Jonathan Pastor
email: jonathan.pastor@imt-atlantique.fr

Jean Marc Menaud
email: jean-marc.menaud@imt-atlantique.fr

SeDuCe: a Testbed for Research on Thermal and Power Management in Datacenters

Keywords: Datacenters, Scientific testbed, Thermal management, Power management, Green computing

With the advent of Cloud Computing, the size of datacenters is ever increasing and the management of servers and their power consumption and heat production have become challenges. The management of the heat produced by servers has been experimentally less explored than the management of their power consumption. It can be partly explained by the lack of a public testbed that provides reliable access to both thermal and power metrics of server rooms. In this paper we propose SeDuCe, a testbed that targets research on power and thermal management of servers, by providing public access to precise data about the power consumption and the thermal dissipation of 48 servers integrated in Grid'5000 as the new ecotype cluster. We present the chosen software and hardware architecture for the first version of the SeDuCe testbed, highlighting its current limitation and proposing some improvements that will increase its relevance.

I. INTRODUCTION

The advent of web sites with a global audience and the democratization of Cloud Computing have led to the construction of datacenters all over the world. Datacenters are facilities that concentrate from a few servers up to hundreds of thousands of servers hosted in rooms specially designed to provide energy and cooling for the servers. These facilities are widely used for applications such as the hosting of web services or High Perfomance Computing.

In recent years, the size of datacenters is ever increasing, which leads to new challenges such as designing fault tolerant software to manage at large scale the servers and energy management of server rooms. On the latter challenge, many research efforts have been conducted [START_REF] Hermenier | Entropy: a consolidation manager for clusters[END_REF] [START_REF] Feller | Energy-aware ant colony based workload placement in clouds[END_REF], most of them focusing on the implementation of on demand power management systems, such as Dynamic voltage scaling (DVFS) [START_REF] Von Laszewski | Power-aware scheduling of virtual machines in dvfs-enabled clusters[END_REF] [START_REF] Wu | A green energy-efficient scheduling algorithm using the dvfs technique for cloud datacenters[END_REF] and vary-on vary-off (VOVO) [START_REF] Pinheiro | Dynamic cluster reconfiguration for power and performance[END_REF] [START_REF] Chase | Managing energy and server resources in hosting centers[END_REF]. Some work has been made to extend existing scientific testbeds with power monitoring of experiments : for example Kwapi [START_REF] Clouet | A unified monitoring framework for energy consumption and network traffic[END_REF] enables researchers to track the power consumption of their experiments conducted on Grid'5000.

On the other hand, the thermal management of servers has been less explored, a large part of the existing work considering only simulations [START_REF] Sun | Spatio-temporal thermal-aware scheduling for homogeneous high-performance computing datacenters[END_REF]. This can be explained, partly, by the difficulty of conducting experiments involving thermal monitoring of servers : to ensure that data recorded experimentally is valid, experimentions must be conducted on a testbed that contains many temperature sensors, not only positionned on cooling systems, but also at the front and the back of each server of racks.

In addition, such a testbed must enable reproducible experimentations, by providing its users with a full control on experimental conditions of their experiments and by exposing its data in a non misleading way, via a well documented API (Application Programming Interface).

Finally, as power management and temperature management of servers are related problems [START_REF] Moore | Making scheduling" cool": Temperature-aware workload placement in data centers[END_REF], there is a need for a testbed that enables users to access to both thermal and power data of servers.

As far as we know, there is no public testbed that enables researchers to work on both power and thermal aspects of servers functionning. The objective of the SeDuCe project is to propose such a testbed : SeDuCe testbed enables its users to use, in the context of the ecotype cluster integrated in the Grid'5000 infrastructure [START_REF] Bolze | Grid'5000: A large scale and highly reconfigurable experimental grid testbed[END_REF], 48 servers located in 5 airtight racks with a dedicated central cooling system (CCS) positioned inside one of the rack. In parallel of conducting the experiment by leveraging the tools provided by Grid'5000, users can get access to thermal and power data of the testbed via a web portal and a user-friendly API. Stability of experimental conditions is guaranteed by hosting the testbed in a dedicated room equipped with a secondary cooling system (SCS) that enables a precise thermo-regulation of the environment outside the cluster. As resources of the testbed are made publicly available via the Grid'5000 infrastructure, all its users will be able to perform reproducible research on thermal and power management of servers.

II. TESTBED DESIGN

A. Ecotype : a Grid'5000 cluster dedicated to the study of power and thermal management of servers

We have built the ecotype cluster, which is composed of 48 servers and has been designed for research related to power and thermal management in datacenters. The ecotype cluster is integrated in the Grid'5000 infrastructure and is made available to any of its users : they can reserve servers of the ecotype cluster and conduct experiments on them by using the usual Grid'5000 tools. Meanwhile they can access in real time to information regarding the temperature of the servers involved in their experiments, and get the power consumption of any parts of the testbed (servers, switches, cooling systems, ...).

Each server of the ecotype cluster is a DELL PowerEdge R630 that contains a pair of Intel Xeon E5-2630L v4 CPUs (10 cores, 20 threads per CPU), 128GB of RAM, and 400GB SSD. The CPUs have been designed to have a power consumption that is lower than other CPUs of the XEON 26XX serie, with a thermal design power (TDP) of 55W. Each server is connected via two 10GBe links to the Grid'5000 production network, and via a single 1GBe link to the Grid'5000 management network. Additionally, each server is certified to work in environments where temperature can be up to 35°C.

The cluster is composed of 5 Racks (Z1, Z2, Z3, Z4, Z5) and, as shown on Figure 1, one rack (Z3) is in charge of cooling the cluster by hosting a dedicated central cooling system (CCS), while remaining racks are computing racks and are dedicated to hosting servers.

As depicted by Figure 1, computing racks host 12 servers, following two layouts of server positions : one layout where servers are organised in a concentrated way with no vertical space between servers (Z1 and Z2), and a second layout where servers are spaced at 1U intervals (Z4 and Z5).

We have deliberately chosen to use these two layouts : they will enable to study the impact of a layout on the temperature and the power consumption of servers.

In addition to servers, the cluster contains three network switches that are in charge of connecting servers to production and management networks of the Grid'5000 testbed. Three racks (Z2, Z4, Z5) are hosting each a network switch.

The cluster has also been designed to leverage "Schneider Electric IN-ROW" racks that create an inside airtight environment for servers, and guarantee that the environment outside the cluster has a limited impact on temperatures inside the racks. The temperature inside the cluster is regulated by central cooling system (CCS), connected to a dedicated management network, which implements an SNMP service that enables to remote control the cooling and to access its operating data.

In addition, the temperature outside the cluster is regulated by a secondary cooling system (SCS) which is mounted from the ceiling of the server room : the SCS is in charge of maintaining a constant temperature in the server room.

Finally, we have installed Airflow management panels between servers, in order to separate the air of the hot aisle from the air of the cold aisle.

B. Power Monitoring

Each element composing the cluster (servers, network switches, fans, condensators, ...) is electrically monitored, and its power consumption is recorded every second in a database.

Electrical plugs of servers and network switches are connected to power distribution units (PDUs), which in turn share power consumption of servers and network switches via a dedicated service network. Each computing racks contains two PDUs, and each server of a computing rack has two electrical plugs. As depicted in Figure 2, the electrical plugs of a server are connected to two different PDUs, which enables servers to have electrical redundancy. The power consumption of each plug of a server can be fetched by issuing an SNMP request to the PDU it is connected.

In a similar way, energy consumption of the CCS can be fetched by requesting its SNMP service. This SNMP service is able to provide an overall power consumption of the CCS and also the power consumption of each internal part such as the condensator or the fans. The SCS does not implement any built-in networking access, and thus cannot share its metrics with any component over a network. To solve this problem, we instrumented several parts of the SCS by using a Fluksometer1 : a Fluksometer is a connected device that can monitor several electrical metrics (power consumption, voltage, amperage, ...) and expose their values over a network via a web-service.

Finally, we have added an additional system that tracks overall power consumption of both servers and the CCS. This additional system is based on the Socomec G50 metering board2 , an electronic board that can measure in real time the power consumption of several electrical plugs. We use the Socomec G50 for checking that the aforementioned source of power consumption data are sound. These additional metrics are fetched by using the modbus protocol.

C. Temperature Monitoring

In order to track the thermal behavior of the ecotype cluster, each server is monitored by a pair of temperature sensors : one sensor is positioned at the front of the server (in the cold aisle) and another sensor is positioned at the back of the server (in the hot aisle).

As depicted by Figure 2, each temperature sensor is a member of a bus (based on the 1wire protocol) connected to a Scanner (implemented by using a wifi arduino) in charge of gathering data from the temperature sensors of the bus. As the front and the back of each server is monitored by temperature sensors, computing racks have in total two Scanners and two buses : a front bus for monitoring the cold aisle and a back bus dedicated to the hot aisle. Scanners fetch temperatures from their sensors at a frequency of one reading per sensor every second.

For a first version of the SeDuCe testbed, we have chosen to use the DS18B20 sensor, a temperature sensor produced by "Maxim Integrated"3 that costs approximately 3$. According to the specifications provided by its constructor, this sensor is able to provide a temperature reading every 750ms with a precision of 0.5°C between -10 °C and 85 °C.

The key feature of the DS18B20 sensor is that it is able to work as part of an 1wire bus. In the context of the SeDuCe infrastructure, 12 DS18B20 sensors are connected together to form an 1wire bus, and a Scanner, an nodeMCU arduino with built-in wifi capabilities, fetches periodically their readings. The current version of the firmware used by Scanners scans an 1wire bus every seconds, and then pushes temperature data to a Temperature Registerer service, as illustrated in Figure 3.

We also developed a contextualisation tool to generate firmwares for the Scanners. It leverages the PlatformIO framework to program a Scanner that pushes data to a web-service. Using this contextualisation tool is simple : a developer needs to define a program template in a language close to C language and marks some parts of code with special tags to indicate that these parts need to be contextualized with additional information, such as initializing a variable with the ID of a Scanner device or with the address of a remote web-service (such as the one that will receive temperature records). The contextualisation tool takes this program and a context as input parameters, analyses the template program, and completes parts that requires contextualisation with information provided in the context, which results in valid C language source file. Then, the firmware is compiled and automatically uploaded to Scanners via their serial ports. By leveraging this contextualisation tool, we can remotely configure Scanners and update their firmware.

D. Seduce portal

To help users to easily access power and thermal metrics generated by the SeDuCe testbed, we developed a platform that exposes publicly two components : a web portal 4 and a documented API 5 (Application Programming Interface). As illustrated by Figure 3, the web portal and the API fetch data from a time series database (TSDB) based on InfluxDB6 . InfluxDB enables to store a large quantity of immutable time series data in a scalable way. In the background, InfluxDB creates aggregates of data by grouping periodically data from a same series. These aggregated sets of data enable the web portal to promptly load data used for visualization.

Two kind of components are in charge of inserting data in the database : the Power consumption crawlers and the Temperature Registerer. Power consumption crawlers are programs that are in charge of polling data from PDUs, Socomecs, Fluksometer, the CCS and the SCS. In turn, this data is inserted in the database. On the other hand, the Temperature Registerer is a web service that receives temperature data pushed from nodeMCU arduino devices, and inserts it in the database.

The web portal and the API are both written in Python and leverage the "Flask" micro web framework. The API component makes an extensive use of the Swagger framework 7 which automatises the generation of complete REST web services and their documentations from a single description file (written in JSON or YAML). This choice has enabled us to focus on the definition and the implementation of the API, by reducing the quantity of required boilerplate code.

All the components depicted in Figure 3 are implemented as micro-services. Our system is able to register 200 metrics per seconds with minimal hardware requirements (it is currently hosted on a single computer). In the case we add more sensors to our testbed, it is likely that the existing components would be sufficient. In the case that one of the component would not be able to cope with the additional workload, it would be easy to setup an high availability approach by using a load balancer such as the Nginx web-server that can forward requests to a pool of instances of the component.

III. EVALUATING THE DS18B20 SENSOR

In this section we evaluate the behaviour of the DS18B20 sensor in order to evaluate its fitness to the thermal measurement of the heat dissipated by servers.

A. Experimental Setup

The performance evaluation of the DS18B20 can be made regarding two criteria : the precision the temperature it reports, and its response time. The precision of a sensor corresponds to the difference between the reported temperature and the actual temperature (usually it is estimated by a calibrated reference thermometer). On the other hand, the response time of a sensor corresponds to the time taken by the temperature reported by the sensor to converge to the reference temperature.

The evaluation of these two parameters requires an experimental environment and the definition of an experimental protocol.

To ensure that the validation of the DS18B20 sensor is based on reliable data, we used an Hart Scientific 7103 microbath which contained a silicon oil maintained at a specified homogeneous temperature. The temperature inside the microbath was controlled by two thermometers (a PT100 probe and a Hart Scientific 1502A). We conducted two experiments : a first experiment to evaluate the precision of the temperatures reported by DS18B20 sensors, and a second experiment to evaluate the reaction time of DS18B20 sensors. To evaluate the precision of DS18B20 sensors, we plunged 5 sensors into a silicon oil configured to be at a precise target temperature. Once the temperature of the silicon oil is stabilized, we measured the temperatures reported by the 5 DS18B20 sensors during 20 minutes. The target temperature was initially set at 10 °C, and incrementally increased by steps of 10 °C.

B. Sensor precision

Table I summarizes the temperatures reported by DS18B20 sensors at each step of temperature.

First, it is noticeable that for each targeted temperature, the average temperature reported by a DS18B20 sensor is in a range of 1°C band around the target temperature. While this value is higher than the 0.5°C advertised by the manufacturer, it should be relativised : when the target temperature is set to 20°C the difference between the worst sensor and the reference temperature is less than 5%, and at 50°C it becomes lower than 2%. These results should also be put in the perspective of the price range of DS18B20 sensors (approximately 3$ per unit).

Second, it appears that for a given sensor, the difference between the reported temperature and the reference temperature is stable for any temperature steps. Thus, by comparing several temperature records of a DS18B20 sensor with those of a reference thermometer (such as the one we used to stabilize the silicon oil), it would be possible to modelise the difference between the temperature reported by the sensor and the reference temperature. This would enable the implementation of a calibration mechanism that will be in charge of correcting the difference between the reported temperature and the reference temperature.

C. Sensor reactivity

To evaluate the reaction time of DS18B20 sensors, we plunged a single DS18B20 sensor from the ambient air at a temperature of 23°C into a silicon oil at a temperature of 30°C. We measured the time taken by the temperature reported by the DS18B20 sensor to converge to the temperature reported by the reference thermometer. Figure 4 plots these measurements.

The sensors takes about 10 seconds to stabilize at the temperature reported by the reference thermometer. This delay can be explained by the fact the DS18B20 sensor uses a "TO-92" semiconductor package which leverages plastic to protect its internal components from the external environment. This plastic shield enables the sensor to be used in a wide range of environments. However, the drawback is that it creates a thermal inertia, as the heat has to first penetrate the plastic shield before reaching the electronic part of the sensor.

This result indicates that DS18B20 are not suitable for configurations where temperature can suddenly change as the reactivity of the DS18B20 sensor is low. However, it appears to be appropriate for cases where the temperature is already stabilized and will only change smoothly, such as about a few °C over tens of seconds, such as in the hot aisle of the cluster. IV. EXPERIMENTATION To illustrate the potential of the SeDuCe platform, we conducted an experiment that mixes energetic and thermal monitoring. The goal of the experiment was to verify that the data produced by the SeDuCe testbed is reliable, by designing an experiment that will use both the thermal and the power data produced by the testbed. These data would be used to reproduce a scientifically validated observation, such as the impact of idle servers on the power consumption and the temperature of a server room.

Such experiment has been conducted in the past [START_REF] Moore | Making scheduling" cool": Temperature-aware workload placement in data centers[END_REF], however as far as we know there is no public testbed that would enable researchers to reproduce this result : by reproducing this result on the SeDuCe testbed, we think that it would demonstrate the soundness of our approach and the usefulness of our testbed.

A. Description of the experiment

To illustrate the scientific relevance of our testbed, we wanted to reproduce the observations made by third party publication [START_REF] Moore | Making scheduling" cool": Temperature-aware workload placement in data centers[END_REF].

In [START_REF] Moore | Making scheduling" cool": Temperature-aware workload placement in data centers[END_REF], authors have highlighted an interesting fact : in a datacenter idle servers (i.e. servers that are turned on while not being used to execute any workload) have a significant impact on power consumption and heat production. We decided to try to reproduce this observation.

For this experiment, servers of the ecotype cluster are divided in three sets of servers:

• Active servers: servers with an even number (ecotype-2, ecotype-4, ..., ecotype-48) were executing a benchmark that generates a CPU intensive workload. • Idle servers: a defined quantity (0, 6, 12, 18, 24 servers) of servers with an odd number (ecotype-1, ecotype-3, ..., ecotype-47) was remaining idle. • Turned-off servers: remaining servers were electrically turned off.

and during one hour we recorded the power consumption of the CCS and the average temperature in the hot aisle of the ecotype cluster. The CPU intensive workload was based on the "sysbench" tool : the goal was to stress CPUs of each servers, resulting in an important power consumption and a bigger dissipation of heat. To guarantee the statistical significance of the measurements, each experimental configuration was repeated 5 times, leading to a total number of 25 experiments.

We executed two sets of experiments : one with the SCS turned-on (Figure 5) and the other while the SCS was turned off (Figure 6). The objective of turning off the SCS was to identify the impact of the SCS over the CCS.

B. Results

Figure 5 plots the cumulated power consumption of the CCS and the average temperature in the hot aisle of the cluster with the SCS enabled.

First, it is noticeable that as the number of idle nodes increases, both the energy consumed by the SCS and the temperature in the hot aisle of the rack increase. This can be explained by the fact that an idle node consumes some energy and produces some heat, which increases the workload of the CCS.

The second element highlighted by Figure 5 is that the impact of idle nodes is not linear : the red line representing the CCS consumption follows an exponential pattern and the blue line representing the average temperature in the hot aisle follows a sigmoid pattern. The exponential pattern of the power consumption of the CCS can be explained by the fact that the heat produced by a given server has an impact on the temperature of surrounding servers, which causes the creation of "hot-spots". These hot-spots are difficult to cool down, and they increase the needs in terms of cooling. As the temperature of hot spots is higher that the average temperature in racks, when a sensors of the CCS detects an hot-spot, it leads the CCS to work intensively and more frequently to reduce the hot-spot. On the other hand, the sigmoid pattern of the average temperature in the hot aisle is explained by the fact that the CCS has its own monitoring of the temperature inside racks, and when temperatures at the back of servers reach a threshold, the CCS works more frequently and intensively to make the average temperature back under a specific threshold, thus attenuating the increase of the temperature in the hot aisle.

Figure 6 plots the cumulated power consumption of the CCS and the average temperature in the hot aisle of the cluster while the SCS is disabled. This figure highlights that the power consumption of the CCS is lower when the SCS is disabled. This can be explained by the fact that the SCS was configured to maintain a temperature of 19 °C in the outside room, which corresponds to the maximum temperature target of the CCS : the outside air, by means of thermal conduction, contributes to warm the air inside the racks at a temperature that activates the CCS. As a consequence, it increases the needs in term of cooling inside the cluster, leading to an higher power consumption of the CCS.

This experimental campaign has shown that idle servers have an important impact on the power consumption of cooling systems and overall racks temperature, thus it confirms the observation made in this publication [START_REF] Moore | Making scheduling" cool": Temperature-aware workload placement in data centers[END_REF]. C. Increasing the reactivity of temperature sensors While being suitable for monitoring temperatures in the hot aisle of our cluster, we have noticed that DS18B20 sensors were experiencing difficulties track the sudden temperature changes that occur in the cold aisle when CCS is active. Figure 7 compares a DS18B20 sensor and with several thermocouple based sensors, one based on the Graphtec GL 220, and two thermocouples based on the MAX31850K card, all positioned in the cold aisle at the front of the "ecotype-42" server, and recording temperatures during a typical instance of the CCS workload. We used the GL 220 to define a reference temperature in the cold aisle. At t=80s, the CCSs just finished cooling the cold aisle, thus the temperature has reached its lowest level and is going to increase. The CCS restarts to cool the cluster at t=180s. It is noticeable that the temperature measured by the thermocouple based sensor drops significantly after few seconds, while the DS18B20 sensor measures a temperature that is falling gradually over a hundred of seconds. Even worse, we can see at t=430s that the minimal temperature measured by the DS18B20 sensor does not correspond to the minimal temperature reported by the thermocouple based sensors, but rather to the intersection between its decreasing measured temperature and the increasing temperature measured by thermocouples. We explain this observation by the thermal design of the DS18B20 : as stated in Section III-C it leverages the "TO-92" semiconductor package which leads to a significant thermal inertia in air environment. On the other hand, thermocouple based sensors have a better reactivity : they can reactively track the decrease of temperature. It is also noticeable that the temperature reported by the two MAX31850K board are very close to the reference temperature reported by the GL 220. However, the two MAX31850K we used were embedded on the ADA1727 board, manufactured by Adafruit, which has a unit cost of 14.95$. In Section V we will study an approach that enables to reduce the unit cost of MAX31850K thermocouples. In Section IV-C, the potential of thermocouple based sensors for reactive temperature measurements has been highlighted. For the second version of the SeDuCe testbed, we have studied the replacement of DS18B20 sensors by thermocouple sensors based on the MAX31850K which is compatible with the 1wire protocol. However, the most popular electronic card featuring the MAX31850K, the ADA1727 board manufactured by Adafruit, costs 15$, which 5 times more expensive than the DS18B20, and it only features a single thermocouple channel.

V. FUTURE WORK

We have designed our own electronic board to reduce the cost of using many thermocouple based sensors. Figure 8 depicts our SeDuCe board, which features 16 thermocouples channels, based on 16 MAX31850K chips connected via an 1wire bus. We have added 2 lines of pin female headers for pluggin a nodeMCU Arduino, and a micro USB port that supplies the board and the Arduino with electricity.

VI. CONCLUSION

In this article we have presented our initial work on building the SeDuCe testbed, which targets research related to power and thermal management in datacenters. We have described the architecture of the testbed, which is built on buses of sensors, storage of power and thermal metrics in a time series oriented database (InfluxDB) and an user friendly web portal and a documented API. We have also detailed the components used in this first version of the SeDuCe testbed, and their limitations such as the lack of reactivity of the DS18B20 sensor, a low cost temperature sensor that shows its limits in situation where temperature changes suddendly. However, this model of sensor remains relevant in a large number of situations. Future work on this first version of the SeDuCe testbed will mainly focus on evaluating more reactive temperature sensors. We are thinking to replace all or a part of the existing sensors by thermocouple based sensors, whose main advantages are that they are more reactive and more precise while remaining affordable.

Figure 1 .Figure 2 .

 12 Figure 1. Layout of the ecotype cluster (front view) PDU 1 PDU 2

Figure 3 .

 3 Figure 3. Architecture of the SeDuCe portal

  .86 ± 0.05 10.24 ± 0.03 10.06 ± 0.06 10.91 ± 0.05 10.13 ± 0.02 20 °C 20.75 ± 0.00 20.00 ± 0.02 19.98 ± 0.05 20.86 ± 0.04 20.00 ± 0.00 30 °C 30.74 ± 0.04 29.93 ± 0.07 29.91 ± 0.06 30.82 ± 0.06 29.97 ± 0.06 40 °C 40.72 ± 0.05 39.81 ± 0.06 39.87 ± 0.05 40.77 ± 0.06 39.92 ± 0.07 50 °C 50.72 ± 0.05 49.75 ± 0.07 49.85 ± 0.06 50.75 ± 0.07 49.89 ± 0.08 60 °C 60.76 ± 0.03 59.76 ± 0.05 59.88 ± 0.03 60.79 ± 0.06 59.93 ± 0.06 70 °C 70.83 ± 0.06 69.79 ± 0.06 69.92 ± 0.06 70.86 ± 0.03 69.99 ± 0.04TABLE I. Comparison of 5 DS18B20 sensors (mean temperature ± standard deviation)

Figure 4 .

 4 Figure 4. Reactivity of a DS18B20 plunged in a silicon oil at 30°C temperature

Figure 5 .Figure 6 .

 56 Figure 5. Central cooling consumption and average temperature in the hot aisle (SCS enabled)

Figure 7 .

 7 Figure 7. Comparison between DS18B20 and thermocouples

Figure 8 .

 8 Figure 8. Prototype of the SeDuCe board

https://www.flukso.net/about

https://www.socomec.com/range-communication-interfaces en.html? product=/diris-g en.html

https://datasheets.maximintegrated.com/en/ds/DS18B20.pdf

https://seduce.fr

https://api.seduce.fr/apidocs

https://www.influxdata.com/

https://swagger.io/


S Ordas

L Guillaume-Sage

K Tobich

J.-M Dutertre
email: dutertre@emse.fr

P Maurine

Evidence of a larger EM-induced fault model

Electromagnetic waves have been recently pointed out as a medium for fault injection within circuits featuring cryptographic modules. Indeed, it has been experimentally demonstrated by A. Dehbaoui et al. [3] that an electromagnetic pulse, produced with a high voltage pulse generator and a probe similar to that used to perform EM analyses, was susceptible to create faults exploitable from a cryptanalysis viewpoint. An analysis of the induced faults [4] revealed that they originated from timing constraint violations. This paper experimentally demonstrates that EM injection, performed with enhanced probes is very local and can produce not only timing faults but also bit-set and bit-reset faults. This result clearly extends the range of the threats associated with EM fault injection.

Introduction

Besides power and EM analyses [START_REF] Paul | Timing attacks on implementations of di e-hellman, rsa, dss, and other systems[END_REF][START_REF] Gandolfi | Electromagnetic analysis: Concrete results[END_REF], fault injection constitutes [START_REF] Boneh | On the importance of checking cryptographic protocols for faults (extended abstract)[END_REF] a serious threat against secure circuits. Among the means used to inject faults within cryptographic circuits, the laser [START_REF] Skorobogatov | Optical fault induction attacks[END_REF] is undoubtedly the most popular because of its high spatial and temporal resolutions. However, fault injection with laser is facing di culties. Among them one can identify the increasing number of metal layers (up to 12 levels) used to rout signals in a chip, this may forbids the use of laser to inject fault through the frontside. The second di culty one may point out is the long practice of laser injection and the related and progressive development of more and more e cient countermeasures like embedded laser shot detectors. It is therefore not surprising that adversaries looks for new mediums for injecting faults. Two fault injection means appeared recently. One of them is the injection of a voltage spike directly into the substrate of the targeted integrated circuit to produce ground bounces or voltage drops according to the polarity of the spike [START_REF] Tobich | Voltage spikes on the substrate to obtain timing faults[END_REF]. The other is EM injection which, despite the early warning of Quisquater et al. in 2002 [START_REF] Bayon | Contactless electromagnetic active attack on ring oscillator based true random number generator[END_REF], did only find recently a larger echo in the scientific bibliography thanks to its inherent advantages: its ability to inject faults through the package and the frontside being the most important as highlighted in [START_REF] Schmidt | Optical and em fault-attacks on crt-based rsa: Concrete results[END_REF] in which a high frequency spark gap is used to produce faults in a CRT-RSA.

Two types of EM injection platforms can be mounted to induce faults into circuits. Harmonic EM injection platform refers to the first type. It produces sine EM waves, that can be modulated in amplitude or not, to produce faults. Such type of platform has been reported e cient in [START_REF] Poucheret | Local and direct em injection of power into cmos integrated circuits[END_REF] to disturb the behavior of an internal clock generator and in [START_REF] Bayon | Contactless electromagnetic active attack on ring oscillator based true random number generator[END_REF] to bias a true random number generator.

EM Pulse (EMP) platform refers to the second type of platform which is detailed in section 2. It produces a single but powerful electromagnetic pulse that creates a sudden current flow in the power/ ground networks of an integrated circuit (IC) and therefore voltage drops and/or ground bounces. Such type of platform was first reported e cient in [START_REF] Dehbaoui | Injection of transient faults using electromagnetic pulsespractical results on a cryptographic system[END_REF] to inject faults into a quite old microcontroller (designed with a 350nm technology). The analysis of the fault obtained using such a platform was conducted in [START_REF] Dehbaoui | Electromagnetic transient faults injection on a hardware and a software implementations of aes[END_REF]. This paper concludes that EM injection produces timing faults and more precisely setup time constraint violations as described in section 3. As a result of this observation, a delay-based glitch detector was evaluated against EM injection in [START_REF] Zussa | E ciency of a glitch detector against electromagnetic fault injection[END_REF] and demonstrated partially e cient.

If the results reported in [START_REF] Dehbaoui | Injection of transient faults using electromagnetic pulsespractical results on a cryptographic system[END_REF] are convincing, they limit de facto the interest of EM Pulses (EMP) for injecting faults into smartcards. Indeed, nowadays smartcards are typically designed with the 90nm process and operate at a reduced clock frequencies (< 40MHz). They are therefore characterized by large timing slacks i.e. the time margin between a circuit critical time and the clock period). They are thus quite robust to EM injection (considering the ranges and the slew rates of modern high speed voltage generators) if the latter does only produce timing faults. Indeed, producing timing faults in such circuits requires the use of extremely powerful pulse generator to produce su ciently intense EMP. Additionally producing such EMP reduces the spatial resolution of the EM injection. This paper addresses this limitation. It experimentally shows that EM injection can also produce other types of faults, like bit-set and bit-reset faults, provided enhanced injectors, that allow to concentrate the magnetic flux on a small part of the IC surface, are used. The rest of the paper is organized as follows. First, the EM injection platform, including the enhanced injectors, used to demonstrate that EM injection can produced bit-set and bit-reset fault is described in section 2. In section 3, the ability of EM injection in producing timing fault is verified and the conditions at which timing faults appear in an AES embedded into an FPGA (90nm) are characterized. Then section 4 gives evidences that EM injection is able to produce bit-set and bit-reset faults into the same FPGA. Conditions at which the bit-set and bit-reset faults appear are also characterized. Finally, section 5 proposes a discussion related to the EM fault model before concluding in section 6.

EM injection platforms, both harmonic and pulsed, are briefly described in [START_REF] Maurine | Techniques for em fault injection: Equipments and experimental results[END_REF]. In this section, a more detail description of the EM pulsed injection platform used to obtain the experimental results reported in this paper is given. Both the setup and EM injectors are discussed.

EM Pulse Platform (EMP platform)

The goal of an EMP platform is to generate, in the close vicinity of the targeted device, an intense and sudden variation of the magnetic field. This variation of the magnetic flow is then captured by some of the metallic loops formed by the power / ground networks. A sudden and intense current variation thus appears in the IC and results in voltage drops and ground bounces. Because, the IC does not operate under its normal voltage conditions, faults are expected to appear.

The EMP platform considered in the rest of the paper is shown in Fig. 1. It features a laptop that controls the whole platform through serial ports, a 3-axis positioning system to place the EM injector with an accuracy of ±5µm at the surface of the Device Under Analysis (DUA), a 3-axes vision system made of USB microscopes connected to the laptop. An oscilloscope is also used in order to monitor the synchronization between the EMP and the target's operations. The pulse generator is a main element of the platform. It delivers, to the EM injector, a voltage pulse of amplitude V pulse as high as 200V (current 8A), with a width that ranges between 5ns and 100ns. Its settling times are lower than 2ns. Because an adversary aims at injecting faults in some specific part of the target's computations while letting the other parts' computations fault free, the EMP should be localized in the smallest possible area. For that, the adversary can design some specific and miniaturized EM injectors.

EM-Injectors

Various EM-injectors can be used according to the context of the analysis. Fig. 2 shows three types of injectors we typically use. All are hand made and designed around a ferrite core to guide the magnetic field lines toward the target. All are also designed in di↵erent sizes. 'Flat' injectors (see Fig. 2-a) were designed with ferrite diameter ranging between 750µm and 300µm. 'Sharp' injectors were designed with tip end as small as 50µm (see Fig. 2-b). Finally, 'Crescent' injectors were designed with an air gap separation 's' (see Fig. 2-c) of the ends as small as 450µm.

The 'Flat' and 'Sharp' Injectors have been typically designed to localize the magnetic flow below the ferrite tip end. In that case, sharpening the tip-end of the ferrite (see Fig. 2-b), as proposed in [START_REF] Omarouayache | Magnetic microprobe design for em fault attackmagnetic microprobe design for em fault attack[END_REF], allows to further concentrate the flow into a smaller area and thus to expect a higher spatial resolution. Note however that contrarily to what has been obtained by simulation in [START_REF] Omarouayache | Magnetic microprobe design for em fault attackmagnetic microprobe design for em fault attack[END_REF] , practice showed that 4 to 7 turns around the ferrite provide better results than 1 or 2. However, practice also shows that increasing further the number of turns does not help in producing faults and can be counterproductive. Some magnetic field lines can couple with interconnects quite far from the tip end indeed. If both the 'Flat' and 'Sharp' injectors are e cient, they su↵er from a same drawback. The magnetic field lines form close loops from one tip end to the other in an ellipsoid shape as this is roughly represented in the Fig. 2-b by the red arrows. This implies that the resolution can be not so high even if the magnetic field is extremely strong below the tip end of the 'Sharp' Injectors.

'Crescent' EM injectors were designed to circumvent this limitation. The idea was to create a circular magnetic field in order to concentrate it between the two ends of the crescent-shaped ferrite. This is expected to avoid (or limit) any magnetic pollution all around the space separating the two ends because the magnetic lines should get out from one end, then surround the top layer of the power / ground network before coming back into the ferrite by the other end. Additionally, because of their geometry, 'crescent' EM injectors have an interesting property: they are directional. If rotated around the z-axis, the field lines direction will also rotate of the same angle. This may modify the properties of the coupling between the injector and the target. This is not the case for the 'Flat' and 'Sharp' injectors because of their cylindrical geometry.

Occurrence of timing faults

Almost all digital ICs are synchronous. Their internal operations are synchronized with a common clock signal. Fig. 3 depicts the principle of their internal architecture: blocks of computational logic, to process the data, surrounded by 'launch' and 'capture' registers (or DFF, D flip-flop). The data stored in a 'launch' DFF are released at the logic's input on a clock rising edge, processed through the logic, then latched into a 'capture' DFF at the next clock rising edge. The use of synchrony leads to timing constraint requirements (as partially exposed hereafter) which violation may induce computation faults. Thus the authors of [START_REF] Dehbaoui | Injection of transient faults using electromagnetic pulsespractical results on a cryptographic system[END_REF] showed on experimental grounds that EM injection, performed with raw EM injectors, produces timing faults (induced by setup time constraint violations). This observation should explain why a glitch detector was tested and find partially e cient in detecting EM injection in [START_REF] Zussa | E ciency of a glitch detector against electromagnetic fault injection[END_REF]. The setup time constraint is related to the amount of time spent by the circuit to process a data. This time, roughly speaking, should be lower than the clock period of the target as written more precisely in eq. 1:

T Clk > D Clk2Q + D pM ax + T setup + T skew + T jitter (1)
where T Clk is the clock period, D Clk2q the delay spent by the 'capturing' DFF to launch a new data on its outputs after the clock rising edge (see Fig. 3), T setup the setup time of the DFF capturing one bit of the resulting computation, T skew and T

jitter the skew that may exist between the clock signals of 'launch' and 'capture' DFFs and its jitter. Finally, D pM ax is the biggest propagation delay of the signal in the computational logic of the device. The time margin that exists between the two hand-sides of eq. 1 is commonly called the timing slack.

D

pM ax depends on many factors. Among them, the most interesting, when dealing with EM fault injection, are the supply voltage V dd and the processed data. Indeed, EM injection is expected to alter V dd locally and thus to modify the value of D pM ax so that a fault appears by violation of equation 1 (i.e. a setup time constraint violation). In this instance, EM injection leads to an increase of D pM ax that makes the right hand-side part of eq. 1 bigger than its left handside part (the timing slack became negative). Similarly, when changing the data processed by the circuit, all terms in eq. 1 remain unchanged except D pM ax that can change significantly. This change in the D pM ax value from one dataset to the other thus alters the value V pulse that must be chosen to produce a fault. The data dependence of D pM ax is illustrated in Fig. 4. We performed EM fault injection on an FPGA that embeds an AES hardware module (AES, or advanced encryption standard, is a symmetric encryption algorithm) processing random texts. EMPs targeted the 9 th round of the AES. For any given dataset, the magnitude V pulse of the voltage pulse inducing the EM perturbation was progressively increased from 60 V to 200 V . A first set of experiments was carried out with the FPGA running at a clock frequency of 100 MHz. The obtained fault occurrence rate is drawn as a function of V pulse in Fig. 4. Below ⇠ 120 V no fault was injected. As V pulse increased further to ⇠ 175 V , the fault occurrence rate grew progressively from 0 % to 100 %. This range corresponds to the appearance of timing violations. However, depending on D pM ax , which changes with the currently handled data, the fault probability increases progressively. Beyond a ⇠ 175 V V pulse , EM fault injection became systematic. A second set of experiments was performed with the FPGA running at 50 MHz and also processing the same dataset. We were expecting that this increase of the clock period, which is obviously related to an increase of the timing slack, would shift the fault occurrence rate towards higher V pulse magnitudes. The obtained fault probability curve at 50 MHz is depicted in Fig. 4, it exhibits a 15 V shift. Moreover, the induced faults were the same at both 50 MHz and 100 MHz for any given dataset. These results are consistent with an EM fault injection mechanism related to timing violations, it is a further experimental reassurance. At that stage, it should be noticed that lowering further the clock frequency (below 20 MHz) leads to a probability of obtaining a fault stuck at 0 % for V pulse 2 [ 200V, 200V ] for this positioning of the EM injector. This is a direct illustration of the limitation associated to EM injection if the latter produces only timing faults. Nevertheless, faults were also observed when the AES was forced to operate at a low clock frequency. This observation suggested us that EM injection does not only produce timing faults.

Evidence of a bit-set/bit-reset fault model

In section 3, the occurrence of timing faults was confirmed. This section intends to experimentally demonstrate that EMPs are also able to induce both bit-set and bit-reset faults into the DFFs of an IC. We define a bit-set (resp. bit-reset) fault as forcing to high (resp. low) level the state of a DFF initially at low (resp. high) level as a result of a disturbance (an EMP injection in our case). To avoid injecting timing faults while performing the experiments reported in this section, the target's clock was stopped during EMP injection.

Detecting bit-set and bit-reset faults: test chip and experimental procedure

Aiming at demonstrating the occurrence of bit-set and bit-reset faults, a specific test chip was designed. Our intend was to be able to easily write and read the content of DFFs to detect, by simple comparison, the occurrence of bit-set or bitreset faults. A large FIFO featuring (640 ⇥ 8) DFFs (64 bytes) was mapped into a Xilinx spartan 3E-1000 (technology node 90nm). Fig. 5 shows the floorplan of this design. At that point, it should be noticed for the remainder of the paper that all DFFs were mapped with their reset signal active low and their set signal active high. This test chip was exposed to EMPs for the purpose of drawing a fault sensitivity map. The following and automated procedure was adopted in order to detect (i.e. experimentally demonstrate) the occurrence of bit-set and bit-reset faults:

-1 st step: the EM injector is placed at a given {X, Y } (initial value {0, 0}) coordinate above the test chip, in its close vicinity (i.e. close to contact) in order to maximize the spatial resolution of the EM injection, -2 nd step: the content of each byte of the FIFO is set to the hexadecimal value 'AA' ('10101010' in binary), -3 rd step: the clock signal is stopped in order to avoid the occurrence of a timing fault, -4 th step: an EM pulse, with an amplitude V pulse ranging between -200V and 200V is delivered to the EM injector, -5 th step: the clock signal is re-activated after a while (several µs) and the content of the FIFO recovered, -6 th step: the initial and final contents are compared (a xor operation) in order to detect the occurrence of bit-set and bit-reset faults, and the result of the comparison is stored in a log file.

-7 th step: steps #2 to #6 are repeated 9 times in order to estimate the probabilities to obtain bit-set and bit-reset faults at the current position {X, Y }, -8 th step: restart the procedure at step #1 at a new {X, Y } coordinate in order to obtain a fault sensitivity map of the target.

Occurrence of bit-set and bit-reset faults

Many fault sensitivity maps of the target were drawn according to the procedure described in subsection 4.1 for di↵erent values of V pulse ranging from -200V to 200V. Di↵erent probes were used. However, we report herein only the results obtained with a 'crescent' injector characterized by 's = 450µm' because these results are the best from a spatial resolution point of view.

During all these experiments, four types of circuit's behavior were observed:

injection of bit-set faults into a given number of DFFs, injection of bit-reset faults into a given number of DFFs, -'Mute' or loss of communication with the circuit, fault free.

Fig. 6 shows three fault sensitivity maps obtained with a displacement step of the EM injector equal to 300µm (¡ to the air gap of the crescent probe). The whole die surface (5500µm⇥5000µm) was scanned resulting in 4500µm⇥2400µm fault sensitivity maps because of the shape of the EM injector and a of guard-banding to avoid any collision of the injector with bondings. These maps were obtained with the following settings: V pulse = +170V and a pulse width P W = 8ns. Fig. 6-a shows the probability to have faults regardless of the type of the obtained faults (either bit-set, bit-reset or Mute). Fig. 6-b reports the probability to have bit-set faults while Fig. 6-c gives the probability to have 'Mutes'. Finally, Fig. 6d shows the orientation of the injector above the IC surface, a parameter that will be discussed later because of the directionality of the injector. Two kind of 'Mutes' were observed. The first category is characterized by a no response of the IC that does not imply to reprogram the FPGA in order to relaunch the cartography. This suggests the occurrence of a fault in one of the DFF of the finite state machine. The second category was more severe. Indeed relaunching the cartography requires in that case to reprogram the FPGA. This suggests that the bitstream was corrupted by the EM injection. Obtaining these sensitivity maps, especially the one of Fig. 6-b, constitutes an experimental demonstration that EM injection, conducted with enhanced injectors, is able to produce bit-set faults. This was our first objective. Additionally, one may observe once again that EM injection is local and reproducible. Indeed, we did verify that the bit-set faults obtained, at a given coordinate from one injection to another, were exactly the same.

Correlation between the EMP polarity and the occurrence of

bit-set and bit-reset faults.

Despite being a proof that EMP injection may inject faults into registers which are not related to timing violations, the experiments reported in subsection 4.2 never leaded to a bit-reset fault. Considering that the set signal of the DFFs was active high and that their reset signal active low, a similar set of experiments was relaunched for both achievable polarities of the EMPs: with V pulse = 140V and +140V instead of +170V only. The idea that motivated this experiment was the assumption that a pulse of a given polarity may a↵ect more the ground network than the power network (or vice-versa). Therefore, it may be easier to induce bit-set than bit-reset faults (or the contrary) depending on the EMP polarity. Note however that the polarity is here an arbitrary notion that depends in our case of both the injector orientation and the sign of the voltage spike. For the sake of simplicity, we choose here to define the polarity as positive when the pulse a↵ects more the 'set' signal which is active high than the 'reset' signal which is active low. pulse reduces the size of the fault sensitive areas. Note however, that the two maps remain similar in shape. This indicates that the magnitude V pulse is an e cient control parameter for EM injection, as it was expected. Fig. 7-b gives the probability to obtain bit-reset faults when applying a negative pulse of amplitude 140V ; during this set of experiments not any bit-set fault was induced. One may observed that the two cartographies are completely di↵erent indicating that the susceptibility of an IC to a positive or a negative pulse may be radically di↵erent.

Nevertheless, the main conclusion that can be drawn from these experiments is that the pulse polarity (and therefore the injector orientation) is a key factor in controlling the type of EMP-induced faults. It seems to allow targeting more the ground network than the power network according to the topology of the IC. These results also suggest that according to their occurrence, bit-set and bit-reset faults are related to the way DFF are designed (set / reset signals active low or high). However, further investigations are mandatory to sustain this assumption.

Threshold voltage for the occurrence of bit-set faults

The evolution with V pulse of the probability to obtain timing faults has been experimentally estimated in section 3. According to [START_REF] Dehbaoui | Electromagnetic transient faults injection on a hardware and a software implementations of aes[END_REF], this evolution should be smooth when random plaintexts are passed to the AES because the electrical paths and therefore the minimum timing slack changes with the processed plaintexts. This has been verified in section 3. Indeed, this evolution has been found, for the AES mapped into the FPGA and the considered positioning of the injector, varying from 10% to 90% for V pulse ranging from 130V to 180V when the AES operates at 100 MHz. The evolution with V pulse of the probability to obtain bit-set faults has also been measured at several {X, Y } coordinates for di↵erent values of the supply voltage, V dd, of the FPGA. Fig. 8 shows the result obtained for one positioning of the injector but for di↵erent Vdd values. As depicted, for this positioning, as well as for many other that have been tested, the evolution is really sharp. The probabilities vary from 10% to 90% when the the magnitude of V pulse varies from less than 1V, which is the voltage resolution of our pulse generator. This confirms the crossing of a threshold, V th pulse , above which the probability to obtain a bit-set (or a bit-reset) is equal to 1. Additionally, this threshold voltage slowly varies with the supply voltage of the FPGA. It should also be noticed that from one positioning of the EM injector to another one, V th,bit set pulse can vary for several tens or even move out of the voltage range of our pulse generator (-200V to +200V). Fig. 9. Evolutions of the Probabilities to obtain bit-set faults with V pulse when the EM injector is parallel or orthogonal to the X-axis

EM injector orientation

In section 2, it is mentioned that 'crescent' injectors, because of their geometry, produce a polarized magnetic field, i.e. are directional. This characteristic of these enhanced EM injectors was experimentally verified. Two fault sensitivity maps were drawn (V pulse = 140V ) with the EM-injector positioned parallel and perpendicular to the X-axis as illustrated in Fig. 9 which also discloses the obtained maps. It is obvious that the susceptibility of the IC to magnetic fields parallel and perpendicular to the X-axis is di↵erent. This could may be be explained by the way the top metal layers of the power (V dd) and ground (Gnd) networks are routed. It is common practice to route perpendicular to each other the V dd and Gnd metal lines. However, we didn't have this information for the FPGA under consideration. Nevertheless, this result confirms that 'crescent' injector are, as expected, directional. EM injection and the type of induced faults. Fig. 10-a and -b (resp. -e andf) show the e↵ect of the positioning of the injector; all others settings being constant. These sub-figures highlight that EM injection can be very local. Fig. 10a and -c allow to observe the e↵ect of V pulse . Fig. 10-a,-b,-c should be compared to Fig. 10 -d,-e and -f to observe the impact of the injector orientation. Fig. 10 -d should be compared to -e or -f to observe the e↵ect of polarity. These six maps allow to observe that both the area a↵ected (let's denote it by spatial resolution even if it is not the most appropriated term) by the EM injection and the types of induced faults (from single bit to multi-bits and from single byte to multi bytes that were all observed during our experiments) strongly depend on several parameters: the pulse amplitude and its polarity, the injector position and its orientation. It was also observed (not illustrated herein) that the distance d (d= 0 to d=1.5mm in our experiments) separating the injector from the IC surface changes significantly the obtained results. Nevertheless, even if the size of the area a↵ected by the EM injection significantly varies with the aforementioned parameters, one may observe the e↵ect is not global but more or less local according to the settings of the injection. These observations could be explained by the mechanism exploited by EM injection : a local EM coupling between an emitting antenna and one or several receiving antennas. This implies that the spatial resolution and the e↵ects produced by EM injection depend of course on the characteristics the EM injector (emitting antenna) but also on the characteristics of the receiving antennas, i.e. on the way the supply network of the IC is designed. It is therefore extremely di cult to define the spatial resolution of an EM injection, or to give any figure. It depends on both the Device Under Test and the settings of the injection. One may only characterize the spatial resolution of its injector in free space; but this is of reduced interest for the practice of EM injection.

As a result, let us conclude that there are several parameters (additional parameters with respect to laser injection) allowing to select the area a↵ected by the EM injection and the faults that are produced. The EM injection can thus be perceived as more complex than laser injection in this regard. However, EM injection o↵ers more degrees of freedom (more tuning parameters), to obtain the desired faults. However, their induction remain conditioned by the presence of the appropriated receiving antenna(s) in the IC. Experiments revealed there are plenty. One has just to target the right ones with an e cient EM injector, i.e. with the EM injector having the best spatial resolution in the empty space. At the moment, no general recipe emerges to quickly and directly find the rights settings for a given desired e↵ect. Experimentation still prevails.

Discussion

At that stage, it has been experimentally observed that EM injection can produce timing faults. This result was expected from [START_REF] Dehbaoui | Electromagnetic transient faults injection on a hardware and a software implementations of aes[END_REF]. It has also been verified that the minimum pulse amplitude, V th,timing pulse , to produce, with a high probability (> 0.8), a timing fault depends on the plaintext processed by the AES: it could vary for one or four tens of volts from one plaintext to the other.

Additionally to these results, we experimentally demonstrated that EM injection, conducted with enhanced EM injectors, can produce bit-set and bit-reset faults in more or less local manner according to the settings of the EM injection. It was also observed that the minimum pulse amplitudes related to the injection of bit-sets or bit-resets with a probability higher than 0.8 can vary for several tens of volts from one positioning of the EM injector to another one.

All these considerations suggest that it is particularly di cult to decide if a fault induced by an EMP is a timing fault, a bit-set or a bit-reset. It is even possible that all type of faults coexist during a same EM injection. Nevertheless, the experimental demonstration that EM injection can produce bit-set or bit-reset faults significantly enlarges the scope of what can be done with EM injection.

Conclusion

In this paper, we have experimentally demonstrated that EM injection, conducted with enhanced EM injectors, is able to produce bit-set and bit-reset faults in addition to timing faults. This experimental demonstration significantly enlarges the scope of what can be done with EM injection, i.e. the EM fault model. Indeed, if this was not the case, EM injection would have been of reduced interest for the evaluation of IC designed with modern technologies but operating at reduced clock frequency, such as smartcards.

Such a result was obtained thanks to the design of EM injectors according to a simple idea : concentrating the magnetic field on the smallest possible area at constant power rather than increasing the power delivered to the EM injector. It should be noticed that there is still room to enhance EM injectors.

Fig. 1 .

 1 Fig. 1. EMP platform used for all experiments reported in this paper.

Fig. 2 .

 2 Fig. 2. EM-Injectors: (a) 'Flat' Injector (b) 'Sharp' Injector and (c) 'Crescent' Injector

Fig. 3 .

 3 Fig. 3. Setup timing constraint in a synchronous IC

Fig. 4 .

 4 Fig. 4. Probability to obtain a faulty response from the same AES when operated at a clock frequency equal to 50MHz and 100MHz respectively.

Fig. 5 .

 5 Fig. 5. Large chain of registers (FIFO) designed to demonstrate the occurrence of bit-set and bit-reset faults.

Fig. 6 .

 6 Fig. 6. Probabilities to produce (a) faults regardless of the fault type (b) bit-set faults (c) 'mutes' and (d) injector orientation (air gap along the y-axis) -(170V, 8ns) EMP.

Fig. 7 .Fig. 7 -

 77 Fig. 7. Probabilities to obtain (a) bit-set faults with V pulse = +140V and (b) bit-reset faults with V pulse = 140V

Fig. 8 .

 8 Fig. 8. Evolutions of the probabilities to obtain bit-set faults when the FPGA is supwith di↵erent V dd values.

4. 6 Fig. 10 .

 610 Fig. 10. Fault types and illustration of EM injection e↵ects for four di↵erent settings of injection parameters: (a) V pulse = 100V , perpendicular; (b) V pulse = 100V , perpendicular; (c) V pulse = 140V , perpendicular; (d) 110V, parallel ; (e) -110V, parallel; (f) V pulse = 110V , parallel.


Mauro Riva

Paolo Stringari

Experimental study of the influence of nitrogen and oxygen on the solubility of solid carbon dioxide in liquid and vapor methane at low temperature

Keywords: Solid-liquid-vapor equilibrium, Solubility, Biogas, Natural Gas, LNG, BioLNG, Cryogenics, Measurements

HAL is

INTRODUCTION

The study of the influence of nitrogen and air content on the production of liquefied methane is of great importance for the development of new technologies in the field of LNG or alternative liquid fuels, such as the bioLNG (or liquefied biomethane). Nitrogen is a classical natural gas impurity, usually treated only after liquefaction in the Nitrogen Rejection Unit. The interest on biomethane as an advanced liquid bio-fuel has grown over the past decade, driven by decarbonisation objectives in recent energy policy. Raw biogas produced by anaerobic digestion of organic substrate (agricultural wastes, water treatment and landfill wastes) is mainly composed of methane and carbon dioxide. In some cases air is present in the raw biogas: in biogas produced in landfills (landfill gas), which is originated by spontaneous degradation of organic substances present in wastes, air is seeped into the biogas pipes during the collection process and can represent up to 20% of the volume fraction. Also in the biogas digesters some air can be injected (up to 8%) in order to reduce the hydrogen sulfide production through bacterial oxidation, the so-called biological desulfurization.

Liquefied biomethane is produced at temperature similar to the Liquefied Natural Gas operating conditions, but at lower pressure, usually lower than 3 MPa. During the liquefaction process, CO 2 solidification may occur from both the vapor and liquid phase. The prediction of solid formation conditions from vapor and liquid phases is thus of essential importance for the design and simulation of the liquefaction process, in order to avoid uncontrolled solid formation. Solid CO 2 solubility in liquid and vapor phases can be calculated by means of appropriate thermodynamic models able to compute the phase equilibrium involving a solid phase.

Nevertheless, phase equilibrium measurements are needed for the regression of model parameters and for the validation of the model. A large number of experimental studies provide the CO 2 solubility in liquid and vapor methane in the range of interest, going from the boiling temperature of LNG/bio LNG at atmospheric pressure (around 110 K) to the boiling temperature at liquefaction pressure (around 180 K), and some studies also provide the solubility of carbon dioxide in nitrogen and oxygen, as shown in Table 1. CO 2 solubility in liquid phase is the CO 2 content in liquid phase at the solid-liquid equilibrium (SLE). SLE data usually provide temperature and composition of the liquid phase, but rarely the pressure. CO 2 solubility in vapor phase is the CO 2 content in vapor phase at the solid-vapor equilibrium (SVE). When solid phase is in equilibrium with coexisting vapor and liquid phase the phase equilibrium is called solid-liquid-vapor equilibrium (SLVE). The phase diagram of ternary N 2 -CH 4 -CO 2 system involving a solid phase has been only partially determined through experimental data. An analysis of the experimental procedure and comparison with model results obtained at same temperature, pressure and global composition, show some incompleteness in available data: declared SLE data [START_REF] Shen | Determination of CO 2 Solubility in Saturated Liquid CH 4 + N 2 and CH 4 + C 2 H 6 Mixtures above Atmospheric Pressure[END_REF][START_REF] Gao | Experimental Determination of CO 2 Solubility in Liquid CH 4 /N 2 Mixtures at Cryogenic Temperatures[END_REF] , are actually SLVE data providing only the CO 2 composition in the liquid phase. Furthermore no data for the quaternary mixture N 2 -O 2 -CH 4 -CO 2 are available, to the authors' knowledge.

The qualitative phase diagram in Figure 1 is representative of the behavior of the N 2 -CH 4 -CO 2 mixture in the range of temperature and pressure of interest and can help understanding the problem of undesired solid CO 2 formation during methane liquefaction. Considering the stable phases for the pure components at the temperature and pressure of the measurements carried out in this work, CO 2 is in solid phase, CH 4 is in liquid phase and N 2 is in vapor phase. A mixture of methane and carbon dioxide thus presents a solid-liquid equilibrium (SLE) where solid CO 2 is solubilized in the liquid phase. In the ternary diagram, there is thus a SLE region when the system is rich in methane and carbon dioxide, but poor in nitrogen. On the contrary, when the system is rich in nitrogen and carbon dioxide, but poor in methane, the system is in the SVE region. If the amount of CO 2 is small, no solid is formed and the mixture rich in N 2 and CH 4 is thus in vapor or liquid phase, or at vapor-liquid equilibrium conditions. The SLE, SVE and VLE regions delimit the SLVE triangular region, where the composition of each phase is defined by the vertices of the triangle: in the studied case, solid phase is pure CO 2 , vapor phase is the vertex with higher N 2 concentration and the liquid phase is the vertex with higher CH 4 concentration.

The composition of the phases at SLVE does not depend on the global composition of the system for a ternary system at given T and p. From the study of the ternary phase diagram, one can observe that for assuring that a multicomponent system containing methane and carbon dioxide does not present the risk of solid formation at given temperature, pressure and global composition, it can be not sufficient to check the solubility of the carbon dioxide in the liquid phase. In Figure 1, point A represents a mixture with CO 2 content lower than the CO 2 solubility limit in liquid phase and poor in nitrogen: no solid phase is formed from this mixture at given T and p. Point B represents a mixture with same CO 2 content but richer in N 2 . Point B falls in the SLVE region and thus a solid phase is present, in equilibrium with a liquid and a vapor phase. It is then evident that, in order to evaluate the potential formation of solid CO 2 in the natural gas or biomethane liquefaction, a precise knowledge of the position of the phase boundaries is mandatory. This consideration is valid for both the N 2 -CH 4 -CO 2 and the N 2 -O 2 -CH 4 -CO 2 systems. For improving the comprehension of these complex multicomponent systems at conditions where a solid phase can appear, original SLVE measurements in the low temperature region are thus produced in this work.

2.

EXPERIMENTAL SETUP AND PROCEDURE

Experimental setup

The apparatus used in this work for obtaining low temperature SLVE measurements for the N 2 -CH 4 -CO 2 mixture and N 2 -O 2 -CH 4 -CO 2 mixture is a slightly modified version of the original apparatus used for low temperature vapor-liquid equilibrium (VLE) measurements [START_REF] Baba-Ahmed | New Equipment Using a Static Analytic Method for the Study of Vapour-liquid Equilibria at Temperatures down to 77 K[END_REF] and solubility data [START_REF] De Stefani | Solubility Measurements for Carbon Dioxide and Nitrous Oxide in Liquid Oxygen at Temperatures down to 90[END_REF][START_REF] Stringari | Solubility Measurements of Solid N-Hexane in Liquid Methane at Cryogenic Temperature[END_REF] . Recently the apparatus has been used for determining solid formation conditions [START_REF] Lange | Purification of Natural Gas by Means of a New Low Temperature Distillation Process[END_REF] .

A scheme of the apparatus is represented in Figure 2. The equilibrium cell (EC) is placed into a 55 liters Dewar, partially filled with liquid nitrogen (LN2). In this way, the cell is surrounded by a nitrogen vapor atmosphere. The equilibrium cell is surrounded by a brass shell closed with a brass cap. The brass shell is wrapped by an electric resistance regulated by a Fuji electric PXR PID temperature regulator. The cold source (liquid nitrogen) coupled with the electric resistance allows temperature regulation in the cell. The liquid nitrogen is supplied from a 176 liters ranger intended for this purpose. The temperature is measured at the top and at the bottom of the cell by means of two PT100Ω (at 0°C) temperature probes, in order to estimate the temperature gradient between the top and the bottom of the cell and induced by the position of the cold source. The average temperature between the two probes is calibrated on the saturated curves of pure methane and pure oxygen. The pressure in the EC is measured by two PTX611 Druck pressure transducers, one for nominal maximum pressure up to 16 MPa and the other up to 0.16 MPa (this last can be isolated when working pressure is higher than 0.16 MPa). Temperature and pressure calibration procedures are discussed in the Supporting Information. The cell is equipped with two pneumatic ROLSI® samplers with stainless steel capillaries. The temperature of the part of the liquid capillary between the cell and the ROLSI® samplers is controlled by a heating cartridge connected to a PID regulator in order to avoid undesired solidification and condensation during the sampling operations. The ROLSI® samplers are connected to the Gas Chromatograph (GC) through a thermostated transfer line. The GC device is a Perichrom PR 2100 type equipped with a Thermal Conductivity Detector (TCD) and a Flame Ionisation Detector (FID) for analyzing the composition. A Porapak Q column (80/100 mesh, 1/8" external diameter, 2 mm internal diameter, length depending on the system to study, made in Silcosteel), is used for separating the mixture components in the gas chromatograph. Operational conditions of the GC are resumed in Table 2. The CO 2 content in fluid phases at low temperature SLVE is expected to be in the range from 20 to 10000 ppm. The Thermal Conductivity Detector (TCD) is not sensitive enough for revealing the lowest CO 2 quantities in such a range. As a consequence, the detection of small amounts of CO 2 is performed by a Flame Ionisation Detector (FID). Since the FID cannot directly detect CO 2 , a methanizer is installed for reducing CO 2 into methane, which can be detected by the FID. The methanizer is a U-tube containing nickel catalyst and kept at 300°C for allowing the complete conversion of CO 2 into CH 4. The four gases used in this work are provided by Air Liquide with declared purity of 99.995%, except for oxygen with declared purity of 99.999%.

Experimental procedure

A static analytic approach is used for determining the SLVE data at low temperature for the N 2 -CH 4 -CO 2 mixture and N 2 -O 2 -CH 4 -CO 2 mixture. In order to determine temperature, pressure, liquid and vapor phase compositions at SLVE conditions, the adopted procedure is composed of three main steps: the loading of the cell, the cooling program for reaching the desired temperature where solid is expected to form, the composition analysis of liquid and vapor phases.

Once vacuum is obtained into the equilibrium cell thanks to a vacuum pump, the mixture with desired composition is loaded into the cell at ambient temperature. Each pure component is loaded into the cell separately from a gas cylinder. The cell is then isolated and the magnetic stirrer activated for assuring suitable mixing in the cell. Once temperature and composition in the equilibrium cell become stable (i.e. their variation in time is lower than the experimental uncertainty in measuring these quantities), the global composition of the loaded mixture is determined by GC analysis.

After the loading of the cell, the Dewar is filled with liquid nitrogen at the half of its volume, avoiding the contact between the bottom of the cell and the liquid nitrogen. The temperature and the pressure inside the cell are continuously recorded and the system is cooled down by setting the temperature regulator. A first rapid cooling is performed down to a temperature set 5 K higher than the expected solid formation temperature. When the system stably reaches this temperature, a second slow cooling is executed setting the temperature regulator to 146 K. The cooling rate is set to 0.5 K/h, and once the temperature is reached, the system is kept at stable temperature for around 48h, checking the stability of pressure. At the end of this period, vapor and liquid phases are sampled for the composition analysis. A series of different samples are analyzed in order to assess the repeatability of the composition measurement. At least two series of samples are taken and analyzed at significant time distance for assuring the stability of the composition. Once the procedure for liquid and vapor phase composition measurement is successfully completed, the Dewar is refilled with liquid nitrogen and temperature is slowly decreased setting the temperature regulator to 132 K with same cooling rate (0.5 K/h). The system is thus kept at stable temperature for around 48h, and composition analysis of vapor and liquid phase is performed following the procedure previously described. After that, the Dewar is refilled and temperature is decreased setting the temperature regulator to 125 K with same cooling rate (0.5 K/h) for another composition analysis. The temperature of the cell is then let increasing up to ambient temperature for evacuating the cell and loading a new mixture. The procedure is repeated for four different mixtures, with compositions reported in Table 3.

RESULTS AND DISCUSSION

Experimental Results

For each of the four different series of measurements, namely four different global composition mixtures, the measured composition (mole fraction) of liquid and vapor phases and estimated uncertainties at each temperature and pressure are reported in Table 4. Expanded uncertainty (coverage factor equal to 2) on temperature is estimated to be 0.2 K and expanded uncertainty (coverage factor equal to 2) on pressure 0.003 MPa. Details on calculations of uncertainties are presented in the Supporting Information. The formation of a solid phase at experimental temperature and pressure can be inferred from the material balance on CO 2 :

(1) with:

(

) 2
where z CO2 is the global CO 2 mole fraction of the loaded mixture (known), y CO2 and x CO2 are the measured CO 2 mole fractions in the vapor and liquid phases and V, L and S the mole fractions of vapor, liquid and solid respectively. The solid phase is assumed to be pure CO 2 . Being z CO2 significantly greater than x CO2 and y CO2 in the measurements performed in this work (see Table 3 and Table 4), one obtains a value of S greater than 0 when replacing the experimental values in eq. ( 1) and eq. ( 2), proving that a solid phase is present. Values of S for each measurement are reported in Section 3 of the Supporting Information. qualitative because the solubility of solid CO 2 in the liquid phase depends also on the pressure of the measurements and on the mole fraction of nitrogen in the liquid phase. Nevertheless, it is possible to observe that the addition of nitrogen and oxygen in methane decreases the solubility of CO 2 in the liquid phase in the temperature range investigated. The effect can be explained studying the CO 2 solubility in liquid oxygen and nitrogen, which is lower than in liquid methane, according to literature data presented in Tab. 1. In the investigated temperature range, one can conclude that methane mole fraction in liquid phase has a major effect on CO 2 solubility in liquid phase. When some nitrogen and oxygen are added to methane, methane mole fraction in liquid phase decreases and thus the CO 2 solubility decreases too. The quantitative comparison with the other literature data for the mixture CO 2 -CH 4 -N 2 is not possible because of the differences in pressure and nitrogen mole fraction of the measurements.

Model for SLVE calculation

Obtained experimental values can be compared with data from literature, when available, and with model results. The approach chosen for modeling the SLVE is the isofugacity of the solid former component in liquid ( ), vapor ( ) and solid phase ( ), which can be assumed as pure CO 2 .

(

) 3
Where T is the temperature, p the pressure, x and y the vectors of compositions of the liquid and vapor phase respectively.

The fugacity of the solid phase can be calculated from the model developed for the solid CO 2 by

Jäger and Span [START_REF] Jäger | Equation of State for Solid Carbon Dioxide Based on the Gibbs Free Energy[END_REF] . The advantage of this model is that the fugacity of the solid CO 2 can be directly calculated from the EoS, without any derivation from a hypothetical subcooled liquid fugacity.

(

) 4
The suffix 0 is for the reference state, taken in this work as ideal gas at and . is thus the ideal gas Gibbs free energy, which can be obtained from the reference quality Eos for pure CO 2 , reported in Kunz et al. ( 2007) [START_REF] Kunz | The GERG-2004 Wide-Range Equation of State for Natural Gases and Other Mixtures[END_REF] .

It has been chosen to compute the fugacity of the fluid phases from the GERG 2008 Equation of

State (GERG 2008 EoS), providing high accuracy in representing phase equilibria and thermodynamic properties of natural gas type mixtures in liquid and vapor phases [START_REF] Kunz | The GERG-2004 Wide-Range Equation of State for Natural Gases and Other Mixtures[END_REF][START_REF] Kunz | The GERG-2008 Wide-Range Equation of State for Natural Gases and Other Mixtures: An Expansion of GERG-2004[END_REF] . In this work, the models for both the solid and the fluid fugacities have been used with the original parameters available from the literature [START_REF] Jäger | Equation of State for Solid Carbon Dioxide Based on the Gibbs Free Energy[END_REF][START_REF] Kunz | The GERG-2004 Wide-Range Equation of State for Natural Gases and Other Mixtures[END_REF][START_REF] Kunz | The GERG-2008 Wide-Range Equation of State for Natural Gases and Other Mixtures: An Expansion of GERG-2004[END_REF] .

The range of validity of an empirical equation of state is, typically, determined by the available data used for regressing the equation parameters. In particular for the CH 4 -CO 2 system, data for the fluid phases are available down to 153 K 26 and for the N 2 -CO 2 system down to 209 K [START_REF] Duarte-Garza | Isochoric PVT and Phase Equilibrium Measurements for Carbon Dioxide + Nitrogen[END_REF] .

Nevertheless the GERG 2008 multi-parameter EoS is developed in order to behave reasonably far beyond the range of temperature and pressure of existing data [START_REF] Kunz | The GERG-2004 Wide-Range Equation of State for Natural Gases and Other Mixtures[END_REF] . Still, data for the O 2 -CH 4 system are not available and then EoS parameters are not regressed for this system. As a consequence, the model is predictive when dealing with the N 2 -O 2 -CH 4 -CO 2 system.

Experimental CO 2 solubility in liquid and vapor phase obtained in this work is tabulated in Table 5, together with solubility calculated from the model at experimental temperature, pressure and global composition. The measured CO 2 solubility in liquid phase is lower than solubility obtained by the model at experimental temperature, pressure and global composition: CO 2 solubility in liquid phase is overestimated by the model, as it is possible to see in Figure 4. From both model and experimental results it is possible to observe that CO 2 solubility in liquid phase slightly decreases with decreasing pressure. From Figure 5 it is possible to observe that, according to experimental values, CO 2 solubility in vapor phase increases when some nitrogen is replaced by oxygen, but the phenomenon is not predicted by the model. Unfortunately, no SVE data are available for the O 2 -CO 2 system for comparing the solubility of methane in vapor oxygen or nitrogen.

The thermodynamic model allows pointing out the dependence of CO 2 solubility on the density of the solvent. In Figs. 6, 7a, and 7b, the solubility of each series of measurements has been plotted as a function of the density calculated by the thermodynamic model at the experimental temperature, pressure, and CO 2 -free mole fraction of the liquid phase (Fig. 6) and of the vapor phase (Figs. 7a and7b). Fig. 6 allows inferring that, for each series of measurements (i.e. for each global composition of the mixture, see Tab. 3), the solubility of CO 2 in the liquid phase decreases when density increases. The trend of solubility of CO 2 with respect to the density of the solvent is very similar for the two series 1 and 2 obtained for the N 2 -CH 4 -CO 2 mixture (full and empty squares in Fig. 6). Also the two series 3 and 4 obtained for the N 2 -O 2 -CH 4 -CO 2 mixture (full and empty triangles in Fig. 6) present a similar behavior. The solubility of CO 2 with respect to the calculated density of the solvent (CO 2 -free) in the vapor phase is plotted in Fig. 7a for mixture N 2 -CH 4 -CO 2 , and in Fig. 7b for mixture N 2 -O 2 -CH 4 -CO 2 . Also in this case it is possible to observe a very similar behavior of the solubility of CO 2 with respect to the density of the solvent for the series 1 and 2, Fig. 7a, and 3 and 4, Fig. 7b.

Expanded uncertainties (coverage factor equal to 2) associated to the mole fraction values are reported in Tab. 4. For methane, the uncertainty is always lower than 2% of the mole fraction value in the liquid phase and 4% in the vapor phase. For oxygen it is lower than 30% of the mole fraction value in the liquid phase and 8% in the vapor phase. For carbon dioxide, it is lower than 20% of the mole fraction (ppm) value in the liquid phase and 50% in the vapor phase.

CONCLUSIONS

In this work, low temperature phase behavior of the methane-carbon dioxide system with addition of air (nitrogen and oxygen) is studied thanks to original SLVE experimental measurements and data from literature. The study is important for understanding the solid formation conditions and maximum CO 2 allowable content in the LNG and bioLNG production processes, especially when significant amount of air gases are present. For this purpose, the study of the SLE may not be sufficient because the presence of light component (N 2 and O 2 )

induce the formation of a vapor phase at conditions where no vapor phase exists for the binary CH 4 -CO 2 system. Furthermore, from experimental results obtained in this work, it is possible to conclude that the addition of nitrogen and oxygen in methane decreases the solubility of CO 2 in the liquid phase, for temperatures between 125 and 145 K. More experimental studies are suggested in order to provide a full description of the system behavior as function of temperature, pressure, and nitrogen and/or oxygen mole fraction.

Experimental measurements are necessary for testing and calibrating thermodynamic models able to provide a complete representation of the phase behavior of complex systems. Density is calculated by the model presented in section 3.2. Dotted lines have the only purpose to connect the symbols in the same series in order to highlight the trends.

Figure 3

 3 Figure 3 presents a qualitative comparison among the experimental results obtained in this work

FIGURESFigure 1 .

 1 FIGURES

Figure 2 .Figure 3 .

 23 Figure 2. Scheme for the experimental apparatus used in this work. LP: pressure transducer for

Figure 4 .Figure 5 .Figure 6 .Figure 7 .

 4567 Figure 4. CO 2 solubility in liquid phase (x CO2 ) at SLVE conditions from experimental values

Table 1 .

 1 The model presented in this work, coupling a high accuracy EoS for the fluid phase (GERG 2008) and an EoS specifically developed for solid CO 2 , agrees with experimental values, even if it overestimates the CO 2 solubility in liquid phase. Selected experimental data sources for the CO 2 solubility in liquid and vapor phase in the temperature range 110-180 K.

	TABLES.
	Author	Mixture	Kind of data	N	Info
	Shen et al.(2012) 1	CH 4 -CO 2 N 2 -CH 4 -CO 2	SLVE SLVE	9 27	Tpx Tpx CO2
	Gao et al. (2012) 2	CH 4 -CO 2 N 2 -CH 4 -CO 2	SLVE SLVE	9 31	Tx Tpx CO2
	Davis et al. (1962) 3	CH 4 -CO 2	SLVE	42	Tp,Tx,Ty
	Boyle (1987) 4	CH 4 -CO 2	SLE	5	Tx
	Cheung and Zander (1968) 5	CH 4 -CO 2	SLE	9	Tx
	Streich (1970) 6	CH 4 -CO 2	SLE	12	Tx
	Preston et al. (1971) 7	CH 4 -CO 2	SLE	2	Tx
	Voss (1975) 8	CH 4 -CO 2	SLE	22	Tx
	Pikaar (1959) 9	CH 4 -CO 2	SVE SLE	103 21	Tpy Tpx
	Yakimenko et al. (1975) 14	N 2 -CO 2	SLE	9	Tx
	Agrawal and Leverman (1974) 10	CH 4 -CO 2 N 2 -CH 4 -CO 2	SVE SVE	41 19	Tpy Tpy
	Le and Trebble (2007) 11	CH 4 -CO 2 N 2 -CH 4 -CO 2	SVE SVE	55 24	Tpy Tpy
	Xiong et al. (2015) 12	CH 4 -CO 2 N 2 -CH 4 -CO 2	SVE SVE	64 77	Tpy Tpy
	Fedorova (1940) 13	N 2 -CO 2 O 2 -CO 2	SLE SLE	4 5	Tx Tx
	Yakimenko et al. (1975) 14	N 2 -CO 2	SLE	9	Tx

Table 2 .

 2 Gas Chromatography operating conditions used in this work

	Mixture	N 2 -CH 4 -CO 2	N 2 -O 2 -CH 4 -CO 2
	Column	4m Porapak Q	2x4m Porapak Q
	Oven Temperature	343 K	248 K for 6.5 min
			343 K for 14 min
	N 2 retention time (min)	0.9	5.3
	O 2 retention time (min)	-	6.3
	CH 4 retention time (min)	1.25	10.2
	CO 2 retention time (min)	2.5	16
	Carrier gas	He	He
	Carrier flow (ml/min)	21	21
	TCD temperature	393 K	393 K
	FID temperature	573 K	573 K
	H 2 flow in the methanizer	30 ml/min	30 ml/min

Table 3 .

 3 Global composition of loaded mixture for each series of measurements. N is the series of measurements.

	N	N 2	O 2	CH 4	CO 2
		mol/mol	mol/mol	mol/mol	mol/mol
	1	0.4	-	0.58	0.02
	2	0.19	-	0.79	0.02
	3	0.31	0.09	0.58	0.02
	4	0.15	0.04	0.79	0.02

Table 5 .

 5 Measured and calculated CO 2 solubility in liquid (x CO2 ) and vapor phase (y CO2 ) and deviation between measured and calculated values.

	N	T	P x CO2,EXP x CO2,CALC ∆x CO2 y CO2,EXP y CO2,CALC	∆y CO2
		(K) (MPa)	(ppm)	(ppm) (ppm)	(ppm)	(ppm)	(ppm)
	1.1 145.9 2.04	6909	7846 937	470	633	163
	1.2 132.1 1.36	1632	2853 1221	48	92	44
	1.3 124.9 0.77	749	1573 824	16	28	12
	2.1 145.8 1.12	5722	7674 1952	572	689	117
	2.2 132.1 0.77	1185	2669 1484	51	120	69
	2.3 124.5 0.52	532	1349 817	15	40	25
	3.1 146.1 2.11	6948	7831 883	1542	631	-911
	3.2 132.4 1.35	1709	2901 1192	209	96	-113
	3.3	125 0.96	367	1551 1184	46	30	-16
	4.1 146.5 1.39	6547	7986 1439	1392	750	-642
	4.2 132.5 0.84	1544	2787 1243	185	121	-64
	4.3 125.1 0.58	356	1451 1095	35	41	6
	ASSOCIATED CONTENT
	Supporting Information.
	Additional details on the calibration procedures for temperature, pressure and CG analysis;
	uncertainties calculation for temperature, pressure and composition

AUTHOR INFORMATION

Corresponding Author *E-mail: paolo.stringari@mines-paristech.fr ABBREVIATIONS LNG, liquefied natural gas; bioLNG, liquefied biomethane; SLE, solid-liquid equilibrium; SVE, solid-vapor equilibrium; VLE, vapor-liquid equilibrium; SLVE, solid-liquid-vapor equilibrium; EoS, equation of state; GC, Gas Chromatography; LN2, liquid nitrogen.