Frédérick Gal
email: f.gal@brgm.fr

Michel Brach

Gilles Braibant

Claire Bény

Karine Michel

Gal Frédérick

Brach Michel

Braibant Gilles

Michel Karine

Beny Claire

What can be learned from natural analogue studies in view of CO2 leakage issues in Carbon Capture

Keywords:

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Natural analogues studies have received much interest over past years through the prism of CO 2 capture and storage (CCS) applications. Several references on this topic may be found in very recent papers such as e.g. [START_REF] Schütze | Natural analogues: a potential approach for developing reliable monitoring methods to understand subsurface CO 2 migration processes[END_REF]. Natural analogues can either be in steady state conditions, i.e. in a non-leaking state, or at the opposite they can experience more or less developed leakages. In this paper we choose to focus on this second situation in order to evaluate how valuable information may be learnt from natural CO 2 leakages and extrapolated to CCS sites. In this particular case of leaking analogues, features devoted to the study of storage integrity are by definition unrealistic. Nevertheless, such analogues represent a good opportunity to illustrate what must be avoided for CCS sites [START_REF] Bachu | Screening and ranking of sedimentary basins for sequestration of CO 2 in geologic media[END_REF].

Even if vertical gas flows are often much greater than those expected in case of undesired CO 2 leakage from CCS site, natural analogues provide the opportunity to study the nature of a gas leakage, its interaction with surrounding rocks and aquifers, its behaviour over time or its potential impacts on surface environments [START_REF] Lewicki | Natural and industrial analogues for leakage of CO 2 from storage reservoirs: identification of features, events, and processes and lessons learned[END_REF]. Consequently, natural analogues monitoring is an appropriate way to study natural seepages and is from the authors' point of view complementary with induced leak experiments such as the ZERT [START_REF] Spangler | Foreword to the Special Issue on Zero Emission Research and Technology Center testing field site[END_REF] or the CO2FieldLab ones (http://www.sintef.no/Projectweb/co2fieldlab/). The Sainte-Marguerite site allows the study of both CO 2 leakage in shallow aquifers and gas escapes in near surface environments. Apart from pressure and temperature consideration, leakage in aquifers is the most critical parameter to assess for ensuring of CCS sites integrity.

One must be confident with near surface monitoring technologies prior to use them in deeper environments. Second, monitoring of CO 2 escapes as a gas phase may consist in the ultimate warner prior to leakage in the atmosphere. Health and risk assessment and public acceptance directly rely on those two aspects.

Another interesting parameter to evaluate is the behaviour of natural analogues over long time periods. CO 2 injection is a very recent process compared to timescale of geological processes.

Consequently, apart from failures linked to defective constraint of a CCS site (leakage due to abandoned wells, existence of fractures or leakage through the caprock; [START_REF] Lemieux | Review: The potential impact of underground geological storage of carbon dioxide in deep saline aquifers on shallow groundwater resources[END_REF], leakage may occur at low rate over years and may not be highlighted by monitoring technologies at depth, especially geochemical ones that rely on discrete measurements. A better understanding of how the gas migrates from depth and how it imprints surface environments is a challenging question that may be addressed by studying naturally leaking sites. Defining the origin of the gas phase is an important issue in case of leakage at a CCS site, helping to decipher whether the gas originates from the reservoir itself or from other sources that do not involve CCS processes (e.g. [START_REF] Gilfillan | He and Ne as tracers of natural CO 2 migration up a fault from a deep reservoir[END_REF].

The Sainte-Marguerite area belongs to the French Massif Central and more precisely to the southern part of the Limagne d'Allier basin (Figure 1). This tertiary basin is mainly filled by limestones with frequent sandy-clayey intercalations that are contemporary of the Oligocene to Miocene West European rifting. Alluvial and colluvial deposits from the Allier River partly overlie these tertiary strata and from place to place volcanic series crosscut the sedimentary formations. Mineral waters emerging in the Limagne d'Allier basin are strongly influenced by their deep circulation in the crystalline basement and the occurrence of deep CO 2 sources [START_REF] Fouillac | Chemical geothermometry in CO 2 -rich thermal waters. Example of the French Massif Central[END_REF]. The main tectonic structures, inherited from the Hercynian orogeny, are respectively N10-N30 and N110-N130 (Merle and [START_REF] Michon | The formation of the West European Rift: A new model as exemplified by the Massif central area[END_REF]. The Sainte-Marguerite area is also characterised by the presence of travertine deposits formed from water degassing at springs [START_REF] Casanova | Microbial control on the precipitation of modern ferrihydrite and carbonate deposits from the Cézallier hydrothermal springs (Massif Central, France)[END_REF][START_REF] Fouillac | Chemical geothermometry in CO 2 -rich thermal waters. Example of the French Massif Central[END_REF][START_REF] Rihs | Long-term behaviour of continental hydrothermal systems: U-series study of hydrothermal carbonates from the French Massif Central (Allier Valley)[END_REF].

While studies on mineral watersmostly of sodium bicarbonate type with CO 2 present as a gas phasefrom the Allier River valley are numerous (e.g. Négrel et al., 1997a and references therein), initial investigations of soil gas composition in the Sainte-Marguerite area were performed during the 90's to locate new boreholes for perpetuating the commercial exploitation of this water [START_REF] Appora-Gnekindy | Etude spatiale et temporelle des émanations gazeuses de quelques zones thermominérales du Massif Central Français[END_REF][START_REF] Baubron | Eaux minérales de Sainte Marguerite (Puy de Dôme) -Prospection géochimique in situ des gaz des sols[END_REF]. Earlier measurements were made in the 70's on the west bank of the Allier River at the Saladis spring [START_REF] Batard | Prospection de CO 2 d'origine profonde dans le Massif Central[END_REF].

The objective of this study is therefore, in light of the work done in the 90's, to compare the similarities and differences of gas emanations separated by 20 years. Point measurements and longer records will be used to examine the relationships existing between the near surface compartment and deeper seated processes.

Figure 1

Methods

Two types of investigative methods were used: soil gas characterisation and description of water flows. Soil gas measurements were made using procedures and equipment identical to those described by the authors elsewhere (e.g. [START_REF] Battani | Geochemical study of the natural CO 2 emissions in the French Massif Central: How to predict origin, processes and evolution of CO 2 leakage[END_REF][START_REF] Gal | Mesure des gaz des sols autour du système volcanique le plus récent de France métropolitaine (lac Pavin, Massif Central). Soil gas measurements around the most recent volcanic system of metropolitan France (lake Pavin, Massif Central)[END_REF].

The monitoring methodology was based on the following:

-CO 2 , O 2 and CH 4 soil gas concentrations were directly quantified in the field using landfill gas analyser (LFG20 gas analyser, ADC Gas Analysis Limited, UK). Gas content was measured at 1 m depth in order to minimize the effect of atmospheric gases. CO 2 and CH 4 contents were determined by non-dispersive infrared absorption and O 2 contents by electrochemistry. No CH 4 was found during the successive surveys indicating concentrations lesser than 0.01% volume in the gas phase. As the CO 2 concentrations ranged from less than 1% up to 100%, precision of the measurements varied between ±0.5% of the reading for CO 2 < 10% to ±5% of the reading for CO 2 > 50%.

-4 He and 222 Rn concentrations were also systematically determined using samples collected in Tedlar bags for 4 He and vacuumed scintillating flasks for 222 Rn, respectively. Concentrations were obtained using mass spectrometry for 4 He (Adixen ASM102S leak detector, France) and scintillation counting for 222 Rn (Calen, Algade, France).

-Some additional grab samples were collected for laboratory determination of the 13 C of the CO 2 . The isotopic ratio was determined using a Delta S Thermo/Finnigan mass spectrometer and expressed as ‰ VPDB (Vienna Pee Dee Belemnite). A Varian 3400 gas chromatography was used for the determination of N 2 , Ar, O 2 , CO 2 and C n H 2n+2 (n = 1 to 6).

-Continuous data acquisition was also performed on 222 Rn content using Barasol probes (absorption spectrometry via a silicon detector; Algade) for long-term acquisitions (from October 2008 to March 2010). Barasol probes were protected by a PVC tube, covered by a Goretex membrane and buried at 1 m depth in the ground.

The joint determination of these gaseous species allow to compare information from tracers that may be enriched through geothermal reservoir processes ( 4 He), from poorly mobile elements that may help highlight areas with significant gas fluxes ( 222 Rn) and from a widely existing gas (CO 2 ) that may be tracer of soil/atmosphere exchanges or of deep seated endogenic processes. Weather conditions were also taken into account for the interpretation of the soil gas data and will be discussed together with the data.

Secondly, as the Sainte-Marguerite area is known for its mineral water resources, chemical characterisation of some springs (physico-chemical parameters and dissolved ions content) was also performed as well as the monitoring of the Brissac Geyser during several hours using a multi-parameter Idronaut probe (Idro316Plus). Dissolved ion contents were determined at laboratory using ICP-AES (Inductively Coupled Plasma -Atomic Emission Spectroscopy) and chromatographic methods. Isotope ratios were measured by gas phase mass spectrometry ( 18 O and D are expressed in ‰ VSMOW -Vienna Standard Mean Oceanic Water). The Idronaut probe was used to monitor the short-time evolution of temperature, pH, specific conductance, dissolved oxygen, redox potential and dissolved CO 2 content of the water.

Gas and water measurements

Soil gas data

A dataset of nearly 1000 data points for each gas specie (CO 2 , 222 Rn and 4 He) is available, half of them from the 90's measurements and the rest from more recent measurements (Table 1).

Table 1 CO 2 concentrations range from values close to those of the atmosphere up to 100% vol. The frequency distributions are different between the two measurement periods in relation to the spatial arrangement of the measurements that is dictated by the tectonic and geological structure of the study area. As a consequence, the mean CO 2 concentration is significantly greater for the 2006-2010 dataset than for the 1992 dataset.

Radon-222 ( 222 Rn) concentrations also fall within similar ranges during the two periods, minimum values being close to 150 Bq.m -3 and greater ones around 2x10 6 Bq.m -3 . The mean values were again higher for the 2006-2010 period as a consequence of data acquisition mainly focused on the Western part of the area. Nevertheless the variation of mean concentrations is only a factor of two whereas it was a factor of four for CO 2 concentrations.

Helium-4 ( 4 He) concentrations are on average quite close to the atmospheric content but this value hides important differences. Both in 1992 and 2006-2010 some measurements showed very strong depletions when compared to the atmospheric content while others had strong enrichments (≥ 10 ppm).

Most of the CO 2 measurements made between 2006 and 2010 were also supplemented by measurements of the O 2 concentrations in soils. A very homogeneous inverse behaviour exists between those species (Figure 2). Almost all data exhibit an O 2 decrease that is not proportional with the increase of the CO 2 content on a per mole basis. Depletion of O 2 is much faster with a factor close to 5. This suggests that CO 2 is supplied in abundance by a powerful process probably related to a deep gas source (crustal and/or mantle origin) as will be discussed later.

Figure 2 This strong O 2 depletion is also confirmed by the gas chromatography measurements reported in Figure 3. Correlations with other gas species follow linear regression with r 2 between 0.991 and 0.998, and also suggest a different behaviour between the CO 2 end-member and the N 2 -O 2 -Ar triptych, with CO 2 becoming predominant as the other three gases diminish and viceversa. This was particularly true for a 30 m deep borehole where atmospheric constituents were only detected at trace levels (0.13% N 2 ; 0.023% O 2 ; 0.002% Ar). Using the relationship presented in Figure 3, it is then possible to recalculate an average composition for the atmospheric end-member. Ar and N 2 contents were respectively at 0.932% and 79.6%, levels that are very close to those usually reported for the atmosphere (respectively 0.934 and 78.08%; http://encyclopedia.airliquide.com/). Unlike O 2 , which is subject to a more active kinetic of replacement, N 2 and Ar are diluted in the soil gas by equimolar replacement with CO 2 .

Figure 3 Finally, the 13 C isotope ratio of the CO 2 gas was also evaluated on these samples and ranged between -3 to -5.1‰ VPDB for CO 2 in the 14 -100% vol. range.

Water measurements

The main physico-chemical properties of mineral springs sampled during the study are listed in Table 2. A rain event collected in October 2008 is also reported for comparison. The emergence temperatures range between 16 and 30°C and pH between 6.2 and 7.2, therefore comparable to those reported by Négrel et al. (1997b) for the carbogaseous waters known throughout the French Massif Central. Specific conductances vary between 2.5 and 8.4 mS.cm -1 , Chapelle springs (used for bottling) having total mineralization approximately half of other sampled waters. The mineralization is dominated by HCO 3 (1.3 to 4 g.L -1 ), Na (0.3 to 1.5 g.L -1 ) and Cl (0.2 to 1.5 g.L -1 ). If this Na-Cl-HCO 3 facies predominates, the Ca and Mg amounts, less variable (respectively 120 to 310 mg.L -1 and 100 to 140 mg.L -1 ), allow the Chapelle springsdue to their lower dissolved elements concentrationsto be linked with the Ca-Mg pole, suggesting a secondary enrichment associated with the chemical hardness of bicarbonate-rich waters [START_REF] Michard | Une méthode globale d'estimation des températures des réservoirs alimentant les sources thermales. Exemple du Massif Central Français[END_REF]. Similarly, the Chapelle springs have an oxidizing character contrary to Tennis and Geyser Brissac waters that are characterized by a marked reducing character. Characteristics of isotope ratios reported in Table 2 will be discussed in section 5. Table 2 4. Interpretation of soil gas data

Point data

One of the first steps to considered for highlighting a potential leakage at a CCS site is to characterise the CO 2 phase. Concentration measurements are of great interest but they may not be sufficient e.g. in case of small leakage rate. Additional information may be gathered using isotope systematics, mobile systems nowadays allowing on-site measurements (e.g. Picarro or Aerodyne lasers). 13 C isotope ratio measurements will not give direct indication of the process that may be involved in the production of the CO 2 phase but will allow 1) to discriminate between several origins and 2) to discard some unrealistic origins.

In the case of Sainte-Marguerite, CO 2 concentrations in soils are supposed to evolve primarily under the influence of deep seated processes rather than surface processes. Indeed, the range of 13 C CO2 isotope ratios in soil gas (-3 to -5.1‰) is related to deep crustal and/or mantle degassing (-4 to -8‰; [START_REF] Gerlach | Carbon isotope constraints on degassing of carbon dioxide from Kilauea Volcano[END_REF]. Similarly, 13 C CO2 are close to ratios measured on the gaseous phase of low helium concentrated, CO 2 -rich waters from the Massif Central (-6.4‰; [START_REF] Dégranges | Hélium et sources thermominérales en France[END_REF]. The more depleted ratio (-5.1‰) was measured in the 30 m borehole, where the gas phase was 100% CO 2 with no 4 He (< 0.05 ppm), whereas soil gas measurements (1 m depth) were slightly enriched in carbon-13 (i.e. greater than -4.8‰). This slight isotopic enrichment of upper soil horizons may be the result of two complementary phenomena, first the percolation of CO 2 through surface aquifers ( 13 C of dissolved carbon from local springs close to 10.2‰; [START_REF] Mercier | avec la collaboration de Ausseur Y[END_REF] and second the interaction with travertine deposits ( 13 C between 5.4 and 7.7‰; [START_REF] Casanova | Microbial control on the precipitation of modern ferrihydrite and carbonate deposits from the Cézallier hydrothermal springs (Massif Central, France)[END_REF].

In the case of leakage originated from a CCS site, such characterisation using the only 13 C isotope ratio will be much more difficult as overlaps between several gas origins and frequent re-equilibration will certainly occur. A way to better constrain gas emanation is to measure other gas species with different chemical properties.

In the present study we mainly refer to 222 Rn and 4 He. As 222 Rn and 4 He are only present as trace levels in the free atmosphere (respectively around 50 Bq.m -3 or less and 5.24 ppm), an enrichment would favour the existence of phenomena occurring either in the soil or in the upper regolith ( 222 Rn) or deeper in the ground ( 4 He; [START_REF] Battani | Geochemical study of the natural CO 2 emissions in the French Massif Central: How to predict origin, processes and evolution of CO 2 leakage[END_REF][START_REF] Gilfillan | He and Ne as tracers of natural CO 2 migration up a fault from a deep reservoir[END_REF].

Relationships between CO 2 , 222 Rn and 4 He are presented in Figure 4.

Figure 4

For 222 Rn/CO 2 and 4 He/CO 2 couples, graphical relationships (Figure 4A) confirm the different origin of these two gases and highlight that the genesis of 4 He from radioactive decay of uranium in the near surface has little influence on the 4 He concentrations. This should also result in an increase of the 4 He concentration when 222 Rn activities are high. This is not the case, since there is rather a gradual depletion when the 222 Rn activities exceed 10 6 Bq.m -3 (Figure 4A). Moreover, these high 222 Rn concentrations are measured at precise locations which correspond to surface discharges of springs (old factory and Tennis; Figure 1) that form tens of centimetres to several meters thick travertine beds. These very high 222 Rn activities are presumably related to these travertines, consequently richer in uranium than the alluvial formations and the local waters [START_REF] Casanova | Microbial control on the precipitation of modern ferrihydrite and carbonate deposits from the Cézallier hydrothermal springs (Massif Central, France)[END_REF]. In this particular case, the CO 2 source is not strong enough to dilute the 222 Rn as may occur farther from travertine deposits. As a consequence, perennial 222 Rn high concentrations exist locally.

The behaviour of 222 Rn and CO 2 is also complex for 222 Rn concentrations lesser than 300,000 Bq.m -3 (Figure 4B). Two distinct trends seem to exist, one with fast 222 Rn enrichment with low CO 2 concentrations (red squares), and the other with weaker 222 Rn enrichment when CO 2 concentrations rise (blue lozenges). These two behaviours correspond to various spatial locations (Figure 5). Most of the "high 222 Rnlow CO 2 " samples plot on the eastern part of the site on sedimentary deposits (mean altitude 350 to 365 m), whereas the majority of the "low 222 Rnhigh CO 2 " group is restricted to a lower terrace of the Allier river (westward from longitude 669,100 in Figure 5 mean altitude 335 to 345 m; see also [START_REF] Battani | Geochemical study of the natural CO 2 emissions in the French Massif Central: How to predict origin, processes and evolution of CO 2 leakage[END_REF] for geological cross-section). Near the Allier River, the thickness of geological formations overlying permeable paths is lesser than eastward. The CO 2 gas interacts to a lesser extent with surface formations, leading to moderate 222 Rn enrichment. On the contrary, on the eastern part of the site, CO 2 has to go through thicker formations (alluvial and Oligocene formations), leading to smaller CO 2 amounts and also to 222 Rn enrichment due to the percolation of the CO 2 into these formations. An intermediate behaviour occurs above travertines deposits (Figures 4 and5) where the 222 Rn content is also dependent from the uranium content of these formations. An additional process can also act in a complementary fashion. Deep CO 2 may be less diluted on the western part of the site than on the eastern part, indicating a more pronounced upward flow that allows the dilution of radon signal [START_REF] Baubron | Eaux minérales de Sainte Marguerite (Puy de Dôme) -Prospection géochimique in situ des gaz des sols[END_REF]Gal et al., 2011).

No relationship can be highlighted for the 4 He/CO 2 couple except from a very weak tendency of having slightly lower 4 He concentrations when CO 2 concentration is greater than 50% (Figure 4A). If considering the 30 m depth borehole as the most representative of the deep end-member, then uprising gas flow is 4 He depleted. A strong CO 2 flux can act as a flushing agent on 4 He. For lesser CO 2 amounts, flushing effect may be less important and 4 He concentrations are higher or even enriched depending on the amounts of 4 He upward migrating.

Figure 5

The great variability of soil gas concentrations on a small area is not only dependent from deep processes but also from the heterogeneity of surface formations and pathways. Such a problematic is critical for CCS sites especially in areas where potential leakage pathways are not well characterised. This will raise the question on how detect surface leakage if e.g. a leakage occurred in deep groundwaters. Nevertheless, a positive point is the persistence of leakage structures over years.

As a result, the Sainte-Marguerite area presents a patchy repartition of anomalies at surface, as evidenced by the equal concentration lines reported on Figure 6. Data are interpolated using natural neighbour algorithm. This interpolation method is more rugged than e.g.

kriging, but it has the advantage in not extrapolating the contours beyond the convex hull of the dataset. The whole dataset is presented top of Figure 6. Separate contributions from the data acquired during the 90's and during the 2000's are respectively presented middle and bottom parts of Figure 6. A good match is highlighted between these 15-year interval datasets especially on the Western part of the study site where strong CO 2 enrichments remain perennial. The match cannot be achieved for the Southern part as a new bottling facility has been built in between time therefore no measurement is yet possible. The North-South to N10 anomalous zone is well in agreement with structural directions reported in the Limagne d'Allier basin (Merle and [START_REF] Michon | The formation of the West European Rift: A new model as exemplified by the Massif central area[END_REF]. This direction is also suggested by variogram computations (data not shown) which suggest, under a spherical model, a significant nugget effect (40% of the variability) and a reduced leg (20 m). Consequently, there seems to be at site scale a structure directly related the Hercynian tectonic and at a smaller scale a less obvious structure that is difficult to model even with a large amount of data.

For CCS site management, this suggests that once fed by seepage or microseepage, a leakage pathway will remain active over a long time period. Its characterisation will then be possible but remediation actions will be very difficult to undertake.

Figure 6 The complex CO 2 distribution in soils is not restricted to this gas phase. A well characterised time coherence for 222 Rn concentrations (90's and 2000's datasets) also exists and reveals an anomalous area close to the flow axis of the Allier river (Figures 2 and6). A N170 direction is suggested by variogram calculations, with a leg identical to that defined for CO 2 but with increased nugget effect (50% of the variability). This may be linked to the location of the area of maximum 222 Rn concentrations, close to the high CO 2 area but with no coinciding peaks, and due to the difference of origin for these two gases, radon being preferentially produced in shallower environments than CO 2 in the present case.

The evolution of 4 He concentrations in the area where 222 Rn and CO 2 anomalies are located is very interesting to detail (Figure 6). This area is characterized by a complex intricacy of positive and negative anomalies in helium i.e. tracing enrichment or depletion with respect to the atmospheric content. This complexity in 4 He emanations is remarkably stable over time.

Low 4 He concentrations are preferentially measured along a N10 axis, locally reinforced by a complementary N160 direction. The adjustment on a spherical model of the variogram suggests a maximum correlation distance of 40 m between two points without a nugget effect.

In order to better assess the behaviour of CO 2 , 222 Rn and 4 He, a linearization of the data was made using the scheme proposed by Michel -Le [START_REF] Pierrès | Radon, Helium and CO 2 measurements in soils overlying a former exploited oilfield, Pechelbronn district, Bas-Rhin, France[END_REF]. The resulting interpolation map is presented in Figure 7. By assumption, CO 2 and 4 He are considered as deep end-members and 222 Rn as a near surface produced gas. This is consistent with gas origins suggested by [START_REF] Jeandel | Lessons learned from natural and industrial analogues for storage of carbon dioxide[END_REF] that found a nearly half/half mantle/crust origin for helium and a predominant crustal origin for CO 2 . This strengthens previous results indicating that CO 2 and 4 He amounts are not directly proportionally linked. The linearization process is then intended to lower the influence of 222 Rn and to over-estimate the one of 4 He by assigning a value between 0 and 1 to each of the gas specie. The 0.05 to 100% CO 2 range is restricted in the 0 -1 interval and so on for 222 Rn (140 to 248,000 Bq.m -3 ) and 4 He (0.05 to 9.83 ppm).

Using this procedure, 4 He concentrations account for c.a. 75% of the total variability, CO 2 for 22% and 222 Rn for the rest (c.a. 3%). Despite this bias introduced in the dataset (Figure 7), the surface geometry of the anomalies is still primarily guided by the distribution of CO 2 concentrations, the influence of 4 He been of second order. Consequently, it is the deep CO 2 source that governs the spatial distribution of anomalies in soil gas through the N10-N30 and N110-N130 structures (Merle and [START_REF] Michon | The formation of the West European Rift: A new model as exemplified by the Massif central area[END_REF]. Other gaseous species evolve either through the heterogeneous composition of the regolith or through the existence of complex phenomena including convective transport, stripping or mixing. This strong imprint of geological structures on the occurrence of anomalies also appears in the comparison of data acquired 15 years apart, since changes between these two periods remain small. This statement is strengthened by comparison with CO 2 flux data available in the area (Battani et al., 2010). The most anomalous CO 2 areas correspond to those marked by fluxes reaching or exceeding 500 cm 3 .min -1 .m -2 , while the radon anomalies are superimposed on areas where the fluxes are smaller (lesser than 100 cm 3 .min -1 .m -2 ). Figure 7 4.2 Time evolution of soil gas concentrations Evaluation of short-term variability of soil gas concentrations was evaluated using point measurements (CO 2 , 222 Rn and 4 He) and continuous measurements (on the CO 2 phase using Fourier Transform Infrared gas spectrometry). Repeated point measurements over 3 days (points 1 to 4 in Figure 1) indicated that the points located northward of the site experienced low variability of their gas concentrations (± 60% for CO 2 ). At the opposite points located in the southern part of the site had much greater variations rising up to a factor of 80 for CO 2 and 200 for 222 Rn (point 4). Continuous measurements in upper soil horizons in the vicinity of the Brissac Geyser had an intermediate variation factor of 8 over few hours, with periodicity influenced by the geyser own kinetic (mean period of 21 minutes).

Assessing the variability of gas emanations at short time scale is important for the comprehension of phenomena occurring at a natural analogue, but such a time scale is not fully matching requirements of CCS site monitoring. Longer chronicles shall be available in order to highlight any deviation from environmental background noise. The Sainte-Marguerite site has then been instrumented for longer-term measurements. They were performed only on the 222 Rn phase for practical reasons. Even if deviations that may be recorded will not be linked to deviations from an environmental background noise in the present case, one must be confident in the capacity of monitoring devices to properly register unexpected events.

Points 2 and 4 (Figure 1) were instrumented with Barasol probes from October 2008 to January 2009 for hourly monitoring and afterwards only the point 4 remained. Soil temperature and barometric pressure were simultaneously recorded at 1 m depth in the soil.

Meteorological data were got from an airport weather station located 14 km NNW from Sainte-Marguerite, at similar altitude. Two distinct time responses exist (Figure 8):

-Pressures measured at 1 m depth in soils perfectly replicate the variations of atmospheric pressure and provide accurate description of local evolutions (Figure 8a); -Temperatures measured in the soil are different from those measured in the atmosphere (Figure 8b). Soil temperatures exhibit a smoother daily variability and are higher than atmospheric temperatures. There is a time-lag between the maxima of temperature in the atmosphere and in the soil, the former occurring 5 to 6 hours before the later.

In December 2008 and January 2009, there is however a difference between temperatures measured by the two probes (Figure 8b). The probe located in the southern part of the study area (point 4 in Figure 1) recorded higher temperatures (from 5 to 10°C) than those measured a few hundred meters northward (point 2 in Figure 1). Point 4 being located in a depression close to mineral springs (25 to 29°C at the orifice), this warming may be related to their influence into higher groundwater level during winter times.

Figure 8 Radon activities measured by the 2 probes during the October 2008 -January 2009 period showed trends with site-specific evolution but the variability of the measurement remained in a similar range (Figure 8c). There is a good agreement between average 222 Rn concentrations computed from Barasol records (Table 3) and that from point measurements performed at site scale (Table 1). Marked activity peaks nevertheless occurred. At the end of January 2009 (Figure 8c), phenomenal concentrations were reached (up to 80x10 6 Bq.m -3 ). Such concentrations remain under saturation threshold of the probe (10 9 Bq.m -3 ) but are far greater than maximum values found during spot sampling (2.5x10 6 Bq.m -3 ). During this January 2009 event, a perfect synchronism was found between the 2 probes with a very quick increase followed by very small 222 Rn amounts few hours later. This event is therefore not related to malfunctioning of the equipment. The measurements suggest a gas burst sweeping the area of Sainte-Marguerite, leading to a huge increase in 222 Rn and a subsequent strong depletion.

Concentrations remained low until radioactive decay produced again a sufficient amount of 222 Rn. Another peak of activity was also detected in September 2009 (Figure 8c). However, as only one sensor was deployed and as it experienced some operational problems, we prefer not trying to interpret this latter signal. Table 3 Apart from these specific periods, the 222 Rn concentrations change cyclically (Figure 8).

Cycle analysis returned variable results depending on the analysed time period and even on the location of the probe (Table 3). There was no clear influence of external forcing such as daily or diurnal variations over long time periods or the existence of pulsation of longer duration. It is therefore not possible to highlight regular gas emanations as may be possible regionally such as in the vicinity of Lake Pavin [START_REF] Gal | Mesure des gaz des sols autour du système volcanique le plus récent de France métropolitaine (lac Pavin, Massif Central). Soil gas measurements around the most recent volcanic system of metropolitan France (lake Pavin, Massif Central)[END_REF].

Nevertheless, during periods characterised by less noisy 222 Rn signals (March 2009; Figure 9a, b andc), a daily cyclicity (24 hours period) clearly appeared even if trends of greater wavelength may also contribute to the shape of the recorded signal (Figure 9d). Principal Component Analysis were calculated by combining the factors accounting for maximum variability (Figures 9e andf). The only apparent trend was an inverse correlation between 222 Rn concentration and soil temperature. Given the interdependence between soil and atmospheric temperature, this trend can be extended to this second parameter. Thermal forcing seemed to be more efficient than pressure gradients to influence the short-term temporal evolution of 222 Rn concentrations, apart from sudden phenomena such as "gas bursts". Figure 9 As previously described, the occurrence of large 222 Rn concentration peaks was very intriguing. The origin of such short pulses may typically be attributed to external causes such as earthquakes. Radon is frequently used as an indicator of crustal movement (precursor), although each earthquake does not raise an 222 Rn anomaly and each anomaly is not necessarily followed by an earthquake (e.g. [START_REF] Al-Hilal | Radon variations and microearthquakes in Western Syria[END_REF]. According to dislocation model [START_REF] Fleischer | Dislocation model for radon response to distant earthquakes[END_REF][START_REF] Fleischer | Association of subsurface radon changes in Alaska and the northeastern United States with earthquakes[END_REF], variations of 222 Rn concentrations issued from stress changes can be detected even at great distances from epicentres, involving a wide set of mechanisms [START_REF] Kharatian | Activité du gaz radon dans l'air du sol et sismicité locale : exemple du bassin de l'Arax (Arménie)[END_REF]. Continuous measurements of 222 Rn in soil gas sometimes allow the identification of spike-like anomalies just before the earthquake, the post-seismic stage being characterised by a rapid return to natural background values [START_REF] Chyi | Automated radon monitoring of seismicity in a fault zone[END_REF]. Although highly variable, increases in 222 Rn concentrations at 1 m depth in soils [START_REF] Wattananikorn | Soil gas radon as an earthquake precursor: some considerations on data improvement[END_REF] often occur between 4 and 15 days before earthquakes of magnitude 2 to 6 with distances from the epicentre to the measuring station comprised between 15 to 250 km [START_REF] Das | Explosive helium burst in thermal spring emanations[END_REF][START_REF] Ghosh | Pronounced soil-radon anomaly -Precursor of recent earthquakes in India[END_REF][START_REF] Ramola | Soil-gas radon as seismotectonic indicator in Garhwal Himalaya[END_REF].

Referring to these constraints, we searched the available databases (http://www-dase.cea.fr/) for events reported in an area covering 4 degrees in longitude and 3 degrees in latitude, centered on Sainte-Marguerite. Twelve earthquakes were recorded between January 28 (12 hours after the 222 Rn peak) and February 13 (17 days after the 222 Rn peak) within this area, at distances between 40 and 70 km from Sainte-Marguerite. All were characterised by very low magnitudes less than 2.5. Although some of the cited literature reports a sensitivity of 222 Rn measurements for low seismic magnitudes, no clear relationship exists in the present case between 222 Rn peaks and tectonic activity.

Such excursions of 222 Rn signal were earlier reported on the Weyburn site, which is not known to be tectonically active [START_REF] Riding | Subsurface characterisation and geological monitoring of the CO 2 injection operation at Weyburn, Saskatchewan, Canada[END_REF]. Phenomena observed at Weyburn were short (3 hours) and activities varied by factors of 7 to 15. At Sainte-Marguerite variations were consequently higher (100 to 1000 times) and the sensitivity of 222 Rn concentrations to pressure changes was less obvious than stated at Weyburn. This renders improbable an origin related to transient phenomena affecting the pressure.

Even if not really successful during the monitoring period, long-term measurements of soil gas emanations are of strong interest in view of CCS applications. Data main not only be gathered on the 222 Rn phase but mostly on CO 2 and/or O 2 phases. This is crucial for assessing if variations are linked to natural processes, either originated from surface processes or deeper ones, or caused by CCS operations. Continuous monitoring is not designed to cover great areas, one limiting factor being costs, but is complementary with point techniques and may be deployed in most prominent locations highlighted by point monitoring.

Chemistry of mineral waters

The Sainte-Marguerite site offers the opportunity to monitor gas escapes into more or less mineralised water bodies. We will first describe water chemical compositions and then discuss what is important in view of long term water monitoring.

Point sampling

Mineralisation of these waters form two groups, one rich in dissolved constituents and belonging to the Na-Cl-HCO 3 end-member, the other (Chapelle springs) more influenced by the Ca and Mg species. This distinction remains when referring to 18 O and D isotope ratios (Table 2). Chapelle springs are always under the local meteoric water line [START_REF] Fouillac | lsotopic studies of deep and surface waters in the French Massif Central[END_REF], i.e. enriched in heavy isotopes contrary to other springs which fall on this meteoric water line. This may be related to evaporation (Négrel et al.,1997b and references therein), to mixing in various proportions between deep and surface end-members (e.g. [START_REF] Michard | Une méthode globale d'estimation des températures des réservoirs alimentant les sources thermales. Exemple du Massif Central Français[END_REF] or to mixing between different deep end-members (Négrel et al., 1997b;[START_REF] Rihs | Long-term behaviour of continental hydrothermal systems: U-series study of hydrothermal carbonates from the French Massif Central (Allier Valley)[END_REF]. These differences in isotope ratios denote spatial disparities within walking distance but do not imply the existence of compartmented geological structures. Theoretical calculations of the 13 C isotope signature of gas in equilibrium with the waters provide ratios between -2.8 and -5.1‰ (Table 2) that exactly match the range measured in soil gas. Water mixing must then occur under open system conditions allowing different end-members to interact one with each other, pro parte explaining temporal variations reported in the area (Négrel et al., 1997b).

Strontium isotope ratio of water ( 87 Sr/ 86 Sr) is known to derive from that of minerals with which the water interacts and to be lower than that of the whole rock, in response to different dissolution rates between the mineral species (e.g. [START_REF] Michard | Acquisition des ions alcalino-terreux par les eaux carbogazeuses[END_REF]. 87 Sr/ 86 Sr ratios (Table 2) suggest that Tennis and Geyser Brissac waters fall in the range of ratios known across the Limagne d'Allier (0.71338; Stettler, 1977) and therefore reflect the signature of a deep end-member. Lower ratios of Chapelle springs suggest either an interaction with lithologies different from those present in the supply circuit of Tennis and Geyser Brissac springs (e.g. plagioclase from the Coudes granite at 0.71028; [START_REF] Rihs | Long-term behaviour of continental hydrothermal systems: U-series study of hydrothermal carbonates from the French Massif Central (Allier Valley)[END_REF] or a mixing with near surface groundwaters (ratio close to 0.71102; Négrel et al., 1997b). In the first case (mixture of 2 groundwaters, one coming from plagioclase weathering), a contribution of the deep end-member (represented by Geyser Brissac or Tennis springs) close to 32% can be calculated using a binary mixing law, whereas in the second case (dilution by surface water), the proportion of the deep end-member may be close to 57%.

Using this deep end-memberor at least the end-member less affected by mixturesequilibrium temperatures with basement rocks may be evaluated referring to cationic geothermometers. As geothermometers induce the existence of equilibrium between waters and rocks, we neither refer to Ca and Mg geothermometers, strongly affected by mixing processes [START_REF] Michard | Une méthode globale d'estimation des températures des réservoirs alimentant les sources thermales. Exemple du Massif Central Français[END_REF], nor to silica -rich species, oversaturated with water at the spring orifice. Na/K [START_REF] Michard | Géothermomètres chimiques[END_REF], 1990[START_REF] Truesdell | Geochemical techniques in exploration, summary of section III[END_REF] and Na/Li [START_REF] Fouillac | Sodium/lithium ratio in water applied to geothermometry of geothermal reservoirs[END_REF][START_REF] Michard | Behaviour of major elements and some trace elements[END_REF] geothermometers are preferred as saturation indices of mineral species containing Na indicate under saturation with water. Deep reservoir temperature is estimated between 180 and 210°C (Na/K) and 195 and 205°C (Na/Li). This estimate is in agreement with that of [START_REF] Fouillac | Sodium/lithium ratio in water applied to geothermometry of geothermal reservoirs[END_REF] and [START_REF] Fouillac | Chemical geothermometry in CO 2 -rich thermal waters. Example of the French Massif Central[END_REF].

Isotope characterisation of waters is often restricted to the monitoring of 18 O, 2 H or 13 C species in view of CCS problematic. Such characterisation is important but water monitoring of deep aquifers, such as the storage complex itself of overlying aquifers, may include other species. O, H, C species may suffer from several processes such as water/rock interaction of mixing between different water bodies. Monitoring other isotopes, such as Sr, Nd, B, Li, Ca or U may also allow getting information on deep seated processes, better define water/rock interaction or describe redox processes. A better comprehension of deep phenomena may allow improved constraint on CO 2 migration in deep horizons if leakage from the storage reservoir may occur.

Continuous monitoring of Geyser Brissac

Here we describe short-term evolution of some key physico-chemical parameters of the Geyser Brissac mineral water. Requirements of CCS monitoring will obviously not imply high frequency measurements but one must be confident on the short time scale before assessing variations of longer period.

Results of this monitoring are presented in Figure 10 andTable 4. Two days were characterised by sunny conditions whereas rainfall events of variable magnitude occurred during day 4 and especially day 3. The evolution of dissolved CO 2 is reported on Figure 10 even if quantification is not accurate using pH-based sensors (Gal et al., 2011), in order to bring qualitative information.

Figure 10

Table 4 A cyclical pattern is clearly apparent for all the parameters, directly related to Geyser Brissac dynamics (Figure 10). Two parameters mainly influence the water temperature: 1) intrinsic processes, the eruption of the geyser progressively warming the water and 2) atmospheric forcing, higher water temperatures being recorded around 16:00 in the evening. This is due to to the location of the Geyser Brissac, emplaced in a 1 m deep, 5 m diameter bowl filled with mineral water. Measurements were performed at the bottom of this bowl, closest to the drain where the geyser overflows. The presence of non-flowing waters induced the occurrence of thermal forcing on this water mass: time is needed for the water directly flowing from the geyser when it erupts to warm up the bowl. Similarly, amplitude of the temperature peaks becomes smaller through the day and the water mass becomes hotter as solar heats the water mass. Dilution effects due to rainfall may happen and significantly affect the water temperature and the specific conductance (day 3, Table 4).

Apart from external causes, time evolution of the records is dependent from the geyser activity. Temperature peaks, which correspond to the maximum of the activity of the geyser, lasted 4 to 5 minutes. They are synchronous to increase of the dissolved CO 2 , slight decrease of the pH value (-0.05 pH unit) and decreases of the dissolved O 2 concentration and of the redox potential. Such evolutions are self-consistent and reflect the progressive replacement of O 2 by CO 2 in the bowl as the eruption takes place. Specific conductance is also affected, CO 2 inflows leading to harmonic variations of the record. Nevertheless, diurnal heating affects the dissolved CO 2 measurements, one of the drawbacks of this sensor elsewhere reported (Gal et al., 2011). Spectral density analysis is best constrained using dissolved O 2 , pH and redox potential redox.

Main period is around 22±1 minutes in good agreement with infrared measurements performed in soils (see section 4.2). As measurements were not conducted over several days, it is not possible to identify periodicity of greater wavelength such as that determined from Barasol probe acquisitions.

Long-term monitoring of water bodies is one of the key procedures in order to ensure of the safety of CO 2 storage. Monitoring performed at Sainte-Marguerite natural analogue shows that this method is sensitive to strong CO 2 leakage well over thresholds expected in deeper environments. Nevertheless devices have the capacity to record variations of lower magnitude. The main issue nowadays existing relies on the stability of the sensors over time.

Long-term deployment at depth generally involves CTD probes, i.e. probes that measure only temperature, specific conductance and depth. This only involves solid state sensors. Idronaut probe has chemical sensors for all other parameters and such sensors are subject to drift. Dissolved oxygen may be better constrained using optical sensors. Until now, no long-term pH or redox monitoring has been reported without frequent recalibration of the devices. This question is of crucial importance, as pH is one of the most sensitive parameter to monitor changes linked to CO 2 dissolution.

Concluding remarks

This case study of Sainte-Marguerite natural analogue allows investigating both soil gas and water compartments.

Point soil gas measurements have suggested the presence of perennial pathways that favour gas escape from depth to the surface by comparing data acquired 15 years apart. Leakage does not occur along all the fault length as may be derived from geological maps but rather along discrete sections. At Sainte-Marguerite there is no visual impact on the vegetation as could exist in other similar environments [START_REF] Krüger | Effects of elevated CO 2 concentrations on the vegetation and microbial populations at a terrestrial CO 2 vent at Laacher See, Germany[END_REF][START_REF] Schütze | Natural analogues: a potential approach for developing reliable monitoring methods to understand subsurface CO 2 migration processes[END_REF]. Permeability of faults does not exist as a whole mechanism but rather as narrow structures separated by less permeable sections filled by secondary mineralization. In terms of CCS monitoring strategy, this suggests that potential pathways that may be deduced from geological or geophysical works may not be the most prone to become pathways. It would be better to search for structures that are still open to fluid draining i.e. secondary fractures that are more likely to have intrinsic permeability than main discontinuities.

The CO 2 gas was found to be the main carrier gas leading to the existence of gas anomalies in near surface environments. Carbon isotope ratios are mainly imprinted from deep seated processes with little interaction in near surface environments either resulting from percolation into surface waters or into travertines horizons. Helium concentrations measured in CO 2 -rich areas also highlighted this strong imprint of crustal contribution [START_REF] Jeandel | Lessons learned from natural and industrial analogues for storage of carbon dioxide[END_REF]. The interaction of fluids with travertine deposits also influenced the 222 Rn concentrations of the gas phase. Consequently, gas emanations were found to be mainly oriented along known regional directions of the tectonics with some complications induced by local surface geology.

When alluvial deposits were the less developed the gas emanations were stronger. Thicker alluvial deposits were found to be less representative of the deep end-member due to more pronounced interaction with these formations. Gas migration from depth is a highly complex phenomenon that must be better constrained in order to build confidence in safety rules and remediation strategies of CCS projects. Even at the upper level, near surface features have a strong influence on degassing pattern as pointed out by coupled geochemical/geophysical investigations [START_REF] Schütze | Natural analogues: a potential approach for developing reliable monitoring methods to understand subsurface CO 2 migration processes[END_REF]. Soil gas surveys performed under "point acquisition" schematic are relevant for the thorough description of surface leakage over a restricted spatial array. They are not fully appropriate for the monitoring of large areas and may be time consuming for repeated data acquisitions. They do not allow to take into account for the variability linked to external causes such as climatic variability and its imprint on surface environments. They are nonetheless crucial to best settle monitoring equipment for long-term surveillance. Investigation done at Sainte-Marguerite was mostly oriented on the 222 Rn specie. It allowed highlighting excursion from background noise under "gas burst" event. Such events were characterised by influence radius of at least 200 m. Scaling effects in case of leakage from CCS storage may not allow to get such amounts of gases percolating up to the surface. Therefore, there is also a need to monitor integrative bodies such as aquifers. In nearly all cases, CCS sites are more or less deep and overlying aquifers exist. Monitoring aquifers in the case of natural leaking analogues is from one side little frustrating as the initial composition of the waters is not knownwater properties prior leakage from a CCS site are known a prioribut on the other hand these waters represent an opportunity to study deep degassing through the interaction with water and rocksthat will be the case for CCS sites. The harmonic pulsation of Geyser Brissac is an extreme case relying on the accumulation of gas until the degassing due to overpressure.

Point monitoring of waters is by definition subject to heterogeneity of spatial coverage, ways to collect samples being restricted to available outlets or wells. Constraints on chemical processes occurring at depth may be brought by specific characterisation of the dissolved constituents and by related isotopic systematics. Particularly, the determination of mixing processes and their influence is important, as leakage from CCS site may be evidenced through the mixing of the water from the storage complex and overlying aquifers. Such methodology is not restricted to dissolved constituents and can also be extended to associate gases such as 4 He [START_REF] Gilfillan | He and Ne as tracers of natural CO 2 migration up a fault from a deep reservoir[END_REF].

As for soil gases, monitoring at regular frequency of water bodies is complementary with point methods. Time scale of recording depends on the kinetic of the processes. At Sainte-Marguerite such monitoring was performed at high frequency in order to take into account variations over short time scales, cyclicity of the geyser being around 22 minutes. Most prominent variations were stated for pH, dissolved oxygen, redox potential and dissolved CO 2 content. From soil gas measurements it was also stated that geyser "breathing" influences the soil gas evolution over short periods at a radius close to 20-30 m.

Several conclusions arise when moving from analogue scale to industrial scale. Basically studies devoted to CCS projects separate into baseline data acquisitions, then monitoring actions during the injection and final monitoring operations after well closure and abandonment. Baseline studies are essential as they represent the only data that will allow definition of anomalies during injection and post-injection. Establishing baseline values is a site-specific procedure but often their definition is based on a restricted dataset of measurement over limited time in order to match scientific issues on one side and industrial approach on the other side.

Natural analogue monitoring suggests that data acquisition should not be restricted in narrow perimeters above the storage complex itself but should encompass all the areas that may potentially be affected by leakage. One of the main concerns is the capability of the monitoring system to detect potential leaks. Anomalies are often restricted on narrow areas at surface and deploying monitoring devices on such small grids (20 to 200 m of array) is absolutely unrealistic if only considering costs. At surface, apart from such a net, it is therefore hypothetical to ensure a safely monitoring over great distances simply using punctual and point methods. Installation of equipment just above a potential leaking pathway that may not have been recognized by geological studies would be too lucky to be reproduced regularly over several deep CO 2 storages. Surveying methodologies are nowadays adapted to integrate gas emanations characteristics from hectometer to kilometer scales. Methods such as eddy covariance, open path laser, airborne hyper-spectral monitoring etc… are promising ones but until now they are not as robust as required for storages monitoring as they are often dependent from modeling of the atmosphere compartment that is strongly turbulent over short time periods and may therefore induce undesirable effects and false warnings (e.g. [START_REF] Klusman | Comparison of surface and near-surface geochemical methods for detection of gas microseepage from carbon dioxide sequestration[END_REF].

Ways to overcome this limitation may be of several types. Monitoring at depth through boreholes, using geochemical and/or geophysical methods, appears to be the best way to get early detection and warning of unexpected events by focusing on the water phase and on dissolved gas contents. Monitoring should be performed under continuously deployed devices or at least consisting in repeated measurements. Nevertheless, from a geochemical point of view, lot of the available monitoring equipment that may be deployed at depth has nowadays not reached the desirable level of reliability over long time periods.

Many efforts have been done in recent years to adapt technologies to CCS monitoring and to gain confidence in results, but long-term recording of parameters remains a challenging question. b: temporal evolution of temperature (°C), pH, specific conductance at 25°C (mS.cm -1 ), dissolved oxygen content (mg.L -1 ), redox potential (Eh, mV) and dissolved CO 2 (expressed as a mV value) during the second day of deployment.

Figure captions:

List of tables:

Table 1: statistical parameters for the CO 2 , 222 Rn and 4 He concentrations during the 90's and 2000's surveys (Sainte-Marguerite area; see Figure 1 for location).

Table 2: physico-chemical parameters of mineral waters from the Sainte-Marguerite area (see location in Figure 1). Major ion contents are reported; blanks indicate a non-detection of the specie or a non-measurement (isotope ratios). 18 O and D isotope ratios are reported as well as the D difference to the local meteoric water line ( D = 8 18 O + 13.1; [START_REF] Fouillac | lsotopic studies of deep and surface waters in the French Massif Central[END_REF]. Equilibrium partial CO 2 pressure is computed using Diagrammes software (http://www.lha.univ-avignon.fr/). Table 3: descriptive statistics for 222 Rn concentrations acquired using Barasol probes. Table 4: top: evolution of temperature (°C), pH, specific conductance at 25°C (EC, mS.cm -1 ), dissolved oxygen content (mg.L -1 ), redox potential (Eh, mV) and dissolved CO 2 (expressed as a mV value) along the 4 days of monitoring of the Geyser Brissac (monitoring duration indicated into brackets); bottom: correlation matrix for each daily dataset. Geyser Brissac was sampled on day 3 (

Figure 1 :

 1 Figure1: location of the study area: dots locate points where soil gas data are available: black

Figure 2 :

 2 Figure 2: O 2 -CO 2 relationship for the 2006-2010 soil gas measurements; the equimolar

Figure 3 :

 3 Figure 3: relationships between Ar, N 2 , O 2 and CO 2 concentrations (% vol.) on samples

Figure 4 :

 4 Figure 4: A: Relationships between CO 2 , 222 Rn and 4 He in soil gas (2006-2010 dataset); B: detail of the CO 2 -222 Rn relationship for low 222 Rn concentrations (lesser than 300,000 Bq.m - 3 ).

Figure 5 :

 5 Figure 5: Relationships between CO 2 , 222 Rn and 4 He in soil gas.

Figure 6 :

 6 Figure 6: spatial distribution of soil gas species (from left to right: CO 2 , 222 Rn and 4 He) along

Figure 7 :

 7 Figure 7: CO 2 , 222 Rn and 4 He concentrations (2006 to 2010 measurements) recalculated in the 0 -1 interval to lower the influence of 222 Rn and strengthen the one of 4 He (arbitrary units).

Figure 8 :

 8 Figure 8: a: temporal evolution of pressure for Barasol probes (labelled as F10X) for points 2

Figure 9 :

 9 Figure 9: F109 Barasol probe (point 4 in Figure 1); period from the 26 February 2009 to the 07 April 2009; a: temporal evolution of soil temperature and 222 Rn concentrations; b: temporal evolution of atmospheric pressure and 222 Rn concentrations; c: temporal evolution of atmospheric temperature and 222 Rn concentrations; d: spectral densities of 222 Rn

Figure 10

 10 Figure 10: a: temporal evolution of water temperature of Geyser Brissac during deployment;

  Table 2).

		T	pH	cond@25°C Eh	Ca	Mg	Na	K	Fe(III) Mn	Sr	Li	HCO 3 Cl	SO 4	PO 4	NO 3	F	Br	SiO 2	d	18 O	dD	theoretical d D	87 Sr/ 86 Sr	13 C gas
		(°C)		(mS.cm -1 )	(mV)	(mg/l) (mg/l) (mg/l) (mg/l) (mg/l) (mg/l) (mg/l) (mg/l) (mg/l) (mg/l) (mg/l) (mg/l) (mg/l) (mg/l) (mg/l) (mg/l) (‰ VSMOW) (‰ VSMOW) if belonging to LMWL	open sys.
	Chapelle 1 (2006)	17.8	6.54	5210	338	237	121	776	81.9		3.74		2288 717	146		4.9				-8.3	-57.4	-53.3	0.712298	-4.6
	Chapelle 1 (2007)	16.6	6.63	4530	391	248	137	875	97.4		4.37	4.48	2465 806	155		2.8	0.7	1.8					-5.1
	Chapelle 2 (2006)	18	6.21	3070	336	196	117	304	34.5		2.5		1276 298	192		6.3				-7.5	-53.7	-46.9	0.712818	-2.8
	Chapelle 2 (2007)	16.6	6.33	3130	444	188	127	360	39.1		2.38	1.66	1483 340	202		4.4	0.9	0.7					-3.4
	Chapelle 3 (2006)	17.5	6.38	2730	340	178	104	266	34.6	0.02	2.16		1410 230	198		8.3				-7.7	-54	-48.5	0.712035	-3.7
	Chapelle 3 (2007)	15.9	6.51	2410	420	184	126	301	40.7		2.30	1.52	1332 315	209		4.6	1.0	0.6					-4.5
	Tennis (2006)	29.2	6.48	7970	91	306	131	1493 163	0.10	6.37		3554 1495 101						-9.6	-63.2	-63.7	0.713388	-3.9
	Tennis (2007)	29	6.46	7970	140	295	135	1486 167		6.66	8.03	3515 1348 129			0.5	3.7					-3.9
	Tennis (2008)	28.5	6.58	8440	138	301	133	1461 163	2.75			3527 1370 111	0.4		1.1		107	-9.5	-62.8	-62.9	-4.4
	Geyser Brissac (2006)	24.6	6.65	8180	186	307	133	1497 163	0.10	6.33		4135 1429 100						-9.6	-63	0.713387	-4.9
	Geyser Brissac (2007)	23.5	6.62	7990	180	297	136	1485 167		6.88	7.99	3534 1355 126			0.4	3.7					-4.8
	Geyser Brissac (2008)	23	6.57	8310	158	299	132	1447 162	2.80			3562 1360 111	0.5		1.1		106	-9.5	-62.7	-62.9	-4.6
	Petit Saladis (2007)	21.6	6.58	8190	245	295	136	1498 168		6.29	8.13	3554 1344 125			0.5	3.5					-4.7
	Grand Saladis (2007)	16.1	7.24	7920	386	125	139	1579 180		2.60	8.52	3124 1414 108		11.0	0.4	3.9					-7.6
	old plant sp. (2008)	29.3	6.7	8270	140	302	133	1457 164	2.41			3147 1390 110	0.4		0.8		105	-9.5	-63	-62.9	-4.9
	Valois sp. (2008)	25.3	6.45	7840	105	298	129	1461 163	2.80			3536 1370 109	0.4		1.2		106	-9.5	-62.9	-62.9	-3.9
	terrace sp. (2008)	18.6	6.45	8410	197	296	131	1459 163	2.44			3566 1360 111	0.3		1.2		102	-9.6	-62.8	-63.7	-4.1
	rainwater (08/10/2008) 12.4	8.45	65	273	4.2	0.9	8.3	1.2	0.03			24	6	2		1.7			0.7	-8.8	-64.7	-57.3

Acknowledgments

This research was conducted through the fundings of French Research Agency projects Geocarbone Monitoring (2006Monitoring ( -2008) ) and Sentinelle (2008Sentinelle ( -2011)). Anne Bonhomme (Les Mousquetaires Group) is warmly thanked to allow the access to the Sainte-Marguerite site and subsequently fruitful data acquisition. BRGM people that performed laboratory analyses are gratefully acknowledged.

Two anonymous reviewers and the associate editor are also warmly thanked for their help in improving the manuscript.


Sylvain Guilley
email: sylvain.guilley@telecom-paristech.fr

Jean-Luc Danger

Robert Nguyen

Philippe Nguyen

System-Level Methods to Prevent Reverse-Engineering, Cloning, and Trojan Insertion -Extended Version of [12]

Keywords: Reverse-engineering (RE), Cloning, Hardware Trojans Insertion

The reverse-engineering (RE) is a real threat on high-value electronic circuits. Many unitary solutions have been proposed to make RE difficult. Most of them are low-level, and thus costly to design and to implement. In this paper, we investigate alternative solutions that attempt to deny the possibility of RE using high-level methods, at virtually no added cost.

Introduction

The field of protection against reverse-engineering (RE) has developed recently, especially in the case of software (where it is called digital forensic [START_REF] Garfinkel | Anti-Forensics: Techniques, Detection and Countermeasures[END_REF]). Those techniques have extended to hardware, because the design of circuits is more and more outsourced (for fabrication, packaging, assembly, etc.). Some governments have additionally enforced anti-RE laws, to force industrialists take this risk into consideration. This article is a position paper about non-technical ways to resist RE and derived attacks that span from mere cloning to Trojan insertion.

The rest of this paper is structured as follows. A detail analysis of the threats categories and of the typical attack protections against them is covered in Sec. 2. Some technologies, mainly proposed by the academia, suitable to fight RE, have emerged. They are reviewed in Sec. 3. Solutions that aim at preventing RE and related attacks at a system-level are discussed in Sec. [START_REF] Biham | Differential Fault Analysis of Secret Key Cryptosystems[END_REF]. Eventually, the conclusions are given in Sec. 5.

Threats

Reverse-engineering consists in recovering the design by analyzing its implementation. It can serve per se to gain illegitimate information. The motivation is typically acquiring the knowledge about industrial design secrets embedded in a system, or cloning a design by extracting its masks or its netlist, in a view to producing compatible chips (albeit without paying for the research/development cost). Also, it can be a first step for Trojan [START_REF] Lin | Trojan Side-Channels: Lightweight Hardware Trojans through Side-Channel Engineering[END_REF] insertion. A Trojan (or a backdoor) is a piece of software or of hardware that is added to the circuit. It is designed not to interfere with its nominal operation, and to allow for the leakage of some secrets when activated by a secret and unpredictable sequence of inputs. Sometimes, the Trojan is an added functionality, that will not be detectable by the test; sometimes, it can alter one functionality. For instance, the "bug attack" of Shamir [START_REF] Biham | Bug attacks[END_REF] can be seen as an exploitation of a Trojan. The idea of this Trojan is that the integer multiplier of the circuit returns one incorrect value, which allows the attacker that knows the data that causes this error to craft a message that will be signed (in practice: raised to the power of the secret key) properly modulo p (resp. q) but incorrectly modulo q (resp. p), which makes it possible to carry out a remote Bellcore attack on CRT-RSA [START_REF] Boneh | On the Importance of Checking Cryptographic Protocols for Faults[END_REF].

Accessing the design can be obtained by several means. The first one consists in simply getting the whole design, if the source is accessible or can be easily stolen. To avoid this risk, recommended design practices consist in concealing the design, by good practices of development. For instance, the class ALC3 of the common criteria formally addresses [START_REF]Common Criteria (aka CC) for Information Technology Security Evaluation[END_REF] this point.

But even when such organizational measures are enforced, the design can still be reversed. Indeed, the binaries can be extracted from memories, and subsequently decompiled to recover its functionality. Nonetheless, as this threat is very pregnant, the designers usually encrypt the memory contents. This doctrine is commonplace in the military objects, where different kinds of data exist:

1. insensitive data, called black, that are either public or encrypted variables, 2. sensitive data, called red, that consist in secret material manipulated unencrypted (i.e. plain).

Thus, as a countermeasure, the data that is intended to be stored in easy dumpable memories is encrypted (i.e. turned to black). We talk about a secure bus architecture [START_REF] Elbaz | Hardware Mechanisms for Memory Authentication: A Survey of Existing Techniques and Engines[END_REF], a.k.a. a protection about the so-called bus probing attacks. The attacker can target the bus encryption mechanism, that can be for instance a side-channel attack or a fault attack (corruption of a data when writing to memory). The side-channel attack is perfectly suitable for this scenario, because it can work as well on read and write operations. Indeed, they work in a context of known-plaintext or know-ciphertext only. For instance, such an attack has been conducted successfully in a know-ciphertext context of FPGA bitstream decryption [START_REF] Moradi | On the Vulnerability of FPGA Bitstream Encryption against Power Analysis Attacks -Extracting Keys from Xilinx Virtex-II FPGAs[END_REF][START_REF] Moradi | On the Portability of Side-Channel Attacks -An Analysis of the Xilinx Virtex 4 and Virtex 5 Bitstream Encryption Mechanism[END_REF]. The fault injection attack can only be applied in some conditions. For instance, in some cases, it is useless in read mode: indeed, the data that is faulted is subsequently processed within the CPU, and might not be known by the attacker. Indeed, at best, the faulted read data can make the programme crash. But the system can resist the fault injection -but nonetheless without leaving the opportunity for the attacker to recover any information about the injection. Typically, the bitstream decryption in Xilinx FPGAs is sent to the fabric (thus becoming non-functional), but the attacker cannot know which fault has been triggered (it remains internal to the FPGA). Also, if a mode of operation is used in way secure way (an initialization vector is refreshed each time), then it is difficult to observe both a correct and a faulty ciphertext; this is the root of the fault injection resilience countermeasure introduced in [START_REF] Guilley | Fault Injection Resilience[END_REF]. Now, secrets can be recovered from a circuit by various means:

-Non-invasive means: for instance, RE using side-channel analysis attacks, aka SCARE [START_REF] Clavier | An Improved SCARE Cryptanalysis Against a Secret A3/A8 GSM Algorithm[END_REF][START_REF] Guilley | Defeating Any Secret Cryptography with SCARE Attacks[END_REF]; -Semi-invasive means [START_REF] Skorobogatov | Semi-Invasive Attacks -A new approach to hardware security analysis[END_REF]; for instance, RE using fault injection attacks, aka FIRE [START_REF] Manuel San | FIRE: Fault Injection for Reverse Engineering[END_REF]; -Invasive means; for instance, the live probing of signals or the delayering of circuits.

State-of-the-Art Technical Solutions

The protection of circuits against RE has been appropriated by the scientific community (CHES, FDTC, etc.). Many technical solutions, that most of the time assume optimistically that an attacker is omnipotent, have been put forward and studied. The most relevant are detailed in the next subsections.

Physically Unclonable Functions (PUFs)

Physically Unclonable Functions (PUFs [START_REF] Suh | Physical unclonable functions for device authentication and secret key generation[END_REF]) consist in devices that produce a stable yet unique per chip output. They can be used to deter RE by producing internally a key. This key is known by nobody, since it is intrinsic to the electronic circuit; thus there is no possibility that it is compromised by any kind of unwanted disclosure (unintentional copy or theft, i.e. human errors or attacks). Also, as the PUF is unique per chip, it does not prevent to extract the encrypted data (common to a product line), but it prevents from the alteration (by a remote Trojan patch) of all the product line. Indeed, an attacker can only forge the data for the device whose key (PUF result) is known.

Obfuscation

Obfuscation consists in turning a straightforward implementation into a complex description, that is hard to unravel. It has been proved that there is no universal obfuscation technique, that can apply to any algorithm [START_REF] Barak | On the (Im)possibility of Obfuscating Programs[END_REF]. Nonetheless, in theory, a concrete obfuscator for RSA, AES, etc. can exist. This method exists for both the pure hardware modules as well as for the pure software.

At the hardware-level, the typical impediments are:

-Covering of the chip with a top-level metal to prevent seeing the layers underneath, and to fight probing; -Spaghetti routing, for evident control wires not to clearly stand out; -Standard cells scattering, which comes down to the previous item (except that the countermeasure is implemented by constraining the placement and not the interconnection).

At the software-level, the typical impediments are:

-Adding an intermediate virtual machine operating with unknown opcodes; -Call graph re-engineering; -Addition of florid tautologies, randomly and abundantly scattered everywhere in the source code.

Whitebox Cryptography

Whitebox cryptography is a scientific domain that aims at providing a description of an algorithm that embeds a secret (for instance an AES with a constant key), but from which the key cannot be recovered. Some examples exist:

-A PIN code or password verification algorithm, in which the PIN code or the password is stored hashed; -A block cipher that is implemented as its codebook (hence as a huge memory, that is unrealistic in practice).

Concrete implementations of whitebox cryptography make of secret tables much smaller than the codebook [START_REF] Chow | White-Box Cryptography and an AES Implementation[END_REF]. This solution is attractive in hardware also, since EEPROM memories are much more difficult to read by invasive means than RAM or ROM.

Backend-Level Decoiling

Circuits can be reversed by the analysis of their layout. Advanced techniques exist for state-of-the-art circuits [START_REF] Torrance | The State-of-the-Art in IC Reverse Engineering[END_REF]. But on various occasions, older designs have been exposed with much lower technology tools. For instance, -CRYPTO1, the encryption algorithm of the NXP MyFare card [START_REF] Nohl | Reverse-Engineering a Cryptographic RFID Tag[END_REF], and -DSC, the encryption algorithm of the DECT [START_REF] Nohl | Cryptanalysis of the DECT Standard Cipher[END_REF], have between disclosed by the observation of the chip and the reconstruction of its netlist (open source software tools exist for this final step [START_REF] Schobert | GNU software degate[END_REF]). Incidentally, those algorithms have been cryptanalysed almost as soon as they were known, which is a brilliant example of the danger of security by obscurity mechanisms.

Optical dissimulation against delayering consists in making the analysis of the images difficult, by: adding dummy wires, dummy interconnections, dummy gates, etc., scrambling the memories [START_REF] Brier | Fast Primitives for Internal Data Scrambling in Tamper Resistant Hardware[END_REF], using custom cells that resemble despite their function differ; For instance the SecLib cells are all derived from a common template, and are customized by the addition of vias [START_REF] Sylvain Guilley | Security Evaluation of a Balanced Quasi-Delay Insensitive Library[END_REF].

In this section, we promote prospective solutions, most of which do not rely on a technical mechanism. The primary goal of the electronic design industry is to sell products that accomplish a given function. Preventing RE is thus usually only a secondary goal. Thus, the anti-RE mechanisms shall be as less costly as possible. This means that both:

1. the design of the countermeasure (if devised internally) shall be as cheap as possible (or the cost of the IP, if bought from a third-party shall be low), and 2. its overhead must not be too large (in terms of silicon area, code size), and it must be discrete enough not to demand for further developments (e.g. because the clock frequency is not high enough, etc.)

Therefore, the state-of-the-art techniques listed in Sec. 3 are often not suitable. Indeed, they answer (fully or partially) to the issue of preventing RE, but are definitely a cost center. In addition, it can be noticed that they are ad hoc solutions that attempt to fix a local problem. Now, the goal of the protection against RE is to protect the whole circuit, and not only some parts in a unitary manner. Therefore, global solutions can be thought about. The next subsection details some recommendations. They might not cover all the problems of RE, but still already provide some hints for good design practices at low cost.

Leaving No Secret in the Weakest Link

In some communication systems, one party is weaker than the other. For instance, in the case of a smartcard talking to a terminal, the smartcard is the easiest party to attack. Indeed, it is depends on the environment for its power supply and time reference, and it is cost-constrained.

Thus, it shall contain as few secrets as possible. This is indeed possible using public-key cryptography [START_REF] Diffie | New Directions in Cryptography[END_REF], for instance. The terminal generates a signature, and the smartcard verifies it. The verification requires no secret, thus there is no reason to attack the smartcard. This technique allows typically to deny virused code (e.g. containing a Trojan) to be executed on the smartcard.

Providing a Minimalist Application Programming Interface (API)

The more rich the API, the more attack scenarios an attacker can write. At the opposite, if the API is minimalist, most of the operations are realized internally, at an unknown pace. They leave fewer control for the attacker to understand what the circuit is actually computing.

Randomizing the Protocols

If the protocols are deterministic, then they can be replayed, which enables some training. Also, differential attacks (such as DFA [START_REF] Biham | Differential Fault Analysis of Secret Key Cryptosystems[END_REF]) require a correct and at least one [START_REF] Tunstall | Differential Fault Analysis of the Advanced Encryption Standard Using a Single Fault[END_REF] faulty cryptogram. This approach is similar to resilient countermeasures: the secret is made volatile [START_REF] Paul | Leak-resistant cryptographic indexed key update[END_REF], as well as the data [START_REF] Guilley | Fault Injection Resilience[END_REF]. We emphasize that for this class of countermeasure to be efficient, a tamper-resistant TRNG (True Random Number Generator) shall be available.

Conclusions

Fighting RE can be done by dedicated means that have been widely discussed in the scientific literature. Nonetheless, they are costly in general, because they consider a very powerful attacker that is able to play with the target at her will. The solutions we sketch in this article do not have this drawback. They are designed not to give the opportunity for the attacker to be in a favourable position, for instance by ascertaining the attack is impossible to setup. The resulting countermeasures, being only "organizational", are thus also low cost, hence acceptable in an industrial context. Nonetheless, they require to define new specific high-level communication protocols that are low-level security oriented.

In version 3.1 of the CC, ALC details the requirements associated with the developer's site.

Acknowledgments

This work has been partially conducted under the framework of the MAR-SHAL+ (Mechanisms Against Reverse-engineering for Secure Hardware and Algorithms) research project, subsidized by FUI #12, and co-sponsored by the competitivity clusters System@tic (IdF region) and SCS (PACA region).