Alexandre Bartel
email: alexandre.bartel@uni.lu

Benoit Baudry
email: benoit.baudry@inria.fr

Freddy Munoz
email: freddy.munoz@inria.fr

Jacques Klein
email: jacques.klein@uni.lu

Tejeddine Mouelhi
email: tejeddine.mouelhi@uni.lu

Yves Le Traon
email: yves.letraon@uni.lu

Model Driven Mutation Applied to Adaptative Systems Testing

Keywords: model driven engineering, MDE, mutation, testing, adaptative systems

Dynamically Adaptive Systems modify their behavior and structure in response to changes in their surrounding environment and according to an adaptation logic. Critical systems increasingly incorporate dynamic adaptation capabilities; examples include disaster relief and space exploration systems. In this paper, we focus on mutation testing of the adaptation logic. We propose a fault model for adaptation logics that classifies faults into environmental completeness and adaptation correctness. Since there are several adaptation logic languages relying on the same underlying concepts, the fault model is expressed independently from specific adaptation languages. Taking benefit from model-driven engineering technology, we express these common concepts in a metamodel and define the operational semantics of mutation operators at this level. Mutation is applied on model elements and model transformations are used to propagate these changes to a given adaptation policy in the chosen formalism. Preliminary results on an adaptive web server highlight the difficulty of killing mutants for adaptive systems, and thus the difficulty of generating efficient tests.

I. INTRODUCTION

Dynamically Adaptative Systems (DAS) must adapt themselves to ongoing circumstances and find the way to continue accomplishing their functionalities. DAS play increasingly important role in society's infrastructures; the demand for DAS appears in application domains ranging from crisis management applications such as disaster management [START_REF] Hughes | An intelligent and adaptable grid-based flood monitoring and warning system[END_REF], space exploration [START_REF] Dvorak | Software architecture themes in JPL's mission data system[END_REF], and transportation control to entertainment and business applications. This demand is intensified by the mobile and nomadic nature of many of these domains. The IDC 1analysts forecast a global increase in the number of mobile workers to more than 1.19 billion by 2013 [START_REF] Drake | Worldwide mobile worken population 2009-2013 forecast[END_REF].

DAS respond to environmental changes by modifying their internal configuration to continue meeting their functional and non-functional requirements. Designing a DAS involves specifying environmental fluctuations that have an impact on the system, as well as the related strategies for performing the structural changes. This is captured by an adaptation logic that expresses the actions to be adopted when the environment changes [START_REF] Chauvel | Composition of qualitative adaptation policies[END_REF], [START_REF] Eliassen | Evolving self-adaptive services using planning-based reflective middleware[END_REF], [START_REF] Keeney | Chisel: A policy-driven, context-aware, dynamic adaptation framework[END_REF], [START_REF] Walsh | Utility functions in autonomic systems[END_REF]. More precisely, adaptation logics drive the adaptation process and compute the right system configuration that should be adopted given an environmental condition.

This paper focuses on the issue of testing whether an adaptation logic is correctly implemented. More specifically, we focus on mutation of adaptation logic, considering that test cases should be able to distinguish between the original adaptation logic and the mutated one. Mutation thus provides a qualification criterion for test cases.

We use a Model-driven engineering (MDE) process to model adaptation formalisms/languages as well as adaptation policies defined according to these formalisms. A metamodel captures all the necessary concepts for representing actionbased adaptation policies. From the metamodel, we derive mutation operators that can apply to several action-based adaptation formalisms.

We classify adaptation logic faults into two groups:

1) The possible environmental conditions the system will face, and 2) the complexity involved in producing a response to those conditions.

The first, environmental completeness (EC) faults embody faults due to gaps in the space covered by the adaptation logic, thereby missing adaptations for environmental changes.

The second, adaptation correctness (AC) faults embody faults due to incorrect adaptations to environmental changes. Our hypothesis is that managing environmental changes involving a single property variation (simple) is easy, whereas managing several properties varying at the same time (complex) is error prone. We summarize the contributions of this paper as follows:

1) A generic metamodel capturing the concepts inherent to adaptation logic, completed with model transformations from two different input formalisms. 2) A generic set of mutation operators for adaptation logics as well as a specialization of this model to action-based adaptation logics. 3) A first proof of concepts through an adaptive web server case study. It has to be noted that we do not deal with efficient test cases generation in this paper, and for the experiments we simply create test sequences randomly (sequence of events issued by the environment).

The remainder of this paper proceeds as follows. Section 2 provides a background on dynamically adaptive systems. Section 3 introduces model driven engineering techniques and explains how they can be used with testing adaptation logics. Section 4 describes the first mutation operators we used. Section 5 presents our first experiments. Section 6 presents the related work. Finally, we conclude and present our perspectives in section 7.

II. DYNAMICALLY ADAPTIVE SYSTEMS

Consider an adaptive web server, which processes file requests over the HTTP protocol. It answers these requests as fast as possible while optimizing the resources it consumes, e.g. memory, CPU time, etc. Additionally, it provides nonstop service, thus it needs to adapt its internal structure to respond to a changing working environment. This environment is characterized by the variable amount of requests over time.

A. Environment and configurations

Dynamically adaptive systems (DAS) encode the environment into an abstraction called context. Definition 1 (context). A context consists of a n-tuple of fields <p 0 ,p 1 , . . . , p n >, where each field p i represents an environmental property. The type of each field is defined by the encoding chosen for the property it represents.

In our adaptive web server example, the environment is modeled as a context with two properties:

• p 1 : number of request per second (server load); • p 2 : the percentage of request (request density). The last one corresponds to the number of requested files. The domain or type of each property has a lower and an upper bound. For instance, we associate the type integer with request density and server load, a lower bound 0 and upper bound 100 for both. The server load domain indicates that the minimum amount of request in one second is 0 (no request) and the maximal is 100. Analogous, request density indicates the number of requested files. Definition 2. Specific environmental conditions at an instant t are drawn by an instance I of the context representing the environment. Such an instance is an n-tuple of values corresponding to the punctual value of a particular property.

The context instance <12, 3> designates a particular environmental condition with 12 requests per second requesting 3 different files. A sequence of context instances I 0 , I 1 , I 2 , . . . , I n ordered by their occurrence over time is called a context flow (CF). A context generates a space containing all the possible instances that can produce the combination of property values. The context of the adaptive web server generates a space containing all its possible context instances.

B. Adaptation logic

Adaptation in DAS is driven by an adaptation logic (adaptation model) that uses a specific strategy to describe the configuration to adopt given a context change. Definition 3. An adaptation logic defines a relation between contexts and system configuration. It receives a context instance (current environmental condition), a context flow (history of the environment, and the history of the system configuration, and gives the next configuration the system must adopt.

There exist several strategies to describe adaptation logics, a few examples are: action-based adaptation [START_REF] Keeney | Chisel: A policy-driven, context-aware, dynamic adaptation framework[END_REF], where adaptations are triggered when a condition is satisfied; goal based adaptation [START_REF] Eliassen | Evolving self-adaptive services using planning-based reflective middleware[END_REF], where adaptations are performed to reach a specific goal; and utility function based adaptation [START_REF] Walsh | Utility functions in autonomic systems[END_REF], where adaptations are calculated according to a cost function based on environmental conditions and variation point value.

An action-based strategy describes the adaptation logic of the adaptive web server [START_REF] Keeney | Chisel: A policy-driven, context-aware, dynamic adaptation framework[END_REF]. In this case the adaptation logic is a set of rules (adaptation policies) that, whenever an event occurs (environmental change) evaluate if a set of conditions are satisfied, and if it is so, they perform a series of adaptation actions.

Table I EXCERPT OF THE ADAPTIVE WEB SERVER ADAPTATION LOGIC.

1 : when r e q u e s t d e n s i t y i s ' h i g h ' o r ' medium ' 2 : i f c a c h e H a n d l e r . s i z e == 0 3 : t h e n u t i l i t y o f addCache i s ' h i g h ' 5 : when r e q u e s t d e n s i t y i s ' low ' 6 : i f c a c h e H a n d l e r . s i z e == 0 7 : t h e n u t i l i t y o f addCache i s ' low ' 9 : when LOAD i s ' h i g h ' 1 0 : i f F i l e S e r v e r s . s i z e <= 10 1 1 : t h e n u t i l i t y o f a d d F i l e S e r v e r i s ' h i g h ' 1 2 : when LOAD i s 'LOW' 1 3 : i f F i l e S e r v e r s . s i z e <= 10 1 4 : t h e n u t i l i t y o f a d d F i l e S e r v e r i s ' low ' Table I presents an excerpt of the adaptive web server adaptation logic. The first two rules manage the system cache. The first rule (lines 1-3) enables the cache mechanism when the request density is high or medium (line 1) and there is no cache (line 2). The second rule (lines 5-6) is analogous to the first. It reflects the fact that when the dispersion is high, adding a cache is not very useful. The remaining rules (lines 9-14) handle the variations of the server load property.

While table 1 presents a textual action-based adaptation logic, the Diva framework 2 allows to express the adaption policy in the form of a set of tables which are directly manipulated as models elements. Thus the connection with our MDE process is natural.

III. MDE AND ADAPTATION LOGICS

This section will introduce the MDE concepts which are required to understand how we create and use mutation operators later in the paper.

A. Metamodeling, Kermeta and Sintaks

This section summarizes the intents of metamodelling and how the Kermeta environment fits in this modelling activity.

1) Metamodelling: Metamodelling is a technique used to build a metamodel that defines a modeling language for a particular domain. The metamodel defines the concepts and relationships that describe the domain. A metamodel is itself a model expressed with a modeling language called the metametamodel.

2) Kermeta : Kermeta [START_REF] Muller | Weaving executability into object-oriented meta-languages[END_REF] is a metamodelling environment developed at IRISA (Research Institute in Information technology and rAndom Systems). This imperative and objectoriented language is used to provide an implementation of operations defined in metamodels.

3) Sintaks: Sintaks [START_REF] Muller | Model-driven analysis and synthesis of concrete syntax[END_REF] is a tool to defines bridges between plain text files and models.

B. Action-based adaptation logic metamodel

Figure 1 represents the metamodel we propose to represent the abstraction of action-based adaptation logics. An actionbased adaptation logic always consists of a set of rules (Rule-Set in the figure) called Event-Condition-Action, or ECA, rules. One ECA rule (Rule) features one event (Property), one condition (Condition) and one action (Action). An event is bound to a context property. When the bounded context property changes and its new value matches the event condition (propertyCondition), then the rule is executed. When the rule is executed the condition (Condition->BoolExpression) has to be true to perform the rule's action. This condition usually refers to internal states of the adaptation system. The action consists of assigning a new value (newValue) to a property (actionProperty).

In short, a rule performs an Action if the bounded Event property in the new context matches the Event condition and if the rule Condition is true. For instance, the first rule of the adaptation logic represented table I, is bounded to the property "requestdensity". The rule will be executed only after specific context changes in which the property became "high" or "medium". The action of assigning "high" to "addCache" is only performed if the internal variable cacheHandle.size equals zero.

The metamodel ecore file was created using EMF (Eclipse Modeling Framework) and GEE (Graphical Ecore Editor).

We will describe the process of mutant generation as well as the genericity of the metamodel in the following section. Figure 2 represents the mutants creation process. The process start by selecting an adaptation policy (AP) expressed in an action-based language (L1 on the figure). The first step (1) is to transform the adaptation policy into a model conforming to the metamodel. The second step consists in applying the mutation operators to the policy. Mutation operators are generic and work on models, not plain text files. Once the mutant models have been generated, they are transformed in plain text files. The Sintaks tool was used to do a mapping between a rule set written in plain text and its model representation.

Since mutation operators are defined from the metamodel and are working on models, they are independent of the actionbased language used to write the adaptation policy: a bridge between textual files and models must be defined for each language. This is achieved by defining one bridge for each language with Sintaks.

As a result we got a set ofResulting plaintext mutants will be used to test the adaptation logic's test suites. We consider that test suites must be able to distinguish a correct adaptation logic from the incorrect ones.

In the following section we introduce the first mutation operators.

IV. MUTATION OPERATORS FOR ADAPTATION LOGICS

Definition 3 introduces the concept of adaptation logic as the driver of the adaptation. Testing the realization of such driver means verifying whether the system is capable of adapting to environmental changes, and whether such adaptations proceed as expected. This section presents the challenges associated with testing adaptation logics, as well as a fault model for adaptation logics.

A. Testing challenges

Testing adaptation logics involves generating context instances, and evaluating the results of exposing the system to such context instances.

Three steps compose the testing process: 2) Then, they execute and expose the system to the generated context flow. Testers evaluate whether the configurations adopted by the system (configuration flow) when exposed to environmental changes are as expected. If not, the adaptation logic contains a fault.

3) The process may start again until a qualification criterion is reached. Note that (1) and ( 2) are not the object of the paper. Thus we generate test cases randomly. We rather focus on [START_REF] Biyani | Testing dynamic adaptation in distributed systems[END_REF].

A test suite is a set of test cases. In this paper a test case is defined as a context flow of a certain length, L. L represents the number of context instances in the flow. Given a flow f containing L context instances I i i ∈ (1, 2, ..., L), I i and I i+1 differs by one or more of their properties' values. For each I i the adaptive system will generate one ore more events corresponding to the properties that have changed. Those events are then handled by the adaptation logic (rules) which generates a new configuration for the system.

A test case is said to kill a mutant if the result (new configuration) generated by the mutant adaptation logic differs from the result given by the original adaptation logic.

This process enables us to

• duplicate rules or useless rules (the mutant is not killed in this case) • errors in the adaptation logic either an event in not handled properly or an incorrect action in performed leading to an incorrect new configuration

B. Fault model for adaptation logics

Managing the scenarios to which a system adapts is complex due to their large number and the difficulty to foresee the interactions between them.

In this section we introduce generic mutation operators for the adaptation logics metamodel. Those operators will mutate adaptation logic models conforming to the metamodel and thus are independent of any adaptation logic language.

1) Environmental completeness faults : Definition 1 defines a context as a tuple of fields representing environmental properties. The adaptation logic interprets these fields' values, and decides the system configuration that best fits the environmental conditions. It is possible, however, that the adaptation logic neglects some property values, or a complete property. We call faults of this type environmental completeness (EC) faults.

In the following, we describe three different types of EC faults represented as mutation operators.

1) ICP -Ignore Context Property

For a given property p, delete each rule that can be executed on p.

For instance, when ignoring property "requestdensity" the two last rules in table I (lines 9-14) are deleted.

2) ISV -Ignore Specific Context Property Value

For a given couple (property p, value v), delete each rule that can be executed when p equals v. When ignoring value "high" for property "LOAD" one rule (lines 9-11) is deleted.

3) IMV -Ignore Multiple Context Property Values

For a given set of couples (property p i , value v i ), delete each rule that can be executed when any p i (i ∈ {1,2,...,N}) equals v i . (At least two rules with different properties are modified/deleted).

When ignoring value "high" for property "LOAD" and "low" for property "requestdensity", two rules (lines 5-7 and lines 9-11) are deleted.

2) Adaptation correctness faults : The observable behavior produced by the adaptation logic is the adaptation it produces facing an environmental change. Some times such adaptation does not change the system in the expected way. We call this kind of faults adaptation corrected (AC) faults, because they lead directly to incorrect adaptations. Notice that the observable behavior of EC faults is manifested in at least one of the following AC faults.

1) SRA -Swap Rule Action

The action values from two rules modifying the same property are swapped.

For instance "high" and "low" swap lines 11 and 14 in table I for property "addFileServer".

2) Modify Rule Condition Value

The condition value (always on the right part of the condition), for a condition which uses operator > or <, in a rule is decreased or increased, respectively.

For instance in table I line 10, the value "10" is increased to "100".

V. EXPERIMENTS

In this section we present a preliminary proof of concept based on the adaptative web server system.

A. Test subject

To validate our hypothesis about the ability of AST to uncover faults in adaptation logics, we use the adaptive web server presented in section 2 as a test subject.

Figure 3 illustrates the architectural realization of the adaptation logic presented in section 2. It is composed of a sensor component, which is aware of the environment and collects the data produced by environmental changes. It encodes the data into values representing the environmental properties of interest (context instance) and passes them to a reconfiguration engine. Finally, the reconfiguration engine loads the adaptation rules and matches the values against the adaptation rules. If an adaptation rule matches the values, then it requests the system implementation to reconfigure as described by the rule.

To inject context instances and collect reconfiguration data we have instrumented the adaptation logic. Figure 3 presents the instrumented architecture. We have modified the source code of the sensor component and replaced the environment sensing mechanism with an environment emulator. This emulator reads context flows from a text file and injects them into the system provoking the instrumented sensor to respond identically to the non-instrumented one. We have also added a reconfiguration probe that records the reconfiguration requests produced by the reconfiguration engine. 1) Experiment: We prepared and executed our experiment as described in table II. We generated 30 test suites. Each of them contains 10 test cases (context flows). A flow is created by uniformly selecting a sequence of context instances among all the possible context instances. What we notice is that 30% of the mutants are not killed with random-generation. Even if we take longer test cases the results are similar. This first shows that other techniques should be studied.

B. Experiment set up, results and analysis

C. Threats to validity

There exists no perfect data, or perfectly trustable analysis results, and this study is not an exception. For this reason we identify the construction, internal and external threats to validity for this study.

Internal threats lie on the source and nature of the empirical data. We recognize that we have only studied a small adaptive system realizing the adaptation logic through action-based reasoning. The limited number of environmental properties, and the size of the space represent a threat since it is easy to achieve a uniform coverage with few context instances.

External threats lie on the statistical significance of our study. We are aware that since the adaptive system is small and only one, it does not represent the industrial trends. To make more general statements it is necessary to try the presented technique on large system. However, DAS are an emergent technology still paving its adoption.

VI. RELATED WORK

As far as we know there is no other work that uses mutation to measure the quality of adaptation logics' tests. However, a large number of researchers have addressed the validation and testing problem of adaptive systems. Zhang et al. [START_REF] Zhang | Modular verification of dynamically adaptive systems[END_REF] address the verification of dynamically adaptive systems through modular model checking. They model the adaptive system as finite state machine in which states represent different system variants. Zhang and Cheng [START_REF] Zhang | Model-based development of dynamically adaptive software[END_REF] introduce a model-based development process for adaptive software that uses Petri-nets. Biyani and Kulkarni [START_REF] Biyani | Testing dynamic adaptation in distributed systems[END_REF] use predicate detection for adaptive systems during adaptation. They extend existing algorithms based of global predicate evaluation [START_REF] Babaoglu | Consistent global states of distributed systems: Fundamental concepts and mechanisms[END_REF] for testing distributed systems to the system during adaptation. Kulkarni and Biyani [START_REF] Kulkarni | Correctness of component-based adaptation[END_REF] introduce an approach using proof-lattice to verify that all possible adaptation paths do not violate global constraints. Allen et al [START_REF] Allen | Specifying and analyzing dynamic software architectures[END_REF] used the Wright ADL to integrate the specifications of both architectural and behavioral aspects of dynamically reconfigurable systems. Kramer and Magee [START_REF] Kramer | Analysing dynamic change in distributed software architectures[END_REF] use property automata and labeled transition systems to specify and verify adaptive program's properties. The main difference between these verification approaches and ours is the focus of attention. We are interested in verifying through testing the adaptation driver, and not the adaptation process itself. Furthermore, these approaches require computing the entire system configurations and the transitions between them, however sometimes this is not possible.

Lu et al. [START_REF] Lu | Testing pervasive software in the presence of context inconsistency resolution services[END_REF] study the testing of pervasive context-aware software. They propose a family of test adequacy criteria that measure the quality of test sets with respect to the context variability.

Since very different testing techniques exist, we hope that mutation will reveal itself as a good way to compare them.

VII. CONCLUSIONS AND PERSPECTIVES

The mutation operators presented in this paper are a first proposal to offer a qualification environment for comparing testing techniques applied to action-based adaptative systems. The use of MDE makes it possible to derive mutants for most action-based logics, thus providing a common framework for such test cases qualification. The case study shows the feasibility of the approach and confirms that, for killing mutants, other testing techniques should be considered rather than random test generation. Due to the size of the case study and the number of environmental properties it contains, it is not possible to generalize to larger DAS. Future work will thus consist of completing the set of mutation operators, and will exhibit experimental results on other case studies comparing several test generation techniques. We plan to experiment with a much larger case study, which comprises several environmental properties and interactions. Furthermore we plan studying and specializing our fault model to other adaptation logic technologies, such as goal oriented.

Figure 2 .

 2 Figure 2. Mutants generation process.

Figure 1 .

 1 Figure 1. Metamodel of action-based adaptation logics

Figure 3 .

 3 Figure 3. Instrumented architecture of the adaptive web server adaptation logic

IDC is an analyst company and a global provider of market intelligence, advisory services, and events for the information technology, telecommunications, and consumer technology markets.


Keywords: simulation, multi-agent simulation, behavioural models, multiple models, collective phenomena, free-riding, peer-topeer

This report discusses how considering spatial and temporal dimensions at the modelling stage may have an influence on the outcome of the study in collective phenomena. We compared different models built on the same initial individual behaviour hypothesis of one collective phenomenon known as "free-riding" (that can be observed in peer-to-peer file sharing networks). Those models are conceived to answer questions related to the convergence and stabilization of the sharing behaviour of the users in those networks, where the non-cooperative behaviour of a subset of users may lead to the collapse of the entire network. Building up from this same individual behaviour, we study one global analytical model and four multi-agent models, the latter ones adding space and time dimensions, which are rarely seen in the literature discussing aggregated models of the collective phenomenon in question. After discussing the a priori and the experimental conditions under which the models are equivalent, we show that the same individual decision algorithm can lead to contradictory information and results.

Introduction

Collective phenomena result from the interactions of individuals in a system. That is, it is not determined by one single individual.

Multi-agent models have been recently used in different disciplines such as ecology, sociology and economics to study collective phenomena [START_REF] Grimm | Individual-based modeling and ecology[END_REF], [START_REF] Goldstone | Computational models of collective behavior[END_REF], [START_REF] Macal | Tutorial on agent-based modelling and simulation[END_REF]. This modelling paradigm is appropriate [START_REF] Ferber | Multi-Agent Systems: An Introduction to Distributed Artificial Intelligence[END_REF][START_REF] Phan | Agent-based modelling and simulation in the social and human sciences[END_REF] for simulating complex distributed systems, such as collective phenomena because it permits to include individual level descriptions and to study the collective level behaviour of the system.

A multi-agent model can be used to answer questions at the individual level as well as at the global level. Given the computational nature of the multi-agent paradigm, multi-agent models have to be simulated in order to answer the questions.

It is common practice to establish a multi-agent model by defining the individual behaviour of the participants of the system being modelled as well as the environment of the model. Usually, hypotheses concerning the behaviour of the agents are carefully stated. However, when the interactions among the agents of the model are not clearly stated, in terms of time and space for example, the answers given by the model might be partial or biased.

We present a study case where one same behavioural hypothesis is implemented in different multi-agent models and show that the answers given by the different models are not always compatible.

Our study case takes place in the context of free-riding, a collective phenomenon present in peer-to-peer file sharing networks. The models of the phenomenon used, are meant to answer questions pertaining the convergence and stabilization of the system. The remainder of the report is structured as follows. The next section deals with the modelling of collective phenomena. Section "Modelling free-riding" details the five proposed models. These models are then compared in terms of the answers they give. Finally, we highlight the cases where these answers are compatible or contradictory from the point of view of the models and of simulation.

Modelling collective phenomena

Modelling

A model is a simplified representation of a phenomenon. As Minsky says (1965), a model exists as long as we can answer to certain questions regarding the modelled object by observation and manipulation of the model. The role of the the model creator is thus as important as that of model itself, because before creating a model, the questions that it should answer should be defined. We are here interested in the influence of taking into consideration, or not, certain dimensions when creating a model regarding the questions to be asked to the model.

Our study takes place within the domain of collective phenomena. We specifically centre our attention on phenomena where none of the components of the system can fully perceive the whole system and where the set of individual behaviours and interactions between the participants produces a global outcome or a collective behaviour. These systems are characterized at least by two levels of description. The first one, the individual level, is focuses on the behaviours of the entities in the system and their interactions.

The second one is associated to the behaviour of the whole system. Specifically speaking, two categories of models can be used to study collective phenomena.

Analytical models

Analytical models (also known as equation-based, aggregated) offer a description of the phenomenon based on macroscopic parameters. They describe the variation of these parameters in terms of time. They are intended to explain the global dynamics of the phenomenon focusing only on a global and average behaviour.

Depending on the type of equations, they can be mathematically solved (for example in case of convergence of values towards a fixed point), or their solution can be found using iterative numerical calculus methods. However, it is not always possible to find a solution or, the solution implies deeply simplifying hypotheses. Moreover, by definition, analytical models lack of the individual dimension.

Multi-Agent models

Multi-agent models provide concepts to describe collective phenomena as a set of agents that interact via their environment. Agents are autonomous (there is no central entity that dictates their behaviour) and they have limited perception of their neighbourhood (no global information). Within this approach, the global dynamics of a system, at the macroscopic level is the outcome of the interaction of the agenst, described at the microscopic level. Because of their explanatory abilities, they are good candidates to study the influence of local behaviour on the global outcome [START_REF] Parunak | Agent-Based Modeling vs Equation-Based Modeling: A Case Study and Users' Guide[END_REF]. By limiting the perception of agents, by using heterogeneous behaviour in time, we can modulate the space and time representation and study the influence of these choices by comparing system outcomes.

Time and space dimensions in modelling

Work has been done to point out the influence of the choices made regarding time and space dimensions on the simulation results. Such choices make the results different in a significant way. Regarding the time dimension, [START_REF] Huberman | Evolutionary games and computer simulations[END_REF] have demonstrated, within the framework of the prisoner dilemma, that the results of the simulations concerning cooperation can be very different depending on the way decisions are taken (synchronous or not). The work of [START_REF] Axtell | Effects of Interaction Topology and Activation Regime in Several Multi-Agent Systems[END_REF] is centred on the modelling of the topology of interactions and on the way to update different multi-agent systems. It shows significant differences on a study of the moment to retire from work, when the space model is a lattice, a random graph or a small-world graph. [START_REF] Kittock | Emergent conventions and the structure of multi-agent systems[END_REF] studied the emergence of social conventions within multiagent systems. By adding a space dimension he found that the global structure of a multi-agent system has an important influence on the evolution of the system. Within the same context, the work of [START_REF] Shoham | On the emergence of social conventions: modeling, analysis, and simulations[END_REF]) demonstrated that increasing the update frequency of the agents slows down the convergence. More recent work within the same context have demonstrated that the structure of a multi-agent system has an influence on the evolution of social conventions. For example, [START_REF] Delgado | Emergence of social conventions in complex networks[END_REF] has found that emergence is more efficient when the agents are organised in a complex graph (either small-world or scale-free) rather than in an equivalent regular graph with the same amount of edges per vertex. [START_REF] Sen | Effects of Social Network Topology and Options on Norm Emergence[END_REF][START_REF] Villatoro | Exploring The Dimensions Of Convention Emergence In Multiagent Systems[END_REF] consider different topologies in a study of speed of convergence of norms in social networks. [START_REF] Mitchell | The Role of Space in the Success of Evolutionary Learning[END_REF] have demonstrated that spatial coevolution performs noticeably better than other evolutionary methods in non trivial learning tasks.

The way to handle time evolution, whether it is asynchronism in cellular automata [START_REF] Cornforth | Ordered asynchronous processes in multi-agent systems[END_REF], the choice of conflict resolution in a simple multi-agent system [START_REF] Fatès | How important are updating schemes in multi-agent systems? An illustration on a multi-turmite model[END_REF] or the way to execute updates in an energetic profile study [START_REF] Caron-Lormier | Asynchronous and synchronous updating in individual-based models[END_REF], has also an influence on the qualitative as well as quantitative results of simulation. [START_REF] Chevaillier | Experimental Study of Agent Population models with a Specific Attention to the Discretization Biases[END_REF] present a list of different sources of biases (regarding the differences in the results of a simulation) in terms of time and space discretization within the framework of a multi-agent model of an ecosystem.

All these studies demonstrate that the collective behaviour may be different depending on the choices made regarding the time and space dimensions, while keeping the individual behaviour unchanged. Hence, the collective behaviour produced by a system may be influenced by the modelling choices and not only depend on the individual behaviour.

In this report we show that models of different natures (analytical and multi-agent), with or without modelling hypotheses about time and space dimensions, can provide results compatible or contradictory according to the ranges of parameters.

Study case: the free-riding phenomenon

In a system attempting to fulfil its objectives mainly by the organized cooperation between all the stakeholders, a free-rider is a participant that refuses to cooperate. Thus obtaining the expected benefit from participating in the system without collaborating is called free-riding. We concentrate on free-riding in peer-to-peer (p2p) file sharing networks.

Free-riding in a p2p file sharing network means downloading files while not sharing any. Extensive presence of free-riders in a network can degrade its performance up to the point of rendering it useless. [START_REF] Ramaswamy | Free riding: A new challenge to peerto-peer file sharing systems[END_REF] and [START_REF] Ge | Modeling peer-peer file sharing systems[END_REF] are some of the first to begin to investigate the effects of free-riders on network performance, although the presence of the phenomenon was first reported in year 2000 [START_REF] Adar | Free riding on gnutella[END_REF]. Most of the existing models are based on game theory as can be seen in: [START_REF] Vassilakis | Modelling real p2p networks: The effect of altruism[END_REF][START_REF] Jian | Why share in peer-to-peer networks[END_REF][START_REF] Yusuke | Evolutionary Game Theory-Based Evaluation of P2P File-Sharing Systems in Heterogeneous Environments[END_REF][START_REF] Hua | A dynamic game theory approach to solve the free riding problem in the peer-to-peer networks[END_REF].

There is one characteristic common to all those models (given their global nature): they do not take into consideration network related aspects as the topology, churn, heterogeneity of the participants, latency of connections, etc.; and they do not include heterogeneous behaviours of users. Multiagent models answer to the afore mentioned limits and have already been used to model p2p systems [START_REF] Costa-Montenegro | Multi-Agent System Model of a BitTorrent Network[END_REF][START_REF] Miralles | Multi-agent system adaptation in a peer-to-peer scenario[END_REF]. Nonetheless, to the best of our knowledge, no previous work has been done to compare different multi-agent models in the context of free-riding as a collective phenomenon.

We want to evaluate the implications of stating hypotheses concerning time and space dimensions in regard to the behaviour of the system. To perform the evaluation, we shall use, besides an analytical model, multiagent models, following a methodology inspired from [START_REF] Parunak | Agent-Based Modeling vs Equation-Based Modeling: A Case Study and Users' Guide[END_REF].

We shall compare five models built upon the same user behaviour. In order to do this, we take an existing analytical model as basis and we gradually add new dimensions such as time and space.

Modelling free-riding

General aspects

We are interested, within a p2p network, in the amount of users that cooperate. With this in mind, we follow the model proposed by [START_REF] Feldman | Freeriding and whitewashing in peer-to-peer systems[END_REF]. We characterise the phenomenon by x the contribution level (the proportion of users that share in the network), x init and x f (respectively the initial contribution level and the final contribution level). The questions that we would like to answer are three: (1) Is the (global) behaviour of the system convergent? which we translate as "is the value of x f stable ?", (2)

In case of stabilisation, what is the value of x f ?, (3)Is there a relationship between x init and x f ?

All the models we present here are based on a rational behaviour of the user. A user (i) is characterized by its generosity (θ i ) and by its boolean state (sharing) that indicates if the user is sharing or not. A user shares if its generosity θ i is higher or equal to the cost of contributing, given that the cost corresponds to the reciprocal of the contribution level: 1

x . Intuitively speaking, the more users in the network share, the less it costs to share. This decision mechanism is presented in algorithm 1; it will be referred to as the agent function "decide()" in the remainder of the report.

Algorithm 1 Agent decision function

if generosity ≥ cost then share ← True else share ← False end if
We wish to highlight once more that, even if we add new dimensions to the models, the decision mechanism remains unchanged through the new models. Table 1 makes a resume of the different dimensions present in the models that we present.

Analytical model

Assuming (1) a particular distribution of generosity among the users of the p2p network (the distribution of θ is uniform between 0 and a maximum value θ max ), (2) a synchronous decision of agents, and (3) a complete perception of the network; it is possible to obtain an exact solution to the corresponding analytical model. The interested reader can consult [START_REF] Feldman | Freeriding and whitewashing in peer-to-peer systems[END_REF] for all the details of the solution.

This analytical solution yields a fixed point dynamics with two attractors: x 1 and x 2 . The final contribution level of the system x f with an initial contribution level x init will be given by:

x f = x 1 if x init ≥ x 2 , 0 if x init < x 2 .
Although the model allows to describe the global dynamics of the system (convergence towards a known value given known initial conditions), there are two important hypotheses in it: it implies a synchronization of the actions between all users and also that all users have "perfect" and "global" knowledge of the system.

Multi-agent models

The following models address the afore mentioned dimensions while keeping the same decision function for the agents and the same initial distribution of generosity.

We propose four multi-agent models that allow to take into consideration the following two dimensions:

1. Time. A model including a time dimension can describe users that take actions at different moments.

2. Space. A network that represents the interactions between users can describe users that estimate the contribution level based on their local perceptions.

In these models, the users are represented by agents and the p2p network is represented by the environment in the model. The agents interact inside the environment that they perceive through the information they obtain from their file sharing client.

Iterated model

This model is a direct numerical translation of the analytical model. Here, the users have a full knowledge of the contribution level of the system at any moment and change their state only after all the other users have taken their decision. We have N agents with an identical decision mechanism who decide in a synchronous manner. This is depicted in algorithm 2

Algorithm 2 Iterated model

for all timeStep do x ← calculateGlobalContributionLevel() cost ← 1
x for all agent do agent.decide() end for end for

Asynchronous model

Within this model, all the participants of the p2p network react at different moments: only a percentage of agents, uniformly and randomly chosen, change their state at each time step. Algorithm 3 represents this.

Topological model

In this model we question the fact that all participants have a perfect and global knowledge of the system. In this model, the users do not have access to the real contribution level and will be forced to estimate it based on their interactions with the other users. In order to realize this, we add a space dimension by organizing the users in a Small-World network [START_REF] Hong | Peer-to-Peer Harnessing the Power of Disruptive Technologies[END_REF][START_REF] Jovanović | Modeling peer-topeer network topologies through small-world models and power laws[END_REF][START_REF] Stutzbach | Characterizing unstructured overlay topologies in modern P2P file-sharing systems[END_REF], following the algorithm of [START_REF] Watts | Collective Dynamics of 'small-world' networks[END_REF]) that enables to create various rich network structures by using only two parameters: p and k.

This characteristic enables the analysis of the pertinence of our experiences in regard to the knowledge of the structure of the network by modifying only parameter p.

In this model, before taking the decision, an agent estimates the global contribution level by using what we call "local" contribution level: the proportion of the neighbours of an agent that share. Algorithm 4 describes this. When an agent estimates the contribution level by taking into consideration only its direct neighbours, we say that it performed an estimation of depth d = 1. An estimation of depth d = 2 means that, besides its direct neighbours, an agent will take into consideration the direct neighbours of his direct neighbours, and so on for other values of d.

Asynchronous and Topological model

In this model, the agents perceive in a local manner (from a topological point of view) the information elements necessary to take the decision and only a percentage of the agents will act at each time step of the simulations. As with the topological model, we have used a Small-World network with identical characteristics. Also, as with the asynchronous model, at each time step, only a percentage of the agents, chosen in a uniformly random way, will be scheduled to estimate the contribution level and decide to share or not. This is described in algorithm 5.

Simulation

In this section, we shall compare the behaviour given by the models, based on analytical and experimental results. Analytical models yield immediately the collective behaviour of a system, but in contrast, multi-agent models have to be simulated to get the collective behaviour.

We are interested in finding out if the system will collapse or stabilize, and in case it stabilizes, what is the stabilization value. We shall measure the mean stabilisation value. In the simulation scenarios, the values given to the different parameters of the models are as shown in table 2.

• x init varies from 0.05 to 1 by 0.05 increment • The number of users N is 1000

• θ follows a uniform distribution probability U (0, θ max ) where θ max = 10.

• End of simulation criteria: a maximum of 200 time steps.

• The percentage of active agents varies from 5% to 95% by an increment of 5%

• Neighbourhood depth: d = {1, 2, 3}

• Small-World network: k = 10 and p = {0, 0.25, 0.5, 0.75, 1}

• Each scenario is run 100 times

Analytical Results

The solution of the analytical model yields a fixed-point dynamics with the attractors x 1 = 0.88729833 and x 2 = 0.11270167. This means that the contribution level stabilizes at 88.7% when the initial contribution level x init is higher or equal to 11.2%, and that the contribution level will drop to zero if the initial contribution level x init is lower than 11,2%. Figure 1 illustrates the expected behaviour, according to this solution.

In the figures describing the simulation results, the attractors x 1 and x 2 predicted by the analytical model are identified where necessary with a horizontal and vertical line, accordingly. Each point represents the mean observed value after having executed 100 times the simulation of the model. We present as well in the figures the minimum and maximum values observed during the simulations.

Iterated model

The experiments reproduced the results predicted by the analytical model nearly all the times. In some of the experiments, around the attractor x 2 , the final contribution level was not the one expected. This can be observed in figure 2a. We suppose that this is due to rounding errors. So, we consider that the system behaves in the same way as the analytical model predicts but within an error range resulting from the numerical simulation.

Asynchronous model

In the experiments done with this model, the proportion of active agents at each time step varied from 5% to 95%, in steps of 5%. It can be seen in figure 2c that, when there are 25% or more active agents in the system, the contribution level dynamics is the same as that of the iterated and analytical models. On the other hand, it can be seen in the figure describing the results of the asynchronous model with a small proportion of active agents (figure 2e) that the smaller the proportion of active agents, the more the final value will be close to 80%, which is less than the value of x 1 of the analytical model. In the inset of figure 2e, we can see that if the value of x init is lower than 0.88, the value of x f seems to approach asymptotically x 1 . Also in the inset, we can see that if the value of x init is higher than 0.88, x f approaches asymptotically 0.88, remaining higher than 0.88.

Topological model

With the topological model, the experiments consisted of varying, on one hand, the depth degree d of the neighbours used by each agent to estimate the cost of sharing, and on the other hand, the probability p that makes the network structured, Small-World or completely random. The values used for d are 1,2 and 3 and the ones for p are {0,0.25,0.50,0.75,1}. We present here only the results for d = 1 and d = 3 in figures 2b and 2d respectively because they are sufficiently representative. For the network configured as a circular lattice (p = 0) the final contribution level starts to stabilize to a value higher than zero at values of x init higher than 3% for d = 1 and higher than 5% for d = 3. For the other configurations of p > 0, the stabilization of the contribution level to a value greater than zero starts at around 5%. For all these cases, the stabilization values greater than zero obtained when x init < 7% are not close to the value of the attractor x 1 . Yet, it should be noticed that for a depth degree d = 3, the system exhibits the same behaviour as that of the iterated model except for the case where the network is configured as a circular lattice (p = 0). This can be observed in figure 2d. Further, it should be noticed that, for the values of d = 1 and d = 3, when p = 0 the contribution level starts to stabilize at values higher than zero, sooner (in terms of x init ) than when p > 0. This can be seen in figures 2b and 2d. Also, it can be seen in the same figures, that when the users have a poor perception of the global contribution level (d = 1), the system will start to stabilize to a value other than zero (that is, will not collapse) at a proportion of sharing peers lower than that predicted by the analytical model.

Asynchronous and topological model

For the experiments done with this model, the values of d varied among 1,2 and 3, and also the values for the proportion of agents active at each time step varied from 5% to 95% in steps of 5%. We present only the results of the simulations for d = 1 in figure 2f since they are sufficiently representative of the other values of d.

As depicted in figure 2f , the final contribution level x f becomes zero when the proportion of active agents per time step is lower than 25%. It can also be seen in the figures that when the initial contribution level is greater than 25%, the contribution level stabilizes at values around 80% when the proportion of active agents per time step is near 95%.

It shall also be noticed that:

• in figure 2c the asynchronous model with 25% of active agents stabilizes at the value predicted by the analytical model.

• in figure 2b the topological model (with 100% of active agents) stabilizes at the value predicted by the analytical model,

• in figure 2f the asynchronous and topological model with 50% and 75% of active agents per time step stabilizes at values between 35% and 65%, far from those predicted by the analytical model.

Finally, we observed in the experiments conducted with the asynchronous and topological model, that when the network has a structure that is close to random (that is, as p grows to values near 1), the stabilization values will be higher, in regard to the proportion of agents active per time step.

Discussions

The question motivating our study was to evaluate the implications of additional time and space dimensions, in regard to the behaviour of the system (which in turn is the object of study of our models). It is possible to answer to the question according to two different points of view. The first one is the quantitative behaviour of the system, that is, is the network stable at the same proportion of sharing peers, no matter which model is used? The second one is concerned with the qualitative behaviour. It can consider different aspects such as: is the system active or has it collapsed? Is the system stabilizing (at different proportions of sharing peers, depending on the model)?

In the following sections we intend to answer these questions, using the models when possible or using the experimental results.

A priori equivalence conditions of the models

A starting point to compare the different models, is identifying the a priori equivalence conditions under which the models should agree in their answers. Table 3 shows a resume of the equivalence conditions. If we use the iterated model, we can expect to see the same results as those of the analytical model, plus the error induced by the numerical calculus.

In the case of topological model, there can be two kinds of equivalence when an agent has a perfect global knowledge of the contribution level: if an agent can interact with all the other agents and if an agent can estimate the contribution level at the maximal depth possible From a broader perspective, the higher the depth or the more the graph is completely connected, the more the results should be close to those of the iterated or analytical models.

The asynchronous model is equivalent to the iterated or analytical model if all the agents decide to share or not at the same time step. We can assert from a broader perspective that the more the proportion of agents are active at a time step, the more the results will be close to those of the analytical or iterated model.

Finally, the asynchronous and topological model needs to fulfil two conditions at the same time to be equivalent with the other models: on the one hand, a big proportion of agents must be active at each time step, and on the other hand, the agents should be able to interact with a lot of other agents.

These equivalences are confirmed by our experimental results.

Comparison of the models in terms of the experimental results

The simulation results show that, although we could identify equivalences between the models in some cases, they only appear under certain conditions. For example, both the asynchronous model and the topological model show the same qualitative behaviour as the analytical or iterated model when x init ≥ x 2 (stabilisation at a fixed value), but it is not the same case when x init < x 2 (there is no systematic collapse of the system). The asynchronous and topological model has the inverse behaviour: it agrees with the analytical and iterated models when x init < x 2 (collapse) but when x init ≥ x 2 , it stabilizes with a certain deviation around the final stabilisation value. Another point of view to consider is the resolution time. With the analytical model, we have an immediate answer to the question of the dynamics of the phenomenon without needing to feed it with the amount of users in the system, provided a solution to the model is available. This is not the case with the multi-agent models, where we are forced to give values to the parameters of the model before simulating. In our study case, this implies, for instance, to have an estimation of the amount of users in the system, the kind of network, the rate of connection and disconnection or their update frequency. Moreover, the behaviour of the system will be obtained by aggregating the individual values of the contribution level.

Given that we have some equivalences, it is possible to determine which model to use, depending on initial conditions. Specifically, we could say that for the models that give answers similar to those of the analytical and iterated models when x init ≥ x 2 , we do not have to run simulations to know which is going to be the final stabilisation value, and even less, to specify the initial parameters (namely, those of the graph building algorithm).

Nonetheless, if we are interested in the process that leads to the results, or in the variability of the final values, only the multi-agent models allow to answer to this question.

Generally speaking, the multi-agent models are richer than the analytical model because they allow to modify the time during which the users are in action, and also, they allow to modify the space in which they find themselves and thus their perceptions of the environment. Hence, they are easier to be used to answer to a whole family of questions holding some wide hypotheses. Therefore, passing from the model proposed by [START_REF] Feldman | Freeriding and whitewashing in peer-to-peer systems[END_REF], to a model where generosity follows a distribution other than uniformity, is easy with the multi-agent models, but can be complicated with the analytical model.

Conclusion

This report studies the influence of the integration of time and space dimensions when modelling a collective phenomenon. We compared five different models of the free-riding phenomenon where the individual decision mechanism remains unchanged while different hypotheses about the modelling of time and space are made. We have demonstrated that such hypotheses can produce contradictory results. We claim that care must be taken when modelling and simulating collective phenomena. In particular, attention must be paid when using multi-agent models, that include time and space dimensions. The hypotheses made about these dimensions have an influence on the answers given by the model.

Moreover, this may be the case both at the qualitative level and at the quantitative level, as shown by the results obtained with the asynchronous and topological model. We found equivalence criteria between the models, as well as value ranges under which a model with a global point of view (analytical model) can be used to answer questions regarding local parameters. Multi-agent models are well suited for modelling collective phenomena because they include both, the individual level of description, and the global. This is an advantage over analytical models that directly describe the global behaviour because they allow to study the influence that local interactions have over the global behaviour of the system. Nonetheless, when using a multi-agent model, special attention must be paid to the way the time and space dimensions are defined in it. If the hypotheses made regarding those dimensions are not fully stated, the range of applicability of the answers given by the model may be uncertain. Our work shows also that analytical models and individual-based models may be complementary [START_REF] Grimm | Individual-based modeling and ecology[END_REF]. In our results, we find (generally speaking) two attractors in the dynamics of the system (either the contribution level stabilizes, or it becomes zero). However, the analytical model cannot specify the exact value of the attractors (nor its variability) for each of the network configurations, no matter if it includes the time or the space dimensions (local characteristics integration). Also, it cannot describe the process underlying the dynamics but it captures the essence of the dynamics (stabilisation).

In a broad sense, our work in centred around knowing the validity domains of a group of models. That is, to know under which limits the results given by a model can be considered as useful. This question is unavoidable and very important when the model is to be used beyond the comprehension of the phenomenon it represents: for instance, when the model outcomes are used as predictions of the behaviour of the system for regulation purposes.

Figure 1 :

 1 Figure 1: Contribution level evolution as given by the analytical model with θ max = 10 and different values of x init .

  model. Mean, minimum and maximum values of the final contribution level with 25 %, 50 %, 75 % and 95 % of active agents.

Figure 2 :

 2 Figure 2: Experimental results of the multi-agent models.

Table 1 :

 1 Different dimensions present in the models of our study.

	Algorithm 5 Asynchronous and topological model
	for all timeStep do
	set← randomSetofAgents()
	for all agent ∈ set do
	x ← calculateLocalContribution(depth d)
	cost ← 1 x
	agent.decide()
	end for
	end for
		Decision in
	Model	Time	Space
	Analytical	Synchronous Global
	Iterated	Synchronous Global
	Asynchronous	Asynchronous Global
	Topological	Synchronous	Local
	Asynchronous and Topological	Asynchronous Local

Table 2 :

 2 Simulation scenarios resume

Table 3 :

 3 A priori equivalence conditions of the models. The multi-agent models can a priori, under certain conditions reproduce the results of the analytical model. Conversely, this table emphasizes that the analytical model can not reproduce a priori the whole spectrum of results of the multi-agent models.

hal-00700643, version 1 23 May 2012


A Elschahawi

Kramer

Hübner Nils-Olaf

Assadian Ojan

Grohmann Steffen

Diab-Elschahawi Magda

Kramer Axel

Prof. Dr Ojan Assadian
email: assadian@uni-greifswald.de

Efficacy of five alcohol-based skin antiseptics on sebaceous skin used at shorter application times than the current recommendation of 10 minutes

Keywords: skin antisepsis, sebaceous skin, application time, alcohol-based antiseptics

Efficacy of five alcohol-based skin antiseptics on sebaceous skin used at shorter application times than the current recommendation of 10 minutes

Introduction

Currently, in Germany and Austria all alcohol-based skin antiseptics are recommended with a minimum application time of 10 minutes on skin areas containing high numbers of sebaceous glands. [START_REF] Christiansen | Richtlinie für die Prüfung und Bewertung von Hautdesinfektionsmitteln[END_REF] Because currently there is no European Norm available to determine the efficacy of preparations for skin antisepsis, in Germany and Austria the efficacy of a preparation is commonly determined according to the test method of the German Society for Hygiene and Microbiology. [START_REF] Gebel | Standardmethoden der DGHM zur Prüfung chemischer Desinfektionsverfahren[END_REF] This test method requires 70% v/v iso-propanol during an application time of 10 minutes on skin with a high density of sebaceous glands. This leads to the requirement that the antimicrobial efficacy of any new skin antiseptic must not be significantly above the efficacy of the reference antisepsis with iso-propanol (70%, v/v) for 10 minutes. [START_REF] Christiansen | Richtlinie für die Prüfung und Bewertung von Hautdesinfektionsmitteln[END_REF][START_REF]Desinfektionsmittelliste der VAH[END_REF] In clinical practice, however, a 10 minute application time often is far too long, especially in emergency situations or in settings with high patient volumes, and it makes compliance to the manufacturers' recommendation difficult. As the work leading to the recommendation is 20 years old and it is based on the application of 70% v/v iso-propanol alone, it seems necessary to re-evaluate the recommendation, as new products containing combinations of different alcohols are available now. Recently published data on surgical hand disinfection [START_REF] Kampf | Surgical hand disinfection with a propanol-based hand rub: equivalence of shorter application times[END_REF][START_REF] Rotter | Long-term effect of a 1.5 minute surgical hand rub with a propanol-based product on the resident hand flora[END_REF] reviled that for certain propanol-based preparations a shorter application time than the previously recommended 3 minutes is achievable with the same effect on the resident hand flora. The results for surgical hand disinfection support new studies for skin antisepsis, as for particular preparations the application time also might be shorter than 10 minutes. In deed, two skin antiseptics based on 85% ethanol were described recently having an equivalent efficacy on the forehead of healthy volunteers within an application time of only 2.5 minutes. [START_REF] Kampf | Efficacy of two ethanol-based skin antiseptics on the forehead at shorter application times[END_REF] The efficacy on the bacterial flora of patients using shorter application times and on other anatomic skin sites containing high numbers of sebaceous glands has not been published so far. Therefore, the aim of our study was to determine the efficacy of five alcohol-based skin antiseptics on the bacterial flora of the forehead (only volunteers) and lower back (volunteers and patients).

Methods

Design and preparation of subjects

Each experiment was performed in a double-blind reference-controlled cross-over design. [START_REF] Gebel | Standardmethoden der DGHM zur Prüfung chemischer Desinfektionsverfahren[END_REF] A minimum of 20 volunteers was recruited per experiment. Only participants with healthy skin on the forehead and the lower back were selected (no injury, eczema or other inflammatory skin disease). Subjects were excluded when they took antibiotics or had previously used a disinfectant or antiseptic solution within the last seven days before any experiment. Bathing and showering was not allowed 24 h prior to an experiment. Hair around the test site was clipped or tied back in order to prevent recontamination of the skin of the forehead during the experiments. The inclusion and exclusion criteria were applied to both, 20 healthy volunteers in the forehead group and 10 healthy volunteers and 10 patients in the lower back group. The skin on the forehead and the lower back was divided into five areas of approximately five cm [START_REF] Gebel | Standardmethoden der DGHM zur Prüfung chemischer Desinfektionsverfahren[END_REF] next to each other. The left area was always chosen to determine the baseline bacterial density. The other test fields were allocated from the left side to right side: 3 min post-value, 4 min post-value, 5 min post-value, 10 min reference treatment post value. A cotton swab was soaked with the tested skin antiseptic and was swabbed strictly over the marked test field. The procedure was repeated as many times as necessary to keep the skin moist with the skin antiseptic for the examined application time.

Products and application

The following preparations were tested: R) propan-2-ol (70%, v/v) as reference alcohol; A) Manorapid synergy, a hand and skin antiseptic based on 57.6% (w/w) ethanol (96%) and 10% All preparations were colourless and blinded to participants and laboratory staff. All skin antiseptics were tested for application times of 10 minutes, 5 minutes, 4 minutes, and 3 minutes (forehead and lower back). The reference alcohol was always applied for 10 minutes to the skin of the forehead according to the recommended test method. [START_REF] Gebel | Standardmethoden der DGHM zur Prüfung chemischer Desinfektionsverfahren[END_REF]

Antiseptic phase

One marked skin area was treated with the reference alcohol, three other areas with one of the antiseptic products each. After each skin antisepsis a sample was taken (post-value) immediately after completion of the application (10, 5, 4 or 3 minutes after beginning of the application). Between each application of the product, a resting period of at least one week elapsed in order to allow complete reconstitution of the normal skin flora.

Determination of the pre-values and post-values

Sampling and cultivation were done according to the test method of the German Society for Hygiene and Microbiology. [START_REF] Gebel | Standardmethoden der DGHM zur Prüfung chemischer Desinfektionsverfahren[END_REF] Each sampling area was marked in such a way that the standard size of 5 cm 2 was clearly visible. A cotton swab was soaked in tryptic soy broth (TSB). The sampling area was rigorously rubbed as described before. [START_REF] Gundermann | New methods for determining preoperative and postoperative skin disinfection[END_REF] Meticulous care was taken to ensure that the swab was only rubbed within the marked skin area. Then, the swab was transferred into 5 ml of TSB containing a combination of neutralizing agents for inactivation of residual microbiocidal activity. The following neutralizing agents were used: 3% Tween 80, 3% saponine, 0.1% histidine and 0.1% cysteine. The combination of neutralizing agents was previously found to be valid for neutralization of 85% ethanol. The tube was vortexed for 30 sec at high frequency. A serial dilution was done in TSB. From appropriate dilution steps, aliquots of 1 ml were spread on tryptic soy agar (TSA) in duplicate.

Calculation of bacterial reduction

The plates were incubated for a total of 48 h at 36°C, and the colony-forming units (cfu) from plates were counted. For calculation purposes, plate count values 300 cfu were accepted.

Plate count values of zero were reset to 1, as the log10 of 0 is undefined, but the log10 of 1 = zero. The weighted mean of cfu was calculated taking into account the number of cfu per plate and the corresponding dilution step. The weighted mean was multiplied by the dilution factor in order to obtain the number of cfu per ml in the sampling liquid. All pre-and postvalues were expressed as log10 values. For each experiment, the logarithmic reduction factor (log10 RF) was calculated as the difference between the log10 baseline value and the log10 post-values.

Statistics

A comparison of multiple mean log10 RFs was done using Friedman's ANOVA. In addition, based on the DGHM test method for skin antisepsis a product is considered effective for skin antisepsis if the mean is not significantly lower than the corresponding mean log10 RF of the 10 min reference treatment (one sided Wilcoxon matched-pairs signed-ranks test). Differences of all other means were investigated by the two sided Wilcoxon matched-pairs signed-ranks test. [START_REF] Gebel | Standardmethoden der DGHM zur Prüfung chemischer Desinfektionsverfahren[END_REF] A P-value < 0.05 was chosen to indicate a significant difference.

Results

Skin antisepsis on the forehead

Product A was most effective after 5 min and less effective after 4 and 3 min (Table I). The difference between all four treatments was significant (P = 0.007; Friedman's ANOVA). A pair-wise analysis did not reveal a statistically significant difference in the efficacy between any of the application times of product A in comparison to the reference treatment (P > 0.05; two sided Wilcoxon matched-pairs signed-ranks test).

Product B was also most effective after 5 min and less effective after 4 and 3 min (Table I).

The difference between all four treatments was significant (P < 0.001; Friedman's ANOVA).

A pair-wise analysis revealed a significant lower efficacy for any of the application times of product B in comparison to the reference treatment (P < 0.005; one sided Wilcoxon matchedpairs signed-ranks test).

Product C also showed the highest efficacy after 5 min and a lower efficacy after 4 and 3 min (Table I). The difference between all four treatments was significant (P < 0.001; Friedman's ANOVA). A pair-wise analysis revealed only a significant lower efficacy for a 3 min application time of product C in comparison to the reference treatment (P = 0.001; one sided Wilcoxon matched-pairs signed-ranks test).

Product D showed also the best efficacy after 5 min and a lower efficacy after 4 and 3 min (Table I). The difference between all four treatments was significant (P < 0.019; Friedman's ANOVA). An application time of 5 min was significantly more effective in comparison to the reference treatment (P = 0.023; two-sided Wilcoxon matched-pairs signed-ranks test). For the other exposure times the efficacy was equal to the reference.

Product E showed the best efficacy after 5 min and a lower efficacy after 4 and 3 min (Table I). The difference between all four treatments was not significant (P < 0.218; Friedman's ANOVA).

Skin antisepsis of lower back in volunteers

Product A, product B, product C, and product D were equally effective as compared to the reference treatment (Table II). The difference between all four treatments each were not significant (P = 0.735; P = 0.902; P = 0.531; P = 0.715; Friedman's ANOVA), respectively.

Product E was also equally effective in comparison to the reference treatment (Table II). The difference between all four treatments, however, was significant (P = 0.009; Friedman's ANOVA). A pair-wise comparison between product E and the reference treatment revealed no significant difference for any of the application times (P > 0.05; one sided Wilcoxon matched-pairs signed-ranks test). No statistical difference was observed in pre-and post results for healthy volunteers and patients on the lower back (P > 0.05; two sided Wilcoxon matched-pairs signed-ranks test).

Discussion

Based on our results it seems not to be necessary to insist on a standard 10 minute application time for skin antisepsis on the forehead or the lower back as it is currently required by the test method of the German Society for Hygiene and Microbiology. [START_REF]Anforderderungskatalog für die Aufnahme von chemischen Desinfektionsverfahren in die Desinfektionsmittel-Liste der DGHM[END_REF] Our data revealed a strong difference between the efficacy of skin antiseptics on forehead and lower back. On the lower back, all tested skin antiseptics were as effective as the reference alcohol within 3 minutes, while on the forehead two of the five preparations were significantly less effective within 3 min, as compared to the reference alcohol. The reason for this finding is the different baseline bacterial density and probably the different density of the number of sebaceous glands per cm 2 (2.1 vs. 3.7 log10). Similar baseline values have been reported before. [START_REF] Henning | Studies on changes in skin surface bacteria in induced miliaria and associated hypohydrosis[END_REF][START_REF] Somerville | Quantitation of Corynebacterium acnes on healthy human skin[END_REF] Application of skin antiseptics for 4 minutes on the lower back of volunteering patients yielded a reduction of resident bacteria equivalent to the 10 min reference antisepsis. It is likely that even shorter application times might reveal an equivalent efficacy on the lower back, however, as we did not investigate shorted application times and therefore no proof, this remains speculation at this stage. Using product D, for example, the bacterial log log10 RF was 1.14 in healthy volunteers and 0.88 in volunteering patients (sub-group data not shown in table II). Particularly the ethanol-based skin antiseptics are likely to be effective even after shorter application times, as recent data show that on the forehead an application time of 2.5 min still was equally effective to the 10 min reference procedure. [START_REF] Kampf | Efficacy of two ethanol-based skin antiseptics on the forehead at shorter application times[END_REF] The efficacy of all antiseptics was lower on the lower back than on the forehead. This finding was expected as the mean baseline bacterial density was quite high with bacterial densities of 3.7 log10 on the forehead and remarkably lower on the lower back with 2.1 log10. Resident bacteria apparently can be reduced to a maximum level which can be described as the "irreducible minimum". Prolongation of the application time will not provide any increase of efficacy, which also was also recently shown, albeit for surgical hand disinfection. [START_REF] Kampf | Surgical hand disinfection with a propanol-based hand rub: equivalence of shorter application times[END_REF][START_REF] Rotter | Long-term effect of a 1.5 minute surgical hand rub with a propanol-based product on the resident hand flora[END_REF] Of importance are our results showing that the mean efficacy of two skin antiseptics applied for 4 minutes on the lower back was equal for both, healthy volunteers and volunteering patients. Similar results between volunteers and patients have been described earlier by Kurth et al. [START_REF] Kurth | Vergleich der Wirksamkeit der Hautdesinfektion bei Gesunden und Krankenhauspatienten[END_REF] Testing the efficacy of skin antiseptics on healthy volunteers can therefore be considered to be a valid method for assuming an efficacy on patients' skin as well.

Since the baseline bacterial density and the resulting reduction factors between forehead and lower back differ, skin antiseptics should be tested on the anatomic sides for which a specific product is intended, and not on the forehead alone. Further research therefore should also include other skin sites such as the perineum, breast, joints and the foot.

Conclusions

Short application times are desirable for skin antisepsis to ensure maximum compliance and efficacy, even under emergency conditions. Application times for skin antiseptics on the forehead or the lower back should be based on their "true application time" or the time, when they are equally effective as compared to the reference skin antiseptic using propan-2-ol (70%, v/v) for 10 minutes application time. Alcohol-based skin antiseptics do not require a standard 10 min application time, especially on the lower back. Most antiseptics surpass the mean log10 reduction factor of the reference alcohol within 10 minutes application time already after 3 or 4 min on the forehead and lower back, respectively. For all of the tested antiseptics a minimum application time of 3 minutes on skin containing sebaceous glands can be recommend.

  (w/w) 1-propanol (Antiseptica GmbH, Pulheim, Germany); B) Skin-Des (Polyalcohol Hautantiseptikum), a skin antiseptic based on 63.1% [w/w] 2-propanol (Antiseptica GmbH, Pulheim, Germany); C) Cutasept F, a skin antiseptic based on 63% (w/w) 2-propanol (Bode Chemie GmbH & Co. KG, Hamburg, Germany); D) VP 365, an alcohol-based antiseptic containing 85% (w/w) ethanol (Bode Chemie GmbH & Co. KG, Hamburg, Germany); and E) VP 505, an alcohol-based solution containing 65% (w/w) 2-propanol and 0.2% (w/w) mecetronium etilsulphate (Bode Chemie GmbH & Co. KG, Hamburg, Germany).

Table I

 I Mean log10-reduction of resident skin flora obtained with four skin antiseptics on the forehead of 20 healthy volunteers applied for 3, 4 and 5 min in comparison to a 10 min reference skin antisepsis.

	Test product	Mean RF ± standard deviation
		Reference (10 min)	Preparation (5 min) Preparation (4 min) Preparation (3 min)
	A (n = 20)	1.57 0.66	2.05 0.59	1.83 0.62	1.57 0.46
	B (n = 20)	2.47 0.53	2.15 0.69	1.93 0.67	1.60 0.52
	C (n = 20)	1.88 0.74	2.05 0.63	1.68 0.62	1.48 0.58
	D (n = 20)	1.67 0.75	2.16 0.79	1.82 0.70	1.75 0.69
	E (n = 20)	1.41 0.80	1.92 0.82	1.55 0.74	1.59 0.95
					14

Table

  II Mean log10-reduction of resident skin flora obtained with four skin antiseptics on the lower back of 10 healthy volunteers and 10 patients each, applied for 3, 4 and 5 min in comparison to a 10 min reference antisepsis.

	Test	Mean RF ± standard deviation			P-
	product	Reference (10	Preparation (5	Preparation (4	Preparation (3	value
		min)	min)	min)	min)
	A (n = 20) 1.24 0.32	1.22 0.36	1.24 0.32	1.09 0.65	0.735
	B (n = 20) 1.23 0.35	1.20 0.36	1.20 0.36	1.22 0.35	0.902
	C (n = 20) 0.99 0.47	0.98 0.47	0.95 0.40	0.95 0.40	0.531
	D (n = 20) 1.15 0.44	1.11 0.40	1.14 0.42	1.00 0.55	0.715
	E (n = 20) 1.14 0.44	0.87 0.52	0.95 0.44	1.07 0.36	0.009

List of abbreviations

TSB

Trypton-Soya-Broth TSA