J.-R Chardonnet
email: jean-remy.chardonnet@ensam.eu

J.-C Leon

Monitoring a Realistic Virtual Hand using a Passive Haptic Device to Interact with Virtual Worlds

Keywords: navigation device, passive haptics, interaction, manipulation

We present a prototype of a hands-on immersive peripheral device for controlling a virtual hand with high dexterity. This prototype is as easy as a mouse to use and allows the control of a high number of degrees of freedom (dofs) with tactile feedback. The goals corresponding to design issues, physiological behaviors, include the choice of sensors' technology and their position on the device, low forces exerted while using the device, relevant multi-sensorial feedback, performance of achieved tasks.

Introduction

Our hands are an essential tool to interact with our environments, for example to manipulate objects. However, interactions may not be easy because for the same object there are generally different possible grasping configurations. This issue still remains a great challenge in virtual reality as current devices, e.g., [START_REF] Schlattman | Simultaneous 4 gestures 6 dof real-time two-hand tracking without any markers[END_REF][START_REF] Bouzit | The Rutgers Master II-new design force-feedback glove[END_REF], and software do not allow reproducing in a natural and realistic way a grasping motion in virtual environments and they are not devoted to general audience use.

Our proposed solution is based on a passive haptic feedback and a hands-on interaction. We present an extension of the HandNavigator described in [START_REF]Design of an immersive peripheral for object grasping[END_REF]. Unlike [START_REF] Schlattman | Simultaneous 4 gestures 6 dof real-time two-hand tracking without any markers[END_REF], we conducted validation tests of the existing prototypes on grasping tasks scenarii, to obtain the design of new requirements of the HandNavigator with a more ergonomic shape, sensors improving dexterity and interactions, while integrating tactile feedback for an enhanced immersion.

Design of the new prototype

Validation tests on previous versions pointed out several issues that are: the choice of sensors' technology, minimization of muscular efforts and the inclusion of tactile feedback. We designed a new prototype, called V4, where several sensors are used to control each finger: a lever-switch for controlling the virtual finger in a free motion mode, with a low displacement amplitude of a real finger, a vibrator to give the user a tactile feedback when a finger touches a virtual object, and a pressure sensor for controlling the virtual finger in a constrained motion configuration (typically when the user holds a virtual object) and to give the user grasp feelings. All these sensors are integrated in a module depicted in Figure 1. There is one module for each finger, altogether four modules. A spring between the lever-switch and the pressure sensor separates free motion mode and constrained hand motion mode. We added a siliconbased coating on the device as damping material to isolate each finger and prevent vibrations from propagating in the whole structure, so that the user can immediately know which finger touches a virtual object.

We tested our device on a simple scenario where the goal is to position a virtual hand on a part coming from a food processor. A comparison between the real hand configuration and the virtual one achieved using our device is depicted on Figure 2.

Figure 1 .

 1 Figure 1. Our new prototype (on the left, a module for one finger).

Figure 2 .

 2 Figure 2. Configuration of a real/virtual hand for object grasping.


L Trevisan
email: lucile.trevisan@g-scop.grenoble-inp.fr

A Lelah

D Brissaud

Service Delivery and Co-Creation to support Value and Sustainability in PSS design

Keywords: Product-Service Systems (PSS), Sustainability, Value, Service delivery, Co-creation, Design

Product-Service Systems are considered as facilitators for value creation to attain sustainability. This paper studies how service delivery and the co-creation process are two means of enhancing the design of valuable and sustainable solutions. The paper shows how service delivery and cocreation process are both in the core of the interaction between the provider and the customer and can be considered as levers to create "sustainable value". The case of a firm proposing clothes rental and cleaning services is reviewed in this light.

INTRODUCTION

The rarefaction of natural resources all over the world has become a major concern today. Maintaining these resources on a level sufficient to enable their regeneration and thus their availability for future generations is a key issue in developed countries.

The concept of "sustainable development" emerged in the 80's to promote economic development which reduces environmental impacts and provides social welfare. Industrial solutions need to be found to support this kind of development. Manufacturing in developed countries is confronted to global competition, which leads manufacturers to find new strategies for providing additional value to their customers. Therefore, more and more manufacturers are integrating services in their product offers. Indeed, in a service-oriented strategy, the utility provided by the product has more perceived value for customers than the product itself. This new focus is centred on final user's needs instead of on products. It enhances innovation to find sustainable solutions fulfilling needs. In this approach, products as well as services are seen as an opportunity for integrated offerings called Product-Service Systems (PSS). Two goals are defined behind the PSS concept: adding customer value and reducing environmental impacts. On one hand, value is seen as the result of interactions between the producer and the customer and not as being embedded in the product. On the other hand, the notion of environmental sustainability drives PSS seeking to replace solutions based on ownership by offers with a lower impact but providing similar benefits for the customer. However, a fully integrated offer covering these two goals is complex. Manufacturers have to put the emphasis on design. Design considerations are the key to valuable and sustainable PSS. Figure 1 summarizes the approach followed in this paper to study service delivery and the co-creation process as key PSS design stages.

Figure 1: Linking PSS issues with design. Following this introduction, this paper explores in Section 2 the PSS definitions and the notions of value and sustainability as key issues in the PSS literature. Then Section 3 put the emphasis on the importance of design and details how service delivery and co-creation can meet the PSS issues. Section 4 shows how service delivery and cocreation can support sustainable value creation. An existing case is presented and retrospectively analyzed in Section 5 to illustrate this idea. Finally the interpretation of the case is discussed in Section 6.

KEY PSS ISSUES

PSS Definition

Product Service Systems have several definitions in literature. While some authors see in these systems a new business model transforming the economy, others consider that a functional approach is a lever to achieve more sustainable production and consumption patterns [START_REF] Tukker | New Business for Old Europe. Product-Service Development as a means to enhance competitivness and eco-efficiency[END_REF], [START_REF] Chesbrough | The role of the business model in capturing value from innovation: evidence from Xerox Corporation's technology spin-off companies[END_REF], [START_REF] Brady | Creating value by delivering integrated solutions[END_REF], [START_REF] Mont | Institutionalisation of sustainable consumption patterns based on shared use[END_REF], [START_REF] Vasantha | A review of productservice systems design methodologies[END_REF]. The term "servitization" was employed by Vandermerwe and Rada to express the fact that services take an important place in manufacturing firms to help them face competitive pressure. This service-based model implies changes in thinking about what is put on the market. Producers offer a value proposition, selling use of the product instead of the product itself and directly focus on customer needs [START_REF] Vandermerwe | Servitization of business: Adding value by adding services[END_REF]. In this context, PSS, proposing a mixture of products and services, are considered to be a special case of servitization [START_REF] Baines | State-of-the-art in productservice systems[END_REF]. Two research streams have studied new models for companies in developed countries: the business management literature and the sustainability-oriented literature [START_REF] Tukker | New Business for Old Europe. Product-Service Development as a means to enhance competitivness and eco-efficiency[END_REF]. The business literature defines PSS as a "value proposition" [START_REF] Chesbrough | The role of the business model in capturing value from innovation: evidence from Xerox Corporation's technology spin-off companies[END_REF] or "integrated solutions" [START_REF] Brady | Creating value by delivering integrated solutions[END_REF]. The sustainability-oriented literature mentions the necessity for a PSS to decrease the environmental impact in comparison with traditional solutions [START_REF] Mont | Institutionalisation of sustainable consumption patterns based on shared use[END_REF]. Vasantha et al. described the multiple elements involved in the PSS, where "innovative value addition" that is economical, environmental and social, encompasses the products, services and business models [START_REF] Vasantha | A review of productservice systems design methodologies[END_REF]. In this paper, we take that the role of PSS is to provide value. We define PSS as integrated offers seeking to provide value to the customer, the provider, the society and the environment. PSS design must care for overall impacts in space and time, with a global view of the external -positive or negative -changes caused by the system.

Value Creation

Value seems to be the concept which unites the different PSS definitions around a common goal. Indeed, in business-oriented literature, PSS are seen as more competitive by providing more value than ordinary products. The transition towards a service-oriented approach has made the value concept evolve, shifting from a perception of value embedded in a physical artefact to another, where value is perceived through the interactions between a combination of products and services and the customer. In a goods-dominant logic, the concept of value is regarded as "value in exchange". Value is considered mainly as monetary and is created by exchanging the product for money. The "value chain" described by Porter [START_REF] Porter | The competitive advantage of nations[END_REF] represents successive additions of value to a product along the supply chain until the customer pays for it. However in the emergent Service-Dominant logic described by Vargo and Lusch [START_REF] Vargo | Evolving to a new dominant logic for marketing[END_REF], the value concept moves on and centres on usage. Value is thus driven by "value-in-use" instead of "value-in-exchange" [START_REF] Vargo | On value and value co-creation: A service systems and service logic perspective[END_REF]. What is put on the market by companies corresponds to a "value proposition" built in a supply network. Value exists only as "potential" until the user experiments this potential; and then value is created. In this theory of value considered as "value-in-use", the customer is always the value creator and creates value in his own sphere, before, during and after his "experience" and independently of the provider [START_REF] Grönroos | Value co-creation in service logic: A critical analysis[END_REF]. The provider can join the customer in the process of value creation and then value is co-created by both the customer and the provider. Therefore, the supplier's role in value generation is to facilitate the customer's process of value creation and to join it in a co-creation process [START_REF] Grönroos | A service perspective on business relationships: The value creation, interaction and marketing interface[END_REF]. Service-Dominant logic puts the emphasis on the fulfilment of the final user's needs moving away from the focus on the means to the results. The "experience" or "satisfaction" provided by the integrated offering prevails over ownership. The responsibility of the provider moves to the satisfaction of the customer all along his use process because he is the value co-creator and pays for good use. The revenue of the provider is dependent on customer satisfaction, which becomes a major point to integrate in design considerations. In other terms, PSS is an integrated product and service offering that delivers value in use [START_REF] Baines | State-of-the-art in productservice systems[END_REF]. Interaction between the customer and the service provider is considered as crucial for value creation through the customer's experience. Service is the artefact of the PSS which allows this interaction to happen.

Sustainability

In 1987, the Bruntland Commission defined sustainable development as "development that meets the needs of the present without compromising the ability of future generations to meet their own needs" [13]. To achieve sustainable production and consumption, societies have to drastically reduce their consumption of physical resources. Early PSS authors understood that a deep transformation was taking place. Tomiyama described the Post Mass Production Paradigm, limited by environmental, social and market capabilities. It should reduce the volume of physical artefacts sold to balance natural and social constraints. In this theory, value is added through knowledge and service contents and would compensate the reduction of the sales volume. This "dematerialized value" is considered as crucial for reducing environmental impacts, decoupling economic growth from the consumption of energy and materials [START_REF] Tomiyama | Service engineering to intensify service contents in product life cycles[END_REF]. Similarly, Jackson identified the concept of a "new service economy", where profitability is not based on material trade exchange but rather on the provision of services to meet essential human needs [START_REF] Jackson | Back to the future. Reinventing the service economy, Material concerns: pollution, profit, and quality of life[END_REF]. The dematerialization concept is seen as a way to decouple economic growth from environmental pressure. Indeed, in complex and advanced industrial societies, the consumption process is set in socio-technical systems (networks, infrastructures) and social welfare is less dependent on commodities consumption than on the interactions created in systems, where commodities are only a component amongst others [START_REF] Cogoy | Dematerialisation, time allocation, and the service economy[END_REF]. The production of physical products should constitute only a limited and decreasing part of the total process of generating value [START_REF] Den Hertog | Intangibles: The soft side of innovation[END_REF]. Meier argues that rental, sharing and pooling of capital goods could lead to important environmental gains and encourage the responsibility of the producer [START_REF] Meier | Industrial Product-Service Systems-IPS2[END_REF]. In the PSS approach, products are seen as a support for a global offer designed in a life cycle perspective. Therefore, the concept of sustainable Product-Service Systems emerged to create sustainable design in terms of environmental burden and resource use, whilst developing product concepts as parts of global sustainable systems that provide a service or function to meet essential needs [START_REF] Roy | Sustainable product-service systems[END_REF]. Finally, PSS design should integrate business model design and ecodesign, which converge in a life cycle approach. This approach integrates service delivery and the co-creation process together to support value creation and sustainability.

DESIGN OF PSS

The life cycle perspective and design

Design to provide value in sustainable systems

Design is increasingly recognized as a relevant factor in business competition [START_REF] Spangenberg | Design for Sustainability (DfS): the interface of sustainable production and consumption[END_REF] and is necessary to establish the system's ability to meet the sustainable issue. Design is a very important stage of the PSS life cycle because this stage largely determines future costs engaged in the development project. Similarly, design impacts the future eco-and socio-efficiencies of the offer. Designers have to consider the offer and the necessary organization in a life cycle approach. Evaluation of the system as early as possible -for each stage of the design process -in terms of monetary benefits but also from environmental and social points of view is crucial [START_REF] Maussang | Product-service system design methodology: from the PSS architecture design to the products specifications[END_REF]. "Without the contribution of design, the full potential of sustainable production and consumption, and thus sustainability, cannot be realised. Similarly, only in a sustainability perspective, can the full potential of design be released" [START_REF] Spangenberg | Design for Sustainability (DfS): the interface of sustainable production and consumption[END_REF].

Life cycle as a key to PSS design PSS have to be designed in a full life-cycle perspective placing the customer in the centre of the integrated offer. Ecodesign must support this point. Adding services in product-oriented offers leads designers to reconsider products, services, supporting infrastructure and the supply network, in a holistic way. A new business model based on the life-cycle approach is needed with a comprehensive view of the real customer's demand and would provide a way to develop ecological potentials while satisfying economical constraints [START_REF] Meier | Life Cycle-Based Service Design for Innovative Business Models[END_REF].

Service delivery

To add services in their offers, suppliers have to redesign an essential stage of the life cycle: service delivery. Service delivery is the core of the value proposition building and is also essential to achieve sustainability.

Service delivery and value creation

Service delivery is the final point of the process of building the "value proposition" or "value facilitation". Since value is determined by the beneficiary, understanding use and customer behaviour becomes a challenge in designing service delivery. The way to deliver the service to the customer impacts the customer's perception and the value creation. Supply network coordination to provide a fully integrated offering is necessary. Suppliers are supposed to learn about customer value, create it and develop the delivery process [START_REF] Berghman | Building competences for new customer value creation: An exploratory study[END_REF]. Therefore, new skills have to be developed for innovative firms willing to provide value. In a knowledge-based economy, skills and knowledge management through organizations is seen as the key concept. Offering a mixture of products and services requires a new design of the entire structure of the organization and the associated supply chain. Using knowledge and mental competences are the heart of competitive advantage and performance [START_REF] Vargo | Evolving to a new dominant logic for marketing[END_REF] and providing integrated solutions requires the full cooperation between all the actors of the supply chain. Designing service delivery means understanding and forecasting the way the service would be used and the value created. Value is considered as being created during activity and based on the performance and outcome of the activity [START_REF] Tan | Strategies for designing and developing services for manufacturing firms[END_REF]. Activity-based approaches take an important place in service-oriented design methodologies. They seek to help designers to have a global understanding about how value is experimented and how to provide more value. For instance, the service blueprint representation proposed by Shostack enables a global view of activities necessary for the service delivery process at multiple levels for the provider and begins with the design of customers' activities. All the operations performed by the customer and the producer appear in a global service delivery process [START_REF] Shostack | How to design a service[END_REF]. Vandermerwe proposes "customer activity cycles" explaining how the customer's activities provide him benefits during three steps: pre (before achieving the result); during (while the benefit is provided); and post (after) [START_REF] Vandermerwe | How increasing value to customers improves business results[END_REF]. Service Engineering defines a service as an activity, which is cut into sub-activities to be done to achieve customer satisfaction [START_REF] Sakao | Service Engineering: a novel engineering discipline for producers to increase value combining service and product[END_REF]. To design service delivery, a representation of the activities performed by the provider to fulfil the user's needs is necessary. To design the activities performed by the provider, it is necessary to first represent the activities performed by the user in a scenario providing him satisfaction. Service delivery is the outcome of the value proposition, so this step has to be considered within the value creation scenario.

Service delivery and sustainability

As we argued in the precedent section, the use phase and the service delivery process are both represented in design methods by their related activities. Activity-based approaches are crucial because all the benefits, costs or environmental effects of a product can only be determined when they interact with a customer or stakeholder, in an activity [START_REF] Tan | Strategies for designing and developing services for manufacturing firms[END_REF]. That's why designing service delivery and so the associated activities are fundamental for providing sustainable solutions. Since service delivery has to focus on use, impacts generated in this phase have to be taken into account and PSS design has to integrate an evaluation of these impacts as soon as possible. The use phase has often been identified as being responsible for the largest environmental impacts in a goods-dominant logic. In a PSS scenario, the shift of responsibility forces the provider to reduce them. Design of service delivery and usage plays a crucial role, because that is when capital goods can be managed intensively and be shared, rented or pooled, leading to significant environmental gains [START_REF] Meier | Industrial Product-Service Systems-IPS2[END_REF]. As mentioned above, PSS have to be designed in a life-cycle perspective, identifying service delivery. Installing and maintaining availability and reliability of the products through maintenance services, or training and advising users, requires a clear identification of the roles and responsibilities in the supply network as well as a clear view on the delivery process (infrastructures, proximity with users, etc.). All these elements push designers towards innovative solutions. Resources can be managed in a more sustainable manner. The sustainability of an integrated offering depends on all the supply network processes during the full life cycle. The products life cycles have to be considered in closed-loop perspectives and the responsibility of producers can encourage this [START_REF] Meier | Industrial Product-Service Systems-IPS2[END_REF]. Beyond the simple cyclic view of the product life time, research has studied ways to manage resources in a continuous process, maintaining them infinitely in a "resource" status and not simply as end-of-line waste. The "value addition" process in the supply chain must evolve. The value chain concept [START_REF] Porter | The competitive advantage of nations[END_REF] where potential value is added linearly and consumed by the customer is over. Addedvalue, which can be defined as the value proposition put on the market, is now shifting from a linear model to a cyclic model. Keeping materials in a resource status leads firms to consider them as "re-valuable". Hence, resources are maintained as potential sources of revenue. Barber et al. propose a "value cycle", corresponding to the supply network cycle, whereby the continuation of the provision of functionality to the customer becomes the dominant focus of a sustainable business model [START_REF] Barber | Environmental sustainability: a value cycle research agenda[END_REF].

The co-creation process

The co-creation process is defined here as a value creation sequence involving different stakeholders, such as supplier networks, customers, etc. In service-dominant logic, "the elaboration of solutions results from a value co-creation process involving actors from both the supply network and the customer network" [START_REF] Cova | Marketing solutions in accordance with the SD logic: Co-creating value with customer network actors[END_REF]. Each one of these actors takes part in adding value during the life cycle of the offer (see Figure 2).

Co-creation and value creation

A value proposition is built by a supply network. Value is potential and will become real value during the customer experience, which is only partially in the hands of the provider. Grönroos represented these two processes in two different spheres: the provider sphere and the customer sphere. These spheres may meet in an interaction which provides "value co-creation" [START_REF] Grönroos | Value co-creation in service logic: A critical analysis[END_REF]. During this interaction, from the provider perspective, the customer participates as coproducer of resources and processes; while from a customer perspective, the provider participates as co-creator of value (value-in-use).

Figure 2: Three strategies of offerings in the service-dominant logic [START_REF] Cova | Marketing solutions in accordance with the SD logic: Co-creating value with customer network actors[END_REF]. With this approach, the customers and supply chain partners are collaborators in the marketing process and solutions are co-created by a supplier and a customer [START_REF] Lusch | Servicedominant logic: reactions, reflections and refinements[END_REF]. Considering that the provider has to build the value proposition to facilitate and cocreate value, this interaction has to be welldesigned. Interactions occur during service delivery and so these two points are strongly linked. Value co-creation results from a participative process between the provider and the customer, where they benefit from one another. This means that the provider can receive value from the customer, which could be, for instance, new knowledge. The customer perceives more value in use or gets better satisfaction. This is often linked to the perception of a relationship during service delivery and depends on the completeness of the offer. Therefore, value co-creation is dependent on the quality of resource and management competences within a network and also on the ability to learn from the users. Being connected to a global network that includes resources, suppliers and customers enhances innovation and value creation in the global knowledge economy [START_REF] Johannessen | The future of value creation and innovations: Aspects of a theory of value creation and innovation in a global knowledge economy[END_REF]. Value co-creation emerges from the interactions between actors. Interdependencies have been largely studied in the past and several models and theories, such as network science or agent-based models, providing better understanding about them, exist. Indeed, in a co-creation system, the elements are agents that make various decisions; have self organization which causes individual behaviours; and mutually interact [START_REF] Ueda | Value creation and decision-making in sustainable society[END_REF]. These interactions have to be designed throughout the entire life cycle of the offer, in order to maintain continuous value creation. Indeed, value co-creation is a dynamical process which can evolve during the life cycle.

Co-creation and sustainability

The co-creation process requires full involvement of all the stakeholders, and this cooperation is in itself a response to sustainability principles. In a sustainable society, common decisions have to be taken regarding whole systems and individual purposes. The co-creation process in PSS building is fundamental for the development of solution oriented partnerships, and consequently for sustainable solutions [START_REF] Morelli | Developing new product service systems (PSS): methodologies and operational tools[END_REF].

Value is generated for both the customer and the provider during the co-creation process, but value must also be generated for society. This can be understood as sustainability achievement. Socially, constructive and co-creative interactions between humans are a lever for knowledge generation inside the system but also for social equity and welfare more generally. Intensive knowledge employment leads to a more balanced distribution of workforce, geographically [START_REF] Aurich | Life cycle oriented design of technical Product-Service Systems[END_REF]. Economically, fulfilling customer needs during a prolonged interaction can generate long term benefits for the provider and reduce cost [START_REF] Tukker | New Business for Old Europe. Product-Service Development as a means to enhance competitivness and eco-efficiency[END_REF]. The provider can also improve his offer by integrating the customer. Concerning the environment, the co-creative process is a win-win relationship; it can enhance responsible behaviour and sustainable usage if the service delivery is correctly designed. However, behaviour or other external parameters such as individual decisionmaking by actors, constitute uncertain variables, which could make the rebound effect appear. The rebound effect "refers to a behavioural or other systemic response to a measure taken to reduce environmental impacts that offsets the effect of the measure" [START_REF] Hertwich | Consumption and the rebound effect[END_REF]. Bartolomeo considers that behavioural changes can occur due to the shift in property rights and the result can be a lower degree of responsibility felt by users for the equipment's proper usage and maintenance [START_REF] Bartolomeo | Eco-efficient producer services-what are they, how do they benefit customers and the environment and how likely are they to develop and be extensively utilised?[END_REF]. That is why user behaviour and acceptance have to be carefully taken into account. The co-creation process can help resolve value creation and sustainability issues. However, human systems are complex and design must be fully conscious of the potential risks in relational, progressive, adaptive and dynamical interactions.

TOWARDS SUSTAINABLE VALUE

Following the discussions above, the question of the definition of value is posed. For Ueda, value cocreation is derived from relations among systems of artefacts, humans, and society; where value creation of artefacts is part of systems that include natural systems [START_REF] Ueda | Value creation and decision-making in sustainable society[END_REF]. Value creation and Sustainability represent two major issues in PSS, justifying the need to integrate sustainability into the value notion. Adding services to product-based offers has implications on the way to consider value for the provider. Instead of thinking only of the product life cycle, providers have to think about the PSS life cycle, which is a continuous process of maintaining and regenerating the value proposition for the customer. The customer experiments his own, particular value-in-use in his own, individual process. Imagining the customer's activities generating value enables the provider to design the service delivery process more efficiently. With efficient design, the co-creation process results from the interaction with the customer when the service is delivered. These two processes and their mutual interaction look like the two spheres represented by Grönroos [START_REF] Grönroos | Value co-creation in service logic: A critical analysis[END_REF], in which the provider sphere corresponds to the production system where potential value is created; and the customer sphere represents the value creation by the customer in an independent process and in different spatial and temporal settings. 3 illustrates the continuous process of value co-creation feeding virtuous circles in both the supply and the demand sides. Sustainable value for society is linked to the closed-looped cycles of the provider regenerating the offer to new customers without material losses. Efficient design of service delivery enhances the co-creation process, so that they combine to meet the PSS issues of sustainable value creation. Indeed, correct design of service delivery will help organize the PSS life cycle in a closed-loop approach supported by learning and co-creation. It will also help to efficiently manage resources during usage. During interaction with the customer the potential of the value proposition will be confronted with the reality of value creation by facing the complexity of human behaviour. Success depends on the ability of the provider to co-create value with the customer. This co-creation process corresponds to a win-win relationship where customer behaviour must be understood and guided in a process where actors are voluntarily involved and satisfied. Finally, sustainable value emerges from a life cycle perspective of a production network and consumption activity. Sustainability is intrinsically linked to the value of services provided by natural and human systems. Sustainability principles promote stakeholder involvement to build sustainable solutions. Continuity and time perspectives are major pillars of sustainable development as continuity of the provision of the functionality for generating value. Cyclic approaches are the foundations of all ecosystems. Sustainability can be considered as a value concept. A PSS providing value should provide value for the present as well as for the future generations and value to society should be measured consequently.

CASE STUDY

Case description

This paper will now interpret, in terms of service delivery, co-creation and sustainable value creation, a clothing rental and cleaning service. The original study was carried out during the Environment Round Table [START_REF] Grenelle | Rapport final au Ministre d'Etat[END_REF] in 2008 in France. The clothing rental and cleaning service provided by the company Elis [38] was studied to evaluate the benefits on the environment. The information used here is found on the web site of Elis and the 'chantier 31' report of the Environment Round Table . Elis provides clothing rental and cleaning services addressing different types of companies in different sectors of activity. Instead of providing work wear individually to each of its employees, the client company outsources both the ownership of the clothes and their cleaning.

An offer with continuous value cycles

Elis provides clean clothes to its customers, who are interested in the continual performance of the offering. The main advantage for the customer in the proposed service is that its employees can concentrate on their core-skills and competencies, while always wearing clean clothes adapted to their daily activities. To satisfy this need, the provider supplies the clothes and cleans them. These two service activities have to be designed to provide better value for the customer while reducing cost for the provider, who should optimize the organization of production, delivery, recovery and cleaning processes. The customer is continuously provided with clean clothes, and proximity with the provider makes services customized and adapted to his specific needs. The co-creation process improves the offering in the relationship developed with the customers through service delivery. Service delivery begins with an on-site diagnosis carried out by Elis to determine the needs in terms of specificities, stock dimensions, delivery frequency, etc. The sizes of the employees are measured in order to provide the most adapted products. Clothes are collected and delivered in function of the needs; they are regularly controlled and repaired. The customer's image is improved because of continuously cleaned clothes of the employees; he can access multiple products adapted to different situations and can adapt the clothes more flexibly. The provider maintains closer relations with the customers and can improve his understanding of usage. With strong implication in cleaning all along the use phase, he can gain knowledge on the ways clothes are used or worn out and improve his offer consequently. The continuity of these value creation cycles in which the customer and the provider are in a winwin relationship also supports the emergence of a sustainable value.

Sustainable value creation

The rental service means that Elis keeps the property rights on the products. The provider's economical interest is to prolong the useful life time of the products. Therefore, Elis re-designed new working clothes using more robust synthetic material rather than the traditional cotton-wear in the reference scenario. The new time of use is about twice as long with this material. Professional cleaning techniques including washing, drying and ironing are re-designed, and combined with the properties of the new materials; the cleaning process finally consumes far less water, electricity and detergents. This is an environmental improvement, but also an economic advantage for Elis. Life Cycle Assessment was realized in 2008 during the Environment Round Table to evaluate the environmental performance of the value proposition. The reference scenario compared with the PSS scenario is a case of working clothes for mechanical industry where the client company purchases the wear and assigns it to a particular employee who is responsible for cleaning it at his home. The study showed that the rental solution proposed by Elis enables a reduction from about 50 % of the energy consumption and of the CO2 emissions compared with a traditional scenario. The water consumption is also divided by 10. The Life Cycle Assessment identified environmental gains obtained by the PSS solution. The global environmental performance achieved was composed:  30 % from use of new materials;  50 % through pooling the wears between the customers;  20 % from improved organization of the cleaning processes and logistics. The location of the storage and cleaning facilities in an industrial area rather than in the city centre was chosen essentially for economical reasons. In order to minimize environmental impacts during transportation, design of the delivery logistics needs to be optimized. Moreover, Elis and its customers are implied in a close relationship supporting the co-creation process. This orientates the offer towards a 'multiservice' concept. Multiservices cover the customer needs very largely by proposing multiple services in a same delivery package, which could include different types of clothes but also sanitary services, mat services and drink services, designed to provide fully integrated solutions. The environmental and economical impacts of transportation are greatly reduced with a larger turnover since the time spent with the client does not increase proportionally. The multiservice concept aims at providing a deeper service 'experience' to the customers. These improvements on the offer can be achieved since the relationships between the provider and consumers enable the value co-creation. Environmental or sustainable value is therefore encouraged. Since 2008, Elis has improved the quality of its products, guaranteeing the users a better comfort. The washing processes have been optimized and recycling of the products organized. As a result, the water consumption has been reduced from 19 %, the energy consumption from 14 % and the washing liquids use from 20%. The continuity of the improvement of the offer by continuous customer' satisfaction has the potential to provide more benefits for the provider, while fulfilling the customer's needs and displaying sustainable value. Another illustration is that Elis recently launched a new collection of working clothes, using biological cotton resulting from fairtrade. Elis is now developing this clothes collection for rental services. "Sustainable value" emerges through careful design creating valuable provider-customer interaction in which the co-creation process generates value for the provider, the customers but also for sustainable development.

DISCUSSION

The case is an example which illustrates the potential of PSS for providing win-win relationships and creating value in a sustainable way. The PSS solution provides additional value for customers in comparison with the reference scenario. Design of new products, processes and professionalization of the activities leads to value creation for the customer and the provider, while largely reducing the environmental impacts compared to the reference scenario. The continuity of the value creation on both the supply and demand sides allows the sustainable performance to be improved continuously. The co-creation of value encourages the emergence of sustainability through interactions provided by the service. In the case study, the provider notices that his delivery process has to be optimized while the customer has other needs, which can be fulfilled by the same type of rental and maintenance services. Therefore, Elis designs "multiservices" with the potential of completely fulfilling the customer's needs, while providing economic benefits and reducing environmental impacts. The firm's development and the enlargement of his competencies is also a lever to enhance the employment in professional and specialized fields. The study illustrates the creation of "sustainable value" emerging from the co-creation process strongly supported by design, which provides additional value for the customer, the provider and society.

SUMMARY

This paper has provided an overview of two major elements involved in PSS design: service delivery and the co-creation process. It was shown that these two factors enhance solutions meeting the value creation and sustainability requirements in developing PSS. "Sustainable value" can emerge. A case of clothing rental and cleaning services firm has been analyzed under this point of view in order to show the possible links between service delivery, the co-creation process and "sustainable value" which can be provided.

Figure 3 :

 3 Figure 3: Co-creation and service delivery toprovide sustainable value. Figure3illustrates the continuous process of value co-creation feeding virtuous circles in both the supply and the demand sides. Sustainable value for society is linked to the closed-looped cycles of the provider regenerating the offer to new customers without material losses. Efficient design of service delivery enhances the co-creation process, so that they combine to meet the PSS issues of sustainable value creation. Indeed, correct design of service delivery will help organize the PSS life cycle in a closed-loop approach supported by learning and co-creation. It will also help to efficiently manage resources during usage. During interaction with the customer the potential of the value proposition will be confronted with the reality of value creation by facing the complexity of human behaviour. Success depends on the ability of the provider to co-create value with the customer. This co-creation process corresponds to a win-win relationship where customer behaviour must be understood and guided in a process where actors are voluntarily involved and satisfied. Finally, sustainable value emerges from a life cycle perspective of a production network and consumption activity. Sustainability is intrinsically linked to the value of services provided by natural and human systems. Sustainability principles promote stakeholder

Figure

  Figure 3: Co-creation and service delivery toprovide sustainable value. Figure3illustrates the continuous process of value co-creation feeding virtuous circles in both the supply and the demand sides. Sustainable value for society is linked to the closed-looped cycles of the provider regenerating the offer to new customers without material losses. Efficient design of service delivery enhances the co-creation process, so that they combine to meet the PSS issues of sustainable value creation. Indeed, correct design of service delivery will help organize the PSS life cycle in a closed-loop approach supported by learning and co-creation. It will also help to efficiently manage resources during usage. During interaction with the customer the potential of the value proposition will be confronted with the reality of value creation by facing the complexity of human behaviour. Success depends on the ability of the provider to co-create value with the customer. This co-creation process corresponds to a win-win relationship where customer behaviour must be understood and guided in a process where actors are voluntarily involved and satisfied. Finally, sustainable value emerges from a life cycle perspective of a production network and consumption activity. Sustainability is intrinsically linked to the value of services provided by natural and human systems. Sustainability principles promote stakeholder


Thi Minh

Tuyen Nguyen

Claude Marché

Hardware-Dependent Proofs of Numerical Programs ⋆

We present an approach for proving behavioral properties of numerical programs by analyzing their compiled assembly code. We focus on the issues and traps that may arise on oating-point computations. Direct analysis of the assembly code allows us to take into account architecture-or compiler-dependent features such as the possible use of extended precision registers.

The approach is implemented on top of the generic Why platform for deductive verication, which allows us to perform experiments where proofs are discharged by combining several back-end automatic provers.

Introduction

The C language is the rst choice for embedded systems or critical software from domains such as simulation of physical systems, control-command programs in transportation, etc. For such systems, oating-point (FP for short) computations are involved and precision of calculations is an important issue. The IEEE-754 standard [1] enforces a precise denition on how the basic arithmetic operations (+, -, *, /, and also absolute value, square root, etc.) must be computed on a given FP format (32 bits, 64 bits, etc.) and w.r.t a given rounding mode. This standard is currently supported by most of the processor chips. However, this does not imply that a given C program must produce exactly the same results whatever is the compiler and the underlying architecture. There are for that several possible reasons, e.g. the x87 oating-point unit (FPU) uses 80-bit internal oating-point registers, FMA instructions compute xy ± z with a single rounding, or the compiler may optimize the assembly code by changing the order of operations. Such issues have been extensively analyzed by D. Monniaux [START_REF] Monniaux | The pitfalls of verifying oating-point computations[END_REF]. A small example that illustrates such an issue is as follows.

double doublerounding() { double x = 1.0; double y = 0x1p-53 + 0x1p-64; double z = x + y; return z; } If computations follow the IEEE-754 standard, the result should be 1 + 2 -52 , but if compiled using the x87 FPU, a double rounding happens and the result is 1. The latter compilation does not strictly follows the standard 3 .

In the context of static verication, FP computations have been considered in part. In analyses based on the abstract interpretation framework, support for FP computations is proposed in tools like Fluctuat [START_REF] Delmas | Towards an industrial use of FLUCTUAT on safety-critical avionics software[END_REF], Astrée [START_REF] Cousot | The ASTRÉE analyzer[END_REF] and the Value analysis of Frama-C [START_REF] Cuoq | Value Plugin Documentation, Carbon version[END_REF]. Generally speaking, FP arithmetic has been formalized since 1989 to formally prove hardware components or algorithms [START_REF] Carreño | Specication of the IEEE-854 oating-point standard in HOL and PVS[END_REF][START_REF] Harrison | Formal verication of oating point trigonometric functions[END_REF][START_REF] Russino | A mechanically checked proof of IEEE compliance of the oating point multiplication, division and square root algorithms of the AMD-K7 processor[END_REF].

However, there are very few attempts to analyze FP programs in the socalled extended static checking techniques, or deductive verication techniques, where verication is typically performed by producing proof obligations, which are formulas to be shown valid using theorem provers. In this context, complex behavioral properties are formally specied using specication languages such as JML [START_REF] Burdy | An overview of JML tools and applications[END_REF] for Java, ACSL [START_REF] Baudin | AN-SI/ISO C Specication Language[END_REF] for C, Spec# [START_REF] Barnett | The Spec# Programming System: An Overview[END_REF] for C#. The support for oatingpoint computations in such approaches is poorly studied. In 2006, Leavens [START_REF] Leavens | Not a number of oating point problems[END_REF] enumerates a set of possible traps when one attempts to specify FP programs. In 2007, Boldo and Filliâtre [START_REF] Boldo | Formal Verication of Floating-Point Programs[END_REF] propose both a specication language to specify FP programs and an approach to generate proof obligations to be proved in the Coq proof assistant. In 2010, Ayad and Marché [START_REF] Ayad | Multi-prover verication of oating-point programs[END_REF] extended this to the support of special values and to the use of automated theorem provers. However, the former approaches assume that the compiler strictly follows the IEEE-754 standard. In other words, on the example above they can prove that the result is 1 + 2 -52 .

In 2010, Boldo and Nguyen [START_REF] Boldo | Hardware-independent proofs of numerical programs[END_REF][START_REF] Boldo | Proofs of numerical programs when the compiler optimizes[END_REF] proposed a deductive verication approach which is compiler-and architecture-independent, is the sense that the behavioral properties that can be proved valid on a FP program are true whatever does the compiler (up to some extent). On the same example, the only property that can be proved is that the result is between 1 and 1 + 2 -52 . In this paper, we propose an approach which is compiler-and architecture-dependent: the requirements are proved valid with respect to the assembly code generated by the compiler. At the level of the assembly, all architecture-dependent information is known, such as the precision of each operation.

This paper is organized as follows. Section 2 presents the approach from a user's point of view, and is largely illustrated by examples. Section 3 explains the technicalities of our approach, which consists in translating annotations and assembly instructions into the Why intermediate language [START_REF] Filliâtre | The Why/Krakatoa/Caduceus platform for deductive program verication[END_REF]. Conclusions and future work will be presented in the last section. Step-by-step from C program to WHY proof obligations annotations are put in comments. To transport these annotations into the generated assembly, we have a preprocessing step in which we rewrite annotations as inline assembly. Assembly code is then generated from this new C source by the regular gcc compiler to generate assembly code, with precise architecturerelated options, e.g. -mfpmath=387 to generate x87 assembly or -On to optimize at level n. The main original step is then a translation of the assembly code to a Why program. This is implemented by modifying the GNU assembler so as to produce Why source instead of binary object. The Why environment is nally invoked to generate proof obligations, and prove them by automatic provers such as Gappa [START_REF] Melquiond | Proving bounds on real-valued functions with computations[END_REF], Alt-Ergo [START_REF] Conchon | Alt-ergo[END_REF], CVC3 [START_REF] Barrett | CVC3. In 19th CAV[END_REF], Z3 [START_REF] De Moura | Z3, an ecient SMT solver[END_REF] or interactive provers like Coq [START_REF] Coq | The Coq Proof Assistant Reference Manual Version V8.2[END_REF].

Overview of the approach

Example: double-rounding

To illustrate this process, let's add a specication in the short program given in introduction under the form of an ACSL assertion: double doublerounding() { double x = 1.0; double y = 0x1p-53 + 0x1p-64; double z = x + y; //@ assert z == 1.0; return z; }

The assembly code generated with our tools in the x87 mode is shown in Fig. 2. Notice on line 16 how the inline assembly preprocessing allowed to replace the occurrence of z in the assertion by its assembly counterpart. Notice also that the rst addition is computed at compile-time (line 9), whereas the second one is compiled into x87 instructions (lines [START_REF] Boyer | Automated correctness proofs of machine code programs for a commercial microprocessor[END_REF][START_REF] Burdy | An overview of JML tools and applications[END_REF][START_REF] Burdy | Java bytecode specication and verication[END_REF][START_REF] Carreño | Specication of the IEEE-854 oating-point standard in HOL and PVS[END_REF]. When this assembly code is fed into our translator to Why, and the result analyzed by Why, three proof obligations are produced. One is naturally for proving the assertion, the two 4 6 0 7 1 8 2 4 1 8 8 0 0 0 1 7 4 0 others are required to prove the absence of overow, once at line 13 of Fig. 2, corresponding to the addition x+y in the source code, and once at line 14, which amount to store the 80-bit value of the x87 stack into a 64-bit memory cell.

These three obligations are proved valid using the Gappa automatic prover.

If we compile the program in SSE2 mode (Streaming SIMD Extensions, 64bits precision arithmetic) then the generated proof obligation corresponding to the assertion cannot be proved anymore. The modied assertion z == 1.0 + 0x1p-52 can be proved instead. As seen on this example, our approach produces proof obligations to show that the program satises its specication, but also to show the absence of overow in FP computations.

Example: Architecture dependent Overow

Monniaux [START_REF] Monniaux | The pitfalls of verifying oating-point computations[END_REF] Excerpts of the generated assembly code are shown on Fig. 3. The left part corresponds to non-optimized x87 code where v * v is rounded in 64 bits whereas the right part is optimized (-O1) where v * v is store in 80-bit registers and then the division is also done in 80-bit register. This is the reason why with no-optimization, overow occurs but with optimization, it does not.

For the non-optimized version, 5 obligations are generated to check absence of overow at lines 4, 5, 7 and 8, and to check that divisor is not null at line 7. All are proved by Gappa except the overow at line 5, where the content of the 80-bit register holding the result of the multiplication is moved into a 64bit memory cell, which indeed overows. On the other hand, 4 obligations are generated on the optimized code at lines 3, 4 and 5 and all are proved by Gappa.

Indeed there is no overow in this version because the result of multiplication is not temporarily stored into a 64-bit register. Finally, notice that we can also analyze the code compiled in the SSE2 mode, resulting in 3 obligations: overows for the multiplication and division and check divisor is not null. As expected, it cannot be proved that multiplication does not overow.

2.3

Example: KB3D

Our next example illustrates the handling of function calls, and the way we express properties on rounding errors across functions. This example is an excerpt of the KB3D collision detection and resolution system developed by Dowek and Munoz [START_REF] Dowek | Conict detection and resolution for 1[END_REF] and formally proved in PVS, but using exact calculations on real numbers. An analysis of the same code but with oating-point calculations was done by Boldo and Nguyen [START_REF] Boldo | Proofs of numerical programs when the compiler optimizes[END_REF] using their architecture-independent approach. The annotated C source is given on Figure 4. The logical symbol l_sign returns the sign of a real number: 1 for positive and -1 for negative (sign of zero is not pertinent). The C function sign returns the sign of a FP number x. To make sure that the result is correct, a precondition requires that the rounding error on previous computation on x (written as x -\exact(x)) is between bounds e 1 and e 2 given as arguments. The C function eps_line then attempts to decide whether a aircraft at position sx, sy with velocity vx, vy should avoid the point (0,0) on the left or on the right. The decision is taken from the sign of #define E 0x1p-45 //@ logic integer l_sign(real x) = (x >= 0.0) ? 1 : -1;

/*@ requires e1<= x-\exact(x) <= e2; @ ensures ( \result != 0 ==> \result == l_sign( \exact(x))) && @ \abs( \result) <= Feeding this annotated source code in our assembly analyser in SSE2 mode, each VC is automatically proved valid using either Gappa or one of the SMT solvers Alt-Ergo or CVC3. The bound E is indeed in that case exactly the same as the one found by Boldo and Nguyen [START_REF] Boldo | Proofs of numerical programs when the compiler optimizes[END_REF] in a strict IEEE-754 mode. At least on this example, this shows that SSE2 assembly conforms strictly to the standard. The table below shows the value of E that are proved correct using various architecture-dependent settings.

Architecture SSE2 x87 x87 FMA Optim. level -O0 -O2 -O2 E 2048 × 2 -56 1025 × 2 -56 1025 × 2 -56 1536 × 2 -56
The FMA setting 4 asks to use the fused-multiply-add operation, which computes expressions of the form x * y ± z with only one rounding [1]. As expected, using FMA improves over SSE2 (25% less) since fewer roundings occur. The extended precision of x87 is even better (around 50% less whatever the optimization level).

#define NMAX 10 #define NMAXR 10.0 #define B 0x1.1p-50 /*@ requires 0 <= n <= NMAX; @ requires \valid_range(x,0,n-1) && \valid_range(y,0,n-1) ; @ requires \forall integer i; 0 <= i < n ==> @ \abs(x[i]) <= 1.0 && \abs(y[i]) <= 1.0 ; @ ensures \abs( \result -exact_scalar_product(x,y,n)) <= n * B; */ double scalar_product ( Of course, all these bounds are smaller than the one found by Boldo and Nguyen for any architecture, which was 0x1.90641p-45≈ 3203 × 2 -56 [START_REF] Boldo | Proofs of numerical programs when the compiler optimizes[END_REF], that is more than 50% higher than the SSE2 one.

2.4

Example: Scalar Product

Our last example illustrates how we combine FP analysis with other features such as loops and arrays. The annotated C program on Fig. 5 computes the scalar product of two vectors represented as arrays of doubles. Similarly as the l_sign function of previous example, exact_scalar_product(x, y, n) is dened to denote the scalar product 0≤i<n x i y i computed in real numbers. The postcondition expresses a bound B on the accumulated rounding error in function of a bound NMAX on the size of the vectors. We also assume a bound, here 1.0, on each component of the vectors. Several extra assertions are added in the body of the loop: these are needed to help the automatic provers to solve the generated VCs. In particular, to make Gappa solve the VCs on the accumulated rounding error, it is necessary to guarantee that p remains bounded: it appears to be bounded by NMAX(1 + B).

The The SSE2 mode, supposed to be strictly compliant with the standard, is worse than FMA and x87 without optimization, because the roundings are, as expected, slightly more precise. However the improvement with x87 with optimization is impressive: around 2 11 ≃ 2000 times better. The reason is that optimization makes the value of p stored into the x87 stack thus with extended 80-bit precision for the complete execution of the loop: no intermediate rounding to 64-bit is done.

Underlying Technique

The core of our technique is to interpret the assembly code into the input language of Why. First we describe the general principles to follow, then we show how we interpret the various assembly statements. Due to the lack of space and the large number of dierent assembly instructions to handle, we only present a few of them. We focus on the support of FP arithmetic which is the point of interest in this paper. We refer to our technical report [START_REF] Nguyen | Proving oating-point numerical programs by analysis of their assembly code[END_REF] for more details.

3.1

Principles of interpretation in Why

In the input language of Why, one can dene a pure model in the logic world by declaring abstract sort names, declaring logic symbols operating on these sorts and posing rst-order axioms to axiomatize the behavior of these symbols. Equality and both integer and real arithmetic are built-in in the logic. One can then declare a set of references which are mutable variables denoting logic values. Finally, one can dene procedures which can modify these references. The body of such a procedure is made of statements in a while-style language. Procedures are also equipped with pre-and post-conditions. The Why VC generator then produces the necessary VCs to ensures that the body respects the post-condition. One can alternatively just declare procedures by only giving pre-and postconditions, but also declaring the set of modied references. This feature allows us to declare how the atomic operations on a given data type behave. It is exemplied below.

Model of data

Machine integers and Floating-Point Numbers The Why logic has unbounded mathematical integers and reals only. We reuse the modeling of machine integers provided by the Jessie plug-in of Frama-C [START_REF] Moy | Jessie Plugin Tutorial, Beryllium version[END_REF]. This is done as follows for 32-bit integers; the type int64 is modelled similarly.

type int32 logic integer_of_int32: int32 -> int predicate is_int32(x:int) = -2147483648 <= x and x <= 2147483647 axiom int32_coerce: forall x:int32. is_int32(integer_of_int32(x))

An abstract type int32 for 32-bit integers is declared, together with a function integer_of_int32 returning the value such a machine integer denotes. The predicate is_int32 checks whether an integer is in the range of a 32-bit word or not, and we pose an axiom to specify that the value denoted by an int32 is always in this range.

To model FP numbers, we reuse the modeling of 32-and 64-bit oats dened by Ayad and Marché [START_REF] Ayad | Multi-prover verication of oating-point programs[END_REF], which introduces the corresponding abstract types single and double. We also complete this modeling by the type binary80 Registers A central feature of our approach is how we model the CPU registers on which the assembly instructions operate. The issue is that a given register only stores a sequence of bits, that can be interpreted either as an integer, a

FP number or a memory address. Moreover, for a given register one can either consider it as a 64-bit value or as the 32-bit value stored in its lower part, e.g. the rax versus eax register of the x86 chip.

To model that behavior, we introduce an abstract type register equipped with several access symbols, each of them denotes a dierent view of the value stored in the register. The symbol sel_exact is the view for calculations in innite precision, to model the \exact construct of Fig. 4. type register logic sel_int32 : register -> int32 logic sel_int64 : register -> int64 logic sel_single : register -> single logic sel_double : register -> double logic sel_80 : register -> binary80 logic sel_exact : register -> real Then, for each register, we introduce a Why variable of type register, e.g. for the code of Fig. 2 two variables xmm0 and rax are declared with type register ref (but not for %rip and %st which have a special meaning).

Model of the memory Interpreting memory access and update at the level of assembly is a major issue, since unlike high-level languages, we have no type information to help interpretation of raw data. In particular a given 64-bit word can be indierently interpreted as an integer or a memory address. The memory is thus interpreted as a large array of data indexed by integers. However, without type information we would need to know how to encode and decode structured data, like FP numbers, into sequences of bits. Encoding and decoding are dened by complex computations that cannot be handle easily in a purely logical context: the generated VCs would be largely polluted with decoding and encoding hence would unlikely be proved by automatic provers.

We thus decide to keep a typed model of memory instead. This implies that we cannot handle C sources which non type-safe operations: pointer casts and union types. Our ad-hoc preprocessor keeps track of the C type of variables. The memory is then represented not only by one but by several arrays which contains dierent types of data. Each of these arrays is represented by a Why variable, e.g. a variable int32M holds an array of int32 indexed by integers, another variable doubleM holds an array of double indexed by integers, etc. The Why type for such an array is declared as a polymorphic type:

type 'v memory logic select: 'v memory -> int -> 'v
where select is the function to access the element at the given index. In assembly, a memory reference is an operand of the general form disp(base, index, scale) where base and index are registers, and disp and scale are integer constants. index defaults to 0 and scale defaults to 1. A memory reference mem = d(b, i, s) is thus interpreted as the integer address b + d + i × s.

Interpretation of Assembly Instructions

Operands An operand is either an immediate constant, a register or a memory reference. Simple instructions for copying (with name typically starting with mov) and arithmetic operations have an output operand called destination and one or more input operands called sources. There are indeed 6 dierent interpretations of a source operand depending on the type of the expected value. We denote by opr int32 , opr int64 , opr single , opr double and opr binary80 the interpretation of a source operand, respectively as a 32-bit, 64-bit integers and a 32-bit, 64-bit and 80-bit FP number. We also denote by opr exact its abstract \exact value.

imm int32 = imm imm int64 = imm imm single = decode_float32 (imm) imm double = decode_float64 (imm) reg int32 = integer_of_int32(sel_int32(!reg)) reg int64 = integer_of_int64(sel_int64(!reg)) reg single = single_value(sel_single(!reg)) reg double = double_value(sel_double(!reg)) reg binary80 = binary80_value(sel_80(!reg)) reg exact = sel_exact(!reg) d(b, i, s) addr = b int64 +d+s* i int64 mem int32 = integer_of_int32(select(int32M, mem addr )) mem int64 = integer_of_int64(select(int64M, mem addr )) mem single = single_value(select(singleM, mem addr )) mem double = double_value(select(doubleM, mem addr )) mem exact = select(exactM, mem addr )
Notations decode_float32 and decode_float64 are not Why logic functions but denote the operations of transforming a decimal literal into the real it represents respectively in single and double format. This decoding is done at compile-time in our translator from assembly to Why.

Move Instructions The move instructions have a mnemonic prexed with mov and their sux details the size of source and destination 5 . Their interpretation depends on whether the destination is a register or a memory reference.

Moving to a 64-bit register and to memory respectively are interpreted as procedure calls: movq imm, reg i = move_cte64 imm int64 imm double imm double reg movq src, reg i = move_cte64 src int64 src double src exact reg movq reg, mem i = move_reg_to_mem64 !reg mem addr where the Why procedure move_cte64 is declared as parameter move_cte64: a:int -> b:real -> exact:real -> r:register ref -> { } unit writes r { integer_of_int64(sel_int64(r)) = a and double_value(sel_double(r)) = b and sel_exact(r) = exact } It reads as follows: calling this procedure modies the register r (and nothing else) and after the call, the new content of r denotes both a 64-bit integer representing a, the FP double representing b and an exact real value exact.

Notice how this interpretation abstracts away from bitwise representation details.

Similarly, the Why procedure move_reg_to_mem64 is declared as parameter move_reg_to_mem64: r:register -> addr:int -> { } unit writes int64M, doubleM, exactM { integer_of_int64(select(int64M, addr)) = integer_of_int64(sel_int64(r)) and double_value(select(doubleM, addr)) = double_value(sel_double(r)) and select(exactM, addr) = sel_exact(r) and forall a:int. not (addr <= a <= addr+7) -> integer_of_int64(select(int64M,a))=integer_of_int64(select(int64M@,a)) and double_value(select(doubleM,a))=double_value(select(doubleM@,a)) and select(exactM,a) =select(exactM@,a)) }

The @ sign in a Why post-condition denotes the value of a variable before the call. Thus, the quantied part of the post-condition above amounts to specifying that the rest of the memory is unmodied. For example, in optimized x87 assembly code compiled from Fig. 5, the topof-stack pointer has value 1 at the loop entrance, because p is stored in the stack. Note that this way of interpreting the x87 stack, instead of considering the stack as an array, greatly improves the verication of VCs by Gappa back-end, since it does not know the theory of arrays as SMT solvers do.

SSE2 Scalar Arithmetic Instructions

Instructions for loading in the stack and storing from the stack are interpreted as follows.

dl src i = set_80 src double src exact st0 d st(%i) i = set_80 sti binary80 sti exact st0 dl1 i = set_80 (1.0) (1.0) st0 fstl reg i = set_double st0 binary80 st0 exact !reg fstl mem i = set_double_mem st0 binary80 st0 exact mem addr where set_80 is the analogous of set_double for 80-bit FP numbers.

Arithmetic instructions in the stack are interpreted as follows (for fmul, fadd and fsub being similar).

fmull src i = set_80 ( st0 binary80 * src double ) ( st0 exact * src exact ) st0

fmul %st(i), %st(j) i = set_80 ( stj binary80 * sti binary80 ) ( stj exact * sti exact ) stj

Translation of Annotated Functions

Assume that we have a function with preconditions, post-conditions and assertions. The translation of this function in assembly language to Why is illustrated in Figure 6. Our preprocessing moved the post-condition to the end of the function. More generally, each annotation is preprocessed into an inline assembly instruction of the form asm("/* <keyword> P */"::"X"(x 0 ),..,"X"(x n ));

where each variable x i of type τ in proposition P is replaced by #τ #%i#. The compiler thus transforms this inline assembly into lines between #APP and #NO_APP as on Fig. 2, where each %i is replaced by any appropriate memory reference or register, even the 80-bit ones 6 . The Why interpretation of an annotation A is denoted by A annot . It is dened by a straightforward structural recursion, where the variables are interpreted as follows. in Why.

#int#v# annot = v int32 #f loat#v# annot = v single #double#v# annot = v double \exact(#τ #v#) annot = v exact where τ ∈ {oat, double} \valid_range(#τ #v#, a, b) annot = forall i, a<=i<b -> e int64 +i*sizeof(τ ) >= !rsp
The interpretation of \valid_range allows to provide separation information for pointers [START_REF] Nguyen | Proving oating-point numerical programs by analysis of their assembly code[END_REF], e.g. in Fig. 5, we need to know that local variable p is separated from x[0..9] and y[0..9]. Finally, the translation of code assertions and function calls are

assert P i = assert P annot call f i = f _parameter ()
About Translation of Compound Statements When the source contains compound statements like conditional and loops, then the assembly code contains conditional jumps to labels. We cannot interpret such arbitrary jumps directly into Why since its programming language only support structured statements. We proceed dierently by interpreting the arbitrary control ow graph of the assembly into a nite set of small pieces of codes, where loop invariants play the role of pre-or post-conditions. This technique is not the purpose of this paper and indeed is not original: we refer to our report [START_REF] Nguyen | Proving oating-point numerical programs by analysis of their assembly code[END_REF] and earlier work done above Boogie [START_REF] Barnett | Weakest-precondition of unstructured programs[END_REF] or Why [START_REF] Filliâtre | Formal Verication of MIX Programs[END_REF] for more details.

Conclusion

An early work on verication of machine code is due to Boyer and Yu in 1992 [START_REF] Boyer | Automated correctness proofs of machine code programs for a commercial microprocessor[END_REF]. They formalize the assembly language of a particular micro-processor and its operational semantics in Nqthm, and were able to verify a few programs, specied in Nqthm too. Their approach provides a deep embedding of assembly code, whereas ours is based on a shallow embedding: assembly code is simulated in Why. In our approach, behaviors are specied in the general-purpose ACSL language, and the proofs can be conducted with a large set of automated provers. Former studies on the verication of assembly code are in the context of the so-called proof-carrying-code [START_REF] Colby | A certifying compiler for Java[END_REF], where proof obligations for safety (of memory dereferencing, absence of overow, etc.) are generated on the object code. However these do not consider any behavioral specication language to specify deeper properties than safety. Although, it is worth noting that there is an identied need to generate loop invariants in the target code to explicitate compilation choices [START_REF] Colby | A certifying compiler for Java[END_REF][START_REF]Abstract interpretation-based certication of assembly code[END_REF]. In 2006, Burdy and Pavlova [START_REF] Burdy | Java bytecode specication and verication[END_REF] consider a specication language on Java bytecode. Barthe et al. [START_REF] Barthe | Proof obligations preserving compilation[END_REF] showed how proofs of VCs at source level can be reused for proving VCs at bytecode level, but they do not admit compiler optimizations. In 2008, Myreen [START_REF] Myreen | Formal verication of machine-code programs[END_REF] proposes to compile assembly code into functions in the HOL4 system. Our approach is somewhat close to this, using Why as target language instead of HOL4. Where Myreen must perform the proofs within HOL4, we can use various automatic provers thanks to the multi-prover feature of Why.

As far as we know, nobody ever considered any aspect of FP computations behavioral verication at the level of assembly. We believe that what we present in this paper is the rst method being able to prove architecture-and compilerdependent behavioral properties of FP programs.

Our approach and our prototype implementation demonstrate that handling architecture-dependent aspects is indeed possible. However it is clearly not mature enough for a non-expert user, because there are a lot of open issues. First, some languages features are not supported at the C level (like pointer casts) and also at the assembly level. Second, we are not always able to interpret all the compiler optimizations. For example we do not support inlining of functions. We believe that to go further, we should integrate our approach into the compiler itself, following the ideas of proof-carrying-code: the optimizations made by the compiler should also produce annotations of the generated assembly (assertions, loop invariants) to make the optimizations explicit.

Fig. 1

 1 Fig.1presents all the steps to prove an annotated C program by analyzing its assembly code. The specication language we consider is ACSL[START_REF] Baudin | AN-SI/ISO C Specication Language[END_REF], where

.

  globl d o u b l e r o u n d i n g .type d o u b l e r o u n d i n g , @ f u n c t i o n d o u b l e r o u n d i n g :

Fig. 3 .

 3 Fig. 3. Optimized versus non-optimized assembly

Fig. 4 .

 4 Fig. 4. Excerpt of KB3D program some quantities, for which rounding errors must be taken into account, here in function of a constant E declared at the beginning. Our goal is to analyze what should be the value of E depending on the architecture.Feeding this annotated source code in our assembly analyser in SSE2 mode, each VC is automatically proved valid using either Gappa or one of the SMT solvers Alt-Ergo or CVC3. The bound E is indeed in that case exactly the same as the one found by Boldo and Nguyen[START_REF] Boldo | Proofs of numerical programs when the compiler optimizes[END_REF] in a strict IEEE-754 mode. At least on this example, this shows that SSE2 assembly conforms strictly to the standard. The table below shows the value of E that are proved correct using various architecture-dependent settings.Architecture SSE2 x87 x87 FMA Optim. level

Fig. 5 .

 5 Fig. 5. Scalar product: annotated code

  considers the following program to illustrate dierences between architectures with respect to overows.

	No optimization		Optimized, level 1
	movabsq $ 9 2 1 4 8 7 1 6 5 8 8 7 2 6 8 6 7 5 2 , %rax	1	fldl .LC0 ( %rip )
	movq	%rax, -8( %rbp )	2	fld	%st ( 0 )
	fldl	-8( %rbp )	3	fmul %st ( 1 ) , %st
	fmull	-8( %rbp )	4	fdivp %st, %st ( 1 )
	fstpl	-16( %rbp )	5	fstpl -8( %rsp )
	fldl	-16( %rbp )	6	movsd -8( %rsp ) , %xmm0
	fdivl	-8( %rbp )	7 . . . .
	fstpl	-24( %rbp )	8 .LC0 :
	movsd	-24( %rbp ) , %xmm0	9	.long 2246822048
	. . . .		10	.long 2145504499
	double foo() {
		double v = 1e308;
		double y = v * v;
		return y/v;
	}

  table below displays the value of B in function of NMAX and the architecture-dependent settings. -54 2 -47 + 33 × 2 -63 129 × 2 -65 2 -47 1000 2 -44 + 2 -54 2 -44 + 513 × 2 -64 1025 × 2 -65 2 -44

	Architecture	SSE2	x87	x87	FMA
	NMAX		-O0	-O2
	10	2 -50 + 2 -54 2 -50 + 17 × 2 -65	17 × 2 -65 2 -50
	100	2 -47 + 2

  Instructions for arithmetic operations of the SSE family operate on 32-or 64-bit integers or oats, depending on the sux. The destination is always a register. Here is the interpretation of the multiplication, other operations being similar (with an additional precondition for division to check the divisor is not zero). mull src, reg i = set_int32 ( dest int32 * src int32 ) reg mulsd src, reg i = set_double ( dest double * src double ) ( dest exact * src exact ) reg In assembly code, %st or %st(0) denote the top of stack, whereas %st(i) denote the i-th register below the top.We could have represented this stack by an array in Why with an additional integer variable. However we can indeed identify statically the current top of stack while translating into Why, so we just represent the stack by 8 variables st0, . . . , st7 of type register ref.The only assumption we make in this optimization is that the stack is empty at functions entrance and exit. Our translator statically computes the value of the top-of-stack pointer at each instruction. This value must be unique whatever is the path of the control-ow graph to reach the instruction. We thus translate x87 registers %st(i) into Why variable sti where i = top_of _stacki.

	parameter set_int32: imm:int -> dest: register ref -> { is_int32(imm) } unit writes dest { integer_of_int32(sel_int32(dest)) = imm } parameter set_double : a:real -> exact:real -> b:register ref -> { no_overflow_double(nearest_even,a) } unit writes b { double_value(sel_double(b)) = round_double(nearest_even,a) and sel_exact(b) = exact } Notice that these procedures have pre-conditions to check for overow. More-over, the post-condition of set_double applies FP rounding: this is the way we interpret the IEEE-754 standard: the result of multiplication should be the same as it was rst computed in innite precision then rounded to the result format. (We hardwire the nearest even rounding mode here for simplicity.) x87 Arithmetic Instructions The x87 FPU has 8 FP registers to hold FP numbers in extended 80-bit precision. These registers are organized as a stack ST0ST7 and the current top of stack is identied internally with a special -→ let f() = .cfi_startproc /*@ requires P ; */ -→ assumes { P annot}; (body of the function f) -→ (body of the function f) i /*@ ensures Q; */ -→ assert { Q annot}; leave void ret .cfi_endproc parameter f: unit -> { P annot } unit writes w { Q annot } register. f: Fig. 6. Translation of a function in assembly to Why

⋆ This work was partly funded by the U3CAT project (ANR-08-SEGI-021, http: //frama-c.com/u3cat/) of the French national research organization (ANR), and the Hisseo project, funded by Digiteo (http://hisseo.saclay.inria.fr/)

The term strict here refers to the -fp-model strict or /fp:strict options of C compilers, or the strictfp keyword of Java, which explicitly requires the compilation to strictly conform to the standard.

obtained by options -mfma4 of gcc-4.5, requires -O2

All the instructions we use in this paper are written in AT&T assembly syntax.

As specied by the constraint "X", see http://gcc.gnu.org/onlinedocs/gcc/ Simple-Constraints.html