Da-Yan Liu
email: dayan.liu@kaust.edu.sa

Taous-Meriem Laleg-Kirati
email: taousmeriem.laleg@kaust.edu.sa

Mathematical properties of a semi-classical signal analysis method: noisy signal case

. The main idea in this method is to interpret a signal as a potential of a Schrodinger operator and then to use the discrete spectrum of this operator to analyze the signal. In this paper, we are interested in a mathematical analysis of this method in discrete case considering noisy signals.

I. INTRODUCTION

Recently, a new signal analysis method based on a semiclassical approach has been proposed [START_REF] Laleg-Kirati | Semi-classical signal analysis[END_REF]. We refer to this method SCSA for Semi-Classical Signal Analysis. The main idea in the SCSA is to interpret a signal as a potential of a Schrodinger operator depending on a semi-classical parameter [START_REF] Dimassi | Spectral asymptotics in the semi-classical limit[END_REF]. It is well-known that if the potential is in the Faddeev class [START_REF] Faddeev | Properties of the S-matrix of the one-dimensional Schrödinger equation[END_REF], then it can be expressed using a sum of the squared eigenfunctions associated to the negative eigenvalues characterizing the discrete spectrum of the Schrodinger operator and an integral involving the continuous spectrum. Similarly to the other standard approximation methods, by truncating the expression of the potential, the sum part is taken as an estimate of the potential. The proposed estimate depends on the semiclassical parameter. It has been shown that by reducing this parameter the estimation of the signal by the SCSA can be improved [START_REF] Laleg-Kirati | Semi-classical signal analysis[END_REF].

Promising results have been obtained when applying the SCSA to arterial blood pressure. More than a satisfactory estimation of the pressure signals, this method introduced new spectral parameters that seem to contain important physiological information [START_REF] Laleg-Kirati | Arterial blood pressure analysis based on scattering transform II[END_REF], [START_REF] Laleg-Kirati | Validation of a semi-classical signal analysis method for stroke volume variation assessment: A comparison with the PiCCO technique[END_REF]. Moreover, a recent study has shown that the SCSA parameters could be useful in the estimation of some physical parameters related to turbomachinery features [START_REF] Eleiwi | A Semi-Classical Signal Analysis Method for the Analysis of Turbomachinery Flow Unsteadiness[END_REF]. It has been also confirmed by some tests that the SCSA method is robust with respect to corrupting noises. Hence, it can be considered as a filter. However, the mathematical analysis of the SCSA in discrete noisy case has not been considered yet, comparing to other signal analysis methods (see, e.g., [START_REF] Fliess | Analyse non standard du bruit[END_REF], [START_REF] Liu | An error analysis in the algebraic estimation of a noisy sinusoidal signal[END_REF], [START_REF] Liu | Error analysis for a class of numerical differentiator: application to state observation[END_REF], [START_REF] Liu | Error analysis of Jacobi derivative estimators for noisy signals[END_REF], [START_REF] Liu | Convergence Rate of the Causal Jacobi Derivative Estimator[END_REF]),

We propose in this paper to study the mathematical properties of the SCSA in discrete case considering noisy signals.

We propose also to study how to choose an appropriate semiclassical parameter to analyze a signal. In Section II, we recall the methodology and some mathematical properties of the SCSA method in the continuous case. Then, we study this method in discrete case in Section III. In Section IV, the SCSA method is studied in discrete noisy case. An a-posteriori error bound of the noise error contribution is given. In Section V, we show how to choose an appropriate parameter for the SCSA method in discrete noisy case. Moreover, we can see its efficiency and stability with corrupting noises. Finally, we give some conclusions and perspectives for our future work in Section V.

II. PRELIMINARY

In this section, we are going to recall the methodology and some mathematical properties of the SCSA [START_REF] Laleg-Kirati | Semi-classical signal analysis[END_REF].

A. Methodology

Let us consider the following Schrodinger operator

H h (y) := -h 2 d 2 dx 2 -y, (1)
where [START_REF] Faddeev | Properties of the S-matrix of the one-dimensional Schrödinger equation[END_REF]. Then, it is well known that y can be reconstructed as follows [START_REF] Kaup | Solitons as particles, oscillators, and in slowly changing media: a singular perturbation theory[END_REF]

h ∈ R * + is a semi-classical parameter [2], y ∈ L 1 1 (R) := V | +∞ -∞ |V (x)| (1 + |x|) dx < ∞ , and L 1 1 (R) is called the Faddeev class
y(x) = 4h N h n=1 κ n h ψ 2 n h (x)- lim b→+∞ 1 b b 0 2i π h +a -a kR r(l)h (k) f 2 ±h (k, x) dk da, a.e., (2)
where -κ 2 n h are the negative eigenvalues of H h (y) with

κ 1 h > κ 2 h > • • • > κ N h > 0, N h
denotes the number of the negative eigenvalues, and ψ n h ∈ H 2 (R) (H 2 (R) being the Sobolev space of order 2) are the associated L 2 -normalized eigenfunctions such that

H h (y) ψ n h = -κ 2 n h ψ n h . (3)
Moreover, R r(l)h (•) is the reflection coefficient and f h± (•, •) denote the Jost solutions defined as the unique solutions of the Schrodinger integral equation at ±∞ respectively. Let us mention that the eigenpairs {κ n h , ψ n h } for n h = 1, • • • , N h can be numerically calculated, but R r(l)h and f h± usually can not be calculated. Hence, similarly to the other standard approximation methods, by truncating (2) we propose to take the sum part as an estimate of y. Moreover, since this sum part 4h

N h n=1 κ n h ψ 2 n h is a positive definite function on R,
it is necessary to assume y to be positive definite too. Then, we give the following proposition. Proposition 1: [START_REF] Laleg-Kirati | Semi-classical signal analysis[END_REF] Let y be a positive definite function belonging to L 1 1 (R), then it can be estimated by

y h (x) := 4h N h n=1 κ n h ψ 2 n h (x), (4)
where h > 0, -κ 2 n h are the negative eigenvalues of the Schrodinger operator H h (y) defined by (1) with κ

1 h > κ 2 h > • • • > κ N h > 0, N h
denotes the number of the negative eigenvalues, and ψ n h are the associated L 2 -normalized eigenfunctions.

Consequently, the proposed estimation only depends on the parameter h [START_REF] Laleg-Kirati | Semi-classical signal analysis[END_REF].

B. Some properties of the SCSA method

Now, it is natural to consider the convergence of this proposed method which is shown in the following proposition.

Proposition 2: [START_REF] Laleg-Kirati | Semi-classical signal analysis[END_REF] Let y be a real valued function satisfying the following condition

y ∈ B := V ∈ L 1 1 (R)| ∀ x ∈ R, y(x) ≥ 0, ∂ m y ∂x m ∈ L 1 (R), m = 1, 2 . (5)
Then, we have lim h→0 y hy L 1 (R) = 0. Moreover, the number N h of the negative eigenvalues of H h (y) is a decreasing function of h.

According to the previous proposition, we can improve our estimation by reducing the value of h. Moreover, it was shown in [START_REF] Laleg-Kirati | Semi-classical signal analysis[END_REF] that if there exists an h such that y h 2 is a reflectionless potential of the Schrodinger operator H h (y), then y h is an exact representation of y.

Let us recall that the study of the Schrodinger operator in the case where h → 0 is referred to the semi-classical analysis [START_REF] Dimassi | Spectral asymptotics in the semi-classical limit[END_REF]. Consequently, we call the proposed signal estimation method Semi-Classical Signal Analysis (SCSA) method.

III. THE SCSA METHOD IN DISCRETE CASE

In order to apply the SCSA method, we need to solve numerically the following Schrodinger eigenvalue problem

H h (y) ψ h = λ h ψ h , ψ h ∈ H 2 (R). (6)
Hence, we will study the SCSA method in discrete case in this section.

We assume that y d is a discrete signal defined on an interval I = [a, b] ⊂ R, which can be considered as the restriction of a function y satisfying the condition given in [START_REF] Laleg-Kirati | Validation of a semi-classical signal analysis method for stroke volume variation assessment: A comparison with the PiCCO technique[END_REF], such that

y d (x j ) = y(x j ), (7)
where x j = a + (j -1) ∆x for j = 1, • • • , M , are equidistant points with the distance between two consecutive points ∆x = b-a M-1 . We denote y d j as the value y d (x j ) for j = 1, • • • , M . The discretization of the Schrodinger eigenvalue problem given in (6) leads to the following eigenvalue matrix problem

A d h Ψh = λh Ψh , (8)
where

Ψh = ψh,1 , ψh,2 , • • • , ψh,M-1 , ψh,M T , A d h = -h 2 D 2 -diag(Y d ), (9)
diag(Y d ) is a diagonal matrix whose elements are y d j for j = 1, • • • , M , and D 2 is a second order differentiation matrix given by a discretization method for differential equations [START_REF] Boyd | Chebyshev and Fourier Spectral Methods[END_REF], [START_REF] Trefethen | Spectral Methods in Matlab[END_REF], which is independent of h.

Let us consider the negative eigenvalues -κ 2

n h of A d h with κ1 h ≥ • • • ≥ κ Nh > 0,
where Nh is the number of the negative eigenvalues of A d h with 0 ≤ Nh ≤ M . We denote their associated eigenvectors by

Ψn h = ψn h ,1 , • • • , ψn h ,M T for n h = 1, • • • , Nh . Moreover, we assume that ∆x M j=1 ψ2 n h ,j = 1, i.e. Ψn h 2 = 1 √ ∆x . (10)
Thus, according to Proposition 1 we can construct an estimation of y by the SCSA method in this discrete case as follows

y d h (x j ) := 4h Nh n=1 κn h ψ2 n h ,j , (11)
for j = 1, • • • , M . By writing the following equality

y d -y d h = y d -y h + y h -y d h , (12)
we can see that the estimation error in this discrete case for y d h can be divided into two sources: 1) the estimation error for y h : y dy h , which corresponds to the truncated integral part in (2), 2) the discrete numerical error for y d h : y hy d h , which is produced by the discretization of the Schrodinger eigenvalue problem. It is shown in Proposition 2 that the number of the negative eigenvalues of the Schrodinger operator is decreasing with respect to h. This property is generalized to the discrete case in the following proposition.

Proposition 3: We assume that the matrix [START_REF] Liu | Error analysis for a class of numerical differentiator: application to state observation[END_REF] satisfies the following conditions:

A d h = -h 2 D 2 - diag(Y d ) defined in
(C1):

D 2 is symmetric, (C2): D 2 is negative definite, (C3): the number of zeros in the diagonal of diag(Y d ) is equal to n with 0 ≤ n ≤ M -1.
Let us denote the number of the negative eigenvalues of A d h by Nh , then we have

∀ h > 0, 0 ≤ Nh ≤ M -n, ( 13
)
where M is the size of the matrix A d h . Moreover, we have

Nh = 0, for h > ŷd M d M , (14)
Nh = M -n, for 0 < h < ŷd n+1 d 1 , (15)
where

λh,M ≤ • • • ≤ λh,1 , d M ≤ • • • ≤ d 1 , -ŷ d M ≤ • • • ≤ -ŷ d 1 .
Then, according to Weyl's theorem (see [START_REF] Stewart | Matrix Perturbation Theory[END_REF]) we get

h 2 d M -ŷd j ≤ λh,j ≤ h 2 d 1 -ŷd j , (16)
for j = 1, • • • , M . If n = 0, then (13)
can be directly obtained. By using (C2) and (C3) we obtain

∀ h > 0, 0 < h 2 d M ≤ λh,j , (17)
for j = 1, • • • , n, and

∀ h > 0, λh,j ≤ h 2 d 1 -ŷd j , (18)
for j = n + 1, • • • , M . Hence, (13) can be deduced from [START_REF] Bianchi | Electronic Filter Simulation & Design[END_REF]. Moreover, if 0 ≤ n ≤ M -1, then by using (18) we obtain that for any h < 14) can be obtained by using [START_REF] Boyd | Chebyshev and Fourier Spectral Methods[END_REF]. Finally, this proof can be completed by solving the following inequality

ŷd n+1 d1 , λh,j < 0, for j = n + 1, • • • , M . It yields Nh ≥ M -n. Then, (
0 < h 2 d M -ŷd M ≤ λh,M . ( 19
)
Corollary 1: We assume that the matrix A d h defined in (9) satisfies the conditions (C1)-(C3) given in Proposition 3. Then,

∀ h > 0, ∃ h ′ with 0 < h ′ < h, such that Nh ′ ≥ Nh , (20)
where Nh ′ and Nh denote the number of the negative eigenvalues of A d h ′ and A d h respectively. Proof. Let h > 0, by using [START_REF] Boyd | Chebyshev and Fourier Spectral Methods[END_REF] we have 0 ≤ Nh ≤ M -n. Then, by using [START_REF] Stewart | Matrix Perturbation Theory[END_REF] we get

∀ 0 < h ′ < min   h, ŷd n+1 d 1   , Nh ′ ≥ Nh . (21)
Thus, this proof is completed.

IV. ERROR ANALYSIS IN NOISY CASE

In this section, we are going to consider the SCSA method in discrete noisy case. Moreover, an a-posteriori error bound of the noise error contribution for the SCSA method will be given.

A. The SCSA method in discrete noisy case

From now on, we assume that

y ̟ = y d + ̟ (22)
is a noisy observation of the discrete signal y d defined in [START_REF] Fliess | Analyse non standard du bruit[END_REF], where the corrupting noise ̟ is an identically distributed sequence of random variables with an expected value µ and a variance σ 2 (σ ∈ R + ). We denote y ̟ j and ̟ j as the values y ̟ (x j ) and ̟(x j ) respectively, for j = 1, • • • , M .

In order to apply the SCSA method in this discrete noisy case, by substituting A d h in (8) by A ̟ h we need to solve the following eigenvalue matrix problem

A ̟ h Ψn = λh Ψh , (23)
where

A ̟ h = -h 2 D 2 -diag(Y ̟ ), (24)
diag(Y ̟ ) is a diagonal matrix whose elements are y ̟ j for j = 1, • • • , M . Hence, according to (9) we obtain

A ̟ h = A d h -diag(W ), (25)
diag(W ) is a diagonal matrix whose elements are

̟ j for j = 1, • • • , M . Let us denote the negative eigenvalues of A ̟ h by -κ 2 n h with κ1 h ≥ • • • ≥ κ Ñh > 0 for n h = 1, • • • , Ñh , where
Ñh is the number of the negative eigenvalues of A ̟ h . Similar to [START_REF] Liu | Error analysis of Jacobi derivative estimators for noisy signals[END_REF], their associated eigenvectors are denoted by

Ψn h = ψn h ,1 , • • • , ψn h ,M T with Ψn h 2 = 1 √ ∆x .
Thus, according to Proposition 1, an estimation of y can be given by the SCSA method in this discrete noisy case as follows

y ̟ h (x j ) := 4h Ñh n=1 κn h ψ2 n h ,j , (26)
for j = 1, • • • , M . By writing the following equality

y d -y ̟ h = y d -y h + y h -y d h + y d h -y ̟ h , (27)
we can see that the total estimation error in this discrete noisy case for y ̟ h can be divided into three parts: 1) the truncated error for y h : y dy h , 2) the discrete numerical error for y d h : y hy d h , 3) the noise error contribution for y ̟ h : y d hy ̟ h . Proposition 4 illustrates a property on the number of the negative eigenvalues in the discrete noisy case.

Proposition 4: We assume that the matrix Let us denote the number of the negative eigenvalues of A ̟ h by Ñh , then we have

A ̟ h = -h 2 D 2 - diag(Y ̟ )
∀ h > 0, 0 ≤ Ñh ≤ M -ñ, (28)
Ñh = 0, for h > ỹ̟ M d M , (29)
Ñh = M -ñ, for 0 < h < ỹ̟ ñ+1 d 1 , (30)
where ỹ̟ ñ+1 (resp. ỹ̟ M ) is the smallest (resp. largest) strictly positive element in the diagonal of diag(Y ̟ ), and d 1 (resp. d M ) is the largest (resp. smallest) eigenvalue of D 2 .

Moreover, we have ∀ h > 0, ∃ h ′ with 0 < h ′ < h, such that Ñh ′ ≥ Ñh , where Ñh ′ and Ñh denote the number of the negative eigenvalues of A ̟ h ′ and A ̟ h respectively. Proof. This proof can be completed in a similar way to the one of Proposition 3.

B. Analysis of the noise error contribution

In this subsection, we are going to study the noise error contribution in the SCSA method by providing an a-posteriori error bound in the following proposition.

Proposition 5: Let y ̟ be a discrete noisy signal defined as in ( 22), y ̟ h and y d h be the estimations of y given by ( 11) and (26) respectively. Moreover, we assume that (C1): the matrix D 2 given in ( 9) and ( 24) is symmetric, (C5): the numbers of the negative eigenvalues of A d h and A ̟ h are equal, i.e. Nh = Ñh , (C6):

κ2 n h < 2 κ2 n h , for n h = 1, • • • , Ñh .
Then, an a-posteriori error bound for the noise error contribution in y ̟ h can be given as follows

y ̟ h -y d h 2 p < 4h √ ∆x Ñh n=1 2κ n h + B γ µ,σ √ 2 κn h , (31)
where B γ µ,σ = max (|µ -γσ|, |µ + γσ|) with µ and σ 2 being the expected value and the variance of ̟ j respectively for j = 1, • • • , M , and c p < d means that the probability for c to be smaller than d is p with p = 1 -1 γ 2 and γ ∈ R * + . In order to prove this proposition, we need the following lemma.

Lemma 1: By giving the conditions (C1), (C5), and (C6), we have

|κ n h -κn h | p < B γ µ,σ √ 2 κn h , (32)
for

n h = 1, • • • , Ñh , where B γ µ,σ = max (|µ -γσ|, |µ + γσ|).
Proof. According to the condition (C1), the matrixes A d h and A ̟ h are both symmetric. Moreover, since the matrix diag(W ) is diagonal, its eigenvalues are ̟ j for j = 1, • • • , M . Hence, by using Weyl's theorem (see [START_REF] Stewart | Matrix Perturbation Theory[END_REF]) and ( 25) with the condition (C5), we obtain

κ2 n h -κ2 n h ≤ max 1≤j≤M |̟ j | , (33)
for n h = 1, • • • , Ñh . By using the Bienaymé-Chebyshev inequality we get that for any real number γ > 0,

Pr (|̟ j -µ| < γσ) > 1 - 1 γ 2 , (34)
i.e. the probability for ̟ j to be within the interval ]µγσ , µ + γσ[ is higher than 1 -1 γ 2 . Consequently, by denoting B γ µ,σ = max (|µ -γσ|, |µ + γσ|) and using (33) we obtain

κ2 n h -κ2 n h ≤ max 1≤j≤M |̟ j | p < B γ µ,σ , (35)
for n h = 1, • • • , Ñh . According to the condition (C6) we obtain

0 < κ2 n h 2 < min κ2 n h , κ2 n h . ( 36
)
Then, the utilization of the mean value theorem gives us

|κ n h -κn h | ≤ 1 2 κ2 n h -κ2 n h κ2 n h 2 1 2 . ( 37
)
Then, this proof can be completed by using (35).

Proof of Proposition 5. By using the condition (C5), ( 11) and ( 26), we get

y ̟ h (x j ) -y d h (x j ) = 4h Ñh n=1 κn h ψ2 n h ,j -κn h ψ2 n h ,j , (38)
for j = 1, • • • , M . Let us denote E n h = [e n h ,1 , • • • , e n h ,M ] T with e n h ,j = κn h ψ2 n h ,j -κn h ψ2 n h ,j . (39)
Then, we obtain

e n h ,j = κn h ψ2 n h ,j -κn h ψ2 n h ,j + κn h ψ2 n h ,j -κn h ψ2 n h ,j = κn h ψ2 n h ,j -ψ2 n h ,j + (κ n h -κn h ) ψ2 n h ,j . (40)
By calculating the norms Ψn h 2 and Ψn h 2 , E n h 2 can be bounded as follows

E n h 2 ≤ 2κ n h + |κ n h -κn h | √ ∆x . (41)
Hence, by using (38), ( 39) and (41), we get

y ̟ h -y d h 2 ≤ 4h Ñh n=1 E n h 2 ≤ 4h √ ∆x Ñh n=1 (2κ n h + |κ n h -κn h |) . ( 42
)
Finally, the proof can be completed by using Lemma 1.

The convergence of the SCSA method in the continuous noise-free case is shown in Proposition 2, where the estimation proposed by the SCSA method can be improved by reducing the value of h. Now, it is interesting to study the efficiency of this method in discrete noisy case. Especially, we need to know the influence of h on the noise error contribution in the SCSA method. A natural idea is to study the influence of the parameter h on the noise error bound given in Proposition 5 so as to deduce the one on the noise error contribution. On one hand, because of the term h this error bound seems to be increasing with respect to h. On the other hand, it is shown in Proposition 4 that the number of the negative eigenvalues Ñh can be decreasing with respect to h. Consequently, it is impossible to intuitively know the influence of h. However, it can be studied numerically as shown in the next section.

V. NUMERICAL RESULTS

In this section, by taking a numerical example we are going to show how to choose an appropriate value of h for the SCSA method in discrete noisy case. Moreover, we can see its efficiency and stability with corrupting noises.

We assume that y ̟ is the discrete noisy observation of y defined in ( 22), where

y d (x j ) = y(x j ) = sech 2 (x j -6) (43)
with x j ∈ I = [0, 12] and ∆x = 10 -2 . Hence, M is equal to 1201. Moreover, we assume that the noise ̟ is simulated from a zero-mean white Gaussian iid sequence. The variance σ 2 of ̟ is adjusted in such a way that the signal-to-noise ratio is equal to 11dB. We can see the original signal y and its noisy observation y ̟ in Figure 1. Let us recall that this sech-squared function is well known in the quantum physics theory as the Pöschl-Teller potential of the Schrodinger operator [START_REF] Olafsson | Function spaces associated with Schrodinger operators: the Poschl-Teller potential[END_REF].

In order to estimate y by using (26), we propose to use a Fourier pseudo-spectral method [START_REF] Boyd | Chebyshev and Fourier Spectral Methods[END_REF] to solve numerically the Schrodinger eigenvalue problem defined in [START_REF] Eleiwi | A Semi-Classical Signal Analysis Method for the Analysis of Turbomachinery Flow Unsteadiness[END_REF]. Thus, the second order differentiation matrix D 2 is given as follows [START_REF] Trefethen | Spectral Methods in Matlab[END_REF]:

If M is even, then D 2 (k, j) = ∆ (∆x) 2 -π 2 3∆ 2 -1 6 , for k = j, -(-1) k-j 1 2 1 sin 2 ( (k-j)∆ 2 )
, for k = j.

If M is odd, then

D 2 (k, j) = ∆ (∆x) 2    -π 2 3∆ 2 -1 12 , for k = j, -(-1) k-j 1 2 cot( (k-j)∆ 2 ) sin( (k-j)∆ 2 )
, for k = j.

with ∆ = 2π M . Let us mention that D 2 is symmetric and negative definite. Then, we use the Matlab routine eig to solve the eigenvalue matrix problems defined in ( 8) and (23).

It is shown in Subsection IV-B that the total estimation error for y ̟ h comes from three parts. However, since the estimation y h can not be calculated in the discrete case, we only consider the estimation error in the discrete noise-free case and the noise error contribution

y d -y ̟ h = y d -y d h + y d h -y ̟ h . (44)
In order to see the influence of h on the total estimation error, we show the variations of y dy ̟ h 2 in Figure 3(a), which is represented by the black solid line. We can see that y dy ̟ h 2 has a minimum at h = 0.4 and a local minimum at h = 0.7. Thus, we can take the optimal value h = 0.4 for y ̟ h so as to produce a minimal total estimation error. The estimation obtained by using y ̟ h with h = 0.4 is given in Figure 2. Consequently, we can see that the SCSA method is accurate and robust with a corrupting noise. Hence, it can be considered as a filter for noisy signals without delays.

The previous analysis is based on the knowledge of y d which is usually unknown in the practice work. If we use y ̟y ̟ h 2 to study the influence of h on the total estimation error, then we generally can not find an optimal value of h. This can be explained by the green solid line in Figure 3(a), which corresponds to the different values of y ̟y ̟ h 2 . In order to solve this problem, we propose to use a second-order Butterworth filter [START_REF] Bianchi | Electronic Filter Simulation & Design[END_REF] which is given as follows

H(s) = w 2 c s 2 + 2w c s + w 2 c , (45)
where the cutoff frequency w c is set to w c = 0.01. H(•) is a classical low-pass filter which can be used to attenuate the corrupting Gaussian noise in y ̟ . The filtered signal is represented by the black dotted line in Figure 2. Since this filter produces a delay to y ̟ , we also apply it to y ̟ h . The filtered signals are denoted by f y ̟ and f y ̟ h respectively. Then, we use the influence of h on f y ̟f y ̟ h 2 to deduce the one on y dy d h 2 which corresponds to the estimation error in the discrete noise-free case. We can see in Figure 3(a) the relation between the variations of f y ̟f y ̟ h 2 and y dy d h 2 which are represented by the red dotted line and the blue dash-dotted line respectively. Hence, we can observe that they have the same variation with the same local minimum and the same local maximum. Now, we study the influence of h on the noise error contribution. The variations of y d hy ̟ h 2 is shown in Figure 3(b). Moreover, we can verify that the number of the negative eigenvalues Nh and Ñh are equal. We can see their variation with respect to h in Figure 3(d). Consequently, according to Figure 3(b) and Figure 3(d) we can observe that when Nh is equal to 1 the noise error contribution is increasing with respect to h. However, when the value of Nh increases, the noise error contribution is decreasing with respect to h. Consequently, a small value of h can produce a large noise error contribution.

We are going to use Proposition 5 to deduce the variation of the noise error contribution with respect to h. Since the noise is assumed to be a zero-mean white Gaussian iid sequence, by using the well known three-sigma rule we obtain that

max 1≤j≤M |̟ j | 99.7% < 3σ. ( 46
)
The variation of the noise error bounds given in Proposition 5 is shown in Figure 3(c). Although this error bound is not sharp, its variation is similar to the one of the noise error contribution shown in Figure 3(b), where there are local minimums at h = 0.6 and h = 0.4, and a local maximum at h = 0.5. Finally, by combined with the variation of f y ̟f y ̟ h 2

shown in Figure 3(a), we can choose h = 0.4 or h = 0.7 in our estimation so as to minimize the total estimation error.

VI. CONCLUSION

In this paper, the SCSA method recently introduced for signal analysis is studied in discrete noisy case. Some mathe-matical properties of the negative eigenvalues of a Schrodinger operator are given in discrete noise-free case and discrete noisy case respectively. An a-posteriori error bound of the noise error contribution is given which is based on the expected value and the variance of a corrupting noise. By taking a numerical example, we show the influence of the semiclassical parameter on different sources of errors in the SCSA method. Moreover, it is shown that the SCSA method is accurate and robust against corrupting noises. Hence, it can be considered as a filter without involved delays. Finally, we study how to choose an appropriate semi-classical parameter without knowing the original signal. The comparison to other signal analysis methods like Fourier transform or the wavelets will be done in a future work. Moreover, the SCSA method will be extended for time derivatives filtering, which is still an open problem, such that this method can be useful in more applications in signal processing and automatic control.

  defined in (24) satisfies the conditions (C1)-(C2) and the following condition (C4): the number of the positive elements in the diagonal of -diag(Y ̟ ) is equal to ñ with 0 ≤ ñ ≤ M -1.

Fig. 1 .Fig. 2 .

 12 Fig. 1. The discrete signal y d and the discrete noisy signal y ̟ with SN R = 11dB.

  of the noise error contribution Noise error contribution (b) The noise error contribution.

Fig. 3 .

 3 Fig. 3. Results of different variations obtained for h = 0.2, 0.3, • • • , 1.9, 2.

  ŷd n+1 (resp. ŷd M ) is the smallest (resp. largest) strictly positive element in the diagonal of diag(Y d ), and d 1 (resp. d M ) is the largest (resp. smallest) eigenvalue of D 2 . Proof. Since the matrices D 2 and diag(Y d ) defined in (9) both are symmetric, A d h is also symmetric. The eigenvalues of A d h , -D 2 and -diag(Y d ) can be denoted and ordered respectively as follows


Luca Costabello

Serena Villata

Fabien Gandon

Context-Aware Access Control for RDF Graph Stores

We present SHI3LD, an access control framework for RDF stores. Our solution supports access from mobile devices with context-aware policies and is exclusively grounded on standard Semantic Web languages. Designed as a pluggable filter for generic SPARQL endpoints, the module uses RDF named graphs and SPARQL to protect triples. Evaluation shows faster execution time for low-selective queries and less impact on larger datastores.

Introduction

The Web is evolving from an information space for sharing textual documents into a medium for publishing structured data. The Linked Data2 initiative aims at fostering the publication and interlink of data on the Web, giving birth to the Web of Data, an interconnected global dataspace where data providers publish their content publicly [START_REF] Giunchiglia | Ontology driven community access control[END_REF]. The open nature of current Web of Data information and the consumption of web resources from mobile devices may give providers the impression that their content is not safe, thus preventing further publication of datasets, at the expense of the growth of the Web of Data itself. Access control is therefore necessary, and mobile context must be part of the access control evaluation. In this paper we address the problem of defining an access control framework, called SHI3LD 3 , for querying Web of Data servers from mobile environments. Three major challenges arise: (i) definition of a fine-grained access control model for graph stores, (ii) modelling of context-aware, mobile consumption of such information, and (iii) integration of mobile context in the access control model. We protect RDF stores by changing the semantics of the incoming SPARQL queries, whose scope is restricted to triples included in accessible named graphs only. We determine the list of accessible graphs by evaluating pre-defined access policies against the actual mobile context of the requester. Beyond the support for context in control enforcement, our proposal has the advantage of being a pluggable filter for generic SPARQL endpoints, with no need to modify the endpoint itself. We adopt exclusively Semantic Web languages and reuse existing proposals, thus we do not add new policy definition languages, parsers nor validation procedures. We provide protection up to triple level. Our work does not provide yet another context ontology: our model includes base classes and properties only, as we delegate refinements and extensions to domain specialists, in the light of the Web of Data philosophy [START_REF] Giunchiglia | Ontology driven community access control[END_REF]. We do not deal with mobile context fetch, thus including on-board sensors or server-side inference. For the time being, our framework assumes the trustworthiness of the information sent by the mobile consumer, including data describing context (e.g. location, device features, etc). We do not provide any privacy-preserving mechanism yet, although aware that sensible data such as current location must be handled appropriately. Our approach focuses only on SPARQL data servers. The remainder of the paper is organized as follows. Section 2 compares the related work to SHI3LD. Section 3 introduces the context aspects and the access control model. The control enforcement algorithm is detailed in Section 4. Section 5 shows the experimental results.

Related Work

We differ from WAC 4 since we go beyond RDF document granularity and we do not rely on access control lists. Sacco and Passant [START_REF] Kulkarni | Context-aware role-based access control in pervasive computing systems[END_REF] present the PPO vocabulary. The common points of PPO and SHI3LD are the use of the ASK queries for representing the access conditions and the use of Semantic Web languages only. Sacco and Passant express access control policies for RDF documents, while we provide an authorization mechanism for RDF stores. Moreover, our framework adopts context-aware policies while in [START_REF] Kulkarni | Context-aware role-based access control in pervasive computing systems[END_REF] context is not considered. Finally, we provide an evaluation of the experimental results of SHI3LD, differently from [START_REF] Kulkarni | Context-aware role-based access control in pervasive computing systems[END_REF] where no evaluation is addressed. Flouris et al. [START_REF] Finin | ROWLBAC: representing role based access control in OWL[END_REF] provide a fine-grained access control framework on top of RDF repositories coupled with a high level specification language. Finin et al. [START_REF] Dey | Understanding and using context[END_REF] consider attribute-based access control where, similarly to our proposal, the constraints are based on general attributes of an action. Giunchiglia et al. [START_REF] Flouris | Controlling Access to RDF Graphs[END_REF] propose a Relation Based Access Control model, while we specify the attributes the consumer must satisfy. Context information is supported to some extent by Abel et al. [START_REF] Abel | Enabling Advanced and Context-Dependent Access Control in RDF Stores[END_REF]. They provide triple-level access control as a layer on top of RDF stores. Contextual conditions are pre-evaluated before expanding the queries. They introduce a high-level syntax for policy definition, while we exclusively rely on RDF. Toninelli et al. [START_REF] Sacco | An access control framework for the web of data[END_REF] adopt context-awareness and semantic technologies for access control but they do not apply their solution to the Web of Data. The semantic technology adopted differs, i.e., rule-based approach with description logic in their case and SPARQL 1.1 in our proposal. Their contextual information does not include the device dimension. Covington et al. [START_REF] Costabello | Linked Data Access Goes Mobile: Context-Aware Authorization for Graph Stores[END_REF] use the notion of role proposed by Role Based Access Control to capture the context of the environment in which the access requests are made. Environmental roles are defined using a prolog-like logical language for expressing policies. Cuppens and Cuppens-Boulahia [START_REF] Covington | Securing context-aware applications using environment roles[END_REF] propose an Organization Based Access Control. They introduce a context algebra whereas we rely on Semantic Web languages. Moreover, we deal with a wider range of contextual dimensions. Corradi et al. [START_REF] Corradi | Context-based access control management in ubiquitous environments[END_REF] present UbiCOSM, a security middleware adopting context for policy specification and enforcement. We support additional contextual dimensions, e.g., the device. Although their policies are expressed in RDF, the system is not designed for the Web of Data.

The Model

The SHI3LD model is grounded on two ontologies (Figure 1): S4AC deals with core access control concepts and PRISSMA5 focuses on the mobile context 6 . The access control model is built over the notion of Named Graph [START_REF] Carroll | Named graphs[END_REF], thus supporting fine-grained access control policies, including the triple level. Enforcing permission models is an envisioned use case for RDF named graphs 7 . We rely on named graphs to avoid depending on documents (one document can serialize several named graphs, one named graph can be split over several documents, and not all graphs come from documents 8 ). At conceptual level, our policies can be considered as access control conditions over g-boxes 9 (according to W3C RDF graph terminology), with semantics mirrored in the SPARQL language. The S4AC vocabulary [START_REF] Toninelli | A Semantic Context-Aware Access Control Framework for Secure Collaborations in Pervasive Computing Environments[END_REF] reuses concepts from SIOC, SKOS, WAC, SPIN and Dublin Core 10 .

The main component of the S4AC model is the Access Policy, as presented in Definition 1. Roughly, an Access Policy defines the constraints that must be satisfied to access a given named graph or a set of named graphs. If the Access Policy is satisfied the data consumer is allowed to access the data. Otherwise, the access is denied. The constraints specified by the Access Policies may concern the data consumer, the device, the environment, or any given combination of these dimensions.

Definition 1. (Access Policy) An Access Policy (P ) is a tuple of the form P = ACS, AP, S, R, AEC where (i) ACS is a set of Access Conditions to satisfy, (ii) AP is an Access Privilege, (iii) S is the subject of the set of resources to be protected by P , (iv) R is the (set of) resource(s) to be protected by P , and (v) AEC is the Access Evaluation Context of P .

An Access Condition, as defined in Definition 2, expresses a constraint which needs to be verified to have the Access Policy satisfied. We introduce the ACS to ease the reuse and combination of ACs to dataset administrators lacking deep SPARQL knowledge. We thus avoid the use of more complicated SPARQL UNION clauses inside the ASKs. Roughly, the verification of an Access Condition Set returns a true/false answer and can be provided in a conjunctive or disjunctive fashion. Conflicts among policies might occur if the data provider uses Access Conditions with contrasting FILTER clauses. For instance, it is possible to define positive and negative statements such as ASK{FILTER(?u=<http://example#bob>)} and ASK{FILTER(!(?u=<http://example#bob>))}. If these two Access Conditions are applied to the same data, a logical conflict arises. This issue is handled in the framework by evaluating policies applied to a resource in a disjunctive way. We expect to add a mechanism to prevent the insertion of conflicting policies as future work.

The Access Privilege (Definition 9) specifies the kind of operation the data consumer is allowed to perform on the resource(s) protected by the Access Policy. Definition 9. (Access Privilege) An Access Privilege (AP ) is a set of allowed operations on the protected resources of the form AP = {Create, Read, U pdate, Delete}.

We model the Access Privileges as four classes of operations to keep a close relationship with CRUD-oriented access control systems, allowing a finer-grained access control beyond simple read/write privileges. We relate the four privilege classes to SPARQL 1.1 query and update language primitives through the SPIN ontology, which models the SPARQL primitives as SPIN classes. As previously explained, policies protect data at named graph level. We offer two different ways of specifying the protected object: the provider may target one or more specific named graphs, or a set of named graphs associated to a common subject. The former is achieved by providing the URI(s) of the named graph(s) to protect using the s4ac:appliesTo property. The latter is implemented by listing the subjects of the named graphs to protect using the property dcterms:subject. The assumption here is that named graphs have been previously annotated with such metadata. Summarizing, both S and R represent the data to protect, but R specifies the URI(s) of the named graphs, while S specifies the subject of the graphs (e.g., the policy protects the named graphs whose subject is Concert, http://dbpedia.org/resource/Concert 11 ).

The Access Policy is associated to an Access Evaluation Context. The latter provides an explicit link between the policy and the actual context data (in the case of the mobile context it is modelled with PRISSMA) that will be used to evaluate the Access Policy. In this paper, we focus on the mobile context, thus the Access Evaluation Context list is composed only by a couple AEC = ( ctx, U RIctx ). We map therefore the variable ctx, used in the policy's Access Conditions, to the URI identifying the actual mobile context in which the SPARQL query has been performed (e.g. :ctx in Figure 2b). More specifically, we choose to implement the Access Evaluation Context as a SPARQL 1.1 BINDINGS clause to constrain the ASK evaluation, i.e. BINDINGS ?ctx {(U RIctx)}. However, the same result can be obtained by binding directly the variable ?ctx to the URI of the contextual graph.

The choice and the design of a context model necessarily need a context definition first. We agree on the widely-accepted proposal by Dey [ Definition 11. (Context) "Context is any information that can be used to characterize the situation of an entity. An entity is a person, place, or object that is considered relevant to the interaction between a user and an application, including the user and applications themselves" [START_REF] Cuppens | Modeling contextual security policies[END_REF].

More specifically, we rely on the work by Fonseca and colleagues 12 , that we adopt as a foundation for our proposal. The mobile context is seen as an encompassing term, an information space defined as the sum of three different dimensions: the mobile User model, the Device features and the Environment in which the action is performed. Our Web of Data scenario favours the adoption of an ontology-based model. As pointed out by Korpipää and Mäntyjärvi [START_REF] Hulsebosch | Context sensitive access control[END_REF], an ontological approach leads to simple and extensible models. This is a common point with the Web of Data rationale: Linked Data on the Web heavily relies on lightweight vocabularies under the open world assumption (i.e. new ontologies can be added at anytime about anything) and model exchange and re-use are welcomed and promoted at Web scale. A large number of ontology-based context models relying on Dey's definition have been proposed in the latter years, as summarized by Bolchini et al. [START_REF] Bolchini | A data-oriented survey of context models[END_REF] (e.g. CoBrA, CoDaMoS, SOCAM). These works are grounded on RDF and provide in-depth context expressivity, but for chronological reasons they are far from the Web of Data best practices (e.g. no lightweight approach, limited interlinking with other vocabularies), thus discouraging the adoption and re-use in the Web community. Our work targets access control in the mobile Web of Data: we need therefore a context model compliant with the Web of Data paradigm [START_REF] Giunchiglia | Ontology driven community access control[END_REF]. Our context-aware access control framework adopts PRISSMA, a lightweight vocabulary originally designed for context-aware adaptation of RDF data [START_REF] Costabello | DC Proposal: PRISSMA, Towards Mobile Adaptive Presentation of the Web of Data[END_REF]. PRISSMA has been originally designed to express the contextual conditions under which activate a given representation for RDF [START_REF] Costabello | DC Proposal: PRISSMA, Towards Mobile Adaptive Presentation of the Web of Data[END_REF]. In this paper we propose context-based access policies, and we therefore need a vocabulary to model mobile context. We thus re-use classes and properties of the PRISSMA vocabulary for a different purpose, i.e. to represent contextual conditions for accessing RDF graphs. PRISSMA provides classes and properties to model core mobile context concepts, but is not meant to deliver yet another mobile contextual model: instead, well-known Web of Data vocabularies and recent W3C recommendations are reused (Figure 1). Moreover, it does not provide a comprehensive, exhaustive context representation: the approach is to delegate refinements and extensions to domain specialists. The overall context is modelled by the class prissma:Context and is determined by the following dimensions: 14 . Time is modelled extending the time:TemporalEntity class 15 . Other dimensions are considered: the motion property associates any given high-level representation of motion to a Environment. The proximity of an object might determine access restrictions: nearby objects are associated to the Environment with the nearbyEntity property. The Activity class consists in a placemark aimed at connecting thirdparty solutions focused on inferring high-level representations of user actions (e.g.'running', 'driving', 'shopping', etc). Further refinements and extensions are delegated to domain specialists (e.g. if dealing with indoor location, the room vocabulary 16 could be easily integrated).

Example 1. We now present an example of Access Policy with a conjunctive Access Condition Set associated to an Update privilege (Figure 2a). The policy protects the named graph :alice data and allows the access and modification of the named graph only if the consumer (i) knows Alice, and (ii) is not located near Alice's boss. Figure 2b visualizes a sample mobile context featuring all the dimensions described above. The user, Bob, knows Alice and is currently at work, near his and Alice's boss. Bob is using an Android tablet with touch display and he is not moving.

When dealing with mobile context, other issues need to be considered beyond context-model definition, such as context fetch, context trustworthiness and privacy. The present paper assumes that context data is fetched and pre-processed beforehand. PRISSMA supports both raw context data fetched directly from mobile sensors (e.g. GPS location, mobile features) and refined information processed on board or by third-party, server-side services (e.g. POI resolution or user activity detection). The trustworthiness of contextual information sent by mobile consumers should not be taken for granted. The User's identity needs to be certified: this is an open research area in the Web, and initiatives such as WebID 17 specifically deal with this issue. Hulsebosch et al. [START_REF] Heath | Linked Data: Evolving the Web into a Global Data Space[END_REF] provide a survey of context verification techniques (e.g. heuristics relying on context history, collaborative authenticity checks). A promising approach is mentioned in Kulkarni and Tripathi [START_REF] Korpipää | An Ontology for Mobile Device Sensor-Based Context Awareness[END_REF], where context sensors are authenticated beforehand by a trusted party. We plan to tackle the issue of context-verification in future work. Privacy concerns arise while dealing with mobile user context. We are aware that sensible data such as current location must be handled with a privacy-preserving mechanism. In the present proposition, we do not address this issue, nor the problem of context integrity.

Access Control Enforcement

Our Access Control Manager is designed as a pluggable component for SPARQL endpoints. The access control flow is described below (Figure 3):

1. The mobile consumer queries the SPARQL endpoint to access the content. Context data is sent with the query and cached as a named graph using SPARQL 1.1 update language statements. Each time a context element is added we use an INSERT DATA, while we rely on a DELETE/INSERT when the contextual information is already stored and has to be updated. Summarizing, the mobile client sends two SPARQL queries: the first is the client query to the datastore (e.g. Figure 5a), the second provides contextual information (e.g. Figure 2b). 2. The client query is filtered by the Access Control Manager instead of being directly executed on the SPARQL endpoint. 3. The Access Control Manager selects the set of policies affecting the client query, i.e. those with a matching Access Privilege. This is achieved by mapping the client query to one of the four Access Privileges defined by S4AC with the SPIN vocabulary. The Access Conditions (SPARQL ASK queries) included in the selected policies are executed. According to the type of Access Condition Set (i.e., conjunctive or disjunctive), for each verified policy, the associated named graph is added to the set of accessible named graphs. 4. The client query is sent to the SPARQL endpoint with the addition of the following clauses: Query execution is therefore performed only on the accessible named graphs, given the consumer contextual information. 5a, where Bob wants to access and modify the datastore (including Alice data :alice data, protected by the policies in Figure 2a) in such a way that all triples having dcterms:subject Concert tours are changed into dcterms:subject Music performance. Bob wants to perform such operation on the datastore from the context described in Figure 2b. When the query is received by the Access Control Manager, the latter selects the Access Policies concerning this query (for instance the policy shown in Figure 2a). The Access Conditions included in the policies are then coupled with a BINDINGS clause, as shown in Figure 4, where the ?context variable is bound to Bob's actual context. The identification of the named graph(s) accessible by Bob returns, for example, only the graph :peter data.

Alice data is forbidden because Access Conditions evaluation leads to a false answer with Bob's context (Bob is near Alice's boss). The Access Control Manager adds the USING, USING NAMED clauses to constrain the execution of the client query only on the allowed named graph(s), i.e., :peter data. The filtered client query is shown in Figure 5b.

Evaluation

To assess the impact on response time, we implemented the Access Control Manager as a Java EE component and we plugged it to the Corese-KGRAM RDF store and SPARQL 1.1 query engine19 [START_REF] Corby | The KGRAM Abstract Machine for Knowledge Graph Querying[END_REF]. We evaluate the prototype on an Intel Xeon E5540, Quad Core 2.53 GHz machine with 48GB of memory, using the Berlin SPARQL Benchmark (BSBM) dataset 3.1 20 .

In Figure 6a we execute 10 independent runs of a test query batch consisting in 50 identical queries of a simple SELECT over bsbm:Review instances (tests are preceded by a warmup run). We measure the response time with and without access control. When executed against the Access Control Manager, the test SPARQL query is associated to the mobile context described in Figure 2b. Each Access Policy contains exactly one Access Condition. In Figure 6a, to simulate a worst-case scenario, access is granted to all named graphs defined in the base (i.e. all Access Conditions return true), so that query execution does not benefit from cardinality reduction. Larger datasets are less affected by the delay introduced by our prototype, as datastore size plays a predominant role in query execution time (e.g. for 4M triples and 100 always-true Access Policies we obtain a 32.6% response time delay). Our solution is independent from the complexity of the incoming SPARQL query, as the only change we do is adding a list of FROM/FROM NAMED clauses (USING/USING NAMED for updates). Since we do not need to rewrite the query, the overhead is independent from query complexity. In a typical scenario, the Access Control Manager restricts the results In Figure 6b we assess the impact on performance for various levels of cardinality reduction, using modified versions of the BSBM dataset featuring a larger amount of named graphs (we define a higher number of bsbm:RatingSites, thus obtaining more named graphs). When access is granted to a small fraction of named graphs, the query is executed faster than the case without access control (e.g. if access is granted to only 1% of named graphs, the query is executed 19% faster on the 1M triple test dataset). As more named graphs and triples are accessible, performance decreases. In particular, response time is affected by the construction of the active graph, determined by the merge of graphs in FROM clauses. As shown in Figure 6b, the cost of this operation grows with the number of named graphs returned by the evaluation of the Access Policies.

In Figure 6c we analyse the overhead introduced on response time by queries executed in dynamic mobile environments. We execute independent runs of 100 identical SELECT queries, dealing with a range of context change probabilities. In case of a context update, the query is coupled with a SPARQL 1.1 update (Section 4). Not surprisingly, with higher chances of updating the context, the response time of the query grows, since more SPARQL queries need to be executed. The delay of INSERT DATA or DELETE/INSERT operations depends on the size of the triple store and on the number of named graphs (e.g. after a DELETE query, the adopted triple store refreshes internal structures to satisfy RDFS entailment). Performance is therefore affected by the number of active mobile users, since each of them is associated to a mobile context graph.

Conclusions

This paper presents an access control manager for RDF stores, designed as a pluggable filter for generic SPARQL endpoints. Our solution features context-aware control policies and relies only on Semantic Web languages, thus we do not add ad-hoc policy definition languages, parsers nor validation procedures. We protect triples by (i) relying on named graphs and (ii) by changing the semantics of incoming SPARQL queries, whose scope is restricted to triples included in accessible named graphs only. We add support for mobile context in control enforcement and we deliver fine-grained protection, up to triple level. Prototype evaluation shows that when the access is granted to a small fraction of named graphs, the query is executed faster than the case without access control. The delay introduced by our Access Control Manager grows with the number of Access Conditions in the system but has less impact on larger datasets while depending on the number of requesters. An effective backend user interface to define Access Policies has to be designed as user interaction issues should not be underestimated. Future work includes supporting the trustworthiness of context data sent by the mobile consumer and a privacy-preserving mechanism to handle mobile user context appropriately.

Figure 1 :

 1 Figure 1: The SHI3LD model at a glance (red boxes represent core classes).

Definition 2 .

 2 (Access Condition) An Access Condition (AC) is a condition which tests whether or not a query pattern has a solution. In the S4AC model, we express Access Conditions as SPARQL 1.1 ASK queries. Note that no query solution is returned, since SPARQL ASK only tests whether a solution exists. Definition 3. (Access Condition verification) If the query pattern has a solution (i.e., the ASK query returns true), then the Access Condition is said to be verified. If the query pattern has no solution (i.e., the ASK query returns false), then the Access Condition is said not to be verified. Each Access Policy P is composed by a set of Access Conditions, as defined in Definition 4. Definition 4. (Access Condition Set) An Access Condition Set (ACS) is a set of access conditions of the form ACS = {AC1, AC2, . . . , ACn}.

Definition 5 .

 5 (Conjunctive Access Condition Set) A Conjunctive Access Condition Set (CACS) is a logical conjunction of Access Conditions of the form CACS = AC1 ∧ AC2 ∧ . . . ∧ ACn. Definition 6. (Conjunctive ACS evaluation) A CACS is verified if and only if every contained Access Condition is verified. Definition 7. (Disjunctive Access Condition Set) A Disjunctive Access Condition Set (DACS) is a logical disjunction of Access Conditions of the form DACS = AC1 ∨ AC2 ∨ . . . ∨ ACn. Definition 8. (Disjunctive ACS evaluation) A DACS is verified if and only if at least one of the contained Access Conditions is verified.

Definition 10 .

 10 (Access Evaluation Context) An Access Evaluation Context (AEC) is a list of predetermined bound variables of the form AEC = ( var1, val1 , var2, val2 , . . . , varn, valn ).

Figure 2 :

 2 Figure 2: The Access Policy protecting :alice data (a) and Bob's sample mobile context in TriG notation (b).

Definition 12 .

 12 (User Dimension) The U ser represents the mobile requester associated to a Context and consists in a foaf:Person sub-class. It can model both stereotypes and specific users. Definition 13. (Device Dimension) The Device consists in a structured representation of the mobile device used to access the RDF store. The Device class inherits from W3C Delivery Context Ontology 13 dcn:Device, providing an extensible and fine-grained model for mobile device features and enabling device-specific access control. Definition 14. (Environment Dimension) The Environment is the model of the physical context in which the Web of Data resource consumption takes place. Different dimensions are involved in modelling the surrounding environment. Location is modelled with the notion of Point of Interest (POI). The POI class consists in a simplified, RDFized version of the W3C Point of Interest Core specifications

Figure 3 :

 3 Figure 3: The algorithm of access control enforcement in the SHI3LD architecture. FROM/FROM NAMED clauses for SELECT queries, to execute the query only on the accessible named graphs, given the contextual information associated to the consumer. Adding the FROM clause is not enough because, in case the client query includes a GRAPH clause, we need to specify the set of named graphs to be queried in a FROM NAMED clause, otherwise the query will be executed on all the named graphs of the store; USING/USING NAMED clauses for DELETE/INSERT, DELETE and INSERT queries. The clauses describe a dataset in the same way as FROM and FROM NAMED. The keyword USING instead of FROM in update requests has been chosen to avoid possible ambiguities which could arise from writing DELETE FROM 18 .

Figure 4 :

 4 Figure 4: The Access Conditions bound to the actual prissma:Context shown in Figure 2

Figure 5 :

 5 Figure 5: The SPARQL query issued by Bob's mobile client (a) and the filtered version (b).

Example 2 .

 2 An example of client query is shown in Figure

Figure 6 :

 6 Figure 6: Response time overhead of a query.In Figure6bwe assess the impact on performance for various levels of cardinality reduction, using modified versions of the BSBM dataset featuring a larger amount of named graphs (we define a higher number of bsbm:RatingSites, thus obtaining more named graphs). When access is granted to a small fraction of named graphs, the query is executed faster than the case without access control (e.g. if access is granted to only 1% of named graphs, the query is executed 19% faster on the 1M triple test dataset). As more named graphs and triples are accessible, performance decreases. In particular, response time is affected by the construction of the active graph, determined by the merge of graphs in FROM clauses. As shown in Figure6b, the cost of this operation grows with the number of named graphs returned by the evaluation of the Access Policies. In Figure6cwe analyse the overhead introduced on response time by queries executed in dynamic mobile environments. We execute independent runs of 100 identical SELECT queries, dealing with a range of context change probabilities. In case of a context update, the query is coupled with a SPARQL 1.1 update (Section 4). Not surprisingly, with higher chances of updating the context, the response time of the query grows, since more SPARQL queries need to be executed. The delay of INSERT DATA or DELETE/INSERT operations depends on the size of the triple store and on the number of named graphs (e.g. after a DELETE query, the adopted triple store refreshes internal structures to satisfy RDFS entailment). Performance is therefore affected by the number of active mobile users, since each of them is associated to a mobile context graph.

  9]:11 dbpedia.org is the RDFized porting of Wikipedia.

	:policy1 a s4ac:AccessPolicy;	ACCESS POLICY
	s4ac:appliesTo :alice_data;	RESOURCE TO PROTECT
	s4ac:hasAccessPrivilege [a s4ac:Update];	ACCESS PRIVILEGE
	s4ac:hasAccessConditionSet :acs1.
	:acs1 a s4ac:AccessConditionSet;
	s4ac:ConjunctiveAccessConditionSet;
	s4ac:hasAccessCondition :ac1,:ac2.	ACCESS CONDITIONS TO VERIFY
	:ac1 a s4ac:AccessCondition;
	s4ac:hasQueryAsk
	"""ASK {?context a prissma:Context.
	?context prissma:user ?u.
	?u foaf:knows ex:alice#me.}""".
	:ac2 a s4ac:AccessCondition;
	s4ac:hasQueryAsk
	"""ASK {?context a prissma:Context.
	?context prissma:environment ?env.
	?env prissma:based_near ?p.
	FILTER (!(?p=ex:ACME_boss#me))}""".
		(a)
	@prefix : <http://example/contextgraphs/bobCtx>
	[other prefixes omitted]
	<http://example/contextgraphs/bobCtx>{
	:ctx a prissma:Context;
	prissma:user :usr;
	prissma:device :dev;
	prissma:environment :env.
	:usr a prissma:User;
	foaf:name "Bob";
	foaf:knows ex:alice#me.
	:dev a prissma:Device;
	hard:deviceHardware :devhw;
	soft:deviceSoftware :devsw.
	:devhw a hard:DeviceHardware;
	dcn:display hard:TactileDisplay.
	:devsw a soft:DeviceSoftware;
	soft:operatingSystem :devos.
	:devos a soft:OperatingSystem;
	common:name "Android".
	:env a prissma:Environment;
	prissma:motion "no";
	prissma:nearbyEntity :ACME_boss#me;
	prissma:currentPOI :ACMEoffice.
	:ACMEoffice a prissma:POI;
	prissma:poiCategory example:Office;
	prissma:poiLabel example:ACMECorp.
	}

INRIA Sophia Antipolis, France, email: firstname.lastname@inria.fr

http://linkeddata.org

http://wimmics.inria.fr/projects/shi3ld/

http://www.w3.org/wiki/WebAccessControl

Ontologies details at http://bit.ly/vspecs

SHI3LD can be adapted to support other definitions of context, stemming from different scenarios.

http://bit.ly/w3rdfperm

The discussion about the use of named graphs in RDF 1.1 can be found at http://www.w3.org/TR/rdf11-concepts

http://bit.ly/graphterm

Reused ontologies details at http://bit.ly/reusedv

http://bit.ly/dc-ontology

http://www.w3.org/TR/poi-core/

http://www.w3.org/TR/owl-time

http://vocab.deri.ie/rooms

http://bit.ly/deleteinsert

http://tinyurl.com/corese-engine

http://bit.ly/berlin-sparql

ACKNOWLEDGEMENTS

The second author acknowledges support of the DataLift Project ANR-10-CORD-09 founded by the French National Research Agency.


Denis Besnard
email: denis.besnard@ncl.ac.ukcliff.jones@ncl.ac.uk

Cliff Jones

Designing dependable systems needs interdisciplinarity

Introduction

Modern computer-based systems pose a huge challenge to designers if they are to achieve dependability of the delivered service. These challenges are recognised for safety-critical systems such as medical devices, industrial process supervision workstations or autopilots. But even for systems where life is in not at stake, the need for properties like reliability, security, maintainability is becoming ever more pressing. Historically, a combination of methods derived from the purely technical fields of computing science, mathematics and statistics were used to provide some form of guarantee that the overall system will behave as prescribed. Human considerations were not totally overlooked from such approaches, but the increasingly intimate connection between the purely technical system and the humans surrounding it requires a more explicit consideration of psychological and social dimensions. Such questions as "Can users revert to manual mode?"; "Are the security features usable?"; "Does the system match established practices?" become crucial to the success of the overall computer-based system.

We outline an overview of the relevance of these questions in the workplace and emphasize the interest of an interdisciplinary approach to computer-based systems. We will draw on the wisdom acquired in a major interdisciplinary project to shed some light on the need for non-IT disciplines and their contribution to the understanding of dependability.

2.

The DIRC project and the dependability challenge DIRC1 is a multidisciplinary research project addressing the dependability of large computer-based systems. It gathers five British Universities into a 6-year consortium funded by EPSRC. The objective is to produce knowledge, methods and tools targeted at informing designers of computer-based systems about the risks, challenges and skills required to build and assess such systems.

DIRC brings a strong commitment to interdisciplinary approaches. Until the mid 1980's, there was an implicit design assumption that operators had to adapt to the tool with which they interact. Later, the ubiquity of computers made it evident that making computers usable required considerations going beyond computer science. IT designers need to understand the human component in socio-technical systems and therefore to communicate with other disciplines. It is this dialogue that DIRC advocates, by arguing that dependability of modern computer-based systems can no longer be achieved without interdisciplinarity.

Making automated agents cooperate with human operators is a real challenge and the question of making them cooperate reliably is still not entirely resolved. In order to better understand the challenges raised by this cooperation, three examples on which DIRC has produced publications are discussed. These highlight three different cases where dependability can be sub-optimal, namely the overriding of computer control by operators, trade-offs in security, and workarounds in assembly lines.

Comments on these examples will follow in Section 3 in which potential improvements and ways forward will be considered.

2.1. Operators reverting to manual mode [START_REF] Clarke | Dependable red hot action[END_REF] show how humans adapt their work to local contingencies. An ethnographic study was conducted of a steelworks factory producing steel slabs. The study focused on the use of a computer-driven rolling mill. Slabs are produced to a required size by rolling large metallic rolls in a series of passes. Because there is a variety of steel quality and slab dimensions, operators have developed various control strategies. For instance, operators sometimes bypass the computer and shift to manual mode for the final passes on slabs of a particular thickness. In doing so, they reduce the number of passes in order to avoid slabs taking a U-shape or turning up, which are occurrences that not always avoidable under computer mode. As quoted from [START_REF] Clarke | Dependable red hot action[END_REF]: "…because the computer, at less than 45, pisses about…does 4-5 passes…that's what's causing turn-up."

The work reported highlights how operators develop strategies that compensate for flaws in the automation. The latter may be fit-to-purpose under nominal work settings but adaptations are required for any other case. In this example, the adaptations performed by the operators prevent the occurrence of undesired outcomes. If such adaptations did not take place, the production would be (at best) much longer due to the necessary remaking of malformed slabs.

Usability trade-offs in IT security

Passwords are a widespread IT security mechanism. But their vulnerability normally hides beyond purely technical considerations: when one looks at how passwords are used in the workplace, human cognitive limitations become obvious. Users cannot remember long or randomly generated passwords and resort to external aids such as sticky notes on monitors. Generally speaking, the use of passwords raises several usability problems. Ultimately, security faces a paradox where by increasing the complexity and number of passwords, the level of protection can actually decrease [START_REF] Weirich | Pretty good persuasion: A First Step Towards Effective Password Security in the Real World[END_REF]. Users who write down passwords act on the basis of an equation where risks, costs and benefits are core factors. Given their perception of risk, users trade-off the cost of memorising passwords against the benefits of seeking ease-of-work [START_REF] Besnard | Computer security impaired by legal users[END_REF]. Similar trade-offs apply to file sharing, patching software or updating anti-virus software. The picture seems to be that risk-unaware users seek immediate benefits at the potential cost of expensive failures. Their behaviour can be seen as driven by a rule of least effort where a security measure standing in the way of accomplishing the main task is unlikely to be followed. [START_REF] Voß | Dependability as ordinary action[END_REF] carried a field study of a company assembling diesel engines and relying on a computer-based tool to track orders, deadlines, special customisations for particular customers, etc. The tool is used to control the production process, from the management of the stocks all the way down to delivery dates. The software is designed in such a way that all the parts needed for an engine have to be in-stock before the assembly can begin. This is sometimes an unworkable constraint for the operators who can work on areas of an engine for which parts are available. However, because the software system does not allow this sort of ad-hoc adaptations to contingencies, operators were forced to make up items "in stock" for the parts that were missing in order to continue the assembly (Later, when the missing parts get delivered, they are mounted on the engine and the stock is set back to zero). Procedures do not rule human behaviour [START_REF] Fujita | Actualities need to be captured[END_REF]. Humans do not obey rules if the latter are perceived to obstruct the accomplishment of a task. Here, the cost of waiting is avoided by a deviation from the procedure. When this happens, it is usually a symptom that the tools and procedures in use do not match the operators' needs or intentions. This mismatch, which often involves managerial decisions [START_REF] Reason | A systems approach to organized error[END_REF], has already caused very serious accidents in other areas of the industry (see the Tokaimura incident report by [START_REF] Furuta | Analysis report[END_REF].

Workarounds in assembly lines

The future of dependable systems

From the viewpoint of computer system design policy, dependability does not rely solely on technological inventions but also in further improvements in the way the range of human particularities is reflected in the technology. This requires taking into account the inputs from a number of disciplines.

The three examples described above are now reviewed and possible ways forward suggested.

Reverting to manual in process control

The steelworks factory study shows how an acceptable level of dependability is achieved in the service through an ad-hoc collaboration between human operators and an imperfect piece of technology. Dependability of service (producing correctly shaped metallic slabs, in this instance) is not a property of a technical artefact but the outcome of a collaboration between human agents and imperfect machines.

In this respect, dependability is just an ideal -yet valuable -objective. The reality is that the service, via human compensations for incorrectness, is made less undependable.

3.2. Improving the human side of security Security must be user-centred [START_REF] Zurko | User-Centred Security[END_REF]. Generally speaking, the design of security products and policies should rely more on the rules of human-computer interaction. Passwords must be, at least, easy to remember and reduced in number as much as possible. As far as end-users are concerned, the ideal number of passwords is zero, so any measure getting closer to an effortless security is a step forward to better security in general. As a design principle, end-users should not be expected to contribute to security. The latter should be transparent for whom it is not the primary task.

3.3. Workarounds as symptoms of system's flaws Workarounds are unsupported configurations. They are violations revealing a lack of flexibility and a need for configurability. One way of avoiding violations and dangerous workarounds is to design around human practices. If this is not a design decision, it will be enforced in an ad-hoc manner by users, out of any control. Integration of practices into design is not a novel idea but [START_REF] Voß | Dependability as ordinary action[END_REF] experienced and extended the concept to that of a long-term immersion of the designer into the work context.

Conclusion

This paper has presented three cases where DIRC investigated the dialogue between humans and some form of automation. Therefore, the technical aspects of the failures described herein only account, if at all, for a portion of the picture. Within the scope of this paper, a range of human factors are needed in order to capture the complexity of designing dependable computer-based systems. This article is hoped to convince one that:

• Dependability of service is not a solely technical notion;

• Simple usability issues impair security;

• Workarounds happen whenever tools do not match work practices. For the sake of clarity, the examples presented above are discrete ones. However, they usually appear jointly in large systems, at different organisational layers, and at various degrees of visibility. Identifying them and reconciling them are the challenges and this is why interdisciplinarity is needed. DIRC is advocating for more and more effort to be allocated to acknowledging the non-IT factors involved in the lifecycle of large computer-based systems. The hope is that the future dependability of technical socio-technical systems will overcome one of its current weakest links: the integration of human-related issues to the design of complex computer-based systems.

Dependability: an Interdisciplinary Research Collaboration. Visit DIRC at www.dirc.org.uk


Mathieu Sellier
email: mathieu.sellier@canterbury.ac.nz

Volker Nock

Cécile Gaubert

Claude Verdier

Droplet actuation induced by coalescence: experimental evidences and phenomenological modeling

This paper considers the interaction between two droplets placed on a substrate in immediate vicinity. We show here that when the two droplets are of different fluids and especially when one of the droplet is highly volatile, a wealth of fascinating phenomena can be observed. In particular, the interaction may result in the actuation of the droplet system, i.e. its displacement over a finite length. In order to control this displacement, we consider droplets confined on a hydrophilic stripe created by plasma-treating a PDMS substrate. This controlled actuation opens up unexplored opportunities in the field of microfluidics. In order to explain the observed actuation phenomenon, we propose a simple phenomenological model based on Newton's second law and a simple balance between the driving force arising from surface energy gradients and the viscous resistive force. This simple model is able to reproduce qualitatively and quantitatively the observed droplet dynamics.

Introduction

Microfluidic devices play an ever increasing role in nano-and biotechnologies. An emerging area of research in this technology-driven field is digital microfluidics which is based upon the micromanipulation of discrete droplets. Microfluidic processing is performed on unit-sized packets of fluid which are transported, stored, mixed, reacted, or analyzed in a discrete manner. An obvious challenge however is how to displace the sessile droplets on a substrate. This work investigates a little explored driving mechanism to actuate droplets: the surface energy gradient which arises during the coalescence of two droplets of liquid having different compositions and therefore surface tensions. The resulting surface energy gradient gives rise to a Marangoni flow which, if sufficiently large, can displace the droplet in analogy to thermocapillary actuation which has been extensively studied, see for example the review of Darhuber and Troian, [1], or the recent paper of Gomba and Homsy, [2].

One of the earliest documented observations of the displacement induced to a droplet placed in the vicinity of another one dates back to work of Bangham and Saweris, [3]. The authors described qualitatively the motion of a water droplet on a mica substrate induced by the nearby presence and possible coalescence of a droplet of 60% acetic acid. They postulated the presence of a very thin film connecting the two droplets. The problem was recently revisited by Bahadur and co-workers, [4], who attempted to unequivocally answer the question of whether the induced motion is the result of the presence of a thin connecting film or transport phenomena through the atmosphere as suggested by Carles and Cazabat, [5]. Their results emphasized the importance of the thin film but could not disregard the role played by the atmosphere since the volatile phase tends to condense on the substrate. The advent of microfluidics has marked a renewed interest in droplet research. In that context, Riegler and co-workers investigated the coalescence of droplets of different fluids. They paid a particular attention to the occurrence of fast or delayed coalescence, [6,7], noting the possible motion of one of the droplets. Lai et al. investigated the mixing potential of coalescing droplets on a surface with a wettability gradient, [8]. Finally, the work of Bico and Quéré deserves special mention as it is the closed configuration analogue of the work presented here, [9,10]. The authors observed and analyzed the spontaneous motion of liquid slugs induced by their interaction with a slug of a different fluid. The authors focused on flows confined in capillaries or between parallel plates (Hele-Shaw configuration).

Recently, the coalescence of miscible droplets was investigated theoretically in [11] and it was shown that two important dimensionless parameters govern the actuation mechanism. The first one reflects the magnitude of surface tension gradient which is the driving mechanism and the second one, equivalent to a Peclet number, is representative of the importance of diffusion. Clearly, the numerical results indicated that the larger the surface tension gradient, the faster and the longer the motion. Diffusion, on the other hand, had an adverse effect since it tends to homogenize surface tension and ultimately stop the droplet motion. The work of [11] established the "theoretical" existence in the parameter space of a self-propulsion window and the natural follow-up study was to demonstrate experimentally these phenomena. The object of this paper is to report on this experimental work and lay the basis of a simple phenomenological model which attempts to capture some of the underlying physics.

Experimental evidences

Observations on the coalescence of droplets of different fluids

The idea of the experiment is elementary and illustrated in Fig. 1. A droplet of Fluid 1 with an approximately known volume was pre-positioned on a substrate using a micro-pipette. A droplet of Fluid 2 was then deposited with a micro-pipette also in the immediate vicinity of the Fluid 1 droplet. The flow dynamic was captured using a high-speed camera. The experiments are performed in open, uncontrolled atmospheric conditions on a horizontal substrate. A range of fluid combinations, miscible or immiscible, and substrates were tested. A wealth of fascinating phenomena was observed during the coalescence. These are highlighted in a video which can be viewed at http://www.youtube.com/watch?v=E33FxyqXLfw. Some of the most striking features which were observed include:

-Spreading reversal: for water-ethanol on a Teflon substrate, the initially rapid coalescence and outward spread is followed by a recession of the contact line (inward spread). -Transition from static to transient states: for water-ethanol on a PMMA subtrate, the initial coalescence is followed by a relatively long static period during which the droplet does not deform but spreading ultimately resumes reaching a different final equilibrium state. -Chaotic transport and clustering: chaotic transport of small particles seeded in a water droplet coalescing with an ethanol droplet. The particles ultimately cluster in the contact line region. -Contact line fingering and free surface turbulence: for a toluene-silicone oil system on a glass substrate, the interaction of these two immiscible fluids is very peculiar. The toluene front reacts with the silicone oil droplet literally pushing it away. Fingering instabilities are clearly visible at the toluene contact line.

This qualitative description and the range of other combinations we studied allowed us to draw several preliminary observations/conclusions:

-As expected, droplet actuation is more likely on a highly-wettable substrate with a low apparent contactangle hysteresis. -Actuation over significant distances was only achieved when the actuating fluid was volatile indicating the importance of the vapour phase in the induction of the surface energy gradient. In some of our experiments, the actuated droplet could be displaced by simply approaching (without touching or depositing) the actuating droplet. -The motion only lasts a limited amount of time clearly showing that the surface energy gradient is a short lasting phenomenon. -In some cases, no apparent thin film connects the actuating and the actuated droplets.

It is clear from basic physics considerations that two mechanisms may be responsible for the observed motion. The first one is related to the evaporation of the actuating volatile droplet. The vapour of the volatile droplet diffuses through the surrounding air contaminating the free surface of the other droplet and the substrate. The condensation of the vapour on the substrate results in a one-sided variation of the contact angle of the actuated droplet. This breaks the symmetry of the droplet and creates a pressure gradient which induces propulsion. The local contamination of the free surface by the vapour also creates a surface tension gradient and Marangoni stresses which tend to displace the fluid. The second important mechanism is a consequence of the actual mixing of the two droplet which creates a surface tension gradient. Since the system loses its symmetry during the coalescence, the capillary forces exerted on the contact line does not balance on either side and the bi-drop is "pulled" towards the highest surface tensions. The atmosphere plays a passive role in this second mechanism. This mechanism is the one observed by Bico and Quéré in confined configurations (bi-slugs in capillaries or between parallel plates), [9,10].

Motion control using substrate patterning

From a potential microfluidic application perspective, the motion of the droplet needs to be controlled in some sense. The most convenient way to achieve this motion control is to create hydrophilic stripes on the substrate. This was achieved by plasma-treating the exposed surface of a PDMS substrate. PDMS substrates were prepared by mixing Sylgard 184 (Dow Corning) base and curing agent in a 10:1 w/w ratio. The pre-polymer mixture was degassed and poured into round PS culture trays, followed by further degassing. The PDMS was cured 3 h at 65 • C in a convection oven. After removal from the oven, substrates were left 24 h at room temperature before use. Rectangular samples of PDMS were cut out using a scalpel and placed upside down onto standard glass microscope slides for handling. Glass coverslips were used to pattern areas of variable surface energy on the PDMS sample. This was performed by bringing the coverslips in reversible contact with the PDMS and exposing the samples to air plasma for 30 s at 100 W. Areas covered by glass remain hydrophobic, while uncovered areas turn hydrophilic. After plasma treatment, the coverslips were peeled off.

The most successful fluid combination on these hydrophilic highways was found to be water and ethanol. Fig. 2 shows a top view of the coalescence on subsequent motion on the stripe. The time sequence reads from top to bottom. The distilled water droplet (labelled DI in Fig. 2) is first placed on the stripe. The ethanol droplet (labelled EtOH) is deposited to the left of the water droplet (it is barely visible because of the lack of contrast). The water droplet is clearly seen to move to the right-hand side of the stripe. In some cases the motion could last over long distances (up to 10 times the initial droplet diameter). The side view of the phenomenon, shown in Fig. 3, offers greater insight into the dynamics of the droplet. In particular, it is possible to measure the evolution of the advancing and receding contact lines. A side view video of the droplet motion can be seen at http://www.scivee.tv/node/26233. Images were post-processed using the ImageJ program, [12]. Figure 4 shows the position of the front and rear contact lines as a function of time and the corresponding contact line velocity for the actuated droplet (the water droplet on the right-hand side). A number of interesting features can be observed. The contact line closest to the ethanol (left-hand contact line) starts moving before the right-hand contact line. This results in an initial contraction of the droplet (up to 2 s). The water droplet then starts to move with a near constant diameter (distance from left-hand to right-hand contact lines). The initial motion is quite rapid. The velocity peaks at about 6 mm/s and then decays in an exponential fashion towards zero. This trend was repeatedly observed for several data sets and is in a sense the expectation from [11].

The surface treatment enables a control of the actuated droplet trajectory as can be seen in Fig. 5 which illustrates the distilled water droplet going around a 90 o corner after the deposition of an ethanol droplet at the top of the pictures. The prospect to manipulate droplets on patterned surfaces opens up interesting opportunities in the field of microfluidics. The following section presents an initial modeling attempt.

Phenomenological model

This section describes a simple model capturing the velocity variation shown in Fig. 4. In order to shed some light on the underlying physics, we consider the simpler quasi-two-dimensional system shown in Fig. 6 which consists of a water droplet interacting with an ethanol droplet and follow an analysis analogous to the one presented in [START_REF] De Gennes | Quéré Capillarity and Wetting Phenomena: Drops, Bubbles, Pearls, Waves[END_REF][START_REF] Ford | [END_REF] for thermocapillary actuation. The proposed scenario is that, as the ethanol droplet approaches the water droplet, it modifies the local surface energies and induces the water droplet motion. Experimentally, it is observed that the water droplet shape does not vary much once it has been actuated and therefore, it will be assumed that the droplet profile remains constant in the following. The motion is the results of a balance between the surface energy driving force, F d , and the viscous resistive force, F r . Accordingly, Newton's second law requires that

m dV dt = F d -F r , (1)
where V is the actuated droplet velocity and m its mass. The driving force on the water droplet can be expressed as where w is the width of the hydrophilic stripe, θ a and θ r the advancing and receding contact angles for the water droplet (on the right-hand side and left-hand side in Fig. 6, respectively) and γ B and γ A the respective surface tensions there. The resistive force is estimated by calculating the shear force exerted by the substrate on the droplet. The flow field is best inferred in a reference frame centered at the droplet centre which moves with velocity V . Assuming a unidirectional flow on the hydrophilic stripe, the lubrication approximation enables the evaluation of the velocity profile. Accordingly,

F d = w (γ B cos θ a -γ A cos θ r ) , (2)
µu(z) = 1 2 dp dx z 2 -2zh + dγ dx z -µV , (3)
where µ is the dynamic viscosity, dp dx the pressure gradient yet to be determined, and dγ dx the surface tension gradient. This velocity profile satisfies the continuity of tangential stress at the free surface and the no-slip condition at the substrate. The pressure gradient in the velocity profile can be inferred by invoking the conservation of mass. After some algebraic manipulation, the wall shear stress τ w is found to be given by

τ w = 3µV h - 1 2 dγ dx . (4)
Finally, the resistive force is found by integrating the wall shear stress over the whole footprint of the droplet,

F r = R-ǫ -R+ǫ w 2 -ǫ -w 2 +ǫ τ w dxdy . (5)
Following [15,16], we introduce the cut-off length ǫ to circumvent the stress singularity at the contact line. This length is representative of the region where the no-slip condition is expected to break down and is therefore expected to be on the order of molecular dimensions. At this stage, some assumptions are necessary regarding the droplet profile. Because the width of the hydrophilic channel is smaller than the characteristic Capillary length, it is safe to assume that the cross-flow droplet profile will be parabolic and following Darhuber and co-workers, [17], we express the droplet thickness profile as

h(x, y) = h c (x) 1 -4 y 2 w 2 , ( 6
)
where h c (x) is the droplet centreline profile. Substituting eq. ( 4) into eq. ( 5) along with the assumed droplet shape (eq. ( 6) leads to

F r = - w 2 (γ B -γ A ) + w 2 log w -ǫ ǫ 3µV R-ǫ -R+ǫ 1 h c dx . (7)
Moreover, following Ford and Nadim in [START_REF] Ford | [END_REF], we assume the droplet to have approximately a parabolic profile such that

h c (x) = tan θ s 2R R 2 -x 2 , ( 8
)
where θ s is the static contact angle. With this final assumption regarding the droplet profile, eq. ( 7) may finally be written as

F r = - w 2 (γ B -γ A ) + log w -ǫ ǫ log 2R -ǫ ǫ 3wµV tan θ s . ( 9
)
Finally, combining eqs. ( 1), (2), and ( 9), we obtain

m dV dt = w (γ B cos θ a -γ A cos θ r ) + w 2 (γ B -γ A ) -log w -ǫ ǫ log 2R -ǫ ǫ 3wµV tan θ s . (10)
As the velocity peaks for dV dt = 0, this condition allows us to estimate the peak velocity V max which is given by

V max = tan θ s 3µK (γ ⋆ B cos θ a -γ ⋆ A cos θ r ) + 1 2 (γ ⋆ B -γ ⋆ A ) , with K = log w -ǫ ǫ log 2R -ǫ ǫ , (11)
where the ⋆ indicates surface tension values evaluated at the time when the velocity peaks. If we assume that θ a = θ s -∆θ and θ r = θ s + ∆θ where ∆θ is small, we can also rewrite the peak velocity as follows:

V max = tan θ s 3µK (γ ⋆ B -γ ⋆ A ) cos θ s + 1 2 + (γ ⋆ B + γ ⋆ A ) sin θ s ∆θ . (12)
From this expression, we conclude that the peak velocity increases with the surface tension difference (γ Bγ A ). This conclusion was also predicted in [11]. The peak velocity also increases with the static contact angle, and the contact angle difference ∆θ. On the other hand, the peak velocity decreases with the viscosity as intuitively expected. Interestingly, it can be noted that this peak velocity appears to be independent of the width of the hydrophilic channel. The reason for this is that both forces vary linearly with the width of the channel. Note that this observation was confirmed experimentally as no discernable effect of the channel width on the distance traveled was observed.

With the assumed droplet profile, the mass can easily be expressed in terms of observable quantities according to

m = ρ 8 18 w tan θ s R 2 . (13)
Equation ( 10) is a simple ordinary differential equation which can easily be integrated but the question now arises as to how to compute γ A and γ B . As a first approximation, we make the assumption that the ethanol vapour "dissolves" in water on the ethanol side thereby decreasing the surface tension. Only a limited amount c sat of ethanol is able to dissolve. In the proposed scenario, the ethanol vapour diffuses through the surrounding atmosphere with a diffusion constant D and progressively contaminates the water droplet free surface thereby decreasing its surface tension. We assume this diffusion process to be one-dimensional as a first approximation (i.e. uniform ethanol concentration across the droplet cross-section). Accordingly, the ethanol concentration satisfies

∂c ∂t = ∂ ∂x D ∂c ∂x , (14)
c(x, t = 0) = 0 ,

(x = x A , t > 0) = c sat , ( (15) c
) ∂c ∂x | x b = 0 . 16
The left-hand boundary condition implies that on the ethanol side, the ethanol concentration is equal to c sat and the right-hand condition is essentially a no-flux boundary condition. This diffusion equation admits the following analytical solution, [START_REF] Kreyszig | Advanced Engineering Mathematics[END_REF]:

c(x, t) = c sat -c sat ∞ n=0 B n sin (2n + 1) πx 4R exp -(2n+1) 2 π 2 Dt 16R 2 , with B n = 4 (2n + 1)π . ( 18
)
surface tension of this water-ethanol mixture is reported in [START_REF] Vasquez | [END_REF] and well approximated by

γ mix (c) = 0.023 + 0.047 exp -c 0.1713 . ( 19
)
Using eqs. (10), [START_REF] Kreyszig | Advanced Engineering Mathematics[END_REF], and [START_REF] Vasquez | [END_REF], the variation of the droplet velocity with time can be computed for given values of the advancing and receding contact angles. These are taken to be time-averaged values over the picture sequence extracted from the recorded video (see Fig. 3 for two such pictures). Accordingly, the advancing contact angle θ a is taken as 34 o and the receding one θ r as 35 o . The static contact angle is chosen to be the average of the advancing and receding ones. The droplet radius, also averaged over time, is 1.3 mm. The dynamic viscosity is chosen to be that of water, i.e. 10 -3 Pa.s. This model has three parameters for which only limited knowledge is available:

-The cut-off length ǫ. This cut-off length is representative of a molecular length scale. We choose here a value of 10 -9 m which is comparable to the values chosen in [15]. -The diffusion constant D. Reasonable values of diffusion constants for the vapour of various volatile liquids have been reported in [20] and many typical values are close to 3 × 10 -6 m 2 /s. We therefore choose here this particular value. Note that diffusion in the liquid bulk is order of magnitude slower. -The saturation concentration c sat . This introduced parameter is the least quantifiable one and it will serve as a fitting parameter.

The differential equation ( 10) is simply solved using the ode45 MATLAB routine. Results reported in Fig. 7 are only for the exponential decay which follows the velocity peaks observed in Fig. 4. The left-hand graph with c sat = 0.012 reproduces very closely the experimentally observed velocity peak and the velocity decay. The peak velocity is most influenced by the value of c sat as larger values of this parameter result in a larger surface tension difference between both ends of the droplets and therefore a greater driving potential. This is observed on the right-hand graph of Fig. 7 which shows that the peak velocity increases by a factor of two as c sat is increased from 0.012 to 0.04. It should be noted that this low value of c sat implies that a relatively small surface tension gradient is actually present at the water droplet surface. This surface tension gradient is on the order of 1.2×10 -3 N/m/mm. The diffusion constant on the other hand has most effect on the time constant in the velocity decay as intuitively expected.

Conclusions

This paper discusses an actuation mechanism with potential application in the field of microfluidics. This mechanism relies on the surface energy gradient which arises when two droplets are placed in immediate proximity and coalesce. We have studied a wide range of fluid systems and observed complex phenomena including spreading reversal, transitions from static to transient states, chaotic particle transport, particle clustering at the contact lines, contact line fingering, and free surface turbulence. The most reactive fluid combinations always involved a volatile fluid phase indicating the importance of the participating atmosphere. With microfluidics application in mind, we also presented a possible way to control the induced motion of one of the droplets by creating a hydrophilic "highway" on a PDMS substrate. We have shown that this is a convenient way to control the droplet motion in straight line but also on more complex paths such as a corner. Concentrating on the simplest case of a water droplet actuated by an ethanol droplet on a straight hydrophilic channel, we observed that the water droplet velocity rapidly reaches a maximum value of around half a centimeter per second and then slowly decays in an apparent exponential fashion over a period of around 6 seconds. Note that although only one case was presented in detail, this trend was repeatedly observed. In order to explain the underlying physics, we have developed a simple model based on Newton's second law applied to the water droplet and taking into account the driving force resulting from gradients of surface energies and the viscous resistive force. In this simple model, one unknown parameter, c sat , served as an adjustable parameter that allowed the model to closely capture the dynamics of the water droplet and predicts the effect of various parameters such as the viscosity, the contact angles, or the surface tension gradient on the peak velocity. The results of the model suggest that the decrease of surface tension of the water droplet on the ethanol side is quite small, on the order of 0.0032 N/m.

Fig. 1 .

 1 Fig. 1. Principle of the experiments: a droplet of water deposited in the middle of an hydrophilic channel is actuated by a droplet of ethanol dropped nearby.

Fig. 2 .

 2 Fig. 2. Picture sequence showing from above the actuation of the water droplet by an ethanol droplet on an hydrophilic highway.

Fig. 3 .

 3 Fig. 3. Side view of the water droplet actuated by the ethanol droplet at two different times. The water droplet moves from left to right.

Fig. 4 .

 4 Fig. 4. Position and velocity of the left-hand and right-hand contact lines.

Fig. 5 .

 5 Fig. 5. Distilled water droplet forced around a 90 o corner.

Fig. 6 .

 6 Fig.6. Sketch of the droplet system and notations.

Fig. 7 .

 7 Fig. 7. Comparison of the experimentally measured droplet velocity (red dots) and the theoretically predicted one (blue line). The left hand figure is for csat = 0.012, and the right-hand one for csat = 0.04.

Acknowledgements

The authors gratefully acknowledge the support of the Royal Society of New Zealand through a Marsden Grant (Grant number UOC1104).