Thomas Gheno

Brian Gleeson

Modes of deposit-induced accelerated attack of MCrAlY systems at 1100 • C

Keywords: MCrAlY coatings, Selective oxidation, Fly-ash, Silicate deposits

The reaction of cast NiCoCrAlY alloys with oxide-sulfate deposits in CO 2 -H 2 O-O 2 was studied at 1100 • C. The minimum Al concentration needed to form an external Al 2 O 3 scale was increased compared with depositfree exposures, as Al 2 O 3 -forming compositions transitioned to internal Al 2 O 3 and external Cr 2 O 3 growth in the presence of certain deposits. Model deposits were used to investigate the role of each constituent in the complex reaction morphology observed with an industrial fly-ash. Two main modes of degradation were identified, which involved Al 2 O 3 dissolution in molten Na silicate and solid-state Al 2 O 3 reaction with CaO. Both led to enhanced Al consumption and promoted non-selective oxidation. Additions of Al 2 O 3 or SiO 2 decreased the CaO reactivity due to the formation of aluminates or silicates, while Na 2 SO 4 , on the contrary, enhanced the degradation by providing rapid mass transport in the molten state, and reduced alloy/scale adherence. A systematic study of the role of phase fractions and phase compositions in the γ-(Ni,Co) + β-(Ni,Co)Al metal system is reported, with the aim of providing guidance in coating design. In particular, high γ fractions and Cr concentrations, which offer optimal hot corrosion resistance, were most susceptible to degradation by oxide-sulfate deposits.

Introduction

Deposit-induced degradation concerns a variety of high-temperature processes, e.g., in aircraft, marine and land-based turbines, and in industrial boilers in general. Particulate matter ingested by an aircraft turbine via its air intake is generally described as calcium-magnesium alumino-silicate or CMAS. In marine engines, chlorides (e.g., NaCl, KCl) can combine with SO x from the environment or produced by combustion of the kerosene to form sulfates (e.g., Na 2 SO 4 , K 2 SO 4 ). In waste or biomass incinerators, sulfur levels are usually low and alkali metals condense as chlorides. Integrated gasification combined cycle (IGCC) plants currently under development are designed to convert coal or a combination of coal and biomass into syngas, which then fuels a combustion turbine to generate electricity [START_REF] Simms | Fireside issues in advanced power generation systems[END_REF][START_REF] Hammond | Techno-economic appraisal of fossilfuelled power generation systems with carbon dioxide capture and storage[END_REF][START_REF] Jenkins | Combustion properties of biomass[END_REF]. In addition to harsh gas environments (CO 2 , H 2 O, SO 2 ), IGCC system turbine components are exposed to deposits of fly-ash which primarily contains SiO 2 , Al 2 O 3 , CaO, MgO and Fe 2 O 3 [START_REF] Levi | Environmental degradation of thermal-barrier coatings by molten deposits[END_REF], but also K 2 SO 4 and Na 2 SO 4 as indicated above and FeS from the sulfidation of steel components upstream [START_REF] Bons | Highpressure turbine deposition in land-based gas turbines from various synfuels[END_REF]. The main source of particulate matter is the ambient air ingested by the turbine [START_REF] White | Conditions in advanced turbines for igcc power plants with carbon capture[END_REF].

Particulate matter compositions vary widely depending on the fuel used and on the turbine location. Bituminous and anthracite coal, for example, tend to produce fly-ash rich in SiO 2 and Al 2 O 3 , while fly-ash from subbituminous and lignite coals contain higher levels of CaO [START_REF]Clean Coal Technology Topical Report Number[END_REF]. In addition, the nature of a deposit depends on the local temperature and gas composition. At high temperatures and low sulfur activities for example, alkali metals will tend to be present as silicates, while at lower temperatures and higher p SO 3 , alkaline earth metals such as Ca or Mg might form sulfates rather than silicates.

Metal coatings applied to impart corrosion resistance to Ni-based structural components in gas turbines include nickel aluminides β-NiAl and MCrAlY (M=Ni, Co or both), based on the B2 compound β-(Ni,Co)Al and the fcc-A1 solid solution γ-(Ni,Co) [START_REF] Reed | The Superalloys: Fundamentals and Applications[END_REF][START_REF] Bose | High Temperature Coatings[END_REF]. Thermal barrier coatings (TBCs) are used on the hottest components, and include an yttria-stabilized zirconia (YSZ) ceramic topcoat for thermal insulation [START_REF] Evans | Mechanisms controlling the durability of thermal barrier coatings[END_REF][START_REF] Gleeson | Thermal barrier coatings for aeroengine applications[END_REF][START_REF] Evans | The influence of oxides on the performance of advanced gas turbines[END_REF][START_REF] Clarke | Thermal-barrier coatings for more efficient gas-turbine engines[END_REF][START_REF] Darolia | Thermal barrier coatings technology: critical review, progress update, remaining challenges and prospects[END_REF]. Since their inception, research on deposit-induced degradation of TBC systems has mostly focused on two aspects, CMAS and hot corrosion. At very high temperatures (> 1200 • C), CMAS deposits melt and infiltrate the YSZ, causing thermo-chemical and thermo-mechanical damage [START_REF] Levi | Environmental degradation of thermal-barrier coatings by molten deposits[END_REF][START_REF] Smialek | Turbine airfoil degradation in the persian gulf war[END_REF][START_REF] Borom | Role of environmental deposits and operating surface temperature in spallation of air plasma sprayed thermal barrier coatings[END_REF][START_REF] Mercer | A delamination mechanism for thermal barrier coatings subject to calcium-magnesium-aluminosilicate (CMAS) infiltration[END_REF][START_REF] Kramer | Thermochemical interaction of thermal barrier coatings with molten CaO-MgO-Al 2 O 3 -SiO 2 (CMAS) deposits[END_REF]. Accelerated corrosion of the bondcoat may occur if the YSZ topcoat is removed or otherwise allows access to condensed species. Ni-and Co-base materials are particularly susceptible to hot corrosion, a potentially severe form of attack at relatively low temperatures (700-900 • C), where molten sulfates dissolve the thermally grown oxides and prevent the establishment of a protective scale [START_REF] Goebel | Mechanisms for hot corrosion of nickel-base alloys[END_REF][START_REF] Stringer | Hot corrosion of high-temperature alloys[END_REF][START_REF] Rapp | Chemistry and electrochemistry of the hot corrosion of metals[END_REF][START_REF] Goward | Low-temperature hot corrosion in gas-turbines: A review of causes and coatings therefor[END_REF][START_REF] Birks | Introduction to the High Temperature Oxidation of Metals[END_REF][START_REF] Pettit | Hot corrosion of metals and alloys[END_REF].

Laboratory CMAS studies do not generally include alkali metal sulfates, because these rapidly volatilize at temperatures where the CMAS is molten (> 1200 • C). On the other hand, hot corrosion studies mostly do not consider oxides or silicates, because these do not melt at temperatures relevant to metal components (700-900 • C). However, depending on the operating conditions, deposits may contain both oxides and sulfates, and continuously increasing service temperatures imply that bondcoats will be exposed to these mixed deposits in an intermediate temperature range (900-1100 • C), where both solid and liquid phases may be of concern (Fig. 1). This paper presents part of a broader study of deposit-induced accelerated corrosion of MCrAlY coatings in conditions relevant to IGCC systems. Ref. [START_REF] Gheno | High temperature reaction of MCrAlY coating compositions with CaO deposits[END_REF] addressed the reaction with pure CaO deposits at 1100 • C. The present paper aims at examining the modes of attack relevant to more complex and realistic oxide-sulfate deposits. In order to study the effect of coating microstructure in a wide composition range, a series of alloys were prepared to provide systematic variations of phase fractions and phase compositions. Cast versions were used in place of coatings. The effects of gas composition and temperature, as well as mechanistic aspects of the accelerated attack, are addressed in companion papers [START_REF] Gheno | On the reaction mechanism of MCrAlY alloys with oxide-sulfate deposits at 1100 • C[END_REF][START_REF] Gheno | Kinetics of Al 2 O 3 -scale growth by oxidation and dissolution in molten silicate[END_REF].

Materials and experiments

Three series of cast NiCoCrAlY alloys were used in this study. Nominal compositions are given in Table 1. First, a β-rich composition typical of bondcoats in plasmasprayed TBCs was made with two Y levels, 0.3 and 0.1 at. % (all alloy compositions are given in at. %). Alloys UT3 to UT8 all have 30 Co and systematic variations of Al and Cr (12/16 Al, 27/30/33 Cr). A third series of alloys was designed to obtain independent variations of phase fractions and phase compositions in the γ-β field at 1100 • C. Alloy UT11 has a high β fraction, f β = 63 vol. %, and a relatively low Cr concentration, 10 at. %. Alloy UT14 was designed to have the same f β as UT4, but with the same phase compositions as UT11, that is, on the same tieline. In the same way, UT15 was designed to have the same f β as UT11, on the tie-line defined by UT4. Finally, UT12 and UT16 are the γ and β end-members of the tie-line defined by UT4, while UT13 and UT17 are the conjugate γ and β compositions for an equilibrated UT11. As shown in Fig. 2, this procedure provided two sets, each with four alloys on a particular tie-line, extending from single-phase γ to single-phase β. The alloys also form four sets of two alloys, each with a constant phase fraction but different phase compositions. All phase equilibrium calculations were done for T = 1100 • C, using the NIST database [START_REF] Kattner | Construction of a thermodynamic database for Ni-base superalloys: A case study[END_REF] in Thermo-Calc [START_REF] Sundman | The Thermo-Calc databank system[END_REF]. The later use of CRALDAD, a more recent database specifically developed for the Al-Co-Cr-Ni system [START_REF] Gheno | Experimental study and thermodynamic modeling of the Al-Co-Cr-Ni system[END_REF][START_REF] Liu | Thermodynamic modeling of Al-Co-Cr, Al-Co-Ni, Co-Cr-Ni ternary systems towards a description for Al-Co-Cr-Ni[END_REF], showed that the alloys were in fact slightly off the tie-lines; nevertheless, the principle of independently varying phase fractions and phase compositions is still qualitatively valid. For clarity of reading, the alloys will be referred to using their β fraction (vol. %) and Cr concentration (at. %). For example, UT3 Ni-30Co-27Cr-12Al-0.1Y is abbreviated 13β-27Cr.

Ingots were made by argon-arc melting, followed by drop casting into 10 mm diameter rods, which were then homogenized in vacuum for 6 h at 1200 • C plus another 48 h at 1150 • C. All processing was conducted at the Materials Preparation Center of the Ames Laboratory [32]. Specimens approximately 1 mm thick were cut from the heat-treated rods, ground using SiC paper to a P1200-grit finish, then degreased with detergent and ultrasonically cleaned in ethanol before exposure.

Microstructural characterization after further annealing at 1100 • C followed by air cooling confirmed the γ-β phase constitution. Some alloys also precipitated σ-CoCr: 1, 2 and 22 vol. % in 18β-33Cr, 40β-30Cr and 42β-33Cr, respectively, as measured by image analysis. A thorough characterization of phase equilibria in the Al-Co-Cr-Ni system can be found in Ref. [START_REF] Gheno | Experimental study and thermodynamic modeling of the Al-Co-Cr-Ni system[END_REF]. The alloys contained a small amount of yttrium-rich intermetallics (∼ 0.1 vol. %), the value being slightly smaller [33]. Measured concentrations were found to be within 0.5 at. % of nominal concentrations for Ni, Co, Cr, Al, and within 0.05 at. % for Y. Volume fractions of β, f β , were measured by image analysis after annealing at 1100 • C for alloys UT2 to UT7, and calculated using the NIST database [START_REF] Kattner | Construction of a thermodynamic database for Ni-base superalloys: A case study[END_REF] for alloys UT11 to UT17 (see explanations in text).

#

Ref.

Elemental concentration (at. %) f β at 1100 (vol. %) mixtures, using a horizontal tube furnace. Gas flow rates were set to 100 ml/min, with a linear velocity of 2 mm/s at reaction temperature, and a total pressure slightly over 1 atm. To obtain a wet gas, CO 2 or CO 2 -O 2 was bubbled through demineralised water set at 62 • C, thereby producing a mixture with slightly more than the desired 0.2 atm H 2 O. The excess water vapor was subsequently condensed by cooling the wet gas in a distillation column at 60 • C. Prior to a given experiment, the furnace was stabilized at 1100 • C with the specimens positioned in a cold zone of the reaction tube, and the gas allowed to flow for 2 h. To start the experiment, the specimens were magnetically pushed into the hot zone.

Specimens were exposed to class C fly-ash deposit procured from a conventional coal-fired power plant (composition and source details in Table 2), as well as model deposits. The latter were prepared by grinding laboratory grade reagents using a mortar and pestle, and were given no heat treatment prior to corrosion testing. The powders were mixed with ethanol, and the resulting slurry was applied to one face of a given specimen using a dropper. The procedure was adjusted to produce approximately uniform 30 ± 5 mg/cm 2 deposits after evaporation of the ethanol. The phase constitution of the model mixtures was also studied by annealing in alumina crucibles with no alloy specimen. After exposure, reaction products were examined by X-ray diffraction (XRD) using a Bruker D8 instrument with Cu radiation (K α1 = 1.54 Å) and Panalytical HighScore Plus processing software. Metallographic cross-sections were first prepared using water-free cutting fluids and polishing suspensions to retain any water-soluble products such as Na 2 SO 4 . Preliminary observations showed the sulfate rapidly reacted or evaporated, and subsequent metallographic preparation was done with water-base products. Specimens were characterized by SEM with a JEOL JSM 6510, and in selected cases by electron probe micro-analysis (EPMA) using a JEOL JXA 8530F. Measured intensities were processed via a built-in ZAF calibration procedure using pure metals as standards.

Results

Oxidation with no deposit

All alloys (Table 1) were exposed to CO 2 -20H 2 O-1.6O 2 with no deposit for 50 h and found to form external Al 2 O 3 scales. Small amounts of Cr, Co or Ni oxide were present in the outermost part of the scales, depending on alloy composition. The alloy with lowest Al concentration, 0β-35Cr, was a borderline Al 2 O 3 -former, in that it occasionally formed internal Al 2 O 3 (and external Cr 2 O 3 ) on the specimen edges.

Exposure to class C fly-ash

Alloys 57β-15Cr, 13β-27Cr, 16β-30Cr, 18β-33Cr, 34β-27Cr, 40β-30Cr and 42β-33Cr were exposed 50 h to the fly-ash in CO 2 -20H 2 O. As a general observation, β-rich alloys were immune to the ash, growing external Al 2 O 3 as they did in the absence of a deposit, while γ-rich alloys were susceptible to a localized type of degradation (Fig. 3). In the latter case the reaction morphology was complex and non-uniform. The attack varied in extent but was of a similar nature for the different alloys. In some regions, the alloys formed an external Al 2 O 3 layer covered by oxides of variable composition, ranging from that of the applied ash (with little Cr, Co or Ni) to Cr 2 O 3 . Other regions showed a more significant metal loss, as the corrosion product included an inner part of mixed Al-rich, Cr-rich and (Co,Ni)-rich oxides. Even then, a continuous Al 2 O 3 layer was almost always present at the base of the scale (Fig. 3c). Photo-stimulated luminescence spectroscopy, which allows Al 2 O 3 polymorphs to be distinguished [START_REF] Tolpygo | Microstructural study of the theta-alpha transformation in alumina scales formed on nickel-aluminides[END_REF], showed this oxide to be α-Al 2 O 3 . In these regions, the outer part of the corrosion product was a mixed, but mostly Cr-rich, oxide. The concentration of alloy elements in the outer part showed local variations, and generally decreased with increasing distance from the specimen surface.

Given the varied nature of the corrosion products, no attempt was made at quantifying the metal loss. Qualitatively, the severity of the attack decreased with increasing Al concentration, and therefore β fraction, in the alloy; higher Cr appeared to make the attack more severe, but this was less marked.

The effect of Y concentration was tested using two versions of alloy 57β-15Cr, with 0.3 and 0.1 at. % Y. In the absence of a deposit, both versions formed Y-Al-O precipitates within the Al 2 O 3 scale and intruding into the alloy. These were more numerous, larger and deeper in the 0.3 Y version. With the ash, while the 0.1 Y version formed external Al 2 O 3 (Fig. 3a), the 0.3 Y version was susceptible to localized attack. As shown in Fig. 4, large Y-Al-O intrusions were found to disrupt the Al 2 O 3 scale and to act as initiation sites for reaction of the alloy with the ash. This appeared to be short-lived, however, as a continuous Al 2 O 3 layer was usually present at the base of the intrusions. In one specimen, zones of severe degradation (> 15 µm deep metal loss) were observed, but corrosion tests conducted for several durations showed these to be isolated events.

Exposure to model deposits

In order to investigate the role of the deposit constituents in the corrosion process, further testing was conducted using model deposits. Fig. 5 shows γ-rich alloys after exposure to a model mixture with the same composition as the fly-ash used previously (Table 2). The reaction morphology was also non-uniform. In some regions (Fig. 5a), it was identical to that observed with the fly-ash. In other regions (Fig. 5b), the inner part consisted of a mixture of Al-rich oxide and Al-free metal.

As discussed later, these are stages of the same process: the fully-oxidized type is simply a more advanced state of the internally-oxidized type. The two morphologies were occasionally observed side-by-side on a given specimen, as shown in Fig. 5c. The similarity in results obtained with the fly-ash and the model deposit validates the use of the latter to study the relevant reaction mechanisms.

A first screening of alloy-oxide interactions was done by reacting a γ-rich alloy, 18β-33Cr, and a β-rich alloy, 57β-15Cr, 50 h in dry air with the following individual oxide deposits: SiO 2 , Al 2 O 3 , Fe 2 O 3 , CaO and MgO. When contacted with SiO 2 , Al 2 O 3 and Fe 2 O 3 , both alloys formed an Al 2 O 3 scale, not significantly different from those grown in the absence of a deposit. Reaction with CaO and MgO produced Ca and Mg aluminates in addition to Al 2 O 3 ; with CaO, the γ-rich alloy also formed a liquid Ca chromate before passivating [START_REF] Gheno | High temperature reaction of MCrAlY coating compositions with CaO deposits[END_REF]. Based on these results, model deposits were designed as combinations of three types of constituents: Al 2 O 3 or SiO 2 as a relatively acidic oxide; CaO as a basic oxide; Na 2 SO 4 as an alkali metal sulfate. Corrosion tests using the deposit compositions given in Table 3 were conducted for 50 h in CO 2 -20H 2 O-1.6O 2 on selected γ-rich alloys. The following focuses on alloys 13β-27Cr and 0β-35Cr. Exposure to SiO 2 -CaO resulted in a reaction morphology similar to that observed with Al 2 O 3 -CaO, with the main difference being that the external scale was made of mixed Ca-Cr silicates; it contained Cr 2 O 3 too, but not as a continuous layer. Furthermore, no Al 2 O 3 layer formed at the internal oxidation front.

The SiO 2 -Na 2 SO 4 deposit produced a molten silicate, which again dissolved large amounts of Al 2 O 3 . A thick Cr 2 O 3 layer was present above most of the internal Al 2 O 3 (left panel of Fig. 10d), but in some locations there appeared to be no external scale, and instead Cr 2 O 3 was found dispersed in the silicate (right panel of Fig. 10d). An external Al 2 O 3 scale was present locally.

With the SiO 2 -CaO-Na 2 SO 4 mixture, a relatively thick scale formed, which contained various phases such as Ca-Cr silicate, C x A y , Ca-Cr sulfo-aluminate, Cr 2 O 3 or CoCr 2 O 4 . Underneath, internal oxidation was relatively shallow and locally an external Al 2 O 3 layer was present (Fig. 10e).

Finally, exposure to SiO 2 -Al 2 O 3 -CaO-Na 2 SO 4 resulted in both regions of external Al 2 O 3 scaling and regions of internal oxidation (Fig. 10f). In the latter case, the affected depth was variable, as was the morphology of the reaction front, which locally featured a continuous Al 2 O 3 layer. The corrosion product also contained an external, more or less continuous scale of mixed alumino-silicate, Cr-rich silicate and Cr 2 O 3 . The deposits used so far had relatively large concentrations of CaO (40 wt. %) or Na 2 SO 4 (10 wt. %). While these levels are relevant to some industrial deposits, e.g., class C fly-ash, they are large relative to other applications such as aero engines, where the CMAS tend to be much richer in SiO 2 . An additional series of experiments was conducted using alloy 13β-27Cr and deposits covering a broader range of compositions. Briefly, these included mixtures based on SiO 2 -25Al 2 O 3 -10CaO-10Fe 2 O 3 -5MgO, with or without 5 wt. % K 2 SO 4 , or with CaO concentrations varying up to 46 wt. %, the other constituents being kept in constant proportions. Also tested was a mixture with the same composition as the fly-ash used previously, but with no sulfate. None of these deposits led to significant degradation of the alloy: variable amounts of Cr-rich oxide formed, but always above an external Al 2 O 3 scale, no internal oxidation occurred.

Discussion

The present results show that NiCoCrAlY alloys that are intrinsically Al 2 O 3 -formers (i.e., when free of a deposit) are at risk of switching to internal Al 2 O 3 and external Cr 2 O 3 formation when exposed to certain types of oxide-sulfate deposits at 1100 • C. The attack is localized, and its severity depends on both deposit and alloy composition.

The processes underlying this deposit-induced attack can ultimately be understood in terms of primary reaction modes involving CaO, SiO 2 and Na 2 SO 4 . The reaction of CaO with Cr to form a liquid chromate rapidly consumes the Cr-rich γ phase, while its reaction with Al 2 O 3 to form Ca aluminates results in enhanced Al depletion [START_REF] Gheno | High temperature reaction of MCrAlY coating compositions with CaO deposits[END_REF]. On the other hand, SiO 2 and Na 2 SO 4 form a molten silicate with high Al solubility. The dissolution of thermally grown Al 2 O 3 in this phase has the same effect as C x A y formation: reducing the Al 2 O 3 thickness causes an increased oxidation rate, and a greater Al flux is required to sustain external scaling, which the alloy may fail to accommodate. Variations of these primary modes are observed in multi-component deposits due to interactions between constituents. In particular, SiO 2 and Na 2 SO 4 affect CCr and C x A y formation, in different ways. These interactions are schematically summarized in Fig. 12, which maps the nature and potential severity of γ-rich alloy degradation as a function of deposit composition. The influence of each constituent will be discussed in subsequent sections.

Regarding the metal system, alloys with both high Cr and high γ fractions were most affected by the deposits. This is related to the nature of the processes identified above: the reaction of thermally grown Al 2 O 3 with either CaO or NS affects the Al mass balance, and is therefore most detrimental to γ-rich alloys, which have a smaller Al reservoir. Similarly, CCr formation is a concern for these alloys both because it preferentially consumes the Cr-rich γ-phase, and because it does so as long as no continuous Al 2 O 3 layer is established, which again depends on the Al content. The importance of the attack can be conveniently described in terms of a shift in the minimum Al concentration required to form an external Al 2 O 3 scale. This is done in Fig. 13, which was inspired by the oxide map developed by Giggins and Pettit for the oxidation of NiCrAl alloys [START_REF] Giggins | Oxidation of Ni-Cr-Al alloys between 1000 • and 1200 • C[END_REF]. As indicated in this figure, an expanded internal/external Al 2 O 3 transition region exists in the presence of the oxide-sulfate deposit. In addition, a slight increase in the Y concentration, from 0.1 to 0.3 at. %, triggered localized attack of the 57β-15Cr alloy exposed to the fly-ash. This was due to the increased number and size of Y-Al-O precipitates, which served as initiation sites for accelerated reaction (Fig. 4). Local Al 2 O 3 scale disruption due to highly reactive Y-rich oxide particles was previously reported for MCrAlY alloys exposed to Na 2 SO 4 in type II hot corrosion conditions [START_REF] Task | The effect of microstructure on the type II hot corrosion of Ni-base MCrAlY alloys[END_REF].

The reaction mechanism associated with multi-component deposits is best described from the morphologies developed after varying durations. This is discussed in detail in Ref. [START_REF] Gheno | On the reaction mechanism of MCrAlY alloys with oxide-sulfate deposits at 1100 • C[END_REF], in which results obtained for exposure times ranging from 20 min to 250 h are reported. As an example, Fig. 14 shows alloy 13β-27Cr after 1 h exposure to the model deposit with the same composition as the fly-ash (Table 2). An external Al 2 O 3 scale is seen to have formed initially, and failed locally. The scale is still present but lost its protective character, as oxides of Cr, Ni and Co are found above it in quantities larger than had formed initially. Alumina intrusions are seen to grow from the scale into the alloy. Due to the localized nature of the attack, several evolutionary stages are visible on the same micrograph: the intrusions develop into the internal oxidation morphology typical of longer exposures, with Cr 2 O 3 growing as an external layer and the internal oxide particles coalescing into a continuous Al 2 O 3 layer at the reaction front. This morphology reflects a steady-state and was not seen to evolve further, at least up to 250 h in isothermal conditions, although in some cases the Al-free metal between the internal Al 2 O 3 also oxidized (Fig. 5). Excepting the latter aspect, the morphology is quite similar to that developed by certain wrought austenitic Ni-base alloys classified as "marginal Al 2 O 3 -formers". In general, these alloys grow external Al 2 O 3 at low temperatures and internal Al 2 O 3 plus external Cr 2 O 3 at higher temperatures. Recently published studies of alloy 602 CA [START_REF] Chyrkin | Modelling compositional changes in nickel base alloy 602 CA during high temperature oxidation[END_REF][START_REF] Schiek | Scale formation of alloy 602 CA during isothermal oxidation at 800-1100 • C in different types of water vapor containing atmospheres[END_REF], for example, illustrate these similarities. Although the present NiC-oCrAlY alloys had higher Al and Cr concentrations, the resemblance with 602 CA reflects the effect of the deposits on the oxide map (Fig. 13).

The link between primary reaction modes identified using unary or binary de- posits and the corrosion process associated with higher-order deposits is deduced from the composition of the latter. Specifically, in the case of the 13β-27Cr alloy: (i) the lowest order mixture causing internal oxidation was the ternary SiO In conditions where Na is present as a sulfate, the question of its interaction with the other deposit constituents is of interest. With CaO being a very basic oxide, its reaction with Na 2 SO 4 involves CaSO 4 . As noted above, the latter is not stable at unit activity in a low p SO 3 gas. However, CaO may dissolve in liquid Na 2 SO 4 : the equilibrium CaSO 4 fraction in the Na 2 SO 4 -CaSO 4 solution, which is wide at 1100 • C [START_REF] Freyer | Crystallization and phase stability of CaSO 4 and CaSO 4 -based salts[END_REF], depends on the environmental SO 3 level. Alumina is amphoteric, and is expected to form NaAlO 2 in a basic environment [START_REF] Jose | Solubility of α-Al 2 O 3 in fused Na 2 SO 4 at 1200 K[END_REF]. The p SO 3 associated with the equilibrium Na

2 SO 4 + Al 2 O 3 = 2NaAlO 2 + SO 3 (2)
is 8 ×10 -9 atm, which is small and suggests that NaAlO 2 would not exist at unit activity in the present conditions. The Na 2 O-NaAlO 2 system contains a liquid aluminate, but the eutectic temperature (1132 Exposure of alloy 13β-27Cr to CaO-Na 2 SO 4 locally led to internal oxidation (Fig. 7), which was not observed with CaO alone. Exactly how Na 2 SO 4 triggered internal oxidation is not clear at this stage, since the activity of pure CaO cannot be increased, but this result further exemplifies the detrimental effect molten Na 2 SO 4 can have on CaO-induced attack. Remarkably, in the case of alloy 0β-35Cr, while exposure to Al 2 O 3 -CaO or SiO 2 -CaO led to uniform internal oxidation, the addition of Na 2 SO 4 to either deposit tended to reduce the internal oxidation depth, to the point where Al 2 O 3 was locally present as an external scale (compare Figs. 10a-b, and Figs. 10c-e). How Na 2 SO 4 favored passivation in this case requires further study.

The presence of Na 2 SO 4 also led to the establishment of a locally elevated S activity at the metal surface, as shown by the occasional presence of internal Y sulfides (for example in Fig. 11b). This had important implications in the early-stage reaction, which are presented in a companion publication [START_REF] Gheno | On the reaction mechanism of MCrAlY alloys with oxide-sulfate deposits at 1100 • C[END_REF]. In the presence of an excess of SiO 2 , Na 2 SO 4 effects can only be short-lived, since Na 2 SO 4 is eventually consumed to form Na silicate. With SiO 2 -free deposits, however, Na 2 SO 4 additions lead to enhanced Al 2 O 3 spallation (Figs. 6 and7) due to the presence of sulfur, which is known to reduce scale adherence [START_REF] Smeggil | A relationship between indigenous impurity elements and protective oxide scale adherence characteristics[END_REF][START_REF] Smialek | Effects of hydrogen annealing, sulfur segregation and diffusion on the cyclic oxidation resistance of superalloys -a review[END_REF][START_REF] Hou | Oxide scale adhesion and impurity segregation at the scale/metal interface[END_REF].

Effects of Al 2 O 3 and SiO 2

The addition of Al 2 O 3 or SiO 2 to CaO reduced the quantity of CCr formed on alloy 13β-27Cr prior to the establishment of external C x A y -Al 2 O 3 . This mitigating effect was greater yet in the case of alloy 0β-35Cr, as CCr consumed over 150 µm of metal during reaction with CaO [START_REF] Gheno | High temperature reaction of MCrAlY coating compositions with CaO deposits[END_REF], but was not observed here with Al 2 O 3 -CaO or SiO 2 -CaO. This can be associated with a reduced reactivity of CaO toward the alloy, due to the formation of Ca aluminate or silicate in the deposit.

However, Al 2 O 3 and SiO 2 do not have equivalent effects. For instance, on alloy 0β-35Cr exposed to Al 2 O 3 -CaO, an external Cr 2 O 3 layer was formed above the internal oxidation zone, and the alloy eventually repassivated (Fig. 10a). With SiO 2 -CaO, both Cr 2 O 3 and Ca-Cr silicates formed, but not as a continuous layer (Fig. 10c). In this case the alloy did not repassivate, and internal oxidation penetrated deeper. It is concluded that, when present as a continuous layer, Cr 2 O 3 lowered the p O 2 at the metal surface, which resulted in a reduced inward O flux, and favored the establishment of a new Al 2 O 3 layer, as opposed to continued internal oxidation. In the presence of SiO 2 , the formation of a Ca-Cr silicate, likely uvarovite Ca 3 Cr 2 Si 3 O 12 [START_REF] Levin | Phase diagrams for ceramists[END_REF], prevented the establishment of a continuous Cr 2 O 3 layer, and therefore repassivation. A pseudo-ternary compound exists in the CaO-Al 2 O 3 -Cr 2 O 3 system (chromate aluminate sodalite Ca 8 [Al 12 O 24 ](CrO 4 ) 2 [START_REF] Melzer | A structural study of aluminate sodalite Ca 8 [Al 12 O 24 ](CrO 4 ) 2 (CACr)[END_REF][START_REF] Antao | Chromate aluminate sodalite, Ca 8 [Al 12 O 24 ](CrO 4 ) 2 : Phase transitions and high-temperature structural evolution of the cubic phase[END_REF], but was not observed to form here.

Conclusions

Applying sulfate-oxide deposits to Al 2 O 3 -forming NiCoCrAlY alloys led to enhanced degradation due to the presence of CaO, SiO 2 and Na 2 SO 4 . The Cr-rich γ-phase initially reacted with CaO to form a molten Ca chromate, Ca aluminates and Ni and Co oxides. Once an external Al 2 O 3 scale was established, it either reacted with CaO to form Ca aluminates, or dissolved in molten Na silicate. In both cases, this increased Al consumption, promoting Al 2 O 3 failure for γ-rich alloys. These primary reaction modes were affected by the deposit compositions: SiO 2 and Al 2 O 3 were found to reduce the reactivity of CaO, due to the formation of Ca aluminates and silicates in the deposit. Sodium sulfate, on the other hand, provided faster Ca transport and enhanced its reactivity toward the alloys. It also produced a locally high sulfur activity at the metal/oxide interface, and reduced scale adherence.

In service conditions, alkali metals may be present either as sulfates or as silicates, depending on the gas and deposit compositions. The present study shows that they can play an important role in the corrosion process either way, and even in successive ways. Indeed, changes in service conditions may lead to the deposition of Na 2 SO 4 , for instance, and its subsequent reaction with SiO 2 to form a silicate, as was the case here.

Within the range of compositions studied, only deposits rich in CaO or those containing Na 2 SO 4 and SiO 2 proved potentially aggressive, and they mostly affected γ-rich, Cr-rich alloys. Both aspects are due to the nature of the primary reaction modes. In an alloy with relatively low Al and high Cr, each reaction mode individually triggered internal oxidation, while with more Al and less Cr, the reaction with CaO and the dissolution in Na silicate each consumed Al 2 O 3 , but its stability as an external scale was only compromised when the two modes were concurrent. Essentially, the deposits raised the minimum Al concentration required to maintain an external Al 2 O 3 scale, to an extent increasing with increasing Cr level.

The present results indicate that with most deposits of realistic compositions, any Al 2 O 3 -forming alloy which would suffer internal oxidation is expected to repassivate eventually, in isothermal conditions. However, given the low adherence of the scales formed with the deposits and the enhanced Al depletion, thermal cycling would certainly have severe consequences, in particular if more deposit is applied periodically.

Figure 1 :

 1 Figure 1: Schematic view of the temperature range and type of deposit relevant to the present work, in comparison with two typical modes of degradation, CMAS and hot corrosion.

Figure 2 :

 2 Figure 2: Alloy compositions (atom fractions) projected on an isothermal (T = 1100 • C), isoplethal (x Co = 0.3) section of the Al-Co-Cr-Ni phase diagram calculated using the NIST database [28]. Alloys UT4 and UT11 to UT17 are along two tie-lines (see explanations in text). The projections of these tie-lines on the plane of constant x Co = 0.3 are indicated by dashed lines.

Figure 3 :

 3 Figure 3: Corrosion products observed after 50 h exposure to fly-ash (composition in Table 2) in CO 2 -20H 2 O at 1100 • C. Alloys (a) 57β-15Cr; (b) 40β-30Cr; (c) 16β-30Cr. The extent of degradation increases with decreasing alloy β fraction.

Figure 4 :

 4 Figure 4: Alloy 57β-15Cr with 0.3 at. % Y after 50 h exposure to fly-ash (Table 2) in CO 2 -20H 2 O at 1100 • C. Where a large Y-Al-O intrusion was present, a mixed corrosion product formed which contained elements from both the ash and the alloy.

Figure 5 :

 5 Figure 5: Local variations in corrosion product morphology observed on γ-rich alloys exposed to a model deposit with the same composition as the fly-ash (Table 2), 50 h at 1100 • C. The zone above the secondary Al 2 O 3 layer is either (a) fully oxidized (alloy 16β-30Cr in CO 2 -20H 2 O) or (b) contains a mixture of Al-rich oxide and Al-free metal (alloy 13β-27Cr in CO 2 -20H 2 O). These two morphologies are occasionally observed side to side on a given specimen, as shown in (c) (alloy 16β-30Cr in dry air).

Figure 6 :Figure 7 :

 67 Figure 6: Corrosion products observed on alloy 13β-27Cr after 50 h reaction in CO 2 -20H 2 O-1.6O 2 at 1100 • C with (a) Al 2 O 3 -40CaO; (b) Al 2 O 3 -40CaO-10Na 2 SO 4 . Mixed compound notation: C: CaO; A: Al 2 O 3 ; S: SO 3 .

3 CASFigure 8 :Figure 9 :

 389 Figure 8: Corrosion products observed on alloy 13β-27Cr after 50 h reaction in CO 2 -20H 2 O-1.6O 2 at 1100 • C with SiO 2 -40CaO. Mixed compound notation: C: CaO; A: Al 2 O 3 ; S: SiO 2 .

Figure 10 :Figure 11 :

 1011 Figure 10: Corrosion products observed on alloy 0β-35Cr after 50 h reaction in CO 2 -20H 2 O-1.6O 2 at 1100 • C with (a) Al 2 O 3 -40CaO; (b) Al 2 O 3 -40CaO-10Na 2 SO 4 ; (c) SiO 2 -40CaO; (d) SiO 2 -10Na 2 SO 4 ; (e) SiO 2 -40CaO-10Na 2 SO 4 ; (f) SiO 2 -25Al 2 O 3 -40CaO-10Na 2 SO 4 . Mixed compound notation: C: CaO; A: Al 2 O 3 ; Cr: Cr 2 O 3 ; N: Na 2 O; S: SiO 2 .

3. 6

 6 Additional exposures to model depositsIn order to better understand the effects of alloy phase fraction and phase composition on deposit-induced corrosion, alloys 0β-19Cr, 0β-35Cr, 17β-16Cr, 16β-30Cr, 63β-10Cr, 63β-18Cr, 100β-5Cr and 100β-8Cr were exposed to the SiO 2 -Al 2 O 3 -CaO-Na 2 SO 4 mixture and to the fly-ash (Table2). With both deposits, only the alloys 16β-30Cr (similar to 13β-27Cr studied above) and 0β-35Cr (see above) alloys experienced internal oxidation, while all others formed external Al 2 O 3 . Thus the β-rich compositions were immune, and in the γ-rich region, only alloys with high Cr levels were susceptible to degradation.The same eight alloys were exposed to pure CaO. The β-rich alloys (63β and 100β) only formed C x A y -Al 2 O 3 scales, while the γ-rich alloys (0β and 16β) also produced molten CCr. As could be expected, the quantity of CCr increased with increasing Cr and decreasing Al concentration in the alloy.The alloy sensitivity to molten NS was studied using alloy 0β-19Cr. Exposure to SiO 2 -Na 2 SO 4 resulted in external Al 2 O 3 formation (Fig.11a). As observed for alloys 13β-27Cr and 0β-35Cr, large amounts of Al were dissolved in the silicate; yet this did not lead to Al 2 O 3 breakdown, despite the alloy having a lower Al concentration than 13β-27Cr. Alloy 0β-19Cr was also exposed to SiO 2 -CaO-Na 2 SO 4 , which involved reaction with both CaO and NS. The alloy produced a thick C x A y scale with Cr 2 O 3 and (Co,Ni)O embedded, and a continuous Al 2 O 3 layer at the base (Fig. 11b). Internal oxidation of Al occurred in a few isolated cases, but mostly the alloy passivated.

Figure 12 :

 12 Figure 12: Schematic map of primary reaction modes involved in the deposit-induced attack of Cr-rich, γ-rich NiCoCrAlY alloys at 1100 • C. The map represents the alloy-deposit reaction products (aluminates, aluminosilicates, and chromates) in a composition space defined by three deposit constituents: SiO 2 , CaO, and Na 2 SO 4 . Deposit compositions causing internal oxidation are represented by hatching.

Figure 13 :

 13 Figure 13: Map showing the effect of sulfate-oxide deposits on the oxidation of NiCoCrAlY alloys at 1100 • C. The boundaries were determined from work by Giggins and Pettit [36] and our work [38] on NiCrAl alloys. "NiO" denotes alloy compositions which form external NiO and internal Al 2 O 3 and Cr 2 O 3 ; "Cr 2 O 3 " denotes compositions which form external Cr 2 O 3 and internal Al 2 O 3 ; "Al 2 O 3 " denotes compositions which form external Al 2 O 3 exclusively;"transition" denotes compositions subject to localized internal oxidation of Al. The alloy map is superimposed on an isothermal section of the NiCoCrAl system with a constant 30 at. % Co, generated with the CRALDAD database[START_REF] Gheno | Experimental study and thermodynamic modeling of the Al-Co-Cr-Ni system[END_REF].

Figure 14 :

 14 Figure 14: Corrosion product formed on alloy 13β-27Cr exposed 1 h to a model deposit with the same composition as the fly-ash (Table 2) in CO 2 -20H 2 O at 1100 • C.

Table 1 :

 1 Nominal composition of NiCoCrAlY alloys used in the present study (at. %). A number of alloys prepared by MPC at Ames Laboratory [32] were sent for ICP-OES analysis to Evans Analytical Group

  [START_REF] Hammond | Techno-economic appraisal of fossilfuelled power generation systems with carbon dioxide capture and storage[END_REF]

Table 2 :

 2 Composition of the fly-ash used in the present study, as reported on the supplier's certification report (wt. %). The ash originated from the Scherer, GA coal-fired power plant and was purchased from Boral (San Antonio, TX). It is classified class C according to ASTM C618 and AASHTO M295 standards.

	SiO 2	25.3
	Al 2 O 3 19.2
	Fe 2 O 3	5.8
	CaO	32.0
	MgO	7.7
	SO 3	3.2
	Na 2 O	2.2
	K 2 O	0.4

Table 3 :

 3 Composition of the model deposits used in this study (wt. %). Al 2 O 3 CaO Na 2 SO 4

	Ref. SiO 2 Al 2 O 3 -CaO	60	40
	SiO 2 -CaO	60		40
	CaO-Na 2 SO 4			90	10
	Al 2 O 3 -Na 2 SO 4		90		10
	SiO 2 -Na 2 SO 4	90			10
	Al 2 O 3 -CaO-Na 2 SO 4		50	40	10
	SiO 2 -CaO-Na 2 SO 4	50		40	10
	SiO 2 -Al 2 O 3 -CaO-Na 2 SO 4	25	25	40	10

  2 -CaO-Na 2 SO 4 ; (ii) in higher order deposits, only those with both a high CaO concentration and some Na 2 SO 4 caused internal oxidation; (iii) in those cases, the corrosion products were similar in nature and morphology to those observed with SiO 2 -CaO-Na 2 SO 4 . It follows that for this particular alloy composition, the co-occurrence of reaction modes involving CaO and NS was necessary to induce Al 2 O 3 failure. This was not the case for alloy 0β-35Cr, which is closer to the threshold for external Al 2 O 3 formation and where each reaction mode separately caused internal oxidation. Another consequence is that corrosion by multi-component deposits can be analyzed in terms of the interactions between thermally grown Al 2 O 3 and deposit constituents, and the consequences thereof on the Al mass balance and Al 2 O 3 stability.At 1100 • C, the p SO 3 corresponding to CaO/CaSO 4 equilibrium is calculated using data compiled byBarin [41] to be 9 ×10 -7 atm, so that CaO should be stable under the current testing conditions. Analysis by XRD of powders reacted in CO 2 -H 2 O-O 2 confirmed that CaO was indeed the predominant species. Sodium sulfate, in comparison, is much more stable relative to Na 2 O, as the p SO 3 for Na 2 O/Na 2 SO 4 equilibrium is 2 ×10 -14 atm, a figure smaller than the impurity level in the reaction gas -no Na 2 O was detected in the reacted samples. However, in the presence of oxides such as SiO 2 , the relative stability of Na 2 SO 4 is reduced: for example, the p SO 3 associated with the equilibriumNa 2 SO 4 + SiO 2 = Na 2 SiO 3 + SO 3(1)is 5 ×10 -6 atm, which is significant, and indeed Na 2 SO 4 reacted to form Na 2 SiO 3 . Incomplete thermodynamic data do not allow accurate calculation at 1100 • C, but extrapolation from lower temperatures yields an even higher p SO 3 value if Na 2 Si 3 O 7 , which is closer to measured silicate compositions, is considered instead of Na 2 SiO 3 . Thus, either a significant p SO 3 or a very low SiO 2 activity would be needed to prevent the formation of the liquid silicate.

	4.1 Thermodynamic considerations

  • C at 5 mol. % Al 2 O 3[START_REF]Ftoxid 2010 database from factsage[END_REF]) is slightly higher than the present reaction temperature. Results on hot corrosion of Al 2 O 3 at 1000 • C[START_REF] Lawson | Hot corrosion of alumina[END_REF] also indicate that the aluminate solubility in molten Na 2 SO 4 is low, Analysis of xCaO + yAl 2 O 3 = C x A y reaction kinetics during annealing of Al 2 O 3 -40CaO and Al 2 O 3 -40CaO-10Na 2 SO 4 powder mixtures in air at 1100 • C. (a) Example of XRD pattern (Al 2 O 3 -40CaO, 8.5 h); (b) extent of completion calculated by adding the mole fractions of all C x A y compounds, determined from XRD patterns.although it can be increased by the simultaneous dissolution of SiO 2 . Indeed, alloy 13β-27Cr was exposed to pure Na 2 SO 4 in dry air, and formed a stable Al 2 O 3 scale -no hot corrosion was observed.4.2 Role of Na 2 SO 4 in the reaction processDespite the absence of an Na 2 SO 4 -induced hot-corrosion process, the addition of Na 2 SO 4 to Al 2 O 3 -CaO did increase the reactivity of CaO, in that it resulted in a thicker C x A y scale on alloy 13β-27Cr (Fig.6). In order to examine the role of Na 2 SO 4 , Al 2 O 3 -CaO and Al 2 O 3 -CaO-Na 2 SO 4 powder mixtures were annealed at 1100 • C in Al 2 O 3 crucibles, with no metal specimen, and the evolution of phase constitution was studied by XRD. Fig.15ashows a typical diffraction pattern, where reactants (CaO, Al 2 O 3 ) and products (C x A y ) are identified. Semi-quantitative analysis of patterns recorded after several reaction times using a built-in tool in the XRD processing software provided an estimation of the powder compositions. The mole fractions of all C x A y compounds were added to determine an accumulated extent of completion for the xCaO + yAl 2 O 3 = C x A y reactions. This extent is also defined as 1 -x Al 2 O 3 -x CaO -x Na 2 SO 4 , where x i is the mole fraction of phase i. Extents of completion are plotted as a function of reaction time for both powder mixtures in Fig.15b. The plots indicate that adding Na 2 SO 4 significantly accelerated the reaction of CaO with Al 2 O 3 to form C x A y phases. As a further study, Al 2 O 3 and CaO powders were mixed in a large excess of Na 2 SO 4 and annealed 20 h at 1100 • C. The molten sulfate was found by SEM-EDS to contain no measurable Al but on average 1 at. % Ca, i.e., about 8 mol. % CaSO 4 in Na 2 SO 4 . Based on this observation, it is concluded that the molten sulfate mediated the conversion of CaO and Al 2 O 3 to C x A y by facilitating Ca transport. This occurs even though pure CaSO 4 is not stable relative to CaO; rather, CaSO 4 exists at activity less than one as a solute in Na 2 SO 4 .

	a														b
	Intensity (arb. unit)	Al 2 O 3 CaO CaAl 2 O 4 CaAl 4 O 7 Ca 12 Al 14 O 33 Ca 3 Al 2 O 6 × + + + × + + × × × × + + + ×	+ +	+ + × ×	+ +	+ + ×		+	+	+	% completion	20 40 60 80 100	Al 2 O 3 -40CaO-10Na 2 SO 4 Al 2 O 3 -40CaO
																0
		15	20	25	30	35	40	45		50	55	60	65	70		0	10	20	30	40	50	60	70	80
							2θ (°)												t (h)
	Figure 15:

Acknowledgements

This work was supported by the Department of Energy through the University Turbine Systems Research (UTSR) Program run by the National Energy Technology Laboratory, award number DE-FE0007271, Seth Lawson, Project Manager. The authors thank Morgan Skapik and Kevin Glorius-Patrick for assistance in preparing the corrosion experiments, Gerald Meier and Nathaniel Bohna for useful discussions, and Xuan Liu and Zi-Kui Liu at the Pennsylvania State University for the phase equilibrium calculations.


Nabanita Dutta

IMAT3E'18 International Meeting on Advanced Technologies in Energy and Electrical Engineering Mathematical models of classification algorithm of Machine learning

Machine learning algorithm has brought the augmenting change in the field of artificial intelligence which espoused human discerning power in a splendid manner. The algorithm has various categories among which classification is the most popular part. Support vector machine algorithm, logistic regression, naïve bays algorithm, decision tree, boosted tree, random forest and k nearest neighbour algorithm all are under classification algorithms. Classification process needs some pre-defined method which leads the method for choosing the train data from the sample data given by the user. Decision making is the heart of any classification algorithm as supervised learning stands out on the decision of users. So the strong mathematical model based on conditional probability lies behind each algorithm. This paper is the study of those mathematical models and logic behind various classification algorithms which help to create a strong decision for users to make the training dataset based on which machine can predict the proper output.

Markov chain model

Markov chain model is a statistical and mathematical setup which has some hidden layers and can be represented as the simple Basyian network which is directly visible to the observer. This model has a remarkable contribution in the field of supervised and reinforcement learning and for pattern recognition. If any example is considered for two classes i.e. A and B and it has 4 transitions when the system is in A then it can be considered as a transition of B similarly when a system is in B it can be considered as a transition of A (Fig1). In that way, a transition matrix will be formed which will define the probability of transition of the state. In that way not only in two classes but also with n no of classes or states the model can be built up.

So the Markov chain model is based on conditional probability. The main target of this structure is to concentrate on the completion of a task is the best-suited way which requires the probability of the summation of all sequences in its best-suited way. The probability of the observant in a particular sequence has been described in the equations (Eqn 1 to 4).

IMAT3E'18

International Meeting on Advanced Technologies in Energy and Electrical Engineering (0), (1),...., ( 1) Y y y y L 

(1) The length of the L is defined as

( ) ( | ) ( ) X P Y P Y X P X   (2)
The sum of the overall hidden node sequences (0), (1),....., ( 1) X x x x L 

(3) Using the chain rule it is defined that

The Markov chain assumption depends on i e .

Example of Markov chain model

In the heavy industry like oil and gas industry, petrochemical industry, in power plant moreover in household purposes and in agriculture, the pumping system is a very instigate part so the health of the pumping system is needed to be under proper vigilance. Machine learning algorithm has conveyed the bewildering elucidation where both incessant monitoring and ground fault detection are conceivable. Various faults occur in the pumping system where cavitation is one of the faults among these [START_REF] Nabanita Dutta | Centrifugal Pump Cavitation Detection Using Machine Learning Algorithm Technique[END_REF]. Cavitation occurs when the bubbles are created in the area of the impeller and sudden pressure drops. So detection of cavitation in the pumping system is a challenging task. If it is considered that total points collectively with faulty and no faulty condition is 300 and only cavitation fault points are 240, then the implementation of Markov model based on conditional probability is described in the equations ( Eqn 5-7).

P (Trained points| Faulty points (cavitation)) = ( int ( )) ( int )

P Faultypo s cavitation P totaltrainedpo s

(5)

= ( int ( )) ( int ) C Faultypo s cavitation C totaltrainedpo s (6) = 240 300 (7)
= 0.8 So the choosing of faulty points is more preferable when the user can define the faulty points properly.

The mathematics behind the algorithms

Each and every classification algorithm is built up with strong mathematical models and logic. Though the decision tree is one of the classification algorithms every algorithm is bound to make one decision before starting of making the trained model. The logic of the SVM is for finding out the optimal separating hyperplane that maximizes the margin of training data [START_REF] Widodo | Support vector machine in machine condition monitoring and fault diagnosis[END_REF]. If two classes A and B are there, for separating A and B a hyperplane is required which is called separating hyperplane, so choosing of the hyperplane is very vital. If hyperplane is wrongly chosen then it is very difficult for the classification of two classes [START_REF] Alfayez | The application of acoustic emission for detecting incipient cavitation and the best efficiency point of a 60 kW centrifugal pump: the Case study[END_REF] (Fig 2). The hyperplane is constrained by the equation 8. ) ( )

N N T i i i i w w C C         (
V st s t s t d x y x y      (9)
Similarly decision tree algorithm needs proper decision-making tree which will take the decision for predicting the best-suited output, naive bays algorithm stands on the theory of conditional probability (eqn 4), logistic regression needs continuous data for analysis and prediction of output is based on sigmoid function (eqn 10), random forest stands on the theory of Chebychev inequality combination of mean and standard deviation (eqn 11).

Conclusion:

The article presents the Markov chain model based on conditional probability which describes the classification algorithms for prediction of faulty points in the system accurately.

Fig 1 :

 1 Fig 1: Two state Markov chain model

Fig 2 :

 2 Fig 2: Choosing of hyperplane for classification in SVM Similarly, k nearest neighbour algorithm needs the proper distance from the testing point to the classification point. The distance d has a relationship between test point y with classification point x [4] (eqn 9).


Problem

Find all n-bit Sboxes having a given difference distribution table.

α/β 0 1 2 3 4 5 6 7 0 8 . . . . . . .

1
δ(F ) = max α =0,β δ F (α, β) .
δ(F ) ≥ 2 with equality for APN functions.

• All entries in the DDT are even.

• The entries in a row sum to 2 n .

Related open problems

• Characterization of valid DDTs.

• Characterization of the functions sharing the same DDT.

• The big APN problem [Dillon 09]: Does there exist an APN permutation of n variables with n even, n ≥ 8?

• The crooked conjecture [Bending, Fon-der-Flaass 98]:

F is an APN permutation of degree 2 if and only if the support of every row in the DDT is the complement of a hyperplane.

Indicator

F ∼ DDT G ⇔ DDT F = DDT G • γ-equivalence (aka differential equivalence [Gorodilova 16]): F ∼ γ G ⇔ γ F = γ G DDT-equivalence ⇒ γ-equivalence
The two notions are different

For n = 4 ,2,3,4,5,6,7,8,9,10,11,12,13,15,14], ,3,2,5,4,7,6,8,9,10,11,12,13,14,15]. ,2,3,4,5,6,7,8,9,10,11,12,13,15,14], ,3,2,5,4,7,6,8,9,10,11,12,13,14,15].

F = [0,1
G = [0,1
DDT F =                    16
                   For n = 4 F = [0,1
G= [0,1
DDT G =                    16 . . .                   
γ-equivalence and differential uniformity

The following 4-bit Sboxes are γ-equivalent:

F 1 = [1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] with δ(F 1 ) = 14, F 2 = [1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1] with δ(F 2 ) = 12, F 3 = [1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1] with δ(F 3 ) = 10, F 4 = [1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 1, 1] with δ(F 4 ) = 8.

The two notions coincide in some cases α/β 0 1 2 3 4 5 6 7 0 0 0 0 0 0 0 0 0

1 0 * 0 * 0 * 0 * 2 0 0 * * 0 0 * * 3 0 * * 0 0 * * 0 4 0 0 0 0 * * * * 5 0 * 0 * * 0 * 0 6 0 0 * * * * 0 0 7 0 * * 0 * 0 0 * F ∼ γ G implies F ∼ DDT G
• when F is APN.

• when F and G are quadratic.

Trivially equivalent Sboxes Proposition.

The DDT-equivalence class of an n-bit Sbox contains all functions of the form

x -→ F (x + c) + d, for c, d ∈ F n 2 .
We say that the DDT-equivalence class of F is trivial if it contains trivially equivalent Sboxes only.

Problems.

• Characterize the Sboxes having a trivial DDT-equivalence class.

• Determine the properties of the Sboxes within a non-trivial DDT-equivalence class.

F and G share the same DDT iff they share the same squared LAT.

⇒ Sboxes within the same DDT-equivalence class correspond to LAT with different sign sequences: In general: For any even n, all n-bit Sboxes defined by

W G (λ, µ) = x∈F n 2 (-1) λ•G(x)+µ•x = (-1) s(λ,µ) W F (λ, µ).
S(x) = (f (x), c 1 , . . . , c n-1 )
where f is a bent function and (c 1 , . . . , c n-1 ) is a constant, have the same DDT.

All rows are equal to

[2 n-1 , 2 n-1 , 0, 0, . .

. , 0]

⇒ There exist Sboxes of any degree between 2 and n/2 in this DDT-equivalence class.

Extended affine equivalence Definition.

Two n-bit Sboxes F and G are extended-affine (EA) equivalent if there exist affine functions A 0 , A 1 , A 2 , where A 1 and A 2 are bijective such that

G = A 1 • F • A 2 + A 0 .
Proposition (adapted from [Gorodilova 16]) If F and G are EA-equivalent, then their DDT-equivalence (resp. γ-equivalence) classes have the same size.

C DDT (G) = {A 1 • F • A 2 + A 0 , with F ∈ C DDT (F )}
CCZ equivalence [Carlet,Charpin,Zinoviev 98] Definition.

Two n-bit Sboxes F and G are said CCZ equivalent if

{(y, G(y)), y ∈ F n 2 } is the image of {(x, F (x)), x ∈ F n 2 } by a linear permutation L of F n 2 × F n 2 .
In particular, if L : (x, y) → (L 1 (x, y), L 2 (x, y)), then

x → L 1 (x, F (x)) is a permutation.

Open problem [Gorodilova 16] Does an analogue of the result for EA equivalence hold for CCZ equivalence?

CCZ equivalence

Theorem.

If F and G are CCZ-equivalent then

• their DDT-equivalence (resp. γ-equivalence) classes have the same size.

• The DDT-class of G is obtained by applying the same linear permutation L to all functions in the DDT-class of F .

Algorithm for determining all Sboxes having a prescribed γ

Input : The indicator of a DDT, Output : All functions having this indicator Idea: Recursive Tree-traversal algorithm

• Tree of depth 2 n : each node at level i corresponds to one possible value for F (i).

• From the constraints of the DDT and the values F (0), . . . , F (i -1):

• find all possible values for F (i)

• for each of them, move on to the next step F (i + 1), and backtrack if necessary

Pruning trick: We fix F (0) and F (1)

APN permutations.

The DDT-equivalence classes of all known APN permutations for n ≤ 9 are trivial.

Optimal permutations for n = 4.

The DDT-equivalence classes and the γ-equivalence classes of all permutations F with δ(F ) = 4 and optimal linearity listed in [Leander, Poschmann 07] are trivial.

APN non-bijective functions

The DDT-equivalence classes of all known APN functions for n ≤ 8 are trivial, except:

• when n ≡ 0 mod 4: the Gold APN functions with exponents 2 k + 1 with k = n/2 ± 1 [Gorodilova 16]

• for n = 6: Class 13 in [Brinckmann, Leander 08].

We checked that, for n = 6, all APN functions of degree ≤ 3 are trivial except Class 13. Do all permutations have a trivial DDT class?

The following permutations share the same DDT.

x 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 F (x) 0 1 2 3 4 5 6 7 8 9 10 11 13 12 15 14 16 G(x) 0 1 2 3 4 5 6 7 8 9 10 11 13 12 15 14 16

x

  of theDDT [Carlet, Charpin, Zinoviev 98] Definition:For any n-bit Sbox F , γ F is the Boolean function of 2n variables defined by γ F (α, β) = 0 if and only if δ F (α, β) = 0 or α = 0 .

F

  and G are trivially DDT-equivalent Sboxes if and only if s(λ, µ) = d • λ + c • µ. Algebraic degree of DDT-equivalent Sboxes Conjecture [Gorodilova 16]. If F is a quadratic APN Sbox, then any G in the DDT-class of F satisfies deg(F + G) ≤ 1 .

  17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 F (x) 17 19 18 20 21 23 22 25 24 26 27 28 29 31 30 G(x) 17 19 18 21 20 22 23 24 25 27 26 28 29 31 30

. . . . . . . . . . . . . 16 . . . . . . . . . . . . . . . . 12 4 . . . . . . . . . . . . . . 4 12 . . . . . . . . . . . . . . . . 12 4 . . . . . . . . . . . . . . 4 12 . . . . . . . . . . . . . . . . 12 4 . . . . . . . . . . . . . . 4 12 . . . . . . . . . . . . . . . . 4 12 . . . . . . . . . . . . . . 12 4 . . . . . . . . . . . . . . . . 4 12 . . . . . . . . . . . . . . 12 4 . . . . . . . . . . . . . . . . 4 12 . . . . . . . . . . . . . . 12 4 . . . . . . . . . . . . . . . . 4 12 . . . . . . . . . . . . . . 12 4

Sboxes sharing the same DDT Experimental results

Some conclusions and a conjecture

• All Sboxes we found with a non-trivial DDT-equivalence class have non-distinct rows in their DTT.

• All rows in the DDT of an APN permutation are distinct.

Conjecture.

The DDT-equivalence class of any APN permutation is trivial.

Open problem.

Find a family of Sboxes for which it can be proved that the DDTequivalence class is trivial.

. 2 2 2 2 . . 7 . 2 2 . 2 .

. 2

• Set F (0) = 0

• F (0) + F (2) ∈ R 2 = {2, 3, 6, 7} and F (1) + F (2) ∈ R 3 = {1, 2, 5, 6} ⇒ F (2) ∈ {3, 7}


k 0 k 1 k 2 k r plaintext x y ciphertext K master key ...
where each F (i) is a permutation of F n 2 .

1

Round function in a substitution-permutation network Truth table of a Boolean function.

S S S S S S S S S S

x 1 0 1 0 1 0 1 0 1 x 2 0 0 1 1 0 0 1 1 x 3 0 0 0 0 1 1 1 1 f (x 1 , x 2 , x 3 ) 0 1 0 0 0 1 1 1 Value vector of f : word of 2 n bits corresponding to all f (x), x ∈ F n 2 .

Vectorial Boolean functions Definition. A vectorial Boolean function with n inputs and m outputs is a function from F n 2 into F m 2 :

S :

F n 2 -→ F m 2 (x 1 , . . . , x n ) -→ (y 1 , . . . , y m )
Each function S i : (x 1 , . . . , x n ) -→ y i is called a coordinate of S.

Example.

x 0 1 2 3 4 5 6 7 8 9 a b c d e f S(x) f e b c 6 d 7 8 0 3 9 a 4 2 1 5 S 1 (x) 1 0 1 0 0 1 1 0 0 1 1 0 0 0 1 1 S 2 (x) 1 1 1 0 1 0 1 0 0 1 0 1 0 1 0 0 S 3 (x) 1 1 0 1 1 1 1 0 0 0 0 0 1 0 0 1 S 4 (x) 1 1 1 1 0 1 0 1 0 0 1 1 0 0 0 0

Hamming weight of a Boolean function

Hamming weight of a Boolean function.

The Hamming weight of a Boolean function f , wt(f ), is the Hamming weight of its value vector.

A function of n variables is balanced if and only if wt(f ) = 2 n-1 .

Proposition.

A vectorial function S with n inputs and n outputs is a permutation if and only if any nonzero linear combination of its coordinates

x -→ n i=1 λ i S i (x), λ = (λ 1 , . . . , λ n ) = 0 is a balanced Boolean function. Algebraic normal form (ANF) Monomials in F 2 [x 1 , . . . , x n ]/(x 2 1 + x 1 , . . . , x 2 n + x n ): x u , u ∈ F n 2 where x u = n i=1
x u i i .

Example:

x 1011 = x 1 1 x 0 2 x 1 3 x 1 4 = x 1 x 3 x 4 .
Proposition.

Any Boolean function of n variables has a unique polynomial representation in F 2 [x 1 , . . . , x n ]/(x 2 1 + x 1 , . . . , x 2 n + x n ):

f (x 1 , . . . , x n ) = u∈F n 2 a u x u , a u ∈ F 2 .
Moreover, the coefficients of the ANF and the values of f satisfy:

a u = x u f (x) and f (u) = x u a x ,
where x y if and only if x i ≤ y i for all 1 ≤ i ≤ n.

Example

x 1 0 1 0 1 0 1 0 1 x 2 0 0 1 1 0 0 1 1

x 3 0 0 0 0 1 1 1 1 f (x 1 , x 2 , x 3 ) 0 1 0 0 0 1 1 1 a = f (000) = 0 a = f (100) ⊕ f (000) = 1 a = f (010) ⊕ f (000) = 0 a = f (110) ⊕ f (010) ⊕ f (100) ⊕ f (000) = 1 a = f (001) ⊕ f (000) = 0 a = f (101) ⊕ f (001) ⊕ f (100) ⊕ f (000) = 0 a = f (011) ⊕ f (001) ⊕ f (010) ⊕ f (000) = 1 a = x∈F 3 2 f (x) = wt(f ) mod 2 = 0 f = x 1 ⊕ x 1 x 2 ⊕ x 2 x 3 .
Computing the ANF n = 3:

0 1 2 3 4 5 6 7 f (0) f (1) f (2) f (3) f (4) f (5) f (6) f (7) f (0) f (0) ⊕ f (1) f (2) f (2) ⊕ f (3) f (4) f (4) ⊕ f (5) f (6) f (6) ⊕ f (7) f (0) f (0) ⊕ f (1) f (0) ⊕ f (2) f (0) ⊕ f (1) f (4) f (4) ⊕ f (5) f (4) ⊕ f (6) f (4) ⊕ f (5) ⊕f (2) ⊕ f (3) ⊕f (6) ⊕ f (7) f (0) f (0) ⊕ f (1) f (0) ⊕ f (2) f (0) ⊕ f (1) f (0) ⊕ f (4) f (0) ⊕ f (1) f (0) ⊕ f (2) f (0) ⊕ f (1) ⊕f (2) ⊕ f (3) f (4) ⊕ f (5) ⊕f (4) ⊕ f (6) ⊕f (2) ⊕ f (3) ⊕f (4) ⊕ f (5) ⊕f (6) ⊕ f (7)
first step:

f (2i + 1) ← f (2i + 1) ⊕ f (2i)
second step:

f (4i + j + 2) ← f (4i + j + 2) ⊕ f (4i + j), ∀0 ≤ j < 2 third step: f (8i + j + 4) ← f (8i + j + 4) ⊕ f (8i + j), ∀0 ≤ j < 4
Computing the ANF When the value vector is stored as a 32-bit integer x:

x ^= (x & 0x55555555) << 1;

x ^= (x & 0x33333333) << 2;

x ^= (x & 0x0f0f0f0f) << 4;

x ^= (x & 0x00ff00ff) << 8;

x ^= x << 16;

Degree of a Boolean function

Definition.

The degree of a Boolean function is the degree of the largest monomial in its ANF.

Proposition.

The weight of an n-variable function f is odd if and only if deg f = n.

Definition.

The degree of a vectorial function S with n inputs and m outputs is the maximal degree of its coordinates.

Example

x 0 1 2 3 4 5 6 7 8 9 7 8 0 3 9 a 4 2 1 5 S 1 (x) 1 0 1 0 0 1 1 0 0 1 1 0 0 0 1 1 S 2 (x) 1 1 1 0 1 0 1 0 0 1 0 1 0 1 0 0 S 3 (x) 1 1 0 1 1 1 1 0 0 0 0 0 1 0 0 1 S 4 (x) 1 1 1 1 0 1 0 1 0 0 1 1 0 0 0

0 S 1 = 1 + x 1 + x 3 + x 2 x 3 + x 4 + x 2 x 4 + x 3 x 4 + x 1 x 3 x 4 + x 2 x 3 x 4 S 2 = 1 + x 1 x 2 + x 1 x 3 + x 1 x 2 x 3 + x 4 + x 1 x 4 + x 1 x 2 x 4 + x 1 x 3 x 4 S 3 = 1 + x 2 + x 1 x 2 + x 2 x 3 + x 4 + x 2 x 4 + x 1 x 2 x 4 + x 3 x 4 + x 1 x 3 x 4 S 4 = 1 + x 3 + x 1 x 3 + x 4 + x 2 x 4 + x 3 x 4 + x 1 x 3 x 4 + x 2 x 3 x 4 Identifying F n 2 with a finite field
F n 2 is identified with the finite field with 2 n elements.

F 2 n = {0} ∪ {α i , 0 ≤ i ≤ 2 n -2}
where α is a root of a primitive polynomial of degree n.

⇒ for any i, α i = n-1 j=0 λ j α j
Example for n = 4: primitive polynomial: 1 + x + x 4 , α a root of this polynomial.

F 2 4 0 1 α α 2 α 3 α 4 α 5 α 6 α 7 0 1 α α 2 α 3 α + 1 α 2 + α α 3 + α 2 α 3 + α + 1
F 4 2 0000 0001 0010 0100 1000 0011 0110 1100 1011

α 8 α 9 α 10 α 11 α 12 α 13 α 14 α 2 + 1 α 3 + α α 2 + α + 1 α 3 + α 2 + α α 3 + α 2 + α + 1 α 3 + α 2 + 1 α 3 + 1 0101 1010 0111 1110 1111 1101 1001
The univariate representation of Sboxes Any vectorial function with n inputs and n outputs can be seen as

S : F 2 n -→ F 2 n Then, S(X) = 2 n -1 i=0 c i X i , c i ∈ F 2 n.
Example:

x 0 1 2 3 4 5 6 7 8 9 a b c d e f S(x) f e b c 6 d 7 8 0 3 9 a 4 2 1 5 S(X) = α 12 + α 2 X + α 13 X 2 + α 6 X 3 + α 10 X 4 + αX 5 + α 10 X 6 + α 2 X 7 +α 9 X 8 + α 4 X 9 + α 7 X 10 + α 7 X 11 + α 5 X 12 + X 13 + α 6 X 14

Linear approximations of a function and Walsh transform

Linear attacks [Matsui 93] Idea.

Use linear relations between the input and output bits of the cipher which hold with probability significantly greater or significantly less than 1/2.

a ∈ F n 2 : input mask b ∈ F n 2 : output mask Pr x [a • x ⊕ b • E k (x) = 0] - 1 2
For our 4-bit Sbox.

x

1 ⊕ x 4 ⊕ S 2 (x) = 0x9 • x ⊕ 0x2 • S(x)
equals 0 with probability 1 8 .

Computing the probabilities of all linear relations Bias of a Boolean function.

For any Boolean function f of n variables

E(f ) = x∈F n 2 (-1) f (x) = 2 n -2wt(f ).
Equivalently,

Pr[f (x) = 0] = wt(f ) 2 n = 1 2 1 - E(f ) 2 n .
→ we need to compute the biases of all Boolean functions

x -→ b • S(x) + a • x .
Linear approximations of an Sbox Pr

[a • x + b • S(x) = 0] = 1 2 1 + E(a, b) 2 n
For instance, for a = 0x9 and b = 0x2, we have p = 1 2 (1 -12 16 ) = 1 8 .

Walsh transform of a Boolean function

Walsh transform of a Boolean function f of n variables

F n 2 -→ Z a -→ E(f + a ) = x∈F n 2 (-1) f (x)+a•x
where a : x -→ a • x Walsh transform of a vectorial function S:

F n 2 × F m 2 -→ Z (a, b) -→ E(b • S + a ) = x∈F n 2 (-1) b•S(x)+a•x
Computing the Walsh transform

f (x) 0 1 0 0 0 1 1 1 T (x) = (-1) f (x) 1 -1 1 1 1 -1 -1 -1 step 1 0 2 2 0 0 2 -2 0 step 2 2 2 -2 2 -2 2 2 2 E(f + a ) 0 4 0 4 4 0 -4 0 first step: T (2i) ← T (2i) + T (2i + 1) T (2i + 1)
← T (2i) -T (2i + 1) second step:

T (4i + j) ← T (4i + j) + T (4i + j + 2), ∀0 ≤ j < T (4i + j + 2) ← T (4i + j) -T (4i + j + 2), ∀0 ≤ j < third step:

T (8i + j) ← T (8i + j) + T (8i + j + 4), ∀0 ≤ j < T (8i + j + 4) ← T (8i + j) -T (8i + j + 4), ∀0 ≤ j < Complexity : n2 n operations.

Some basic properties of the Walsh transform

Lemma:

E( a ) = x∈F n 2 (-1) a•x = 2 n if a = 0 0 otherwise .
Proposition. The Walsh transform is an involution (up to a multiplicative constant): for any x ∈ F n 2 ,

a∈F n 2 E(f + a )(-1) a•x = a∈F n 2 u∈F n 2 (-1) f (u)+a•u+a•x = u∈F n 2 (-1) f (u) a∈F n 2 (-1) a•(x+u) = 2 n (-1) f (x)
Some basic properties of the Walsh transform Parseval equality.

a∈F n 2 E 2 (f + a ) = 2 2n .
Proof.

a∈F n 2 E 2 (f + a ) = a∈F n 2    x∈F n 2 (-1) f (x)+a•x       y∈F n 2 (-1) f (y)+a•y    = x∈F n 2 y∈F n 2 (-1) f (x)+f (y) a∈F n 2 (-1) a•(x+y) = 2 n x∈F n 2 (-1) f (x)+f (x) = 2 2n .
[Check it on each column of the

L(f ) = max a |E(f + a )|
is called the linearity of f (highest bias for an affine approximation).

N L(f ) = 2 n-1 - 1 2 L(f )
is called the nonlinearity of f (distance of f to the affine functions).

Can we say something about L(f )?

L(f ) = max a |E(f + a )|
Theorem. [Rothaus 76] For any Boolean function with n variables,

L(f ) ≥ 2 n 2 ,
with equality for even n only. The functions achieving this bound are called bent functions. They are not balanced.

Proof. From Parseval equality:

2 2n = a∈F n 2 E 2 (f + a ) ≤ max a∈F n 2 E 2 (f + a ) × 2 n = 2 n L 2 (f )
with equality if and only if all E 2 (f + a ) are equal.

Then, L(f ) ≥ 2 n 2 with equality if and only if

E(f + a ) = ±2 n 2 , ∀a ∈ F n 2 .
Can we say something about L(f )?

What is the lowest possible value for L(f ) when n is odd? When f is balanced?

Functions of degree 2.

For n odd, n = 2t + 1

x 1 x 2 ⊕ x 3 x 4 ⊕ . . . ⊕ x 2t-1 x 2t ⊕ x 2t+1 satisfies L(f ) = 2 n+1 2 . Moreover, f is balanced and ∀a ∈ F n 2 , E(f + a ) ∈ {0, ±2 n+1 2 }.
Theorem.

2 n 2 ≤ min f ∈Bool n L(f ) ≤ 2 n+1 2
Boolean functions with a low linearity

n min f ∈Bool n L(f ) 5 8 [Berlekamp-

Linearity of an Sbox

Criterion on the Sbox.

All linear approximations of S should have a small bias, i.e.,

L(S) = max

a∈F n 2 , b∈F n 2 ,b =0 |E (b • S + a )| = max b =0 L(b • S)
must be as small as possible.

N L(S) = 2 n-1 - 1 2 L(S)
is called the nonlinearity of S.

Sboxes with a low linearity

What is the lowest possible value for L(S) when S is a vectorial function with n inputs and n outputs?

Theorem. [Chabaud-Vaudenay 94] For any function S with n inputs and n ouputs,

L(S) ≥ 2 n+1 2 ,
with equality for odd n only. The functions achieving this bound are called almost bent functions.

For n even.

There exist Sboxes with

L(S) = 2 n+2 2
but we do not known if this value is minimal.

Resistance to differential attacks

Difference distribution table of an Sbox a \ b 1 2 3 4 5 6 7 8 9 a b c d e f 1 2 0 4 2 0 2 2 0 0 0 2 0 0 0 2 2 2 2 0 2 4 0 2 0 4 0 0 0 0 0 0 3 2 0 4 0 2 0 0 0 0 6 0 0 0 2 0 4 2 0 2 4 0 0 0 2 2 0 0 2 0 0 2 5 0 4 2 0 0 0 2 2 0 0 4 2 0 0 0 6 4 0 0 0 0 4 0 4 0 0 0 0 4 0 0 7 0 2 0 0 2 2 2 0 2 2 2 0 0 2 0 8 0 4 0 0 0 4 0 0 0 0 0 0 4 0 4 9 2 2 0 2 2 0 0 0 4 0 0 2 0 2 0 a 0 0 2 2 0 2 2 2 0 2 2 0 0 0 2 b 0 0 2 0 4 0 2 2 0 0 0 6 0 0 0 c 0 2 0 0 0 2 0 0 2 2 2 2 0 4 0 d 2 0 0 0 2 0 0 0 0 2 0 0 8 2 0 e 0 0 0 0 0 0 4 0 0 0 4 0 0 4 4 f 0 0 0 4 0 0 0 4 2 2 0 2 0 0 2

δ S (a, b) = #{X ∈ F n 2 , S(X ⊕ a) ⊕ S(X) = b}
E 2 (a, b), a, b ∈ F n 2 E 2 (u, v) = a,b∈F n 2 (-1) a•u+b•v δ(a, b) δ(a, b) = 2 -2n u,v∈F n 2 (-1) a•u+b•v E 2 (u, v)
There is a one-to-one correspondence between the Sbox and the LAT. But several Sboxes may have the same squared LAT.

Finding good Sboxes

Affine equivalence between Sboxes S 1 and S 2 are affinely equivalent if there exist two affine permutations of F n 2 , A 1 and A 2 , such that

S 2 = A 2 • S 1 • A 1
Then, δ(S 2 ) = δ(S 1 ) and L(S 2 ) = L(S 1 ) ≤ 2 -m δ(S) d

•

  Linear approximations of a Boolean function and Walsh transform • Resistance to differential attacks • Finding good Sboxes • Security criteria for the linear layer Boolean functions Definition. A Boolean function of n variables is a function from F n 2 into F 2 .

  a b c d e f S(x) f e b c 6 d

  Link between the difference and square correlation tables Theorem. [Chabaud Vaudenay 94][Blondeau Nyberg 13] There is a one-to-one correspondence between the DDT δ(a, b), a, b ∈ F n 2 and the squared LAT

  table on Slide 19] Linearity of a Boolean function Definition. For any Boolean function f of n variables,

  Find the lowest possible linearity for a Boolean function of n variables, where n is odd and n ≥ 9.Open problem. Find the highest possible nonlinearity for a balanced Boolean function of n variables, where n is even and n ≥ 8. +1 , i.e., at least by 4 (and by 8 if deg f < n -1).

	Balanced Boolean functions with a low linearity
			n min f ∈Ba n L(f )
			4	8
			5	8
			6	12	Welch 72]
	7	16	7	16	[Mykkelveit 80]
	9	24, 26, 28, 30 8	[Kavut-Maitra-Yücel 06] 20, 24
	11	46-60 9	24, 28, 32
	13	92-120 10	36, 40
	15	182-216	[Paterson-Wiedemann 83]
	Open problem.
	Proposition. [Katz 71] If f is balanced, all values E(f + a ) are
		n-1
	divisible by 2	deg f

Resistance to differential attacks Criterion on the Sbox.[Nyberg- Knudsen 92] All entries in the difference table of S should be small.

#{X ∈ F n 2 , S(X ⊕ a) ⊕ S(X) = b} must be as small as possible.

δ(S) is called the differential uniformity of S (always even).

Theorem. For any Sbox S with n inputs and n outputs, δ(S) ≥ 2 .

The functions achieving this bound are called almost perfect nonlinear functions (APN).

Known AB permutations of F n 2 , n odd Monomials permutations S(x) = x s over F 2 n.

For n odd, divisible by 3 and not by 9. , 54, 48, 13, 15, 18, 53, 35, 25, 63, 45, 52, 3, 20, 41, 33, 59, 36, 2, 34, 10, 8, 57, 37, 60, 19, 42, 14, 50, 26, 58, 24, 39, 27, 21, 17, 16, 29, 1, 62, 47, 40, 51, 56, 7, 43, 44, 38, 31, 11, 4, 28, 61, 46, 5, 49, 9, 6, 23, 32, 30, 12, 55, 22}; satisfies

The corresponding univariate polynomial over F 2 6 contains 52 nonzero monomials (out of 56 possible monomials of degree at most 4).

This is the only known APN permutation with an even number of variables.

Good permutations of F n 2 , n even Usually, we search for permutations S with

The last one is affinely equivalent to the AES Sbox.

Security criteria for the linear layer

Differential branch number of L over F m 2 minimal number of active Sboxes within a 2-round characteristic

Maximizing the differential branch number.

From Singleton's bound,

with equality for MDS codes.

A differential may aggregate many differential characteristics.

Bound on the 2-round MEDP [Hong et al00][Daemen-Rijmen02]:

where d is the differential branch number of L over F m 2 .

AES In the AES:

• S(x) = A(x 254 ) over F 2 8 where A is an affine permutation of F 8 2 . Then, δ(S) = 4.

For any 2-round characteristic Ω, EDP(Ω) ≤ δ(S)

For any 2-round differential (a, b),

For linear cryptanalysis

Expected squared correlation (linear potential) of a mask (u, v):

Expected squared correlation of a 2-round linear trail (a, L T (c), c, b):

AES In the AES:

• S(x) = A(x 254 ) over F 2 8 where A is an affine permutation of F 8 2 . Then, L(S) = 2 5 .

• L = MixColumns is such that C L is an [8,4,5] More detailed lecture notes https://www.paris.inria.fr/secret/Anne.Canteaut/poly.pdf


Algebraic Normal Form

Algebraic Normal Form of f : F n 2 → F 2 : unique polynomial representation in F 2 [x 1 , . . . , x n ]/(x 2 1 -x 1 , . . . , x 2 n -x n ). For u = (0101),

Monomials of n variables

x u = x 0 4 x 1 3 x 0 2 x 1 1 = x 3 x 1 f (x 1 , . . . , x n ) = u∈F n 2 c u x u with c u ∈ F 2 Example + - χ - ? + - ? + ? - - χ -π - (k 1 , k 2 , k 3 , k 4 , k 5 ) (k 1 , k 2 , k 3 , k 4 , k 5 ) (k 1 , k 2 , k 3 , k 4 , k 5 )
(x 1 , x 2 , x 3 , x 4 , x 5 ) (y 1 , y 2 , y 3 , y 4 , y 5 )

y 1 = k 2 k 3 k 4 k 5 + k 2 k 3 k 4 x 5 + k 2 k 3 k 5 x 4 + k 2 k 3 x 4 x 5 + k 2 k 4 k 5 x 3 + k 2 k 4 x 3 x 5 + k 2 k 5 x 3 x 4 +k 2 x 3 x 4 x 5 + k 3 k 4 k 5 x 2 + k 3 k 4 x 2 x 5 + k 3 k 5 x 2 x 4 + k 3 x 2 x 4 x 5 + k 4 k 5 x 2 x 3 + k 4 x 2 x 3 x 5 +k 5 x 2 x 3 x 4 + x 2 x 3 x 4 x 5 + k 2 k 3 k 4 + k 2 k 3 k 5 + k 2 k 3 x 4 + k 2 k 3 x 5 + k 2 k 4 k 5 + k 2 k 4 x 5 +k 2 k 5 x 3 + k 2 k 5 x 4 + k 2 x 3 x 5 + k 2 x 4 x 5 + k 3 k 4 k 5 + k 3 k 4 x 2 + k 3 k 4 x 5 + k 3 k 5 x 4 + k 3 x 2 x 4 +k 3 x 4 x 5 + k 4 k 5 x 2 + k 4 k 5 x 3 + k 4 x 2 x 5 + k 4 x 3 x 5 + k 5 x 2 x 4 + k 5 x 3 x 4 + x 2 x 4 x 5 + x 3 x 4 x 5 +k 1 k 3 + k 1 x 3 + k 2 k 3 + k 2 k 5 + k 2 x 5 + k 3 k 5 + k 3 x 1 + k 3 x 3 + k 3 x 5 + k 4 k 5 +k 4 x 2 + k 4 x 3 + k 4 x 5 + k 5 x 3 + k 5 x 4 + x 1 x 3 + x 2 x 4 + x 3 x 4 + x 3 x 5 + x 4 x 5 +k 2 + k 3 + k 5 + x 2 + x 3 + x 5
ANF of a random function Uniform distribution over all functions: equivalent to the uniform distribution over all ANFs.

→ each monomial appears with probability 1 2 .

Uniform distribution over all permutations: open problem.

• all coordinates of a permutation of F n 2 have degree at most (n -1).

• almost all permutations of F n 2 have degree (n -1)

[Wells 69], [Das 02], [Konyagin-Pappalardi 02]
Higher-order differential attacks

Higher-order differentials [Lai 94] Differential (derivative) of f w.r.t. α ∈ F n 2 : D α f : x → f (x ⊕ α) ⊕ f (x)
Higher-order differential.

D α 1 D α 2 . . . D α d f (x) = v∈ α 1 ,...,α d f (x ⊕ v) := D α 1 ,...,α d f (x) deg D V f ≤ deg f -dim V Then, for any subspace V with dim V > deg f ∀a ∈ F n 2 , D V f (a) = v∈V f (a ⊕ v) = 0
for all keys, f k has a low degree in x

For any affine subspace a

+ V with dim V > deg x f x∈a+V f k (x) = 0
Distinguisher with data complexity proportionnal to 2 deg f with f (y 1 , y 2 , y 3 , y 4 ) = y 1 y 2 .

x 0 1 2 3 4 5 6 7 8 9 a b c d e f S(x) f e b c 6 d 7 8 0 3 9 a 4 2 1 5 S 1 (x) 1 0 1 0 0 1 1 0 0 1 1 0 0 0 1 1 S 2 (x) 1 1 1 0 1 0 1 0 0 1 0 1 0 1 0 0 S 3 (x) 1 1 0 1 1 1 1 0 0 0 0 0 1 0 0 1 S 4 (x) 1 1 1 1 0 1 0 1 0 0 1 1 0 0 0 0 S ? ? ? ? ? ? ? ? e e e e e% % % % % ? y

x 1 x 2 x 3 x 4 f with f (y 1 , y 2 , y 3 , y 4 ) = y 1 y 2 .

x 0 1 2 3 4 5 6 7 8 9 a b c d e f S(x) f e b c 6 d 7 8 0 3 9 a 4 2 1 5 S 1 (x) 1 0 1 0 0 1 1 0 0 1 1 0 0 0 1 1 S 2 (x) 1 1 1 0 1 0 1 0 0 1 0 1 0 1 0 0 S 3 (x) 1 1 0 1 1 1 1 0 0 0 0 0 1 0 0 1 S 4 (x) 1 1 1 1 0 1 0 1 0 0 1 1 0 0 0 0 deg S 1 S 2 ≤ 3

Exercise: find the maximal degree of the following 4-bit function S ? ? ? ? ? ? ? ? e e e e e% % % % % ? y

x 1 x 2 x 3 x 4 f with f (y 1 , y 2 , y 3 , y 4 ) = y 1 y 2 y 3 .

x 0 1 2 3 4 5 6 7 8 9 a b c d e f S(x) f e b c 6 d 7 8 0 3 9 a 4 2 1 5 S 1 (x) 1 0 1 0 0 1 1 0 0 1 1 0 0 0 1 1 S 2 (x) 1 1 1 0 1 0 1 0 0 1 0 1 0 1 0 0 S 3 (x) 1 1 0 1 1 1 1 0 0 0 0 0 1 0 0 1 S 4 (x) 1 1 1 1 0 1 0 1 0 0 1 1 0 0 0 0 deg S 1 S 2 S 3 ≤ 3 δ k = maximal degree of the product of k coordinates of S

In our example:

k 1 2 3 4 δ k 3 3 3 4 Proposition. If S is a permutation of F n 2 , δ k = n if and only if k = n x 1 x 2 x 3 x 4 x

L

where the 4-bit Sbox S is such that the maximal degree δ k of the product of k of its coordinates is given by k 1 2 3 4 δ k 3 3 3 4

Exercise: find the maximal degree of the following 2-round cipher f is a function of degree ≤ 3 of the output of the first Sbox layer

x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 y 1 y 2 y 3 y 4 y 5 y 6 y 7 y 8 S ? ? ? ?

? ? ? ?

S

? ? ? ?

? ? ? ?

First case:

f (x 1 , . . . , x 8 ) = y 1 y 2 y 3 = S 1 (x 1 , . . . , x 4 )S 2 (x 1 , . . . , x 4 )S 3 (x 1 , . . . , x 4 )

⇒ deg f ≤ 3

Exercise: find the maximal degree of the following 2-round cipher f is a function of degree ≤ 3 of the output of the first Sbox layer

x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 y 1 y 2 y 3 y 4 y 5 y 6 y 7 y 8 S ? ? ? ?

? ? ? ?

S

? ? ? ?

? ? ? ?

Second case:

f (x 1 , . . . , x 8 ) = y 1 y 2 y 5 = S 1 (x 1 , . . . , x 4 )S 2 (x 1 , . . . , x 4 )S 1 (x 5 , . . . , x 8 )

⇒ deg f ≤ 3 + 3 = 6 δ k = maximal
deg(G • F ) ≤ n - n -deg G γ(S)
where Input: 2 52 pc pairs (m i , c i ) with m i in an affine subspace of dim 52

γ(S) = max 1≤k≤m-1 m -k m -δ k (S) . Most notably, γ(S) ≤ m -1 with equality iff deg S = m -1. γ(S) = max 1≤k<4 4 -k 4 -δ k (S) k 1 2 3 4 δ k (S) 3 3 3 4 γ(S) ≤ max 3 1 , 2 1 , 2 1 = 3 We deduce deg(G • F ) ≤ n - n -deg G 3
For recovering the j-th key byte k j :

For each possible value for k j For i from 0 to (2 52 -1) y i,j ← R -1 (c i,j ⊕ k j ) If i y i,j = 0 Return k j D = 2 52 and T = 8 × 2 60

Are there better choices for V ? For V = a + e 0 , . . . , e 27 ,

V = C C C C C C C C C A A A A A A A

• invariant under the key addition and the first Sbox layer

  Inspired by JH[Wu 2007] block size = 64 bits with a 4-bit Sbox SuperBox view: r rounds without the last linear layer = each output depends on 2 r+1 input bits.For r = 3:n = 16, γ(S) = 3, deg G ≤ 6 ⇒ deg(G • F ) ≤ 16 -bethe first 5 rounds of the cipher deg G k ≤ 51 ⇒ x∈a+V G k (x) = 0 for any (a + V ) with dim V = 52

•

  Let H k = first linear layer + rounds 2 to 5. Since deg H k ≤ 25 and dim V = 28, x∈a+V H k (x) = x∈b+V G k (x) = D V G k (b) = 0 ⇒ D = 2 28 and T = 8 × 2 36

  5 x 6 x 7 x 8

	? ? ? ?	? ? ? ?
	S	S
	? ? ? ?	? ? ? ?
	? ? ? ?	? ? ? ?
	S	S
	? ? ? ?	? ? ? ?

  degree of the product of k coordinates of S ≤ 2δ 4 + δ 3 δ k = maximal degree of the product of k coordinates of S

		A new bound [Boura, C., De Cannière 09]
	Theorem.	Let F = (S, . . . , S) where S is a permutation of F m 2 .
	Then,
	Example: d = 11 deg f Example: d = 11 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? S S ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? S S deg f ≤ δ 4 + 2δ 3 + δ 1 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? S S S ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? S S S

Degree of an iterated block cipher

Degree of the product f of d output coordinates A fundamental parameter:

δ k = maximal degree of the product of k coordinates of S

Example: d = 11

? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?

? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?

SuperBox view: r rounds without the last linear layer = each output depends on 2 r+1 input bits.

For r = 3:

For V = e 0 , . . . , e 27 = {x : x 0 . . . 0 1 . . .