J Chapovaloff

F Rouillard
email: fabien.rouillard@cea.fr

K Wolski

M Pijolat

Kinetics and mechanism of reaction between water vapour, carbon monoxide and a chromia-forming nickel base alloy

Keywords: C. High temperature Corrosion, C. Oxidation, C. Reactor conditions

The kinetic aspects of the competitive reaction of CO and H 2 O in the formation of chromia layer on a nickel base alloy at high temperature were studied by thermogravimetry combined to gas phase chromatography. It was shown that competitive adsorption occurred between both molecules and that whatever P CO /P H2O ratio, CO mainly reacted in the first instants of oxidation and H 2 O became the main long-term oxidant species. After an interfacial and diffusion mixed kinetic regime, the long-term oxidation rate was parabolic and did not depend on the water vapour content in the gas phase. The oxidation kinetics was well described by considering that the rate limiting step was the outwards diffusion of interstitial chromium cations in the oxide layer.

Introduction

The understanding of high temperature corrosion of alloys in mixed gas environments containing aggressive species such as oxygen bearing species (H 2 O, CO 2 , O 2 , CO…), carbon bearing species (CH 4 , CO 2 , CO…) or sulphur bearing species (SO 2 , H 2 S…) is more than ever, nowadays, a major research area. Progress is urgently needed since most of the future technologies involve complex environments. In prospective nuclear plants, High Temperature gas cooled Reactor (HTR) is one typical example of technologies involving the use of complex aggressive atmospheres. It is a nuclear system with an all graphite core cooled by helium. From reactions between the pollutants -out-gassing, air ingress -and the hot graphite core, the helium coolant contains a mixture of small amounts of impurities typically H 2 , H 2 O, CO, and CH 4 . Even if these impurities are highly diluted in helium -only between a few tens to hundreds of µbar -they can react at high temperature, typically between 850°C and 1000°C, with structural metallic materials. Gas-metal interactions involved in HTR heat exchangers have been discussed in numerous papers published in the past three decades [START_REF] Brenner | The Development And Application Of A Unified Corrosion Model For High-Temperature Gas-Cooled Reactor Systems[END_REF][START_REF] Christ | High-Temperature Corrosion Of The Nickel-Based Alloy Inconel-617 In Helium Containing Small Amounts Of Impurities[END_REF][START_REF] Shindo | Corrosion Behavior Of High-Temperature Alloys In Impure Helium Environments[END_REF][START_REF] Quadakkers | Thermodynamic And Kinetic Aspects Of The Corrosion Of High-Temperature Alloys In High-Temperature Gas-Cooled Reactor Helium[END_REF][START_REF] Quadakkers | Corrosion Of High-Temperature Alloys In The Primary Circuit Helium Of High-Temperature Gas-Cooled Reactors.1[END_REF][START_REF] Quadakkers | Corrosion Of High-Temperature Alloys In The Primary Circuit Helium Of High-Temperature Gas-Cooled Reactors.2. Experimental Results[END_REF] and more recently in France [START_REF] Cabet | High temperature reactivity of two chromium-containing alloys in impure helium[END_REF][START_REF] Rouillard | Oxidation of a chromia-forming nickel base alloy at high temperature in mixed diluted CO/H2O atmospheres[END_REF][START_REF] Rouillard | Oxide-layer formation and stability on a nickel-base alloy in impure helium at high temperature[END_REF][START_REF] Rouillard | High temperature corrosion of a nickel base alloy by helium impurities[END_REF][START_REF] Rouillard | Thermodynamic modelling of the destruction of the surface Cr(2)O(3) on Alloy 230 in the impure helium atmosphere of a Gas Cooled Reactor[END_REF][START_REF] Chapovaloff | Parameters governing the reduction of oxide layers on Inconel 617 in impure VHTR He atmosphere[END_REF][START_REF] Chapovaloff | Influence of Al on the High Temperature corrosion behaviour of Inconel 617 in VHTR primary coolant atmosphere[END_REF][START_REF] Cabet | Comparison of the high temperature surface reactivity in impure helium of two materials for gas cooled reactors[END_REF] and in the USA [START_REF] Kumar | High-Temperature Oxidation of Alloy 617 in Helium Containing Part-Per-Million Levels of CO and CO(2) as Impurities, Metall[END_REF][START_REF] Adharapurapu | Chromia-Assisted Decarburization of W-Rich Ni-Based Alloys in Impure Helium at 1273 K (1000 degrees C)[END_REF][START_REF] Mo | High Temperature Aging and Corrosion Study on Alloy 617 and Alloy 230[END_REF]. These works have demonstrated that depending on the composition of the chromia-former alloy, on the working temperature (850-1000°C) and on the partial pressures of the various gas species in helium, two main behaviours could be distinguished: either a passive corrosion behaviour based on the formation of a stable, slow-growing, Cr-rich oxide layer on the surface or an active corrosion with the destruction of the surface oxide layer and the subsequent decarburization or carburization of the alloy [START_REF] Rouillard | Oxide-layer formation and stability on a nickel-base alloy in impure helium at high temperature[END_REF]. In the passive region which is the behaviour desired for the material, it is very important to know what is the oxide growth mechanism and its kinetics in order to predict the component lifetime. It has been shown in [START_REF] Rouillard | Oxidation of a chromia-forming nickel base alloy at high temperature in mixed diluted CO/H2O atmospheres[END_REF] that the oxide layer is formed in the first instant of exposure by reactions with both CO and H 2 O and that these reactions are in competition. At longer times, it appears that H 2 O is the main oxidizing species. Nevertheless, up to now, several questions remain opened: What is the rate limiting step of the long term oxidation kinetics by H 2 O? What are the different reaction steps of CO and H 2 O with the metallic surface which could explain the competition between both species in the formation of the first oxide layers? In order to progress on these questions, a very innovating facility was conceived: a thermobalance was coupled to a gas phase chromatograph in order to get both in-situ mass gain measurements and in situ measurements of each gas species' consumption [START_REF] Chapovaloff | Assessing the kinetics of high temperature oxidation of Inconel 617 in impure helium by coupling TGA and GPC analysis[END_REF]. From these data, the experimental reaction kinetics of CO and H 2 O with the metallic surface could be determined and a reaction mechanism with several steps (adsorption, dissociation, diffusion…) could be proposed for each gas species.

Experimental procedure Material

The chemical composition of the tested alloy 617 is given in Table 1. Specimens of 15 × 15 mm 2 were machined from a metal sheet of 2 mm thickness. The specimen surfaces were ground to 2400-grit emery paper and finished with a diamond suspension of 3 µm. Before testing, they were washed ultrasonically in acetone, then alcohol, dried and weighed.

Test facility

In order to make a well-controlled mixture of CO, H 2 and H 2 O in the µbar range, a bottle of helium containing a low concentration of CO and a bottle a helium containing a low concentration of H 2 were diluted into a main flow of pure helium via parallel mass flow meters. Then, in order to remove any oxygen and water vapour from the gas phase, the impure helium flow was passed through graphite packed in a quartz tube and heated within a furnace up to 900 °C. The reaction of oxygen and water with graphite produced CO and H 2 . Finally, the water level was adjusted by passing through a container with temperature-controlled deaerated water. The exact amounts of CO, H 2 and H 2 O in the gas mixture were accurately measured by a gas phase chromatograph and a mirror chilled dew point hygrometer before injection in the thermobalance.

The measurements of the sample weight mass gain were carried out in a symmetric thermobalance whose accuracy was in the microgram range. The rates of gas production or consumption were measured by the gas phase chromatograph (GPC) every seven minutes at the thermobalance exit. The detection limit was 0.1 µbar.

The facility is shown in Figure 1.

Test conditions

Corrosion tests under hydrogen enriched helium with different amounts of CO and H 2 O were carried out at 850°C. Before reaching the temperature of interest (20°C/min), a plateau at 650°C for 2h was carried out in order to desorb gases from the sample. Then, the temperature was increased up to 850°C at 1.7 °C/min. Two different test campaigns were carried out. First, the influence of the water vapour pressure on the corrosion kinetics was studied by varying its amount from 2 µbar to 21 µbar in a mixture composed of 14 µbar CO, 130 µbar H 2 in helium (He-14CO-130H 2 ). Then the influence of the carbon monoxide pressure on the corrosion kinetics was studied by varying its amount from 7 µbar to 60 µbar in a mixture He-5H 2 O-130H 2 . In all experiments, the gas flow was accurately set to 43 L/h. Characterization of the corrosion layer was carried out by XRD, FESEM-EDX and GDOES.

Experimental results

In-situ measurements of mass gains and GPC measurements

The mass gain increase and the changes of the levels of gaseous impurities in helium atmosphere during the oxidation test of alloy 617 under He-14CO-130H 2 with low water vapour partial pressure (4 µbars) are shown in Figure 2. The gas phase analyses resulted from a mass balance performed between the output and the input measurements of the thermobalance. This was obtained, on one hand, by GPC for carbon monoxide and hydrogen and, on the other hand, by measurements on the chilled-mirror dew point hygrometer for the water vapour. Depending on whether the content variation was positive or negative, the gaseous impurities were respectively either produced or consumed by the sample.

As shown in Figure 2, during the temperature increase up to 850°C, water vapour was consumed and hydrogen was produced symmetrically. CO was consumed as well but at much lower extent than water vapour. It started to be consumed at a higher temperature than water and its maximum consumption rate was reached at 850°C. Once reached the temperature, the production rate of hydrogen and the consumption rate of water and carbon monoxide started to decrease with time. After 7 hrs, the consumption rate of CO was nearly null whereas the consumption rate of water and the production rate of hydrogen were still non negligible until the end of the test.

They became null only during the temperature decrease. The fact that the evolution of the water consumption and the hydrogen production were symmetric strongly indicated that the sample oxidized by H 2 O according to reaction (1):

2 2 M+ H O M O + H x y x y y → (1)
The CO consumption indicated that CO reacted with the sample surface according to reaction (2):

s M+ M O + C x y x yCO y → (2)
with C s , the carbon in solution. We consider in (2) that carbon was deposited in solution in the sample since no solid phases such as carbides could be observed.

Mass balance

In order to check if the experimental mass gain observed on the sample was entirely due to reaction (1) and ( 2), the theoretical mass gain considering (1) and ( 2) and the GPC analyses were calculated and compared.

Figure 3 shows m(O) H2 , the mass gain calculated from the H 2 production measured by GPC (indicating the H 2 O consumption through reaction (1)), m(O) CO , the mass gain calculated from the CO consumption measured by GPC and reaction (2), the total mass gain from both CO and H 2 O and the experimental mass gain m measured by thermobalance. Figure 3 shows that the total mass gain from both CO and H 2 O was in very good agreement with the experimental mass gain. As a consequence the total mass gain was exclusively due to reactions (1) and ( 2)

during the whole corrosion test duration.

One very important result that should be observed in Figure 3 is that more than 90% of the total mass gain was due to oxidation by H 2 O even if its partial pressure was about 3 times lower than the partial pressure of CO.

Surface observations

Figure 4 shows the oxide layer formed on alloy 617 surface after the corrosion test at 850°C for 20 hrs under He-14CO-130H 2 -4H 2 O. It can be observed that the oxide morphology was heterogeneous. The oxide which grew above the metallic grains was mainly made of small crystallites whereas the oxide formed above the metallic grain boundaries were thicker and with a foam-like morphology. Complementary characterizations of the surface by XRD, GDOES and FESEM-EDX revealed that the oxide layer was mainly made of Cr 2 O 3 with an upper layer enriched in Mn (XRD pattern: Mn 1.5 Cr 1.5 O 4 ) and titanium. From Figure 4, the oxide layer thickness reached about 300 nm but could reach more than 1 µm above the metallic grain boundaries. Below the oxide layer, several voids condensed at the metal/oxide interface and in metallic grain boundaries. Aluminium rich intergranular oxides precipitated in metallic grain boundaries up to several microns in depth. EDX analysis combined with GDOES profiling of the oxide layer revealed silicon enrichment at the metal/oxide interface.

Since this element is well-known for segregating from the very first instants of oxidation [START_REF] Rouillard | Oxidation of a chromia-forming nickel base alloy at high temperature in mixed diluted CO/H2O atmospheres[END_REF], it could be proposed that the oxide/metal interface corresponded more or less to the initial metallic surface. As a consequence, the growth of chromia layer was likely to be mainly outwards. This proposition is in good agreement with the observation of voids deeper in the alloy which could result from vacancies condensation [START_REF] Shida | Intergranular oxidation and internal void formation in Ni-40% Cr alloys[END_REF].

Influence of CO content on its consumption rate

Figure 5 shows the CO consumption over time for corrosion tests with different amount of CO from 7 to 60 µbar in He-130H 2 -5H 2 O. The hydrogen production (which indicated the reaction rate of water) and the mass gain were roughly the same whatever the CO amount used in the corrosion tests. First, it could be observed that when the CO partial pressure increased in impure helium, the maximum CO consumption rate defined at point B, ie when 850°C was reached, increased. Then, during the plateau at 850°C, the consumption rate decreased with time and tended to zero except for the highest CO partial pressure at 60 µbar since the consumption started again after 13h. This new consumption was not explained.

With 7 µbars, 14 µbars, 28 µbars and 60 µbars of CO, the percentage of the total mass gain of the sample due to reaction with CO was 3 %, 8 %, 8.5 % and 11 % respectively. Thus, even for a CO partial pressure more than 12 times higher than the water partial pressure, the CO consumption stayed a minor process. Finally, no major difference in the oxide morphology could be observed when changing the CO partial pressure in the corrosion tests.

Influence of the water content in helium on the maximum rate of CO consumption

In Figure 6 is shown the maximum rate of CO consumption as a function of water content in He-14CO-130H 2 . It could be observed that when the water content increased in the gas phase, the maximum CO consumption rate decreased. Moreover when the water content was set higher than 17 µbar, CO did not react any more.

The observations in Figure 5 and Figure 6 that the CO consumption depended both on CO partial pressure and H 2 O partial pressure in the gas phase suggests that there was a competition between both reactions probably linked to the adsorption steps or interfacial reactions. The rate limiting step will be discussed next. Another important result was that CO reaction occurred only in the first hours and was, thus, transient. H 2 O was the main oxidant species both for short and long-term exposure.

Influence of the water content on the oxide growth rate

Figure 7 shows the mass gain of alloy 617 measured in-situ by thermobalance in He-14CO-130H 2 as a function of the water content in helium. It could be observed that the oxide growth kinetics was in all cases parabolic and that the oxide growth rate increased with the water partial pressure in helium.

Discussion

Modelling of the CO consumption kinetics

The study on the carbon monoxide consumption by alloy 617 showed that its maximum consumption (indicated by point B on the GPC analysis in Figure 5) was sensitive to the impure helium composition. The different corrosion tests showed that it decreased when the partial pressure of carbon monoxide decreased (see Figure 5)

or when the partial pressure of water vapour increased (see Figure 6). To model the consumption kinetics of carbon monoxide it is necessary, first, to write the reaction mechanism, then, to know the limiting step of the kinetics, that is to say the elementary step which had the lowest rate constant. In most cases, diffusion phenomena are those with the lowest rate constants, but sometimes the interfacial processes play an important role, especially for thin oxide scale such as the one encountered in the first instants of oxide growth. To model the kinetics of consumption of carbon monoxide at point B (which corresponds to the maximum rate of consumption), let consider a chemical sorption process on the external oxide layer surface able to describe the competition between water vapour and carbon monoxide.

The most common model of adsorption is to consider that the gas molecule bound to a site on the surface without creating a new adsorption site (Langmuir's theory [20]). Then, these species could form other species which were likely to be desorbed. For water molecule, let consider four different steps which may have occurred on the oxide surface. To express the equilibrium constants of reactions (K eq ) in the case of monolayer adsorption, let consider the recovery factor 0 i i s s θ = as variable where s 0 is the initial concentration of available sites per area unit and S i , the concentration of sites of sites occupied by species i per area unit.

For adsorption and dissociation of H 2 O and CO, the following reaction steps with their equilibrium constants are proposed in Table 2.

Semi reaction

Equilibrium constant

1 k 2 2 H O + s H O-s  → (3) S1 2 eq. 2 H O-s s H O θ K = θ . P (10) k 2 2 H O-s s HO-s + H-s +  → (4) 2 S eq. 2 HO-s . H-s s H O-s θ θ K = θ . θ (11) 3 k 2 2H-s H + 2s  → (5) 2 2 . S3 eq. s H-s H θ K = P θ       (12) k 4 HO-s + s H-s + O-s → (6) S4 eq. O-s . H-s s HO-s θ θ K = θ . θ (13)

Semi reaction Equilibrium constant

k 5 CO + s CO-s  → (7) 5 S eq. CO-s s CO θ K = θ . P (14) k 6 CO-s s C-s + O-s +  → (8) S6 eq. C-s . O-s s CO-s θ θ K = θ . θ (15) k 7 C-s C + s  → (9) S7 C eq. s . C-s θ a K = θ (16)
with k i the constant rates of the elemental semi reaction.

Oxygen adsorbed on the surface of the oxide layer (O-s) from both H 2 O (reaction 6) and CO (reaction 8)

participates in the growth of the oxide layer and releases the adsorption site s. Hydroxyl species OH°, often presented in the literature was only considered, here, as an non stable intermediate species and do not participate to the edification of the oxide layer. This assumption is in good agreement with Lu et al.'s observation that the OH/O ratio in the oxide layer formed on pure chromium at 450°C was lower than 0.1 [START_REF] Lu | H216o/H218o/O2)-O-16-O-18 Gas-Mixtures At 300-730 K Studied In-Situ With Sims[END_REF]. Moreover, considering CO adsorption, we preferred to consider as first reaction a "deposit" of pure carbon on the surface of the oxide layer. Then, it is conceivable to expect other basic steps where carbon formed chromium oxy-carbide or dissolved in the oxide. But all these steps were not described here since they were not assumed to be rate limiting in the mechanism of oxidation by CO.

From Eyring's theory, the order coefficient for each species involved in elementary reactions is equal to the stoichiometric factor of the species and is null for normal constituent of the unit cell or the metallic phase [START_REF] Delmon | Introduction à la cinétique hétérogène[END_REF]. If one considers, now, one after the other, each adsorption/dissociation steps as rate limiting (and neglecting the reverse side of each reaction since they are considered to be far from the equilibrium), the rate laws which can rightly describe a decrease in CO consumption when the partial pressure of H 2 O increases or when the partial pressure of CO reduces are shown in Table 3.

 → k 7

CO + s CO-s . .

7 7 CO v = k s P θ
By writting θs as a function of the equilibrium constants of the other elemental steps and by using equation 8 below:

2 H O HO H O CO C θ -s + θ -s + θ -s + θ -s +θs + θ -s + θ -s = 1 ( 17
)
one ends up with The comparison between the experimental results and the two equations ( 18) and [START_REF] Shida | Intergranular oxidation and internal void formation in Ni-40% Cr alloys[END_REF] shows in Figure 8 that the most appropriate rate limiting step to describe the observed changes of the maximum rate of CO consumption (point B) as a function of water and carbon monoxide partial pressures is the CO dissociation (reaction [START_REF] Cabet | High temperature reactivity of two chromium-containing alloys in impure helium[END_REF] with equation ( 18)).

Water vapour, which was responsible for more than 90% of oxidation, decreased the coverage in free sites θ s on the outer oxide surface which resulted in decreasing the amount of dissociated carbon monoxide per unit time on the surface of the oxide layer (Figure 8). This competition between H 2 O and CO on adsorption sites was also observed by Anghel et al. when studying CO dissociation on chromium oxide [START_REF] Anghel | Gas phase analysis of CO interactions with solid surfaces at high temperatures[END_REF]. Indeed, they observed that CO dissociation decreased by increasing the partial pressure of water in the gas phase. They concluded that H 2 O had a higher tendency for molecular adsorption than CO and, as a consequence, blocked reaction surface centers for CO reaction. Our results confirmed their results.

Modelling of the H 2 O consumption kinetics

Since the total mass gain measured by thermobalance was due to reaction with H 2 O for more than 90% whatever the CO partial pressure in impure helium, the total mass gain measured by thermobalance could be considered to characterize the reaction of the sample with H 2 O. As a consequence, Figure 7 shows that the oxidation rate by H 2 O looks parabolic which means that the rate limiting step was probably diffusional. However, as reminded by several authors [START_REF] Wouters | Thermal oxidation of titanium by water vapour[END_REF][START_REF] Monceau | Determination of parabolic rate constants from a local analysis of mass-gain curves[END_REF][START_REF] Deal | General Relationship For Thermal Oxidation Of Silicon[END_REF][27], the growth of an oxide layer controlled by pure diffusional process is generally a borderline case and it is most common to obtain kinetics that deviates slightly from theoretical behaviour especially in case of very thin oxide films. Mixed kinetic law introducing both a diffusion step (k p ) and an interfacial step (k l ) is generally more appropriate to define the growth of an oxide layer [START_REF] Wouters | Thermal oxidation of titanium by water vapour[END_REF][START_REF] Monceau | Determination of parabolic rate constants from a local analysis of mass-gain curves[END_REF][START_REF] Deal | General Relationship For Thermal Oxidation Of Silicon[END_REF][27]. After several assumptions and calculi (see Appendix A), the mixed kinetic law could be written as following:

2 Am Bm C t + + = (20)
where the values of parameters A, B and C given in the second-order polynomial expression are shown in Table A.1 (Appendix A).

The fitting of the experimental curves by equation (20) with A and B forced to be positive constants (C can be either positive or negative) was satisfying only in the oxidation test carried out under low water vapor partial pressure (4 µbar, Figure 9). The values of A, B and C were in that case equal to 116230, 11762 and 106.43 respectively. When the partial pressure of water was higher, typically 21 µbar, B was found to be null (in order to obtain the best fit for the experimental curve) which meant that, in that case, the interfacial rate constant k l was far higher than the parabolic rate constant k p and thus the oxidation rate follows the parabolic law.

As a consequence, with this kinetic model, the growth of the oxide layer under 4 µbars water vapour would be controlled by a mixed kinetic regime with a diffusion and interfacial step. In that case, the k p value and the k l value were found to be equal to 8,6.10 -6 mg.cm -4 .min -1 and 8.5.10 -5 mg.cm -2 .min -1 respectively. At H 2 O partial pressures higher than 21 µbars, the kinetics could be considered as purely diffusional. The transition between these two kinetic models as a function of the water vapour content implies first, that the rate limiting interfacial step was dependent on the amount of water vapour and secondly, that the rate of the interfacial reaction increased rapidly with the amount of water vapour so that it was no longer limiting the growth of the oxide layer at high content of water vapour. This effect was only true in the first time of oxidation when the first tens or hundreds of nanometers of the oxide layer were built. The variation of the parabolic constant (k p ) determined from the mixed kinetic model as a function of water vapour content is presented in Figure 10. Despite a poor reproducibility, it can be inferred that the parabolic constant does not vary with H 2 O partial pressure.

On the contrary of k p variations with H 2 O partial pressures, the linear rate constant k l was found to increase significantly (Figure 11).

In order to write the proper reaction mechanism describing the external growth of the oxide layer on alloy 617, the dominant point defect in the oxide layer should be determined. For outwards oxide growth (Figure 4), two defects must be considered: chromium vacancy (V Cr ) and chromium interstitial (Cr i ). On one hand, if the main defect was chromium vacancy, the parabolic rate constant would depend on the partial pressure of water since the interface of formation would be at the oxide/gas interface [START_REF] Sarrazin | Les mécanismes de la corrosion sèche. Une approche cinétique[END_REF]. On the other hand, if the main defect was chromium interstitial, the parabolic rate constant would not depend on the partial pressure of water since the interface of formation would be at the oxide/metal interface [START_REF] Sarrazin | Les mécanismes de la corrosion sèche. Une approche cinétique[END_REF]. These two cases are represented in Figure 12.

Since it was observed that the parabolic rate constant did not depend on the partial pressure of water (Figure 10), the main point defect responsible for the outward oxide growth was most likely interstitial chromium ions.

The growth mechanism of the oxide layer assumed to be chromia could be divided into four basic steps which are schematized in Figure 13: • The surface steps associated to water adsorption and hydrogen desorption at Cr 2 O 3 surface (external surface steps)

The possible reactions of water adsorption on the oxide layer surface were detailed previously through reaction

(3) to ( 6).

• The formation of interstitial chromium cations at the metal/oxide interface (internal interfacial step).

When chromium metal was incorporated into the oxide as Cr i °°° (according to the Kroger-Vink notation [START_REF] Kroger | Relations Between The Concentrations Of Imperfections In Crystalline Solids[END_REF]), a vacancy wascreated in the underlying metal and electrons were injected for electrical neutrality.

The reaction could be written as following:

( ) ( ) ( ) k X ••• X 21 Cr i Cr int alloy Cr Cr + V + 3e' alloy → (21)
Considering that the activity of point defects in the oxide layer was equal to their concentration, 21 eq K could be rewritten as:

Then, the vacancy condensation induced void formation under the oxide layer according to the following reaction:

It would explain the observations of voids below oxide layer in Erreur ! Source du renvoi introuvable..

• The outwards diffusion of chromium interstitials through the oxide layer.

Interstitial chromium cations diffused from the metal/oxide interface to the gas/oxide interface.

This step represents the only diffusion process in the oxidation mechanism.

• The reaction of chromium interstitial with adsorbed oxygen at the gas/oxide interface to form a new oxide unit cell (external interfacial reaction).

The global oxidation reaction of alloy 617 by water ( 29 . . '

X i Cr int alloy eq Cr Cr V e K a •••         = (23) ( ) k X 24 Cr alloy n V null ( voids) → → (24)
with

24 1 1 ( ) [ ] n eq X Cr alloy K V = (25) ( ) ( ) ••• ••• i i int ext Cr > Cr L (26) ( ) ( ) ( ) k ••• X X 27 i Cr O ext 2 Cr + 3O-s + 6e' 2 Cr + 3 O + 3s oxide oxide → (27)
[ ]

3 27 . s eq. 2 6 ••• O-s i ext θ 1 avec K = θ Cr . e'           (28)

Rate of the diffusion step

From the oxidation mechanism proposed above, the only diffusion step was the diffusion of chromium interstitials from the metal/oxide interface to the gas/oxide interface.

Its rate could be expressed as following:

where D Cr °°° is the chromium diffusion coefficient in the oxide layer, X(t) the oxide layer thickness and S, the oxide area that is taken equal to 1 cm 2 .

Photoelectrochemical measurements of the chromium rich oxide conductivity formed on alloy 617 have shown that the semi-conductivity was n-type which means electrons were the predominant electronic species. Work on model alloys with the same composition as alloy 617 with and without titanium have shown that titanium dissolved in the chromium rich oxide layer and that its semi-conductivity changed from p-type to n-type [START_REF] Chapovaloff | Etude des mécanismes de corrosion de l'Inconel 617 dans le circuit des Réacteurs à Haute Température refroidis par l'hélium[END_REF].

This in good accordance with previous results concluding that titanium (+4) dissolved in chromia adds excendentary mobile electrons [START_REF] Holt | Electrical conductivity of Cr2O3 doped with TiO2[END_REF]. As a consequence, we considered the following Brouwer approximation for the electroneutrality conservation equation in the oxide layer : By expressing 21) and ( 24) and combining Eq. ( 31) with Eq. (32), the expression of the diffusion rate becomes:

••• i int Cr     from steps (
Finally, by combining Eq. (33) and Eq. (A.2) (see Appendix A), it results that the parabolic kinetic constant did not depend on the partial pressure of water:

( ) ( ) ( ) X X X
P 1 K = . K .K .K .K . K . K .K a P   =       (30)
••• i ••• dif. i int Cr D v = . Cr .S X(t)     (31)
• Cr

[e']= Ti     (32) ( ) ( ) ( ) 21 24 ' 3
. ]

••• i 1/n dif eq. eq. Cr alloy Cr Cr S . D v = . K . K a X(t).[Ti (33) ( ) ( ) ( ) ' 3 ] ••• i 1/n 21 24 p
eq. eq.

Cr alloy Cr Cr 2m . S . D k = . K . K . a X(t).[Ti (34) This result is in good agreement with what was observed experimentally in Figure 10.

Rate of the interfacial step

The variation of the linear rate constant k l with the partial pressure of water that was observed experimentally indicates that the rate limiting step must have occurred at the gas/oxide interface. Since the adsorption step was not rate limiting neither for CO nor for H 2 O (it is not possible to get such dependency law by considering only steps (3) to ( 6) or ( 7) to ( 9)), the rate limiting step was likely to be the interfacial step (35) which corresponds to the formation of an oxide unit cell:

( ) ( ) ( ) k ••• X X 11 i Cr O ext 2 Cr + 3O-s + 6e' 2 Cr + 3 O + 3s oxide oxide → (35) ( ) ( ) 3 2 ' 6 5 6 7 8 7 5 7 8
] . . .

.

P α = K . K . K . K = P K K P K K β γ β γ •••             +     = + (36)
From Eq. (36), in order to observe an increase of the oxidation rate with the water partial pressure, one should

consider that β >> 2 H O. P γ ,
With such an approximation, the interfacial reaction rate becomes:

As shown in Eq. ( 37), the interfacial reaction rate is a cubic function of P H2O which is in good agreement with the experimental observations shown in Figure 14.

It is now interesting to compare the rates (calculated from the k l and k p constants) that would be observed if the oxidation was controlled only by one of the two steps, diffusion or interfacial reaction.

By representing on the same plot the change in, both, the diffusion rate of interstitial chromium Eq. (33) and the rate of formation of a chromia unit cell Eq. (37), two distinct kinetic behaviours can be observed depending on the water partial pressure value. On one hand, at high partial pressure of water (higher than 10 µbar), the diffusion rate of chromium interstitial has the lower value at any time (Figure 15). As a consequence, the oxidation rate of alloy 617 would be well described by a parabolic kinetics as observed experimentally.

On the other hand, when exposed to a low partial pressure of water, and up to 10 µbar, the interfacial reaction at the gas/oxide interface between adsorbed oxygen and chromium is slower than the diffusion rate of chromium in ( )

3 2 ' 6 35 ] .
. .

H O 2 35 Cr i ext H 2 P .α v = k .[Ti Cr P β •••         (37)
the first twelve hours of oxidation (Figure 16). Nevertheless, with the oxide thickening, the rate of chromium diffusion through the oxide layer decreases progressively to become roughly equal to the interfacial reaction rate after roughly 12 hours. In that case the oxidation kinetics in the first hours of oxidation is well described by a mixed regime as observed experimentally in Figure 9. The lower the water partial pressure in impure helium, the longer is the time at which the interfacial reaction impacts on the oxidation kinetics. After about hundred hours, diffusion of cations becomes the rate limiting step and parabolic growth rate is observed.

Conclusions

Oxidation tests of alloy 617 at 850°C for 20h under impure helium with 130 vpm H 2 and variable partial pressures of water and carbon monoxide showed that there was a competition between CO and H 2 O for oxidizing the material. To react, the CO partial pressure in helium had to be much higher than the water partial Whatever the helium composition, the oxidation kinetics was well defined by considering the outward diffusion of interstitial chromium cations in the oxide layer. In that case, the long-term oxidation rate was found not to depend on the H 2 O partial pressure in helium.

Substrate grain boundary

  ) was obtained by the linear combination of the different reaction steps as following: 3*reaction (3) + 3*reaction (4) + 3*reaction (5) + 3*reaction (6) + 2*reaction (21) + 2*reaction (24) + (S27), which results in:

Figure 1 :

 1 Figure1: Scheme of the experimental facility used for carrying out the oxidation test in well-controlled CO-H 2 -H 2 O mixture in helium and measuring the gas reactions and the mass gain increase[START_REF] Chapovaloff | Assessing the kinetics of high temperature oxidation of Inconel 617 in impure helium by coupling TGA and GPC analysis[END_REF].

Figure 2 :

 2 Figure 2: Evolution of the gas phase content (H 2 O, H 2 and CO) and mass gain during the oxidation test He-14CO-130H 2 -4H 2 O for 20 hrs at 850°C measured between inlet 2 and inlet 3 (Figure 1).

Figure 3 :

 3 Figure 3: Experimental mass gain (m(exp)) compared to the total mass gain calculated from H 2 production (Reaction (1)) and CO consumption (Reaction (2)) measured by GPC during corrosion test at 850°C for 20 hrs under He-14CO-130H 2 -4H 2 O.

Figure 4 :

 4 Figure 4 : FESEM images of Alloy 617's cross section and Alloy 617's surface after corrosion test at 850°C for 20h under He-14CO-130H 2 -4H 2 O.

Figure 5 :

 5 Figure 5 : Evolution of the CO consumption rate as a function of time in corrosion tests with different CO amount in He-130H 2 -5H 2 O.

Figure 6 : 2 Figure 7 :

 627 Figure 6: Maximum CO consumption rate as a function of water partial pressure in He-14CO-130H 2Figure 7 : Mass gain of alloy 617 measured by thermobalance as a function of time for different water content in He-14CO-130H 2 .

Figure 8 :

 8 Figure 8 : Variation of the maximum CO consumption rate as a function of CO partial pressure (a) and as a function of water partial pressure (P CO = 15 µbar) (b) in impure helium and fitting curves by Eq. (19).

Figure 9 :

 9 Figure 9 : Mass gain due to the reaction of 4 µbar H 2 O with alloy 617 as a function of time fitted by (a) the parabolic law and (b) the complete parabolic law. In case (b), k p and k l are found to be equal to 8.6 10 -6 mg 2 /cm 4 /min and 8.5 10 -5 mg/cm 2 /min respectively.

Figure 10 :

 10 Figure 10 : Variation of the diffusional rate constant k p as function of water partial pressure.

Figure 11 :

 11 Figure 11: Variation of the interfacial rate constant k l as function of water partial pressure.

Figure 12 :

 12 Figure 12 : Point defects which could be formed when considering outwards chromium rich oxide layer.

Figure 13 :Figure 14 :Figure 15 :Figure 16 : 5 Figure 1 ( 1 Figure 2 Figure 3 Figure 4

 13141516511234 Figure 13: Scheme of the oxidation mechanism of alloy 617 by H 2 O in impure helium with the different reaction steps Figure 14: Experimental values of k l as a function of P H2O and its fitting by Eq. (37) Figure 15 : Comparison between the rate of interfacial reaction and the rate of diffusion involved in the oxidation of alloy 617 in He-15CO-130H 2 with 21H 2 O. k l = 1.4. 10 -6 *(21) 3 = 0.013 Figure 16 : Comparison between the rate of interfacial reaction and the rate of diffusion involved in the oxidation of alloy 617 in He-15CO-130H 2 with 4H 2 O. k l = 1.4. 10 -6 *(4) 3 = 9 10 -5

Figure 7 Figure 8

 78 Figure 7

H 2 O

 2 Figure 9

Figure 15 Figure 16

 1516 Figure 15

  pressure. It is concluded that the adsorption of H 2 O and CO molecules occurs on the same sites and that H 2 O is more strongly adsorbed than CO on the Cr 2 O 3 surface. As a consequence, the higher water partial pressure, the lower surface reaction sites available for CO.After a transient time (about a few hours) which corresponds probably to the time for growing a complete homogeneous oxide layer on the alloy surface, H 2 O becomes the only molecule to oxidize the surface. By analyzing the variations of H 2 O and CO consumption rates with time, a reaction mechanism for each molecule could be proposed and compared to experimental kinetic data. By taking several assumptions, it was found that, at a water partial pressure below 10 µbar, the oxidation kinetic regime by H 2 O was mixed with an interfacial and a diffusional reaction. The interfacial step was only rate limiting in the first tenths hours of oxidation. At higher H 2 O partial pressures, the kinetic regime was only diffusional from the very beginning of the exposure.

Table 1

 1 Alloy composition (wt %)

			Ni	Cr	Co Mo Al Fe Mn Si	C
	Alloy 617	1	Bal 21.6 12.0 9.2 1.0 1.0 0.1 0.2 0.06

Table 2

 2 Reaction steps for adsorption and dissociation of H 2 O and CO with k i the constant rates of the elemental semi

							reaction and	K	i eq.	the equilibrium constant of reaction step i.
		Semi reaction			Equilibrium constant
	2 H O + s	k 3  →	2 H O -s			(3)	3 eq. K =	θ s θ .P H O-s 2 2 H O	(10)
	2 H O-s + s		k 4  →	HO-s + H-s			(4)	4 eq. K =	HO-s s θ .θ θ	H O-s 2 H-s .θ	(11)
	2H-s	k 5  →	2 H + 2s			(5)	5 eq. K = P H	2 . s H-s θ θ   	  	2	(12)
	HO-s + s	k 6  →	H-s + O-s			(6)	6 eq. K =	O-s s θ θ HO-s H-s . θ .θ	(13)
		Semi reaction			Equilibrium constant
	CO + s	k 7  →	CO-s			(7)	7 eq. K =	CO-s CO θ s θ .P	(14)
	CO-s	k 8 +  → s	C-s + O-s			(8)	8 eq. K =	C-s s CO-s O-s . θ θ θ .θ	(15)
	C-s	k 9  →	C + s			(9)	9 eq. K =	s θ a C-s C . θ	(16)

Table 3

 3 Reaction steps of CO reaction describing a decrease in CO consumption when the partial pressure of H 2 O increases or when the partial pressure of CO reduces.By writting θs as a function of the equilibrium constants of the other elemental steps and by using equation 8

	CO + s	k 7  →	CO-s
	. . 7 s CO v = k 7 P θ

α = K .K . K .P β = K .P . α P + K .K + K . K . P a γ= K . K . P K . P + a

Table A . 1

 A1 A, B and C values in the kinetic law Am 2 + Bm + C = t k p : parabolic rate constant k l : linear rate constant t* and m* are the initial conditions and account for the transient oxidation period of non parabolic kinetics : after t*, m=m*

	A	B		C
	p 1 k	l 1 k	t	l m m k k	2 p

Acknowledgements

The authors would like to thank AREVA NP for financial supports.


Moral hazard issues can deter profitable investments in energy efficiency. Energy-savings insurance and quality standards can mitigate the problem -yet not eliminate it.

Article (1719 words)

Are we missing opportunities for profitable investments in energy efficiency? As Adam Jaffe and Robert Stavins made clear in an influential paper in 1994, the answer could very well be 'yes,' provided that one can prove such investments are subject to market failures. Since then, economic analysis has sought to identify and quantify market failures that induce an 'energy efficiency gap,' i.e., a suboptimal level of energy efficiency investment.

In an ongoing project, we contribute to this line of research by examining information asymmetries, a classic market failure that has received little attention in the energy efficiency literature. This article summarizes early results, focusing on moral hazard issues and policy solutions to address them. It takes a broad perspective in which interactions between moral hazard and other market failures, such as environmental externalities, as well as other market barriers to energy efficiency (e.g., consumer heterogeneity) are taken into account.

How moral hazard can affect energy efficiency decisions

Moral hazard problems arise when one or several contracting parties take actions that are not fully observable to the others, but impact the final outcomes of the transaction. Such a situation is common in the context of energy retrofits for buildings. Our first result shows that when the actions of the contractors (i.e., installers of energy-saving technologies) are not fully observable, contractors will underprovide quality, and opportunities for further energy savings will be left untapped.

Consider a homeowner willing to insulate the walls in her house. She might be motivated by reducing her heating bill and, perhaps, by ancillary attributes unrelated to energy, such as cosmetic makeover or acoustic absorption. Suppose that the homeowner cannot perfectly observe the energy saving performance of the job completed by the contractor. That is, she does not have the technical skills to judge whether the insulation panels have been properly connected, although she is aware that any such defect will deter the thermal performance of the installation. Anticipating that the contractor is aware of her limitations, she will expect him to save on installation costs and perform the job poorly.

Any claim that he will provide the highest quality, enabling her to maximize energy savings, will be considered 'cheap talk' by the homeowner. We show that the contractor will not deviate from these expectations and indeed complete the lowest possible quality job. Absent policy intervention, quality will not be contractible and thus underprovided. This conclusion holds irrespective of the structure of the market, from a competitive industry with free entry, which is the most likely case [START_REF] Zabin | Chapter Four: Case studies of the HVAC, residential retrofit, and commercial lighting controls sectors[END_REF], to a monopolistic industry.

Were energy performance perfectly observable, the homeowner would demand the level of installation quality that reduces her marginal energy expenditure up to the marginal benefit she derives from space heating. Outside this condition, the contractor does not internalize the benefits his actions provide to the homeowner and a wedge arises between social and private surplus. The wedge gets larger if, in addition to the moral hazard, one considers the environmental externalities associated with energy consumption.

Such quality problems might be substantial and affect any energy end-use technology for which installation is a significant input, such as HVAC systems or window replacements. As of 2008, only 15% of central air conditioning installations in existing dwellings met satisfactory quality specifications in California (Messenger, 2008). In the commercial sector, where retrofit projects are deployed over a large scale, the gap can be sizeable. Overall, the energy savings that would thereby remain untapped could be around two quadrillion end-use BTUs. This is a lower bound of the contribution of building shell and HVAC system improvement in existing buildings to the technical potential for energy efficiency in the U.S. by 2020, as assessed by McKinsey&Co. (2009).

Government intervention: Conditions, instruments and efficiency

A natural conclusion to the demonstration that the moral hazard induces an energy efficiency gap is that some government intervention is justified. We show, contrary to normal intuition, that addressing a moral hazard might not always be warranted in a world with large environmental externalities.

Internalizing environmental externalities is always desirable, regardless of whether or not the contracting parties overcome the moral hazard. Social welfare cannot be maximized as long as the parties do not account for the broader externalities produced by their actions. However, the reciprocal is not necessarily true: If environmental externalities are not (or cannot be) internalized, then it might be desirable to maintain, rather than undo, the moral hazard. Though unlikely, this can actually occur if the 'rebound effect' (i.e. the elasticity of the demand for energy service with respect to energy efficiency) is beyond a certain level, which can be derived analytically. In this case, if solving the moral hazard leads to noticeable improvements in energy efficiency, then energy consumption could actually increase. As a result, environmental externalities would be larger.

Notwithstanding this extreme and rare 'backfire' situation, we can consider that environmental externalities are internalized through energy price, so that we only need to worry about the moral hazard. Now, what policy instrument can fix it?

A social planner would like to get the contractor to provide the optimal level of quality and the homeowner to consume the optimal quantity of energy service. This could be achieved by a quality standard forcing the contractor to offer the level of quality that is optimal to a representative consumer. Yet such an instrument suffers from the classic criticism that it abstracts from heterogeneity in consumer valuation of energy service. Take, for instance, an owner who visits her vacation home infrequently, thus consuming little heat there. The price of a high quality retrofit to save energy would be in excess of what is optimal to her. Now if the stringency of the standard is below what would be optimal to the consumer, as long as performance remains unobservable to her, the contractor will not offer more than the standard.

Besides regulatory instruments, one might think of incentive-based mechanisms. Energy-savings insurance, whereby the contractor bears a share of the consumer's energy bill (perhaps above a certain threshold), is one example. Such a contract, however, is subject to a second moral hazard: Lowering the marginal energy expenditure to the consumer decreases her marginal benefit. She may increase her consumption of energy service by setting her thermostat to a higher temperature, knowing that the contractor will have to pay some of the cost. The contractor would provide optimal quality if he fully insured the savings to minimize insurance payouts, but energy service would be consumed optimally by the consumer were she not insured. As a result, the only insurance that can be sustained in equilibrium features incomplete coverage and only brings about a second-best outcome.

In the end, in such context where both parties can take hidden actions, the only way to bring about the first-best outcome is to involve a perfectly informed third-party (perhaps with the help of a smart meter). This is very unlikely to be implemented, however, as it would incur prohibitive transaction costs.

The instruments described are already available in the marketplace. Various types of quality certifications exist, most notably those provided by the Building Performance Institute (BPI) and the Residential Energy Services Network (RESNET). Likewise, energy-savings insurance has been present in the commercial sector for about twenty years [START_REF] Mills | Risk transfer via energy-savings insurance[END_REF], and has started to appear in the residential sector (see for instance Green Homes America). As normative analysis just showed, these instruments cannot fully establish economic efficiency. This does not mean, however, that they cannot improve welfare.

Assigning numbers: Size of the gap and policy effectiveness

To get a sense of the magnitude of the problems studied, we have developed an analytical model of insulation sales that is calibrated to the U.S. market. Numerical assumptions are detailed in Box 1.

BOX 1

We find that social welfare (measured as the sum of consumer's utility and firm's profit) derived from space heating consumption could be doubled, were both moral hazard and energy externalities fixed. Simply undoing the moral hazard closes about two-thirds of the gap. The results are displayed in Figure 1 in a Jaffe & Stavins-like 'energy efficiency gap diagram' (welfare vs. energy efficiency), as well as in an 'energy gap diagram' (welfare vs. energy consumption).

FIGURE 1

When it comes to policy instruments, quality standards of different stringencies (each based on what would be optimal for one specific representative consumer) will yield different welfare improvements. Yet one level could bring society remarkably close to the first-best outcome. Comparatively, energy-savings insurance achieves lower welfare gains on average. Still, those can be non-negligible in absolute value, amounting to 15% of the welfare enjoyed in the laissez-faire situation. This is achieved through optimal insurance coverage as low as 13% on average. These results are displayed in Figure 2.

Conclusions

Our analysis suggests that moral hazard can induce a significant energy efficiency gap. This insight is relatively new. Most of the literature has concluded that it was hard to find market failure explanations for the abnormally high implicit discount rates observed in energy efficiency decisions, which can be seen as a manifestation of the energy efficiency gap [START_REF] Gillingham | Energy Efficiency Economics and Policy[END_REF][START_REF] Allcott | Is There an Energy Efficiency Gap?[END_REF]. While these studies have focused on the role of possible undervaluation of energy efficiency by consumers, ours underlines that the behavior of the firms should not be excluded from the analysis.

In terms of policies to address moral hazard, we show that the first-best outcome can only be attained to the extent that energy performance can be made perfectly observable. Since no technology can meet that goal, government intervention will only generate a second-best outcome, even though it can get very close to the first-best. Our numerical simulations suggest that the various types of quality certifications already implemented may be worthwhile, although more empirical support is needed to determine whether they are set at satisfactory stringency levels and what administrative costs they incur. Energy-savings insurance may not perform as well as quality standards. Still, even with modest coverage insurance products could deliver welfare gains that should not be disregarded. This is perhaps itself a paradox that firms in constant search of new marketing strategies have not relied more heavily on such schemes.

BOX 1

A homeowner of median income is assumed to live in a house of average size. She consumes natural gas for space heating with a price-elasticity of -0.8 and responds to energy efficiency improvements with a 20% rebound effect (which is below the 'problematic' range mentioned in the text). When considering an insulation project, she discounts future energy expenditures over ten years (which is close to the duration of either average house occupancy or energy-savings insurance contracts), at a 7% discount rate and using a constant natural gas price of $12 per thousand cubic feet. She contracts with an insulation contractor who allocates three installers a day. Job completion takes at least one full day. At this input level, job is sold $2,400 and expected energy savings are 5%. Performance increases as installers work longer and mobilize higher skills, up to 25% for three-day operation. Workers are paid $5 an hour at the end of the first day and wages escalate to $30 at the end of the third day. From a social perspective, it is assumed that energy consumption produces, over 30 years (which is the physical lifetime of energy efficiency investments), CO 2 emissions that cause damages worth $30/tCO 2 in constant annual present value.

FIGURE 2

 2 FIGURE 2

  FIGURE 1

Precourt Energy Efficiency Center (PEEC), Stanford University, and Centre international de recherche sur l'environnement et le développement (CIRED), Ecole des Ponts ParisTech

Department of Management Science and Engineering, Stanford University

Double Moral Hazard and the Energy Efficiency Gap

Louis-Gaëtan Giraudet 1 , Sébastien Houde 2 Submission for the Winter issue of the IAEE 'Energy Forum' newsletter, which will focus on energy efficiency.


M Cunche

A Bouabdallah

Cdta K Matsuzono

Task Force (IETF) V. Roca Request for Comments: 6865 INRIA Category: Standards Track

This document describes a fully-specified simple Forward Error Correction (FEC) scheme for Reed-Solomon codes over the finite field (also known as the Galois Field) GF(2^^m), with 2 <= m <= 16, that can be used to protect arbitrary media streams along the lines defined by FECFRAME. The Reed-Solomon codes considered have attractive properties, since they offer optimal protection against packet erasures and the source symbols are part of the encoding symbols, which can greatly simplify decoding. However, the price to pay is a limit on the maximum source block size, on the maximum number of encoding symbols, and a computational complexity higher than that of the Low-Density Parity Check (LDPC) codes, for instance.

Introduction

The use of the Forward Error Correction (FEC) codes is a classic solution to improve the reliability of unicast, multicast, and broadcast Content Delivery Protocols (CDP) and applications. [START_REF] Watson | Forward Error Correction (FEC) Framework[END_REF] describes a generic framework to use FEC schemes with media delivery applications, and for instance with real-time streaming media applications based on the Real-time Transport Protocol (RTP). Similarly, [START_REF] Watson | Forward Error Correction (FEC) Building Block[END_REF] describes a generic framework to use FEC schemes with object delivery applications (where the objects are files, for example) based on the Asynchronous Layered Coding (ALC) [START_REF] Luby | Asynchronous Layered Coding (ALC) Protocol Instantiation[END_REF] and NACK-Oriented Reliable Multicast (NORM) [START_REF] Adamson | NACK-Oriented Reliable Multicast (NORM) Transport Protocol[END_REF] transport protocols.

More specifically, the [START_REF] Luby | Raptor Forward Error Correction Scheme for Object Delivery[END_REF] and [START_REF] Roca | Low Density Parity Check (LDPC) Staircase and Triangle Forward Error Correction (FEC) Schemes[END_REF] FEC schemes introduce erasure codes based on sparse parity-check matrices for object delivery protocols like ALC and NORM. These codes are efficient in terms of processing but not optimal in terms of erasure recovery capabilities when dealing with "small" objects.

The Reed-Solomon FEC codes described in this document belong to the class of Maximum Distance Separable (MDS) codes that are optimal in terms of erasure recovery capability. It means that a receiver can recover the k source symbols from any set of exactly k encoding symbols. These codes are also systematic codes, which means that the k source symbols are part of the encoding symbols. However, they are limited in terms of maximum source block size and number of encoding symbols. Since the real-time constraints of media delivery applications usually limit the maximum source block size, this is not considered to be a major issue in the context of FECFRAME for many (but not necessarily all) use cases. Additionally, if the encoding/ decoding complexity is higher with Reed-Solomon codes than it is with [START_REF] Luby | Raptor Forward Error Correction Scheme for Object Delivery[END_REF] or [START_REF] Roca | Low Density Parity Check (LDPC) Staircase and Triangle Forward Error Correction (FEC) Schemes[END_REF] codes, it remains reasonable for most use cases, even in case of a software codec.

Many applications dealing with reliable content transmission or content storage already rely on packet-based Reed-Solomon erasure recovery codes. In particular, many of them use the Reed-Solomon codec of Luigi Rizzo [RS-codec] [START_REF] Rizzo | Effective Erasure Codes for Reliable Computer Communication Protocols[END_REF]. The goal of the present document is to specify a simple Reed-Solomon scheme that is compatible with this codec. More specifically, [START_REF] Lacan | Reed-Solomon Forward Error Correction (FEC) Schemes[END_REF] introduced such Reed-Solomon codes and several associated FEC schemes that are compatible with the [START_REF] Watson | Forward Error Correction (FEC) Building Block[END_REF] framework. The present document inherits from Section 8 of [START_REF] Lacan | Reed-Solomon Forward Error Correction (FEC) Schemes[END_REF], "Reed-Solomon Codes Specification for the Erasure Roca, et al.

Standards Track [Page 4] RFC 6865

Simple Reed-Solomon FEC Scheme February 2013

Channel", the specifications of the core Reed-Solomon codes based on Vandermonde matrices and specifies a simple FEC scheme that is compatible with FECFRAME [START_REF] Watson | Forward Error Correction (FEC) Framework[END_REF]:

The Fully-Specified FEC Scheme with FEC Encoding ID 8 specifies a simple way of using of Reed-Solomon codes over GF(2^^m), with 2 <= m <= 16, in order to protect arbitrary Application Data Unit (ADU) flows.

Therefore, Sections 4, 5, 6, and 7 of [START_REF] Lacan | Reed-Solomon Forward Error Correction (FEC) Schemes[END_REF] that define [START_REF] Watson | Forward Error Correction (FEC) Building Block[END_REF]-specific Formats and Procedures are not considered and are replaced by FECFRAME-specific Formats and Procedures.

For instance, with this scheme, a set of Application Data Units (ADUs) coming from one or several media delivery applications (e.g., a set of RTP packets), are grouped in an ADU block and FEC encoded as a whole. With Reed-Solomon codes over GF(2^^8), there is a strict limit over the number of ADUs that can be protected together, since the number of encoded symbols, n, must be inferior or equal to 255. This constraint is relaxed when using a higher finite field size (m > 8), at the price of an increased computational complexity.

Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].

Definitions Notations and Abbreviations

Definitions

This document uses the following terms and definitions. Some of these terms and definitions are FEC scheme specific and are in line with [START_REF] Watson | Forward Error Correction (FEC) Building Block[END_REF]:

Source symbol: unit of data used during the encoding process. In this specification, there is always one source symbol per ADU.

Encoding symbol: unit of data generated by the encoding process. With systematic codes, source symbols are part of the encoding symbols.

Repair symbol: encoding symbol that is not a source symbol. FEC Source Packet: At a sender (respectively, at a receiver) a payload submitted to (respectively, received from) the transport protocol containing an ADU along with an Explicit Source FEC Payload ID (that must be present in the FEC scheme defined by the present document, see Section 5.1.2).

FEC Repair Packet: At a sender (respectively, at a receiver) a payload submitted to (respectively, received from) the transport protocol containing one repair symbol along with a Repair FEC Payload ID and possibly an RTP header.

The above terminology is illustrated in Figure 1 (sender's point of view): --------------------- --------------------- --------------------- ---------------------+ Figure 1: Terminology used in this document (sender).

+----------------------+ | Application | +-
+ | | (1) Application Data Units (ADUs) | v +----------------------+ +----------------+ | FECFRAME | | | | |-------------------------->| FEC Scheme | |(2) Construct source |(3) Source Block | | | blocks | | (

Notations

This document uses the following notations. Some of them are FEC scheme specific. k denotes the number of source symbols in a source block. GF(q) denotes a finite field (also known as the Galois Field) with q elements. We assume that q = 2^^m in this document. m defines the length of the elements in the finite field, in bits. In this document, m is such that 2 <= m <= 16.

q defines the number of elements in the finite field. We have: q = 2^^m in this specification.

CR denotes the "code rate", i.e., the k/n ratio. a^^b denotes a raised to the power b. This section introduces the procedures that are used during the ADU block and the related source block creation for the FEC scheme considered.

Restrictions

This specification has the following restrictions: o there MUST be exactly one source symbol per ADUI, and therefore per ADU; o there MUST be exactly one repair symbol per FEC Repair Packet; o there MUST be exactly one source block per ADU block.

ADU Block Creation

Two kinds of limitations exist that impact the ADU block creation:

o at the FEC Scheme level: the finite field size (m parameter) directly impacts the maximum source block size and the maximum number of encoding symbols; o at the FECFRAME instance level: the target use case can have realtime constraints that can/will define a maximum ADU block size.

Note that terms "maximum source block size" and "maximum ADU block size" depend on the point of view that is adopted (FEC Scheme versus FECFRAME instance). However, in this document, both refer to the same value since Section 4.1 requires there is exactly one source symbol per ADU. We now detail each of these aspects.

The finite field size parameter m defines the number of non-zero elements in this field, which is equal to: q -1 = 2^^m -1. This q -1 value is also the theoretical maximum number of encoding symbols that can be produced for a source block. For instance, when m = 8 (default) there is a maximum of 2^^8 -1 = 255 encoding symbols. So: k < n <= 255. Given the target FEC code rate (e.g., provided by the end-user or upper application when starting the FECFRAME instance, and taking into account the known or estimated packet loss rate), the sender calculates: This max_k value leaves enough room for the sender to produce the desired number of repair symbols. Since there is one source symbol per ADU, max_k is also an upper bound to the maximum number of ADUs per ADU block.

The source ADU flows can have real-time constraints. When there are multiple flows, with different real-time constraints, let us consider the most stringent constraints (see [START_REF] Watson | Forward Error Correction (FEC) Framework[END_REF], Section 10.2, item 6 for recommendations when several flows are globally protected). In that case, the maximum number of ADUs of an ADU block must not exceed a certain threshold since it directly impacts the decoding delay.

The larger the ADU block size, the longer a decoder may have to wait until it has received a sufficient number of encoding symbols for decoding to succeed, and therefore the larger the decoding delay. When the target use case is known, these real-time constraints result in an upper bound to the ADU block size, max_rt.

For instance, if the use case specifies a maximum decoding latency l, and if each source ADU covers a duration d of a continuous media (we assume here the simple case of a constant bit-rate ADU flow), then the ADU block size must not exceed:

max_rt = floor(l / d)
After encoding, this block will produce a set of at most n = max_rt / CR encoding symbols. These n encoding symbols will have to be sent at a rate of n / l packets per second. For instance, with d = 10 ms, l = 1 s, max_rt = 100 ADUs.

If we take into account all these constraints, we find:

max_B = min(max_k, max_rt)
This max_B parameter is an upper bound to the number of ADUs that can constitute an ADU block.

Source Block Creation

In their most general form, FECFRAME and the Reed-Solomon FEC scheme are meant to protect a set of independent flows. Since the flows have no relationship to one another, the ADU size of each flow can potentially vary significantly. Even in the special case of a single flow, the ADU sizes can largely vary (e.g., the various frames of a "Group of Pictures" (GOP) of an H.264 flow will have different sizes). This diversity must be addressed since the Reed-Solomon FEC scheme requires a constant encoding symbol size (E parameter) per source block. Since this specification requires that there is only one source symbol per ADU, E must be large enough to contain all the ADUs of an ADU block along with their prepended 3 bytes (see below).

In situations where E is determined per source block (default, specified by the FFCI/FSSI with S = 0, Section 5.1.1.2), E is equal to the size of the largest ADU of this source block plus 3 (for the prepended 3 bytes; see below). In this case, upon receiving the first FEC Repair Packet for this source block, since this packet MUST contain a single repair symbol (Section 5.1.3), a receiver determines the E parameter used for this source block.

In situations where E is fixed (specified by the FFCI/FSSI with S = 1, Section 5.1.1.2), then E must be greater or equal to the size of the largest ADU of this source block plus 3 (for the prepended 3 bytes; see below). If this is not the case, an error is returned. How to handle this error is use-case specific (e.g., a larger E parameter may be communicated to the receivers in an updated FFCI message using an appropriate mechanism) and is not considered by this specification.

The ADU block is always encoded as a single source block. There are a total of B <= max_B ADUs in this ADU block. For the ADU i, with 0 <= i <= B-1, 3 bytes are prepended (Figure 2 ----------------------------------------------------------------> +----+--------+-----------------------+----------------------------- ---+--------+----------+------------+----------------------------- -------+----------+------------------------------------------ -------+------+---------------------------------------------- -------+------+----------------------------------------------+ \_________________________________ ________________________________/ \/ simple FEC encoding +-------------------------------------------------------------------+ | Repair 4 | +- ------------------------------------------------------------------+ ------------------------------------------------------------------+ Figure 2: Source block creation, for code rate 1/2 (equal number of source and repair symbols; 4 in this example), and S = 0.

+ |F[0]| L[0] | ADU[0] | Pad[0] | +-
+ |F[1]| L[1] | ADU[1] | Pad[1] | +----+-
+ |F[2]| L[2] | ADU[2] | +----+-
+ |F[3]| L[3] |ADU[3]| Pad[3] | +----+-
. . . . +-------------------------------------------------------------------+ | Repair 7 | +-
Note that neither the initial 3 bytes nor the optional padding are sent over the network. However, they are considered during FEC encoding. It means that a receiver who lost a certain FEC source packet (e.g., the UDP datagram containing this FEC source packet) will be able to recover the ADUI if FEC decoding succeeds. Thanks to the initial 3 bytes, this receiver will get rid of the padding (if any) and identify the corresponding ADU flow.

Simple Reed-Solomon FEC Scheme over GF(2^^m) for Arbitrary ADU Flows

This Fully-Specified FEC Scheme specifies the use of Reed-Solomon codes over GF(2^^m), with 2 <= m <= 16, with a simple FEC encoding for arbitrary packet flows.

Formats and Codes

FEC Framework Configuration Information

The FEC Framework Configuration Information (or FFCI) includes information that must be communicated between the sender and receiver(s) [START_REF] Watson | Forward Error Correction (FEC) Framework[END_REF]. More specifically, it enables the o m parameter (m): an integer that defines the length of the elements in the finite field, in bits. We have: 2 <= m <= 16.

These elements are required both by the sender (Reed-Solomon encoder) and the receiver(s) (Reed-Solomon decoder).

When SDP is used to communicate the FFCI, this FEC scheme-specific information MUST be carried in the 'fssi' parameter of the 'fec-repair-flow' attribute, in textual representation as specified in RFC 6364 [START_REF] Begen | Session Description Protocol Elements for the Forward Error Correction (FEC) Framework[END_REF]. For instance: a=fec-repair-flow: encoding-id=8; fssi=E:1400,S:0,m:8

If another mechanism requires the FSSI to be carried as an opaque octet string (for instance after a Base64 encoding), the encoding format consists of the following 3 octets of o m parameter (m): 7-bit field. 0 1 2 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Encoding Symbol Length (E) |S| m | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 3: FSSI encoding format.

Explicit Source FEC Payload ID

A FEC source packet MUST contain an Explicit Source FEC Payload ID that is appended to the end of the packet as illustrated in Figure 4. -------------------------------+ -------------------------------+ | Explicit Source FEC Payload ID | +- ------------------------------- 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Source Block Number (24 bits) | Enc. Symb.

+-

| IP Header | +--------------------------------+ | Transport Header | +--------------------------------+ | ADU | +-

ID | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |

Source Block Length (k) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 5: Source FEC Payload ID encoding format for m = 8 (default). 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 The format of the Source FEC Payload ID for m = 8 and m = 16 are illustrated in Figures 5 and6, respectively.

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-

+-+-+ | Source Block Nb (16 bits) | Enc. Symbol ID (16 bits) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Source Block Length (k) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Repair FEC Payload ID

A FEC repair packet MUST contain a Repair FEC Payload ID that is prepended to the repair symbol(s) as illustrated in Figure 7. There MUST be a single repair symbol per FEC repair packet. -------------------------------+ | IP Header | +--------------------------------+ | Transport Header | +--------------------------------+ | Repair FEC Payload ID | +--------------------------------+ | Repair Symbol | +- ------------------------------- o Encoding Symbol ID (ESI) (m-bit field): this field identifies the repair symbol contained in this FEC repair packet. This value is such that k <= ESI <= n -1 for repair symbols.

+-

o Source Block Length (k) (16-bit field): this field provides the number of source symbols for this source block, i.e., the k parameter. If 16 bits are too much when m <= 8, it is needed when 8 < m <= 16. Therefore, we provide a single common format regardless of m. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Source Block Number (24 bits) | Enc. Symb. ID | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Source Block Length (k) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 8: Repair FEC Payload ID encoding format for m = 8 (default). 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Source Block Nb (16 bits) | Enc. Symbol ID (16 bits) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Source Block Length (k) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ o The FEC repair packet creation MUST follow the procedures specified in Section 5.1.3.

FEC Code Specification

The present document inherits from Section 8 of [START_REF] Lacan | Reed-Solomon Forward Error Correction (FEC) Schemes[END_REF], "Reed-Solomon Codes Specification for the Erasure Channel", the specifications of the core Reed-Solomon codes based on Vandermonde matrices.

Security Considerations

The FECFRAME document [START_REF] Watson | Forward Error Correction (FEC) Framework[END_REF] provides a comprehensive analysis of security considerations applicable to FEC schemes. Therefore, the present section follows the security considerations section of [START_REF] Watson | Forward Error Correction (FEC) Framework[END_REF] and only discusses topics that are specific to the use of Reed-Solomon codes.

6.1. Attacks Against the Data Flow

Access to Confidential Content

The Reed-Solomon FEC Scheme specified in this document does not change the recommendations of [START_REF] Watson | Forward Error Correction (FEC) Framework[END_REF]. To summarize, if confidentiality is a concern, it is RECOMMENDED that one of the solutions mentioned in [START_REF] Watson | Forward Error Correction (FEC) Framework[END_REF] is used with special considerations to the way this solution is applied (e.g., is encryption applied before or after FEC protection, within the end-system or in a middlebox) to the operational constraints (e.g., performing FEC decoding in a protected environment may be complicated or even impossible) and to the threat model. The Reed-Solomon FEC Scheme specified in this document does not change the recommendations of [START_REF] Watson | Forward Error Correction (FEC) Framework[END_REF]. To summarize, it is RECOMMENDED that one of the solutions mentioned in [START_REF] Watson | Forward Error Correction (FEC) Framework[END_REF] is used on both the FEC Source and Repair Packets.

Attacks Against the FEC Parameters

The FEC Scheme specified in this document defines parameters that can be the basis of several attacks. More specifically, the following parameters of the FFCI may be modified by an attacker (Section 5.1.1.2):

o FEC Encoding ID: changing this parameter leads the receiver to consider a different FEC Scheme, which enables an attacker to create a Denial of Service (DoS).

o Encoding symbol length (E): setting this E parameter to a value smaller than the valid one enables an attacker to create a DoS since the repair symbols and certain source symbols will be larger than E, which is an incoherency for the receiver. Setting this E parameter to a value larger than the valid one has similar impacts when S = 1 since the received repair symbol size will be smaller than expected. On the opposite, it will not lead to any incoherency when S = 0 since the actual symbol length value for the block is determined by the size of any received repair symbol, as long as this value is smaller than E. However, setting this E parameter to a larger value may have impacts on receivers that pre-allocate memory space in advance to store incoming symbols.

o Strict (S) flag: flipping this S flag from 0 to 1 (i.e., E is now considered as a strict value) enables an attacker to mislead the receiver if the actual symbol size varies over different source blocks. Flipping this S flag from 1 to 0 has no major consequences unless the receiver requires to have a fixed E value (e.g., because the receiver pre-allocates memory space

Baseline Secure FECFRAME Operation

The Reed-Solomon FEC Scheme specified in this document does not change the recommendations of [START_REF] Watson | Forward Error Correction (FEC) Framework[END_REF] concerning the use of the IPsec/ESP security protocol as a mandatory to implement (but not mandatory to use) security scheme. This is well suited to situations where the only insecure domain is the one over which FECFRAME operates.

Operations and Management Considerations

The FECFRAME document [START_REF] Watson | Forward Error Correction (FEC) Framework[END_REF] provides a comprehensive analysis of operations and management considerations applicable to FEC schemes. Therefore, the present section only discusses topics that are specific to the use of Reed-Solomon codes as specified in this document.

7.1. Operational Recommendations: Finite Field Size (m)

The present document requires that m, the length of the elements in the finite field in bits, is such that 2 <= m <= 16. However, all possibilities are not equally interesting from a practical point of view. It is expected that m = 8, the default value, will be mostly used since it offers the possibility to have small to medium sized source blocks and/or a significant number of repair symbols (i.e., k < n <= 255). Additionally, elements in the finite field are 8 bits long, which makes read/write memory operations aligned on bytes during encoding and decoding. An alternative when it is known that only very small source blocks will be used is m = 4 (i.e., k < n <= 15). Elements in the finite field are 4 bits long, so if 2 elements are accessed at a time, read/ write memory operations are aligned on bytes during encoding and decoding.

An alternative when very large source blocks are needed is m = 16 (i.e., k < n<= 65535). However, this choice has significant impact on the processing load. For instance, using pre-calculated tables to speed up operations over the finite field (as done with smaller finite fields) may require a prohibitive amount of memory to be used on embedded platforms. Alternative lightweight solutions (e.g., LDPC FEC [START_REF] Roca | Low Density Parity Check (LDPC) Staircase and Triangle Forward Error Correction (FEC) Schemes[END_REF]) may be preferred in situations where the processing load is an issue and the source block length is large enough [START_REF] Matsuzono | Performance Analysis of a High-Performance Real-Time Application with Several AL-FEC Schemes[END_REF].

Since several values for the m parameter are possible, the use case SHOULD define which value or values need to be supported. In situations where this is not specified, the default m = 8 value MUST be used.

In any case, any compliant implementation MUST support at least the default m = 8 value.

IANA Considerations

Values of FEC Encoding IDs are subject to IANA registration.

[RFC6363] defines general guidelines on IANA considerations. In particular, it defines the "FEC Framework (FECFRAME) FEC Encoding IDs" subregistry of the "Reliable Multicast Transport (RMT) FEC Encoding IDs and FEC Instance IDs" registry, whose registration procedure is IETF Review.

This document registers one value in the "FEC Framework (FECFRAME) FEC Encoding IDs" subregistry as follows:

8 refers to the Simple Reed-Solomon [RFC5510] FEC Scheme over GF(2^^m) for Arbitrary Packet Flows.

Acknowledgments

The authors want to thank Hitoshi Asaeda and Ali Begen for their valuable comments.

  FEC source and repair packets v +-

  max_k = floor((2^^m -1) * CR) Roca, et al. Standards Track [Page 9] RFC 6865 Simple Reed-Solomon FEC Scheme February 2013

o

  Encoding symbol length (E): 16-bit field. o Strict (S) flag: 1-bit field.

Figure 6 :

 6 Figure 6: Source FEC Payload ID encoding format for m = 16.

+Figure 7 :

 7 Figure 7: Structure of a FEC Repair Packet with the Repair FEC Payload ID.

Figure 9 :o

 9 Figure 9: Repair FEC Payload ID encoding format for m = 16. The format of the Repair FEC Payload ID for m = 8 and m = 16 are illustrated in Figures 8 and 9, respectively.

  alignment purposes up to a size of exactly E bytes. The data unit resulting from the ADU i and the F[i], L[i], and Pad[i] fields, is called ADU Information (or ADUI). Each ADUI contributes to exactly one source symbol of the source block.

	RFC 6865	Simple Reed-Solomon FEC Scheme	February 2013
		Encoding Symbol Length (E)
	< -
	Roca, et al.	Standards Track	[Page 11]

): o The first byte, F[i] (Flow ID), contains the integer identifier associated to the source ADU flow to which this ADU belongs to. It is assumed that a single byte is sufficient, or said differently, that no more than 256 flows will be protected by a single instance of FECFRAME. o The following 2 bytes, L[i] (Length), contain the length of this ADU, in network byte order (i.e., big endian). This length is for the ADU itself and does not include the F[i], L[i], or Pad[i] fields. Then zero padding is added to ADU i (if needed), in field Pad[i], for

Authors' Addresses