F Fayos

R Torres

Local behaviour of evaporating stars and black holes around the total evaporation event

Keywords: numbers: 04.20.Cv, 04.40.-b, 04.90.+e, 98.10.+z

Many models in which the object under study loses all its mass have appeared in the literature. One can find from evaporating stars to incipient black holes, all the way to evaporating black holes. In this article we try a semiclassical study of these evaporating models centered on the evaporating event itself. We analyze their common properties, behaviours and possibilities. Specifically, we pay special attention to the evaporating models as a means of avoiding singularities during the collapse. In case of any pre-existing non-spacelike curvature singularity, we show that these models tend to evaporate it. Finally, we introduce a new class of evaporating black holes.

Introduction

The pioneering work on evaporating models (1968) was an article by Demianski and Lasota [1]. In this work they found an exact solution of Einstein's equations representing a star endowed with a perfect fluid interior with a flux of unpolarized radiation travelling radially outwards. This interior was matched through the evolving stellar surface to a Vaidya solution which modelled the radiating exterior of the star. The proper radius of the model had the particular property of becoming zero in a finite time. Thus, the star evaporated and a flat space-time appeared in the future of the evaporating event. Later [2] it was shown that this model could be used as a counterexample of Penrose's cosmic censorship conjecture [3] since an instantaneous naked curvature singularity appeared at the evaporating Confidential: not for distribution. Submitted to IOP Publishing for peer review 11 February 2010 event. Likewise, an evaporating radiating star with a Robertson-Walker interior was proposed in [4] by Lake and Hellaby. This model generates a naked singularity that the authors argue is not instantaneous. However, this is questioned in [5]. The generation of naked singularities by particular models of evaporating stars avoiding the formation of horizons is also treated in [6] where the subject is treated in four and higher dimensions.

Contrary to the use of evaporating models as a means of getting naked singularities, the ejection of matter until reaching a complete evaporation can also provide a method of avoiding the formation of closed trapped surfaces, singularities (naked or not) and black holes. Thus, for example, in reference [7], by studying the general procedure for getting spherically symmetric matched models, we obtained a particular analytical example of a regular collapsing toy-star satisfying all the energy conditions which manages to avoid the formation of singularities by radiating away enough mass while the radius of the stellar surface keeps decreasing until becoming zero. In [8] we extended this case to a wide class of models sharing the same properties. Therefore, these models do not need to be in a stationary equilibrium configuration nor to bounce to avoid the formation of a singularity. Along this line, other authors have proposed new evaporating models with different matter fields [9], different exact solutions of Einstein's equations for non-perfect fluids with heat flow [10] or different equations of state [11]. Recently [12] a new mechanism for ejecting matter (based on the mini-super-space loop quantum gravity formalism) has been proposed with the aim of creating this kind of evaporating singularity-free models. This is interesting since it indicates that quantum effects could even favour the total evaporation §.

Another possibility for evaporating stellar models is that of the incipient black holes. In these models an about-to-be-formed black hole emits radiation until it evaporates without forming neither a black hole nor a singularity. For example, in [13] the blackbody radiation coming from the collapsing star continuously drains away the irreducible mass of the incipient black hole at an ever increasing rate. The lifetime of the about-to-be-formed black hole is therefore finite and it can never § However, some geometrical and physical problems are present. See [8] for details.

pass through its instantaneous R=2 M surface. Other recent models for incipient black holes can be found in [14], [15] and [16], where usually the evaporation of the collapsing object is due to nonthermal pre-Hawking radiation, thus avoiding the information loss problem. Likewise, a treatment of non-singular evaporating black holes in the framework of quantum gravity can also be found in [17] and [18].

Our goal in this article is to study the evaporating models as a whole, but paying special attention to the evaporating event itself. We will try to obtain the general conditions that such evaporating objects must satisfy and their different behaviours and possibilities using the geometrical approach of requiring the existence of a well defined metric around the evaporation event. In order to get these models we will match a general interior solution with the exterior radiating Vaidya's solution, in such a way that mass will be lost in the form of outgoing incoherent null radiation.

Since the physics of some evaporating models at late stages can be fairly unknown, we will not restrict the energy-momentum tensor in the interior of the model allowing classical or quantum fields. This semiclassical approach will be necessary when we consider regular interiors for evaporating objects reaching high densities and pressures in their final stages. However, even this approach will fail when considering singular interiors in which the second order curvature invariants diverge. In the vicinity of such singularities only a full quantum gravity theory could provide us with the accurate answers. Therefore, when we deal with this singular case our aim will be to try to discover the possibilities allowed in the semiclassical framework. On the other hand, we will not even impose the fulfillment of any kind of energy conditions in the interior of the models since it is well known that the energy conditions can be violated in the presence of quantum fields. In fact, this is an usual feature for evaporating black holes ( [START_REF] Hawking | The large scale structure of space-time[END_REF], proposition 9.2.8). This work is organized as follows: In section 2 we deal with the radiating Vaidya's solution. We limit the study of this solution to its possibilities as the exterior of an evaporating model and, subsequently, we interpret these possibilities in terms of what is happening with the star. In section 3, we introduce the general interior and study its different properties, characteristics and possibilities around the total evaporation event. In section 4 we study the complete matched models and the dynamical behaviour of the object's surface. The models that lose all its mass without reaching a complete collapse are treated in section 5. In section 6 we deal with the conditions that should be satisfied by models that collapse and evaporate completely avoiding the formation of any exterior singularity. The models with regular interiors, interiors with a non-spacelike singularity and evaporating black holes are sequentially treated in section 7. Finally, the possible existence of models that develop an exterior singularity in their collapse is studied in section 8.

Vaidya's solution as the radiating exterior of an evaporating model

Locally, Vaidya's metric [START_REF] Vaidya | [END_REF] can be described in radiative coordinates [21] as

ds 2 V = -χdū 2 -2 dū d R + R2 d θ2 + sin 2 θd φ2 (1)
where χ = 1 -2 m(ū) R and the mass function m [22,23,24] depends only on ū. For those values of ū such that m > 0, there is a space-like curvature singularity at R = 0.

The energy-momentum tensor for the metric (1) is of pure radiation type

Tµν = - 2 R2 d m(ū) dū l µ l ν , l µ dx µ = -dū l µ l µ = 0 . (2)
The weak energy conditions demand that d m(ū) dū ≤ 0. We shall assume from now on that ū grows towards the future. Then, m is a non-increasing function of ū and the incoherent radially directed radiation described by ( 2) is outgoing. Here outgoing means going towards bigger values of R.

We want to describe a process of total evaporation such that the mass function must decrease until vanishing from the total evaporation event on. Vaidya's solution will model the radiating exterior of the evaporating object. Therefore, we are only interested in studying the particular Vaidya's solutions with vanishing mass. We will proceed for the exterior space-time as follows: we use the metric (1) in the interval -∞ ≤ ū ≤ 0, assuming that the non-increasing function m(ū) satisfies

m(ū = 0) = 0, (3)
so that we arbitrarily set the evaporation event at ū = 0. For ū ≥ 0 we extend Vaidya's metric with Minkowski's spacetime, i.e. m(ū ≥ 0) = 0 (see [7], [8] and references therein for details).

In order to analyze the particular Vaidya's solutions with vanishing mass it is useful to study the behaviour of the radial ingoing null geodesics. To do that, we have to take into account that the differential equation for these null geodesics non-transporting radiation, i.e.

dū d R = - 2 R R -2 m(ū) , (4)
has a critical point at { R = 0, ū = 0}.

In particular, if

- 1 16 ≤ Υ ≤ 0, (5)
where

Υ ≡ lim ū→0 - m(ū) ū = lim ū→0 - d m(ū) dū , (6)
then ū = R = 0 has a node (or col-node) structure [25][26]. This implies that every ingoing radial null geodesic must reach the critical point according to a well defined value for its tangent which can only be one between two possibilities. In order to calculate the values of these tangents, let us define ξ ≡ ū/ R and let λ be the affine parameter of the radial null geodesic such that lim λ→0 ū(λ) = 0 and lim λ→0 R(λ) = 0. Then we have, by applying Hôpital's rule, ξ 0 ≡ lim λ→0 ū/ R = lim λ→0 dū/d R = -2/(1 -2 m, ū ū=0 ξ 0 ). Which provide us with the two possible values for the critical directions:

ξ 0± (Υ) = 1 ± √ 1 + 16Υ 4Υ (7)
Therefore, condition (5) implies

-∞ < ξ 0+ ≤ -4 ≤ ξ 0-≤ -2. ( 8
)
Even more, the node (or col-node) structure implies that there is an infinite family of spherically symmetric null hypersurfaces reaching the critical point ū = R = 0 with tangent ξ 0+ , while there is only one with tangent ξ 0- [START_REF] Volovich | [END_REF][28] [START_REF] Dwivedi | [END_REF] as illustrated in figure 1.

-6 -4 -2 0.1 0.2 0.3 R u R = 2 m EH l 2 l ¥ l ¥ l ¥ l ¥ l ¥ R =2 m R u l ¥ l ¥ l ¥ l ¥ l2
Detail around R=0, u=0 In what follows, it will be useful to know the values of χ at ū = R = 0 as measured in this two directions ξ 0± . Using (7)

χ0± (Υ) = lim ū→0 -1 -2 m(ū) R = 1 2 (1 ∓ √ 1 + 16Υ) (9)
What implies

0 ≤ χ0+ (Υ) ≤ 1 2 ≤ χ0-(Υ) ≤ 1. (10)
In particular, if Υ = 0 then ξ 0+ = -∞, χ0+ = 0, ξ 0-= -2 and χ0-= 1.

The translation of these results into Penrose's diagrams is shown in figures 2 and 3, where a null singularity ū = R = 0 appears. In practice, only if we know the behaviour of m(ū) for all ū in the interval (-∞, 0) we will be able to distinguish between the two possibilities appearing in the figures.

For the sake of completeness, let us remark that if Υ < -1 16 the critical point in the differential equation for the radial ingoing null geodesics is an unstable focus.

The Penrose diagram corresponding to this case can be seen in figure 4. No other cases exist since Υ ≤ 0.

s SF s NS A3H E H C H f o r F u = 0

Candidates for matching hypersurface in Vaidya's spacetime

The behaviour of the stellar model will depend both on the chosen solution for the interior and on the hypersurface chosen as the matching hypersurface. In this way, a totally collapsing evaporating model must have a time-like matching hypersurface Σ ending at ū = R = 0. This exclusively corresponds with hypersurfaces of type σ NS and σ SF appearing in figure 2 . In the case σ NS a null singularity emerges beyond the total evaporation event, while this does not happen if the matching hypersurface were σ SF .

A spherically symmetric timelike hypersurface (ū(τ ), R(τ )) (where τ is a futuredirected time coordinate defined only on the hypersurface) is timelike and future directed if, and only if,

χ u + 2 Ṙ > 0 ( 1 1 )
and u > 0, where dots stand for derivatives with respect to τ .

The slope of such hypersurface when reaching ū = 0, R = 0, at let's say τ = 0, This type of hypersurfaces does not exist in the particular Vaidya's solutions shown in figures 3 and 4

in the {ū, R} plane can be computed as:

ζ ≡ lim τ →0 - ū(τ ) R(τ ) = lim τ →0 -u Ṙ . (12)
Likewise, the value of χ on the hypersurface as it approaches ū = 0, R = 0 will be χ0ζ

≡ lim τ →0 -1 -2 m(ū) R = 1 -2Υζ. ( 13
)
If we use ( 11), ( 12) and ( 13) we find that the slope of the timelike hypersurface

reaching ū = R = 0 must satisfy -∞ < ξ 0 + (Υ) ≤ ζ ≤ ξ 0 -(Υ) ≤ -2, (14)
where ξ 0± are defined in (7) and we have taken into account that, since the time-like hypersurface reaches R = ū = 0 which does not belong to the manifold, the limiting value could also be ξ 0± ¶. Let us remark that inequality ( 14) is expected from the structure shown for the ingoing radial null geodesics.

If we now use ( 7) and ( 13) we find the following bounds for χ0ζ :

0 ≤ χ0+ (Υ) ≤ χ0ζ (Υ, ζ) ≤ χ0-(Υ) ≤ 1. (15)
When dealing with a spherically symmetric timelike hypersurface ending at ū = R = 0 (see figure 2), a way of classifying it as type σ NS or type σ SF is to notice that only timelike hypersurfaces of type σ SF cross all the ingoing radial geodesics near the cauchy horizon for F (except for this same CH). Due to the node (or colnode) structure of the family of ingoing radial null geodesics, in the { R, ū} plane (see figure 1) this means that a curve of type σ NS must fulfill

ζ NS = ξ 0+ (Υ) (16) 0 ≤ χ0ζ NS (Υ, ζ NS ) = χ0+ (Υ) ≤ 1 2 . ( 17
)
We would like to remark that this is the behaviour of, for example, all radial timelike geodesic hypersurfaces ending at the singularity ū = R = 0 [START_REF] Dwivedi | [END_REF].

On the other hand, it is sufficient for a curve to be of the type σ SF to fulfill:

ξ 0 + (Υ) < ζ SF ≤ ξ 0 -(Υ), ( 18
) 0 ≤ χ0+ (Υ) < χ0ζ SF (Υ, ζ SF ) ≤ χ0-(Υ) ≤ 1. ( 19
)
¶ Note that, nevertheless, the hypersurface would be time-like in the manifold.

Another possibility for evaporation is possible if the matching hypersurface is of type σ e , as can be seen in figures 3 and 4. In this case the stellar surface would reach ū = 0, corresponding to m(ū = 0, R = 0) = 0, with a non-zero value of R ( R ≡ R0 ). This means that from ū = 0 on, the mass-energy contained in the sphere R = R0 vanishes [23]. Beyond this point Σ could be continued with an arbitrary timelike trajectory crossing the Minkowski region. Therefore no singularities can be formed there.

The interior solution

Let us consider a four-dimensional spherically symmetric space-time V, so that its line-element can be expressed in radiative coordinates [21] {x µ } = {u, R, θ, ϕ}

(µ = 0, 1, 2, 3) as ds 2 = -e 4β χdu 2 + 2εe 2β du dR + R 2 dΩ 2 , (20)
where χ ≡ 1-2m/R, ε 2 = 1, β and m depend on {u, R}, and

dΩ 2 ≡ dθ 2 + sin 2 θdϕ 2 .
It is easily checked that m(u, R) is the mass function [22,23,24], which represents the total energy inside the two-spheres with constant values of u and R.

We choose u growing to the future, then

l = d d = -ε ∂ ∂R (21)
is a future directed radial null vector tangent to the null geodesics u =constant and is a future directed parameter. If ε = -1 (or +1), then the expansion of these null geodesics is positive (negative, respectively) and, therefore, they are outgoing (ingoing, respectively) radial null geodesics. On the other hand,

k = d dκ = e -2β ∂ ∂u + ε χ 2 ∂ ∂R (22)
is a future directed radial null vector such that l • k = -1 and κ is a future directed parameter. If χ > 0 and ε = -1 (or +1), then this vector is tangent to a family of null geodesics with negative (positive, respectively) expansion and, therefore, these radial null geodesics are ingoing (outgoing, respectively). It is interesting to note that if, in a given 2-sphere, χ < 0 and ε = -1 (ε = +1) then the two radial null vectors have both positive (negative) expansion which means that the 2-sphere is a closed surface trapped to its past (future, respectively). We will call the spherically symmetric hypersurface defined by χ = 0 the Apparent 3-Horizon, A3H for short.

It is well known that spacetimes can be classified according to the properties of the energy momentum tensor [START_REF] Hawking | The large scale structure of space-time[END_REF]. A spherically symmetric spacetime is said to be type I if its energy-momentum tensor diagonalizes in an orthonormal basis E 0 (time-like), E 1 , E 2 ∝ ∂/∂θ and E 3 ∝ ∂/∂ϕ, being λ α the corresponding eigenvalues, as long as

α ≡ β, R χ 2 β, R +ε 2e -2β R m, u > 0 ( 2 3 )
is satisfied. The corresponding eigenvalues are

λ 0 ≡ -ρ d = -2 m, R R 2 + 2 R (χβ, R -α 1/2 ), (24)
λ 1 ≡ p d = -2 m, R R 2 + 2 R (χβ, R +α 1/2 ), (25)
λ 2 ≡ p T = 3 -χ R + 4χβ, R - 6 R m, R β, R +2χβ, RR - 1 R m, RR + + ε2e -2β β, uR . (26)
λ 3 = λ 2 . (27)
If α = 0 then λ 0 = λ 1 = -2m, R /R 2 and we have a double eigenvalue that corresponds to the null eigenvector l. Then the energy momentum tensor is said to be type II.

The dominant energy conditions (DECs) [START_REF] Hawking | The large scale structure of space-time[END_REF] require the energy density and the energy-flux measured by any timelike observer to be non-negative and nonspacelike, respectively. These conditions applied to our interior line element written in radiative coordinates can be written, in both (type I and II) cases, as

β, R ≥ 0, (28)
m, R -Rχβ, R ≥ 0, ( 29
)
χ 2 β, R +ε 2e -2β R m, u ≥ 0, ( 30
)
ρ d -p T ≥ 0, (31)
ρ d + p T ≥ 0. ( 32
)
Let us now consider a first application of the DEC that we will use later:

Proposition 3.1 In regions fulfilling the DECs and with χ > 0:

• The mass function must be a non-decreasing function along the outgoing radial null geodesics.

• The mass function must be a non-increasing function along the ingoing radial null geodesics.

To show this we can use ( 28), ( 29) and the condition χ > 0 to get

m, R ≥ 0 ( 3 3 )
and we can use ( 29), (30) and the condition χ > 0 to get

χ 2 m, R +εe -2β m, u ≥ 0. ( 34
)
On the other hand, the variation of the mass function along a u =constant null geodesic can be computed using (21) to get

dm d = -εm, R . (35)
And the variation of the mass function along the other family of radial null geodesics can be computed using (22) to get

dm dκ = ε( χ 2 m, R +εe -2β m, u ). ( 36
)
For outgoing radial null geodesics, if ε = -1 then l is tangent to these geodesics and we must combine (33) and (35) to show that the mass is non-decreasing along the outgoing geodesics. However, if ε = +1 then k is now the vector tangent to the outgoing geodesics and we must combine (34) and (36) to show that the mass is non-decreasing along the outgoing geodesics. (It is enough to follow a similar reasoning to show that along ingoing radial null geodesics the mass function will be non-increasing).

Inner local behaviour

Let us consider U ≡ {(u, R)| δu ≤ u ≤ 0, 0 ≤ R ≤ δR}, where the boundaries δu and δR must be fixed according to some natural conditions for evaporating models that will be stated from section 6 on. In order to build the Einstein Field Equations we need β and m to be C 2 in the points of U belonging to the manifold. In this paper we will assume that β and m are C 2 in U .

Without loss of generality, we will always consider β(u, R = 0) ≡ β 0 (u) = 0 (since, if it was not, we can always perform a coordinate change u → u such that the new coordinate u were defined by du = e 2β 0 (u) du).

According to the values of m(u, R) and β(u, R) and their partial derivatives computed at u = R = 0 we can classify U (with a fixed characterization of R = 0) as follows:

1) Regular interiors: If there are not curvatures singularities in U , i.e., if the curvature scalar invariants polynomial in the Riemann tensor (henceforth second order curvature invariants) remain finite at U . A full independent set of invariants was found in [30]. By using this set it is easy to show that, out of R = 0, we have a singularity-free region of the space-time if, and only if, β and m and their first and second partial derivatives are non-diverging functions there, but this is guaranteed by our assumption that both m and β are C 2 . On the other hand, one gets some conditions on R = 0 which lead to the following statement [START_REF] Torres | Construcción de modelos de estrellas y burbujas de vacío o radiativas, en el marco de la Relatividad General[END_REF][32]: All curvature invariants will be finite at U preventing the existence of curvature singularities if, and only if,

lim R→0 β(u, R) R 2 = β 2 (u) and lim R→0 m(u, R) R 3 = m 3 (u), (37)
where β 2 (u) and m 3 (u) are finite functions in U . This implies that

m(u, R = 0) = m, R (u, R = 0) = m, RR (u, R = 0) = 0 β(u, R = 0) = β, R (u, R = 0) = 0. ( 38
)
2) Interiors with a non-spacelike singularity at R = 0: It is easy to show that we have a non-spacelike singularity at R = 0 if, and only if, conditions (38) are not all fulfilled but

m(u, R = 0) = 0 and m, R (u, R = 0) ≤ 1/2. ( 39
)
3) Interiors with a spacelike singularity at R = 0: In this case

m(u, R = 0) > 0 or m(u, R = 0) = 0 and m, R (u, R = 0) > 1/2. ( 40
)
It should be noted (37) that in cases 2) and 3) the second order curvature invariants diverge.

A spherically symmetric timelike hypersurface {u(τ ), R(τ )} (where τ is a future-directed time coordinate defined only on the hypersurface) is timelike and future directed in the manifold if, and only if,

2ε Ṙ -e 2β χ u < 0 ( 4 1 )
and u > 0, where dots stand for derivatives with respect to τ . However, we need to remark that in case the hypersurface reaches a singularity at R = 0 then the inequalities in the timelike conditions above could be replaced by equalities in the limit as R tends to 0 while the hypersurface would be timelike in the manifold.

Whenever a mass function satisfies m(u = 0, R = 0) = 0 and there is a spherically symmetric hypersurface reaching u = R = 0, in general the value of χ computed along this hypersurface in the limit when it reaches u = R = 0 will depend on the specific hypersurface. However, there will be certain important situations in which the value of χ in this limit is fixed. Consider the following (

) 42
In order to show this, consider in U a first order power-series development in R of the mass function taking into account that m(δu ≤ u ≤ 0, R = 0) = 0:

m(u, R) = m, R (u, R = 0) R + 1 2 m, RR (u, R = ρ) R 2 , (43)
where the last term is the remainder and, according to Taylor's theorem, 0 ≤ ρ ≤ R.

Likewise, m, R (u, R = 0) can be developed in u taking into account that m, R (0, 0) = 0 to obtain the following zeroth order power-series development

m, R (u, R = 0) = m, uR (u = ν, R = 0) u, (44)
where only the remainder appears and, according to Taylor's theorem, u ≤ ν ≤ 0.

Finally, with (43) and (44) and using u(τ = 0) = 0 and R(τ = 0) = 0 we get

lim τ →0 -χ = 1 -2 lim τ →0 - m R = = 1 -2 lim τ →0 -m, uR (u = ν, R = 0) u + 1 2 m, RR (u, R = ρ)R = 1.

The complete matched models

Now, in order to get the complete evaporating models, we need to match a part of the interior spacetime containing R = 0 with the exterior radiating Vaidya's solution through a spherically symmetric timelike matching hypersurface identified with the evolving star's surface. In fact, we are interested in the local behaviour around the evaporating event. Therefore, we restrict the analysis of our matching to U in the interior manifold and to Ū in the Vaidya spacetime, where similarly to U , we define Ū ≡ {(ū, R)| δū ≤ ū ≤ 0, 0 ≤ R ≤ δ R} and the boundaries must be fixed according to the conditions that we will discuss from section 6 on.

The matching of two spherically symmetric space-times through a time-like matching hypersurface Σ can be found in [7] and references therein. First we need to identify an embedding of Σ in both the Vaidya and the general interior space-times.

To that end let us consider a general timelike hypersurface σ preserving the spherical symmetry of the exterior spacetime and with intrinsic coordinates {ξ a } = {λ, ϑ, ϕ},

where λ is a future-directed time coordinate defined only on the hypersurface. The general parametric equations of σ are: ū = ū(λ), R = R(λ), θ = ϑ, φ = ϕ. Similarly, let us take a general spherically symmetric timelike hypersurface σ in the interior spacetime. This hypersurface is assumed to be diffeomorphic to σ, and thus the intrinsic coordinates are chosen to be the same {ξ a } = {λ, ϑ, ϕ}. The general parametric equations for σ are:

u = u(λ), R = R(λ), θ = ϑ, φ = ϕ.
Finally, the Darmois gravitational junction conditions (see [7] and references therein for details) applied to the case ε = -1 provide us with the following matching conditions

R Σ = R, (45) m
Σ = m, (46) u
Σ = e 2β u, (47) 0
Σ = χβ, R - m, R 2R e 2β u + β, R Ṙ. ( 48
)
On the other hand, if ε = +1 the matching conditions are

R Σ = R, (49)
m Σ = m, (50)
χ u Σ = χe 2β u -2 Ṙ, (51) 0
Σ = χ χβ, R - m, R 2R + m, u e -2β R e 2β u + m, R R -χβ, R Ṙ. ( 52
)
We choose ū(λ = 0) = u(λ = 0) = 0, so that λ = 0 is identified with the total evaporation event.

Regarding the existence of two sets of matching conditions, it is interesting to notice that the choice ε = -1 implies that an outgoing radial null geodesic defined by u = constant when crossing Σ is simply continued with an outgoing radial null geodesic in the Vaidya metric defined by ū = constant. Contrarily, if we choose ε = +1 a radial ingoing null geodesic defined by u = constant is continued through Σ with a radial ingoing null geodesic in the Vaidya metric which is not defined by ū = constant. This has as a consequence that the analysis of the ε = +1 case is generally more complicated.

Evaporating models that do not completely collapse

We first study the evaporating models that lose all their mass without completely collapsing. The exterior for these models was studied in subsection 2.1. There we saw that the matching hypersurface must be of type σ e (see, for example, figure 4).

In these models, the following proposition applies: with the lightlike hypersurface introduced in the proposition.

In order to show proposition 5.1, we must consider the outgoing radial null geodesic reaching the matching hypersurface at (u = 0, R = R0 ), where the mass function becomes null. According to proposition 3.1, the mass function must be null along the outgoing radial null geodesic from R = 0 until reaching (u = 0, R = R0 ).

Moreover, as m(ū = 0) = 0, the mass function will be null along ū = 0 in the exterior region and, thus, it will be null along all the geodesic. We can always match the model across this null geodesic with a portion of Minkowski's solution. (See [33] for details). In this way we get a model of a completely evaporating star that vanishes without generating any singularity.

Evaporating collapsing models: The case Σ of type Σ SF

In this section we will analyze the matching in the cases in which the matching hypersurface reaches R = u = 0 = R = ū with m(ū ≥ 0) = 0, in such a way that no exterior singularities appear. I.e., the cases in which Σ will be identified with a hypersurface of type σ SF in Vaidya's spacetime and, as stated in subsection 2.1, (18) and ( 19) hold. Henceforth, a matching hypersurface of this type will be denoted by Σ SF . We will list the sufficient conditions for a general interior to produce this kind of evaporating collapse: "The evaporating collapsing conditions". The analysis of every particular interior and the necessary and sufficient conditions for every case will be treated in the next section.

The evaporating collapsing conditions on the exterior

• 1. There must be a C 1 solution R(λ) to the matching conditions in Ū satisfying

R(λ = 0) = 0, (53) R(λ < 0) > 0. ( 54
)
• 2. We demand the mass of the object to be non-negative according to an observer in the exterior:

m(ū < 0) > 0 and m(ū = 0) = 0. ( 55
)
• 3. The matching hypersurface must be timelike in the manifold:

Ṙ u + χ 2 Σ SF > 0 ( 5 6 )
in Ū -{ū = R = 0}.

• 4. As stated in subsection 2.1, the matching with Σ of type Σ SF imposes a bound on Υ:

- 1 16 ≤ Υ ≤ 0. ( 57
)
It is appropriate to remark now that we will also require a condition on the interior : In the case of existence of a previous spacelike singularity in the interior spacetime the presence of a region in which the 2-spheres are closed surfaces trapped to their past (ε = -1) has been excluded. In this way, we avoid, for example, the presence of a white hole in a stellar interior. Thus we only treat the case ε = +1 in this situation.

Consequences of the conditions

• From 1 : Ṙ/ u must exist in U and Ṙ u ≤ 0. (58)

• From 2 : Conditions (55) imply that ṁ u ≤ 0 ( 5 9 ) in Ū . Therefore, under these circumstances, WEC's hold in Ū .

Taking into account ( 46) or (50), we obtain m(u < 0, R > 0)

Σ SF > 0 and m(u = 0, R = 0) = 0. ( 60
)
In interiors in which m(u, R = 0) = 0 condition (60) implies m, R (u, R) > 0 in

U + .
• From 3 : If we define

η ≡ lim λ→0 -Ṙ u ( 61
)
and

χ 0η = lim λ→0 -1 - 2m R , ( 62
)
then the timelike condition in the interior lead us to lim

λ→0 - -ε Ṙ u + χe 2β 2 = -εη + χ 0η 2 ≥ 0. ( 63
)
By the way, note that the matching conditions imply that χ 0η = χ 0ζ . So that, from ( 19), we will have 0 < χ 0η ≤ 1 if the matching hypersurface is of type Σ SF .

Constructing specific evaporating models with Σ of type Σ SF

In this section, first we will deal with some general considerations to see how the collapsing conditions together with the matching conditions restrict the different possible interiors. Then, we will analyze the consequences for every different type of interior.

In what follows it will be useful to define

K ± 0 ≡ lim λ→0 -u u, ( 64
)
where the ± refers to the two possibilities ε = ±1.

We can write η and K ± 0 as functions of the exterior quantities ζ and Υ if we use (47) or (51) (when = -1 or +1, respectively) and ( 13) as follows + Notice that the first two items help to delimit U and Ū.

• If = -1 then η = ζ -1
(65)

K - 0 = 1 • If = +1 then η = 1 -2Υζ 2 + ζ -2Υζ 2
(66)

K + 0 = 2 + ζ -2Υζ 2 ζ -2Υζ 2
It will be useful to note that K ± 0 are finite. This is obvious for K - 0 and can be shown for K + 0 using ( 5) and ( 18) since one gets 0 ≤ K + 0 ≤ 1. In order to compute Υ partially in terms of interior magnitudes we have

Υ ≡ lim ū→0 - d m dū = lim λ→0 -ṁ u = lim λ→0 -ṁ u u u = = K ± 0 (m, u (0, 0) + m, R (0, 0)η).
(67)

General considerations

Let us now explore the consequences on the interior of including the evolution equations (48) or (52).

In what follows it will be useful to define:

A 0 ≡ lim λ→0 - m, R Rβ, R . ( 68
)
Note that, in general, A 0 will depend on the particular matching hypersurface Σ SF .

Case ε = -1

In this case χ 0η and η are finite, according to ( 18), ( 19) and (65). Then A 0 is also finite since from (48) we have

η ≡ lim λ→0 -Ṙ u = lim λ→0 - m, R 2Rβ, R -χ = 1 2 A 0 -χ 0η . ( 69
)
It is important to remark here that equation (69) can be in fact a non linear algebraic equation for the variable η.

Provided that η < 0, equation ( 69) can be integrated in U in order to obtain

R SF ∼ ηu. ( 70
)
The timelike character of Σ SF (63) together with (69) implies

A 0 -χ 0η ≥ 0. ( 71
)
If (71) holds then Σ SF will be timelike in U -{u = R = 0}.

Finally, conditions (71) and η < 0 (from ( 18) and ( 65)) lead to

χ 0η ≤ A 0 < 2χ 0η (72) 7.1.2. Case ε = +1
.

In this case, from (52):

η ≡ lim λ→0 -Ṙ u = lim λ→0 - χ (2Rχβ, R -m, R ) + 2m, u 2(Rχβ, R -m, R ) . ( 73
)
The timelike character of the matching hypersurface is trivially satisfied if η < 0 and

χ 0η > 0 in U since they imply lim λ→0 -(-Ṙ/ u + χe 2β /2) > 0. Condition η < 0 is equivalent to lim λ→0 - χ (2Rχβ, R -m, R ) + 2m, u 2(Rχβ, R -m, R ) < 0 ( 7 4 )
If η is finite and negative then the integration of (73) in U provides

R SF ∼ ηu. (75)

Models with a regular interior

In this subsection we would like to study the local behaviour of models with a regular interior that evaporate without creating an exterior singularity. A typical Penrose's diagram corresponding to a completely evaporating star of this type is illustrated in figure 6.

In this case, if we use (37), (38) and the finiteness of K ± 0 on (67) then we get

Υ = 0. ( 76
)
Since proposition 3.2 applies to a regular interior (38) In this case the star's surface reaches R = 0 and, simultaneously, the total mass vanishes completely.

χ 0η = 1. (77)

Case ε = -1

Proposition 7.1 All conditions for an evaporating collapsing model with a regular interior will be fulfilled if, and only if, the interior satisfies m(u < 0, R)

Σ SF > 0 in U -{u = 0, R = 0} and 1 ≤ lim λ→0 - m, R Rβ, R < 2. ( 78
)
This is easy to show by mere inspection of the conditions and taking into account that the last inequality comes from (72) for the particular case of a regular interior.

An example involving the lowest order derivatives of m and β that can be nonnull at u = R = 0 in the case of a regular interior (that is, we assume m, RRR (0, 0) = 0 and β, RR (0, 0) = 0) is

η ≡ lim λ→0 - dR du = m, RRR (0, 0) 4β, RR (0, 0) -1. (79)
In U we can choose the integration constant in order to satisfy (53) and (54) so that the evolution equation can be written as

R SF (u) ∼ m, RRR (0, 0) 4β, RR (0, 0) -1 u. (80)
We have in this case

m Σ ∼ 1 6 u3 0 m, RRR (0, 0)η 3 λ 3 > 0 ( 8 1 )
β Σ ∼ 1 2 u2 0 β, RR (0, 0)η 2 λ 2 , (82)
in U , where u0 ≡ u(λ = 0) is an arbitrary positive constant. Positivity of the mass function on Σ SF implies m RRR (0, 0) > 0 and therefore, condition (78) becomes 0 < 2β, RR (0, 0) ≤ m, RRR (0, 0) < 4β, RR (0, 0). ( 83)

7.2.2. Case ε = +1
Proposition 7.2 All conditions for an evaporating collapsing model with a regular interior will be fulfilled if, and only if, the interior satisfies m(u < 0, R)

Σ SF > 0 in U -{u = 0, R = 0} and lim λ→0 - (2Rβ, R -m, R ) + 2m, u 2(Rβ, R -m, R ) < 0 ( 8 4 )
The last inequality comes from (74) applied to the regular interior case.

The first example involving the lowest non-null derivatives of m and β is

η ≡ lim λ→0 - dR du = m, RRR (0, 0) -4β, RR (0, 0) 2(m, RRR (0, 0) -2β, RR (0, 0)) . (85)
The functions m(λ) and β(λ) are expressed in U as in (81) and (82), respectively.

Positivity of the mass function on Σ SF implies m, RRR (0, 0) > 0 and therefore, condition (84) becomes 0 < 2β, RR (0, 0) ≤ m, RRR (0, 0) < 4β, RR (0, 0). (86)

Models with a non-spacelike interior singularity

We will now consider interiors with m(u, 0) = 0 and m, R (u, 0) ≤ 1/2, but not satisfying all the conditions for a regular interior (38), what implies the existence of a non-spacelike singularity at u = R = 0. The interior of these models must satisfy m, R (0, 0) = 0. (87) u = 0 To show this in the case ε = -1 it is enough to consider the finiteness of A 0 and its definition (68). In the case ε = +1 we must take into account that these models have m, u (0, 0) = 0 and the negativeness of η in (73) to show it.

On the other hand, (87) implies that Υ = 0 and χ 0η = 1 (see previous subsection). Since the existence of a null singularity at R = 0 requires m, R (u, 0) = 1/2, it is clear that an interior spacetime with a null singularity at R = 0 cannot be matched with a Vaidya metric across a timelike hypersurface.

The Penrose diagram around the evaporation event for this case is illustrated in figure 7.

Case ε = -1

Similarly to the regular interior case we have Proposition 7.3 All conditions for an evaporating collapsing model with a nonspacelike interior singularity will be fulfilled if, and only if, the interior satisfies m(u < 0, R)

Σ SF > 0 in U -{u = 0, R = 0} and 1 ≤ lim λ→0 - m, R Rβ, R < 2. ( 88
)
An example with the possible lowest order derivatives that could be non null at u = R = 0 would be

η ≡ lim λ→0 - dR du = m, uR (0, 0) + m, RR (0, 0)η 2β, R (0, 0)η -1. ( 89
)
Now, η is a negative solution of the previous quadratic algebraic equation.

We have in this case

m Σ ∼ 1 2 u2 0 (2m, uR (0, 0) + m, RR (0, 0)η)ηλ 2 (90) β Σ ∼ u0 β, R (0, 0)ηλ, (91)
in U . Positivity of mass function on Σ SF implies 2m, uR (0, 0) + m, RR (0, 0)η < 0.

Finally, condition (88) becomes 1 ≤ m, uR (0, 0) + m, RR (0, 0)η β, R (0, 0)η < 2.

(92)

7.3.2. Case ε = +1
Proposition 7. 4 All conditions for an evaporating collapsing model with a nonspacelike interior singularity will be fulfilled if, and only if, the interior satisfies m(u < 0, R)

Σ SF > 0 in U -{u = 0, R = 0} and lim λ→0 - (2Rβ, R -m, R ) + 2m, u 2(Rβ, R -m, R ) < 0 ( 9 3 )
The last inequality comes from (74) applied to the case with a non-spacelike interior singularity.

The corresponding example involving the lowest order derivatives that could be non null in this case implies

η ≡ lim λ→0 - dR du = (m, RR (0, 0) -2m, uR (0, 0) -2β, R (0, 0))η + m, uR (0, 0) 2 [(m, RR (0, 0) -β, R (0, 0))η + m, uR (0, 0)] . (94)
Therefore, η is a negative solution of this quadratic algebraic equation.

The functions m(λ) and β(λ) are expressed in U as in ( 90) and (91), respectively.

Positivity of mass function on Σ SF implies 2m uR (0, 0) + m RR (0, 0)η < 0.

Finally, condition (93) is directly (m, RR (0, 0) -2m, uR (0, 0) -2β, R (0, 0))η + m, uR (0, 0) 2 [(m, RR (0, 0) -β, R (0, 0))η + m, uR (0, 0)] < 0. (95)

Interiors with spacelike singularities

We would like to analyze those models describing the evaporation of a star in which a spacelike singularity (m(u < 0, R = 0) > 0 or m(u < 0, R = 0) = 0 but m, R (u < 0, R = 0) > 1/2) and a black hole interior region are already present.

These models must obey the minimum set of conditions (subsec. 6.1).

Furthermore, as we discussed then, around the space-like singularity χ < 0 and, thus, the existence of a black hole region demands ε = +1. Another less usable condition is that in order to have a total evaporation (m(u = 0, R = 0) Σ = m(ū = 0) = 0) the star's surface can not cross the event horizon. A typical Penrose's diagram of the complete matched spacetime for this situation is shown in figure 8.

Note that there are radial outgoing null geodesics ending at the R = 0 singularity so that their expansion is initially positive and becomes negative once they cross the A3H (section 3). The EH is one of these null geodesics. Likewise, the degree of differentiability of the space-time guarantees that there are radial outgoing null geodesics close enough to the EH (and to its right -see figure 8-)

with an initial positive expansion that becomes later negative. These null geodesics do not end at the singularity, but continue their travel to the future null infinity and must, therefore, turn their expansion to positive again, after crossing the A3H somewhere in the stellar interior. This, according to [START_REF] Hawking | The large scale structure of space-time[END_REF] (proposition 9.2.8), can only happen if they traverse regions where the weak energy conditions are violated.

Let us remark that despite figure 8 illustrates a particular case of evaporating black hole, the behaviour of the EH and the A3H around the total evaporation event is totally generic. Thus, all these evaporating black holes must violate the WECs.

In this case, the conditions explained in subsec. 6.1 for ε = +1 lead us to a rather complex set of inequalities that must be fulfilled. Therefore, in order to show the existence of solutions modelling evaporating black holes, we will just work out a particular example. Let us consider m(u, R) m 40 u 4 + m 03 R 3 and β(u, R) β 02 R 2 in U , where m 40 , m 03 and β 02 are constants. Using the procedure described above taking into account that ε = +1 we find until reaching the A3H. After crossing it, the expansion becomes negative and the geodesic continues its travel to the future null infinity crossing again the A3H and turning its expansion to positive again. Therefore [START_REF] Hawking | The large scale structure of space-time[END_REF], it must traverse regions where the weak energy conditions are violated.

η -1 = 2(3m 03 -2β 02 ) 3m 03 -4β 02 . ( 96
) A3H u = 0 E H V W E C
If we now take into account the non-negativity of the exterior mass function and the negativity of η (what also guarantees a timelike Σ) we get the following set of conditions for the correct behaviour of Σ:

0 < 2β 02 ≤ 3m 03 < 4β 02 (97)
On the other hand,

d m(ū) dū -3m 03 1 - 3m 03 4β 02 R 2 (98)
In this way, Υ = 0.

Generation of exterior light-like singularities

If a star collapses and an exterior light-like singularity at R = ū = 0 appears then the time-like matching hypersurface must be of type σ NS and, thus, ( 16) and ( 17) must be fulfilled. From (16) we know that for this case ζ = ξ 0+ so we can easily find ζ using (7). We have to consider two different cases according to the two different values for .

• Case = -1. The value of η can be obtained from (65):

η = ( √ 1 + 16Υ -1)/4 = - χ 0η 2 . (99)
Equation ( 69) together with (99) implies A 0 = χ 0η .

• Case = +1. The value of η can be obtained from (66):

η = -∞. (100)
This, together with the differentiability of the metric, the limits on χ 0η (17) and (73) implies A 0 = χ 0η .

Therefore, in both cases, A 0 must be a finite quantity satisfying 0 ≤ A 0 ≤ 1/2 according to (17). Since lim λ→0 -R = 0, then the definition of A 0 (68) implies that m, R (0, 0) = 0 (101)

We now consider the possibility that m(u, R = 0) = 0 on a neighbourhood of u = R = 0, then (101) would imply χ 0η = lim λ→0 -χ = 1 (according to proposition 3.2), what contradicts the necessary requirement (17) for the matching with a Σ NS hypersurface. The only possibility left for a total evaporation is that near the evaporation event m(u < 0, R = 0) > 0 and m(u = 0, R = 0) = 0. Let us consider the two possibilities for :

• If = -1 and m(u < 0, R = 0) > 0 then there is an inner space-like singularity and the 2-spheres near to it will be closed surfaces trapped to their past (i.e., there is a white hole-like region), what we think can be discarded for a stellar interior. However this possibility has been already treated for the particular (non-stellar) case in which the interior is Vaidya's spacetime, as can be seen in figure 3, if we take for the matching hypersurface σ NS .

• If = +1 and m(u < 0, R = 0) > 0 the model must have a previous inner space-like singularity, but now the 2-spheres near to it will be closed surfaces trapped to their future (i.e., there would be a black hole-like region). On the other hand, χ 0η can be easily written as

χ 0η = 1 -2 lim λ→0 -m, R +m, u u Ṙ . ( 102
)
Taking into account the differentiability of the mass function, (100) and ( 101)

it is clear that χ 0η = 1, what contradicts (17).

The considerations above can be summarized in the following Proposition 8.1 A collapsing star endowed with an interior C 2 mass function cannot develop an exterior light-like singularity at the total evaporation event.

Discussion and conclusions

Due to the great number of situations in which the evaporating models have been used in the current literature, our aim in this article was to study the evaporating models as a whole and to analyze their common properties, behaviours and possibilities. Our work was centered on the evaporating event itself. However, we have to remark that this semiclassical study is not completely general. This is due to the fact of demanding an interior C 2 metric in U . This, for example, prevents us to include in our study singular evaporating models in which the mass function is not even well-defined at u = R = 0 (see, for instance, [1] * ). Taking this into account, let us now list our main results.

First, we have treated stellar models that evaporate without reaching a complete collapse, i.e., models in which the star simply gets rid of all its mass in a more or less violent process. Proposition 5.1 tell us that whenever the dominant energy conditions are fulfilled and in absence of closed trapped 2-spheres there must be an outgoing spherically symmetric lightlike hypersurface crossing the matched spacetime such that the mass function is null on it and to its future. * Nevertheless, some of our results apply. For example, in the aforementioned model χ 0η = 1 and, therefore, according to (17) it can not develop an exterior singularity. As stated in the introduction the evaporating models have been often used in the current literature as a means of avoiding the generation of singularities during the collapse (from [7] to [12]), sometimes under the name of incipient BHs or non-singular evaporating BHs (from [13] to [18]). In this respect, we have shown (propositions 7.1 or 7.2) that a collapsing stellar model with a regular interior will evaporate if, and only if, the mass function on the matching hypersurface is nonnegative and condition (78) (or 84) is satisfied for the ε = -1 (or the ε = +1, respectively) case. Furthermore, provided that the conditions are fulfilled, we have shown that the star cannot generate an exterior lightlike singularity (proposition 8.1) such as the one illustrated in figure 9. This is remarkable because, even if such situation is not possible in non-radiative models (Schwarzschild's exterior), it seemed feasible with an exterior radiating Vaidya's solution. In this way, the complete matched model must be singularity free. Figure 6 illustrates this situation.

We have extended our study to stellar models in which an inner non-spacelike We have shown that this possibility is not feasible under our assumptions since an exterior lightlike singularity can not appear.

singularity (and, therefore, naked) has already formed during the collapse. In this case, we have shown (propositions 7.3 or 7.4) that a collapsing stellar model with an inner non-spacelike singularity will evaporate if, and only if, the mass function on the matching hypersurface is non-negative and condition (88) (or 93) is satisfied for the ε = -1 (or the ε = +1, respectively) case. Furthermore, provided that the conditions are fulfilled, we have shown that the star cannot generate an exterior lightlike singularity (proposition 8.1) such as the one illustrated in figure 10. In this way, the evaporation process seems to evaporate the inner singularity in case of not being spacelike. In other words, the evaporation process eliminates any preexisting naked singularity. Figure 7 illustrates this situation around the evaporation event.

Finally, we have treated the case in which an inner spacelike singularity preexists. The models presented here can be considered a special type of evaporating black hole since the object achieves the total collapse with null total mass. These models violate the weak energy conditions and they all posses an instantaneous naked singularity that does not extend to the exterior of the collapsing object (figure 11). We have illustrated this type of evaporating black holes in figure 8. shown that this possibility is not feasible under our assumptions since an exterior lightlike singularity can not appear.

Figure 1 .

 1 Figure 1. In this graphic we show the behaviour of the ingoing radial null geodesics when Υ = 0. Notice the existence of a null geodesic ending at the critical point with tangent equal to -2 (labelled as l 2 ) and of null geodesics arriving with minus infinite tangent (labelled as l ∞ ).

Figure 2 .

 2 Figure 2. The Penrose diagram for Vaidya's spacetime when m(ū) vanishes from some instant ū = 0 on and -1/16 ≤ Υ ≤ 0. Note that in this diagram some ingoing radial null geodesics come from the past null infinity J -and reach the light-like singularity ( R = 0, ū = 0). A generic space-like hypersurface F has the past Cauchy Horizon in the null hypersurface marked as "CH for F ".

Figure 3 .

 3 Figure 3. Alternative Penrose's diagram for Vaidya's spacetime when m(ū)vanishes from some instant ū = 0 on and -1/16 ≤ Υ ≤ 0. Note that in this diagram no ingoing radial null geodesic comes from the past null infinity J -and reaches the light-like singularity. A generic space-like hypersurface F has the past Cauchy Horizon in the null hypersurface marked as "CH for F ".

Figure 4 .

 4 Figure 4. The Penrose diagram for Vaidya's solution when m(ū) vanishes from some instant ū = 0 on and Υ < -1/16.

Proposition 3 . 2

 32 If a mass function m is C 2 in U and satisfies m(δu ≤ u ≤ 0, R = 0) = 0 (δu = 0) and m, R (0, 0) = 0, then the limiting value of χ along an arbitrary spherically symmetric hypersurface {u(τ ), R(τ )} reaching u = R = 0 at τ = 0 satisfies lim τ →0 -χ = 1.

Proposition 5 . 1 Figure 5 .

 515 Figure 5. An evaporating model that loses all its mass without completely collapsing.

u = 0 Figure 6 .

 06 Figure 6. Penrose's diagram corresponding to a completely evaporating star.

Figure 7 .

 7 Figure 7. A stellar model with a preexisting timelike curvature singularity completely evaporates. Therefore, a locally naked singularity is already present before the evaporation event. The figure only shows the behaviour around the total evaporation.

Figure 8 .

 8 Figure 8. Typical Penrose's diagram for an evaporating star with an inner black hole region. Note that the outgoing null radial geodesic labelled ū = 0 emerges from the singularity and reaches the future null infinity. Therefore, there is an instantaneous globally naked singularity in this situation. The radial outgoing null geodesic outside the BH labelled as V W EC has a positive expansion from R = 0

u = 0 Figure 9 .

 09 Figure 9. Hypothetical Penrose's diagram corresponding to a completely evaporating star with a regular interior. We have shown that this possibility is not feasible under our assumptions since an exterior lightlike singularity can not appear.

Figure 10 .

 10 Figure 10. Hypothetical Penrose's diagram around the evaporation event corresponding to a completely evaporating star with a interior timelike singularity.

Figure 11 .

 11 Figure 11. Hypothetical Penrose's diagram for an evaporating star that collapses creating an inner black hole region and an exterior light-like singularity. We have

Acknowledgements

FF would like to acknowledge the Ministerio de Educación y Ciencia (FIS2007-63034) and the Generalitat de Catalunya (grant 2005SGR 00515) for financial support.


Sidi Ould Biha
email: sidi.ouldbiha@inria.fr

A formal semantics of PLC programs in Coq

Programmable logic Controllers (PLC) are embedded systems that are widely used in industry. We propose a formal semantics of the Instruction List (IL) language, one of the five programing languages defined in the IEC 61131-3 standard for PLC programing. This semantics support a significant subset of the IL language that includes on-delay timers. We formalized this semantics in the proof assistant Coq and used it to prove some safety properties on an example of PLC program.

I. Introduction

Programmable Logical Controllers (PLC) are micro-processor based control systems. They are used in a wide range of industrial applications, from automotive industry and chemical plants to home appliances. PLC applications are critical in a safety or economical cost sense. The recent events of the recall of a large amount of cars for some safety problems caused by a programming bug, are just a new example of a how the cost of such errors can easily get out of proportion. This is more relevant for PLC programs because they are generally used to perform repetitive actions. Thus the use of formal methods and specially theorem proving in the PLC programs development process, will increase the confidence in such programs.

Instruction list (IL) is one of the five programing languages defined in the IEC 61131-3 standard [START_REF] Commission | IEC 61131-3 : Programmable controllers -programming languages[END_REF]. With the graphical language ladder diagrams (LD), they are the most widely used languages for programing PLC. The definition of a formal semantics of IL is a prerequisite for the development of a generic tool for verifying PLC programs written in IL. Since most of PLC compilers use IL as an intermediate language in the compilation process to machine code, a formal semantics of IL is also necessary for the development of a certified compiler for PLC. This work is the first step towards the development of a certified compiler for PLC programs. It also provides a basis for the development of a static analyzer for PLC programs.

There are many examples of the use of formal methods for the verification of PLC programs [START_REF] Mader | Timed automaton models for simple programmable logic controllers[END_REF], [START_REF] Canet | Towards the automatic verification of plc programs written in instruction list[END_REF], [START_REF] Völker | Automated verification of function block-based industrial control systems[END_REF]. Most of these examples use model checking. In some of these works, an operational semantics of PLC programs is defined. We extend the operational semantics defined in [START_REF] Huuck | Semantics and analysis of instruction list programs[END_REF] to support a larger subset of IL instructions (timers...) and the cyclic behavior of PLC programs. We formalized this semantics in the proof assistant Coq [START_REF]The Coq System[END_REF] using its extension SSReflect [START_REF] Gonthier | A small scale reflection extension for the Coq system[END_REF].

In this paper, we give in the first section a brief presentation of PLC systems. In the second section we present a small step operational semantics of the IL language. The formalization of this semantics in the proof assistant Coq and an example are described in the third section. Related works and conclusions are presented in the two final sections.

II. Programmable Logic Controller

A PLC is composed of a microprocessor, a memory, input and output devices where signals can be received from sensors or switches and sent to actuators. A main characteristic of PLC is there execution mode. A PLC program is executed in a permanent loop. In each iteration of the execution loop, or scan cycle, the inputs are read, the program instructions are executed and the outputs are updated. Figure 1 shows the sequencing of the 3 phases of the scan cycle. The cycle time is often fixed or has an upper bound limit. It depends on the manufacturer and type of the PLC.

Inputs scan instructions execution

Outputs scan • Ladder Diagrams (LD) : graphical language that represent PLC programs as relay logic diagrams. • Functional Block Diagrams (FBD) : graphical language that represent PLC programs as connection of different function blocks. • Instruction List (IL) : an assembly like language.

• Structured Text (ST) : a textual (PASCAL like) programing language. The standard defines also a meta language called Sequential Function Charts (SFC). It corresponds to a graphical method for structuring programs and allows to describe the system as a state transition diagram. Each state is associated to some actions. An action is described using one of the PLC programing languages like LD or IL. SFC are well suited to write concurrent control programs. We present later in more details the IL language, the main focus of this work.

B. Timers

In the context of PLC applications, there is often the need to control time. For example, a motor might need to be activated or switched off for a particular time interval. Another example, in a chemical plant a valve is open and a tank will be full after a period of time. PLC timers are components that set on a boolean output after or for a period of time following the activation of a boolean input. They are used to control output signal duration or as input signal for time dependents PLC programs. In general, they have two inputs and two outputs. There is three basic types of timers that can be found with PLC. The IEC 61131-3 standard defines the :

• on-delay timers (TON) : they come on after a time delay following the activation of the input (Figure 3(a)).

III. Instruction List language

A. General structure

The IEC 61131-3 standard defines an Instruction List program as a list of variables (input, output and local) declarations followed by a list of instructions. An instruction contains an operator followed by a list of operands. Most of IL instructions take one operand, but some like timers instructions need more than one operand. A label followed by a colon (:) can be inserted before an instruction. An example of IL program is the following:

LABEL OPERATOR OPERAND l1: LD x ADD 3 JMP l1
The meaning of some IL operators can be changed using modifiers. In particular, the standard defines the two modifiers: C and N. The C modifier indicates that the corresponding instruction should be executed only if the current evaluated result is the boolean value true. It can be used with branching instruction or functions call. The N modifier indicates that the operand of the corresponding instruction should be negated. If it is combined with the C modifier, it means that the corresponding instruction should be executed only if the current evaluated result is the boolean value false. It can be used with branching instruction, functions call or booleans operators. For example, the instruction JMPCN l1 will be executed only if the current evaluation is false.

B. Model choices

The IEC 61131-3 standard was published after many PLC manufacturers have defined and implemented their own programming languages. It does not give a clear description of the semantics of PLC languages. It does not also specify how PLC timers should behave. We saw previously that a PLC timer have two outputs : the boolean output and the elapsed time since the timer activation output. How this output are updated is not described by the standard. In practice, PLC manufacturers defines two types of timers according to the way their outputs are updated. In the first category, outputs can be updated only if the timer instruction is executed. For this kind of timers, a time error is introduced depending on the timer delay variable and the program cycle duration. In the second category, timer outputs are automatically updated by a system routine. In this case a time error is introduced depending on the position of the timer instruction in the program. The execution of the timer instruction is only required to check the state of the outputs. Both timers are not ideal timers and the time error should be taken into account by the PLC programmer when defining the timers delay input.

Our IL model is a significant subset of the language defined by the IEC 61131-3 standard. This subset covers assignments instructions and boolean and integer operations. It covers also comparison and branching instructions and on-delay timers. We choose to consider only booleans and integers as basic data types. In most of PLC systems, reals are available as basic data types. But in practice, real numbers computation cost much time and they are often delegated to a PC that can communicate with the PLC. This is motivated by the need to keep the program scan cycle within a relatively small time upper bound. In this work we will consider only TON timers. The other two kinds of timers can be treated similarly. We will also suppose that the outputs of the timers are updated only when the timer instruction is executed. This is the case in most of the timers provided by PLC manufacturers. We will also suppose that in an IL program, a timer instruction is called only once with the same output variable. This is needed to keep the time error for the timer less than an cycle duration.

The IL subset we work with does not include function call or counters instructions. In our model, we also choose to work with simple IL operators. In particular, the IL language support binary operators that use a stack for the operation execution. The IL subset we deal with does not includes this operators. An extension of our semantics to support these operators and the function call should not be difficult.

C. Syntax

Each IL program start with variable declarations. We will denote the type of IL variables by Var. These declarations specify for each variable if it is an input (V ar in ) or/and output (V ar out ) or a local variable (V ar loc ). In addition to standard variables, IL have a specific register where every computation takes place. This special register will be denoted reg. For simplicity, we suppose that IL program labels are natural numbers. Since an IL program is a list of instruction, a label will indicate the position of the corresponding instruction in the list. For a given program P and an index i, P (i) ∈ Instr represent the instruction of P at the position i.

P ::= {
::= LD op load | ST id store | SR id | RS id set and reset | JMP lbl | JMPC lbl jumps | JMPCN lbl | ADD op | SUB op integers | MUL op | AND op | OR op booleans | ANDN op | ORN op | NOT op | EQ op | GE op comparison | GT op | TON id ,

D. Operational semantics

We defined a small step operational semantics of IL programs. This semantics extend the one defined in [START_REF] Huuck | Semantics and analysis of instruction list programs[END_REF] to support on-delay timers and the cyclic behavior of PLC programs.

Modes: as we mentioned in Section II, each IL program scan cycle contains 3 phases:

• I: input, • O: output, • E: instruction execution.
The set of these execution phases will be denoted modes.

Cycles: we suppose having a global discrete time clock. Each program execution cycle is represented by an identifier or its index in the time execution line. Every cycle is associated to its beginning time according to the global clock. The set of program execution cycles is denoted C ⊆ N. For a cycle c, the starting time is denoted t c and the duration of every cycle is fixed and correspond to a global system constant δ = t c+1 -t c .

States: a state is a function that associates to each variable of the program and the register a value. The set of state corresponds to:

S = {reg} ∪ V ar → D,
where D is the union of the IL variables data domains.

Configurations: elements of the set E = C ×S × N × mode. A configuration (c, σ, i, m) corresponds to a cycle identifier c, a state σ, a position index i and an execution mode m.

Transitions: relation on configurations ⊆ E×E. Figure 4 gives the inference rules of the IL configurations transitions relation. The transition system is defined by an initial configuration (0, σ 0 , 0, I), where σ 0 is the initial state that maps all the integer variables to 0 and boolean variables to f alse.

The first two transitions rules of Figure 4 correspond to the load and store instructions. In the first case the register is updated while in the second the variable state is updated. The transitions corresponding to the set/reset instructions (rules SR and RS) update the variable state function with the corresponding values for the given operands. In the inference rule JMP, transition for the unconditional branching instruction, there is no condition on the branching label value (position of the jumping target) compared to the current position of the program counter. This can lead to non terminating IL programs. In practice this should not be the case, since every IL program should terminate during the

LD P (i) = LD op σ ′ = σ[reg → op] P ⊢ (c, σ, i, E) → (c, σ ′ , i + 1, E) P (i) = ST x σ ′ = σ[x → reg] P ⊢ (c, σ, i, E) → (c, σ ′ , i + 1, E) ST SR P (i) = SR x σ ′ = σ[x → x ∨ reg] P ⊢ (c, σ, i, E) → (c, σ ′ , i + 1, E) P (i) = RS x σ ′ = σ[x → x ∧ ¬reg] P ⊢ (c, σ, i, E) → (c, σ ′ , i + 1, E) RS JMPC-true P (i) = JMPC lbl σ(reg) = T P ⊢ (c, σ, i, E) → (c, σ, lbl, E) P (i) = JMPC lbl σ(reg) = F P ⊢ (c, σ, i, E) → (c, σ, i + 1, E)
JMPC-false JMPCN-false

P (i) = JMPCN lbl σ(reg) = F P ⊢ (c, σ, i, E) → (c, σ, lbl, E) P (i) = JMPCN lbl σ(reg) = T P ⊢ (c, σ, i, E) → (c, σ, i + 1, E) JMPCN-true JMP P (i) = JMP lbl P ⊢ (c, σ, i, E) → (c, σ, lbl, E) P (i) = ADD op σ ′ = σ[reg → reg + op] P ⊢ (c, σ, i, E) → (c, σ ′ , i + 1, E) ADD SUB P (i) = SUB op σ ′ = σ[reg → reg -op] P ⊢ (c, σ, i, E) → (c, σ ′ , i + 1, E) P (i) = MUL op σ ′ = σ[reg → reg * op] P ⊢ (c, σ, i, E) → (c, σ ′ , i + 1, E)

MUL AND

P (i) = AND op σ ′ = σ[reg → reg ∧ op] P ⊢ (c, σ, i, E) → (c, σ ′ , i + 1, E) P (i) = OR op σ ′ = σ[reg → reg ∨ op] P ⊢ (c, σ, i, E) → (c, σ ′ , i + 1, E) OR ANDN P (i) = ANDN op σ ′ = σ[reg → reg ∧ ¬op] P ⊢ (c, σ, i, E) → (c, σ ′ , i + 1, E) P (i) = ORN op σ ′ = σ[reg → reg ∨ ¬op] P ⊢ (c, σ, i, E) → (c, σ ′ , i + 1, E) ORN NOT P (i) = NOT op σ ′ = σ[reg → ¬op] P ⊢ (c, σ, i, E) → (c, σ ′ , i + 1, E) P (i) = EQ op σ ′ = σ[reg → reg == op] P ⊢ (c, σ, i, E) → (c, σ ′ , i + 1, E) EQ GE P (i) = GE op σ ′ = σ[reg → reg ≤ op] P ⊢ (c, σ, i, E) → (c, σ ′ , i + 1, E) P (i) = GT op σ ′ = σ[reg → reg < op] P ⊢ (c, σ, i, E) → (c, σ ′ , i + 1, E) GT P (i) = TON T x, P t σ(reg) = F σ ′ = σ[T x.Q → F, T x.ET → 0] P ⊢ (c, σ, i, E) → (c, σ ′ , i + 1, E)

TON-off

P (i) = TON T x, P t σ(reg) = T T x.ET < P t σ ′ = σ[T x.Q → F, T x.ET → T x.ET + δ] P ⊢ (c, σ, i, E) → (c, σ ′ , i + 1, E)

TON-on

P (i) = TON T x, P t σ(reg) = T T x.ET >= P t σ ′ = σ[T x.Q → T, T x.ET → T x.ET + δ] (c, σ, i, E) → (c, σ ′ , i + 1, E)
TON-end

P (i) = RET P ⊢ (c, σ, i, E) → (c, σ, 0, O) RET -→ x : V ar in σ ′ = σ[x i → v i ] P ⊢ (c, σ, i, I) → (c, σ ′ , i, E) Input P ⊢ (c, σ, i, O) → (c + 1, σ, i, I)

Output

Figure 4. IL Operational semantics scan cycle time limit. We chose here not to consider this kind of errors. They can be treated at the level of the syntactic analysis or by static analysis of the program.

The transition relation for the TON instruction is given by the rules TON-off, TON-on and TONend of Figure 4. The elapsed time variable ET of the TON timer is incremented by the global constant δ when the timer is activated (the evaluation register value is true). The timer output Q is activated when the elapsed time variable ET is greater or equal to the timer delay parameter PT. For the input transition, the variables state function is updated by the input variables values given by the program global environment. The output transition corresponds to the cycle identifier incrementation and the change of the configuration mode. The program environment will have to read the variables state during this transition to get the values of the outputs of the system.

After this definition of the semantics of the IL language, we present in the next section our formalization of this semantics in the proof assistant Coq.

IV. Coq formalizations

As we mentioned before, we intend to develop a certified compiler from IL to the C language. We choose to formalize the IL semantics in the Coq proof assistant to make it easier to connect our development to the already existing certified compiler for C : the CompCert [START_REF] Leroy | A formally verified compiler back-end[END_REF] compiler. We also want to produce from this formal development a certified executable. The Coq extraction mechanisms will allow us to produce such executable.

In the reasoning about IL programs, we will have to deal with proprieties about booleans and naturals numbers. In this development, we chose to use the Coq extension SSReflect for its rich libraries on booleans and natural numbers. We also use SSReflect generic library for lists and its interface for types with decidable equality. More details about this libraries can be found in the SSReflect manual [START_REF] Gonthier | A small scale reflection extension for the Coq system[END_REF] and tutorial [START_REF] Gonthier | An introduction to small scale reflection in Coq[END_REF].

A. Syntax

The Coq system provides a very powerful mechanism to define recursive or finite type or set. This mechanism is called inductive type and is very useful when defining the syntax of a programming language. We define the IL syntax presented in Section III-C, using the Coq inductive type mechanism. The definitions are given in Figure 5. In these definitions, the types time and ident are a renaming of the Coq standard type nat. The first one corresponds to the type of variable identifiers. Since we consider discrete time, the type time is the type of time values. A piece of IL code corresponds to a list of instruction. We represent it as an element of the type code := seq Instr 1 . Variables (delta : time) (pi : seq ident). Variables (p_ival : nat → ident → nat) (P : code).

The variable delta represents the cycle duration time. The list of program input variables is represented by pi. In order to define the semantics transitions, we need to know the input variables in order to update them with the values given by the program environment at the beginning of each cycle. Those values are represented by the function p_ival that takes as parameters a cycle identifier and a variable identifier and returns a value.

When we look at the definition of the transition relation for the IL semantics given in Figure 4, we notice that it can be decomposed into two sub-operations. First, there is the states updating function. It returns a new state according to the evaluated program instruction. Second, there is the program location successor. Normally it returns the incremented value of the current location, unless the instruction is a branching. The configuration transition function can be defined on top of the suboperations just by checking the execution mode.

States: For the definition of the variable states and since booleans can be injected in integers 2 , we choose to represent the natural numbers as the data domain of the IL variables. We define a state as an object of the type State. The function eval_instr takes two arguments, a state and an instruction, and returns a new state. For example, the evaluation of a load instruction will return an updated state where the current register is equal to the value of the instruction operands. Another example is given by the set instruction SR x. For this case, the variable x is updated with the disjunction of its previous value and the value of the current register. For the operators that are defined only for booleans values (like: SR, AND ...), we use the function BofN that return the original boolean value of a boolean variable that was translated to a natural numbers. In the definition of Figure 6 and the following definitions, we use an SSReflect notation for a natural number successor. When we write x.+1 this correspond to the successor of x or x + 1.

Configurations transition: the IL configurations, presented in Section III-D, are encoded as a Coq product type. Since our IL semantics is deterministic, we define the configurations transition relation as a function. The Coq definition is given in Figure 7. The transition function proceeds by looking at the mode of the configuration passed as argument. If it is an input mode, the variables state function is updated by the new values of the input variables and the mode is changed to execution. The function state_up_seq is a generalization of the state updating function state_up that updates a list of variables. When the original configuration has an output mode, the cycle identifier is incremented and the mode is changed to input. This two cases correspond to the inference rules Input and Output of Figure 4.

When the configuration mode is execution, the transition function will first check the instruction corresponding to the current configuration. This instruction corresponds to the l th element of the list of instructions of the code P. We use here the generic function nth from SSReflect seq library. If the element at the position l of P is equal to RET then the rule RET of Figure 4 is applied. Otherwise the cycle and the mode will not be modified. The variable state will be updated using the function eval_instr. The configuration location is updated using the function instr_succ that returns the successor of a location according to the corresponding instruction and the state of the current register. Using our IL semantics, we formalized a simple example of PLC program and proved some properties about it. This is presented in the following sub-section.

C. Example

We formalized a simple example of PLC program written in the IL language. It is one of the examples given in the book Programmable Logic Controller s [START_REF] Bolton | Programmable Logic Controllers[END_REF].

Description: We consider the example of a PLC program for opening and closing a car park en-trance barrier. The barrier is opened when the correct amount of money is inserted in the collection box. The barrier will stay open for 10 seconds. The program has three inputs and two outputs. The first input is associated to a sensor in the collection box. When the barrier is down it trips a switch and when up it trips another switch. These switches are associated to the two others input variables of the program. They give the position of the barrier to the program. The opening and closing of the barrier is managed by a valve-piston system. The two program outputs are associated to the two valves of this system. The program source Inputs: 9. The output Q0 for raising the entrance barrier is activated when the input I0 is activated. It remains on until the timer output variable T0 is activated. This happens when the input I1, indicating that the barrier is up, remains on for 10 seconds. At the end of the time delay the output Q1 is activated telling the valve-piston system to lower the barrier. In a normal state, the input variables I1 and I2 should have opposite boolean values. When they have the same values, it means the barrier is in the process of being lowered or raised.

X400(I0) X401(I1) X402(I2) Outputs: X430(Q0) X431 (
Properties: we formalized and proved some safety properties about the IL program presented above. For example, Figure 10 shows two lemmas that prove some properties about the output Q0 and the timer output T0. The lemma barrier_open states that after one cycle execution, the output Q0 will be on if the input I0 was on at the input phase or Q0 was on in the previous cycle, and the timer output and the output Q1 were off during the previous cycle. The lemma timer_on states that the timer output will be on if and only if the input I1 is on and the elapsed time is greater or equal to the predefined time delay. The proofs of this two lemmas are straight forward and proceed by case analysis over the inductive predicate exec.

V. Related works

There is numerous publications on the use of formal methods for the verification of PLC programs. Model checking is the most used approach in these verification works. In [START_REF] Mader | Timed automaton models for simple programmable logic controllers[END_REF] a semantics of IL is defined using timed automaton. The language subset contains TON timers but data types are limited to booleans. The formal analysis is performed by the model checker UPPAAL. In [START_REF] Canet | Towards the automatic verification of plc programs written in instruction list[END_REF] an operational semantics of IL is defined. A significant sub-set of IL is supported by this semantics, but it does not include timer instructions. The semantics is encoded in the input language of the model checker Cadence SMV and linear temporal logic (LTL) is used to specify properties of PLC programs. Abstraction interpretation techniques are also used for the verification of PLC programs. In [START_REF] Huuck | Semantics and analysis of instruction list programs[END_REF] an operational semantics of IL is defined. This semantics is used to perform abstract interpretation of IL programs by a prototype tool called HOMER. In the theorem proving community, there has been some work on the formal analysis of PLC programs. In [START_REF] Völker | Automated verification of function block-based industrial control systems[END_REF] the theorem prover HOL is used to verify PLC programs written in FBD, SFC and ST languages. In this work, modular verification is used for compositional correctness and safety proofs of programs. In the Coq system, an exam-ple of verification of PLC program with timers is presented in [START_REF] Wan | Formalization and verification of PLC Timers in Coq[END_REF]. A quiz machine program is used as an example in this work, but no generic model of PLC programs is formalized. There is also a formalization of a semantics3 of the LD languages in Coq. This semantics support a sub-set of LD that contains branching instructions. This work is a component of a CDK environment for PLC.

VI. Conclusions and future work

Our goal is to develop a formally verified compiler and a verification tool for PLC programs. This require a formal semantics of PLC programing languages. In this paper we presented a formal semantics of PLC programs written in the IL language. This semantics covers a large sub-set of IL instructions that includes timers. We formalized this semantics in the type theory based theorem prover Coq and used it to prove some safety properties of a simple example of PLC program. The proof of these properties are straightforward and require only some basic knowledge about the Coq system. Although our main goal is the development of a PLC certified compiler, this work can also be used for formally proving properties of IL programs.

In the short term, the perspectives of our work are the following:

• Developing a certified compiler front-end for PLC. We plan to formalize and certify a transformation of PLC programs written in LD language to IL. • Integrating our formal semantics of IL with the formal semantics of the meta language SFC [START_REF] Blech | Towards a property preserving transformation from IEC 61131-3 to BIP[END_REF]. This work will allow us to prove safety properties of industrial examples of PLC programs written in SFC.

In the long term, the work on the certified compiler front-end open the way to the development of a certified compilation chain for PLC. This chain can be build on top of the CompCert compiler and uses the BIP [START_REF] Bensalem | Compositional verification for component-based systems and application[END_REF] framework as an intermediate language. We also plan to develop a static analysis tool for PLC programs.

Figure 1 .

 1 Figure 1. Schema of PLC scan cycle

Figure 2 .Figure 2 Figure 3 .

 223 Figure 2. Standard timer representation Figure 2 shows the IEC 61131-3 standard graphical representation of timers. In this representation, IN and Q are respectively the boolean input and output of the timer. PT is the constant input used to specify the time delay of the timer. ET is the output indicating the elapsed time since the activation of the timer. The delay PT and elapsed time ET are multiples of a system predefined time base.

  • off-delay timers (TOF) : they stay on for a fixed period of time after the input goes off (Figure3(b)). • pulse timers (TP) : they turn on for a fixed period of time after the input goes on (Figure 3(c)).

n

  On delay timer | RET end of program Operands: op ::= id | cst variable identifier or constant Constants: cst ::= n | b integer or boolean literal We will denote the set of IL instructions by Instr.

Figure 5 .

 5 Figure 5. Coq definition of the IL syntax

Figure 6 .

 6 Figure 6. IL instructions evaluation function

  Inductive ILmode := I | O | E. Definition ILConf := nat * State * nat * ILmode. In a configuration, cycle identifier and location are represented by naturals numbers. The execution mode is represented by an element of the inductive Definition instr_succ (i : Instr) x (s : State) : nat := match i with | JMP l => l | JMPC l => if BofN s.1 then l else x.+1 | JMPCN l => if ~~BofN s.1 then l else x.+1 | _ => x.+1 end. Definition transition (Cf : ILConf) := match Cf with (c, s, l, m) => match m with | I => let s' := state_up_seq s pi (p_ival c) in (c, s', l, E) | O => (c.+1, s, l, I) | E => let I := nth RET P l in if I == RET then (c, s, 0, O) else (c, eval_instr s I, instr_succ I l s, E) end end.

Figure 7 .

 7 Figure 7. IL Configurations transition function

  Program executions: After the definition of the IL configuration transition function, we define a program execution as the transitive closure of the transition relation. Since it is not always possible to know how many transition are needed to execute an IL program, we define the program execution as a propositional relation rather than a computational function. The definition of exec is given Inductive exec (c1 c2 : ILConf) : Prop := | exec_step : transition c1 = c2 → exec c1 c2 | exec_star cf : transition c1 = cf → exec cf c2 → exec c1 c2. Lemma exec_splitI_prodl : forall c n s0 s, exec (c, s0, 0, I) (c + n.+1, s, 0, O) → exists r, exec (c, s0, 0, I) (c, r, 0, O) ∧ exec (c.+1, r, 0, I) (c + n.+1, s, 0, O). Lemma exec_splitI_prodr : forall c n s0 s, exec (c, s0, 0, I) (c + n.+1, s, 0, O) → exists r, exec (c, s0, 0, I) (c + n.+1, r, 0, I) ∧ exec (c + n.+1, r, 0, I) (c + n.+1, s, 0, O).

Figure 8 .

 8 Figure 8. IL program execution definition and lemmas

Figure 9 .

 9 Figure 9. Car barrier program in Mitsubishi format and in Coq

  Lemma barrier_open : forall c s0 s, exec (c,s0,0,E) (c,s,0,O) → BofN (s Q0) = (BofN (s0 I0) || BofN (s0 Q0)) && ~~BofN (s0 T0) && ~~BofN (s0 Q1).Lemma timer_on : forall c s0 s, exec (c, s0, 0, E) (c, s, 0, O) → BofN (s T0) = BofN (s0 I1) && (PT <= (s0 ET0)).

Figure 10 .

 10 Figure 10. IL Configurations transition

  The first element of the pair, denoted s.1, represents the value of the current register. The second element of the pair, denoted s.2, represents the function that maps every program variable to its value. We define also some state transformation function. The function state_up updates the value of a state s for a given variable determined by its second argument i with a value v. If i is equal to zero the current register value is updated otherwise the variables mapping function is updated.Instruction evaluation: The definition of the IL instruction evaluation function is presented in Fig-

	Definition eval_instr (s : State) (i : Instr) : State :=
	match i with
	| LD op => state_up s 0 (s op)
	| ST x => state_up s x.+1 s.1
	| SR x => state_up s x.+1 (BofN s.1 || BofN (s.2 x))
	| RS x => state_up s x.+1 (~~BofN s.1 && BofN (s.2 x))
	| AND op => state_up s 0 (BofN s.1 && BofN (s op))
	| OR op => state_up s 0 (BofN s.1 || BofN (s op))
	| NOT op => state_up s 0 (~~BofN (s op))
	| ANDN op => state_up s 0 (BofN s.1 && ~~BofN (s op))
	| ORN op => state_up s 0 (BofN s.1 || ~~BofN (s op))
	| ADD op => state_up s 0 (s.1 + s op)
	| MUL op => state_up s 0 (s.1 * s op)
	| SUB op => state_up s 0 (s.1 -s op)
	| GT op => state_up s 0 (s.1 < s op)
	| GE op => state_up s 0 (s.1 <= s op)
	| EQ op => state_up s 0 (s.1 == s op)
	| TON q et pt =>
	if BofN s.1 then
	let s' := state_up s et.+1 (s.2 et + d) in
	if s.2 et < pt then state_up s' q.+1 0
	else state_up s' q.+1 1
	else
	let: s' := state_up s et.+1 0 in state_up s' q.+1 0
	| _ => s
	end.

Definition State := nat * (ident → nat). Definition state_up s i v : State := if i is (S n) then (s.1, fun x => if n == x then v else s.2 x) else (v, s.2).

A program state s : State is a pair.

This can be automatically done in Coq using coercions.

Research report in Korean available at: http://pllab.kut. ac.kr/tr/2009/ldsemantics.pdf

This research work is funded by the ANR grant ANR-08-BLAN-0326-01 for the SIVES project. Inductive ILcst : Type := | Ncst (n : nat) | Bcst (b : bool) | Tcst (t : time).