R Yaich

O Boissier

P Jaillon

G Picard

Trust Management within Virtual Communities: Adaptive and Socially-Compliant Trust Model

Recent years have witnessed increasing interest of people in sharing, collaborating and interacting in many different ways among new social structures called Virtual Communities (VC). They represent aggregations of entities with common interests, goals, practices or values. VCs are particularly complex environments wherein trust became, rapidly, a prerequisite for the decision-making process, and where traditional trust establishment techniques are regularly challenged. In our work we are considering how individual and collective trust policies can be managed, adapted and combined. To this aim, we propose an Adaptive and Socially-Compliant Trust Management System (ASC-TMS) based on multi-agent technologies. In this framework, policies are used as concrete implementations of trust models in order to specify both (i) user-centred (i.e. personal) and community-centred (i.e. collective) trust requirements. Agents are used to manage and combine these different policies in a decentralized and flexible way. We describe the functionalities and the architecture that supports them and discuss also a prototype implementation.

Introduction 1.Context

Online environments such as virtual communities are known to be complex structures (open, dynamic, uncertain and risky) where trust became rapidly a prerequisite for the decision-making process. Further, several characteristics of these environments are constantly challenging our societies on how trust is produced and assessed; besides identifying key trust factors, finding the appropriate formalism to represent trust requirements has been, for the last decade, one of the most interesting issues for both industrials and academics.

Trust policies [START_REF] Seamons | Requirements for policy languages for trust negotiation[END_REF] are considered to be a viable solution to represent trust requirements. They constitute a flexible way to specify under which conditions trust may be granted. However, none of the existing languages is able to address properly new considerations raised by VCs.

Problematic

One of the main issues in specifying and deploying trust policies in VC is the ability to manage unpredictability that is inherent to their dynamic and evolving character. Unforeseen changes must be handled otherwise running policies could rapidly become obsolete and inefficient. Another important issue is the capacity of personal policies, specified individually by entities, to integrate seamlessly collective trust requirements that could be imposed or recommended by virtual communities or virtual organizations. In fact, humans in their daily decisions often consider trust by combining, at the same time, two requirements' levels: Collective and personal requirements. Collective requirements represent common trust criteria that should/must be used by the members of the same community/organization, while personal requirements reflect personal and subjective trust criteria. Thus, it's becoming increasingly evident that neither static trust models nor inert trust policies tackles appropriately the previously cited considerations. Whether for tuning used policies to fit environment changes or for making individual requirements comply with collective ones, enabling trust policies with adaptation features is clearly needed as it has been pointed out by some authors.

Proposition

In this report, we focus on endowing Trust Management Systems with adaptation features based on rich, dynamic and integrative trust model. By rich we mean that trust is built upon a wide range of trust factors. By dynamic we mean that policies are constantly adapted and evolve over time. By combinative we mean that individual policies are combined with collective ones to yield global trust requirements. To that aim, we propose to use Policy-based Trust models [START_REF] Seamons | Requirements for policy languages for trust negotiation[END_REF] wherein policies are used to specify trust requirements. In order to express and illustrate mentioned aspects within our framework, we used Jason [START_REF] Bordini | Semantics for the jason variant of agentspeak[END_REF], an extension of AgentSpeak [START_REF] Rao | AgentSpeak ( L ): BDI Agents speak out in a logical computable language[END_REF] syntax, as the underlying logic formalism. The remainder of this report is organized as follows. The next section introduces background concepts including details on trust basis. To illustrate our approach we use a simple virtual community scenario wherein requirements has been identified. Section 3 introduces the foundations of our approach, including the system overview and the trust model outline. Section 4 introduces the details on policies representation. The framework architecture is illustrated and discussed in Section 5. Finally, concluding remarks and future works are presented in Section 6.

Background And Positioning

The last decade has seen an increasing interest on trust that gave rise to numerous researches and many definitions. In this report, we do not consider investigating these definitions nor do we attempt to add a new one. We refer readers to [START_REF] Artz | A survey of trust in computer science and the semantic web[END_REF] that summarizes the existing literature. However, given the multidimensional nature of trust, we are more interested in identifying essential trust factors (i.e. sources of information) based on which trust is built. To that aim, we will have a quick insight on existing trust models in order to isolate pertinent trust factors.

Trust Models

Among the large literature on trust, sociologists vision is particularly interesting. They identified two kinds of factors that are widely used in trust assessment among human societies: hard trust and soft trust factors [START_REF] Jøsang | Foundations of security analysis and design iv. chapter Trust and reputation systems[END_REF], where hard trust factors represent information derived from security mechanisms such as identity keys, credentials and certificates, whereas soft trust factors encompass information that are inferred from experience and observations of others. Based on this, existing trust models can be categorized into two families: hard trust models and soft trust models.

Hard trust models

They focus on managing digitally signed documents (e.g. public keys, credentials and certificates) and enforcing policies. These approaches assume, in most of cases, that trust is derived by obtaining sufficient credentials that satisfy the policy. PGP [START_REF] Abdul-Rahman | The PGP Trust Model[END_REF], PolicyMaker [START_REF] Blaze | Decentralized Trust Management[END_REF] and IBM TE [START_REF] Herzberg | Access control meets public key infrastructure[END_REF] are some of the works, among others, that pioneered this type of models. These models highlights some common features of trust: it is direct and is accorded based on the identity key [START_REF] Abdul-Rahman | The PGP Trust Model[END_REF][START_REF] Blaze | Decentralized Trust Management[END_REF], transferable by authorization credentials [START_REF] Blaze | Decentralized Trust Management[END_REF], and/or subjective and depends on different properties certified by a third party authority [START_REF] Herzberg | Access control meets public key infrastructure[END_REF].

Soft trust Models

They mainly stress the importance of the social dimension of trust [START_REF] Falcone | Social trust: a cognitive approach[END_REF]. These models build trust based on others history [START_REF] Karl | A framework for concrete reputation-systems with applications to history-based access control[END_REF] or evaluations [START_REF] Sabater | Regret: A reputation model for gregarious societies[END_REF][START_REF] Jøsang | Foundations of security analysis and design iv. chapter Trust and reputation systems[END_REF] in absence of (or in addition to) personal ones. The history represents the experience over past interactions while reputations are measures of trust associated to individuals. Both factors are used based on direct and indirect information where personal experience and assessments are internally computed and indirect information are aggregated over all the community (i.e. social structure). Full integration of soft and hard trust factors within trust models has not been done yet. However, [START_REF] Bonatti | An Integration of Reputation-based and Policy-based Trust Management[END_REF] and [START_REF] Lee | Effective trust management through a hybrid logical and relational approach[END_REF] paved the way recently for such perspective by exploring the combination of these two types of trust factors into what we call Hybrid Trust Models. They represent new approachs that make use of both hard and soft trust factors. In addition to hard an soft trust factors, these models, often, consider the use of any other factor that may be pertinent for trust evaluation and open doors for any source of information including context information the risk and the outcome of an interaction. This work is an additional right step toward the proposition of a better integration of hard and soft trust factors in more realistic and rich model. For that, we consider the use of a wide range of source of information. Without loss of generality, chosen factors have been limited to the most commonly used ones among reviewed models.

Trust issues in virtual communities

In this section, we will explore first some interesting issues that are challenging trust establishment within VC and have not been solved yet. To that aim, we support our motivation with three scenarios of Virtual Communities. We then used this scenarios in order to derive and argue a set of important features that should be addressed by modern trust management models.

1. Developers Community Alice is regularly developing new Android applications within the Google Android Community (GAC). Before releasing the final version, Alice often needs the help of some GAC members for pointing out and fixing bugs. However, granting access to her project repository is risky (e.g. the code could be revealed and the binaries distributed). Thus, Alice limits the access to her code (resp. binary) to qualified members (i.e. having competences in Android/Java) that have reputation higher than 0,7 (resp. 0,6). As a member of the GAC, Alice is also obliged to comply with the model used by the community and must rely on identity (e.g. PGP keys) as an additional trust criterion.

Scientific Virtual Community:

Bob is a PhD student in the LSTI lab. He is also member of the ePub Community where he can exchange with the other members scientific articles. Bob is disposed to share his articles only with student members having a good reputation (higher than 0,6). The ePub community members are copyright conscious and agreed that they must respect the publishers policies while sharing articles. Thus, articles access is granted only to the members that are authorized by the publisher of the article.

Open Innovation Community: Hypios is a new open innovation

platform whose users form a widespread community. Hypios proposes a showcase for R&D problems to which the community members try to find a solution and earn money for that. Carol, as an avid passionate of challenging problems, joined recently Hypios. She first managed to solve individually some simple problems but for the actual one she requires the help of some mathematicians. She created a group in order to solve collaboratively the problem and share the reward. Carol restricts the access to her group to members with mathematic backgrounds and a reputation of at least 0,7. Moreover, some problems are sensitive and the access to their description should be protected by respecting both Hypos and companies trust requirements. For instance, in order to exclude malevolent members, Hypios indicates to it's members the least tolerated value for the reputation. Thus, members reputation threshold must be at least equal to the advocated value (e.g. 0.6).

Each of the above scenarios highlights a number of interesting characteristics that should be addressed by modern trust management models. We focus here principally on three of them that we consider as central in our approach:

1. Subjectivity: Virtual communities, as the one presented above, are highly dynamic environments where no generic interaction pattern could be identified. Each specific interaction requiring trust establishment is different and will need specific set of trust requirements. We think that an efficient trust model should not neglect any trust factor in order to enable the user to protect himself in any circumstance.

Example 1 Alice, Bob and Dave expressed differently their trust requirements characterizing the subjectivity of trust 1. Dynamicity: Trust perception is not static and changes depending on the situation. However, we think that trust dynamics is not solely due to perception changes but also to how these perceptions are managed. In other words, not only trust the set of used trust factors varies, the variation comes also from how they are used and aggregated. Thus, trust models should be malleable at will.

Example 2 Carol received three requests to join her group from, respectively, Dave (Rep = 0,75), Paul (Rep = 0,60) and Walter (Rep = 0,65). She accepted Dave's requests and refused Paul's and Walters ones. After refusing Pauls and Walter's requests due insufficient reputation, Carol was worried about the success of her objectives, as she still requires the collaboration of some mathematicians. she decided then to reduce the reputation threshold to 0,65 and finished by accepting Walter too. The dynamic of her evaluation is not due to the input information she used that remained unchanged, but its related to her perception of the environment that led her to change the way she considers these information (e.g. As the community is new, she considers that 0,6 is a fair value while she still respect the least tolerated value advocated by the community).

Social-Context Awareness:

Trust is closely tied to beliefs, values, traditions, and norms of the society. The social dimension of trust received considerable attention recet year but wasn't completely explored leading to closed trust models (i.e. insensitive to social influences). We think that, like all our practices, trust is highly influenced by the social context we belong to. This influence may be strict such as the law that obliges a person to let a policeman enter his home, but in most of case is seamless and constitute a kind of inspiration.

Example 3 Both Alice, Bob and Dave integrated social trust requirements along with their individual ones for the trust assessment.

Desiderata

Our study of the above use cases led us to identify three important requirements for trust management within virtual communities. these requirements should be considered as an extension of the more traditional requirements for trust management that has already been raised in the literatures [START_REF] Seamons | Requirements for policy languages for trust negotiation[END_REF][START_REF] De Coi | A Review of Trust Management, Security and Privacy Policy Languages International Conference on Security and Cryptography (SECRYPT 2008)[END_REF]. Thus, in this report we are more interested in :

1. Identifying essential trust factors (i.e. sources of information) based on wich VC members could build trust. We are particularly motivated by stressing the importance of two kinds of factors that are widely used in human societies: hard trust and soft trust factors [START_REF] Jøsang | Foundations of security analysis and design iv. chapter Trust and reputation systems[END_REF], where hard trust factors represent information derived from security mechanisms such as keys, credentials and certificates, whereas soft trust factors encompass information that are inferred from experience and observations of others.

2. Specifying how these factors are aggregated in trust assessment. A lot of works tried mimic humans behaviour by capturing the subjective aspect trust evaluations. Nevertheless, in most of the cases, the subjectivity refers only to some kind of variations in the inputs/ outputs of the trust evaluation mechanism. Further, a direct implication from the previous point, which is stressed here, is the importance of models heterogeneity which may exists from a community member to another and even from a community to another. This heterogeneity implies the coexistence of different trust models within the same environment. The question that arises here is how community members deal with such heterogeneity when they have a fixed trust model. In other words, do they need to use always the same trust model regardless of the partner, the community or the situation? For instance, what could an individual with an exclusively reputation-based trust model do when he moves from collaborative and altruist community to a dishonest and selfish one? Thus, trust models are fare to be inert. they are in fact perpetually re-shaped to fit newly considered trust criteria. None of the cited works address this dynamic aspect of trust models where the set of used trust factors; the required values and their weight within the trust assessment are constantly reconsidered.

3. Studying the co-influence of individual trust models on collective ones and vice-versa. A trust model reflects minimal conditions an entity requires in order to grant trust to another entity. These entities are either atomic and represent individuals (e.g agent) or aggregated and represent social structures (e.g. communities). The influence of the community on the individual as the influence of the individual on the society has already been studied for general decisionmaking process. However, to the best of our knowledge, no work tried to address the effect of such co-influence in regard to trust practices. Indeed, on one hand, the community to which we belong considerably affects our trust decisions as the way we are evaluating trust. On the other hand, collective trust requirements constitute an image of individual practices leading to a mutual influence between the individual and the social trust mechanisms.

Foundations

In this section, we describe the basic foundations and concepts on which the proposal is built.

System Overview

The system model (cf. Fig. 1) represents a multi-agent system S which is defined by S = C, A, R, O, I, F . Where C is a set of communities c, A is a set of agents a, R is a set of resources r, O is a set of operations o, I is a set of interactions ı taking place between agents and F is an ontology of trust factors f among S.

Definition 1 (Communities) Agents from S with common interests join together to form communities wherein they engage in frequent interactions. Each community is governed under a set of social policies that describes minimal conditions community members must use in their trust assessment. ∀c ∈ C, c is represented by ε C c , Π c where: ε C c is unique identifier and Π c is the set of social policies.

Example 4 With respect to the motivating scenario. The Android Developers platform DevCo constitutes the system wherein each project represents a community. For instance, c is a community by the agent Bob. a , κ a , ω a , β a , ψ a , T P a , where, ε A a is the agent's unique identifier, κ a ⊆ 2 O is the set of operations that a can perform (i.e. capabilities ), ω a ⊆ 2 R is the set of resources under control of a, β a ⊆ 2 O are communities a belongs to, ψ a ⊆ 2 R×2 O ×2 O are rights agent a acquired that state which operations a is allowed to perform on each resource, and T P a is set of trust patterns and ∀tp ∈ T P a , tp = p a ∪ p c ∪ ∈ MP a where p a ∈ π a is and individual policy among the set π a of all individual policies that has a, p c ∈ Π c is the social policy of the community to which a belongs (i.e. the community c), and M(p a ) is a set of meta-policies over the policy p a Definition 3 (Resources) Resources are passive artefacts in S on which operation can be performed. ∀r ∈ R, r is represented by ε R r , τ r , ς r where: ε R r is its unique identifier, (ii) τ r represents its type, τ R ∈ {object,service,data, credential} and ς r qualifies its sensitivity, ς r ∈ {private, public}. Public resources could be manipulated by any agent without restrictions, while private resource manipulation is limited to trustworthy agents and requires permission from an agent controlling them.

Example 5 Bob considers online-demo as service, the binary of the application as an object, its source-code, the documentation wiki and the discussion boards as data while the members' electronic addresses and their PGP keys represents credentials. All these resources are private except the discussion boards that are public. Definition 4 (Operations) Operations represent the actions agents are able to perform on a resource. Without loss of generality, we can classify operations into types. ∀o i ∈ O, o i ∈ τ O = {access, retrieve, alter, release, grant ,release, delegate}.

Definition 5 (Interactions) Interactions are message exchanged between agents. Each interaction ı ∈ I is defined by a s , a t , τ ı , θ , where a s , a t are respectively the source and target agent of the message, τ ı ∈ {request, inf orm ,reply} is the interaction type and θ the content of the message and θ ∈ R. Our focus will essentially be on requests where each request concerns a specific type of resources τ r (with r ∈ R) and a specific type of operations τ o (with o ∈ O). An interaction starts when an agent a r ∈ A (called the requester) sends a request to another entity a c ∈ A (called the controller) asking him permission to preform an action on a private resource a c controls.

Definition 6 (Permissions) A permission issued from an agent a c to an agent a r is a declaration stating which rights a c possesses with respect to a specific resource r. Permissions are defined by a c , a r , r, O + , O -where a c , a r ∈ A are, respectively, the issuer (i.e the controller) and the recipient (i.e. requester) of the permission, while O + , O -∈ O are, respectively, sets of allowed and forbidden operations over the resource r. Now that the system model been introduced, we will describe how trust is built within such system by introducing our Trust Model.

Trust Model outline

Figure 2, illustrates our operational model for building trust and gives a temporal vision about interactions between required concepts and the process handling them. This model is used to be implemented by each agent a of the system S.

Model description

Within the model, agent a evaluates the trustworthiness of a requester b (where a, b ∈ A) based on a trust model resulting from the combination of its individual trust requirements and the social ones. Both requirements are concretely represented by use of trust policies. Individual policies (π) constitute the agent's requirements in regard of according trust. These 3). Social policies (Π) represent trust requirements imposed by the community (c here). They are used to ensure minimal trust level for each interaction undertaken within the community. Meta-policies (M(p)) enable the user to specify how its individual policies p could be adapted in order to handle specified events. Trust Patterns (T P) have been introduced in the model in order to reduce complexity and handle properly each type of request. In fact, as already mentioned, requests are categorized into types and each request r is mapped into a unique type τ r . Thus, the model enables, for instance, the agent a to associate to each type t ∈ τ r ⊂ (τ O × τ R ) an individual policy p t a , a social policy p t c relative to the community to which a belongs and a set of meta-policies M(p t a ) in order to adapt his individual policy p t a . Trust patterns (T P t a ) constitute an elegant way to structure and encapsulate policies and meta-policies based on the request type they handle. Thus, trust patterns reduce the complexity when specifying and managing trust policies while limiting the aftereffect of an error when updating a policy. As depicted above, only the appropriate trust pattern is selected and used avoiding accidents. Context information are captured by meta-policies and handled by triggering policies adaptation. In our approach we principally used, but are not limited to, the social and individual contexts. Social Context (SC) has a great influence on trust decisions, whether the context is highly competitive or cooperative, different trust requirements can be formulated affecting the way decisions are taken. This model enables agents to make context-aware trust decision based on such indicators. Thus, information such as the number or agents are proposing the same resource (#providers) or the number of agents looking for it (#requesters) constitute good examples of such social context information. Personnal Contex (PC) are indicators agents uses for adapting individual policies in order to fit user (i.e. represented by the agent) requirements. Whether the requested resource is extremely sensitive or its realease is highly rewarding, such information gives the agent indicators on what to focus on: protecting the resource or releasing it. Concretely, in the model, the individual policies are regularly weakened on strengthened basede on risk and reward information for each resource and stated within the user preferences.

Example 6 (Context) Bob is exlusively proposing a new performance testing service for Android phones. As his service is sensitive to denial-of-service attacks, he is using a policy that regulates the access to its service based on users' past behaviour. He fixed a bad-experience threshold to zero in order to exclude agents that misbehaved at least one time by making abusive use of his service. However, bob is also conscious that the community is open and at each moment new agents may propose the same service, he is also sensitive to the number of agents using his service. For that, his decided to enable policy adaptation based on his social context.

Model features

The model outlined above offers three interesting features that, we believe, deserves to be highlighted: it is rich, dynamic and combinative (i.e. socially compliant). (i) Richness is relative to the subjectivity and the multidimensionality of used trust factors in order to build trust. (ii) Dynamic refers to the fact that it is constantly reshaped as it is illustrated in the figure wherein individual policies evolve over time by integrating individual preferences, social context and social policies. Finally (iii) the model is combinative in the sense that for each trust decision, the social requirements in regard trust evaluation are integrated to individual ones leading to versatile and socially compliant trust model. The combination of these features enables agents to benefit from a more realistic trust model where they can build, reshape and combine trust requirements at will.

Trust Factors Ontology

In the model characterized above, the trust model represents a specification of trust factors aggregation function. For that, the Trust Factors Ontology (TFO) (see Fig. 3) is central to our approach. It is used to capture and represents essential requirements that constitute the basis for establishing trust between agents.

Toward semantically enabled trust models

According to [START_REF] Gruber | Toward Principales for Design of Ontologies Used for Knowledge Sharing[END_REF], an ontology represent a specification of a shared conceptualization. The conceptualization refers to the choices on the way to describe a domain (e.g. trust requirements), the specification represents its formal description, while shared means that these conceptualization specification is shared among the members of a system. Ontologies are particularly interesting for modern trust management within virtual communities (and multi-agent systems as well) for several reasons. (i) First, in order to establish trust, a requester is required to provide some specific information that satisfies the controller trust requirements. These information and their semantics should be unambiguous and shared among agents of the system. Second (ii), agents within a community are asked to combine social trust requirements with their individual ones. Such combination would not be possible without a common description of these requirements. (iii) Further, agents who newly joined community may also need to discover what kinds of requirements they could use and which values they should accept for their trust assessment, the need for a semantically rich description of the trust factors arise again here. Also (iv), the structure representing trust requirements should extensible as new requirements could/should be added at need. Finally, in virtual communities where individual is constantly reshaped by social influences, ontology is crucial for agents with different trust models in order to communicate and share trust information (e.g. reputations and experiences). Therefore, the need for a formal, semantic and extensible representation of trust factors is leading the ontologies to be preferred to other representations.

TFO description

Different from existing ontologies [START_REF] Anantharam | Trust Model for Semantic Sensor and Social Networks : A Preliminary Report[END_REF], TFO concepts are derived from literature review and analysis of existing trust models (see section 2). Most of these models, however, emphasize some factors and abstracts away others, while it is assumed that the integration of various factors provides agent with optimal set of trust requirements [START_REF] Manchala | E-commerce trust metrics and models[END_REF]. Therefore and as outlined in section 2, the Trust Factors considered in the TFO as sources of information for trust evaluation are not limited. We refer instead to any factor that may be pertinent for trust evaluation. In this way, doors remain wide open for any sources of information for trust decisions to be further added.

Definition 7 (Trust Factor

) A trust factor f i ∈ F is a tuple (τ f , ∆ f )
where τ f is the type of the f i and ∆ f its domain (i.e. the set of values f i can take). The whole set of trust factors types (τ f ∈ F) is hierarchically structured and forms the Trust Factors Ontology, as illustrated in Figure 3. The first level Figure 3: The Trust Factors Ontology root concept represents a generic trust factor type, it is further divided in two sub-types proofs and indicators: proofs represent all digitally signed statements, while indicators include the set of all possible facts stored internally or gathered from external sources. Even if they are impossible to check and may be subject to tempering, proofs are valuable hints for trust evaluation in many situations (e.g. when no certification authority exists). For simplicity reasons, we're considering in our ontology, identities, authorizations, and certified properties as proofs, while experience (direct and indirect) and reputation (direct and indirect) are considered as indicators of trust.

Example 8 (proofs and indicators) In the running example, agents are using PGP [START_REF] Abdul-Rahman | The PGP Trust Model[END_REF] model for the identities management, Authorizations represent permissions controllers' issues and two types of properties are considered, skills and familiarization (e.g. how an agent is skilled in Java and how much he is familiar with Android applications).

TFO features

As the domains ∆ f of trust factors values are quite heterogeneous (i.e. sets and intervals), and in order to be able to use the same management mechanism for each f i ∈ F, we defined a relation hasStrength : f i → l, where l ∈ L is a level representing f i 's strength. While the levels can be as finely grained as desired, we adopte the set of levels L = {V eryLow, Low, F air, High, V eryHigh}. With the same mechanism function hasImpact : f i → N * is defined in order to associate to each f i an impact value representing its weight among the trust decision.

Definition 8 (Trust Criteria and Trust Information) When f ∈ F is used to express a trust requirement we call it a trust criterion (T C). When f is used to state (realease or gather) an information used in order to fulfill a T C, its called a trust Information (T I).

The ontology F is used within the model (cf. Fig. 2) in three different ways. (i) For policies specification where τ F are used as types and the l ∈ L as thresholds for restrictions; (ii) for policies adaptation where F offers values ordering agents refers to in order to strengthen or weaken their policies; and (iii) while combining individual and social policies where it offers referential values set for choosing the most restrictive policy. Mapping each f i ∈ F enables agents (if needed) not to care about heterogeneity of values and to express trust critetia at abstract level, while being able to map such abstract values with concrete ones at will. These criteria are then checked in comparison with acquired trust information.

Example 9 (Trust Criteria and Trust Information) Agent a wants to limit the access to the online demo of his service to requesters having a reputation of at least +0.6. a states then T C = (Reputation, +0.6) and when he receives an access request r of type τ r = (access, service) from an agent b, in order to check whether b satisfies his criterion he needs to acquire a trust information about b's reputation. Hence, when a acquires T I = (reputation, +0.8) about b he considers that his, quite basic, trust requirement is satisfied and may decide to issue the permission (a, b, {access}, {}).

Trust Policies

The trust model represents a specification of trust factors aggregation function. This function is expressed through trust policies, wherein restrictions on types, acceptable values and weights of trust factors are stated (i.e T C expression). This section presents how the previous trust model is concretly expressed in order to implement the semantic of rich, dynamic and combinative trust. It introduces the policy language formalism and describes how policies and Meta-policies are expressed using that formalism. Definition 9 (Policies) Let P = (π ∪ Π) be the set of all policies where π and Π are respectively the sets of all individual and social policies within the system S. ∀p ∈ P = (π ∪ Π), p ∈ 2 τ F ×ℵ×N where ℵ is either a level l ∈ L or a value v ∈ F.

Expression formalism

Besides its expressivity and ease-of-use, the required formalism to represent policies must be flexible enough to allow adaptation and combination of policies by adding, removing and updating trust criteria. In order to address such requirements, we adopted first-order predicate structures in order to represents policies. These policies are represented using programming language Prolog is especially interesting as it is declarative and can express a wide range of constraints [START_REF] Bonatti | Regulating service access and information release on the web[END_REF]. For meta-policies, Jason [START_REF] Bordini | Semantics for the jason variant of agentspeak[END_REF], an extension of AgentSpeak [START_REF] Rao | AgentSpeak ( L ): BDI Agents speak out in a logical computable language[END_REF] (Prolog extension for BDI architectures) has been used. This language offers better practical programming features enabling the combination of declarative and procedural approaches. The most interesting issue in representing meta-policies with this language are plans.

Representing policies

Policies are represented as a set of T C. Now, let T = {tc 1 , tc 1 , ..., tc n , } be a set of trust criteria. Each tc i , (i ∈ [1, n]) is a triplet τ i , ℵ i , w i . τ i corresponds to existing trust factors τ f ∈ F, ℵ i is a threshold value or level from among possibilities, while w i ∈ N * represents the weight of the tc i . Let p t a = {tc 1 , tc 2 , ..., tc m } be the policy used by the agent a ∈ A associated to the request τ r . The policy is assimilated to a function f (r, l) = f (p t a ) that evaluates the trust level l relative to an instance request r ∈ I of type t. Then :

f (p t a ) = m i=1 f (τ i , ℵ i , w i ) m i=1 w i (1)
Where f (τ i , ℵ i , w i ) ∈ [0, w i ] is the weighted evaluation of the constraint ℵ i satisfaction on the criterion of type τ i . Relative importance assigned to each trust criterion is modelled as the weight w i of a criterion within the policy. Each criterion is then evaluated and returns one [START_REF] Abdul-Rahman | The PGP Trust Model[END_REF] or zero (0), respectively, whether the criterion is fulfilled or not. This result is then multiplied by the w x which is the weight associated to tc i and returned by f . This policies representation is used to represent both individual and social policies. ∀p t i ∈ P, if i ∈ A then p t i is an individual policy and belongs to π, if i ∈ C then p t i is social policy and belongs to Π.

Example 10 (individual and social policies) Let r = (alter, object) be a request type. The individual policy agent a uses in order to issues permissions for requests of type r is stated as follow: p r a = { identity, trusted, 2 , reputation ,High, 1 }. While community c to which a belongs obliges its members to use the following policy in handling requests of type r : p r a = { identity, V eryHigh, 3 , reputation, +0.5, 1 }.

Representing Meta-policies

As mentioned in previous sections, meta-policies state how a policy could be changed to handle a specific context. The meta-policies presented in this report are specified by means of AgentSpeak plans. Plans could be described by means of an informal pseudo-code under which each plan is a sequence of event-condition-action rules of the form: U pon event : If condition ← Do action where event represents a triggering events, condition is a general expression, typically a conjunction or a disjunction of literals to be checked before the execution of the plan. Conditions filters defined over the social context, the agent preferences, the requester or the requester resource, while the action is one or more adaptation actions specified by the agent in order to adapt its policy. The key feature in using Jason plans lies in the possibility to execute legacy code through internal actions. In this work, we use internal action to execute adaptation operations presented in our trust model (for more details on AgentSpeak plans see [START_REF] Rao | AgentSpeak ( L ): BDI Agents speak out in a logical computable language[END_REF]). The result of the execution of each meta-policy affects the original policy by adding, removing, changing restricting or relaxing one or more trust criteria. The adaptation process will be described with more details in the next section.

Example 11 (Meta-policies) The agent a is particularly vigilant in regard to the number of agents using his service and the risk associated to such use. He wants then to express adaptation meta-policies in order to adapt dynamically his policy depending on this information. Let r be an access request on the service andro, where τ t = (access, service) and p r a be the policy a uses to handle such request from an agent b. Meta-policies he may state are as follow: Adapt(p r a 1 , a 2 , andro) : N umber(users, X)&T hreshold(users, Y ) ∧ (X < Y ) ← .relax(reputation). Adapt(p r a 1 , a 2 , andro) : Risk(randro, X)&T hreshold(risk, X)∧(X > Y ) ← .restrict(reputation), .add( "identity", "T rusted", 3 .) The first meta-policy lowers the required reputation value depending on the users amount while the second increases it and adds an identity creteria when the risk is over a certain threshold. Both meta-policies has been express using Jason plans.

ASC-TMS : An Adaptive and Socially Compliant TMS

This section presents essential components of our Socially Compliant Trust Management System (ASC-TMS) that assists agents (each agent is equipped with a personal ASC-TMS) in their trust decision-making process. ASC-TMS is an on-going project that implements the adaptive and combined trust model presented in this report.

Framework design

The abstract architecture depicted in Figure 4, illustrates our proof-ofconcept implementation. We use the JACAMO platform [START_REF] Ricci | [END_REF] to leverage the requirements discussed earlier while preserving the generality of the approach. The architecture is essentially composed by five main modules and each modules is responsible of a specific operation.

As the principal objective of the framework is the management of trust policies by realising the operations presented within the model, we decided to present the framework in respect to its functional features rather then describing the components. The focus will be on essential operations while the others will be briefly described. Selection (1-4) operations are realised by the Trust Broker module where the appropriate trust pattern to each request is retrieved from the Patterns Manager based on a mapping matrix ( τ q → τ O × τ R ) Management (3) realises the creation and the maintenance of TPs. It enables the user to specify for each request type, the individual policy and associated meta-policies. Social policies are automatically retrieved from the community and integrated to the TP. The maintenance is processed when one of the policies needs to be updated.

Function Combine(p µ,ρ a ,p µ,ρ c ) SP ← p µ,ρ c ; IP ← p µ,ρ a ; T P ← ∅ ; i ← 0 while SP = ∅ do foreach SP.tc x ∈ SP do if tc x .τ x / ∈ IP then T P.tc i ← tc x SP ← SP -{tc x } i ← i + 1 while IP = ∅ do foreach IP.tc x ∈ IP do if tc x .τ x / ∈ SP then T P.tc i ← tc x IP ← SP -{tc x } i ← i + 1 forall the tc x ∈ SP , tc y ∈ IP s.t. tc x .τ x = tc y .τ y do T P.tc i ← τ i , max(tc x .ν x , tc x .ν y ), max(tc x .w x , tc y .w y )) SP ← SP -{tc x } IP ← IP -{tc y } i ← i + 1 return SP Adaptation (5-7
) is carried out by the Policy Adapter which integrates five main operations : Add, Remove, Set, Relax, Restrict. Each operation implements an internal action that is triggered by a meta-policy. The Policy Adapter regularly updates its beliefs-base. When the condition of a meta-policy holds the plan is executed and specified actions are performed. Adaptation is then achieved by the execution of one or more of the following internal actions: .add( t i , ν i , w 1 ) : this action adds the criteria t i , ν i , w 1 tc i ) in the current policy. If another T C of the same type exists, a .set( t i , ν i , w 1 tc i ) is triggered otherwise. .remove(t i ) : the actions removes all T C of the type t i . t i is either a specific type as the identity or a general one such as proofs or indicators. .set( t i , ν i , w 1 ) : this action affects t i and ν i , w 1 , respectively, to the strength and the weight of the T C of type t i in the current policy. If such T C does not exists, an .add( t i , ν i , w 1 ) is triggered.

.restric(t i ) / .relax(t i ) : These two actions are quite similar. When no parameter is given, all T C of the policy are affected by the action. Otherwise only the specified trust criterion is affected. This action checks the TFO for a lower (resp. higher) value for the specified TC. If such value exist, a set with the new value is called other wise the weight of the T C is lowered (resp. incresed). If the weight becomes null, the T C is removed.

Combination (8-9) consistes in combining the individual policy along with the social one.

Definition 10 (Combining Policies) Let P a be the policies set of the agent a, ∀p a ∈ P a , p a is dedicated to a specific request type τ q ⊂ (τ O × τ R ). Let t ∈ τ q , p t a is the policy the agent a generates to handle a request of the type t = (µ, ρ) within the community c and p µ,ρ a ∈ π µ,ρ a , p µ,ρ c ∈ Π µ,ρ c are, respectively individual and social policies set dedicated to the request type t. p t a = p µ,ρ a ⊕ p µ,ρ c means that the policy p t a is obtained by combining p µ,ρ a , p µ,ρ c while p t a the resulting policy is at least as restrictive as p µ,ρ a ∪ p µ,ρ c

When the policy combiner receives the policies to be combined. It executes the heuristic sketched above (cf. Combine). Evaluation (10-12) is realised by the Policy Checking module. This part of the framework behaves as basic Trust Management System in a way that it evaluates the policy satisfaction by confronting policy T Cs to received and/or gathered T I. When this agent receives a policy to check [START_REF] Herzberg | Access control meets public key infrastructure[END_REF], and after parsing it, it identifies the types of the T C. Proofs are requested from the Proofs Manager [START_REF] Jøsang | Foundations of security analysis and design iv. chapter Trust and reputation systems[END_REF], while indicators are collected by the indicators manager (11'). When all T Is has been received, the module executes the function described in the previous section (cf. section 4.2) in order to compute all verified T C. The final result is a quantitative evaluation stating the amount of satisfied criteria out of the initially formulated ones.

Conclusion And Future Works

We introduced in this report the notion of social compliance for trust management within virtual communities. In order to realize it, we developed a rich, dynamic and combinative model that mimics trust features (i.e. subjectivity, dynamics and context awareness) and preserves real world semantics of trust. We began by exploring and isolating commonly used trust factors from the literature in order to enhance subjectivity. We outlined then a new trust model where individual requirements are adapted and merged with social ones. The originality of this proposition lies in the use of dynamic and adaptive trust policies (and meta-policies) in order to capture and represent the dynamisms of trust. Finally, we made the first steps towards designing a Socially Compliant Trust Management System (ASC-TMS) based on Multi-agent technologies. The next steps in our work include extending the model in order to integrate individual trust requirements (policies) into social ones. The idea would be to study how agents may influence / trigger adaptation or evolution of social policies. We also plan to investigate mechanisms to automatically build social policies from individual ones. Such feature is particularly interesting for decentralized and self-organized communities like social networks (diaspora for example).

Figure 1 :

 1 Figure 1: System model overview

Figure 2 :

 2 Figure 2: The Trust Model

Example 7 (

 7 Trust Factor) (reputation, +0.6) and (identity, "T rusted") are examples of trust factors used by DevCo are using.

Figure 4 :

 4 Figure 4: ASC-TMS Framework Architecture


Christophe Pijolat

Guy Tournier
email: tournier@emse.fr

Jean-Paul Viricelle

Keywords: CO detection, PEM fuel cell, Hydrogen

CO detection in H2 reducing atmosphere with mini fuel cell

Christophe Pijolat, Guy Tournier, Jean-

I. Introduction

In the field of PEMFC, CO poisoning of platinum based catalyst which is used at the anode to dissociate H 2 , is now well known [START_REF] Uribe | PEMFC reconfigured anodes for enhancing CO tolerance with air bleed[END_REF] and [START_REF] Oetjen | Performance data of a proton exchange membrane fuel cell using H 2 /CO as fuel gas[END_REF]. CO strongly adsorbs on the Pt catalyst surface, causing a decrease of the available catalytically active Pt surface area for H 2 electro-oxidation. Nevertheless, H 2 is often produced by reforming process of various fuels with an unavoidable contamination of CO. Consequently, CO sensors are very important in order to monitor the purity of the reforming gas. The difficulty to find adequate CO sensors for these fuel cell applications is related to the absence of oxygen in the gaseous flow which, besides hydrogen, contains principally carbon dioxide and water vapor. Classical tin oxide based semiconductor sensors are not well adapted to work without oxygen because the detection principle is generally related to the reaction of reducing gas (like H2 or CO) with the adsorbed oxygen species. Moreover, the selective detection of CO in the presence of high concentration of H 2 is difficult because ceramic gas sensors are usually more sensitive to H 2 than to CO. Only a few articles are related to the detection of reducing gases in the absence of oxygen using semiconductor SnO 2 based sensors [START_REF] Tournier | Influence of oxygen concentration in the carrier gas on the response of tin dioxide sensor under hydrogen and methane[END_REF], [START_REF] Wurzinger | CO-sensing properties of doped SnO 2 sensors in H 2 -rich gases[END_REF] and [START_REF] Prasad | Microporous ceramic coated SnO 2 sensors for hydrogen and carbon monoxide sensing in harsh reducing conditions[END_REF]. CuCl or CuBr based sensing materials have also been used with success for the CO detection in reducing gases [START_REF] Reddy | Detection of CO in a reducing, hydrous environment using CuBr as electrolyte[END_REF]. Nevertheless, the difficulties seem to be connected to the high influence of humidity which is a key factor in fuel cell applications. Another promising solution proposed for such application is to use mini fuel cells (solid oxide fuel cell (SOFC) or PEMFC) and to follow the degradation of the fuel cell performances due to the presence of CO. In the case of classical SOFC, the use of a Pd metal based anode associated with a 20 mol % Sm 3+ -doped CeO 2 (SDC) as the electrolyte has been proposed [START_REF] Hashimoto | Solid oxide fuel cells that enable the detection of CO in reformed gases[END_REF]: the Pd anode was subjected to a large and reversible change in the anodic reaction resistance with the CO concentration. With the same type of material, a potentiometric sensor working with an electrode dissymmetry Au/Pt has been presented [START_REF] Pijolat | Detection of CO in H2-rich gases with a Samarium doped ceria (SDC) sensor for Fuel-cell applications[END_REF]: the originality of this sensor is that the two electrodes are placed in the same atmosphere without a reference cell; the difference of potential between the two electrodes (ΔV) is used as electrical signal. The response, defined by the difference between the ΔV value under carrier gas and the ΔV value under CO, is then correlated with the CO concentration (0-400 ppm). Several articles concern the use of a mini PEMFC as CO sensor for fuel applications [START_REF] Kirby | Detection of low level carbon monoxide in hydrogen-rich gas streams[END_REF], [START_REF] Mukundan | A low temperature sensor for the detection of carbon monoxide in hydrogen[END_REF], [START_REF] Planje | A two-electrode sensor cell for CO detection in a H 2 -rich gas[END_REF] and [START_REF] Bhambare | A carbon monoxide sensor in polymer electrolyte fuel cells based on symbolic dynamic filtering[END_REF]. For Kirby et al. [START_REF] Kirby | Detection of low level carbon monoxide in hydrogen-rich gas streams[END_REF], the closed cell potential of the mini PEM is a function of the current and anode polarization resulting from CO poisoning; if one further maintains the closed cell potential at a fixed value, the current through the cell becomes a single function of the CO poisoning and thereby can be used as a signal for detection. These authors show that reducing the Pt concentration of the Pt/carbon paste used for electrodes was found to increase the CO sensitivity: with a Pt/carbon paste where [Pt] = 0.005 mg cm -2 the measure of low CO concentration (50 ppm) could be attained within 2.5 s but air recovery is necessary to return the output current to its initial value. Mukundan et al. [START_REF] Mukundan | A low temperature sensor for the detection of carbon monoxide in hydrogen[END_REF] use a PEM type sensor with Nafion ® as electrolyte and two different metal-based electrodes which function as an amperometric sensor: one Pt electrode serves as the sensing electrode whose current density is affected by the CO adsorption whereas the other electrode, made with a Pt-Ru alloy, is quasi unaffected by the presence of CO. The sensor configuration is considerably simplified because the two electrodes are in the same atmosphere and stable response is obtained at 10-1000 ppm of CO. Planje et al. [START_REF] Planje | A two-electrode sensor cell for CO detection in a H 2 -rich gas[END_REF] use a two-electrodes chemical cell with a proton-conducting polymer as electrolyte: the anode (low Pt loading) is exposed to the gas flow while the cathode (high Pt loading) is immersed in water to retain the polymer conductivity. The cell cycles continuously through two potentiostatic modes, the clean-up mode (V anode > 0.6 V) where CO and H 2 are oxidized and the measurement mode (V anode < 0.6 V) where CO is only adsorbed; this sensor is able to detect CO concentrations (1-500 ppm) in H 2 -rich gas mixtures. A small fuel cell fuelled by diverted stream of reformate is also used by Bhambare et al. [START_REF] Bhambare | A carbon monoxide sensor in polymer electrolyte fuel cells based on symbolic dynamic filtering[END_REF]: in this case, the CO level is determined through time series analysis of the dynamic current response of the sensor cell due to load oscillations. In this work, we propose to use a mini PEMFC developed by the CEA to detect CO concentrations (0-4000 ppm) in a simulated reforming gas with H 2 (5%), N 2 , H 2 O and eventually CO 2 . Working modes have been optimized in order to detect low (≤20 ppm) or high (up to 4000 ppm) CO concentrations.

II. Experimental

I II I. .1 1. . D
De es sc cr ri ip pt ti io on n o of f t th he e m mi in ni i f fu ue el l c ce el ll l s se en ns so or r The prototype used in this study has been developed by the Laboratory of Components for PEM fuel cell -Electrolysis and Modeling (LCPEM) of CEA/LITEN at Grenoble. This laboratory has a very high expertise and much experience in the field of fuel cells developments, including mini fuel cell studies. The prototype of miniaturized PEMFC contains a membrane-electrode-assembly (MEA) composed of two 1.5 cm 2 commercial gas diffusion electrode (BASF LT140 EWSI, 0.5 mg Pt cm -2 loading) hot pressed at 135 °C and 4 MPa on a Nafion ® 212 membrane [START_REF]Composite basic element and its seal for fuel cell and manufacturing process for the assembly[END_REF]. It is a self breathing PEMFC that could be placed directly on line in the gaseous flow (anode side), while the second electrode (cathode) is simply exposed to ambient air. The prototype is presented in Figure 1. The MEA is inserted between two chambers, each of them containing a 2 mm thick porous sintered PTFE disc and a 0.5 mm thick gold mesh used as current collector. I II I. .2 2. . T Te es st ts s c co on nd di it ti io on ns s The sensor prototype has been tested on a laboratory gas bench. This bench is equipped with mass flows which allow controlling the concentrations of different gases in the carrier gas.

Hydrogen, nitrogen, carbon dioxide and carbon monoxide, pure or diluted in synthetic air, are conditioned in gas cylinders and present a high degree of purity (Alphagaz 1 quality of Air Liquide). For the present study, the carrier gas is generally a simulated reforming fuel mixture composed of H 2 diluted in N 2 (5%), with CO 2 (1.9%) and H 2 O (1.8%) as additional components. The humidity level is obtained by bubbling (except CO 2 ) in a H 2 O bottle with a thermostatically controlled temperature. The presence of moisture is essential to prevent drying of the Nafion ® membrane which degrades the performance of the sensor and leads to unusable results. For security reasons during the laboratory tests, the H 2 level is limited to 5% but similar results have been obtained with higher concentrations of H 2 (up to 20% H 2 in N 2 ). The concentration of O 2 in the gas mixture, measured by various O 2 probes, is still less than 50 ppm. Two different ranges of CO concentrations have been studied. One (from 2.5 to 20 ppm) concerns particularly the normal low temperature PEMFC which are poisoned by low traces of CO, and the other (from 250 to 4000 ppm or more) is representative of reforming gas and well adapted to the monitoring of high temperature PEMFC that are resistant to higher levels of CO. The control of the test bench is provided by the Labview software. Finally, all tests were performed at room temperature in the range 20-25 °C. The miniaturized fuel cell has been built with two 1/4″ gas tubes: these tubes are connected to the anode side and are used for the inlet and outlet of the reforming gas. The second chamber of the sensor (cathode side) is equipped with a metal grid allowing the contact of the cathode directly with the ambient air. In the case of classical experiments, the signal from the mini PEMFC is first stabilized in the carrier gas and injections of increasing concentrations of CO are performed. Each injection is followed by an exposure to the carrier gas of varying duration that depends on the reversibility of the phenomenon. If the initial value is not recovered, the carrier gas is replaced by pure synthetic air in order to regenerate the sensor. The gas flow is maintained at 6 l h -1 throughout the test. As with conventional fuel cells, different working modes can be proposed. On one hand, an external loading resistor (R) can be placed in the electrical circuit. The value of R varies between 1 and 10 6 Ω. In these so-called amperometric (for R ≤ 10 3 Ω) or quasi-potentiometric (for values of R ≥ 10 4 Ω) modes, the ongoing performances of the mini PEMFC (voltage, current and possibly power) are followed depending on the nature of gas and in particular the presence of CO in the reformate. On the other hand, the open circuit voltage (OCV) which corresponds to the maximum voltage delivered by the cell is measured at zero current (without load resistor): this mode of operation is the so-called potentiometric or OCV mode. Results of the electrical measurements have been obtained by a data acquisition system by using the Delogger software.

III. Results

I II II I. .1 1. . A

Am mp pe er ro om me et tr ri ic c m mo od de e The first experiments were conducted with amperometric mode by using low load resistors. For a value of load resistor of 10 Ω, the cell voltage (ΔV) developed at the terminals of the mini PEMFC is around 530 mV. When a level of 50 ppm of CO is introduced into the gas mixture, the value of ΔV falls sharply to approximately 75 mV. After removal of CO, the signal does not reach its original value even after 3 h. The entire reversibility can be achieved only by regeneration in air, i.e. replacing the carrier gas by pure synthetic air. These results are shown in Figure 2 with a period of air recovery of 1 h. We will see later that the period of regeneration may be reduced to 5 min or less (about 1 min). Similar results are obtained with load resistors of less than 10 Ω. The results reported in Figure 3 are obtained with a load resistor of 1 Ω and CO levels ranging between 2.5 and 20 ppm. In this case, the initial value of ΔV before the injection of CO is close to 60 mV. We see first that the signal appears very quickly saturated because the value of ΔV drops to only a few mV at 10 ppm CO. In addition, the reversibility after 1 h in the absence CO is very poor and this leads to a progressive decrease in the ability to detect increasing injections of CO with this operating mode (see Figure 3a). However, if a regeneration of 5 min (or less) in air is performed, we find that ΔV recovers its original value before the next injection of CO (see Figure 3b). Under certain experimental conditions, it is nevertheless possible to follow changes in CO content around a mean value without any air regenerating (as it will be mentioned later in Section IV). Some experiments were also conducted with the load resistor higher than 10 Ω. The results obtained for a load resistor of 1000 Ω are shown in Figure 4. Firstly, we note that the initial value of ΔV is, as expected, much higher than in the previous cases since it is close to 700 mV. Furthermore, we see that the reversibility of the signal is almost complete 1 h after removing the CO gas flow. The regeneration step under air did not seem absolutely necessary in this case. Moreover, increasing the load resistor decreases CO response but also increases the response time. In some cases (low CO content and/or high load resistance), the total response is still not obtained 1 h after the injection of CO (see Figure 3 and Figure 4). To obtain quantitative information, the relative response Rr (expressed in percent) is represented by the following expression:

1 0 r 0 R 100% t h t t V V x V              (1)
where ΔV t = 0 and ΔV t = 1 h represent the values of ΔV at the time of injection of CO and 1 h after CO exposure, respectively. According to the definition of R r and taking into account that ΔV t = 1 h is less than ΔV t = 0 , the maximum value of R r is obviously equal to 100. The results obtained for the levels of CO between 0 and 20 ppm and for values of load resistor between 1 Ω and 1000 Ω are shown in Figure 5. By the way of comparison (see below), the observed results without load resistor (potentiometric (or OCV) mode) are also plotted on this Figure 5.

On one side, we confirm that the relative response appears very quickly saturated (from 10 to 20 ppm CO) for low values of load resistor (1 or 10 Ω). On the other side, in the case of a high load resistor (1000 Ω for example), there is only a 20% response for 20 ppm CO, which augurs the possibility of detecting higher levels of CO. However, the use of a low load resistor (e.g. 10 Ω) can be interesting to very quickly detect (in the case of alarm threshold for example) a high CO content (e.g. 1000 ppm) because the measured response time is then short (about 30 s for 50% response) as shown in Figure 6. I II II I. .2 2. . Q Qu ua as si i--p po ot te en nt ti io om me et tr ri ic c a an nd d p po ot te en nt ti io om me et tr ri ic c m mo od de es s If the load resistor increases more (10 4 -10 6 Ω), the supplied current is very low and the value of ΔV tends to a value close to 800-900 mV: this operation mode is so-called quasipotentiometric mode. In the absence of load resistor, the value of ΔV becomes equal to the open cell voltage (OCV): this operation mode is so-called potentiometric mode. As assumed above, these modes lead to a sensor able to detect high levels of CO. The results for CO concentrations ranging between 250 and 4000 ppm and for values of load resistor of 10 4 Ω and 10 6 Ω are reported in Figures 7a andb, respectively. In both cases, the injection of high levels of CO in the simulated reformate is reflected by large responses of the mini PEMFC. Furthermore the reversibility is virtually complete in a reasonable period of time and a step of regeneration in pure air does not seem absolutely necessary. Moreover, the value of ΔV obtained under high levels of CO remains almost stable during long-term injection (see Figure 7b, in the case of an injection of 4000 ppm CO for a period of 5 h). For the potentiometric mode, the results obtained for low levels of CO (between 2.5 and 20 ppm) confirm the low sensitivity of the device (see Figure 5). However, as in the case of the quasi potentiometric mode, this mode is useful for the detection of higher levels of CO: the results for CO concentrations ranging between 250 and 4000 ppm are reported in Figure 8. By the way of comparison, the obtained results with 20% H2 are also plotted on this Figure 8: it could be noticed that results are quite similar for 5 and 20% H 2 , but with a shorter response time for the higher H 2 content, especially for lower levels of CO (≤500 ppm).

IV. Discussion

The cell voltage (ΔV) is equal to the difference between the electrical potential V c of the cathode and the electrical potential V a of the anode. At the anode, the following reaction takes place:

2 2H 4H 4e    (2)
The protons then migrate through the Nafion ® membrane to the cathode where the following reaction takes place:

+ - 2 O +4H +4e 2H O  (3)
The overall reaction is then:

2 2 2 2H +O 2H O  (4)
In the case of open circuit voltage (potentiometric mode), V c is close to 1 V ( vs. SHE) while V a is equal to 0 V ( vs. SHE), being the standard potential.

The value of the cell voltage is then close to 1 V. As soon as the mini PEM delivers a current, this value decreases due to various phenomena such as the ohmic losses across the electrolyte material and the electrode over potentials. It can thus be observed that the value of the cell voltage, of about 920 mV in the case of the potentiometric mode (see Figure 8), decreases slightly (870 mV) for a load resistor of 10 6 Ω (see Figure 7b). When the current increases, this effect becomes more significant as the value of the cell voltage is close to 530 mV and 60 mV for values of load resistance of 10 Ω and 1 Ω, respectively (see Figure 2 and Figure 3). Another reason which may lead to a decrease in the cell voltage is the presence of CO in the gas stream. Indeed, at the anode, the CO adsorbs strongly on the platinum on the same sites as H 2 , which increases the effective current density and the anode polarization [START_REF] Farrell | Experimental and modelling studies of CO poisoning in PEM fuel cells[END_REF]: this leads to a decrease in cell voltage. In fact, this effect allows this mini PEM behave as a true CO sensor as shown in Figure 2, Figure 7 and Figure 8 as for example. Based on the results above presented, it seems that the detection performances are widely dependent on operating mode. For low values of R (10 ≤ R ≤ 100 Ω), the supplied current by the mini PEM (amperometric mode) is relatively large (up to 50 mA) and the cell voltage (V c -V a ) is of the order of 500 mV: in this case, there is a high relative response of the device since CO levels as low as 2.5 ppm can be easily detected (see Figure 5). The effect of adsorbed CO results in a rapid decrease in cell voltage whose value drops to a value of 100 mV or less. Under these conditions, the kinetics of the response is very fast (except for CO levels less than 10 ppm) since a response time (50% response) of 30 s is measured in the case of a load resistor of 10 Ω and a CO concentration of 1000 ppm (see Figure 6b). If, on the contrary, a large value of R (10 4 ≤ R ≤ 10 6 Ω) is selected, the supplied current by the mini PEM is very low (quasi-potentiometric mode); it becomes zero in the absence of load resistor (potentiometric mode). In both modes, the value of the initial cell voltage is high: it is equal to 750 mV or 920 mV for R = 10 4 Ω (see Figure 7a) or in the case of the potentiometric mode (see Figure 8), respectively. Moreover, the relative response decreases sharply (see Figure 5 in the case of the potentiometric mode) and CO levels below 20 ppm are very difficult to detect. However, levels of CO between 250 and 4000 ppm (or more) lead to large responses (see Figure 7 and Figure 8). For 250 ppm CO the response time is quite long but it decreases for higher CO concentrations: it is of the order of 75 s (50% response) in the case of the potentiometric mode and for a CO content of 1000 ppm (see Figure 8). Regarding the reversibility of the response, it may take place by oxidation or simply by desorption of adsorbed CO. The oxidation of CO can occur in the presence of water according to the following reaction:

2 2 0 o /H O E =1.23V + 2 0 H /H E =0 0 oxidant/reducer E [
- + 2 2 CO+H O CO +2H +2e  (5)
and results in an increase of the cell voltage related with the decrease of the anode polarization However, this reaction is only possible if the anode potential V a is higher than 600 mV vs SHE [START_REF] Planje | A two-electrode sensor cell for CO detection in a H 2 -rich gas[END_REF] and [START_REF] Papageorgopoulos | A voltammetry study of the influence of carbon dioxide on the hydrogen oxidation capability of carbon-supported Pt and PtRu anodes[END_REF]. In the case of amperometric mode (10 ≤ R ≤ 100 Ω) the cell voltage (V c -V a ) drops to an average of 500-600 mV in the absence of any trace of CO; this drop is largely due to the cathode over voltage [START_REF] Bernardi | A mathematical model of the solid-polymerelectrolyte fuel cell[END_REF] since the anode polarization is negligible under these conditions of cell operation. Assuming, like Kirby et al. [START_REF] Kirby | Detection of low level carbon monoxide in hydrogen-rich gas streams[END_REF], the cathode potential V c does not vary too much whatever the CO concentration in the anodic gas supply, it follows that the difference: (V c -V a )before CO injection-(V c -V a )after CO injection is representative of the final value of V a (under CO pollution). It could be noticed that V a remains well below 600 mV under CO pollution: for example, it is of the order of 460 mV for R = 10 Ω and a CO content of 50 ppm (see Figure 2). When CO is removed, it could not be oxidized and the signal recovers very slowly its original value without air regenerating. However, in some cases, the value of the anode potential Va under CO pollution is closer to 600 mV (see Figure 6 in which V a is of the order of 500 mV for R = 10 Ω and a CO content of 1000 ppm): when CO is removed from the gas stream, the return to baseline then occurs in two steps. This phenomenon is clearly visible in Figure 6a. The first step is very fast, results in an increase in the value of the cell voltage up to 400 mV and is possibly followed by oscillations; the second one is much slower and may require a period of several hours to obtain the almost complete reversibility of the signal.

During the first stage, there is likely the oxidation of CO by reaction ( 5); the possible oscillations depend on the CO content and intensity of supplied current and are probably related to oxidation-reduction phenomena commonly encountered in devices such as PEM involving CO and Pt in reducing atmospheres at low temperatures [START_REF] Farrell | Experimental and modelling studies of CO poisoning in PEM fuel cells[END_REF]. During the second stage, the value of the cell voltage increases and V a falls below 300 mV, which no longer allows easy oxidation of CO; the reversibility of the signal is then mainly ensured by the slow desorption of CO and air regenerating is requiring. Nevertheless, as can be seen in Figure 9, if the value of the cell voltage remains sufficiently low, the monitoring of changes in CO levels seems possible both in the sense of increasing levels and for decreasing levels: changes in the CO content of about 25-100 ppm around a mean value of 100 ppm are thus easily and rapidly (about 10 s for 100% response) detectable.

When the current supplied by the mini PEMFC is still more important (see Figure 3 for R = 1 Ω) these observations remain largely the same. However, the polarization of both electrodes becomes more important, even without any CO in the anode gas feeding.

In the case of quasi-potentiometric or potentiometric modes, the value of the initial cell voltage is usually between 750 and 920 mV, respectively (see Figure 7 and Figure 8). It can be observed that even for significant levels of CO (e.g. 4000 ppm), the value of the cell voltage remains above 300 mV (see e.g. Figure 7a (R = 104 Ω)) or 650 mV (see e.g. Figure 8 (potentiometric mode)). It is therefore reasonable to assume that in both cases the potential Va of the anode is less than 450 mV which does not allow an easy oxidation of CO according to the reaction [START_REF] Prasad | Microporous ceramic coated SnO 2 sensors for hydrogen and carbon monoxide sensing in harsh reducing conditions[END_REF]. That is why the return to baseline after CO removal occurs in one step probably corresponding to a simple desorption of CO. In this case, the air regeneration does not seem necessary because the time to return to the baseline is relatively acceptable (less than 30 min). Several experiments are currently carried out by changing the load resistor value during the recovery stage: it can be shown that CO desorption is complete only four hours after CO removing. In fact, the sensor response seems to be completely reversible in a much shorter time because of the low sensitivity of the sensor under these operating conditions (quasi-potentiometric or potentiometric modes). It is likely that air regenerating will be required in the case of long exposures under high CO levels. These various explanations have been given in order to interpret the observed phenomena.

Further experiments are obviously required to explain more thoroughly the results presented here and particularly the shape of the curves obtained during the return to baseline after removal of CO. Moreover, the performances of such a sensor under various operating modes and for CO levels between 2.5 and 4000 ppm have been relatively satisfactory during three months. However, long-term experiments are obviously needed to assess more precisely the stability of the device.

V. Conclusions

In this study, the CO detection performances of a mini PEMFC were evaluated on a test bench. This device is a self breathing PEMFC that could be placed directly on line in the gaseous flow (anode side), while the second electrode (cathode) is simply exposed to ambient air. The carrier gas is a simulated reforming fuel mixture composed of H 2 diluted in N 2 (5%), with CO 2 (1.9%) and H 2 O (1.8%) as additional components. Different operating modes have been considered. With load resistor (R) placed in the external circuit the evolution of the closed cell potential is recorded: this mode is so-called amperometric in the case of low values of R (1 Ω < R < 10 3 Ω) and quasi-potentiometric in the case of high values of R (10 4 Ω < R < 10 6 Ω). In the absence of load resistor, the cell voltage takes the value of open cell voltage (OCV): this is the so-called potentiometric mode. The obtained results depend on the selected mode.

In the case of amperometric mode, the device has a high sensitivity since levels of about 2.5-20 ppm can be easily detected. When the CO content increases, the relative response appears very quickly saturated but the response time (50% response) becomes very interesting (e.g. 30 s for 1000 ppm CO). Nevertheless, under this operation mode, a recovery in pure air is absolutely necessary to fully desorb the CO which leads to discontinuous operation of the sensor.

In the case of potentiometric or quasi-potentiometric modes, the relative response is much lower and high levels of CO (up to 4000 ppm or more) are easily detectable. The response time is slightly longer than in the case of amperometric mode; moreover, the reversibility of the response is almost complete and the stage of regeneration under pure air did not seem necessary that allows continuous operation of the device.

In the case of a low temperature PEMFC for which CO poisoning is critical, an amperometric mode seems preferable with a periodic regeneration in pure air. For high temperature PEMFC, the CO poisoning is less severe and it seems that potentiometric or quasi-potentiometric are suitable modes for continuous operation. A detection system using two mini PEMFC sensors could also be considered. The first, operating in amperometric mode (R = 10 Ω for example), would be useful to quickly detect the presence of CO in the reformate (alarm threshold). The second, operating in quasipotentiometric mode (R = 10 5 or 10 6 Ω for example), would be interesting to determine more precisely the CO concentration; when the return to baseline has been achieved and thus the CO pollution has disappeared, it could start the regeneration step of the first sensor. The goal of current research is to improve the knowledge of encountered mechanisms in order to explain in more detail some observed phenomena such as the shape of the curves during the return to baseline.

Figures

FF

  Fi ig gu ur re e 5 5: : R Re el la at ti iv ve e r re es sp po on ns se e R Rr r o of f t th he e f fu ue el l c ce el ll l a as s a a f fu un nc ct ti io on n o of f C CO O c co on nt te en nt t ( (0 0--2 20 0 p pp pm m) ) f fo or r s se ev ve er ra al l v va al lu ue es s o of f l lo oa ad d r re es si is st to or r. . F Fi ig gu ur re e 6 6: : R Re es sp po on ns se e o of f t th he e f fu ue el l c ce el ll l t to o 1 10 00 00 0 p pp pm m C CO O w wi it th ho ou ut t r re eg ge en ne er ra at ti io on n i in n p pu ur re e a ai ir r. . C Ca ar rr ri ie er r g ga as s: .9 9% %) ). . A Am mp pe er ro om me et tr ri ic c m mo od de e: tr ra an ns si ie en nt t r re es sp po on ns se e a an nd d r re ec co ov ve er ry y s st te ep p; ; ( (b b) ) d de et ta ai il ls s o of f t th he e r re es sp po on ns se e. . F Fi ig gu ur re e 7 7: : R Re es sp po on ns se e o of f t th he e f fu ue el l c ce el ll l t to o i in nj je ec ct ti io on ns s o of f .9 9% %) ). . Q Qu ua as si i p po ot te en nt ti io om me et tr ri ic c m mo od de e. . ( Fi ig gu ur re e 8 8: : R Re es sp po on ns se e o of f t th he e f fu ue el l c ce el ll l t to o i in nj je ec ct ti io on ns s o of f C CO O f fr ro om m 2 25 50 0 t to o 4 40 00 00 0 p pp pm m. . C Ca ar rr ri ie er r g ga as s: : [ [H H2 2] .9 9% %) ). . P Po ot te en nt ti io om me et tr ri ic c m mo od de e. . F Fi ig gu ur re e 9 9: : E Ev vo ol lu ut ti io on n o of f t th he e c ce el ll l v vo ol lt ta ag ge e o of f t th he e f fu ue el l c ce el ll l f fo or r c ch ha an ng ge es s i in n t th he e C CO O c co on nt te en nt t pp pm m) ). . A Am mp pe er ro om me et tr ri ic c m mo od de e:

Acknowledgments

This work has been funded by the French ANR agency (Agence Nationale de la Recherche) in the frame of the H 2 -Fuel-cell program, especially in the GAPPAC project (ANR-06-PANH-012). The authors also wish to acknowledge CEA Grenoble (France) for the supply of the PEMFC device and for fruitful discussions.