Ahlem Ellili
email: ahlem.ellili@gmail.com

Jacques Rabier
email: jacques.rabier@imbe.fr

Pascale Prudent
email: pascale.prudent@univ-amu.fr

Marie-Dominique Salducci
email: marie-dominique.salducci@imbe.fr

Mokhtar Lachaâl
email: mokhtar.lachaal@fst.rnu.tn

Isabelle Laffont-Schwob

Decision-making criteria for plant-species selection for phytostabilization: issues of 1 biodiversity and functionality 2 3

Keywords: Atriplex halimus, ecological management, metals and metalloids, 42 phytostabilization, potential invasiveness. 43 44

but also in term of biodiversity preservation.

In polluted protected areas, using phytoremediation raises the question of the choice of the 21 plant species to select. As an example, Atriplex halimus has been identified as a proliferative 22 plant species that needs to be eradicated in the Calanques National Park (PNCal). Since it has 23 been proven that the spontaneous populations of this plant species could phytostabilize shore 24 waste deposits generated by past industrial activities within the PNCal territory, its status 25 seems controversial, presenting a dilemma between biodiversity management of a protected 26 area and ecological solutions for pollution management. To address this issue, we assessed 27 the ability of A. halimus to grow on different soils from this territory, in order to estimate the 28 potential invasiveness of this plant in this territory. Petri dish germinations and pot-growth 29 experiments showed 50% germination of seeds collected on local individuals from the most 30 polluted PNCal soil and 20% growth reduction of seedlings. Soil analysis showed that 31 limitation of growth was caused by high pH value and sparsely available micronutrients as 32 well as metal and metalloid contamination. Our results suggested that local populations of A.

33 halimus may stabilize the highly metal and metalloid polluted salt-affected soils of the PNCal, 34 with low seed germination potential lowering the eventuality of a propagation over the PNCal 35 territory. As a consequence of this study, the administration of the PNCal decided not to 36 remove A. halimus populations along the polluted coastline until another solution to prevent 37 pollution dispersal had been found. This laboratory approach may be extended to other similar Basin (Ortíz-Dorda et al., 2005;[START_REF] Pardo | The use 793 of Atriplex halimus for the phytostabilisation of trace elements contaminated soils under semi-794 arid climate: evaluation of soil health improvement[END_REF]. In South East France (Mediterranean The current PNCal territory was the site of metallurgical and chemical industrial activities 130 from the mid-19th century until the beginning of the 20th century. Silver-galena ore was 131 treated by pyrometallurgical processes during this period (Daumalin and Raveux, 2016). The 132 former Escalette factory (in operation from 1851 to 1924) was the one that had the most 133 intensive activity in the area. The factory, located on the lower slopes of a hill, was 134 characterized by a horizontal smelter chimney as the condensing system. The ruins of this 135 chimney are still present today. In well-constructed flues, the deposit could yield from 2 % to 136 3 %, while loss dispersed in the smoke could amount to around 10 % of the lead produced in 137 the ore, depending on its quality [START_REF] Percy | The metallurgy of lead: including desilverisation and cupellation[END_REF]. Slag was deposited on the old factory site, but 138 was also scattered along the coast in several main deposits and as roadfill. Six sites were [START_REF] Rabier | Heavy metal and arsenic 810 resistance of the halophyte Atriplex halimus L. along a gradient of contamination in a French 811 Mediterranean spray-zone[END_REF]; for E.C., E.S and SO, soils samples 155 were collected under mattoral plant cover (Testiati et al., 2013;Affholder et al., 2013).

156

On each of the six selected sites, soil samples were collected from the top 15 cm after removal 157 of the litter. In order to obtain representative samples of each site, a composite soil sample 158 was achieved by mixing 5 subsamples of equal weight. These 5 subsamples were collected 2 159 m apart in a cross pattern at each site, and were sieved on site to 2 mm mesh. Each composite 160 soil sample was stored in a plastic bag until returned to the laboratory.

161

An ex-situ assay by pot experimentation in the laboratory was conducted with these 162 composite soils, to assess the germination and growth capacities of A. halimus from seeds 163 collected on spontaneous individuals in the area on these MM and salt-affected soils. Total organic carbon (TOC) quantifications were carried out with a Jena Analytic TOC-176 N/C2100S, coupled with HT1300 solid module (ISO 10694, 1995). Total Kjeldahl nitrogen 177 content was measured with Büchi 323 digester and distillation units (ISO 11261, 1995). The following analyzes were performed by the Laboratoire Developpement Méditerranée at 188 Alès (Gard, France). The soil texture was measured on five non-decarbonated fractions (NF X 189 2003), the exchangeable P (P 2 O 5 ) was determined according to the Joret Hébert 190 method (ISO 11263, 1995), the cation exchange capacity (CEC) was measured according to 191 the Metson method (ISO 23470, 2007), extraction of the exchangeable cations was carried out 192 with ammonium acetate (ISO 23470, 2007). , 1984;Talamali et al., 2004;Walker et al., 2005. This population is thus 202 characteristic of the particular conditions of A. halimus populations in the area. The seeds were germinated under controlled conditions with 12/12 h of day/night at 24/20 °C, 210 respectively, constant humidity 60 %, that have been proven to be appropriate conditions to 211 enhance the percentage of germination in A. halimus (Muñoz-Rodríguez et al., 2012). The

244

Hydration rates (HR) were calculated on shoots and roots of plants grown on the different 245 soils, as described elsewhere (Rabier et al. 2007) 246

The root and shoot dry material was ground separately for metal analysis. Finally, MM 247 concentrations were analyzed in root and shoot parts. [START_REF] Prudent | Insights on metal-tolerance and symbionts of the rare species 718 Astragalus tragacantha aiming at phytostabilization of polluted soils and plant conservation[END_REF]Cerovic et al., 2008). Though we used the term 'anthocyanin indices' 258 because the apparatus was developed for relative measurement of anthocyanin, the red 259 pigments of A. halimus are betalains, as for other members of the Amaranthaceae with a 260 similar absorbance spectrum (Lavene, 1995;LoPresti, 2015). For each type of soil, the 261 average of five measurements was made per pot and was repeated for the 10 pot replicates.

262

Before starting the measurement by Multiplex, we covered the soil of each pot with pieces of The texture of soils from the coastal sites (SA, TR and CC) was sandy loam as well as for

337

CN, but with less coarse sand for the latter (Fig. 1). The percentage of germination after 14 days was 80 % in the CN (Fig. 3), while significantly 360 lower for all the other soils tested (it varied from 20 to 60 %). However, the germination of 361 this plant species was mostly affected by the combination of alkalinity and salinity (TR, Fig.

387

The growth traits not significantly inhibited were survival, shoot and root length for E.S and,

388

shoot length and root fresh weight for TR. was a selective transfer of each of these elements between the soil and the root parts, as Pb 420 was better transferred to root than Sb and Zn (Fig. 2). The transfer coefficients from soil to 421 aerial parts were always < 1 for As, Cu, Fe and Pb (supp. data 4). TF values were more than 1 422 in the case of K and Na for all conditions. TF values were only > 1 for Zn in the case of CN, 423 CC and SO. Mn was present in soils at moderate to high concentrations, with higher 424 concentrations in E.S, SO and SA soils. However, its transfer to shoots was particularly low 425 in E.C, E.S and SA soils, although Mn TF value was high for the CN.

426

The elements that are regulators of osmotic pressure, e.g. Na and K (Fig. 2), were 427 preferentially accumulated in shoots in all the soils tested. However, the concentration ratios 428 between Na and K in shoots were strictly above 1 for TR and SA, and below 0.5 in all the 429 other PNCal soils, while this ratio was equal to 0.51 for CN (supp. data 5). Reduced additional individual losses were shown during plant growth monitoring for TR.

505

However, a growth inhibition of as much as 60-80 % for the less polluted soils was observed.

506

This demonstrated a negative impact on growth of these mainly oligotrophic soils,

507

independently of their pollution level. This is in accordance with the studies by other authors Felix et al., 1978;Fogarty and Tobin, 1996;Mandyam and Jumpponen, 2005; 562 Mugerwa et al., 2013;Stainsack et al., 2003). However, the ability of fungal symbionts to Supplementary data 5: Na/K ratio in different soil types, and in root and shoot of A. halimus growing on these different soils.

Soil origin Soil Na/K Root Na/K Shoot Na/K Control (CN) 0,5656±0,0008a 0,109±0,004c 0,51±0,03b

Calanque de Saména (SA) 0,42±0,02c 0,42±0,05a 1,03±0,04a

Calanque des Trous (TR) 0,33±0,01d 0,35±0,05a 1,09±0,08a

Cap croisette (CC) 0,1741±0,0003e 0,25±0,02b 0,470±0,003b E. Chimney (E.C) 0,481±0,003b 0,25±0,01b 0,280±0,004c E. Slagheap (E.S) 0,329±0,002d 0,091±0,008c 0,139±0,001d Sormiou (SO) 0,056±0,0004f 0,16±0,02b 0,207±0,003d

Different letters following means ± standard error (SE) in a column indicate significant difference (n=3, p≤0.05, Wilcoxon test).

support data 1 Click here to download Interactive Map file (.kml or .kmz): GPS_data-0607073342.kml

  83 coast), spontaneous populations of A. halimus are found in polluted coastal soils of a 84 protected area i.e. the Calanques National Park (PNCal). Though part of the populations 85 present on the site may be native of Ibero-Provençal origin, according to Ortíz-Dorda et al. 86 (2005), the Mediterranean National Botanical Conservatory (MNBC), a French authority for 87 plant conservation, considers that many ornamental individuals of this species planted as 88 hedges near housing might have escaped from neighbouring gardens and originated most of 89 the populations currently occurring along the coast of the PNCal on the basis of 90 phytosociological criteria. Therefore the MNBC suggested the eradication of A. halimus from 91 the territory of the PNCal in the same way as the notorious invasive species Carpobrotus 92 edulis in Mediterranean (Affre et al., 2010). However, the composition of the soil near the 93 coastal road in the PNCal was definitely altered by slag deposits from past industrial activities this territory. More scientific information on the ecological preferendum of A. halimus is thus 119 necessary. As a first step, the ability of local A. halimus populations to germinate and grow on 120 various soils from the PNCal territory needs to be assessed. Therefore, an ex-situ experiment 121 was conducted in laboratory on the germination, seedling growth and MM accumulation 122 capacities and on chemical and ecological traits of A. halimus in various PNCal soils. The 123 results are discussed in a global perspective to propose a methodological approach for the 124 selection or keep up of non-native or potentially invasive plant species in polluted protected

139

  selected for this study (supp. data 1), located in the peri-urban area of Marseille, south-east 140 France, i.e. Calanque de Saména (SA, 43 °13.749' N; 5 °20.960' E) and Calanque des Trous 141 (TR, 43 °13.233' N; 5 °20.766' E), corresponding to soils from moderately polluted seashore 142 sites where A. halimus grows spontaneously; Escalette Chimney (E.C, 43 °13.584' N; 5 °21.32' E) and Escalette Slagheap (E.S, 43 °13.454' N; 5 °21.126' E), corresponding to soils from the 144 former Escalette smelter heavily polluted by two different steps of the smelting process; Cap 145 Croisette (CC, 43 °12.812' N; 5 °20.899' E), a site exposed to very low pollution and seaspray; 146 Sormiou (SO, 43 °12.806' N; 5 ° 24.964' E), a site exposed to very low pollution and no 147 seaspray; and in order to have a reference condition, was chosen as a control substrate a 148 loamy horticultural soil (CN, mixture of peat moss, sphagnum peat moss, wood fiber and 149 plant cultivation support composted with NPK 8-2-7, Botanic®). The areas were chosen on 150 the basis of previously published data on metal and metalloid contamination in the PNCal 151 area (Laffont-schwob et al., 2016) and according to similar physico-chemical characteristics 152 of the soils (except level of MM contamination). All soils are pooled samples of five sub-153 samples collected on the top soil: for SA, TR and CC, soils are from the root zone of Atriplex 154 populations as previously described

  . Soil physico-chemical analyses 166 In the laboratory, soil composite aliquots were air-dried at room temperature and then ground 167 to pass through a 0.2 mm titanium sieve (RETSCH zm 1000 with tungsten blades) before 168 analyses. Physico-chemical parameters of soil, i.e. salinity, pH, conductivity, texture, total 169 organic carbon and total Kjeldahl nitrogen content, and trace and major element 170 concentrations, were determined on 3 analytical replicates of each soil composite sample per 171 site. 172 Measurements of pH (ISO 10390, 2005) and salinity (calculated from conductivity) were 173 determined by potentiometry in a 1:5 soil:water suspension using a Multi 3420 SET B-WTW 174 pH meter and ECmeter (Baize, 2000).

  175

178

  For MM analyses, soil samples were mineralized in a microwave mineralizer (Milestone Start 179 D) using aqua regia (1/3 HNO 3 + 2/3 HCl). The solutions obtained for soil mineralization 180 were filtered with a 0.45 µm mesh and the metal levels were determined by ICP-AES 181 (JobinYvon Horiba, Spectra 2000) for As, Cu, Fe, Mn, Pb, Sb and Zn (Lotmani et al., 2011); 182 flame AES (Thermo Scientific ICE 3000) was used for Na and K measurements. Cd was not 183 taken into account since results showed concentration levels far below 1ppm. Quality 184 assurance controls and accuracy were checked using standard soil reference materials (CRM 185 049-050, from RTC-USA) with accuracies within 100 ± 10 %. Results are presented in supp.

  187

  seeds were collected in September 2013 from 5 individuals of the spontaneous 196 population at Escalette (highly polluted site, supp. data 1), then pooled and stored in paper 197 bags at room temperature until use. No information is available on this population regarding 198 its potential ornamental origin, but it was confirmed that the chromosome number of this 199 populations was diploid (2n = 2x = 18) (Snow, 1963), corresponding to the phenotype of the 200 subsp. halimus originating from France and Spain, according to Le Houérou, 1992; McArthur 201 and Sanderson

  from their bracts by dragging them over sandpaper. The seeds were 206 surface-sterilised just before use by immersion in 5 % (v/v) sodium hypochlorite for 10 min 207 and rinsed three times in sterile water, a treatment that does not affect germination parameters 208 or seedling characteristics (Muñoz-Rodríguez et al., 2012).

  209

212

  Petri dishes were put in a plant growth chamber (SANYO MLR-351H). The light was 213 provided by fluorescent lamps that produce an average photosynthetic photon flux density of 214 300 µmol/m 2 /s. Germination tests were carried out in Petri dishes filled with 40 ml of every 215 soil type (corresponding to 20 g of composite soil (sieved to 2 mm) from each site and 5 g of 216 control substrate (CN), due to the different substrate densities). These different soils were 217 watered with distilled water to near field capacity. Ten replicates of 30 seeds were used for 218 each soil type. Germination was monitored every 2-days by counting the number of 219 germinated seeds per Petri dish (Keiffer and Ungar, 1997). Seeds were considered to have 220 germinated after radicle emergence. 221 222 2.5. Growth conditions and plant morphology 223 The six composite soils (sieved to 2 mm) and the control (CN) were distributed in individual 224 120 ml-paper pots (100 ml of dried soil per pot from the six PNCal sites or CN) in order to 225 get 10 pots for each soil type. These pots were placed in a plant growth chamber under the 226 same previously described conditions and were sprayed with distilled water until soil water-227 holding capacity (WHC) was reached. WHC had been previously determined for each soil 228 type. 229 Seedlings from the Petri dishes were transplanted into the pots, being careful to keep the 230 seedlings from one type of soil in the Petri dish in the same soil in the pot (7 types of soils i.e. 231 6 sites and CN, 5 plants per pots, 10 replicates per type of soil). Seedlings were grown for 63 232 days and they were watered with distilled water every two days to restore the initial WHC. 233 Plant height (shoots) and number of leaves were measured every 7 days. 234 At the end of the experiment, the plants were carefully removed and then separated into roots, 235 stems and leaves. Roots were thoroughly washed with tap water to clean off soil particles and 236 were rinsed with deionized water (three successive rinses of 30 s each), then gently blotted 237 between paper towels. Morphological parameters (root length, shoot length, and leaf number) 238 were measured on each plant. 239 Leaf surface areas were determined using a scanner and ImageJ software (URL: 240 http://rsbweb.nih.gov/ij/). 241 Shoot and root fresh weights (FW) were determined immediately. The pooled root samples 242 per pot were oven-dried at 40 °C for 48 h to determine the root dry weight (DW). Dry weight 243 determination was done identically from pooled shoot samples per pot.

  Non-destructive plant physiological index measurements 250 At three different stages (35, 55 and 63 days), plant physiological indices were estimated 251 optically using a Multiplex® 3 non-destructive measurement equipment (FORCE-A, Orsay, 252 France; Agati et al., 2011). This portable fluorimetric device uses fluorescence technology 253 with multiple excitations to measure constitutive and induced epidermal phenols, flavonols, 254 anthocyanins, chlorophylls and a chlorophyll-to-flavonoid ratio referred to as nitrogen 255 balance index (NBI). Different combinations of the blue-green, red and far-red fluorescence 256 signals at the various excitation bands could be used as indices of the different compounds 257 (Agati

263

  blackboard wall stickers to avoid fluorescence of organic matter from soil. 264 265 2.7. Plant elemental analysis 266 Before analysis, dried shoot and root plant samples from the 10 replicates were pooled 267 separately. They were then ground to pass a 0.2 mm mesh titanium sieve and three aliquots 268 were analyzed by sample. About 0.5 g of dry matter was digested with the microwave 269 digestion system Milestone start D with a HNO 3 , H 2 O 2 and ultra-pure H 2 O mixture (volume 270 proportion ratio 2:1:1). Extracts were analyzed for pseudo-total metals and metalloids (MM) 271 i.e. Cu, Fe, Mn, Pb, and Zn content, using inductively coupled plasma-atomic emission 272 spectroscopy (ICP-AES, JY 2000 Jobin Yvon Horiba) and by graphite furnace AAS (Thermo 273 Scientific ICE 3000) for As and Sb, while flame AES (Thermo Scientific ICE 3000) was used 274 for Na and K measurements. Three analytical replicates were performed for each type of plant 275 sample. Standard plant reference materials (DC 73349) from China National Analysis Centre 276 for Iron and Steel (NSC) were analyzed as part of the quality control protocol (accuracies 277 within 100 ± 10 %). 278 To evaluate the phytoremediation ability of the plants, bioaccumulation factors (BCF) and 279 translocation factors (TF) in each soil were computed according to the following formula 280 (Yoon et al., 2006): 281 BCF = C root /C soil (1) 282 TF = C shoot /C root (2) 283 Where C soil , C root , C shoot are average concentrations of trace elements in soils, roots and shoots, 284 respectively. These factors indicate the importance of pollutant transfer from soils to roots 285 (BCF) and from roots to shoots (TF).

286A

  quantitative approach of the multi-element contamination can be made based on the 287 pollution load indices (PLI) calculated for each soil following Rashed (2010): = [MM] considered soil /[MM] SO 290 CF being the soil contamination factor and Sormiou (SO) being considered as the reference 291 area for this study since MM soil concentrations at this site are very close to the local 292 background of contamination in the PNCal area (Affholder et al., 2014). A PLI value strictly 293 above 1 indicates that the soil may be considered as polluted.

  germination percentage at 4 days was negatively correlated both with soil pH and 363 conductivity (supp. data 3). The results also showed a weak negative correlation after 14 days 364 with Zn (r s = -0.45, p-value < 0.0001) and Cu (r s = -0.45, p-value < 0.0001). Very weak 365 negative correlations were observed for As (r s = -0.30, p-value < 0.0001) and Pb (r s = -0.28, 366 p-value < 0.0001). The negative correlation between germination and pH increased with time, 367 while the correlation with exchangeable Na and conductivity decreased. The negative 368 correlation between germination and soil Zn concentration increased with time. These results 369 can be interpreted as a rapid osmotic effect for germination inhibition by conductivity, with 370 possibly a partially transitory priming effect for Na(Capron et al., 2000) and a progressive 371 inhibition by MM, mainly Zn.372These results demonstrated the ability of A. halimus to germinate up to 50 % even in the case 373 of soils containing up to 2 500 mg/kg of As and up to 30 000 mg/kg of Pb near the horizontal 374 chimney (E.C), and the limitation of germination potential by pH alone or combined with 375 salts for all the PNCal soils. growth traits expressed as percentages compared to control can be classified by 379 increasing order of effects, as follows: survival (given by the number of individuals) < shoot 380 and root lengths < shoot and root fresh weights < leaf surface area (Fig.4). In other words, 381 amongst growth traits, leaf surface, length and plant weight were the most significantly 382 inhibited with 60-90 % reduction compared to control. After germination, individual loss 383 continued during plantlet growth up to 10-20 % for TR whereas no significant losses were 384 observed for the four other PNCal soils. Reductions of all parameters except survival for E.C 385 and SO soils were significantly greater than those for SA soil. The growth traits were not 386 significantly inhibited for SA and only concerning leaf surface and shoot fresh weight for CC.

  , the highest indices of flavonol, betacyanin (refered as antocyanin index for 392 Multiplex® index) and phenol were obtained for plants grown in SO soil, whereas phenol and 393 betacyanin indices were the lowest in CN soil. Chlorophyll indices were the most stable, with 394 significantly lower values in E.S, E.C and CC soils than in other soils. 395 Monitoring of plant chemical traits with non-destructive index measurements (Fig. 5) enabled 396 observation of a time-dependent response. As a first step, betacyanin indices decreased in basal leaves and stems in CN and SA and increased in SO soils, immediately followed by an 398 increase in chlorophyll index in all soils except SO, then in phenol indices in all soils and 399 finally a decrease in flavonol indices. The latter was concomitant with the appearance of 400 necrosis in the basal leaves in E.C and E.S. Moreover, there were no specific visual symptoms 401 of toxicity and/or necrosis on the other leaves and heterogeneity of betacyanin pigmentation 402 developed in the same way from rib to limb on CN soil as on the PNCal soils. The general 403 trend of the curves (Fig. 5) showed that this physiological succession was faster for the 404 control. Thus part of the response of chemical traits may be due to the physiological stage of 405 the seedlings.

(

  photography archives, the soils from these sites, heavily contaminated and disturbed during

563

  limit metal transfer from soil to A. halimus may not be the only factor involved. It has 564 recently been proven that A. halimus, with its own biosynthesis of enzymes and antioxydants, 565 may bind, sequestrate and reduce the harmful effect of trace metals(El-Bakatoushi et al., 566 2015). Consequently the occurrence of this plant species in coastal polluted soils may not 567 increase the potential transfer of MM to the food chain and may favour phytostabilization. Decision-making criteria for the PNCal to maintain or eradicate A. halimus 570In response to the question of whether A. halimus is able to grow on more or less polluted or 571 salt-affected soils from the PNCal -in other terms, in soils different from those in which it 572 spontaneously grows, -the answer is yes. However, a high loss of 50 % at the germination 573 stage was observed. The results also showed 80% growth reduction for the surviving plants in 574 the two technosols (E.C and E.S.). Moreover, the controlled conditions used mimicked the 575 field conditions except for xericity, providing more favourable conditions than the in natura 576 ones. The nitrophilous character of A. halimus also limits its potential for the colonization of 577 new territory. Thus, the oligotrophic and less polluted soils of CC and SO showed a 578 significant reduction of growth, while that of SA exhibited better growth results and higher 579 chlorophyll indices associated with more widely available micronutrients, despite its 580 significant pollution. 581 Given the low translocation factors, our results confirm that the individuals of A. halimus 582 growing naturally on polluted soils along the coast do not present a risk of transfer of 583 pollutants to aerial parts and the food chain and are tolerant to MM. It would appear that the 584 germination and growth of this species require disturbed soil sites with increased 585 macronutrient availability and associated symbionts. On the basis of these results, the PNCal 586 is considering maintaining A. halimus stands in the polluted soils of the coastal area until a 587 better ecological solution for pollution containment is found. study, we wanted to reconsider the simplistic vision of pollution treatment vs 591 biological conservation in polluted protected areas. In various cases, plants spontaneously 592 growing in polluted areas are adapted to pollution and may prevent pollutant transfer. The 593 potential invasiveness of these pollutant-tolerant plants in such field may be easily 594 experienced by analysing biotic and abiotic factors favouring their germination and growth in 595 ex-situ assays and give decisional tools for the protected area managers.

  Figure1Click here to download Figure: Figure1 new.pdf

  Except for the control substrate (CN) with a pH value ca. 6, all soils of the PNCal area were 328 alkaline including the technosols (E.C and E.S), being characteristic of local limestone soils 329 (Fig.1). SO had the lowest conductivity and SA the highest, but lower than 2000 µS/cm.

	306
	307	vesicles (V) and arbuscular (A) structures, using optical microscopy at 100 and 400
	308 330	magnifications.
	309 331	The structures of dark septate endophytes (DSE) i.e. septate melanized mycelia and Therefore, according to natural soil saline classification and conductivity data, all the PNCal
	310 332	microsclerotia were observed. The percentages of each symbiotic structure (A, M, V and soils, as well as CN, may be considered as non-saline.
	311 333	DSE) observed in the samples were independently estimated for each soil type, using the TOC values in all PNCal soils were very low except for SO, with an average value of 110
	334	formula of Zhang et al. (2010): mg/g. The TOC values were 14 (CC) to 3.5-fold lower (SO) than CN. No NTK differences
		were observed for SA and SO compared to CN, although other NTK values were up to 7-fold
	317
	294
	318
	295
		2.9. Statistical analysis
		2.8. Root symbiosis observations
	300
	324
	301	method described by Vierheilig et al. (1998) for staining fungal structures before observation.
	302 325	First roots were soaked for 3 min in 10 % KOH bath at 80 °C then rinsed and stained with
	326	Pelikan ® blue ink, in a 5 % acetic acid solution at 90 °C for 3 min. The roots were mounted 3. Results
	327	3.1. Soil characterisation

296

Before the final harvest, an individual from each pot was removed for root symbiosis analysis 297 (10 replicates per soil type). The roots of these plants were rinsed first under tap then 298 deionized water, pooled in three replicates for each soil type and stored in alcohol (60 %, v/v) 299 at room temperature until proceeding. To limit the use of highly toxic products, we used the 303 on slides. For each sample, five slides were prepared, each containing 10 root fragments of 1 304 cm length. Therefore the results are based on the observation of 50 fragments of roots per 305 replicate. The arbuscular mycorrhizal (AM) structures were sorted into mycelium (M), 312 Percentage of fungal structures observed = 100 * number of fragments where the structure 313 was observed / number of observed fragments. Information about root symbioses may 314 indicate the ability of the plant to interact with edaphic micro-organisms, playing a role in 315 plant pollutant tolerance but also giving an indication of the potential occurrence of symbionts 316 in polluted soils (biological characteristic of soils). 319 Statistical analyses and control carts were performed for all data using JMP 11 statistical 320 software (SAS Institute, Cary, North Carolina, USA). A. halimus germination percentages, 321 MM concentrations in plant parts and soils, plant stress indices and fungal root colonization 322 percentages were compared using non-parametric Wilcoxon rank sum test (Kruskal-Wallis 323 test) and Wilcoxon each pair test. 335 lower (E.C, E.S) than CN. The fertility of these soils could be thus considered as low.

336

  This revealed a potentially high ecotoxicological risk associated with both technosols i.e. ingestion 352 or inhalation of soil particles may expose biocoenosis to non negligible effects of trace

	353
	354	elements.
	355	Following these analyses, the loamy horticultural soil (CN) could be considered as control
	356	soil and the soil of CC and SO were the least PNCal polluted soils, being also the least
	357	seaspray-affected of the four seashore soils.
	358
	359	3.2. Germination test
	346
	347	and a very high content of As in E.C (about 0.3 %), but also high values of Fe, i.e. 1 to 5 % as
		for all PNCal soils (Fig. 2 and supp. data 2).

The granulometry of SO soil 338 corresponded to clay loam while the technosols (E.C, E.S) were sandy clay loam with coarser 339 sand for E.S.

340

According to agronomic criteria (Fig.

1

), soils from the coastal sites contained highest 341 concentrations of exchangeable Na but also of the major fertility elements (P, Ca, Mg, K), 342 with less exchangeable P for TR. The technosols (E.C, E.S) and the soil from SO had a low 343 content of exchangeable Na but also of exchangeable P, Ca, Mg, K. As expected, CN 344 presented good fertility indices.

345

The E.S and E.C technosols had the highest Pb and Zn contents whose varied from 1 to 3 %, 348 We used the PLI to compare the relative load of the mixed pollution of the various soils. PLI 349 for E.C and E.S soils were at least 20-fold higher than all the other soils i.e. PLI E.C = 216 and 350 PLI E.S = 203 whereas PLI SA = 6, PLI TR & PLI SO = 4, PLI CC = 1.4 since PLI CN = 1.3.

  The results of Pb and TOC for SO were a little above those of natural soils, but SO was not 470 exempt from previous anthropogenic activities that took place at the beginning of the 19th 471 century(Fressoz, 2013; Daumalin and Raveux, 2016). Pb or Zn treatments for A. halimus sub. schweinfurthii(Lotmani et al., 2011) and 495 separated Cu or Zn treatments for A. halimus sub. halimus(Márquez-García et al., 2013).

	446	4. Discussion
	447	4.1 Do PNCal soils have good agronomic properties?
	472 496
	448	The metal and metalloid contamination of PNCal soils has previously been partially studied
	449 473 497	and the diffuse pollution of these soils has been discussed in separate publications (Affholder In summary, the PNCal soils have low fertility with high pH, high Fe content and low nutrient Finally, our results indicated that the potential for widespread dissemination of A. halimus by
	450 474 498	et al., 2013; Heckenroth et al., 2016; Rabier et al., 2014; Testiati et al., 2013). However, in and TOC contents. The anthropogenic addition of materials maintained or increased pH and seed germination is very limited in the PNCal soils. Previous test of germination with an
	451 475 499	this study, soil characterization was completed by fertility parameters for the seashore sites. Fe concentration, but lowered TOC. Fertility was slightly increased for seashore sites in agronomic plant species i.e. Raphanus sativus showed a percentage of germination of 83±6,
	476 500	Soils were alkaline with pH ranging from 7.5 to 8.5, typical of calcareous areas, but the relation with domestic anthropogenic nitrogen deposition and a covering layer of excavated 72±9 and 90±3 on E.C, SO and CN soils respectively (unpublished data), confirming the low
	501	loam (Rabier et al., 2014). The positive common denominator of these soils is that high pH, capacity of A. halimus to develop on other soils than the type on which it spontaneously
	430 502	develops compared to an agronomic species.
	431 503
	504	3.6. Root fungal colonization 4.3. A. halimus growth inhibition in PNCal soils
	486
	487	inhibition whose differentiated the effect of alkalinity from salinity (Chen et al., 2010; Ma et
	440 488	al., 2015). Sodium soil concentration may explain the delay of germination shown by the
	441 465 489	colonisation percentages and As, Pb and Zn concentrations in soils, with Spearman characteristic S-shaped aspect of germination for seashore soils which has been observed for
	442 466 490	coefficients of 0.70, 0.63 and 0.56, respectively (p-value ≤ 0.01). DSE colonisation toxicity is more well-known, were also present at high concentrations. some other Atriplex species and other Chenopodiaceae (Capron et al., 2000; Katembe et al.,
		percentage was also negatively correlated with available P in soil (Spearman coefficient of -Zn concentration was locally important (Testiati et al., 2013), which could be explained by 1998). The effect of multiple metals and metalloids is difficult to appreciate because they
	444

432

Two types of fungal structure were observed in A. halimus roots i.e. arbuscular mycorrhizal 433 fungi (AMF) and dark septate endophytes (DSE). Both kinds of symbiotic microorganisms 434 were present in all root systems for each of the PNCal soils. A discriminant analysis was 435 applied on the percentages of each fungal structure (Fig.

6

). Along the first dimension, there 436 was a separation between CN and CC, with a higher occurrence of AM colonization, and E.C 437 and E.S with more DSE. In the second dimension, more arbuscules were observed in roots 438 from CC and SO soils. With this analysis, three main groups may be identified: (i) CN, (ii) 439 CC, TR, SA and SO, (iii) E.C and E.S. A strong correlation was detected between DSE 443 0.55 at p-value ≤ 0.01).

452 highest exchangeable Ca and K values found for the soils from less polluted areas of the 453 seashore were associated with the presence of scrap materials such as lime mortar for Ca, and 454 for K an origin that could be linked to bricks and tiles with aminosilicate of potassium as the 455 active substance (Testiati et al., 2013). The soils from the seashore were mainly sandy clay 456 soils, while the granulometry of the technosols from E.C and E.S had no relation with the 457 mineralogy of natural soils. There was more fine dust in E.C without coarse sand and coarser 458 sand and less fine dust in E.S soil. Technosol from E.C seemed to be very compact when dry, 459 like real clay soil. 460 Concerning soil pollution, the strong correlation between As and Pb, particularly for E.C soil, 461 was probably related to their deposition as lead arsenate, while the correlation between As 462 and Sb was explained by their belonging to the same group in the periodic table in relation to 463 the same behaviour during the ore treatment and dust deposit in soils (Testiati et al., 2013). Sb 464 concentrations were low in soils except for E.S and E.C, where As, Pb, Zn and Cu, whose 467 differences in ore origin during the smelter activity and use of pyrite in the former sodium 468 carbonate factories at the vicinity of the smelter factory (Daumalin and Raveux, 2016).

469 477 Fe and Mn oxides and low TOC lowered MM mobility and limited their transfer into plants 478 and into marine ecosystems (Bert, 2012; Dang et al., 2014; Lenoble et al., 2015; Lin et al., 479 2008; Martínez-Sánchez et al., 2011). The higher fertility level compared to the other PNCal 480 soils of the coastal area where spontaneous A. halimus populations are exclusively localized 481 for the moment may be a driving parameter for A. halimus development. 482 483 4.2. Is A. halimus able to germinate in all the PNCal soils? 484 The results showed that pH, Na and Zn were involved in A. halimus germination inhibition. 485 The data of pH and soil composition were in accordance with those of studies of germination 491 occur simultaneously in the field and their presence is correlated with other factors such as 492 salinity and alkalinity. The correlation between Zn and germination rate was weak, which is 493 in accordance with other studies under controlled conditions showing no effect of separated 494 Cu,

  Physico-chemical characteristics of the PNCal soils and control. Parameters: EC: Average metal and metalloid concentrations (logarithmic scale, mg/kg of dry weight, Growth traits and survival (as percentage of control) for A. halimus in the PNCal soils, Monitoring of chlorophyll, flavonol, anthocyanin and leaf epidermal phenol indices in 893 A. halimus leaves depending on PNCal soils types (n=10, p ≤0.05). Different letters following 894 curves indicate significant difference for the same parameter (Wilcoxon test). Evolution of Spearman correlations between germination percentages and soil

	pH EC µS/cm TOC (mg/g) NTK (mg/g) Clays (mg/g) Fine silt (mg/g) Coarse silt (mg/g)	596 597 868 869 Fig. 1: 870 Figures electrical conductivity, TOC: total organic carbon, NTK: total Kjeldahl nitrogen, Exch. P 2 O 5 : 4 6 8 6,3 8,5 7,9 8,6 8,6 8,1 7,6 Fine sand (mg/g) Fig. 5: 895 2 871 exchangeable P mg/kg P 2 O 5, Exch. Na, K, Mg, Ca: exchangeable Na, K, Mg, Ca (mg/g), 872 CEC: cationic exchange capacity (Metson cmol+/kg). Sites: CN: control; SA: Calanque de 873 Saména; TR: Calanque des Trous; CC: Cap Croisette; E.C: Escalette Chimney; E.S: Escalette 874 Slagheap; SO: Sormiou. 875 876 Fig. 2: 885 886 Fig. 4: 888 Cap Croisette; E.C: Escalette Chimney; E.S: Escalette Slagheap; SO: Sormiou. Different 889 letters above mean values (± standard error (SE)) indicate significant difference for the same 890 parameter (Wilcoxon test). 891 896 Fig. 6: Canonical plot of results of discriminant analysis with the percentages of each fungal 897 structure (A: arbuscule, M: mycelium, V: vesicle and DSE: dark septate endophytes), and the 898 7 soil types as parameters (n=3 and F (24,39) =7.67, P<0.0001; Wilk's Lamda = 0.002; 899 Canonical1=59.9%, Canonical2=28.3%). For each category, inner and outer circles represent 900 the 95% confidence intervals for the means and the 50% prediction intervals, respectively. 901 The seven soil types explain 59.9% and 28.3% of the observed variance in fungal occurrence 902 on axis 1 and 2, respectively. 903 904 Supplementary data: 909 samples from each soil type. Different letters following means ± standard error (SE) in a 910 column indicate significant difference (n=3, p≤0.05, Wilcoxon test). 912 parameters up to 15 days after imbibition (n= 10, p ≤0.05). ρX,Y: Spearman correlation, 913 X=G: germination percentage, Y=pH, EC, TOC, (Na): Na concentration, (Zn) Zn 0 500 750 1000 520 626 1079 570 Coarse sand (mg/g) 400 480 230 250 300 400 372 Exch. P2O5 (mg/Kg) 0 100 200 6 27 111 53 39 38 27 7 5 CEC (cmol+/kg) 0 0 2 4 0 100 150 200 3 2 1 1 1 280 (mg/g) Exch. Ca 300 250 0 50 100 150 200 50 100 150 164 169 137 164 63 97 168 119 (mg/g) Exch. Mg 198 116 180 168 97 151 Exch. K (mg/g) 169 151 120 102 64 104 Exch. Na (mg/g)
		892 916	CN SA TR CC E.C E.S SO Site

877 DW) in soils, shoots and roots of A. halimus (n=3, p ≤0.05). Sites: CN: control; SA: Calanque 878 de Saména; TR: Calanque des Trous; CC: Cap Croisette; E.C: Escalette Chimney; E.S: 879 Escalette Slagheap; SO: Sormiou. Different letters above mean values (n=3, p ≤0.05) mean 880 significant difference (Wilcoxon test).

881 882 Fig. 3: Effect of PNCal soil contamination and/or salinity on germination of A. halimus 883 during the 14 days of the experiment. Different letters above mean values (n = 10, p ≤0.05) 884 indicate significant difference (Wilcoxon test). 887 n= 10, p ≤0.05). Sites: CN: control; SA: Calanque de Saména; TR: Calanque des Trous; CC: 905 Supp. data 1: Map of soil sampling locations (SA: Calanque de Saména; TR: Calanque des 906 Trous; CC: Cap Croisette; E.C: Escalette Chimney; E.S: Escalette Slagheap; SO: Sormiou) 907 and seed sampling location (E) in the Calanques national park (PNCal). 908 Supp. data 2: Average metal and metalloid concentrations (mg/kg of dry weight) in soil 911 Supp. data 3: 914 concentration. The Line of Fit element shows a linear regression with confidence intervals in 915 shady colors.

  Different letters following means ± standard error (SE) in a column indicate significant difference (n=3, p≤0.05, Wilcoxon test).

		0.28±0.07 b	0.29±0.02c	0.08±0.02 bc	3.24±0.17cd 0.24±0.02bc 10.56±0.94a 0.07±0.01b	0.06±0.00b	0.68±0.02d
	Cap croisette (CC)	0.17±0.00 b	0.42±0.01bc	0.04±0.00 de	4.18±0.15ab 0.23±0.00bc 8.41±0.79ab 0.15±0.01b	1±0a	1.10±0.03c
	E. Chimney (E.C)	0.03±0.00 c	0.38±0.04c	0.1±0.01c d	4.45±0.63a 0.14±0.01cd 4.88±0.49c	0.04±0.01b	0.05±0.01c 0.23±0.02ef
	E. Slagheap (E.S)	0.02±0.00 c	0.04±0.00d	0±0f	3.46±0.09bc 0.11±0.01d 5.62±0.52bc	0±0b	0.02±0.00d	0.10±0.01f
	Sormiou (SO)	0.14±0.01 b	0.89±0.04a 0.07±0cd 3.33±0.22c 0.31±0.01b 4.67±0.36c	0.39±0.05a	1±0a	1.91±0.11b

Acknowledgements

work has been carried out partly thanks to 605 the support of the A*MIDEX project (n° ANR-11-IDEX-0001-02) funded by the 606 Investissements d'Avenir French Government program, managed by the French National 607 Research Agency (ANR) (project named SynTerCalM). This research has been made possible 608 by participation in the EU COST Action FA 0901, favouring links between scientists of 609 various countries on halophytes. Many thanks to the Calanques National Park and the CD13 610 for providing access to the field.

References 613

Abbad, A., Cherkaoui, M., Wahid, N., El Hadrami, A., Benchaabane, A., 2004 656 Capron, I., Corbineau, F., Dacher, F., Job, C., Côme, D., Job, D., 2000 Total Environ. 368,[456][457][458][459][460][461][462][463][464] Zhang, X., Zhang, S., Xu, X., Li, T., Gong, G., Jia, Y., Li, Y., Deng, L., 2010


Deepak Subramanian

Guillaume Hiet

Christophe Bidan Centralsupélec

A self-correcting information flow control model for the web-browser

Web-browser security with emphasis on JavaScript security, is one of the important problems of the modern world. The potency of information flow control (IFC) in the context of JavaScript is quite appealing. In this paper, we propose a novel approach to help track and learn from information flows. This learnt data can subsequently be used to create a more adaptive and effective IFC model. As the information about a function augments, potential leaks are also thwarted.

Introduction

The state of the internet has been evolving with the constant sharing of content and functionalities between websites. Many modern technologies proposed in HTML5 have served to increase capabilities of the browser while also raising new possibilities for information leakages. For example, LocalStorage provides an efficient way for persistence in the web-browser. This could cause browser-side persistent cross-site scripting if not sanitized properly. Another example is the use of WebSockets, which provides a real-time communication channel to the server. Once the channel is open, further messages in the channel do not require re-authenticaion or cookies since the connection is already established. There is hence a clear need to monitor the browser at a variable level as JavaScript slowly dominates the application space.

Web-browser vulnerabilities have constantly been cited among the top prevalent threats as seen clearly in lists such as the OWASP Top Ten1 . Despite the numerous safeguards proposed over the years, including some important considerations such as the "same-origin policy" and "content security policy", these threats continue exist. Moreover it is important to have a method to provide security while preserving the user experience. It is our sincere belief that Information Flow Control (IFC) could be an effective solution to this problem.

This paper is a logical extension an approach called Address Split Design (ASD) proposed by Deepak et. al. [START_REF] Subramanian | Preventive information flow control through a mechanism of split addresses[END_REF]. In ASD, the authors show how the use of IFC can prevent unauthorized code from accessing sensitive information thereby protecting leakage of sensitive information. ASD maintains a dummy/public value for every secret variable and uses this public value in case of unauthorized access. In this paper, we first propose a change to how ASD maintains runtime monitoring. This proposal could reduce the number of operations that need to be performed when a secret variable is updated. In this next part of the paper, we describe a learning-based approach to information flow control on a web-browser. After the initial execution of a program using ASD, information regarding the propagation of the secret is remembered. This information is used in a self correcting mechanism for the analysis and enforcement of security on an interpreted language such as JavaScript. The bedrock of our proposed mechanism lies in correcting any possible leak through learning rather than using rigid security guarantees. Hence, in this paper, we first start with ASD as the base model and remember all the flow propagations which are used subsequently thereby accounting for all possible information flows.

The rest of the paper is organized as follows. The section 2 provides a summary of the various related work. This is followed by a description of our model, address split design with dependency graphs (ASD-DG), along with relevant formalisms, in section 3. The details on how reinforcement learning is applied to ASD-DG and the security guarantees that can be obtained because of learning are described in section 4. There is a sum up of our approach in section 5.

Related work

There have been several key research since the models such as Bell and La Padula [START_REF] Bell | Secure Computer Systems : Mathematical Foundations[END_REF], and Biba [START_REF] Biba | Integrity Considerations for Secure Computer Systems[END_REF] that have helped in shaping the field of Information Flow Control (IFC). These models established various levels of privileges and associated information to these levels. A common mechanism to achieve this is to attach security labels to information containers such as files or variables. The most simple example consists of two security labels namely, "high/sensitive" and "low/public". Information cannot flow from "High" level containers to "Low" level containers while the vice-versa is permissible. In a lattice-based design, the security lattice can contain multiple parallel or intertwined levels allowing for more complex information flow control design.

The first step in an IFC approach is to specify a policy. It consists first in defining different security labels in a lattice-based structure and then to attach these labels to the containers according to their sensitivity. Once a policy has been specified, the IFC model ensures that the execution conforms to the policy. Such an approach helps to classify information flows into legal and illegal flows. IFC models have varying mechanisms to deal with illegal information flows. These could be raising alerts, stopping execution, stopping the compilation process, modifying execution or some other customized action.

Language based IFC has been explored in great detail by label based approaches as illustrated by Sabelfeld and Myers [START_REF] Sabelfeld | Language-based information-flow security[END_REF]. In these approaches, the secret variables are tagged with security labels and these labels are propagated along with the information flows. In the context of IFC in JavaScript, Bielova et. al. [START_REF] Bielova | Survey on JavaScript security policies and their enforcement mechanisms in a web browser[END_REF] provide a substantive survey with comparative studies on techniques, types of analysis (i.e. static vs. dynamic approaches) and their formal guaran-tees. This work has been instrumental in providing a complete picture of this research area thereby becoming a valuable stepping stone to the design of our approach.

In the field of IFC, the most important property to be satisfied by any analysis is non-interference. There are two types of non-interference based on the conditions satisfied, namely Termination-insensitive non-interference (TINI) and, Timing-and Termination-sensitive non-interference (TTSNI).

TINI [START_REF] Askarov | Termination-insensitive noninterference leaks more than just a bit[END_REF][START_REF] Bielova | Survey on JavaScript security policies and their enforcement mechanisms in a web browser[END_REF][START_REF] Sabelfeld | Language-based information-flow security[END_REF][START_REF] Devriese | Noninterference through Secure Multi-execution[END_REF] is a security guarantee where, for two terminating executions of a program with the same public input, the observable public output remains unchanged regardless of the value of the secret. TTSNI [START_REF] Devriese | Noninterference through Secure Multi-execution[END_REF][START_REF] Kashyap | Timing-and Termination-Sensitive Secure Information Flow: Exploring a New Approach[END_REF] is a security guarantee where, for two executions of a program with the same public input, the public output, the number of execution steps and time taken to generate the public output remain unchanged regardless of the value of the secret.

There are several IFC models that have been designed for the web-browser taking into account the nature of JavaScript. Relative work in this domain has been heavily biased towards dynamic approaches. This is justifiable by the highly dynamic nature of JavaScript which increases the complexity for static approaches thereby making dynamic approaches more effective.

Label-based approaches have always been in the forefront of dynamic approaches. In the context of JavaScript, Austin and Flanagan proposed the nosensitive-upgrade [START_REF] Austin | Dynamic information flow analysis for Javascript in a web browser[END_REF]. Hedin and Sabelfeld [START_REF] Hedin | Information-Flow Security for a Core of JavaScript[END_REF] proposed an IFC approach for JavaScript based on a classical label-based approach previously described by Sabelfeld and Myers [START_REF] Sabelfeld | Language-based information-flow security[END_REF]. Hedin and Sabelfeld show the need for dynamic approaches by describing problem of the information-flow being flow sensitive in JavaScript. This increases the need to keep track of changing labels throughout the execution which becomes tedious with pure static approaches. The difference between the two approaches is that Hedin and Sabelfeld allow some upgrade instructions before the behest of the implicit information-flow. This means that, in case an implicit flow results owing to the value of a secret variable, the public output of a public value cannot be performed under any scenario in case of the no-sensitive-upgrade. However, in case of Hedin and Sabelfeld, such a public output can be allowed if and only if there was an explicit upgrade instruction before the output statement is performed.

Both these label based approaches stop further execution of a program when they encounter a possible information leak. These approaches are useful to check if a program is adherent to TINI by default without any modifications. However, they fail to continue execution of the program if there is a possibility of a leak. There exist a few dymanic preventive enforcement mechanisms in JavaScript which are able to continue execution of the program and still prevent information leakage. These mechanisms maintain more than one copy of the variable and switch contexts of the variable based on the scenario. In case there is an unauthorized public output of a secret variable, these mechanisms use a dummy/public value instead. Secure Multi-Execution (SME), faceted approach and Address Split Design (ASD) are the models known to use this approach.

The model of SME was proposed by Devriese and Piessens [START_REF] Devriese | Noninterference through Secure Multi-execution[END_REF]. In SME, the information flow across labels is segregated at the process level by providing a separate process for each level of sensitivity. Let us consider a system with two levels namely a high and a low. Such a scenario would imply that there is a dedicated process for high level computations and a dedicated process for low computations. This ensures that the memory is also safely handled since the processes themselves are isolated. The low level process is the only one that can influence public output and it can only receive public input. FlowFox is a concrete implementation of SME on the Firefox web browser by De Groef et al. [START_REF] Groef | FlowFox: a web browser with flexible and precise information flow control[END_REF]. However, the use of SME automatically increases the time-and spacecomplexity for the system.

The faceted approach that has been proposed by Austin et al. [START_REF] Austin | Efficient purely-dynamic information flow analysis[END_REF][START_REF] Austin | Dynamic information flow analysis for Javascript in a web browser[END_REF] is the chief proponent of the multi-path execution approach. The authors attempt to mimic the functionality of SME with the use of a single process. It would intuitively result in a much lower time complexity. The faceted approach attains termination-insensitive non-interference since the use of a single process cannot account for timing-sensitivity. This approach works on containing multiple copies of the variables at each juncture to mimic the values of the variables in different processes in case of SME. A faceted value is represented as <p?a private :a public > where p is the principal. The principal is an access control object which determines which copy of the variable should be used. If an object c were created by using two other objects a and b, each with its own principal, there would be four possible values for this object, as shown in [FACETED APPROACH] . This growth in the number of objects is exponential. The positive effect of this phenomenon is that, only the correct copy of the object is used when it is invoked by the public output function. Just like the SME approach, the execution of multiple branches can have unintended consequences in a dynamic approach. The ZaphodFacets2 is an implementation of the faceted approach as a plug-in in Firefox. It use the Narcissus JavaScript engine3 . Cross-site scripting is handled effectively by this approach by assigning each domain into separate principal. Variables from each domain are accessed only if there is access to that principal hence significantly reducing the effects of XSS.

[FACETED APPROACH]
The ASD was proposed by Deepak et. al. [START_REF] Subramanian | Preventive information flow control through a mechanism of split addresses[END_REF] and forms the first basis for the approach described in this paper. In this approach each secret variable is split into public and private values. ASD is similar to the faceted approach in terms of having a single process and different values for private variables. However, the key difference is that a variable can have only one private value in ASD while the faceted approach could force it to have multiple private values. Further, ASD does not execute additional branches based on the split values.

ASD seems to provide a more fine-grained IFC with function level control and its performance degradation is much more acceptable than competing approaches [START_REF] Subramanian | Preventive information flow control through a mechanism of split addresses[END_REF]. However, this approach does not adhere to TINI; though the secret is never given as a public output. Therefore, it suffers from lower security guarantees than SME while offering being practical. The core of this model starts with a split variable which is represented as ⌈public p ∥ private s ⌋. The split variable consists of a public value and a private value which are stored in different memory locations. The default symbol table connects the variable to its public value while the ASD mechanism overloads the symbol table at appropriate junctures to change the inferred memory location. This information is maintained in a data-structure called a dictionary that is unique to each function defined in the policy.

ASD's policies allow a differentiation to read and write accesses to secret variables. These policies hence result in more fine-grained IFC which we find to be suitable as a base for our model. The working of ASD is shown in the figure 1. There policies and the JavaScript program are the input. The monitor which is added to the JavaScript compiler interprets these policies and creates data-structures called dictionaries. The variables which contain secret values are split to show public and private parts. The private parts of the variable are inferred from the dictionaries. These dictionaries are updated by the monitor according to information flow.

However, the tracking mechanism used in this IFC has been shown to be less efficient in write operations in comparison with read operations by the authors themselves. Further, the IFC mechanism does not consider all possible information flows and relies solely on over-approximation. We believe that with some suitable changes to this model supplemented by learning, ASD could eventually become adherent to TINI while becoming more efficient.

Description of our approach

As described in the section 1, our work is an extensio of the ASD approach.Therefore, we describe the preliminaries regarding ASD in subsection 3.1. This is followed by the description of the dependency graph which tracks the various secrets in our approach in subsection 3.2. We finally discuss the evolution of the dependency graph with information flows in subsection 3.3.

Preliminaries on ASD

ASD is an IFC where secret variables are split to store two different values in their private and public addresses separately. The access to the secret value for Let us consider that variable a is secret and function f1 has access to a. In that case, at the beginning of the function call, a = ⌈2 p ∥ undefined s ⌋. This notation signifies that the variable a has been split. Here, a has a public value that was initialized to 2 and a secret value that is undefined. However, when executing function f1, in line 4, the secret value is changed. This is because f1 has access to the variable a. Therefore, a = ⌈2 p ∥ 3 s ⌋.

In line 6, the variable a is read. Therefore, the dependency tracker is updated and DT = {a}. When variable b is initialized, it is split. The public value remains as undefined while the secret value is assigned as 3. Therefore, b = ⌈undefined p ∥ 3 s ⌋.

Further, any function that has access to a, is given access to b. Hence, the function f1's dictionary would be:

Variable Rights Address a RW @(A) scope(f1).b RW @(B)
Table 1: Dictionary of function f1

In the table 1, the notation "scope(f1).b" represents the local variable of the function. Each run of the function generates a unique scope identifier which is used to identify which instance of the local variable is being used. Hence, the use of the scope identifier allows handling of local variables in all cases including recursion.

Any function that is defined in the policy is called a self-sufficient function and has its own dictionary. All other functions are called utility functions and use the dictionary of the self-sufficient function that called them. To implement the above mechanism, the symbol table is overloaded with a dictionary datastructure in ASD. There is hence a unique dictionary for every function defined in the policy.

ASD creates all dictionaries when interpreting the policies and changes every dictionary based on the monitored information flow. This creates an increased overhead when there is a large number of dictionaries. We hence propose another data-structure called the dependency graph to keep track of the information flows supplanting the existing dictionaries. We call this approach Address Split Design with dependency graphs (ASD-DG). When the dependency graph is updated, those changes will be noted by a learning mechanism. These learnt dependencies will be applied to the variables at the end of the function's execution. In the next subsection we will discus the dependency graph and its working.

Dependency graph

The dependency graph is a tree data-structure which contains three types of vertexes, namely, the function nodes, root nodes, and dependent nodes. The function nodes represent the various self-sufficient functions, whereas the root nodes and dependent nodes represent the various variables that contain secret values. Root nodes are created for all variables represented in the policies. Dependent nodes are created when a variable contains a secret value originating from another variable due to information flow.

In this paper, we describe the formalism along with the concepts involved in our approach. The various initial suppositions are given in [DECLARATION].

Here, the various representations used throughout the rest of the paper have been defined. We continue the representation used in ASD as part of the while language. Most rules defined in ASD hold true to ASD-DG as well. We will describe the rules that change in greater detail in parallel with the dependency graph.

[DECLARATION] The dependency graph is used to maintain data about the various variables that contain secret values due to information flow. It is a tree structure which can be defined as

Let, Variables (x ∈ Var) Functions ( f ∈ F ⊂ Var) Statements (S ∈ Stm) State (s( f ) → {public,
DG(V,E) where,            V is a set of vertexes V ∋ { DG f , DG root , DG d } E is a set of edges E ∋ { DG f → DG root , DG root → DG d }           
The structure of the dependency graph is a simple unidirectional that can only consist of three layers. The edges are strictly only between the function nodes to root nodes or root nodes to dependent nodes. Function nodes can have any number of child root nodes. Similarly, there is no limitation on the number of child dependent nodes for root nodes. Root nodes can have two possible states, active and inactive. When interpreting the graph, the functions can access variables represented by any of the active root nodes with whom they share an edge. The state modifications occur due to information flow. Such modifications are described in greater detail along with the evolution of the graph in subsection 3.3. Finally, a function can access a dependent node if and only if it has access to all root nodes which are parents to that dependent node. In the formalism, the x ⇝ f represents that f can access x. In the figure 2 f2 has access to V6. However, it cannot access V5 because f2 cannot access V1.

An example of this data structure, can be seen in the figure 2. The rule [POLICY: FUNCTION READ ACCESS] describes the interpretation of the policy into the dependency graph. The read access constructs the link between the function nodes and the root nodes in the dependency graph. The root nodes are the initial secrets. The other secrets are added to the dependency graph because of information flows from the root nodes and hence become dependent nodes. The main purpose of the dependency graph is to overload the

V1 F1 F2 V3 V2 V4 V5 V6 V7 V8 Functions Root nodes Dependant nodes
[POLICY: FUNCTION READ ACCESS] P( f , x, AC r ) DG f ← f ; DG root ← x; x ⇝ f
symbol table on a just in time basis as needed by the compiler. When a function attempts to read a variable, the monitor checks the dependency graph to validate the function's permissions to perform the operation. The rules for accessing the variable are given in [RUNTIME: FUNCTION READ ACCESS]. In this equation, for a given policy, the function and variable are added to the dependency graph and then f becomes a parent of x.

[RUNTIME: FUNCTION READ ACCESS]

f ∈ DG f ; x ∈ DG s.t. x⇝ f , DGState(x) = active AC r ( f , x) = true; s( f ) = secret f ∈ DG f ; x ∈ DG s.t. x⇝ f , DGState(x) ̸ = active AC r ( f , x) = false; f ∈ DG f ; x ∈ DG , DGState(x) = active, x & & ⇝ f AC r ( f , x) = false; f ¡ ∈DG f ; AC r ( f , x) = false; x ¡ ∈DG; AC r ( f , x) = false;

Dependency graph evolution

In this section, we discuss the dependency graph's evolution with the various variables that are added to it over time. Variables evolve when a function performs a write operation. There have been no changes in the write operation from the original ASD in this paper. Since write permissions do not change because of information flow and are only present to protect the variable, they are maintained as a simple list. When a function writes a secret value into a public variable, this variable is split and added as a dependent node to the dependency graph. If this split variable becomes dependent on another root, it is simply moved to become a child of that root node. However, if a root node becomes dependent on another root, a dependent node pointing to that variable is created and original root node becomes inactive. An inactive root node exists only for its children. This implies that the orignal root variable's value has changed but there are other existing variables which contain some information about the value due to information flow.

Let us consider a statement, V2 = V4 + 4;. It can be observed in the figure 3 that the variable V2, which is a root variable has been changed. The figure shows that by marking the root node V2 as a grayed out node. This implies that the function does not have access to the variable represented by this node but it may have access to the variables represented by its children. It can also be observed that the variable V2 is now dependent on V1 and is indicated by a square in the figure .  In ASD, every dictionary containing the variable required a change when the variable was updated. However, dependency graph needs only a single operation

Listing 1.3: ASD Example

The set of variable information shown in listing 1.3 is the persistent data set that is maintained about the function f4 for the example 1.2. As stated above, it contains information on dependency tracker at the time of the split as well as the root node that was allocated as the parent to the variable at the end of the information flow. Each time a variable is split or its secret value is updated because of a dependency, a data set for the variable is created. This data set is added to the a persistent array of data sets if not already present. This is hence the "learnt data".

Hence, at the end of the execution of function f4, it is noted that variable V10 and V11 are dependent on the variable V1. This information is used for later executions. Now, let us consider the same function such that variable V1 = ⌈false p ∥ false s ⌋. In this case, the line 7 is not executed. However, we know from the prior execution that V10 is dependent on V1 based on DT at the time of the split. Hence, V10 is split at the end of the execution and its private address contains the value copied from its public address, i.e. V10 = ⌈true p ∥ true s ⌋.

Whenever, a variable is split or updated due to information flows, the changes to the dependency graph are noted into the learning mechanism. Therefore, it is represented as part of the rules [VARIABLE UPGRADE] and [VARIABLE UPDATED]. These rules stipulate the various necessary steps when a new secret value flows into a public variable and split variable respectively. In these rules, the v.root represents the parent root node set the variable v and v.root ⇝ x implies that the node of the variable x becomes a child node to all the root nodes of variable v. The rules show that a join operation is performed to the persistent set of learnt data along with a successful variable update or split.

The rationale and the necessity for this split becomes evident in the execution of the function f6. The table 2 illustrates the execution of function f6 if variable V10 was split or not. It must be noted that f6 has read access to V1 according to the policy definition.

[VARIABLE UPDATED] f ∈ DG f ; x ∈ DG; x → x ′ ; AC w ( f , x) = true; dt = {} x s ← A[x ′ ]; x ⇝ f ; L ⋊ ⋉ ( f , x, dt) f ∈ DG f ; x → x ′ ; AC w ( f , x) = true; dt ̸ = {} x s ← A[x ′ ]; ∀(v ∈ dt)v.root ⇝ x; L ⋊ ⋉ ( f , x, dt) f ∈ DG f ; x → x ′ ; AC w ( f , x) = true; x ∈ DG root ; dt ̸ = {}; State(x) = inactive f ∈ DG f ; x → x ′ ; AC w ( f , x) = true; dt ̸ = {}; x ∈ DG d delete x ∈ DG d f ∈ DG f ; x → x ′ ; AC w ( f , x) = false; x p ← A[x ′ ]; f ¡ ∈DG f ; x p ← A[x ′ ]; [VARIABLE UPGRADE] f ∈ DG f ; dt ̸ = {}; S(y); y ¡ ∈DG A[y s ]; y ← ⌈A[y]||A[y s ]⌋; (∀v ∈ dt){v.root ⇝ y}; L ⋊ ⋉ ( f , y, dt);
In the table 2 we show the execution of the function f6 after the function f4 has been executed. There are two columns where we compare ASD with ASD-DG post learning has been completed. The two cases where V1 = true s and V1 = false s have been considered in this example.

The first major difference is caused because of V10 being split for both values of V1 in case of ASD-DG post learning. Since the variable split is known, the DT remains the same for both cases. However, this is not the case in simple ASD. In the first case, the variable is added to the DT. The rule [SELF-SUFFICIENT CALLED] [START_REF] Subramanian | Preventive information flow control through a mechanism of split addresses[END_REF] is invoked because f5 is also a self-sufficient function. Since f5 does not have access to the V11, the function call is skipped. This is in line with the dynamic policy enforcement where the secret addresses are not allowed to flow into the public addresses. The use of the dependency graph is to compensate for the deficiencies caused by the rule [SELF-SUFFICIENT CALLED] in ASD. This rule is necessary to prevent the secret from being leaked. However, it still can cause leak on whether the variable was split. This occurs when a self-sufficient function fails to split a global variable because of that branch not being executed and this global variable being used in a subsequent self-sufficient function as a conditional in an implicit flow. In the table 2, V10 being split affects the DT in line 1, therby allowing/denying the execution of f5. While such a leak is only caused under specific circumstances, and the actual secret value is never leaked, it nevertheless undesirable and makes the model non-adherent to TINI. We aim to solve this issue through learning. Adding the dependency graph approach, the model gradually closes up its leaks and will eventually become adherant to TINI. Further, since the dependency graph keeps track of the variables for every run, it can also observe dependencies caused by the use of eval, every case of a switch case and other information flows gradually over a period of time. Hence, the dependnency graph and how it keeps track of various information flow is very important to the model.

[SELF-SUFFICIENT CALLED] { S( f ); f ∈ DG f ; dt = {x}; AC r ( f , x) = true; } s( f ) = secret; dt = {x}; { S( f ); f ∈ DG f ; dt = {x}; AC r ( f , x) = false; FL = i } (Skip S( f )) { S( f ); f ∈ DG f ; dt = {x}; AC r ( f , x) = false; FL = e } s( f ) = public; x → A[x]; dt = {}; { S( f ); dt = {}; } S( f ); function f6
The various information learnt is used by the rule [DG LEARNING -FUNCTION ENDED]. At the end of the execution of the function f, if there is any past secret information flow, additional IFC actions are performed. The learnt data contains a set of function, dependency tracker and the dependent variable. If the dependent variables have not already been split, a variable upgrade is performed based on the dependency tracker. Else, a variable update is performed.

[DG LEARNING -FUNCTION ENDED] exec( f ) → completed; L( f ) ̸ = ∅ (∀r ∈ L( f )){([VARIABLE UPGRADE]/[VARIABLE UPDATED])(r);}

Eventual TINI

It must be noted that the premise of our model starts with not being adherent to TINI initially. This is because, ASD could leak state information of a variable at the end of the execution of a function. This leak does not mean that secret values would be printed but that it is possible to infer whether a public variable has become a dependent node or not.

[Proof for TINI]

Let, Functions (

f h ∪ f l ≡ ∀ f ∈F ∪ f ) Public output functions ( f p ∈ f l )
Secret input x in.s Proof: The [Proof for TINI] shows that ASD-DG is only adherent to TINI if the same variables are split at the end of the execution of a given function for different values of the secret. The reinforcement learning model solves this issue by collecting information on the states of the various variables and simulating these states at the end of each function. Hence, over time, all execution paths would be covered and even dynamic flows like eval operations can be handled to a certain extent. Since the learning model would eventually ensure that the states of the variables would eventually be the same, the ASD-DG can be said to be adherent to "eventual TINI".

(∀ f ∈ f h ) : { f ← AC r ( f , x) = true; } (∀ f ∈ f l ) : { f ← AC r ( f , x) = false; } (∀ f ∈ f h ) : { f ← AC w ( f , x) = true; } (∀ f ∈ f l ) : { f ← AC w ( f , x) = false; } A[x in.s ] := A[x p in.s ] A[x in.s ] :̸ = A[x s in.s ] { f (x in.s ) | f ∈ f l ; } f ← V re f (x in.s ); DG(x) & & ←A[x in.s ] { f (x in.s ) | f ∈ f h ; } f ← V re f (

Conclusion

There is a clear and urgent need to address the various information leaks in the context of JavaScript. The dynamic nature of the language makes the standard approaches insufficient or inefficient. In this case, starting with a practical efficient approach and making it adhere to more restrictive security guarantees over time is more appropriate. We have proposed one such model and take the novel approach of using learning in the runtime environment to achieve our goals of "eventual TINI". In this process, we have also proposed a proper change to the architecture of ASD to become more efficient. Taking ASD as the base has also allowes us to account for fine-grained function level policies. We hence, propose this model as a viable IFC model for the modern web-browser. The future work of the model is to work towards a complete web-browser implementation of the proposed model.

  var a = ⟨p1?1 : 2⟩; var b = ⟨p2?3 : 4⟩; var c = a + b; => c = ⟨ p1 ? ⟨ p2 ? 4 : 5 ⟩ : ⟨ p2 ? 5 : 6 ⟩ ⟩;

Fig. 1 :

 1 Fig.1: Address Split Design[START_REF] Subramanian | Preventive information flow control through a mechanism of split addresses[END_REF]

Fig. 2 :

 2 Fig. 2: Dependency graph

Table 2 :

 2 ASD-DG working

  x s in.s ); DG(x) ← A[x s in.s ] S f p ← x in.s ; FL = e f

p ← A[x in.s ]; S f p ;

S f p ← x in.s ; FL = i (Skip S f p ) { f (x in.s ), y ¡ ∈DG, y ← x f ∈ f h ; } split(y); f ← V re f (y s ); DG(y)←A[y s ]; ∴ { S f p (x s in.s ) ≡ S f p ((x ′ s in.s ) x in.s ≡ x ′ in.s } However, x in.s ≡ x ′ in.s iff ∀x ∈ s, if {x ∈ DG} =⇒ {x ′ ∈ DG} =⇒ S f p (x s in.s ) ≊ sS f p ((x ′ s in.s ) iff ∀x ∈ s, if {x ∈ DG} =⇒ {x ′ ∈ DG}

https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

https://github.com/taustin/ZaphodFacets

http://en.wikipedia.org/wiki/Narcissus_(JavaScript_engine)

to be performed to the same effectiveness. Every time the dependency graph changes, it is registered by the second part of model, the reinforcement learning mechanism. The use and working of the learning mechanism is described in greater detail in the following section.

Reinforcement learning

The evolution of the dependency graph is continuously monitored when a function is executed and this data is used to learn about the function's characteristics. The information collected is stored as a persistent data set to be used in subsequent executions. The purpose of this learning is to understand the various paths and loops that were taken in prior executions.

The information collected contains the following: the name of the function, the dependency tracker at the time of the split, the variable being split/updated, root variable and the layout of the relevant nodes in the dependency graph. Once collected, this information is used to split/update variables at subsequent flows.

Let us consider the current state to be as shown as in the figure 2. We now consider functions f4, f5, and f6 as shown in the listing 1.2. In this example, the variable V1 is a secret variable. Here we consider that the functions f4 and f6 have read access to V1. The function f5 does not have access to V1. If V1 = true s , in line 7, the public variable V10 becomes a secret. In the dependency graph, its root node is V1. If V1 = false s , in line 9, the public variable V11 becomes a secret with its root node being V1 due to the over-approximation of ASD.

1 [{function:"f4", rootVariable:"V1", split:"V10", 2

DT:[V1], dgInfo:[{"V1", "V10"}]}, 3 {function:"f4", rootVariable:"V1", split:"V11", 4

DT:[V1], dgInfo:[{"V1", "V11"}]}]


D O'sullivan
email: dara.osullivan@ucc.ie

F Salcedo

A Blavette

M Santos

A W Lewis

Case studies on the benefits of energy storage for power quality enhancement: oscillating water column arrays

Keywords: Power quality, oscillating water column, grid integration, energy storage

This paper presents case studies investigating the benefits of short term energy storage for wave farms connected to electrical networks having different grid strengths. The first network model represents the Atlantic Marine Energy Test Site (AMETS) of the Republic of Ireland, located at a significant wave resource but connected to a relatively weak network. The second network represents the Biscay Marine Energy Platform (BIMEP) test site, located off the Basque Country coast in Spain, which is connected to a relatively strong network. The case study utilises scaled real oscillating water column (OWC) device test data from the FP7 CORES project, and is intended to be a companion paper to a corresponding set of case studies performed with a point absorber farm, thus addressing two of the main wave energy technology types in the two papers. The paper investigates the impact of storage on voltage fluctuation, flicker, and power output profile.

Introduction

The significant power fluctuations associated with wave energy converters are an issue of concern for grid operators specifically in relation to power quality. Large changes in power over relatively short periods of time can cause voltage and frequency issues in regional networks, particularly at distribution level where grid impedance is higher.

Power quality standards are in existence for grid connected wind turbines [START_REF]Wind turbines -Part 21: Measurement and assessment of power quality characteristics of grid connected wind turbines[END_REF] which address such issues as voltage flicker, power ramp rates and voltage transients. These are still under development for ocean energy, but it is likely that similar limits will be imposed.

Short term energy storage can contribute to the enhancement of power quality for wave farm power outputs by mitigating the power fluctuations associated with many device technologies. Moreover, by reducing the amplitude of power peaks, the required rating for components such as cables and transformers may also be reduced, potentially reducing capital expenditure.

This paper investigates the benefits of short term energy storage on the power quality of an OWC-based wave farm when connected to two electrical networks of different strength or impedance. A companion paper performs similar case studies utilising a point absorberbased array.

Description of Case Studies

In this section, the case studies are described in detail.

Resource

A comprehensive resource characterisation of the AMETS test site is provided in [START_REF] Cahill | Wave Energy Resource Characterization of the Atlantic Marine Energy Test Site[END_REF] indicating that the majority of energy production sea states at AMETS fall within the ranges of 1.5m and 7m significant wave height and 7s-14s peak wave period, although storm wave conditions up to 10m wave height can be experienced. Both sites are open Atlantic sites and approximately similar conditions prevail at the BIMEP site as described in [START_REF] Ricci | Sea State Characterisation for Wave Energy Performance Assessment at the Biscay Marine Energy Platform[END_REF]. The case studies are simulated in the following seaway conditions for both sites: These sea conditions are selected as a reasonable crosssection of wave height and period, and also linked to available data in the context of this particular case study.

Test Sites

AMETS

The AMETS test site is located off the north-west coast of Ireland. It is still under development and it is envisaged that this site will be used by developers for the final stages of device testing prior to commercial deployment. The grid model used in the current study for the test site is based on cabling design studies performed in conjunction with ESBI in the context of the grid connection application and is shown in Figure 1. The conceptual wave farm consists of two clusters each including up to 11 generators. The clusters are connected to the shore by two ac subsea feeder cables each, one being 6.5 km long, the other being 16 km long. Each feeder cable is connected to an offshore 0.4 kV/10 kV transformer. The cluster located at a 6.5 km distance from the shore is referred to as Cluster 1, whereas the other cluster (16 km from the shore) is referred to as Cluster 2 as shown. Each cluster consists of two radial feeders (Feeder 1 and Feeder 2) to which wave energy converters are connected. An onshore substation steps the voltage up to 20 kV. Then, the wave farm is connected to the rest of the national network of Ireland by a 5-km long, 20 kV overhead line. The on-shore VAr compensation system is designed to maintain the power factor at the PCC between 0.92 and 0.95 lagging as specified by the network code [START_REF]Distribution Code[END_REF] of the distribution system operator (DSO), ESB. In this case study, a constant 0.93 lagging power factor was applied Operator) as 4550 MVA. There is a static VAr compensator connected at the PCC in order to keep the power factor equal to unity.

WECs

Each wave energy converter is modelled by means of a DIgSILENT built-in "Static Generator" model, representing a generator connected to the grid via fullyrated back-to-back PWM converters. The electrical power output of each generator was modelled using an experimental power time series from the CORES project. CORES stands for "Components for Ocean Renewable Energy Systems". It is an FP7 European collaborative research project focusing on the development of new concepts and components for power-take-off, control, moorings, risers, data acquisition and instrumentation for floating wave devices [START_REF] Thiebaut | Testing of a floating OWC device with movable guide vane impulse turbine power take-off[END_REF].

The project itself was based on a floating OWCtype system. The project began in April 2008 and ended in December 2011. The quarter-scale OWC prototype used in the project was deployed offshore from March to May 2011. Figure 4 shows the OWC deployed offshore. An important outcome of the project has been a considerable volume of time series data of electrical parameters at a resolution of 0.1 s. This can be scaled and used directly for grid impact studies, as in this case. In order to reflect the output of the farm in an appropriate manner, the power output time series from the CORES device must be scaled to full scale power level, and modified for each device to reflect the impact of spacing and aggregation. This process is described in [START_REF] Blavette | Impact of a Wave Farm on its Local Grid: Voltage Limits, Flicker Level and Power Fluctuations[END_REF] and involves the following steps:

1. Scale power data to full scale. 2. Introduce time delay shifting to represent spacing of devices within a cluster.

3. Introduce further time delay shifting to represent spacing of the two clusters.

Energy Storage

In this study, energy storage is assumed to be applied to the combined output of the entire at the shore side substation. It is modelled in a simplified manner as a first order low-pass filter with a variable time constant. In this manner, varying levels of energy storage can be represented in a generic way at this stage, without requiring specific detail on the exact implementation of the storage technology. The options considered correspond to a power smoothing on a time scale of 5 s, 25 s and 50 s respectively. These values are selected to correspond to a range of a real energy storage options from hydraulic accumulators to flywheel inertia to seawater reservoirs, as outlined in [START_REF] O' Sullivan | Dynamic characteristics of wave and tidal energy converters & a recommended structure for development of a generic model for grid connection[END_REF].

Results and Outputs

Results for power fluctuation, voltage fluctuation, flicker and contingency are given in the following sections.

Power Fluctuation

The active power outputs as measured at the PCC for the farms at BIMEP and AMETS are illustrated in Figure 5 and Figure 6 without energy storage. In order to assess the impact of differing levels of energy storage on each farm output, the active power at the BIMEP PCC in the high energy sea state is depicted in Figure 7 and at the AMETS PCC in the medium energy sea state in Figure 8. The dramatic effect on the power profile is evident in both Figure 7 and Figure 8. There does not however appear to be a significant change from 25s to 50s storage time constants in both cases. Despite the significant smoothing of the power time series perceived visually in Figure 7 and Figure 8, with many individual power peaks dropping by 50% or more depending on storage time constant, the actual ratio of peak power to average power does not drop as much as might be expected, as illustrated in Figure 9 for the high energy sea state. For instance, at 5s storage time constant, the peak to average ratio drops to 2.3 from a level of 3.1 with no storage. At a 50s time constant, this ratio has dropped to 1.35, which is a more acceptable level. This is important for rating considerations, particularly of the power converters where the maximum VA rating level of the converters usually corresponds to the maximum peak power. This underlines the additional importance of implementing some form of power peak limiting [START_REF] Tedeschi | Effect of Control Strategies and Power Take-Off Efficiency on the Power Capture From Sea Waves[END_REF], as well as energy storage capability.

Voltage Variation

The voltage variations seen at the PCC in both AMETS and BIMEP are illustrated in Figure 10 and Figure 11 for the high energy sea state and for the different levels of storage. Due to the weaker grid strength at AMETS, the storage has a dramatic effect, even at its lowest level of 5s, raising the voltage nadir from 0.92 pu to around 0.965 pu.

Figure 10: PCC voltage AMETS; high energy

The impact at BIMEP is measurable but less significant as a result of the stronger network at that location even though the power fluctuations are almost exactly the same.

Flicker

Short term flicker coefficient, P st is an important measure of power quality [START_REF] Blavette | Impact of a Wave Farm on its Local Grid: Voltage Limits, Flicker Level and Power Fluctuations[END_REF][START_REF] Macenri | Influence of Tidal Parameters on SeaGen Flicker Performance[END_REF][START_REF] Thiringer | Flicker Evaluation of the SeaGen Tidal Power Plant[END_REF] and provides an indication of the level of visual disturbance that can be induced in lighting loads by the voltage fluctuations in the distribution network.

The flicker severity level for both sites under the different seaway conditions are plotted in Figure 12. As expected for BIMEP, the flicker level is extremely low due to the strength of the electrical network, and in this regard the effect of the energy storage on the performance is almost indistinguishable. For AMETS however, the reduction in flicker coefficient is dramatic, even with only 5s of energy storage time constant. It should be noted that the flicker limit for the Irish DSO is 0.35, and that the AMETS study comes close to this level with no storage.

Farm Disconnection

The transient step in the PCC voltage on connection or disconnection of a farm is an important power quality consideration [START_REF]Wind turbines -Part 21: Measurement and assessment of power quality characteristics of grid connected wind turbines[END_REF]. Sudden disconnection is a more likely scenario, since this can happen under fault or protection conditions, whereas farm connection is usually a scheduled event with a ramped approach that gradually increases the farm power output. This phenomenon is illustrated in Figure 13 for AMETS for the high, medium, and low energy sea states. Disconnection is performed at maximum power, so that these graphs represent the worst case scenario. The variation in voltage deviation with the sea state and for the two sites is illustrated in Figure 14. Again, AMETS shows the most significant deviations due to the weaker grid. The addition of a small amount of energy storage makes a significant difference to this voltage disturbance as evidenced in Figure 15 for AMETS with a 5s energy storage addition.

Conclusions and Summary

This paper has illustrated the potential value of energy storage in the grid integration of wave energy converters with high fluctuation power outputs, such as OWCs. It has been demonstrated that even relatively small values of energy storage time constant -which roughly corresponds to inertia constantcan have a significant impact on the power and voltage fluctuations measured at the grid PCC. Flicker and voltage deviation during switching events are also reduced significantly. This is more striking and effective in a weaker grid, as illustrated by the AMETS results, in which energy storage can be the difference between grid compliance and non-grid compliance. The effect is less evident in a stronger grid such as BIMEP, where the disturbance on the grid from the wave farm is not as significant in the first place. Peak-to-average power ratio is not however, reduced as much as would be expected by the presence of energy storage. This implies that rating issues for components such as power electronics converters are still significant and may require other mitigation measures such as peak power limiting.

Figure 1 :

 1 Figure 1: AMETS grid modelThe rest of the national network is modelled by a 20kV/38 kV transformer connected to a fixed voltage source in series with a reactor. The impedance of this reactor represents the short-circuit impedance at this node, which was estimated to be equal to 22.8 Ω based on the EirGrid Transmission Forecast Statement[START_REF]Eirgrid Transmission Forecast Statement[END_REF].This corresponds to a short-circuit power of 63MVA.BIMEPThe BIMEP (Biscay Marine Energy Platform) is an offshore facility for research, demonstration and operation of real-scale WECs on the open sea. It is

Figure 2 :

 2 Figure 2: Bimep architecture Each WEC (Wave Energy Converter) is connected to shore through an offshore cable. The model of each WEC includes a generator and a 0.69kV/13.2 kV transformer. Figure 2 shows the grid model for BIMEP.

Figure 3 :

 3 Figure 3: BIMEP grid modelThe PCC is modelled considering its Ssc (shortcircuit power) given by the DSO (Distributed System

Figure 4 :

 4 Figure 4: Oscillating water column deployed in CORES

Figure 5 :Figure 6 :

 56 Figure 5: Farm active power at PCC for BIMEP

Figure 7 :

 7 Figure 7: Active power at BIMEP PCC; high energy

Figure 8 :

 8 Figure 8: Active power at AMETS PCC; medium energy

Figure 9 :

 9 Figure 9: Peak to average power ratios for BIMEP and AMETS; high energy

Figure 11 :

 11 Figure 11: PCC voltage BIMEP; high energy

Figure 12 :

 12 Figure 12: Short term flicker severity level at (top) AMETS (bottom) BIMEP (different y-axis scales)

Figure 13 :Figure 14 :

 1314 Figure 13: PCC Voltage on disconnection of farm (AMETS)

Figure 15 :

 15 Figure 15: PCC Voltage on disconnection of farm (AMETS) with 5s energy storage

Table 1 : Sea State Summary

 1

	Sea State	H S (m)	T P (s)
	Low energy	1.3	13.8
	Medium energy 2.4	11.0
	High energy	5.7	16.5

Acknowledgements

The work of Dara O'Sullivan and Anne Blavette was supported by the Charles Parsons Award from Science Foundation Ireland (Grant 06/CP/E003).