dataesr/scientific-paragraphs-categorization huggingface dataset:
The kernel is linked to platform-specific drivers at compiletime. At the beginning of its development in 2002, the security of Contiki was not the main concern. Security of communication was introduced later, while the source code has become a target of formal verification only very recently  [6, 19, 21]. A particularly interesting verification target discovered in these projects is the linked list module, one of the most critical modules of Contiki. This module offers a very rich API that is usable in many other contexts, and relies on a specific representation of lists. That makes it different from other classical implementations of linked lists and justifies the need for a dedicated verification effort. In a previous work  [6] , we performed formal specification and deductive verification of the list module using the Frama-C verification platform  [15].
Approach and Results. The present paper reports on a new verification effort for the list module based on a completely different specification approach. All functions of the module (including the function not proved correct previously) have been specified and formally verified. As in the previous work  [6] , the verification has been performed in the Frama-C/Wp tool  [15]  and relies on a formal specification in Acsl  [4] , the specification language offered by Frama-C. The proposed specifications have also been validated by proving a few client functions manipulating lists. The new specification approach is based on Acsl logic lists whose support in the tool has been recently improved. The main principle of the verification is to show how the linked list data structure can be related to a logic view of the list.
The contributions of this work include • formal specification of the list module 1 of Contiki in the Acsl specification language and its complete deductive verification using the Wp plugin of Frama-C; • a presentation of the underlying approach based on the Acsl logic list type; • formal statement and proof of several lemmas useful for reasoning about this representation;   4  • a preliminary validation of the proposed specification of the module via a successful verification of a few annotated test functions dealing with lists; • a comparison with our previous approach based on ghost arrays, underlining strong and weak points of each technique. Outline. The paper is organized as follows. Section 2 presents the specifics of the linked list module. Section 3 describes our verification approach.
THE LIST MODULE OF CONTIKI The linked list module list is a critical library in Contiki. It is required by 32 modules in the core of the OS and invoked more than 250 times. Lists are for example used to manage timers in the scheduler. Formal specification and verification of this module are thus required to prove many other modules of Contiki. Figure  1  gives the API of the module. This API differs from common linked list implementations in multiple aspects. First, an existing list (illustrated by the lower part of Figure  2 ) is identified thanks to a list handler -a variable supposed to refer to the first element of the list -named root in Figure  2. Creating a copy (cf. lines 22-23 in Figure  1 ) of the list does not consist in duplicating each element of the list but only in copying the list handler.
The compilation of Contiki is configured to prevent the compiler to make code transformation following the assumption of strict-aliasing compliance. Third, in Contiki, memory is provided to (and released by) processes through blocks stored in a pre-allocated array (see  [19]  for more detail). Thus, the list module does not perform any dynamic allocation, and the size of the list is bounded to the number of originally available memory blocks. All elements in a list should be distinct memory regions. In particular, duplicates (leading to a circular list) are not allowed. Fourth, calling a function to add an element into a list is allowed even if this element is already in the list. In such a case, the element is first removed from the list, and then added (at the beginning, the end, or elsewhere, depending on the function called).
Modeling Linked Lists using Logic Lists For specification and verification of the list module, it is convenient to have a more abstract view of the elements of a linked list. In a previous work  [6] , we used a companion ghost array for this purpose. Our new approach relies on a companion logic list and uses the logic list datatype available in Acsl. This datatype, denoted It has two usual constructors: \Nil (also written []), the empty list, and \Cons(type, \list<type>), that builds a new list \Cons(e, l), also denoted by e::l, from a given list l and an element e added at the beginning. Instead of \Cons(item,\Nil), a singleton list can be written  [|item|]. It also provides some other features, for example concatenation (denoted by l1 ^l2), length, n th element, etc. In our case, we use logic lists of type \list<struct list*>, that will contain the addresses of elements of the linked list.
1 /* @ 2 predicate in_list { L } 3 ( struct list * e , \list<struct list *> l) = 4 ∃ Z n ; 0 ≤ n < \length ( l ) ∧ \nth (l , n ) == e ; For example, lines 2-4 of Figure  3  show a predicate stating that list element e is present in logic list l, while lines 6-9 illustrate a predicate stating that list element e is separated from (that is, has no overlap with) the elements in logic list l. In an Acsl annotation, each of the predicates can specify the program point (or label) L where it should hold. Examples of predefined labels in Acsl are Pre and Post (respectively, to refer to the states before and after the function execution), as well as Here (for the current program point). If the label is omitted, it is set by default to the current point. A logic view of a C linked list is built using two different constructs (see Figure  4 ): an inductive predicate linked_ll establishing the equivalence between a C linked list and a logic list, and an axiomatically defined logic function to_ll ("to logic list") that translates a C list into the corresponding logic list.
The list_insert Function The present work is the first complete verification of the linked list module of Contiki, including the list_insert function. The list_insert function inserts a given list element new into a given linked list pLst after another given element prev, or at the beginning of the list if prev is NULL (cf. Figure  1 ). Our previous verification study  [6]  of the list module detected and reported an error in this function, which thus remained unverified. The error was fixed since that time, so we address the verification of this function in this study. The verification of the list_insert function was particularly challenging, mainly because it has several quite different cases to handle, depending on where the element new should be inserted and whether it is already present somewhere in the list or not.
RESULTS OF THE VERIFICATION In this work, we have formally specified and verified all functions of the list module of Contiki. In total, for about 176 lines of C code in the module (excluding macros), we wrote about 1700 lines of annotations, including about 410 lines for contracts and 270 lines for logic definitions and lemmas. They constitute a solid basis for the verification of client modules using linked lists, its future extensions and other similar implementations. We did not specifically try to minimize the number of intermediate assertions: they were added to explicitly state the expected local properties and to help the automatic proof, and some of them could probably be removed. On the other hand, these assertions can be useful to illustrate the expected reasoning of the provers and to make the logic of this reasoning clearer for the verification engineer.
For this annotated version of the module, the verification using Frama-C/Wp generates 757 goals (also called proof obligations or verification conditions). This number includes 68 goals for the verification of absence of runtime errors that are often responsible for security vulnerabilities and have also been carefully checked by Frama-C/Wp. It also includes 33 auxiliary lemmas (that is, only about 4. 4% of all properties). These lemmas are proved interactively using Coq v. 8  Note that the verification of the list_insert function represents, in terms of annotations and verification conditions, the third of the verification effort. In total, for the three functions (list_insert, list_split and list_force_insert) discussed in Section 3. 5, we wrote 626 lines of annotations, that is more than a third of all annotations.
For them, Wp generates 259 proofs obligations (again, a third of all generated proof obligations). Finally, this function is the only one that forced us to use Coq to prove assertions. Interestingly, these assertions were not hard to verify with Coq, so we assume that the failure of the SMT solvers to prove these goals is due to the size of the proof context. In order to get confidence in our specification of the list module functions, we wrote 15 valid test functions manipulating lists, and proved simple properties about them using Frama-C/Wp. We have also implemented 15 invalid tests. Each invalid function is an altered version of a valid one where either the contract or the function contains an error. As expected for those functions, the verification leads to proof failure. This gives us further confidence that the proposed contracts can be used to verify client functions.
For the new specified code relying on logic lists, Wp generates 33 goals for lemmas and 470 for other annotations. Except lemmas, all goals are automatically discharged in about 5 min 30 s, that is, 0. 702 s per goal on average. For the version based on ghost arrays, Wp generates 24 goals for lemmas and 781 goals for other annotations. Using more recent versions allowed to decrease the time needed for the proof using ghost arrays from about 50 min (using the same versions of the code and the tools as in  [6]  and the script provided to launch the verification) to 21 min 20 s (that is, 1. 639 s per goal on average). This speedup can be explained by improvements in the recent versions of Frama-C and the provers, and the fact that we use less SMT solvers, thus allowing to verify more proof obligations in parallel (since for each obligation, we start two SMT solvers instead of four solvers used in  [6] ).
Thus, we expect the logic list based formalizations to be harder to handle by non-specialists. For experienced engineers, this should not be a major obstacle though: once the lemmas are proved and understood, they can be applied again and again. Another advantage of the previous version is its compatibility with runtime verification. A previous work  [18]  provides a proof of concept that the ghost array based formalization can be made executable, and thus can be used to check by runtime verification that the preconditions stated for the functions of the list module are respected by some user code. Currently, is not clear whether the new approach can be made executable. The runtime verification plugin E-Acsl  [16]  of Frama-C does not support logic lists, and adding this support would require to implement this datatype in E-Acsl.
Finally, ghost arrays can be used to model other linked data structures. For example, Dross et al. [9]  prove an implementation of red-black trees in SPARK that involves underlying arrays. They also rely on ghost code for the proof. In another work  [7] , Frama-C was used to prove a heap data structure implemented as a tree flattened into an array. So we expect that tree data structures could be proved in Frama-C using an approach based on ghost arrays. In comparison, using another pure logic type would require an extension of the Acsl language and its tool support.
RELATED WORK For the verification of linked data structures, that involves important separation properties, separation logic  [24]  can be more suitable than Hoare logic, on which the Wp plugin of Frama-C is based. Tools based on separation logic can be more efficient to verify a linked list API. This is for example the case for VeriFast  [14] , that has been used in several industrial case studies  [22] , or the Verified Software Toolchain (VST)  [1, 3] , mainly used for the verification of crytography related software  [2, 27]  but also a message passing system  [20]. We are currently not aware of efforts specifically dedicated to linked list modules, even if the example gallery of VeriFast 4  and the VST case studies do include linked list function specifications and verification. These specifications follow the idea proposed by Reynolds in  [24]  and are based on a logic list data structure and an inductive predicate relating the memory and such a logical data structure.
In our work, we essentially followed the same idea, by expressing separation hypotheses in another way. We used Frama-C since it enables the use of various verification techniques for different parts of code, that is an important advantage in such an ambitious project as the verification of Contiki. The logic types of Acsl basically provide a way of defining abstract data types. For programming languages that provide highlevel ways of describing abstract data types (ADT), such as Eiffel or Java, the language itself can define side-effect free immutable ADTs. Such ADTs can then be used in specifications  [23]. Such ADTs are often called models and are related to implementation classes in a way similar to the way we related a C linked list with an Acsl logic list. As these model classes are valid classes, they can be used in dynamic verification tasks.
Being a framework for Coq also means that the specifications can be written in the very rich Gallina language of Coq. Additionally, the soundness of the underlying logic of VST has been proved in Coq. The same applies to the Wp plugin and VeriFast, even though only subsets of the tools have been considered so far  [13, 26]. Based on our experience of teaching both Frama-C and Coq, the former is much more accessible to students and junior engineers who know how to program in C. With basic knowledge on first order logic, Acsl specifications are more easily understood than Coq statements, and therefore VST specifications.
CONCLUSION The linked list module of Contiki is both one of the most critical and widely used modules in the OS. The present work performed a first complete formal specification and deductive verification of this module. It proposed a specification approach using logic lists in order to represent and manipulate the elements of a C list. Logic lists provide a practical high-level view of C lists for the specification of the functions. The proof was tested for several definitions of list data structure. We have stated several useful lemmas to reason about logic lists, and proved them in the interactive proof assistant Coq. These lemmas will be useful in future verification case studies for client functions and similar modules. The specification of the list_insert function allowed us to propose an optimized implementation, which also made the verification easier.
ACKNOWLEDGMENTS This work was partially supported by a grant from  CPER DATA  and the project  VESSEDIA , which has received funding from the  European Union 's  Horizon 2020 research and innovation programme  under grant agreement No  731453. The authors thank the  Frama-C team  for providing the tools and support, as well as  Patrick Baudin ,  François Bobot  and  Loïc Correnson  for many fruitful discussions and advice. Many thanks to the anonymous referees for their helpful comments.
Acknowledgements: We are grateful to  Niel de Beaudrap  for sharing with us their initial work on the effectiveness of small error correcting codes for NQIT device and the details of Q20:20 noise model [2]. D. M. would also like to thank the  Atos quantum computing R&D team of Les Clayes-sous-Bois, Paris , for a bountiful supply of expertise in classical simulation of quantum computers. The authors would also like to thank the anonymous reviewers of this work who, though their suggestions, contributed significantly. This work was supported by  EPSRC  grants  EP/N003829/1  and  EP/M013243/1 , and  EP/L01503X/1  for the  University of Edinburgh, School of Informatics, Centre for Doctoral Training in Pervasive Parallelism.
To the best of our knowledge, we are the first to study the similarities between affordances. Second, by innovatively applying the Kano model and affordance-based design into online review analysis, we bring traditional design methods new vitality in the era of big data. Third, we extend the application of design-centred online review analysis, by providing innovation leads and capturing the changes of user preferences, to guide decision making for the product design of a new generation. The remainder of this paper is organized as follows. Section 2 briefly describes the affordance-based design. Section 3 describes the research framework of our work. Section 4 presents the data ICED19 structuration method, which identifies automatically product affordances and the associated usage contexts and user perceptions.
In this regard, we classify similar affordances and sort the affordances by their frequency of occurrence. This part of study includes similarity evaluation, clustering, performance analysis, and innovation leads identification (Figure  1 ). Meanwhile, as a flow of information, it possible to capture user preferences on product affordances overtime from online review data, which enable design companies to follow the trends in commerce rapidly and thus gain more market share. Therefore, in the third step, we develop another data ICED19 analytics method based on the automatically identified affordances. We measure users' preference on the affordances with conjoint analysis and then categorize them on the Kano model. Changes of user preference can be observed through the online reviews posted in different timespans.
CONCLUSION Online reviews have been studied by many researchers in product design due to their rich content and high reliability. Unlike the previous research on feature-based opinion mining, we provide a data structuration method that can automatically identify product affordances and the associated usage conditions and perceptions from online reviews, which provide more information for designers to understand their customers. In addition, we provide two data analytics method to identify innovation leads and capture the changes in user preferences based on the structured data, which were less discussed in previous research. To evaluate the effectiveness of our proposed framework, we conducted experiments and case studies using the online reviews of Kindle Paperwhite (KP) e-readers. A set of practical suggestions for the design of next-generation e-reader has been drawn.
The dataset ET, T and E data have been acquired over a drip irrigated wheat field in the Haouz plain in Morocco during the 2016-2017 growing season. The study field has been stressed voluntarily during 3 periods. ET was estimated with a standard eddycovariance tower (CSAT3 sonic anemometer and KH20 krypton hygrometer) completed by a CNR1 net radiometer and HFT3 soil hat flux plates buried at 5 cm. Surface temperature was measured by using an infrared thermoradiometer (IRTS-P) and surface soil moisture by CS615 TDR probes at 5 cm. EC data were corrected by forcing the Bowen ratio closure. T was measured with the SHB micro-sap flow method using Dynagage SF sensors. E was estimated by a SFL lysimeter at a 30 cm depth with special treatment to prevent plant transpiration while capturing plant shadowing effect on the ground.
ACKNOWLEDGEMENTS Funding from the  CNES/TOSCA program  for the  PITEAS  project is gratefully acknowledged. Initial set up and maintenance of the field instrumentation have been funded by the  Joint International Laboratory TREMA  (cf. http://trema. ucam. ac. ma). The dataset was acquired with support by the  European Commission Horizon 2020 Programme for Research and Innovation (H2020)  in the context of the  Marie Sklodowska-Curie Research and Innovation Staff Exchange (RISE) action  ( REC project , grant agreement no  645642 ) and by the  French Agence Nationale de la Recherche  ( MIXMOD-E  project,  ANR-13-JS06-003-01 ). Other funding was provided by  SAGESSE (PPR program  funded by the  Moroccan Ministry of Higher Education  Grant agreement no:  PPR/2015/48 ). We especially thank the farmer  Omar Rafi  for giving access to his fields.
BRDF Parameterization and fitting Unfortunately, no single general model is adaptable to the very wide variety of materials existing in the real world. Fitting the parameters of existing models from measured data only rarely provide comparable predictive curves and appearances. Several authors have employed basis functions for exploiting BRDF data with global illumination algorithms. For instance, cosine lobes have been first employed by Phong  [9] , for empirically representing glossy materials. The idea has been extended by Lafortune  [90]  for managing several lobes. In France, such representations have been used for fitting image-based data  [91] , and for interactive rendering  [92]  for instance. N. Noé and B. Péroche have employed a hierarchical approach and locally supported functions  [93].
L. Claustres et al. have employed wavelets for representing and efficiently rendering materials  [94, 95]. C. Soler et al. benefit from a Gaussian process for representing, managing and interpolating BRDF data  [96, 97]. J. Dupuy et al. also propose a method for recovering microfacet distribution parameters and refraction indices using power iterations  [98]. Besides, the choice of a BRDF correct parametrization is not straightforward because of high frequency effects and anisotropy. Several French authors have proposed studies for determining a hemispherical representation that relies on the reflection geometry  [99] [100] [101] [102].
g. sensors 5 and 9). In this section, the algorithm used to reconstruct non-sampled data is explained. As mentioned earlier, the Sink detects and replaces non sampled data with a "Nan" value. After a certain period of time, let's say M rounds, defined by the user, the sink runs a reconstruction algorithm that can replace all the "Nan" values with estimations calculated using the spatial and temporal correlation among the data reported by the sensor nodes in the network. This algorithm it is deployed on the Sink instead of the CH due to its complexity. If deployed on CH it will consume a great amount of energy. The reconstruction algorithm proposed in  [35]  essentially used to estimate missing data in co-evolving time series was adopted and adapted to suit our case. Assuming after M rounds, the Sink would have stored in his Sink the following data-set: SinkDataSet =         x 1 1 x 2 1 x 3 1.
V. EXPERIMENTAL RESULTS We implemented our algorithm in addition to DPCAS  [11]  in a custom WSN simulator built in Matlab, and we conducted multiple experiments in order to evaluate and compare their performances. In the simulation, we used real sensor readings collected from a sensor network that was deployed at the Grand-St-Bernard pass between Switzerland and Italy  [37]. The Network consisted of 23 sensors, each one of them collects 9 different environmental features with a fixed sampling rate of 1 sample every 2 minutes. We have chosen 4 out of these 9 features (ambient temperature [C • ], Surface temperature [C • ], relative humidity [%], and wind speed [m/s]), since the others are not complete. Environmental features are usually stationary, therefore, in addition to taking a sample every 2 minutes, and for a rigorous comparison, we set up two other scenarios, the first one, a sample is taken every 10 minutes instead, and the second one, a sample is taken every 20 minutes.