Christophe Rippert
email: christophe.rippert@inria.fr

Daniel Hagimont

An evaluation of the Java Card environment

In this paper, we present the experiment we have conducted to evaluate the suitability of Java cards for advanced applications. We developed a resource-consuming application in a Java card using only the specified Java Card environment, and noted which missing features could have been useful to improve the functionalities of our application or to ease its development. We then propose new system services to improve the Java Card environment.

Introduction

The advent of the Java Card technology [1] in 1996 opened new perspectives for smart card application providers. However, the use of Java cards has mostly been reduced to small applications, like electronic wallets or ID cards, for which their potential does not appear to be completely used. It therefore seems interesting to try and evaluate the Java Card environment for programming bigger applications. Since hardware limitations are bound to disappear as manufacturing techniques improve, we only focus on software limitations in this paper. We developed a resource-consuming application and noted the limitations of the Java Card environment which hindered the development. This experiment enabled us to identify new system systems for the Java Card environment which might be needed to ease the development of advanced applications.

We first present the Java Card environment. Then we describe our application and point out the limitations of the Java Card environment which caused us problems during the development of the application. Finally, we propose new system services to improve the Java Card environment and address the problems previously identified.

The Java Card environment

A Java card is essentially an Integrated Circuit Card (ICC) with an embedded Java Virtual Machine. The Central Processing Unit (CPU) can access three different types of memory: a persistent read-only memory (ROM) which usually contains a basic operating system and the greatest part of the Java runtime environment, a persistent read-write memory (EEPROM) which can be used to store code or data even when the card is removed from the reader, and a volatile read-write memory (RAM) in which applications are executed.

Java Card applications are written using the Java Card language. This language is a subset of the Java language [START_REF]The Java Language Specification[END_REF]. Noticeable restrictions concern the primitive types available which are limited to booleans, bytes and shorts, and arrays which must be linear. Since Java Card applets are compiled using a plain Java compiler, they must undertake an additional checking phase to verify that they comply with the previous restrictions. Due to limitations of the Java Card class loader, the class files must then be converted to a simpler binary format before being loaded on the card.

On the card, applets are executed in the Java Card Runtime Environment (JCRE) [START_REF]Java Card 2.1 Runtime Environment (JCRE) Specification[END_REF]. The JCRE includes the Java Card Virtual Machine (JCVM) [START_REF][END_REF], the Java Card Application Programming Interface (API) [START_REF][END_REF] classes and support services like the applet loader for example. Due to the small quantity of memory available on the card, the JCVM is significantly restricted compared to the Java Virtual Machine [START_REF]The Java Virtual Machine Specification[END_REF]. Main differences include no dynamic class loading, no garbage collection, and no support for multiple threads of control. The Java Card API is also very limited.

Java Card applets are composed of two parts: a server part on the card and a client part run on the terminal linked to the reader. This client/server scheme is based on a low level protocol of communication through message exchanging. Application Protocol Data Units (APDUs) are sent by the terminal to the card to issue commands and the card send back responses in the same way. It is important to note that the card can only send APDUs as responses to a client request and cannot call the terminal on its own initiative.

Before being usable, the server part of an applet must be loaded on the card. This operation is done by the applet installer, which is usually an applet dedicated to that use provided by the card manufacturer. Once loaded, an applet is initialised by calling the method install that all Java Card applets must implement. This method is usually used to allocate static fields and initialised them. It must finish by calling the method register which notifies the JCRE of the new installed applet. Since the card may contain several applications, the JCRE must maintain a list of all installed applets.

Once it has been initialised, the client can select an applet by sending a select APDU to the JCRE which in turn calls the method select of the applet. This method can be used to initialise data that must be initialised every time the applet is run (and not only once when it is installed). Then the client can send command APDUs to the JCRE which passes them to the method process of the applet. The method corresponding to the command APDU sent by the client is then called and possibly returns a result. This result can be sent back to the client in a response APDU. Finally, the client can select another applet by first calling the deselect method of the applet through a deselect APDU and then selecting the new applet.

Application example

To test the suitability of smart cards for real applications, we have developed a car driver's assistant application. This application becomes more and more common nowadays, even in cheap cars. The user simply enters his destination and guidance information is displayed on a screen and updated as the car moves. This application is based on three hardware components: the Java card on which the application runs, the terminal embedded in the car which is composed of a screen, a keyboard and of course a Java card reader, and the GPS which gives the current position of the car to the application. A wireless network connection can optionally be added, to allow dynamic downloading of maps for example.

Sons per

Execution scheme

The application provider sells a Java card which contains the application and the maps of several towns. The user inserts his card into the terminal and selects his destination from the proposed list. The map of the current town is explored (i.e. the application computes the best path from the current location to the appropriate town exit to get to the next town) and guidance information are displayed as the car moves. When the car reaches the town exit, the map of the next town is explored and so on until the user reaches his destination. Additional maps can be added after the card issuance, for example by downloading them from the application provider's web site into the card if the terminal include a wireless network connection. We chose this application as an example since it is memory and CPU-time expensive. The maps are represented as graphs, which consume a significant amount of memory when representing large maps. Moreover, the map-solving algorithm is a simple width-first search of the graph, a rather slow and memory-consuming algorithm on a smart card. One must note though that this application is not meant to be realistic and that alternative architectures could be devised to achieve much higher performances. We purposely chose a resource-consuming architecture to push the Java Card environment to its limits, not a realistic example to illustrate its use.

Prototyping issues

We developed this application using Gemplus GemXpresso RAD 211 [7]. The Java card used includes an eight bits processor running at 5 MHz, 32 KB of ROM, 32 KB of EEPROM, and 2 KB of RAM. The embedded Java Card environment is compliant with the Sun Java Card 2.1 Specifications.

The application is divided in two parts: the client part (on the terminal) which includes a graphic user interface, and the server part (in the Java card) which comprise the main application code. The client part (approximately 1300 lines) is written in standard Java 2 whereas the server part (around 540 lines) is subject to the restrictions of the Java Card language.

We performed some benchmarks to compare the performance of our application in the card and on a standard personal computer (i.e. a PC with an Intel Pentium II processor and 128 MB of RAM). Since the most time consuming part of the application is the search for the best path in a map, we choose to monitor that function on both platforms. The parameters the most interesting to make vary are the maximum number of sons per nodes and the length of the best path computed since the maps are represented as graphs. We give in Figure 1 and Figure 2 the results of these benchmarks for the function in the card and on the PC.

Prototyping constraints

The major problem we had to deal with was obviously the lack of memory in the card. The maps we used to test the application included approximately 20 nodes and the temporary data needed to find the best path in a town filled all the available memory. The algorithm used to find the optimal path is a simple breadth-first search of the tree representing the possible paths in the map, which requires an array to store the nodes of the same level during the search. Since the size of this array grows exponentially with the height of the tree, it soon becomes to big to fit in the card.

Moreover, since the JCRE does not include a garbage collector, all object allocations must be done at installation time (i.e. when the application is downloaded in the card) and not at run time. Since the objects are never unallocated, reallocating them each time the application is run would quickly fill the card memory. So we had to know when we developed the application the size of all the arrays we used. This was impossible for some, since their size depended on an user input. This constrained us to set the sizes of these arrays to their maximum possible value, which worsened the memory shortage problem described above.

Another problem we encountered concerns the lack of any dynamic remote class loading mechanism in the JCRE, which prevented us from improving the flexibility of our application. For example, if the application provider wants to modify the format of his maps, he must update the application embedded in the cards. The first way to do it would be to recall all the issued cards, which would be very expensive, and bothersome for users. Another way would be for the application to update itself automatically. For example, if the application connect to the application provider web site to download a map using the optional wireless network connection, it can detect that a new format is available, and download the code plug-in that will enable it to read that new format and translate it in its own internal format. To do that, a dynamic remote class loading mechanism would be necessary since the JCRE would have to download and link the code plug-in to the application. Unfortunately, this service is not available in the JCRE.

In our application, the terminal is only used for user interaction and as a gateway for the GPS. Since the main operations (i.e.: finding the best path, ...) are executed in the card, it would be logical to consider the card as the client to the terminal which would act only as an input/output device. Unfortunately, the Java Card communication model imposes that all commands come from the application on the terminal (i.e. the applet in the card can only response to commands and never issue them). This master/slave model is constraining for the design of an application since it forces a code architecture which might not be the one which the programmer would like to set up.

Finally, the communication scheme between the terminal and the card is not very comfortable to use. As we have seen above, it is based on APDUs exchange. Unfortunately, the maximum length of these APDUs (approximately 250 bytes) makes the passing of large arguments (e.g.: arrays, complex objects, ...) to a method on the card rather tedious since these arguments must be split by the client and then merged again on the card. Moreover, methods on the card cannot be called "directly" (i.e.: by using their symbolic name) and they must be assigned an identifier (an integer) which the client includes in the APDU to select the method it wants to call. It is then the task of the process method to decode the APDU and call the chosen method.

Synthesis

We can differentiate the hardware and software limitations detailed above. The memory size and CPU power limitations are bound to be suppressed as the card manufacturers improve their miniaturization techniques (recent cards now include as much as 2 MB of persistent memory). So our study focuses only on software limitations and we expect the following services to be realistic on recent hardware.

Missing services

In this section, we present the new system services that could be added to the JCRE to improve its features or ease of use. It should be noted that we were not able to actually implement any of these services on a Java Card since to our knowledge there does not exist any open-source Java Card Virtual Machine. Moreover, empty ICCs are not sold freely to prevent credit card piracy. Therefore, our propositions remain empirical, but we expect recent hardware progresses to cope with the additional cost induced by the implementation of these services in the JCVM.

Improved communications between the terminal and the card

Remote method invocation

Providing a remote method invocation service, like the one included in the Java 2 Platform, would greatly improve the programmer's comfort and efficiency, since he would not have to cope with APDUs which are uncomfortable to use. This service is sometime supplied by card manufacturers, but since it is not yet specified in the Java Card Platform, all these proprietary implementations are incompatible with one another. Examples of such proprietary implementations include Gemplus DMI [START_REF] Vandewalle | Direct Method Invocation[END_REF].

Reversing the client/server scheme

With the communication protocol specified in the Java Card platform, the methods on the card are inherently passive: they can be called and return a result but they cannot call a method on the terminal on their own initiative. This scheme can be unsuited for application for which the main program should logically be located in the card. It might be interesting then to reverse this master/slave model. Allowing nested method invocations might also be interesting, though it might require support for multi-threading in the JCRE if the card is allowed to issue the first command.

Dynamic class loading

The standard Java 2 environment provides a mechanism which enables the Java Virtual Machine to download remote classes and link them dynamically when they are needed (this mechanism is used by the Java Remote Method Invocation [START_REF]Java Remote Method Invocation Specification[END_REF] protocol for example). The JCRE does not provide such a service. The applet installer can load applets on the card and call their install method, but it cannot be invocated by another applet since it is usually an applet itself and to select it would mean deselecting the other applet, thus losing its execution stack. So this applet installer cannot be used to dynamically load classes like it can be done in the Java 2 Platform. Providing such a service could be interesting, for example to update applications as we have seen above.

Advanced memory system

The Java Card memory system is very restrictive compared to the Java 2 platform. As we have seen above, objects must be allocated at installation time since they cannot be unallocated. A garbage collector could be implemented to enable object unallocation. Since the JCVM is monothreaded, this garbage collector would not be able to work will another applet is running, but it could be called in the deselect method for example. Thus, an applet could allocate objects dynamically during its execution and these objects would be unallocated when it terminates.

However, the main problem with Java cards remains the very small size of memory available. Technical limitations complicate the installation of memory, especially RAM, on small devices like smart cards. So it could be interesting to study a swapping system which would use the memory installed on the terminal to discharge the memory on the card. Such a service is economically interesting since buying a few megabytes of RAM for a PC for example is very cheap compared to the cost of memory for smart cards. This service could be implemented in the operating system, in which case it would probably be similar to existing swapping systems in UNIX or Windows and would swap pages of memory. Or it could be a part of the JCVM which would enable it to swap whole objects. In that last case, a serialization service would be necessary to save and restore the state of swapped objects.

Conclusion

As we have tried and shown in this paper, the Java Card environment is still very limited compared to the standard Java 2 environment. The memory system limitations are very constraining for the programmer and the lack of a dynamic remote class loading mechanism forbids whole types of applications. Extending the Java Card environment with advanced system services is therefore necessary if it is to be used for realistic applications. The cost of these services remains a pending question, but recent progresses in hardware let us believe that their implementation should not be too penalizing in term of resource-consumption. By providing these extensions to their virtual machines, Java cards manufacturers would enable advanced applications to be developed, thus finally exploiting fully the potential of smart cards.


Christophe Rippert
email: christophe.rippert@imag.fr

Jean-Bernard Stefani
email: jean-bernard.stefani@inrialpes.fr

Protection in the Think exokernel

Introduction

In this paper, we present our preliminary ideas concerning the adaptation of security and protection techniques in the Think exokernel. Think is our proposition of a distributed adaptable kernel, designed according to the exokernel architecture.

After summing up the main motivations for using the exokernel architecture, we describe the Think exokernel as it has been implemented on a PowerPC machine. We then present the major protection and security techniques that we plan to adapt to the Think environment, and give an example of how some of these techniques can be combined with the Think model to provide fair and protected resource management. Finally, we briefly present the iPAQ Pocket PC to which we plan to port the Think exokernel and explain our interest in this kind of mobile devices.

The Think exokernel

Traditional kernels [START_REF] Rusling | The Linux Kernel[END_REF][START_REF] Solomon | Inside Microsoft Windows 2000[END_REF] provide the application programmer with abstractions like virtual memory, processes, or file systems, to ease the development of applications. The programmer can use these abstractions to avoid coping directly with the hardware, which is usually a tedious work. However, monolithic kernels are often considered as bulky, poorly evolutive and slow [START_REF] Engler | Exterminate All Operating System Abstractions[END_REF] by kernel developers who have been trying to find alternative solutions for more than 30 years [START_REF] Lampson | On reliable and extendable operating systems[END_REF].

Micro-kernels

The micro-kernel architecture [START_REF] Gien | Micro-Kernel Architecture, Key to Modern Operating Systems Design[END_REF] has been proposed to improve the portability, the modularity and the evolutivity of standard kernels. A micro-kernel includes the basic abstractions that all standard applications should need, such as a memory manager or inter-process communications. A micro-kernel can be extended with additional abstractions structured as servers outside the micro-kernel itself, that specific applications requiring them can call using IPC. The micro-kernel architecture offers a better control over the hardware resources to the application programmer than monolithic kernels, since it provides only the most basic abstractions and does not force the programmer to use high-level abstractions including functions that he might not need. However, it has been deemed insufficient for applications that require a fine-grained control of the hardware resources, to enjoy high performance or to enforce application specific policies.

Exokernels

The exokernel architecture [START_REF] Engler | Exokernel: An Operating System Architecture for Application-Level Resource Management[END_REF][START_REF] Kaashoek | Application Performance and Flexibility on Exokernel Systems[END_REF] is based on the idea that a kernel should not force the programmer to use any abstractions, even the most basic ones. So an exokernel only propose interfaces which give the programmer direct access to the hardware resources, without adding any functionality. Highlevel abstractions can be provided but their use must remain completely optional to the application programmer. For instance, a programmer who needs a classic scheduler for his application could use one provided by the system, but nothing should prevent him to implement and use its own scheduler if he needs to. By providing these optional abstractions as external libraries, the exokernel architecture offers a complete flexibility to the programmer. Moreover, the modularity of the exokernel architecture enables the application programmer to choose exactly which libraries his application needs and to install only these libraries, whereas a monolithic kernel is usually bloated with services that only a few (if any) applications really need.

The Think exokernel

The Think architecture is our proposition of a distributed exokernel. As its name implies, THink Is Not a Kernel. It does not provide any abstractions usually proposed by traditional kernels, like a process model or a scheduler for example. Instead, it provides interfaces that export the hardware resources to the applications. It also supplies binding factories to permit communication between the objects that will compose the application. A configuration tool is proposed to help the programmer define which interfaces are needed by a given object, and which interfaces it provides, and to check that all needed interfaces are available at compilation time. Finally, some standard abstractions (memory or a process models for example) are also provided, but their use is completely optional and the application programmer can chose to implement its own abstractions if they suit his application better.

The hardware interfaces provided by Think are completely machine-dependent. They do not extend the hardware functionalities nor do they try to ease the portability of the architecture by providing high-level functions common to several machines. Their aim is simply to give access to hardware resources by wrapping them in software interfaces. For instance, a TrapRegister(id, handler) function is included in the exception-handling interface. Using this function to register an exception handler is much easier than manipulating the exception vector table directly, without adding any functionality to the processor exception model.

In the Think architecture, software and hardware resources are seen as objects, as defined in the ODP Reference Model [START_REF]Fundations[END_REF]. These objects export interfaces that define their behavior to other objects. Each interface has a name in a given naming context, and is linked with others by bindings. A binding is basically a communication channel between objects. Bindings can take many forms, as simple as the association between a variable name and its value in memory, or more complex like a network connection between objects on different machines. Bindings are created by dedicated objects, called binding factories, which basic functionality (i.e. creating a binding between the calling object and an interface identified by its name) can be freely extended to ensure a given behavior. Finally, objects are grouped in domains according to a common property (e.g. security domains, fault domains, ...).

These various concepts are represented as a minimal software framefork, described in the Figure 1 below. We use Java as the interface description language in Think. The Top interface is the greatest element in the Think type lattice, the common type from which all interfaces derive. The Name interface is the common type for all names in Think. The method NamingContext getDefaultNamingContext() returns the current naming context and the method String toString() provides a serialized form of the name. The NamingContext interface is the common type for all naming contexts in Think. Its method Name toName(String name) deserializes a name known as a String. The method Name export(Top itf) provides a name for a given interface. As a side effect, it also creates a binding between the returned name and the given interface. The BindingFactory interface is the common type for all binding factories in Think. The method Top bind(Name name) creates a binding between the calling object and the object those name is given to the method.

The Think architecture has been implemented by Jean-Philippe Fassino from France Télécom R&D on a PowerPC computer. More details about this experiment, including benchmarks, can be found in [START_REF] Fassino | Think : un noyau d'infrastructure répartie adaptable. 2 ème Conférence Française sur les Systèmes d'Exploitation[END_REF].

Security issues

The exokernel architecture seems to be much less secure that a monolithic kernel. Indeed, allowing the application programmer to directly access the hardware resources opens the way to all sorts of abuses. Thus, some exokernel specific security techniques have been devised, like the secure bindings presented in [START_REF] Engler | Exokernel: An Operating System Architecture for Application-Level Resource Management[END_REF]. We plan to further this work by adapting existing security techniques used in standard operating systems and virtual machines to the exokernel architecture. We give below an example of how to use some of these techniques in the Think environment to implement a fair scheduler.

Existing security techniques

Our definition of security threats is the same as in [START_REF] Butler | [END_REF]: an application should not be able to access private data belonging to another application without permission, and no application should monopolize the system resources in a way that would compromise the quality of the service offered to other applications.

Much work has been conducted around the isolation of applications (or processes) to prevent unauthorized accesses. Security techniques usually exploit the hardware to implement efficient isolation [START_REF] Chiueh | Integrating Segmentation and Paging Protection for Safe Efficient and Transparent Software Extensions[END_REF]. However, some processors do not offer these kinds of facilities, and basing a system security on them reduces the portability of this system. So software isolation techniques have been devised to provide machine-independent security [START_REF] Wallach | Extensible Security Architectures for Java[END_REF][START_REF] Chase | Sharing and Protection in a Single Address Space Operating System[END_REF], without penalizing IPC too heavily.

Apart from preventing unauthorized accesses, processes isolation is also a way to prevent a faulty process from compromising the whole system. Once again, this isolation is often achieved by using hardware facilities, but efficient software-based isolation techniques have also been devised [START_REF] Wahbe | Efficient Software-Based Fault Isolation[END_REF].

However, the most challenging security problem is the fair allocation of resources between the various applications running in the system. A process should not be able to use all the memory space or monopolize the processor, even without malign intentions. The main difficulty lies in counting exactly the amount of resources allocated to a process (for example, should each process using an area of shared memory be charged for the whole area or for a fraction of it?). Isolating the processes can be a way to ease the count of resources allocated, though it usually complicate IPC (forbidding shared memory usually complicate data exchange between processes, for example) [START_REF] Back | Drawing the Red Line in Java[END_REF]. Solutions have been proposed to enforce fair resources allocation without compromising IPC [START_REF] Back | Java Operating Systems: Design and Implementation[END_REF][START_REF] Back | Processes in KaffeOS: Isolation, Resource Management, and Sharing in Java[END_REF], though these propositions are centered on the Java environment. A Java interpret could be implemented in Think as an optional abstraction, but not in the exokernel itself. Moreover, language-based security has been deemed less effective than operating system based protection [START_REF] Jaeger | Operating System Protection for Fine-Grained Programs[END_REF], since the former implies that the language compilation chain must be trusted. Operating system based security has been studied too [START_REF] Cheriton | A Caching Model of Operating System Kernel Functionality[END_REF][START_REF] Ford | CPU Inheritance Scheduling[END_REF] concerning the fair allocation of resources. Adaptation of security has also been studied in the Gandiva system, which provides configuration support for applications written in C++ [START_REF] Stuart | The Design and Implementation of a Framework for Configurable Software[END_REF] and Java [START_REF] Mark | Building Configurable Applications in Java[END_REF].

Example: implementing a fair and protected scheduler in Think

In a standard operating system, the kernel is responsible for resource allocations, so it is easy to implement a security system in it. On the other hand in the exokernel architecture, resources are allocated by applications, not by the kernel, which greatly complicates the implementation of a protection system to enforce fair allocation of resources for example. We believe that the binding factories can be used to enforce this security, as we shall see in the following example.

The Figure 2 describes the basic architecture for a fair and protected scheduler abstraction in Think. We suppose that the programmer's application is composed of three processes (this model can of course be extended to any number of processes). Each one is executed in its own security domain (D1, D2, D3). These domains can be defined using software-based fault isolation techniques as presented in [START_REF] Wahbe | Efficient Software-Based Fault Isolation[END_REF] for example. The scheduler itself is executed in its own domain. To share the processor between the processes, the scheduler needs to access the system clock, which is considered as a hardware resource in Think. So the scheduler must register a new trap-handler for the clock interruption, using the TrapRegister function described above. By doing this, the scheduler creates a binding between itself and the trap object located in the exokernel. This binding is represented by the solid line in the Figure 2 (the dashed lines represents the fact that the three processes are scheduled by the scheduler object). So the scheduler is able to start and stop the processes according to its own policy. Obviously, the three processes must not be able to modify the clock trap handler. Hence, the binding factory that creates the binding between the scheduler and the system clock must check that any binding requests for the system clock come from a scheduler object and not a standard process.

This architecture can easily be provided as an optional library. Then the application programmer only needs to implement his own scheduler and instantiate the library with his scheduler and processes. Therefore, this abstraction can easily be adapted to provide fair resource allocation techniques such as those presented in [START_REF] Back | Processes in KaffeOS: Isolation, Resource Management, and Sharing in Java[END_REF] for example. The binding factory responsible for providing bindings to the system clock object can easily be extended to deny bindings with non-scheduler objects, thus providing a secure binding mechanism as presented in [START_REF] Engler | Exokernel: An Operating System Architecture for Application-Level Resource Management[END_REF]. We believe that this protection scheme can be generalized to other resources allocation. As an application of our work on exokernels and protection, we plan to port Think and its associated libraries to the iPAQ Pocket PC [START_REF]iPAQ Pocket PC home page[END_REF]. This mobile device includes a 206 MHz Intel StrongARM processor [START_REF]Intel StrongARM SA-1110 Microprocessor Developer's Manual[END_REF], 32 megabytes of SDRAM and 16 megabytes of flash memory, which make it powerful enough to run interesting applications. The Windows Pocket PC operating system [START_REF]Microsoft Corporation Pocket PC home page[END_REF] is initially installed in the flash memory, but a port of Linux has been implemented by volunteers supporting the Open Source Software movement on handheld computers [13]. This will enable us to reuse some of the existing Linux code (especially the device drivers), which will be easier than programming the libraries from scratch.

Our main interest in porting the Think architecture to the iPAQ lies in the inherent limitations of this type of mobile devices. Even if the iPAQ is powerful enough for a mobile device (a 200 MHz processor and 32 MB of RAM was a good configuration for a standard PC five years ago), it cannot compete with modern machines with processor speeds approaching the GHz and memory sizes of 256 or 512 MB. Therefore, using an exokernel on this kind of devices can help the application programmer to optimize his applications to use efficiently the available resources. Considering the small amount of memory available (32 MB of RAM can be considered a small amount nowadays), it should not be wasted by including unnecessary services in the kernel, for example. Likewise, the processor should work more on the application code than on the kernel code, and it should never work on unnecessary code. This is especially important since the power consumption is directly linked to the activity of the processor, and power is a precious resource on a battery-powered device like a Pocket PC. We think that using an exokernel on this type of devices can increase its efficiency (i.e. speed up the execution of applications and lengthen the battery life), which we shall try and prove by monitoring the performances of our architecture and comparing it with the same machine running Linux and Windows Pocket PC OS.

Conclusion

We are interested in building a secure and efficient kernel on a mobile computer such as the iPAQ Pocket PC. We chose the exokernel architecture since we consider it to be the best-suited environment to provide the application programmer with a fine-grained control over the hardware resources. Moreover, the modularity of the Think exokernel permits to restrict the proposed services to those that the applications really need. By using secure bindings to implement the security techniques used in standard operating systems, we plan to provide the same level of security in the exokernel architecture that in a classical monolithic kernel. We believe that the exokernel is a good architecture to build secure, adaptable, and efficient kernels and we hope to contribute to its promotion by porting Think to different kinds of devices.

Figure 1 :

 1 Figure 1: The core software framework in Think

Figure 2 :

 2 Figure 2: An fair and protected scheduler in Think


L Baba

Y Balan

Israëli

H B Zouari

M Dabert

L Asia

P Wong-Wah-Chung

M Baba

L Balan

Y Israëli
email: yael.israeli@uca.fr

Influence of in situ photo-induced silver nanoparticles on the ageing of acrylate materials

Keywords: silver nanoparticle, nanoparticle migration, acrylate photopolymer, photooxidation, composite material

Influence of in situ photo-induced silver nanoparticles on the ageing of acrylate materials

Introduction

Innovative applications of composite materials, e.g. in aerospace, automobile, marine industry, sporting equipment [START_REF] Koniuszewska | Application of polymer based composite materials in transportation[END_REF][START_REF] Harris | A perspective view of composite materials development[END_REF], biosensors [START_REF] Haes | Using solution-phase nanoparticles, surface-confined nanoparticle arrays and single nanoparticles as biological sensing platforms[END_REF][START_REF] Pumera | Graphene in biosensing[END_REF] or for biomedical purposes [START_REF] Chaloupka | Nanosilver as a new generation of nanoproduct in biomedical applications[END_REF], permanently stimulate the development of new sustainable materials capable of providing new functionalities. Among many types of nanoparticles (NPs) available and dispersible in a polymer matrix, silver nanoparticles (AgNPs) were tested and evaluated. These nanoparticles are capable of imparting antimicrobial activity [START_REF] Guo | Polymer/nanosilver composite coatings for antibacterial applications, Colloids and Surfaces A: Physicochem[END_REF][START_REF] Dallas | Silver polymeric nanocomposites as advanced antimicrobial agents: Classification, synthetic paths, applications, and perspectives[END_REF], or optical [START_REF] Evanoff | Synthesis and optical properties of silver nanoparticles and arrays[END_REF] and conductive [START_REF] Diantoro | Modification of electrical properties of silver nanoparticle[END_REF][START_REF] Gupta | Optical and electrical transport properties of polyaniline-silver nanocomposite[END_REF] properties to the polymer material. However, the key characteristic of this type of material remains the durability of the polymeric matrix in the specific environment in which it is to be used. Indeed, it is well known that, in general, the combination of oxygen, humidity and sunlight leads to degradation and consequently to chemical and architectural modifications of the macromolecular chains (chain scission and crosslinking) which strongly affect the use properties of the composite polymer material.

However, there was great interest in the remediation of polluting industrial waste. The use of silver nanoparticles was a promising solution to overcome this problem as they exhibited photocatalytic potential to degrade water effluents under sunlight [START_REF] Roy | Photocatalytic activity of biogenic silver nanoparticles synthesized using yeast (Saccharomyces cerevisiae) extract[END_REF][START_REF] Punnoose | Treatment of water effluents using silver nanoparticles[END_REF][START_REF] Elemike | Phytosynthesis of silver nanoparticles using aqueous leaf extracts of Lippia citriodora: Antimicrobial, larvicidal and photocatalytic evaluations[END_REF][START_REF] Kumari | Antibacterial and photocatalytic degradation efficacy of silver nanoparticles biosynthesized using Cordia dichotoma leaf extract[END_REF][START_REF] Francis | Catalytic activities of green synthesized silver and gold nanoparticles[END_REF][START_REF] Nahar | Photocatalytic degradation of organic pollutants over visible light active plasmonic Ag nanoparticle loaded Ag 2 SO 3 photocatalysts[END_REF].This photocatalytic effect could be a disadvantage to a long term stability of a composite material. The following examples of earlier studies of polymer/Ag NPs composites illustrate the influence of the nanofillers on the photochemical and thermochemical stability of various polymers. In the case of high-density polyethylene (HDPE), Ag NPs acted as a stabilizer when the composite material was exposed to UV irradiation at 280 nm [START_REF] Grigoriadou | Comparative study of the photochemical stability of HDPE/Ag composites[END_REF]. The higher the NPs loading (0.5 to 5 wt %), the lower was the concentration of products resulting from the oxidative chain scission due to oxidation. When the amount of NPs was at its highest, the high stabilization effect was explained by a change in oxygen permeability due to the presence of NPs. Previous studies on HDPE/Cu [START_REF] Grigoriadou | HDPE/Cu-nanofiber nanocomposites with enhanced mechanical and UV stability properties[END_REF] showed that Cu nanofibers led to a decrease in permeability and therefore protected the material from photodegradation. This phenomenon also appeared to occur at higher Ag NPs loads. The features observed by infrared spectroscopy were corroborated by SEM analysis. While pure polymer and composites with low loads of nanofillers (< 3%) exhibited significant morphological alterations (defects and holes), little or no change was observed for samples containing high amounts (3 and 5 %). Silver nanoparticles inhibited the chain scission process, therefore the thermal properties of the matrix remained almost unchanged. Indeed, DSC analysis showed the photoprotective effect of Ag NPs on HDPE films (the melting point and the degree of crystallinity remained almost constant). In contrast to HDPE, it was shown that the degradation of low-density polyethylene at longer wavelengths triggered the migration of nanoparticles to the surface of the film. As a result, when in contact with water, the material could undergo Ag NPs removal, resulting in a deterioration of the antibacterial properties of the composite materials [START_REF] Chinkamonthong | Effects of thermal and UV aging on antibacterial properties of linear low-density polyethylene and poly(vinyl chloride) films containing nano-silver colloid[END_REF]. It was also reported that UV and thermal ageing caused the brittleness of poly(vinyl chloride)/NPs composite film, which reduced the antibacterial performance of the material. However, despite the migration of NPs to the surface, the percentage reduction of bacteria was close to 99.9 %. This was due to dehydrochlorination of the poly(vinyl chloride). The resulting chlorine atoms would favor the bactericidal capacity [START_REF] Chinkamonthong | Effects of thermal and UV aging on antibacterial properties of linear low-density polyethylene and poly(vinyl chloride) films containing nano-silver colloid[END_REF].

When poly(acrylic acid), PAA, doped with NPs was subjected to polychromatic irradiation at room temperature, a loss of the optical properties of the nanofillers was observed for an exposure time of more than 50 minutes [START_REF] Kaczmarek | Effect of stabilizer type on the physicochemical properties of poly(acrylic acid)/silver nanocomposites for biomedical applications[END_REF]. This behavior was attributed to degradation of the polymeric matrix. Thermogravimetric analysis in an inert atmosphere showed that undoped and doped PAA, before and after 25 hours of exposure, decomposed into two successive steps. The first one between 200 and 300 °C involved the cleavage of the covalent bonds, responsible for the release of low molecular weight degradation products. The second, between 300 and 500 °C, was related to chain scission reactions and the formation of other degradation species. A decrease in temperature, corresponding to the maximum rate of the first step, was observed for both the PAA/Ag before (about 264 °C) and after irradiation (about 255 °C) compared to un-doped PAA (277 °C initially and 260 °C after 25 hours of irradiation). This result emphasizes the catalytic effect of the nanofiller [START_REF] Kaczmarek | Effect of stabilizer type on the physicochemical properties of poly(acrylic acid)/silver nanocomposites for biomedical applications[END_REF]. This effect was also responsible of the decrease of the nanohardness measured by atomic force microscopy and observed after a few tens of minutes of exposure.

In the case of poly(lactic acid) (PLA), short wavelength irradiation conditions ( = 254 nm) were quite different from those corresponding to solar irradiation (≥ 300 nm).

However, this study was of crucial importance as UVC light is often used for sterilization and disinfection in medical and pharmaceutical applications [START_REF] Mucha | Effect of nanosilver on the photodegradation of poly(lactic acid)[END_REF]. Part of this work was also dedicated to evaluating the influence of Ag NPs (0.2 and 0.5 % loading) on the thermal degradation of PLA at 80 °C [START_REF] Mucha | Comparison of photochemical and thermal degradation of poly(lactic acid) doped by nanosilver[END_REF]. Chemical changes in the macromolecular chain were observed to occur after an induction period that increased with the amount of nanofillers. This was a consequence of the photoprotector effect played by the silver nanoparticles which was associated with an improvement in mechanical properties reported elsewhere [START_REF] Mucha | Comparison of photochemical and thermal degradation of poly(lactic acid) doped by nanosilver[END_REF].

Through the studies described above, it appears that the impact of nanofillers on the stability of polymer/Ag NPs composite material depends greatly on the nature of the polymeric matrix. Consequently, for the development of new composite materials with new functionalities for applications in different fields, it is difficult to anticipate their behavior under given external stresses. For this reason, the purpose of this present work was to assess how small amounts of silver nanoparticles (0.2 and 0.4 wt.%) dispersed in an acrylate photopolymer could modify the photochemical behavior of the polymeric matrix under the combined effect of light and oxygen. This kind of study necessarily involved a preliminary investigation of the behavior of the pure acrylate polymer under the same experimental conditions, which corresponds to the first part of the present work. The corresponding material was obtained by photopolymerization of a formulation containing poly(ethylene glycol) diacrylate monomer (PEGDA) and pentaerythritoltriacrylate monomer (PETIA).

Infrared spectroscopy, differential scanning calorimetry and thermogravimetry were used to monitor the chemical and architectural changes occurring in the corresponding crosslinked polymer. Gas chromatography coupled with mass spectrometry was useful to identify the volatile organic compounds resulting from irradiation and then to develop a mechanism to account for the observed degradation. This kind of approach was successfully applied in previous studies [START_REF] Goourey | Photostability of acrylate photopolymers used as components in recording materials[END_REF][START_REF] Goourey | Influence of ZnO nanoparticles in the photostability of acrylate photopolymers used as components in recording materials[END_REF]. Once the photodegradation mechanism of the pure polymer matrix was established, the next step was to assess the impact of silver nanoparticles dispersed on the matrix on the degradation process and on the long-term durability of the polymer/Ag NPs nanocomposite.

Experimental section

Materials

Pentaerythritoltriacrylate (PETIA) and poly(ethylene glycol) 600 diacrylate (PEGDA) (Fig. 1) were purchased from Sartomer and used as received without further purification. The typical photopolymerizable formulations were prepared in low-light conditions by mixing the two acrylate monomers (80:20 PEGDA:PETIA) with the photoinitiator (0.5 wt.%).

The polymer samples were prepared by coating the photopolymerizable mixture onto a glass slide or a CaF 2 plate (film thickness of 8 ± 1 µm) followed by irradiation using a Xe-Hg source (Lightning cure L8333 with a Hamamatsu L8253 Xe-Hg 100 W lamp). The polymerization was followed by Fourier transformed infrared spectroscopy with the disappearance of the vinyl C=C stretching vibration band at 1410 cm -1 .

As regards silver nanocomposite materials, a one-step photo-induced approach was applied [START_REF] Mustatea | Photoinduced synthesis of silver/polymer nanocomposites[END_REF][START_REF] Sakamoto | Light as a construction tool of metal nanoparticles: synthesis and mechanism[END_REF][START_REF] Zaier | Generating highly reflective and conductive metal layers through a light assisted synthesis and assembling of silver nanoparticles in a polymer matrix[END_REF][START_REF] Balan | In situ photochemically assisted synthesis of silver nanoparticles in polymer matrixes, Silver nanoparticles[END_REF]. Silver nitrate (0.2 or 0.4 wt.%), photoinitiator (0.5 wt.%) and the two acrylate monomers (80:20 PEGDA:PETIA) were stirred under magnetic stirring for one hour at room temperature. This step ensured complete dissolution of the metal precursor and Darocur®TPO, a free radicals generator working through homolytic cleavage of a C-P bond.

These highly reactive radicals would be used to reduce silver cations to silver nanoparticles

CH 2 CH C O O CH 2 C CH 2 CH 2 OH CH 2 O C O CH CH 2 O C O CH CH 2 14 CH C O O CH 2 CH 2 O CH 2 CH 2 O CH 2 CH 2 O C O CH CH 2 CH 2 a b
(Ag NPs). In parallel, these species would also initiate the radical polymerisation of the acrylate monomers. A few drops of the photosensitive formulation were coated onto a glass slide or a CaF 2 plate and then exposed to a fluence of 200 mW cm -2 for a few minutes. The formation of silver nanoparticles during the crosslinking polymerization was confirmed by UV-visible spectroscopy (the color of the samples turned to brown-yellow due to the plasmon resonance of silver).

Experimental set-up and procedure

For photoageing investigations, a SEPAP 12/24 unit from Atlas was used. This ageing simulator device was, in general, equipped with four medium pressure mercury lamps (Novalamp RVC 400 W) located in a vertical position at each corner of the chamber.

Wavelengths below 295 nm were filtered off by the glass envelope of the sources. The temperature and the light intensity are parameters that can modify the kinetics of degradation [START_REF] Goourey | Photostability of acrylate photopolymers used as components in recording materials[END_REF][START_REF] Philippart | Influence of the exposure parameters on the mechanism of photooxidation of polypropylene[END_REF]. In this work, the SEPAP 12/24 was working with only two lamps (at opposite corners) in order to reduce the light intensity. In the same way, the temperature at the surface of the sample was fixed at 45 °C. A rotating carousel, on which the samples were fixed, was placed at the center of the chamber.

Infrared spectra were recorded on a Nicolet 5SXC FTIR spectrometer with Omnic software. Spectra were obtained with a 4 cm -1 resolution and 32 scan summation. UV-visible absorption spectra were recorded on a Shimadzu UV-2600 PC spectrophotometer.

For solid-phase microextraction (SPME) experiments, the photopolymer films (deposited on a glass plate) were irradiated in the SEPAP 12/24 unit, in 20 mL sealed clear glass vials to collect the volatile organic compounds (VOCs) stemming from the photodegradation.

Carboxen-PDMS fiber (75 µm) purchased from Supelco (Bellefonte, PA, USA) was used to extract the VOCs in the headspace (HS) [START_REF] Larché | Chemical structure evolution of acrylic-melamine thermoset upon photo-ageing[END_REF][START_REF] Kumazawa | Solid-phase microextraction and liquid chromatography/mass spectrometry in drug analysis[END_REF] VOCs were analyzed using SPME coupled with gas chromatography/mass spectrometry (GC-MS), called HS-SPME/GC-MS, as previously described in details in reference [START_REF] Larché | Chemical structure evolution of acrylic-melamine thermoset upon photo-ageing[END_REF]. Mass spectra and reconstructed chromatograms (total ion current, TIC) were acquired under the electron ionization mode (EI) at 70 eV and recorded from 20 to 400 m/z. The compounds were identified by comparison with the mass spectra of the spectral library (NIST MS Search Version 2.0).

Thermoporosimetry is a technique that allows the calculation of mesh size distribution from the DSC thermal curve obtained from the freezing of the solvent confined inside the meshes of the polymeric network [START_REF] Baba | Crosslinking on ageing of elastomers: I. Photoageing of EPDM monitored by gel, swelling and DSC measurements[END_REF][START_REF] Baba | Crosslinking of elastomers resulting from ageing: use of thermoporosimetry to characterise the polymeric network with n-heptane as condensate[END_REF][START_REF] Bussière | Photocrosslinking of poly(N-vinylcarbazole): Implementing a complementary set of techniques to characterize the three-dimensional network formation[END_REF][START_REF] Habib | Application des méthodes de l'analyse thermique à l'étude du vieillissement des polymers[END_REF]. In this study the solvent was deionized water. DSC analysis was carried out with a Mettler Toledo DSC 3+, with cooling from 5°C to -85 °C at rate of 0.7 °C min -1 . Analyses were performed on swelled films for four weeks, which were placed in a 100 µL aluminum crucible.

The mesh size distribution P P dR dV as a function of the mesh radius R P , where the phase transition occurred, was calculated from the relationship DSC-TGA curves were recording using SetSys Evolution 1750 -SETARAM at temperatures ranging from 25 °C to 500 °C with a heating rate of 5 °C min -1 .

Transmission electron microscopy (TEM) measurements were achieved at 200 kV employing a Philips CM200 instrument with LaB6 cathode in order to observe morphology and in-depth organization of Ag NPs inside the polymer matrix. For the analysis, samples were cut with an ultra-microtome and observed on their cross sections.

Results and discussion

3.1. Photochemical behavior of the pure acrylate polymer

Chemical modifications

Under accelerated photoaging, pure PEGDA/PETIA polymer (deposit on a CaF 2 plate, thickness ca 8 µm) underwent chemical modifications as shown by the infrared spectra, recorded at various increasing exposure times (Fig. 2a). Two phenomena simultaneously occurred. The first one was a post-polymerization that consumed the residual vinyl groups (band at 951 cm -1 , Fig. 2a). Such reaction was already observed in acrylate photopolymers [START_REF] Goourey | Photostability of acrylate photopolymers used as components in recording materials[END_REF]. The second process was the photooxidation of the polymeric matrix. Irradiation caused the decrease of the bands at 2871 and 1115 cm -1 related to the methylenic and ether groups of PEG units, respectively. The absorbances of these two bands were linearly correlated (not shown). At the same time, new hydroxyl groups (increase of absorbance of the OH bond vibration band centered at 3460 cm -1 ) and carbonyl functions were formed. In the carbonyl domain (1900-1500 cm -1 ), the evolution of the differential infrared spectra (subtraction between the infrared spectra after and before irradiation) showed an increase in absorbance around 1707 and 1766 cm -1 , unfortunately the maxima of the corresponding bands were not observed due to the large band of the initial ester groups at 1735 cm -1 . (Fig. 2b). At this stage, it was important to note that previous studies carried out on poly(ethylene oxide) have shown that under accelerated conditions, the ether groups were favorable sites for oxidative degradation and therefore unstable [START_REF] Goourey | Photostability of acrylate photopolymers used as components in recording materials[END_REF][START_REF] Morlat | Phototransformation of water soluble polymers. I: photo-and thermooxidation of poly(ethylene oxide) in solid state[END_REF][START_REF] Hassouna | Etude des mécanismes de phototransformation de polymères hydrosolubles en milieu aqueux[END_REF]. These studies evidenced the fact that the combination of light exposure and oxygen resulted in the formation of formate (band at 1725 cm -1 ) and ester (band at 1750 cm -1 ) groups. In order to identify the resulting photoproducts, an irradiated PEGDA/PETIA film was exposed to NH 3 . The aim of this derivatization treatment was to evidence the formation of acid and ester functions. After the treatment, acid functions convert into carboxylate groups, ester into amide groups [START_REF] Wilhelm | Infrared identification of carboxylic acids formed in polymer photooxidation[END_REF] and formate end group into formamide [START_REF] Morlat | Phototransformation of water soluble polymers. I: photo-and thermooxidation of poly(ethylene oxide) in solid state[END_REF]. Differential spectra (subtraction between the spectra after and before treatment, Fig. 2c) revealed the band decrease at 1719 and 1748 cm -1 and in parallel, the band formation at 1575 cm -1 (carboxylate) and 1687 cm -1 (amide derived from esters and formates). Subsequently, the evolution of esters during ageing was followed by an increase in absorbance at 1766 cm -1 .

Changes in the chemical structure of the copolymer were mainly the result of chain scission reactions that were accompanied by the consumption of the methylene groups. As a result of these reactions, low molecular weight compounds might have evolved. In order to obtain information on the resulting gases, HS-SPME/GC-MS was used. This technique is a very powerful tool for monitoring polymer degradation and determining the mechanism of their photo-oxidation [START_REF] Goourey | Photostability of acrylate photopolymers used as components in recording materials[END_REF][START_REF] Goourey | Influence of ZnO nanoparticles in the photostability of acrylate photopolymers used as components in recording materials[END_REF][START_REF] Kahabbaz | Trapping of volatile low molecular weight photoproducts in inert and enhances degradable LDPE[END_REF][START_REF] Bortoluzzy | Solid phase microextraction to concentrate volatile products from thermal degradation of polymers[END_REF][START_REF] Lattuati-Derieux | Assessment of the degradation of polyurethane foams after artificial and natural ageing by using pyrolysis-gas chromatography/mass spectrometry and headspace-solid phase microextraction-gas chromatography/mass spectrometry[END_REF]. It was applied to samples irradiated for 0, 3, 10, 26, 50 and 100 hours. As an illustration, Fig. 3 All the compounds were identified (Table 1). According to M.N. Mortensen [START_REF] Mortensen | Stabilization of poly(ethylene glycol) in archeological wood[END_REF], formic acid (compound B) detected at 22.4 minutes resulted from hydration of formate resulting from the photo-oxydation of PEG units. To account for these gases, some degradation pathways are At this step, it should be mentioned that, based on previous studies on photopolymers synthesized from the polymerization of 2(2-ethoxy ethoxy)ethyl acrylate, HS-SPME/GC-MS analysis also evidenced the formation of ethylene glycol diformate (compound C detected at 22.6 min) stemming from the photo-oxidation. A mechanism was proposed to account for the release of this low molecular weight compound [START_REF] Goourey | Photostability of acrylate photopolymers used as components in recording materials[END_REF]. By analogy, mechanistic hypothesis was ventured to explain the formation of this species (Fig. 4).

O CH 2 CH 2 O CH CH O CH CH O O CH O CH 2 CH 2 O CH 2 CH 2 O CH 2 CH O CH 2 CH 2 O O O CH 2 CH 2 O CH 2 C O CH 2 CH 2 O O O CH 2 C O CH 2 C O CH 2 CH 2 O O O O CH 2 CO 2 CH 2 C O CH 2 CH 2 O O CH 2 CH 2 O H 3 C C O CH 2 CH 2 O O CH 2 CH 2 O H 3 C C O CH 2 CH 2 O H 3 C C O CH 2 CH 2 O OH OH OH H 2 O CH 2 O O CH 2 CH 2 O + + + + … O C H O CH 2 CH 2 O O CH 2 + O CH 2 CH 2 O C H O CH 2 CH 2 O O CH 2 CH O 2 ,PH,h, O  scission O CH 2 + H C O O CH 2 CH 2 O C O H Ethylene glycol diformate (C) O C H O CH 2 CH 2 O  scission O CH 2 C H O + PH 2-hydroxyethyl formate (F) O C H O CH 2 CH 2 O H + Cage reaction  scission O C H CH O 2 O
diformate (compound C) or 2-hydroxyethyl formate (compound F) (Figure 4). -scission reaction not only yielded compound F but also aldehyde end groups, which could in turn oxidize into acid. This was consistent with infrared spectroscopy which revealed the presence of carboxylic acid in the polymer chain upon exposure, a result confirmed as indicated above, by the NH 3 treatment.

A mechanism of photo-oxidation initiated by Norrish I and/or ester elimination reactions then followed by decarboxylation and/or decarbonylation [START_REF] Carroccio | MALDI investigation of photooxidation in aliphatic polyesters: poly(butylene succinate)[END_REF][START_REF] Bei | Photodegradation behavior and mechanism of block copoly(caprolactone-ethylene glycol)[END_REF] was proposed to rationalize the results obtained in a previous study on the photostability of acrylate photopolymer (Fig. 4 in reference 23). The A mechanism accounting for the formation of 2,3-dihydroxypropanal and (2methoxyethoxy)ethene was proposed in Fig. 6. According to M.N. Mortensen [START_REF] Mortensen | Stabilization of poly(ethylene glycol) in archeological wood[END_REF], the double bond of (2-methoxyethoxy)ethene species arose from H • radical. The oxidation of the methylene group gave rise to alkoxy radicals that yielded another radical through  scission. This latter would then convert into (2methoxyethoxy)ethene (compound A), which was detected at 16.9 minutes (Fig. 6).

Taking into account the surface area of the HS-SPME/GC-MS peaks, it appears that regardless of the irradiation time, ethylene glycol diformate (compound C) remained the main gas released (Fig. 7). Similarly, 2-hydroxy ethyl formate (compound F) and 2,3dihydroxypropanal (compound G) were formed at a high concentration, but at a lower concentration than compound C. These characteristics could suggest that H abstraction at position (a) proposed as initiation step of degradation pathway in Fig. 4 could be the major degradation pathway for PEGDA/PETIA polymer. Thus, pathway (b) did not appear to be a preponderant pathway (Fig. 4). The proposed mechanism to explain the formation of 2,3dihydroxypropanal derived from • CH 2 -O-CH 2 CH 2 -O-radicals could also be considered as one of the major degradation pathways (Fig. 6)

.

A C D E F G H I 3 26 100 Irradiation time (h) a b
Concerning 2-hydroxy ethyl formate, its concentration increased, went through a maximum at 50 hours of exposure and then decreased (Fig. 7b). Such a behavior could be explained by a conversion of this compound into formic acid [START_REF] Mortensen | Stabilization of poly(ethylene glycol) in archeological wood[END_REF].

Thermal analysis

Photoageing causes the polymer to undergo chain scission reactions that should have an impact on the size of the meshes of the three-dimensional network. To highlight this, we used thermoporosimetry which is a powerful technique to monitor the distribution of mesh size from the DSC thermogram during irradiation. Prior to exposure, water was trapped in meshes with radius ranging from 1.63 to 1.9 nm (Fig. 8). After 3 hours, the average mesh size distribution shifted to a higher R P from 2.8 to 4.8 nm. This result highlighted that at earlier exposure time, polymer degradation was sufficient to increase the mesh size. This increase occurred despite the post polymerization that took place in parallel with the degradation process. After 10 hours, the mesh radius was between 2.1 and 4.1 nm. It is interesting to mention that DSC thermograms of samples irradiated 26 and 50 hours, only displayed the crystallization peak of free water. This could be the result of important chain scission reactions occurring in the polymer which were responsible for the non-confinement of the solvent (the mesh sizes were too large). As regards the thermal properties of the copolymer, before irradiation, DSC thermogram showed three peaks with maxima at 180, 270 and 370 °C. After 3 hours of exposure, the second peak disappeared. Changing the composition of the monomer mixture did not allow us to attempt this peak. This could be related to residual monomer or unreacted functions that are converted during the first three hours of photoageing, as a post-polymerization phenomenon.

To obtain information on the influence of photoageing on thermal properties of the polymer at higher temperatures, thermogravimetric analyses coupled with DSC were performed on samples irradiated 3 and 10 hours in SEPAP 12/24 and at 45 °C. The thermal parameters obtained are presented in Table 2.

Temperatures in °C

The decomposition of irradiated PEGDA/PETIA films occurred in two steps: the first in the 103-293 °C range and the second at 288-421 °C. These steps were also observed in thermogravimetric analysis of poly(acrylic acid) [START_REF] Kaczmarek | Effect of stabilizer type on the physicochemical properties of poly(acrylic acid)/silver nanocomposites for biomedical applications[END_REF]. By analogy, the first step might be attributed to the cleavage of the covalent bonds. The corresponding weight loss was 44 % and 50 % after 3 and 10 hours of irradiation, respectively, compared to the low value of 8 % obtained for the unirradiated polymer film. As regards the last peak, it might be related to a chain scission reaction. Exposure resulted in a small increase in weight loss from 30 % before irradiation to 40 % and 37 % after 3 and 6 hours of photoageing, respectively (Table 2).

Influence of silver nanoparticles on the photochemical behaviour of the polymeric matrix

The influence of ageing on 0.2% and 0.4% silver filled samples was first evaluated by UVvisible spectroscopy (Fig. 9a). Absorbance spectra show that ageing induced an increase of the plasmon band with a small shift from 416 nm to 425 nm for both concentrations. During the first 50 hours of photoageing, the plasmon band progressively shifted to red, from 416 nm (without aging) to 420 nm (10 h) and finally to 425 nm (50 h) which indicated a small coalescence of the NPs in both concentrations. Between 50 and 100 h no more evolution was observed in terms of wavelength shift, no more coalescence. In the same time, the intensity on the plasmon increased progressively in both concentration (Fig. 9b), behavior ascribed to the reduction of residual silver ions. No evolution of the UV-visible spectra between 200 to 600 nm was observed for the polymer without NPs. TEM characterizations of sample cross sections were realized to visualize the changes of silver nanoparticles in terms of size/shape and organization in the polymer matrix (Figure 10).

Before ageing, the particles were homogeneously dispersed in the matrix for both concentrations. The size distribution was bigger at 0.4 % of AgNPs (3 to 15 nm) than 0.2 % (1.5 to 5 nm). After 100 hours of exposure, particles size slightly increased and a clear structuring of the nanoparticles was observed with a depth wise gradient of nanoparticles concentration toward the air surface of the nanocomposite film (Fig. 10). These changes resulted from migration and coalescence of the silver nanoparticles to the air surface of the nanocomposite film, phenomena also occurred in poly(vinyl chloride)/NPs composite film during UV and thermal ageing, and in low-density polyethylene/NPs material at longer wavelengths exposure [START_REF] Chinkamonthong | Effects of thermal and UV aging on antibacterial properties of linear low-density polyethylene and poly(vinyl chloride) films containing nano-silver colloid[END_REF]. The migration phenomenon was also observed by Tenorio-Neto et al. after 1 hour of a thermal treatment at 180°C of copolymer/Ag NPs nanocomposite [START_REF] Tenório-Neto | Synthesis and characterization of silver nanoparticle nanocomposite thin films with thermally induced surface morphology changes[END_REF]. The chemical changes in the polymeric matrix followed by infrared spectroscopy were identical to those observed during the photo-oxidative degradation of the pure copolymer. To try to better establish the role played by silver nanoparticles in both photo-oxidation and postpolymerization processes, it is necessary to investigate the kinetic aspects of these processes.

Fig. 11a revealed that the higher the amounts of NPs, the greater the decay of the methylene groups. Indeed, for example after 220 hours of irradiation in the case of un-doped polymer, 25 % of CH 2 were consumed compared to 39 and 65 % when 0.2 and 0.4 % of NPs were dispersed in the polymer matrix, respectively. Such results highlighted the photocatalytic effect played by nanofillers even used in low quantity. This effect was also observed in the case of HDPE/Ag NPs composite when the load of NPs was lower than 3%. On contrary for amounts superior to 3%, the nanofillers could avoid chain scission reactions to occur and finally act as a protector role [START_REF] Grigoriadou | Comparative study of the photochemical stability of HDPE/Ag composites[END_REF]. Thus, in PEGDA/PETIA matrix both concentrations of Ag NPs favored the chain scission phenomenon that caused the migration of the nanoparticles upon ageing, also reported in low-density polyethylene/Ag NPs composite [START_REF] Chinkamonthong | Effects of thermal and UV aging on antibacterial properties of linear low-density polyethylene and poly(vinyl chloride) films containing nano-silver colloid[END_REF].

The influence of Ag NPs was also evidenced in the kinetics of formation of new ester groups followed by infrared spectroscopy at 1766 cm -1 (Fig. 11b). Fig. 11b showed that the concentration of this species increased with increasing amounts of NPs. Interestingly, a linear correlation between the formation of ester groups and the decay of CH 2 groups was observed regardless of the NPs loading in the nanocomposite (0, 0.2 and 0.4 %). irradiation compared to 10 % in the case of an unfilled polymer. According to the literature [START_REF] Zaier | Generating highly reflective and conductive metal layers through a light assisted synthesis and assembling of silver nanoparticles in a polymer matrix[END_REF], the polymerization process was initiated by the silver nanofiller and thus, addition of Ag + ions to the photopolymerizable formulation increased the ultimate conversion degree of acrylate groups. The obtained results were in agreement with the literature.

After the absorption of photons, an electron-hole pair was photogenerated and could react with water and O 2 molecules [START_REF] Punnoose | Treatment of water effluents using silver nanoparticles[END_REF]. As a result, hydroxyl radicals were formed. It is known that this species are the main reagents in the photocatalytic process; they can promote hydrogen abstraction and thus initiate the degradation phenomenon. Thus, the higher the amount of Ag NPs in the polymer, the higher the concentration of hydroxyl radicals and finally the more important the photocatalytic effect, as revealed in Fig. 11a and11b.

Conclusion

In this study, we were interested in new acrylate photopolymers containing Ag NPs. The development of these new classes of composites depends crucially on their ability to resist photoageing over a long period of time.

Thus, to assess this point, our work was first devoted to the photostability of the un-doped polymer matrix. In an environment simulating sunlight, a post-polymerization of residual vinyl groups and an oxidation developed in this material. The latter process led to chemical changes (degradation of the -CH 2 CH 2 -O-groups of the PEGDA units and formation of new carbonyl functions on the polymer backbone) and architectural modification (increase in pore size). The chain scission responsible of the instability of PEG units caused, as expected, the formation of volatile organic compounds identified by SPME/GC-MS.

In the second part of this work, the influence of addition of low amount of Ag NPs (0.2 and 0.4 % loading) on post-polymerization and photo-oxidation kinetics was examined. NPs promoted the polymerization of the residual vinyl groups. However, the investigation

Fig. 1 .

 1 Fig. 1. a) Poly(ethylene glycol) diacrylate (PEGDA) and b) Pentaerythritoltriacrylate

  was the mesh volume, Y(T) was the DSC thermal curve ordinate corrected by the baseline. k designed a proportionality coefficient that depended on the rate of cooling and the sensitivity of DSC instrument. W a was the apparent enthalpy of crystallization of water that verified an empirical equation established by calibration in a previous work[START_REF] Habib | Application des méthodes de l'analyse thermique à l'étude du vieillissement des polymers[END_REF]. T was the difference in the crystallization temperatures of the confined and the free water. The different steps followed to calculate the mesh size distribution ) ( DSC thermogram was described in detail in reference 36.

Fig. 2 .

 2 Fig. 2. a) Changes in infrared spectra of film of pure PEGDA/PETIA upon irradiation in

  displays the chromatogram of a film irradiated 50 hours. It highlights the migration of various low molecular weight compounds into the gas phase.

Fig. 3 .

 3 Fig. 3. TIC HS-SPME/GC-MS chromatogram of a PEGDA/PETIA film irradiated 50h in a

  proposed in Figures4 to 6. Based on the decay of methylene groups and -C-O-C bonds, spectroscopy, the photo-oxidation of PEG units could involve abstraction of labile hydrogens in position to oxygen atom.

Fig. 4 .

 4 Fig. 4. Proposed mechanism of formation of ethylene glycol diformate, 2-hydroxyethyl

  • O-CH 2 CH 2 -O-and • CH 2 -O-CH 2 CH 2 -O-radicals generated from the two chain scission processes could account for the formation of compounds A, E, G and H. (2methoxyethoxy)ethanol arose from hydrogen abstraction in  position to methylene groups of macroalkoxyradicals • O-CH 2 CH 2 -O-and then from  scission (Fig. 5). Compound H might be the result of two successive H abstractions in  position to CH 2 groups in the same macromolecular chain giving rise to alcohol and ester functions. The resulting compound would in turn undergo chain scission by Norrish I or ester elimination reaction followed by decarboxylation process. The resulting biradical would yield 1,4-dioxan-2-ol after intramolecular recombination.

Fig. 5 .

 5 Fig. 5. Proposed degradation pathways of macroalkoxy radicals derived from Norrish I

Fig. 6 .

 6 Fig. 6. Proposed degradation pathways of macroalkyl radicals resulting from Norrish I

Fig. 7 .

 7 Fig. 7. a) Distribution, by cumulated area, of volatile organic compounds (from compound A

Fig. 8 .

 8 Fig. 8. Mesh size distribution of a film of PEGDA/PETIA before and after 3 and 10 hours of

Fig. 9 .

 9 Fig. 9. a) Evolution of UV-visible spectra of the surface plasmon band of Ag NPs dispersed in

Fig. 10 .

 10 Fig. 10. TEM images of samples cross section before and after 100 hours of exposure in

Fig. 11 .

 11 Fig. 11. Comparison of kinetic evolution of a) the decay of methylene groups (band at 2871 cm -1 ) and b) the formation of ester groups (band at 1766 cm -1 ) for the pure and Ag NPs

Table 1 .

 1 Volatile organic compounds stemming from irradiated PEGDA/PETIA film as identified by HS-SPME/GC-MS.

	Retention time	Products
	(min)
	16.9	(2-methoxyethoxy)ethene (A)
	22.4	Formic acid (B)
	22.6	Ethylene glycol diformate (C)
	22.8	2-hydroxyethyl acetate (D)
	23.6	(2-methoxyethoxy)ethanol (E)
	24.1	2-hydroxyethyl formate (F)
	24.2	2,3-dihydroxypropanal(G)
	25.9	1,4-dioxan-2-ol (H)
	27.7	1,3-dioxan-5-ol (I)

Table 2 .

 2 Thermal parameters of PEGDA/PETIA film before and after 3 and 10 hours of irradiation in SEPAP 12/24( 300 nm, 45 °C).

		Peak 1		Peak 2		Peak 3
		T decomposition m (%) T decomposition m (%) T decomposition m (%)
	0 h	112-221	8	222-317	45	317-423	30
	3h	108-293	44			293-434	41
	10h	103-288	50			288-421	37

Acknowledgements

The authors thank the Agence Nationale de la Recherche (ANR) for financial support under contract ANR-16-CE08-0032-01 projet MeTex.

Lawrence Frezet is thanked for his help in recording DSC-TGA curves.

highlighted the photocatalytic effect played by nanoparticles involving hydroxyl radicals resulting from the reaction between absorbed water and photogenerated electron-hole pairs. This means that silver nanoparticles unfortunately had an impact on the durability of the polymer matrix and therefore of the composite material. This unwanted characteristic is all the more important as these nanocomposite materials could find great applications in textile industry thanks to the specific properties of silver nanofillers (antibacterial, optical, conductive properties). Besides, under irradiation, Ag NPs underwent size distribution modification and a gradient structuring as a result of migration to the surface of the film and coalescence.

Very recently materials with reflective metallic top coatings and with spatially control of the assembling process of Ag NPs in a 3D polymer network have been developed. Since silver nanofillers have a rather negative effect on the photostability of the composite material, the question arises whether the reflective metallic top coating might not, on the contrary, provide some form of protection of the polymer matrix against degradation. This will be the subject of a forthcoming study focusing on the photostability of these nanocomposite materials specially designed to open up new perspectives in the textile industry.


Nishant Kumar
email: nishant.kumar@cnrs.pprime.fr

Franck Kerhervé

Laurent Cordier

Data Assimilation for control of a plane mixing layer

Keywords: data assimilation, active flow control, plane mixing layer

Introduction

Despite decades of intensive research in shape optimization, aerodynamic mechanisms such as separation and mixing still represent an important source of energy expenditure in transport vehicles. The manufacturers have consequently developed, over the years, a range of strategies to improve the aerodynamic performance of their vehicles. One of these strategies consists in inserting passive control devices like vortex generators directly in the flow-path. In general, these actuators are optimized considering the most likelihood inflow condition which potentially leads to bad performance for varying initial conditions and/or unsteady upstream perturbations. The classical remedy is then to consider active devices that can be actuated on and off based on the change of the inflow conditions. To drive such actuators, command laws and more globally valid controllers are required. To design these controllers, different control strategies can be employed. The class of model-based controllers is considered here. This approach requires the knowledge of a dynamical model of the flow that one wants to control in real-time. Experimentally, the identification of such a model is challenging because it is generally obtained from limited spatial and time discrete measurements. This problem of state estimation is well-known in the field of meteorology where data is collected at several locations, with spatial and temporal scales varying in orders of magnitude, to estimate the evolution of the weather [START_REF] Talagrand | Variational Assimilation of Meteorological Observations With the Adjoint Vorticity Equation. I: Theory[END_REF].

Classical methodologies involve the use of data assimilation (DA) techniques where data is assimilated, when available, with the dynamical model of weather forecast to correct the state estimate obtained by the model, and eventually, to correct the model itself for further, more accurate predictions. In the specific context of aerodynamicrelated problems, the complexity resides essentially in the large number of degrees of freedom of the flow dynamics, in the broad range of scales to examine and in nonlinearities driving the flow dynamics. To design a physical model that can be managed in real-time applications, the Navier-Stokes equations are traditionally projected on an appropriate reduced basis leading to a reduced-order model of the flow [START_REF] Rowley | Model Reduction for Flow Analysis and Control[END_REF]. Proper Orthogonal Decomposition (POD) [START_REF] Lumley | Atmospheric Turbulence and Wave Propagation. The structure of inhomogeneous turbulence[END_REF] is typically used to design the orthonormal basis but other decomposition methods can be employed to capture flow features which are believed essential to the desired objective. The derived physical reduced-order model (ROM) can then be used in conjunction with DA techniques to design dynamic observers able to predict the flow state from limited information [START_REF] Papadakis | Assimilation de données images : application au suivi de courbes et de champs de vecteurs[END_REF]. In this work, such dynamic observers will be developed, building on the state-of-the-art in meteorology. The first part of the work covers the implementation of DA methods to numerical simulations. The second part will then focus on the experimental implementation by considering the canonical case of a plane mixing layer in the perspective of real-time control.

Assessment of Data Assimilation method

In this section, we evaluate a DA technique with the consideration of applicability to the experiments. Specifically, we will focus on a method known as Dual Ensemble Kalman Filter (Dual-EnKF) which belongs to a category of sequential data assimilation methods. Before discussing the method, we briefly discuss the dynamic model used in data assimilation for the optimal estimation of the state of the system. In agreement with the POD-ROM obtained by Galerkin projection of the Navier-Stokes equations onto the POD basis, the model equation corresponds to a quadratic polynomial [START_REF] Cordier | Calibration of POD Reduced-Order Models using Tikhonov Regularization[END_REF] form given by

da i (t) dt = C i + N j=1 L ij a j (t) + N j=1 N k=1 Q ijk a j (t)a k (t), (1)
where a = (a 1 , • • • , a N ) T is the state vector and may represent the POD temporal modes. The coefficients C i , L ij and Q ijk are model's parameters which need to be tuned properly to describe the flow dynamics.

Under forcing or varying inflow conditions, the model's parameters may change significantly. Both state and parameters estimation is therefore performed by the Dual-EnKF method. Dual-EnKF is a data assimilation method based on Kalman filter [START_REF] Moradkhani | Dual state-parameter estimation of hydrological models using ensemble Kalman filter[END_REF] where the state and parameters statistics are propagated in time (forecast step) to naturally provide the prior statistics for the assimilation of the next observations (analysis step). Due to finite ensemble size, the filter is subject to sampling errors, which must be adjusted to ensure stability of the scheme. The data assimilation methods are evaluated based on their ability to: i) improve the description of the dynamics within the observation time window, and ii) provide a dynamical model which can correctly predict the longterm dynamics.

Dual-EnKF applied to 2D-cylinder wake flow

The DA methods are applied to estimate the numerical 2Dcylinder wake flow at Re = 100 obtained in the form of snapshots from a finite-element solver FreeFem++. The snapshots contain the information of the two components of the velocity vector u = [u, v] T . To build the reduced order model in [START_REF] Cordier | Calibration of POD Reduced-Order Models using Tikhonov Regularization[END_REF], POD is first used to energetically extract the important features from the flow field. The first four modes which represent 99% of the energy are retained to build the ROM. However, we observe that for various reasons (structural instability of the Galerkin projection, truncation of the POD basis, inaccurate treatment of the boundary and pressure terms), this dynamical system does not represent sufficiently well the correct dynamics. This problem is tackled by Dual-EnKF method to obtain better approximation of the coefficients in the ROM and hence improve the ability to forecast the evolution of modes (see Fig. 1).

Experimental Demonstration

At the conference, we will also present results where data assimilation will be applied to experimental data obtained for a plane mixing-layer. The tests will be conducted in the closed-loop mixing layer wind-tunnel COCOM at Institut Pprime (Poitiers, France). The wind-tunnel features a twin-turbine design with two separate air streams, running in parallel and meeting in the test section to produce a mixing layer (see Fig. 2). The test section is 3 m long with a 1 m × 1 m square cross-section. It begins at the throat of the convergent part of the wind tunnel, where the surface separating the two air streams terminates with a splitter plate. The splitter plate maintains a horizontal upper surface (from where the upper stream originates), while its lower surface is angled at 8 degrees so as to connect with the upper surface and form a relatively thin trail-ing edge. The splitter plate spans the entire width of the test section inlet, and extends by 39 cm into the test section. The initial thickness of the splitter plate is 8 cm and the trailing edge is only 2 mm thick (allowing instrumentation of the plate for control purpose). The boundary layers at the end of the splitter plate are turbulent for operation at higher speeds. Planar PIV will be performed and synchronised with a rake of 18 hot-wires located just downstream the PIV measurement plane as illustrated in Fig. 2. The PIV data will be used to identify a POD-based reduced-order model of the flow following the work of Cordier et al. [START_REF] Cordier | Calibration of POD Reduced-Order Models using Tikhonov Regularization[END_REF]. The Dual-EnKF technique described in the previous section will be applied with the hot-wires data as the observation array in order to recover a time-resolved estimate of the flow field as well as an update of the model's parameters. A high-speed planar PIV data set will be used to validate the estimate.

Figure 1 :

 1 Figure 1: Time evolution of the POD-ROM for the temporal POD coefficients a R 1 and a R 2 corresponding to the two most energetic modes for the 2D-cylinder wake flow at Re = 100. (a)-(b) ROM coefficients obtained from least mean-square estimation [5]. (c)-(d) ROM coefficients evaluated by Dual-EnKF. The dotted line at t = 200 s indicates the end of the assimilation window and beginning of the forecast window.

Figure 2 :

 2 Figure 2: Schematic of the plane mixing layer experimental set-up.