Karim Ramdani
email: ramdani@loria.fr

Takéo Takahashi
email: takahash@iecn.u-nancy.fr

Marius Tucsnak
email: tucsnak@iecn.u-nancy.fr

A uniformly stable finite difference space semi-discretization for the internal stabilization of the plate equation in a square

We propose a finite difference space semi-discretization of the stabilized Bernoulli-Euler plate equation in a square. The scheme studied yields a uniform exponential decay rate with respect to the mesh size.

x ∈ Ω, t > 0, w(t) = ∆w(t) = 0,

x ∈ ∂Ω, t > 0, w(x, 0) = w 0 (x), ẇ(x, 0) = w 1 (x),

x ∈ Ω.

(

) 1
It is well known (cf. [START_REF] Jaffard | Contrôle interne exact des vibrations d'une plaque rectangulaire[END_REF]) that the energy

E(t) = || ẇ(t)|| 2 L 2 (Ω) + ||∆w(t)|| 2 L 2 (Ω)
of system (1) decreases exponentially. The aim of this paper is to propose a space semi-discretization of this internal stabilization problem that ensures an exponential decay of the discretized energy E h (t) which is uniform with respect to the mesh size. This is not a trivial issue because of the possible appearance during the approximation process of high frequency spurious modes that cannot be damped by the feedback term. The appearance of such spurious modes in the approximation by finite differences or finite elements of control problems has been emphasized in several works (see, for instance [START_REF] Glowinski | A numerical approach to the exact boundary controllability of the wave equation. I. Dirichlet controls: description of the numerical methods[END_REF], [START_REF] Infante | Boundary observability for the space semidiscretizations of the 1-D wave equation[END_REF], [START_REF] Tcheugoué Tébou | Uniform exponential long time decay for the space semi-discretization of a locally damped wave equation via an artificial numerical viscosity[END_REF] and the review paper [START_REF] Zuazua | Propagation, observation and control of waves approximated by finite difference methods[END_REF]). Various solutions to overcome this difficulty have been proposed in the literature. The one followed in this paper is the one based on the introduction of an artificial numerical viscosity term.

Let us now precise the numerical scheme proposed. Given N 1 ∈ N, denote by h = π/(N 1 + 1), and assume that there exist integers a

(h), b(h), c(h), d(h) in {1, . . . , N 1 } such that a = a(h)h, b = b(h)h, c = c(h)h, d = d(h)h. (2)
Let w j,k denote for all j, k ∈ {0, N 1 +1} the approximation of the solution w of system (1) at the point x j,k = (jh, kh). We use the standard finite difference approximation of the laplacian, by setting for all j, k ∈ {1, . . . , N 1 }:

∆w(jh, kh) ≈ 1 h 2 (w j+1,k + w j-1,k + w j,k+1 + w j,k-1 -4w j,k ) .
Set V h = R (N1) 2 and let w h ∈ V h be the vector whose components are the w j,k for 1 ≤ j, k ≤ N 1 . In order to satisfy the boundary conditions in (1), we impose that ∀k ∈ {0, . . . , N 1 + 1} :

   w 0,k = w k,0 = w N1+1,k = w k,N1+1 = 0 w -1,k = -w 1,k , w N1+2,k = -w N1,k , w k,-1 = -w k,1 , w k,N1+2 = -w k,N1 . (3)
The matrix A 0h representing the discretization of the bilaplacian with hinged boundary conditions is defined via its square root A 0h given by

A 1 2 0h w h j,k = - 1 h 2 (w j+1,k + w j-1,k + w j,k+1 + w j,k-1 -4w j,k ) ,
for all 1 ≤ j, k ≤ N 1 . The finite-difference space semi-discretization for system (1) studied in this paper reads then

ẅj,k + (A 0h w h ) j,k + (χ O ẇh ) j,k + h 2 (A 0h ẇh ) j,k = 0, 1 ≤ j, k ≤ N 1 , w j,k (0) = w 0h , ẇj,k (0) = w 1h , 1 ≤ j, k ≤ N 1 , (4)
In the above equations, w 0h and w 1h are suitable approximations of the initial data w 0 and w 1 on the finite-difference grid and χ O ẇh denotes the vector of V h whose components are the ẇj,k if j and k are such that x j,k ∈ O, and 0 otherwise. The numerical viscosity term h 2 A 0h ẇh in (4) is introduced in order to damp the high frequency modes. Our main result is the following.

Theorem 1. The family of systems defined by (3)-( 4) is uniformly exponentially stable, i.e. there exist constants C, α, h * > 0 (independent of h, w 0h and w 1h ) such that :

ẇh (t) 2 + A 1 2 0h w h (t) 2 ≤ Ce -αt w 1h 2 + A 1 2 0h w 0h 2 ,
for all h ∈ (0, h * ) and all t > 0.

In the above theorem and in the remaining part of this paper, we denote by • the Euclidean norm in R m for various values of m. The proof of theorem 1 is based on the following frequency domain characterization for the uniform exponential stability of a sequence of semigroups (see [4, p.162]).

Theorem 2. Let (T h ) h>0 be a family of semigroups of contractions on the Hilbert space V h and A h be the corresponding infinitesimal generators. The family (T h ) h>0 is uniformly exponentially stable if and only if the two following conditions are satisfied: i) For all h > 0, iR ⊂ ρ(A h ), where ρ(A h ) denotes the resolvent set of A h , ii) sup h>0,ω∈R

(iω -A h ) -1 < +∞.
2 Proof of Theorem 1

Abstract second and first order formulations

Let U h = R (b(h)-a(h)+1)×(d(h)-c(h)+1
) be the discretized input space, where the integers a(h), b(h), c(h) and d(h) are defined by [START_REF] Infante | Boundary observability for the space semidiscretizations of the 1-D wave equation[END_REF].

If B 0 ∈ L(L 2 (O), L 2 (Ω))
denotes the restriction operator defined by B 0 u = χ O u for all u ∈ L 2 (O), we introduce its finite-difference approximation B 0h ∈ L(U h , V h ) by setting for all u h ∈ U h : (B 0h u h ) j,k = u j,k if j and k are such that x j,k ∈ O, and 0 otherwise. The adjoint 4) admits the following abstract second order formulation:

B * 0h ∈ L(V h , U h ) of B 0h is then defined for all w h ∈ V h by (B * 0h w h ) j,k = w j,k for all j, k such that x j,k ∈ O. The finite-difference semi-discretization (3)-(
     ẅj,k + (A 0h w h ) j,k + (B 0h B * 0h ẇh ) j,k + h 2 (A 0h ẇh ) j,k = 0, 1 ≤ j, k ≤ N 1 , w j,k = A 1 2 0h w h j,k = 0, j, k = 0, N 1 + 1, w j,k (0) = w 0h , ẇj,k (0) = w 1h , 0 ≤ j, k ≤ N 1 + 1.
(5) It can be easily checked that the sequence ( B 0h L(U h ,V h ) ) is bounded and that the eigenvalues of A

1 2 0h are λ p,q,h = 4 h 2 sin 2 ph 2 + sin 2 qh 2 , for 1 ≤ p, q ≤ N 1 . (6)
A corresponding sequence of normalized eigenvectors is given by the vectors

ϕ p,q,h = ϕ j,k p,q,h 1≤j,k≤N1
, with components ϕ j,k p,q,h = 2h π sin (jph) sin (kqh).

In order to apply theorem 2, we write system (5) as a first order system. Let us then introduce the space X h = V h × V h , which will be endowed with the norm (ϕ h , ψ h )

2 X h = ϕ h 2 + A 1 2 0h ψ h 2 . Setting z h = w h ẇh , equations (5)
can be easily written in the equivalent form

żh (t) = A h z h (t), z h (0) = z 0h ,
where z 0h = w 0h w 1h and A h ∈ L(X h ) is defined by

A h = 0 I -A 0h -h 2 A 0h -B 0h B * 0h . (7)
It will be useful to introduce the operator

A 1h = 0 I -A 0h 0 ∈ L(X h ) such that A h = A 1h - 0 0 0 h 2 A 0h + B 0h B * 0h . ( 8
)
We will also need in the sequel the spectral basis of the operator A 1h . Moreover, it will be more convenient to number the eigenelements of A 1h using only one index m instead of the couple (p, q). To achieve this, let us first rearrange the sequence of eigenvalues λ p,q = p 2 + q 2 , p, q ∈ N * , of the continuous problem in nondecreasing order to obtain a new sequence (Λ m ) m∈N * . Then, if

Λ m = λ p,q = p 2 + q 2 , ∀ m ∈ N * , ∀p, q ∈ N * , (9)
then we set for all 1 ≤ m ≤ (N 1 ) 2 , and for all 1 ≤ p, q ≤ N 1 :

Λ m,h = λ p,q,h , ϕ m,h = ϕ p,q,h . ( 10
) Let then N 2 (h) = (N 1 ) 2 = π h -1 2
be the number of nodes of the finitedifference grid. If we extend the definition of Λ m,h and ϕ m,h to the values m ∈ {-1, . . . , -N 2 (h)} by setting

Λ m,h = -Λ -m,h , ϕ m,h = ϕ -m,h , (11)
then it can be easily checked that the eigenvalues of A 1h are iΛ m,h , where 1 ≤ |m| ≤ N 2 (h), and that an orthonormal basis of X h formed by eigenvectors of A 1h is given by

Φ m,h = 1 √ 2   - i Λ m,h ϕ m,h ϕ m,h   , 1 ≤ |m| ≤ N 2 (h), (12)
We are now in position to apply theorem 2.

Checking the assumptions of theorem 2

To prove condition i) in theorem 2, we use a contradiction argument. Suppose that there exist

ϕ h ψ h ∈ X h and ω ∈ R such that: A h ϕ h ψ h = iω ϕ h ψ h
. Then, by using the definition (7) of A h , we easily obtain that ψ h = iωϕ h and that

ω 2 -A 0h -iω(h 2 A 0h + B 0h B * 0h ) ϕ h = 0.
By taking the imaginary part of the inner product of this last relation with ϕ h , we get that ϕ h = 0, and thus ψ h = 0. Therefore, for all ω ∈ R, iω cannot be an eigenvalue of A h . Thus, condition i) in theorem 2 holds true. Now, we check condition ii) of theorem 2. Once again, we use a contradiction argument. Let us thus assume the existence for all n ∈ N of h n ∈ (0, h * ),

ω n ∈ R, z n = φ n ψ n ∈ X hn such that z n 2 = A 1 2 0hn φ n 2 + ψ n 2 = 1 ∀ n ∈ N (13) iω n z n -A hn z n → 0. ( 14
)
To obtain a contradiction, the idea is to decompose z n into a low frequency part and a high frequency part. Then, thanks to the numerical viscosity introduced in the scheme, we prove that the high frequency part tends to 0. Finally, we conclude by using a result on the uniform observability of low frequency packets of eigenvectors. More precisely, for 0 < ε < 1 and h ∈ (0, h * ), we define the integer

M (h) = max m ∈ {1, . . . , N 2 (h)} | h 2 (Λ m ) 2 ≤ ε , (15)
where the sequence (Λ m ) m∈N * defined in (9) constitutes the sequence of eigenvalues of the continuous problem. The eigenvalues Λ m,h for 1 ≤ |m| ≤ M (h) correspond to "low frequencies" and will be damped to zero by the feedback control term B 0h B * 0h ẇh . The eigenvalues Λ m,h for |m| > M (h) correspond to "high frequencies" and will be damped by the numerical viscosity term. To get the desired contradiction, we follow several steps.

Step 1 Let us prove the two relations

h 2 n A 1 2 0hn ψ n 2 + B * 0hn ψ n 2 → 0, (16)
lim n→∞ A 1 2 0hn φ n 2 = lim n→∞ ψ n 2 = 1 2 . ( 17
)
Relation (16) follows directly from (14) by taking the inner product in X hn of iω n z n -A hn z n by z n and by considering only the real part. By using ( 14), ( 16), (8) and the fact that the operators B 0hn are uniformly bounded we obtain that

iω n z n -A 1hn z n + 0 h 2 n A 0hn ψ n → 0. ( 18
)
It can be easily that the sequence (ω n ) is bounded away from zero for n large enough(use a contradiction argument). Therefore, taking the inner product in X hn of (18) by 1 ω n φ n -ψ n and by considering the imaginary part, we obtain that lim n→∞ A Step 1 is thus complete.

In order to state the second step, let us introduce the modal decomposition of z n on the spectral basis of (Φ m,hn ) 1≤|m|≤N2(hn) of A 1hn . For all n ∈ N, there exist complex coefficients (c n m ) 1≤|m|≤N2(hn) such that

z n = φ n ψ n = 1≤|m|≤N2(hn) c n m Φ m,hn . (19)
The normalization condition (13) reads then 1≤|m|≤N2(hn)

|c n m | 2 = 1. ( 20
)
Step 2

In this step, we prove that the following relations holds true

ψ n = 1 √ 2 N2(hn) m=1 c n m + c n -m ϕ m,hn , (21)
M (hn)<m≤N2(hn)

c n m + c n -m 2 → 0, ( 22
) 1≤|m|≤M (hn) |ω n -Λ m,hn | 2 |c n m | 2 → 0. (23)
Note that, roughly speaking, relations (21) and ( 22) show that the projection of ψ n on the high frequencies tends to 0 as n tends to +∞. Relation (21) follows directly by taking the second component in (19) and by using (12). On the other hand, by using (19) and the fact that Φ m,h is an eigenvector of A 1h associated to the eigenvalue iΛ m,h , we have

iω n z n -A 1hn z n = 1≤|m|≤N2(hn) i (ω n -Λ m,hn ) c n m Φ m,hn (24)
From ( 16) and (21) it follows that

h 2 n A 1 2 0 ψ n 2 = N2(hn) m=1 h 2 n Λ 2 m,hn c n m + c n -m 2 → 0. (25)
Using the expression (6) of λ p,q,h and that λ p,q = p 2 + q 2 , it can be easily checked that 4 π 2 λ p,q ≤ λ p,q,h ≤ λ p,q , for all 1 ≤ p, q ≤ N 1 , or equivalently

4 π 2 Λ m ≤ Λ m,h ≤ Λ m ∀ 1 ≤ m ≤ N 2 (h). (26)
Relations (25), ( 26) and (15) imply (22). On the other hand, relations (26) and (25) clearly imply that there exists a constant C independent of h such that

h 4 n M (hn) m=1 Λ 4 m,hn c n m + c n -m 2 ≤ Cε M (hn) m=1 h 2 n Λ 2 m,hn c n m + c n -m 2 → 0. (27)
On the other hand, a simple calculation shows that

0 h 2 n A 0hn ψ n = 1≤|m|≤N2(hn) h 2 n 2 Λ 2 m,hn c n m + c n -m Φ m,hn , (28)
Relations ( 27) and (28) imply that

0 h 2 n A 0hn ψ n - M (hn)<|m|≤N2(hn) h 2 n 2 Λ 2 m,hn c n m + c n -m Φ m,hn → 0 (29)
By using (18), ( 24) and (29) it follows that

1≤|m|≤N2(hn) i (ω n -Λ m,hn ) c n m Φ m,hn + M (hn)<|m|≤N2(hn) h 2 n 2 Λ 2 m,hn c n m + c n -m Φ m,hn → 0.
Since the family (Φ m,hn ) is orthogonal, the above relation implies (23).

Step 3 Consider the set In other words, F is constituted by those integers n such that ω n is located in the "low frequency band". We distinguish then two cases:

F = n ∈ N | ∃ m(n) ∈ Z, 1 ≤ |m(n)| ≤ M (h n ),
First Case: The set F is finite. Then, for the sake of simplicity, we can suppose, without loss of generality, that F is empty. In this case, all the elements of the sequence (ω n ) are located in the "high frequency band". By using relation (23) in Step 2 and the above relation, we obtain that < Second case: The set F is infinite. Then, for the sake of simplicity, we can suppose, without loss of generality, that F = N. In this case, all the sequence ω n is located in the "low frequency band". For all n ∈ N, we

1

  Statement of the main resultConsider a square plate Ω = (0, π) × (0, π) subject to a feedback force distributed on a rectangular subdomain O = [a, b] × [c, d] of Ω. If χ O denotes the characteristic function of O, the stabilization problem considered reads:    ẅ(t) + ∆ 2 w(t) + χ O ẇ(t) = 0,

1 2 0hn φ n 2 -ψ n 2 = 0 .

 220 This last relation and (13) yield (17).

  and |ω n -Λ m(n),hn | < 1 8.

  1≤|m|≤M (hn) |c n m | 2 → 0, i.e. that the low-frequency part of ψ n tends to 0. Thus, the above relation, (21) and (22) in Step 2 imply that ψ n → 0 in H, which contradicts (17).

  introduce the set F n = m ∈ Z | 1 ≤ |m| ≤ M (h n ) and |ω n -Λ m,hn | < 1 8 .

Note that F n is never empty (since it always contains m(n)) and represents the collection of low frequency eigenvalues located near ω n . Set then ψ n =

But on the other hand, applying lemma 3.2 in [START_REF] Ramdani | Internal stabilization of the plate equation in a square : the continuous and the semi-discretized problems[END_REF] on the uniform observability of low frequency packets of eigenvectors (note that I hn (ω n ) = F n ) , we get the existence of δ > 0 such that for all n ∈ N, we have

Gathering ( 30), ( 32) and (33), we finally obtain that ψ n → 0 in H. By using (31), we obtain that ψ n → 0 which contradicts (17). The proof of theorem 1 is now complete.


Etienne Balit

Dominique Vaufreydaz

Patrick Reignier

Integrating Animation Artists into the Animation Design of Social Robots An Open-Source Robot Animation Software

Keywords: human-robot interaction, animation, robot animation, expressive movement, expressive gestures

Movements are an important part of robot design and we need dedicated tools to design them. As previous research has shown, 3D animation techniques are of great use to animate a robot. However, most robots don't benefit from an animation tool and therefore from animation artists knowledge. We present an open-source robot animation software to address this issue and describe some principles for designing a robot animation software derived from the specificity of robot as a medium.

I. Introduction

Movements and appearance are an important part of a robot interface. They are what users see and have a great influence on its familiarity and credibility, two major design goals of a social robot. Moreover, these two components are intertwined, which makes them difficult to design separately.

Robots appearance has made great progress over the years, but movements are often an afterthought in the design process. This often leads to social robots that move mechanically and fail to achieve the Illusion of Life. This expression comes from the title of a book, written by two animation masters from Disney, which is a reference in character animation [START_REF] Thomas | The Illusion of Life: Disney Animation[END_REF]. Animators are trained to breathe life into characters. Robotics would greatly benefit from their skills and knowledge by integrating them in the design process of social robots.

A first strategy is developed in [START_REF] Hoffman | Designing robots with movement in mind[END_REF]. The authors propose a design methodology starting with the creation of sketch on paper followed by an animated 3D sketch of the prospective robot. A physical prototype is then built, and software is written to generate the movements displayed in those 3D animated sketches. An issue with this approach is that robots present additional challenges compared to 3D animation. Robots are physical objects subject to the laws of physics. They can fall and wobble, their motors make noise and are limited in speed and acceleration. All these constraints specific to robotics can modify the expressiveness of a movement if they are not accounted for. Moreover, many robots that are not designed with movements in mind could still benefit from animators knowledge.

Another strategy is to create tools to animate robots using the paradigm that animators already use for 3D animation for movies or video games. How to design robot animation software has been explored in [START_REF] Van Breemen | Advanced animation engine for user-interface robots[END_REF][START_REF] Pot | Choregraphe: a graphical tool for humanoid robot programming[END_REF][START_REF] Saldien | A motion System for social and animated robots[END_REF]. But these softwares are designed for a specific robot and often proprietary (ex: Choregraphe, from Aldebaran). This leads to a situation where every research team designing a new robot would need to implement an animation tool to benefit from the animators knowledge and art. Because of the complexity of the task, animation tools for a given robot are often limited or inexistent.

We try to address this issue by developing an open source software that could become a common software for animating robots and a starting point for the community to iterate upon and investigate the optimal user interface for robot animation [Fig. 1]. We also derive some principles for the user interface of robot animation software from the specific constraints and possibilities of a robot.

II. An Open Source Robot Animation Software

A. Principles

Keyframes with Bezier interpolation: Most computer graphics (CG) animation software use keyframing with spline interpolation to describe the variation in time of a parameter. We use the same paradigm, as it has proven to be effective and animators master it.

Direct Manipulation and Live Preview: There has been an attempt at creating tangible input device for 3D character articulation [START_REF] Jacobson | Tangible and modular input device for character articulation[END_REF], as it can be difficult to define the pose of a 3D character with many degrees-of-freedom (DOF) through a 2D interface. Using motors that can act as rotation sensors, we can use the robot as a tangible interface to define its key poses. Our system emulates gravity compensation by deactivating the torque if it reaches a given limit. The user can thus move the robot parts to bring the robot into the desired pose [Fig. 2] and then create a keyframe with it. Our system also uses the robot to preview the movement and interpolated poses between keyframes. It enables the user to preview the result, to edit the pose in place and create a new keyframe to precise the motion if necessary. Fig. 2. The robot, here a Poppy Torso, can be manipulated to define new poses or edit a keyframe.

Constraints violations communication:

As we noted in the introduction, robots have mechanical constraints. We propose that the user interface should make those constraints visible to the animator. This can take the form of a permanent visual aid or warnings when there is a violation, as it exists in programming Integrated Development Environment (IDE) for example. We implemented two types of constraints handling. Angular position limits are made visible by displaying the grid only on the valid range. Angular speed and acceleration limits violation are communicated through warnings [Fig. 3].

B. Implementation

Our system is implemented with adaptability in mind as we aim at creating a software generic enough that the community can adapt it to diverse use cases and build upon it. It also means that it should be simple and easy to modify.

The user interface of our system is implemented using the Web Platforms standards -more specifically JavaScript, HTML and SVG -because these are multiplatform standards. Another reason is that it allows the software to be easily adapted as a desktop application or as a web application served directly from the robot's computer.

The backend of the system is developed in Python and uses the pypot library from the Poppy Project [START_REF] Lapeyre | Poppy project : open-source fabrication of 3D printed humanoid robot for science, education and art[END_REF] to control the motors. This library is primarily targeted at controlling Robotis Dynamixel motors but is extendable to other actuators. We choose not to base our system on a middleware like ROS to keep the architecture simple but the backend could also be substituted with a ROS node if necessary.

III. Future Work

The system described could be improved in multiple ways. A first way would be to make other parameters of the motors available to animation. Animating the compliance of motors would bring new possibilities for designing movement with physical interaction with an object or with a person like a handshake. A second way to improve upon this system would be to include a method to compute the position of degree-offreedom (DOF) from another, as it can be useful to simplify the animation of many coupled DOF like a bird's wings. The last way that we envision to improve upon this software is to create a parametric animation software for robots to enable animators to create movements and gestures adaptable to the context.

IV. Conclusion

We think this open robot animation software can enable the community to integrate animators and benefit from their knowledge.

The system that we presented draws inspiration from CG animation software for its user interface and introduces new principles derived from the specificity of robot as a medium. While the ideas drawn from CG animation are well tested in CG and in robotics, we need to evaluate the effectiveness of the new principles described in this paper and their compatibility with those inspired by CG.

This evaluation is ongoing, working with animation artists to animate the Poppy Robot [START_REF] Lapeyre | Poppy project : open-source fabrication of 3D printed humanoid robot for science, education and art[END_REF]. But we also need feedback from the community to reach the goal of this project to propose a common software for animating robots.

Fig. 1 .

 1 Fig. 1. Top: Preview of the interface of the animation software showing the degrees-of-freedom list on the left, the spline editor on the right and the timeline on the bottom. Bottom: Example of live preview of a movement.

Fig. 3 .

 3 Fig. 3. Example of constraint handling. The grid makes visible the valid range of the angular position and the area in red indicate a violation of angular speed constraints.

This work was partly funded by the Agence Nationale de la Recherche (ANR) under the project Amiqual4Home ANR-11-EQPX-0002.


Alain Karsenty
email: alain.karsenty@cirad.fr

Driss Ezzine-De-Blas

PES, markets and property rights: a comment on Wunder's revisited concept of PES and a proposal of conceptual framework

Keywords: payment for environmental services, market-based instruments, markets, commodification, utilitarianism, incentives. Highlights

Payments for Environmental Services (PES) are often described as market-based instruments as they are used to change relative prices, and therefore to provide incentives. Following the line of thought of institutional economists, we argue that a market is a place for the transfer of property rights (the right to perform certain actions), beyond the goods and services which are exchanged. We underline the need for aclear distinction between "ecosystem services" (services obtained by peoplefromnature) and "environmental services" (services rendered by people to other people). Against Wunder's (2015) interpretation, we explain why ecosystem services are, by nature, collective or public goods, and as such do not lend themselves to appropriation.We argue also that appropriation is a precondition of exchanges, even in a service economy, unless admitting that there are markets without exchange. In PES there is no transfer of property rights: the holders simply freeze or use their ownland development rights. PES embedded into REDD+ projects, which are "backedagainst the carbon market", and PES in which service's providres are selected through auctions: these PES can be analysed as "hybrids" combining a market-based procedure and bilateral agreements about setting environmental easements.

"Market-based instruments (…) include payments for ecosystem service provision (PES), pollution taxes, cap-and-trade schemes, ecocertification and labelling, and certain capacity building measures" (Lockie, 2013).

"…conservation has adopted a number of market-based instruments (MBI), notably payments for ecosystem services (PES)" [START_REF] Carrière | Rio+20, biodiversity marginalized[END_REF] "Although not necessarily inherent to the ecosystem services framework, this governance agenda has come along with two associated measures, (1) the economic valuation of these services, and (2) the promotion -and increasing use-of market-based policy tools, especially the so-called ''payments for ecosystem services'' [START_REF] Muradian | Between markets and hierarchies: The challenge of governing ecosystem services[END_REF]".

These three excerpts reflect the frequentconfusion in the recent literature between "payment for ecosystem services" (PES) and market-based instruments (MBIs). Tradable permits, auctions, environmental taxes, "green" labels and PES are regularly classified asbelonging to the category of "market-based instruments" (MBIs) [START_REF] Pirard | Market-based instruments for biodiversity and ecosystem services: A lexicon[END_REF], Commission of the European Communities, 2007). In particular,the widely citedTEEB (The Economics of Ecosystems and Biodiversity) report [START_REF] Teeb | The Economics of Ecosystems and Biodiversity for National and International Policy Makers -Summary: Responding to the Value of Nature, TEEB for Policy Makers[END_REF], states:"Experienceshowsthatenvironmentalgoalsmaybereached moreefficiently bymarketbasedinstrumentsthan by regulationalone". The report also specifies: "Market-based instruments, such as taxes, charges or tradable permits can, if carefully designed and implemented, complement regulations by changing economic incentives, and therefore the behaviour of private actors, when deciding upon resource use " (p. 31).The rationale behind calling such tools "market-based instruments" (MBIs) is that they all are used to change relative prices, and therefore encourage reliance on the "self-interest" of economic agents who take the decisions. ForStavins (2005), "market-based instruments are regulations that encourage behaviour through market signals rather than through explicit directives". This analytical entry point explains why environmental taxes are classified as MBIs, although it is hard to see how they rely on a market. [START_REF] Pirard | Market-based instruments for biodiversity and ecosystem services: A lexicon[END_REF] argues that the reference to pricing is the common denominator among MBIs, thus clearly differentiatingthem from regulatory instruments which rely on prescription. He points out that this classification obscures the very different principles underlying the range of instruments categorized as MBIs, especially PES. Nevertheless he still uses pricing as the main variable to differentiate MBI instruments. This choice explains why PES schemes are classified in different categories, with different degrees of closeness to markets: while trading of forest carbon and Coasian type agreements both embed PES schemes in their implementation, forest carbon exchange schemes are closer to a classical market configuration than agreements between upland and lowland farmers to improve the quality and quantity of water. Nevertheless, the creation of carbon credits and of an international platform on which to trade them is not a precondition for the agreement to be negotiated, and responds more to a conjunctural choice in a policy context dominated by the belief that markets are more efficient than other types of more regulated schemes, e.g. a fund to fight deforestation in the case of forests. [START_REF] Corbera | The equity implications of marketing ecosystem services in protected areas and rural communities: case studies from Meso-America[END_REF] also point to the difference between different schemes involving a PES design and conclude that "PES are not actual markets where ecosystem services are sold to service buyers" and therefore distinguish between amarket for ecosystems services (MES) 2 and PES. Other scholars have highlighted the fact that PES do not function as a market per se, but have introduced a market-oriented vocabulary and way of thinking in the social and policy spheres [START_REF] Milne | Market Masquerades: Uncovering the Politics of Community-level Payments for Environmental Services in Cambodia[END_REF]. To equate incentive instruments (i.e. taxes and PES) with MBIs reinforces their separation from prescriptive regulations. Such a contrastsuggests a desirable switch from a bureaucratic and rigid administrative universe to a modern one where the free will of individuals, capable of weighing their options and deciding accordingly, is emphasized. In a nutshell, it's bureaucracy versus markets. Calling such a wide range of different instruments market-based amounts to promoting an "organizing fiction" of the worldsometimes unnoticed by those who relay this language -in which the market is identified as the only intelligent alternative to administrative directives for the management of the environment.

In the present paper we explain why pricing is not the right analytical entry point to understand the structural difference between PES and markets, this being one of the main sources of confusion in the literature when PES are associated with MBIs and commodification. First, the services to be regulated (the type of services involved in PES) are properties, like the quality of water or the composition of the atmosphere, which cannot be exchanged, only altered or enhanced. Second, markets are defined by the transfer of property rights in a competitive setting between suppliers and aquirers.We argue that most PES are based on a contractual relationship between actors to compensate for avoided land use change, and that this relationship is decoupled from the creation of a market, whose aim is to exchange and transfer property rights. The recent tendency to equatemarket metaphors (pricing mechanisms and contractual relationships) with genuine markets responds to a policy context and a desire to create a tradable commodity and to rank instruments in a heirarchyin which MBIs are considered to besmarter than instruments that are prescriptive, i.e., based on constraint.

Incentives, relative prices and markets

According toE.F. [START_REF] Rosenbaum | What is a Market? On the Methodology of a Contested Concept[END_REF]: "Many economists tend to find markets almost everywhere on Earth and in history (…). But (…) the market concept is hardly analyzed in depth. Nor are there serious attempts to examine empirically where markets exist". Many different definitions of markets have been provided by different economic schools3 . [START_REF] Rosenbaum | What is a Market? On the Methodology of a Contested Concept[END_REF] distinguishes between three sets of definitions: (i) observational definitions, "which refer to some empirical phenomenon, often together with one or several stylized facts about prices and/or commodities"; (ii) functional definitions which "focus on what the market does rather on what, from an empirical point of view, the market is". According tothe functional definition, "the concept of a market is equated with the determination of relative prices by demand and supply", which correspond to the MBIrhetoric presented above. 2 For [START_REF] Corbera | The equity implications of marketing ecosystem services in protected areas and rural communities: case studies from Meso-America[END_REF], "MES must have a well-defined ecosystem service and a well-defined trading commodity, and active supply and demand sides must coexist" (p. 366).

The third definition Rosenbaum mentions is (iii) astructural definitionwhich draws attention to "the underlying and hence not immediately observable structure of a market, emphasising the alleged mechanisms and structures that give rise to market phenomena". Such definitions have been favoured by institutional economists who pay attention to history and to the issue of what drives institutional change. G.M. Hodgson, a prominent figure in institutional economics, defined the market as "a set of social institutions in which a large number of commodity exchanges of a specific type regularly take place, and to some extent are facilitated and structured by those institutions. Exchange (…) involves contractual agreements and the exchange of property rights, and the market consists in part of mechanisms to structure, organize, and legitimate these activities" (Hodgson, 1988, p. 174). For institutional economists, whether they are considered to be "old" or "new" institutionalists, markets are, above all, a place where legal property rights are exchanged. John Commons, who symbolizes "old" institutionalism, states: "Transactions are the means, under operation of law and custom, of acquiring and alienating legal control of commodities, or legal control of the labor and management that will produce and deliver or exchange the commodities and services, forward to the ultimate consumers" [START_REF] Commons | [END_REF]. As [START_REF] Coase | The institutional structure of the production[END_REF], who features himself as new institutionalist, put it: "… what is traded on the market are not, as often supposed by economists, physical entities, but the right to perform certain actions" (p. 717). Admittedly, the market for services is not exactly to the same as the market for commodities: the transfer of property rights does not entail a change in the ownership of physical assets, but the transfer by the seller of a service of an agreed fraction of the working time to the client. The seller transfers the (future) product of his/her labour to the buyer, and exclusively to the buyer (property right). The labour market works in the same way, but so does consulting, cutting hair, transporting goods, etc.

According tothis definition, we can agree that emission rights (or catching rights in fisheries) can be considered as transferable property rights, in the sense that they allow their holder to undertake certain actions and those rights can be exchanged on markets 4 . Environmental taxes, like any other tax, change the relative prices of certain actions and, in this respect, can be compared with emission rights. Besides, paying such taxes is the counterpart for performing certain actions, and can therefore be considered as property rights. But the main difference concerns the degree of transferability: there are no markets for exchanging taxes whereas there are markets for emission permits, tradable development rights and "individual transferable quotas" in fisheries5 . If pricing were the cornerstone of markets (rather than the exchange of rights), it would be difficult to see why penalties entailed by prescriptive regulations (for instance, on the payment on the damage caused by pollution) could not be classified asMBIs: Even if there are several motivations for compliance with the law, it was argued by Gary [START_REF] Becker | The economic approach of human behavior[END_REF] and many other scientists of utilitarian thinking, that compliance with the law by individuals could be interpreted as deriving from a cost-benefit analysis: agents weigh the [START_REF] Vatn | An Institutional Analysis of Payments for Environmental Services[END_REF] coined "an ideal type of the market" as "a system of voluntary exchange" (p.1246). Unfortunately, he focuses on the voluntary dimension of the exchange and does not say exactly what has to be exchanged on markets to distinguish between mere "exchanges" and a market. probability of being caught and punished, and the benefits to be had from breaking the law. "A Fine is a Price", to cite the title of a famous article by [START_REF] Gneezy | A Fine is a Price[END_REF].

Grouping the above mentioned economic instruments as MBIs on the sole grounds they have an impact on pricingthus seems to be a weak argument. Classifying them between incentivesand prescriptive seems to be more justifiable, but could also be questioned by the above mentioned utilitarian cost-benefit interpretation of "why do people follow a rule?". In practice, the wide use of such a categorization can be explained by the belief that markets are more efficient than administrative regulationsin managing environmental services [START_REF] Gómez-Baggethun | The history of ecosystem services in economic theory and practice: From early notions to markets and payment schemes[END_REF].

Markets of services and property rights

Characterizing markets essentially as transfers of property rights, i.e. social authorization to perform certain actions to adopt Coase's terms, is challenged by analysts arguing that in the markets of services there is no transfer of property rights. Yet, Wunder (2015) criticising Karsenty's 2011 tentative definition of PES (see infra), argues that the implicit idea that "one can only sell what one possesses" is "a generalized misconception" of the economy of services:

"exchange of property rights is usually not required in service trade: a teacher does not own the provision of knowledge, a house cleaner has no patented right to cleanliness, and a dentist does not own his clients' teeth. Following [START_REF] Shelley | What should we call instruments commonly known as payments forenvironmental services? A review of the literature and a proposal[END_REF], ES instead imply the provision of stewardship in ways where humans and nature interact".

But this argument ignores the exchange itself. Services (environmental or not) are reduced to "stewardship" which can be provided without any exchange.Going a step farther and suggesting that the services economy is unrelated to markets6 , leads to something quite odd:a market without exchange. Wunder's argument suggests that institutional and neo-institutional economists just overlooked the economy of services and implicitly referred to the exchange of goods when theorizing about markets. Is this right? Another well-known representative of neo-institutionalism, D. North (1977:711) put forward the following: "An essential pre-condition for price-making markets is the existence of well-defined and enforced property rights over the good or the service7 to be exchanged". Clearly, North considered markets of services, with respect to property rights over the good or the service.

Obviously, the (private) teacher does not own the knowledge he/she delivers, but Wunder simply disregards the fact that what is transferred exclusively to the payer is the "skilled labour-time" of the service's provider, not the knowledge which is public good, and the provider only "owns" the time he/she can decide to allocate to a client. The exchange is "skilled labour time against money", as already analysed by K. Marx who referred to "labour power" as "the aggregate of those mental and physical capacities existing in a human being, which he exercises whenever he produces a use-value of any description" (Marx, 1867). In general, the qualification is more important than the time allocated: the more skilled the labour time dedicated to the service contracted, the higher its value (as anyone can verify with top lawyers, famous singers or consultants). Yet, there are other services where it is not the skilled labour time that matters but the transfer of a financial guarantee over time, e.g. the insurance market. The contract anticipates the possibility of damage occurring which will be covered by the insurance scheme, hence a portion of the money owned by the insurance company will be transferred to the victim of the damage. The only market situation in which one can sell something she/he does not possess (yet) is through "short selling" on financial markets. Short selling means selling an asset that is not currently owned by the seller who will manage to own it at the agreed date of the transfer for delivering the asset to the buyer. But even there, ownership of the asset must be effective the day the transaction occurs.

Remember that the starting point of our analysis is that PES schemes cannot be analysed as markets, since they lack several conditions included in the definition of markets such as competition, substitutability of the good or service and, more basically,there is a contractual agreement to suspend -but not to transfer -property rights. This is for "land-use restricted" PES. In "assetsbuilding PES", there is an exchange of "labour time against reward" for enhancing ecosystem services, which could suggest that such peculiar PES would qualify as "markets". But this would be misguiding. A market entails "alienation" of the fruit of the (skilled) labour, i.e. its transfer to the payer. Yet, the environmental service rendered through assets building (such as planting trees) is performed on the land owned or controlled by the labourer, and the trees planted belong to him/her, not to the payer. This characteristic distinguishes PES from "out-growing" schemes implemented by companies who sometimes claim they run PES schemes since they pay the farmer to plant trees (e.g. shea butter trees), on his own land -but with a contractual agreement for the company to pay an initial subsidy and the farmer to give the company exclusive purchasing rights to the fruits or the wood produced by these trees. The assets-building PES does not involve alienation of the physical assets created, which remain the property of the labourer. Furthermore, since ecosystem services are, by nature, collective or public goods, they are not "transferred" and should be considered as positive externalities someone has paid for.

What are PES about?

We agree with [START_REF] Wunder | Revisiting the concept of payments for environmental services[END_REF] about the usefulness of proposing ideal-types for clarifying and understanding conceptual constructs which facilitate the recognition of regularities in the diversity of some social phenomenon, which in practice cannot be 'imprisoned' in narrow definitions. Distinguishing among composite realities and classifying embedded phenomena are the essence of intellectual endeavours.

We will start with a clarification about the notions of "environmental" and "ecosystem" services. Both are often used interchangeably to refer to PES. According to the Millennium Ecosystem Assessment, "ecosystem services" can be defined as services that nature renders people ("Ecosystem services are the benefits people obtain from ecosystems" (MEA, 2005). Although, from an economic perspective, one can question the relevance of combining "the provisioning services" (which are about goods for which there are markets and, thus, market prices) and "regulating services" (which can be considered as positive externalities, that is without markets); it would be difficult to ignore this MEA framework that has gained so much importance in literature and policy debates.

If ecosystem services are benefits obtained from nature, we suggest that PES are related to "environmental services", which can be understood as remunerations for services rendered by people to other people for the maintenance or the improvement of a given ecosystem service. Most of the analysts disregard this distinction or argue against it, considering PES as a joint production of amenities by the combined biophysical and socioeconomic processes (e.g. Wunder 2015: 6). This reluctance to separate ecological functioning and human actions affecting nature is probably associated to the proposed "new paradigm" (retrieving ancient cosmogonies) that sees the human being as part of the ecosystem (cf. Larrère&Larrère, 1997). However, following [START_REF] Teyssèdre | Le pari de la réconciliation[END_REF]who urged scientists to distinguish between "ecological service" and "economic service" (specifying that "maintaining a scarce ecological service corresponds to an economic service"), we argue that a distinction should be made between, say, the pollination activity of insects (referred to as an ecological service by biologists) which can occur without any human action and the making of hives or the planting of flowers that will favour the activity of the pollinizing insects. The same can apply for water: on the one hand, sedimentation that occurs in ecosystems may filtrate and regulate water flows naturally, without human intervention while, on the other hand, land use activities may contribute to the maintenance or the enhancement of this natural ecological function. The frequent uncertainties concerning the outcome of a given land use in a specific site (i.e. keeping or planting trees for enhancing water quality, that can be the expected environmental service) and the result in terms of ecosystem services (i.e. the actual water quality) should ascertain the pertinence of distinguishing between the notions, despite the strong interaction between human actions and ecosystem functioning.

Distinguishing "services rendered by nature" and "services rendered by people", even if interactions are frequent between both, is critical in dealing with the issue of commodification. Ecosystem services are by nature collective goods (non-rivalry) or public goods (non-excludability and nonrivalry) since they are qualities associated with a certain state of the ecosystem (for instance the quality of the water from a watershed, or the quality of the natural habitat which favours biodiversity) and which cannot be exchanged.

PES and property rights

Characterising ecosystem services as a collective or public good by nature is not widely accepted. [START_REF] Wunder | Revisiting the concept of payments for environmental services[END_REF], discussing the [START_REF] Muradian | Reconciling theory and practice: An alternative conceptual framework for understanding payments for environmental services[END_REF] tentative definition of PES referring to "the social interest" (see supra), argue that "not all environmental services are public" and specify: "some are club goods *…+, and yet others are fully private (e.g. when the only downstream user is a private brewery)". For reasons exposed above, Wunder does not distinguish between ecosystem and environmental services, but in the last example implicitly refers to the quality of water that is somehow 'appropriated' by the brewer. This quality is, for us, the ecosystem service that can be rendered without human intervention and that can be also maintained and enhanced through environmental services (adoption of a given land use). In this example, the quality of the water is not appropriated by the brewer but is likely to be a common pooled resource shared by the inhabitants of the watershed drawing from the same aquifer. The fact that the brewery is able to take advantage of this quality for its private production does not mean its owner is able to deprive its neighbours of the benefits they will get from access to high quality water8 .

The argument is that some environmental services (generally referred to as 'ES') can be privately owned is also raised with regard to pollination and soil fertility. But, generally, these services are different from those associated with PES. Some beekeepers, for instance, move their hives by truck along the road and rent pollination services to famers (by parking the hives in the orchards for a few days). This clearly involves a market transaction; the farmer buys the pollination service since the bees are left on his land. But is this socio-economic practice the same as the one involved in PES? In this example (as for "fertilising contracts" practised in some rural areas between croppers and pastoralists), the service is rendered on the land belong to someone else, while in PES literature, the situations analysed refer to payments for actions to maintain or enhance ecosystem services on the lands owned (or controlled, in case of collective property) by the provider of the environmental service. A gardener planting trees on a municipal or private estate, that is not his own, is a salaried worker, not the recipient of a PES.

PES are proposed to those who have rights over lands and their resources. The payments are made for not using these property rights or using them in a different way. In sum, all the transactions involving ecosystems are not PES according to the framework for the ideal type of PES that has gradually emerged from the literature.

Environmental services and markets: on the issue of definitions

What about environmental services? Does paying for environmental servicesmake them synonymous with market-based relationships? Let us review some of the main tentative definitions of PES. PES are often described as MBIs in the literature. The definition of PES proposed by Wunder in 2005, and extensively quoted since then, has certainly contributed to this classification: "a voluntary transaction in which a well-defined environmental service (ES) or a form of land use likely to secure that service is bought by at least one ES buyer from a minimum of one ES provider, if and only if the provider continues to supply that service (conditionality)". This definition uses market terminology (buying and, implicitly, selling), which implies that the services have been appropriated prior to the transaction (one can only sell what one possesses). Alternative definitions,whichavoid linking PES to a market-orientedview of the world,have also been proposed. [START_REF] Karsenty | Payments for environmental services and development: Combining conservation incentives with investments[END_REF], suggested that "a PES is a payment to an agent for services provided to other agents -wherever they may be in space and time -by means of a deliberate action aimed at preserving, restoring or increasing [an] environmental service agreed by the parties". Wunder (2015:6) criticized this definition, pointing, rightly, to the issue deriving from the causal circularity associated with the reference to the sole notion of environmental service. Indeed, since making this first proposal, we have explored what could be identified as the distinction between environmental and ecosystem services. Replacing "environmental service agreed by the parties" by "ecosystem service" would avoid the imprecision caused by the circularity of the definition. [START_REF] Tacconi | Redefining payments for environmental services[END_REF] underlined the importance of additionality in the PES definition he proposes ("A PES scheme is a transparent system for the additional provision of environmental services through conditional payments to voluntary providers", p. 35), as did Sommerville et al. (2009, p. 34). Both table. Today, Vittel, the farmers and the local inhabitants benefit from pure water, although the company benefits most financially. definitions are influenced by the conviction that PES should be efficient, i.e. not pay for "business-asusual". In practice, such criteria have not always been respected, in particular in government PES, like in Costa Rica, where the government paid landholders for business-as-usual (Pfaff et al., 2007;[START_REF] Pattanayak | Show me the money: Do payments supply environmental services in developing countries?[END_REF], simply because they were owners of forested land and they committed to keep it, without considering whether (or not) they inccured any opportunity costs. Another useful definition was proposed by [START_REF] Muradian | Reconciling theory and practice: An alternative conceptual framework for understanding payments for environmental services[END_REF]Muradian et al., ( , p. 1205) who considers "PES as a transfer of resources between social actors, which aims to create incentives to align individual and/or collective land use decisions with the social interest in the management of natural resources". As pointed out by [START_REF] Farley | Payments for ecosystem services: From local to global[END_REF] "most PES schemes actually pay for land uses associated with generating the service" (p. 2062).

This emphasis on land use has major consequences for our conceptualization of PES, and leads to the frequent distinction between "landuse restricting" and "assetbuilding" PES [START_REF] Wunder | Payments for environmental services: Some nuts and bolts[END_REF]. Although the former can be categorised as negotiated easements for which compensation can be received (suspension of development rights), the latter are related to (remunerated) efforts invested in planting trees, fences or changing polluting agricultural practices. What qualifies them as PES is the fact that the efforts are focussed on the property (individual or collective) of the recipients (which distinguish the scheme from the case of a municipal gardener) 9 . We argue that the term marketbased relationships isnot appropriate to describe PES, while there are some cases where PES can be organized throughcompetition to select service providers, such as inverted auctions. And the fact that there are markets for carbon credits generated by certain types of forestry projects (CDM or REDD+) does not mean the landusers, whose practices are directlyresponsible for carbon emissions, are selling environmental services.

PES and the markets of "carbon credits"

Let us consider the case of payments for maintaining endemic biodiversity through habitat conservation or species monitoring [START_REF] Wunder | Decentralized payments for environmental services: The cases of Pimampiro and PROFAFOR in Ecuador[END_REF][START_REF] Clements | Payments for biodiversity conservation in the context of weak institutions: Comparison of three programs from Cambodia[END_REF][START_REF] Sommerville | The role of fairness and benefit distribution in community-based Payment for Environmental Services interventions: A case study from Menabe, Madagascar[END_REF]. By definition, endemic species are not substitutable and looking for equivalence (a metric) would not make sense. Nevertheless, some PES aremore amenable to metrics. The maintenance or enhancement of the quality and amount of water -the most frequent PES scheme -can be assessed using different metrics (microbiological composition, turbidity, concentration of inorganic compounds, litres of water per second).But, unlike CO 2 , which has a global impact regardless of where it is emitted, in this case, there are no polluting rights to beexchanged. The physical nature of the environmental service of water regulation and the specific links its creates between the provider and the user do not allow for a transfer in its canonical sense, nor for competition between several possible users and providers. As [START_REF] Wunder | Beyond "Markets[END_REF] put it, a payer who "thinks the price for watershed protection charged by upstream farmers is too high, ususally cannot just go for the next three watersheds for better offers". In these circumstances, commodification is simply not possible, and any attempt to create ecosystem marketplaces is prevented by the very nature of the services and the impossibility of allocating property rights on them.

If an environmental service can be expressed as a relatively homogenous unit, like the CO 2 equivalent which can be used as a metric for a reduction in greenhouse gas emissions, then a tradable asset can be created (the "carbon credit"), and this credit (and only this credit) can be echanged on a market for emission permits. But such a good is no longer an environmental service: the service which is provided is the reduction in carbon emissions; and it is contingent, i.e. it can be rendered without the issuance of "carbon credits". A carbon credit is produced bya standardized and quite costly procedure (set by voluntary standards) and separated from the underlying contract (if there is a contract) in which a land holder agrees to perform a negotiated land management activity. And, unlike environmental services which are "externalities", carbon credits are, indeed, subject to appropriation.

The fact that the promoters of REDD+ projects can sell "carbon credits" (offsets) derived from the estimated avoided or captured emissions entailed by the prevention of an alternative land use option does not alter the nature of -or support for -the transaction (the land-use agreement) concluded between the land users and the project/promoter. Furthemore, through carbon measurements, setting, certification, and marketing reference emission levels and MRV (Monitoring, Reporting and Verification) operations, there is a specific prodution process of the tradable assets (the carbon credits) which, although these depend on the field context, makes them a genuine creation by the project promoter [START_REF] Karsenty | Carbon Rights', REDD+ and payment for environmental services[END_REF] which is contingent to the PES itself, i.e. payment for the land-use agreement 10 . And the carbon credit is not the environmental service: it is, in the best case, a quasi-monetary sign acknowledging a certain amount of emission reduction deriving from a bilateral land use agreement between the project promoter and the direct land users -those who provide the service of reducing emissions (see figure 1). In sum, it is difficult to see any tangible commodification of nature in such transactions which do not entail the transfer of property rights, even though one might consider such PES are "backedagainst" 11 the carbon markets without being market-based. A parallel can be drawn with the principle of patents: as recalled by a 2013 decision of the US Supreme Court (n° 12-398, Myriad Genetics), natural phenomena cannot be patented (and are consequently not marketable), neither is a process reciting a law of nature patentable, unless that process has additional features (genetic modification of a living organism, for instance) . The additional feature, in the case of a PES, is the creation of "certificates of emission reductions" commonly referred to as carbon credits. 11 This term is suggested by an expression used by R. [START_REF] Pirard | Peut-on sauver les forêts tropicales ? Instruments de marché et REDD+ vs principes de réalité[END_REF] in French ("adossés aux marchés") about PES In PES (i.e. voluntary) schemes, land use rights are frozen by the PES recipient as long as payments continue, and not transferred. A transfer of property rights would require other institutional arrangements, such as a lease, concession or purchase. But, in such cases, this would imply a shift from PES to a very different situation, which has been referred to as "green grabbing" by some authors includingFairhead et al. (2012). Like some PES, such operations can be driven by the opportunities for profit offered by the development of the carbon market, or the desire to compensate for environmental damage through land acquisition (or long-term renting) for conservation (e.g. "conservation concessions"). But these operations are fundamentally different from PES in the sense they are based on a permanent or temporary (lease) transfer of property rights 12 . In addition, renting the land, even for a short period, often implies physical intrusion by the taker and displacement of former land users, which is not the case with PES.

The case for hybrids: selection through auctioning

In "asset-building" PES schemes, when the time invested by land users in ecosystem restoration and planting the land they control is to be paid for, the basis of the payment is the working time invested, possibly bonified by the species planted (or their location). Introducing competition in the supply of labour is limited by the number of land users/owners who are called to work on their own estates.

12 On this point, we agree with [START_REF] Sommerville | A revised conceptual framework for payments for environmental services[END_REF] analysis that "any intervention where one-time property rights are transferred to another group, would not likely be considered as PES approaches" (p. 34).

But if a service payer is looking for an environmental service which consists in planting 10,000 trees of a given species in a given area (to enhance the ecosystem service of pollination, for instance), he/she can launch a call for tendersto select farmers who will commit themselves to planting the trees on their property at the least cost. Similar competitive procedures can be envisaged for PES which restrict landuse, and some current payment schemes use inverse auctioning to select the service providers in some countries, notably in the USA and Australia (Latacz-Lohmann and Schilizzi, 2005): if the payer believes the ecosystem service (a quality threshold) can be renderered with a minimum number of landusers conserving wetlandson their property or conserving the plant cover on the uplands they control, the payer can select them using a reverse auction procedure.

In such a case, a market-based procedure for selecting the environmental service providerstakes place, but this fact does not end the debate on whether the instrument is marketbased or not. [START_REF] Lapeyre | Payments for environmental services and market-based instruments: next of kin or false friends?[END_REF] ask, "what should be considered as an instrument: the entire agroenvironmental scheme or just the reverse auction?". In this case, the PES could be analyzed as "hybrid" arrangements [START_REF] Ménard | The Economics of Hybrid Organizations[END_REF], similar to what Vaissière and Levrel (2015) proposed for biodiversity mitigation banking. For Ménard (2004:351), hybrids "rely on partners who maintain distinct property rights and remain independent residual claimants". The composite nature of this scheme, that uses market-based procedures but does not entail the transfer of property rights, set the stage for hybrid arrangements in which some PES are much closer to the market than others.

Will most PES in the future be managed through such hybrid arrangements? It is interesting that auctioning is favoured by economists for reason of efficiency (see Munoz Pina et al.), but that selecting the providers through auctioning could lead to the opposite result. Selecting the lowest bidder tends to mean selecting landowners with zero or very low opportunity costsfor conserving portions of their estates. As Blackmore et al. (2013:12) stated in the context of Australia, "Additionality of outcomes may be of concern in Australian [conservation tender] programs [that] may be failing to achieve biodiversity benefits greatly in excess of those that would have been achieved in any case. Moreover, this finding is in line with the limited additionality observed in environmental stewardship programs in the United Kingdom [START_REF] Jones | Implementation of Environmental Stewardship optionsadditionality and compliance[END_REF]".

In most cases,selectinga small number ofproviders of environmental services is not the best way to achieve the objective of preserving or enhancing a threatened ecosystem service: the conservation of endangered species, for instance, needs the broadcooperation of farmers and other land users, not the selectionof some of them. Climate change mitigation requires huge efforts in all sectors all over the world, which is the exact opposite of selecting only those with the lowest abatement costs.

Conclusion

It is striking how both unconditional advocates of market solutions, on one hand, and authors who are more attached to public regulations on the other, classify instruments as different as transferable permits, taxes and PES in the very same category of market-based instruments. Such a classification is used either to praise the instrument in the name of its alleged efficiency, or the contrary, to refuse it as a neoliberal solution for commodifying nature. Both arguments can be contested.Here our aim wasto exemplify the use and misuse of the "market-based" concept through a review of institutional economists'definitions of what a market actually is, and what is exchanged on them. Goods or services to be exchanged should be appropriated in advance. By their very nature,ecosystem services, i.e. the services rendered by nature, are collective or public goods, the properties of ecosystems, and as such cannot be appropriated or exchanged; only modified. What could be the subject of market-based relationships are environmental services, i.e. how the services people render to other people in return for enhancing ecosystem services through their land-use practices,are framed.

Distinguishing "asset-building" and "land-use restriction" PES can helpgrasp the different relationships such schemes have with markets. In both types, providers can sometimes be selected through a competitive procedure (auction) which still might not justify referring to the entire scheme as market-based, but may be analysed as a hybrid form between market-based instruments and bilateral agreements often related to the setting of environmental easements. When payments reward the work time invested by a farmer in planting trees or building fences on his/her own land, there is a monetary relationship for what remains a bilateral agreement with no transfer of property rights. This would be very different for out-growing plantation schemes, where the investor acquires, by contract, the exclusive righttopurchase the future production. On the other hand, at landscape level, it is still possible to select environmental service providers through competitive bidding (reverse auctioning), even though, in practice, enhancing threatened ecosystem services often requires the broadest possible collaboration rather than selection. Like most "land-use restriction" PES, asset-building PES do not entail transferring property rights from landholders to environmental service users -land-use rights are voluntarily suspended but not transferred, even temporarily. This is a good reason for not confusing this subset of PES (the one most people usually have in mind) with genuine MBIs.

It is also surprising to see such wide acceptance of markets equated with incentives -even though both change relative prices, especially by authors who describe themselves as critical vis-à-vis "mainstream" economic theory, which generally refers to the neoclassical economy and its variants. We argue that this interpretation masks an ideological attempt to introduce a hierarchy -and not simply a distinction -between (allegedly) smart and efficient (market) instruments and (still allegedly) burdensome and inefficient (administrative) regulations. ***

  10

Figure 1 :

 1 Figure 1: Schematic diagram of the articulation of a PES component and the carbon credit transactions compartment (REDD+ project type)

 Hodgson (1988) comments that only a few economists have attempted to define a market while, for most, "the market has been taken for granted". Among these economists, he mentions Cournot, Jevons and Alfred Marshall, who provided rather vague definitions (such as the one of Jevons, 1871: "to mean any body of persons who are in intimate business relations and carry on extensive transactions in any commodity" -quoted byHodgson, 1988, p.173.

Some authors including[START_REF] Corbera | The equity implications of marketing ecosystem services in protected areas and rural communities: case studies from Meso-America[END_REF] and[START_REF] Vatn | An Institutional Analysis of Payments for Environmental Services[END_REF] emphasize the public character of the financing of many PES to distinguish them from "standard markets"[START_REF] Vatn | An Institutional Analysis of Payments for Environmental Services[END_REF](Vatn, : 1246)). But the involvement of public authorities is not sufficient to clearly distinguish between what MBIs are and what they are not. Even the fact that the money collected by payments is not "voluntary" (but is collected through a tax on water, for instance) does not seem to be a strong enough law to portray PES as non-market instruments. On the other hand, the reference to the voluntary dimension would be useful to question equating environmental taxes (which are compulsory) and MBIs.

An arguments, however, not advanced by Wunder

Our emphasis

The same occurred in the well-known example of Vittel in France: the company paid the farmers to make major changes in farming practices e.g. avoid the use of pesticides, and diminish nitrate levels in the water

Here, we do not consider "transferable development rights "[START_REF] Chomitz | Transferable Development Rights and Forest Protection: An Exploratory Analysis[END_REF] as PES, inasmuch they are based on prior capping of property rights by law, and are not directed towards the provision of more ecosystem services but rather a reduction in the social cost of a given environmental target. Neither do we consider certification as a PES, since the price premium (when there is one) for the products is largely disconnected from the service (indirect inventive).

Acknowledgements:The authors would like to thank the projects PESMIX and INVALUABLE funded by the French AgenceNationale de la Recherche (ANR) and the European research network ERANET BIODIVERSA, for their support.


Jean-Louis Camus

Carole Haudebourg

Data Flow Model Coverage Principles and Practice p 1/10 Data Flow Model Coverage Analysis: Principles and Practice

Keywords: Topic Processes, methods and tools Coverage, Model, Data flow, Tool, Qualification, Safety, Embedded, Software, DO-178C/

Safety critical software requires rigorous processes in order to achieve a high degree of integrity. These processes include so-called "verification of verification". In the case of Model Based Development and Verification, DO-178C/DO-331 requires model coverage analysis. This paper reminds the objectives of model coverage analysis and the difference with structural code coverage analysis. It proposes coverage criteria suited to data flow models. These criteria are a generalization of the functional masking effect and also take into account modularity and inlining of the model operators. It presents a tool supporting model coverage analysis according to these criteria. It concludes with industry field experience and future extensions.

Regulatory Context

Safety critical software requires a high degree of rigor in its development and verification processes. These processes are regulated by standards such as DO-178C/ED-12C [START_REF] Do-178c | Software Considerations in Airborne Systems and Equipment Certification DO-178C[END_REF] for airborne software, EN 50128 [START_REF]EN 50128 Railway applications -Communication, signalling and processing systems -Software for railway control and protection systems[END_REF] for railway equipment, IEC 61508 [START_REF]IEC, IEC_61508 Functional safety of E/E/PE safety-related systems[END_REF] for industry, ISO 26262 [START_REF]ISO 26262 Road vehicles -Functional safety[END_REF] for automotive, ECSS (in particular Q80, E40) [START_REF] Ecss | Space product assurance Software product assurance[END_REF] for European space and IEC 60880 [START_REF]IEC 60880 Nuclear power plants Instrumentation and control systems important to safety Software aspects for computer-based systems performing category A functions[END_REF] for the nuclear industry. These standards are based on process assurance, with a strong emphasis on verification activities: reviews, analyzes, and testing. These processes include so-called "verification of verification". In the case of Model Based Development and Verification, DO-331 [START_REF]Model-Based Development and Verification Supplement to[END_REF] requires model coverage analysis of so-called "design models", i.e. models describing Low-Level Requirements. This paper reminds the objectives of model coverage analysis and the difference with structural code coverage analysis.

Role of Testing and Coverage Analysis in the Safety Standards

In addition to review and analysis, safety standards require dynamic verification. Simulation can be used as a means for verifying compliance of models to their higher-level requirements and algorithm accuracy. Testing is used for verification of the executable object code.

Safety standards require various types of coverage analysis. For instance DO-178C requires the following categories of coverage analysis:  High-Level Requirements Coverage analysis (6.4.4 Difference with Structural Coverage Analysis Model coverage analysis should not be confounded with structural [code] coverage analysis. Model coverage analysis concerns the Low-Level Requirements expressed by a model, and is at a higher level of abstraction than structural coverage analysis. Model coverage analysis concerns the functional aspects of the model regardless of the code that implements this model, which structure is highly dependent on the coding technique. Also, the code coverage criteria that are required by standards and supported by tools are limited to control structures and Boolean expressions: they do not address very important functional aspects such as the definition and use of data.

1.2.3

Is Model Coverage Analysis a New Burden? Model coverage analysis is not an additional burden introduced by DO-331, it is just the appropriate term for LLR coverage analysis in case of model-based development and verification (MBDV). LLR coverage analysis has always been required by DO-178B, whether one uses traditional development or MBDV. For years, a number of applicants using MBDV used to assess coverage of their LLRs by manual means such as Excel tables or colored pencil on model diagrams, or using specific tools such as pioneering versions of SCADE MTC or Simulink.

Challenge of Defining Appropriate Model Coverage Criteria

2.1

The Scade Language and the SCADE Suite Environment Let us introduce the context, which is the Scade language and its supporting environment. The Scade language [START_REF]Esterel Technologies, Scade 6.0 Language Reference Manual[END_REF] is a synchronous data flow language [START_REF] Benveniste | The Synchronous Languages 12 Years Later[END_REF] for reactive software. Its formal semantic foundation is the Lustre language [START_REF] Halbwachs | The synchronous dataflow programming language Lustre[END_REF], extended with state machines and iterators [START_REF] Colaço | A Conservative Extension of Synchronous Data-flow with State Machines[END_REF]. Scade is fundamentally a declarative language, which is not based on the notion of execution. A Scade model is a set of non-ordered equations combining flows/variables subject to formal clocks (i.e. conditions under which are defined). It is not a sequence of executable statements and it is the job of the code generator to transform purely declarative sets of equations into imperative statements.

The Scade language supports a free combination of notations that are familiar to control engineers:  Block diagrams to specify the control algorithms (control laws, filters)  State machines to specify modes and transitions in an application (e.g., taking off, landing) with parallelism, hierarchy and preemption  Flowchart-like constructs (called clocked blocks) ERTS 2016 Data Flow Model Coverage Principles and Practice p 3/10

The basic building block in Scade is called an operator. An operator is either a pre-defined operator (e.g., +, delay) or a user-defined operator that is built with predefined or user-defined operators. It is thus possible to build structured complex applications with high modularity.  Degree of formality: modeling notations range from non-formal (e.g. UML) to formal (e.g. Scade, SDL).  They may be based on various concepts and representations such as data flow, state machines, sequence charts.  They may be based on a synchronous basis (e.g. Scade) and/or an asynchronous basis (e.g. SDL, UML).

Elemnt Textual Form Graphical Form

And there may also be other notations in the future that are currently unknown.

The committee agreed that it was not possible to impose specific model coverage criteria in DO-331, and the following approach was retained: 1) DO-331 provides general principles for model coverage criteria (e.g. coverage of transitions in state machines)

and requires model coverage criteria to be defined in each project's software verification plan. 2) Each applicant project defines in its SVP the model coverage criteria that it will apply. Thus, it was necessary to define relevant model coverage criteria for the Scade language.

2.3

Are Structural Code Coverage Criteria Suited to Data Flow Model Coverage? Analysis of classical imperative code has been investigated and applied for decades. This type of analysis is supported by a number of tools. The most commonly used code coverage criteria are Statement Coverage, various forms of Branch Coverage, Decision Coverage (DC), Modified Decision Coverage (MC/DC) [START_REF] Chilenski | An Investigation of Three Forms of the Modified Condition Decision Coverage (MCDC) Criterion[END_REF]. Note that statement coverage and branch coverage address the control structure, whilst DC and MC/DC are actually specific data flow criteria for Boolean expressions (a decision is NOT a branch as recalled by [START_REF] Cast | Position Paper CAST-10 What is a "Decision" in Application of Modified Condition/Decision Coverage (MC/DC) and Decision Coverage (DC)?[END_REF].

The first natural approach is to consider traditional structural coverage criteria as candidates for the basis of model coverage criteria. But this approach would not work with Scade for the following reasons:  It would be highly implementation-dependent  It would not capture the essence of the functional flows expressed at the model level  The traditional criteria are based on execution concepts for imperative languages, whilst Scade is a declarative language, not based on the notion of execution (it is the job of the code generator to transform purely declarative sets of equations into imperative statements).

3 Data Flow Coverage Criteria for the Scade Language

Principles of the Model Coverage Criteria Defined for the Scade Language

The principles of the proposed model coverage criteria are based on two related considerations:  Good testing practice: an experienced tester develops requirement-based tests checking that the effect of input data values on observed data complies with the requirements. In order to be under appropriate controllability/observability situations, the tester sets the software in conditions where this influence occurs for each concerned data of interest. The proposed model coverage criteria assess that these conditions are met during testing.  Theoretical basis: a synthesis of Definition-Use analysis is provided in [START_REF] Clarke | A Fomal Evaluation of Data Flow Path Selection Criteria[END_REF]. More specifically, [START_REF] Parissis | Structural test coverage criteria for Lustre programs[END_REF] proposes coverage criteria for the Lustre language (on which Scade is based). In this paper, we have chosen a definition sharing with it some aspects of path activity. In addition it consistently takes into account masking MC/DC, Arithmetic, Structured data handling, Iterators, Reset, Clocked blocks and State machines.

A data path from one point of the data flow graph to another one is active when its Activation Condition (AC) is true. For instance on Figure 3, B influences Z when C2 is true and C1 is false. Several coverage criteria all based on this activity concept are defined, as summarized in Table 1.

Table 1: Coverage Criteria Summary

Coverage Criterion Synopsis

Basic Coverage (BC) Every element has been on an active path.

Decision Coverage (DC) Every Boolean expression outcome has toggled while on an active path.

Modified Condition /Decision Coverage (MC/DC)

Every condition of every Boolean expression's has toggled while on an active path (shows independent effect of the conditions).

Control coupling Every state/transition, clocked block, activate branch has been active

Data coupling Every input flow to every user operator instance has changed value.

Operator feature Every characteristic feature (e.g. saturation, reset) has been active.

In order to match industrial practice regarding code coverage analysis, the current approach considers the flows occurring in the current instant (i.e. memories are part of the inputs/outputs).

Application of the Influence Principle to Logic and State Machines

The principles presented above are very general. In the case of Boolean expressions, the activation condition is actually the negation of the masking effect which concerns any level of abstraction (requirements, code, or hardware) as explained by [START_REF] Chilenski | An Investigation of Three Forms of the Modified Condition Decision Coverage (MCDC) Criterion[END_REF]. On example 2, the influence of In1 is masked if its activation condition (In2 and not In3) is not satisfied. Note that our definition, matches masking MC/DC as defined in [START_REF] Rtca | Software Considerations in Airborne Systems and Equipment Certification DO-178C[END_REF] and [START_REF] Chilenski | An Investigation of Three Forms of the Modified Condition Decision Coverage (MCDC) Criterion[END_REF]. This differs from [START_REF] Parissis | Structural test coverage criteria for Lustre programs[END_REF]. Indeed, for X= Y and Z, the AC of the path Y to X is defined as Z in our definition: whereas it is defined as (not Y and Z) in [START_REF] Parissis | Structural test coverage criteria for Lustre programs[END_REF].

, One can see that even on a very simple example, the proposed model coverage criteria capture the functional activation at model level regardless of the code that will implement it, whereas structural coverage, which is limited to control structures does not address functional flows aspects. This difference is of course amplified when analyzing more complex modeling constructs, such as complex data flow combinations or state machines.

In [START_REF] Frankl | An Applicable Family of Data Flow Testing Criteria[END_REF] it is shown that there is a subsumption (a kind of implication) hierarchy between data flow coverage and statement coverage. Intuitively, one understands that in order to activate a Definition-Use data flow, one needs to execute the related imperative statements in the generated C code, whereas execution of statements does not guarantee Definition-Use activation, as shown in the implementations A and B of Table 2. It has been verified in practice for complex models that tests covering the model also cover the code generated from that model, except few systematic cases which are predictable and justifiable. Formal demonstration of implication of code coverage by model coverage require some additional refinement of model coverage criteria (see conclusion of this paper).

3.4

Handling Structured Models A Scade operator can be considered either as a black box or just as a syntactical/graphical device (it is said to be expanded or in-lined). This choice (which can expressed at model level as well as at code generation time) is a design choice. It is reflected by the code generator both in terms of causality analysis (i.e. any data shall be produced before being consumed) and in the architecture of the generated code: a non-expanded operator is implemented as a C function, whereas an expanded operator is in-lined as part of the function corresponding to the nearest non-expanded parent.

ERTS 2016

Data Flow Model Coverage Principles and Practice p 7/10

There are a number of possible approaches for handling such hierarchies such as: a) Fully expand all operators of the model: this ideal analysis is supported by SCADE, and works for small models, but is impractical for large models both regarding the testing effort and machine resources. b) Expand no operator at all, and consider each of them as pure black boxes. This was supported by historical versions of SCADE. c) Selectively expand at model level consistently with the expansion selected for code generation and abstract non-expanded operators by considering their interfaces as atomic. This is supported by SCADE R16 and is the most typical use case. d) The definition provided in [START_REF] Papailiopoulou | Structural Test Coverage Criteria for Integration Testing of LUSTRE/SCADE Programs[END_REF] proposes a definition that abstracts non-expanded operators with a fine-grained dependency between their inputs/outputs. e) Abstract specific operators with user-defined criteria. For instance for the integrator shown on Figure 5 , each instance of the integrator can be abstracted from its caller perspective as four objectives to cover: Reset, Normal integration, Low saturation and High Saturation. This analysis, supported by SCADE, is well suited to library operators. In the case of example 3, if node NASA_Example1 is not expanded, there are two Boolean expressions with 3 non-independent conditions each, if it is expanded there is one single expression with 5 conditions.

Tool Support Overview

A toolchain called MTC (for Model Test Coverage) version 6.4.7 supporting of the above described criteria has been developed. Using appropriate observers, it runs test cases and collects model coverage information during simulation. The coverage results can be displayed in graphical form (e.g. Figure 7) or textual form. For applicants wanting to provide direct evidence of structural coverage, there is also a feature supporting direct measurement of structural code coverage of the source code that will be embedded, under execution of the same test cases as those used for model coverage analysis and with the corresponding coverage criteria (DC, MC/DC). The toolset has been qualified according to Tool Qualification Level TQL-5 of DO-330 [START_REF]Software Tool Qualification Considerations DO-330[END_REF].  There are potential improvement in the presentation of missing activations, since the reason of missing activations is sometimes hard to understand.

General Return of Experience

The new MTC has been used on complex airborne software systems (FADEC, flight control sub systems). The main feedback is the following:  Model coverage analysis supports detection of insufficient testing and dead or deactivated model elements.

The detection can be done early in the software lifecycle, which reduces cost and time for software development.  There is a focus shift from code level to model level both for design and coverage analysis.  There is a paradigm change from the traditional imperative mindset (statements, branching) to a data flow mindset (definition/use), which is more efficient but requires appropriate user training.  The tools were able to handle complex software (3000 user operators, 100 000 model coverage points, 50 000 code coverage points). The ability to handle efficiently incremental software changes will be improved. The user interface will be improved for more comfortable navigation in large data sets.  It is recommended to perform model coverage analysis early in the lifecycle, in order to detect and fix dead and/or non-optimal model elements and take full benefit of model coverage analysis.

Conclusion and Future Work

Model coverage analysis was a pioneering approach 10 years ago. It is now explicitly required and/or recognized as an alternate means for checking testing activities completeness in domains such as avionics (DO-331) or automotive (ISO 26262). The combination of the Scade language and of SCADE tools with appropriate model coverage criteria described in this paper allows software engineers to consistently shift their focus from code level to model level. Usage on large industry projects showed that it is an efficient means for detecting insufficient testing and dead or deactivated model elements.

Future work will provide additional benefits. For instance further refinements for addressing numeric aspects would allow performing analysis of singular points. Handling delays such as in [START_REF] Whalen | Observable Modified Condition/Decision Coverage[END_REF] would allow assessment of sequential logic. Providing formal evidence of model to code coverage implication would allow application of DO-331 FAQ#11, definitely eliminating need to handle double-check of structural coverage.

Figure 1 Figure 2 :

 12 Figure 1 Integrator in Graphical Scade Notation

Figure 3 :

 3 Figure 3: Example 1 Data Flow Activity and Influence

Figure 4 :

 4 Figure 4: Example 2 Masking and Activation Condition in a Boolean Expression

Figure 5 :

 5 Figure 5: Example 4 Integrator Library Component

Figure 6 :

 6 Figure 6: Example 3 Cascaded Operators with Boolean Expressions

Figure 7 :

 7 Figure 7: Model Coverage Browser 5 Industrial Return of Experience Model coverage analysis tools based on simpler criteria have been used since 2005 on many industry projects. The first versions supporting the new criteria described in this paper have been released by mid-2014 and used recently in several industrial projects in avionics and nuclear industry. The current version is MTC 6.4.7a.5.1MTU Experience Example MTU develops emergency diesel engines for nuclear power plants. This function is very critical in case of failure of the electrical network. MTU develops the digital engine control unit for such engines. This unit shall in particular maintain safe state requested by user. The applicable standard are IEC60880 and IEC61508:2010 (SIL 3 for the software).The previous experience of MTU about coverage concerns: Structural coverage with Cantata++  Scade coverage with earlier versions of MTC:

  .1), with full coverage required by table A-7 objective 3.  Low-Level Requirements Coverage analysis (6.4.4.1), with full coverage required by table A-7 objective 4. In case of model-based development, the Low-Level Requirements are contained in a model and LLR coverage is model coverage (DO-331 MB 6.4.7). One should apply requirements-based testing assessed with structural coverage analysis, and not structural testing. As explained by DO-248C [8] FAQ#44, "Whereas structural testing is the process of exercising software with test scenarios written from the Source Code, DO-178C/DO-278A section 6.4.4.2 explains that structural coverage analysis determines which code structure, including interfaces between components, was not exercised by the requirements-based test procedures…. Since the starting point for developing structural test cases is the code itself, there is no way of finding requirements (high-level, low-level, or derived) not implemented in the code through structural tests. It is a natural tendency to consider outputs of the actual code (which is de facto the reference for structural testing) as the expected results. This bias is avoided when expected outputs of a tested piece of code are determined by analysis of the requirements. " As stated in DO-331 6.7, model coverage analysis determines which requirements expressed by the model were not exercised by verification based on the requirements from which the model was developed. Model coverage analysis is a means to assess thoroughness of the model verification activities. Model coverage gaps may reveal:

	1.2	Objectives of Model Coverage Analysis
	1.2.1	Objectives of Model Coverage Analysis
	a) Shortcomings in requirements-based verification cases or procedures
	b) Inadequacies or shortcomings in requirements from which the Model was developed
	c) Derived requirements expressed by the Model
	d) Deactivated functionality expressed by the Model
	e) Unintended functionality expressed by a Model
	1.2.2
	 Structural [Code] Coverage analysis (6.4.4.2), with full coverage required by table A-7 objectives 5, 6, 7 and
	8.

Several aspects of coverage analysis have to be emphasized:

1) Coverage analysis in general (requirements coverage and structural coverage) is not a goal per se, it is a means for verifying that verification activities are thorough and complete ("verification of verification").

ERTS 2016

Data Flow Model Coverage Principles and Practice p 2/10

2)

ERTS 2016

Data Flow Model Coverage Principles and Practice p 6/10

The masking effect is also taken into account for coverage analysis of higher-level constructs such as state machines, where the influence of data depends on conditions related to the state, flows from/to states and transitions guards and priorities.

Position with Respect to Structural Coverage

Let us take example 1 to show the difference with structural coverage. The code that implements this model part may typically be implemented in three ways, shown in Table 2 in the form of pseudo-code.

Table 2: Implementation of Example 1

Implementation A can be structurally covered just with just one execution cycle; it is obvious that such a test case does not cover the LLRs expressed in this model and is very poor. Implementation B can be covered just with the following set of test cases for C1/C2= {T/T, F/F}, which does not test the effect of B on Z.

The proposed model coverage criteria (even the most basic one) require at least C1/C2= {T/x, F/F, F/T} (where x stands for don't care) in order to activate the effect of A, B, D and E on Z; more specifically, C1/C2= {F/F,F/T} shows the effect of B on Z . Note that this is also what is required for implementation C.