Vlad-Florin Drȃgoi

Brice Colombier
email: brice.colombier@grenoble-inp.fr

Pierre-Louis Cayrel

Vincent Grosso
email: vincent.grosso@univ-st-etienne.fr

Integer Syndrome Decoding in the Presence of Noise

Keywords: Code-based cryptography, Syndrome decoding problem, Information-set decoding

Code-based cryptography received attention after the NIST started the post-quantum cryptography standardization process in 2016. A central NP-hard problem is the binary syndrome decoding problem, on which the security of many codebased cryptosystems lies. The best known methods to solve this problem all stem from the information-set decoding strategy. A recent line of work considers augmented versions of this strategy, with hints provided by side-channel information. In this work, we consider the integer syndrome decoding problem, where the integer syndrome is available but might be noisy. We study how the performance of the decoder is affected by the noise. We provide experimental results on cryptographic parameters for the Classic McEliece and BIKE cryptosystems, which are in the fourth round of the NIST standardization process.

I. INTRODUCTION

With an increasing practical feasibility of a quantum computer, the threat posed by Shor's algorithm [START_REF] Shor | Algorithms for quantum computation: Discrete logarithms and factoring[END_REF] on number theory base cryptosystems grows significantly. To address this threat, NIST began a standardization process in 2016 for post-quantum cryptography. In July 2022, three code-based candidates (McEliece [START_REF] Albrecht | Classic McEliece[END_REF], BIKE [START_REF] Aragon | BIKE[END_REF], HQC [START_REF] Melchor | Hamming quasi-cyclic (hqc)[END_REF]) qualified for the fourth round.Their security relies on the NP-hardness of the binary syndrome decoding problem (SDP) [START_REF] Berlekamp | On the inherent intractability of certain coding problems[END_REF]. Given a paritycheck matrix H of a binary linear code, a binary syndrome vector s * and an integer t, the SDP consists in finding a binary vector x of Hamming weight t such that Hx = s * . The best known strategy to solve the SDP is referred to as informationset decoding (ISD). Originally proposed by Prange [START_REF] Prange | The use of information sets in decoding cyclic codes[END_REF], it has been incrementally refined since [START_REF] Lee | An observation on the security of McEliece's public-key cryptosystem[END_REF], [START_REF] Stern | A method for finding codewords of small weight[END_REF], [START_REF] Dumer | Two decoding algorithms for linear codes[END_REF], [START_REF] May | Decoding random linear codes in O(2 0.054n )[END_REF], [START_REF] Becker | Decoding random binary linear codes in 2 n/20 : How 1 + 1 = 0 improves information set decoding[END_REF], [START_REF] May | On computing nearest neighbors with applications to decoding of binary linear codes[END_REF], [START_REF] Both | Decoding linear codes with high error rate and its impact for LPN security[END_REF].The complexity of the ISD method has been used to better tune the parameters of the cryptosystems according to the required security levels [START_REF] Esser | Syndrome decoding estimator[END_REF].

a) Syndrome decoding with hints: Recently, modified versions of the SDP, with additional information, obtained via side-channel analysis, was considered. In [START_REF] Horlemann | Information-set decoding with hints[END_REF], authors study the case where parts of the error are known, or only their Hamming weight. The case where the integer syndrome s is available, as if the matrix-vector multiplication had been performed in the integer ring instead of the binary finite field, is considered in [START_REF] Dragoi | Solving a modified syndrome decoding problem using integer programming[END_REF]. One method to obtain the integer syndrome is by laser fault injection attack [START_REF] Cayrel | Messagerecovery laser fault injection attack on the classic McEliece cryptosystem[END_REF]. The problem one has to solve in this case is the integer syndrome decoding (N -SDP), where the input is the parity-check matrix H, the integer syndrome vector s and the weight of the solution t. The same question is raised, does Hx = s admits a solution of weight t? This problem can be tackled down by means of Integer Linear Programming [START_REF] Cayrel | Messagerecovery laser fault injection attack on the classic McEliece cryptosystem[END_REF] or probabilistic methods [START_REF] Feige | Quantitative group testing and the rank of random matrices[END_REF]. Another method of obtaining s, much more feasible and realistic than laser fault injection, is by side-channel analysis [START_REF] Colombier | Messagerecovery profiled side-channel attack on the classic McEliece cryptosystem[END_REF]. However, due to physical factors, the estimation of s might not be perfectly accurate. Hence, in the N -SDP in the presence of noise, we are given a noisy integer syndrome s = s + ϵ, where ϵ models the noise. The solution proposed in [START_REF] Colombier | Messagerecovery profiled side-channel attack on the classic McEliece cryptosystem[END_REF] uses a combination of ISD techniques and the score decoder from [START_REF] Feige | Quantitative group testing and the rank of random matrices[END_REF]. In [START_REF] Colombier | Messagerecovery profiled side-channel attack on the classic McEliece cryptosystem[END_REF] only simulations are provided to assess the performance of this algorithm.

b) Learning with errors and hints: Not only code-based cryptosystems are vulnerable to such attacks. Similar results were obtained in the context of lattice-based cryptosystems by Bootle et al. [START_REF] Bootle | LWE without modular reduction and improved side-channel attacks against bliss[END_REF]. The BLISS cryptosystem was cryptanalysed by means of similar hybrid attacks, where side-channel attacks revealed an Integer version of the Learning with Errors (ILWE). The ILWE problem is the lattice-based equivalent of the N-SDP. However, ILWE was solved with another technique that does not seem to work for N-SDP. Nevertheless, it points out that such scenarios are not only applicable to code-based cryptosystems.

c) Quantitative Group Testing: Quantitative Group Testing (QGT) is an active field of research, lately boosted by the the COVID-19 epidemic. In the QGT we are given a large population out of which some individuals suffer from a disease, and the goal is to identify the infected individuals. Possible applications of QGT go from bio-informatics [START_REF] Cao | Quantitative group testing-based overlapping pool sequencing to identify rare variant carriers[END_REF], traffic monitoring [START_REF] Wang | Group testing under sum observations for heavy hitter detection[END_REF] and confidential data transfer [START_REF] Dinur | Revealing information while preserving privacy[END_REF], [START_REF] Adam | Security-control methods for statistical databases: A comparative study[END_REF] to machine learning [START_REF] Martins | Testing the Maximum by the Mean in Quantitative Group Tests[END_REF], [START_REF] Wang | Data extraction via histogram and arithmetic mean queries: Fundamental limits and algorithms[END_REF]. The N-SDP can be also seen as a QGT in presence of noise. As we shall demonstrate, the algorithm we propose here, solves a noisy QGT instance, by adapting and improving (using coding theory tools, such as ISD techniques) a recent solution to the classical QGT [START_REF] Feige | Quantitative group testing and the rank of random matrices[END_REF].

Contributions: In this article, we analyze in detail the algorithm proposed in [START_REF] Colombier | Messagerecovery profiled side-channel attack on the classic McEliece cryptosystem[END_REF], referred to as ISD-score decoder, and provide the following contributions. First, we demonstrate that the ISD-score decoder finds a solution to the N -SDP in the presence of noise with high probability, as long as the weight is sufficiently sub-linear in n, more exactly, t ≤ O n-k log(n-k) , where n is the code length and k the dimension. We consider two noise models, i.e., Binomial centered in zero and Bernoulli variables. The ISD-score decoder can tolerate noise levels that are linear in the weight of the solution t. For that we partially build our demonstration on the techniques used in [START_REF] Feige | Quantitative group testing and the rank of random matrices[END_REF]. We incorporate the noise models into these techniques and, by using sharper inequalities, determine a much clearer condition for having a higher probability of success. One consequence of this new method is that when the noise is null and the ISD part is ignored, equivalently the ISD-score decoder boils down to the algorithm proposed in [START_REF] Feige | Quantitative group testing and the rank of random matrices[END_REF], the conditions we obatain for t are larger that those from [START_REF] Feige | Quantitative group testing and the rank of random matrices[END_REF]. This gives a lower bound on the number of syndrome entries required to find a solution, known as the information theoretic bound.

Due to page limitations, all proofs have been omitted, the full version of the article being available on eprint.iacr.

II. PRELIMINARIES

Notations: A finite field is denoted by F, and the ring of integers by Z. We write N * n = {1, . . . , n} and Z -n,n = {-n, . . . , 0, . . . , n}. For p ∈ [0, 1] and n ∈ N we denote the Bernoulli distribution by Ber(p) and the Binomial distribution by B(n, p). We denote by W (x) the Lambert W function. Matrices and vectors are written in bold capital, respectively small letters. Also, HW(c) and Supp(c) denotes the Hamming weight and the support of the vector c.

Integer syndrome decoding problem: Let us recall the formal definition of N -SDP as already stated in [START_REF] Cayrel | Messagerecovery laser fault injection attack on the classic McEliece cryptosystem[END_REF], [START_REF] Dragoi | Solving a modified syndrome decoding problem using integer programming[END_REF].

Definition 1 (N -SDP).

Inputs:

H ∈ {0, 1} (n-k)×n , s ∈ N n-k , t ∈ N * . Output: x ∈ {0, 1} n , s.t. Hx = s, and HW(x) = t.
To define N -SDP in the presence of noise as generally as possible, we model the noise ϵ = (ϵ 1 , . . . , ϵ n-k ) as a vector of random variables ϵ i ∼ D, where D is a discrete probability distribution. In the N -SDP in the presence of noise we are given a noisy syndrome s = s + ϵ and the value s * = s (mod 2) (component-wise).

Definition 2 (N -SDP in the presence of noise ϵ).

Inputs:

H ∈ {0, 1} (n-k)×n , s ∈ Z n-k s * ∈ {0, 1} n-k , t ∈ N * Output: x ∈ {0, 1} n , s.t. Hx = s ⋆ with HW(x) = t s ⋆ = s mod 2, and s = s + ϵ.
Remark that N -SDP in presence of noise is the SDP with additional information. Under certain conditions, we hope that, given (H, s * , t, s), we can find x, solution to the SDP. Also, when the noise is zero we face the classic N -SDP.

III. ISD-SCORE DECODER

A. Score decoder

The idea of assigning a score to each column was already used for the N -SDP in [START_REF] Colombier | Messagerecovery profiled side-channel attack on the classic McEliece cryptosystem[END_REF]. The goal is to distinguish columns of H in Supp(x) from columns outside Supp(x), where x is a solution. We shall begin by defining a particular efficient score decoder, introduced by [START_REF] Feige | Quantitative group testing and the rank of random matrices[END_REF]. For a better illustration of the nice features of the decoder in the presence of noise, we will express it in function of the noiseless decoder. As we shall see, this method allows not only to derive a particularly simple relation between those two, but also to deduce conditions on the tolerated noise level.

Definition 3. Let H ∈ {0, 1} (n-k)×n , s ∈ N n-k and t ∈ Z * be the input of N -SDP. Then define the score of a column: ∀i ∈ N * n ψ i (s) = n-k ℓ=1 (h ℓ,i s ℓ + (1 -h ℓ,i )(t -s ℓ ))
) . ψ can be seen as a correlation measure between the columns of H and the syndrome, and thus, it reveals those columns that contributed to the syndrome. For the N -SDP in the presence of noise we shall use ψ i ( s). The next result, rephrased from [START_REF] Feige | Quantitative group testing and the rank of random matrices[END_REF], expresses the capability of the score decoder to distinguish between columns in the support of the solution vector from columns which are outside the support.

Theorem 1. Let H ∈ {0, 1} (n-k)×n be a random matrix, with h j,i independent variables s.t. h j,i ∼ Ber( 1 2 ) and s ∈ N n-k such that ∃ x ∈ {0, 1} n with HW(x) = t satisfying Hx = s. Then ψ i (s) follows the distribution B((n -k)t, 1 2 ) , i ̸ ∈ Supp(x) B((n -k)(t -1), 1 2 ) + n -k , i ∈ Supp(x)
.

From Thm. 1, we deduce that for i ̸ ∈ Supp(x) we have E(ψ i (s)) = (n-k)t 2 , while for i ∈ Supp(x) we have

E(ψ i (s)) = (n-k)t 2 + n-k 2 .
This difference in the mean points out that ψ can be a distinguisher.In addition, the variance also differs, a fact that will be used in the tail bounds.

B. Score decoder in the presence of noise

Here, we assume that ϵ i are i.i.d. random variables, the noise does not depend on the distribution of the entries in H and the distribution D is symmetric.

Proposition 1 ([19]

). For j ∈ Z * n-k let ϵ j be i.i.d. discrete random variables following a symmetric distribution over the set Z -d,d , s.t. ϵ j and h i,j are independent. Then

Prob (ψ i ( s) -ψ i (s) = α) = Prob n-k j=1 ϵ j = α .
Remark 1. To keep ψ i ( s) -ψ i (s) as small as possible, it is not necessary that the ϵ i values are small. Indeed, the ϵ i values may be large, as long as n-k i=1 ϵ i is close to zero. For a centered binomial noise, we deduce the following.

Corollary 1. Let d ∈ N. If ϵ i ∼ -d + B(2d, 1 2 ) then ψ i ( s) is a random variable that follows the distribution B((n -k)(t + 2d), 1 2 ) -d(n -k) i ̸ ∈ Supp(x) B((n -k)(t -1 + 2d), 1 2 ) -(d -1)(n -k) i ∈ Supp(x)
822000 824000 826000 828000 830000 832000 834000

α Prob(ψi = α) n=24646, k=12323, t=134 i / ∈ Supp(x) d = 0 d = t/2 d = t i ∈ Supp(x) d = 0 d = t/2 d = t i ∈ Supp(x) d = 0 d = t/2 d = t (a)
(ψi = α) n=3488, k=2720, t=64 i / ∈ Supp(x) d = 0 d = t/2 d = t i ∈ Supp(x) d = 0 d = t/2 d = t i ∈ Supp(x) d = 0 d = t/2 d = t (b) Example parameters set of Classic McEliece Fig. 1: Distribution of ψ i for ϵ ∼ -d + B(2d, 1 2 ) Moreover, E(ψ i ( s)) = E(ψ i (s)) and V ar(ψ i ( s)) = V ar(ψ i (s)) + (n -k)d/2.
To maintain the capability to distinguish between positions inside the support and positions outside the support, the noise parameter d from B(2d, 1 2 ) should be restricted.

Corollary 2. Let ϵ i ∼ -d + B(2d, 1
2 ) and g(n, k, t) a positive unbounded function.

Then

Prob |ψ i ( s) -ψ i (s)| ≤ d(n-k)g(n,k,y) 2 ≥ 1 - O( 1 g(n,k,t) ). Moreover, for any d ≤ n-k 8g(n,k,t) , ψ( s) distinguishes positions in Supp(x) from positions outside Supp(x) w.h.p.
Fig. 1 shows the distribution of ψ i values for different levels of noise, ranging from d = 0, i.e. the noiseless setting, to a very high noise of B(2t, 1 2 ). Notice that the distinguishing capability is much higher for the BIKE parameters [START_REF] Aragon | BIKE[END_REF], as shown in Fig. 1a, than for the Classic McEliece parameters [START_REF] Albrecht | Classic McEliece[END_REF], as shown in Fig. 1b.

C. Combining ISD and score decoder

The idea in [START_REF] Colombier | Messagerecovery profiled side-channel attack on the classic McEliece cryptosystem[END_REF] was to boost the distinguishing capability of the score decoder with ISD-like techniques. To this end, the score decoder is integrated in the "permutation" step of the ISD method. Indeed, this method starts by performing a permutation on the columns of H that will hopefully rearrange the solution in a useful way. More precisely, in the first ISD algorithm, the Prange decoder [START_REF] Prange | The use of information sets in decoding cyclic codes[END_REF], a "good" permutation (Π) is one that satisfies Π -1 x = x 1 0 . Hence, the initial system becomes HΠΠ -1 x = s * . By Gaussian elimination on HΠ one can find an invertible matrix A s.t. AHΠ = I∥B . Hence, the system becomes I∥B x 1 0 = As * which yields x 1 = As * . In the original ISD methods, permutations are sampled randomly until a "good" one is obtained. Thanks to the extra-information provided by s or s, the function ψ allows to construct a permutation which by no means is random. Indeed, we have seen that ψ, by its nature, allows one to distinguish between positions in Supp(x) and positions outside. Hence, the underlying permutation, hopefully is a "good" permutation. As pointed out in [START_REF] Colombier | Messagerecovery profiled side-channel attack on the classic McEliece cryptosystem[END_REF], sorting the list of values ψ i ( s) in descending order is equivalent to generating a permutation Π. Algorithm 1 finds a solution to the N -SDP in the presence of noise as long as Π is "good" enough.

Algorithm 1 PRANGE SCORE DECODER(H, s, t)

1: Compute Π from the list ψ i ( s) 2: Compute A * , H * ← rref(HΠ) 3: if HW(A * s ⋆ ) = t then 4: return x = Π A * s ⋆ 0 n-r ▷ r = rank(A)
The procedure rref(HΠ), which stands for "reduced row echelon form", is equivalent to performing a partial Gaussian elimination over F 2 . Indeed, there is an

(n -k) × (n -k) non- singular matrix A * such that, A * HΠ = I r 0 n-k-r,r ∥ B *
where HΠ = [A ∥ B] with A a (n -k) × r matrix satisfying

A * A = I r 0 n-k-r,r
, and B * = A * B. In the case of a full rank matrix A we have A * A = I n-k . From the description of the algorithm above, the following result can be deduced.

Proposition 2 ([19]

). PRANGE SCORE DECODER outputs a valid solution as long as there exists at least one set

L ⊂ N * n \ Supp(x) with #L ≥ n -r such that min{ψ i ( s), i ∈ Supp(x)} > max{ψ i (x), i ∈ L}.
The overall time complexity of PRANGE SCORE DECODER is O((n -k) 3 ), since it is dominated by the partial Gaussian elimination, i.e. the computation of A * . Since the permutation Π might not move all the positions in Supp(x) in the first n -k positions, more powerful ISD methods may be used, e.g. Lee-Brickell [START_REF] Lee | An observation on the security of McEliece's public-key cryptosystem[END_REF], Stern [START_REF] Stern | A method for finding codewords of small weight[END_REF] or Dumer [START_REF] Dumer | Two decoding algorithms for linear codes[END_REF]. The idea is to allow a number of δ positions from Supp(x) outside the first n -k positions. This is equivalent to extending PRANGE SCORE DECODER so that it covers error vectors with a more general pattern. The Lee-Brickell score decoder, where δ positions are searched exhaustively, is thus proposed in [START_REF] Colombier | Messagerecovery profiled side-channel attack on the classic McEliece cryptosystem[END_REF] as a possible solution. When the Lee-Brickell variant is used and δ = O(1), k = O(n), the work factor of the resulting algorithm becomes polynomial in n. An algorithm allowing δ out of t positions from Supp(x) in the last n -r positions will be further called δ-ISD-score decoder or simply ISD-score decoder.

Proposition 3. The δ-ISD-score decoder outputs a solution as long as ∃J ⊂ N n of cardinality n -k and at most δ indices i ∈ Supp(x) with values ψ i ( s) < ψ j ( s) with j ∈ J.

IV. SUCCESS PROBABILITY OF THE ISD-SCORE DECODER

A. Main results

The following result gives a condition on the parameters for having a high probability of success for the ISD score decoder on the N -SDP in presence of noise.

Theorem 2. Let ϵ i ∼ -d + B(2d, 1 2 ). If the interval t+2d n-k W n-t n-k-t+δ+1 e √ 2 π 2 , 1 -t+2d-1 n-k W t δ+1
2e π 2 is non-empty, then w.h.p. the ISD-score decoder succeeds in finding a solution.

To give a more sensitive meaning of our result, we can approximate the value of the Lambert W function by W (m) = log m -log log m + O( log log m log m ) when m tends to infinity. Using only the first term we define

I β = 2(t+2d) n-k log n-t n-k-t+δ+1 , 1 -2(t+2d-1) n-k log t
δ+1 . Hence, we deduce the following result.

Proposition 4. Let m → ∞. If I β ̸ = ∅ then the probability of success of the ISD-score decoder is at least   1 - e 2π 1 log n-t n-k-t+δ+1     1 - e √ 2π 1 log t δ+1   .
The construction of the interval in Thm. 2 comes from the underlying proof, where two functions depending on a parameter β ∈ [0, 1] (Lb Supp(x) , Lb Supp(x) c ) are required to have co-domain [0, 1]. These two functions are

Lb Supp(x) c = 1 - e(n-t) √ 2πβ(n-k-t+δ+1) t+2d n-k e -(n-k)β 2 2(t+2d) , Lb Supp(x) = 1 - e.t π(1-β)(δ+1) t+2d-1 n-k e -(n-k)(1-β) 2
2(t+2d-1) . To fairly compare with state-of-the-art techniques such as the algorithm in [START_REF] Feige | Quantitative group testing and the rank of random matrices[END_REF], which is only valid for the noiseless scenario, we adapted the conditions from [START_REF] Feige | Quantitative group testing and the rank of random matrices[END_REF] to the noise model considered here. This gives two similar functions in β, namely 1) . In Fig. 2, we plot the modified functions from [START_REF] Feige | Quantitative group testing and the rank of random matrices[END_REF] (dashed lines) and Lb Supp(x) , Lb Supp(x) c (solid lines). In dark green and light green, the valid interval/region for the adapted functions from [START_REF] Feige | Quantitative group testing and the rank of random matrices[END_REF], and our functions, respectively, is represented. Notice that for all parameter sets and all noise levels considered here, our function offers a larger interval. Hence, this implies that for some sets of parameters, e.g., in Fig. 2d, the interval is empty w.r.t. conditions in [START_REF] Feige | Quantitative group testing and the rank of random matrices[END_REF], while w.r.t. our conditions the interval exists.

1-n-t n-k-t t+2d n-k e -(n-k)β 2 2(t+2d) , and
1-t t+2d-1 n-k e -(n-k)(1-β) 2 2(t+2d-

B. Information-theoretic bounds

1) Bounding the value of t: To see how large t must be the following estimate can be used. Fig. 2: Valid β interval from the bounds in [START_REF] Feige | Quantitative group testing and the rank of random matrices[END_REF] (dashed lines) and the proposed ones (solid lines)

Theorem 3 (Upper bound on t). Let k ≤ n -t + δ + 1 -(n - t)(δ + 1)/t and d = ct/2. Then I β ̸ = ∅ as long as we have t ≤ n -k 8(1 + c)W n-k 8(1+c)(δ+1) (1)
Moreover, when n → ∞, we have that t ≤ O n-k log(n-k) .
Using the first term approximation for the Lambert W function near infinity we have t ≤

d = ct 2 ≤ n -k 8 log t ⇒ t log t ≤ n -k 4c . (2)
This improves the constant term by t ≤ n -k 4cW ( n-k 4c )

.

Remark 2. Notice that we cannot decrease the non-constant factors lower than what we have achieved here. More exactly we need to have at least t log t δ+1 ≤ n-k 2(1+c) to possibly make the interval from Proposition 4 non-empty. Therefore, the minimum number of syndrome entries required for this algorithm to output a valid solution has to be at least 2(1+c)t log t/(δ+1). In the noiseless scenario, this becomes 2t log t. 2) Bounding the required ratio of syndrome entries: The existence of a value such that the ISD-score decoder succeeds in finding a solution using fewer syndrome entries could be deduced. It suffices to replace (n-k) with γ(n-k), where γ ∈ (0, 1] represents the percentage of syndrome entries required to achieve a high probability. This value can be deduced from Thm. 3. Given n -k, the maximum value of for which the success probability is close to 1 also determines the minimum number of required rows. More exactly, for a fixed value of t and n -k, we can compute γ(n -k), the value for which t satisfies 8t(1 + c) log t δ+1 = γ(n -k). By Thm. 3, with only γ(n -k) rows, one can recover a solution of weight at most t w.h.p. Formally, the following holds.

Corollary 3. Let d = ct/2 where c is a constant. The minimum quantity of information required by the ISD-score decoder to find a solution is 4(1 + c)t log t δ+1 . Moreover, in the noiseless scenario, the minimum quantity of information becomes 4t log t δ+1 . Consequently, the constant term pointed out in Remark 2 may be improved, however not lower than 2(1 + c) log t δ+1 .

V. EXPERIMENTAL RESULTS

For the simulation we have set the (n, k, t) parameters according to the specifications of the Classic McEliece [START_REF] Albrecht | Classic McEliece[END_REF] and BIKE [START_REF] Aragon | BIKE[END_REF]. We choose two security levels for both schemes to illustrate the performance of the ISD-score decoder.

Our experiments look at the number of syndrome entries required to bring t -δ ones in the first n -k positions, as dictated by the ISD method. Results are shown in Fig. 3. The green band is the [t -δ; t] interval for which, given the value of n, exhaustive search for the correct permutation is feasible, i.e. [t -3; t] for Classic McEliece and [t -1; t] for BIKE. Let us explain the meaning of the plots, when these are read horizontally. One way this could be read is as the weight of solutions retrieved by the ISD-Score decoder with probability 1. For example, when n = 8192 and noise level equal to t we can hope to retrieve solutions of weight at most 122 (which is smaller that the proposed parameters), while for the same length and noise smaller than t/2 we can retrieve any solution of weight at most 128 using the ISD-score decoder using δ = 3, or equivalently solutions of weight 125 using the Prange-score decoder. To summarize, except for the case n = 8192 with noise levels strictly greater than t/2, all the plots suggests that the ISD-score decoder is able to retrieve with high probability a valid solution of weight t in presence of noise.

We can also read the plots vertically. This gives us the ratio of syndrome entries required to find a solution of given weight with high probability. The abscissa of the points of intersection between the curves and the green stripe gives minimum percentage of syndrome entries required in the ISD-score decoder to successfully retrieve a valid solution of weight t. For the BIKE cryptosystem, the ratio of syndrome entries required to bring at least t -1 ones in the first n -k positions ranges is as low as 7.5 % in the noiseless setting. For the Classic McEliece cryptosystem, the ratio of syndrome entries required to bring at least t -3 ones in the first n -k positions ranges from 48 % to 62 % without noise. In both cases, moderate noise levels are well tolerated, and prove the efficiency of the decoder in these settings.

We have also computed the best theoretical lower bound we could hope for, i.e. the percentage of syndrome entries should be at least 2(1+c)t n-k log t δ+1 . When compared with the experimental results, we noticed that theoretical values are less than 10 % smaller than the experimental values.

VI. CONCLUSION

This article evaluated the efficiency of the score decoder for integer syndrome decoding in the presence of noise. We proved that, even in the presence of noise, this decoder is indeed able to successfully bring t -δ ones in the first n -k positions, as required by the ISD-based methods. We then experimentally validate this capability considering the parameter sets of two post-quantum cryptosystems, Classic McEliece and BIKE. Future works could investigate other types of noise or improve the efficiency of the decoder, bringing it closer to the information-theoretic bound.

  V.-F. Drȃgoi was supported by a grant of the Ministry of Research, Innovation and Digitization, CNCS/CCCDI-UEFISCDI, project number PN-III-P1-1.1-PD-2019-0285, within PNCDI III. B. Colombier was supported by the French National Research Agency in the framework of the "Investissements d'avenir" program "ANR-15-IDEX-02" and the LabEx PERSYVAL "ANR-11-LABX-0025-01".

  n = 24646, d = t, δ = 0 0.00 0.25 0.50 0.75 1.00 β n = 24646, d = t, δ = 3 0.00 0.25 0.50 0.75 1.00 β n = 3488, d = t, δ = 3

.

  Recall that a preliminary condition on d was determined, more exactly, d ≤ n-k 8g(n,k,t) , where g(n, k, t) is a positive unbounded function. Taking d = n-k 8 log(n-k) ≤ n-k 8 log log(n-k) validates the choice in the hypothesis d = ct/2, as per Thm. 3 t ≤ O n-k log(n-k) . Taking into account this condition and the hypothesis of Thm. 3, i.e. d = ct/2, we deduce the following upper bound on t

Fig. 3 :

 3 Fig. 3: Number of ones in the first n -k positions for some of the Classic McEliece and BIKE sets of parameters and different levels of a centered binomial noise.

  Example parameters set of BIKE

	Prob
	24000	24250	24500	24750	25000	25250	25500
				α


Martin David
email: martin.david@promes.cnrs.fr

Adrien Toutant
email: adrien.toutant@univ-perp.fr

Françoise Bataille
email: francoise.bataille@promes.cnrs.fr

Impact of asymmetrical heating on the uncertainty propagation of ow parameters on wall heat transfers in solar receivers

Keywords:

Impact of asymmetrical heating on the uncertainty propagation of flow parameters on wall heat transfers in solar receivers

Introduction

In applied engineering devices, there are many possible sources of uncertainty: measurement with nite instrument resolution, personal bias in reading analog instruments, inadequate knowledge of the eects of environmental conditions on the measurement [START_REF] Jcgm | Evaluation of measurement data Guide to the expression of uncertainty in measurement[END_REF]. The committed errors should be put into perspective with a sensitivity analysis. They may become very problematic when moving from principles to a functioning system. Indeed, while some devices are poorly affected by parameter variations, some are very sensitive to specic parameters. For example, in gas turbines the wall temperature variation greatly aects the lifetime of the components: it is generally accepted that a variation of 20 K in the metal reduces the life of the components by 50% [START_REF] Han | Gas Turbine Heat Transfer and Cooling Technology[END_REF]. Uncertainties may skew the understanding of the results of experiments or numerical simulations. For that reason, several authors propose methods to bring uncertainties out. Some studies dealing with uncertainties in the elds of uid me-chanics and heat transfers are addressed below. Oliver et al. [START_REF] Oliver | Estimating uncertainties in statistics computed from direct numerical simulation[END_REF] address two major sources of uncertainty in statistics computed from Direct Numerical Simulation (DNS): nite sampling error and discretization error. They propose a systematic and unied approach to estimate these two uncertainty sources when resolving the NavierStokes equations. A Bayesian extension of the standard Richardson extrapolation that accounts for both statistical uncertainty and prior information is formulated. Phillips and Roy [START_REF] Phillips | Richardson Extrapolation-Based Discretization Uncertainty Estimation for Computational Fluid Dynamics[END_REF] investigate the accuracy of various Richardson extrapolation-based discretization error and uncertainty estimators for problems in computational uid dynamics. The Richardson extrapolation consists in using two solutions on systematically rened grids to estimate the exact solution to partial dierential equations. This method is only applicable when the grids are suciently ne. Carneval et al. [START_REF] Carnevale | Uncertainty Quantication: A Stochastic Method for Heat Transfer Prediction Using LES[END_REF] propose a stochastic method to predict heat transfer using Large Eddy Simulation (LES). It consists in coupling a classical uncertainty quantication to LES in a duct with pin ns. The authors demonstrate that the uncertainties related to the unknown conditions, named aleatoric uncertainties, and those related to the physical model, named epistemic uncertainties, are strongly interconnected. Menberg et al. [START_REF] Menberg | Sensitivity analysis methods for building energy models: Comparing computational costs and extractable information[END_REF] investigate three methods for sensitivity analysis in relation to dynamic, high-order, non-linear behavior and the level of uncertainty in building energy models. Prediction of uncertainties in heat transfer coecient determination is a commonly studied topic. For instance, a large number of works addresses the uncertainty prop-agation when estimating the convection coecients in a wide spectrum of convective heat transfer processes with the Wilson plot method. Uhía et al. [START_REF] Uhía | Uncertainty analysis for experimental heat transfer data obtained by the Wilson plot method: Application to condensation on horizontal plain tubes[END_REF] detail the application of the Guide to the expression of Uncertainty in Measurement (GUM) [START_REF] Jcgm | Evaluation of measurement data Guide to the expression of uncertainty in measurement[END_REF] for calculating the uncertainty associated with experimental heat transfer data obtained thanks to the Wilson plot method. They illustrate their work by applying the GUM to the specic process of condensation of R-134a on a horizontal smooth tube. The [START_REF] Coleman | A numerical study of turbulent supersonic isothermal-wall channel ow[END_REF]: the uncertainty magnication factor (UMF) and the uncertainty percentage contribution (UPC). The eects of the temperature interference on the results obtained using the Wilson plot technique are also investigated by Wójs and Tietze [START_REF] Wójs | Eects of the temperature interference on the results obtained using the Wilson plot technique[END_REF]. The authors highlight the importance of using adequate experimental data to obtain reliable results.

The uncertainty propagation can be quantied with probabilistic and deterministic methods. The Monte Carlo approach rely on repeated random sampling. It is very commonly used in engineering [1016]. The methodology has many advantages: it is a general and powerful technique that can be applied to non-linear problems. However, the computational cost of Monte Carlo simulation can easily become prohibitive [START_REF] Cláudio | Efcient bounds for the Monte CarloNeumann solution of stochastic thermo-elasticity problems[END_REF]. Taler [START_REF] Taler | Assessment of the indirect measurement uncertainty[END_REF] details the calculation of the indirect measurement uncertainty using the rule formulated by Gauss for the uncertainty propagation. The non-linear least squares method used to estimate parameters and indirectly determined quantities are described and several examples of uncertainty determination of measured parameters involved in heat transfer correlations are presented. Functional expansion-based methods such as the arbitrary polynomial chaos expansion [START_REF] Oladyshkin | Data-driven uncertainty quantication using the arbitrary polynomial chaos expansion[END_REF], KarhunenLoève expansion [START_REF] Cho | KarhunenLoève expansion for multi-correlated stochastic processes[END_REF], and Neumann expansion [START_REF] Tomy | Neumann-Expansion-Based FEM for Uncertainty Quantication of Permittivity Variations[END_REF] can also be used for uncertainty quantication. The Guide to the expression of Uncertainty in Measurement (GUM) provides a local expansion-based method involving the Taylor expansions. It gives general rules for evaluating and expressing uncertainty in measurement that are intended to be applicable to a broad spectrum of measurements. It is considered as a general cross-disciplinary standard, applicable to all elds. Furthermore, it produces an analytical expression of the error. The GUM framework assumes the quasi-linearity and the quasinormality of the studied function. The linear approximation of the function has to be close to the function in the uncertainty range. The GUM method is particularly advantageous when dealing with reasonable input variability and outputs that do not express high nonlinearity. For these reasons, this method is selected to study the sensitivity of the wall heat ux to ow parameters. The GUM framework is detailed in [START_REF] Jcgm | Evaluation of measurement data Guide to the expression of uncertainty in measurement[END_REF]. Studying convective heat transfer, Håkansson [START_REF] Håkansson | An investigation of uncertainties in determining convective heat transfer during immersion frying using the general uncertainty management framework[END_REF] notices some incoherence in the literature when regarding heat transfer coecient values. Using the GUM, he points out that several methods used to determine the heat transfer coecient are very dependent on the accuracy of measurements. This could be responsible for the various results obtained in the literature.

Heat transfer correlations are widely used in engineering eld to estimate wall heat ux of complex devices such as automobile radiators [START_REF] Dittus | Heat transfer in automobile radiators of the tubular type[END_REF], heat exchangers [2426], and solar receivers of concentrated solar power tower [START_REF] David | Nu-merical development of heat transfer correlation in asymmetrically heated turbulent channel ow[END_REF]. Correlations allow the estimation of the heat transfer within, generally, 10% to 20% of error [2732]. This accuracy is usually acceptable for pre-dimensioning. However, it is necessary to consider the uncertainty of measurements and their propagation to estimate an error range associated with the heat ux prediction. Correlation may also be useful to quantify the heat transfer sensitivity to parameters. Table 1 gives the major results of some studies investigating uncertainty propagation.

To the author's knowledge, there is no study addressing wall heat ux sensitivity in the operating conditions of solar receivers. In this paper, a correlation developed for both symmetrically and asymmetrically Table 1 Major results of some literature papers dealing with uncertainty propagation.

Authors Topic Major results

Driscoll and Landrum [START_REF] Driscoll | Uncertainty Analysis on Heat Transfer Correlations for RP-1 Fuel in Copper Tubing[END_REF] Uncertainty on heat transfer correlations for fuel in copper tubing. They quantify the inuence of uncertainties on the engine design.

The overall uncertainty on the Nusselt number can reach 36%. The magnitude of the uncertainty values and their impact on engine design parameters highlights the importance of mitigating the Nusselt number uncertainties.

Scariot et al. [START_REF] Vinicius | On the sensitivity to convective heat transfer correlation uncertainties in supercritical uids[END_REF] Inuence of the uncertainty of measurements on the uid temperature and enthalpy in carbon dioxide tube ow using heat transfer correlations.

Results shows that the uncertainty propagation is signicantly inuenced by the local conditions. They state that the diculty to predict experimental data from correlations is due to the observed uncertainty amplication. In the worst case, the uncertainties on the enthalpy range from -7% to +15%, considering that the correlation has a 10% uncertainty under such conditions. These uncertainties are signicantly increased if the accuracy of the correlation decreases. Dimassi and Dehamni [START_REF] Dimassi | Experimental heat ux analysis of a solar wall design in Tunisia[END_REF] Experimental thermal analysis of a Trombe wall Uncertainties of thermal heat uxes can reach 4.8% despite small uncertainties on the temperature, velocity, radiation coecient, and convection coecient measurements. Sciacchitano and Wieneke [START_REF] Sciacchitano | PIV uncertainty propagation[END_REF] PIV uncertainty propagation

The uncertainty of the vorticity is estimated typically within 510% accuracy, time-averaged velocities are accurate within 5%. The Reynolds stresses are more dicult to estimate and the PIV gives a prediction within 10%. Paudel and Hostikka [START_REF] Paudel | Propagation of Model Uncertainty in the Stochastic Simulations of a Compartment Fire[END_REF] Stochastic simulations of a compartment re with Fire Dynamic Simulation.

The results show that the prediction uncertainty for both gas phase and solid phase temperature is accurate within 10%.

Zhao et al. [START_REF] Zhao | Uncertainty and sensitivity analysis of ow parameters for transition models on hypersonic ows[END_REF] Uncertainty and sensitivity analysis of ow parameters for transition models on hypersonic ows.

Uncertainties on heat ux and skin friction coecient distribution, as well as uncertainties on the Stanton number, and the onset and length of the transition zone are investigated. The uncertainty results quantitatively verify that the transition zone is greatly sensitive to changes in ow parameters. The transition length and onset are estimated within 10% of uncertainty.

heated turbulent channel ow is used to quantify the propagation of the uncertainties of the ow parameters on the wall heat uxes. Firstly, the used correlation is presented in Section 2. The sensitivity of the heat uxes to ow parameters is analyzed under symmetric heating conditions and in the working conditions of gas-pressurized solar receivers of concentrated solar power tower (Section 3). Then, in Section 4, the results obtained by the GUM applied to the correlation are compared to the direct computation of the wall heat uxes with the same variations of the input parameters in both heating conditions. The entire applicable range of the correlation in terms of bulk-to-cold wall temperature is investigated.

Heat transfer correlation for turbulent channel ow

The correlation proposed by David et al. [START_REF] David | Nu-merical development of heat transfer correlation in asymmetrically heated turbulent channel ow[END_REF] aims to estimate the heat transfer in the working conditions of gas-pressurized solar receivers. This technology is still in the research stage. Numerous geometries are investigated in the literature including tubes [START_REF] Wang | Coupled optical and thermal performance of a n-like molten salt receiver for the next-generation solar power tower[END_REF], channels with vortex generators [START_REF] Capeillère | Thermomechanical behavior of a plate ceramic solar receiver irradiated by concentrated sunlight[END_REF][START_REF] Colleoni | Simulation of an innovative internal design of a plate solar receiver: Comparison between RANS and LES results[END_REF], and thin channels [START_REF] Li | Micro-channel pressurized-air solar receiver based on compact heat exchanger concept[END_REF][START_REF] Daguenet-Frick | Numerical investigation of a ceramic high-temperature pressurized-air solar receiver[END_REF]. In the present study, we focus on this last type of gas-pressurized solar receiver. A bi-periodic channel is used to model the geometry. The correlation has been established thanks to 70 Thermal-Large Eddy Simulations, constituting a consequent and reliable database. In those simulations, the Navier-Stokes equations are solved under the low Mach number approximation. The coupling between velocity and temperature is considered. The thermal dilatation is taken into account. The density is linked to the temperature variations thanks to the ideal gas-law. The gravity force is not taken into account since its impact is negligible in the working conditions. Indeed, the Richardson number is about 10 -5 . The correlation is obtained for fully developed ows. The simulations are performed in a bi-periodical channel. To lower the uid temperature, a source term is introduced in the energy equation. It allows to maintain a constant bulk temperature. Hence, this temperature corresponds to the average of the uid temperature along the wall-normal direction. The small turbulent scales are not solved in LES. Their eects on bigger turbulent structures are considered thanks to the Anisotropic-Minimum-Dissipation (AMD) model. This model showed a good agreement with DNS in similar conditions [4446]

T w T b -0.9 T w T w -T b 1.4(1-Tw Tm ) T b Tw , (1)
with

T m = (T h + T c )/2.
A term accounting for asymmetric heating conditions is included in the equation to reproduce the heat transfers at both walls taking into account the respective eects of one on this other. This term involves ow parameters in the exponent. The singularity of the Nusselt number, observed when the bulk temperature (dened as the average uid temperature) tends towards the cold wall temperature and explained by Nield in [START_REF] Nield | Forced convection in a parallel plate channel with asymmetric heating[END_REF], is reproduced thanks to the dierence of temperature at the denominator of the asymmetric group. This term, accounting for asymmetric condition, is equal to 1 in the case of symmetric heating conditions leading to the correlation presented below:

Nu sym w = 0.024Re 0.8 b Pr 0.4 b T w T b -0.9 . (2)
The proposed correlation is studied in the commonly encountered working conditions of heat exchangers and solar receivers. The validity domain of the correlation in terms of Reynolds number and temperature ranges is given in Table 2. The wall temperatures vary from 293 K to 1300 K. The uid temperature ranges from 342 K to 1237 K, Prandtl number is between 0.76 and 3.18, and heat uxes vary from 4 kW/m 2 to 578 kW/m 2 .

Table 2 Applicable domain of the correlation.

Symmetric heating

Asymmetric heating

12000 < Re b < 177000 10600 < Re b < 145000 0.47 < T b /Tw < 0.99 1.1 < T h /Tc < 2.0 0.63 < T b /Tc < 0.95 0.44 < T b /T h < 0.85
An overview of the point distribution is given in this paragraph. The values are given indierently for both types of heating. The Reynolds number ranges from 10600 to 177000. 25 dierent values of Reynolds number are covered with a mean step of 6400. The Prandt number is between 0.76 and 3.18. The values taken by the Prandtl number are dependent of the temperatures. Most of the points are around 3.1, 2.6, 1, and 0.8. The hot wall temperature is between 586 K and 1300 K. The covered values are: 586 K, 700 K, 810 K, 900 K, 1100 K, and 1300 K. The cold wall temperature is between 293 K and 1300 K. It takes the following values: 293 K, 500 K, 700 K, 810 K, 900 K, 1100 K, and 1300 K. The bulk temperature is between 461 K and 1236 K. The range is homogeneously covered. There are several bulk temperature points in every 50 K interval.

The Nusselt numbers obtained with the correlation proposed by David et al. [START_REF] David | Nu-merical development of heat transfer correlation in asymmetrically heated turbulent channel ow[END_REF] are plotted against the Nusselt numbers obtained with the numerical simulations in Figure 1. The relative error on the Nusselt number is obtained as follows:

Nu = Nu cor -Nu sim Nu sim . (3)
Black dots stand for the Nusselt number obtained under symmetric heating conditions. Red dots, respectively blue dots, account for the Nusselt obtained at the hot wall, respectively cold wall, under asymmetric heating conditions. The Nusselt number range is between 20 and 680. The results show that all the points are within the 10% error range. A detailed analysis of the data shows that more than three-quarters of the results are in the error bound 5%. The determination coecient is 0.993. The mean error is 0.29% and the standard deviation is 4.1%.

In the following, the wall heat uxes are computed using the Nusselt numbers obtained with the correlation thanks to equation presented below:

φ w = λ w (T w -T b )Nu w L . (4)
Figure 2 aims to give an overview of the wall heat ux behavior depending on the ratio between bulk temperature and the average of both wall temperatures in both heating conditions. It permits linking the heat ux uncertainties presented in Section 4 to the value of the reference heat ux. The Reynolds number and the wall temperatures used to obtain Figure 2 are those referenced in Table 3 for the symmetric heating case and those referenced in 700 K and 1100 K. Hence, this gure is valid for a xed Reynolds number of 60 000 and xed wall temperatures of 1100 K under symmetric heating condition or 900 K and 1300 K under asymmetric heating conditions. The wall heat uxes are normalized with the following equation:

φ + = φ w (T b /T m ) φ sym w, max , (5)
where φ sym w, max corresponds to the maximum wall heat ux obtained under symmetric heating and φ sym w, max = 198 kW/m 2 . This maximum wall heat ux obtained under symmetric heating is reached for a Reynolds number of 60 000, a Prandtl number of 0.87, a bulk temperature of 700 K, and wall temperature of 1100 K. The ratio T b /T m into brackets is a functional expression. The wall heat uxes are decreasing with the increase of the temperature ratio. For the asymmetric case, the cold wall heat ux is rapidly diminishing and became equal to zero when the bulk and cold wall temperatures are the same. On the hot side, the normalized heat ux is slowly decreasing and reaches 0.45 for a ratio between bulk temperature and the average of both wall temperatures of 1. In the symmetric heating conditions, the wall heat ux is moderately diminishing.

Wall heat ux sensitivity

Studying the sensitivity of wall heat ux with a correlation is an interesting approach to highlight the inuence of each parameter. It gives the measurement accuracy necessary to provide a reliable prediction of the wall heat uxes. In the applicable domain of the correlation, the estimated wall heat ux sensitivity reects the physic behavior. A high temperature sensitivity calculated with the correlation means that the physical wall heat ux is greatly impacted by this parameter. In Subsections 3.1 and 3.2, the wall heat ux is computed thanks to the direct application of the correlation. A routine is used to compute the reference wall heat ux and the altered wall heat ux thanks to the correlation. The altered wall heat ux is calculated by altering a single ow parameter from -10% to 10% of its reference value by step of 0.5%. For each step, the ratio between the reference and the altered wall heat ux is computed and reported in Figures 3 and5 Firstly, the sensitivity of the wall heat uxes is studied in symmetric heating condition. These conditions are summarized in Table 3.

Table 3

Studied conditions in the symmetric heating case.

Re b Pr b T h [K] Tc [K] T b [K]
60 000 0.87 1100 1100 700

Figure 3 exposes the error on the wall heat uxes depending on the error committed on various ow parameters in the symmetric heating conditions presented in Table 3. The propagation of the error committed on the measurements of the wall temperature, the bulk temperature, the Reynolds number, and the Prandtl number are studied. The error on the wall heat ux is computed as follows:

Err φ = φ (Y alt ) -φ (Y ref ) φ (Y ref ) , (6)
where Y alt = Y ref + x% with x ranging between -10% and 10%. The errors on ow parameters are dened in the same way that the error on the wall heat ux and described by equation 3.1. All the temperatures are expressed in degree Kelvin. The results show that uncertainties on wall temperature are amplied. They induce an important error on the wall heat ux. The bulk temperature and Reynolds number estimations are less impacting but remain consequent. The wall heat ux error is mitigated when compared to the error on the Prandtl number. Indeed, the wall heat ux error is in the 5% error range. The ranking of the parameters in terms of inuence is independent of the uncertainty of measurement. Figure 4 presents the slope of the error propagation for uncertainties relative to the wall and bulk temperatures. The curves observed in Figure 3 are approximated by straight lines thanks to the generalized least-squares method. Four wall temperatures are investigated. The wall temperature increases from 700 K to 1300 K. In each case, the bulk temperature is 200 K below the wall temperature. The investigated cases are listed in Table 4 The error propagations concerning the Reynolds number and the Prandtl number are not affected by the thermal conditions that is why they are not plotted in this gure. The results show that the David et al.: Preprint submitted to Elsevier 4. The bulk Reynolds number is 60 000 for all the tested cases. slope of the error propagation increases linearly with the wall temperature. In the studied cases, the slope of the error propagation corresponding to the wall temperature is higher than the slope of the error propagation of the bulk temperature.

Table 4

List of the tested cases in Figure 4. The sensitivity of the wall heat uxes is studied in the typical working conditions of gas-pressurized solar receivers [START_REF] Capeillère | Thermomechanical behavior of a plate ceramic solar receiver irradiated by concentrated sunlight[END_REF]. Asymmetric heating is due to the fact that one wall is irradiated by the concentrated sunlight and the opposite wall is insulated on the exterior face of the solar receiver (the one which is in contact with ambient air). The ow temperature is increasing as the uid moves forward. These conditions are summarized in Table 5. In the following, the insulated wall is denoted as the "cold wall" for practical reasons. Nonetheless, in this study and in classical working conditions of solar receiver, for a given axial distance from the inlet, the mean uid temperature is lower than the insulated wall temperature. Indeed, the "cold wall" is indirectly heated by the concentrated sunlight thanks to the radiations of the hot wall.

Tw [K] T b [K] T b /
Table 5 Studied conditions in the asymmetric heating case.

Re b Pr b T h [K] Tc [K] T b [K]
60 000 0.87 1300 900 700

The impact of the error, committed on various ow parameters, on the wall heat uxes is plotted in Figure 5. The results are obtained in the working conditions discussed in Table 5. The bulk-to-cold wall temperature ratio is 0.78, reproducing the working conditions observed in the middle of the solar receiver [START_REF] Capeillère | Thermomechanical behavior of a plate ceramic solar receiver irradiated by concentrated sunlight[END_REF]. As expected, the results show that the uncertainties on the cold wall temperature (respectively hot wall temperature), induce the biggest uncertainties on the cold wall heat ux (respectively hot wall heat ux). The cold wall heat ux is highly sensitive to the bulk temperature. The hot wall is less sensitive to the uid temperature. These dierent behaviors are due to the asymmetric heating of the uid. Since the bulk temperature is closer to the cold wall temperature than the hot wall temperature, the uncertainties are bigger when estimating the cold wall heat ux but they are associated with smaller heat transfers. The opposite wall temperatures also have an impact on the wall heat uxes, even if it is much smaller than the eect of the concerned wall temperature. The propagation of the uncertainties on the bulk Reynolds number is similar to the propagation of the uncertainties on the hot wall temperature when studying the cold wall heat ux. The error committed on the Prandtl number has low impact on the heat ux prediction. For the four last discussed parameters and regarding the impact of the cold wall temperature on the hot wall heat ux, the propagation of the error on the heat ux is mitigated compared to the error on these parameters. For instance, an overestimation of the Reynolds number of 10% leads to an error of 8%. Notice that the propagation of bulk temperature uncertainties is not symmetric. An overestimation of 10% of the bulk wall temperature induces 20% of error on the cold heat ux, whereas an under-estimation of 10% of this temperature conducts to an error of 13% on the heat ux. The ranking of the parameters in terms of inuence is independent of the uncertainty of measurement.

In Figure 6, the curves observed in Figure 5 5.

proximated by straight lines thanks to the generalized least-squares method. The slope of the heat ux error is computed for each ow parameter. The coecient of determination is superior to 0.999 for all the parameters except the bulk temperature, for which it is 0.979 in the most unfavorable case. Three bulk temperatures, corresponding to three locations in the solar receiver, are investigated. The left graph displays the slope of the error propagation on the hot wall heat ux and the right graph gives information on the cold wall heat ux. The slope of the error propagation of the wall and bulk temperatures increases with the bulk temperature. The errors of the Reynolds number and the Prandtl number are independent of the bulk temperature. As observed in Figure 5, the slope of the errors is bigger on the cold wall heat ux than on the hot wall heat ux. Furthermore, their increase soars when the bulk temperature becomes close to the cold wall temperature. So, the measurement of the ow parameter should be adapted to the location in the solar receiver in order to keep a constant uncertainty on the wall heat uxes. In Figure 7, four couples of wall temperatures are investigated. The hot wall temperature increases from 700 K to 1300 K. In each case, the cold temperature is 200 K below the hot wall temperature. The bulk temperature is chosen so that it is 250 K below the mean of hot and cold wall temperatures, see Table 6. The results show that the cold wall heat ux is more sensitive than the hot wall. The slope of the error propagation increases linearly with the temperatures as observed in Figure 4. The slope inclination of the error propagation of the bulk temperature steepen faster with the increase of the wall temperature than the one of the wall temperatures. This is particularly salient at the cold wall since for T h = 1300 K and T c = 1100 K the slope of the error propagation concerning the bulk temperature is almost as steep as the one concerning the wall temperature.

Table 6

List of the tested cases in Figure 7.

T h [K] Tc [K] T b [K] T b /

Propagation of temperature uncertainties

In this section, the propagation of the temperature uncertainties on the wall heat uxes is analyzed with two methods. The computation of the propagation of uncertainties using the GUM method is compared to the results obtained by the direct computation of heat uxes with altered temperature values. The uncertainty associated with the thermal conductivity has almost no inuence on the results. It is then, neglected to simplify the equation. The uncertainties on the input variables are assumed to be uncorrelated. In the following, we consider the uncertainty of measurements on one parameter at a time and we only investigate the uncertainties relative to temperature.

Symmetric heating conditions

In the symmetric heating case, the Taylor series expansion of the simplied heat transfer correlation proposed by David et al. [START_REF] David | Nu-merical development of heat transfer correlation in asymmetrically heated turbulent channel ow[END_REF] is computed. The expression of the uncertainty propagation is given by:

∆φ sym φ sym = A 2 sym + B 2 sym + C 2 sym + D 2 sym , (7)
with

A sym = ∆Re b 0.8 Re b , B sym = ∆Pr b 0.4 Pr b , C sym = ∆T b 0.9 T b - 1 T w -T b , D sym = ∆T w - 0.9 T w + 1 T w -T b .
In Sections 4.1.1, and 4.1.2, the studied conditions are those described in Table 3, except for the bulk temperature which varies in order to cover the entire range of the correlation in terms of bulk-to-cold wall temperature ratio. The bulk Reynolds number is 60 000 for all the tested cases and the wall temperatures are 1300 K and 900 K.

Figure 7: Slope of the error propagation in absolute value for wall and bulk temperatures. Four couples of wall temperatures are investigated, see Table 6. The left, respectively right, graph concerns the hot, respectively cold, wall heat ux. The bulk Reynolds number is 60 000 for all the tested cases.

in Figure 8. The top-left corner of the left graph is colored in black because, in this region, the altered cold wall temperature induces a bulk-to-altered wall temperature superior to 0.95 and is, then, out of the applicable domain of the correlation (even if the plotted bulk-toreference wall temperature is inferior to 0.95). The wall heat uxes, obtained by the direct computation of heat transfer correlation with the altered input wall temperature, are compared to the results obtained with the GUM. The reference wall heat ux errors are presented on the left side whereas the estimation provided by the GUM procedure is displayed on the right side. The results show the wall heat ux is strongly dependent on the wall temperature error of measurement. The shape of the lines indicates that the bigger the bulk temperature is, the more inuential the error of measurement is. An under-estimation of the wall temperature leads to slightly higher uncertainty on the wall heat ux than an overestimation. The model provides an accurate estimation of the error on the entire validity domain of the correlation. Nevertheless, it is worth noting that the lines of isoerror predicted by the GUM are not linear. The error committed by the model increases with the inaccuracies of the measurement since it assumes the linearity of the studied function. The bulk temperature is also aected to the uncertainties of measurement. Figure 9 shows the uncertainties on the wall ux depending on the bulk-to-cold wall temperature ratio and the error of the measurements of the bulk temperature. The left graph exposes a strong asymmetric distribution of the error. Indeed, at a bulkto-wall temperature ratio of 0.70, for the same value of uncertainty, an overestimation of 10% of the bulk temperature induces an error of 16% of the wall heat ux. An under-estimation in the same conditions leads to an error of 12%. This is due to the increase of the sensitivity of the wall heat ux to bulk temperature when the temperature dierence between the wall and the uid is low. On the right graph, the estimation of the uncertainties obtained with the Taylor expansion, does not capture this asymmetric behavior of the error propagation. However, the results obtained with the GUM procedure are satisfying since the obtained error is almost equal to the average of the under-estimation and overestimation. For small bulk-to-wall temperature ratios, i.e. near the entrance of the solar receiver, the wall heat ux is only slightly aected by the uncertainties David et al.: Preprint submitted to Elsevier Figure 8: Uncertainties on the wall ux depending on the bulk-to-cold wall temperature ratio and the error of the measurements of the wall temperatures in the case of symmetric heating conditions. The left graph shows the reference results, the right graph exposes the estimation produced by the GUM. The lines indicate the isovalues of error 2%, 4%, 8%, 12%, 16%, 20%, 30%, 40%, 60%, 80% and 100%. on the bulk temperature.

Asymmetric heating conditions

Applying the Taylor series expansions to the heat transfer correlation of David et al. [START_REF] David | Nu-merical development of heat transfer correlation in asymmetrically heated turbulent channel ow[END_REF], the GUM provides the analytical expression of the uncertainty propagation exposed in the following equation:

∆φ asy φ asy = A 2 asy + B 2 asy + C 2 asy + D 2 asy + E 2 asy , (8)
with

A asy = ∆Re b 0.8 Re b , B asy = ∆Pr b 0.4 Pr b , C asy = ∆T b 0.9 T b + 1.4 T w α (γ + log(β)) - 1 T w -T b , D asy = ∆T w - 0.9 T w +∆T w -1.4α T b T 2 w γ + log(β) 1 + 1 δ + α δ + 1 T w -T b , E asy = ∆T w 2.8 T b (T w + T w ) 2 log(β) .
where α = (T w -T w ) / (T w + T w ), β = T w /(T w -T b ), γ = T b /(T w -T b ), δ = (T w -T w )/T w . The logarithm used here is the natural logarithm.

Note that, when the wall temperatures are close, the terms associated with the uncertainties on the bulk and wall temperatures tend towards the ones obtained in the symmetric heating case. Indeed, (T w -T w ) → 0 induces α → 0 and δ → 0.

In Sections 4.2.1, and 4.2.2, the studied conditions are those described in Table 5, except for the bulk temperature which varies in order to cover the entire range of the correlation in terms of bulk-to-cold wall temperature ratio. The uncertainties on the wall uxes depending on the bulk-to-cold wall temperature ratio and the error of the measurements of the wall temperatures are exposed in Figure 10. On the hot side, the maximum error is obtained for an under-estimation of the hot wall temperature of 10% and a bulk-to-wall temperature ratio of 0.95. It reaches an error of 26%. The results obtained for an under-estimation of the wall temperature are similar to those obtained for an overestimation. The isoerror lines show that the wall heat ux is not very aected by the bulk-to-wall temperature ratio, especially for small errors of temperature measurement. The model is slightly under-estimating the results traducing the non-linearity of the studied function. The uncertainty propagation is bigger at the cold wall than at the hot wall. Furthermore, the results are more sen-David et al.: Preprint submitted to Elsevier Figure 9: Uncertainties on the wall ux depending on the bulk-to-cold wall temperature ratio and the error of the measurements of the bulk temperature in the case of symmetric heating conditions. The left graph shows the reference results, the right graph exposes the estimation produced by the GUM. The lines indicate the isovalues of error 2%, 4%, 8%, 12%, 16%, 20%, 30%, 40%, 60%, 80% and 100%.

sitive to the bulk-to-wall temperature ratio. The uncertainty distribution is similar for under-estimation and overestimation of the wall temperature, as observed on the hot side. As for Figure 8, the results out of the applicable domain of the correlation, resulting from an under-estimation of the cold wall temperature, are masked thanks to a black triangle. It corresponds to a bulk-to-altered cold wall temperature superior to 0.95. In the case of asymmetric heating, the wall heat ux is aected by the opposite wall temperature. Figure 11 depicts the propagation of the wall temperature uncertainties on the opposed wall heat ux, i.e. the inuence of the cold, respectively hot, wall temperature on the hot, respectively cold, wall heat ux (the black corner on the top-left graph masks the results out of the framework of the heat transfer correlation). The uncertainties on the hot wall heat ux are low since they remain below 5%. The model under-estimates the uncertainty propagation. The bottom graphs show that the cold wall heat ux is more impacted by the hot wall temperature than the hot wall heat ux by the cold wall temperature. Indeed, the errors reach 18% for the most unfavorable case. The Taylor series expansion signicantly under-estimates the uncertainties when the bulk-to-cold wall temperature ratio is high (end of the solar receiver). This may be explained by the relatively strong non-linear dependence to the opposite wall temperature of the term accounting for asymmetric heating in the correlation. The accuracy of measurement of the bulk temperature is also impacting the wall heat ux estimation. The wall heat ux uncertainties are plotted as a function of the bulk-to-wall temperature ratio and the uncertainty of measurement of the bulk temperature in Figure 12. The results indicate that the hot wall heat ux is substantially less impacted by altered measurement of the bulk temperature than the cold wall heat ux. The GUM procedure provides a quite satisfying estimation of the uncertainties despite the non-normal distribution of the uncertainties on the wall heat uxes. At the cold wall, an overestimation of the bulk temperature may result in a bulk-to-altered cold wall temperature ratio out of the application domain of the correlation (see the top-right corner of the bottom-left graph). For low bulk-to-cold wall temperature ratio, the uncertainty of measurement of the bulk temperature has little eect on the wall heat ux when compared to the uncertainties on the measurement of the wall (see Figure 10). However, the results are very sensitive to the bulk-to-wall temperature ratio, i.e. very sensitive to the location in the solar receiver: when this ratio is small, the uncertainty of measurement of the bulk temperature is not very impacting the wall heat ux. At the cold wall, when the bulk temperature is close to the cold wall temperature, the heat ux uncertainties become very high even for uncertainties of measurements David et al.: Preprint submitted to Elsevier Figure 10: Uncertainties on the wall uxes depending on the bulk-to-cold wall temperature ratio and the error of the measurements of the wall temperatures in the case of asymmetric heating conditions. The left graphs show the reference results, the right graphs expose the estimations produced by the GUM. The results regarding the hot, respectively cold, wall heat ux are displayed on the two top, respectively bottom, graphs. The lines indicate the isovalues of error 2%, 4%, 8%, 12%, 16%, 20%, 30%, 40%, 60%, 80% and 100%. below 5%. Note that these high uncertainties should be put into perspective with the relatively small wall heat ux associated.

Comparison of the uncertainties in both types of heating

The results presented in Subsections 4.1 and 4.2 show that, contrarily to what one might think, the biggest uncertainties are obtained in the case of symmetric heating. Reducing the wall temperature dierence induces a more homogeneous uncertainty propagation on the wall heat uxes but the propagation is amplied when compared to the case of asymmetric heating. Indeed, the term accounting for asymmetric heating, (T w /(T w -T b ))

1.4(1-(Tw/Tm))T b /Tw , balances the eect of the term (T w /T b ) -0.9 . The result is a mitigation of the wall heat ux dependence to wall and bulk temperature estimation under asymmetrical heating conditions.

Conclusion

In this study, the correlation proposed by David et al. [START_REF] David | Nu-merical development of heat transfer correlation in asymmetrically heated turbulent channel ow[END_REF] for asymmetrically heated turbulent channel ow has been used to investigate the sensitivity to ow parameters of the wall heat uxes and the propagation of uncertainties depending on the location in the solar receiver.

The results obtained following the Guide to the expression of Uncertainty in Measurement, which used Taylor series expansion to provide an analytical expression of the uncertainty propagation, have been compared to the results obtained with the direct computation of the heat ux with altered ow parameters. The results presented in this study show that a low bulkto-wall temperature ratio mitigates the inuence of the bulk and wall temperatures on the wall heat uxes. In the studied conditions, the impact of the bulk temperature on the wall heat uxes is more inuenced by the working condition than the wall temperatures. Progressing in the solar receiver, the uid temperature becomes closer to the wall temperatures. For relatively high values of the bulk-to-cold wall temperature ratio, David et al.: Preprint submitted to Elsevier Figure 11: Uncertainties on the wall uxes depending on the bulk-to-cold wall temperature ratio and the error of the measurements of the opposed wall temperatures in the case of asymmetric heating conditions. The left graphs show the reference results, the right graphs expose the estimations produced by the GUM. The results regarding the hot, respectively cold, wall heat ux are displayed on the two top, respectively bottom, graphs. The lines indicate the isovalues of error 2%, 4%, 8%, 12%, 16%, 20%, 30%, 40%, 60%, 80% and 100%. the uncertainties on the bulk temperature become more inuential than the uncertainties on the wall temperatures and are highly impacting the wall heat ux estimation. This means that it is possible to adapt the accuracy of measurement devices according to their location in the solar receiver.

A precise analysis shows that the asymmetric term induces a highly non-linear dependence of the wall heat ux to the bulk, wall, and opposite wall temperatures. In the case of inaccuracies in the measurement of the bulk temperature, the uncertainties on the wall heat ux are strongly asymmetrically distributed with regards to the 0% uncertainty line.

The expression of the heat transfer correlation used for asymmetric heating conditions involves an additional term to reproduce the heat transfers at both walls taking into account the respective eects of one on this other. Contrarily to what one might think, this new term tends to mitigate the wall heat ux dependence to bulk temperature estimation. The result is a lower wall heat ux sensitivity to wall and bulk temperatures in the case of asymmetric heating than in the case of symmetric heating.

The method described in the GUM gives very satisfying results in the studied symmetric heating conditions. Even though the eects of the opposite wall temperature on the wall heat ux are underestimated, the method produces quite accurate estimations in the asymmetric heating case.

Acknowledgements

This work was granted access to the HPC resources of CINES under the allocation 2020-A0082A05099 made by GENCI. The authors acknowledge PRACE for awarding them access to Joliot-Curie at GENCI@CEA, France (PRACE Project : 2020225398). The authors gratefully acknowledge the CEA for the development of the TRUST platform. The authors gratefully acknowledge the Occitania region for their funding of the thesis grant. 12: Uncertainties on the wall uxes depending on the bulk-to-cold wall temperature ratio and the error of the measurements of the bulk temperature in the case of asymmetric heating conditions. The left graphs show the reference results, the right graphs expose the estimations produced by the GUM. The results regarding the hot, respectively cold, wall heat ux are displayed on the two top, respectively bottom, graphs. The lines indicate the isovalues of error 2%, 4%, 8%, 12%, 16%, 20%, 30%, 40%, 60%, 80% and 100%.

CRediT authorship contribution statement

Martin David: Data acquisition, Writing. Adrien Toutant: Work guiding, Reviewing. Françoise Bataille: Work guiding, Reviewing.

  . The proposed correlation is given David et al.: Preprint submitted to Elsevier by:

Figure 1 :

 1 Figure 1: Relative error on the Nusselt number obtained with the heat transfer correlation as function of the Nusselt number obtained by the simulation.

Figure 2 :

 2 Figure 2: Normalized wall heat uxes as function of the ratio between bulk temperature and the average of both wall temperatures. The wall temperatures are 1300 K and 900 K in the case of asymmetric heating. They are of 1100 K in the case of symmetric heating. The bulk temperature and the Reynolds number are respectively 700 K and 60 000.

  .

3. 1 .

 1 Symmetric heating conditions

Figure 3 :

 3 Figure 3: Error on the wall heat uxes depending on the error committed on various ow parameters for symmetric heating conditions. The results are obtained with the conditions listed in Table3.

Figure 4 :

 4 Figure 4: Slope of the error propagation in absolute value for wall and bulk temperatures. Four wall temperatures are investigated, see Table4. The bulk Reynolds number is 60 000 for all the tested cases.

  are ap-David et al.: Preprint submitted to Elsevier

Figure 5 :

 5 Figure 5: Error on the wall heat uxes depending on the error committed on various ow parameters depending on the bulkto-cold wall temperature ratio. The results are obtained with the conditions listed in Table5.

4. 1 . 1 .

 11 Uncertainties on the measurements of the wall temperature depending on the bulk-to-wall temperature ratio The uncertainties on the wall ux depending on the bulk-to-cold wall temperature ratio and the error of the measurements of the wall temperature are plotted David et al.: Preprint submitted to Elsevier

Figure 6 :

 6 Figure 6: Slope of the error propagation in absolute value for the ve ow parameters. Three bulk temperatures are investigated.The bulk Reynolds number is 60 000 for all the tested cases and the wall temperatures are 1300 K and 900 K.

4. 1 . 2 .

 12 Uncertainties on the measurements of the bulk temperature depending on the bulk-to-wall temperature ratio

4. 2 . 1 .

 21 Uncertainties on the measurements of the wall temperatures depending on the location in the solar receiver

4. 2 . 2 .

 22 Uncertainties on the measurements of the bulk temperature depending on the location in the solar receiver

  David et al.: Preprint submitted to Elsevier

Figure

  Figure12: Uncertainties on the wall uxes depending on the bulk-to-cold wall temperature ratio and the error of the measurements of the bulk temperature in the case of asymmetric heating conditions. The left graphs show the reference results, the right graphs expose the estimations produced by the GUM. The results regarding the hot, respectively cold, wall heat ux are displayed on the two top, respectively bottom, graphs. The lines indicate the isovalues of error 2%, 4%, 8%, 12%, 16%, 20%, 30%, 40%, 60%, 80% and 100%.

  impact of the uncertainty of

	Nomenclature
	Err	relative error
	L	hydraulic diameter [m]
	Nu	Nusselt number based on hydraulic diameter
	Pr	Prandtl number
	Re	Reynolds number based on hydraulic diameter
	Ri	Richardson number based on hydraulic diame-
		ter
	T m	mean wall temperature [K]
	T	temperature [K]
	Y	ow parameter
	Greek symbols
	∆	uncertainty
	λ	thermal conductivity [W/(K.m)]
	φ	heat ux [kW/m 2 ]
	Subscripts and superscripts
	alt	altered
	asy	asymmetric heating conditions
	b	bulk
	cor	refering to the correlation
	c	cold wall
	h	hot wall
	max maximum
	m	mean
	ref	reference
	sim	refering to the simulation
	sym	symmetric heating conditions
	w	wall
	w	opposite wall
	measurements is discussed on the basis of two normal-
	ized coecients proposed by Coleman and Steele

Table 5

 5

for the asymmetric heating case. The bulk temperature varies between David et al.: Preprint submitted to Elsevier

project funded by the Occitania region.