Amongst the benefits expected from such an extension of the OCL, we can cite, model simulation / animation at a high abstraction level (without precise specification of any data-dependent behavior), transformation checking, execution trace verification, generation of observers for the implementation, easier communication among domain specialists.

The next section describes related works that focus either on the extension of the OCL or on the explicit specification of behaviors at the metamodel level.

Related works

Our approach aims at extending the OCL so that the specification of behavioral invariants. Our goal is to specify the synchronization relationships amongst the events of a model. There exist various approaches that extends the OCL to enhance the behavioral constraint expressiveness. First we want to avoid ambiguity by stating that our goal is clearly not to put (some of) the temporal logic operators in the OCL; this has already been done in other approaches [START_REF] Cengarle | Towards ocl/rt[END_REF][START_REF] Bradfield | Enriching ocl using observational mu-calculus[END_REF][START_REF] Ziemann | Ocl extended with temporal logic[END_REF]. Adding temporal logics to the OCL is a good way to take benefits from a very expressive and formal language. However, it gets a rather low acceptance due to the complexity of temporal logics itself and the lack of abstraction mechanisms of such approaches. An alternative approach has been proposed by Flake et al. [START_REF] Flake | Enhancing the message concept of the object constraint language[END_REF]. It consists in enhancing the OCL message-related concepts to add expressiveness on the pre/post condition constraints. The authors highlight the lack of expressiveness of the OCL behavioral constraints and proposes a clean and formal integration with the OCL semantics. Almost the same approach has been conducted in [START_REF] Kyas | On message specifications in ocl[END_REF]. Two main drawbacks of these approaches have been identified. First, by focusing on the message-related concepts of OCL, they restrict the use of their approach to the UML. It is not possible to use any message-related concept on a DSL. It is also a problem of OCL itself, whose utilization is, nowadays, not intended to be limited to the UML. The second drawback of the approach is that, by using pre/post conditions to specify the synchronization, it is difficult to specify synchronizations that must be respected independently of a specific behavior. For instance constraints due to the allocation of various components on a single processor or on the contrary due to the allocation on a distributed platform cannot be easily specified since they cannot be directly associated with a specific behavior or message call.

Cariou et al. [START_REF] Cariou | Contracts for model execution verification[END_REF] proposed an approach to specify the semantics of models by using the OCL. While we share with them the same goal, they chose to do it by using a contract-based approach (i.e., by using the pre/post conditions). An interesting point shared with [START_REF] Crégut | Generative technologies for model animation in the topcased platform[END_REF] is that they highlight the need to add some data used only to represent the dynamic state of the system. Consequently, they add specific methods to process these data and more precisely to specify (by using pre/post conditions) when the other behaviors can or cannot be called. For instance they add a run_to_completion() method to a state machine to specify contracts on the system state before and after the execution of the method. Their preconditions mainly rely on the concepts of UML events and it is not clear how it can be used in a DSL where such events do not exist. Also, because they use OCL without any extensions, they suffer from the same restrictions as the one identified by approaches that worked on OCL extensions: no message manipulation outside of the UML, poor synchronization capabilities, no way to specify concurrency explicitly and no operators to handle time.

All the proposed approaches use mechanisms based on pre/post conditions to specify the behavioral aspects of models. We believe that it is important to introduce explicit events and behavioral invariants to complement such approaches. Explicit events create a mandatory bridge between the static aspects of a metamodel and its dynamics (as stated in [START_REF] Crégut | Generative technologies for model animation in the topcased platform[END_REF]). Behavioral invariants specify constraints that must be true independently of any method call. For instance, we want to be able to specify that two components allocated on a single CPU cannot be concurrent without giving any detail on the actual "behavior" of the CPU. The goal of behavioral invariants is to specify the acceptable (partial) orderings between the occurrences of the events and consequently has strong relations to the notion of MoC.

Finally, when speaking about making domain-specific executable models, we should mention Ker-Meta [START_REF] Muller | Weaving executability into object-oriented meta-languages[END_REF]. KerMeta is a metamodeling language, which allows structural and behavioral semantics to be defined directly within a metamodel. By using aspect-oriented modeling, KerMeta is well integrated in a modeling process. A classical use of KerMeta consists in specifying the behavioral semantics as aspects of a specific metamodel. The KerMeta framework is then able to weave the aspects into the Domain Specific Metamodel and each model that conforms to this metamodel is then an executable model. KerMeta has a great expressiveness that allows general descriptions and data manipulation but this expressiveness is achieved by using a java-like language. This language is too much operational and is used to implement a specific solution rather than to specify and declare a set of possible solutions. This way it is not possible to specify behavioral invariants directly. Such invariants would represent a large set of acceptable executions, like causality relationships for distributed systems. Obviously such invariants can be encoded in the KerMeta language but the invariants should be accessible as first-class citizens if analyses have to be conducted. Also KerMeta does not support timed invariants or concurrency operators (like periodic execution, parallel execution, deadline, etc.). However, the aspect-oriented feature of KerMeta is an elegant way to weave in a metamodel the data that represent the system states as well as the behaviors that process these data during the execution. For these reasons, we are currently studying a merge of both approaches: KerMeta for data manipulation, explicit events to refer to actions on these manipulations (call, start, suspend. . . ) and the behavioral invariants to specify the orchestration of these manipulations in a non restrictive way.

Proposition

We want to be able to specify behavioral invariants on structural metamodels and models. To do so, we use the notion of event, an event being a totally ordered set of event occurrences. The behavioral invariants are then specific kinds of OCL expressions that restrict the (partial) ordering of the event occurrences in the system. The language used to specify the behavioral invariants must be formal but easy to use by any designer. Additionally the expressiveness of the language must allow various kind of constraints to be specified, from loosely to very strong synchronizations between the events. Finally, to match the OCL style, this language must be declarative. We chose to adapt the Clock Constraint Specification Language (CCSL) to the OCL. CCSL, is a model-based declarative language initially introduced in the OMG MARTE profile [START_REF]UML Profile for MARTE, beta 2, Object Management Group[END_REF]. It is used to specify relationships between clocks (i.e., events). CCSL has a formal semantics [START_REF] André | Syntax and Semantics of the Clock Constraint Specification Language[END_REF] that defines valid partial order according to a given CCSL specification or rejects the specification when there are some contradictions. As a concrete syntax to handle logical time expressions, Inria the CCSL has proved to be very expressive at different levels of abstraction.

Logical time has been successfully used in several domains. It was first introduced by Lamport to represent the execution of distributed systems [START_REF] Lamport | Time, clocks, and the ordering of events in a distributed system[END_REF]. It has then been extended and used in distributed systems to check the communication and causality path correctness [START_REF] Fidge | Logical time in distributed computing systems[END_REF]. During the same period, logical time has also been intensively used in synchronous languages [START_REF] Benveniste | Synchronous programming with events and relations: the SIGNAL language and its semantics[END_REF][START_REF] Berry | The foundations of Esterel, Proof, Language and Interaction: Essays in Honour of Robin Milner[END_REF] for its polychronous and multiform nature (i.e., based on several time references). In the synchronous domain it has proved to be adaptable to various levels of description, from very flexible causal descriptions to precisely timed ones [START_REF] Boussinot | The ESTEREL language[END_REF]. Actually, the notion of logical time is often used every day when a specific event is taken as a reference. For instance, consider the sentence "Component 1 is executed twice as often as Component 2". An event is then expressed relative to another one, that is used as a reference. No reference to physical time is given. However, given the execution occurrences of Component 1, the execution occurrences of Component 2 can be deduced. Another example is: "init() must be called before any other methods". Once again, you schedule an event in time relatively to another one (this time in a very loosely synchronized way). This is the main idea of using logical time. In this context, physical time is a particular case of logical time where events generated by a physical clock are taken as references. Consequently, logical and multiform time allows considering not only the distance between two event occurrences (that would be expressed relative to the physical time) but also the relative ordering of event occurrences.

By taking advantage of logical time, CCSL has been used successfully in several domains ranging from the expression of the Synchronous Data-Flow (SDF) model of computation [START_REF] Mallet | The Clock Constraint Specification Language for building timed causality models[END_REF] to the specification of temporal constraints for EAST-ADL models [START_REF] Mallet | Marte CCSL to execute East-ADL timing requirements[END_REF] but also to reflect the behavioral impact of implementation on requirements [START_REF] Peraldi-Frati | Scheduling Multi Clock Real Time Systems: From Requirements to Implementation[END_REF] and so on [START_REF] Mallet | Executing AADL models with UML/Marte[END_REF][START_REF] Glitia | Logical time @ work: Capturing data dependencies and platform constraints[END_REF][START_REF] Deantoni | RT-simex: retro-analysis of execution traces[END_REF][START_REF] Garcés | A Model-Based Approach for Reconciliation of Polychronous Execution Traces[END_REF][START_REF] Le Tallec | Combining SystemC, IP-XACT and UML/MARTE in model-based SoC design[END_REF][START_REF] André | The Time Model of Logical Clocks available in the OMG MARTE profile[END_REF][START_REF] Gascon | Logical time and temporal logics: comparing UML MARTE/CCSL and PSL[END_REF][START_REF] Yu | Polychronous analysis of timing constraints in uml marte[END_REF].

The problem of CCSL is twofold. In the one hand it can only specify constraints in extension (i.e., for each concept instances in a model) so that it is difficult to use on big models. In the other hand, CCSL only deals with constraints between the events and cannot take benefits from contract based approaches.

By adapting CCSL to the specification of behavioral invariants in OCL, we want to take benefits of both languages and we aim at providing a meaningful constraint language for MDE.

Before the presentation of the proposed language, we starts with an informal description of CCSL and its underlying mathematical model.

CCSL concepts and relations

In this paper, we describe only a small subset of CCSL, focusing on syntactic and semantic aspects sufficient to understand the examples given at the end of the paper. The syntax and the semantics of full CCSL is available in a technical report [START_REF] André | Syntax and Semantics of the Clock Constraint Specification Language[END_REF] and an overview is available at http://timesquare.inria. fr.

A simplified view of the CCSL metamodel is given in Figure 1 1 . A TimeSystem (aka CCSL specification) consists of a finite set of Clocks, and the parallel composition of a set of ClockConstraints (denoted | in the remainder). A clock is a strictly ordered set of instants, usually infinite. Two instants belonging to different clocks are possibly related by a causal or a temporal relationship. Causality is denoted . It can be refined into a temporal relationship, either a strict precedence (denoted ≺) or a coincidence (denoted ≡). By combining such relationships, a time system is the specification of partially ordered sets of instants [START_REF] André | Modeling time(s)[END_REF]. A clock constraint specifies generic relationships between (infinitely) many instants of the constrained clocks.

A clock constraint is either a ClockRelation or a ClockSpecification. A clock relation mutually constrains its parameters according to its type. A clock specification is either a ClockExpression or a simple reference to an element (e.g., a clock, an integer, etc) (ElementRef ). A clock expression has parameters and specifies a new clock according to the type of expressions and of its parameters. The types of the clock relations and expressions are defined in a Library. Low abstraction level constraints are defined in a kernel library. CCSL allows for the definition of user-defined constraints by combining existing relations imported from a set of kernel relations or from another user-defined library. It makes easier the use of complex constraints. However it makes the syntax quite verbose; especially for the binding of the formal parameters of the declaration to the actual ones of the constraint. This is not detailed here and we consider that the order of the parameters are used to bind them.

In this paper, we consider two types of clock relations, whose parameters are clocks references:

• the precedence (denoted ≺ ), which specifies that all instants of the first parameter occur before the corresponding instants of the second parameter.

• the coincidence (denoted = ), which specifies that all instants of the first parameter are simultaneous/synchronous with the corresponding instants of the second parameter.

We also only use two clock expressions:

• Union expression (denoted c1 + c2), whose resulting clock ticks synchronously with each of the clocks provided as parameters.

• delayedFor expression (denoted c $ n on ref ), which takes two clocks (c and ref ) as first and second parameters and an integer (n) as third parameter. The resulting clock ticks synchronously with the n th tick of ref after each tick of c.

Example We consider two clocks A, B constrained by the following CCSL specification S.

S = A ≺ B | B ≺ (A $ 1 on A) (1)
This specification is slightly reformulated to facilitate the semantic explanations: we introduced one implicit clock C that evolves in coincidence with the delayedFor clock expression of the previous specification.

S = A ≺ B | C = A $ 1 on A | B ≺ C (2)
Inria 2 provided by the TIMESQUARE environment [START_REF] Deantoni | TimeSquare: Treat your Models with Logical Time[END_REF] (blue dashed arrows represent precedences and red diamond lines represent coincidences). This kind of construction can be defined in a library so that the alternates relation can be directly used as if it was part of the language (without corrupting the formal semantics). The corresponding RelationDeclaration is then:

def Alternates(clock lef tClock, clock rightClock) (3)
lef tClock ≺ rightClock | C = lef tClock $ 1 on lef tClock | rightClock ≺ C)
This is the goal of the libraries to provide domain-specific constraints, constructed by semantic specialists but used by (meta)model designers. In this section, the concrete syntax is not the one used in the tool but has been used in the semantic definition because it is more concise than the actual one. The actual concrete syntax definition is available here: http://timesquare.inria.fr/index.php? slab=extendedccsl-grammar

CCSL operational semantics

This paragraph gives the flavor of the CCSL semantics without falling into the details. Please refer to [START_REF] André | Syntax and Semantics of the Clock Constraint Specification Language[END_REF] for a more precise definition. A CCSL specification is an executable model. An execution of a CCSL specification is an infinite sequence of reaction steps. Each reaction step computes the set of clocks that can/must "tick" to represent the evolution of the system. This set is computed according to the specified constraints. The computation is based on the resolution of a boolean expression defined by the conjunction of the boolean expressions induced by the clock constraints of the system. Consequently, each clock constraint corresponds to a boolean expression. Once a reaction is computed, the system evolves by propagating the result of the reaction in the system.

extension of the OCL metamodel: ECL

Our goal is to allow the manipulation of logical time according to the semantics defined by CCSL but in an OCL-like manner (i.e., possibly at the metamodel level and by intension instead of by extension). A first solution consists in creating a specific OCL library that extends the existing OCL standard library with the notion of event and some predefined constraints on them. However, this method does not allow the creation of domain-specific behavioral invariants (i.e., like the constraints of a CCSL library). To avoid repulsing users with difficult specifications, we extended the OCL metamodel itself so that the use of high abstraction level constraints is possible. We named this metamodel ECL for Event Constraint Language, however, because any other constraints from OCL are accepted by the metamodel, the name should surely be reconsidered.

ECL added three new possibilities to the OCL language:

1. The definition of Event; in the same way than the already existing definition of new attributes or temporary attributes 2. The initialization of an event from already existing event(s) and model attributes 3. The specification of relations between the events in the model; in the same way than already existing relations between other attributes.

There exist various implementation of the OCL specification. We chose to extend the implementation provided in the eclipse MDT 2 . This implementation supports several metamodel depending on whether we consider the "complete OCL" or only fragments specified, for instance, in UML constraints. To avoid being intrusive in every metamodel, we decided to create a new metamodel extending the complete OCL metamodel. Our extension is shown in Figure 3. The yellow metaclasses are the ones from the existing OCL metamodels, the ones in Red are new metaclasses, and the ones in blue are from the CCSL metamodel. Actually only the relation and expression declarations are imported from the CCSL metamodel in order to take benefits from the semantics of kernel relations and expressions defined in the MARTE profile as well as from user-defined library.

An ECLDocument is the root of the specification. An ECLDocument is a CompleteOCLDocument. Only specific imports are added to enable references to relation and expression libraries. Imports are specified by an ImportStatement. It contains the path of a library file whose RelationDeclaration and ExpressionDeclaration are used by the relations and expressions of the ECL specification. To allow the addition of events to a (meta)model, we have added the new type EventType. This type can be used in a classical OCL definition (like in listing 1) as well as in temporary variables (like in listing 2). Note that it does not, in anyway, make side effects since these values/methods are not used in the model itself, they are just used by the ECL specification. Additionally, these attributes can be initialized and read but cannot be assigned, as requested by the OCL specification. An EventType can be parameterized by a referredElement used to specify the (meta)model element the event attribute is associated with. This referred element is an ExpCS, i.e., an OCL expression, so that it can be a navigating expression, querying a specific modeling element (e.g. self , or self.incoming-> select(i|i.stuf f <> null)-> f irst()). When specifying a new attribute of type EventType, the event has to be initialized. The EventLiteralExp is a way to initialize the event attribute. It possesses a value, which specifies the role of the event with regards to its referred element. This role is an enumeration (EventKind). A Relation is an OCL expression whose goal is exactly the same than the CCSL relation, i.e. constraining the relative order between the occurrences of the events in its parameter list. The type of a relation is a RelationDeclaration. The parameters are also OCL expressions so that they can be specified by a navigating expression, querying a specific event or a specific model attribute depending on the type of the parameters specified in its type. Note that, a relation declaration has an ordered set of variables. The first parameter in a relation is then bound to the first variable in its type, the second with the second and so on... In OCL, one can use a let expression (LetExpCS) to create a temporary variable from other model elements or variables, and used it in a constraint. When the constraint is a relation on events, one can need to consider an event which results from the relative evolution of other events as well as on other parameters (for instance the union of a set of events). The ECLExpression can be used in a let expression to specify a temporary event. Similarly to relations, the type of an ECL expression is an ExpressionDeclaration. The result of the metamodel extension is the possibility to specify behavioral invariants as well as any other OCL constraints. Of course to make it usable, we have also modified the concrete syntax. The implementation of OCL in eclipse uses XText 3 . We extended the syntax with three main keywords: Event, Relation and Expression. All the other introduced keywords are used to specify the event kind enumeration. Examples of OCL specifications with behavioral invariants are provided in section 4.5. The next section details the use of such behavioral invariants.

ECL tooling and usages

The first goal of an OCL specification is to improve the specification of the model-based specification. The invariants specify structural constraints on models. Many tools provide a checker to validate these invariants on a specific model. Considering the pre and post conditions, they require another kind of tools because they refer to the execution of the model. They can be used in different manners according to the context. A first use of them consists in translating the pre post conditions to their equivalent in a programming language when the targeted language supports such contracts (e.g., for KerMeta and the Eiffel languages). A second use consists in using such contracts as a reference for model manipulations (e.g., transformations, execution, ...) where the manipulation is said to be correct when it respects such contracts [START_REF] Cariou | Contracts for model execution verification[END_REF][START_REF] Cariou | Ocl for the specification of model transformation contracts[END_REF].

In the same way than pre and post conditions, we will use behavioral invariants in different ways according to the context. The main goal is to take benefits of the specification in order to provide confidence either in the developed model or in its manipulation/implementation. We have seen that the extension of the OCL language is based on the semantics of the CCSL language. As far as we know, there exists two frameworks able to process a CCSL specification to take advantage of it [START_REF] Deantoni | TimeSquare: Treat your Models with Logical Time[END_REF][START_REF] Ge | Verification of Synchronization-Related Properties for UML-MARTE RTES Models with a Set of Time Constraints Dedicated Formal Semantic[END_REF]. To take benefits of these tools, we generated a CCSL specification according to the ECL specification and an input model. By doing so, we can exploit the possibilities provided by these tools depending on the context:

• obtaining a satisfying trace model linked with the model (in any cases)

• generation of timing diagrams (in any cases)

• graphical animation of the model (if modeled in the Papyrus tool)

• generation of observers to have a run-time checking of the implementation (for esterel and VHDL languages)

• checking of some execution traces according to the specification (if the trace is based on the open trace format)

• exhaustive simulation of synchronization properties (when the state space is finite by translation to timed petri nets)

In order to create the corresponding CCSL specification, we realized an high order transformation whose inputs are the ECL constraints and the domain-specific metamodel and whose result is a transformation from a domain-specific model to a CCSL specification (see Fig. 4). This last transformation is reusable for all models that conform to the metamodel used in input of the high order transformation. From a technological point of view, the first transformation has been implemented using acceleo 4 . It generates a QVTO transformation 5 that can be used to automatically create CCSL specifications. The first behavioral invariant we want to specify is taken from section 2. It states that "for a Component, it is only possible to call one behavior at a time". In other words, if one behavior has already started, no other behaviors can be started while the first one has not finished.

To specify this behavioral invariant, the first step consists in choosing the model elements that are relevant from a behavioral constraints point of view. In this example, both Component (line 8 of Figure 6) and Behavior (line 15 of Figure 6) are used. In a second step, we define, for these elements, the events used in the invariant. In our case, the start and the end of a behavior are used. We consequently define two event attributes in the context of a Behavior (line 9 and 10 of Figure 6). It is now necessary to constrain these events. We first specify that the start of a behavior always precedes its stop. This is specified by the startPrecedesStop behavioral invariant (line 12,13 of Figure 6), that uses the Precedes relation declaration from a CCSL library. Now, because we do not want more than one behavior to execute at a time, it means that they cannot start simultaneously. This is the goal of the second behavioral invariant, named notSimultaneousStarts on the line 16 and 17 of Figure 6. This invariant specifies an Exclusion relation on a collection of events. It means that all events in the collection are exclusive with each other. Note that this is a simplification of the CCSL syntax where exclusion on a set must be specified for each pair of clocks in the set. Finally, in the last behavioral invariant we specified that no behavior can start if another one has already started. Consequently, it is impossible to observe two consecutive start events without a stop. This is done by using temporary events (line 20 and 21). These events, named allStart and allStop are respectively defined by the Union of all start and stop events of the behavior of a component. These temporary events are then constrained to Alternates.

This example has been used to present the idea behind our extension of the OCL. In the next subsection, we present a more realistic example where an activity diagram is constrained so that it follows the Inria Figure 6: a simple ECL specification in the ECL editor execution rules of Synchronous Data Flow (SDF [START_REF] Lee | Static scheduling of synchronous data flow programs for digital signal processing[END_REF]) graphs, a formal model suitable to analysis.

Synchronous Data Flow

The goal of this section is not to explain the constraint needed on a UML activity model to give it the semantics of SDF. The goal is to show how, by using a high level library developed by experts, a model behavioral semantics can be formally specified. The library internal and details about its specification can be found in [START_REF] Mallet | The Clock Constraint Specification Language for building timed causality models[END_REF]. The result of [START_REF] Mallet | The Clock Constraint Specification Language for building timed causality models[END_REF] is that, it is possible to construct a RelationDeclaration, whose uses on a structurally constrained activity diagram, gives the behavioral semantics of SDF. The structural constraints put on the activity diagram enforce that the control flow between two actions go through a join node. The initial mark (delay) of the arc can then be given by using an initial node associated with this join node. An example of such activity model is provided in Figure 7. The high abstraction level relation developed in [START_REF] Mallet | The Clock Constraint Specification Language for building timed causality models[END_REF] has the following signature: def Arc(int delay, event sourceExec In this relation, the delay integer represents the initial number of data on the arc. The sourceExec event represents the atomic execution of the node in input of the join node. Similarly targetExec represents the atomic execution of the node in output of the join node. The two integers in and out respectively represent the number of data consumed on a specific arc and the number of data produced on a specific arc when an action executes.

The behavioral invariant is then call after retrieving the parameters of the relation by using the query operators provided by OCL. The result of the specification is depicted in Figure 8. On this screenshot, only the highlighted parts are from our extension; the remaining part of the specification is pure OCL.

The result of the high order transformation (the QVTo transformation) as well as the CCSL specification resulting from the transformation can be consulted at http://timesquare.inria.fr/ examples/ECL/. If the first benefit is to provide a concise specification of the behavioral invariants integrated within a standard language, the second benefit comes from the ease to read and understand the specification compared to the associated QVTo transformation.

Critics of the approach and its tooling

The approach is a first step towards a specification of causality relationships, concurrency and logical time behavior in an MDE approach. It is a fact that creating behavioral invariants requires a good knowledge Inria Figure 8: an ECL specification to constrain an activity model to conform to SDF semantics and experience of the CCSL introduced in the MARTE profile. The same kind of knowledge and experience are also required to provide a good metamodel. We believe that the possible use of high abstraction level libraries and the use of an existing language is a way to reduce the gap between the people that create formal models and the ones that develop metamodels. Our approach aims at making a separation between the abstract syntax of a language (the metamodel); its behavioral invariants (i.e., the specification of the model of computation); and the implementation of a specific model that must respect both structural and behavioral constraints. The CCSL semantics was successful in specifying various kinds of behavioral invariants on models (see the beginning of section 4) but more experiments are required to completely validate the proposition. These experiments have been a motivation for the tooling of the approach. However there still exist some limitations on the tooling of the approach.

First, we extended the OCL implementation of the eclipse project. This implementation uses various technologies that are still evolving. It makes it difficult for our editor and transformation to be up to date with the various releases of these technologies. We consequently wait for the release of the eclipse Juno before proposing any update site of our tooling. Also, to exploit tools that process CCSL specifications, we developed an high order transformation that takes an ECL file as an entry. The main limit comes from this transformation. There often exist various ways to specify the same OCL constraint. In our transformation, only a part of these constructions are supported. For instance, it is not possible to use more than one relation in a single behavioral invariant. It is also not supported if in a single invariant classical OCL Boolean expressions are put in conjunction with an ECL relation. These kinds of limitations are not very inconvenient, and we tried to support all part of the language needed to drive new experiments. Additionally, by using the TIMESQUARE software environment, it is possible to have convenient feedback on the resulting semantics, making easier the development of new semantics for our models (http://timesquare.inria.fr/index.php? slab=screenshots).

Conclusion

This paper presents an extension of the OCL language. This extension allows the explicit specification of relevant events of a model. It also allows the specification of behavioral invariants. Behavioral invariants is a way to specify constraints on the partial ordering of the event occurrences in a model. The goal is to specify the causality relationships, the concurrency and the timed behavior of a model, so that domainspecific analyses can be conducted. Such behavioral descriptions can then be used in various scenarios ranging from model animation to generation of observers at runtime. The extension semantics is based on the Clock Constraint Specification Language (CCSL), a model-based declarative and formal language.

CCSL has been chosen because it supports, by using polychronous logical time, a timed causality model that brings consistency between interactions of the model element events. CCSL can be used to specify (not program) the expected behavior of the whole model. The extension, named ECL, proposed in this paper aims at complementing (not replacing) other features of the OCL language like the use of pre/post conditions.

ECL simplifies the CCSL language while keeping its formal semantics and allows the specification of behavioral invariants at the metamodel level. This specification uses relations and expressions defined in external libraries, by semantic experts. One goal was to keep OCL simple to use by non formal designer while allowing a formal specification of the causalities and concurrency in a system.

A prototype has been developed to allow the reuse of existing analysis tools like TIMESQUARE. The tool allows specific formal model to be created, according to the ECL specification. This helped in demonstrating the benefits of the approach, either to obtain early simulation of models, or to use another output of the simulation tool (like the verification of execution traces).

There are two main ongoing investigations to extend this work. A short-term objective is to provide our extension and its tooling as an update site in order to get feedback from the community. The direct results of this short-term objective is a study about the formal specification of heterogeneous systems; where a single model uses different relation and expression libraries (i.e., heterogeneous modeling). Another future work consists in studying extensions of the language like the capacity to use the notion of mode to specify behavioral invariants that are dynamically enabled or not according to the value of data in the model.

Listing 1 :

 1 Example of attribute definition in OCL c o n t e x t P e r s o n d e f : n b _ c h i l d r e n : I n t e g e r = s e l f . c h i l d r e n -> s i z e ( )

Listing 2 :

 2 Example of invariant and temporary variable in OCL c o n t e x t P e r s o n i n v n o t T o o M u c h C h i l d r e n : l e t maxChildrenNumber : I n t e g e r = s e l f . l i v i n g C o u n t r y . m a x i m a l N u m b e r O f C h i l d r e n i n s e l f . n b _ c h i l d r e n <= maxChildrenNumber

Figure 1 :

 1 Figure 1: Simplified CCSL metamodel

Figure 2 :

 2 Figure 2: A timing diagram of the example in equation 2

Figure 3 :

 3 Figure 3: the extension of the OCL metamodel to allow the specification of behavioral invariants

Figure 4 :

 4 Figure 4: models and transformations to take benefits from CCSL tooling

Figure 5 :

 5 Figure 5: A sketchy and partial component metamodel

Figure 7 :

 7 Figure 7: a UML activity diagram with join node between actions

RR n°8031

The whole metamodel in ecore is available at http://timesquare.inria.fr/resources/metamodel/ RR n°8031

http://wiki.eclipse.org/MDT/OCL Inria

http://www.eclipse.org/Xtext/

http://www.eclipse.org/acceleo/

http://wiki.eclipse.org/M2M/Operational_QVT_Language_(QVTO) Inria

route des Lucioles -BP 93 06902 Sophia Antipolis Cedex Publisher Inria Domaine de Voluceau -Rocquencourt BP 105 -78153 Le Chesnay Cedex inria.fr ISSN 0249-6399