Najet Boughanmi
email: najet.boughanmi@loria.fr

Hugo Cruz-Sanchez
email: hugo.cruzsanchez@loria.fr

Yeqiong Song
email: yeqiong.song@loria.fr

Ibrahim Al-Salami
email: ibrahim.al-salami@cran.uhp-nancy.fr

Joseph Yam
email: joseph.yame@cran.uhp-nancy.fr

Case study of Wireless Networked Control System : CONECS and COWNECS platform

Keywords: Wireless Networked Control System, Online adaptation quality of control, Multi hop control system

Many techniques for the enhancement of the quality of control have been studied in the networked control systems based on differentiated services, synchronization or dynamic aproaches. By controlling the resources of the network, a compromise between the offered quality of service and the required quality of control can be established. In the case of a multi hop control loop, using IEEE 802.15.4 for instance, the quality of control can be affected by the inherent network factors (e.g. the load of traffic, the delay, the jitter). These factors must be considered when the quality of control techniques are applied. By using an on line adaptation of quality of control and some other techniques, we analyze the behavior of the control systems when the control loop includes multi hop paths. Simulation results show the effects of delay components derived from the multi hop paths of the control loop.

Introduction

In Wireless Networked Control systems(WNCS), the quality of control (QoC), i.e., the performance delivered by each closed-loop operation, depends not only on the controller design but also on the quality of service (QoS) offered by the wireless network. The degradation of the QoC of the controlled process can be caused by the network or by the controlled system. In order to manage this QoC many researchers try to enhance the QoS offered to the WNCS. Thus several network resource allocation techniques for WNCS have been proposed. These techniques are based on static strategies that ensure average control performance at the expenses of permanently occupy the available bandwidth. In the case of wireless networks, the use of resources must be controlled at the same time that the control performance. We consider de case of a multi-hop IEEE 802.15.4/Zigbee network used within the control loop of a control system. We propose an adaptive online QoC management protocol : if the QoC of the controlled process is not sufficient, this network offers more resources to the WNCS. Moreover, since the degradation of the QoC can be due to the control loop, if there is no enhancement of the QoC for a certain amount of time, we have to act on the control loop (changing the sampling period for example). We analyze the degradation of the QoC caused by the lack of network resources and by the presence of multiple delay components derived from the multihop network configuration.

The remainder of the contribution is organized as follows. Section 2 shows the related contributions. Section 3 presents the model of the platform used as the controlled system. The multi hop network platform is described in Section 4. In Sec-tion 5 we describe the effects of different lengths of the control loop over the control system. We observe that the delay over the loop has a main influence over the control behavior. Section 6 describe several QoS mechanisms. In Section 7 we present an online adaptive mechanism applied over the multi hop network. Finally, Section 8 contains some concluding remarks.

Related work

Guaranteeing the network QoS, especially for industrial process control architecture, is a common problem that has been addressed in several research works. In [START_REF] Mouney | On the implementation of one process control application type through a network. considering three LANs : CAN, WiFi, ZigBee[END_REF], the case of a dedicated network (CAN, WIFI, IEEE 802.15.4/ZigBee) to the process control application has been studied but the realistic case with other nodes than control loop nodes sharing the network has not been analyzed. In [START_REF] Colandairaj | Analysis of an IEEE 802.11b wireless networked control system[END_REF], the suitability of IEEE 802.11b for wireless networked control system has been analyzed and it has been shown that the network bandwidth is important for the performance of WNCS.

Koubâa et al. [START_REF] Koubâa | Improving the ieee 802.15.4 slotted csma/ca for time-critical events in wireless sensor networks[END_REF] proposed a simple differentiated service scheme for slotted CSMA/CA in IEEE 802.15.4 to improve the performance of time sensitive message. In [START_REF] Rao | Adaptive backoff exponent algorithm for zigbee[END_REF], the authors have modified the initial value of the backoff exponent in the IEEE 802.15.4 MAC (slotted CSMA/CA) and proposed an adapted backoff exponent (ABE) algorithm. These works was restrained to the slotted CSMA/CA and was not analyzed in the case of wireless networked control systems.

The blackburst mechanism [START_REF] Sobrino | Quality of service in ad hoc carrier sense multiple access networks. Selected Areas in Communications[END_REF] was introduced in the IEEE 802.11 to minimize the delay for real time traffic. Blackburst requires that all high priority stations try to access the medium with constant interval, and the ability to jam the wireless medium for a period of time. This mechanism was not designated for IEEE 802.15.4. Moreover, the length of the black burst is determined by the time the station has been waiting to access the medium and not by its priority.

Some other works have dealt with the IEEE 802.15.4/Zig-Bee and especially the synchronization of the GTS mechanism. Francomme et al. [START_REF] Francomme | Beacon synchronization for GTS collision avoidance in an IEEE 802.15.4 meshed network[END_REF] proposed a new synchronization method for beacons and GTSs in meshed networks using IEEE 802.15.4. Koubâa et al. [START_REF] Koubâa | A time division beacon scheduling mechanism for IEEE 802.15.4/ZigBee cluster-tree wireless sensor networks[END_REF] proposed a synchronization mechanism based on time division beacon scheduling to construct cluster-tree WSNs. Moreover, they proposed a methodology for an efficient duty-cycle management in each router to ensure the fairest use of bandwidth resources. Those works are centric over network Quality of Service (QoS) and do not include any actual realtime applications.

These works show that the differentiation of service is a promising solution to guarantee the QoS required by the network and so the QoC needed by the control loop.

There are several works which deal with the resource allocation for control loops. Marti et al. [START_REF] Marti | Optimal state feedback based resource allocation for resource-constrained control tasks[END_REF] studied the CPU resource management and showed that by using feedback to dynamically allocate resources to controllers as a function of the current state of their controlled systems, control performance can be significantly improved. They present an optimal resource allocation policy that maximizes control performance within the available resources. In this work the QoC management depends on the controller since when there is a perturbation, the sampling period is adapted.

Velasco et al. [START_REF] Velasco | A control approach to bandwidth management in networked control systems[END_REF] propose a dynamic approach to bandwidth management in networked control systems that allows control loops to consume bandwidth according to the dynamics of the controlled process meanwhile attempting to optimize overall control performance. This is done by augmenting the original state-space representation of each controlled system with a new state variable that describes the network dynamics.

Ji et al. [START_REF] Ji | Optimal bandwidth allocation and qos-adaptive control co-design for networked control systems[END_REF] assign the network-bandwidth dynamically to each control loop according to the quality of performance of each control loop. This is done by using an adaptive controller.

All these works try to adapt the control loop to its environment. Thus, the parameters of the control loop are changed, especially the sampling period.

Marti et al. [START_REF] Marti | Managing quality-of-control in network-based control systems by controller and message scheduling co-design[END_REF] propose an approach to adaptive controllers for NCS that online adapts the control decisions according to the dynamics of both the application and the executing platform. This approach offers capabilities for dynamic management of QoC through message scheduling. They formulate a scheduling strategy that uses feedback information from the control application in order to schedule messages in such a way that the degrading effects of the message latencies are minimized. Thus, the overall QoC is improved. However, this strategy was not analyzed nor tested.

All above works are designed for wired networks. For the best of our knowledge, there is no QoC online adaptive strategy for WNCS using the IEEE 802.15.4 which adapts the QoS of the network to the control loop requirements. This QoS management can be done through the service differentiation as stated above.

In this paper,first, the WNCS using the probabilistic priority, the deterministic priority and the GTS mechanism are analy-zed in order to ensure the QoC of the controlled system. Then, an online adaptive scheme is proposed for wireless networked control systems.

Platform description

The platform function is to move a metallic bar along a linear rail. This platform consists on two independent mobile carts. Each cart is equipped with measurement sensors, calculators and communication devices. There is also a computer used for IHM, supervision and high level control law calculation algorithms.

FIG. 1 -Platform description

The system has four freedom degrees : X 1 , X 2 , θ 1 and θ 2 . After linearization, the system model is given by

ẋ = Ax + Bu y = Cx (1)
where

x = [X 1 , X 2 , θ 1 , θ 2 , Ẋ1 , Ẋ2 , θ1 , θ2 ] u = [f 1 , f 2 ] A =             0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 k 1 -k 2 -k 3 F v k 4 F v k 5 C v -k C v 0 0 -k 2 k 1 k 4 F v -k 3 F v -k 6 C v k C v 0 0 -k 7 k 8 k 9 F v -k 10 F v -k 11 C v k 12 C v 0 0 k 8 -k 7 -k 10 F v k 9 F v k 12 C v -k 11 C v             B =             0 0 0 0 0 0 0 0 k 3 -k 4 -k 4 k 3 -k 9 k 10 k 10 -k 9             and C =            
1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 1

            .
This platform is characterized by : -k i , i = 1 . . . 10 : system's constants which are calculated using the system's parameters, -F v : the viscous friction of engines 1 and 2 on the linear axis, -C v : the viscous friction torque on the bars of connection 1 and 2. The control law is given by u = -Kx + HX ref with

K T =             37.
           
and H = 37.42 0 0 37.42 .

FIG. 2 -Networked control system architecture

Using simulations, the maximum value of the sampling period is 40ms in order to keep the system stable.

The network platform

The IEEE 802.15.4 defines two type of network components : the Full-Function Devices (FFD) and the Reduced-Function Devices (RFD). The FFD can work as a router, a bridge or a Personal Area Network (PAN) coordinator. The RFD are the minimum form of the IEEE 802.15.4 devices with minimal functionalities (usually they are used as sensor nodes) and minimal energy consumption. There are three routing types in Zigbee :

-Star topology routing, defined by a coordinator and several end-devices. -Tree topology routing, defined by a hierarchical routing composed by several end-devices and one or more FFD. -Mesh topology routing, where the routing strategy is more complex than in the tree or star topologies. This topology enables to establish routes between any pair of network devices allowing different routes. In our testbed we use a set of Crossbow Micaz motes working on the 2.40-2.48 GHz band with support for the IEEE 802.15.4/Zigbee standards and offering a 250kbps transmission data rate. The motes use the ATmega128L running at 8MHz. Each component of the network use a micaz as a communications interface. The IEEE 802.15.4/Zigbee network transport the traffic originated at each location using one or more FFDs in any network configuration. A pair of AA batteries provide energy to the FDDs, the other network components use the conventional energy source (from communications port at each location). A simple routing policy allows to communicate the components of the network : sensor, actuator, controller and other devices. The network aims to provide a minimal performance to satisfy the required Quality of Control (QoC) of the control system. This requirements are translated in network terminology as the guaranteed Quality of Service (QoS). Must of the times, this QoS can be expressed in terms of end-to-end delay and delivery rate. We implement a multi-hop routing policy in order to find the relationship between the QoC/QoS requirements and the network parameters. The network can be implemented by using any of the three IEEE 802.15.4/Zigbee routing types. The objective of this testbed is to determine the parameters of a network making part of a control loop. A relationship between network behavior (end-to-end delay, delivery rate, energy efficiency, etc) and control (system response, lost packets tolerance, etc.) parameters can be establish and the compromise between requirements of control and the routing strategy can be derived.

Model description and routing effect

In our example, the communication channel is shared by 2 cyclops (sensors equipped with camera) and a main control unit as shown in Figure 3. Hence, the wireless network is used to transmit image packets from cyclops to the main control unit. The image sensor has CIF resolution (352 × 288). Each cyclops sends, periodically, 133 bytes. Besides, there are other nodes which contribute in the routing process between the two calculators. Thus, we can study the one-hop and multi-hop routing.

FIG. 3 -Platform description

The studied system is composed of two calculators whose control law is dependent since needs each other information. In this part, we focus on the influence of the chosen paths on the controlled carts. There are two possible situations. The first one consist on the same number of hop in the each path. The second situation considers that the number of hops of each path is different.

The first set of simulations deals with the same number of hops in each path. Different cases are presented : 1, 2, 3 and 4 hops. The simulation results using the IEEE 802.15.4 shows that the multi-hop routing induces the degradation of the QoC. In fact, as shown in Figure 4, for the same configuration, the WNCS which uses the one-hop routing reaches the stability quicker than when it uses the multi-hop routing. Besides, the responses of the two carts behave in the same way all the time. This can be explained by the same delay values. In fact, since the number of hop is the same in each path, the induced delay is the same for the two carts. Thus, the two carts are synchronized. The second case deals with different number of hops between each path. Figure 5 shows the responses of the two carts the path from the calculator 1 to the calculator 2 is composed of only one hop whereas the one from the calculator 2 to the calculator 1 is composed of four hops. These responses are no longer synchronized since the delays caused by each path are different.

FIG. 5 -Platform description

Given that the communications paths between calculators are different, each one has a different associated delay derived from multiple hop paths between components of the wireless network making part of the control system. When both delay components are equivalent, a slower response from the control system is obtained and the stability state is reached later. In this case, the equivalence of delays allows the system to have a synchronized response over both carts. When the system has two different components of delay, the response of the system performance may be unsatisfactory.

QoS adaptation

In this paper several QoS adaptation mechanisms are proposed and implemented in the TrueTime package.

Black burst mechanism

The goal of black burst [START_REF] Sobrino | Quality of service in ad hoc carrier sense multiple access networks. Selected Areas in Communications[END_REF] is to minimize the delay for the real-time traffic. The black burst mechanism requires that :(i) all stations try to access the medium with equal, constant interval, blackburst period ; (ii) the ability to jam the medium for a period of time. When a new cycle starts, each station who wants to send a frame, sends a blackburst to jam the channel. The length of the blackburst is determined by the priority of the application, and is calculated as a number of black slots. The duration of a black slot t bslot is at least equal to the turn around time (TT) (t bslot ≥ T T ). After transmitting the blackburst, the station listens to the medium for an observation time t obs (t obs < t bslot ) to see if another station is sending a longer blackburst. This would imply that this station has higher priority, so it should access the medium first. If the medium is idle, the station will then send its frame, otherwise it will wait until the medium becomes idle again and enter another black burst period. As it is supposed that there is different priority for each station, the black burst mechanism will yield to a unique winner.

FIG. 6 -Competition to access to the communication medium

Figure 6 shows three nodes competing to access to the communication medium. Node N 3 has the lowest priority, thus it is the first one to finish the transmission of black burst. Then, it listens to the medium during a t obs and it finds that there is someone else sending. Hence, N 3 quits. The same thing for node N 2. When node N 1 (with the highest priority) transmits its black bursts and then listens to the medium, it finds it free. Thus, N 1 is the winner and start to send its data packet.

Adaptive priority

The second QoS adaptation mechanism is based on the adaptive priority [START_REF] Koubâa | A time division beacon scheduling mechanism for IEEE 802.15.4/ZigBee cluster-tree wireless sensor networks[END_REF]. This is ensured through a priority mechanism which adapts the backoff exponent value in the IEEE 802.15.4 MAC standard.

The CSMA/CA mechanism for IEEE 802.15.4 uses the random waiting delay for collision avoidance. It uses the backoff exponent (BE) which is related to how many backoff period (BP) a device must wait before attempting to assess the channel activity. The algorithm attempts to avoid collision by waiting during a given delay randomly generated in the range of [0, 2 BE -1] × BP . If battery life extension is activated then, BE = min(2, macM inBE) else, BE = macM inBE where macMinBE attribute specifies the minimum of backoff exponent, which is set to 3 by default. This aspect is exploited in order to differentiate the services offered by the WSN. We propose to vary the randomly generated waiting delay depending on the priority of the packet. Thus, by choosing a higher macMinBE for the applications, different from the control loop, the probability to have a longer delay is increased and the control loop nodes will be able to send their data packets.

The nodes are divided into two classes : the high priority (h) class contains the nodes of the WNCS (sensor, controller, and actuator), and the low priority (l) class is composed of the other nodes present in the WSN. BE CL represents the BE of the control loop nodes macM inBE CL its macM inBE, and it is set to the default value 3. The macM inBE OA and BE OA are the macM inBE and the BE of the other applications sharing the WSN. When the batterylife extension is not activated, the control loop nodes have to wait random[0,

2 BE CL -1] × BP ( random[0, 7] × BP ).
The macM inBE OA of the low priority nodes is increased in order to make their data packets wait during a delay randomly generated in a longer range. The intersection between the waiting ranges of the high and low priority nodes is eliminated as shown in Figure 7. The lower-priority applications will wait during a delay randomly generated in the range of [variable, 2 BE OA -1] backoff periods. The question is how to choose the variable's value. This variable is set to 2 BE CL so that there is no collision between the members of the two classes ( variable = 8). FIG. 7 -Waiting ranges for high (h) and low (l) priority nodes using the deterministic priority

QoS adaptation : CSMA/CA with priority

The CSMA/CA mechanism for IEEE 802.15.4 uses the random waiting delay for collision avoidance. It uses the backoff exponent (BE) which is related to how many backoff period (BP) a device must wait before attempting to assess the channel activity. The algorithm attempts to avoid collision by wai-ting during a given delay randomly generated in the range of [0, 2 BE -1] × BP . If batterylife extension is activated then, BE = min(2, macM inBE) else, BE = macM inBE where macMinBE attribute specifies the minimum of backoff exponent, which is set to 3 by default. This aspect is exploited in order to differentiate the services offered by the WSN. We propose to vary the randomly generated waiting delay depending on the priority of the packet. Thus, by choosing a higher macMinBE for the applications different from the control loop, the probability to have a longer delay is increased and the control loop nodes will be able to send their data packets.

The nodes are divided into two classes : the high priority (h) class contains the nodes of the WNCS (sensor, controller, and actuator), and the low priority (l) class is composed of the other nodes present in the WSN. BE CL represents the BE of the control loop nodes macM inBE CL its macM inBE, and it is set to the default value 3. The macM inBE OA and BE OA are the macM inBE and the BE of the other applications sharing the WSN. When the batterylife extension is not activated, the control loop nodes have to wait random[0, 2 BE CL -1] × BP ( random[0, 7] × BP ).

GTS mechanism

To ensure the stability of the WNCS, we are interested in the beacon-enabled mode of the IEEE 802.15.4. Indeed, network resources are reserved using the GTS mechanism. The superframe duration (SD) is given by SD = aBaseSuperf rameDuration.2 SO for 0 ≤ SO ≤ BO ≤ 14 where SO is the Superframe Order.

SD is divided into 16 equally-sized time slots, during which frame transmissions are allowed. GTSs are allocated by the PAN coordinator. The PAN coordinator can allocate at most seven GTSs and each GTS may occupy more than one time slot.

Each node in the control loop will have a reserved GTS whose size will be 1 slot since the control data is not big (small frame). Figure 8 shows that 3 GTSs (3 slots) are needed, but as the superframe has at least 16 slots (if the inactive part is omitted), the WNCS sampling period T e has to be at least equal to the superframe duration. Indeed, T e must be greater than SD. As the smallest superframe duration (for SO = 0) is equal to 0.01536s, then the WNCS sampling period T e is greater then T emin = 0.01536s. Besides, since the number of GTS is restricted to 7, the GTS mechanism cannot afford QoS guarantees to more than two control loops with the same sampling period. Otherwise, one should use the scheduling policy in [START_REF] Francomme | Beacon synchronization for GTS collision avoidance in an IEEE 802.15.4 meshed network[END_REF].

Discussion

These mechanisms are efficient when there is only one WNCS and the path is composed of one hop as shown in [START_REF] Boughanmi | Wireless networked control system using zigbee[END_REF] and in [START_REF] Boughanmi | Online adaptation of the ieee 802.15.4 parameters for wireless networked control systems[END_REF]. However, the co-existence of several WNCSs induces a conflict between the messages of these WNCS. For example, in the case of the double cart, the packets of the two controlled carts have the same priority. Thus, collisions may happen between these packets. Besides, multi-path routing can be a source of conflict since if there are different instances of the same WNCS message, it may cause a collision between them. This kind of problem can be avoided if the network delay is less than the sampling period.

QoC online adaptation

The QoC of the WNCS is evaluated using the controlled process error e. If the WNCS is stable, the error is bounded. Thus, the same criterion, as in [START_REF] Ji | Optimal bandwidth allocation and qos-adaptive control co-design for networked control systems[END_REF], is adopted : the error should be bounded by a threshold to ensure the required QoC to the plant. This threshold depends on the controlled process and on the reference value if there is any. If e > threshold, the WNCS is considered to be in a critical situation and action has to be taken. The trouble is caused either by the controlled system itself or by the network (overloaded network). Action should be taken on the network for a certain period of time through offering more resources to the WNCS. If the situation is not improved (there is a problem in the control loop), action should be taken on the WNCS by changing the sampling period for example. In order to enhance the QoC this work deals with the adaptation of the QoS.

For the systems with architecture presented in Figure 10, the error e is equal to |r -y| where r is the reference and y is the process response. In order to have a good QoC, the condition is |r -y| < threshold + r

(2)

has to be satisfied. The reference value is added in order to take into account the case where there is a change in the reference value that makes |r -y| = r and there is no network problem. FIG. 10 -The network control system architecture

Dynamic management of the QoC

The QoC of the controlled process is dynamically managed through the QoC metric e (the system error). First, the controller checks the error value so that it can decide its priority level because there are two : the maximum priority, and the normal one. If the error e is higher than the threshold, then the WNCS is in critical situation. Thus, the controller priority is set to its maximum value. Else, the controller has a normal priority. This priority data is expressed through the random range of the waiting delay of the CSMA/CA. There are two alternatives :

1. this range is set to a big one for all the nodes in the network, then when the controller priority is equal to the maximum value, this range is decreased for both the sensor and the controller, 2. this range is set to the default one for all the nodes, then if the controller priority is equal to the maximum value, this range is increased for all the nodes in the network except the sensor and the controller.

The first solution is the most suitable for hard real-time applications considering the robustness aspect. However, it induces the waste of the network resources by the large waiting delay. Thus, the second solution is adopted.

The priority parameter is transferred to the MAC layer which will send it to the WSN coordinator. This coordinator is in charge of informing all the other nodes of the current controller's priority. Once one node gets the controller priority information, it decides if it will apply the CSMA/CA either with the probabilistic priority or without. This decisions is related to the controller priority value. Moreover, the transition between the two mechanisms is done progressively. In fact, if the controller priority is equal to the maximum value, the range of the random delay is increased, else, it decreased until it is equal to the default range.

Online probabilistic priority adaptation

Action will be taken on both the variable and macM inBE OA . Moreover, since a static assignment of these variables can lead to the under-use of the network resources due to the large waiting delay, these variables are adapted online depending on the controller's priority level. Thus, if the control loop is in a critical situation, the variable is set to 8 and the macM inBE OA is increased by 1 in order to enlarge the waiting delay, else the variable is set to 0 and the macM inBE OA is decreased by 1.

The QoS management depends on the QoC metric which is represented by the controlled system error. Thus, the upper bound of the allowed error ( e ≤ threshold), the threshold, has to be chosen carefully. This threshold is defined, in equation 3, by the control loop threshold (threshold process ) and a security margin. threshold = threshold processsecurity margin [START_REF] Koubâa | Improving the ieee 802.15.4 slotted csma/ca for time-critical events in wireless sensor networks[END_REF] The delay introduced by the network should be taken into account in order to make the new QoS effective. This delay represents the propagation time of the new priority value to all the nodes. Thus, the network delay is calculated as

d net = max(RB) + aBaseSuperf rameDuration • 2 BO , (4)
when BO = 0, d net = 17.6ms.

The minimal sampling period T emin of the control loop has to be as the following : T emin = d net so T emin = 17.6ms.

Conclusion

The application of the techniques for enhancing the QoC over networked control system may consider the behavior of network and its inherent aspects. In this study case, the presence of a wireless network causes the delay and packet loss so that the QoC of the controlled system is badly affected. When a multi hop control system is used, other factors must be taken into account in order to guarantee the required levels of QoC. Some other techniques related to the network resources management or routing parameters can be foreseen in order to improve control systems. The use of the network delay as control parameter and other open issues will be investigated in future work. This work is in progress under the CONECS and COW-NECS projects.

  FIG. 4 -results when using IEEE 802.15.4 and multi-hop routing with overloaded network

FIG. 8 -

 8 FIG. 8 -Used GTSs by the WNCSMoreover, the sensor and the controller use only CFP to send sensing and control data so that they do not use the CAP part. The CAP part is used by other nodes using the WSN.

4 FIG. 11 -

 411 FIG.11-results when using Online adaptation and multi-hop routing 1

FIG. 12 -

 12 FIG. 12 -Results when using Online adaptation and multi-hop routing 2


A Haj Ammar

J Bouajila

A Lebrihi

F Mathieu

M Romdhane

F Zagrouba

Chemical Composition and in vitro Antimicrobial and Antioxidant Activities of Citrus aurantium L. Flowers Essential Oil (Neroli Oil)

Keywords: Citrus aurantium L., neroli, antimicrobial activity, antioxidant activity, gas chromatography-mass s ectrome

N eroli essential oil is ext r acted from the fragrant blossoms of the bit ter orange tree. It is one of the most widely used floral oils in perfumery. In this study chemical composition and in vitro antimicrobial and antioxidant activities of neroli oil are investigated. The essential oil of fresh Citrus aurantium L. Flow ers (N eroli oil) cultivated in North East of Tunisia (Nabeul) were analyzed by GC-FID and GC-MS. About 33 compounds were identifiecl, representi ng 99% of the total oil. Limonene (27 .5%) was the main component followed by (E)-nerolidol (17.5%), a-terpineol (14%), a-terpi ny l acetate (11. 7%) and (E, E)-farnesol (8%). Antimicrobial activity was determined by Agar-well-diffusion method against 6 bacteria (3 Gram-positive and 3 Gram-negative), 2 yeasts and 3 fungi. Neroli oil exhibited a marked antibacterial activity especially against Pseudomonas aeruginosa. Moreover, Neroli oil exhibited a very stro ng antif ung al activity compared with the standard antibiotic (Nystatin) as evidenced by their inhibition zones. Antioxidant activity determined by ABTS assay showed IC 50 values of 672 mg L-1

. Finally, this study may be considered as the first report on the biological properties of this essential oil. The results of this study have provided a starting point for the investigations to exploit new natural substances present in the essential oil of C. aurantium L. flowers.

INTRODUCTION

Citrus aurantium L., commonly named sour or bitter orange is a tree that belongs to the Rutaceae family. In Tunisia, C. aurantium L. is grown in warm regions shielded from strong winds, mainly in Cap Bon region which covers an area of 1500 ha. Sour orange trees are very resistant to cold, water excess and several diseases. For these main qualities, sour orange is widely used as a rootstock [START_REF] Lota | Chemical variability of peel and leaf essential oils of sour orange[END_REF].

C. aurantium L. is amo ng the species most frequently used for both traditional and modern medicinal purposes. Previous studies have underlined that preparations made up from peels, flowers and leaves of C. aurantium L. are popularly used for treating gastrointestinal tract disorders, for its diuretic action against tachycardia and rheumatism and for minimizing central nervous system disorders (Momes et al., 2009). In addition, C. aurantium L. is a plant most frequently used as sedative at the outpatient clinics (Hernandez et al., 1984;[START_REF] Pultrini | Effects of the essential oil from Citrus aurantium L. in experimental anxiety models in mice[END_REF] Recently, extracts of un r ipe fruits have gained significant popularity for the treatment of obesity, as an alternative to ephedrine alkaloids [START_REF] Arbo | Subchronic toxicity of Citrus aurantium L. (Rutaceae) extract and p-synephrine in mice[END_REF].

These flowers give the orange blossom water, named 1 ocall y 'zhar'. This floral water is used as food flav oring compounds (syrups, fruit salads, coffee and pastry) as well as corporal and body linen perfumes [START_REF] Arbo | Subchronic toxicity of Citrus aurantium L. (Rutaceae) extract and p-synephrine in mice[END_REF]. It is also used as therapeutic products [START_REF] Ayadi | Tunisian aromatic waters profile[END_REF]. Traditionally, floral water was used, in Tunisia, as a cardiac stimulant and for carminative activity in the digestive tract and to cairn babies and help them fall asleep. It is also supposed to be helpful during detoxification programs or when quitting a habit or addiction like smoki ng (Arias and Ramon-Laca, 2005;[START_REF] Jeannot | Quantification and determination of chemical composition of the essential oil extracted from natural orange blossom water (Citrus aurantium L. ssp. aurantium)[END_REF].

In addition to the aromatic waters, the distillation of sour orange flowers gives N eroli, a rare aromatic oil since to extract 1 kg of N eroli, 1000 kg of flowers is required. This volatile oil contains a sensual fragrance and forms the heart of one of the world's most enduri ng perfumes, 'eau de col og ne'. It is also used in pharmacy as a flavouri ng agent. In fact, the Food and Drug Administration (FDA) has approved bitter orange flowers in small amounts even in some medicines [START_REF] Jeff | Natural Medicines Comprehensive Database[END_REF]. N eroli oil has many therapeutic properties including sedative, calmative, tonie, cytophylactic, aphrodisiac, anti-depressant and antispasmodic [START_REF] Jeannot | Quantification and determination of chemical composition of the essential oil extracted from natural orange blossom water (Citrus aurantium L. ssp. aurantium)[END_REF].

Although, Neroli oil is produced in many countries such as Algeria, Morocco, Egypt, France and Spain, the oils produced in Tunisia have always been considered to be the finest and the most expensive ones. Distillation of C. aurantium L. flowers activity represents a considerable value for Tunisian economy since it releases revenue between three and four million dinars per year in terms of exportation. Neroli is mainly exported to France, especially to Grasse region [START_REF] Nis | Statistical yearbook of Tunisia[END_REF].

Inspite of the economic importance of the Tunisian N eroli oil, no attempt has been made to study their biological activities. To the best of our knowledge, only the chemical composition of the sour orange flower oil has been reported [START_REF] Boussaada | Chemical variabilit:y of flowers, leaves and peels oils of four saur ora ng e provenances[END_REF]. This prompted us to investigate flowers of C. aurantium L. for N eroli oil constituents and in vitro antimicrobial and antioxidant activities.

MATERIALS AND METHODS

Chemicals: Ali chemicals used were of analytical reagent grade. Ali reagents were purchased from Sigma-Aldrich-Fluka (Saint-Quentin France).

Plant material: Bitter orange flowers (C. aurantium L.) were collected by hand in the beginning of May 2009 from the Cap Bon of Tunisia, precisely in the surroundi ng s of Nabeul localized in 5 m of altitude and 1044 of lo ng itude. In May 2009, Nabeul average rainfall was 31 mm, the average of Temperature was 20.5 °C and humidity was 79%. These data were provided by National Institute of Meteorology of Tunisia.

Isolation of essential oils: Fresh flowers were subjected to hydrodistillation using a Clevenger-type apparatus (European Pharmacopeia,197 5). Extraction was performed in triplicate. Duri ng every experiment, a portion (100 g) of plant material was submitted for 3 h (after the falling of the first drop of distillate) to water distillation. The essential oil yield (R) is defined as follows: R (%) Essential oil mass x 100

Fresh flowers mass

The obtained essential oils were dried over anhydrous sodium sulfate, measured (yield) and stored at 4 °C in dark glass bottles until tested and analyzed.

Analysis of the essential oil

Gas chromatography: Essential oils were analyzed using a Thermo Electron (Courtaboeuf, France) gas chromatograph equipped with flame ionization detection (FID) detector and DB-5MS capill ary column (30 mx0.25 mm, film thickness 0.25 µm). Injector and detector temperatures were set at 200 and 270 °C, respectively. Oven temperature gradually raised from 60 to 260 °C at 5 °C min-', held for 15 min and fi nally raised to 340 °C at 40 °C min-1

• Helium (purity 99.999%) was the carrier gas, at a flow rate of 1 mL min-1 • Total analysis time was 57 min. Diluted sample (l /100 in pet r oleum ether, v/v) of 1.0 µL was injected in the split mode (ratio 1:10). Quantitative data were obtained electronically from FID area percent data without the use of correction factors.

Gas chromatography/mass spectrometry (GC-MS):

Analysis of essential oils was performed under the same conditions used for GC-FID analysis ( column, oven temperature, flow rate of the carrier gas) usi ng a Thermo Electron (Courtaboeuf, France) DSQ II GC-MS single quadrupole mass selective detector in the elect r on impact mode (70 ev). Injector and MS transfer line temperatures were set at 200 and 300 °C, respectively. MS was adjusted for an emission current of 1 0 µA and electron multiplier voltage at 1500 V. Trap temperature was 250 °C and mass scanni ng was from 40 to 650 amu.

The components were identified based on the comparison of their KI (Kovats indices) and mass spectra with those of standards, Wiley 2001 libr ary data (NIST 02 version 2.62) of the GC-MS system and literature data (Adams). Alkanes (C5-C24) were used as reference points in the calculation of KI. Ali determinations were perforrned in triplicate and then averaged. Weil-diffusion assay: Agar-well-diffusion method [START_REF] Kalemba | Antibacterial and antif ung al properties of essential oils[END_REF][START_REF] Oke | Essential oil composition, antimicrobial and antioxidant activities of Satureja cuneifolia Ten[END_REF] was used for the determination of antimicrobial activity of Neroli essential oil. Ampicillin and nalidixic acid were used as positive reference standards to, respectively determine the sensitivity of Gram-positive and Gram-negative bacterial. Nystatin was used as positive reference standard to determine the sensitivity of yeast and f ung i species. These plates, after stayi ng at 4 °C for 2 h to allow dispersal, were incubated at 37 °C (bacteria) and at 30 °C (yeast and fungi) during 48 h. Antimicrobial activity was evaluated by measuring the diameter of the growth of the inhibition zone, around the dise, against the test organism. The diameter of the inhibition zones was measured in millimeters. Ali the experiments were conducted in triplicate and the mean diameter of the inhibition zone was recorded.

Antioxidant activity by ABTS radical-scavenging assay:

The radical scave ng ing capacity of antioxidants for the ABTS (2,2' -azinobis-3-ethylbenzothiazoline-6-sulphonate) radical cation was determined as described by Re et al.

(1 999). For each sample, diluted methanol solution of the essential oil (100 µL) was allowed to react with fresh ABTS solution (900 µL) and then the absorbance was measured 6 min after initial mixing and the absorbance was recorded as Acsamp I , ) • A blank experiment was also carried out applyi ng the same procedure to a solution without the test material and the absorbance was recorded as A c,Iank) • The free radical-scave ng ing activity of each solution was then calculated as percent inhibition according to the following equation:

Antioxidant activity of standard or essential oils was expressed as IC 50 (mg L -1

), defined as the concentration of the test material required to cause a 50% decrease in initial ABTS concentration. Ascorbic acid was used as a standard. Ali measurements were performed in triplicate.

Statistical analysis: Ali data were expressed as Mean±Standard deviations of triplicate measurements.

The confidence limits were set at p<0.05. Standard Deviations (SD) did not exceed 5% for the majority of the values obtained.

RESULTS

The Tunisian Neroli essential oil obtained by hydrodistillation from flowers of C. aurantium L. has a light yellow color and a very pleasant soft odor characteristic of the orange tree flower that is "fresh", "zesty" and "citral". The extraction yield of hydrodistilled C. aurantium L. essential oil was 0.12%.

Chemical corn position:

Nero li oil was analyzed by GC-F1D and GC-MS. Thirty three components were identified, representi ng 99% of the total components in the essential oil from the flowers of C. aurantium L. The constituents identified by GC-MS analysis, the retention indices and area percentages are surnmarized in Table 1. The Neroli oil

Antimicrobial activity:

The in vitro antirnicrobial potential of Neroli essential oil (C. aurantium L.) was evaluated against 3 Gram positive bacteria, 3 Gram negative bacteria, 2 yeasts and 3 fungi by zone diameter. These morphologically and physiologically different microorganisms were selected on the basis of their relevance as food contaminants. As it can be seen in Table 2 and 3, the essential oil was found to have good to excellent antirnicrobial activities against all microorganisms tested except for Staphylococcus aureus since no inhibition zone was observed.

Neroli oil showed a reasonable in vitro antibacterial activity compared with references against all the tested bacteria including Gram-positive and Gram-negative with inhibition zones diameter 11 to 19 mm (Table 2). Among the Gram-negative bacteria, the oil was very active against P. aeruginosa which the response was else the same as that of the standard antibiotic (Nalidix acid) (19 mm).

Marked antirnicrobial activity of Nero li essential oil was observed against the 2 yeasts Saccharomyces cerevisiae (20 mm) and Candida albicans (22 mm) (Table 3). In addition, N eroli oil exhibited a great potential for antifungal activit:y against the 3 tested f ung i more as that of the standard antibiotic (N ystatin), as evidenced by their inhibition zones which are 27 mm against 24 mm for Antioxidant activity: Free radical activit:y of Neroli oil was investigated by ABTS assay. A moderate antioxiclant activit:y was obtained to scavenge the ABTS radical cation (IC 50 of 672±4 mg L _,) (Table 4).

DISCUSSION

Chemical com p osition: Results showed some differences in composition with respect to data in literature. [START_REF] Anonis | Neroli in perfumery[END_REF], [START_REF] Boelens | The chemical composition of the peel oils from unripe and ripe fruits of bitter orange, Citrus aurantium L. ssp. arnara engl[END_REF], [START_REF] Lin | Chemical constituents of the essential oil from the flowers, leaves and peel of Cit r us aurantium (Chin.)[END_REF]Zhu et al. (1993) found that the Neroli oil is characterized by the dominance of linalool (37.5-74%) while no significant quantity was detected in the Tunisian Neroli oil. Conversely, limonene, the main component of the TW1isian Neroli oil (27%), has been foW1d in very weak quantities except in the Spanish Neroli oil (16.6%) [START_REF] Boelens | The chemical composition of the peel oils from unripe and ripe fruits of bitter orange, Citrus aurantium L. ssp. arnara engl[END_REF].

In the present study, much higher concentration of (E)-nerolidol (17 .5% ), a-terpineol (14%) and a-terpinyl acetate (11. 7%) were found. However, several components such as �-pinene and citronellol, mentioned in the literature, were not detected in our oil [START_REF] Anonis | Neroli in perfumery[END_REF][START_REF] Boelens | The chemical composition of the peel oils from unripe and ripe fruits of bitter orange, Citrus aurantium L. ssp. arnara engl[END_REF]. These changes in the essential oil composition might arise from several environmental ( clirnatical, seasonal, geographical) and genetic differences [START_REF] Perry | Essential oils from Dalmatian Sage (Salvia officinalis L): Variations among yndividuals, plant parts, seasons and sites[END_REF].

Antimicrobial activity:

Results obtained in this study show that N eroli oil does not have selective antibacterial activity on the basis of the cell-wall differences of bacterial microorganisms (Gram-positive or Gram-negative bacteria) as reported previously [START_REF] Cosentino | ln vitro antimicrobial activity and chemical composition of sardinian Th ym us essential oils[END_REF]Karaman et al., 2003). In fact, a general observation derived from studies with essential oils from many other plant species [START_REF] Nostro | Extraction methods and bioautography for evaluation of medicinal plant antimicrobial activity[END_REF][START_REF] Ouattara | Antibacterial activity of selected fatty acids and essential oils against six meat spoilage organisms[END_REF] showed that the antimicrobial activity of the tested essential oil was more pronounced against Gram-positive than against Gram-negative bacteria. This generally higher resistance among Gram-negative bacteria could be ascribed to the presence of their phospholipidic membrane, almost impermeable to lipophilic compounds [START_REF] Nikaido | Molecular basis of bacterial outer membrane permeability[END_REF]. The absence of this barrier in Gram-positive bacteria allows the direct contact of essential oil's hydrophobie constituents with the phospholipid bilayer of the cell membrane, where they bring about their effect, causi ng either an increase of ion permeability and leakage of vital intracellular constituents, or impairment of the bacterial enzyme systems [START_REF] Cowan | Plant products as antimicrobial agents[END_REF]W endakoon and Sakaguchi, 1995). The antimicrobial activity of an essential oil is related in most cases to its major components. Referring to the literature, the most frequently occurri ng constituents in N eroli oil showi ng high antifungal activity were limonene, (E)-nerolidol and (E,E)-farnesol [START_REF] Lee | Antifungal effect of eugenol and nerolidol against Microsporum gypseum in a guinea pig model[END_REF][START_REF] Wilson | Rapid evaluation of plant extracts and essential oils for antif ung al acti vity against Botrytis cinerea[END_REF]Ramage etal., 2002).

Although limonene (27%) and (E)-nerolidol (17 .5%), two major components of Neroli oil, presented a st r ongly positive antifungal activity, they are inactive as antibacterial agents [START_REF] Kim | Antibacterial activit:y of s orne essential oil components against five foodbome pathogens[END_REF]. a-terpineol which was found to be in appreciable amounts in the oil of this study (14%), has been reported to inhibit the growth of a quite number of bacteria and fungi that include E. coli, S. epidermis and C. albicans [START_REF] Carson | Antimicrobial activity of the major components of the essential oil of Melaleuca alternifolia[END_REF]Ramanetal., 1995).

It is necessary to signal that other compounds in lower amount may also contribute to improve this stro ng er activity. In fact, the synergistic effects of the diversity of major and minor constituents present in the essential oils should be taken into consideration to account for their biological activity.

In this context, terpinen-4-ol, a minor constituent in the oil under study (0.4%), is reported [START_REF] Carson | Antimicrobial activity of the major components of the essential oil of Melaleuca alternifolia[END_REF] to show activity against these organisms. It is also said to be responsible for the broad spectrum activity of the essential oil of Melal euca alternifolia (tea tree oil) [START_REF] Sean | Dete1mining the antimicrobial actions of tea tree oil[END_REF]. Another minor constituent, �-caryophyllene oxide (0.1%), is known to have very efficient antibacterial properties [START_REF] Magiatis | Chemical composition and in vitro antimicrobial activity of the essential oils of three Greek Achillea species[END_REF].

Although, these compounds are not abundant in the essential oil, their activity could be important.

Antioxidant activity: Antioxidant activity of Neroli oil is largely depending on its chemical composition. In the present study, the major component of Neroli oil, limonene, had low ABTS free radical scave ng ing activity. This result was confirmed by previous studies in which commercially obtained limonene displayed negligible antioxidant activity [START_REF] Ruberto | Antioxidantactivity of selected essential oil components in two lipid mode! systems[END_REF]. Although, y-terpinene, a minor component in Neroli oil, is known to show high antioxidant activity, no activity was observed here, since its concentration was too low (0.3%).

Essential oils are quite complex mixtures constituted by several tens of components and this complexity makes it often difficult to explain the activity pattern. For this reason, many reports on the antioxidant potentials of the essential oils often refer to concepts such as synergism, antagonism and additivity.

From a general point of view, phenols were confirrned to possess strong antioxidant activity [START_REF] Ruberto | Antioxidantactivity of selected essential oil components in two lipid mode! systems[END_REF]. In particula r , oxygenated monoterpenes ( especially two well known phenolic compounds, thymol and carvacrol) are mainly responsible for the antioxidant potential of the plant oils which contain them [START_REF] Aeschbach | Antioxidant actions of th ym ol, carvacrol, 6-gi ng erol, zingerone and hydroxytyrosol[END_REF][START_REF] Baratta | Antimicrobial and antioxidant properties of some commercial essential oils[END_REF][START_REF] Lagouri | Composition and antioxidant activity of essential oils from oregano plants grown wild in Greece[END_REF]. Monoterpene hydrocarbons; particularly terpinolene, a-and y-terpinene, could also be taken into account for the antioxidative activity observed, but obviously, none has st r o ng er than that of oxygenated monoterpenes. The presence of strongly activated methylene groups in these molecules is probably the reason for this behavior. On the other hand, sesquiterpenes hydrocarbons and their oxygenated derivatives have very low antioxidant activity [START_REF] Ruberto | Antioxidantactivity of selected essential oil components in two lipid mode! systems[END_REF].

CONCLUSION

Cit r us aurantium L. flowers have a very stro ng aromatic odor. The high in vitro antimicrobial activity of N eroli oil could be attributed to the presence of a mixture of monoterpenes, sesquiterpenes, alcohols and esters which can be considered as promising for future utiliz.ation as a food preservative eliminating the growth of important foodbome pathogens and contributing to enhance food safety and shelf life. Separation of terpenes, responsible for the antimicrobial activity, would be an interesting study to identify the molecules generating the good efficacy.

  (Saccharomyces cerevisiae ATCC 4226 A, Candida albicans IP A 200) and 3 fungi (Aspergillus parasiticus NRRL 3174, Mucor ramamnianus ATCC 9314, Fusarium culmorum) were used.

Table 1 :

 1 Chemical com!)osition oeercenQ ofNeroli essential oil

	No.	RI	Com!)ounds	%
	1	878	Ethylbenzene*	0.1
	2	936	cx-pinene	0.2
	3	974	Sabinene	0.5
	4	985	p-myrcene	0.3
	5	1011	6-3-carene	2.4
	6	1025	p-cymene	0.2
	7	1028	Limonene	27.5
	8	1037	(E)-P-ocimene	4.3
	9	1050	Z-P-ocimene	0.8
	10	1057	y-terpinene	0.3
	11	1145	Isopulegol *	1.0
	12	1178	Terpinen-4-ol	0.4
	13	1185	cx-terpineol	14.0
	14	1278	Geraniol	0.3
	15	1291	Trans-sabinyl acetate	0.1
	16	1322	Geranial	0.3
	17 18	1338 1352	Methyl anthranilate cx-terpinyl acetate	1.2 11.7
	19	1359	P-terpinyl acetate	1.7
	20	1389	P-elemene	0.3
	21	1428	y-elemene	3.4
	22	1436	Gerany 1 acetone	0.1
	23	1480	Germacrene D	0.7
	24	1540	(E)-nerolidol	17.5
	25	1565	Z-nerolidol	0.2
	26	1580	P-caryophyllene oxide	0.1
	27	1652	cx-cadinol	0.1
	28	1720	(E,E)-famesol	8.0
	29	1733	E,E-famesal	0.9
	30	2202	Docosane*	0.1
	31	ND	cx-terpinyl formate*	0.3
	32	ND	Nerolidyl propionate•	0.1
	33	ND	Tetratetracontane•	0.1
	Total			99.0
			Monoteipene hydrocarbons	36.2
			Monoteipenes oxygenated	14.1
			Sesquiterpenes hydrocarbons	4.1
			Sesquitel]lenes oxygenated	26.2
			Othei-s	18.4
	*Tentatively identified supported by good match of MS, ND: Not
	determined

  Aspergillus parasiticus, 35 mm against 31 mm for Mucor ramannianus and 35 mm against 31 for Fusarium culmorum.

	L. monocytogenes	E. coli	P. aerugenosa	K pnewnoniae
	16	18	19	11
	31
		30	19	28
	A. parasitic us	M ramannianus	F culmorwn
	27		35	35
	24		31	31
	Table 4: Free radical scavenging capacity ofNeroli essential oil Samples ABTSIC 50 (mgL-1 )
	Essential oil
	Neroli			672.0±4.0
	Reference standard
	Vitamine			1.9±0.1
	Standard Deviations (SD) did not exceed 5%

Microbial strain: Neroli essential oil was tested against a panel of microorganisms. Seven bacteria including 3 Gram-positive (Bacillus subtillis ATCC 6633, Staphylococcus aureus CIP7625, Listeria monocytogenes Scott A 72 4) and 4 Gram-negative (Escherchia coli

ACKNOWLEDGMENTS

The authors are thankful to Prof. Manef Abderrabba and Miss Ines Ellouze for their collaboration. W e are also especially thankful to our colleagues Dr. Naceur Harndi and Dr. Ines Sallami.


André Seznec
email: seznec@irisa.fr

Towards Phase Change Memory as a Secure Main Memory

Phase change memory (PCM) technology appears as more scalable than DRAM technology. As PCM exhibits access time slightly longer but in the same range as DRAMs, several recent studies have proposed to use PCMs for designing main memory systems. Unfortunately PCM technology suffers from a limited write endurance; typically each memory cell can be only be written a large but still limited number of times (10 7 to 10 9 writes are reported for current technology). Till now, research proposals have essentially focused their attention on designing memory systems that will survive to the average behavior of conventional applications. However PCM memory systems should be designed to survive worst-case applications, i.e., malicious attacks targeting the physical destruction of the memory through overwriting a limited number of memory cells.

In this paper, we propose the design of a secure PCM-based main memory that would by construction survive to overwrite attacks. In order to prevent a malicious user to overwrite some memory cells, the physical memory address (PA) manipulated by the computer system is not the same as the PCM memory address (PCMA). PCMA is made invisible from the rest of the computer system. The PCM memory controller is in charge of the PA-to-PCMA translation . Hiding PCMA alone does not prevent a malicious user to overwrite a PCM memory word. Therefore in the secure PCM-based main memory, PA-to-PCMA translation is continuously modified through a random process, such preventing a malicious user to overwrite some PCM memory words. PCM address invisibility and continuous random PA-to-PCMA translation ensures security against an overwriting attack as well it ensures a practical write endurance close to the theoretical maximum. The hardware overhead needed to ensure this security in the PCM controller includes a random number generator and a medium large address translation table.

Introduction

Phase change memory (PCM) technology [START_REF] Raoux | Phase-change random access memory: a scalable technology[END_REF] appears as a promising technology for designing main memory in future computer systems [START_REF] Lee | Architecting phase change memory as a scalable dram alternative[END_REF][START_REF] Zhou | A durable and energy efficient main memory using phase change memory technology[END_REF][START_REF] Qureshi | Scalable high performance main memory system using phasechange memory technology[END_REF][START_REF] Qureshi | Enhancing lifetime and security of pcm-based main memory with start-gap wear leveling[END_REF]. PCM presents advantages over DRAMs in terms of static energy consumption as well as integration scalability for future technologies generations; for instance, [START_REF] Qureshi | Scalable high performance main memory system using phasechange memory technology[END_REF] anticipates a 4X higher memory density with PCM than with DRAM. Since PCM presents read access time in the same range as DRAMs, PCM has been recently considered as an alternative for designing main memory systems [START_REF] Lee | Architecting phase change memory as a scalable dram alternative[END_REF][START_REF] Zhou | A durable and energy efficient main memory using phase change memory technology[END_REF][START_REF] Qureshi | Scalable high performance main memory system using phasechange memory technology[END_REF][START_REF] Qureshi | Enhancing lifetime and security of pcm-based main memory with start-gap wear leveling[END_REF]. Unfortunately, PCM suffers from a limited write endurance, i.e., a PCM memory cell can only support a limited number of writes and exceeding this limit might impair its correct functioning. The reported write endurances for PCM memory vary between 10 7 and 10 9 writes on a single cell. Such a limited endurance has been recognized as a major issue for the design of PCM-based main memory systems. Several propositions [START_REF] Lee | Architecting phase change memory as a scalable dram alternative[END_REF][START_REF] Zhou | A durable and energy efficient main memory using phase change memory technology[END_REF][START_REF] Qureshi | Scalable high performance main memory system using phasechange memory technology[END_REF][START_REF] Qureshi | Enhancing lifetime and security of pcm-based main memory with start-gap wear leveling[END_REF] have been made to allow a PCM main memory to survive the anticipated lifetime of a computer system, i.e., 10 to 20 years, in the context of general applications.

The security hole of PCM based main memory At the exception of [START_REF] Qureshi | Enhancing lifetime and security of pcm-based main memory with start-gap wear leveling[END_REF], these studies completely ignore the security breach that the limited write endurance of PCM components would create in a main memory. Using PCM components for main memory would create an opportunity to a malicious attacker to physically destroy the main memory through a very simple program overwriting the same memory cells again and again. The potential attack is particularly simple to mount. It can be run by any user without any execution privilege.

Qureshi et [START_REF] Qureshi | Enhancing lifetime and security of pcm-based main memory with start-gap wear leveling[END_REF] mention that their Region Based Start Gap scheme would survive to such a naive overwrite attack consisting in constantly overwriting the same physical memory address. However in Section 2, we will explain why the RBSG scheme is not secure.

If this overwrite security breach is not closed then no reasonable computer manufacturer will ever consider PCM for implementing main memory.

Contribution In this paper, we propose the design of a secure main PCM memory that will not suffer from this security breach. In order to prevent a malicious user to overwrite some memory cells, the physical memory address (PA) manipulated by the computer system is not the same as the PCM memory address (PCMA) as proposed in [START_REF] Qureshi | Enhancing lifetime and security of pcm-based main memory with start-gap wear leveling[END_REF]. PCMA is made invisible from the rest of the computer system. The PCM memory controller is in charge of the PA-to-PCMA translation . Hiding PCMA alone does not prevent a malicious user to blindly overwrite some PCM memory blocks. Therefore in the secure PCM-based main memory, PA-to-PCMA translation is continuously modified through a random process. This prevents a malicious user to overwrite some PCM memory words, it also uniformizes the write pressure on the overall memory for every possible type of workloads. For implementing the PA-to-PCMA translation, the PCM memory controller implements a translation table and needs an efficient random number generator. Our study shows that for PCM memory components with write endurance in the 10 8 -10 9 range, associating a single translation table entry with a 4K memory blocks region should be sufficient to ensure that the resulting PCM memory would reach 74-83 % of the expected total memory write endurance if writes were uniformly distributed on the main memory while generating an extra 12.5 % writes on the PCM memory.

2 Deconstructing the security of Region Based Start-Gap scheme [START_REF] Qureshi | Enhancing lifetime and security of pcm-based main memory with start-gap wear leveling[END_REF] 2.1 The start-gap scheme

The start-gap scheme proposed in [START_REF] Qureshi | Enhancing lifetime and security of pcm-based main memory with start-gap wear leveling[END_REF] considers dynamic PA-to-PCMA translation that varies during the lifetime of the computer. PA is translated at run-time in PCMA through a logic function and this function is periodically slightly modified every N memory block writes on the PCM memory . In [START_REF] Qureshi | Enhancing lifetime and security of pcm-based main memory with start-gap wear leveling[END_REF], N=100 is considered. Thus the PAto-PCMA translation does not remain constant; at each parameter change, PA-to-PCMA translation is conserved for every physical memory block, apart one.

The start-gap scheme tends to smooth the distribution of writes on the PCM memory. However, for applications presenting spatial locality on memory writes, the initial start-gap scheme does not smoothly equalize the write charge on the PCM memory. Qureshi et al. [START_REF] Qureshi | Enhancing lifetime and security of pcm-based main memory with start-gap wear leveling[END_REF] augments their initial start-gap scheme with a pseudorandomization of the PA-to-PCMA translation. A Fleistel network function is first applied on PA and is followed by the start-gap mechanism. This overall scheme is shown to smoothly average the write pressure on the overall memory for a significant set of benchmarks, since it eliminates spatial locality on PCM memory writes.

Pointing out the security hole associated with malicious overwrite attacks, Qureshi et al. [START_REF] Qureshi | Enhancing lifetime and security of pcm-based main memory with start-gap wear leveling[END_REF] improve their scheme with applying start-gap to memory regions instead of the whole memory. The size R (measured in memory blocks of the region is determined in order to ensure that the PCM address of a physical memory block will be modified before W max writes on the region; W max being the write endurance of the PCM components. That is R < W max 100 . If the parameters of the Fleistel network function are unknown from the attacker (e.g. personalized for each machine at manufacturing time without any external access to read them) then this region-based stat-gap scheme (RBSG) should allow the PCM main memory to survive several months to a malicious attack consisting in constantly overwriting the same physical memory address.

The write traffic overhead of the start-gap scheme is very limited: one extra PCM memory block write per 100 physical writes.

Deconstructing the region based start-gap scheme security 2.2.1 Birthday paradox attack

Unfortunately, the RBSG scheme would not survive a slightly more malicious attack using the birthday paradox. If one picks random elements in a set of X elements then sequences with far less than X elements are very likely to exhibit pairs of equal elements: in a group of 24 persons, there is in average at least one pair of persons having the same birthday. For a set of 256K elements (resp. 64M), picking in average 645 (resp. 7230) random elements is sufficient to exhibit a pair of equal samples sequence are required for 2 18 (resp. 2 26 ) elements. Through leveraging this property, an attacker could significantly reduce the time needed to overwrite some memory block in the PCM memory.

A "birthday paradox" attack on a PCM memory would consist simply in overwriting the same physical block W max times, then randomly picking another physical memory etc. To counteract the delayed write policy suggested in [START_REF] Qureshi | Enhancing lifetime and security of pcm-based main memory with start-gap wear leveling[END_REF], one has simply to interleave 16 write flows. Our estimation for the example illustrating [START_REF] Qureshi | Enhancing lifetime and security of pcm-based main memory with start-gap wear leveling[END_REF] is that, assuming a 4 GBbytes/s write bandwidth, 4 hours in average would be sufficient for a "birthday paradox attack" for overwriting some block in the considered 16GB PCM main memory, while the theoretical write endurance of the overall memory should be 4 years. The attack could be implemented at user level without sophisticated knowledge of the intrinsics of the memory structure and/or flaws in the operating system.

Sandbagging RBSG is unpractical

One could try to improve the endurance of the RBSG scheme to birthday paradox attacks through decreasing the size of the regions in RBSG. Thus the size of the region could be decreased in order that the PA-to-PCMA translation of a block is guaranteed to be modified after at most W max I writes on the region. If the region features R blocks then one should enforce R < W max 100I For I in the range of 8-16, this would make the "birthday paradox" attack unpractical, but would bring back practicality to brute force attacks consisting in overwriting always the same physical memory: using I=8 in the example illustrating [START_REF] Qureshi | Enhancing lifetime and security of pcm-based main memory with start-gap wear leveling[END_REF] reduces the endurance interval of the PCM memory from 4 months to 2 weeks.

Moreover, if PCM components are used as main memory, a page mode as on DRAM would be needed order to fully exploit memory spatial locality on memory reads. To implement such a page mode, (for instance 4 Kbytes page ), the overall page should move at the same time, leading the write overhead of the RBSG scheme to the read and write of one page every N writes. To maintain a reasonable write bandwidth overhead, N should be in the order of 1000 instead of 100. This would further reduce the number of location for a block in a region: if the region features P pages then one should guarantee P < W max 1000I . Using I=8 in the example illustrating [START_REF] Qureshi | Enhancing lifetime and security of pcm-based main memory with start-gap wear leveling[END_REF] reduces the endurance interval of the PCM memory to an overwrite attack is further reduced by a factor 10, i.e., to one and a half day.

Analysis of RBSG weaknesses

To resist to an overwrite attack, the PA-to-PCMA translation must be modified dynamically at execution time.

The first weakness of the RBSG scheme as described in [START_REF] Qureshi | Enhancing lifetime and security of pcm-based main memory with start-gap wear leveling[END_REF] is associated with a faulty evaluation of this constraint; the authors assumed that dimensioning regions in order that the PA-to-PCMA translation of any physical block is modified before the write endurance of the associated PCM block is reached would be sufficient. Unfortunately the birthday paradox provides an opportunity of an efficient attack.

The second and more fundamental weakness of the RBSG scheme lies in the definition of the region-based start-gap scheme by itself. The PCM memory is statically divided in regions and the PA-to-PCMA translation local scheme is periodic. The attacker is guaranteed that the naive overwrite of the same physical memory block will result in writing always on the same region in the memory: the endurance of the whole PCM memory to a naive attack is limited to the endurance of a single region. The need to resist to the birthday paradox attack as well as the need for a page mode to ensure high read bandwidth reduce the practical number of PCM blocks on which a physical block can be mapped. Thus the practical endurance to overwrite attack of the whole PCM memory is only a small fraction of the overall theoretical endurance of the PCM memory. If a malicious attacker knows the PA-to-PCMA translation, then for a given PCM memory block B, he/she is able to figure out the address of the physical memory block that is mapped on B. If the PA-to-PCMA translation is made invisible from the outside of the PCM memory then the attacker can not retrieve the address of the physical memory block mapped on a given memory block. Figure 1 illustrates this invisibility: the computer system manipulates data in the physical address space, but has no access to the PCM address. Our analysis of the RBSG scheme has shown that, in order to resist a birthday paradox attack, the PA-to-PCMA translation of any physical block B has to be modified with a frequency largely higher than one time every W max possible writes on B.

The PA-to-PCMA translation changes should be completely unpredictable from the outside of the PCM memory; in particular there should be no restrictions on the new translation. Through limiting the translation change possibility to a single region, the RBSG scheme is providing an overwrite attack possibility.

Principles of a practical secure PCM-based main memory 3.2.1 PA-to-PCMA translation

In the secure PCM-based main memory we propose, the PA-to-PCMA translation is performed by the PCMmemory controller through the use of a translation table. For a physical memory block B, the address of the corresponding PCM block is computed from an entry read in the translation table and the address B. The PA-to-PCMA translation must perform a one-to-one address translation from the physical address space to PCM address space.

The simplest mapping would be to associate a translation table entry with each physical memory block and ensuring that the translation is a one-to-one block mapping. Such one-to-one block mapping appears as unpractical: for instance 256M entries would be needed to map a 16 GBytes memory using 64 bytes memory blocks, leading to an indirect translation table requiring approximately a gigabyte of storage in the PCM memory controller to implement the translation table. Instead, we associate a single translation table entry with a region of R contiguous memory blocks; for instance if 4K contiguous memory blocks are mapped by a single entry, 64K entries are sufficient to map 16 GBytes.

PA-to-PCMA region address translation Initializing at boot time the translation table T with a one-to-one region mapping is unpractical. Instead of such an initialization, we assume that at initialization time, the translation table T is initialized with only zeros, but that some computation is performed at run-time in addition to the read of the translation table. If memory regions are numbered from 0 to N-1, the translation is performed as follows: region B in physical memory is mapped onto region (T(B).address xor B xor R init), where R init is a random number generated at initialization time.

PA-to-PCMA region displacement translation The use of a single entry to map a complete region of the physical memory could lead to a possible overwrite attack on trying to write a specific block in all the regions, for instance the first block. In order to avoid such an attack, the displacement in the region is also translated. Physical memory block X in region B is mapped onto block ( T(B).disp xor X xor D init ) in region (T(B).address xor B xor D init). As R init, D init is a random number generated at initialization time. This PA-to-PCMA translation is illustrated on Figure 2.

T(B).addr ⊕ B ⊕R_init T(B).disp ⊕X ⊕ D_init

Dynamically changing PA-to-PCMA translation

In order to avoid blind overwrite attacks, the PA-to-PCMA translation must be continuously modified. More precisely, only writes represent an issue. Therefore, the PA-to-PCMA translation modification is triggered randomly and only on memory writes.

This random triggering is particularly important: As an example, if the PA-to-PCMA translation change occurs periodically on writes, for instance every 10 writes, an attacker could repeat the sequence of nine consecutive writes on physical block B, one write on physical block C. Physical block C moves in the PCM memory, but block B remains on the same PCM memory location that can be easily overwritten.

How to modify PA-to-PCMA translation Modifying the PA-to-PCMA translation for a physical region B is implementing through swapping the translations for two physical regions. This guarantees that the PA-to-PCMA translation remains a one-to-one mapping. The region swapping induces the modification of two entries in the translation table as described below.

A random physical region B' is chosen and the PA-to-PCMA translations of B and B' are exchanged, i.e., T(B).address := old(T(B').address) xor B' xor B and T(B').address := old(T(B).address) xor B' xor B. At the same time, displacement translations inside blocks B and B' are also modified,: T(B).disp: =old(T(B)).disp xor RAND and T(B').disp: =old(T(B')).disp xor RAND where RAND is randomly selected 1 .

The two memory regions in the PCM memory have to read and swapped accordingly.

Frequency of PA-to-PCMA translation modifications The cost of a PA-to-PCMA translation modification is proportional to the size R of a region in the memory. The two swapped regions have to be read and rewritten, i.e., a PA-to-PCMA translation modification induces 2 R memory block reads and 2 R memory block writes. Therefore, the frequency of the address translation modification should be chosen in order to maintain the total overhead to a reasonable level. In this study, we arbitrarily estimate that inducing in average one extra write on the PCM memory per 8 effective writes would be acceptable. That is, in average one out of 16 R physical memory block writes can trigger a PA-to-PCMA address translation modification. Therefore on receiving a write on a physical memory block, the modification of its PA-to-PCMA translation is randomly triggered with probability 1 16R .

Putting all together in the memory controller

The design of a secure PCM-based main memory lead to several constraints inside the memory controller.

Write endurance and region size

The principles above in Section 3.2 lead to the design of a PCM-based main memory on which an overwrite attack would only be able to consecutively write the same memory block in average 16R times before the physical block is moved in another PCM memory block. In practice, a write attack could succeed in significantly reducing the lifetime of the memory, if 16R is not small with respect to the write endurance of the cells.

We run simulations of an overwrite attack on a 16 GBytes PCM memory i.e., 2 28 64-byte blocks. Regions of respectively 64K, 4K and 256 memory blocks were considered. If the memory features a write endurance of W max = 2 E writes, then the theoretical write endurance of a uniformly accessed PCM memory is 2 28+E .

With a write endurance of only 8 Megawrites (2 23 ) per cell, using 64K memory blocks per region is not an option: some memory blocks would be destroyed by a brute force overwrite attack in less than a billion (2 30 ) writes. With 4K memory blocks regions, the PCM memory would be able to support an attack consisting of up to 38 % of the theoretical 2 51 writes. With 256 memory block regions, this ratio would increase up to 71 %.

If the write endurance is 128 Megawrites per cell (2 27 ) then these respective ratios become 38 % for 64K memory blocks regions, 74 % for 4K memory blocks region and 85 % for 256 memory blocks region for a theoretical maximum of 88.88 % since in average one extra block write is triggered for 8 physical memory writes.

If the write endurance is 1 Gigawrites per cell (2 30 ) then these ratios become 65 % , 83 % and 86% for 64K, 4K and 256 memory block regions respectively.

Therefore, if the technology is able to ensure write endurance in the billion range then even very large regions could be considered for PA-to-PCM translations.

Memory controller constraints

The secure PCM main memory would need to integrate extra hardware in the memory controller to implement the secure PA-to-PCMA translation.

Memory storage volume

The storage volume of the PCM memory controller is a major issue. The main component is the translation table that features an entry per memory region. For a 16 GB memory, the use of regions of 256 64-bytes blocks would lead to 1 M entries, each entry featuring the address of region (20 bits) and a displacement in the region (8 bits) i.e. a total of 28 bits. The total storage cost of the translation table would be 3.5 Megabytes. Using larger granularity regions for instance 4K 64-byte blocks would lead to a much smaller 224 Kbytes translation table.

For a 256 GB memory, using 4K 64-bytes blocks regions would still appear possible since it would lead to a 4 Megabytes translation table. For such a 256 GB memory and 64K 64-byte blocks regions would only necessitate 256 Kbytes for the translation table.

Swapping memory regions logic The memory controller has to handle the important function of swapping two memory regions on a PA-to-PCMA translation change. This induces a large number of memory reads and writes. An atomic swap of the two memory regions would stop the normal read and write accesses by the computer system . This would not unacceptable.

Therefore the memory controller must feature logic to interleave blocks swapping with the normal flow of reads and writes from the computer system. The logic must be able to handle the case where a normal write is overwriting a block belonging to one of the memory regions being swapped. Moreover this normal flow of writes may randomly trigger new region swaps; the memory controller should be able to buffer these swaps.

The priority on writes must be dynamically adapted in order to maintain a limited number of regions waiting for swaps, for example at most 8 swaps. As an example, we tested a policy randomly splitting the write priority to 1/4th for region swapping and 3/4th for normal write flow when less than 4 region swaps are waiting and one half for region swapping and one half for normal write flow when 4 or more region swaps. On an experiment on 2 40 writes and assuming a continuous saturated write flow from the computer system, there was never more then 8 waiting region swaps.

Extra PA-to-PCMA translation latency The extra access time to main memory due to PA-to-PCMA translation is essentially due to the read of the PA-to-PCMA translation table. This table will be implemented as a SRAM table in the memory controller. For a 16 GB memory using 4K 64-byte blocks region, the read access time of a 224Kbytes SRAM memory would in the range of 3-5 processor cycles and would be marginal compared with the overall main memory access time.

The random number generator Our secure PCM-based main memory will be able to resist to an overwrite attack if no one is able to follow or reconstruct the PA-to-PCMA translation process. Our proposal heavily relies on a random number generator. The security of our proposal also depends of the security of this random number generator.

One can remark that the output of the random number generation used in our memory controller cannot be directly observed from the outside of the PCM memory. Therefore different possible schemes could be implemented ranging from a true hardware random generator to a simpler algorithmic pseudo-random number generator personalized with a huge key at manufacturing time.

A secure PCM main memory might become practical in a few years

A need for large write endurance per cell A rule of thumb that has been approximately respected for the past 10 years has been that in general purpose computer systems, the processor was able to write its complete main memory in a second. That is if a system features X GBytes, its achievable memory write bandwidth is in the X GBytes/s range.

This rule of thumb is very useful to determine at which write endurance threshold, the PCM technology will become reliable enough to consider using it as main memory for computer systems. As Qureshi et al [START_REF] Qureshi | Enhancing lifetime and security of pcm-based main memory with start-gap wear leveling[END_REF], we approximate a year by 2 25 seconds. Therefore, a memory system randomly and uniformly exercised at full write bandwidth will necessitate a endurance per cell of 2 25 writes per cell and per year of expected life of the system. That is a write endurance per cell of 256 Megawrites for 8 years and 1 Gigawrites for 32 years.

Economic feasibility of PCM main memory If within a few years, the write endurance per cell on PCM components reach a billion writes then it would become feasible to build 16 GBytes (or larger) memory using comparatively very small PA-to-PCMA translation table (for instance, using 64K memory regions): as mentioned above, the secure PCM memory would be able to survive to an overwrite attack at full write bandwidth for 65 % of an expected lifetime of 32 years.

Page mode is compatible with security If PCM memories are used as main memory then a page mode would be interesting as on current DRAM to limit the access latency and increase bandwidth when the memory read requests exhibit high spatial locality. Our PA-to-PCMA translation scheme is compatible with such page mode since regions are large enough to accommodate large page, even split across several PCM components.

Conclusion

If the promises of the PCM technology are fulfilled (4X higher integration density, 1 billion write endurance per cell, access time in the same range as DRAMs, dynamic energy consumption in the same range as DRAMs) then it will become economically feasible to build a main memory from PCM memory component in the next few years. Such a PCM-based main memory will particularly be attractive due to its very low static energy consumption. However to consider such a memory for an industry product , the PCM based memory would have to be able to resist to software overwrite attacks targeting its physical destruction.

In this paper, we have proposed a first secure PCM based main memory that will resist to overwrite attacks . By hiding the effective PCM memory address from the rest of the computer system and continuously and randomly moving the physical memory blocks in PCM memory, overwrite attacks are made impossible. The proposed PAto-PCMA translation scheme uniformizes and randomizes the write flow on PCM memory for malicious overwrite attacks as well as conventional non malicious applications. Our scheme requires some hardware overhead in the memory controller (essentially a PA-to-PCMA translation table, the memory region swapping logic and a random number generator). But it brings the practical write endurance of the overall PCM main memory in 70-85 % of the theoretical write endurance of a uniformly accessed PCM memory.

  3 A secure PCM-based main memory 3.1 Security principles 3.1.1 Invisible PA-to-PCMA translation is required

Figure 1 :

 1 Figure 1: Physical memory address space and PCM memory address space

Figure 2 :

 2 Figure 2: PA-to-PCMA translation More complex translation functions replacing D init and R init by functions randomly parameterized at initialization time can be considered.

RR n°7088

The same RAND is used since it allows to exchange the blocks one per one among the B and B' regions.INRIA

Acknowledgments

This work was partially supported by the European Commission in the context of the SARC integrated project #27648 (FP6).