domain: chim.mate sdv spi

text:
Charlotte Durif

Mélanie Wynn

Maxime Balestrat

Giorgia Franchin

Young-Wook Kim

Anne Leriche

Philippe Miele

Paolo Colombo

Samuel Bernard
email: samuel.bernard@unilim.fr

Open-celled silicon carbide foams with high porosity from boron-modified polycarbosilanes

Keywords:

Introduction

Porous solids possessing a large amount of internal surface area are suitable for performing specific functions for a large variety of applications related to separation techniques, i.e., especially for energy and environment-related fields, that require fast and effi cient transport in, out, or within a high porosity. Their performance and function are governed by the class of materials they belong to, i.e., polymers, metals, ceramics, the chemical composition of the considered porous scaff old material, and the porosity characteristics (pore shape, average pore size and size distribution, pore interconnectivity and tortuosity).

An appropriate classification of the porosity is based on the investigations made by Dubinin [START_REF] Dubinin | The potential theory of adsorption of gases and vapors for adsorbents with energetically nonuniform surfaces[END_REF] and adopted by Everett [START_REF] Everett | IUPAC, Manual of symbol and terminology for physico-chemical quantities and units, appendix, definitions, terminology and symbols in colloid and surface chemistry, Part I[END_REF] then Sing et al. [START_REF] Sing | Reporting physisorption data for gas/solid systems with special reference to the determination of surface area and porosity[END_REF]. It consists in classifying pores as macropores ( > 50 nm, sintered ceramics, foams, …), mesopores in the range of 2-50 nm (mesoporous silica and carbon, …) and micropores < 2 nm (zeolite, activated carbon, metal organic framework, membranes, …) [START_REF] Lale | Polymer-derived ceramics with engineered mesoporosity: from design to application in catalysis[END_REF]. In such systems, (large) macropores are ideal for providing easy access to internal sites, while micro-or mesopores increase the surface area and therefore improve selectivity [START_REF] Sandra | Polymer-derived silicoboron carbonitride foams for CO2 capture: from design to application as scaff olds for the in-situ growth of metal-organic frameworks[END_REF][START_REF] Majoulet | Silicon-boron-carbon-nitrogen monoliths with high, interconnected and hierarchical porosity[END_REF].

The development of porosity in ceramics extends the functionality of the latter toward applications where a defined permeability for various fluids is required, especially at high temperature [START_REF] Scheithauer | Alternative process routes to manufacture porous ceramics-opportunities and challenges[END_REF]. A typical example is the Diesel Particulate Filter (DPF) usually made of silicon carbide (SiC), mainly used for the safe and eff ective reduction of Diesel engine exhaust gases and soot [START_REF] Sandra | Silicon carbide-based membranes with high filtration effi ciency, durability and catalytic activity for CO/HC oxidation and soot combustion[END_REF].

The porosity characteristics, thus the production of highly porous ceramic components such as SiC, are all determined by the selected processing strategies. In particular, designing porosity from nanoscale to microscale is a unique attribute of the chemical material technologies. Among these technologies, the chemical approaches based on tailormade preceramic polymers, such as the polymer-derived cera-mics (PDCs) route, off er a precise control over chemical compositions, microstructure and porosity characteristics at diff erent length scales for ceramics.

The PDCs method is based on the synthesis of a preceramic polymer as a precursor [START_REF] Colombo | Polymer-derived ceramics: 40 years of research and innovation in advanced ceramics[END_REF][START_REF] Mera | Ceramic nanocomposites from tailormade preceramic polymers[END_REF][START_REF] Viard | Polymer derived Si-B-C-N ceramics: 30 years of research[END_REF][START_REF] Termoss | Preparation of boron nitride-based coatings on metallic substrates via infrared irradiation of dip-coated polyborazylene[END_REF][START_REF] Ionescu | Ultrahigh temperature ceramics (UHTCs) and related materials -syntheses from polymeric precursors and energetics[END_REF][START_REF] Bernardo | Advanced ceramics from preceramic polymers modified at the nano-scale: a review[END_REF]. Its main purpose is to produce ceramic components, often as non-oxide, through the thermo-chemical conversion of preceramic polymers via shaping (to form the desired component), curing (to further crosslink the polymer), pyrolysis (to transform the cured polymer into an amorphous ceramic) and optionally annealing (to crystallize the amorphous ceramic). Interestingly, because of the possibilities of controlling the cross-linking degree, the type of bonds linking monomeric units and the nature of functional groups in preceramic polymers, polymer shaping (before or during curing) can be carried out to produce thin parts or complex architectures such as fibers, coatings, or dense monoliths [START_REF] Viard | Polymer-derived ceramics route toward SiCN and SiBCN fibers: from chemistry of polycarbosilazanes to the design and characterization of ceramic fibers[END_REF][START_REF] Barroso | Polymeric and ceramic silicon-based coatings -a review[END_REF][START_REF] Bernard | Polymer-derived boron nitride: a review on the chemistry, shaping and ceramic conversion of borazine derivatives[END_REF]. If the PDCs route is coupled with a porous network design method, at the polymer level, a control of the porosity can be achieved at various length scales [START_REF] Colombo | Engineering porosity in polymer-derived ceramics[END_REF][START_REF] Shi | Ordered mesoporous non-oxide materials[END_REF][START_REF] Lale | Organosilicon polymer-derived mesoporous 3D silicon carbide, carbonitride and nitride structures as platinum supports for hydrogen generation by hydrolysis of sodium borohydride[END_REF][START_REF] Borchardt | Preparation and application of cellular and nanoporous carbides[END_REF][START_REF] Vakifahmetoglu | Porous polymer derived ceramics[END_REF]. Based on the advantages provided by the PDCs route, the processing of opencelled SiC foams has been exploited in the present paper.

An approach to prepare open-celled foams consists in using sacrificial agents serving as placeholder substances to create open pore networks in the final ceramics [START_REF] Borchardt | Preparation and application of cellular and nanoporous carbides[END_REF][START_REF] Vakifahmetoglu | Porous polymer derived ceramics[END_REF][START_REF] Vakifahmetoglu | Highly porous macro-and micro-cellular ceramics from a polysilazane precursor[END_REF][START_REF] Schmalz | Analysis of polyethylene-particle filler SiCN precursor and the resulting porous ceramics with emphasis on using micro computed tomography[END_REF][START_REF] Konegger | Asymmetric polysilazane-derived ceramic structures with multiscalar porosity for membrane applications[END_REF][START_REF] Konegger | A novel processing approach for free-standing porous non-oxide ceramic supports from polycarbosilane and polysilazane precursors[END_REF]. Such agents mainly include organic materials that decompose without leaving residues during heating, such as poly(methyl methacrylate) (PMMA) beads, and that can be directly mixed with the SiC precursors. The selection of the latter is important: because uniaxial warm-pressing is a typical forming method to shape mixtures of preceramic polymers and PMMA and deliver highly porous non-oxide ceramics in monolithic form after pyrolysis [START_REF] Vakifahmetoglu | Porous polymer derived ceramics[END_REF][START_REF] Vakifahmetoglu | Highly porous macro-and micro-cellular ceramics from a polysilazane precursor[END_REF], an ideal open-celled SiC foam precursor would display a relatively high crosslink degree to be processed into pellets by warmpressing while plastic deformation then precursor particle joining occur, leading to infusible and consolidated green bodies. Subsequent pyrolysis should retain the shape of the material (i.e., controlled volume shrinkage) and lead to open-celled PDC foams (if the PMMA beads mixed with the ceramic precursor before warm-pressing are embedded in an amount large enough to create an interconnecting network), through the conversion of the precursor into ceramics, while PMMA is removed to leave voids, i.e., macropores.

The pioneered commercially available polycarbosilane (PCS), nominally '[SiH(CH3)CH2]n' obtained upon thermolysis of polysilanes (PS) [START_REF] Yajima | Continuous silicon carbide fiber of high tensile strength[END_REF][START_REF] Yajima | Development of a silicon carbide fibre with high tensile strength[END_REF], is a solid preceramic polymer displaying a relatively high ratio of C to Si (2:1) and a complex structure which appears to contain largely carbosilane linkages. PCS is melt-spinnable and led in the middle of the seventies to the achievement of the 1st generation of SiC fibers called Nicalon™ [START_REF] Yajima | Continuous silicon carbide fiber of high tensile strength[END_REF][START_REF] Yajima | Development of a silicon carbide fibre with high tensile strength[END_REF]. However, the preparation of other geometries than fibers is diffi cult because of the low ceramic yield of PCS and the strong shrinkage occurring during its pyrolytic conversion. Moreover, the compositional purity of the SiC ceramic produced by this process is limited by the lack of cross-linking moieties in the precursor, which requires oxidative curing to generate a non-fusible polymeric body. As a second commercially available PCS precursor, allylhydridopolycarbosilane (AHPCS), nominally [Si(CH2CH = CH2)) HCH2]0.1[SiH2CH2]0.9 [START_REF] Whitmarsh | Carbosilane polymer precursors to silicon carbide ceramics[END_REF] is produced by the Starfire Systems company [30]. It is a liquid and can produce SiC with an almost stoichiometric C:Si ratio. It has been previously investigated to produce porous SiC through its combination with PE [START_REF] Konegger | A novel processing approach for free-standing porous non-oxide ceramic supports from polycarbosilane and polysilazane precursors[END_REF] and PMMA [START_REF] Kotani | Processing of polymer-derived porous SiC body using allylhydridopolycarbosilane (AHPCS) and PMMA microbeads[END_REF] microbeads. The latter reported the mixing of AHPCS and PMMA microbeads in a slurry to be casted and then pyrolysed at 900 °C, forming foams. As a proof of concept, a thick disc-shaped porous ceramic body was successfully produced using 68 vol% of PMMA beads (90 μm diameter), after pyrolysis at 900 °C. No detailed information was provided about the morphological, mechanical and thermal characteristics of the materials. The major issue of AHPCS is its relatively low degree of crosslinking and the lack of low temperature cross-linkable functional groups, both involving the releases low molecular weight species such as oligomers in the early stages of the pyrolysis. This inherently reduces the ceramic yield while increasing the volume shrinkage, making the process diffi cult to scale up. Furthermore, using liquid AHPCS and solid sacrificial agents, it is really challenging to obtain highly porous components (porosity above 70 vol%) with a high degree of pore interconnectivity.

For further processing AHPCS into open-celled SiC foams, a solution would consist in firstly cross-linking the liquid AHPCS, allowing its transformation into rigid solid-state materials that could be then homogeneously mixed with PMMA microbeads. Thus, the latter will exhibit a higher ceramic yield to form open-celled SiC foams with a reduced volume shrinkage. This strategy has been demonstrated to prepare dense SiC objects [START_REF] Kaur | Pressureless fabrication of dense monolithic SiC ceramics from a polycarbosilane[END_REF]. However, this requires relatively high cross-linking temperatures (T approaching 250 °C) and uniaxial warmpressing should be performed at a significant higher temperature (T > 250 °C). Furthermore, it is diffi cult to precisely control the crosslinking evolution via the temperature (and the time at the set temperature), and the resulting polymers can be extensively crosslinked and therefore no longer processible.

To form a solid-state SiC precursors with a tuned plasticity at relatively low temperature, we modified AHPCS with borane dimethylsulfide to synthesize a boron-modified AHPCS with a tailored cross-linking degree according to a strategy reported recently by our group on various types of commercially available preceramic polymers [START_REF] Schmidt | Molecular-level processing of Si-(B)-C materials with tailored nano/microstructures[END_REF][START_REF] Bechelany | In-situ controlled growth of titanium nitride in amorphous silicon nitride: a general route toward bulk non-oxide nitride nanocomposites with very high hardness[END_REF][START_REF] Bechelany | Nanocomposites through chemistry of single-source precursors: understanding the role of chemistry behind the design of monolith-type nanostructured titanium nitride/silicon nitride[END_REF][START_REF] Viard | Molecular chemistry and engineering of boron-modified polyorganosilazanes as new processable and functional SiBCN precursors[END_REF][START_REF] Fonblanc | Crosslinking chemistry of poly (vinylmethyl-co-methyl)silazanes toward low-temperature formable preceramic polymers as precursors of functional aluminium-modified Si-C-N ceramics[END_REF]. Thus, this strategy allowed us to produce open-celled SiC foams containing free carbon and a low boron content by warm-pressing and pyrolysis. Carbon and boron additives are often used as sintering aids during the densification of SiC, based on the fact that carbon inhibits the ineff ective mass transport while boron favors dif-fusion and hence the ceramic densification [START_REF] Stobierski | Sintering of silicon carbide II. Eff ect of boron[END_REF]. Based on this strategy, we report, in the first part of the paper, the design of open-celled SiC foams by mixing the boron-modified AHPCS with PMMA microbeads of 25 μm in diameter. As-synthesized materials were characterized in detail by elemental analyses, SEM, mercury porosimetry and mechanical tests. To identify the potential of using these materials in harsh environments, their behavior at high temperature was investigated via HT-TGA, SEM, mercury porosimetry and BET. Then, aging as well as microfiltration tests were performed to simulate the conditions of a primary loop of coolant in a Pressurized Water Reactor (PWR). The schematic representation of the synthetic process is shown in Fig. 1.

Experimental procedure

For all the synthesis reactions, a ventilated hood equipped with a vacuum/argon line allowed to manipulate the chemical products under argon atmosphere. Argon (> 99.995%) was purified by passing through a column of phosphorus pentoxide (Sigma-Aldrich, Saint Quentin, France), sicapent™ (Millipore S.A.S, Molsheim, France) and copper oxide-based catalysts (Sigma-Aldrich, Saint Quentin, France)). The glassware was stored in an oven at 120 °C overnight before being assembled and pumped under vacuum for 30 min and then filled with argon. In order to keep inert conditions after the synthesis reactions, the manipulation of the chemical products was made inside argon-filled glove boxes (MBraun MB200B; O2 and H2O concentrations kept at < 0.1 ppm and Jacomex, Campus-type; O2 and H2O concentrations kept at ≤ 0.1 ppm and ≤ 0.8 ppm, respectively). Allylhydridopolycarbosilane (AHPCS labeled SMP-10, Starfire Systems® Incorporation, New York, USA), with a density of 0.998 g.cm -3 , was used as-received. Toluene (99.85%, Extra Dry over Molecular Sieve, AcroSeal(R)) was obtained from Acros Organics. Borane dimethylsulfide BH3⋅S(CH3)2 (BDMS complex solution 2.0 M in toluene) was obtained from Sigma Aldrich. Poly(methylmetacrylate) (PMMA) microbeads with a diameter of 25μm were provided by Atofina Italia, Milan, Italy.

Material preparation

Open-celled SiC foams were produced from a boron-modified allylhydridopolycarbosilane labelled AHPCSB30 (30 being the Si:B ratio fixed during the polymer synthesis) which was synthesized by reaction between AHPCS and BDMS according to a previously published report [START_REF] Schmidt | Molecular-level processing of Si-(B)-C materials with tailored nano/microstructures[END_REF]. AHPCSB30 was ground in an agate mortar, then it was mixed with 25 μm PMMA microbeads in AHPCSB30:PMMA weight ratios ranging from 10:90 to 30:70. The mixture was homogenized in a mortar and the mixture was then pressed at 74 MPa, in a steel die with diameter 13 mm with a heating mantle, from RT to 120 °C, using an automatic uniaxial press (Atlas Auto model, Specac) set-up in a nitrogenfilled glove-box. We also investigated a higher steel die diameter (25.6 mm) for further scaling-up. The homogeneous mixture was in-troduced in the steel die, put under load and heated to the desired temperature of warm-pressing, then the temperature was held for 0.5 h. The samples were slowly deloaded after cooling down to RT (within 1 h). Typical dimensions of the cylindrical green bodies were 13 mm × 1.6 mm (Please note that compressive strength measurements required a sample thickness of 4 mm; thus, we used a higher quantity of mixture for warm-pressing to perform mechanical measurements). Green samples were placed in alumina boats, and then transferred under argon flow into a silica tube inserted in a horizontal furnace (Carbolite BGHA12/450B). The tube was pumped under vacuum (1.10 -1 mbar) and refilled with argon (99.995%) at atmospheric pressure. Subsequently, the samples were subjected to a cycle of ramping of 0.5 °C.min -1 to 450 °C (dwelling time of 2 h) then to 1000 °C (dwelling time of 2 h) to form mSiBC30_10 samples. A constant flow of argon (120 mL.min -1 ) was passed through the tube during the pyrolysis cycle. In order to investigate the high temperature behavior of the mSiBC30_10 samples, annealing treatments were performed above 1000 °C in a graphite furnace (Gero Model HTK 8). The furnace was pumped under vacuum (1.10 -1 mbar), refilled with argon and maintained under a constant flow of argon (200 mL.min -1 ) during the whole heat treatment. The program consisted of a 5 °C min -1 heating ramp up to the maximum temperature fixed in the range 1000-1500 °C, dwelling at this temperature for 2 h, and cooling down to RT at 5 °C.min -1 . The samples were labelled as mSiBC30_X, X being the two first digits of the temperature at which the open-celled SiC foams were heated, e.g., X = 13 for 1300 °C.

Material characterization

AHPCSB30 was fully characterized in our previous report [START_REF] Schmidt | Molecular-level processing of Si-(B)-C materials with tailored nano/microstructures[END_REF]. High-temperature thermogravimetric analysis (HT-TGA, Setaram Setsys 2400 CS evolution equipment) of the foams prepared at 1000 °C was performed in flowing argon from 25 to 1500 °C at a heating rate of 5 °C.min -1 using tungsten crucibles. X-ray diff raction was carried out from 20 to 80° with a step size of 0.0167° using a Philips PW 3040/60 X'Pert PRO X-ray diff raction system operating at 30 mA and 40 kV to identify the crystalline phase assemblage of the samples. Samples were also investigated by SEM (Hitachi S4800) coupled with EDX to assess the morphology of the samples while measuring the Si, C and O content in materials. ICP-OES (Perkin Elmer Optima 7000 DV) was performed at the IUT Montpellier-Sète (France). N2 adsorptiondesorption iso-therms were carried out using a Model Sorptomatic 1900 analyser (Fisons); prior to the analysis samples were degassed overnight at 150 °C. The Brunauer-Emmett-Teller (BET) method was used to cal-culate the specific surface area of samples. A Micromeritics Autopore IV 9500 mercury porosimeter was used to investigate the pore size dis-tribution of the samples. Compression tests were carried out on espe-cially designed cylindrical samples with 10 mm diameter and 4 mm height using a universal testing machine (Instron 1121 UTM, Instron Danvers, MA) at a cross head speed of 1 mm/min; at least three samples were tested for each data point, and values are reported as mean ± standard deviation. The aging tests of foams including mSiBC30_10 and mSiBC30_13 samples were performed in six micro-autoclaves made of Inconel 600 arranged set-up in an oven at 330 °C under 140 bar and containing demineralized water with 2.24 ppm (mg.L -1 ) of lithium and 590 ppm of boron at a pH of 6.8 to reproduce the working condi-tions of a primary loop of coolant [START_REF] Bourdet | Essais de capsules en four[END_REF] (Fig. 2).

In parallel, the microfiltration capacity of mSiBC30_10 samples was tested for 220 h by using a closed system under 90 bar up to 275 °C, which was based on a filter cascade as illustrated in Fig. 2. The filtration system, as a dead-end filtration process, contained diff erential pressure detectors at each of the three consecutive filters with diff erent porosity ranges [START_REF] Geier | Initial Operation of High Temperature Colloid Catcher with Kurt Microloop at AREVA Technical Center in Le Creusot[END_REF][START_REF] Lehr | Test Stage of High Temperature Colloid Catcher with KURT Micro Loop at AREVA Technical Center in Le Creusot[END_REF]. The mSiBC30_10 samples were considered as the filter 1 with the largest porosity. The foam was inserted in a PTFE ring for sealing before being mounted between two stainless pieces. The system was then set-up in the chamber of the filter 1. The two other filters with lower porosity were commercially available. Such a system allowed for the in-situ measurement of the pressure upstream and downstream from the open-celled SiC foams, during filtration at a flow rate of 40 mL•min -1 of demineralized water containing ethanolamine (3 ppm) and ammonia (1 ppm) as well as magnetite particles (around 5 μm in diameter and 10 g of particles for 50 ml of demineralized water), simulating the corrosion products coming from structural materials used in the primary loop of coolant.

Results and discussion

Design and characterization of open-celled SiC foams

The modification of AHPCS by BDMS allows adjusting the degree of cross-linking of the derived polymer, i.e., AHPCSB30 for solid-state processing. Thus, AHPCSB30 is a solid compound with a ceramic yield as high as 91% [START_REF] Schmidt | Molecular-level processing of Si-(B)-C materials with tailored nano/microstructures[END_REF] that could be mixed with 25 μm PMMA microbeads as a pore former to form homogeneously mixed powders with controlled AHPCSB30:PMMA weight ratios. Powders could be then warmpressed and pyrolyzed to generate foams. The 20:80 ratio was selected as the most appropriate AHPCSB30:PMMA weight ratio, based on the fact that the corresponding samples did not collapse upon pyrolysis (as observed with samples prepared with 10:90 and 15:85 wt ratios) while being mechanically stable and presenting a high level of interconnected porosity after pyrolysis (samples prepared with the 30:70 wt ratio did not display a significant level of interconnectivity). The pyrolysis at 1000 °C produced the mSiBC30_10 samples with an empirical formula of Si1.0B0.04C1.6O0.18. As-obtained samples are X-ray amorphous, based on the presence of diff use SiC diff raction peaks in their powder X-Ray Diff raction (XRD) pattern, and contain free carbon, as indicated by the chemical composition and the Raman spectrum through the appearance of the D and G bands of free carbon (See Fig. 1SI

in ESI).

As shown in Fig. 1, as-obtained materials reproduce the monolithic shape of the warm-pressed samples without the presence of any defects or cracks, whereas a volume shrinkage equivalent to 52.6% occurs (very close to bulk analogs). As shown in the high magnification SEM image (as inset in Fig. 1), the mSiBC30_10 samples display a typical combination of spherical voids with a size controlled by the diameter of the PMMA beads. These macropores, homogeneously distributed within the bulk, contain a large amount of cell windows, aff ording high inter-connectivity among adjacent cells to the foams. In order to better qualify and quantify the macroporosity and pore interconnectivity of in mSiBC30_10 samples, mercury intrusion porosimetry was carried out (Fig. 3).

During Hg porosimetry experiments, we observed a continuous increase in mercury uptake with the decrease in pore diameter within one intrusion step (i.e., increase of Hg intrusion pressure), as illustrated through the evolution of the cumulative pore volume versus pore diameter. This indicates a sharpening of the distribution of the cell windows in the samples. As a consequence, the log diff erential intrusion versus diameter, demonstrating the rate-limited filling of the pores by mercury under pressure, is represented by one signal with a shoulder on the left part from 5 to 7 μm allowing to range the size of the windows from 2 to 25 μm. The mSiBC30_10 samples exhibit a total porosity of 73.4 vol% and an intrusion volume as high as 1.47 cm 3 . g -1 . They display a bulk density as low as 0.51 g.cm -3 and a skeletal density of 1.92 g.cm -3 . We confirmed such data by increasing the diameter of the foams to 20 mm (See Fig. 2SI in ESI): A total porosity of 77.2 vol% and an intrusion volume as high as 1.66 cm 3 . g -1 have been determined. They display a bulk density as low as 0.47 g.cm -3 and a skeletal density of 2.04 g.cm -3 . According to the relatively high porosity, an average compressive strength of 3.49 ± 0.56 MPa was measured. Although it is challenging to speculate on these results, we can consider reports using a similar strategy to prepare foams. Based on an equivalent precursor (polysilazane):PMMA ratio (i.e., 20:80), C. Vakifahmetoglu et al. prepared Si(O)CN foams with an average compressive strength of 5.6 ± 0.7 MPa for a higher porosity (77.24 vol%) [START_REF] Vakifahmetoglu | Highly porous macro-and micro-cellular ceramics from a polysilazane precursor[END_REF]. SiOC microcellular produced from a silicone resin using the same amount and size of PMMA microbeads had a compression strength, after pyrolysis, of about 5.4 ± 0.9 MPa [START_REF] Colombo | Novel microcellular ceramics from a silicon resin[END_REF]. In contrast, using a physical blowing agent, the same authors produced oxygen-free SiCN foams with a porosity of 70.68 vol% and a flexural strength of 2.89 ± 1.04 MPa. Authors applied the model proposed by Gibson and Ashby [START_REF] Gibson | Cellular Solids, Structure and Properties[END_REF] to discuss on the compressive strength of their samples, for which the validity of the model is appropriate (relative density lower than 0.3). ) for the SiBC30_10 and mSiBC30_10 samples. SEM images of the mSiBC30_10 sample annealed at 1300 °C (mSiBC30_13) and 1500 °C (mSiBC30_15) as inset.

In our case, and based on SEM images, it appears that the mSiBC30_10 samples possess a morphology close to SiCN foams produced using a physical blowing agent and made of spheroidal cells with circular interconnecting windows. Thus, we can consider mSiBC30_10 samples as open-celled SiC foams and this is most probably the reason of their lower compressive strength compared to those measured for Si (O)CN foams using an equivalent precursor:PMMA ratio (i.e., 20:80).

High temperature behavior of open-celled SiC foams

The high temperature behavior of mSiBC30_10 samples was first investigated through high temperature TG experiments up to 1500 °C in an argon atmosphere (Fig. 4). As a comparison, the TG curve of the bulk analog labelled SiBC30_10, prepared by direct pyrolysis of AHPCSB30 in an argon atmosphere at 1000 °C was reported [START_REF] Schmidt | Molecular-level processing of Si-(B)-C materials with tailored nano/microstructures[END_REF]. Then, complementary characterization experiments of samples pyrolyzed at different temperatures in the temperature range 1000-1500 °C were carried out to follow the evolution of the porosity characteristic and the mechanical behavior of open-celled SiC foams at high temperature.

As expected, the mSiBC30_10 samples do not undergo any weight loss after heat-treatment to 1000 °C; temperature at which they were prepared. Then, a two-step weight loss occurs: a first and very small weight loss (0.25%) was measured in the temperature range 1000-1300 °C and a second one, more significant (3.75%), was then identified from 1300 to 1500 °C. Thus, a total weight loss of 4% was measured at 1500 °C for mSiBC30_10 samples. It should be pointed out that the shrinkage upon annealing to 1500 °C is diffi cult to quantify because its evolution is very poor. As a comparison, the SiBC30_10 samples display a single weight loss from 1120 °C to 1500 °C. A total weight loss as low as 0.55% has been measured at 1500 °C for the SiBC30_10 samples.

The diff erences in terms of high temperature thermal behavior between both samples are related to both the architecture and composition of the materials. First, it should be pointed out that the mSiBC30_10 samples contain a certain amount of oxygen (5.6 wt%) whereas the bulk analogs exhibit a very low oxygen content (0.3 wt%). The boron and carbon contents in the macroporous samples are 0.9 and 35.6 wt%, respectively. These values, especially for boron, are relatively close to those found in the bulk analog [START_REF] Schmidt | Molecular-level processing of Si-(B)-C materials with tailored nano/microstructures[END_REF]. The higher carbon content in the porous samples most probably comes from the presence of carbon residue from decomposition of PMMA. The oxygen intake could be attributed to the combined eff ects of (a) the use of PMMA (its decomposition during the pyrolysis involving release of oxygen-based species that could react with the system which is not yet fully converted into a ceramic), (b) relatively high sensitivity of the preceramic polymer to moisture (during warm pressing, although performed in a glove-box, transfer into the furnace, handling for characterization) [START_REF] Vakifahmetoglu | Highly porous macro-and micro-cellular ceramics from a polysilazane precursor[END_REF], and (c) the presence of an open porosity that makes the sample more sensitive to oxidation. In addition, we cannot exclude in both samples the presence of residual hydrogen that is removed above 1000 °C during the transformation of AHPCSB30 into SiC [START_REF] Schmidt | Molecular-level processing of Si-(B)-C materials with tailored nano/microstructures[END_REF]. Secondly, the mSiBC30_10 samples possess an open and accessible network structure (because of interconnected pores), as demonstrated by SEM images (Fig. 1), that clearly facilitates the release of gaseous species, especially compared to "closed" systems as represented by the bulk analog, i.e., SiBC30_10 samples. Thus, the release of residual hydrogen is most probably associated with the first weight loss identified between 1000 and 1300 °C for the mSiBC30_10 samples, and shifted to higher temperature, i.e., above 1120 °C, for SiBC30_10 samples. The weight loss observed in mSiBC30_10 samples when the temperature is raised beyond about 1300 °C could be attributed to the evolution of oxygen-containing gaseous species such as CO and SiO [START_REF] Johnson | Degradation me-chanisms of silicon carbide fibers[END_REF][START_REF] Prewo | Silicon carbide yarn reinforced glass matrix composites[END_REF]. The latter is expected to readily react with free carbon to form stoichiometric SiC by carboreduction reaction at higher temperature, involving CO. To confirm the formation of SiC after annealing to 1500 °C, we observed the evolution of the porous structure of the samples by SEM/ EDS after annealing to 1000 °C (See Fig. 1 as inset), 1300 °C and 1500 °C (Fig. 4 as inset). Whereas the SEM images of mSiBC30_13 samples, i.e., mSiBC30_10 samples annealed at 1300 °C (Fig. 4 as inset), do not show any diff erence in terms of pore structure and distribution compared to the mSiBC30_10 samples, we observed the formation of SiC (as confirmed by EDS) whiskers in the mSiBC30_15 samples, i.e., mSiBC30_10 samples annealed at 1500 °C (Fig. 4 as inset), highlighting the occur-rence of vapor phase reactions at high temperature, most probably in the temperature range 1300-1500 °C. In such porous samples, the dif-fusion paths for CO (resulting from the reaction between silicon oxide gases and free carbon) are shorter and hence, formation of stoichio-metric SiC is kinetically favored compared to bulk samples in which no SiC whiskers were identified after annealing to 1500 °C.

In order to understand the eff ect of the high temperature treatment of open-celled SiC foams on their porosity characteristics, the evolution of the pore architecture of the mSiBC30_10 samples between 1000 and 1500 °C was firstly assessed at the mesoscopic length scale by nitrogen gas adsorption-desorption measurements at 77°K (Fig. 5). Thus, mSiBC30_X (X = 12 (1200 °C), 13 (1300 °C) and 15 (1500 °C)) samples were obtained by annealing treatment of the mSiBC30_10 samples at 1200, 1300 and 1500 °C (a dwelling time of 2 h was applied at the final temperature).

Based on IUPAC classification [START_REF] Sing | Reporting physisorption data for gas/solid systems with special reference to the determination of surface area and porosity[END_REF][START_REF] Everett | IUPAC, manual of symbols and terminology for physicochemical quantities and units, appendix II: definitions, terminology and symbols in colloid and surface chemistry[END_REF], the adsorption-desorption isotherms of the mSiBC30_10 samples has a type-II shape, characterized by a progressive increase of the adsorbed quantity of nitrogen with the P/Po increase: such an isotherm is in general produced from nonporous or macroporous samples. As a confirmation of the macroporous nature of this sample, a specific BET surface area as low as 1.7 m²•g -1 was measured, whereas a total pore volume (for pores smaller than 79.61 nm) of only 0.0017 cm 3 g -1 was determined from the amount of nitrogen adsorbed at P/Po = 0.97. The horizontal isotherm characteristic of the mSiBC30_12 samples indicates a saturation of the adsorbent. Such isotherms are in general obtained with adsorbents containing micropores. This is confirmed with the relatively fast increase of the adsorbed volume at very low P/Po, indicating the development of microporosity in this sample. This can be related to the release of dihydrogen from the mSiBC30_10 samples from 1000 to 1200 °C, involving the first weight loss identified in the TG curve depicted in Fig. 4. As a consequence, an increase of the specific BET surface area to 6.7 m²•g -1 was measured, whereas a total pore volume (for pores smaller than 79.6115 nm) of 0.0040 cm 3 g -1 was determined from the amount of nitrogen adsorbed at P/Po = 0.97 in the mSiBC30_12 samples. The specific BET surface area still increased in the mSiBC30_13 samples to reach a value of 58.44 m²•g -1 , because of the contribution of micropores (fast increase of the adsorbed volume at very low P/Po). To illustrate this, a pore size of 2.93 nm was computed at the mesoscopic length scale in the mSiBC30_13 samples, whereas it was 20 nm in the mSiBC30_12 samples. The total pore volume (for pores smaller than 79.6115), determined from the amount of nitrogen adsorbed at P/ Po = 0.97, increased to 0.029 cm 3 g -1 confirming the formation of a hierarchical porosity within the sample. The profile of the isotherms of the mSiBC30_15 samples shows a H3-type hysteresis from P/Po = 0.4 to P/Po = 1, which is characteristic of a low degree of pore curvature and non-rigidity of the aggregate structure. Although the BET surface area decreased to 16.9 m²•g -1 , the total pore volume (for pores smaller than 79.6115 nm), determined from the amount of nitrogen adsorbed at P/Po = 0.97, still increased to 0.042 cm 3 g -1 most probably because of the increased content of macropores to the detriment of mesopores. We suggested that this was due to the coalescence of micropores and mesopores into macropores. Therefore, the evolution of the pore architecture of the mSiBC30_10 samples between 1000 and 1500 °C, at the mesoscopic length scale, confirms the TG experiments concerning the release of gases from the samples that help to develop the micro-and mesoporosity in open-celled SiC foams at high temperature. Thus, opencelled SiC foams with hierarchical porosity were produced at 1300 and 1500 °C. In contrast, the macroporous volume, measured by Hg porosimetry, did not change drastically upon annealing to 1500 °C: it varies from 73.4 vol% (mSiBC30_10 samples) to 70.5 vol% (mSiBC30_15 samples). The mSiBC30_13 samples possess a porosity of 71.6 vol%. In the same time, the skeletal density varies from 1.92 g.cm -3 (mSiBC30_10 samples) to 2.06 g.cm -3 (mSiBC30_13 samples) before decreasing to 1.54 g.cm -3 (mSiBC30_15 samples). The mechanical properties of the mSiBC30_10 samples remain stable even after at 1300 °C, i.e., mSiBC30_13 samples, which possess a compression strength of 3.37 ± 1.86 MPa. It decreases to 2.26 ± 0.49 MPa for the mSiBC30_15 samples that tend to confirm the degradation of opencelled SiC foams upon annealing above 1300 °C.

Based on the results discussed above, it is reasonable to consider that open-celled SiC foams are relatively stable even after annealing to 1300 °C. Interestingly, we can tune the porosity of the foams at diff erent length scales through the temperature of annealing: opencelled SiC foams were produced at 1000 °C whereas foams with a hierarchical porosity were produced at 1300 °C. In the latter, the microstructural characterization carried out by XRD revealed the presence of distinct XRD peaks related to the β-SiC phase at 2θ = 35.6° (111), 60.2° (220), and 72.1° (311) (mSiBC30_13 samples; See Fig. 2SI in ESI), which were poorly resolved in the XRD pattern of the mSiBC30_10 samples (See Fig. 1SIa in ESI). The crystal growth also followed an increasing trend with processing temperature, according to the calculation of the average crystallite size by applying the Scherrer equation to the (111) peak, which showed an increase of the grain size from 0.8 nm for the mSiBC30_10 samples to 2.3 nm for the mSiBC30_13 samples.

Ageing and microfiltration tests of open-celled SiC foams

Both mSiBC30_10 and mSiBC30_13 samples were used for investigating the ageing of open-celled SiC foams and their chemical stability in the working conditions of a primary coolant loop in a Pressurized Water Reactor (PWR). In parallel, the microfiltration capacity of foams toward colloids was investigated.

The primary loop of coolant, flowing through the reactor core at very high pressure to remain a liquid, prevents water from boiling within the reactor. It is comprised of a solution made of boric acid and lithium hydroxide to maintain the reactor coolant at an alkaline value. Because the primary loop is made of nickel and zirconium alloys as well as stainless steels, corrosion occurs. The corrosion products coming from the corrosion of the structure materials in contact with the primary coolant are in the form of soluble, colloidal or particulate compounds, which are transported by the primary coolant to the core where they become activated and redistributed out of the core surfaces. The deposits as radionuclides generate dose rate mainly at the bottom of the pressurized reaction vessel and on the surface of the steam generator tubes [START_REF] Beslu | Occupation radiation exposure at French power plants: measurement and Prediction[END_REF]. To limit the formation of radionuclides and reduce the dose rates, porous ceramics could be employed to separate such radionuclides from the solution. However, porous ceramics should be stable in the conditions imposed by the primary loop. In the present work, ageing tests were performed in a static autoclave under 140 bar at 330 °C in demineralized water containing 2.24 ppm (mg•L -1 ) of lithium and 590 ppm of boron (both measured by ICP), at a pH of 6.8, to reproduce the working conditions of a primary loop of coolant. Tests were carried out on a series of several pieces representative of the mSiBC30_10 samples (See Fig. 2). After the tests, samples labelled mSiBC30_10-at (at for ageing tests) were characterized by XRD, Hg porosimetry, SEM, EDX, and the solution after ageing was analyzed by ICP to measure the Si and B contents.

Samples were weighed before and after the tests according to this procedure: cleaning with demineralized water under ultra-sonication for 5 min, followed by drying in an oven at 100 °C for 24 h then in a desiccator for 12 h. The mSiBC30_10 samples undergo a weight loss of 6.8% after the ageing test, suggesting that the samples degrade under the imposed conditions. The solutions in which the samples were immersed possess a silicon (Si) content of 551 mg L -1 (there was no Si in the solution before tests), whereas the boron (B) content is 728 mg L -1 (590 mg L -1 in the solution before tests) and the pH decreases from 6.8 to 4.3 after the ageing test. Therefore, we could infer that the mSiBC30_10 samples released silica, which is known to be an oxide acid, and boric acid. Although the mSiBC30_10 samples were Xray amorphous (See Fig. 1SIa in ESI), it seems that a further "amorphization" process occurred after ageing tests in the mSiBC30_10-at samples, as shown by the broader (111) and (220) XRD peaks of the β-SiC phase (See ESI, Fig. 1SIa). SEM-EDS investigations showed the presence of spheres (1-2 microns in diameter) at the surface of the mSiBC30_10-at samples (Fig. 6b), which were not present in the mSiBC30_10 samples (Fig. 6a).

An O content of 57.8 at%, a Si content of 37.6 at% and a C content of 4.6 at% was measured by focusing in the area of spheres by EDX, whereas the part free of spheres (the bulk) had an O content of 12.9 at %, a Si content of 33.1 at% and a C content of 53.9 at%. Therefore, we suggested the formation of silica spheres at the surface of the samples that inherently lead to the "amorphization" of the mSiBC30_10-at samples as shown by XRD. It is important to mention that those spheres were not observed when using Li-and B-free demineralized water during the ageing tests. Therefore, this clearly confirms that silica spheres formed because of the presence of Li and B within the solution simulating the primary loop of coolant. As a result of the formation of silica spheres, Hg porosimetry analysis (See Fig. 2 and Fig. 3SI in ESI) showed a distinct shift of the cell windows toward lower sizes in the range 1-6 μm. Interestingly, the degradation did not aff ect the microfiltration capacity of the foams, since the latter were able to trap magnetite particles present in demineralized water without pressure drop during tests for 220 h. It should be mentioned here that we did not use a solution made of Li and B in order to be able to distinguish magnetite particles (and iron oxide) from silica spheres deposited on the foams by SEM (See Fig. 2). As shown in Fig. 2, a crack appeared along the foams during the removal of the foams from the PTFE ring. However, we can consider that the strength of the foams is suffi ciently high to withstand the conditions imposed by the application.

Because of their porosity characteristics and mechanical properties comparable to those of the mSiBC30_10 samples, the stability of the mSiBC30_13 samples was investigated in the same conditions. Interestingly, "amorphization" did not occur in the mSiBC30_13-at samples (See ESI, Fig. 4SI), which could be related to the lower presence of silica sphere at the surface of the sample (See Fig. 6c (before ageing tests) and d (after ageing tests)). Furthermore, it appeared that the mSiBC30_13 samples release a significantly lower content of Si (255 mg L -1 ), whereas the boron content released is similar (773 mg L -1 ). This could be explained by the higher degree of crystallization of the mSiBC30_13 samples, that improved its chemical stability. Because of the lower release of Si as silica, the pH of the solution was measured to be 5.3. Although the pore junction size was also shifted to lower size from the mSiBC30_13 samples to the mSiBC30_13at samples (See Fig. 3SI in ESI), it had a smaller diff erence compared to the mSiBC30_10 and mSiBC30_10-at samples. Therefore, we may infer that open-celled SiC foams prepared at 1300 °C display a higher stabi-lity in harsh environment compared to those prepared at 1000 °C, and could withstand the harsh conditions imposed by the primary loop of coolant in PWR.

Conclusion

Open-Celled silicon carbide (SiC) foams with an interconnected porosity of 73.4 vol% were prepared from a mixture of boron-modified polycarbosilane and poly(methymetacrylate) (PMMA) microbeads (25 μm) sacrificial fillers in a 20:80 ratio. The boron-modified polycarbosilane was synthesized through the reaction between allylhydridopolycarbosilane (AHPCS) and borane dimethylsulfide (BDMS) according to a controlled Si:B ratio of 30. It allowed to significantly reduce its processing temperature compared to thermally crosslinked AHPCS. Thus, warm-pressing of the powder mixture was performed at a temperature as low as 120 °C and the green body was then pyrolyzed at 1000 °C under argon. The resulting highly porous components were analyzed in detail at the mesoscopic and macroscopic length scales, and their structural stability as well as compressive strength was investigated. Open-celled SiC foams combined a low density with a compressive strength of 3.49 ± 0.56 MPa and a thermostructural and mechanical stability that can be extended up to 1300 °C, temperature at which a single-step weight loss continuously occurred up to 1500 °C without losing the monolithic structure. It was attributed to the evolution of oxygen-containing gaseous species such as CO and SiO. As a consequence of the release of gaseous species, the BET SSA of foams increased in the temperature range 1000-1500 °C to form open-celled SiC foams with a hierarchical porosity at 1300 and 1500 °C. Ageing and microfiltration tests in the condition of a primary loop of coolant in a Pressurized Water Reactor (PWR) showed that open-celled SiC foams were able to retain particles with diameter around 5 μm without degradation of the performance of filtration, but those prepared at 1300 °C demonstrated a higher chemical stability than open-celled SiC foams prepared at 1000 °C in the tested conditions.

Fig. 1 .

 1 Fig. 1. Overall synthetic path employed to generate open-celled SiC foams from boron-modified AHPCS. High magnification SEM image of the mSiBC30_10 samples as inset.

Fig. 2 .

 2 Fig. 2. Schematic representation of the ageing and microfiltration tests performed on a series of mSiBC30_10 samples.

Fig. 3 .

 3 Fig. 3. Macroscopic pore-size distribution obtained by mercury-intrusion porosimetry of the mSiBC30_10 samples.

Fig. 4 .

 4 Fig. 4. High temperature TG experiments recorded under argon (5 °C min -1

Fig. 5 .

 5 Fig. 5. N2 adsorption-desorption isotherms of the mSiBC30_10 (a), mSiBC30_12 (b), mSiBC30_13 (c) and mSiBC30_15 (d) samples.

Fig. 6 .

 6 Fig. 6. Low magnification SEM image of the mSiBC30_10 and mSiBC30_13 samples before (a,c) and after ageing and microfiltration tests (b,d).

Acknowledgements

Dr. Samuel Bernard and Prof. Philippe Miele gratefully acknowledges AREVA NP and ANRT for their financial support of the PhD thesis


Jens Gustedt
email: jens.gustedt@inria.fr

Robert C Seacord
email: robert.seacord@nccgroup.com

C language mechanism for error handling and deferred cleanup extended abstract

This paper introduces the implementation of a C language mechanism for error handling and deferred cleanup adapted from similar features in the Go programming language. This mechanism improves the proximity, visibility, maintainability, robustness, and security of cleanup and error handling over existing language features. This feature is under consideration for inclusion in the C Standard.

INTRODUCTION

The defer mechanism can restore a previously known property or invariant that is altered during the processing of a code block. The defer mechanism is useful for paired operations, where one operation is performed at the start of a code block and the paired operation is performed before exiting the block. Because blocks can be exited using a variety of mechanisms, operations are frequently paired incorrectly. The defer mechanism in C is intended to help ensure the proper pairing of these operations. This pattern is common in resource management, synchronization, and outputting balanced strings (e.g., parentheses or HTML tags). A panic/recover mechanism allows error handling at a distance.

Unlike existing high-level languages, C lacks a general mechanism for resource management and error handling, outside of C's use of integer error codes and outmoded mechanisms such as errno. Consequently, resource management in C programs can be complex and error prone, particularly when a program acquires multiple resources. Each acquisition can fail, and resources must be released to prevent leaking. If the first resource acquisition fails, no cleanup is needed, because no resources have been allocated. However, if the second resource cannot be acquired, the first resource needs to be released. Similarly, if the third resource cannot be acquired, the second and first resources need to be released, and so forth. This pattern results in duplicate cleanup code, and it can be error-prone because of this duplication and the associated complexity.

C programmers need to manage the acquisition and release of resources. Because resources exist in limited quantities, it is always possible that a resource cannot be acquired because the supply of that resource has been exhausted. Examples of C standard library functions [START_REF]Programming languages -C. International Organization for Standardization[END_REF] that acquire resources include storage functions (malloc, calloc, realloc, aligned_alloc), mutexes (mtx_init, mtx_lock, mtx_timedlock, etc.), strings (strdup, strndup), and streams (fopen, freopen).

Improper resource management and error handling frequently results in software vulnerabilities. They can result in denial-ofservice (DoS) attacks which seek to prevent legitimate users from being able to access information systems, devices, or other network resources [START_REF] Mirkovic | Internet Denial of Service: Attack and Defense Mechanisms[END_REF]. For example, if an attacker can identify an external action that causes memory to be allocated but not freed, memory can eventually be exhausted. Once memory is exhausted, additional allocations fail, and the application is unable to process valid user requests. Another variant of such erroneous resource management can be exploited in multi-threaded programs that use mutexes. By default, most systems have no provisions to cope with a mutex that is locked by a thread that exits. Other threads that try to access that same mutex will block, eventually causing a deadlock of the whole execution.

Another common error associated with manual memory management is the deallocation of memory more than once, without an intervening allocation. Double Free vulnerabilities can be exploited to execute arbitrary code with the permissions of a vulnerable process [START_REF] Robert | Secure Coding in C and C++[END_REF]. A common source of this error is the deallocation of memory while handling an error condition which is then deallocated again during normal cleanup procedures.

To cope with these shortcomings, the C standards committee (ISO/IEC JTC1/SC22/WG14) is investigating the adaptation of Go's mechanism of deferred execution to C [START_REF] Ballman | Defer Mechanism for C[END_REF]. There is evidence that this mechanism provides improved cleanup and error handling over existing C language features (such as goto or longjmp) and over features that could be imported from other languages such as C++, C# or Java like constructor/destructor pairings, exception handling, or finally blocks, or from compiler extensions such as explicit destructor functions (GCC compilers).

This paper provides a concise overview of the features that are proposed by our reference implementation.

PRINCIPAL FEATURES

The principal features of the proposed language mechanism are:

• guard prefixes a guarded block • defer prefixes a defer clause SAC '21, March 22-26, 2021, Virtual Event, Republic of Korea Jens Gustedt and Robert C. Seacord

• break ends a guarded block and executes all its defer clauses • return unwinds all guarded blocks of the current function and returns to the caller • thrd_exit unwinds all active deferred statements of the current thread and exits that thread • exit unwinds all active deferred statements of the current thread and exits the execution • panic starts global unwinding of all guarded blocks • recover stops a panic and provides an error code The existing features break, return, thrd_exit and exit gain new functionality while the remaining features are new. Existing features are overloaded by macro definitions that take effect as soon as the library header is included.

The defer Statement

The defer statement defers execution of the deferred statement to the end of the guarded block (described in the next subsection). The syntax is defer statement Deferred statements may not themselves contain guarded blocks or other defer statements, and must not call functions that may result in a termination of the execution other than panic. Additionally, such a call to panic must only occur after the current panic state has been tested with recover.

The deferred statement may use any local variable that is visible where the defer is placed and that is alive when the deferred statement is executed at the end of the encompassing guard or function body. This property is verifiable at compile time, and a violation usually results in compilation failure. The reference implementation puts everything in place such that a deferred statement uses the last-written value for all variables.

The guard Statement

The guard statement marks a whole block as guarded for uses of the defer mechanism.

guard compound-statement If such a block terminates normally or with a break or continue statement, all deferred statements that have been registered are executed in reverse order of their registration. There is also a macro defer_break that can be used in contexts where break or continue statements would refer to an inner loop or switch statement. In addition, return, exit, quick_exit, and thrd_exit also trigger the execution of deferred statements, but continue this treatment up to their respective levels of nesting of guarded blocks. In contrast, other standard means of non-linear control flow out of, or into, the block (goto, longjmp, _Exit, and abort), do not invoke that mechanism and may result in memory leaks or other damage when used within such a guarded block.

In the C standards committee proposal [START_REF] Ballman | Defer Mechanism for C[END_REF], each function body implements a guarded block such that an explicit guard statement is not necessary for many common use cases. We use the term "guarded block" throughout this paper, regardless of whether a guard statement is used or the function body defines the guarded block. Listing 1 shows a guarded block containing three deferred statements. The defer keyword indicates that the evaluation of the following statement, such as a call to free, is deferred to the end of the guarded block. The deferred statement is evaluated regardless of how the guarded block exits. In Listing 1, the block can be exited after the final statement is evaluated, or if a break statement is evaluated. Deferred statements are evaluated in the inverse order they were encountered. Possible branches for this guarded block are shown in Figure 1. Dashed lines represent conditional error handling paths that are executed when resources are unavailable or evaluation is interrupted by a signal. This approach has advantages over familiar C, C++, C# or Java solutions. Cleanup code that releases resources is collocated with the code that acquires these resources, making it easier for programmers to ensure statements are properly paired. Similar to C# or Java's finally blocks, cleanup code is clearly visible. This differs from atexit handlers in C or constructor/destructor pairs in C++, where cleanup code may be defined in a different translation unit. For control flow that doesn't include return, exit, or other non-returning functions calls an equivalent control flow can be implemented with existing C language features. The guarded statement from Listing 1 is equivalent to the code segment in Listing 2. The if (false) statement guarantees that the deferred statements are not evaluated when they are first encountered. The labels and goto statements implement the backward branches to execute the deferred statements when the guarded block terminates. A common C idiom for cleanup handling is to linearize resource management as shown in Listing 3. This code has the advantage of making the conditional error handling code explicit but at the cost of proximity; the cleanup code is removed from where its need arises. This linearization requires a naming convention for the labels. For more complicated code the maintenance of these jumps can be error prone.

In contrast to such commonly found idioms, deferred statements do not depend on arbitrary label names (C) or RAII classes (C++) and do not change when defer or break statements are added or removed.

All exits from a guarded block by break, return, thrd_exit, exit, or an interruption by a signal must be detected and acted upon. This is difficult to implement in C and requires try/catch blocks in C++. The defer mechanism ensures that deferred statements are guaranteed to be executed, provided program execution progresses. The defer statement has syntax similar to other control structures, such as if and for blocks.

For maintainability and robustness we opted for object access by reference within a deferred statement and not by value. Listing 1 illustrates the importance of access by reference. The value of p could be changed by means of realloc, for example. If defer copies the value, the deferred call to free would use a stale copy of the value.

Because the scope in which the deferred statement is executed is limited, compilers can detect and diagnose a usage of a variable that is out of scope. As stated earlier, vulnerabilities can occur if resources are not released, or released more than once. Security is improved because of increased proximity and visibility of cleanup code to the resource acquisition code, and to improvements in maintainability and robustness.

Regular termination

There are three severity levels for termination of a guarded block: break or similar just terminates the guarded block, return terminates all guarded blocks of the same function and exit or panic terminates all guarded blocks in the same thread across all function calls. The implementation augments break (within a guard) and return by this functionality. This is achieved by overloading these features by macros, a technique that the C standard explicitly allows. Code that is compiled with the <stddefer.h> header will also replace calls to the C library functions exit, thrd_exit, and quick_exit by calls to their corresponding wrappers.

Panic/Recover

Error handling at distance is supported by the introduction of a panic/recover mechanism, which is similar to throw/catch in C++. Panic/recover depends on the defer mechanism to release resources during stack unwinding. Generally, a panic is a condition which requires unwinding one or several levels of deferred statements. Such a panic may occur implicitly if the run-time library detects or signals a fault, or explicitly by the use of a macro dedicated to that purpose.

The panic macro is called to indicate an abnormal execution condition. It triggers the execution of all active deferred statements of the current thread in the reverse order they are encountered, until either a deferred call to recover is executed or all deferred statements have been executed. If no recover statement is encountered, the function stack unwinds the caller's stack and executes all deferred statements registered in that stack frame. This process continues until a recover expression is encountered or all deferred statements have executed.

Our reference implementation applies the convention that user error codes passed to panic are always positive, and system error codes are generally negated errno numbers.

Once a deferred statement begins evaluation, the condition that led there can be investigated by means of recover. The recover function returns an integer value indicating why the deferred statement is executing. A return value of 0 indicates that the deferred statement is the result of a break, return or exit. Any other value indicates that the deferred statement is executing as the result of a panic. The programmer is responsible for handling the recovered error and may re-issue the panic from within the deferred statement if it is impossible to recover at a particular level of abstraction.

CONCLUSIONS

An effort is underway to add a mechanism for error handling and deferred cleanup to the C standard by providing a new library clause for a new header with the proposed name <stddefer.h> [START_REF] Ballman | Defer Mechanism for C[END_REF].

C code converted to use defer typically has less code, equal or better performance, and improved usability based on an analysis of existing open source libraries such as OpenSSL, PostgreSQL, and Flux.

Figure 1 :Listing 1 :

 11 Control flow of a guarded block with three defers An example with three deferred statements guard { void * const p = malloc (25) ; if (! p ) break ; d e f e r free ( p ) ; void * const q = malloc (25) ; if (! q ) break ; d e f e r free ( q ) ; if ( mtx_lock (& mut ) == thrd_error ) break ; d e f e r mtx_unlock (& mut ) ; // all resources acquired }

Listing 3 :

 3 A linearization void * const p = malloc (25) ; if (! p) goto DEFER0 ; void * const q = malloc (25) ; if (! q) goto DEFER1 ; if ( mtx_lock (& mut ) == thrd_error ) goto DEFER2 ; // all resources acquired mtx_unlock (& mut ) ; DEFER2 : free (q); DEFER1 : free (p); DEFER0 :;

ACKNOWLEDGMENTS

Thanks to Aaron Ballman, Alex Gilding, JeanHeyd Meneide, Miguel Ojeda, Tom Scogland, Martin Uecker, Freek Wiedijk and Simon Harraghy for their contributions to this work.