Lyes Bayou

David Espes

Nora Cuppens-Boulahia

Frédéric Cuppens

Security analysis of WirelessHART communication scheme

Communication security is a major concern in industrial process management. Indeed, in addition to real-time requirements, it is very important to ensure that sensing data sent by field sensors are not altered or modified during their transmission. This is more true in Wireless Sensor Networks where communication can be hijacked and false data injected. Therefore wireless communication protocols include several security mechanisms to ensure data confidentiality and integrity. In this paper, we present an attack against WirelessHART, the leading wireless communication protocol in industrial environment. We show that an insider attacker can bypass security mechanisms and inject false commands in the network. Such attacks can have harmful economical consequences or even more can threaten human lives. We propose also some solutions that can be applied for detecting and mitigating this kind of attacks.

Introduction

Industrial Control Systems (ICS) are computed-based systems used for monitoring and managing industrial installations and facilities. We can find such systems in airports, power plants, gas refineries, etc. The architecture of these systems relies on several sensors and actuators deployed throughout the industrial installation. Sensors are responsible for gathering different kinds of information about the industrial process such as temperature, pressure, flow, etc. These information are sent to a controller that processes them and sends back commands to actuators. As results, an actuator can for example open a valve to increase the flow of a chemical component or stop a pump when the oil tank is filled.

The security in Industrial Control Systems is a major concern. Indeed, these systems manage installations that play an important economical role. Even more, targeting these systems can lead not only to economical losses but can also threaten human lives [START_REF] Huang | Understanding the physical and economic consequences of attacks on control systems[END_REF].

Therefore and as these systems depend on sensing data, it is important to secure communication channels between these sensors and the main controllers. This issue is more challenging in Wireless Sensor Networks as the use of wireless communications brings its own security weaknesses.

Based on the analysis of the communication scheme, we present in this paper an attack against WirelessHART [2], the leading wireless communication protocol in the industrial environment. We show that although this protocol implements several mechanisms to ensure the integrity and confidentiality of exchanged data, an insider attacker can use its own credential to bypass security mechanisms and inject false commands in the network. Using this weakness, we describe three scenarios that can be used to launch an attack against a WSN. Such attacks can have harmful economical consequences or even more can threaten human lives.

Several tests were conducted on a simulated network to prove the feasibility of these attacks and to assess its potential impact on the functioning of the industrial process.

The rest of the paper is organized as follows. In Section 2, we give a brief description of the functioning of a WirelessHART network, its communication scheme and how data are exchanged and secured. We detail in Section 3, the functioning of the broadcast attack and give three different scenarios that use this attack. Section 4 presents results of the three scenarios on a simulated WSN. Some countermeasures that can be used to detect such attacks are discussed in Section 5. In Section 6, we discuss prior works on the security of WirelessHART. Finally, Section 7 presents the conclusion and future works.

Background

WirelessHART [2] is the first standardized wireless communication protocol specially developed for industrial process management. It uses a time-synchronized, self-organized and self-healing mesh architecture to provide a reliable and realtime communication. It is included in version 7 of the HART standard, released in 2007, and was approved as a IEC 62591 standard in 2010.

Topology of a WirelessHART network

A typical WirelessHART network is composed of the following devices:

-A Gateway that connects the wireless network to the plant automation network, allowing data to flow between the two networks. It can also be used to convert data and commands from one protocol to another one; -A Network Manager that is responsible for the overall management, scheduling, and optimization of the wireless network. It generates and maintains all of the routing information and also allocates communication resources; -A Security Manager that is responsible for the generation, storage, and management of cryptographic keys; -Access Points that connect the Gateway to the wireless network through a wired connection; -Field devices deployed in the plant field and which can be sensors or actuators;

-Routers used for forwarding packets from one network device to another; -Handheld devices that are portable equipments operated by the plant personnel used in the installation and during the maintenance of network devices.

WirelessHART stack

The WirelessHART protocol is composed of 4 layers. It is based in its physical layer upon the IEEE 802.15.4 standard [3]. It defines its own data link layer and network layer and shares the same application layer with the wired HART protocol (in the addition of wireless commands). A brief description of each layer is given below:

-Application Layer

WirlessHART Communication

The Network Manager is one of the most important devices in a WirelessHART network. It is responsible for the overall management, scheduling, and optimization of the wireless network. It generates and maintains graphs and routing information and also allocates communication resources.

Communication type

In WirelessHART there are 05 packet types, called Data Link Protocol Unit (DLPDU), that can be exchanged between devices:

-Data DLPDU: encapsulates packets from the NL. It is used to exchange sensing data and AL commands. -Ack DLPDU: is used by a device that receives an unicast packet, to send back to the sender device an acknowledgment of the reception of that packet.

-Keep-alive DLPDU: is used by a device that spends a defined time without sending any packets, to inform its neighbors that it is still active. -Advertise DLPDU: is used for providing information to neighboring devices trying to join the network; -Disconnect DLPDU: is used by a device to inform its neighboring devices that it is leaving the network.

Ack, Advertise, Keep-Alive and Disconnect DLPDUs are generated and processed in the Data Link Layer and are not propagated to the network layer or forwarded through the network. This means that these DLPDUs are only used in local communication between neighbors. The Data DLPDU is the only kind of packet that is transmitted in an end-to-end communication. During the transmission, data fields in the payload are enciphered.

Communication scheduling To provide reliable and collision free communication, WirelessHART uses Time Division Multiple Access (TDMA) and Channel hopping to control the access to the wireless medium. The time is divided in consecutive periods of the same duration called slots. Each communication between two devices occurs in one slot of 10 ms. Superframes are collection of slots repeated continuously with a fixed repetition rate.

Typically, two devices are assigned to one time slot (one as the sender and a second as the receiver). Only one packet is transmitted in one slot from the sender to the receiver which has to reply with an acknowledgment packet in the same slot. In the case of a broadcast message, there is one sender and multiple receivers and the message is not acknowledged.

In addition to the TDMA, WirelessHART uses channel hopping to provide frequency diversity and avoid interferences. Thus, the 2.4 GHz band is divided into 16 channels numbered from 11 to 26 which provide up to 15 communications in the same slot (Channel 26 is not used).

Communication routing WirelessHART implements in the Network Layer, two methods of routing packets throughout the network, i.e., graph routing and source routing.

-Graph routing: a graph is a collection of directed paths that connect network devices. It is build by the Network manager based on its knowledge of the network topology and connectivity. Every graph has a unique graph identifier that is inserted in the network packet header. Each device receiving this packet, must forward it to the next hop belonging to that graph. This routing method is used for normal communications, in both upstream (from a device to the network manager) and downstream (from the network manager to a specific device) directions. -Source routing: it is a single directed route between a source and a destination device. The complete route is completely inserted in the network packet header by the sender device. Each intermediate device propagates the packet to the next device indicated in the source route field. This method of routing is used only for testing routes, troubleshooting network paths or for ad-hoc communications.

Communication security WirelessHART implements several mechanisms to ensure data confidentiality, authenticity and integrity in both hop-by-hop and end-to-end transmissions. Indeed, as WirelessHART builds a mesh network, sensors are located several hops from the network manager. Thus, these sensors rely on their neighbors to forward their packets from/to the network manager. Therefore, as illustrated in Figure 1, the several forwards of packets between neighbor devices are called the hop-by-hop transmission and the communication between the sending sensor and the network manager is called the end-to-end communication.

Security at Data Link Layer: The hop-by-hop transmission security is provided by the Data Link Layer (DLL) using a cryptographic key called "Network Key" shared by all devices composing the wireless network. It defends against attackers who are outside the network and do not share its secret.

Each DLPDU is authenticated by the sending device using the network key. Therefore, before processing any received DLPDU, a device must check the keyed Message Integrity Code (MIC) to authenticate the identity of the sending device. We must note that the DLPDU itself is not enciphered but authenticated by a four-byte MIC generated with CCM* mode (Combined Counter with CBC-MAC) using the AES-128 block cipher.

Security at Network Layer:

The end-to-end security is provided by the Network Layer (NL) using a cryptographic key called "Session Key" known only by the two communicant devices. It defends against attackers who may be on the network path between the source and the destination (Inside attacker).

The network layer also uses a keyed Message Integrity Code (MIC) for the authentication of the Network Protocol Data Unit (NPDU). Additionally, it is used to encrypt and decrypt the NPDU payload. The end-to-end security is session oriented i.e., it provides a private and secure communication channel between a pair of network devices. Each session is defined by two elements:

the session key: it is a dedicated 128-bits cryptographic key. It is used to encipher the NPDU payload and to authenticate the whole NPDU. the session counter: it is a 32 bits value that defends against replay attacks and used as the nounce for generating the NPDU MIC. Each device keeps a history of received nonce counter.

Communication scheme

WirelessHART implements unicast and broadcast communications in both the Data Link and the Network Layers. In the Data link layer, the unicast or broadcast communication is set by configuring the packet with unicast or a broadcast destination address, by using the unicast or the broadcast graph and also by using the dedicated transmission slots. Indeed, the Network Manager configures each wireless sensor to be at the beginning of each slot either a sender, a receiver or to stay idle. As illustrated in Figure 2, when a device receives unicast packet, it starts by authenticating it in the Data link layer (DLL) using the network key and then it is transmitted to the Network layer. There, the destination NL address is checked. If it matches the device's address, the packet is authenticated a second time using the unicast session key and its payload is deciphered and sent to the Application Layer to be executed. Otherwise, the packet is sent back to the DLL to be forwarded to the next hop device. In a broadcast communication, a packet sent by the Network manager is propagated to all devices in the wireless network. As illustrated in Figure 3, each time a device receives a broadcast packet, it starts by authenticating it firstly in the Data link layer (DLL) using the network key and then in the Network layer (NL) using the broadcast session key. If the packet passes authentication validations, it will be deciphered and sent to the Application Layer (AL) to be executed. A copy of the packet is also sent back to the DLL to be forwarded to other devices. On another hand, in the Network Layer, four sessions are set up as soon as any device joins the network. They allow the transmission of sensing data from a device to the Network Manager, and the transmission of commands from the Network Manager to a field device.

1. unicast session with the NM: it is used by the network manager to manage the device. 2. broadcast session with the NM: it is used to globally manage devices. For example this can be used to roll a new network key out to all network devices. All devices in the network have the same key for this session. 3. unicast session with the Gateway: it carries normal communications (for example process data) between the gateway and the device. 4. broadcast session with the Gateway: it is used by the gateway to send the identical application data to all devices.

In addition, each device has a join session key which cannot be deleted. The Join_key is the only key that is written once connecting to the device's maintenance port. It can also be updated by the Network Manager once the device is successfully connected. All other keys are distributed by the Network Manager.

Communication Scheme Attack

The idea of the attack is that a malicious insider attacker uses its own credentials to bypass the authentication mechanism and injects false command into the network. These false commands will be authenticated as legitimate commands and executed by receiving devices. Depending on the nature of injected false commands, consequences on the network can be more or less harmful.

As indicated in the previous Section, end-to-end communications are secured by session keys. In unicast communications, the session key is only known by the two communicant devices while in broadcast communications, the session key is shared by all devices connected to the network.

Therefore to launch the command injection attack, the malicious insider attacker will use Broadcast Session credentials to perform this kind of attacks. Indeed, as part of the network, the malicious node is configured with the broadcast session key and the session counter.

The command injection attack can be performed in several ways such as: a Direct command injection attack, a Bounced command injection attack and an On-the-fly command injection attack.

Scenario 1: Direct Command injection attack

In a Direct Command Injection Attack a malicious insider node forges a fake broadcast packet and forwards it to its neighbors.

As illustrated in Figure 4, at the moment T the malicious node Device5 uses its knowledge on the broadcast session credential i.e., the broadcast session key and the session counter, to forge a broadcast packet. The source address in the NL is set to the Network Manager address and the destination addresses in both network and data link layers are set to the broadcast address. The malicious insider node will send the forged packet using its own broadcast link in the same way as if it was a legitimate packet sent by the network manager. Receiving nodes, Device8 and Device9, will authenticate the packet using the broadcast session key and execute the injected false command.

Using this attack, a malicious insider node can inject any false command and send it to its neighbors using the broadcast graph.

Scenario 2: Bounced Command injection attack

In WirelessHART both DLL and NL destination addresses can be either unicast or broadcast addresses and all combinations are allowed. So, a packet can have unicast DLL destination address and a broadcast NL destination address. In a Bounced Command Injection Attack a malicious insider node forges a fake broadcast packet and sends it to its parent node. As illustrated in Figure 5, this kind of attacks is composed of the following steps:

1. At the moment T the malicious node Device5 uses its knowledge of the broadcast session credential i.e., the broadcast session key and the session counter, to forge a broadcast packet. The source address in the NL is set to the Network Manager address and the NL destination address is set to the broadcast address.

In the DLL, the source address is set to the Device5 address and the destination address is set to its parent's address i.e., Device2. The malicious insider node will send the forged packet using its own normal link between itself and the parent node. 2. The receiving node Device2 authenticates the packet in the DLL as a legitimate unicast packet and transmitted it to the upper layer.

In the NL, the packet is identified as a broadcast packet sent by the Network Manager. It is authenticated and deciphered using the broadcast session key.

The packet is then transmitted to the application layer to be executed. A copy of the packet is also transmitted to the DLL to be forwarded to Device2 neighbors i.e., Device4 and Device5. 3. Both Device4 and Device5 process the received packet as a legitimate broadcast packet sent by the Network manager and propagate it to their neighbors. 4. As results, the injected false command packet is received and executed by Device2, Device4, Device5, Device6, Device7, Device8 and Device9.

This scenario allows a malicious insider node by using its parent node as a relay to increase the impact of the attack. By this way, the injected false command is propagated to all parent node's children.

Scenario 3: On-the-fly Command injection attack

In an On-the-fly command injection attack, a malicious insider node that receives a broadcast packet, will forward to its neighbors a modified version of the received packet.

As illustrated in Figure 6, this attack is performed according to the following steps:

1. The Network Manager sends a broadcast packet. 2. The broadcast packet is forwarded to devices and received by the malicious insider node Device5. 3. All receiving node execute the command sent by the network manager and forward it to devices in their neighborhood. 4. The malicious node Device5 uses its knowledge of broadcast session credential i.e., the session key and the session counter, to modify the received broadcast packet and send it to its neighbors. 5. As results, the injected false command packet is received and executed by Device8 and Device9.

As in the direct command injection attack, a malicious insider node can inject any false command and sent it to its neighbors using the broadcast graph. The difference is that an on-the-fly injection command attack is a stealth attack as the injected packet is hidden inside a legitimate communication flow.

Discussion

Described scenarios showed the feasibility of the broadcast attack and that it can be performed in several ways. We must note that although we can launch the attack at any chosen time T , the malicious node must wait for an appropriate time slot to be able to send the forged packet. For example in the case of the direct command injection, the malicious node must wait for the next broadcast slot to send the false command to its neighbors. But as all devices are configured with this kind of slots, it is always possible for a malicious node to send its false command. According to the WirelessHART [2], by default each device is configured with one sending unicast slot and one sending broadcast slot each 1 minute. Thus, the average waiting time T Avg between the attack launching time and the false command injection time is: T Avg = T sending_broadcast /2 = 30s in the case of a direct attack and T Avg = T sending_unicast /2 + T sending_broadcast /2 = 60s for a bounced attack. The on-the-fly attack duration depends on the industrial process and broadcast commands sending frequency. In average, this frequency is around 1 hour. By comparing the 3 scenarios, we can see that the bounced command injection increases the spreading area of the attack by using the parent of the malicious node as a relay. Also, the on-the-fly command injection attack is interesting as it hides the attacks inside a legitimate flow. Nevertheless, the drawback of this attack is that the malicious node must wait to the transmission by the network manager of a broadcast packet which can take a long time to happen.

Finally, we must note that in all these scenarios, the malicious insider node has the choice between executing or not the injected false command. Indeed, depending on the attack's goal, the malicious node can launch the attack with or without executing it. For example, by not executing the false command, the malicious node can mislead administrators in their investigations to discover the origin of the network disturbances.

Attack implementation

To test the broadcast attack, we use WirelessHART NetSIM [START_REF] Bayou | WirelessHART Net-SIM: A WirelessHART SCADA-Based Wireless Sensor Networks Simulator[END_REF], a simulator that we develop for assessing the security of WirelessHART SCADA-based systems.

As illustrated in Figure 7(a), the simulated wireless network is composed of a network manager and 9 wireless sensors. Wireless sensors are configured to send periodically each 4s simulated sensing data to the Network Manager. For testing the three scenarios, we launched the broadcast attack at T = 800s and the Device5 is configured to be the malicious insider attacker. The injected false command is the command 961 that is used to set a new network key. This command has 2 parameters: the new network key, and T the time when it will be changed. In all the three scenarios T = 920s.

As illustrated in Figure 8(a) i.e., in the normal case, the size of sensing data received by the Network Manager is about 720 bytes each 4s. We observe that for the three scenarios of the broadcast attack, the size of received data by the Network Manager falls immediately at T = 920. This indicates that the Network manager stops receiving sensing data from some wireless sensors.

Indeed at T = 920 infected devices will execute the injected false command and start to use the received network key to calculate the DLL MIC. When received by a device that has not been infected by the attack, the packet do not pass the MIC validation step and is rejected. Consequently, packet sent by infected devices will be rejected and not received by the Network Manager.

In comparison with the normal case, in the direct command injection attack the data received by the Network Manager, illustrated in Figure 8(b), falls from 720 bytes to 480 bytes. This represents a decrease of 33%. Indeed, 3 devices i.e., Device5, Device8 and Device9, are infected by this attack.

In the case of the bounced command injection attack, shown in Figure 8(c), we record a decrease of 77% in the data received by the Network Manager. This indicates that this kind of attacks, allows a malicious node to use its parent device as a relay to propagate the attack to a great number of devices. As result, 7 devices are infected by the attack, i.e, Device5, Device2, Device4, Device6, Device7, Device8 and Device9. In the on-the-fly command injection attack, we configure the Network Manager to broadcast, at T = 800s to all devices, a command to change the network key at T = 920s. The malicious attacker will modify this command and send a false command to its children devices. This attack has the same impact as in the case of a direct command injection command. As a variant, we choose that the malicious node does not execute the false command, which explains the difference of the impact between the direct and on-the-fly broadcast attacks. As indicated in Figure 8(d), the received data by the network manager decreased by 22% as only 2 devices are infected i.e., Device5 and Device6.

Countermeasures discussion

The broadcast communication is an important feature in WirelessHART. It allows the Network Manager to configure all devices composing the wireless network by only sending a single packet. It avoids a costing time and resources process of sending a single packet to each device. But as shown in this paper, this feature creates a dangerous breach in the communication scheme security. As it is complicated to ban broadcast communications, we propose hereafter, some ideas to reduce the exposition to this vulnerability.

-Broadcast packet validation after the reception of 2 identical packets: this condition aims to stop direct and on-the-fly command injections. Indeed, as WirelessHART builds a meshed network, best practices in industrial sensor networks recommends that each node has at least 2 or 3 parents. Consequently, each sensor will receive the broadcast packet more than once. Thus, according to this rule, each node must wait till the reception of the same packet from another of its parents before it executes and forwards it. Nodes located at one hop do not have to apply this rule as they receive the broadcast packet directly from the Network Manager. This countermeasure adds a latency in the transmission of broadcast packets and can, in some cases, block their forwarding. -DLL and NL addresses validation: in the case of the bounced command injection attack, DLL and NL headers of the injected packet indicate contradictory informations. Indeed, the source address in the DLL header indicates that the packet has been sent by a children node i.e., the malicious node, while the source address in the NL header indicates that the packet has been sent by a parent node i.e., the network manager. Therefore, implementing in the NL a security mechanisms that rejects packets indicating such contradictory informations can mitigate this kind of attacks. We must note that even if this solution do not complain with the layer separation principle, in practice WirelessHART layers already use information provided by other layers such as addresses. -Use of an IDS for monitoring node's behavior: indeed, except rethinking deeply the communication scheme of WirelessHART, as implementing asymmetric cryptography for packet's authentication, that is a costly process, the use of an IDS will increase significantly the security of such networks. Indeed, this kind of system by monitoring exchanged packets, are able to detect the injection of a false packet or the modification of a packet during its transmission.

In conclusion, the two first countermeasures are partial solutions that do not prevent all scenarios. The second solution is the costless one as it adds a reduced overhead. The use of an IDS is the more efficient solution. Indeed, although it requires the installation of dedicated equipments for traffic monitoring, it is the only solution that detects all possible scenarios. Nevertheless, given that WSNs are distributed systems, we must pay attention to the scheme used to deploy the IDS as it directly impacts the information gathering capability.

Related Works

Most of dedicated studies on WirelessHART focus mainly on the evaluation of the performances of this protocol and its capabilities to operate in an industrial environment and its capacity to meet real-time requirements [START_REF] Han | Reliable and real-time communication in industrial wireless mesh networks[END_REF][START_REF] Kim | When HART goes wireless: Understanding and implementing the wirelesshart standard[END_REF][START_REF] Song | Wirelesshart: Applying wireless technology in real-time industrial process control[END_REF].

On the other hand, security analysis conducted on WirelessHART are based on the specifications of the standard without conducting any tests. Thus, in [START_REF] Raza | Security considerations for the wirelesshart protocol[END_REF] Raza and al. discuss the strengths and the weaknesses of security mechanisms and analyze them against the well known threats in the wireless sensor networks. They conclude that WirelessHART is strong enough to be used in the industrial process control environment. Alcazar and Lopez identify in [START_REF] Alcaraz | A security analysis for wireless sensor mesh networks in highly critical systems[END_REF] vulnerabilities and threats in several wireless communication protocols used in industry i.e., ZigBee PRO, WirelessHART and ISA100.11.a. They analyze in detail the security features of each of these protocols. For them, WirelessHART offers strong authentication capabilities before and after deployment. However, they recommend to add a rekeying process to WirelessHART to enforce its resilience to sniffing attacks and thereby key disclosure.

But although WirelessHART implements several security mechanisms, it stays vulnerable to dangerous attacks. Thus, in a previous work, we develop WirelessHART NetSIM [START_REF] Bayou | WirelessHART Net-SIM: A WirelessHART SCADA-Based Wireless Sensor Networks Simulator[END_REF], a simulator for assessing the security of WirelessHART SCADA-based systems. It can be used to test attacks and countermeasures on WSN. It includes several scenarios for testing simple and complex kinds of attacks. Using this simulator, we give the first description of a Sybil attack specially tailored to target WirelessHART based SCADA systems [START_REF] Bayou | Security issue of wirelesshart based SCADA systems[END_REF]. We demonstrate that an insider attacker using this weakness can isolate partially or more again totally wireless sensors from the SCADA network. This attack targets the security authentication in the data link layer and is based on the knowledge of the network key by all devices composing the wireless network.

Nevertheless, this attack do not allow the injection of false commands into the network as security mechanisms in the upper layer will stop injection attacks. Therefore, the presented attack in this paper is more dangerous than the previous one, as it permits the injections of any false command by circumventing security mechanisms implemented in the Network Layer.

Conclusion

In this paper, we analyze the security of the communication scheme in Wire-lessHART, the most widely used wireless protocol in SCADA systems. We show that an insider attacker can bypass implemented security mechanisms and inject false commands into the network. These false commands will be authenticated as legitimate commands and executed by receiving devices.

The attack is based on the use of the broadcast session credentials that are shared by all devices composing the wireless network. We give also the description of three different scenarios that exploit this weakness. Tests conducted, using a simulator dedicated to WirelessHART security assessment, confirm the feasibility of the attack and its potentially harmful impact. In these tests we choose the network key change command as injected false command. By this way, we were able to break the reception by the network manager of sensing data from wireless sensors. Other scenarios can be developed to take advantage of this weakness. For example, the source routing method can be used to inject false commands to a greater number of sensors.

On the other hand, proposed solutions do not totally mitigate the broadcast attack. Indeed, the broadcast communication is an important feature that cannot be removed. Therefore, and except changing deeply the communication scheme implemented by WirelessHART, the use of an Intrusion Detection System (IDS) is the best operational manner to detect and mitigate this kind of attacks. Further research must be made to study the best way to apply IDS to WSN in industrial environments.

Fig. 1 .

 1 Fig. 1. WirelessHART Communication scheme

  validation Transmit the packet to NL NL Destination address validation NL MIC Validation using Unicast Session Key. Deciphering NL payload using Unicast Session Key. Transmit the packet to AL AL Command execution Transmit the paket to DLL Forwarding the packet

Fig. 2 .

 2 Fig. 2. Unicast packet processing sequence

Fig. 3 .

 3 Fig. 3. Broadcast packet processing sequence

Fig. 4 .Fig. 5 .

 45 Fig. 4. Direct Broadcast attack

Fig. 6 .

 6 Fig. 6. On-the-fly Broadcast attack

Fig. 7 .

 7 Fig. 7. Simulation network topology

Fig. 8 .

 8 Fig. 8. Sensing data received by the Network Manager.

  (AL): it is a command based layer. It is used to send sensing data from field devices to the Network Manager, and to send commands from the Network Manager to the field devices. It supports both common HART commands (inherited from the wired version) and WirelessHART commands.

	-Physical Layer (PhL) : it is based on the IEEE 802.15.4-2006 standard and
	operates in the 2.4 GHz. It is responsible of wireless transmission and recep-
	tion.

-Transport Layer (TL): it provides mechanisms to ensure packets fragmentation and defragmentation. It ensures data delivery without loss, duplication or misordering to its final destination. It supports acknowledged and unacknowledged transactions.

-Network Layer (NL): it ensures end-to-end integrity and confidentiality. It provides routing features. It receives packets from the DLL and checks if they have to be transmitted to the AL or have to be resent to the DLL to be forwarded to the next device. -Data Link Layer (DLL): it is responsible of preparing packets for transmission, sending and receiving packets, managing time slots and maintaining informations about neighborhood. It provides hop-by-hop authentication.


V Mortet

David Trémouilles

J Bulíř

P Hubík

L Heller

Eléna Bedel-Pereira

A Soltani

Peculiarities of high electric field conduction in p-type diamond

published or not. The documents may come   L'archive ouverte pluridisciplinaire

Due to their high ionisation energy, dopants in diamond are only partially ionised at room temperature, e.g. less than 0.1% of boron impurities are ionised in low-doped p-type diamond. As matter of fact, the temperature range of incomplete ionisation of boron acceptor, i.e. the freeze out region, extends up to about 1000 K. The consequent high resistivity severely limits potential applications of diamond as semiconductor [START_REF] Jonscker | Proc IEEE[END_REF][START_REF] Dreifus | Diamond: electronic properties and applications[END_REF] . In the freeze out regime, the conductivity can be increased by excitation of free carriers bounded to neutral impurity centres to conduction/valence band by 1-thermal ionisation rising the temperature, 2-optical ionisation with light irradiation of suitable wavelength and finally 3impact ionization of neutral centres by the free carriers under sufficiently high electric field. Under high electric field, free carriers can gain enough energy to be able to ionised neutral impurities by inelastic collisions leading to free carrier multiplication. This process results in nonlinear current voltage characteristics [START_REF] Sclar | [END_REF] . Impact ionization of impurities has been already studied in narrow band gap semiconductor like germanium [START_REF] Sclar | [END_REF] and silicon 4 at cryogenic temperature, and it has been very recently reported in wide band gap semiconductor like silicon carbide polytypes 5 and diamond 6 at room temperature.

In this paper, we present further experimental data on reversible non-destructive avalanche breakdown effect in diamond. This effect has been studied as function of the concentration of impurities and temperature.

Epitaxial boron doped diamond layers were grown on (100) oriented diamond substrates by microwave plasma enhanced chemical vapour deposition (MW PECVD) in an AX5010 reactor from Seki Diamond Systems with a base pressure below 2 × 10 -6 mbar. Diamond substrates are synthetic high pressure high temperature Ib Sumicrystal UP crystals from Sumitomo Electrics Hartmetall GmbH that have been re-polished using scaife's technique to remove subsurface damages caused by the previous polishing process. Polishing were carried out on the soft polishing direction to minimise any sub surface damages and to produce a smooth surface with a root mean square roughness R RMS <1 nm. Substrates were cleaned in oxidizing mixture of hot sulphuric acid and potassium nitrate for 10 min, rinsed in hot deionized water, and further cleaned in acetone and isopropyl alcohol in ultrasonic bath for 10 min each and finally air dried before loading in the CVD reactor.

Prior to the epitaxial growth, the substrates were etched in hydrogen/oxygen mixture plasma for 10 min. Doped diamond layers (2 µm thick) were grown in a mixture of 1% of methane diluted in hydrogen at a total pressure of 100 mbar, a microwave power of 550 W and a substrate temperature of 1000 -1100 °C using trimethylboron precursor. Epitaxial layers are smooth (R RMS ∼ 1 nm) and free of surface defects. Electrical properties of layers studied in this work were determined by Hall effect method at room temperature using a commercial Accent HL 5500PC measurement setup. Resistivity, mobility and carrier concentration are reported in Table I. Activation energy has been determined by temperature dependant measurement for temperature below 500 K. Acceptor concentration has been estimated from reported electronic properties of boron doped CVD diamond layer by W. Gajewski et al. 7 . Quasi static current-voltage characteristics of boron impurity breakdown in diamond have been carried out in air and at room temperature on specially designed test devices by pulsed measurement using a Transmission-Line Pulsing (TLP) technique [START_REF] Maloney | Proc. EOS/ESD symp. 49[END_REF] . High electrical field test devices consist of two ohmic contacts separated by a boron-doped diamond bar with variable length (d) from 4 to 40 µm. These devices and Hall bars have been prepared by a conventional reactive ion etching system (Vacutec, 1540 RIE/PE system) using sputtered aluminium mask prepared by mask less photolithography using a MicroWriter ML TM laser lithography System from Lot Oriel and wet chemical etching. Diamond layers were etched in an Ar, O 2 , CF 4 and He mixture (10:40:1:1 in volume) at a total pressure of 0.26 mbar with a 400 W RF power and resulting in a maximum auto polarisation bias voltage of 400 -430 V. The etching rate of the doped diamond and aluminium mask are about 50 nm/min and less than 3 nm/min, respectively. Ohmic contacts consist of evaporated Ti/Au layers, deposited using an Edwards Auto 500 Vacuum System, annealed at 450 °C for 30 min in vacuum. They were also patterned by photolithography and wet chemical etching methods. The Transmission-Line Pulse generator used in this work is an Oryx Celestron 1 system that is set to deliver pulses of 100 ns width with 1 ns rise and fall time and a maximum repetition rate of 20 Hz. As the pulse generator's internal resistance (50 Ω) is too low to limit and to measure the current after threshold voltage a 510 Ω surface mount resistance was placed in series with tested samples. High-bandwidth current and voltage probes are used for the measurement of each pulse in the time domain with the help of a 6 GHz bandwidth oscilloscope. The short duration of the pulses and the added serial resistance is intended to drastically reduce the self-heating and to achieve accurate current/voltage electrical characterisation of the samples at extremely high current density. Fig. 1 shows the measured voltage and current pulses across the test device in series with the 510 Ω resistor together with the calculated voltage pulse across the diamond device measured at room temperature. The first and last parts of the current and voltage waveforms are not to be considered. Indeed they result of the non-overlapping of the incident and reflected pulses (propagation effects). However, due to the flatness of the incident pulse, the waveforms after 20 ns and before 100 ns are effective images of voltage and current at the device despite two parasitic reflexions occurring at about 30 ns and 40 ns and that add up to the real device signal. Due to its high resistance (R = 36.8 kΩ) compared the setup serial resistor, the voltage drop across the diamond device nearly equals the applied voltages below 250 V. At higher applied voltage, the current increases superlinearly (see Fig. 2a) and a relative portion of voltage across the device diminishes. At critical voltage, i.e. for an applied voltage higher that 300 V, the current suddenly surges at a rate of about 16 MA.s -1 and the voltage across the device decreases in comparison with the prebreakdown values. Fig. 2a shows the typical quasi-static characteristic current-voltage characteristic of fabricated device extracted by averaging the voltage and current waveform at the end of each TLP pulses (hashed area in Fig. 1a and Fig. 1b). This quasi-static current -voltage (I-V) characteristic exhibits five different conduction regions: 1-highly resistive ohmic region at low electric field, 2-non ohmic superlinear region at intermediate field, 3critical voltage at impurity impact ionisation avalanche, 4-transient region with negative resistance and 5-highly conductive region. Discrepancy between experimental points and theoretical ohmic I-V curve in low field is due to the insufficient measurement accuracy of the experimental setup at low currents (below 10 mA). In the region (2) the (I-V) characteristic deviates from ohm's law until the breakdown.

The increase in conductivity set in first as carriers become hot and consequently carrier's thermal recombination rate is decreased until a sufficient number of carriers acquire enough energy to ionise neutral acceptors by impurity impact ionization 6 . The complete ionisation of dopant by avalanche effect is indicated by the current surge together with a voltage drop that results in an S-shape I-V characteristic typical of current controlled differential negative resistance [START_REF] Ridley | [END_REF] . This effect could not be observed in our previous study 6 due to current limitation of the experimental setup. Differential negative resistances are associated to either contact/junction phenomena (e.g. tunnel diodes) or semiconductor bulk properties (e.g. Gunn diodes or cryosar 10 ). Similar I-V characteristic of synthetic high pressure high temperature boron doped single crystal diamond was reported by Rotner et al. 11 with a breakdown field of 500 V.cm -1 . In their work, it was suggested that the S-shape I-V characteristic may be caused by impurity impact ionisation avalanche despite inconsistency with the expected field. We attribute this discrepancy to thermal self-heating effect. As our observed I-V characteristic cannot be due to contact phenomena (with Nshape I-V characteristic), we ascribe its S shape to impact ionization avalanche.

There exists few reports on simulation of carriers transport properties in diamond at high electric field. Watanabe et al. have demonstrated the average energy of electron can increase well above few hundreds meV for electric field above 10 5 V/cm by Monte-Carlo transport simulations in diamond 12 . Jacoboni et al. have calculated charge transport in silicon at high electric field. Electrons and holes acquire an average energy of ∼ 400 meV at electric field of 10 5 V/cm 13 . Based on these results, we estimate that carriers' energy is of the order of the boron acceptor ionization energy 914 in diamond at breakdown voltage. Noticeably, the avalanche is maintained at a lower sustaining field compared to critical field. The increase by two decades of current appears consistent with full ionization of dopants considering the acceptor and carrier concentrations at room temperature. These measurements are repeatable until the filamentation of the current at highest voltages that permanently damage diamond device. The current density is extremely high (about 2 MA.cm -2 ) after the avalanche threshold voltage. The average power (P = V.I) dissipated in the device prior to the breakdown (region 3) is below 3 W whereas it reaches about 100 W in region 5, i.e. the region of complete impurity ionization. Consequently, thermal effects must be considered, especially on activation of dopants. The energy released within nanoseconds increases significantly the device's temperature as simulated using a simplified model in COMSOL multiphysics simulation software. The model is based on the devices' geometry and heat transfer equation including an electric current heat source. The electrical conductivity of diamond layer was modelled as a smoothened stepwise function of voltage to account for the sharp increase in conductivity after breakdown voltage. The simulation shows that the heat can neither be effectively dissipated through conduction into substrate, nor convection into air, nor radiation. Consequently, temperatures beyond 1000 °C in the centre of the test sample after breakdown have been computed. Note that the simulation does not account for the possible local conductivity of the surrounding substrate that might be induced by carriers' injection from the bar. This would presumably delocalise the thermal effects and, hence, lower the temperature. This temperature is enough to ionize all boron acceptors; however, as shown in our previous study 6 , measured I-V characteristics clearly show that the super linear increase of the current, due to carriers multiplication, occurs at same power dissipation level for which no current multiplication is observed at higher temperature. This result demonstrates that the observed initial carriers' multiplication is due to electric effect and cannot be due to thermal effect. The critical avalanche voltage has been determined as the highest voltage prior to the I-V characteristic discontinuity. Determined critical voltages are reported in Fig. 2b as function of inter-electrode gap and carrier concentration. All measured values are below Paschens' laws in air in standard temperature and pressure conditions as well as measured air breakdown on un-doped diamond layers (not shown). These results demonstrate that the observed breakdown is a diamond-bulk electrical phenomenon and not an inter-electrode arcing in air. This is further confirmed by the linearity of breakdown voltage with the inter electrode gap which clearly indicates an electric field dependent phenomenon. The breakdown voltage increases as acceptor concentration decreases (see Table I) which is opposite to classic work 15 . Indeed concentration of majority and minority impurities, i.e. compensation, are the main parameters that determine the breakdown field. In germanium, breakdown field is known to increase with dopant concentration and compensation as for dopant concentration between 6.1 × 10 13 and 3.1 × 10 17 cm -3 . However, our results are consistent with Sankin et al. work on silicon carbide who reported an increase of impurity impact ionisation breakdown field with decreasing aluminium acceptor concentration 5 . This behaviour is attributed to the substantial decrease of activation energy at high dopant concentration (≥ 10 19 cm -3 ) 16,17 .

Quasi-static current-voltage characteristics of sample 1 (see Table I), with interelectrodes gap of 22.4 µm and bare width of 12.1 µm, measured at substrate's temperature between 15 and 100 °C are shown on Fig. 3a. Temperature rise reduces devices resistance, resistivity and most significantly the critical voltage and field. Noticeably, all current-voltage characteristics in the high conduction region converge to the same I-V characteristics with a characteristic slope of 4.5 mA/V, i.e. an equivalent resistivity of 24 mΩ.cm that is in agreement with full ionisation of neutral impurities. The variation of critical field with temperature is consistent with impurity impact ionisation avalanche 18 . We experimentally observe a T - α temperature dependence of the critical field with α = 1.3 (see Fig. 3b). Amazingly, this result is similar to the temperature dependence of critical field results reported by Koenig et al. 18 in doped germanium at low temperature.

In summary, we have investigated electrical properties of p type semiconducting diamond in high electric field. Quasi static current-voltage characteristic of CVD doped (100) diamond epitaxial layers with variable boron concentration have been measured by Transmission-Line Pulse method between 15 and 100 °C. All studied samples exhibit an Sshape current-voltage with a highly resistive ohmic region at low electrical fields and a highly conductive region at high electric fields that are separated by a transient negative resistance region. This behaviour is attributed to impurity impact ionisation avalanche and consequent full ionization of neutral boron impurity. Determined values of avalanche critical fields are consistent with those expected from theoretical estimations and with our previous report 6 . Like for silicon carbide 5 , their increase with decreasing acceptor concentration is attributed to the reduction of ionisation energy of dopant in the range of studied boron concentration while its temperature dependence is consistent with classic impurity impact ionisation. Still more detailed studies must be carried out to completely describe electrical conduction mechanisms in doped diamond in high electrical fields.

FIG. 2 .

 2 FIG. 2. (a)Quasi-static I-V characteristic of a 22.4 µm long boron doped diamond device with [p] 300K =1.7 × 10 17 cm -3 . Theoretical linear ohmic I-V characteristic with R = 36.8 kΩ resistance is plotted for comparison (dotted line) (inset: Scanning electron microscopy images of high electric field test devices); (b) Experimental breakdown voltage (dots) as function of the inter-electrodes distance of sample 1-3 with different acceptor concentration with their linear fit (line). Breakdown voltage characteristics in air and at atmospheric pressure as function of a gap, i.e. Paschen's (dashed line) and modified Paschen's (dotted line)[START_REF] Schaffer | Electrophotography[END_REF] curves are shown for comparison. Lower limit of undoped diamond breakdown voltage of (i.e. with breakdown field of 1 MV.cm -1 ) is also reported for comparison.

FIG. 3 .

 3 FIG. 3. (a) Quasi-static I-V characteristic (electrodes' gap: 22.4 µm) for different temperature; (b) variation of breakdown voltage as function of temperature for different interelectrodes distances (d) of sample 1.

TABLE I .

 I

	Parameter	Sample 1	Sample 2	Sample 3	Units
	Carrier concentration ([p]) 1.7 × 10 17	4.1 × 10 16	4.0 × 10 15	cm -3
	Estimated acceptor concentration	3 × 10 19	2 × 10 19	1 × 10 19	cm -3
	Carrier mobility (µ)	9.3	21.5	286	cm 2 .V -1 .s -1
	Resistivity (ρ)	3.8	7.3	5.5	Ω.cm
	Activation energy (E A )	210	230	265	meV
	Breakdown field	128	167	214	kV.cm -1
	Table I: Electrical properties of studied boron doped diamond
	FIG. 1. (a) Measured voltage pulses across the diamond test device in series with the 510
	Ω resistor (full lines) and calculated voltage pulses across the test device (dotted lines); (b)
	Measured current pulses (003-L62-L=22.4 µm / w=12 µm; R= 36.8 kΩ).

Acknowledgements: Financial support from the following sources are gratefully acknowledged: Academy of Sciences of the Czech Republic, Czech Science Foundation (GACR) Grant ID: GAČR 13-31783S, the French-Czech Project PHC BARRANDE 2016 35785SC "High Electric Field Properties of Doped Diamond and Applications" and J.E. Purkyně fellowship awarded to V. Mortet by Academy of Sciences of the Czech Republic.


Maciej Gierada

Ivan Petit

Jarosław Handzlik

Hydration in Silica Based Mesoporous Materials; A DFT Model

Keywords: Silica, MCM-41, DFT, Hydration

MCM-41 material is very commonly used as a support for catalysts. However, theoretical investigations are significantly limited due to the lack of appropriate models that well and accurately describe the real material and enable effective computation at the same time. In this work, our aim is to obtain calculable models at the DFT level of MCM-41 which are as close as possible to the real material. In particular the hydration degree has been investigated, and we present and characterize here for the first time a model for the MCM-41 unit cell filled with explicit solvent water molecules. This is particularly important, because the models developed here are aimed to be further applied in theoretical ab initio/DFT studies of adsorption or as a support for modelling active sites in catalysts.

INTRODUCTION

Silicon dioxide or silica is the most common mineral on Earth. Its application is therefore very attractive and stimulated in many applications, beside its use in construction materials such as cement and glass, it is important in catalysis in which it is used as a support and in chromatography, electronic devices, but also in food, pharmaceutical applications and in biomineralization. 1 Different reviews summarize its chemical properties. [START_REF] Legrand | The Surface Properties of Silicas[END_REF][START_REF] Iler | The Chemistry of Silicas[END_REF][START_REF] Rimola | [END_REF] An important feature of silica is the existence of a large variety of polymorphs composed of SiO4 tetrahedra. The high flexibility of the Si-O-Si bond, with a bending energy barrier about 4 kJ/mol 5 is responsible for the great number of existing polymorphs, either natural or synthetic: several crystalline forms such as quartz, cristobalite, tridymite, diatomite, and edingtonite, noncrystalline glasses or sol-gel phases, and micro/mesoporous materials. In this study we focus on the amorphous polymorphs, which alike other amorphous materials are a challenge for modeling.

The silica surface shows undercoordinated atoms, such as three coordinated Si atoms, terminal oxygens, and strained Si-O-Si bridges in small size 2 and 3-membered rings. These silica defects react with water in ambient conditions to form surface hydroxyl groups called silanols [START_REF] Iler | The Chemistry of Silicas[END_REF]6,7 which can make the surface hydrophilic. In contrast, a non-defective clean SiO2 surface is hydrophobic. [8][9][10][11] Due to the amorphous nature of silica, the classical diffraction techniques cannot be used to give structural information. Yet its surface exhibits a rich diversity of chemical groups.

There are different types of silanols that exist on top of silica surface which are schematically presented in the Figure 1. The first general distinction is between the single and geminal silanols. Single silanols are bound to a Si atom involved in three Si-O-Si siloxane groups, whereas geminal silanols complete the coordination sphere of a Si atom involved in two siloxane groups. Silanols can be also associated with Hbond interaction with other silanols or siloxane bridges. Although many authors 9,10,[12][13][14] discriminate vicinal silanols as one of the existing types of SiOH groups, their exact definition is sometimes different in different papers 9,12 and spectroscopic characterization is rather poorly established. Because of that, we are not distinguishing and discussing vicinal silanols in this paper. We treat vicinal silanols as single, since they have one -OH group attached to Si atom, in contrast to geminal silanols (Fig. 1). The most important chemical functions of amorphous silica, surface silanols on the surface, have been characterized mainly by means of vibrational spectroscopies and NMR: IR 15,16 , Raman 17,18 and 29 Si MAS, CP-MAS 9,19-22 and 1 H MAS [23][24][25][26][27][28][29][30] NMR.

The silanol SiO-H stretching frequencies of H-bonded silanols are observed around 3550 cm -1 , while isolated silanols vibrate between 3747-3750 cm -1 . [START_REF] Legrand | The Surface Properties of Silicas[END_REF][START_REF] Iler | The Chemistry of Silicas[END_REF]15 Theoretical studies have complemented the lack of information using different approaches. First, force field calculations have allowed to propose large size models (several thousands of atoms) of amorphous silicas, which have been validated with experimental data such as Si-O-Si angles, Si-O bond lengths, and ring size distributions. [31][32][33][34][35][36][37][38][39][40][41] The bulk, surfaces, and their reactivity toward water to generate a hydroxylated surface have also been studied. 14,31,32,[42][43][44][45][46][47][48][49][50] Second, ab initio calculations combined or not with classical MD (molecular dynamics) to understand adsorption sites and the chemical reactivity of the anhydrous surface 14,44 and hydroxylated amorphous silica 14,49 have been performed as well.

An interesting example of amorphous silica are the mesoporous ordered materials, such as MCM-41. [51][52][53] This material is described by a hexagonal array of roughly cylindrical, straight, unconnected pores which diameter can be engineered. Mesoporous structures usually have a high surface area, as well as a high pore volume, which make them very attractive as catalytic supports. MCM-41 can also be used to adsorb different molecules, including biomolecules, in confined spaces. 54 Nowadays, this material is very commonly used as a support for nano-objects. However, theoretical investigations are significantly limited due to the lack of appropriate models that well and accurately describe the real material and enable effective computation at the same time.

In this work, our aim is to obtain calculable models of MCM-41 which are as close as possible to the real material. This is particularly important, since we aim to use the developed models here to be further applied in theoretical studies of adsorption or as a support for modelling active sites in catalysts. In 2008 one of us presented, characterized and verified a full DFT amorphous hydroxylated silica model, 55 which was recently successfully employed in computational studies of Cr, [56][57][58] Mo, 59 W, 60 V, 61 Nb 62 and Au 63,64 oxide centers on SiO2. Other examples of applications were also investigated in the field of adsorption of bioorganic molecules, [65][START_REF] Costa | AIP Conf. Proc[END_REF][START_REF] Folliet | [END_REF] surfactants, 68 and ionic liquids. 69,70 Here, we are using this previously developed silica slab 55 to prepare mesoporous structures. Although some models of MCM-41 material were postulated in the literature so far, all of them, beside one, are limited to molecular mechanics and kinetic Monte Carlo techniques. [71][72][73][74] Only Ugliengo et al. 75,76 studied MCM-41 at DFT level (B3LYP), however, the model developed by the authors is characterized by the high silanol density (7.2 OH nm -2 ), which seems to be too high to account for adequate representation of the real MCM-41 surface. That model has been recently redefined including dispersion interactions and used in the static 77,78 and AIMD 78 studies of drug molecules adsorption in confined spaces, however, the silanol density remain unchanged. One should note that small cluster models of mesoporous material studied at B3LYP level were also published, 79 but they are far from being realistic.

In this work, six realistic models of MCM-41 mesoporous material, characterized by different degrees of hydroxylation, expressed as a function of their silanol density, are reported. More specifically, models with the 5.8, 5.8 with H2O inside the pores, 4.8, 3.6, 2.3 and 1.7 OH nm -2 (models A, B, C, D, E and F, respectively) are studied. Those models describe MCM-41 surface at different temperatures and/or water vapor pressures. It is worth to emphasize here that such a comprehensive and extensive DFT study on modeling of MCM-41 structure have never been done before.

COMPUTATIONAL DETAILS

The geometry optimization was performed using Pardew-Burke-Ernzerhof (PBE) functional 80 implemented in Vienna Ab Initio Simulation Package (VASP). [81][82][83] This functional was previously successfully used to model amorphous silica structure. 55 The electron-ion interaction was described by the projector augmented-wave (PAW) method. 84,85 Standard PAW atomic parameters were used with a cutoff energy of 400 eV. To account for dispersion interactions, single point energy calculation were performed at PBE-D3(BJ) level. 86,87 To determine harmonic vibrational frequencies, Hessian matrix was calculated by the finite difference method, i.e., each relaxed ion was displaced in the direction of each Cartesian coordinate and the Hessian was determined from the forces. Taking the limited computational power into account, as well as the size of our models, only silanols, i.e., Si-OH groups, was considered in the Hessian matrix. For the graphic presentation of the models developed, Materials Studio 5.5 software was applied. 88 To obtain model B, where water molecules are inside the pores, Packmol package 89,90 was used. Packing procedure were done with the initial water-water and water-MCM-41 distance of 2 and 3 Å, respectively.

In some cases, several H2O molecules had to be displaced manually, in order to obtain optimizable geometry of the whole system. Then, a full relaxation of such model were performed with the fixed unit cell parameters.

The dehydroxylation energy Edeh(T0) of removing water molecules from the high hydroxylated surface to obtain models with lower silanol density was calculated adopting the following equation (1):

∆𝐸 𝑑𝑒ℎ (𝑇 0 ) = 𝐸 𝑖 (𝑇 0 ) + 𝑛𝐸 𝑤𝑎𝑡𝑒𝑟 (𝑇 0 ) -𝐸 𝐴 (𝑇 0 ) (1)
where Ei(T0) and EA(T0) are the PBE-D3(BJ) energies at T = 0 K of partially dehydroxylated (C-F) and high hydroxylated (A) models, respectively, n is a number of water molecules removed in considered dehydroxylation step and Ewater(T0) is the PBE-D3(BJ) energy at T = 0 K of an isolated water molecule calculated using the same unit cell dimensions as in the case of MCM-41 models.

To account for temperature and water partial pressure dependence, the Gibbs energies Gdeh(T,p) were estimated assuming that differences between the Gibbs energies for condensed phases are equal to the differences in their calculated electronic energies and only contributions to enthalpy and entropy of gas water molecule are included (equation 2), following the procedure described by Digne et al. 91 :

∆G deh (T, p H2O ) = ∆E deh (T 0 ) + n [∆g water (T, p 0 ) + RTln ( p H2O p 0 )] (2)
where p0 = 1 atm, T0 = 0 K, R -gas constant and gdeh(T,p0) is the Gibbs energy correction for H2O molecule calculated from statistical thermodynamics using PBE functional 80 combined with def2-QZVPPD basis set 92 implemented in Gaussian 09 set of programs. [START_REF] Frisch | Gaussian 09[END_REF] AIMD simulations were also carried out with the package CP2K/Quickstep, [START_REF] Vandevondele | [END_REF] consisting in Born-Oppenheimer MD (BOMD) PBE electronic representation including Grimme (D3) correction for dispersion, 86 GTH pseudopotentials, 95,96 a combined Plane-Wave (300 Ry density cutoff) and TZVP basis sets. The BOMD are performed using the NVT ensemble. The Nosé-Hoover thermostat is used to control the average temperature at 300 K. Trajectories are accumulated 8 ps (whom 3 ps of equilibration) with a time step of 0.5 fs.

RESULTS AND DISCUSSION

The structural properties Experimental studies show that pore diameter of MCM-41 material can be tailored in a wide range of values starting from 15 up to 100 Å, 51 depending on different factors, such as the surfactant used, pH of the solution, etc. However, typically the pore diameter for MCM-41 is 25 -40 Å. [51][52][53][97][98][99][100][101][102][103] Taking these data into account, we designed the pores in our models with a diameter (including silanols) between 27 -33 Å. This range also well corresponds to other theoretical studies. [71][72][73][74][75] Hence, our first model of MCM-41 material (A) was obtained by connecting three identical, slightly modified amorphous silica slabs 55 and putting them into one hexagonal supercell (initial parameters a = b = 40 Å, c = 13 Å, = 60°), forming a Y-type structure with an angle between the slabs of about 120° (Figure 2). The empty space between three junctions (not connected slabs) was replaced by the SiO2 entities -forming a materialized connection within the junction areas and creating mainly four, five and six-membered -O-Si-O-Si-O-rings since they dominate on the surface of hydroxylated amorphous silica. This was performed manually. To obtain an optimizable model, some atoms were removed, added or there positions were changed. Eventually, the model constructed counts 456 atoms including 117 SiO2 units and 35 H2O molecules (Si117O269H70). Then, the positions of all atoms were fully relaxed together with the unit cell dimensions, in order to minimalize energy of our new structure. Finally, the obtained model is characterized by the unit cell parameters of about 36 Å × 37 Å × 12 Å. The detailed information is given in the Table 1, whereas Figure 3 shows the hexagonal array of cylindrical pores obtained after multiplication of the unit cell. The wall thickness of our model A varies between 6 -8 Å, which is comparable with the experimental data (7 -30 Å). [51][52][53]98,99,102,103 Moreover, based on Monte Carlo simulations and experimental investigations, Maddox et al. 71 suggested that the wall thickness of MCM-41 material is approximated to be smaller than 10 Å.

As far as the T-site (SiO4 tetrahedron) density is concerned, a value of 8.6 T-site nm -3 is calculated, which correlates well with the models proposed by Ugliengo et al. 75 (8.2 T-site nm -3 ). It is also in accordance with previous models obtained through molecular mechanics or kinetic Monte Carlo simulation. [71][72][73][74] Nevertheless, T-site density of the wall was also measured, i.e., density without including the volume of the pores, yielding 25.4 T-site nm -3 . This value is in agreement with the experimentally determined density for MCM-41 (27 T-site nm -3 ). 72 The calculated T-site density of the wall corresponds to wall density of

A B F  a b A B
about 2.8 g cm -3 . 105 The wall density of MCM-41 reported in other experimental 72,104 and theoretical 72,74 works are found to be in a range of 2.15 -3.0 g cm -3 , thus close to the results of our calculations.

An important structural property, that each model of amorphous silica should well predict, is the distribution of the siloxane ring sizes. Our model contains mainly four, five and six-membered rings, however, one can find some larger rings, i.e., containing seven and higher amount of SiO4 tetrahedra (Figure 4). The small three-membered rings are also present but they are (should be) in minority due to their high reactivity. As expected, two-membered rings are not seen, since they are too strained. The average Si-O-Si distance in model A is about 1.64 Å, in agreement with the experimental data. For amorphous silica, the experimentally measured Si-O-Si distance is about 1.62 Å 107 whereas for MCM-41 it is about 1.60 -1.61. [108][109][110] Similarly like in the case of our amorphous silica slab, 55 the Si-O-Si angles range from nearly 103° up to almost 180°. Smaller angles are related to the smaller rings, or they are caused by the deformation of the four-five-and six-membered ones. These results correlate well with the broad distribution of the Si-O-Si angle. 5,108,109 The crucial feature of each type of silica, including also MCM-41, is the characteristics of the surface silanols, since they are responsible for chemical properties of the surface. Model A, with a surface silanol density of 5.8 OH nm -2 , corresponds to our previous amorphous silica slab. 55 The reported surface silanol density fits to the experimentally estimated amount of silanol groups on a hydroxylated surface of amorphous silicas at ambient conditions (4.1 -6.1 OH nm -2 ). 12,111 It is also close to the values reported explicitly for MCM-41 material at room temperature (RT), which is in the range of 4.4 ± 0.5 OH nm -2 . 13 Our next model (B) with 4.8 OH nm -2 fits even better to the experimentally determined silanols density, however, the one with 5.8 OH nm -2 can be defined as a fully hydroxylated MCM-41 structure that is stable at RT and spontaneously decomposes at elevated temperatures to give surface with 4.8 OH nm -2 (vide infra). In contrast, Ugliengo et al. 75 developed MCM-41 model having 7.2 OH nm -2 , which seems to be too high to account for adequate description of hydroxylated surface of this mesoporous silica material, especially at higher temperatures.

As far as different silanols types is concerned, about 89% of all Si-OH groups in the model A are single silanols and 11% are geminal (Table 1), in accordance with the experimental estimation of germinal silanols (13%) on the surface of amorphous silica at 453 K 12,111 . Among all 70 silanols, 40 are involved in H-bond contact (57%), which is also consistent with the experimental data (61%). 12,111 The Si-OH distances on selected sites in the different models are reported in Figure 5.

The effect of dehydroxylation and thermodynamics

To simulate surface of MCM-41 material at different temperatures and water partial pressures, we developed models with 4.8, 3.6, 2.3 and 1.7 OH nm -2 (models C-F), by removing 6, 13, 21, and 25 water molecules, respectively, relatively to the model A. The partial dehydroxylated models of MCM-41 material (C-F) were not arbitrary modelled, but can always be obtained from more hydroxylated ones by elimination of several H2O molecules. The nearest hydroxyls were condensed first to form siloxane bridges and H2O molecules. We started removing silanols that were involved in H-bond interaction and then -if it was necessary, non-H-bonded silanols -until the desired silanol coverage was achieved. Hence, we obtained our dehydroxylated models based on distance criteria only. Similar approach was used by other authors as well. 14,75 Dehydroxylation of silica surface, including mesoporous structures, occurs over a wide range of temperature, 12,13,111,112 so, the energy of each dehydroxylation step depends on the local environment of the leaving silanol group. Otherwise, all silanols would condense in a much narrower range. In particular, the amount of water molecules released form the surface as a result of silanols condensation should affect dehydroxylation energy, i.e., the more dehydroxylated model, the higher Edeh. Indeed, according to our calculations (Table 2), the average energy required to remove H2O molecule from the model A (5.

b c a

Figure 6 shows the stability of each dehydroxylated model of MCM-41 studied, in terms of Gibbs energy of dehydroxylation as a function of temperature and pressure. The water partial pressure equivalent to ambient air water partial pressure was chosen equal to 10 -2 atm. 113 Additionally, the stability of each model is also presented at 10 -5 atm and 10 -9 atm. Considering dehydroxylation at 10 -2 atm (Figure 5 a), dehydroxylation of model A may occur to generate a surface with 4.8 OH nm -2 (model C), which is stable above 460 K. At about 620 K, formation of the surface having 3.6 OH nm -2 (D) becomes thermodynamically favored. Further temperature increasing up to above about 800 facilitates formation of more dehydroxylated model E with the silanols density of 2.3 OH nm -2 . Finally, the calcined surface (model F), characterized by the silanols coverage of 1.7 OH nm -2 , is stable above 820 K. These results are in good agreement with the experimental studies of Zhuravlev 12,111 on amorphous silica, as well as Gallas et al. 13 explicitly for MCM-41. One should note that surface of amorphous silica is not the same as surface of mesoporous material, however, the silanols coverage at different temperatures in both cases are quite close to each other. Additionally, for MCM-41 the most of data are related to the silanols density after high-temperature calcination, which is usually carried out at about 800-900 K. For that temperatures, experimentally determined silanols density is about 1.6 -2.3 OH nm -2 , 13,79,100,102,114 however, 0.8 OH nm - 2 , 115 as well as up to 3 OH nm -2 112 is also reported. At lower water partial pressure (Figure 6 b,c), which are more typical in experimental studies 13,79 , stability of our models are shifted towards lower temperatures.

One should note that the presented values are reported for equilibrium state which might be hardly achievable during experiments.

The basic properties of each dehydroxylated models do not change significantly. Because of that, we will only discuss here the calcined model F (Figure 2).

After releasing 25 water molecules form A the pore size diameter (including silanol groups) becomes slightly longer, wall density is smaller, whereas wall thickness remains almost unchanged (Table 1). This is in agreement with the high number of silanol pairs which were removed from the surface. Experimental studies suggest 12,111 that most of silanols that still remain on the surface after high temperature calcination are isolated (non-H-bonded). This well agrees with our results (Table 1) where among all 20 silanols, only 35% are involved in H-bond contact with neighboring siloxane bridges. Additionally, none of the silanols interact with other Si-OH groups, because they are well dispersed now. According to our model, geminal silanols are not presented on the surface at high temperature, in agreement with the experimentally determined dominance of single silanols. 78 Silanols condensation increases number of -O-Si-O-Si-O-rings in the MCM-41 material. Our calculations suggest, that after high-temperature calcination, mainly three-, four-and five-membered rings are formed, whereas number of larger rings remains almost unchanged, in comparison to the model A (Figure 4). A few strained two-membered rings are also present. Nevertheless, the ring size distribution is similar to that for the model A with 5.8 OH nm -2 .

The solvated model

Having prepared several models of MCM-41 material, which describe properties of this mesoporous silica at different temperatures, next we study this system with water molecules adsorbed inside the pores. To this end, the pores of previously developed model A (stable at RT) were filled with 213 water molecules randomly oriented and located. The number of water molecules corresponds to the experimentally determined amount of H2O adsorbed in cylindrical pores of MCM-41 material (about 0.5g H2O/1g MCM-41) 115. Hence, including the average pore size diameter of about 30 Å, the density of water in the pores is about 0.7 g cm -3 . The obtained value is quite close to the results of other studies. 113 Then, the whole system was fully relaxed with fixed unit cell dimensions. As a result, model B with the molecular formula Si117O482H496 (1095 atoms in unit cell) were obtained (Figure 2). In this model, the same unit cell dimensions, silanols density, silanols type distribution, pore diameter, wall thickness, wall density and geometric parameters was found as for model A (Table 1).

As expected, most of the 30 non-interacting silanols of the model A are now (model B) involved in Hbond contact with water molecules, either as a donor or an acceptor of hydrogen bond. After filling the pores with the water molecules, most of the remaining 40 silanols, which were involved in H-bond interaction with other silanols or siloxane bridges in the model A, still remain interacting with each other (model B). Nevertheless, some of them are also able to create new H-bond with water molecules, finally giving 37 silanols on a total 70, on which the water is adsorbed. Further analysis showed that 7 silanols are able to interact with two water molecules at once and none with more than two. Water molecule can be also adsorbed on two neighboring silanols (two H2O molecules in our model). It is clear that as far as the water silica interface is concerned a molecular dynamics study should be performed similar to our former studies on a silica slab model. 105,116 The average binding energy of H2O molecule in the model B is 54 kJ/mol, whereas in recent paper 55 it was 46-50 kJ/mol. Hence, the results obtained for MCM-41 models and silica slab are comparable. Taking dispersion interaction into account, the average binding energy of H2O in the model B is 64 kJ/mol.

The vibrational properties

In order to further verify our models of MCM-41 material, we have simulated the IR spectra of systems A, B and F in the extended OH stretching frequencies region (4000 -2000 cm -1 ). The obtained results are summarized in Figure 6. One should note that comparison with experimental data 13,118 is not straightforward, because the shapes and shifts of calculated spectra (Fig. 7) are different. This is because we do not scale nor fit the frequencies like it was done elsewhere, 75,77,78 so, quantitative comparison with experiments is a difficult task. On the other hand, more important is the qualitative comparison. In that case, our results simulate very well experimental data, since the position of all bands are in a good agreement with experiments.

Starting from the simulated spectra of model A, it is seen that the OH stretching vibrations occur between 3821 -3033 cm -1 , which can be divided into three domains. The highest values (3821 -3787 cm -1 ) are calculated for non H-bonded silanols. Then, we observe a domain (3787 -3699 cm -1 ) corresponding to either H-bonded acceptor or non-H-bonded silanols. The third domain is the broadest, and lies between 3699 and 3033 cm -1 , and corresponds to the H-bonded donor silanols. Additionally, it is also worth to mention, that each -OH moiety of H-bonded geminal silanols do not vibrate with the same wavenumber, due to different interaction with neighboring silanols. Our results correlates very well with the spectra of real MCM-41 material. Experimentally, sharp bands are observed between 3747-3737 cm -1 which are assigned to non-H-bonded silanols 13,112,[118][119][120] , the bands at around 3715 cm -1 118,119 to H-bonded acceptor silanols, whereas the broadest bands, with the maximum at around 3536-3520 cm -1 are assigned to Hbonded silanols, either acceptors or donors 13,118,119 . For model B (Figure 7) the simulated spectra becomes broader (3776-2207 cm -1 ). Not surprising, since the H-bond network is much complex now due to the presence of water. Again, the calculated vibrational frequencies can be divided into three domains. The non-H-bonded silanols vibrate at 3776-3759 cm -1 , whereas silanols that are acceptors of H-bonds, either from other silanols or adsorbed water molecules vibrate at 3759-3525 cm -1 . The third domain, occurring over wide range of wavenumbers (3525-2207 cm - 1 ) corresponds to the silanols that are donors of H-bonds to other silanols, siloxane bridges or water molecules. Hence, after filling the pores of MCM-41 material by water, the OH stretching vibrations becomes redshifted as one may expected. One should note that the bands of H-bonded silanols overlap by

A B F

with the signal from water aggregates adsorbed on the surface. The latter are experimentally detected between 3600-2700 cm -1 . 117

In the case of the model representing MCM-41 material after high-temperature calcination (Figure 2, model F), narrow spectra are simulated (Figure 7), with the OH stretching frequencies region of 3826-3503 cm - 1 . The bands at 3826-3791 cm -1 correspond to non-H-bonded single silanols, whereas at 3791-3503 cm -1 to silanols being donor of H-bond to siloxane bridges.

Ab Initio Molecular Dynamics investigation of the interfacial water layer.

In the static models, after optimization, no information is given on the mobility of the water molecules inside the channels. In order to shed some light on the dynamical properties of water, we performed a AIMD including dispersion corrections. One of the questions to ask is: Can we rationalize the water mobility towards its positon in the channel? Previously, the water/SiO2 interface has been studied in detail at the AIMD level 106,117 and at the FFMD level [45][46][47][48] . It is not the aim here to develop this point in detail, however some remarks are interesting to be mentioned. When DFT results are compared with empiric FF results important differences are observed. Especially the interaction of the water molecules with the surface silanol groups. In DFT studies the "ice like structure" of the first water layer at the surface is observed whereas in FF the water molecules are found to be more mobile. Nevertheless, one should mention here the experimentally observed high affinity of water towards the hydroxylated silica surface, especially observed in when water is competing with amino acids. [START_REF] Folliet | [END_REF] In order to find any explanation one should answers to questions involving the following parameters: Time scale, FF and functional quality, size of the model, confinement, the silanol density and distribution. Here we present in short our results on the MCM-41 model which agrees, without any surprise with the Silica slab model. 55,117 The first water layer is strongly adsorbed on the silica wall of the MCM-41 channel having a silanol density of 5.8 OH/nm -2 , as can be seen in Figure 8, the blue colored water molecules in the model stay close to the channel surface and do not diffuse for a sampling time up to 8 ps.

Figure 1 .

 1 Figure 1. Types of silanol groups existing on the surface of silica

Figure 2 .

 2 Figure 2. Detailed view of atoms belonging to the unit cell: model A (5.8 OH nm -2 ), model B (5.8 OH nm -2 with water adsorbed inside the pores) and model F (1.7 OH nm -2 ) of MCM-41 mesoporous material.

Figure 3 .

 3 Figure 3. Hexagonal array of the cylindrical pores in the model A of MCM-41 mesoporous material: (A) 2D top view of the 4x4x1 unit cell, (B) 3D view of the 3x2x4 unit cell

Figure 4 .Figure 5 .

 45 Figure 4. Ring size distribution in model A (5.8 OH nm -2 ) and model F (1.7 OH nm -2 ) of MCM-41 mesoporous material

42 AFigure 6

 426 Figure 6 Diagrams (Gibbs energy of dehydroxylation vs. temperature) showing stability of each dehydroxylated models of MCM-41 material at different water partial pressure: a) 10 -2 atm, b) 10 -5 atm c) 10 -9 atm.

Figure 7 .

 7 Figure 7. Simulated IR spectra of model A (5.8 OH nm -2 ), model B (5.8 OH nm -2 with water adsorbed inside the pores) and model F (1.7 OH nm -2 ) of MCM-41 mesoporous material.

Figure 8 .

 8 Figure 8. Snap shot of the MD at 300K a) when potential energy equilibration is reached (after 3 ps), b) after 6,5 ps equilibration.

Figure 9 .

 9 Figure 9. Distance distribution between Si and H atoms in the hydrated model.

Figure 10 .

 10 Figure 10. Distance distribution between O and H atoms in the hydrated model.

Table 1 .

 1 Properties of the models of MCM-41 material

	Model	Exp.

  8 OH nm -2 ) to give model C (4.8 OH nm -2 ) is 42 kJ/mol, whereas to obtain the calcined model (model F) (1.7 OH nm -2 ) from model A is 137 kJ/mol. One should note that Ugliengo et al. 75 observed similar trend for dehydroxylation of silica surface.

Table 2 .

 2 Average dehydroxylation energy normalized per H2O molecule ( av Edeh, kJ mol -1 ) for each dehydroxylation step. The first four rows are the average energies relatively to model A. The last three rows are the average energies for each step

	reaction	 av Edeh

A  C + 6 H2O

ACKNOWLEDGEMENTS

This work was supported in part by the National Science Centre, Poland, Project. No. 2015/19/N/ST4/00007 and 2015/19/B/ST4/01836, and by French state funds managed by the ANR within the Investissements d'Avenir programme under reference ANR-11-IDEX-0004-02, and more specifically within the framework of the Cluster of Excellence MATISSE led by Sorbonne Université. HPC resources from GENCI-[CCRT/CINES/IDRIS] (Grant 2015-[x2015082022]) and the CCRE of Université Pierre et Marie Curie are also acknowledged. Other computational resources from PL-Grid Infrastructure are acknowledged as well.

NOTES

The coordinates of all the structures developed in this work are available in the Supplementary Information.

AUTHOR INFORMATION

Corresponding Author:

e-mail address: frederik.tielens@upmc.fr e-mail address: mgierada@chemia.pk.edu.pl More details of the AIMD analysis concerning the radial distribution functions can be found in the Supplementary Information.

CONCLUSION

In this work, a series of periodic models are presented to describe properties of MCM-41 mesoporous silica -an important material and a popular catalyst support. We have prepared and verified six models of MCM-41 that follow temperature dependence of silanols density. In particular, models with 5.8, 5.8 with water inside the pores, 4.8, 3.6, 2.3 and 1.7 OH nm -2 have been developed. We have shown that our models represent very well the surface of real MCM-41 silica, as evidenced by the comparison with available experimental data, and are improved compared with earlier published models [70][71][72][73][74] . The simulated IR spectra additionally confirms that our models are realistic. For the first time such comprehensive theoretical studies, including the high level of theory and AIMD, have been performed for MCM-41 material.

Comparing our models of MCM-41 material to that published by Ugliengo et al. 74 it is worth to note that in our model the unit cell dimensions as well as the number of atoms belonging to the cell is smaller, and thus more suited for applicative calculations due to less demanding computational power. Hence, we believe the models developed in this work can be applied in further studies of adsorption processes or they can be used in the modelling of the catalyst supports, because they are realistic and enable effective computation in reasonable time.


T K T Nguyen

A Cr Épieux

T Jonckheere

A V Nguyen

Y Levinson

T Martin

DEPHASING DUE TO A FLUCTUATING FRACTIONAL QUANTUM HALL EDGE CURRENT

The dephasing rate of an electron level in a quantum dot, placed next to a fluctuating edge current in the fractional quantum Hall effect, is considered. Using perturbation theory, we first show that this rate has an anomalous dependence on the bias voltage applied to the neighboring quantum point contact, because of the Luttinger liquid physics which describes the fractional Hall fluid. Next, we describe exactly the weak to strong backscattering crossover using the Bethe-Ansatz solution.

Introduction

The presence of electrical environment influences the transport through a quantum dot: its energy level acquires a finite linewidth if the environment has strong charge fluctuations. Several experiments, performed with a quantum dot embedded in an Aharonov-Bohm loop, probed the phase coherence of transport when the dot is coupled to a controlled environment, such as a quantum point contact (QPC) 1 . Charge fluctuations in the QPC create a fluctuating potential at the dot, modulate its electron level, and destroy the coherence of the transmission through the dot 2 . Theoretical studies for describing this dephasing have been developped 3,4 , and were applied to a quantum Hall geometry 5 , and to a normal metal-superconductor QPC 6 .

In this work, we consider the case of dephasing from a QPC in the fractional quantum Hall effect (FQHE) regime 7 . QPC transmission can be described by tunneling between edge states which represent collective excitations of the quantum Hall fluid. It is interesting because the transport properties deviate strongly from the case of normal conductors 8,9,10 : for the weak backscattering (BS) case, the current at zero temperature may increase when the voltage bias is lowered, while in the strong BS case, the I(V ) is highly non linear. It is thus important to address the issue of dephasing from a Luttinger liquid.

Dephasing in the fractional quantum Hall regime

The system we consider is depicted in Fig. 1. The single level Hamiltonian for the dot reads H QD = 0 c † c, where c † creates an electron. This dot is coupled capacitively to a point contact in the FQHE. The Hamiltonian which describes the edge modes in the absence of tunneling is:

H 0 = (hv F /4π) dx[(∂ x φ 1 ) 2 + (∂ x φ 2 ) 2 ]
, where φ 1 and φ 2 are the chiral Luttinger bosonic fields, which are related to the electron density operators By varying the gate potential of the QPC, one can switch from a weak BS situation, where the Hall liquid remains in one piece (Fig. 1a), to a strong BS situation where the Hall liquid is split in two (Fig. 1b). In the former case, the entities which tunnel are edge quasiparticle excitations. In the latter case, between the two fluids, only electrons can tunnel. We consider the weak BS case, and then we use a duality transformation 8,11 to describe the strong BS case. The tunneling Hamiltonian between edges 1 and 2 reads H t = Γ 0 e iω 0 t ψ + 2 (0)ψ 1 (0) + h.c. where we have used a Peierls substitution to include the voltage: ω 0 = e ⋆ V /h (e ⋆ = νe is the effective charge, ν is the filling factor). The quasiparticle operator is

ρ 1(2) by ∂ x φ 1(2) (x) = πρ 1(2) (x)/ √ ν. ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✂ ✁✂
✜ ✁✜ ✁✜ ✜ ✁✜ ✁✜ ✜ ✁✜ ✁✜ ✜ ✁✜ ✁✜ ✜ ✁✜ ✁✜ ✜ ✁✜ ✁✜ ✜ ✁✜ ✁✜ ✜ ✁✜ ✁✜ ✜ ✁✜ ✁✜ ✜ ✁✜ ✁✜ ✜ ✁✜ ✁✜ ✜ ✁✜ ✁✜ QD QD φ 2 φ 2 φ 1 φ 1 IB IB a) b)
ψ i (x) = e i √ νφ i (x) / √ 2πα (the spatial cutoff is α = v F τ 0 , with τ 0 the temporal cutoff).
The Hamiltonian describing the interaction between the dot and the QPC reads H int = c + c dxf (x)ρ 1 (x), with f (x) a Coulomb interaction kernel, which is assumed to include screening by the nearby gates f (x) ≃ e 2 e -|x|/λs / √ x 2 + d 2 , where d is the distance from the dot to the edge, λ s is a screening length. The dephasing rate, expressed in terms of irreducible charge fluctuations in the adjacent wire, is written as 3,4,5 :

τ -1 ϕ = 1 4h 2 ∞ -∞ dt dxf (x) dx ′ f (x ′ ) ρ 1 (x, t)ρ 1 (x ′ , 0) + ρ 1 (x ′ , 0)ρ 1 (x, t) . (1)
The equilibrium contribution to the dephasing rate corresponds to the zero order in the tunneling amplitude Γ 0 :

(τ -1 ϕ ) (0) = ν 4π 2 h2 ∞ -∞ dt dxf (x) dx ′ f (x ′ ) η=± ∂ 2 xx ′ G η-η 1 (x -x ′ , t) , (2)
where the bosonic Green's function is

G η 1 η 2 i (x -x ′ , t 1 -t 2 ) = φ i (x, t η 1 1 )φ i (x ′ , t η 2 2 ) -φ 2 i .
The coefficients η,η 1,2 = ± identify the upper/lower branch of the Keldysh contour. There is no contribution to first order in the tunneling Hamiltonian, while the non-equilibrium contribution corresponding to the second order in Γ 0 exists:

(τ -1 ϕ ) (2) = - ν 4π 2 h4 Γ 2 0 2(2πα) 2 ∞ -∞ dt dxf (x) dx ′ f (x ′ ) η,η 1 ,η 2 , η 1 η 2 ∞ -∞ dt 1 ∞ -∞ dt 2 ×e i ω 0 (t 1 -t 2 ) e νG η 1 η 2 2 (0,t 1 -t 2 ) e νG η 1 η 2 1 (0,t 1 -t 2 ) ∂ 2 xx ′ G η-η 1 (x -x ′ , t) + ν[∂ x G ηη 1 1 (x, t -t 1 ) -∂ x G ηη 2 1 (x, t -t 2 )][∂ x ′ G -ηη 1 1 (x ′ , -t 1 ) -∂ x ′ G -ηη 2 1 (x ′ , -t 2 )] . (3)
The dephasing rate depends on the geometry of the set up via the length scales d, λ s , and α. The assumption of strong screening

λ s ∼ α = v F τ 0 is made (f (x) ≃ 2e 2 αδ(x)/d). Inserting G ηη ′ 1 (x, t) = -ln sinh[π[(x/v F -t)((η +η ′ )sgn(t)-(η -η ′ ))/2+iτ 0 ]/hβ] sinh[iπτ 0 /hβ]
, where β = 1/k B T , in the dephasing rate gives: (τ -1 ϕ ) (0) = 4e 4 τ 2 0 ν/πh 3 βd 2 and,

(τ -1 ϕ ) (2) = e 4 Γ 2 0 π 2 h4 v 2 F d 2 ν 2 τ 2ν 0 Γ(2ν) 2π hβ 2ν-1 cosh ω 0 hβ 2 Γ ν + i ω 0 hβ 2π 2 . (4)
Note that (τ -1 ϕ ) (2) = (eτ 0 /d) 2 S I (0), with S I (0) = dt I(t)I(0) the zero-frequency BS noise. The non-equilibrium contribution of the dephasing rate is proportional to the zerofrequency noise 9,10,11,[START_REF] Martin | Les Houches Summer School session LXXXI[END_REF] in the quantum Hall liquid. At zero temperature, the non-equilibrium dephasing rate given by Eq. ( 4) leads to (τ -1 ϕ ) (2) ∝ |ω 0 | 2ν-1 and depends on the QPC bias with the exponent 2ν -1 < 0, in sharp contrast with the linear dependence obtained by Levinson 3 . In the left of Fig. 2, we plot the dependence of the non-equilibrium contribution of the dephasing rate on the filling factor ν for weak BS and strong BS for several temperatures (β = 5, 10, 50) at fixed QPC bias. ν is considered as a continuous variable, while it has physical meaning only at Laughlin fractions 7 . For the strong BS case, the dephasing rate increases when the ν increases. For weak BS and 1/β eV , the dephasing rate has a local maximum at ν < 1/2, the position of which depends on temperature: when the temperature increases, it gets closer to ν = 1/2. The rate at ν = 1 is smaller than that at ν = 1/3. This result demonstrates that for two different filling factors, we can have comparable dephasing rates. For weak BS and 1/β > eV , the dephasing rate increases when the filling factor increases. In the right of Fig. 2, the dependence of the dephasing rate on the QPC bias voltage is plotted for ν = 1/3 and several temperatures. In the case of strong BS, the dephasing rate increases when the bias increases. For 1/β eV , the dephasing rate saturates, whereas for 1/β > eV , the dephasing rate increases when eV increases, but it increases from a finite value (not shown), which is proportional to the temperature. Things are quite different at weak BS. At high temperatures, the dephasing rate decreases when we increase eV : this behavior is symptomatic of current and noise characteristic in a Luttinger liquid. In the low temperature case 1/β eV , for small eV , the lower the temperature, the bigger the dephasing rate and the faster it decreases when we increase eV .

General formula for the decoherence rate

The charge fluctuations are directly related to the current fluctuations along the edges which are identical to the fluctuations of the tunneling current. The tunneling current fluctuations were computed non pertubatively using Bethe-Ansatz techniques [START_REF] Fendley | [END_REF] . We can therefore invoke current conservation at the point contact to derive a general formula for the decoherence rate, which describes the crossover from weak to strong BS: (τ -1 ϕ ) (2) = (e 3 τ 2 0 /d 2 )(V G dif f -I)ν/(1-ν) where G dif f = ∂ V I is the differential conductance and I is the current 14 . This expression allows us to describe the crossover in the dephasing rate from the weak to the strong BS regime.

Remarkably, it is possible to go beyond the strong screening limit, and one can compute Eq. ( 3) for an arbitrary Coulomb kernel f (x). The result can be displayed in terms of the ratio between the arbitrary screening dephasing rate and the strong screening dephasing rate:

F ≡ (τ -1 ϕ ) (2) (τ -1 ϕ ) (2) λ s→α = d 2 (eα) 2 ∞ 0 dxf (x) 2 .
(5)

If the Coulomb interaction kernel f (x) is chosen as suggested before, the dephasing rate at arbitrary λ s has an analytical expression: F = (πd/2α) 2 [E 0 (d/λ s ) + N 0 (d/λ s )], where E 0 (d/λ s ) and N 0 (d/λ s ) are the Weber and the Neumann functions of zero order. F is plotted in the insert of Fig. 2: F is infinite in the absence of screening. However, the presence of metallic gates always imposes a finite screening length. F decreases with d/λ s and approaches 1 when λ s is close to the spatial cutoff α. The dephasing rate increases when the screening decreases.

Conclusion

We have established a general formula for the dephasing rate of a quantum dot located in the proximity of a fluctuating fractional edge current. For strong screening, we have shown that the dephasing rate is given by the tunneling current noise, for both weak and strong BS. For weaker screening, the spatial dependence of the density-density correlation function has to be taken into account, but we have shown explicitly that the long range nature of the Coulomb interaction can be included as a trivial multiplicative factor. The fact that the dephasing rate decreases with increasing voltage can be reconciled with the fact that the charge noise is directly related to the BS current noise in the FQHE. There it is known, and seen experimentally, that when the bias voltage dominates over the temperature, both the tunneling current and noise bear a power law dependence ∼ V 2ν-1 with a negative exponent. The fact that at low temperatures, the dephasing rate for filling factors can be lower than that of the integer quantum Hall effect comes as a surprise and is a consequence of chiral Luttinger liquid theory.

Figure 1 :

 1 Figure 1: Schematic description of the setup: the quantum dot (top) is coupled capacitively to a quantum point contact in the FQHE regime: a) case of weak backscattering, b) case of strong backscattering.

2 FFigure 2 :

 22 Figure 2: (Left) Dephasing rate, plotted in units of e 4 Γ 2 0 τ0/π 2 h4 v 2 F d 2 , as a function of the filling factor for weak BS (full line) and strong BS (dashed line) at QPC bias eV = 0.1. The star, diamond and circle points correspond to the Laughlin fractions ν = 1/m, m odd integer. (Right) Dephasing rate as a function of QPC bias with ν = 1/3 for weak BS (full line) and strong BS (dashed line). The insert is the ratio of non-equilibrium contribution in dephasing rate between the arbitrary screening and strong screening multiplied by (α/d) 2 as a function of d/λ s .