Xavier Jannot

Kevin Gaudefroy

Nicolas Vinel

Pierre Vidal

Philippe Dessante
email: philippe.dessante@supelec.fr

OPTIMAL DESIGN OF A WOUND ROTOR SYNCHRONOUS GENERATOR USING GENETIC ALGORITHM

The manufacturers are tempted to reduce the amount of active materials in the devices in order to lower the material bill. However, reducing the weight of the devices directly affects the energy efficiency. In this paper, a solution to this problem is proposed for the case of synchronous wound rotor generators. The trade-off between cost and efficiency is formulated as a constrained optimization problem and solved using a Genetic Algorithm. The cost optimization of three different machines is carried out through various design approaches. The proposed approach always gives better results than the classical approach concerning the global cost of the range.

Introduction

The recent rise in the cost of raw materials is motivating the manufacturers of electrical machines to improve the designs of their devices. The manufacturers are tempted to reduce the amount of active materials in the devices in order to lower the material bill. However, reducing the weight of the devices directly affects the energy efficiency, and therefore goes against the current trend and European suggestions [START_REF] Belmans | Energy Efficient Motor Driven Systems[END_REF], which recommend that the manufacturers increase the efficiency of their products. Manufacturers are thereby confronted with a constrained optimization problem: reducing the costs of devices and respecting the fixed efficiencies. In this paper we propose a solution to this problem for the case of a series of Wound Rotor Synchronous Generators (WRSG) using an optimization method based on Genetic Algorithm (GA).

The optimal design approach is used more and more often in the case of electromagnetic device design. This approach needs to accurately model various physical domains [START_REF] Kreuawan | Optimal design of permanent magnet motor using Multidisciplinary Design Optimization[END_REF][START_REF] Legranger | Combination of Finite Element and Analytical Models in the Optimal Multi-Domain Design of Machines : Appllication to an Interior Permanent Magnet Starter Generator[END_REF]. Magnetic, electric, thermal or mechanical models of the systems are often developed in order to design optimal devices respecting physical constraints from various fields of physics. The accuracy of the model and its execution time basically depends on the modeling complexity: 1D analytical model [START_REF] Legranger | Combination of Finite Element and Analytical Models in the Optimal Multi-Domain Design of Machines : Appllication to an Interior Permanent Magnet Starter Generator[END_REF][START_REF] Bellegarde | Optimisation of a drive system and its epicyclic gear set[END_REF][START_REF] Li | Optimization of Multibrid Permanent-Magnet Wind Generator Systems[END_REF][START_REF] Dessante | Optimization of a linear brushless DC motor Drive[END_REF], electric circuit type model [START_REF] Legranger | Combination of Finite Element and Analytical Models in the Optimal Multi-Domain Design of Machines : Appllication to an Interior Permanent Magnet Starter Generator[END_REF][START_REF] Candela | Optimal Design of a Salient Poles Permanent Magnet Synchronous Motor Using Geometric Programming and Finite Element Method[END_REF][START_REF] Kano | A Design Approach for Direct-Drive Permanent-Magnet Motor[END_REF] or Finite Element model [START_REF] Legranger | Combination of Finite Element and Analytical Models in the Optimal Multi-Domain Design of Machines : Appllication to an Interior Permanent Magnet Starter Generator[END_REF][START_REF] Schätzer | Vector optimimzation of two-dimensional numerical field problems applied to the design of a wind turbine generator[END_REF][START_REF] Jung | Optimal Design of Direct-Driven PM Wind Generator Appliying Parallel Computing Genetic Algorithm[END_REF].

In this work, a 1D multiphysics modeling of the WRSG was adopted whose short execution time allowed coupling with a stochastic optimization method. A GA optimization technique was employed because it is well suited to a mixed-variable constrained problem and it allows searching for a global optimum. The complexity of the treated objective function also leads to choose a zero-order derivation method.

The modeling of the machine and then the optimization method will be detailed followed by the optimization results. The range optimization needs to introduce a new procedure, different from the classical range design approach used in industry. The introduced method compares favorably with the classical one for various test cases and permits rationalization of the optimal design of a series of machines from an industrial point of view.

Wound Rotor Synchronous Generator Model

The geometry of the studied WRSG is shown in Figure 1. The stator tooth width is constant except for the bottom and the slots' back side. The air gap is progressive and the rotor winding is ordered. The model is parameterized with eight variables, constrained within a fixed range, which are detailed in Table 1 with their original values.

Electromagnetic Modeling of the WRSG

The fundamental quantity used for the machine modeling and optimization is the line voltage (peak or rms value). This voltage waveform is considered purely sinusoidal. Knowledge of this voltage, neglecting the winding resistance, allows determination, via integration, of the amplitude of the flux through the WRSG windings. The next step consists of determining the amplitude of the fundamental of the air gap magnetic flux density which is directly linked to the flux amplitude as a function of air gap geometry (length of the air gap and Carter's coefficient).

Next, the local value of air gap magnetic flux density under the poles is determined. To do this precisely, one needs to know the relations used to determine the "exact" waveform of the air gap magnetic flux density under one pole from the fundamental air gap magnetic flux density value and reversely, as depicted in Figure 2. The magnetic flux density local value under the whole pole permits computation of the flux through the pole and the magnetic flux density inside the pole. Then, using the flux conservation law, one can determine the magnetic flux density's values in the various elements of the magnetic parts of the stator: in the teeth and in the stator back iron (for the latter the minimal and maximal values are computed). This computation gives the magnetic field in the various parts of the WRSG: inside the air gap, the relation between magnetic field and magnetic flux density is linear, it is the vacuum magnetic permeability; for the other elements, information about the iron sheets (magnetic characteristic: magnetic flux density at saturation, permeability in linear and saturated areas) permits determination of the correspondence between flux density and magnetic field.

The computed magnetic field allows determination of the magneto motive forces (or Ampere-turns, mmf) applied to each element of the WRSG: the air gap, the pole, the teeth and the stator back iron.

The summation of all the mmf gives the mmf value for the no-load working point 0 ε .

All that is described in the previous paragraphs corresponds to a no-load running, and so now the influence of the current flowing in the stator when loaded must be determined. To determine this effect, it is considered that the mmf ε to be supplied for a given working point (emf E and current I) is the sum of two mmf: 0 ε that should be supplied to obtain the no-load emf E and cc ε that should be supplied to deliver the current I in short-circuit condition [START_REF] Belmans | Energy Efficient Motor Driven Systems[END_REF].

cc ε ε ε + = 0 [A.turns] (1)
The determination of cc ε is detailed as follows. The current flowing in the stator windings produces a mmf which will be called the armature current reaction. From this quantity, the air gap magnetic flux density due to the armature reaction is deduced. Then, according to the principle detailed before, the fundamental of this magnetic flux density noted d B 1 is determined. d B 1 depends only on cc ε .

Potier's method, described in [START_REF] Liwschitz | Calcul des machines électriques[END_REF], needs to be applied according to the following considerations. In short-circuit, the air gap magnetic flux density value is low, so that the machine is not saturated; on the contrary, it is working under linear conditions. As a consequence it can be stated that the mmf cc ε needed to obtain the air gap magnetic flux density is directly proportional to this very value. To determine the proportionality coefficient, a linear relation linking the mmf ent ε to be applied to the air gap and the magnetic flux density inside this one is:

0 . . µ ε carter e B ent ent = [A.turns]. (2)
Where ent B is the fundamental amplitude of the air gap magnetic flux density, e is the air gap length, carter is the Carter's coefficient of the air gap.

With a simple proportional relation, one can deduce:

ent d ent cc B B 1 ε ε = [A.turns]. (3)
From this expression, the value of the mmf needed according to relation (

Losses and Thermal Model

To ensure normal working conditions of the machine, the thermal behavior has to be studied. First the different kinds of losses occurring in the machine must be evaluated to give the input parameters of the thermal model that yields the stator and rotor temperatures.

1/ Losses' Estimation

The classical copper losses in stator and rotor windings are computed in a traditional way with (4).

2 . 3 I R P copper = [W] (4)
The resistivity temperature dependence is taken into account, which leads to a coupling between loss estimation and temperature computations. This coupled system of equations is solved using a fixed point method. The iron losses can be estimated because the magnetic flux density has been determined in all the magnetic parts. In the first harmonic approximation the iron losses appear only inside the stator. These losses are computed in the teeth and stator back iron, using (5).

2 5 . 1       = B k P iron iron [W/kg] (5)
which is valid at 50 Hz. iron k is the specific iron loss for a 1.5 T induction at 50 Hz for a 4-pole machine. Finally the mechanical losses corresponding to the windage losses and the bearing losses are evaluated with the correlation (6).

Where mec k are the mechanical losses for a given stator outer diameter and out Φ is the actual stator outer diameter. Knowing the different losses, the efficiency, as defined by [START_REF]Methods for Determining Losses and Efficiency of Rotating Electrical Machinery from Tests (Excluding Machines for Traction Vehicles)[END_REF], is computed.

2/ Thermal Modeling

As soon as the losses are determined the temperature increase in the stator and rotor are evaluated using a formulation derived from experimental correlations resulting from a wide experimental campaign. Either the stator or rotor temperature increase is evaluated with [START_REF] Candela | Optimal Design of a Salient Poles Permanent Magnet Synchronous Motor Using Geometric Programming and Finite Element Method[END_REF].

( )

stack out temp copper L eff P T , Φ = ∆ [K] (7)
Where

Optimization Problem

Genetic Algorithm (GA) has been widely used in electrical machine optimization [START_REF] Skaar | Genetic Optimization of Electric Machines, a State of the Art Study[END_REF]. It can find the global optimum, and can easily deal with non-linear constraints and complex cost functions; this is why it is used in this study. The cost function, expressed in [START_REF] Kano | A Design Approach for Direct-Drive Permanent-Magnet Motor[END_REF], is determined by the sum of the copper and iron weight multiplied by their respective material cost [START_REF] Li | Optimization of Multibrid Permanent-Magnet Wind Generator Systems[END_REF][START_REF] Candela | Optimal Design of a Salient Poles Permanent Magnet Synchronous Motor Using Geometric Programming and Finite Element Method[END_REF][START_REF] Schätzer | Vector optimimzation of two-dimensional numerical field problems applied to the design of a wind turbine generator[END_REF].

∑ = st co material weight st co total _ * _ (8)
It should be noted again here that there are eight design variables given in Table 1 with their respective ranges to be considered in the optimization. The optimization problem mixes continuous and discrete variables. Discrete variables are handled using the round operator after the crossover and mutation process [START_REF] Lebesnerais | Mixed-variable multi-objective optimization of induction machines including noise minimization[END_REF]. The constraints to be considered are maximum temperature increase and minimum efficiency listed in Table 2, and they are handled via penalty functions as in [START_REF] Li | Optimization of Multibrid Permanent-Magnet Wind Generator Systems[END_REF].

Optimization Results

Several optimizations were run to minimize various objective functions. A set of three machines covering a range of powers was considered for optimization. The three machines had power ratings of 125 kVA, 165 kVA, and 180 kVA. The goal of the consideration of a series of machine size is to show the interest of considering an ensemble of machine size when trying to optimize machines. First, the three WRSGs' costs are optimized separately. This approach leads to three different stator cross section geometries. This is unacceptable for industrial applications because it leads to unacceptable cost of production tools. Next, a classical range design approach is applied to determine a series of machines in which the cross section geometry is identical for the three WRSGs. Finally, new objective functions are introduced that hold for the specifications of the whole series of machines at once.

Independent Optimization of Three Different Machines

The three machines were first optimized independently. The cost is minimized respecting the minimum efficiencies of 91.6%, 91.7%, and 91.7% respectively for the 125, 165, and 180 kVA WRSGs. The results are given in Table 3 and the convergence of the algorithm is presented in Figure 3. It can be noted in Table 3 that for the 165 and 180 kVA machines the constraints on rotor and stator temperature increases are saturated as well as outer stator diameter. The 125 kVA WRSG has two saturated constraints: the rotor temperature increase and the efficiency. These results are in good agreement with usual remarks: larger machines are often very efficient but limited by temperature constraints. On the other hand smaller machines are known to have lower heating but poorer efficiencies.

Classical Design Approach Covering a Range of Powers

When designing a series of machines in an industrial environment, an important constraint is the cost of production. To reduce investment costs, a strong constraint is introduced: all the machines having the same outer diameter must have the same cross section geometry. This means that the three machines of our range of powers differ only in their stack length and their conductor number. Usually the largest machine cost is optimized and then the stack length is adjusted as well as the conductor number in order to obtain the two smaller power machine designs.

Thus starting from the 180 kVA design of One can think of starting from the cross section design of the smallest optimized machine and then having the stack length increased and the conductor number changed in order to reach the specified powers of 165 kVA and 180 kVA. An optimization was performed according to this idea but the algorithm was unable to find any solution. Indeed a feasible solution for the largest machine would be to enlarge the stack length beyond the upper fixed limit: the optimal stack length of the largest machine would be 0.478 m. This confirms the approach adopted by manufacturers: designing the largest machine and then having the stack length shortened. This way, one can be sure to keep all the machines of the series within a fixed volume. But fixing the cross section geometry from the largest optimized WRSG may not be the most optimal solution when considering the cost of the entire range.

Simultaneous optimization of a series of machines at once

It is here proposed to optimize the cost of the entire range considering the three machines at the same time. The objective function to minimize is then a weighted sum (9) of the individual costs of the three

∑ = = 3 1 _ _ * _ _ i st co i machine i weight st co total . ( 9
)
The weighting factors correspond to the repartition of the sales inside the considered range. Thus the cost function to minimize is the average cost per machine. The design variables are therefore changed. Instead of one stack length and one conductor number, there are now three stack lengths and three conductor numbers, one stack length and one conductor number per machine. Three different cases are studied, corresponding to three different sets of weighting factors given in Table 5. The optimization results of the three cases are given in Table 6 along with the considered constraints. Moreover the savings due the new proposed method are given. Whatever the chosen weighting factors, the proposed cost function gives better results than the classical design approach. This will give a non-negligible cost reduction for manufacturers. When analyzing the cost of the optimized WRSGs, it can be observed that the heaviest weighted machine is that which is privileged during the optimization process. This also means that the saturated constraints are often those of the privileged WRSG as can be seen in Table 6. In case I the minimum efficiency is saturated for the smallest machine and the larger ones are constrained by their temperature increases.

In case II the 165 kVA and 180 kVA WRSG are both limited by temperature increase. Finally in case III the largest WRSG is thermally constrained and the smallest one by its minimal efficiency. As expected the cross section design resulting from the simultaneous optimization of the whole series depends on the sales' distribution. The differences in the results confirm the adopted approach.

Conclusion

A GA optimization process has been applied to wound rotor synchronous generators' design with the idea of minimizing the cost of the machine. First, three different WRSGs, differentiated by their power, have been independently optimized under geometrical, thermal and efficiency constraints.

Then the three WRSGs' designs were considered from an industrial point of view which introduces a new geometric constraint: the cross section dimensions of the three WRSGs must be the same to avoid excessive investments in the production tool. Using this consideration a classical design approach is carried out and its results are compared with the results from the minimization of the newly proposed objective function. As shown, the new approach gives better results in all of the cases studied. Very few adjustments are needed for optimizing the whole range at once and the results show that the global optimization of the series can bring an important reduction of the global range cost. The method can be extended to series of any kind of electrical equipment through a straightforward process.

Fig. 1 .

 1 Fig. 1. Geometry of the WRSG studied with salient poles

Fig. 2 -

 2 Fig. 2 -Exact waveform of air gap magnetic flux density and its fundamental due to d-axis stator current reaction

  temp eff characterizes the ability of evacuating the heat generated by losses; and it depends on machine external dimensions: the stator outer diameter out Φ and the stack length stack L . Substituting the stator or the rotor copper losses to copper P , one can determine respectively the stator or rotor temperature increase.

Fig. 3 -

 3 Fig. 3 -Cost function evolution vs. iteration number for the 165 kVA WRSG. The results are normalized according the initial 165 kVA design

  1. WRSG's initial variable values with their ranges

	WRSG's parameters	Initial design	Range
	Effective Power [kVA]	165	-
	Outer stator diameter [mm]	390	[390,420]
	Inner stator diameter [mm]	270.5	[255,290]
	Slot diameter [mm]	317.5	[300,360]
	Tooth width [mm]	10.2	[5,24]
	Rotor pole width [mm]	86.5	[70,100]
	Rotor pole opening factor	0.7045	[0.6,0.8]
	Machine length [mm]	410	[210,420]
	Conductor number	6	[5,12]
	Cost [€]	790	-

  1) is computed.

	ISEF 2009 -XIV International Symposium on Electromagnetic Fields
	in Mechatronics, Electrical and Electronic Engineering
	Arras, France, September 10-12, 2009

Table 3 ,

 3 two-variable optimizations (stack length and conductor number) are carried out but for the powers of 125 kVA and 165 kVA. The results are given in Table4.

	Tab. 4 -Machine characteristics resulting from the classical design approach: adapting the largest machine to
	obtain the two smaller power machines
	variables	125 kVA 165 kVA 180 kVA
	Outer stator diameter [mm]		420
	Inner stator diameter [mm]		278.9
	Slot diameter [mm]		331.5
	Tooth width [mm]		12.4
	Rotor pole width [mm]		96.9
	Rotor pole opening factor		0.7415
	Machine length [mm]	261.8	349	349.9
	Conductor number	8	6	6
	Stator temperature rise [K]	87.1	97.8	125
	Rotor temperature rise [K]	90.3	106.9	125
	Efficiency [%]	91.61	92.53	92.34
	Cost [€]	594.52	755.85	757.56

Arras, France, September[START_REF] Jung | Optimal Design of Direct-Driven PM Wind Generator Appliying Parallel Computing Genetic Algorithm[END_REF][START_REF] Liwschitz | Calcul des machines électriques[END_REF][START_REF]Methods for Determining Losses and Efficiency of Rotating Electrical Machinery from Tests (Excluding Machines for Traction Vehicles)[END_REF] 2009


H B Ribeiro

E Anceaume

DataCube: a P2P persistent Storage Architecture based on Hybrid Redundancy Schema

Keywords: Peer-to-peer, availability, persistence, Byzantine failure model, collusion DataCube: Une Architecture de stockage persistent Systemes grande échelle, dynamisme, disponibilité, stockage persistent, collusion

This paper presents the design of DataCube, a P2P data persistent platform. This platform exploits the properties of cluster-based peer-to-peer structured overlays altogether with a hybrid redundancy schema (a compound of light replication and rateless erasure coding) to guarantee durable access and integrity of data despite adversarial attacks. In particular, the recovery of damaged data is achieved through the retrieval of the minimum number of coded blocks: coded blocks are selectively retrieved and their integrity is checked on the fly. An analysis validates DataCube principles design. Specifically, the triptych "availability -storage overhead -bandwidth usage" is evaluated, and results show that despite massive attacks and high churn, DataCube performs remarkably well.

Introduction

The huge interest for peer-to-peer systems has motivated researchers to go beyong routing and look-up functionalities. In this work we are interested in constructing a persistent storage functionality for implementing long-lived data objects despite massive and targeted attacks. Data redundancy is a required solution for implementing data persistence. However, in contrast to classic distributed systems in which the membership is stable, in peer-to-peer systems one has to face nodes churn (nodes propensity to frequently join and leave the system). To efficiently handle churn, recent works (e.g., eQuus [START_REF] Locher | equus: A provably robust and locality-aware peer-to-peer system[END_REF], PeerCube [START_REF] Anceaume | Peercube: an hypercube-based p2p overlay robust against collusion and churn[END_REF] and, S-Chord [START_REF] Fiat | Making chord robust to byzantine attacks[END_REF]) have extended classic DHT-based overlays (e.g., Chord [START_REF] Stoica | Chord: A scalable peer-to-peer lookup service for internet applications[END_REF], CAN [START_REF] Ratnasamy | A scalable content-addressable network[END_REF], Kademlia [START_REF] Bhagwan | Understanding availability[END_REF]) to their clusterized version. Clusters are populated by nodes that are close to each other according to a given proximity metrics (i.e., logical, geographical or semantical), and each of these clusters acts as a vertex of the structured topology. All the join and leave events are handle at clusters level which largely limit their impact on the overlay topology. In addition to being robust to churn, one can easily take advantage of these clusters to guarantee durable access to data (by using nodes as replica) as long as the coverage of nodes failures assumptions is close to one. Unfortunately a fundamental issue faced by any practical open systems is the inevitable presence of malicious (a.k.a Byzantine) nodes [START_REF] Sit | Security considerations for peer-to-peer distributed hash tables[END_REF]. They can devise complex strategies to prevent honest nodes or users from retrieving data they locally cache (e.g. by mounting eclipse attacks [START_REF] Sit | Security considerations for peer-to-peer distributed hash tables[END_REF], dropping, re-routing messages towards other malicious ones or providing incoherent responses). Existing P2P overlays that focus on tolerating the presence of Byzantine nodes (e.g., Peercube [START_REF] Anceaume | Peercube: an hypercube-based p2p overlay robust against collusion and churn[END_REF], Oceanstore [START_REF] Kubiatowicz | OceanStore: an architecture for global-scale persistent storage[END_REF], S-Chord [START_REF] Fiat | Making chord robust to byzantine attacks[END_REF]) make the assumption that no more than a bounded proportion of malicious nodes (i.e., a third of the population) are present at any time and anywhere in the system. This is a fundamental and required assumption to be able to design Byzantine tolerant algorithms [START_REF] Lamport | The byzantine generals problem[END_REF]). However, differently from static distributed systems in which coverage of such an assumption is very high, in open systems, membership of the system evolves according to clients wishes. Thus even if the proportion of malicious nodes in these systems can be roughly estimated, there are some corners of the system that may be potentially surrounded by more malicious nodes than expected. This typically occurs through collusion of malicious nodes [START_REF] Awerbuch | Towards a scalable and robust DHT[END_REF]. Such collusion allow to easily mount targeted attacks that quickly endanger the relevance of failures assumptions. Actually by holding a logarithmic number of IP addresses, an adversary can very easily and efficiently disconnect some target from the rest of the system. This can be achieved in a linear number of offline trials [START_REF]Group spreading; a protocol for provably secure distributed name service[END_REF]. It has been shown by Awerbuch et al [START_REF] Awerbuch | Towards a scalable and robust DHT[END_REF] that the only strategies that can protect open systems against such targeted attacks are the ones that preserve node identifiers randomness. However either these solutions keep the system in an hyper-activity (they force nodes to continuously leave and re-join the system) or they are intrinsically complex and costly [START_REF] Awerbuch | Towards a scalable and robust DHT[END_REF].

The solution we propose to face this challenging issue is by designing a hybrid redundancy schema (a compound of light replication and rateless erasure coding) on top of a clusterized DHT-based overlay. This schema guarantees durable access and integrity of data despite adversarial attacks. Briefly, in addition to replication at a subset of clusters nodes, data is fragmented, coded and spread outside its cluster. Each fragment is uniquely identified and is placed at the cluster that matches its new identifier. When a cluster is detected corrupted (through simple integrity tests), this cluster is logically isolated from the system, and recovery of the data this cluster was in charge of is triggered. Coded fragments are collected, decoded, and the recovered data is eventually pushed to a new cluster that subsitutes the corrupted one. A secure verification hashing scheme is used to identify and verify each collected fragment on the fly. Analytical study of operations complexity, storage and bandwidth overhead, and data availability show the very good performance of our approach. Note that for the best of our knowledge this is the first work that addresses open-system data-persistence in presence of collusion. An analysis validates DataCube principles design. Specifically, data availability is evaluated in different adversarial contexts (i.e., 30% of malicious nodes in the system plus collusion at targeted clusters, while storage overhead, and bandwidth usage are derived for different amount of data (up to 200 TB). This makes DataCube an appealing data persistent platform for open and large scale systems.

The remainder of this paper is structured as follows: Section 2 presents related work on persistent structured peer-to-peer systems. Section 3 discusses persistence issues that one has to face in presence of massive attacks and the design we suggest to solve that issue. Section 4 presents an analysis of data availability, storage overhead, and total bandwidth maintenance. Section 5 concludes.

s > k . The ratio k

s is called code rate and it gives the exact amount of redundancy added to the original data. Fundamental property of erasure coding is that the original data is recoverable from any k distinct coded blocks. Reed-Solomon codes are the pioneered fixed-rate erasure codes. They are well adapted to bounded-loss channels, and the recent introduction of Tornado codes guarantees fast coding and decoding operations (in linear time) however they are intrinsically not adapted to unbounded-loss channels (as generated coded blocks are interdependent). Rateless codes (also called Fountain codes) overcome this feature. As a class of erasure codes, they provide natural resilience to losses, and therefore are fully adapted to dynamic systems. By being rateless, they give rise to the generation of random, and potentially unlimited number of uniquely coded symbols. A clear advantage of that property is that content reconciliation is useless and one may recover an initial object by collecting coded blocks generated by different sources. The three main rateless codes proposed so far are the pioneering LT codes introduced by Luby [START_REF] Luby | LT codes[END_REF], quickly followed by the online codes by Maymounkov et al. [START_REF] Maymounkov | Online codes[END_REF] and Raptor codes by Shokrollahi [START_REF] Shokrollahi | Raptor codes[END_REF]. The two latest ones independently discovered the idea of adding a pre-coding phase to obtain linear codes and stronger recoverability guarantees. Section 3.2 details the main principles of online coding. An empirical study based on Kademlia [START_REF] Bhagwan | Understanding availability[END_REF] has shown that data redundancy management (full replication vs. erasure coding) strongly depends on both nodes availability and rate at which these changes take place. Actually, it has been shown [START_REF] Rodrigues | High Availability in DHTs: Erasure Coding vs. Replication[END_REF] that erasure coding benefits vanish due to their implementation complexity and because of the increase in terms of download latency. The present work tends to demonstrate that by judiciously managing full replication and coding one can keep the best of both techniques.

From an operational point of view, an increasing number of peer-to-peers systems focus on implementing persistent objects. Total Recall [START_REF] Bhagwan | Total Recall: System support for automated availability management[END_REF] is designed to provide a probabilistic prediction of the number of replicas the system needs by evaluating the past behavior through a stochastic model. Differently from our approach Total Recall is not designed to handle a Byzantine-prone environment. In Reperasure [START_REF] Zhang | Reperasure: Replication protocol using erasure-code in peer-to-peer storage network[END_REF] a fixed-rate erasure coding approach is performed to achieve redundancy. However, the main weakness of this work is the lack of churn handling which may prevent nodes to find all required fragments. The closest work to ours in terms of failure model is OceanStore [START_REF] Kubiatowicz | OceanStore: an architecture for global-scale persistent storage[END_REF][START_REF] Rhea | Pond: The OceanStore prototype[END_REF]. In Oceanstore a hybrid redundancy scheme is applied. A primary/secondary-tiers of full replicas is employed to serialise objects read/write operations. In addition, an archival form of objects based on fixed-rate erasure-coding is massively applied to any object. Differently from DataCube, Oceanstore hybrid scheme does not handle adversarial collusion, and because of the use of fixed-rate erasure codes, reliability of their data does not evolve with the number of replicated fragments.

3 DataCube Principles

Preliminaries

Prior to detailing our algorithm, we first present the two prerequisites any Byzantine tolerant cluster-based overlays have to provide to be directly exploitable by DataCube as a substrate: (i) each cluster must be uniquely labelled and, (ii) the size of each cluster must be lower (resp. upper) bounded. The lower bound, named S min in the following, should satisfy S min ≥ 4 to allow Byzantine tolerant agreement protocols to be run among these S min nodes. The upper bound, that we call S max , should be in O(logN ), where N is the current number of nodes in the system, to meet scalability requirements. Both prerequisites are already met (or easily achievable) in existing cluster-based overlays (e.g. , in S-Chord [START_REF] Fiat | Making chord robust to byzantine attacks[END_REF] labels can be easily assigned as a function of nodes position on the Chord ring).

Let us briefly describe how cluster-based overlays typically evolve according to these properties. When node n enters the system, it joins the cluster whose label matches the proximity metrics. Once a cluster size exceeds S max , this cluster splits into two smallest clusters, each one populating with the nodes that are closer to each other. When n leaves, it simply leaves its cluster. When a cluster size reaches S min this cluster merges with its closest neighbour. According to the proposed overlays, all cluster members or only a subset of them (but at least S min of them) are in charge of routing lookup requests, replicating all data-items that match the cluster label, and handling cluster operations (split/merge and create). In the following we assume that only S min nodes are in charge of these operations. We call these nodes core members of a cluster. The other nodes of the cluster (if any) are inactive until they replace left core members. We call these nodes spare members of the cluster. In PeerCube [START_REF] Anceaume | Peercube: an hypercube-based p2p overlay robust against collusion and churn[END_REF], spare members also allow to make join and leave events transparent to the overlay topology (this is simply achieved by having any node that joins a cluster to join it as a spare member).

In the following, when referring to an action taken by a cluster, we mean an action taken by all the core members of that cluster. However, for simplicity of the presentation, we abusively use the term "cluster" in place of the terms "the core members of the cluster".

Principles of Online Coding

Online codes [START_REF] Maymounkov | Online codes[END_REF] are based on two main system parameters ε, and q. Parameter ε, typically equal to 0.01, infers how many blocks are needed to recover the original message (i.e., a message of n blocks can with very probability be decoded from (1 + ε)n coded blocks) while q affects the probability of reconstructing the original message (i.e., the decoding process may fail with negligeable probability (ε/2) q+1 , with q typically equal to 3 [START_REF] Maymounkov | Online codes[END_REF]). Online coding consists in three phases respectively called pre-coding, coding and decoding phases. Consider an original message (or data item) divided into n equal-sized input blocks.

The pre-coding phase consists in generating a small number A = δεqn of auxiliary blocks, with δ typically equal to .55, and by appending them to the original message. Specifically, for each original input block b i we associate q randomly chosen numbers i 1 , . . . , i q with i j ∈ [1, . . . , A] such that each auxiliary block a ij is computed by XORing the content of all the input blocks we have associated it to. The A auxiliary blocks are then appended to the original n blocks message to form the so called composite message F of size n = n(1 + δεq) which is suitable for coding.

The coding phase consists in generating check blocks c i from the composite message F . Specifically, check block c i is generated by XORing the content of d i blocks of the composite message, with d i a value sampled from a pre-specified probability distribution that depends on ε. The coded block is then the pair c i , x i with x i the set of d i blocks randomly chosen from F to compute the check block c i . A possibly infinite number of independent coded blocks can be generated this way. In this work we use a pseudo-random number generator function G(x) to sample d i which allows different sources to generate exactly the same c i (see Section 3.5). Any set of (1 + ε)n output checks blocks are sufficient to recover a fraction 1 -ε/2 of the composite message which guarantees to recover the original message with probability 1 -(ε) q+1 .

Decoding amounts in rebuilding the bipartite graph composed by all recovered blocks c i , x i and its adjacencies x i . An adjacent block (also called neighbour ) is a block in the set x i XOR-ed to produce each coded block. In the bipartite graph the decoding algorithm continously looks for received coded blocks with only one unknown adjacent block. It recovers the adjacent composite block by XOR-ing the coded blocks and all adjacents. Hence, coded blocks with adjacence-degree 1 are direct copies of the corresponding composite block. At each round, any recovered composite block increases the probability of recovering other blocks through its edges. At the same time input blocks are recovered from recovered composite blocks likewise.

Leveraging the Power of Clustering

We now detail how DataCube guarantees a durable access to data-items. As previously mentioned in Section 3.1, all core members of a cluster are responsible for the same data-items. Thus as long as less than a third of core members are malicious, replication at core members is provably sufficient to guarantee both their persistence and integrity through Byzantine-tolerant agreements executed by core members. In particular any lookup request for any data-item D in the system is successful in no more than O(N/log 2 (N )) hops, and in O(log 2 (N ) messages (where N is the current number of nodes in the system) [START_REF] Anceaume | Peercube: an hypercube-based p2p overlay robust against collusion and churn[END_REF][START_REF] Fiat | Making chord robust to byzantine attacks[END_REF]. Now in presence of collusion, replication of data-items at core members does not guarantee anymore their persistence nor their integrity. Note that replicating data-items at all cluster members does not bring any additional guarantees. It will only take longer for the adversary to succeed in polluting the whole cluster. Thus the solution we propose is, in addition to keep full replica of data-items at core members, to fragment, identify, and spread coded fragments at other clusters of the system, each fragment being placed at the cluster that matches the fragment random identifier. Hence, when a cluster is detected corrupted (through simple integrity tests), this cluster is logically isolated from the system, and recovery of the data this cluster was in charge of is triggered. Coded fragments are collected, decoded, and the recovered data is eventually pushed to a new cluster that subsitutes the corrupted one. A secure verification hashing scheme is used to identify and verify each collected fragment on the fly. Thus if we consider data-item D such that D is originally placed on cluster C (C is the closest cluster to D key), then at cluster C, each core member stores a full replica of data-item D while each spare member of C stores check blocks c i , x i of data-item D such that C's label is closer to the key of c i , x i .

Figure 1 shows the algorithm for the pre-coding and coding phases performed by any node p ∈ V c , the spreading of check blocks on the closest clusters to their keys, as well as the replication of check blocks at these clusters. Specifically, upon receipt of data-item D, node p proceeds as follows. It generates a composite message (as explained above) and its associated Merkle root [START_REF] Merkle | A certified digital signature[END_REF] (see lines 1-6), and runs a Byzantine tolerant consensus agreement among core members to agree on a unique composite message and Merkle root (line 7). The Merkle hash tree is an authentication scheme based on a tree of hashes that eliminates the large storage requirement by using a single signature (called root of the tree) for authenticating a finite number of messages. The consensus agreement eliminates the possibility of using a corrupted composite message during the coding phase. Finally, the Merkle root guarantees that only consistent composite blocks are used during the decoding phase. Once an agreement is achieved, the coding phase is invoked by each core member, with c 0 = (1 + ε)n (line 8) the number of check blocks to be created.

In the Coding phase, c 0 check blocks are initially generated (lines 9-17). Note that, more check blocks can be generated afterwards by invoking CodedBlock function (lines [START_REF] Lamport | The byzantine generals problem[END_REF][START_REF] Awerbuch | Towards a scalable and robust DHT[END_REF][START_REF]Group spreading; a protocol for provably secure distributed name service[END_REF]. This invocation is triggered when all α spares, at which a specific check block is stored, collude altogether to alter the integrity of the check block. Function generateCodedBlock implements the generation of each check block according to Section 3.2. To generate check blocks, core members use a PRNG function G(x) to select the degree of each check block, instead of using a random function, as described in [START_REF] Maymounkov | Online codes[END_REF]. Data-item key and the check block sequence form together the seed of G(x). The rationale of using G(x) is that it guarantees that all core members generate exactly the same check block at each coding round without any synchronization among them. At round j, the degree x j of check block c j , x j is derived from G(key(D) + j).

Each check block is assigned a key from which the placement on Datacube is defined. Keys must be random (to prevent malicious nodes from devising strategies to generate them), but their retrieval, for decoding, must not involved any storage overhead. Indeed, a straightforward solution that would consist in storing the key of each generated check block in order to lately retrieve its associated check block would be clearly unbearable. Thus, Datacube exploits a hash-chain [START_REF] Lamport | Password authentication with insecure communication[END_REF] method to identify check blocks. Each key assigned to a generated check block results from a recursive hash function on the data-item, establishing a chain (or stream) of keys. Specifically, given a data-item D and its associated key(D)=hash(D), then key cB n of check block c n , x n is equal to hash (n) (key(D)), with hash (n) (key(D)) the n th recursive application of the hash function on key(D) (line 14). Each check block c i , x i is then pushed at α ≥ 2 spare members (line 18) belonging to cluster C sec (line 15). We use the name C sec as a generic name for the closest cluster at which each check block is stored. These α spares are determined according to some arbitrary but deterministic function (e.g., the α spares are the closest spares to cB i ) (line 19). Replicating check blocks at α spares members reduces the influence of spare members departure, avoiding accordingly the computation cost of creating a new (Cb j , c j , x j ) block each time a spare member leaves. Whenever some replica q among α leaves or become manipulated, another spare member substitutes q. Then, the only situation during which a new check block (Cb j , c j , x j ) has to be generated is when all α spare members simultaneously leave or collude. Note that, when S max = S min (i.e., there are not enough spare members in the cluster) check blocks are temporarily stored at core members (line 25). Besides, by the time each check block is dispatched to α spares, core members of C sec compute and store a fingerprint of c j , x j by applying an one-way hash function on it (line 22). Afterwards, this fingerprint is used by cluster C sec to guarantee the integrity of check blocks stored at spare members.

Finally, to enable the recovery of data-items in case of corruption, each node p ∈ V c only needs to register the keys of all data-item D that are owned by p at the set of clusters C , such that C is a direct neighbour of C (This is detailed in Section 3.5).

Detecting Attacked Clusters

The goal of the detection is to identify misbehaving clusters and tag these clusters as polluted to isolate them from the system. Practically, any cluster C that points to cluster B may verify B integrity upon receipt of a lookup request for some data-item D housed at B. When cluster C receives the response of the request it can easily check D integrity by checking that D hashing is equal to D key. In case of inconsistency, cluster C contacts all neighbours of B to agree on whether B is corrupted or not. In the affirmative the recovery process is invoked by the closest cluster pointing to B (see Section 3.5). Note that if the number of B neighbours is not sufficient to invoke a Byzantine tolerant agreement, then C relies on the closest cluster A to B to decide on B corruption. Finally, in case C (or equivalently A) is corrupted while B is not, then B is the only cluster that will consider B as attacked which is clearly not an issue since all the other neighbours of B will continue to send and receive data from B through other routes.

Note: the time interval that elapses from the time a cluster is attacked to the time the detection is effective may represent a threat to DataCube as the adversary can generate manipulated check blocks to prevent the original data-item from being recoverable. Datacube handles this issue by having spare members store different coded blocks under the same key. On doing so, any check block honestly created can never be masked by corrupted ones.

Recovering Attacked Clusters

Let C be the cluster that invokes the recovery of cluster B, and let D be the data-item initially owned by B. Then, any request r received by C that either (i) has B as an intermediate cluster on the path to its destination, or (ii) whose destination is B itself, is prevented from reaching cluster B as follows: in the former case, C forwards r to its recipient through another path, while in the latter case, C blocks request r, and takes in charge the recovery of D by aggregating sufficiently enough check blocks as now described. Cluster C uses D key (noted in the sequel, key(D)) to obtain the minimum number of check block keys cB j , with j ≥ (1 + ε)n . Cluster C searches for check blocks by combining both the deterministic function G(x) used to generate check blocks (see Section 3.3) and the hash-chain built during the coding phase. From G(key(D) + j) cluster C rebuilds the bipartite graph used to generate check blocks and thus descriminate any specific check blocks to be searched. From the hash-chain, cluster C derives the keys cB j of coded blocks selected from G(x). To recover degree-1 check blocks, C first applies the deterministic function G(x) in order to identify these check blocks, i.e., any check block j, such that G(key(D) + j) = x i , with i : 1 . . . n and |x i | = 1. Then, keys of specific degree-1 check blocks are derived from the j th position of the hash-chain selected with G(key(D) + j), such that cB j = hash (j) (key(D)). Fetching degree-1 check blocks before other check blocks makes the decoding of composite blocks faster. Once derived, cluster C sends a lookup request for check blocks identified by cB j .

Upon receipt of a lookup(cB j ) request, core members ask for cB j to each of the α spare members that house it or them (as previously noted). By using check blocks fingerprints (and possibly with the means of majority votes), core members cope with spare members collusion by verifying the integrity of the retrieved check block(s). Finally, the integrity of the recovered composite blocks is also verified by using the associated Merkle root saved at the neighbour clusters during the coding process (see algorithm 1 line 17). It guarantees that only non-corrupted check blocks are used to recover the original data-item. In case of integrity violation, core members of cluster C asks for other check blocks (by invoking the CodeBlock function). Once data-item is fully decoded core members of C send it back to the requesting node, and temporarily store data-item D. This completes the recovery process.

When a new cluster N is created (due to a split, merge or create operation) and becomes in charge of the data-items of cluster B, recovered data-items temporarily stored in C are transfered to N . Further requests for data-items previously owned by B (but not recovered by C) are recovered by N by proceeding as above.

Analysis of DataCube

This section is devoted to the analysis of the data availability guaranteed by DataCube and the associated incurred storage and bandwidth usage requirements. Note that numerical values of the parameters used in the experiments are drawn from PeerCube features [START_REF] Anceaume | Peercube: an hypercube-based p2p overlay robust against collusion and churn[END_REF], in particular the derivation of the number of independent routes.

Data availability

In the following, we analysis the availability of data-item D. We assume that D sits at cluster C, and each of the i generated check blocks have been spread on clusters C i , where c 0 ≤ i ≤ c b , c 0 is the minimum number of check blocks necessary to recover D, i.e., c 0 = (1 + ε)n , and c b is the number of generated check blocks needed to reach a given data availability (as derived later in this section). For simplicity reasons, we assume that each check block sits on a different cluster. By construction, D availability depends on both cluster C availability where the S min replicas of D sit and on the availability of the clusters on which coded blocks are located. Let µ denote the ratio of malicious nodes in the whole system. The Collection des Publications Internes de l'Irisa c IRISA probability p that cluster D is polluted is equal to the probability that its core set is polluted, that is, populated by more than (S min -1)/3 malicious nodes. In the following we consider the upper bound of p which is obtained when the number of clusters in the system is minimal, i.e. equal to N/S max . Let Y denote the random variable representing the number of malicious nodes in a given core set, and X the one depicting their number in the cluster then p = 1 -

P{X = x} = µN x (S max /N ) x (1 -S max /N ) µN -x .
Now the lower bound p h on the probability that a request issued from cluster D successfully reaches cluster C i located at h hops from C and is successfully handled by C i is equal to

p h = 1 -(1 -(1 -p) h ) r ,
where r is the number of independent paths the request can take. It has been proved [START_REF] Anceaume | Peercube: an hypercube-based p2p overlay robust against collusion and churn[END_REF], that log(N/S max ) ≤ r ≤ log(N/S max ) + 3 and 1 ≤ h ≤ log(N/S max ) + 5. We are ready to derive the availability d a of D.

d a = (1 -p) + p c b c0 c b c 0 (p h ) c0 (1 -p h ) c b -c0 .
Table 1 provides a comparison between the stretch factor of our policy (i.e., the total amount redundancy added to data-items which is c b over c 0 ) and the replication factor imposed by classical full replication required to get data availability at least greater than 0.9, 0.99, and 0.999. To compute the replication factor obtained with classical full replication, we suppose that each copy of the data-item is replicated on a different cluster, as supposed for coded blocks. Experiments are conducted for different sizes N of the system. Let S max = log 2 N . In all these experiments, we assume that h is maximal (i.e. we maximise the probability of encountering faulty clusters). Thus, for example for N = 1, 000, we have h = 11 hops. Finally, we assume that 30% of the nodes in the system are malicious (e.g. for N = 1, 000, p h = 0.076). However, to simulate a targeted attack at cluster C (the cluster on which D sits), we suppose that C is populated by µ target = 45% of malicious nodes.

Results of these experiments, given in Table 1, show the benefit of our approach over full replication. It is shown that for reaching different level of availability, the stretch factor required increases relatively smoothly, while the growing of the replication factor is more sensitive. For instance, for N = 1, 000, and c 0 = 50, the stretch factor is equal to 17, 02 for an availability of .99 and reaches a stretch factor of 18, 92 for an availability equal to 0.999%. Whereas in the same conditions, the replication factor increases from 51 to 80 which clearly becomes a problem for large data-items. The same trend is obtained for increasing values of N .

N

Stretch factor Replication factor 0.9 0.99 0.999 0.9 0.99 0.999 1,000 Table 1: Computation of the stretch factor in DataCube and the replication factor obtained in classical full replication as a function of the required availability and the number of nodes in the system N . In these experiments, the ratio of malicious nodes in C is equal to 45% while it is equal to 30% in the remaining of the system.

Figure 2 confirms the scalability of our approach. For all these experiments we have c 0 = 50, µ = 30 and µ target = 40%. For N = 2 16 , rather than a replication factor of 194, we achieve the same availability with only 62 times the storage using hybrid replication, a 3-fold savings. Finally, one can notice the impressive benefit when using independent routes on both approaches. For instance, for r = 6 and N = 2 8 , replication factor decreases to 33 while in our solution the stretch factor drops to 10. full replication (1) hybrid replication [START_REF] Bhagwan | Understanding availability[END_REF] full replication [START_REF] Bhagwan | Understanding availability[END_REF] Figure 2: This graph shows the required stretch factor for our solution (hybrid redundancy) and replication factor for the full replication approach in function of N the number of nodes in the system. The required availability is da = 0.99. The number shown in brackets (i.e., 1 and 6) represents the number of redundant routes.

Storage overhead

We now compute the storage overhead implied by DataCube. We recall that each data-item D is initially replicated at S min core members and n fragments generated from D are coded and spread to other clusters at α spare members. The storage overhead DS for D is given by: DS

= (n.S min + c 0 c b c 0 α) -n. (1)
We now estimate how this storage overhead is distributed among nodes in Datacube. First, remark that data-items identifiers are randomly assigned for both data-items and check blocks. Thus, we can interpret the placement of both data-items and check blocks as the throwing of balls into several urns. We denote by Z c (resp. Z s ) the random variable representing the total number of data-items (resp. check blocks) stored at each core (resp. spare) member. Let f be the total number of data-items in the system, c b be the number of check blocks generated for each D to get a target data availability, and N = N c + N s be the current number of nodes in DataCube-N c (resp. N s ) is the number of core (resp. spare) members. The probability that the number of data-items (resp. check blocks) at any core (resp. spare) is upper bounded by z is given by:

P (Z s,c ≤ z) = z k=0 f.DS s,c k 1 N s,c k 1 - 1 N s,c f.DSs,c-k ,
where the notation X s,c stands for X s when dealing with check blocks and X c for data-items. In particular, DS s = c 0 c b c0 α and DS c = n.S min . Figure 3 compares the number of fragments per node (core and spare member) in DataCube with the one needed in case of full replication and pure rateless erasure coding to guarantee an availability of 0.99. Recall that data-items are made of n fragments. In these experiments, N = 1, 000, c0 = 50, the stretch factor is equal to 10 (see Figure 2), and α = 2. Lessons learnt from these experiments are two-fold: first, our approach guarantees a 3.5-fold savings wrt full replication, and second is very close to pure rateless erasure coding approach which clearly shows the low impact on storage overhead of the full data-items stored at S min core members in DataCube.

Collection des Publications Internes de l'Irisa c IRISA This graph shows the number of stored fragments per node in DataCube, in a full replication approach, and pure rateless erasure coding one. The replication factor used for the full replication approach is equal to 33 (see Figure 2) while the stretch factor for pure coding is equal to 10.

Bandwidth Usage

We finally derive the total bandwidth needed per node for maintaining DataCube redundancy mechanism in presence of churn. Each time a node p leaves the system data-items or checked blocks p cached are copied over to new nodes (to keep the redundancy guarantees), while each time a new node p joins the system p needs to download all the data that match to it. If we assume that nodes join the system at rate λ and leave it at rate α, and that α = λ (to keep the system size constant in average), the usage bandwidth per core node is, in expectation, equal to twice the size of fragments a node houses times λ. Note that the rate at which core members leave the system is 1/ Smin log2(N )-Smin less than the one spare members do. Figure 4, derived from figures obtained in Section 4.2, shows the required bandwidth per node needed for maintaining up to 1000 TBytes of unique data in a system of N = 10 6 nodes (this corresponds to a very large video archive). Clearly at a daily turnover rate, the required redundancy policy is too demanding to be support by nodes, however, at a monthly turnover rate, continuous contribution of each node shrinks to less than 20Kbytes/s which is clearly compatible with classic ADSL rates.

Conclusion

In this paper we have presented Datacube, a peer-to-peer persistent storage architecture which provides data persistence. We have shown that through lightweight full replication and fountain codes, durable access to data-items is achievable despite of a powerful adaptive adversary and high churn. As future work, we intend to study how reputation could help in estimating nodes trustworthiness.

Figure 1 :

 1 Figure 1: Algorithm performed by any node p ∈ Vc of C

P{Y

  = y|X = x}P{X = x}. Probability P{Y = y|X = x} represents the probability that y malicious nodes are inserted in the core knowing that x are in the whole cluster, i.e., P{Y = y|X = x} = x y S max -x S min -y / S max S min , and

  nodes in the system hybrid replication[START_REF] Locher | equus: A provably robust and locality-aware peer-to-peer system[END_REF]

  per node Number of data-items in the system DataCube full replication approach pure rateless coding approach

Figure 3 :

 3 Figure 3: This graph shows the number of stored fragments per node in DataCube, in a full replication approach, and pure rateless

  6e+06 8e+06 1e+07 1.2e+07 1.4e+07 1.6e+07 Bandwidth Usage per Node (Kbytes/s) Total Amount of Data in the System (Gbytes) Average membership = 1 hour Average membership = 1 day Average membership = 1 week Average membership = 1 month

Figure 4 :

 4 Figure 4: This graph shows the required bandwidth per node function of the churn for maintaining up to 1000 TBytes of unique data at an availability at least equal to 0.99

Collection des Publications Internes de l'Irisa c IRISA


M Bédja

I Magne

M Souques

J Lambrozo

L Le Brusquet

G Fleury

A Azoulay

S Ruszczynski

FRENCH POPULATION EXPOSURE TO 50 HZ MAGNETIC FIELDS: INTERMEDIATE RESULTS

Constitution of the study sample

To study the exposure of the French population to 50 Hz MF, a representative sample of 1 000 children from 0 to 14 years old and 1 000 adults has been created randomly. This sample phase and the information collecting phase were entrusted to the polling institute "MV2 Conseil" which was selected after

Introduction

For the last thirty years, the electricity related 50 Hz magnetic fields (MF) have been suspected of being responsible for several pathologies, in particular childhood leukemia [START_REF] Wertheimer | Electrical wiring configurations and childhood cancer[END_REF]. The most recent collective expertise (WHO 2007 andSCENHIR 2009) concluded that the last major interrogation with regard to low frequency MF is the statistical association observed in several joint analyses between the increase of risk of the childhood leukemia and a higher than 0.4 µT exposure to MF on average in a 24-hour period [START_REF] Ahlbom | A pooled analysis of magnetic fields and childhood leukaemia[END_REF]. Currently, the exposure of the French population to these magnetic fields is only approximately known. A study carried out in residences located near high voltage power lines in the "département 1 de la Côte d'Or" made it possible to assess the MF background level inside these residences [START_REF] Clinard | Évaluation de l'exposition aux champs magnétiques dans les habitations situées à proximité des lignes de transport de l'électricité en France[END_REF]. However, these residences are a limited sample compared to the diversity of the housing developments in France and the study characterized the exposure of the houses and not of the resident people.

We are all exposed to many sources of magnetic fields due the fact that we do not remain at home 24 hours a day. Transportation in particular, significantly contributes to the individual exposure. Other places or activities can also constitute sources of exposure such as the workplace, sport activity areas, shopping centers or schools.

Should the MF in excess to 0.4 µT on average carry health risk, would the authorities be able to manage it, i.e. estimate the proportion of the French population at risk and identify and mitigate the main sources causing the exposure? To answer this question the Ministry of Health and Solidarities initiated a study on the exposure of a representative sample of the French population to 50 Hz MF. The major issues of this study were to select randomly a representative sample and to collect all of necessary data. Measurements were performed in three campaigns at winter time (October to April). The present paper gives the results of the two first campaigns. MV2 first created a data base of 95 362 telephone numbers, which were extracted in a completely random way from the national file of the telephone numbers existing in France, excluding professional numbers. No quota was applied during this drawing of lots. The telephone numbers distributed on the whole of the territory including the unlisted numbers 2 and those of the "cellular phone only" were, at this stage, all potentially eligible to take part in this study.

A contact with "the adult reference of the household" was established by telephone in order to ask for volunteering for the study. All these contacts followed strictly a single recruitment screener (recruitment questionnaire by telephone) previously elaborated. If the contact accepted the principle of the study, the recruiter asked for the birthdates of all the members of the household. The person who had date of birth closest to the phone contact date (day and month only) was the person elected to carry the magnetic field measuring device. Therefore, only random chance selected the person included in the collection of measurements of MF. In this stage, only the age of the recruited person, the telephone number and address are known. If the elected person refused or was not able to carry out the 24-hour test, the contact was regarded as definitively invalid. For the first campaign the recruitment of children proved to be much more difficult than adults. They were given preference in the two other campaigns of measurements. The recruitment was carried out by region until was obtained a quota of participation per region representing the pattern of the settlement on the French territory. No measurement was achieved during weekends, public holidays (Chrismas, spring and Easter) and Wednesdays (this is a day off from school for French children).

The 2 000 individuals recruited constitute a representative sample of the French population, covering all the sociodemographic characteristics (age, sex, region, size of the household, cut agglomeration, type of residence, socio-professional status, etc). These households are representative of the ways of life of the French population in all its diversity (life style, type of habitat, domestic equipment, etc).

Measurements of MF and data collection

Each elected volunteer carried an EMDEX II (Enertech, USA) meter, measuring and recording every three seconds the magnetic fields which he was exposed to during a minimal length of a 24-hour period. This device measures two kinds of MF: the broadband and harmonic resultants. The EMDEX II calculates and records the magnetic induction obtained on the three axes, by step of time fixed, according the formula (1).

2 2 2 z y x B B B B + + = (1)
To achieve this study, 65 EMDEX II were used.

Calibration and check procedures

All the EMDEX were calibrated before and after each winter campaign of measurements in a laboratory of the department of electromagnetism of SUPELEC. In this laboratory, the background MF was very weak (between 0.03 and 0.05 µT). A dedicated semi-automatic system of calibration was developed. It is made of two sets of Helmholtz coils (Leybold), a programmable low frequency generator and an calibrated ammeter. In the center of each Helmholtz system, the magnitude B of the MF (in µT) is given by [START_REF] Wertheimer | Electrical wiring configurations and childhood cancer[END_REF] where N is the number of turns, R radius of the coils is equal to the distance between the centers of the two coils of each system (in meter), I the intensity of the current (in Amp) flowing in the coils and We checked that the values read on the meter are practically identical to those given by (2), therefore no correction factor was needed.

R I N B × × = 716 . 0 0 µ (2)
Another portable system was developed to check in situ the correct operation of the EMDEX before and after each 24-hour measurement. This system was copied, with the kind authorization of the original designer, from an device developed by the Australian Thanh Dovan (SWPNet). It is composed of one square solenoid of 25 cm of side with 225 turns, which can be fed by 4 different currents, therefore generating 4 MF magnitudes. It permits to compare the generated value to the one read on the screen of the EMDEX II.

Collection of data

During the period of individual measuring, each volunteer progressively filled out a timetable, noting the activities carried out and the corresponding beginnings and endings. For the volunteers unable to write (infants, etc), the timetables were filled out by the supervisor (parents or the babysitter for the children). At the recovery time of the device, the pollster filled out a questionnaire with the help of the volunteer containing information relating to the volunteer (age, sex, socio-professional code...) and his/her residence (year of construction, numbers years in the residence, number of persons living in the residence, type of heating energy used, mode of heating of the residence, mode of water heating, etc). The pollster noted the GPS coordinates at the entry of the residence volunteer. Before sending all the information for analysis, MV2 Conseil checked their validity (information sheets and timetables were well filled out, duration of measurements, etc). All the information in paper version were captured by means of computer and each series of MF was virtually cut out according to the associated timetable. In these two first campaigns, 1 500 volunteers took part, whose 996 series of measurements have been analysed yet.

To have all the information relating to the power lines (overhead or underground) and to the power stations positioned near the residence, the GPS coordinates will be transmitted to EDF (Électricité de France, operating the distribution network) and RTE (Transmission System Operator). They will inform us of the presence (possibly the number) or not of power lines at a distance to the residence less than or equal to 200 m for the 400 kV lines, 120 m for the 225 kV lines, 100 m for the 150 kV lines, 70 m for the 63 or 90 kV lines and 20 m for the underground cables. This information is not yet available and the analysis presented here under does not takes it into account.

Statistical analysis

The aim of the statistical analysis is to identify the factors explaining the intensity of MF by integrating information drawn from the questionnaires and timetables. After having checked the homogeneity of each series compared to the timetable and, having done a descriptive analysis for the validated series, the study is mainly directed towards three points:

1. Estimate of the exposure of the population in terms of average values,. 2. Characterization of the average exposures and identification of the factors contributing to the exposure 3. Search of exposure classes and identification of the factors explaining the probability of belonging to the most exposed classes.

All the analysis is based on the broadband resultant recordings.

Results

Out of the 996 fact sheets analyzed, 6 series were definitively eliminated for inconsistencies in the associated questionnaires. On the 990 remaining others, 437 are recordings of children and 553 are recordings of adults.

The results of the descriptive analysis showed that 15 children (3.4%) are exposed to a MF higher than 0.4 µT in arithmetic mean (AM). Only one of them observed a geometric mean (GM) higher than this value. The principal sources of these exposures are clock radios. In fact 13 of these children declared in the questionnaire to have placed the EMDEX beside a clock radio during the night. For the 2 others, the identified sources are a railway line which passes beside the school and the residence and a low power domestic transformer, perhaps in a desk lamp. The average exposures are 0.106 µT for AM and 0.029 µT for GM for the children and 0.148 µT and 0.044 µT respectively for the adults. The of comparison tests carried out (test of Wilcoxon-Mann-Whitney) showed that the children are overall less exposed than the adults and that the exposure is higher in the Paris region than in the other regions in terms of arithmetic and geometric means (p_values are lower than 0.1%).

To characterize or identify the factors of exposure in terms of AM and GM, two steps were adopted :

1. In the first step, linear models [START_REF] Azais | Le modèle linéaire par l'exemple[END_REF] and nonparametric regression models (generalized additive models)

were developed [START_REF] Wood | Generalized Additive Models: An Introduction with R[END_REF][START_REF] Hastie | Generalized Additive Models[END_REF]. The results showed that the most significant variables are linear with regard to the MF exposure. The nonparametric models did not give additional information compared to the linear models in terms of explained variance (tables 1, 2, 3 and 4). The factors identified are 1) having placed the EMDEX near a clock radio and 2) spending more time in railway transportation (tables 1 and 2). Other information appears according to the population and the average considered (arithmetic or geometric). The adults GM increase with working time on computer. The children living in apartments are more exposed than those who live in individual households. This result is also observed on the GM of the adults. To live in a city of more than 2 000 inhabitants contributes to increase the exposure of the adults.

2. In the second step, other descriptors were calculated for each series. An ascending hierarchical clustering is applied to the centered and reduced descriptors [START_REF] Stéphane | Data mining et statistique décisionnelle : L'intelligence des données[END_REF]. To measure the similarities, we used the Euclidean distance for individuals and the linkage of Wald for the classes. It led to a classification of each population in three classes noted " class 1 ", " class 2 " and " class 3 " (figures 1 and 2). To characterize these classes, a logistic regression was applied [START_REF] Stéphane | Data mining et statistique décisionnelle : L'intelligence des données[END_REF]. The aim was to model the probability from the class where an individual is showing to be more exposed taken from the information drawn from the fact sheets and the timetables The most discriminating variables and the Odds ratio (OR) associated are represented in tables 5 and 6.

Discussion

The magnetic fields we are exposed to, can be associated with several sources. The majority of the studies carried out on this subject are centered on the MF recorded in the residence or in the bedrooms. The originality of this study is characterized by the method used for the selection of the individuals constituting the study sample (method of random polling) and by the fact that measurements are individual exposures in a 24-hour period.

The GM measured on each type of population (GM) is lower than the GM observed on the French dwellings located near power lines (0.05 µT) but largely higher than those measured on the other dwellings (0.01 µT) [START_REF] Clinard | Residential magnetic field measurements in France: comparison of indoor and outdoor measurements[END_REF]. The 99% percentile of the adults AM is 1.529 µT. The Paris region is the most industrialized area and the most equipped with railway transportation. Thus the exposure is higher than in the whole of the other regions.

A higher exposure is also observed on the people who placed the EMDEX near a clock radio. Six adults (out of 553) are exposed to an AM higher than this value. They all have declared to have placed the EMDEX meter near a clock radio when sleeping. The clock radios are supplied by a low power transformer, which is the source of MF. During the night, it works normally in a single way (clock but no radio) and in this case, the MF magnitude is stable and characterized by a ratio of 3 between the broadband and the harmonic measurements. Figure 3 represents the MF series recorded by a 3-year old child whose EMDEX was placed beside a clock radio between 20:20 and 10:43. The volunteers indicated on the questionnaire if the EMDEX was placed beside a clock radio or not during time of sleep.

The electric railway transportation systems are sources which can influence the average exposures over a 24-hour period. The averages increase with the time spent in these types of transportation. If we consider GM (less sensitive to the peaks), the adults exposure increases with the time spent in front of the computer (working time on computer). The adults who live in cities of more than 2 000 inhabitants are more exposed then those who live in the smaller cities. The individuals who live in multifamily apartments (buildings or apartments) are more exposed than those who reside in individual households. AMs decrease with the time spent in school. However, these factors explain only partially the variations of the MF which we are exposed to over a 24-hour period (tables 1, 2, 3 and 4). The future introduction of the information related to the presence of power lines (transmission and distribution) in the residence neighborhoods could improve the rates of the variance explained by the different models.

The comparison tests applied to the average exposures of the classes resulted in concluding that the adults of class 1 are less exposed than those of the second. These latter are less exposed than those of class 3 in terms of arithmetic and geometric means (p-values lower than 0.1%). These results were obtained for classes 1 and 2 for the children (the size of class 3 is weak and the test was not carried out). The classes of the most exposed (class 3) are mainly formed by the people who declared to having placed the EMDEX beside a clock radio (6 out of 6 for the children and 21 out of 33 for the adults, table 5).

The results of the logistic regression enabled us to retain that in addition to placing the EMDEX near the clock radio, living in a multifamily apartment and/ or spending more time in front of computer increase the probability of belonging in classes 2 or 3 for the children (table 6). For the adults, having an individual mode of water heating and/ or placing the EMDEX near the clock radio increase the probability of being in class 3 (class of the most exposed). This probability decreases with the time spent in nonrailway transports (table 7).

Conclusion

For the first time in France, this study was made possible to assess the population exposure to 50 Hz magnetic fields. It also made possible identifying some sources of exposure even if these latter do not alone explain the average exposures. In the continuation, other measurements will be done and included to the data base. Information relating to the presence or not of power lines and power stations in the vicinity of the residence will also be introduced in the analysis. To ensure the validity of the results, robustness tests will be carried out.

a

  call to tender. The collection of data required significant workforce and financial costs and was conducted in three phases (February-April 2007, October 2007-April 2008 and October 2008-January 2009).

France is divided into 96 ''départements" + oversee islands

In France, the unlisted numbers are telephone numbers that are not in the phone book for privacy protection