Jordan Miller

Christopher Gomez
email: christopher.gomez@canterbury.ac.nz

Heather Purdie

Interactions between Slope and Lake Sedimentary Processes: Study from Aerial Imagery and Ground Penetrating Radar Survey In the Alps of New Zealand

Lake Pearson is an alpine lake located amid a paraglacial landscape subject to accelerated rates of erosion, in the Upper Waimakariri Basin, South Island, New Zealand. Preliminary research into the shallow subsurface has been conducted with the use of groundpenetrating radar, supplemented with observation of surface sedimentology and landscape features. Distinct subsurface structures have been found beneath sections of Craigieburn Fan and the southern bed of Lake Pearson and the geomorphic processes responsible for the formation of each of these structures have been interpreted. Radargrams display evidence of avulsion of Craigieburn Stream, with the identification of several palaeochannels beneath the western side of Craigieburn Fan. Buried slope deposits at the base of Purple Hill show historic hill slope erosion and suggest hill slope stability is strongly linked to surface vegetation. Foreset bedding and onlap sedimentary sequences provide depositional evidence of lake level rise and lake currents have been identified as having a role in redistribution of fine sediment. Craigieburn Stream is the largest source of sediment to the area, though avulsion of the stream and progradation of Craigieburn Fan occurs on an episodical basis, in accordance with sediment availability and high stream flows capable of shifting large volumes of sediment.

 [START_REF] Coates | The rise and fall of the Southern Alps[END_REF], yet today the highest peaks reach less than a fifth of that height. The mountains are being eroded almost as quickly as they are rising, literally being broken down by weathering processes and seismicity. The issi g aterial has ee redistri uted amongst the surrounding high country by glacial, fluvial, and mass wasting processes [START_REF] Coates | The rise and fall of the Southern Alps[END_REF]. Throughout the Late Pleistocene period the peaks and valleys of the Southern Alps were heavily moulded by glacial action. Ice sheets, thousands of metres thick in places, once extended eastwards from the Main Divide, literally carving through solid rock to form broad glacial valleys [START_REF] Gage | Late Pleistocene glaciations of the Waimakariri Valley, Canterbury, New Zealand[END_REF][START_REF] Fitzsimons | Late-glacial and Holocene glacier activity in the Southern Alps, New Zealand[END_REF]. Glaciers went through cycles of advance and retreat in accordance with global and local climatic conditions. Following the retreat of ice at the start of the Holocene period, the high country entered a phase of instability k o as paragla ial o ditio s .

The ter paragla ial is described as nonglacial geomorphological processes, sediment accumulations and landforms which operate and exist in landscapes that have in the past been shaped by glaciation [START_REF] Church | Paraglacial sedimentation: a consideration of fluvial processes conditioned by glaciation[END_REF][START_REF] Ballantyne | Paraglacial geomorphology[END_REF].

Paraglacial landscapes are highly dynamic due to their exposed condition and instability and geomorphic processes are accelerated. They often exist in regions of extreme topography and climate, i.e.

alpine environments, which are already susceptible to accelerated erosion. Most models of post-glacial sediment flux have an initial period increased landslide frequency and sediment production immediately following glacial retreat, which diminish as deglaciation progresses [START_REF] Mccoll | Paraglacial rock-slope stability[END_REF]. Paraglacial sedimentation peaks in the period during the glacial recession due to the abundance of melt water and loose sediment available for re orki g. The paraglacial period is ot restricted to the closing phases of glaciation, but may extend well into the ensuing non-glacial interval [START_REF] Church | Paraglacial sedimentation: a consideration of fluvial processes conditioned by glaciation[END_REF]. The relaxation of a landscape shifting from glacial to nonglacial can occur over a period of tens of thousands of years and many areas that went through deglaciation in the Late Pleistocene have still not adjusted to nonglacial conditions [START_REF] Ballantyne | Paraglacial geomorphology[END_REF].

Paraglacial landscapes are characterised y their te porary appeara e, here sediment is often in state of transition between source and sink.

Every year an estimated 4,500 tonnes of material per square kilometre is eroded from the Southern Alps [START_REF] Adams | Contemporary uplift of the Southern Alps, New Zealand[END_REF].

The eroded sediments have been redistributed and deposited by various geomorphic agents, forming the sedimentary landforms that exist today [START_REF] Gage | Late Pleistocene glaciations of the Waimakariri Valley, Canterbury, New Zealand[END_REF][START_REF] Hales | Climate-controlled variations in scree production[END_REF].

Ground penetrating radar (GPR) analysis has been applied in a wide range of sedimentary environments, including fluvial systems [START_REF] Roberts | Radar signatures and structure of an avulsed channel: Rhone River, Aoste, France[END_REF]Smith & Jol, 1997;[START_REF] Abbott | Lake-level reconstructions and palaeohydrology of Birch Lake, Central Alaska, based on seismic reflection profiles and core transects[END_REF][START_REF] Ekes | Ground penetrating radar facies of the paraglacial Cheekeye Fan, southwestern British Columbia, Canada[END_REF], debris flow deposits [START_REF] Starheim | Complex internal architecture of a debris-flow deposit revealed using ground-penetrating radar[END_REF] and lahar deposits [START_REF] Gomez | Transverse architecture of lahar terraces, inferred from radargrams: preliminary results from Semeru Volcano, Indonesia[END_REF]. It has proved to be an effective tool for shallow subsurface investigations [START_REF] Gomez | Transverse architecture of lahar terraces, inferred from radargrams: preliminary results from Semeru Volcano, Indonesia[END_REF].

GPR provides two-dimensional imaging (radargrams) of the shallow subsurface to produce a stratigraphy of sediment beds laid down by depositional processes. Each of these processes produces a specific bedding formation or facies, which has a distinctive reflection signature in the radargrams [START_REF] Ekes | Ground penetrating radar facies of the paraglacial Cheekeye Fan, southwestern British Columbia, Canada[END_REF][START_REF] Neal | Ground-penetrating radar and its use in sedimentology: principles, problems and progress[END_REF]. These allow interpretation of the different geomorphic processes that have or Southern Lake Pearson.

Glacial and Geomorphic History

The glacial history of the Southern Alps in Canterbury has been pieced together by various researchers, initially through examination of landscape features [START_REF] Gage | Late Pleistocene glaciations of the Waimakariri Valley, Canterbury, New Zealand[END_REF] followed with more sophisticated dating techniques and correlation with climatic history (Chinn, 1981;[START_REF] Burrows | Radiocarbon dates from late Quaternary deposits in the Cass district, Canterbury, New Zealand[END_REF][START_REF] Ricker | A late Quaternary moraine sequence dated by rock weathering rinds, Craigieburn Range, New Zealand[END_REF]. Despite this, glacial deposits are thought to have been poorly dated (Fitzsimmons, 1997;[START_REF] Pugh | The late quaternary environmental history of the Lake Heron Basin, Mid Canterbury[END_REF] and though advances are considered to have occurred simultaneously throughout different parts of New Zealand, precise timing of regional ice advances is largely determined by local environmental conditions (Fitzsimmons, 1997). The Otira Glacial Stage extended from 75-14 ka BP [START_REF] Burrows | Radiocarbon dates from late Quaternary deposits in the Cass district, Canterbury, New Zealand[END_REF] The ice was so thick at the present location of Lake Pearson that the Winding Creek lobe deposited moraine on the Craigieburn Saddle and a melt water stream drained into Castle Hill Basin [START_REF] Gage | Late Pleistocene glaciations of the Waimakariri Valley, Canterbury, New Zealand[END_REF]. Retreat of Blackwater 3 began before 17 ka BP [START_REF] Mcglone | Late-glacial and Holocene vegetation and climatic history of the Cass Basin, central South Island, New Zealand[END_REF]. The Poulter advance was the final major advance in the Waimakariri catchment, but it only extended just past Lake Grasmere [START_REF] Gage | Late Pleistocene glaciations of the Waimakariri Valley, Canterbury, New Zealand[END_REF]Suggate, 1990). Dating of moraine ridges and deposits from the terminus has produced different ages; [START_REF] Burrows | Radiocarbon dates from late Quaternary deposits in the Cass district, Canterbury, New Zealand[END_REF] suggests a minimum age of 13.7 ± 0.2 ka BP, while more recent work by [START_REF] Ricker | A late Quaternary moraine sequence dated by rock weathering rinds, Craigieburn Range, New Zealand[END_REF] puts the minimum age between 12 ± 0.1 and 9.7 ± 0.9 ka BP. decades [START_REF] Chinn | Annual ice volume changes 1976-2008 for the New Zealand Southern Alps[END_REF].

Upon the retreat of the ice during the Aranui Interglacial, paraglacial processes replaced glacial processes as the dominant geomorphic activity in the high country landscape. In the absence of ice, widespread erosion occurred on the slopes of the steep glacier-carved valleys and newly-exposed landscape [START_REF] Ballantyne | Paraglacial geomorphology[END_REF]. [START_REF] Gage | Late Pleistocene glaciations of the Waimakariri Valley, Canterbury, New Zealand[END_REF] The Southern Alps are a highly active tectonic zone. Their uplift rate decreases from 11 mm/yr at the Alpine fault to 1 mm/yr at the eastern range front [START_REF] Coates | The rise and fall of the Southern Alps[END_REF][START_REF] Hales | Climate-controlled variations in scree production[END_REF]

Geomorphic Processes

Erosion ultimately stems from the combination of gravity and hydraulic action on exposed surfaces [START_REF] Ballantyne | Paraglacial geomorphology[END_REF][START_REF] Davies | Principles on the sustainable development of fans[END_REF]. landforms that can be difficult to interpret [START_REF] Pharo | Sedimentation processes in a short residence-time intermontane lake, Kamloops Lake[END_REF][START_REF] Mccoll | Paraglacial rock-slope stability[END_REF].

Mass Wasting

Mass wasting is the downslope movement of soil and rock through the force of gravity and without direct involvement of water (Selby, 1985). [START_REF] Mccoll | Paraglacial rock-slope stability[END_REF]. They occur when the force of gravity exceeds the shear stress between the rock and the slope. Bedrock detachment is usually triggered by debuttressing and seismic events [START_REF] Korup | Sediment generation and delivery from large historic landslides in the Southern Alps, New Zealand[END_REF]. Rock avalanching is a type of landslide where rock material moves downslope en masse [START_REF] Whitehouse | Frequency and hazard of large rock avalanches in the central Southern Alps[END_REF]. Rock avalanches are mainly composed of bedrock but when they also consist of coarse soils they can be termed debris slides (Selby, 1985).

While over-steepening of valley sides following glacial retreat was a cause of some of the rock avalanches in the Southern Alps, most rock avalanche deposits postdate the likely instability period and were most likely triggered by the other known mechanisms, such as earthquakes, heavy rainfall and removal of slope support [START_REF] Whitehouse | Frequency and hazard of large rock avalanches in the central Southern Alps[END_REF]. High intensity rainfall is usually responsible for the triggering of shallow landslides and debris-type movement, which result in slopes being stripped of colluvium (Selby, 1985).

Scree is the commonly used term for the slope deposits produced through rock

Fans

Alluvial fans are among the most common features of paraglacial reworking [START_REF] Ballantyne | Paraglacial geomorphology[END_REF]. Fans are prominent features of landscape surrounding Lake

Pearson and are generally quite easy to identify due to their distinctive morphology. Fluvial fans are low-gradient, cone-shaped sediment deposits that have accumulated where the transporting power of a river or stream becomes inadequate to carry its entire sediment load any farther downstream, so that the coarser fraction of the sediment is deposited on the streambed [START_REF] Bagnold | Bed load transport by natural rivers[END_REF][START_REF] Davies | Principles on the sustainable development of fans[END_REF][START_REF] Roberts | Radar signatures and structure of an avulsed channel: Rhone River, Aoste, France[END_REF]. This includes the bed load, which is defined as the solid material that is not constantly suspended in the water column by upward currents or turbulence and instead bounces (saltates) along the stream bed. Saltation applies to coarse sediment and is distinguished from very fine material which becomes suspended within the flow [START_REF] Church | Geomorphic thresholds in riverine landscapes[END_REF]. Deposition generally occurs where a river or stream that has been confined to a narrow valley transitions abruptly onto an area of flat land such as a valley floor and is able to spread and wander freely. Fluvial sediment transport is a function of stream power and is inversely related to the size of the sediment [START_REF] Bagnold | Bed load transport by natural rivers[END_REF][START_REF] Church | Geomorphic thresholds in riverine landscapes[END_REF]. The flow depth, and velocity determine the capacity of the stream to move particular sediment sizes but the availability of material able to be transported by the stream is also important. Glacial moraines also provide large reservoirs of relatively loose sediment available to be gradually reworked by fluvial processes. The grain size of bed material is usually directly correlated to the channel gradient, as this is reflective of the stream power [START_REF] Church | Geomorphic thresholds in riverine landscapes[END_REF]. In fan development the

Lacustrine Processes

Displacement of beach sediments by longshore currents is a significant component of sediment movement in New Zealand lakes (Allan, 1996).

Longshore currents are induced when the incident wave angle approach occurs at an oblique angle to the shoreline. Sediments are gradually transported along the shoreline in the direction of the current.

Natural beach armouring occurs in response to the sorting actions of waves and currents which remove gravels and fine sediments from the beach and leave behind larger cobbles and boulders. The result of this process is increased protection of the beach foreshore and near-shore beneath the water line [START_REF] Allan | Shoreline development at Lake Dunstan[END_REF]. Berms are raised, linear mounds that lie parallel to the shoreline on gravel beaches. Berm size and shape are functions of wave energy and the nature of the sediment present [START_REF] Allan | Shoreline development at Lake Dunstan[END_REF]. Resuspension of fine bed sediments occurs when waves, generated by strong winds, interact with the lake bed.

Fluvial deposition in a lacustrine environment often leads to the formation of a submerged delta platform extending out from the river mouth. Deltas are distinct shoreline protrusions that form where an alluvial system (river) enters a lake. Sediment carried by the incoming river is rapidly deposited when the river water experiences quick deceleration upon meeting the lake water. The sediment is also supplied at a rate more rapid than the speed at which lacustrine redistribution processes operate [START_REF] Phillips | Sedimentation in an artificial lake -Lake Matahina, Bay of Plenty[END_REF]. Foreset bedding is beds of sediment that dip in the direction of stream flow. It occurs where moving water meets still water and is common in underwater deltas [START_REF] Abbott | Lake-level reconstructions and palaeohydrology of Birch Lake, Central Alaska, based on seismic reflection profiles and core transects[END_REF][START_REF] Ekes | Ground penetrating radar facies of the paraglacial Cheekeye Fan, southwestern British Columbia, Canada[END_REF]. The way river water travels through the lake upon arrival also depends on the difference in density between the two water bodies [START_REF] Orton | Variability of deltaic processes in terms of sediment supply, with particular emphasis on grain size[END_REF]. Density is influenced by the water temperature and the sediment concentration of the incoming flow.

Density currents will often form during flood flows, when both discharge and the suspended sediment concentration are high. Density currents flow as underflow and penetrate further into the lake, with some forming sub-lacustrine channels, often following the thalweg of the lake.

These channels are also likely to form under the lake surface beneath welldeveloped debris flow paths. When river water is of higher temperature or of similar or lower sediment concentration, sediment will usually disperse in a plumeshape formation over a wide area, either along the lake surface or as interflow [START_REF] Phillips | Sedimentation in an artificial lake -Lake Matahina, Bay of Plenty[END_REF].

Study Area

Field investigation was focused on the southern lakebed and shoreline of Lake

Pearson and also on the Craigieburn Fan (Fig. 3.1). The area can be further separated into three distinct areas, A, B and C, based on the landforms present and dominant geomorphic processes operating (Fig. 3.2).

Area A

This area includes the shallow southeastern corner of the lake and the base and lower slopes of Purple Hill. During extended dry periods the lake level drops at least 1 m, revealing tens of metres of lakebed and in this south-eastern corner a flat with fine gravels and occasional patches of fine silts and muds is exposed.

For ease of explanation this area will be referred to as the udflat fro o o .

Area B

This area includes the mouth of Craigieburn Stream as it enters Lake

Research Aim

The aim of this research is to examine the Transects were conducted in a grid pattern, perpendicular and parallel to the shoreline. Most transects were kept under 100 m in length to help with ease of processing.

GPR Facies

Different Smooth dipping, beds. This is known as foreset Bedding, and is associated with deltaic environments.

Discontinuous, hummocky, chaotic beds. This usually indicates poorly bedded gravels and sands. This meant that additional radargrams of the lakebed were unable to be obtained and accessibility along the shoreline was reduced as previously we had been able

to walk along the lakebed to get to the eastern side of the lake. It seems that the lake level is this high for the majority of the year, therefore there is o shore as su h, so the orre t ter lake ed ill e used i stead of lakeshore .

Several of the radargrams from the three with north to the right.

Slope Deposits

There is an unconformity been two

Area B

There Ho this pro ess affe ts the lake s o ly outlet, Winding Creek, is yet to be seen.

Seasonal fluctuation in the lake level will influence the area at which fluvial deposition occurs. When the lake level is low, surface flows will travel further onto the lakebed before they reach the lake water, meaning fluvial sediments will be deposited on the lakebed. It may also be partly composed of organic material (Selby, 1985).

Stream Avulsion

Craigieburn Fan is composed of fluvial sediments originating from higher elevations further up the Craigieburn catchment. Paraglacial fan progradation northwards is responsible for the formation of Lake Pearson [START_REF] Gage | On the origin of some lakes in Canterbury[END_REF] and this process is still in operation as of a lake basin filling with water over time [START_REF] Abbott | Lake-level reconstructions and palaeohydrology of Birch Lake, Central Alaska, based on seismic reflection profiles and core transects[END_REF]. This would imply that the slope deposit was in position at a time when the lake was at least 2 m below what it is now. Lacustrine sediment beds were progressively deposited over time as the lake level rose.

Anthropogenic Implications

In an anthropogenic context, some of faster rates of through-low [START_REF] Revil | Self-potential signals associated with preferential ground water flow pathways in a buried paleo-channel[END_REF][START_REF] Mastrocicco | Monitoring and modelling nitrate persistence in a shallow aquifer[END_REF]. This means they can act preferential pathways to the lake for groundwater pollutants.

Increased farming activity is likely to have two major effects; firstly, it will result in a greater presence of nutrients and bacteria from livestock effluent, which is likely to make its way to the lake through groundwater leaching or surface runoff.

Over-enrichment of nitrogen and phosphorus is the fundamental cause of eutrophication. Lake Pearson is currently in a mesotrophic state, changing from an oligotrophic state 10 years ago. Nitrogen and phosphorus levels have been increasing in the lake over recent years and this is thought to be caused intensified farm production on its fringes (Environment Canterbury, 2007).

Secondly, inflow to the lake will be

  of the South Island, New Zealand, are a region of tremendous geological and geomorphological activity. The Alpine Fault marks the transform boundary between the Pacific and Australian Plates. Over the last 20 million years immense tectonic forces associated with the collision of these plates have formed the Southern Alps, a mountain chain extending almost the entire length of the South Island. In this time, enough rock has been uplifted to form a mountain range 20 km high

  operated in the past and the piecing together of the recent depositional history to see how each of these processes has interacted with each other to produce the present landforms. Understanding the various processes responsible for the formation of the present landscape is important for anticipating how the landscape will change in the future. This is especially important for geomorphologically active landscapes like the Canterbury high country, where paraglacial conditions have accelerated the rate at which these processes occur. There are a very few studies in New Zealand that have utilised GPR to interpret the formation of sedimentary landforms and certainly none in the immediate vicinity of the Craigieburn Fan

  and the last glacial maximum (LGM) occurred between 22-18 ka BP (Fitzsimmons, 1997). Three major advances occurred in the Waimakariri catchment during that stage; the Otarama in the early Otira and the Blackwater and Poulter advances in the late Otira. The Blackwater advance occurred in three stages and was the farthest reaching of the LGM in the Waimakariri area. Deposits from the youngest of these, Blackwater 3, have been given a maximum age of 18.4 ± 1.8 ka BP based on weathering rind ages (Ricker et al, 1992). The Waimakariri River represents the former course taken by the main lobe of ice during these advances as they flowed eastwards from the Main Divide. A separate lobe diverged from the main lobe and crossed over Goldney Saddle and into the Cass Basin, making marginal contact with the trunk glacier east of Lake Sarah. The main stream of this distributary during the Blackwater 3 advance remained separate from the trunk glacier and continued beyond the Cass Basin as the Lake Pearson-Winding Creek lobe, leading to the excavation of bedrock and eventual formation of glacial lakes in the area; Sarah and Grasmere.

Following

  the Poulter advance the climate entered a warming phase and the subsequent glacial retreat marked the beginning of the Aranui Interglacial, where with the exception of a few minor advances during brief cold periods (the two McGrath advances suggested by Chinn, (1981)) ice masses have reduced significantly in volume. Glaciers and areas of permanent ice are still in this part of the Southern Alps, but they are restricted to only the highest altitude basins along the Main Divide. Monitoring of ice volume change reveals they have been in an overall state of retreat over the last few

  suggests that alluvial fan development around Lake Pearson and Cass may have begun during the Poulter advance rather than during the interglacial, but regardless of when it started it has certainly continued throughout the Holocene period. The formation and progradation of two of these fans, Ribbonwood Stream fan and Craigieburn Stream fan, ultimately led to the development of Lake Pearson over the last 10,000 years through blocking of drainage as the valley filled with fluvial outwash sediments, surface runoff and groundwater discharge. Because of this, Lake Pearso is regarded as a o -gla ial lake as it was not formed directly by glacial action (Gage, 1959). Ribbonwood Stream has incised a deep gully in the Craigieburn Range and as it emerges into the valley a fan has formed and prograded eastwards across the valley to Long Hill, which forms a barrier between Lake Pearson and Lake Grasmere (Fig. 1.3.1). The gravel-bed Craigieburn Stream has created an extensive fan with a very gently sloping, almost sub-horizontal gradient. The stream has built the fan out in a north-east direction from the narrow valley between Mt Manson and Broken Hill and occupies the whole width of the Lake Pearson valley floor, to the base of Purple Hill. The maximum extent of progradation marks the southern shoreline of Lake Pearson.

Figure 1 . 2 . 1

 121 Figure 1.2.1 The maximum extent of different glacial advances. Blackwater 3 (purple) and Poulter (green). Arrows show the direction of ice flow. Ribbonwood Fan and Craigieburn Fan (both in yellow) developed after the retreat of ice.

Figure 1 . 3 . 1

 131 Figure 1.3.1 View north toward Cass Basin from Purple Hill. The northern end of Lake Pearson is the foreground; Ribbonwood Stream can be seen the mid-ground and Lake Grasmere is to the right in the background (photo Richard Allen).

Figure 1 . 3 . 2

 132 Figure 1.3.2 View upstream of the Craigieburn Stream from the lakeshore. For much of the year it runs dry.

Figure 1 . 3 . 3

 133 Figure 1.3.3 Panoramic view of Lake Pearson and Cass Basin from Purple Hill (photo Richard Allen).

  flows are initiated by gravity and provide an abundance of loose sediment available to be transported further afield by fluvial processes and deposited in terrestrial and lacustrine sediment sinks. Erosion is enhanced in alpine areas by the steep topography, climatic extremes in precipitation, temperature variation and lack of vegetation (due to anthropogenic or natural cause). A variety of transportation mechanisms can co-exist and interact with each other, resulting in complex sediment

  slopes within the central section of the Southern Alps. They identified that the zone of maximum scree extent within the Southern Alps is 40-60 km east of the Main Divide, which includes the area Lake Pearson lies in. The majority of scree lies within a of scree on steep gullies can often provide good conditions for the formation of another type of mass movement, debris flows. Debris flows are moving masses of unconsolidated mud, soil, rock, water and air and are triggered by intense rainfall (Selby, 1985). They can travel at very fast speeds and pose a significant risk in mountain environments worldwide due to their highly destructive nature and unpredictability. Debris flows operate in a way that fine sediments allow buoyancy of large heavy material which is able to flow on top. They can often be recognised in the landscape by their reverse graded deposits. Debris flows do form fans and cones, though the formation process is completely different to that of fluvial fans. While many alluvial fans are initially attributed to be of fluvial origin, mass movements are quite often involved in their development

Figure 2 . 1

 21 Figure 2.1 Erosion is characterizing feature of the landscape surrounding Lake Pearson. The base of the Craigeburn Range is mantled with a thick layer of colluvium.

  combination of greater width (which causes a reduction in depth) and lower slope (which reduces water velocity) reduces the ability of the stream to transport the same capacity of sediment that it carried when confined in the narrower, steeper valley upstream. Sediment drops out of suspension and is deposited locally, causing an increase in the streambed elevation (aggradation). As the fan immediate to the active channel builds up, an area of higher elevation relative to the rest of the fan is created. Avulsion occurs when the channel is overtopped during high flows and the stream cuts a new path to the lower elevation parts of the fan. Over time this new flow path is built up too, causing the process to repeat and the stream to wander back and forth across the fan (Davies & McSaveney, 2008). When the stream changes course, the former channel becomes inactive and over time gets filled in. Buried stream channels are known as palaeochannels and are channels that were once active but have since become inactive and been buried as the stream that used to occupy them changes course and abandons them (Toonen et al, 2012). Fan development normally requires a significant supply of coarse sediment available for mobilization. Shallow-gradient alluvial fans require large amounts of sediment to be repositioned to alter their morphology, as their bed load sediment concentration is usually quite low.

  Pearso . Here there is a 5 ide of gravel mouth bars and cobbles, through which the active channel of Craigieburn Stream flows. Surface gravels and cobbles are well-rounded but are poorly sorted and crudely bedded. Area B also includes the western edge of the mudflat. 3.3 Area C This area includes the western half of Craigieburn Fan close to the shoreline. The southern shoreline of Lake Pearson marks the northern extent of Craigieburn Fan and is composed of fine to coarse gravels and cobbles. A small (20 cm) wave-cut step along parts of the shoreline marks the high water level (fig._). The near-shore lakebed is composed of gravels, ranging from fine gravels (<1 cm) to cobbles (<6 cm). Pasture continues right to the shoreline along this section of the fan. The lakebed slope at the southern e d is ery shallo a d Ir i s bathymetry of Lake Pearson shows that this slope continues for several hundred metres offshore, although it likely that the lakebed has changed in the time since this survey was conducted.

  subsurface of Craigieburn Fan and the Lake Pearson lakebed and interpret the geomorphic processes responsible for their formation. This involves identifying the roles played by paraglacial fluvial, hill slope and lacustrine geomorphic processes and interpreting how they have operated in the landscape and interacted with each other to produce the landforms present. GPR imagery was used to image the subsurface and was supplemented with field observation of surface sediments and landforms. Research was focused here because the location lends itself to being suitable for examination of multiple geomorphic agents operating within close proximity to each other. This research may provide useful information to promote the effective management of high country land and allow consideration of potential future hazards.

Figure 3 . 2

 32 Figure 3.2 Map of study area including three sub-areas, A, B and C.

Figure 4

 4 Figure 4.1.1 A 500 MHz PulseEKKO GPR system was used in this project

  radargram reflection signatures are associated with different depositional environments. Various research from other studies involving GPR such as Neal (2004) and Ekes & Hickin (2001), describe the range of reflection geometries and the terminology used to describe them. The following three are common facies: Horizontal, smooth, parallel beds. This indicates well bedded fined silts and sands.

Figure 4 . 1 . 2

 412 Figure 4.1.2 Map showing locations of GPR transects in the study area

  structures are able to be interpreted with knowledge of how they operate in the landscape and their spatial relation to surface features. All radargrams have to been adjusted to be to-scale, unless stated otherwise. Eastwest radargrams are displayed from a southern perspective, i.e. with east on the right. North-south radargrams are displayed from an eastern perspective, i.e.

  distinct areas of sediment bedding beneath the mudflat, against the base of Purple Hill. T20 reveals a series of westward-dipping hummocky beds overlain with onlapping beds of fine sediment (Fig.5.1.1). The beds are part of a structure, 6 m wide and at least 2 m tall, possibly larger if it extends beyond the range of the GPR. Based on its parallel orientation the structure could initially be assumed to be a subsurface continuation of the beds that make up the slope of Purple Hill, but this seems unlikely considering there is almost 1 m of horizontal bedding on top of it. The structure dips at an angle of approximately 30° and appears to be composed of large clasts that are arranged chaotically rather than in uniform layers. Its appearance suggests that the structure is, or part of, a colluvial deposit originating from the hill slope directly above (Fig. 5.1.2). Given its location at the very base of the steep hill slope, it is probably too coincidental to assume otherwise. The smooth beds on top of it appear to be of lacustrine origin and must be younger to be positioned earlier in the vertical sequence; this is emphasised by the lacustrine beds conforming to the shape of the underlying deposit (onlap deposition). The lacustrine sediment appears to be fine-grained, suggesting it is similar to the mud that is present on the surface (Fig. 6.1.2). The surface sediment at the base of the hill slope is composed of a range of chaotically-arranged, angular hill slope deposits that range in size from cobbles to boulders (>40 cm) and there are some rocks strewn tens of metres further out onto the mudflat.

Figure 5 . 1 . 1

 511 Figure 5.1.1 Transect 20 from the base of the Purple Hill slope (on the right). The uniform, fine-grained lacustrine layers (green) can be easily distinguished from the coarse hills slope deposits (white).

Figure 5 . 1 . 2

 512 Figure 5.1.2The buried hill slope deposit appears to be similar to the material on the surface at the base of Purple hill slope, which is coarse and angular.

Figure 5 . 2 . 1

 521 Figure 5.2.1 Foreset bedding beneath the mudflat provides evidence that Craigieburn Stream has avulsed in the past. Foreset bedding is also evident beneath the lakebed just west of Craigieburn Stream mouth (T18) with bedding planes dipping toward the lake at angles varying from 10° to 30° (Fig. 5.2.2). The depth at which these planes lie is wider than Fig. 5.2.1, ranging from 0.2-2 m. Beds with strong reflective signal appear further apart here, with the bedding in between each being relatively quiet. There is

Figure 5 . 2 . 2

 522 Figure 5.2.2 Radargram from transect 18 just west of the active stream channel.

5. 4

 4 .1 in appendix). This is far smaller than the first palaeochannel, being only 5 m wide, less than 0.4 m deep and it lies approximately 0.6 m beneath the surface. It has a coarse sediment bed, hara terized y the hu o ky shape of radargram surface lines, with an infilling of very fine-grained sediments.

Figure 5

 5 Figure 5.3.2 A palaeochannel was found beneath Craigieburn Fan which appears to extend to the lake.

Figure 5 . 3 . 3

 533 Figure 5.3.3 The surface of the shallow depression in the middle distance is comprised of much smaller sediments than that in the foreground (A). The location of the depression can be seen in (B) and the location of the palaeochannel relative to it in (C).

Figure 5 . 4 . 1

 541 Figure 5.4.1 Lakebed grain size gradually increases from west (A) to east (B). Boot for scale.

Figure 5 . 4 . 2

 542 Figure 5.4.2 These structures could be interpreted as berms given their size and proximity to the shoreline (NB not to scale).

Figure 5 . 4 . 3

 543 Figure 5.4.3 The water discoloured by sediment re-suspension is evident in A. The debris line indicates the height that the lake level can get to in B.

Figure 6 . 1 . 1

 611 Figure 6.1.1 The surface of the mudflat is composed of saturated silt and sand and occasional patches of coarse gravel.

Figure 6 . 1 . 2

 612 Figure 6.1.2 The subsurface of the mudflat is composed of fine-grained lacustrine sediments.

Figure 6 . 1 . 3

 613 Figure 6.1.3 Longshore currents transport fine-grained sediment onto the mudflat.

  bed load of Craigieburn Stream met the resistance of stationary Lake Pearson water, lost momentum and was deposited on a submerged delta platform. This delta progressively built outwards as more sediment was deposited, each new sediment rolling over the edge of the deltaic bedform. The presence of foreset bedding and a delta platform means that at some point in the past Craigieburn Stream flowed eastwards towards the base of Purple Hill (Fig. 6.2.1). The limited depth range of foreset beds means that this direction of flow only occurred through a specific period of time. At the time this happened the lake water was at a level higher than at least 0.7 m below the surface. Onlap deposition of fine lacustrine sediment occurred against the delta platform after the stream avulsed to a flow in a northward direction and the lake level rose. This means that the mudflat has been gradually being encroached upon with fluvial gravels as the fan progrades eastwards and that this process will continue until eventually the mudflat is filled in with fluvial gravels and represents something similar to what the rest of the southern shoreline looks like.

Figure 6 . 2 . 1

 621 Figure 6.2.1 Craigieburn Stream may have taken a different path (white) to what it does at present (blue).

Craigieburn

  has avulsed in the past. The palaeochannels in Area C (Figs. 5.3.1 and 5.3.2) also provide possible physical evidence that avulsed to the western side of Craigieburn Fan, but evidence of whether or not these are former paths of Craigieburn Stream would require more transect lines further up the fan to map their full extent. There is some evidence for avulsion on the surface of the fan with the identification of at least one inactive channel, albeit significantly modified, through examination of aerial imagery. This may be a former path of Craigieburn Stream, considering it seems to continue along the same line the Craigieburn takes before it turns suddenly to the east near the head of the fan. It is also possible that this channel is that of a separate ephemeral stream that flowed on the fan from the western slopes. Craigieburn Fan is now completely pastured and its surface has probably been significantly modified since settlers arrived in the area in the late 19 th century. While the geomorphic origin of many of the subsurface features can be speculated upon, it would be wise not to discount the influence anthropogenic activity may have had on the landscape over this time. Construction of State Highway 73 in the 1930s probably involved the rerouting or filling in of ephemeral stream channels that ran down the slopes and onto the western side of the fan. Ephemeral streams are now no longer able to continue their natural path downslope across the fan and instead surface runoff is directed conveniently into a road-side ditch that flows through a pipe beneath the road. It is also possible that the palaeochannels identified do not continue along the entire length of the fan, but instead represent the drainage channels of former springs that used to emerge at points across the fan where the water table met the land surface. This may help to explain why both the palaeochannels discovered lie at the same depth below the surface. Anthropogenic change in land use through activities like farming generally only alters soil erosion rather than bedrock erosion, and thus does not have much of an effect on long-term, i.e. geological, erosion and sediment delivery (Davies & McSaveney, 2008). Soil erosion usually only delivers fine material to streams, too fine to cause significant alteration to stream morphology or trigger stream avulsion. On a large fan a considerable increase in the volume of coarse sediment is required to cause major changes in stream morphology. Alteration of vegetation is likely to be more influential on sediment delivery rates in large, low-gradient catchments than in small, steep ones, but on the contrary, the former are associated with correspondingly large, low gradient fans, which respond slowly to even large changes in the sediment input rate. Therefore changes in land use are likely to be less significant than tectonic or climatic changes in altering large fan morphology. This leads to the idea that large sediment pulses from events such as heavy rain and seismic events triggering mass wasting are largely responsible for sediment delivery, avulsion and ultimately the progradation of Craigieburn Fan. This may not have always been the case in the past, when the fan did not extend as far north as it does today and the gradient was steeper, increasing stream power and allowing more sediment to be shifted. The highly active tectonic setting Lake Pearson resides in means it is susceptible to frequent earthquakes of high shaking intensity. It lies a mere 50 km east of the Alpine Fault, which is capable of generating earthquakes greater than M W 8 and has experienced major ruptures four times at regular intervals over the past thousand years, the last time in 1717 (Wells & Goff, 2006). Porters Pass Fault is another fault lying only 20 km further east. Earthquakes are powerful triggers for mass wasting in steep topography. Coseismic mass wasting increases the sediment flux in drainage catchments (Davies & McSaveney, 2008). On the West Coast, formation of some coastal landforms has been attributed to sediment delivery from co-seismic mass wasting triggered by Alpine Fault ruptures. The dates of past ruptures have been closely associated with the formation of beach ridges at Haast. It takes many years for these sediments to be transported out of the catchment. Following the M W 7.8 Murchison earthquake in 1929, the majority of sediment had moved to the coast within a decade (Wells & Goff, 2006). Goff and McFadgen (2005) proposed in the same event on the eastern South Island sediment would take as long as 4,000 years to make its way from the Southern Alps to the coast, due to the longer distance to the coast, gentler gradient and lower precipitation available to shift sediment. Localised redistribution of sediment from source to sink in a small catchment like Craigieburn Stream has a much smaller distance to occur over, however, its delivery onto the fan and subsequent progradation is still limited by the transporting power of streams. Craigieburn Stream has a catchment area of approximately 24 km 2 and drains steep forested valleys. This is not large in comparison with those of nearby alpine stream and river catchments and the Craigieburn is sub-horizontal. This means a prolonged period of steady rain (to saturate the ground) or a localized high intensity downpour is likely to be required for generation of high flows or flood flows capable of shifting large volumes of material onto and along the fan. If aggradation occurs at any section along stream length, the resulting base level change will alter the stream gradient fan, in accordance with the occurrence of heavy rain and periods of high sedimentation that follow seismic events. The poor bedding at the Craigieburn Stream mouth suggests that flood events are responsible for the majority of sorting. Though the stream remains dry for most of the year, high flows must occur relatively frequently as the channel has remained clear of encroachment from vegetation. The riparian vegetation on either side of the active Craigieburn channel may restrict its mobility. Experiments have shown that vegetation in channel bar systems leads to huge reductions in channel bar migration rates. This is attributed to the strengthening effect vegetation has on banks, which reduces eroding sediment from vegetated banks and the funnelling effect vegetation has, which reduces channel width (Wickert et al, 2013). Establishment of plants on channel edges and point bar systems acts to stabilize flood plain sediments and generate a positive feedback cycle where further deposition of fine-grained sediment suspended in flood water is promoted due to the slowing effect they have on the flow (Mouw et al, 2008).Without historic aerial imagery to see the former path of Craigieburn Stream, it is hard to say whether anthropogenic vegetation has reduced the rate of avulsion, although, it is likely that the vegetation that exists on the slopes probably also grew on Craigieburn Fan prior to European settlement and conversion of the fan to pasture.6.5 Slope StabilityIt is widely accepted that vegetation stabilizes steep hill slopes and strengthens them from erosion by mass movements(Selby, 1985;[START_REF] Greenwood | Assessing the contribution of vegetation to slope stability[END_REF]. The eastern mountains of the Southern Alps are characterized by tussocklands and scrublands and mass wasting and slope deposits are characterizing features of the landscape. Through a combination of anthropogenic and natural causes, much of the beech forest that would have naturally clothed the land is no longer in place. Vegetation plays a significant role in maintaining soil cohesion and hill slope stability through root arming and it also influences hill slope hydrology (Greenwood et al, 2004). Trees help to intercept precipitation and reduce surface splash erosion. Leaf litter and plants on the ground slow the velocity of surface runoff and reduce its ability to entrain sediment and cause erosion. Root growth between potential failure surfaces helps to bind them together and remove soil moisture, reducing the volume of water held in pores, as well as pore pressure (Selby, 1985). Above the tree line on the mountains surrounding Lake Pearson, thousands of years of physical, chemical and freeze-thaw weathering on the exposed bedrock peaks has resulted in the upper slopes being mantled in a thick layer of shattered rock. Over time this has its way down to the valley floor through further rockfalls, landslides and debris flows to form thick colluvium deposits. Removal of vegetation through anthropogenic or natural causes can lead to extensive erosion below the tree line and can create a positive feedback cycle; as vegetation is removed from the slope, the slope is eroded more easily. Topsoil is stripped, reducing its ability to support vegetation growth, making re-vegetation of the slope very difficult (Cochrane & Acharya, 2011). The steeper upper slopes of Purple Hill are heavily eroded however the lower slopes are quite well vegetated with scrub and do not bear much evidence of slope failure, although radargrams from the mudflat reveal some of the erosional history of the hill slope. There is a significant difference in the subsurface bedding between the two transects on the mudflat and this corresponds directly to the vegetation cover present on the respective areas of Purple Hill slope each transect. The contrasting subsurface structures can be used to show the important role vegetation plays in stabilizing hill slopes.

Figure 6 . 5 . 1

 651 Figure 6.5.1 Very little beech forest remains on the high slopes of Mt Manson, resulting in accelerated erosion (photo Richard Allen).

Figure 6 . 5 . 2

 652 Figure 6.5.2 Vegetation appears to play a significant role in stabilizing hill slopes.

  these findings may have implications for further development in the area. Many high country areas that were previously thought to be too inhospitable and inaccessible for agriculture and viticulture are now being considered for new development -one of these areas is the Cass Basin. In 2012 Environment Canterbury recently received a proposal to abstract water from the Cass River to irrigate 554 ha of land on Grasmere Station for intensified farm production. This has implications for the quality local lakes and streams.Groundwater pollution is one of the key environmental issues New Zealand is facing at the moment. The underlying sediment composition of high country areas can make them vulnerable to the effects of activities on the land surface, due to the ease at which pollutants can leach to groundwater. Coarse alluvial gravels are highly permeable and allow high rates of throughflow(Selby, 1985). Groundwater flow was observed to be an integral component of inflow to Lake Pearson. Increasing the amount of irrigation for farming also increases the risk of pollution from surface runoff. The Craigieburn Fan has been shown to be composed of coarse gravels and contain more than one palaeochannel not far below the surface. Palaeochannels are of particular significance for groundwater pollution, as they can act as conduits for

  reduced if water is abstracted from Craigieburn Stream, or groundwater at either the northern or southern end of the lake. Increased demand for water around the lake may reduce groundwater recharge which Lake Pearson is clearly dependent on. Sustained periods of low rai fall ha e aused the lake s ater le el to drop by a metre or more in the past(Environment Canterbury, 2007) and this was also observed during field collection.The Maori name for Lake Pearson is Moa a 'ua, hi h tra slates to t o lakes . This suggests that a lo lake le el is nothing new; when Maori discovered Lake Pearson centuries ago the water must have been so low that the bed was exposed at the narrow midpoint, dividing the lake into separate northern and southern lakes. A reduction in lake apa ity ill affe t the lake s a ility to deal with extra pollutants. It could make the shallow sections more susceptible to heating during summer, which will help to facilitate algal growth. Lake Pearson is a wildlife refuge and a popular location for camping and recreational pursuits. Any degradation in local surface water quality will significantly reduce the aesthetic appeal of the lake and surrounds and may also threaten its ability to provide for these uses. and interpret the geomorphic processes responsible for their formation. GPR imagery proved to be a very useful tool for this. Radargrams have allowed identification of depositional structures of fluvial, lacustrine and hill slope origin. The one or more geomorphic processes and the interaction between each of these processes in the formation these structures, have been described. E ide e of Craigie ur Strea s a ulsio was found through identification of palaeochannels and deltaic depositional bedding. There are apparent links between surface features and underlying structures, with a strong linkage found beneath subsurface hill slope deposits and the cover of surface vegetation on the hill slope directly above. This suggests vegetation is a strong determinant of hill slope stability in the area. Onlapping sediment sequences reflect the depositional structures associated with lake level rise. As paraglacial landscapes are so dynamic, observation of present landforms offers only a tiny snapshot in time amid a landscape which, in a geomorphological sense, is constantly changing. This research certainly forms the basis for further, more in depth investigation in the area, possibly with the use of historic aerial imagery or absolute dating techniques to assess the rate at which these processes are operating. It also advocates the use of GPR imagery for analysis of similar landscapes. This may be for the benefit of further anthropogenic development of high country areas, through managing the landscape in a way that takes into consideration the way natural processes have operated in the past and will continue to operate in the future.


Gilles Deleuze
email: gilles.deleuze@edf.fr

Aurélie Léger
email: aurelie.leger@edf.fr

Pierre Yves Piriou

Sylvain Chabroux
email: sylvain.chabroux@k-inside.com

Interoperability between a dynamic reliability modeling and a Systems Engineering process -Principles and Case Study

Keywords: Systems engineering, systems modeling, RAMS, dynamic dependability assessment, dynamic reliability, interoperability

Industrial systems are often large, and complex, in terms of structure, dynamic interactions between subsystems and components, dynamic operational environment, ageing, etc. The dynamic reliability approach is a convenient framework to model the behavior of such systems. However, there is a price to pay, e.g. in terms of amount of data, size of state graphs, volume of reliability calculations, and combination of various engineering activities. A sound Systems Engineering process, benefiting from the improvement of most recent tools, may be a fruitful approach to decrease these difficulties. Although feasibility demonstrations have been done for conventional, static, approaches of dependability, interoperability between dynamic reliability modeling and Systems Engineering has not the same maturity level. The article explains how, on the basis of Systems Engineering (SE) process definitions, a Meta-model defines a framework for integrating the safety into SE processes. It supports a "hub automaton", that is the key element for interoperability with the tools and activities required for a dynamic reliability assessment. The case study is the dynamic assessment of availability of a feed-water control system in a power plant steam generator, presented in previous articles.

Introduction

Feasibility demonstrations and significant studies have been done to demonstrate the feasibility and benefits of an interoperability between System Engineering frameworks and Reliability, Availability, Maintainability and Safety (RAMS) activities ( [David, 2010], [Aboutaleb, 2012]). However, these studies considered only so called "static" dependability approaches, assuming an invariant structure of the system. It focuses on "events combinations" with models like FMEA, static Fault Trees and Event Trees. Considering the system dynamics requires "dynamic" dependability approaches, focusing on event sequences with models like Dynamic Fault Trees, Boolean Driven Markov Processes…, and in term of Meta-model, a semantic adapted to the system behavior.

Improvement of the completeness of assessment of large and complex industrial systems, requires these "dynamic" dependability approaches, since they cover a wider range of phenomena. Given this context, the problematic is to develop meta-models integrated in a proven Systems Engineering (SE) process [START_REF] Se | SE Handbook Working Group and International Council on Systems Engineering, Systems Engineering Handbook -A guide for system Life Cycle Processes and Activities[END_REF]], [IEEE, 2005], [ISO/ CEI 26702, 2007], [ISO/CEI 15288, 2008]), properly combined with RAMS engineering activities, including dynamic modeling, and benefiting from recent support tools.

A SE process implemented in a consistent platform helps the engineer to manage the processes (description of functional and physical architectures, allocation of functions, preliminary assessment of requirements...) which are necessary, upstream of the dependability study. Then, it is possible to describe the failure features of the components, to model realistic failure/repairing scenarios and to define redundancy policies and dynamical allocation of functions caused by failure events. To do that, an idea is to develop a "hub automaton", that supports the translation of the dynamic model into specific dynamic dependability tools. This article is organized into four main sections:

1. Definitions and theoretical framework. We define the fundamental concepts for the study, e.g. System Engineering (SE), RAMS Activities and Hybrid System.

2. Principles. We present the key elements on which this demonstration is based: choice of interoperability vs. integration, System Engineering process supported by a Meta-model, Dynamic Reliability approach.

3. Method description. This section describes the processes and data used in the method and the Meta-model developed to support them.

4. Case Study. The case study is focused on the availability of a feed-water control system in a power plant steam generator. The meta-model is instantiated for specifying a sub-system, a dynamic model is generated for describing its behavior and an availability assessment is performed on it.

Definitions and theoretical framework

1.1. Systems Engineering SE consists in concurrent interdisciplinary approaches for the design and validation of complex technical systems. The process proposed by INCOSE Systems Engineering Handbook [SE, 2010], integrates all the disciplines and specialty groups, e.g. RAMS, into a team effort that focuses on defining customer needs and required functionality early in the development cycle, documenting requirements, and then proceeding with design synthesis and system validation.

RAMS activities

RAMS acronym refers to a set of engineering activities aiming to perform Reliability, Availability, Maintainability and Safety assessments, based on deterministic and probabilistic approaches. INCOSE Handbook [START_REF] Se | SE Handbook Working Group and International Council on Systems Engineering, Systems Engineering Handbook -A guide for system Life Cycle Processes and Activities[END_REF]] refers to Availability, Reliability, Maintainability and Supportability (RAMS), also known as dependability. The dependability of a system describes its ability to fulfill the required functions under given conditions, considering degradation of performance due to failure and maintenance. RAMS studies are considered in this case study, as validations, as defined by [ISO 9000: 2005], based on modeling and focused on dependability requirements.

System complexity

A technical system may be considered at the highest abstraction level, as a structured set of variable elements, acting in a technical environment for an explicit purpose. In the RAMS engineering domain, it is interesting to characterize its complexity by the combination of two attributes: "interactive complexity" and "tight coupling" [Perrow,85]. Interactive complexity results from presence of dynamic phenomena, occurrence of rare event sequences and non-linear effects. The consequence is a risk of incomplete knowledge of the system. Tight coupling results from strong interdependence between phenomena. The consequence is a risk of dependent failures, e.g. common-cause and cascade failures.

Hybrid System

System that combines continuous physical processes, deterministic event sequences (defined by specifications), random events (that may be intrinsic, like failures, or extrinsic, like unexpected context modification).

Dynamic Dependability, Dynamic Reliability

Dynamic Dependability is a branch of dependability engineering that deals with "the influence of time, process dynamics, and human actions, on system operations and failures, and accidental scenarios." [START_REF] Brissaud | [END_REF]. Discrete Dynamic dependability approaches rely on models like Dynamic Fault Trees, Boolean Driven Markov Processes… Hybrid dependability approaches permit to improve the modeling of hybrid systems as they consider also the multiple interactions between deterministic and random discrete events, and continuous processes. The mathematical framework derives from Kolmogorov-Chapman equations [START_REF] Labeau | [END_REF]. Its applicationconsists basically in the modeling or the simulation of Piecewise Deterministic Markov Processes (PDMP) [START_REF] Dufour | [END_REF]. Exact analytical solutions of stochastic differential equations are complex and require, beyond a small system size, simplifying assumptions, whereas approximation (using numerical methods or by Monte Carlo simulations) allow realistic modeling and provide data for comprehensive statistical analysis. It is very useful to apply this framework in the case of software intensive hybrid systems, as it explicitly considers the interactions between system states and context evolutions that may represent the most contributing risk factor to system failures [START_REF] Leveson | Engineering a Safer World. Systems thinking applied to safety[END_REF].

In addition to consideration of hybrid dynamic dependability, the so called dynamic reliability assume that some continuous phenomena (like for example, ageing), are influenced by stochastic events or drifts. It means that some reliability characteristics are influenced by the process.

Principles

Interoperability vs. Integration

Designing a complex system require a set of activities in interaction (Figure 1). This set is practically an organizational system and its management has to consider in particular the exchanges of data between the activities. At this point, a decision has to be done between 'knowledge integration' and 'knowledge interoperation' [Léger, 2009].

Figure 1: Activities in interaction for a real system

Knowledge integration consists in modeling the different activities of a system through a shared semantics (Figure 2). As such, the modeling focuses on knowledge extracted from each of the studied activities. The difficulty is to limit the loss of knowledge representation due to a common semantic.

Figure 2 : An "integrated" model

Knowledge interoperation consists in using neutral exchange formalism as a "pivot" or "hub" for the interaction between the different activities (Figure 3). As such, a large amount of specific knowledge is kept in each activity.

Figure 3: An "interoperable" model

For the case study presented here, the choice is to move towards an interoperation of the models through a dedicated Systems Engineering platform.

Choice of a Meta-model as a framework

In software engineering and systems engineering, a Data Model, or Meta-model, is a structured collection of "concepts" (things, terms, etc.) within a given knowledge domain. A model complies with a Metamodel in the way that a computer program complies with the grammar of the programming language in which it is written. The modeling language is used to manage diversity of objects types and their relationship, such as hierarchical, production/consumption... The properties of each type of object are defined by attributes. In this demonstration, the Meta-model allows to manage a large quantity of heterogeneous data. In order to implement and support an innovative Meta-model for dynamic reliability, we used arKItect Designer, a Commercial Off-The-Shelf (COTS) tool having relevant capabilities for this demonstration: 1. Ready to use. As the SE framework is predefined, it was easy to design a Meta-model from scratch, estimated in the range of 10 to 30 times faster that with classical Object-Oriented (OO) approaches. 2. Interpretation. The Meta-model and the model can be modified dynamically, both are displayed in parallel in real time. This enables a fast prototyping of the Meta-model that seems more questionable, with other platforms where recompilation is needed after each modification of the Meta-model.

Generation of customizable building block

diagrams. It allows getting immediately graphical editing views for all the artifacts needed in the design. 4. Easy to use. This tool does not require a high level of competence in Object Oriented approaches and programming to design a specific Meta-model. The rules for using the tool are rather simple and an engineer can build his data model and concentrate fairly on his own domain of activity. 5. Completeness. It is possible to represent in the meta-model all the artifacts needed to describe the system, as for example, stochastic automata.

Choice of a dynamic model

In a previous study, modeling the availability of a feed-water control system (considered as hybrid) in a power plant steam generator, the feasibility of two complementary approaches has been demonstrated [START_REF][END_REF].

One approach models the system with Stochastic Hybrid Automaton (SHA) presented in [START_REF] Babykina | [END_REF] and [START_REF] Castaneda | [END_REF]. Analysis of the model may be quantitative, with Monte Carlo Simulations, to make dependability assessments; or qualitative, with technique of sequence exploration, to find sequences having a length inferior to a given criteria.

The other approach, presented in [START_REF] Zhang | [END_REF], models the system with State Charts and a dedicated COTS (Matlab/Simulink). The analysis of the model is quantitative, with Monte Carlo simulations

Neutral exchange formalism

Both approaches require a combination of various engineering activities, the use of computational power, a large volume of data, component level models, and exchange between various tools (Matlab, Scilab…). This demonstration focuses on the interoperability between SE process and a dynamic modeling based on SHA. SHA allow the exploration of event sequences and model checking, which is an interesting feature for dependability studies. Furthermore, EDF R&D has the disposition of an internally developed open source tool, Pycatshoo, also based on SHA [Chraïbi, 2013].

Method description

Specification of RAMS/SE interoperability

Dependability assessment requires a coupling between SE and the various RAMS activities. However, there is in practice sometimes a discontinuity between the system design and the dependability studies because they are considered lately in the project development. Functional analysis has to be performed during the system design phase, but it has also sometimes to be performed again during the dependability analysis, especially if the engineering framework does not consider RAMS/SE interoperability. Moreover, SE and RAMS teams often use tools that are not interoperating. This may lead to incoherence between the functional analysis and the failure analysis.

In a context of hybrid systems, interoperability between SE and RAMS engineering processes, is critical and must start early in the system life cycle. Their interoperability deserves particular attention all over the development process. Thus, it is needed to clearly specify the RAMS/SE interoperability on following points:

• Stages of the SE process,

• Stages of the RAMS process,

• Relations between the processes, • Documentation to be generated. A tool such as ArKItect facilitates the production of systems and dependability studies. It can easily be used to provide diverse customizable views on the system and its dependability aspects.

Detailed Description of RAMS/SE interoperability

For this case study, [START_REF] Se | SE Handbook Working Group and International Council on Systems Engineering, Systems Engineering Handbook -A guide for system Life Cycle Processes and Activities[END_REF]] interpretation in the arKItect environment has led to the definition of a process divided into two sub-processes (see Figure 10, in appendix): (1) System Specifications (SS) and (2) System Design (SD).

The SS sub-process contains:

-Analysis of customer needs, detailed in terms of system lifecycle and mission phases, requirements statement, functions identification and context contributions definition tasks.

-Functional Architecture stage. It consists of requirements and functions refinement, definition of sub-functional flow exchanges. During this stage, the specification activity is iterative; allocating requirements upon functions allows the emergence of system sub-functions and requires the refining of requirements into subrequirements.

The system Design (SD) sub-process contains:

-System Architecture (SA) stage. It consists in defining system components, functions allocation to components, definition of physical interfaces allocation of flows, and allocation of requirements to components.

Refinement

Feedback.

Based on the requirements allocation upon systems, it insures with reasonable certainty, that the selected system architecture is adequate, given a "reasonable certainty" , with the requirements produced from the Customer Needs Analysis stage. The allocation of design requirements to the system components can lead to the generation of further functional requirements. The assessment of the "reasonable certainty" is the purpose of the risk assessment processes done in parallel.

The arKItect environment also covers Dependability studies and is divided into two sub-processes: (3) Preliminary Risk Analysis (PRA) and (4) System Risk Analysis (SRA). PRA is linked to the functions definition in the System Specifications stage. It includes:

-System state definition -System risk event identification -Undesired Customer Event (UCE) identification the preliminary risk analysis, where risks are linked to functions and priorized.

SRA is linked to the internal functional analysis from the SE process. It includes:

-"Static" analysis such as Failure Modes and Effects Analysis (FMEA) -Fault Tree Analysis (FTA). FTA risk events and basic risk events are identified in the System Architecture resulting from the SE process. -For this case study, dynamic assessments capabilities have been added, through interoperability.

Results are capitalized into the arKItect project database and they are compared with safety and reliability requirements elicited previously in System Specification phase. ArKItect includes Python scripting language that ensures interfacing between System Engineering platform and analysis tools, like for example, Fault trees analyzing tools and availability estimation tools. Another scripting application is the report generation for project deliveries.

Data and data management for dependability study

The Approdyn case study [Deleuze, 2011], deals with data relevant for Dependability studies, like system states, failure modes, availability, reparability, reliability …

The various data required for the dependability studies may be structured as follows:

• Functional description of the system (elements, context, operating conditions, states…). • Qualitative and quantitative reliability data at element level, including failure modes, wear out and dynamic phenomena, state graphs (figure 4)… • Models of the physical phenomena of interest for the RAMS studies of the system (including normal and possible abnormal conditions) and relevant control logic. • Fault Tolerance Features (redundancy policy, defense in depth…). • Qualitative and quantitative RAMS data at system level, including Operation and Maintenance procedures, Periodic Testing.

The challenge is to manage object relationships (like allocation, production, consumption, etc.) in interoperable SE and RAMS processes. The SE process implementation requires managing project data relating to requirements, functional and physical architecture.

A graphical representation tool like arKItect proposes a solution for both efficient and seamless SE and RAMS processes. Indeed, the model is based on the system architecture, that means all activities related to the system design and to the dependability analysis are gathered in the same representation space.

The Meta-model for interoperability

Existing meta-models for SE, like [START_REF] Pfister | [END_REF], organize the data and support the SE processes defined by INCOSE standard. However, they consider only the normal, faultless, operation of the system, whereas for critical systems safety and dependability matter too. Thus, the Meta-model defined by [START_REF] Pfister | [END_REF], has been extended to be able to represent Dependability into SE processes. [Piriou, 2013] and [START_REF] Piriou | [END_REF] describe in detail the design of this extension.

The meta-model proposed in this study adds the semantics required to perform dependability analyses on phased mission systems with repairable multistate components. The meta-model is represented by an UML class diagram [START_REF] Sysml | SysML Specification 2007, OMG Systems Modeling Language (OMG SysML), V1.0 Object management group[END_REF].

It supports the development of a "hub automaton" or "pivotal automaton", comparable to a Guarded Transition System [Rauzy, 2008], which is the key element for interoperability between the tools and activities needed for dynamic reliability assessment.

Figure 5 presents the meta-model. The resulting class diagram enables to model the stochastic evolutions of the component in the form of transitions from a state to another. These transitions are due to failure or repair events that occur with a probability law depending on rates defined for the considered state.

It is assumed here that these rates do not depend on time. Thus the scope of the model to represent dynamic aspects of dependability is not fulfilled and will require further developments.

Effects of component states on function achievement.

It is assumed, that the achievement of a function is quantifiable. This means that the achievement percentage can be computed for every function from the knowledge of the current states of its allocated component. For instance, the achievement percentage of a function whose aim is to fill in a tank and for which two identical pumps are allocated is equal to 100% when the two pumps are faultless and 60% when one pump is leaking.

Redundancy policies.

The set of components allocated to a function can changes during operation; redundancy policies specify these changes. The "Redundancy policy" class and its relations are introduced in the meta-model. Also, two methods are added to the "Function" class that updates the allocation attribute of the "Function" class. The "Redundancy policy" class permits to specify how the faulty components are replaced by redundant components.

Systematic generation of a dynamic model

For describing the dysfunctional behavior of the system, we have developed an algorithm for building a dynamic model from an instance of this metamodel, in a generic way. Since the Stochastic Guarded Transition System (SGTS), defined by [Rauzy, 2008], allows a permissive and compact description of the system, we chose it as the formalism for representing this dynamic model. Moreover, the respect of best practices for using this formalism leads to constructions which preserve the structure aspect of the system. This conservation of data complies relevantly with the interoperability purpose.

A SGTS is defined as a 7-uplet <V,E,π,T,i,H,B> where:

• V is a set of variables • E is a set of symbols called avents • π is a priority function (a mapping of events to non-negative integers) • T is a set of transitions, i.e. of triple <G,e,P>, where: o G is a guard (a Boolean expression built over V) o E is an event o P is a post-condition (an instruction built over V) • i is an assignment called the initial assignment (a mapping from the set of variables to the set of values). • H and B are two possibly empty instructions called respectively the head and body parts of the assertion. The instructions can be seen as a mapping from assignments to assignments.

A transition

→ is fireable in a state (an assignment) , if it validates the guard and if the fix point ( ( ( ))) exists, i.e. there is an integer such that ( ( ( ))) = ( ( ( ))). The firing of this transition consists in three steps:

• First, the post-condition of the transition is performed.

• Second, the head part of the assertion is performed • Finally, the body part of the assertion is iterated until a fixpoint is reached. Hence, the state ( ( ( ))) is called the successor of by the transition → .

Case Study

Description

The case study is focused on the availability of a feed-water control system used in a power plant steam generator. It is described in [Deleuze, 2011].

The case is a classical problem of hybrid dependability with dynamic reliability issue. It has been studied e.g in France [START_REF][END_REF], [START_REF] Zhang | [END_REF], [Deleuze et al., 2011] and USA [NUREG 6942].

Instantiation of the meta-model

In this article, only the sub-system composed of the two feeding turbo pumps (TPA, in Figure 9), are considered. This sub-system has to perform only one function F: "Supply enough water to the steam generator". The pumps may fail and be repaired. To increase dependability of the function, the operation mode of each pump must be managed dynamically according to redundancy policies.

Defining Mission Phases

A first step is to build object diagrams on the basis of the meta-model. The main mission contains three phases (Table I). The function is mandatory in all phases but only one pump is needed to perform this function during the first and third phase.

Table I: Phases Description

Defining Component States

Instance diagrams are used to model the combination of operation modes and failure modes (see figure 6). The contribution of one pump to the function depends on its state. For example, When the pump is disabled (operation mode OFF), this contribution is obviously equal to zero. This is also the case when the Rupture failure mode has occurred. The analysis is not easier for the remaining four states, especially as they suppose leaks, with no complete loss of function. Thus values of the attribute "achievementRate" for every state of a pump have to be defined (see Figure 8).

Building the dynamic model

This subsection presents a large part of the SGTS which models the dysfunctional behavior of the pumps. It is built on the basis of the instance given in the last subsection.

Defining and initializing variables

The variables of the models are listed below:

called = False

Defining the transitions There are three transitions for changing the current mission phase, whose priority is 0:

= 1 → = 2 ∧ . ! = 100 = 2 →# = 3 ∧ . ! = 60 = 3 #→ = 1 ∧ . ! = 60
There are seven stochastic transitions (not priority) by pump which model failure and repair occurrences.

The values of probability rates are given by the Table II. Since the pumps are identical, only the transitions defined for the pump TPA1 are given below:

& '1. () = *+ ∧ & '1. ) = (,

Defining the assertion

The assertion aim is to compute if the function is satisfied and if the redundancy policies must be called. The head part of the assertion is sufficient, and the body part is reduced to the identity.

Contribution to System validation

The last stage we performed on this case study, is the assessment of the availability of the pumps for realistic scenarios. To do this, the SGTS described above, has been fully implemented using the tool PyCATSHOO [Chraïbi, 2013]. At this step, expert knowledge had been integrated to the model for filling the lack of knowledge due to the semantic used for interoperability. Finally, the availability is assessed with a Monte Carlo simulation (figure 9). The result is obtained for a sequence of twelve identical missions where the first phase lasts 1 day, the second 28 days and the third 1 day. The average unavailability is equal to 0.62%. Traceability is maintained throughout all levels of system model, since the early Customer Needs Analysis phase, that provides functional and dependability requirements:

1. Allocation of System Requirements to hardware, software, or manual actions. 2. Allocation of all functional and performance requirements or design constraints, either derived from or flowed down directly to components. 3. Traceability of requirements from source documentation through the whole project life cycle. 4. Traceability of the history of each requirement on the system is maintained and is retrievable.

To bridge functional and failure analysis, the SE framework used, as a starting point, the recent ISO 26262 safety standard. It specifies how to ensure traceability between specification activities and those of validation. System validation ensures that requirements and system implementation provide the right solution to the customer needs in terms of functionality and dependability.

Figure 4 :

 4 Figure 4: Example of state graph for one element of the steam generator

Figure 5 :

 5 Figure 5: Complete meta-model for the integration of dependability analyzes into SE processes [Piriou, 2013] It includes the following aspects: Phased missions. A phased mission system is characterized by a structure, failure and recovery

Figure 6 .

 6 Figure 6. Example of Instance Diagrams Figure 7 presents the quantification of the attributes of the State class instances. The first value (e.g. 0.01 for the state Run-Leak) is the failure rate of the transition that leads to this state and the second one (0.1 for the same state), is the repair rate to leave this state. As the pumps are identical, their states description are similar.

Figure

  Figure 7. States description Description of the effects of component states

•

  Phase = P1; • F.goal = 60; F.isSatisfied = True; • TPA1.OM = Run ; TPA1.FM = OK • TPA2.OM = OFF ; TPA2.FM = OK • R1.called = False; R2.

  B !! > ← = 2 ∧ ; . G H ;G IG >

Figure 9 :

 9 Figure 9: Unavailability of the pumps (x-axis : time in hours, y-axis : unavailability)

& '1. ) = 4 5 & '1. () = *+ ∧ & '1. ) = (,

Conclusions

With the extension of SE Meta-model presented in [Piriou, 2013], this case study describes how, from outputs of a SE process, a RAMS engineer can model realistic failure/repairing scenarios, define redundancy policies and dynamical allocation of functions caused by failure events. A sound SE process, supported by a tool like arKItect, can support the RAMS engineer to get data and models from the upstream processes (functional and physical architectures, allocation of functions, requirements...). It is especially helpful to manage the amount of data and the concurrent engineering activities required to assess dependability of hybrid systems, e.g. through traceability and capabilities to reconsider efficiently upstream stages of the design process with the output the RAMS studies. A "hub automaton" support the translation of the dynamic dependability model into dedicated RAMS tools like Pycatshoo. This case study is a first step towards interoperability of Systems Engineering and dynamic RAMS studies Complementary studies have to be done at the hub automaton level to represent more hybrid aspects, and at RAMS models level, to improve the dynamic reliability modeling aspects.