Grégory Bonnet

A Protocol Based on a Game-Theoretic Dilemma to Prevent Malicious Coalitions in Reputation Systems

In decentralized and open systems, a large number of agents interact and make collective decisions in order to share resources. As those systems are open, the presence of malicious agents needs to be considered. A way to deal with such agents in a decentralized fashion is to use reputation systems. But, as reputation systems are based on the aggregation of local trust between the agents, they are vulnerable to malicious coalitions, particularly to self-promotion based on false identities. In this paper, we propose a game-theoretic approach to prevent such manipulations. Its main feature is that honest agents use in turn a false-name manipulation to fool malicious agents and to drive them into a dilemma. We show that the best response to that dilemma in terms of mixed strategy equilibrium leads the malicious agents to give up most of their manipulations.

Introduction

In decentralized and open systems, a large number of agents interact and make collective decisions in order to share resources such as skills, knowledge, computational power, or mass memory. Those systems are designed to provide a decentralized service to their members such as composing Web services, grid computing, or providing an electronic market place. In order to insure the nominal use of such systems, it is assumed that the agents follow the rules defined by a protocol or by norms. Even if the agents might be altruistic, cooperative or competitive, it is also assumed that they are honest entities within the system. However, as those systems are open, some malicious agents can misuse the rules to their own profit or disrupt the service. Consequently, their presence needs to be considered. Such problematics lead to study the concept of trust and the use of reputation systems. Those systems allow the agents to modelize the interactions they observe or they make in order to decide if interacting with a given agent is ap r i o r iacceptable. This acceptance (or trust) notion means that the investigated agent behaves well and is reliable. Even if the reputation systems are designed to detect the behavior of a single agent, they are vulnerable to malicious coalitions [START_REF] Hoffman | A survey of attack and defense techniques for reputation systems[END_REF]. Indeed, reputation systems are based on the aggregation of local subjective trust values between the agents. In addition of the aggregation of opinion issues, a set of malicious agents is able to report a high trust level for each other in order to artificially increase their reputation. Such manipulation is a self-promoting attack and can be used for instance to fool eBay's reputation system [START_REF] Dini | Buying reputation on eBay: do recent changes help?[END_REF], Google's PageRank algorithm [START_REF] Cheng | Manipulability of PageRank under Sybil strategies[END_REF], or even to free-ride on peer-to-peer networks [START_REF] Sirivianos | Free-riding in Bit-Torrent networks with the large view exploit[END_REF]. Conversely, a set of malicious agents is able to report a low trust level for an honest agent and artificially decrease its reputation. Such manipulation is a slandering attack and can be used jointly with selfpromotion in order to enhance its effects. Moreover, in any system where the authentification mechanisms can be fooled, a single malicious agent can enter the system with multiple identities and create a virtual coalition to manipulate the reputation system. Such manipulation is called a Sybil attack [START_REF] Douceur | The Sybil attack[END_REF]. As dealing with malicious coalitions is critical for reputation systems, much work have been done towards this end [START_REF] Levine | A survey of solutions to the sybil attack[END_REF]. These proposals cover a broad area ranging from cryptographic puzzles to insure the unicity of the agents, to the detection of communities inside social networks, and the design of robust reputation functions. A recent way assumes that the malicious agents are rational agents and proposes to use game-theoretic techniques to provide incentives not to fool the system [START_REF] Conitzer | Using mechanism design to prevent falsename manipulations[END_REF]. Such approaches are interesting because they can be extended to other applications such as combinatorial auctions and voting procedures. In this context, this paper proposes a game-theoretic approach to prevent some specific collusions in reputation systems. Its specificity is based on the fact that the honest agents use in turn a Sybil attack to fool the malicious agents. The paper is organized as follows. We first introduce related work in Section 2. In Section 3, we give details about the proposed protocol before analysing it under a game-theoretic perspective in Section 4. Before concluding, we show the advantages and the limits of our protocol with simulation results in Section 5, raising some questions to be answered by future work.

Related work

In the literature about trust, reputation functions can be symmetric, meaning that each agent in the system contributes to the reputation calculus, or asymmetric, meaning that the local trust is only propagated through aprioritrusted agents such as in a social network. [START_REF] Cheng | Sybilproof reputation mechanisms[END_REF] shows that a symmetric reputation function cannot prevent manipulations whereas asymmetric reputation functions can, if and only if they satisfy strong properties that make them weakly informative and difficult to design. Moreover, if reputation functions reduce the trust values of the witness agents when the agents they recommend act in a bad way, such approach is vulnerable to whitewashing where malicious witnesses can change their identities to reset to a default trust value. Hence, other solutions based on detecting the malicious witnesses before interacting with the recommended agent were proposed [START_REF] Levine | A survey of solutions to the sybil attack[END_REF]. A first class of solutions consists in preventing the Sybil attacks that facilitate the manipulations. Some approaches such as [START_REF] Castro | Secure routing for structured peer-to-peer overlay networks[END_REF] propose to use a central trusted authority that certifiates each agent, but it reduces the decentralization and openness properties of the system. Moreover, a central authority is alway a failure point in the system. Another approach introduces a recurring cost to join the system, such as solving a cryptographic puzzle [START_REF] Borisov | Computational puzzles as Sybil defenses[END_REF], paying a financial fee or using captchas. Therefore, creating a large number of false identities to manipulate the system is difficult. However, malicious agents can have a huge amount of computational resources thanks to botnets, and these methods are still very constraining for honest agents. A second class of solutions [START_REF] Viswanath | An analysis of social network-based Sybil defenses[END_REF] consists in detecting malicious communities inside a social network. Such approaches assume the Sybil agents present either a high clustering coefficient with a few links outside [START_REF] Conitzer | False-name-proofness in social networks[END_REF][START_REF] Yu | SybilLimit: a near-optimal social network defense against Sybil attacks[END_REF], or a common identifier range [START_REF] Cholez | Efficient DHT attack mitigation through peers' ID distribution[END_REF]. They use clustering techniques from link mining or graph analysis litterature to cut the graph between honest and Sybil agents. However, these approaches address the Sybil attack problem and cannot consider malicious coalitions between true distinct agents. In order to propose a general framework that can address both Sybil attacks and distinct agents collusions, recent works focus on game-theoretic approaches [START_REF] Conitzer | Using mechanism design to prevent falsename manipulations[END_REF][START_REF] Liao | A taxonomy of game theoretic approaches agains attacks in wireless ad hoc networks[END_REF][START_REF] Margolin | Informant: detecting Sybils using incentives[END_REF][START_REF] Pal | A discriminatory rewarding mechanism for Sybil detection with applications to Tor[END_REF] by assuming that the malicious agents are rational. Those approaches make the link with the false-name manipulation problem in weighted voting game [START_REF] Bachrach | Divide and conquer: false-name manipulations in weighted voting games[END_REF] and combinatorial auctions [START_REF] Yokoo | The effect of false-name bids in combinatorial auctions: new fraud in Internet auctions[END_REF] where false-name-proofness means that an agent never benefits from participating more than once. For instance, the Informant protocol [START_REF] Margolin | Informant: detecting Sybils using incentives[END_REF] and its application to Tor [START_REF] Pal | A discriminatory rewarding mechanism for Sybil detection with applications to Tor[END_REF] is based on a game where the honest agents use a Dutch auction to reward the malicious agents that reveal themselves. However, it assumes the reward is built on a recurring fee, and the protocol may incite new malicious agent to join the system. In this context, we propose to prevent self-promoting manipulation on reputation functions without recurring fee or huge computational cost for the honest agents. For this, we propose a protocol based on a game that causes a dilemma only to malicious agents if they are rational. We use the answer to this dilemma to partition agents into honest and malicious agents.

A Sybil-based protocol

We first introduce the reputation system we consider, the manipulations we address and highlight the major features of our protocol.

Reputation system

Let us reuse the definition of a reputation system given by [START_REF] Cheng | Sybilproof reputation mechanisms[END_REF]. For convenience, we denote by A the truster agent, by B the trustee agent and by Wi a witness agent: E) be an oriented graph where V is a set of agents and E ⊆ V × V an interaction relation labeled by a trust value c : E -→ [0, 1]. The reputation of an agent B according to an agent A with respect to a trust network G is given by a function fG : V × V -→ [0, 1] where:

Definition 1 Let G =(V,
fG(A, B)= max P AB ∈G ⊕P ∈P AB ⊙ (P )

PAB is the maximum set of disjoint paths between A and B in G in the sense of inclusion, ⊙ is an aggregation operator on c along a single path P between A and B, and ⊕ is an aggregation operator on g along all disjoint paths between A and B.

Example 1 The FlowTrust reputation system proposed by [START_REF] Cheng | Sybilproof reputation mechanisms[END_REF] is defined by ⊙ = , ⊕ =max. The reputation of an agent B according to an agent A is given by the maximum value over the products of the trust values among all disjoint paths between A and B.

Each agent A makes a decision about trusting or not the agent B with respect to its reputation. In our model, as fG represents the collective agregation mechanism, g and ⊕ are common to all agents, whereas d is a private and subjective decision function. Therefore, d can be different for all agents. Whatever d is, computing the reputation of a given agent involves searching through the interaction graph and asking the involved agents their trust value.

Manipulation properties

In this paper, we only consider self-promoting manipulations where the malicious agents support each other and want to fool every other agent in the system. It corresponds to many real-world attacks, such as PageRank manipulation, Tor poisoning and free-riding on peerto-peer networks. Indeed, the aim of the malicious agents is that all honest agents interact with at least one member of the malicious coalition. Consequently, a self-promoting manipulation is defined as follows.

Definition 3 ∀ A ∈ V that asks an agent B its value c(B, Wi),i f Wi is in collusion with B then c(B, Wi) > 0.5.
This definition means that every agent within a malicious coalition reports a high trust towards the others. They form a high mutual trust cluster. We can deduce two things from this definition. Firstly, the malicious coalition is characterized by a high mutual trust among its members. Therefore, we assume that the honest agents know a suspicion function which computes the probability that two agents are in collusion with respect to a given trustee agents. Such a function is a heuristic representing a knowledge about the assumption we made on the malicious coalition. Such function may be defined as follows:

Definition 4 Let M : V × V -→ [0, 1] be a suspicion function such that M (W1,W2)=c(W1,W2) × c(W2,W1
). The higher is M (W1,W2), the more likely W1 and W2 are in collusion.

Considering two distinct witnesses that individually trusts the trustee agent B, the more the witnesses trust each other, the more likely they are in collusion. Secondly, as the malicious agents want to fool every honest agent within the system, their behavior is the same in the front of all the other agents. Consequently, they can be fooled in return. Indeed, an honest agent A can ask a witness W1 its trust value for another witness W2,thenaskW2 its trust value for W1, both under the pretence of computing a trust network whereas A uses these trust values to determine if there is a malicious collusion.

Building the trust network

The protocol we propose needs to detect the colluding agents within the set of witnesses according to Definition 4. To this end, the protocol needs to build the trust network from the witnesses to the trustee and from the trustee to the witnesses in order to compute the suspicion function. However, the malicious agents can hide their relationship if a single honest agent asks for mutual trust. In order to incite the malicious agents to reveal themselves according to Definition 3, the honest agent uses a Sybil attack to conceal its investigation: both malicious agents are asked their trust value by two apparently distinct agents (the honest agent and its Sybil). As both malicious agents believe that those truster agents are honest, they are incited to reveal a high mutual trust value in order to fool them. Consequently, we can define a protocol based on a Sybil attack to force the malicious agents to reveal their collusions. Algorithm 1 presents the main steps of this protocol. First, A uses a given reputation system to compute the trustee's reputation (line 1). Thereby, A gets a set W of witnesses for B and can compute d(A, B). As noticed by [START_REF] Conitzer | Using mechanism design to prevent falsename manipulations[END_REF], B may be an honest agent under a slandering attack if d(A, B)=0or B may be a malicious agent doing self-promotion if d(A, B)=1. Indeed, only successful manipulations need to be considered; and a manipulation is successful if and only if it leads A to make the right decision: trusting if there is self-promotion, or distrusting if there is slandering. As we only consider self-promoting manipulations, the protocol only considers the case where d(A, B)=1(line 2).

1: A computes fG (A, B) with a given reputation system 2: if d(A, B)=1then

3:
A selects the subset W of W that trusts B 4:

for each Wi,Wj ∈ W (Wi = Wj) do 5:
A generates two Sybil agents A and A

6:

A asks Wi its trust value c(Wi,Wj)

7:

A asks Wj its trust value c(Wj,Wi)

8:

A computes M (Wi,Wj) A uses all the M (Wi,Wj) values to revise fG (A, B) 11: end if Algorithm 1: A Sybil-based protocol Next, A selects the subset of witnesses that trust B (line 3). For each couple of witnesses, A generates two Sybil agents (line 4 and 5) that will be used to fool the possible malicious agents. Those Sybil ask Wi if it trusts the witness Wj (line 6)a n da s kWj if it trusts Wi (line 7). If Wi (respectively Wj) is an honest agent, it will answer honestly and, if Wi is a malicious agent, it will answer honestly too because it is fooled by the Sybil according to Definition 3. Consequently, the agent A can build the real mutual trust network and decide if there is a malicious collusion with respect to Definition 4.

Using the suspicion value

Once an honest agent A has computed a set of suspicious values M (Wi,Wj) over the selected witnesses, it needs to use them to compute fG(A, B) (line 10) once again. The higher the suspicion values for Wi, the less trustable the testimony c(Wi,B) by Wi. Consequently, we propose a mechanism, given in Algorithm 2, that a posteriori removes the testimony from the fG (A, B) calculus. The honest agent proceeds as follows: for each path in the trust network that relies on a testimony given by an agent Wi in favor of B, the honest agent removes this path with a probability equal to the highest suspicion value computed for Wi. If there is several suspect testimonies on a single path, each of them can independently removes the path.

Overall cost of the protocol

As our protocol is a layer implemented over a reputation system given by fG(A, B), it increases the global communication cost of this latter. Such communication cost is the number of messages exchanged in one round of communication.

Analyzing the dilemma

As this protocol is known by all the agents in the system, a malicious agent needs to decide if it will answer honestly when any other agent asks for its trust values. Making such a decision is a dilemma that we now analyze from a game-theoretic perspective. To analyze the dilemma, we first present a strategic form game to represent it. Then, we show some of its properties.

Strategic form game

In the sequel, we consider the following notations as we assume the agents are rational. Definition 5 Let g ∈ R and c ∈ R such that g>cbe the reward for the malicious agent that fool the system and the cost of being identified as a malicious agent respectively. Let δ ∈ [0, 1] be the probability that a given agent asking a malicious one its trust value is a Sybil agent.

Table 1 gives the strategic form of the game from the malicious agents' point of view as this game is a zero-sum game.

Agent Reveal Conceal

Honest (1 -δ)g 0

Sybil -δc δg

Table 1. Strategic form game for the malicious agent

Informally, the game is the following. If the malicious agent reveals its trust in a witness to an honest agent, it fools the honest agent. If the malicious agent conceals its trust to a Sybil agent, it fools the protocol, and then fools the honest agent that generated the Sybil. If the malicious agent reveals its trust to a Sybil agent, it receives a penalty due to the cost of a collusion between it and the witness. In the last case, the malicious agent has no reward, nor penalty if it conceals its trust to an honest agent. The structure of the payoff matrix corresponds to a matching pennies game [START_REF] Dang | Gaming or guessing: mixing and best-responding in matching pennies[END_REF] where δ is the mixed strategy parameter of the protocol (the malicious agent's opponent). As this dilemma is a variant of the matching pennies game, we know that there is no pure strategy profile that allows a player to maximize its reward. Consequently, the malicious agent needs to play a mixed strategy.

Mixed strategy Nash equilibrium

Let us denote for a malicious agent R the action of revealing its trust and C concealing it. Let us also denote for the protocol S the fact that the truster agent is a Sybil and H the fact it is an honest agent. Consequently, we can denote πB = σ(R)=(1-m),σ(C)=m the malicious agent's mixed strategy profile, and πp = σ(H)= (1δ),σ(S)=δ the protocol's mixed strategy profile.

Proposition 2

The mixed strategy Nash equilibrium of the game depicted in Table 1 is:

m = g + c 2g + c and δ = g 2g + c Proof 2
The expected utility of πB with respect to m and δ is:

uπ B (m, δ)=(1-m)((1 -δ)g -δc)+mδg = g -δg -δc + m(2δg + δc -g)
As the malicious agent wants to maximize u(πB), we find the roots of the partial derivative of uπ B (m, δ) with respect to δ.

-g -c + m(2g + c)=0 m = g + c 2g + c
Likewise, as the protocol wants to minimize u(πB), we find the roots of the partial derivative of -uπ B (m, δ) with respect to m.

-2δg -δc + g =0 δ = g 2g + c
✷ Moreover, we can notice that m =1δ which is a feature of matching pennies games. Even if the penalty is zero, a rational malicious agent that maximize its reward needs to play a mixed strategy such that m = δ = 1 2 .

Successful attack probabilities

However, even if the malicious agent has a mixed strategy that maximize its reward, manipulating a reputation system needs to play the game twice. Indeed, a malicious agent needs to fool both the honest agent and its Sybil. In the other cases, the manipulation is a failure. Concealing first in front of an honest agent leads to give up the attack whatever is the next game, and revealing in front of a Sybil agent in the second leads to being sanctionned for collusion. Consequently, a successful manipulation is defined as follows:

Definition 6 A manipulation is successful if and only if the malicious agent plays reveal against an honest agent on a first game then plays conceal against a Sybil agent on another game.

Agent Reveal Conceal Honest m(1 -m) m 2 Sybil (1 -m) 2 m(1 -m)
Table 2. Occurence probabilities of joint strategies

According to the mixed strategy Nash equilibrium we determined in the previous section (and m =1δ), the Table 2 gives the occurence probabilities of the joint strategies. We assume that due to the simultaneous requests in the system, and due to the fact that the Sybil agents wait before asking the trustee its trust valuation, a malicious agent cannot determine if two dilemmas are correlated. Hence, Proposition 3 A manipulation is successful if the joint strategy (honest,reveal) then (Sybil,conceal) occurs. Consequently, the probability that a given manipulation is successful is

m 2 -2m 3 + m 4 .
As we know the best value for m thanks to Proposition 2, we can express the probability of success in terms of g and c. Moreover, we can express c as a fraction of g. In this case, even if c =0 , the probability that a manipulation is successful is only 0.0625.H o w e v e r ,i t is important to notice that this success probability only concerns the trust relationship between two malicious agents. To conclude this analyzis, the protocol we defined forces the malicious agents to reveal their high mutual trust and, hence, enables some honest agents to dethem, or to give up some manipulations to avoid being suspected.

Simulation results

In order to evaluate our approach, we implemented it over a reputation system proposed by [START_REF] Cheng | Sybilproof reputation mechanisms[END_REF] and compared its performances with and without the dilemma. Although, all the results are strongly dependent on a huge number of parameters from the topology, to the distribution of the trust values within, through the kind of reputation system, they give us insights about the efficiency of our protocol.

Common setting

We consider the trust network as a binomial Erdös-Rényi graph with p =0.15, and where the trust values are fixed according to a uniform distribution. For each experiment, we fix the number of agents and the proportion of malicious agents without making any assumption about their position within the graph. We also consider that there is no cost for colluding (c =0 ). We launched 10, 000 simulations where a random honest agent evaluates a subset of random trustee agents. Indeed, a decentralized reputation system cannot evaluate all the agents in the system without scaling problems. Then the honest agent computes the reputation of each trustee without our protocol, then with our protocol under a pure and a mixed malicious strategy. In each case, if a malicious agent maximizes its reputation with respect to the other trustee agents, we consider that there is a successful manipulation. Our performance criterion is the proportion of successful manipulations over the 10, 000 simulations. Obviously, we need to use a given reputation system in order to compare and implement our protocol. We chose the FlowTrust reputation system given in Example 1. This reputation system is known to be robust against manipulation when the agents have a global view of the system although they are not very informative. All the results are given in Figure 1, 2 and 3. For each of those figures, the red diamondshaped curves represent the successful manipulations with the original reputation system. The green head-up-triangle-shaped curves represent the successful manipulations with our approach under a mixed malicious strategy whereas the yellow upside-down-triangleshaped curves represent the successful manipulations under pure malicious strategy (always revealing).

About the number of malicious agents

In order to highlight the influence of the network in terms of size and malicious agents, we ran two experiments with a network of 50 agents and 100 agents respectively. The proportion of malicious agents varies from 10%t o50%, and in each simulation an honest agent evaluates 5 trustee agents chosen at random before deciding the one it can trust. The results are shown on Figure 1. Obviously, the number of successful manipulations increases in all cases as the number of malicious agents grows, with a slightly higher number of manipulations for the network of size 100.H o w e v e r ,i na v e r a g e , the mixed strategy reduces by 55% the number of successful manipulations, whereas a pure strategy sees its manipulations reduced by 62%. Finally, the results have the same shape for both size of networks with a difference of 11% in average in favor of large networks. Consequently, our protocol seems to be sensitive to the size of the network. The more agents in the network, the more efficient the protocol. Moreover, the theoretical results are confirmed as the malicious agents need to play a mixed strategy if they want to maximize their number of successful manipulations. Even though the malicious agents play an optimal mixed strategy, their manipulations are reduced by more than a half.

About the strength of the manipulation

A rational malicious agent reduces the strength of its manipulation in order to avoid being suspected by the honest agents. In this case, the malicious coalition reduces the value of their mutual trust. In order to highlight the influence of such malicious behavior, we ran two experiments with a network of 50 agents and 100 agents respectively. In each of them, we considered 20% of malicious agents, and the trust value they reported varies in the range of [0.5, 1].T h er e s u l t s are shown on Figure 2. Obviously, the number of successful manipulations decreases with respect to the original reputation system as the malicious agents reduce their manipulation. It converges to around 20%, the proportion of malicious agents within the network. We can notice that our protocol is very efficient as, in all cases, the successful manipulations remain around 20% for the mixed strategy and 15% for the pure strategy. When the network grows in size, the successful manipulations are reduced to 15%a n d10% respectively. Thus, our protocol can prevent manipulations and cannot be manipulated by the malicious agents. Moreover, as Algorithm 2 removes the suspected witnesses stochastically, the performance is not reduced when malicious agents reduce their mutual trust value to mimic honest agents.

About the amount of information

In the previous experiments, we considered a decentralized case where the honest agent only evaluates a subset of agents in the network: this is the trade-off between exploration and exploitation. In order to highlight the influence of the amount of information owned by an agent, we ran two experiments with a network of 50 agents and 100 agents respectively. In each of them, we considered 20%of malicious agents and the number of random trustee agents the honest agent evaluates varied from 10%to100% of the network. The results are shown on Figure 3. Once again, the results present the same structure with 50 or 100 agents. We can notice that the number of successful manipulations decreases under the original system as the number of considered trustees increases. The efficiency of our protocol under a mixed strategy decreases from around a reduction of manipulations by 64% to a null gain. We can also notice that the mixed strategy is as efficient as the pure strategy: whatever the strategy the malicious agents play, they cannot increase the number of successful manipulations. Finally, in both cases, the performance of our protocol converges towards the performance of the original system. However, the original reputation system is robust to manipulation in a centralized system. In real systems, we cannot assume that an agent can evaluate all the other agents in the system. Consequently, our protocol is still very efficient in general.

6C o n c l u s i o n

In order to insure the nominal use of decentralized and open systems, the presence of malicious agents needs to be considered. Such problematics are addressed by reputation systems, but even if those systems are designed to detect the malicious behavior of a single agent, they are vulnerable to malicious coalitions and Sybil attacks. As dealing with malicious coalitions is critical for reputation systems, much work has been done towards this end. These proposals cover a broad area ranging from cryptographic puzzles to insure the unicity of the agents, to the detection of communities inside social networks, and the design of robust reputation functions. However, those approaches cause a partial centralization of the system, or are costly for the honest agents. A recent way proposes to use game-theoretic techniques to provide incentives not to fool the system. In this context, we propose a protocol based on a game-theoretic dilemma to detect, and therefore prevent, self-promoting coalitions in reputation systems. Its specificity is based on the fact that the honest agents use in turn a Sybil attack to fool the malicious agents. Our protocol leads the malicious agents to reveal their mutual trust relationships, that are then used as a heuristic to detect collusions by the honest agents. Our theoretical analysis shows that the malicious agents need to play a mixed strategy and give up some manipulations in order to maximize their efficiency. Our simulations show that our protocol reduces in average the manipulations by more than a half. Moreover, its efficiency remains high even if the malicious agents hide themselves. However, our work raises several perspectives. Firstly, we need to improve our experiments to highlight the limits of our protocol. How the protocol behaves when the trust values of the honest agents are correlated? Moreover, how the protocol behaves when compared to other reputation systems such as EigenTrust [START_REF] Kamvar | The EigenTrust algorithm for reputation management in P2P networks[END_REF]? Secondly, we need to address the problem of the suspicion function to enhace the overall performance of our protocol. Indeed, this function represents a heuristic about what is a malicious behavior and many definitions can be applied. For instance, we can suspect a single agent that provides too many testimonies. As we did not make any assumption about the topological relationships between the malicious agents, we can also combine our heuristic with others based on the topology of the network, such as SybilLimit [START_REF] Yu | SybilLimit: a near-optimal social network defense against Sybil attacks[END_REF]. This information might enhace the efficiency of our approach. Another way is to consider the dynamics of the system. Indeed, our protocol only considers a snapshot of the system at a given time. However, if a malicious agent plays a mixed strategy, an honest agent does not. Consequently, considering several answers about the dilemma may allow to detect if some agents are playing a mixed strategy, and therefore to deduce that they are malicious agents. Reasoning about the strategy, and not the answer in itself, is a way for overcoming the current limits of our protocol.

Definition 2 Example 2

 22 Let d : V ×V -→ { 0, 1} be a decision function where 0 means that A distrusts B and 1 means that A trusts B.Thevalue of d(A, B) is given by a threshold function over fG(A, B). Let us assume that fG(A, B) ∈ [0; 1] where 0.5 means indifference, then d(A, B) can be defined in {0, 1} by d(A, B)= (fG(A, B) > 0.5).

1 : 3 : 4 :Algorithm 2 :

 1342 Let PAB be the set of paths between A and B 2: for ∀P ∈PAB do for ∀Wi ∈ P such that c(Wi,B) > 0 do PAB ←PAB \{P } with probability max W j ∈W ′ M (Wi,Wj)5:end for 6: end for 7: A computes fG (A, B) Using the suspicion value

Proposition 1 Proof 1

 11 Let |W | be the number of selected witnesses in Algorithm 1 line 3. The communication cost of the protocol given by Algorithm 1 is in O(|W | 2 ) Each time the reputation for an agent B is computed by an agent A, a Sybil agent A asks the |W | witnesses their trust value for each of the other witnesses. Consequently, our protocol adds |W | 2 new messages to the original protocol that computes fG(A, B).

Figure 1 .Figure 2 .Figure 3 .

 123 Figure 1. Successful attacks w.r.t. the proportion of malicious agents over a network of 50 and 100 agents

University of Caen Lower-Normandy, UMR CNRS 6072 GREYC, France, email: gregory.bonnet@unicaen.fr

G. Bonnet / A Protocol Based on a Game-Theoretic Dilemma to Prevent Malicious Coalitions in Reputation Systems


Estimation of the distributed temperature of a SI engine catalyst for light-off strategy Delphine Bresch-Pietri, Thomas Leroy, Nicolas Petit

Abstract-This paper proposes a model for the internal temperature of a SI engine catalyst, aiming at designing a prediction-based light-off strategy. Due to its elongated geometry where a gas stream is in contact with a spatially distributed monolith, the system under consideration is inherently a distributed parameter system. This paper advocates an approach which is based on a one-dimensional distributed parameter model, coupled with an advection-diffusion equation accounting for the distributed heat generation resulting from pollutant conversion. Following recent works, this heat supply is shown here to be equivalent to an inlet temperature entering the system at a virtual entry point inside the catalyst. This new input has a static gain depending on the state of the system, which introduced a coupling. Taking advantage of the low-pass filter characteristic of the system, an estimate of this model is designed and results into a time-varying input-delay system whose dynamics parameters (time constant, delay, gains) are obtained through a simple analytic reduction procedure. A corresponding prediction-based light-off strategy is proposed and illustrated in simulations exploiting experimental data.

I. INTRODUCTION

Automotive SI engines are equipped with a Three-Way Catalyst (TWC) located in the exhaust line. This aftertreatment device aims at reducing the three major pollutants resulting from the combustion: hydrocarbons HC, carbon monoxide CO and nitrogen oxide NO x . Yet, conversion efficiency highly depends on the catalyst temperature [START_REF] Heywood | Internal combustion engine fundamentals[END_REF] [9], as presented in Fig. 5. In this context, a cold start of the engine is problematic, as the temperature is too low to activate chemical reactions. As a result, the catalyst conversion ratio is poor [START_REF] Please | Light-off behavior of catalytic converters[END_REF] and pollutant emissions are above admissible levels. Therefore, speed-up of the catalyst warm-up is a point of critical importance.

When the catalyst is cold, heat source is provided by the exhaust burned gas, which, flowing through the monolith, are exchanging with the layer and warming it. Therefore, active warm-up strategies classically aim at feeding the catalyst with gas having higher temperature, exploiting combustion timing shifting [START_REF] Guzzella | Introduction to modeling and control of internal combustion engine systems[END_REF]. This open-loop technique relies on combustion efficiency degradation which, in turn, to satisfy the driver torque request, yields substantial consumption increase. To limit this negative effect of the open-loop strategy, it is of prime importance to determine when the catalyst should reach its light-off temperature 1 . This would generate a satisfactory compromise between pollutant emissions and consumption. When this light-off temperature is obtained, optimal combustion can be performed and the consumption can simply go back to a standard level.

Unfortunately, no temperature sensor is available on commercially embedded catalysts. The switch time is usually determined from the measurements provided by a temperature sensor located into the cooling system. Certainly, the thermal behavior of the water cooling system can be indirectly related to the engine and exhaust line temperatures. Yet, this information is relatively uncertain (and lags behind), as other sources of heat can bias it. Under realistic driving conditions, this reference water temperature, optimized for one particular normalized cycle (e.g. NEDC or FTP), can be completely uncorrelated with the catalyst light-off. This may lead either to higher consumption (if the light-off is estimated too late) or to higher pollutant emissions (if the light-off is estimated too soon).

To avoid such a bad detection, an alternative is to rely on models, accounting for the inherent distributed nature of the catalyst and the intrinsic transport phenomenon. Some infinite-dimensional model have been proposed in [START_REF] Laing | A simplified approach to modeling exhaust system emissions: SIMTWC[END_REF], [START_REF] Onorati | 1D fluid dynamic modeling of unsteady reacting flows in the exhaust system with catalytic converter for SI engines[END_REF] or [START_REF] Depcik | One-dimensional automotive catalyst modeling[END_REF], under the form of Partial Differential Equations (PDE), modeling heat exchange and chemistry inside the monolith. These models give very accurate estimation of the light-off temperature, but introduce very complex representations of the heat release by chemical reactions. Further, the induced computational burden discards them from real-time implementations.

Some alternative catalyst temperature models have been proposed. In [START_REF] Kum | Optimal energy and catalyst temperature management of plug-in hybrid electric vehicles for minimum fuel consumption and tail-pipe emissions[END_REF], a mean-value (spatially lumped) model is presented, in which the catalyst temperature follows a first-order dynamics, assuming the temperature inside the wall temperature as spatially homogeneous. This kind of model is known to be inaccurate, as it usually leads to an overestimation of the light-off temperature.

In this paper, following the overture presented in [START_REF] Lepreux | Model-based temperature control of a Diesel oxidation catalyst[END_REF], we propose to represent the chemical reactions inside the catalyst as a temperature entering the system at a virtual entry point located downstream of the physical inlet of the monolith. To make this approach compliant with SI engines applications, it is proposed here to use the catalyst efficiency conversion to calculate the gain relating the heat release to the fictitious temperature. As this efficiency depends on the output of the model, it introduces an additional coupling, which is shown here not to be detrimental to the stability of the model. The validity of this PDE model is emphasized on experimental data.

Besides, these PDE equations are exploited to propose a semi-lumped model, under the form of a first-order inputdelay dynamics relating the inlet gas temperature to any punctual wall catalyst temperature. The accuracy of this model, of gentle implementation complexity, is discussed at the light of experimental data. Taking advantage of the delayed nature of the model, a corresponding open-loop prediction-based light-off control strategy is proposed and illustrated with simulations. This is the main contribution of the paper.

The paper is organized as follows. In Section II, we give main context elements and present the catalyst under consideration in experiments. In Section III, we detail the PDE temperature modeling which is used in Section IV to derive a first-order input-delay model through analytic formula stemming from simple operational calculus. Finally, in Section V, we detail a corresponding open-loop predictionbased light-off strategy of the catalyst, illustrated by simulations.

II. EXPERIMENTAL SET-UP

The catalyst under consideration in this study is mounted at the outlet of a 2L four-cylinder turbocharged SI engine, downstream the turbine. Fig. 1 presents a scheme of the catalyst under consideration. It is composed of two separated monoliths [START_REF] Ramanathan | Optimal design of catalytic converters for minimizing cold-start emissions[END_REF] in charge of oxidizing carbon monoxides and hydrocarbons into carbon dioxide and water, and reducing nitrogen oxides to nitrogen and oxygen2 . For experimental studies and comparisons, the catalyst has been instrumented with two internal temperature sensors. Such sensors are not embedded on any commercial line product and serve here for providing experimental data only. Fig. 2 presents experimental results obtained at test bench during a NEDC (New European Driving Cycle) cycle. Histories of both the exhaust mass flow and the temperature located upstream the catalyst are reported in Fig. 2(a). These quantities are the inputs of the ). We will account for this in Section IV. III. PDES MODEL REPRESENTATION We now refer to Fig. 3, where a schematic representation of the monolith is given. Exhaust burned gas enter the monolith at x = 0 and convective exchanges with the wall occur all along the monolith, i.e. for x = 0 to x = L, yielding to non-uniform distributed temperature profiles of the gas T g (x,t) and the catalyst wall T w (x,t) 4 . Chemical reactions

Catalyst length L

Reactive length Lr

Equivalent efficiency length Lη

Gas flow

Gas flow Fig. 4. Schematic view inspired from [START_REF] Lepreux | Model-based temperature control of a Diesel oxidation catalyst[END_REF]. The conversion is assumed to take place on an upstream part of the catalyst of length L r . The temperature used to determine the catalyst efficiency is located at length L η ≤ L.

occur distributely along the monolith, depending on the wall temperature profile.

A. Complete model

We consider the following coupled linear infinite dimensional thermal dynamics

     ∂ T w ∂t (x,t) = k 1 (T g (x,t) -T w (x,t)) + Ψ(x,t, T w (x,t)) (1) ṁg ∂ T g ∂ x (x,t) = k 2 (T w (x,t) -T g (x,t)) (2)
with the boundary conditions

∂ T w ∂ x (0,t) = ∂ T w ∂ x (L,t) = 0, T g (0,t)
given and where ψ is a distributed time-varying source term, related to the chemical reaction occurring inside the catalyst and the constants k 1 , k 2 > 0 are defined as

k 1 = h I P I A w ρ w Cp w , k 2 = h I P I Cp g
Such a model is considered for example in [START_REF] Laing | A simplified approach to modeling exhaust system emissions: SIMTWC[END_REF]. It encompasses the detailed modeling ( 13)- [START_REF] Onorati | 1D fluid dynamic modeling of unsteady reacting flows in the exhaust system with catalytic converter for SI engines[END_REF] given in Appendix, provided that a few simplifications are performed:

• conduction (λ w ∂ 2 T g /∂ x 2
) into the monolith is neglected compared to convection exchanges; • gas storage is considered as very small compared to the monolith one, i.e. ρ g Cp g << ρ w Cp w ; • convective exchanges with the atmosphere are neglected compared to the one with the exhaust gas 5 .

B. Proposed reduced PDE model

Here, we consider that the source term ψ, which gathers the sum of the enthalpies of the various reactions taking place inside the catalyst, is uniform over some spatial interval

Ψ(x,t, T w ) = ψ(t, T w ) for 0 ≤ x ≤ L r ( ṁg ) 0 for L r ( ṁg ) < x ≤ L
where L r is the length of the portion of the catalyst where the heat is released, which is a piecewise affine function of the channel gas mass flow rate. This model is illustrated in Fig. 4. This source term also depends on the wall temperature. This point is important to study the light-off process. For moderate temperature, the conversion efficiency highly depends on the wall temperature and this dependence cannot reasonably be neglected. a) Conversion efficiency representation: in this paper, we propose to represent the conversion efficiency of the catalyst as a function of a punctual wall temperature, at a position L η (potentially varying with aging) 6 . Experimental determination of an appropriate length L η and of the resulting efficiency was performed and follows the tendency of Fig. 5. In the following, the conversion efficiency is called η and is considered as a known function. b) Virtual temperature inlet accounting for heat release: to represent the source term ψ, we propose to consider the pollutant conversion effects as a second temperature front T eq occurring at the virtual position L r inside the catalyst 7 . Indeed, for steady-state conditions, energy balance for the system can be written as

ṁg Cp g (T g (0) -T g (L)) ∆ =T eq +η(T w (L η )) N ∑ i=1 ∆H i [x i ] in = 0
where [x i ] in are the inlet pollutant concentrations. Typically, three main pollutants are considered (N = 3), i.e. hydrocarbons (HC), carbon monoxide (CO) and nitrogen oxides (NO x ). They result in three steady-state gains

G HC =η(T w (L η )) ∆H HC ṁg Cp g , G CO = η(T w (L η )) ∆H CO ṁg Cp g and G NO x = η(T w (L η )) ∆H NO x ṁg Cp g
where the unity enthalpy ∆H HC , ∆H CO and ∆H NO x are known constants. These gains are then used to calculate an equivalent temperature

T eq =G HC [HC] in + G CO [CO] in + G NO x [NO x ] in (3)
In practice, the pollutant concentrations are not measured but can be effectively estimated, e.g. by look-up tables.

An important point to notice is the appearance of the temperature at length L η as a parametrization of the conversion efficiency η. This yields a coupling represented in Fig. 6 under a closed-loop form.

Exploiting the linearity of the dynamic through a superposition principle, we propose to distinguish the T g (0) effects from the pollutant conversion effect. The distributed temperature of the catalyst is then modeled as the sum of two similar and relatively simple advection-diffusion equations of type (1)-(2) without source term (i.e. Ψ = 0). The propagation phenomena occurs on two different lengths. This model is represented in Fig. 6.

C. Model validation from experimental data

Simulation results of the wall catalyst temperature model at two positions (described in Fig. 1) are provided in Fig. 7 (in black) and compared to experimental measurements (in blue). These measurements were obtained on a NEDC cycle, with an initially cold catalyst. The inputs used for the models (gas mass flow rate and gas inlet temperature) are pictured in Fig. 2(a). PDEs have been implemented with an explicit numerical scheme and a sampling time T s = 1ms. All parameters involved have been identified in simulation, in accordance with the literature 8 . One can easily notice that the computed temperatures catch both short-term and long-term variations of the true signals, which validates the proposed distributed model.

D. Comments about the proposed model

The proposed PDE model provides accurate estimation of the wall catalyst temperature (only) on the spatial interval [L r , L], i.e. over the non-reactive length of the catalyst. For designing a light-off strategy, this is the spatial interval we are interested in.

To feed the model, values for various inputs, presented in Fig. 6, are necessary: the mass flow rate, the inlet gas temperature and the pollutant emissions upstream of the catalyst. In practice, the information of the mass flow rate is given by a model already implemented for combustion control purposes (namely, cylinder charge estimation). Further, a certain number of inlet gas temperature models have been proposed in the literature and can be used here if no sensor is available. For example, the interested reader can refer to [START_REF] Fu | A one-dimensional model for heat transfer in engine exhaust systems[END_REF] where a complex 1D model is presented or to [START_REF] Eriksson | Mean value models for exhaust system temperatures[END_REF] for lumped parameters exhaust temperature models.

We are interested in the design of a simple model of the

G HC G CO G N Ox [HC] in [CO] in [N Ox] in T g (0, t)
T eq T w (., t)

Heat release

Efficiency model (T w (L η , t))

       ∂Tw ∂t (x, t) =k1(Tg(x, t) -Tw(x, t)) ṁg ∂Tg ∂x (x, t) =k2(Tw(x, t) -Tg(x, t)) Advection-Diffusion PDE (L) Advection-Diffusion PDE (L -L r )        ∂Tw ∂t (x, t) =k1(Tg(x, t) -Tw(x, t)) ṁg ∂Tg ∂x (x, t) =k2(Tw(x, t) -Tg(x, t))
L -L r L r L Fig. 6. Proposed catalyst temperature PDE model. The pollutant conversion effects (HC, CO and NO x ) are assimilated to a front of temperature T eq propagating on a virtual length L η -L r , while the gas heating occurs on the complete length L η . The model is also fed by the gas mass flow rate ṁg which is not represented here for sake of clarity.

wall temperature at L η 9 , handling the potential variability of this position 10 . Yet, the equations presented above are not real-time compliant and therefore cannot be used on an embedded engine control strategy. For this reason, we study their low-frequency behavior in the following section to obtain a simple ordinary differential dynamics.

IV. APPROACHING THE DYNAMICS BY AN INPUT-DELAY ORDINARY DIFFERENTIAL EQUATION

In this section, we present a semi-lumped representation of the PDE model described earlier. We summarize this inputdelay model by the following claim.

Claim 1:

The wall catalyst temperature at position L η can be efficiently represented as

T w (L η ) =T th w + T ψ w ( 4
)
where T th w satisfies

τ(L η ,t) dT th w dt = -T th w (t) + T g (0,t -D(L η ,t)) (5)
and

T ψ w satisfies τ(L η -L r ,t) dT ψ w dt = -T ψ w (t) + T eq (0,t -D(L η -L r ,t)) (6)
T eq is defined in (3), the time constant τ and the delay D are defined for

x ∈ [0, L] as    τ(x,t) = 1 k 1 + νδ (x,t) (7) D(x,t) = (1 -ν)δ (x,t) (8)
with ν a given constant in [0, 1] and δ defined through the integral equation

t t-δ (x,t) k 1 k 2 ṁg (s)ds = x ( 9
)
9 An effective length L η was identified as the one of the first monolith on experimental data. 10 Yet, in the following, for experimental validation, we also compute wall temperature estimates at other locations.

A. Comments

The relation ( 9) implicitly defines a transport delay through past values of the gas flow rate. It corresponds to a transport phenomenon occurring over a length x with a speed k 1 k 2 ṁg accordingly to a Plug-Flow assumption [START_REF] Perry | Perry's chemical engineers' handbook[END_REF]. This time can be understood as a residence time into the monolith (see [START_REF] Pv Danckwerts | Continuous flow systems: distribution of residence times[END_REF]). As the two main effects of the gas residence inside the monolith are transport and exchange with the monolith, it can reasonably be separated into a first order dynamics with a pure delay effect. The tuning parameter ν can be determined via dedicated tests and allows this model to qualitatively represent a relatively vast range of catalyst devices.

It is worth noticing that the catalyst temperature at any position x ∈ [0, L] can also be computed by a similar procedure, provided one has value of the steady-state gains (correspondingly, T w (L η , .) has to be calculated independently).

We now give some elements to explain why this claim is formulated.

B. Derivation of Claim 1

Based on the previous PDE model presented in Section III (and summarized in Fig. 6), one notices that the following claim, characterizing the "purely thermal" behavior of the PDE model (i.e. without chemical heat release), is equivalent to the previous one.

Claim 2: Assume Ψ = 0. In the range of low (time domain) frequencies, the distributed parameter model ( 1)-( 2) can be approximated by the following set of first-order delayed equations

∀ 0 ≤ x ≤ L , τ(x,t) dT w (x,t) dt = -T w (x,t) + T g (0,t -D(x,t)) ( 10
)
with τ, D and δ defined respectively in ( 7), ( 8) and ( 9). We now focus on giving some elements of background for this last claim.

1) Modeling the transport delay: By taking a spatial derivative of (1) with Ψ = 0, a time-derivative of (2) and matching terms with (1)-( 2), one can obtain the decoupled equations, for all x ∈ [0, L],

       ṁg (t) ∂ 2 T w ∂ x∂t = -k 2 ∂ T w ∂t -k 1 ṁg (t) ∂ T w ∂ x ṁg (t) ∂ 2 T g ∂ x∂t + mg (t) ∂ T g ∂ x = -k 2 ∂ T g ∂t -k 1 ṁg (t) ∂ T g ∂ x
where the first equation defining T w can be reformulated using a spatial Laplace transform (operational calculus) to get

∀t ≥ 0 , ( ṁg (t)p + k 2 ) d Tw dt = -k 1 ṁg (t)p Tw (p,t)
This scalar system can be solved as

Tw (p,t) = exp - t t 0 k 1 ṁg (s)p ṁg (s)p + k 2 ds Tw (p,t 0 )
where t 0 is such that t 0 ≤ t.

The catalyst, as is visible from experimental data reported in Fig. 2(b), is relatively non-sensitive to high-frequencies. Consequently, by considering only low-level spatial frequencies (i.e., ṁg p << k 2 for any gas flow ṁg ), the term below the integral can be substantially simplified 11 . Rewriting the resulting equation into the usual space domain gives

∀x ∈ [0, L] , T w (x,t) =T w x - t t 0 k 1 k 2 ṁs (s)ds ,t 0 Formally, one can define δ (x,t) ≥ 0 such that x - t t-δ (x,t) k 1 k 2 ṁs (s)ds = 0
which is [START_REF] Kiencke | Automotive control systems[END_REF]. Consequently, the wall temperature at abscissa x is formally delayed by

∀x ∈ [0, L] , T w (x,t) =T w (0,t -δ (x,t)) (11)
2) Obtaining a finite-dimensional first-order model: From there, it is possible to relate the dynamics under consideration to the gas inlet temperature. Consider for a moment that δ (x) is constant with respect to time. Then, writing [START_REF] Laing | A simplified approach to modeling exhaust system emissions: SIMTWC[END_REF] in the time Laplace domain, jointly with (1) for x = 0, one directly obtains for all x ∈ [0, L]

Tw (x, s) =k 1 e -δ (x)s s + k 1 Tg (0, s) (12)
Finally, following the same considerations as previously, it is possible to only consider low frequencies (s << 1). By considering, following the considerations presented in [START_REF] Pekar | Rational approximations for time-delay systems: case studies[END_REF], [START_REF] Lepreux | Model-based temperature control of a Diesel oxidation catalyst[END_REF] rewrites for low frequencies

e -δ (x)s ≈ e -(1-ν)δ (x)s νδ (x)s + 1 with a constant ν ∈ [0, 1],
Tw (x, s) = e -(1-ν)δ (x)s 1 k 1 + νδ (x) s + 1
Tg (x, 0) 11 The exact relation between time and spatial frequencies remains to be rigorously explored.

By formally generalizing this relation to a time-varying residence time δ (x,t), one obtains the dynamics formulated in Claim 2.

From there, matching Claim 2 with the chemical heat release model proposed in Section III, one can deduce Claim 1.

C. Validation of the reduced input-delay model (4)-(9) on experimental data

To illustrate Claims 1-2, simulation results of the temperature inside the wall catalyst at two different locations are pictured in Fig. 7 for the NEDC cycle considered previously. The proposed simplified dynamics (4)-( 9) is pictured in red and compared both to the experimental measurements and to the numerical solution of the PDEs of Section III. The physical parameters have been kept similar to the one previously used and the tuning parameter have been chosen as ν = 0.4 12The simulated temperature almost perfectly matches both the one computed with the PDE model and experimental data. It is worth observing that the inputs corresponding to this NEDC cycle (in particular the gas mass flow rate) are highly variable and that therefore this test case is challenging. As these performances are obtained for very demanding external conditions, one can reasonably expect similar behavior on different kinds of driving conditions.

D. Comments about the reduced input-delay model

The proposed model is accurate and simple enough to be implemented in real-time. One extra advantage of the proposed technique that is worth noticing is that it provides insight into the temperature everywhere inside the monolith. A lumped model (or 0D-model) like the one presented in [START_REF] Kum | Optimal energy and catalyst temperature management of plug-in hybrid electric vehicles for minimum fuel consumption and tail-pipe emissions[END_REF] for example, cannot achieve this. Also worth noticing is the fact that aging of the catalyst can be accounted for by updating L η .

V. PREDICTION-BASED LIGHT-OFF STRATEGY

In this section, we use the proposed input-delay model of Section IV to determine the light-off temperature reaching time, i.e. the time when the efficiency of the catalyst is greater than 90 percent. With this aim in view, we consider simulation results on the US driving cycle, FTP, and compare three different open-loop controllers.

A. Compared light-off open-loop strategies

From a bird's eye view, the three considered strategies achieve the same task. When the catalyst is cold, the combustion efficiency is degraded to provide higher exhaust gas temperature. Then, at the light-off temperature reaching time, standard combustion is performed again. The difference between the three following techniques relies on the determination of this light-off switching time.

1) Strategy 1 : calibration using the water cooling system temperature

As the temperature sensor of the water cooling system is the only exhaust temperature sensor commercially embedded, the light-off temperature is usually calibrated from its measurement. For the engine under consideration for the presented experiments (Renault F4Rt) and a NEDC cycle, the temperature of the cooling system corresponding to light-off is 74 o C. The light-off switching time used with this technique is then the time where the water cooling temperature reaches this value.

2) Strategy 2, using the reduced input-delay wall temperature

This strategy uses the efficiency function previously calibrated, fed with the input-delay temperature model proposed in Section IV at length L η . The light-off switching time directly results from this model.

3) Strategy 3, using the prediction-based wall temperature

This strategy also uses the efficiency function, but fed with a prediction of the temperature model at length L η . Indeed, by exploiting the input-delay form of the model ( 4)-( 9), the light-off switching time can be scheduled in advance.

In details (see [START_REF] Artstein | Linear systems with delayed controls: a reduction[END_REF]), assuming that the external conditions remain similar (i.e., for s ∈ [t,t + D(x,t)], τ(x, s) = τ(x,t)), then it is possible to predict the future value of the wall temperature at time t + D(L η ,t), i.e.

T pred w (L η ,t) =T th w (L η ,t + D(t)) + T ψ w (L η ,t + D(t)) with T th w (L η ,t + D(L η ,t)) = e -1 τ(Lη ,t) T th w (L η ,t) + 1 τ(L η ,t) t t-D(L η ,t) e -1
τ(Lη ,t) (t-s) T g (0,t -D(L η , s)ds and T ψ w (L η ,t + D(t)) computed similarly. This prediction is obtained integrating (4) between t and t + D(L η ,t) starting with the current modeled temperature value. When this predicted temperature reaches the light-off temperature, optimal combustion can be performed.

More precisely, due to the delay variations, this prediction may not be accurate (i.e. the computed value T pred w (L η ,t) may not be achieved exactly at time t + D(L η )) but still provides information about the catalyst warming. Indeed, due to the delayed input, one can expect then that the gas temperature that are already heating the monolith are sufficient to achieve the desired warming. Therefore, it can be decided to turn off combustion timing shifting when such a point is reached.

B. Simulation comparison results

Simulation results have been performed on the first 510s of the FTP cycle, represented in Fig. 8(c) and corresponding to real driving conditions over a distance of approximately 6 km. The three different strategies have been tested. Corresponding catalyst wall temperature at length L η , with respective light-off switching times, are pictured in Fig. 8(a). These switching times are also reported on Table II, with consumption gain increases, compared to Strategy 1 13 .

First, one can easily notice that Strategy 2 and 3 considerably lower the light-off switching time, resulting into substantial consumption decrease (see Table II). For this reason, as a degraded combustion is performed longer, the temperature obtained with Strategy 1 is much most important than the two others after a certain lag (transport delay). The difference between the two switching times of Strategy 2 and 3 is compliant with the scale of the delay pictured in Fig. 8(b). On the time interval separating these two instants, one can observe on Fig. 8(a) that the two temperatures are similar. This is due to the delayed nature of the system. The strategy impact is only noticeable after that time: the temperature obtained with Strategy 2 is then higher than for Strategy 3. Strategy 3 has a moderate but positive impact on the consumption, without any prejudicial effects on the pollutant emissions.

VI. CONCLUSION

In this paper, a simple infinite dimensional model of the wall catalyst has been presented. A corresponding first-order input-delay reduction has been performed. Following the works presented in [START_REF] Lepreux | Model-based temperature control of a Diesel oxidation catalyst[END_REF] on Diesel engines, the distributed heat generation resulting from pollutant conversion is represented as a second inlet temperature taking place on a virtual front inside the catalyst. This work has been shown to represent well the behavior of SI engine catalysts, thanks to the introduction of a closed-loop coupling on the conversion efficiency.

The reduced input-delay model suggests interesting control strategies for the light-off, which have been illustrated on simulations. In particular, comparing this strategy to the existing ones, this strategy enables to detect light-off independently on the driving cycle. Further experiments are needed to evaluate these potential merits. Another direction of work is the evaluation of the robustness of this model to input estimation errors.

APPENDIX

In this appendix, we provide a more detailed modeling of the thermal exchanges occurring in the catalyst, from which (1)-( 2) is a simplification. Following [START_REF] Depcik | One-dimensional automotive catalyst modeling[END_REF], a thermal balance of the gas leads to the equation ρ g A g Cp g ∂ T g ∂t + ṁg Cp g ∂ T g ∂ x =h I P I (T w (x,t) -T g (x,t)) [START_REF] Olsson | Kinetic modelling in automotive catalysis[END_REF] where the first term on the left hand side accounts for the gas energy storage, the second one for transport and the righthand term for convective exchanges. A similar balance for the wall yields

ρ
where the left-hand side still accounts for the energy storage and the right-hand side represents respectively: i) the conduction/diffusion inside the monolith; ii) the enthalpy flow of the N chemical reactions occurring inside the catalyst (mainly, N = 3); iii) the exchange respectively with the gas and the atmosphere.

One can notice that, following [START_REF] Lepreux | Model-based temperature control of a Diesel oxidation catalyst[END_REF], no transport occurs in the (solid) wall. In more details, a mass balance of the species in presence can be established. The species concentrations inside the monolith are necessary to determine the reaction terms R i in the enthalpy flows. Two additional equations per species are also necessary (one for the gas and one for the monolith, see [2] [13]).

Fig. 1 .

 1 Fig.1. Experimental catalyst composed of two monoliths. Two sensors permit to measure the wall temperature in the center of each monolith. Test-bench is also equipped with inlet temperature and mass flow sensors.

  Exhaust gas flow (solid line) and temperature (dashed line). First and second monolith temperature.

Fig. 2 .

 2 Fig. 2. Experimental results on European driving cycle (NEDC).

Fig. 3 .

 3 Fig. 3. Schematic view of the distributed profile temperature inside a catalyst jointly with thermal exchanges.

Fig. 5 .

 5 Fig.5. Conversion efficiency (jointly for CO, HC and NO x ) as a function of temperature for typical catalytic converter (Source :[START_REF] Heywood | Internal combustion engine fundamentals[END_REF]).

  Simulation results for both the proposed reduced PDE model and its approximation by an input-delay model, compared to experimental data in the center of the first monolith. Below : the corresponding delay used in the input-delay model. Simulation results for both the proposed reduced PDE model and its approximation by an input-delay model, compared to experimental data in the center of the second monolith. Below : the corresponding delay used in the input-delay model.

Fig. 7 .

 7 Fig. 7. Comparison for a NEDC cycle between the proposed PDE model, its reduction to an input-delay system and experimental data at two location inside the monolith.

  ) measured with Strategy 1 Tw(Lη) measured with strategy 2 Tw(Lη) measured with strategy 3 (a) Simulation results of the temperature at L η for the three light-off strategy on a FTP cycle. The markers indicate the light-off time shifting. Vehicle Speed (km/h) (c) Vehicle speed set-point.

Fig. 8 .

 8 Fig. 8. Comparison between the three control strategies applied on the first 510s of a FTP cycle with cold start.

TABLE II COMPARISON

 II OF THE LIGHT-OFF TIMINGS OBTAINED WITH THE THREE DIFFERENT STRATEGIES AND CONSUMPTION IMPACT (RELATIVE DIFFERENCE WITH THE CONSUMPTION OBTAINED USING STRATEGY 1).

Defined here as the temperature at which the catalyst becomes more than 90 percent effective.

In the following, the two monoliths are not distinguished. In details, neglecting the conduction inside the wall catalyst yields to the equivalent representation of a unique monolith.

The presented results are obtained by performing the combustion with greatest efficiency during the whole cycle, without warm-up strategy. The duration of the warming phase is therefore longer than a classical one.

On the contrary, the axial conduction in the solid is not important and can be neglected, as underlined in[START_REF] Vardi | Thermal behavior of exhaust gas catalytic convertor[END_REF],[START_REF] Young | Mathematical models of the monolith catalytic converter[END_REF]

This last assumption is only made for sake of simplicity in the following analysis and can easily be relaxed.

At a given time, the variation of L η modifies the sharpness of the conversion efficiency variations with respect to temperature and therefore the accuracy of the estimated efficiency. In details, the lower L η is, the sharper the conversion efficiency variations are. While device aging, it can be expected that L η should be increased to account for deterioration of an upstream part of the catalyst.

In details, this fictitious length does not exactly match the physical nonreactive length introduced earlier. Yet, for sake of simplicity, we assume here that they are identical.

[START_REF] Heywood | Internal combustion engine fundamentals[END_REF] The proposed model was calibrated using experimental data for different given operating points, for which the engine was initially cold and requested torque and engine speed were kept constant.

This value was calibrated using the same experimental data that in the previous section to calibrate the physical parameters (cold engine, constant requested torque and engine speed). The parameter ν was adjusted during this calibration procedure to maximize the match between the PDE model and the reduced one on these data.

For sake of clarity, pollutant emissions are not reported here. Their scale is similar on the three study cases. Yet, the validity of this evaluation would benefit from dedicated experimental tests.

ACKNOWLEDGMENT

The authors are thankful to Olivier Lepreux for fruitful discussions and advice and to Sopheaktra Kim, ENSTA ParisTech undergraduate student, who carried out substantial model developments during an internship.


Najat El

Mekkaoui De Freitas

Bérangère Legendre
email: berangere.legendre@dauphine.fr

Individual Private Retirement Insurances: holding behaviours among pensioners

In the current context of demographic pressures, reforms of PAYG pension systems increase the extent to which individuals are responsible for their own retirement planning. The French pension system offered high replacement rates. The population used to consider that the State scheme had to provide them with an adequat level of pension. In 2003, the pension reform implemented individual and professional pension plans. These retirement savings contracts are not well developed. However, we observed that individuals prefer contracting life endowment contracts, which are long term savings supports, to prepare retirement. Using econometric specifications, we intend to put into perspective the households and individual characteristics which explain the holding behaviours of life endowment contracts and retirement savings plans. We conclude that the highest professional categories and the most educated individuals hold more frequently and simultanesously both types of contracts.

Introduction

In the current context of pension reforms and population aging in OECD countries, the extent to which people are responsible for their own retirement planning increases.

To face demographic challenges, reforms encourage private pension funding and increase the contributory characteristics of the pension system in OECD countries. Private wealth is an important pillar to maintain the standard of living after the retirement.

In France, the major role of the statutory scheme, the high replacement rates implied a low development of voluntary or sectorial pension schemes. A few questions on the French case deserve to be addressed as it constitutes a paradox: despite the generous Pay-As-You-Go (PAYG) pension system, the household savings rate is high, it amounts to 16% in 2009 (Eurostat), while it amounts only to 13.9 in the European Union. However, private pension plans are not well developed. Despite the high household savings rate, inequalities in retirement planning remain. Among the 50-70 age group, we observe strong inequalities of accumulation. Some households retire with a high level of financial and non financial level of assets and other did not save enough to maintain their standard of living during the retirement period.

In 2010, 6.3 billion euros pension benefits were paid under a contract of additional pension, equivalent to only 2.3% of the total amount of pensions paid (DREES, 2012). The French population used to consider that the PAYG public pension system should finance pensions. The pension system being based on an insurance principle and intergenerational risk sharing, households used to estimate that, once retired, the public system had to provide them with an adequate level of pension. Although the minds are changing, the French case remains a special case.

Funded pensions are recent: individual and professional pension plans4 were introduced only in 2003 and are not well developed. However, we observe that French households contract frequently life endowment contracts, also called in France "life insurances". This typical French savings vehicle gives the possibility to household to choose between an annuity or a lumpsum at the end of the contract.. The first motive to save trough a life endowment contract is the retirement planning (28% of annuities holders) [START_REF] Darmon | Patrimoine : quand les ménages prennent de l'assurance[END_REF]. Until 2004, the second and third pillars were, for the most part inaccessible for French workers. The 2003 reform encouraged individuals to turn to individual or collective savings plans.

In this paper, we intend to better understand what kind of supplementary income sources elder may receive after retirement. We focus on the current French pensioners. Using an original representative household survey, we define econometric specifications to estimate the effects of different socio-demographic determinants on life endowment contracts and retirement savings contracts holding. We then use a bivariate probit model to examine the correlation between the holding of annuities and retirement savings contracts. Are the two savings contracts complementary products or substitutable assets? What characteristics impact on such holdings among elderly people? The relationship between life endowment contracts and retirement savings contracts holding among retirees has not been analyzed before. We consider life endowment contracts and individual retirement plans, more precisely financial contracts that may provide a monthly or annual sum to an individual in retirement until he dies. By identifying factors impacting holding behaviour among the elderly, we aim to define part of the institutional framework that could reduce the intragenerational poverty risk.

The remainder of the paper is organized as follows. In the second section, we present briefly the pension system in France and the literature on life endowment contracts and individual retirement plan holding. Section III describes the survey and the econometric estimates that combine the relationships between life endowment contracts and individual retirement savings contracts holding. In the section IV, we report the estimates results. The last section offers concluding remarks.

Retirement and holding behaviour in France

The French retirement system is primarily based on a statutory pay-as-go system. The State pension scheme is dependant on the sector of activity in which the worker participates. The state pension is calculated on the basis of the person's wage, rate of contribution, and length of contribution. The supplementary schemes, which complement the general State regime and are compulsory, are financed on a pay-as-you-go basis.

The 2003 reform encouraged individuals to turn to individual or collective savings plans. This reform strongly pushed for an increase in the importance of the second and third pillar. The introduction of new savings vehicles encouraged employers to motivate their employees to save for retirement. Important tax benefits were introduced in order to develop the private sector schemes. Until 2004, only few private disposals, depending on the sector of employment, allowed workers to plan individually their retirement. The reform attempted to propose more attractive and universal retirement savings vehicles.

Two new forms of occupational pension funds were implemented. The PERCO 5 is a corporate defined contribution scheme. It is a funded scheme in which all employees may have access. This scheme benefits from tax incentives. Some employees must request membership into this plan, while in other companies enrolment is automatic. At retirement age, the individual may choose to receive their pension amount in the form of annuities or lump sum capital withdrawal depending on the original collective or employer agreement. The PERE 6 plan is a pension scheme offered by insurance companies upon agreement between Unions or companies. Company contributions are mandatory and, if defined in the initial agreement, employee contributions can also be compulsory. The pension sum is only available upon retirement in the form of annuities.

The 2003 reform has also widely encouraged the development of privately managed pension provision through individual contracts. The PERP7 is an individual, voluntary retirement plan running under insurance directives. This optional savings vehicle is available to all individuals. It was designed to complement other retirement income sources. By contributing regularly to this savings plan, the individual can acquire enough savings to receive an additional annuity amount upon retirement.

However, over the past decades, we observe that French households have been prone to make long-term investments by contracting life endowments contracts, also called "life insurance" in France. They contract individual retirement savings products more rarely. Life endowment contracts are typical French long-term savings vehicles. French households have the possibility to contract two types of life insurances:

• Pure life insurances as in other countries: term, or whole-life, policy providing payments to beneficiaries if death occurs during the contract, nothing being paid in case of survival of the insured. This is actually death insurance. We do not consider this type of contract in the article. • What is commonly called "life insurance" in France is real savings product over a single period, with the tax benefits of insurance. Life endowment contracts allow funds to grow while maintaining a long-term goal: retirement, investment real estate, etc. It also offers significant tax benefits for succession. At the end of the contract, the beneficiary may receive an annuity or a capital. We consider this savings product. To avoid confusion in the article, we use the terms "life annuity" or "life endowment contracts". Bernard et al. (2002) show how demographic structure and age impact the holding of life annuities or private voluntary pension contracts. The authors test a probit model to explain the determinants of endowment insurance and voluntary retirement savings holding. Households aged 50 and more hold more contracts than younger households. Whereas the holding of complementary pension contracts tends to decrease after the age of 60, that is not the case for life insurance contracts. Using the same survey, [START_REF] Arrondel | Epargne, Assurance Vie et Retraite, assurance[END_REF] provide an analysis of the socio-economic determinants of life insurance holdings in France. They conclude that French households without children buy more life endowment contracts in order to prepare for their retirement, whereas households with children prefer pure life insurance in case of death in order to protect their family.

In France, the holding behaviour with a retirement related motive8 is consistent with the life cycle hypothesis. Using the French Wealth survey (Patrimoine) of 1992, 1998and 2004[START_REF] Brun-Schammé | L'épargne financière en prévision de la retraite: comportements de détention et montants investis[END_REF] distinguish the age effect from the cohort effect by describing the long-term assets holding for several cohorts. The holding rate for retirement motive increases significantly among households until the age of 60. The highest holding rate is observed for households headed by a 60 years old individual. Then, the holding rate decreases to 5% for households aged of 72 years. However, the possession of such long-term assets, for any motive, decreases only very slightly after the age of 55. The authors conclude that very few households liquidate their retirement related wealth, and change their holding motive. They keep their wealth but for other reasons (bequests, disability risk, tax deductions). It appears that retirement related savings behaviour depends mainly on the age and the professional status. However, financial long term assets holding behaviour, for any motive, highly depends on the income level [START_REF] Brun-Schammé | L'épargne financière en prévision de la retraite: comportements de détention et montants investis[END_REF].

Since Brun-Schammé and Duée's article, new data on holding behaviour, including the recent individual and professional pension plans, the PERP and the PERCO, have been published. At the end of 2007, 2 million of individuals held a PERP, and 334 000 a PERCO [START_REF] Croguennec | L'épargne retraite en 2007[END_REF]. After its introduction in 2003, the development of the PERP experienced an increase of 6%, and the PERCO 66%, of the covered employees. Before the implementation of these retirement pension plans, the possibility the save for retirement through a funded pension plan concerned only few professional categories, mainly executives. 30% of the PERP holders belong to the 40-49 age group, and 35% of the PERCO holders belong to the 50-59 age group.

Survey and empirical model

The Wealth Survey

Asset accumulation is linked with various socio-economic characteristics. We aim particularly to highlight household's holding behaviour, linked with the aging risks in a country where the retirement income usually depends on the public PAYG pension system.

We consider savings vehicles (life endowment contracts and retirement savings contracts both collective and individual) in phases of accumulation and decumulation. Indeed, although individuals retire, they may keep their assets, particularly in the case of life endowment contracts. Conversely, they usually liquidate their retirement savings contracts.

We use the latest household survey (The Wealth survey) conducted in France in 2009-2010 by the French National Institute of Statistics and Economic Studies -Institut National de la Statistique et des Etudes Economiques (INSEE). The database includes a representative sample of the French population, consisting in 35729 individuals, belonging to 15006 households. The wealth survey is particularly informative about the financial and non-financial assets of the households and questions individuals on their income, age, professional category, education/training, marital situation, and work status (active, inactive, retired). Furthermore, the survey also includes the type of asset held by the household (checking account, savings account, real estate, corporate savings, etc.). Retirement pensions, both state and private (type and amounts by range), are also reported.

For each pensioner, we consider personal and household characteristics. 21.22% of the respondents are retired.

A sub sample of 3989 pensioners, who filled in the holding questions in the survey, is selected. In this sample, pensioners are in average 71 years old, 44.8% of the retired are aged from 60 to 69, 46.8% from 70 to 85 and 8.4% are aged 85+. The youngest individual is 60 years old, whereas the oldest one is aged 99.

Life endowment contracts are much more developed among pensioners than private retirement contracts: 46% hold such a contract or receive an annuity from this contract.

Only 21% of the sample holds a retirement savings contract. Among retirees, only individuals retired between 2004 and 2010 are concerned by the 2003 reform that implemented new private retirement savings contracts. 55% of pensioners holding a retirement savings contract hold simultaneously a life endowment contract. 56% of pensioners who do not hold retirement savings asset do not hold life endowment contract. 83% of retirees having no life endowment contract do not hold any retirement savings contract.

Considering these statistics, we may conclude that both life endowment contracts and retirement savings contracts are complementary. However, 75% of life endowment contracts holders do not hold any private retirement contracts.

The estimation method

As a first analysis, we test probit models explaining the probability of annuity ( i ac ) and retirement savings contracts ( i rc ) holding, formulated as:

( ) i i i i u X ac ob + = = α 1 Pr ( ) 1 , 0 ~N u i ( ) i i i i u Y rc ob + = = β 1 Pr ( ) 1 , 0 ~N u i With i
X and i Y the vector of explanatory variables for each individual i of our sample, and i u the error term. In the second step, we construct a bivariate-probit model to estimate simultaneously the probability of holding an annuity and that of holding a private retirement savings contract. We assume that the probability of an annuity holding ( i ac ) and a retirement savings contract ( i rc ) holding are interrelated (Greene, 2008).

The model includes separate probit models with correlated disturbances. Our two binary dependant variables represent the probability of holding an annuity contract ( * i ac ), and the probability of holding a retirement savings contract ( * i rc ). We assume that these two variables represent two interrelated decisions by households. French households have usually made long term investments by contracting annuities. New retirement savings contracts have been implemented since the 2003 reforms. We estimate a bivariate probit model to highlight the correlation between the holding decisions of these two savings vehicles: are they substitutable or complementary?

We estimate the following model:

* = 1 1 + 1 * = 2 2 + 2
Where * and * are unobservable and are related to the binary dependant variables and by the following rules:

� 1 ℎ ℎ 0 ℎ ℎ ℎ � 1 ℎ ℎ 0 ℎ ℎ ℎ
represent the error terms of the two probit models.

In the bivariate probit model, we assume that the error terms are correlated:

1 = + 1 2 = + 2
The error terms follow a standard multivariate normal distribution, where V represents the residual covariance matrix, with ρ as the correlation coefficient.

� 1 2 � → �� 0 0 � , � = � 1 1 �
Conducting likelihood ratio tests, our results indicate that the bivariate-probit estimation is more efficient than that of two independent probit equations. The probability of annuities holding and that of holding a private retirement savings contract are interrelated.

The variable definitions

We take into account the standard socioeconomic determinants used in the literature: professional categories (blue collar, white collar, employed, self-employed), age and life expectancy, composition of the family and a dummy of poverty.

We define the exposure-to-poverty threshold at 60% of the median equivalent income in the population. Each member of the household is assigned an income calculated using an equivalence scale. The economies of scale in housing and the consumption of goods and services are considered by controlling for household composition 9 . We assign the value of 1 to the first household member, 0.5 to each additional adult member and 0.3 to each child under 14. This methodology has the advantage of illustrating more precisely the standard of living of individuals belonging to a household.

According to [START_REF] Yieh | Desired Precautionary savings in the US[END_REF], age, gender, the number of children and education affect the precautionary savings of consumers. Professional categories might capture a wealth effect and could be considered as a proxy of income. Using the 1999 American retirement investment survey, [START_REF] Joo | A Retirement Investment and Savings decision model : influencing factors and outcomes[END_REF] showed that individuals with higher education higher income, and financially literate invest more frequently in a retirement program [START_REF] Lusardi | Financial Literacy and Financial Sophistication Among Older Americans[END_REF]. We consider the level of education (i.e. level of diploma) as a proxy of financial literacy.

Housing may provide a good vehicle for consumption at retirement. We consider a dummy variable indicating whether the household is homeowner or not. Homeownership may negatively affect the demand for endowment insurance and retirement savings if it is considered as a partial substitute for precautionary savings. Conversely, if homeownership and other asset holding are complementary, it could positively affect such demand. [START_REF] Bloom | Longevity and life-cycle saving[END_REF] argued that higher life expectancy should lead to an increase in precautionary savings. To analyze the longevity effect, we introduce a variable of life expectancy.

Results

We consider firstly the last professional category of the current retired. Our results show a great difference between professional categories. Indeed, the probability of holding a life endowment contract is weaker for employees and blue-collar workers (See Individual retirement contract holding is significant only among Executives. The marginal effect related to Executives workers is significant: the probability of holding a retirement savings contract increases to 7.6% at 60 if the individual was an Executive during their active life (See table IV). The marginal effect decreases with age: it amounts to 6.4% for Executives at 80. The oldest pensioners in our sample are not concerned by the 2003 pension reform. Consequently, they saved less for retirement than younger retirees who had the possibility to contract at the end of their career a PERP, a PERCO or a PERE.

Those who lack literacy are much less likely to plan for retirement. Indeed, the population group having a low level of education do not hold any life endowment contract or retirement savings contract. This result is conform to [START_REF] Lusardi | Financial Literacy and Financial Sophistication Among Older Americans[END_REF]. The population group having a high level of education are most likely to be financially sophisticated. At the age of 60, the probability to hold simultaneously a life endowment contract and a retirement savings contracts increases of 12% if people attained a high level of education.

There is a strong relationship between homeownership and life endowment contracts holding. Being a homeowner impacts positively the holding. The marginal effect of homeownership on such a contract holding increases slightly with age: it attains 23.2% at 60 years old and increases to 24.4% at 80 years old (See table III in appendix). However, we still expected to find a significant impact of homeownership on retirement savings contract holding. Indeed, homeownership allows retirees to improve their living standard. It prevents them from paying a rent at old ages. Homeownership is not a significant variable to explain retirement savings.

Life expectancy has a statistically significant impact on holding behaviour. It impacts positively on life endowment contracts and negatively on retirement savings holding. In other words, individuals expecting a long period of retirement tend to accumulate more through a life endowment contract. This savings vehicle may be considered as precautionary savings in order to finance, for instance, expenditure on long-term care. When life expectancy increases by one year, the annuity holding increases by 0.4%. Conversely, when an individual anticipates living longer, they neither keep their retirement contracts nor receive an annuity from such contracts. We conclude that the older French households were not used to preparing for their retirement individually. Given the generous retirement pension system and the low development of private retirement disposals, they did not save for their retirement through retirement savings contracts. The marginal effect of the life expectancy variable on retirement savings contracts holding attains -0.4%.

Family composition may affect the life endowment contracts holding behaviour. Adults probably aim to accumulate wealth in order to allow bequests to their children. However, at the same time, it may be more difficult to save when parents have to bring up children. In the case of retired people, it seems that only individuals without children continue to hold life endowment contracts or retirement savings contracts after retirement. Indeed, retirees still raising children are probably not able to save. Being a couple, widowed or single without any child increases the probability of holding an annuity by about 11 to 15%. This marginal effect remains stable with age. However, household composition does not impact on retirement savings contract holding, a result which may be explained by the fact that this savings vehicle applies to individuals preparing for their own retirement when it is contracted.

Being poor impacts significantly and negatively on the probability of holding an annuity contract or a retirement savings contract. The marginal effect of poverty on the holding behaviour is significant and negative: the probability of holding an annuity decreases by 10.8% at the age of 60 for poor people. This probability decreases to 11.2% at the age of 80. In other words the impact of poverty increases with age. The negative impact is less strong on retirement savings contract holding: the probability of holding decreases by 5.7% at the age of 60 for an individual under the exposure-to-poverty threshold. In this case, the intensity of the marginal effect decreases with age. The probability amounts to 4.6% at the age of 80.

We find a positive and significant correlation of unobserved disturbance in the two probits when estimating the biprobit. Consequently, some individual characteristics that explain the holding of life endowment contracts may also explain the detention of retirement savings. This is particularly the case for the following variables: Executive, Poor, and Master's degree. It puts into perspective the importance of literacy and standard of living in the retirement planning. However, other parameter estimates, such as age or household composition, are quite different, suggesting that life endowment contracts and retirement savings assets may be held by different people. Given the very different levels of development of life endowment contracts and retirement savings vehicles, it is difficult to definitively assert that the two types of contracts are complementary. However, the majority of retirement savings holders also have a life endowment contract.

Although the correlation coefficient is not very large, it is significant. Consequently, the bivariate probit approach is the preferred method for putting into perspective the positive correlation between life endowment and retirement savings vehicles. The marginal effect of the professional categories on the probability of simultaneously holding an annuity and a retirement savings vehicle increases between the age of 60 and the age of 70. This probability attains 5.7% for older Executives at the age of 60 (See table V) and 6.1% at the age of 70. The marginal effects are negative for employees and blue-collar workers.

Concluding remarks

By using micro data from household surveys on income and wealth, we provide an original empirical study to analyse the holding behaviour among elderly people.

We found the existence of potential supplementary income sources among French pensioners. Retirement savings and life annuities could be considered as good vehicles for receiving a supplementary retirement income. France is an interesting case compared to others OECD countries, firstly, because occupational plans are not developed in this country. Secondly, individuals are not made aware of the need to save for their retirement in the context of generous public pension system. We analyse in this paper the relationship between holding rates and socio-demographic characteristics among retirees. We take into account the standard socioeconomic determinants used in the literature: professional categories (blue collars, white collars, employees, self-employed), age and life expectancy, composition of the family and a dummy of poverty. Our results show that life endowment contracts holding is weaker for employees and blue-collar workers. Conversely, Executives tend to hold these assets more frequently. People with a high level of diploma hold more frequently an annuity contract and a retirement savings contract. A high level of diploma provides them with a better financial awareness.

We also find a impact of life expectancy on holding behaviour. However, it impacts annuities holding positively and retirement savings contract holding negatively. In other words, when expecting a long period of retirement, individuals tend to accumulate more through life annuity contracts. This savings vehicle may be considered as precautionary savings, in order to finance the long-term care expenditures for instance.

Family composition also affects savings behaviour. Our models put into perspective the impact of this composition on the holding of life annuities. Elderly people probably aim to accumulate wealth in order to bequeath part to their children.

Finally, poorer retirees' access to annuity and retirement contracts is very weak. The government could encourage private savings through annuity contracts or retirement savings among poor people by proposing matching contributions according to the number of children and disposable income within the household. Among non-poor people, the issue is different: as they prefer contracting life annuities, it could be useful to make the private retirement contract more attractive by implementing new fiscal incentives.

Table I Life endowment contracts and retirement savings contracts holders in the sample

 I

		No retirement	Retirement
		savings	savings	Total
		contract	contract
	No life endowment contract	1764	371	2135
	Life endowment contract	1396	458	1854
	Total	3160	829	3989
	Source: Wealth Survey, 2010

  table II of the appendix). Executives and shopkeepers have a higher probability of holding such a contract than the intermediate professional category. Observation of the marginal effects confirms that the professional category impacts on the probability of holding a life endowment contract: having been an Executive increases the probability of holding such a contract by about 7.4% at the age of 60, 70 and 80 (See table III in appendix). Conversely, this probability decreases if the individual has been an Employee or a Blue-collar worker. The negative marginal effect increases with age for these two categories: at the age of 60 having been an Employee decreases the probability of holding a life endowment contract by 6.8%. At the age of 80, this negative probability amounts to 7%. The probability reaches 8% for Blue-collar workers at the age of 60 and to 8.3% at the age of 80. In other words, this marginal effect increases slightly with age, whereas it remains stable for the higher professional categories. The negative impact is reinforced with age.

These private plans are called " Plan d'épargne retraite populaire" (PERP), " Plan d'épargne retraite entreprise " (PERE) and " Plan d'épargne pour la retraite collectif " (PERCO).

Plan d'épargne pour la retraite collectif

Plan d'épargne retraite en entreprise

Plan d'épargne retraite populaire

Life endowment contracts, popular savings schemes, retirement savings contracts held specifically to prepare the retirement.

support the Chaire Dauphine-Ensae-Groupama.

Appendix