Nathanaël Cheriere
email: nathanael.cheriere@irisa.fr

Matthieu Dorier
email: mdorier@anl.gov

Gabriel Antoniu
email: gabriel.antoniu@inria.fr

Lower Bounds for the Duration of Decommission Operations with Relaxed Fault Tolerance in Replication-based Distributed Storage Systems

Keywords: Elastic Storage, Malleable Storage, Distributed Storage Systems, Decommission, Fault Tolerance

Efficient resource utilization is a major concern for large-scale computer platforms. One method used to lower energy consumption and operational cost is to reduce the amount of idle resources. This can be achieved by using malleability, namely, the possibility for resource managers to dynamically increase or decrease the amount of resources of jobs while they are running. Decommissioning (removing from the cluster) the idle nodes as soon as possible allows the resource manager to quickly reallocate the nodes to other jobs. Challenges appear when such nodes host part of a distributed storage system. Indeed, distributed storage systems need to transfer large amounts of data during decommission in order to ensure data availability and a constant level of fault tolerance. In this paper, we explore the possibility of relaxing the level of fault tolerance during the decommission in order to reduce the amount of data transfers needed before nodes are released, and thus return nodes to the resource manager faster. We quantify theoretically how much time and resources are saved by such a a fast decommission strategy compared with a standard decommission. We establish lower bounds for the duration of the different phases of a fast decommission. We use the lower bounds to estimate when the fast decommission would be useful to reduce the usage of core-hours. We implement a prototype of fast decommission mechanism. Using the prototype, we validate the lower bounds on the duration of the operation and confirm the findings about the core-hour usage.

Bornes Inférieures pour les Temps de Décommission dans les Systèmes de Stockage Distribués basés sur la Réplication lorsque la Tolérance aux Pannes est Relachée

Résumé : Dans ce rapport, nous modélisons la durée de la décommission de noeuds d'un système de stockage distribué basé sur la réplication lorsque la contrainte de tolérance aux pannes est relachée. Une borne inférieure pour chaque phase de l'opération est obtenue. Une implémentation du mécanisme dans Pufferbench permet de valider les résultats théoriques.

Cette méthode de décommission est par nature peu sure, et nous montrons que des gains ne sont obtenus que dans le cas d'un système limité par la bande passante du réseau.

Mots-clés : Stockage élastique, Stockage malléable, Système de stockage distribué, Décommission, Tolérance aux pannes

Introduction

Improving the resource utilization of a platform is a challenge for its administrators. It directly links to better cost effectiveness and higher productivity. One approach used to improve resource utilization is to reduce the number of idle nodes. This can be achieved by multiple ways, such as careful scheduling, precise prediction of the required resources, or job malleability.

Job malleability is the possibility for jobs to have their resources resized at run time by the resource manager. Thus, unused resources can be returned to the resource manager and either shut down or reassigned to other jobs. Applications also benefit from malleability; unused resources are released, thus reducing the energy consumption and costs attributed to that application at the same time as the core-hour usage is decreased. Moreover, the capability to dynamically adjust the number of resources available to a job allows the job to match the workloads in order to have constant quality of service, even if the workload is highly volatile. Many solutions have been proposed to add malleability to platforms and applications. Resource managers such as KOALA-F [START_REF] Kuzmanovska | KOALA-F: A Resource Manager for Scheduling Frameworks in Clusters[END_REF] and Morpheus [START_REF] Jyothi | Morpheus: Towards Automated SLOs for Enterprise Clusters[END_REF], are able to manage malleable jobs, and various frameworks [START_REF] Vadhiyar | SRS: A Framework for Developing Malleable and Migratable Parallel Applications For Distributed Systems[END_REF], [START_REF] Kale | A Malleable-Job System for Timeshared Parallel Machines[END_REF], [START_REF] Buisson | A Framework for Dynamic Adaptation of Parallel Components[END_REF] enable the design of malleable applications.

Previous works focused on the malleability of computing resources, however; and no distributed storage systems have been designed to be malleable, even though many of them include both commission (adding nodes) and decommission (removing nodes) operations for maintenance purposes. Indeed, adding nodes to a distributed storage system or removing nodes from it involves many data transfers in order to balance the load. These data transfers are assumed to be too slow for practical use. The implemented rescaling operations (commission and decommission) are thus rightfully designed to limit their impact on application performance as much as possible and are not optimized for speed.

Having a truly malleable distributed storage system with fast rescaling operations would enable many features for applications that need to deploy a distributed storage system colocated with computation resources. In particular, applications could benefit from fast data accesses to a co-deployed distributed storage system and benefit from malleability.

• Reduction of the core-hours cost: When a storage node is not needed by the application anymore, it can be given back to the resource manager instead of being idle.

• Ideal scalability: The distributed storage system can expand and contract with the malleable application using it, ensuring consistent storage system performance.

• Data isolation: The data manipulated by an application can be located solely on the computing nodes used by the application and does not need to be stored on a shared storage cluster. This is consistent with the recent trends in HPC systems, which increasingly include local storage on computing resources.

• Better auto-tuning: An autotuner can test various storage configurations without having to restart and repopulate the distributed storage system each time.

Inria

With a fast decommission, the platform can claim resources back from applications quickly. This action allows the resource managers to mitigate unpredictable events, such as the submission of high-priority jobs or a sudden increase in the workload of some jobs, by quickly allocating new resources to the task.

In our previous work [START_REF] Cheriere | How Fast Can One Scale Down a Distributed File System?[END_REF], we modeled node decommission in replication-based distributed storage systems and provided a theoretical lower bound for the duration of this operation. Having a lower bound for this operation has multiple uses.

• The lower bound can be used to evaluate the performance of decommission mechanisms when designing a distributed storage system.

• They can also help the resource scheduler make scheduling decisions. With it, the resource scheduler can anticipate the duration of the decommission of nodes in order to have nodes available when they are needed.

• With the lower bound, a user can quickly estimate whether to use malleability on a given platform.

• The study of this operation highlights inherent bottlenecks that need to be mitigated for efficient implementations.

In our previous work, we assumed that the level of fault tolerance of the storage system should not be weakened during the decommission; if the system is configured to keep k replicas of an object at all times, the number of replicas of that object during the decommission should never be strictly less than k. It also means that the decommissioned nodes can be given back to the resource manager only at the end of the decommission operation, since all objects need to be sufficiently replicated on the remaining nodes. This is an opportunity for optimization. As long as no data is lost, decommissioned nodes can be returned to the resource manager sooner. We denote this strategy as fast decommission. It is composed of three phases. During the data-safekeeping phase, the system ensures that at least one replica of each object is present on the remaining nodes, transferring objects if needed. Then, during the node release phase, the decommissioned nodes are given back to the resource manager. Missing replicas are recreated during the system stabilization phase.

With this strategy, the decommissioned nodes are effectively made available for other jobs faster than they are with standard decommission. However, fast decommission comes at the cost of weakened fault tolerance during the system stabilization phase: not all objects have their required number of replicas until the stabilization finishes.

The idea of trading fault tolerance for performance is not new. Our contribution in this paper is to make a step forward in understanding better this trade-off. To this purpose, we provide theoretical lower bounds for the two main phases of fast decommission: the data-safekeeping and the system stabilization (the node release is assumed to be instantaneous) phases. We also implement fast decommission in Pufferbench [START_REF]gitlab.inria.fr/Pufferbench/Pufferbench[END_REF] [8], a benchmark designed to study the commission and decommission mechanisms of distributed storage systems in practice.

The lower bounds highlight interesting results. As expected, the nodes decommissioned with the fast decommission mechanism are released in a fraction of the time needed by the standard decommission. For distributed storage systems, however, the phase of system stabilization that comes after the release of the decommissioned nodes lengthen the duration of the whole operation. When the bottleneck of the operation is the network, the whole operation lasts as long as the standard decommission. In the case of a storage bottleneck, the duration of the operation is longer than that with the standard decommission: fewer resources are available for the stabilization phase, and thus the operation is longer.

The experimental results obtained with Pufferbench confirm the highlights obtained from the lower bounds. In particular, the decommission times obtained are on average within 10% of the lower bounds when the storage is the bottleneck and are on average within 40% of the lower bounds when the network is the bottleneck.

We also compared the number of core-hours needed for the fast decommission and the standard decommission mechanisms. In the case of a network bottleneck, using fast decommission always leads to a reduction in core-hour usage. The gain in corehours increases with the number of decommissioned nodes. In the case of a storage bottleneck, however, no gain in the usage of core-hours is realized unless many nodes are decommissioned at once. Overall, fast decommission can be an interesting trade-off for the designer of distributed storage systems when the network is the bottleneck: the consumption of corehours is reduced compared with that of standard decommission while the duration stays the same for the distributed storage system. Moreover, depending on the network bandwidth, the stabilization phase, during which the fault tolerance is weakened, can be short. However, the trade-off is less relevant in the case of a storage bottleneck: the whole operation is longer than the duration of the standard decommission, and there is no gain in core-hours unless many nodes are decommissioned at once. Fast decommission may even be detrimental depending on the bandwidth of the storage devices. If the storage is slow, such as a hard drive, the fault tolerance will be weakened for the duration of the long stabilization phase, increasing the probability of losing data. This paper is organized as follows. Related work is presented in Section 2. Hypotheses detailed in Section 3 are used to build the lower bounds in Section 4. In Section 5, we compare the experimental run times of an implementation of fast decommission with the lower bounds. We discuss the results in Section 6 and present our conclusions in Section 7.

Related Works

Many distributed and parallel file systems, such as Ceph [START_REF] Weil | Ceph: A Scalable, High-Performance Distributed File System[END_REF] and HDFS [START_REF] Shvachko | The Hadoop Distributed File System[END_REF], include a decommission mechanism. However, it is available primarily for maintenance purposes. Hence it is understandably optimized to reduce the performance impact of the decommission on other jobs. It is not meant to be fast. Inria Some distributed storage systems enable some form of malleability: some of the machines of the cluster on which they are deployed can be shut down to save energy. Rabbit [START_REF] Amur | Robust and Flexible Power-Proportional Storage[END_REF], Sierra [START_REF] Thereska | Sierra: Practical Power-Proportionality for Data center Storage[END_REF], and SpringFS [START_REF] Lianghong | SpringFS: Bridging Agility and Performance in Elastic Distributed Storage[END_REF] are examples of such a system. They have two main limitations. First, the shutdown nodes still store data and may be turned back on at any time; thus they cannot be given back to the resource manager for use by another job. Second, the nodes that can be shut down are determined by the distributed storage system and not by the resource manager.

Some resource managers are able to manage malleable distributed storage systems. The SCADS Director [START_REF] Trushkowsky | The SCADS Director: Scaling a Distributed Storage System under Stringent Performance Requirements[END_REF], for example, is a resource manager designed to ensure service-level objectives. It can add or remove storage nodes and move the data, as well as the number of replicas needed for each file. The SCADS Director adds malleability to the SCADS file system [START_REF] Armbrust | SCADS: Scale-Independent Storage for Social Computing Applications[END_REF]. Its authors focus their evaluation on the ability of the system to maintain its service-level objective, however, and not on the performance of the rescaling operations themselves.

Lim, Babu, and Chase [START_REF] Lim | Automated Control for Elastic Storage[END_REF] propose a resource manager based on HDFS. This resource manager chooses when to add and remove nodes and the parameters of the rebalancing operations. However, it simply uses HDFS as is and does not focus on efficiency. Both Trushkowsky et al. [START_REF] Trushkowsky | The SCADS Director: Scaling a Distributed Storage System under Stringent Performance Requirements[END_REF] and Lim et al. [START_REF] Lim | Automated Control for Elastic Storage[END_REF] focus on ways to leverage malleability rather that on improving it. Therefore their work is complementary to this paper.

In a previous work [START_REF] Cheriere | How Fast Can One Scale Down a Distributed File System?[END_REF], we provided lower bounds for the time of a standard decommission in replication-based storage systems. This standard decommission required that the requested number of replicas for each object be maintained throughout the decommission operation. In this paper, we relax this constraint. We accept that the number of replicas of the stored objects drops below its normal value during the decommission. Of course, we still require that no data be lost and that the replication factor be brought back to its normal value at the end of the operation. This method of decommission trades better resource utilization for temporarily higher vulnerability to faults. Indeed, a storage node can be given back to the resource manager as soon as at least one replica of each of its data objects exists on remaining nodes. Until new replicas are created, however, a crash may lead to data loss. While this trade-off is not new, this paper aims to model it precisely.

Hypotheses

In this section, we start by stating what the targeted storage systems are. We then define the fast decommission operation and the hypotheses used in order to compute the lower bounds of its duration.

Targeted distributed storage systems

Many similarities exist between the fast decommission mechanism and the crash of a node followed by the recovery of the system. In both cases, some storage nodes become unavailable, and some data has to be recreated on the remaining nodes.

While several methods exist to recreate the missing data, in this paper we consider only the distributed storage systems that use data replication. This crash recovery mechanism is popular: it is used in HDFS [START_REF] Shvachko | The Hadoop Distributed File System[END_REF], Rabbit [START_REF] Amur | Robust and Flexible Power-Proportional Storage[END_REF], and Sierra [START_REF] Thereska | Sierra: Practical Power-Proportionality for Data center Storage[END_REF], among others. It has the advantages of being simple and highly parallel: most of the remaining nodes share some replicas with the crashed nodes and thus can quickly restore the replication level to its initial value. Moreover, little CPU power is required for this technique.

We do not consider full-node replication, in which sets of nodes host exactly the replicas of the same objects, since the recovery mechanism is fundamentally different. Erasure coding, used in systems such as Pelican [START_REF] Balakrishnan | Pelican: A Building Block for Exascale Cold Data Storage[END_REF], is not considered either. With erasure coding, CPU power is needed to recreate missing data. Thus a mathematical model of the CPU would be required in order to compute a lower bound on the duration of such operations.

Another major recovery mechanism, lineage, also requires CPU power. Its principles greatly differ from those of data replication. When a node crashes, the data that is lost is recreated by executing again the jobs that generated it. Modeling the lower bounds of such an operation would require knowledge of the jobs that generate data, however, and we therefore do not consider this recovery mechanism in this paper. Lineage is used in Tachyon [START_REF] Li | Reliable, Memory Speed Storage for Cluster Computing Frameworks[END_REF] and is tightly coupled to Spark [START_REF] Zaharia | Spark: Cluster Computing with Working Sets[END_REF] in order to regenerate the data.

Despite the similarities between fault tolerance mechanisms and fast decommission, the fault tolerance mechanism cannot be used directly to decommission nodes. The fault tolerance mechanism of a distributed storage system has an upper limit on the number of nodes that can crash simultaneously. The fast decommission mechanism is an intentional operation. Hence, even if more nodes are decommissioned than then number of replicas, this decommission mechanism will prevent the loss of data by first making sure that at least one replica of each object exists in the remaining nodes.

Problem definition

We consider a replication-based distributed storage system deployed on a cluster of N nodes. Each node initially hosts an amount of data D. Each of the objects stored in the system is replicated r times. The resource manager requests the decommission of x arbitrarily chosen nodes.

A fast decommission is done in three main steps.

1. Data-safekeeping: During the data-safekeeping phase, the objects that are stored only on the leaving nodes have a replica transferred to remaining nodes to ensure that no data is lost during the operation.

Nodes release:

The leaving nodes are given back to the resource manager. They no longer participate in the distributed storage.

System stabilization:

The missing replicas are recreated by the remaining nodes to recreate the target replication degree.

We define the time to availability t avail. as the lower bound of the time needed to execute the first step of the decommission. The stabilization time t stab. is the lower bound on the duration of the whole process; t stab. is obtained assuming that the leaving nodes participated only in the data-safekeeping phase and were all removed from the cluster at time t avail. . Inria

Hypotheses on the cluster infrastructure

We make three hypotheses concerning the hardware of the cluster to provide comprehensive lower bounds.

Hypothesis 1: Homogeneous cluster

All nodes have the same characteristics, in particular the same network throughput (S Net ) and storage write and read throughputs (S W rite , S Read ).

Hypothesis 2: Ideal network

The network is full duplex, data can be sent and received with a throughput of S Net at any time, and there is no interference.

Hypothesis 3: Ideal storage system

The writing speed is not higher than the reading speed (S W rite ≤ S Read ). The storage device must share its I/O time between reads and writes and thus cannot sustain simultaneous reads and writes at maximum speed (during any span of time t, if a time t Read ≤ t is spent reading, the storage cannot write for more than tt Read , and conversely).

Hypothesis 3 holds for most modern storage devices. Moreover, we assume that all resources are available to the decommission and that either the network or the storage is the bottleneck.

Hypotheses on the initial data distribution

The initial data distribution is important for the performance of the decommission. Thus we make some hypotheses in this respect.

Hypothesis 4: Even data distribution

All N nodes initially host the same amount of data D.

Hypothesis 5: Uniform data replication Each object stored in the storage system is replicated on r ≥ 2 distinct nodes. The probability of finding a given object on a node is uniform and independent.

Hypothesis 6: Uniform data distribution

The probability of finding a given object on all the nodes in a set of r distinct nodes is uniform and independent of the chosen set.

These hypotheses reflect the ideals of the load-balancing policies implemented in many state-of-the-art distributed file systems such as HDFS [START_REF] Shvachko | The Hadoop Distributed File System[END_REF] and RAMCloud [START_REF] Ousterhout | The Case for RAMClouds: Scalable High-Performance Storage Entirely in DRAM[END_REF]. We assume that the data is initially in an ideal load-balanced state.

Formalizing the problem

At the end of the decommission operation, the data distribution on the remaining nodes should satisfy the following objectives.

Objective 1: No data loss

No data can be lost during the decommission.

Objective 2: Maintenance of an even data distribution All nodes host the same amount of data D .

Objective 3: Maintenance of a uniform data distribution All sets of r distinct nodes host the same amount of exclusive data, independently of the choice of the r nodes.

These objectives ensure that the load balancing is ideal at the end of the decommission.

All the listed hypotheses and objectives are common with standard decommission. The difference between both decommission strategies comes from Objective 4.

Objective 4: Maintenance of the replication factor

Each object stored on the storage system is replicated on r distinct nodes.

The fault tolerance requirements are relaxed during the execution of the decommission. Instead of ensuring the replication factor of the objects at any time during decommission, the replication factor is required to be at its initial level only at the end of the decommission. This relaxation is the main difference between the hypotheses of this work and the ones for the lower bounds of the standard decommission established in our previous work [START_REF] Cheriere | How Fast Can One Scale Down a Distributed File System?[END_REF]. The purpose of this paper is to quantify theoretically how many resources are saved by relaxing this constraint and how fast such a decommission process can be, compared with a standard decommission operation.

Lower Bound

In this section, we establish the lower bounds for the duration of the data-safekeeping and stabilization phases (the node release phase is assumed to be instantaneous).

Data to move

Because data should not be lost during a decommission (Objective 1), a minimum amount of data has to be moved from the leaving nodes to the remaining ones. The objects to move are the ones that have all their replicas on the leaving nodes and that would have been lost had these nodes all been removed at the same time. Thus, we first compute the probability for an object to have exactly i replicas on the leaving nodes. From it, we deduce the minimum amount of data to transfer to remaining nodes D avail. .

p i =    0 if i > r, ( r i )( N-r x-i ) ( N x )
for i ≤ r.

(Def. 1)

D avail. = NDp r /r if x ≥ r 0 in other cases. (Def. 2) D stab.
is the amount of data to move in order to recreate all replicas from the leaving nodes onto the remaining nodes. It is the amount of data that was initially present on the leaving nodes and includes D avail. .

D stab. = xD = ∑ r i=1 ip i ND r (Def. 3) Inria 4.

Case 1: Bottleneck at network level

In this section we assume that the network is the bottleneck for the data transfers required by the data-safekeeping and stabilization phases. The network is the bottleneck if it limits the storage in any situation (S Net < S Read ).

Time to availability

During the data-safekeeping phase, only the leaving nodes send data to the remaining ones. As defined by Hypothesis 2, the network is ideal without interference, and each node can send and receive data with a bandwidth S Net at the same time. Two possible bottlenecks may appear, however: either sending data from the leaving nodes or receiving the data on the remaining nodes. Thus, the time to availability t avail. depends on the number of nodes leaving the cluster x, the amount of data to move D avail. , and the bandwidth of the network S Net . We express t avail. as follows.

t avail. = p r ND rxS Net if x ≤ N/2 p r ND r(N-x)S Net

Stabilization time

When the leaving nodes sending data are the bottleneck of the data-safekeeping phase, the remaining nodes may not have their network bandwidth saturated by the reception of the data. Thus, data exchanges needed to stabilize the storage can start before the end of the preservation without slowing the preservation itself. We denote as t overlap the time available per remaining node during the data-safekeeping phase to exchange data for the stabilization.

t overlap = 0 if x > N/2 (N-2x)p r ND rx(N-x)S Net

Demonstration:

In case the data sent by the leaving nodes cannot saturate the network of the remaining nodes, the remaining nodes can exchange data before the data-safekeeping phase is over.

Let S Recv be throughput at which the remaining nodes can receive the data.

t overlap = t avail. -D avail. /S Recv = p r ND rxS Net - p r ND r(N -x)S Net = (N -2x)p r ND rx(N -x)S Net

QED

From this, we obtain the time needed to stabilize the distributed storage system t stab. .

t stab. = xD (N-x)S Net .
(Prop. 3)

Demonstration:

Let S Recv be throughput at which the remaining nodes can receive the data. S Recv is also the rate at which data can be exchanged during the stabilization phase as nodes can send and receive data at the same time.

t

Observations

The lower bound for the whole operation (t stab. ) is exactly the lower bound for the standard decommission established in our previous work [START_REF] Cheriere | How Fast Can One Scale Down a Distributed File System?[END_REF] (in which the replication factor is maintained). Thus, one can relax the fault tolerance to release nodes faster (the fewer the' core-hours used,the better the overall platform utilization) without any difference in the length of the operation compared with standard decommission.

We also infer that keeping the leaving nodes after they have transferred the data needed for the fast decommission does not speed the duration of the operation: in all cases, receiving data on the remaining nodes is the bottleneck. It would, however, have an impact on the ability of the cluster to service read requests. The network is completely saturated by the stabilization, servicing any request would slow it.

In Figure 1, we observe the differences between a standard decommission and a fast decommission; with the fast decommission, the nodes are released in a fraction of the time needed to decommission nodes while maintaining the replication factor. Decommissioned nodes (out of a 20-nodes cluster) Time to decommission (s) q q q q q q q q q q q q q q q Network bottleneck

Standard decommission Data safekeeping Stabilization

Case 2: Bottleneck at storage level

When the storage is the bottleneck, the situation is different because of the limitations of the storage devices (Hypothesis 3): data cannot be read and written at the same time. The storage is a bottleneck if it cannot read and write all the data received and sent on the network during the same period of time ( S Read S W rite S Read +S W rite < S Net ).

Time to availability

The limitations on the storage, however, do not have any impact on the time to availability since leaving nodes only have to read data, and remaining nodes only have to write it. Thus, the time to availability depends on the data to move during the datasafekeeping phase D avail. and the reading and writing speeds of the storage devices S Read and S W rite .

t avail. = NDp r rxS Read if x ≤ NS W rite
S Read +S W rite NDp r r(N-x)S W rite in other cases.

(Prop. 4)

Demonstration:

In the case of a reading bottleneck,

t avail. = D avail. xS Read
In case of a writing bottleneck,

t avail. = D avail. (N -x)S W rite A reading bottleneck occurs if D avail. xS Read > D avail. (N -x)S W rite (N -x)S W rite > xS Read x < NS W rite S Read + S W rite QED 4.3.

Stabilization time

Similar to the first case, when the bottleneck of the operation is reading data from the leaving nodes, the storage of the remaining nodes is not saturated: these nodes can read or write more data without slowing down the data-safekeeping process. Thus, the remaining nodes can exchange data to start the stabilization before the data-safekeeping finishes and without impact on the time to availability.

Each remaining node has some time t overlap to exchange data with other remaining nodes in the data-safekeeping phase.

Demonstration:

The available time to exchange data during the data-safekeeping phase is the time to availability nodes minus the time needed to write the data onto storage.

In the case of a reading bottleneck:

t overlap = t avail. -D avail. /(S W rite * (N -x)) = NS W rite -x(S W rite + S Read ) x(N -x)S Read S W rite .

QED

We determine S e f f , the effective writing speed on the cluster when the remaining nodes exchange data among themselves. S e f f is not simply the product of the number of remaining nodes by their individual writing speed. Indeed, to exchange data among themselves, remaining nodes also must read data.

Let R be the ratio of data read to data written during the stabilization. This ratio is not equal to 1 in most cases because of the possibility of buffering data. When the data is read, it can be buffered in memory and thus sent to multiple destinations with only one read operation. The buffering relies on the bandwidth of the memory being a few times higher than the bandwidth of the storage device. Thus, if the storage is in memory and is the bottleneck, the ratio R is equal to 1 because the buffering is inefficient.

Inria R =    1
in case of in-memory storage, ∑ r-1 i=1 p i (r-1)p r +∑ r-1 i=1 ip i in other cases.

(Prop. 6)

Demonstration:

The data that must be read is a replica from each of the objects that will be lost when the leaving nodes leave except for the ones that have been transferred by the leaving nodes (when objects have all their replicas on leaving nodes); those replicas can be buffered upon reception from leaving nodes.

The data that must be written is all the data that was on the leaving nodes except for the data that was written during the data-safekeeping phase: one replica for each of the objects that were entirely stored on leaving nodes.

QED

With the ratio R we deduce S e f f . Storage devices have their operation time divided between reads and writes (they cannot read and write at the same time). The cluster must also avoid imbalances between the data read and written. If too much data is read compared with the data written, the amount of memory needed to store it before writing it will increase. On the contrary, if too little data is read, the system will slow since storage devices will have to wait for data to write. Thus, the ratio of data read on data written during any given duration should be equal to R. From this we deduce S e f f . S e f f = (N-x)S W rite S Read S Read +RS W rite (Prop. 7)

Demonstration:

During a time t, data is read and written with a ratio R.

Let t = t Read + t W rite . R = t Read (N -x)S Read t W rite (N -x)S W rite t Read = t RS W rite S Read + RS W rite
S ( e f f ) is the amount of data written during t divided by t.

S e f f = t W rite (N -x)S W rite t = (N -x)S W rite S Read S Read + RS W rite

QED

From the speed at which data is effectively exchanged on the cluster during the stabilization (Prop. 7), the amount of data to write (Def. 2 and 3), the duration of the overlap of data-safekeeping and stabilization (Prop. 5), and the time to availability (Prop. 4), we deduce the stabilization time t stab. .

t stab. = D N-x R S Read + 1 S W rite x -N p r r + NDp r r(N-x)Sw (Prop. 8)
= D N -x R S Read + 1 S W rite (x - N p r r ) + NDp r r(N -x)Sw QED 4.3.

Observations

In the case of a storage bottleneck, the data-safekeeping phase and thus the effective decommission of the leaving nodes can be completed a lot faster than with the standard decommission. It is done, however, at the cost of a long stabilization phase: the leaving nodes were reading data in the case of a standard decommission, reading that must be done by remaining nodes in the case of a fast decommission. This situation implies that, contrary to the case of a network bottleneck, the longer the leaving nodes stay in the cluster, the faster the stabilization is. The stabilization cannot be faster than the standard decommission since the standard decommission is the extreme case in which the leaving nodes stay until the end of the stabilization.

During a fast decommission, the storage devices are fully saturated. Thus, servicing any request can only slow the decommission.

In Figure 2, we show the lower bounds for the duration of a standard decommission and of the data-safekeeping and stabilization phases of a fast decommission. Decommissioned nodes are available in a fraction of the time needed for a standard decommission. However, it comes at the cost of having the distributed storage system unable to operate for a longer time.

Core-hour usage

In Figure 3 we compare the usage of core-hours for the standard decommission and the fast decommission in the case of a network bottleneck. Since the numbers are based on the lower bounds for the duration of the operations, the figure represents the lower bound for the core-hour consumption. We observe that using the fast decommission mechanism always reduces the core-hours consumption when the network is the bottleneck. Moreover, the gain increases greatly with the number of decommissioned nodes, and more than 50% of the core-hours consumption can be saved when many nodes are decommissioned at once.

In Figure 4 we compare the core-hours needed for the decommission in the case of a storage bottleneck. When few nodes are decommissioned at once (less than 8 in this case), there are no benefits in using the fast decommission compared with the standard decommission. When many nodes are decommissioned simultaneously, however, the core-hours consumption can be reduced by more than 50%. Decommissioned nodes (out of a 20-nodes cluster) Time to decommission (s) q q q q q q q q q q q q q q q Storage bottleneck

Standard decommission Data safekeeping Stabilization

Experimental Validation

In this section, we use Pufferbench to study the fast decommission mechanism in practice.

Implementing fast decommission in Pufferbench

Pufferbench [START_REF]gitlab.inria.fr/Pufferbench/Pufferbench[END_REF] is a modular benchmark designed to evaluate how fast one can rescale a distributed storage system on a given infrastructure. We implemented the fast decommission mechanism in Pufferbench. Pufferbench computes and recreates on the hardware all the I/O that are requiered for a rescaling operation. It emulates a distributed storage system for the duration of a rescaling operation. The leaving nodes transfer to the remaining ones only the data that is exclusively on them with high priority. The remaining nodes have to recreate the missing replicas; however, the operation is done with a lower priority. The leaving nodes can leave the cluster only after the data is on the storage device; they cannot leave if the data is only buffered in memory.

We also made sure that the implementation of the fast decommission matches the hypotheses presented in Section 3 in order to be able to safely compare the lower bounds and the practical results.

Experimental setup

All measurements were done on the French Grid'5000 [START_REF] Balouek | Adding Virtualization Capabilities to the Grid'5000 Testbed[END_REF] experimental testbed. Experiments were done on the grisou cluster in Nancy. The cluster is composed of 51 nodes: Dell PowerEdge R630 with Intel Xeon E5-2630 v3 Haswell 2.40 GHz (2 CPUs/node, 8 cores/CPU), 128 GiB of RAM, and two 558 GiB HDD. The nodes are all connected with a 10 Gb/s Ethernet network to a common Cisco Nexus 9508. Pufferbench emulates a DSS that initially hosts 50 GiB per node. Ten measurements per configuration of Pufferbench were done. The results are represented by using box plots showing the minimum, the first quartile, the median, the third quartile, and the maximum duration of the phases.

In order to create a network bottleneck, the data was stored in memory because it has a bandwidth (6 GiB/s reading, 3 GiB/s writing) significantly higher than the network's bandwidth. Similarly, in order to generate a storage bottleneck, the data was stored on the drives of the nodes (207 MiB/s reading, 199 MiB/s writing).

For each configuration (bottleneck and number of decommissioned nodes), ten measures of decommission times were done for fast decommission and for standard decommission.

Decommission when the network is the bottleneck

Figure 5 shows the duration of the data-safekeeping and stabilization phases when the network is the bottleneck. The duration of the standard decommission has been added for comparison.

Inria

Compared with the lower bounds, the time to availability is on average 37% slower, while the stabilization time is 32% slower. For the same configurations, the standard decommission is, on average, 22% slower than its lower bound.

When few nodes are decommissioned (less than 6), the difference in duration between the two strategies is negligible. When many nodes are decommissioned at once, however, there is a large difference between the standard decommission and the time to stabilization. For example, the fast decommission is 12% slower than the standard decommission when 14 nodes are decommissioned. The reason for this difference is the stress on the network induced by the fast decommission. Indeed, during the fast decommission, the remaining nodes have to send and receive data at the maximum bandwidth speed in order to stabilize the system quickly. During the standard decommission, however, the sending load is distributed not only on the remaining nodes but also on the leaving nodes, reducing the overall load on each node. This difference does not appear on the lower bounds because we assume that the network is ideal (Hyp. 2).

Figure 6 shows the number of core-hours consumed by decommission normalized by standard decommission. In most cases, using the fast decommission reduce the usage in the number of core-hours. The gain in core-hours increases with the number of decommissioned nodes. When most of the nodes are decommissioned at once, the fast decommission uses only 50% of the core-hours required by the standard decommission. The predictions the core-hour usage (see Section 4.4) are confirmed by these results.

When the network is the bottleneck, using fast decommission is a relevant choice. Even if fault tolerance is temporarily reduced, the overall operation is slightly slower, but there is a substantial gain in core-hours saved. This gain increases with the number of decommissioned nodes.

Decommission when the storage is the bottleneck

The time to availability and the stabilization time obtained with Pufferbench in the case of a storage bottleneck are presented in Figure 7. The duration of the standard decommission has been added for reference.

On average, the time to availability is within 10% of the lower bounds, while the stabilization time is within 9% of its lower bound. In comparison, the standard decommission is within 17% of its lower bound. From these results, we deduce that the lower bounds are sound and can almost be reached in practice.

Figure 6 shows the number of core-hours needed for the whole operation normalized by the core-hours needed for a standard decommission. Using a fast decommission offers no benefit in core-hours when the number of decommissioned nodes is low. In this case, the core-hours needed to stabilize the system are canceling the benefits of releasing the decommissioned nodes earlier. When a large number of nodes are decommissioned at once, however, the gain in core-hours can reach 50%. These results are in line with the core-hours that lower bounds established in Section 4.4.

Depending on the scenario, using fast decommission when there is a storage bottleneck can be detrimental or risky. If most of the decommission concerns just a few nodes, the fast decommission is detrimental: the fault tolerance is affected, the whole operation is slower than a standard decommission, and there are no gains in core-hours usage.

If many nodes are decommissioned at once, the gains in core-hours may be worth the longer operation and the risk taken. However, the whole operation takes a long time, during which the fault tolerance is not ensured; thus there is a greater risk of losing data due to a crash.

Discussion

In this section, we discuss multiple aspects of the lower bounds.

Limiting the bandwidth

One can limit the bandwidth usage dedicated to the operation in order for the distributed storage system to be able to still service client requests during the decommission. In this case, S Read , S W rite , and S Net must be set to the allowed upper limit for the respective bandwidth in order to obtain the corresponding lower bounds.

This limitation, however, increases the duration of the stabilization during which fault tolerance is not ensured. Thus, the risk of losing data to crashes increases.

Using the lower bound as a model

As shown in Section 5, an efficient implementation of fast decommission exhibits a performance that varies with the number of decommissioned nodes in a way similar to the lower bounds. Thus, we can use the lower bound as a model for the fast decommission to predict the duration of the different phases. For instance, in the case of the network bottleneck, the lower bounds can be used as models with a coefficient of determination of 0.979 for the time to preservation and 0.995 for the time to stabilization.

Once fitted to the decommission mechanism of a distributed storage system, the model can be useful for resource managers to estimate the duration of a decommission and evaluate whether it is interesting to decommission nodes, when to do so, and which nodes to decommission.

Determining where the bottleneck is

The network is the bottleneck if it limits the storage in any situation: S Net < S Read . Conversely, the storage is the bottleneck if it cannot read and write the data received and sent on the network: S Read S W rite S Read +S W rite < S Net . From the two formulas, a situation exists in which the network and the storage can be bottlenecks at the same time: storage devices being the bottleneck for some nodes, while the network is the bottleneck for Inria some other nodes. Building a lower bound for such situations can be difficult. In this case, using a tool such as Pufferbench can give accurate, practical results.

Preserving k > 1 replicas

For the lower bounds presented in Section 4, the fault tolerance is simply ignored during the decommission: only one replica of each object is required. However, one may want to be able to tolerate 0 < k -1 < r faults during the decommission. In this case, at least k > 1 replicas of each object must be preserved on the remaining nodes before the leaving nodes are released.

Lower bounds for this situation can be defined. In the case of a network bottleneck (Prop. 9 and Fig. 8), the time to stabilization is the same as the standard decommission which is also the time to stabilization when maintaining only one replica. For the time to availability, we notice that receiving the data is always the bottleneck, indeed, due to the uniform data distribution (Hypothesis 6), each and every node hosts some objects that are also stored by leaving nodes, and they can replicate them among themselves.

t avail. = k ∑ i=1 ip r-k+i ND r(N -x)S Net t stab. = xD (N -x)S Net (Prop. 9)

Demonstration:

Since the data is distributed uniformly on all nodes, all nodes host some data that must be replicated during the data-safekeeping phase. The bottleneck is the reception of the data (it holds as long as r ≥ 2). From this, we deduce t avail. . The rest of the data to transfer for the stabilization can be sent and received with the same throughput by the remaining nodes. From this, we can deduce t stab. . QED

In the case of a storage bottleneck (Prop. 10 and 11, and Figure 9) the time to availability is longer than when keeping only one replica. On the other hand, the time to stabilization is shorter. Indeed, since the leaving nodes stay for a longer time, their drives are used to read data during a longer duration, eventually reducing the reading load on the drives of the remaining nodes. Note, however, that reaching the lower bound of the stabilization time when k > 1 is hardly possible in practice since all the data transferred during the preservation would have to be kept in a buffer to reduce the reading overhead during the stabilization, which induces very large memory buffers.

Let R avail. be the ratio of the amount of data to read on the amount of data to write during the data-safekeeping phase.

R avail. =    1
for in-memory storage

∑ k i=1 p r-k+i ∑ k i=1 p r-k+i
in other cases. Decommissioned nodes (out of a 20-nodes cluster) Time to decommission (s) q q q q q q q q q q q q q q q Network bottleneck

Demonstration:

The ratio of data read on the amount of data to be written is determined with p r : if an object does not have enough replicas on the remaining nodes, a comparable number of replicas must be moved. Thanks to buffering, however, each object can be read once.

Then, the transfer rate in the cluster can be determined with R avail. and with the fact that the drives cannot read and write at the same time. Moreover, leaving nodes do not have to write, so they can read data all the time. t avail. is deduced from these. QED Let R stab. be the ratio of the amount of data to read on the amount of data to write during the stabilization phase. Decommissioned nodes (out of a 20-nodes cluster) Time to decommission (s) q q q q q q q q q q q q q q q Storage bottleneck Classic decommission Data safekeeping with k=1 Stabilization with k=1 Data safekeeping with k=2 Stabilization with k=2

Demonstration:

Similar to the demonstration of Prop. 10, the ratio of data read on the amount of data written is determined with the p r . However, the data that has been read during the data-safekeeping phase is assumed to have been buffered and does not need to be read a second time.

Then, the transfer rate in the cluster can be determined with R stab. , and the fact that the drives cannot read and write at the same time. t stab. is deduced from these and t avail. . QED

Conclusion

Efficient decommission is needed to leverage malleability in distributed storage systems. In this work, we study fast decommission, a decommission mechanism that makes the released nodes available to the resource manager as soon as possible by relaxing the fault tolerance. We provide lower bounds for the various steps required for this decommission, and we validate them using a prototype implemented in Pufferbench.

We demonstrate that fast decommission allows to return the decommissioned nodes to the resource manager in a fraction of the time required by standard decommission. We show that in case of a network bottleneck, the duration of the whole operation is only slightly longer than for a standard decommission, while the core-hour usage is significantly reduced. In this situation, the choice of using fast decommission is relevant and can be considered by distributed storage system designers.

In the case of a storage bottleneck, however, using a fast decommission to release few nodes is detrimental to resource usage. The whole operation lasts longer than standard decommission; and although the decommissioned nodes are returned faster to the resource manager, there is no overall gain in core-hours.

In both cases, the more nodes are decommissioned at once, the higher the gain in core-hours. However, this also leads to higher risks since the fault tolerance is weakened for a longer period of time.

Using these lower bounds in order to design a resource manager fully aware of distributed storage system malleability is a challenge left for future work.

  If the sending nodes are the bottleneck, their throughput is S avail. Send = xS Net . In this case the time to availability is t avail. = p r ND rxS Net . If the receiving nodes are the bottleneck, their throughput is S avail.Receiving = (Nx)S NetIn this case the time to availability is t avail. = p r ND r(N-x)S Net .Overall, t avail. = p r ND rxS Net if x ≤ N/2 p r ND r(N-x)S Net in other cases. QED

Inria

Figure 1 :

 1 Figure 1: Lower bounds for the duration of the data-safekeeping and stabilization phases compared with the lower bounds for the standard decommission in case of a network bottleneck. Each node initially hosts 50 GiB of data; the network has a throughput of 1.25 GiB/s (10 Gib/s).

  x)S W rite -xS Read x(N-x)S Read S W rite if x ≤ NS W rite S Read +S W rite 0 in other cases. (Prop. 5)

Inria

Figure 2 :

 2 Figure 2: Lower bounds for the duration of the data-safekeeping and stabilization phases compared with the lower bounds for the standard decommission in case of a storage bottleneck. Each node initially hosts 50 GiB of data, and the reading and writing speed of the storage is set to 1.25 GiB/s.

Figure 3 :

 3 Figure 3: Lower bounds for the number of core-hours used during the data-safekeeping and stabilization phases compared with the standard decommission in the case of a network bottleneck. Each node initially hosts 50 GiB of data, and the network bandwidth is set to 10 Gb/s to match the values observed on the hardware used for the experiments in Section 5.

Figure 4 :

 4 Figure 4: Lower bounds for the number of core-hours used during the data-safekeeping and stabilization phases compared with the standard decommission in the case of a storage bottleneck. Each node initially hosts 50 GiB of data, and the storage bandwidths are set to 207 MiB/s reading and 199 MiB/s writing to match the values observed on the hardware used for the experiments in Section 5.

Inria

Figure 5 :

 5 Figure 5: Data-safekeeping and stabilization times obtained with Pufferbench compared with the lower bounds, in the case of a network bottleneck. Each node initially hosted 50 GiB of data.

  nodes (out of a 20-nodes cluster) Core hours normalized Fast decommission -Network Fast decommission -Storage Standard decommission

Figure 6 :

 6 Figure 6: Core-hours needed to do a fast decommission on a cluster of 20 nodes normalized by the standard decommission with the same bottleneck. The standard deviation has been added.

Figure 7 :

 7 Figure 7: Data-safekeeping and stabilization times obtained with Pufferbench compared with the lower bounds in the case of a storage bottleneck. Each node initially hosted 50 GiB of data.

Figure

  Figure Lower bounds for the duration of the data-safekeeping and stabilization phases compared with the lower bounds for the standard decommission in case of a network bottleneck for k = 1 and k = 2. Each node initially hosts 50 GiB of data, and the network bandwidth is set to 1.25 GiB/s.

  of storage in-memory∑ r-k i=1 p i ∑ r i=1 ip i -∑ k i=1 ip r-k+iin other cases.

Figure 9 :

 9 Figure 9: Lower bounds for the duration of the data-safekeeping and stabilization phases compared with the lower bounds for the standard decommission in case of a storage bottleneck for k = 1 and k = 2. Each node initially hosts 50 GiB of data, and the reading and writing speed of the storage is set to 1.25 GiB/s.

  stab. = t avail. + D stab. -D avail.

			S Recv	-t overlap
	= t avail. +	D stab. -D avail. S Recv	-t avail. +	D avail. S Recv
	=	D stab. S Recv
	=	xD (N -x)S Net

RR n°9229

Publisher Inria Domaine de Voluceau -Rocquencourt BP 105 -78153 Le Chesnay Cedex inria.fr

Acknowledgment

The work presented in this paper is the result of a collaboration between the Ker-Data project team at Inria and Argonne National Laboratory, in the framework of the Data@Exascale Associate team, within the Joint Laboratory for Extreme-Scale Computing (JLESC, https://jlesc.github.io).

Experiments presented in this paper were carried out on the Grid'5000 testbed, supported by a scientific interest group hosted by Inria and including CNRS, RENATER, and several universities as well as other organizations (see https://www.grid5000. fr).

This material is based upon work supported by the U.S. Department of Energy, Office of Science under contract DE-AC02-06CH11357.


A Chateauneuf
email: chateauneuf@univ-paris1.fr

G Lakhnati
email: lakhnati@univ-paris1.fr.

E Langlais
email: eric.langlais@univ-nancy2.fr

On the precautionary motive for savings and prudence, in an EU and a NEU framework

Keywords: Modèle EU, Modèle RDEU, Aversion forte pour le risque, Pessimisme, Prudence et Prudence locale faible. Classification JEL: D10, D80, D90, E21 EU Model, RDEU Model, Strong Risk Aversion, Pessimism, Prudence and Local Weak Prudence. JEL Classification: D80, E21

Dans ce papier nous traitons le problème de base de consommation à deux périodes où l'utilité de la consommation en première et deuxième période, respectivement: v et u, est supposée concave. Considérant l'hypothèse usuelle de l'identité de u et v, nous montrons que la prudence est entièrement caractérisée par la convexité de u dans le modèle EU. Plus intéressant, nous montrons que pour le modèle RDEU, la prudence est entièrement caractérisée par la convexité de u et le pessimisme fort. Le papier finit en montrant que pour un décideur RDEU adversaire fort du risque, le pessimisme strict implique la prudence faible locale, quel que soit le signe de u .

Introduction

The most popular model which has been used to analyze consumption decisions under risk is the basic two-period "Consumption-Saving" model where the decision maker (DM) is supposed to be a risk averse expected utility maximizer (see, Leland [12] and Sandmo [START_REF] Sandmo | The Effect of Uncertainty on Saving Decisions[END_REF]). An important question to ask is: how an agent's saving is affected by an increase in risk. If the individual may want to increase his saving in the face of risk, his reaction indeed is associated with the notion of "Precautionary saving". Kimball [START_REF] Kimball | Precautionary Saving In The Small and In The Large[END_REF] has proposed to define as a prudent DM any individual who displays a positive motive for precautionary saving -that is: a prudent DM increases his saving when the risk on his future income increases. Since Leland [START_REF] Leland | Saving and Uncertainty: The Precautionary Demand For Saving[END_REF], Drèze and Modigliani [START_REF] Drèze | Consumption Decisions Under Uncertainty[END_REF], Sandmo [START_REF] Sandmo | The Effect of Uncertainty on Saving Decisions[END_REF], it is well known that in the basic two-period model, the convexity of the marginal utility of second period is a sufficient condition for a risk averse DM to be prudent. Nevertheless, the necessity of the convexity of the marginal utility has not yet been proved. This remark also applies to the analysis of consumption decisions in the context of non expected utility decision models (Demers and Demers [START_REF] Demers | Saving Under Uncertainty: A Bivariate Non-Ecpected Utility Approach[END_REF], Etner [START_REF] Etner | Precautionary savings: an element of behavior and economic adjustments analysis[END_REF]). In this paper, we revisit the basic two-period consumption/saving decisions model, where in the first period, the consumer is endowed with an initial (non risky) wealth w, while in the second period, his income is supposed to be risky, represented by a random variable Y, with a known probability distribution. We consider necessary and sufficient conditions for prudence, first in the Expected utility case and then in the Rank Dependant one. For its main part, the paper also focuses on the case where the DM is facing a large increase in risk, according to the popular criterion used by economists of the second stochastic dominance (SSD) order. But it is well known that Arrow [START_REF] Arrow | Essays In The Theory OF Risk-Bearing[END_REF] has shown that in fact, a risk averse EU DM facing risky prospects with small variance behaves locally as a risk neutral DM. Segal and Spivak [START_REF] Segal | First Order Versus Second Order Risk Aversion[END_REF] define this attitude as second order risk aversion, and show that in contrast, any RDEU DM risk averse in the strong sense, displays first order risk aversion (i.e. risk aversion for small risks). Hence, in the last part of the paper, we focus on the precautionary motive for saving when the future income is seen as such a small risk. The paper is structured as follows. Sections 2 and 3 present the concepts used for our theoretical model. In section 4 we study the consumption/saving problem in the Expected Utility model and we show that, if the agent keeps the same function of utility in both periods, convexity of the (second period) marginal utility (i.e. u ≥ 0) is necessary and sufficient for prudence. Then relaxing the assumption of an identical utility index in both period, we consider two particular cases for which the DM will be prudent whatever the sign of u . Section 5 deals with the Rank Dependent Expected Utility model. We prove that if the agent considers the same concave utility function in both periods then under Inada conditions, the DM is prudent if and only if he is strictly risk averse in the strong sense and u ≥ 0. Section 6 introduces the case of a small (second period) income risk. The DM will be in some sense "prudent", if when facing a small actuarially neutral risk, then he increases his saving. We will term his attitude as a locally weakly pru-dent behavior. We will prove that for the RDEU model, if a DM is strictly risk averse and strictly pessimistic, he will be locally weakly prudent whatever the sign of u is, a behavior not necessarily verified by a strictly risk averse EU DM. Section 7 concludes.

2 Risk and increase in risk: the framework Let us begin with some basic notations and definitions. Since the topics of the paper is the analysis of savings decision under risk, when we will speak in the sequel of a situation as a risky one, we mean the following. We consider a decision maker (DM) faced with choices among risky assets X, the set V of such assets consisting of all bounded real random variables defined on a probability space (S, A, P ) assumed to be sufficiently rich to generate any bounded real-valued random variables. S is the set of states of nature, A is a σ-algebra of events, and P is a σ-additive non atomic probability measure on (S, A). For X ∈ V, F X will denote the cumulative distribution function of X : F X (t) = P (X ≤ t), and E(X) the mathematical expectation of X : E(X) = xdF X (x). A finite discrete random variable X, will be also denoted as: L(X) = (x 1 , p 1 ; x 2 , p 2 ; ...; x n , p n ), with p i ≥ 0, n i=1 p i = 1, and assuming that x 1 ≤ x 2 ≤ ... ≤ x n without loss of generality. Now, let be the preference relation over V of a decision maker (DM thereafter). Thus for any pair of real random variables X, Y ∈ V : X Y means that for the DM, X is at least as good as Y . The relation is assumed to be a weak order (i.e.: transitive and complete preference ordering) 1 and also monotone (i.e.: X Y + .S * , > 0 ⇒ X Y )2 . One of the most popular criterion used by economists to represent the idea of an increase in risk, is the second stochastic dominance order (SSD). By definition, for any X, Y ∈ V, we say that Y is dominated by X with respect to the SSD order (that is Y is riskier than X) if:

t -∞ F Y (x)dx ≥ t -∞ F X (x)dx, ∀t ∈ R
When we constrain X and Y to have the same mean (i.e.: E(X) = E(Y )), then Y is said to be a Mean Preserving Increase in Risk (MPIR thereafter) of X, denoted Y MPIR X. As shown earlier by Rothschild and Stiglitz [START_REF] Quiggin | A Theory of Anticipated Utility[END_REF], this notion of MPIR leads to a very natural definition for the behavioral concept of aversion to risk.

1 A non trivial weak order is a relation between the elements of V which is:

• Transitive: ∀X, Y, Z ∈ V, X Y, Y Z implies X Y. • Complete: ∀X, Y ∈ V, X Y or Y X.
Definition 2.1 (Rothschild and Stiglitz [START_REF] Rothschild | Increasing risk. I. A definition[END_REF])

The DM is strongly risk averse if: ∀X, Y ∈ V, such that Y M P IR X, then X Y.

Note that economists are usually more familiar with the definition of risk aversion initially proposed by Pratt and Arrow:

Definition 2.2 (Arrow [START_REF] Arrow | The Theory of Risk Aversion[END_REF], Pratt [START_REF] Pratt | Risk Aversion In the Small and In The Large[END_REF])

The DM is weakly risk averse if ∀X ∈ V, E(X).S * X.

Trivially, given that X M P IR E(X) for any X, risk aversion in the strong sense of Rothschild and Stiglitz implies risk aversion in the weaker sense of Arrow-Pratt.

3 The representation of the decision maker's preferences: Assumptions

Following the descriptive solution of Allais [START_REF] Allais | The General Theory of Random Choices In Relation to The Invariant Cardinal Utility Function and The Specific Probability Function[END_REF], Quiggin [START_REF] Quiggin | A Theory of Anticipated Utility[END_REF] and Yaari [START_REF] Yaari | The Dual Theory of Choice Under Risk[END_REF] have proposed a generalization of the Expected Utility approach rationalizing the basic idea that facing with a risk associated to a known probability distribution, a DM distorts the probabilities in a subjective manner that depends on the relative ranking of the payments to which they are associated. Several authors as for instance Chateauneuf [START_REF] Chateauneuf | Comonoticity Axioms and RDEU Theory for Arbitrary Consequences[END_REF] and Wakker [START_REF] Wakker | Separating marginal utility and risk aversion[END_REF] have proposed alternative axiomatics that lead to a Rank Dependent Expected Utility (RDEU thereafter) representation of the preferences of such a DM. The fundamental aspect of the RDEU model is the weakening of the independence axiom which is central to the Expected Utility model (EU thereafter). It is replaced by the comonotonic sure thing principle. Let us recall the definition of comonotonicity:

Definition 3.3 Two random variables X and Y are comonotonic if ∀s, s ∈ S, then (X(s) -X(s ))(Y (s) -Y (s )) ≥ 0.
The RDEU model can be defined as follows: If the preferences of the DM respect the axioms of the RDEU model ( on V is transitive, complete and monotone, satisfies comonotonic sure thing principle and some additional technical properties), then there exists two functions: i) u : V → R which is a continuous and increasing utility function, which is unique up to a positive affine transformation. ii) f : [0, 1] → [0, 1] which is a continuous and increasing probability transformation function, satisfying:

f (0) = 0 and f (1) = 1, such that ∀X, Y ∈ V, X Y ⇔ E f oP (u(X)) ≥ E f oP (u(Y )) where ∀Z ∈ V: E f oP (u(Z)) = 0 -∞ [f (P (u(Z) > t) -1] dt + +∞ 0 f (P (u(Z) > t)dt
In the case where we focuse the attention on discrete random variables, the value function E f (u(Z)) may be written as:

E f oP (u(Z)) = u(z 1 ) + n i=2 [u(z i ) -u(z i-1 )] f   n j=2 p j  
Then, it is easy to see that the RDEU representation of the preferences is based on an intuitive behavioral principle: the DM takes for sure the utility of the worst outcome u(z 1 ) and weights the successive additional increases of the utility u(z i ) -u(z i-1 ) by f ( n j=i p j ), which may be understood as a subjective transformation of the probability to obtain at least the outcome z i .

While the RDEU model is a generalization of the EU model, it may also encompass the Dual Theory of Yaari. On one hand, if the perception function f is the identity function, then E f oP (u(Z)) = E(u(Z)). On the other hand, if the utility function u is the identity function, then E f oP (u(Z)) = E f oP (Z) which is the Yaari functional. Finally, if both the risk perception function and the utility function are the identity, then E f oP (u(Z)) is simply the expected value E(Z) of the random variable.

It is worth noting that for a RDEU DM, risk aversion in the strong sense is characterized by the concavity of u and the convexity of f (Chew, Karni and Safra [START_REF] Chew | Risk Aversion in The Theory of Expected Utility With Rank Dependent Preferences[END_REF]).

Note also that when the transformation function f is convex, it turns out that the set-function ν = f oP is a convex capacity on (S, A):

ν(∅) = 0, ν(S) = 1, A, B ∈ A, A ⊂ B ⇒ ν(A) ≤ ν(B) and (convexity) ∀A, B ∈ A, ν(A) + ν(B) ≤ ν(A ∪ B) + ν(A ∩ B).
Accordingly we will make an extensive use of the following lemma (see Proposition 10.1 in Denneberg [START_REF] Denneberg | Non-additive Measure and Integral[END_REF]): Lemma 3.1 Let f be a convex probability transformation function. Then for any class C of (pairwise) comonotonic random variables in V, there exists a probability measure

Q on (S, A), Q ≥ f oP such that ∀X ∈ C : E f oP (X) = E Q (X).

The basic EU-based Consumption/Saving problem

Let us consider the basic two-period model which has been extensively used since Leland [START_REF] Leland | Saving and Uncertainty: The Precautionary Demand For Saving[END_REF] and Sandmo [START_REF] Sandmo | The Effect of Uncertainty on Saving Decisions[END_REF], to analyze consumption decisions under risk.

In the first period, the consumer is endowed with a deterministic initial wealth w, while his second-period income is risky, represented as a random variable Y with a perfectly known probability distribution. There exists in the economy a technology of storage, which has the main characteristic that one unit of consumption today may be transformed in one unit of consumption tomorrow.

In words, the access to this technology implies no transaction costs, no loss of initial value but also proceeds no additional value. Hence, when the agent uses this storage technology, everything goes as if he may save part of his current income and is rewarded with a risk-free interest rate equal to zero. Assume that the preferences of the agent respect the axioms of the EU model, with a time-additively separable representation. Denoting c 1 and C 2 respectively the first-period and second-period consumption levels, the intertemporal utility of the consumer is denoted:

U (c 1 , C 2 ) = v(c 1 )+ Eu(C 2 ).
The consumption/saving problem of the agent corresponds to the choice of x ∈ [0, w] so as to maximize v(w -x) + Eu(Y + x).

We assume that u and v the two consumption utility functions are real-valued, defined on R + and satisfy the following assumptions:

Assumption 4.1 : i) v is two times continuously differentiable, with v > 0 and v ≤ 0;
ii) u is three times continuously differentiable, with u > 0 and u ≤ 0;

iii) u or v is strictly concave.

These assumptions are quite natural in the present context: 4.1i) implies that more consumption today is always desirable and that the marginal utility of money today is decreasing, which appears as a usual assumption under certainty. 4.1ii) means that more consumption tomorrow is also always desirable, but that more risk is never desirable: since Drèze and Modigliani [START_REF] Drèze | Consumption Decisions Under Uncertainty[END_REF], it is well known that when he is facing a set of such temporal lotteries (c 1 , C 2 ), the DM's attitude towards risk is embedded only through the assumption made on the curvature of the second period utility function (assuming a time-additively separable representation of the preferences). Hence, the DM is risk averse if and only if u is concave. Apart a long stream of controversies on this point, it is worth noting that the concavity of both utility functions may also be usefully justified, at least from an economically meaningful point of view, on the ground that it guarantees the positivity of the income effects. In other words, v ≤ 0 is required soon as we assume that the second period consumption is a normal good, while u ≤ 0 insures that the first period consumption is also a normal good. Finally, 4.1iii) appears as technically useful and tractable. To see this point, denote:

g(x) = v(w -x) + Eu(Y + x).
On the one hand, from the continuity of u and v in R + , we conclude that g is also continuous in [0, w] . On the second hand, from 4.1iii) we conclude that g is strictly concave in [0, w] . As a result, g has a unique maximum on [0, w]. Hence under 4.1, the basic consumption/saving problem is well behaved and has a unique solution.

In this problem, the DM obtains through his savings decision a perfect control as far as his first period consumption level is concerned: c 1 is a deterministic variable. But in contrast, the decision to save, even when saving the full amount of the current income, gives him only a partial control of the second period consumption level: C 2 is a random variable, contingent on the realization of the risky income. Hence, the desire to smooth the intertemporal consumption may not be the unique motive of savings here. In order to hedge against the second period income risk (and possibly the most defavorable realizations of the future income), the DM may also display a precautionary saving motive.

Kimball [START_REF] Kimball | Precautionary Saving In The Small and In The Large[END_REF] proposes to define as a prudent DM any individual who displays a positive motive for precautionary savings -that is: a prudent DM increases his savings when the risk on his future income increases. Formally, denote x * (Y, w) (respectively x * ( Ỹ , w)) the DM's amount of optimal savings when his future income is Y (respectively Ỹ ) and his initial wealth is w. Then:

Definition 4.4 The individual is prudent if ∀Y, Ỹ ∈ V, such that Ỹ M P IR Y and ∀w ≥ 0 then x * ( Ỹ , w) ≥ x * (Y, w).
Since Leland [START_REF] Leland | Saving and Uncertainty: The Precautionary Demand For Saving[END_REF], Drèze and Modigliani [START_REF] Drèze | Consumption Decisions Under Uncertainty[END_REF] and Sandmo [START_REF] Sandmo | The Effect of Uncertainty on Saving Decisions[END_REF], it is well known that the convexity of the (second period) marginal utility (i.e. u > 0) is a sufficient condition to obtain that a risk averse DM has a positive precautionary saving motive. For his own, Kimball [START_REF] Kimball | Precautionary Saving In The Small and In The Large[END_REF] argues in a stimulating paper that there is an isomorphism between the concept of risk aversion and the concept of prudence that may be fruitfully exploited. Then, he suggests that in order to evaluate the intensity of the precautionary saving motive, it may be possible (for a small zero-mean income risk) to define a precautionary premium Ψ(ε,

x) = (-u (x) u (x) ) σ 2 ε 2 where (-u (x) u (x)
) is an index of prudence.

Nevertheless, the necessity of the convexity of u has not yet been proved. In the following propositions, we proceed in two steps. First, we show that in the case where v = u, the condition u ≥ 0 is necessary and sufficient for prudence. Then, in the general case where v = u, we consider two cases for which the DM will be prudent whatever the sign of u is. Before proceeding with the proof, let us denote, for all Y and Ỹ in V: g(x) = v(w -x)+Eu(Y +x) and h(x) = v(w -x)+Eu( Ỹ +x), for all x ∈ [0, w].

Proof (⇒)

Let us consider the following alternative distribution functions for the second period income: L( Ỹ ) = (a, 1 2 ; b, 1 2 ) and L(Y ) = ( 1 2 a + 1 2 b, 1). Trivially, Ỹ M P IR Y. Since u is continuous, to prove that u ≥ 0, it is enough to prove that:

∀a, b ∈ R, u ( 1 2 a + 1 2 b) ≤ 1 2 u (a) + 1 2 u (b).
Define respectively g and h on [0, w] , by : g

(x) = u(w -x) + u( 1 2 a + 1 2 b + x) and h(x) = u(w -x) + 1 2 u(a + x) + 1 2 u(b + x). Hence, g (0) = -u (w) + u ( 1 2 a + 1 2 b) and h (0) = -u (w) + 1 2 u (a) + 1 2 u (b). Let > 0 and take w = 1 2 a + 1 2 b + . Since u is strictly concave, g (0) > 0, and therefore x * (Y, w) > 0. If h (0) < 0, since h is strictly concave, x * ( Ỹ , w) = 0. Therefore h (0) ≥ 0, that is u ( 1 2 a + 1 2 b + ) ≤ 1 2 u (a) + 1 2 u (b)
, for all > 0. Now by continuity of u , when tends to 0 we have: u

( 1 2 a + 1 2 b) ≤ 1 2 u (a) + 1 2 u (b), ∀a, b ∈ R. Therefore u is convex. (⇐) Assume u ≥ 0. If x * (Y, w) = 0, the result is trivial. Assume that x * (Y, w) ∈ (0, w]. Given that g is strictly concave, then g (x) > 0, ∀x ∈ [0, x * (Y, w)). To show that x * (Y, w) ≤ x * ( Ỹ , w), it remains to prove that h (x) > 0, ∀x ∈ [0, x * (Y, w)). Since Ỹ M P IR Y , then Ỹ + x M P IR Y + x, ∀x ∈ [0, w]
. By hypotheses (i.e.: u concave and u ≥ 0), we obtain that -u is increasing and concave. Hence, ∀x ∈ [0, w], E(-u (Y + x)) ≥ E(-u ( Ỹ + x)). Therefore, Eu (Y + x) ≤ Eu ( Ỹ + x). Adding both sides with -u (w -x), we obtain: g (x) ≤ h (x), ∀x ∈ [0, w], hence: h (x) > 0, ∀x ∈ [0, x * (Y )). As a result, x * ( Ỹ , w) ≥ x * (Y, w). Now, we consider two alternative cases where the DM is prudent whatever the sign of u is. Proposition 4.2 Under assumption 4.1, if sup v < inf u , then the DM is prudent.

Proof

Take X in V, w > 0 and x ∈ R, hence Eu (X + x) ≥ inf u , and since inf u > sup v , Eu (X + x) > v (w -x). That is g (x) = -v (w -x) + Eu (X + x) > 0 for all x ∈ [0, w] , therefore x * (X, w) = w. As a result, the individual is always prudent.

Example 1:

Take u : R + → R defined by u(x) = x -(x + 2) exp(-x) and let v : R + → R defined by v(x) = -1 2 exp(-x); u and v satisfy assumption 4.1. One obtains

1 = inf u > sup v = 1 2 , but u ≥ 0 if x ≥ 1, and u ≤ 0 if x ∈ [0, 1). Proposition 4.3 Under assumption 4.1, if sup u < inf v , then the DM is prudent.
Proof Take X in V, w > 0 and x ∈ R, hence Eu (X + x) ≤ sup u , and since sup u < inf v , Eu (X + x) < v (w -x). That is g (x) = -v (w -x) + Eu (X + x) < 0, for all x ∈ [0, w] , therefore x * (X, w) = 0. As a result, the individual is always prudent.

Example 2:

Take u : R + → R defined by u(x) = -1 2 (x + 2) exp(-x) and v : R + → R, defined by v(x) = x -exp(-x); u and v satisfy assumption 4.1. One obtains

1 = inf v > sup u = 1 2 , but u ≥ 0 if x ≥ 1, and u < 0 if x ∈ [0, 1).
Propositions 4.2 and 4.3 exhibit two alternative sets of assumptions for which the savings decision of a risk averse DM is defined as a corner solution for the problem of maximizing his intertemporal utility function. Truly speaking, in both instances, the DM's optimal saving level is independent of the future income riskiness. Nevertheless, the DM is said to be prudent in the common sense of the literature, since he does not reduce his savings when the risk associated to his second period income increases, the amount of saving is constant (either w or 0).

The RDEU-based consumption/saving problem

Assume now that the DM's preferences over temporal lotteries (c 1 , C 2 ) satisfy the RDEU axioms, and admit a time-additively separable representation given by:

V (c 1 , C 2 ) = v(c 1 ) + E f oP u(C 2 ).
We firstly establish that u ≥ 0 is sufficient for prudence, although the convexity of f is at the same time required. In other words, if the DM is risk averse in the strong sense and if his (second period) marginal utility is convex, then he is prudent.

Proposition 5.4 Under assumption 4.1, assume that f and u are convex, then the DM is prudent.

Before proceeding with the proof, let us denote for all Y, Ỹ ∈ V and x ∈ [0, w]:

g(x) = v(w -x) + E f oP u(Y + x) and h(x) = v(w -x) + E f oP u( Ỹ + x).
Since u and -u are both non-decreasing, it turns out that ∀Z ∈ V, ∀x ∈ R u(x + Z) and -u (x + Z) are comonotone, hence from lemma 3.1 (E f oP u(Z + x)) = -E f oP (-u (Z +x)), and therefore g

(x) = -v (w-x)-E f oP (-u (Y +x)) and h (x) = -v (w -x) -E f oP (-u ( Ỹ + x)). Proof Let Y, Ỹ ∈ V, such that Ỹ M P IR Y . If x * (Y, w) = 0, the result is triv- ial.
Assume that x * (Y, w) ∈ (0, w], since g is strictly concave we have:

g (x) > 0, ∀x ∈ [0, x * (Y, w)). Hence to show that x * ( Y , w) ≥ x * (Y, w), it is enough to show that ∀x ∈ [0, x * (Y, w)) , h (x) > 0.
By assumption, -u is concave and non-decreasing, and f is convex. From Chew, Karni and Safra ([6], theorem 2), since for any x, Ỹ + x M P IR Y + x we directly obtain that:

E f oP (-u (Y + x)) ≥ E f oP (-u ( Ỹ + x)). Then -E f oP (-u (Y +x)) ≤ -E f oP (-u ( Ỹ +x)). Therefore h (x) ≥ g (x), ∀x ∈ [0, w] .
As a result, we have: h (x) > 0, ∀x ∈ [0, x * (Y, w)) , which completes the proof. Before proceeding with the proof of proposition 5.5, it is worth noting that it may be formulated as follows: under assumptions 4.1 and 4.2, the DM is prudent if and only if he is strictly risk averse in the strong sense and u is convex.

Proof (⇒) Let Y, Y ∈ V be such that: L(Y ) = (y 1 , p 1 ; y 2 , p 2 ; y 3 , p 3 ), with 0 ≤ y 1 < y 2 < y 3 and p 1 + p 2 + p 3 = 1 taking p 1 < 1, p 2 > 0, p 3 < 1; and L( Ỹ ) = (y 1 , p 1 + 1 ; y 2 , p 2 + 2 ; y 3 , p 3 + 3 )
, where 1 , 2 , 3 ∈ R satisfy the following conditions: 1 + 2 + 3 = 0, and 1 y 1 + 2 y 2 + 3 y 3 = 0. This implies that:

     1 = 2 = -y 3 -y 1 y 3 -y 2 3 = y 2 -y 1 y 3 -y 2
Take now > 0; as a result, Ỹ M P IR Y . ∀x ∈ [0, w] :

g(x) = u(w-x)+u(y 1 +x)+[u(y 2 +x)-u(y 1 +x)]f (p 2 +p 3 )+[u(y 3 +x)-u(y 2 +x)]f (p 3 ) h(x) = u(w-x)+u(y 1 +x)+[u(y 2 +x)-u(y 1 +x)]f (p 2 +p 3 -)+[u(y 3 +x)-u(y 2 +x)]f (p 3 + y 2 -y 1 y 3 -y 2 )
Then:

g (x) = -u (w-x)+u (y 1 +x)+[u (y 2 +x)-u (y 1 +x)]f (p 2 +p 3 )+[u (y 3 +x)-u (y 2 +x)]f (p 3 ) h (x) = -u (w-x)+u (y 1 +x)+[u (y 2 +x)-u (y 1 +x)]f (p 2 +p 3 -)+[u (y 3 +x)-u (y 2 +x)]f (p 3 + y 2 -y 1 y 3 -y 2 )
For x = 0, we obtain:

g (0) = -u (w) + u (y 1 ) + [u (y 2 ) -u (y 1 )]f (p 2 + p 3 ) + [u (y 3 ) -u (y 2 )]f (p 3 ) h (0) = -u (w)+u (y 1 )+[u (y 2 )-u (y 1 )]f (p 2 +p 3 -)+[u (y 3 )-u (y 2 )]f (p 3 + y 2 -y 1 y 3 -y 2 )
6 The Local Weak Prudence

The results of the previous sections are based on the notion of mean preserving increase in risk (MPIR), which is usually more relevant when we consider a class of large risks. But some of the well known paradoxes in decision theory appear in the range of small risks. For instance, Arrow [START_REF] Arrow | Essays In The Theory OF Risk-Bearing[END_REF] has shown that in fact a risk averse EU DM behaves locally in a risk neutral manner, where by locally we mean: facing risky prospects with small variance. Segal and Spivak [START_REF] Segal | First Order Versus Second Order Risk Aversion[END_REF] define this attitude as second order risk aversion, and they show that in contrast, any RDEU DM, risk averse in the strong sense, displays first order risk aversion (that is, he is also risk averse for small risks).

In this part of the paper, we focus on the precautionary motive for saving when the future income is seen as a small risk, defined as follows.

Let (a, w) ∈ R +2 * be given, with a a deterministic second period income level. Let Z be a random variable with zero-mean, and consider a + tZ with t small enough such that a + tZ ≥ 0. Hence, tZ may be seen as a small noise which adds to the determinist future income.

Intuitively speaking, the DM will be in some sense "prudent", if facing with a small actuarially neutral risk, then he increases his savings. We will term this attitude as a locally weakly prudent behavior. Formally: Definition 6.5 The DM is locally weakly prudent if ∀(a, w) ∈ R +2 * , ∀X ∈ V with E(Z) = 0, there exists t 0 > 0 such that 0 < |t| ≤ t 0 implies x * (a + tZ, w) ≥ x * (a, w).

It is now shown that in the EU model, the individual may not be locally weakly prudent. This is done by constructing a counter-example.

A Counter-example:

Let u : R + → R and v : R + → R defined by: u(x) = -1.2(x + 2) exp(-x) strictly increasing, strictly concave and v(x) = x strictly increasing, concave and u ≥ 0 if x ≥ 1, u ≤ 0 if x ≤ 1. Let a = 0.5 and w = 2 fixed and L(Z) = (-0.1, 1 2 ; 0.1, 1 2 ), E(Z) = 0. It remains to show that for all 0 < t 0 ≤ 5, there exists 0 < |t| ≤ t 0 such that x * (0.5 + tZ, 2) < x * (0.5, 2). For simplicity of notation, denote x * (0.5, 2) = x * g(x) = 2 -x + u(0.5 + x), so g (x) = -1 + u (0.5 + x) = -1 + 1.2(x + 1.5) exp -(x + 0.5) and g (x) = -1.2(x + 0.5) exp -(x + 0.5) It is very easy to verify that the optimal solution x * of the maximization of g under x ∈ [0, 2] exists, unique and satisfy g (x * ) = 0, since g (0) > 0 and g < 2. Also we can easly check that 0, 2 < x * < 0, 3. Let us show that ∀ 0 < |t| ≤ 1, h (x * ) < 0, which will complete the proof. h(x) = 2 -x + Eu(a + x + tZ), then h (x) = -1 + 1 2 u (0.5 + x -0.1t) + 1 2 u (0.5 + x + 0.1t). Since 0.5 + x * -0.1t and 0.5 + x * + 0.1t belong in (0, 1) and u is strictly concave in (0, 1), h (x * ) < -1 + u ( 0.5+x * -0.1t+0.5+x * +0.1t 2 ) = -1 + u (0.5 + x * ) = 0. That is x * (0.5 + tZ, 2) < x * (0.5, 2), ∀ 0 < |t| ≤ 1.

Assume that the preference of the DM respects the RDEU axioms. Consider the additional following assumption:

Assumption 6.5 : i) f ≥ 0 and f (p) < p ∀p ∈ (0, 1). ii) u ∈ C 2 (R + , R) and u (x) < 0, ∀x ∈ R + .
6.5i) says that the DM is strictly pessimistic: this hypothesis is weaker than the strict convexity of f , but stronger than strict risk aversion, since the DM is strictly risk averse if and only if f and u are respectively convex and concave, convexity of f or concavity of u being strict. 6.5ii) implies that the utility function of the second period is strictly concave. Hence, the DM is strictly risk averse in the strong sense, and strictly pessimistic. Proposition 6.7 Under assumptions 4.1 and 6.5, a RDEU DM is locally weakly prudent.

Proof

Let us consider (a, w) ∈ R +2 * , and Z a random variable in V such that E(Z) = 0 and t ∈ R such that a + tZ ≥ 0. For simplicity of notation, denote x * (a, w) = x * and x * (a + tZ, w) = x * . We intend to prove that there exists t 0 > 0 such that 0 < |t| ≤ t 0 implies x * ≥ x * . If x * = 0, the result is trivial. Assume that x * ∈ (0, w]. Let us define, ∀x ∈ [0, w]: g

(x) = v(w -x) + u(a + x) and h(x) = v(w -x) + E f oP u(a + x + tZ). Clearly g (x) = -v (w -x) + u (a + x).
First suppose that t > 0 is chosen small enough such that a + tZ ≥ 0. Since for t > 0, the class C of random variables defined by: Z and u(a + x + tZ), is a class of comonotonic random variables, from lemma 3.1 there exists a probability

Q, Q ≥ f oP, such that E f oP (Z) = E Q (Z) and E f oP u(a + x + tZ) = E Q u(a + x + tZ) for such a small t > 0. It turns out that h (x) = -v (w -x) + E Q u (a + x + tZ). Let [m, M ] be the range of Z, hence from the Taylor formula applied to z ∈ [m, M ]: u (a + x + tz) = u (a + x) + tzu (a + x) + (tz) 2 2 u (a + x + θ z .tz); θ z ∈ (0, 1). Since u is continuous hence bounded on [0, a + x + M ], it comes: E Q u (a+x+tZ) = u (a+x)+t[E Q (Z)u (a+x)+ (t)]
, with (t) → 0, where t → 0 + . Given that f (p) < p, ∀p ∈ (0, 1), we know that E f oP (Z) < E P (Z) = 0 (Quiggin [START_REF] Quiggin | Comparative Static for Rank-Dependent Expected Utility Theory[END_REF], Chateauneuf and Cohen [START_REF] Chateauneuf | Risk seeking with diminishing marginal utility in a non expected utility model[END_REF]), i.e. E Q (Z) < 0. Since u (a + x * ) < 0 it is obvious that there exists t 1 > 0 such that: 0

< t ≤ t 1 implies E Q u (a + x * + tZ) > u (a + x * ), hence h (x * ) > 0.
Let us now suppose that t < 0 is chosen small enough such that a + tZ ≥ 0. Pairwise comonotonicity of -Z and u(a+x+tZ), t < 0, implies from lemma 3.1 the existence of a probability Q, Q ≥ f oP , such that: E f oP (-Z) = E Q (-Z) and E f oP u(a + x + tZ) = E Q u(a + x + tZ) for t < 0 small enough. The same reasoning as above gives: h (x) = -v (w -x) + E Q u (a + x + tZ) and E Q u (a + x + tZ) = u (a + x) + (-t)[E Q (-Z)u (a + x) + (t)], with (t) → 0, where t → 0 -. Again f (p) < p, ∀p ∈ (0, 1) implies E f oP (-Z) < E P (-Z) = 0, i.e. E Q (-Z) < 0. Since u (a + x * ) < 0 it is clear that there exists t 2 > 0 such that: 0 < -t ≤ t 2 implies E Q u (a + x * + tZ) > u (a + x * ), hence h (x * ) > 0. Take t 0 = min(t 1 , t 2 ), we have 0 < |t| ≤ t 0 implies h (x * ) > 0. That is 0 < |t| ≤ t 0 implies x * ≥ x * , which completes the proof.

Concluding remarks

The concept of prudence is at least as popular as the concept of risk aversion among economists. Nevertheless, it seems that it had not yet received so robust foundations, and as a matter of fact, there did not exist a complete charaterization of this behavioral assumption even in the classical context of the expected utility model. It is obvious that the previous analysis of the prudence, focusing on the precautionary motive for savings, provide only sufficient conditions -not necessary conditions, for prudent behaviors to exist. This paper was an attempt to fulfil this gap, and successfully affords a complete characterization of prudence both in the EU model and in the RDEU framework. We have considered the basic two-period consumption/saving problem where the DM is facing a risky income in second period, and where his first and second period consumption utility, respectively v and u, are assumed to be concave. When the usual assumption according to which u = v is introduced, we have shown that prudence is fully characterized by the convexity of u in the EU model, while we have proven that for the RDEU model, prudence is fully characterized by the convexity of u and strong pessimism. Interestingly enough, we have shown through two sensible examples that, relaxing the assumption u = v, the convexity of u is neither necessary nor sufficient in a EU context to obtain a prudent behavior. But, in the RDEU model, we obtain that strong pessimism and the convexity of u are necessary and sufficient for prudence when u = v, as far as the first period utility function is well behaved (respects Inada conditions). Although the paper mainly considers the case of a large income risk, understood in the sense of mean preserving increase in risk (MPIR), we also adress the issue of prudence in the case of a small (actuarially neutral) risk in the sense of Arrow [START_REF] Arrow | The Theory of Risk Aversion[END_REF]. This has allowed us to introduce the concept of local weak prudence, attended to parallel the analysis of first order risk aversion in the

Assumption 4 . 2 vProposition 4 . 1

 4241 = u. Under assumptions 4.1 and 4.2, the DM is prudent if and only if u ≥ 0.

Assumption 5 . 3 fProposition 5 . 5

 5355 is continuously differentiable on [0, 1]. Under assumptions 4.1, 4.2 and 5.3 the DM is prudent if and only if f and u are both convex.

For A ∈ A, De Finetti 's use of A * to denote the characteristic function of A : [A * (s) = 1 if s ∈ A, A * (s) = 0 if s /∈ A] will be adopted.

-E f oP (-u (Y )) = u (y 1 ) + [u (y 2 ) -u (y 1 )]f (p 2 + p 3 ) + [u (y 3 ) -u (y 2 )]f (p 3 ) = u (y 1 )(1 -f (p 2 + p 3 )) + u (y 2 )(f (p 2 + p 3 ) -f (p 2 )) + u (y 3 )f (p 3 ) -E f oP (-u (Y )) ∈ [u (y 3 ), u (y 1 )]. Since u is continuous, ∃w ∈ [y 1 , y 3 ] such that u (w) = -E f oP (-u (Y )) Let w n = w + 1 n > w, ∀n ∈ N * , w n → w For n ∈ N * , we have g (0) = -u (w n ) + u (w) > 0, since u is strictly decreasing. By assumption of prudence (x * ( Ỹ , w) ≥ x * (Y, w)), we obtain h (0) > 0, hence:

When n → ∞, we have:

Given the differentiability of f , the first order Taylor formula gives:

Then we obtain:

Dividing by > 0 and letting tend to zero, we obtain:

By continuity of f , when p 2 → 0 and p 3 is chosen such that f (p 3 ) > 0 we have:

therefore, u is convex. Now, let us consider the inequality (I), and let us take simultaneously y 3 → y 2 and y 1 → y 2 . Since u is twice differentiable, we obtain:

By strict concavity of u, we may assume y 2 chosen such that u (y 2 ) < 0, therefore f (p 3 + p 2 ) ≥ f (p 3 ) which means that:

The proof for sufficiency is the same as in proposition 5.4. Once more, before proceeding with the proof of proposition 5.6, it is worth noting that it may be formulated as follows: under assumptions 4.1, 5.3 and 5.4, the DM is prudent if and only if he is risk averse in the strong sense and u (second period marginal utility) is convex.

Proof (⇒)

Consider Y, Y ∈ V as in the proof of proposition 5.5, we choose y 2 such that u (y 2 ) < 0, Ỹ M P IR Y . Define ∀x ∈ [0, w] :

So:

For x = 0, we obtain:

Since, u and f are increasing, then -E f oP (-u (Y )) > 0.

By assumption 5.4 and continuity of v , there exists a sequence w n > 0 such that:

As a result, ∀w n we have: g (0) > 0. On the other hand, by assumption of prudence (x * ( Ỹ , w) ≥ x * (Y, w)), we obtain h (0) > 0; hence:

When n → ∞, we have:

The remainder of the proof is the same one as in proposition 5.5.

(⇐)

The proof for sufficiency is the same as in proposition 5.4.

sense of Segal and Spivak [START_REF] Segal | First Order Versus Second Order Risk Aversion[END_REF]. The paper finally has shown that for a strong risk averse RDEU decision maker, strict pessimism allows local weak prudence, whatever the sign of u .