Mohamed Kaâniche

Karama Kanoun

System dependability assessment -Interplay between research and practice

This chapter illustrates examples of collaborative work with industry in which we have been involved over time. We concentrate on a set of projects one or both authors contributed to, in the area of dependability assessment. These collaborations are grouped into four main topics, corresponding respectively to: modelbased dependability assessment, software reliability, simulation and fault injection based dependability assessment, online error detection and diagnosis. We show examples of results obtained in the framework of these collaborations.

Introduction

This chapter aims to briefly present examples of collaborative work with industry in which we have been involved over time. We concentrate on a set of projects one or both authors contributed to, in the area of dependability assessment. Assessment is used in a broad sense, including dependability evaluation based on i) behavioral system models, or on ii) data collected on a real system, or on iii) controlled experiments, mainly based on fault injections. The assessment has been used either at design time to help define system architecture and components, or at run time, to characterize potential system misbehavior or to help and plan corrective or maintenance actions.

The topics addressed in the collaborative work evolved during the years, initially, taking into account mainly hardware accidental faults and concentrating on system safety, then integrating progressively software design faults, either considered alone, or considering both hardware and software faults and their interactions. Later, we have focused on the assessment of the impact of malicious faults on system security, considered alone, then jointly addressing safety and security together. More recently, model learning approaches used at run time, for error detection and diagnosis, have become central.

The context in which our collaborations with industry have been triggered can be classified into two extreme situations:

• The company has immediate needs, together with a very specific problem to solve in short or near terms. • The company needs are real, but the problem to address is open, it is not clearly stated (on purpose), this case usually corresponds to advance long-term prospection, to increase the company's technical skills and be ready for new challenges.

Of course, intermediate situations are not uncommon: starting with a very specific problem to be immediately solved, the ultimate aim of the work could be to go further and prepare new changes for the company.

Obviously, long-term objective situations, without very specific problems to solve a priori, are more challenging for research, as they are usually far-reaching and ambitious. The topics are then defined jointly with the company. On the other hand, very specific problems, requiring immediate solutions, might be less challenging for research, in particular when similar problems have already been solved in other sectors. In this case, research role could be to open the company's vision to leading practices in other sectors, and can go further by generalizing the problem and providing solutions that are as generic as possible.

Indeed, the company is a priori interested in solutions that correspond to their specific business, and research is interested in real problems to solve that could fit other sectors.

In the rest of this chapter, we will briefly present examples of work we have carried out in collaboration with industry. These examples are grouped in four sections: i) model-based dependability assessment, ii) software reliability, iii) simulation and fault injection based dependability assessment, iv) online error detection and diagnosis

Model-based dependability assessment

Usually, dependability assessment is carried at design time, in order to define an appropriate system architecture satisfying the system dependability requirements. However, model-based dependability assessment could also be helpful during system operation to anticipate system failures and to schedule system maintenance and/or reschedule system mission accordingly. Our work, in an industrial context, addressed essentially the design phase, with an exception, related to aeronautics. Even though the same modeling techniques can be used at runtime, the added constraints concern essentially the way models should be structured to allow their quick update (and re-execution) during system operation, without requiring an additional validation.

The main difficulties when modeling real-life systems come from the inherent complexity of the system performing a multitude of related or correlated functions, which induces large-scale models, requiring large processing times and tedious validation process. In addition, during system design, assessment is used as a powerful means for comparing possible system architectures to select the most suitable one. Modeling approaches are thus needed to optimize model construction of competing architectures, their processing and validation, to encourage comparison of several of them. This is also true for assessment at runtime, as one has to compare maintenance strategies that are possible, depending on the nature of failed components and on the maintenance environment available at the time of failure.

Defining an appropriate dependability measure (or attribute) to be assessed is fundamental. Indeed, classical measures such as availability of safety do not necessarily allow bringing out the most salient properties of the system. In addition, several complementary attributes are most of the time required to highlight various facets of a system.

Our work related to dependability assessment was based on Markov chains and evolved towards Generalized Stochastic Petri Nets (GSPNs) and their offspring. We have also explored how to automate the generation of GSPN based model from higher levels description languages such as AADL (Architecture Analysis and Design Language), a mature industry-standard, (Rugina et al. 2011). To illustrate the kind of modeling activities we have carried out in collaboration with industry, we have selected three critical domains: electricity production and distribution, air traffic control, and aeronautics.

Electricity production and distribution

Several collaborations took place with EDF, the French multinational electric utility company. The first one (Laprie and Kanoun 1980) was dedicated to the definition of a new architecture for the monitoring systems of an Extra High Voltage substation, driven by rare, external solicitations, due to incidents in the process. The main difficulties were due to i) the dormancy of the considered system, some parts of which could be failed for a long period of time and could not be detected without the occurrence of an incident or until the next system inspection, and ii) there were very few model processing tools well suited to this kind of systems and we have adapted SURF-2 [START_REF] Béounes | SURF-2: a program for dependability evaluation of complex hardware and software systems[END_REF]) to this end. The approach we have followed was based on i) the definition of dependability levels and attributes, directly from the statement of system functions, that can be physically interpreted, and ii) the construction of the systems dependability model by aggregating models of subsets that have been reduced to include only those pa-rameters that have a real influence on the considered attribute. The results have shown the impact of redundancy both at the computing system level (using double or triple redundancy for all local equipment) and at the communication level (a reconfigurable optical counter-rotating double loop) [START_REF] Blanquart | REBECCA: a dependable communication sub-system for the control system of extra-high-voltage substations[END_REF]. Even though the above results addressed only the hardware part of the systems and seem obvious nowadays, the work performed was challenging because of its explorative nature at that time.

A more recent collaboration with EDF was dedicated to the selection of Instrumentation and control system based on modeling together with fault injection. Candidate architectures proposed by various suppliers were compared based on GSPNs (Betous-Almeida and [START_REF] Betous-Almeida | Dependability modelling of instrumentation and control systems: a compaaprison of competing architectures[END_REF]. The most impacting parameters identified are then evaluated experimentally using fault injection. [START_REF] Betous-Almeida | Dependability of computer control systems in power plants[END_REF].

Air Traffic control

As the air traffic control (ATC) volume is continuously and rapidly growing, the associated control systems have to evolve to meet this trend. The French ATC is based on an automated system (the CAUTRA, "Coordinateur Automatisé du Trafic Aérien") providing a valuable support to controllers. CAUTRA is implemented on a distributed fault-tolerant computing system composed of five regional control centers (RCC) ensuring coverage of the whole country, and a centralized operating center, connected to these centers through a dedicated telecommunication network. Redundancy and fault tolerance mechanisms are used at various hardware and software component levels.

In the framework of two joint collaborations, we have developed two modeling approaches, dedicated respectively to the assessment of:

• RCC availability: with respect to its two main functions, Flight Plan Processing (FP) and Radar Data Processing (RD), based on the analysis of the impact of the failures of its own components, (see e.g. [START_REF] Fota | Dependability evaluation of an air traffic control computing system[END_REF]). • ATC safety: based on the analysis of the impact of the CAUTRA components' failures on the degradation of the service provided to the controller, including the global CAUTRA system architecture with the five interconnected RCC subsystems interconected [START_REF] Fota | Dependability evaluation of an air traffic control computing system[END_REF].

For each case, we have defined and modeled several alternative architectures, compared their dependability measures, and identified the most important factors impacting these measures. Even though the two modeling approaches are i) modular, ii) based on GSPNs and iii) take into account permanent and transient failures of hardware and software components as well as error propagation between components, they differ in the model construction approaches due to the very different nature of the final measures to be assessed. Availability is defined at the regional center level, while safety is evaluated at the CAUTRA level requiring the knowledge of the states of all centers. Hence, in addition to modeling of the five regional centers and the centralized operating center, ATC safety analyses rely heavily on a detailed Failure Modes and Criticality Analysis (FMECA) to define and assess the service degradation levels.

For example, for RCC availability assessment, a block modeling approach has been defined to assess the impact of reconfiguration strategies on the availabilities of FP and RD. A block represents the model of a component or a dependency. The block models are generic and have well-defined interfacing rules to facilitate their composition as well as validation of the resulting composed models. Hence, several reconfiguration strategies have been easily compared, with only few additional blocks, compared to the current architecture at that time. The comparative analyses identified the reconfiguration strategies that satisfy the following important requirement: RD unavailability should be less than 5 min per year.

For ATC safety, the models of the regional and the centralized centers are built independently in successive steps according to an incremental approach, following specific construction guidelines, to assess the centers dependability, together with an appropriate specification language associated with transformation rules allowing an automatic generation of optimized GSPNs. The resulting models are very complex. For example the GSPN of the Radar Data Processing and the Flight Plan Data Processing Systems has about 100 places and 500 transitions and corresponds to a reduced Markov chain of about 25 000 states. At the global level, the partial measures assessed for the six centers are combined to assess their impact on ATC safety, more precisely, on the levels of degradation of the service provided to the controller. The results identified the most impacting features that need to be monitored during the design phase.

Aeronautics

As stated earlier, model-based dependability assessment can be helpful during system operation too, to anticipate system failures (or mission interruption). This is typically the case in aeronautics where airline companies and operators need to reschedule a mission if some components fail. Our collaboration with Airbus was in this context.

The main challenge comes from the fact that the model has to be tuned dynamically, in operation, to take into account the current state of the system, the maintenance environments and potential new information by operators. Indeed, these operators usually do not have any knowledge related to dependability modeling techniques. Hence the model should be prepared and validated in advance, offline, in a way that makes it easily and very quickly configurable in operation.

To this end, we have developed a modeling approach, based on a meta-model used to i) structure the information needed to assess operational reliability, and to ii) build a stochastic model to be tuned dynamically to take into account the system operational state, the mission profile and the maintenance facilities (Tiassou et al 2012). This model allows to i) assess, on-the-fly, the ability to succeed in continuing on the remaining part of the mission, in case of an unscheduled event occurrence, and to ii) support maintenance planning. A case study, based on an aircraft subsystem, is considered for illustration, using the Stochastic Activity Networks formalism. It shows how to re-schedule a mission, based on the failed component and its impact on the remaining part of the mission, as well as the maintenance possibilities at the various stops of the aircraft (Tiassou et al. 2013).

Software reliability

Even though the first software reliability growth models have been published in early 70s, their practical use in industrial environments was very seldom at the time we had our collaborations with industry. Our first investigations showed that preliminary rigorous analyses of failure data are required before model applications. For example, reliability growth/decrease tests i) tell about the impact of fault removal on software reliability evolution and ii) guide selection of models to be applied according to their trend. In particular, reliability growth model assuming pure reliability growth give non-meaningful results if applied to data displaying reliability decrease over some periods of time. Data partitioning improves model results.

We briefly report on two collaborations concerning Electronic Switching Systems (ESSs), developed by two different companies Alcatel and TELEBRAS. Even though both companies were interested in assessing software behavior in operation, the measures of interest were different, due essentially to the different maturity levels of the software, when the study took place.

For Alcatel, the dataset analyzed was collected during 3 years, on a mature system, in operation on more than 1000 sites. One of the expected results of the collaboration was an estimate of the software failure rate. Alcatel aim was to build a Markov chain, taking into account hardware and software failures, to assess the switching system unavailability, to check its compliance with the international telecommunications requirements (that was less than 3 min / year).

Detailed analyses of the data either at the level of the ESS, at the components levels, as well as taking into account the severity of failures (impact of failures on service loss) is performed in (Kanoun and Sabourin 1987). They show for example that: i) the defense component (in charge of hardware fault tolerance) has the highest failure rate, the three other software components dedicated to functional operation have equivalent, lower, failure rates, ii) only a very low number of faults led to service unavailability, the others had minor impact.

TELEBRAS started the development of a new series of ESSs increasing progressively the ESS capacity. We concentrated first on the software of the early one before considering together three successive generations. This very first analysis (Kanoun et al. 1991) allowed to gain insight into the development process and provided, among other things, an estimate of the number of failures that will occur in the field (equivalently, the number of required corrections), for planning the maintenance effort after system delivery. A comparative analysis of the reliability, in terms of failure rates, of the three generations gives insight into the evolution of the reliability of a family of products (Kaâniche and Kanoun1994). Examples of comparative analyses, with respect to the evolution of the nature of faults activated and their impact through the successive generations, can be found in (Kaâniche and Kanoun1998).

Dependability assessment based on simulation and fault injection

Simulation offers complementary means to analytical modeling for analyzing and assessing dependability. Specifically, it offers the possibility to take into account a much wider spectrum of assumptions and to describe the system behavior at a relatively lower level of detail, in order to analyze the effects of faults as close as possible to the components where they occur, and to study their impacts at the system level. Also, it can be used to estimate the parameters involved in analytical dependability models. The main challenge is related to the need to master the simulation time that increases dramatically when the model is simulated at a low level of detail. One possible solution is to develop a hierarchical simulation approach to analyze the behavior of the target system in the presence of faults by considering different levels of abstraction. We have explored this approach in the context of a collaborative research project involving the University of Illinois at Urbana-Champaign, and the StorageTek Company in Colorado, USA [Kaaniche et al. 1998]. This approach was developed to support the dependability analysis and evaluation of a highly available commercial cache-based RAID storage system. The architecture is complex and includes several layers of overlapping error detection and recovery mechanisms. Three abstraction levels have been considered to model the cache architecture, cache operations, and error detection and recovery mechanism. The impact of faults and errors occurring in the cache and in the disks was analyzed at each level of the hierarchy. The models have been developed using the DEPEND simulation-based environment developed at UIUC, which provides facilities to inject faults into a functional behavior model, to simulate error detection and recovery mechanisms, and to evaluate quantitative measures. Several fault models were defined for each submodel to simulate cache component failures, disk failures, transmission errors, and data errors in the cache memory and in the disks. Some of the parameters characterizing fault injection in a given submodel correspond to probabilities evaluated from the simulation of the lowerlevel submodel. Based on the proposed methodology, we evaluated and analyzed i) the system behavior under a real workload and high error rate (focusing on error bursts), ii) the coverage of the error detection mechanisms implemented in the system and the error latency distributions, and iii) the accumulation of errors in the cache and in the disks. It is important to emphasize that an analytical modeling of the system is not appropriate in this context due to the complexity of the architecture, the overlapping of error detection and recovery mechanisms, and the necessity of capturing the latent errors in the cache and the disks.

Another major challenge in industry concerns the efficient integration of dependability assessment techniques into their existing system engineering process and tools. We had the opportunity to explore this challenge with Technicatome, a French industrial leader in nuclear engineering and with Valeo, a global worldwide automotive supplier.

With Technicatome, the objective was to rely on a commercial systems engineering tool (RDD-100) in order to facilitate the integration of operational safety analyses in industrial processes at early design stages. This work has resulted in the extension of the functionalities offered by this tool by defining mechanisms for injecting faults into RDD-100 models and analyzing their effects from the point of view of operational safety. The proposed mechanisms are based on two complementary techniques. The first one consists in inserting saboteurs, to disturb the inputs or outputs of the elementary components of the nominal model as well as their behavior. The second one consists in directly mutating the code of the elementary components of the nominal model. A critical analysis of the advantages and limitations of each of these techniques, in terms of difficulty of implementation and the possibilities offered for fault injection and observation of their effects, led us to propose a solution combining these two techniques [Kaâniche et al 2004].

Collaboration with Valeo took place in the context of the publication of the first standard specifically dedicated to automotive safety systems, ISO 26262. This standard requires introducing fault injection from the very early phases of the development process. Indeed, even though experimental validation of embedded systems, including fault injection, was of common practice in industry, its adoption in the early design phase, as advocated by the ISO26262 standard, was not common and unclear. In this context, we developed a global approach integrating fault injection in the whole development process in a continuous way, from system requirements to the verification and validation phase. We have shown the strong link between classical safety analyses, commonly used in industry for critical systems design and fault injection principles at design phase. In particular, we have shown the similarities between two well-known domains that are separated in practice, namely i) Failure Modes, Effects, and Criticality analyses Analysis (FMECA) and ii) fault injection. More precisely, we have shown how FMECA spreadsheets i) can be used to guide fault injection on one hand, and to synthesize the results of fault injection in the other hand, and ii) to link the successive development levels via their failure modes, their causes and their effects, to capture the failure propagation paths between the levels. These chains help making fault injection campaigns effective.

We have shown the benefits of the proposed approach (Pintard et al. 2014), which is compliant with the ISO 26262 standard, on a case study from the automotive domain. The ultimate aim was to guide fault injection experiments, based on early system safety analyses to optimize the whole development process by defining an optimal set of experiments. From a practical point of view, a fault injection tool was developed by Valeo to implement fault injection at various levels.

Online error detection and diagnosis

Traditional approaches to dependability assessment are based on the development of models during the design phase in order to assist in architectural choices. However, the need is more and more for automated solutions allowing to monitor and assess the dependability of the system at run-time, i.e. while the system is in operation, using in particular machine learning algorithms. Indeed, the massive collection of data together with the significant progress and successes achieved with machine learning algorithms have motivated the exploration of these algorithms to support anomaly detection and diagnosis in several application areas. It should be noted that such models have been studied since the 1980s, but have received increased attention in the recent years due to the growing interest in artificial intelligence techniques, particularly in industry.

We have explored the use of such techniques to support online error detection and diagnosis in cloud infrastructures and future telecommunication architectures using network functions and software virtualization technologies (SDN and NFV). This study was carried out in collaboration with Orange Labs. In particular, we have defined a generic strategy enabling the detection of two types of anomalies in cloud services (errors and service level agreement violations) while providing two diagnosis levels to the cloud provider (i.e., identifying the anomalous virtual machine and the type of error causing the anomaly) (Sauvanaud et al. 2018). The strategy is based on system monitoring data collected online either from the monitored cloud service, or from the underlying hypervisor(s) hosting the service. Different types of machine learning algorithms (supervised, unsupervised, and hybrid) were used to classify anomalous behaviors of the service. Moreover a fault injection tool was developed to collect training data including anomalous samples to train the detection and diagnosis models and to validate our detection strategy. The evaluation was applied to two case studies: a database management system (MongoDB) and an IP multimedia system developed as a virtual network function.

In particular, we have compared the efficiency of several classification algorithms and concluded that the Random Forests algorithm provides in our context the best tradeoff in terms of detection efficiency and training and detection time. The experimental results include a comparative analysis of the detection performance obtained with Operating Systems related monitoring data and hypervisor monitoring data.

We have explored similar approaches in the security area to support the detection of potential intrusions targeting critical embedded applications. In particular, in the context of a joint work with Thales avionics, we designed and implemented a host-based intrusion detection system (HIDS) adapted to the specific constraints and stringent requirements of real-time critical applications embedded in Integrated Modular Avionics (IMA) architectures [Damien et al. 2019-b]. The proposed HIDS implements an anomaly-based approach based on the monitoring of ARINC 653 API calls. The model of the legitimate behavior of the application is built based on data collected during the aircraft integration phase. Besides detecting anomalous behaviors of the target application, a signature-based system providing a first diagnosis after the detection of an anomalous behavior was also implemented. This approach has been validated on a real avionic computer and yielded good results in terms of classification accuracy and resource consumption [START_REF]On-board Diagnosis: A First Step from Detection to Prevention of Intrusions on Avionics Applications[END_REF]]. To support the validation of the HIDS, we developed a tool enabling the automatic injection of attacks and the generation of application code mutations that mimic the behavior of malevolent pieces of code introduced inside the target application [Damien et al. 2019-a].

Besides avionics, we also had the opportunity to design and implement, in collaboration with Renault, an intrusion detection system for CAN (Controller Area Network) based embedded automotive networks, that takes into account specific constraints of the automotive domain (simplicity of implementation without modifying the ECU (Electronic Control Unit) architecture, low cost, low detection latency). The proposed approach consists in automatically generating attack signatures from automata based models, derived from the ECU specification, describing the behavior of the ECUs on board interacting via messages on the CAN bus (Studnia et al 2018). This approach was validated on an early prototype using simulated attacks performed on logs of an actual CAN network.

Lessons learned and concluding remarks

Joint collaborations with industry have always been an important source of inspiration for new research challenges and solutions, as well as an opportunity to validate our results on real-life use cases and applications. Such collaborations have allowed us to address a wide range of topics with several industry partners from various application domains (aeronautics, automotive, telecommunication, energy, etc). Development of scalable and generic solutions that can accommodate the increasing complexity of computing systems and be easily integrated within industrial system engineering processes are concerns shared by several industry partners. The examples presented in this chapter clearly show the evolution of the topics of interest to industry over the years, at least as we have experienced it from our side. This evolution is in-line with the evolution of the technological trends through the years.

Over the years, we learned to reach quickly a consensus between industry needs and research objectives while preserving intellectual and industrial properties. In particular, we have accepted not to publish all results. In an academic world where publication is becoming more and more a driving process, this may be not acceptable. However, we have always been able to agree on i) parts of results we were allowed to publish and/or include in the PhD dissertation without harming the industrial properties and ii) results to be delivered to the industrialist only. With the benefits of hindsight, this process was always challenging and extremely rewarding. Another lesson learned concerns the clear distinction, upfront, between the user and the system provider perspectives. This led us to define dependability attributes related to the two points of view, and try to optimize both of them or at least reach an acceptable compromise, which was not obvious all the time, but truly challenging too.

Currently, significant efforts in many industries are being devoted to exploring the opportunities opened by recent advances in artificial intelligent techniques together with massive data collection thanks to the widespread deployment of IoT technologies. One of the main questions is how to leverage these techniques in various areas (monitoring, anomaly and intrusion detection and diagnosis, testing, etc.) to improve the dependability, resilience and quality of service of networks and computer systems performance while reducing the costs. A major challenge in this context is related to the lack of trust and confidence in such techniques and the need for rigorous and formalized approaches to provide justified assurance and ensure a better explainability and acceptability of AI algorithms in a context where malicious threats are also increasing. This problem has many dimensions and requires an interdisciplinary approach combining expertise from various scientific fields including mathematics, optimization theory, computer science, and also social and neuro-sciences. The study of use cases in different application domains and the cross-fertilization of solutions from different industrial sectors will be a key to achieve significant advances in this field.

(Kaâniche and Kanoun, 1998) , vol. 17, pp. 334-344, 1991. (Kanoun andSabourin, 1987)

  : K. Kanoun, T. Sabourin Software dependability of a telephone switching system. 17th IEEE International Symposium on Fault Tolerant Computing (FTCS-17), Pittsburgh (USA),6-8 July 1987, pp.236-24. (Kanoun et al. 1999): K. Kanoun, M. Borrel, T. Morteveille, A. Peytavin, Availability of CAUTRA, a subset of the French air traffic control system, IEEE Transactions on Computers, Vol.48, N°5, pp.528-535, May1999 (Laprie and Kanoun, 1980): J.C. Laprie and K. Kanoun. Dependability Modeling of Safety Systems, 10th IEEE International Symposium on Fault-Tolerant Computing, 1-3 October 1980, pp. 245-250. (Pintard et al. 2014): L. Pintard, J.C. Fabre, K. Kanoun, M. Leeman, M. Roy, From Safety Analysis to Experimental Validation of Automotive Systems", IEEE Pacific Rim Dependable Computing Conference (PRDC 2014), 19-21 November. 2014, Singapore. (Rugina et al. 2011): A. E. Rugina, K. Kanoun, M. Kaâniche. Software Dependability Modeling Using AADL (Architecture Analysis and Design Language). International Journal of Performability Engineering, Vol.7, N°4, pp. 313-325, July 2011. (Sauvanaud et al. 2018) C. Sauvanaud, M. Kaâniche, K. Kanoun, K. Lazri, G. Da Silva Silvestre. Anomaly Detection and Diagnosis for Cloud services: Practical experiments and lessons learned, Journal of Systems & Software, Special issue on Software Reliability, Volume 139, May 2018, Pages 84-106. (Studnia et al 2018): I. Studnia, E. Alata, V. Nicomette, M. Kaâniche, Y. Laarouchi, A language-based intrusion detection approach for automotive embedded networks, International Journal on Embedded Systems. Volume 10, Issue1, 2018. (Tiassou et al. 2012): K. Tiassou, K. Kanoun, M. Kaâniche, C. Seguin, C. Papadopoulos. Impact of Operational Reliability re-Assessment during Aircraft Missions. 31st IEEE International Symposium on Reliable Distributed Systems (SRDS 2012), Irvine, CA, USA, 8-11 October 2012, pp. 219-224. (Tiassou et al. 2013): K. Tiassou, K. Kanoun, M. Kaâniche, C. Seguin, C. Papadopoulos. Aircraft operational reliability -A model-based approach and a case study. RESS (Reliability Engineering and System Safety), 120 (2013) pp. 163-176.

  Kaâniche et al. 1994): M. Kaâniche, K.Kanoun, M. Cukier, and M. Bastos Martini, Software Reliability Analysis of Three Successive Generations of a Switching System. First European Conference on Dependable Computing (EDCC-1), Berlin, Germany, 4-6 October 1994, pp. 473-490. (Kaâniche et al. 2004) M. Kaâniche, Y. Le Guédart, J. Arlat, T. Boyer, An investigation on mutation strategies for fault injection into RDD-100 models, Safety Science, Issue 5, Vol.42, pp.385-403, June 2004 (Kanoun et al. 1991): K. Kanoun, M. Bastos Martini, and J. Moreira de Souza. A Method for Software Reliability Analysis and Prediction-Application to The TROPICO-R Switching System. IEEE Transactions on Software Engineering

	: M. Kaâniche, K. Kanoun, Software reliabilty analysis of
	three successive generations of a telecommunications system, IEEE Workshop on Ap-
	plication-Specific Software Engineering and Technology (ASSET'98), Richardson
	(USA), March 26-28 1998, pp. 122-127
	(Kaâniche et al. 1998): M. Kaâniche, L. Romano, Z. Kalbarczyk, R. Iyer, R. Karcich, A
	hierarchical approach for dependability analysis of a commercial cache-based RAID
	storage architecture, 28 th IEEE International Symposium on Fault-Tolerant Computing
	(FTCS-28), Munich (Germany), June 1998, pp.6-15
	(

Acknowledgement

The chapter topic was inspired by friendly discussions with Ravi Iyer, over the years, especially during our sabbatical visits to the University of Illinois at Urbana Champaign or at LAAS-CNRS in Toulouse. We all know that Ravi enjoys the practical aspects of research, in addition to deep conceptual work. We had the opportunity to share with him our lessons learned and some ideas inspired from the industry projects that we have conducted as well as from our experimentaloriented research on system dependability and software reliability, and also more recently on the assessment and mitigation of security threats. Thank you Ravi!

We also thank all our numerous colleagues from LAAS-CNRS and from industry with whom we have carried out the collaborative work outlined in this chapter.


Claire Alestra

Gilbert Cette

Valérie Chouard

Rémy Lecat
email: remy.lecat@banque-france.fr

Growth impact of climate change and response policies: The advanced

Keywords: Climate, Global warming, Energy prices, Environmental policy, Growth, Productivity, Long-term projections JEL classification: H23, Q54, E23, E37, O11, O47, O57, Q43

come

Introduction

The latest report by the Intergovernmental Panel on Climate Change (IPCC, 2021) has underlined the fast deterioration of climate stability. This issue presents strong implications for policy-making, notably regarding the carbon pricing strategy in terms of efficiency, equity or political acceptance. A pigouvian tax on CO 2 emissions is often presented as the simplest and most efficient policy to reduce CO 2 emissions (see the synthesis from [START_REF] Gillingham | The cost of reducing greenhouse gas emissions[END_REF], although, from a welfare point of view, it could be complemented by other policies as for instance regulation and norm setting (see [START_REF] Stiglitz | Addressing climate change through price and non-price interventions[END_REF]).

Yet, the economic literature reveals a lack of consensus among economists and policy-makers concerning the impacts of climate change and the appropriate policies to face this risk. Appropriate macroeconomic modelling frameworks have emerged to quantify the economic impacts of climate change, breaking down the different mechanisms at play from fossil energy use to final damage. Amongst them, the Integrated Assessment Models (IAMs), the Computable General Equilibrium (CGE) models, the Input-Output models, Agent-based models and the Macroeconometric models (for a recent overview of these models see the NGFS Technical Supplement, 2019 and[START_REF] Bolton | The Green swan: Central banking and financial stability in the age of climate change[END_REF].

The IAMs describe not only relationships between human activities and environmental processes but also between socio-economic systems and environmental systems. The most renowned IAM is Nordhaus' Dynamic Integrated Climate and Economy (DICE) model (1991,1994,2007,2013,2018). It consists of a macroeconomic module, modelling the relationship between economic activity, GHG emissions and the costs of their reduction (through an abatement curve) and a climate module, which links the rise in concentration of GHG emissions to the increase in world temperatures (that is, the climate sensitivity). [START_REF] Nordhaus | A regional dynamic general-equilibrium model of alternative climate-change strategies[END_REF] and [START_REF] Nordhaus | Warming the world: Economic models of global warming[END_REF] developed the RICE, a regional version of the DICE model with different inputs endowments (in labour, capital and energy) by geographic areas. Other examples of IAMs are the models DART [START_REF] Deke | Economic impact of climate change: Simulations with a regionalized climate-economy model[END_REF] with a general equilibrium framework and the inclusion of agricultural productivity and sea level rise, WITCH [START_REF] Bosetti | WITCH: A world induced technical change hybrid model[END_REF] that considers noncooperative behaviour between different regions, MERGE [START_REF] Manne | MERGE: A model for evaluating regional and global effects of GHG reduction policies[END_REF], PAGE [START_REF] Alberth | Developing the PAGE2002 model with endogenous technical change[END_REF] and FUND [START_REF] Tol | Emission abatement versus development as strategies to reduce vulnerability to climate change: An application of FUND[END_REF][START_REF] Waldhoff | The marginal damage costs of different greenhouse gases: An application of FUND[END_REF].

On the contrary, CGE models are dynamic general equilibrium models that describe the economy as a system of monetary flows across sectors and agents, solving numerically combination of supply and demand quantities, as well as relative prices to clear the commodity and labour market simultaneously (NGFS technical Supplement, 2019). The OECD ENV-Linkages multi country by [START_REF] Chateau | An overview of the OECD ENVLinkages model: Version 3[END_REF] is one example of a recursive dynamic neo-classical CGE model.

Our contribution proposes a fully transparent and free-access model, the Advanced Climate Change Long-term model (ACCL), with a rich and endogenous modelling of the GDP growth dynamics. This tool is based on a supply-side approach. A major blind spot of the economic literature on climate change is Total factor productivity, which is the most significant determinant of the future path of GDP, but which is sketchily presented, usually as a deterministic trend. We present here a comprehensive modelisation of TFP, including all its major drivers. Moreover, University of Orléans, the 6 th AFSE-DGT policy evaluation conference, the 69th Congress of the AFSE, the Eco-Mod2021 conference, and the 20th International Conference on Credit Risk Evaluation for their advice on the paper. We would like to warmly thank Thomas Laboureau for his preparatory work on the model. This paper does not necessarily represent the opinions of the Banque de France or the Eurosystem. This work was supported by the French National Research Agency Grant ANR-17-EURE-0020 and by the Excellence Initiative of Aix-Marseille University -A*MIDEX. capital intensity is endogenous. Our contribution could be classified in the Macroeconometric models family. It is a user-friendly projection tool 2 , designed with R-Shiny, which allows the user to run scenario-analysis to identify and quantify the consequences of energy price shocks on GDP. The user can change at will all the hypotheses and parameters.

In this model, we assess the long-run effects of carbon taxation on economic growth through two opposite channels. First, the negative consequences of carbon tax, or any other regulation increasing prices of CO 2 -emitting energies, on GDP growth via the impact of higher energy prices on Total Factor productivity (TFP). Then, the positive economic impact of limiting climate change consequences, through the abatement of carbon dioxide (CO 2 ) emissions (as the increase in the prices of CO 2 -emitting energies has a deterrent effect on their consumption).

To address this question, we build an original and extensive database that enables us to estimate or calibrate most of the relationships of the model (18 developed countries and seven emerging countries among the world greatest polluters, plus six regions to cover the rest of the world). We then use these empirical findings to implement-global and local projections for the whole world, decomposed in 31 countries and regions at the 2060 and 2100 horizons, allowing for user-designed scenarios of both climate change and carbon taxation.

Our results illustrate the "tragedy of the horizon" with net GDP losses induced by climate policies in the medium term, but a favourable net impact in the long term. Similarly, we can presume that international coordination is of significant importance since climate change is a global issue. A collective reduction of greenhouse gases (GHG) emissions would actually benefit a vast majority of countries. Yet, these social benefits can be neglected by national governments facing high individual costs to implement such a policy and fearing inaction by other emitters. Our simulations do show that for each country, the best individual strategy is a "Business As Usual" (BAU) one and stringent climate policies for others. Hence, the global best collective strategy would be the implementation of stringent climate policies simultaneously in all countries. This coordination problem comes from the fact that a climate policy has a detrimental impact on GDP through TFP decrease in the country which implements it, but a favourable GDP impact through lower environmental damage for all countries.

The rest of our paper is organized as follows. Section 2 describes the general framework of the ACCL tool. Section 3 presents the evaluation of the GDP before climate damage. Section 4 presents the endogenous evaluation of the global warming and of GDP damage from climate change. Section 5 proposes several climate scenarios, corresponding to business as usual country behavior or to the implementation of climate policies. Section 6 concludes.

Global framework for analysis

We adopt a supply-side approach and a long-term view. Indeed, at the 2060 and 2100 horizons which we chose, we take into account a production function approach to GDP, assuming full capacity utilization and full adjustment of production factors to their optimum values. Short-and Diagram 1. Overall scheme of the projection tool. Damage to GDP from global warming in country c EPL * PMR t,c Regulation index ΔCUR t,c Change in Capacity utilization rates medium-term transition costs are only partly taken into account, as the consequences of climate policies are based on long-term estimates of the impact of energy prices on TFP and on energy consumption.

Diagram 1 presents the overall scheme of the projection tool. The series (cf. Table 1) defined in the scenario are in dark and resulting series are in blue. The main scenario inputs are the prices of the different types of energy relative to the GDP price. These series are meant to represent the policies that will impact the relative price of energy sources in order to curb energy consumption towards less CO 2 -emitting energy types.

The other inputs are directly and mainly related to the determination of TFP, as presented in part 3.3. The resulting series stem either from estimated or calibrated relationships. GDP is based on a Cobb-Douglas production function with two factors: capital and labour. TFP is estimated based on its structural determinants as well as on relative energy prices: relationship 1 of Diagram 1 is the long-term estimates of TFP on all the series defined in the scenario mentioned above but regulations, which are used in relationship 2 as determinants of the country fixed effects estimated in relationship 1, and capacity utilization rate, which are used in short-run relationship 3. Labour is directly determined by the hypotheses on employment rates and hours worked. We endogenise the dynamics of the capital stock from the path of TFP, labour and relative investment prices. Relationship 5 relates total energy consumption to relative energy prices and GDP. The decomposition of total energy consumption into consumption of the different energy types is based on the substitution elasticities between energy types, which are set as parameters of the scenarios (relationship 4 and 6). As energy prices influence the TFP level, our production function indirectly corresponds to one with three production factors, with an implicit substitution elasticity between energy and the other two factors not necessarily equal to one.

Consumption by energy types and by country/regions yields a path of the global CO 2 emissions (relationship 7). The relationship between the GHG stock and global temperature increase compared to the pre-industrial era (relationship 8) is calibrated on the Representative Concentration Pathway of the IPCC (2014). GDP damage from temperature increase is calibrated on Nordhaus and Moffat (2017)' meta-analysis of studies and derived at the country/region level using OECD (2015) estimates as a distribution key. GDP damage is assumed to be non-linearly related with temperature increases (relationship 9). We assume that GDP damage from temperature increases does not affect the energy consumption stemming from GDP, as it results from it. Indeed, this damage may appear non-linearly through time and hence may not slow down energy consumption.

Subscript i energy, t for year and c for country; series defined in the scenario in dark and resulting series in blue; estimated relationship numbers in blue and calibrated or accounting ones in dark.

Relationships 1, 2, 3 and 5 are estimated on a sub-sample of advanced countries. Estimate results are used for other countries/regions, for which no existing or sufficiently long time-series are available. This may create a bias for emerging countries, which are further from the productivity frontier and for which some coefficients may be, compared to those estimated for advanced countries, higher (e.g. education) or lower (e.g. regulations).

Estimating GDP before damage

Estimating GDP

The GDP evaluation is based on a supply-side model, at the country level. We assume a usual two-factor (capital and labour) Cobb-Douglas production function, with constant returns to scale, as in a large part of the literature (and for instance the DICE model from [START_REF] Nordhaus | Projections and uncertainties about climate change in an era of minimal climate policies[END_REF]:

Q c,t = TFP c,t .K α c,t-1 . (N c,t . H c,t ) 1-α (1a)
Where c and t variable indexes indicate for which country c and which year t the variable is considered. Q is the volume of GDP, TFP the total factor productivity, K the volume of capital installed at the end of the year, N the employment, i.e. the number of workers, and H the average number of hours worked per year and per worker. α is the elasticity of output Q to capital K and we assume constant elasticity over time for all countries with the calibration: α = 0.3 as in other studies (see for example [START_REF] Bergeaud | Productivity trends in advanced countries between 1980 and 2012[END_REF], or Fouré et al., 2013, among others). Relation 1 can be expressed in logs and growth rate terms:

Δq c,t = Δtfp c,t + α.Δk c,t-1 + (1 -α) .(Δn c,t + Δh c,t ) (1b)
where x corresponds to the logarithm of the variable X (x = log(X)), and Δx is the usual approximation for the growth rate of X. (Δk c,t-1 -Δn c,t -Δh c,t ) is the change of the capital intensity, which corresponds to the capital deepening mechanism.

To build a scenario, for each country c, employment N and working hours H are exogenous. The quantification of the volume of capital K and of the TFP is based on specific assumptions and relations.

Estimating the capital stock

Concerning K, the volume of capital, we assume that in the long term, at the potential path, the capital coefficient (ratio of capital divided by GDP) remains constant in nominal terms (cf. [START_REF] Cette | ICT and potential output growth[END_REF]:

Δpq c,t + Δq c,t = Δpk c,t + Δk c,t-1 (2a)
Where P Q is the GDP price (pq = log(P Q )) and P K the price of investment in fixed productive capital (pk = log(P K )).

As in [START_REF] Cette | ICT and potential output growth[END_REF], we observe in nominal terms in the US a notable stability in the capital coefficient over the last few decades. The stability assumption, thus, seems realistic.

From relation 2a, we obtain the relation 2b, which is used to build long-term capital scenarios:

Δk c,t-1 = Δpq c,t + Δq c,t -Δpk c,t (2b)
We could assume a short-term over-decommissioning of capital due to the faster capital obsolescence triggered by environmental policy implementation. Such environmental policy could make obsolete some capital components quicker than previously expected without policy. Due to this short-term capital over-decommissioning, the capital growth rate could be lower than the growth rate given by relation 2b, for some time. But in our supply approach, the appropriate level of capital would not be changed in the long-term, which means that the transitory lower capital growth rate would be followed by an equivalent transitory higher capital growth rate. For this reason, as we consider climate policy impacts at a long-term horizon, we do not consider a possible short-term impact of climate policy on the decommissioning rate.

Estimating TFP

Total factor productivity, estimated in log level, depends on several variables. We estimate in two steps the long-term relation. 3In a first step, the log of TFP is assumed to depend on the following variables:

-The log of the price of energy relative to the price of GDP. This corresponds to a substitution effect: if this relative price increases (resp. decreases), firms decrease (resp. increase) their intermediate consumption of energy and increase (resp. decrease) their use of labour and capital production factors, per unit of GDP. Everything else being equal, this corresponds to a decrease (resp. increase) of the TFP. Then, we expect a negative coefficient for this variable. Our choice of specification corresponds to that included in several models (and for instance the DICE model, see [START_REF] Nordhaus | Projections and uncertainties about climate change in an era of minimal climate policies[END_REF]). An alternative could have been to specify a three-factor production function (as [START_REF] Fouré | Modelling the world economy at the 2050 horizon[END_REF], among numerous others, see this paper for a survey). Implicitly, our specification is equivalent to such a three-factor production function: the coefficient of the relative price of energy can be considered as equivalent (in absolute value) to an implicit substitution elasticity between energy and the combination of the two other factors (labour and capital). This impact on TFP, which relies on a substitution effect within the production function, is estimated on past energy price hikes, which did not involve any redistribution of the proceed of the increase. -The log of investment price relative to GDP price. This corresponds to a technical progress effect: if this relative price decreases (resp. increases), it means that the same capital value corresponds to higher (resp. smaller) volume and production capacity, which could go with technical progress implying at the same time TFP improvement (resp. deterioration). The underlying idea is that quality improvements in investment in terms of productive performance are at least partly incorporated into the measurement of investment prices in national accounts through hedonic or matching methods. This is mainly done for ICT since this investment benefits more than others from performance improvements (for a summary on these aspects, see [START_REF] Cette | ICT and potential output growth[END_REF]. This means that technical progress decreasing the relative investment price impacts GDP level and growth through two channels. First, a capital deepening channel, the same capital nominal value corresponding to a higher capital volume and then to a higher production capacity. This channel is taken into account by the previous relation 2b. Second, a TFP improvement channel, which is taken into account through TFP relation 3. Thus, we expect a negative coefficient for this relative investment price variable in the TFP relation, which corresponds to the second mentioned channel. -The average years of schooling in the working age population, to take into account the contribution of education to the quality of labour input. This contribution is calibrated at a 5% return by year of schooling, estimated in [START_REF] Bergeaud | The role of production factor quality and technology diffusion in the 20th century productivity growth[END_REF] on the same database. This return falls within the range of estimates of "Macro-Mincer" equations such as [START_REF] Barro | A new data set of educational attainment in the world, 1950-2010[END_REF]. -The employment rate that displays decreasing returns because less productive workers are more than others recruited (resp. fired) as the employment rate increases (resp. decreases). This impact is estimated in other studies (see [START_REF] Bourlès | Trends in 'structural' productivity levels in the major industrialized countries[END_REF] for surveys and estimates) and the related coefficient is expected to fall within the range -0.75 to -0.25.

Where pen, pgdp and pinv correspond to the log of energy, GDP and investment price indexes, EDUC is the average years of schooling, ER is the employment rate. The indexes c and t (or t-1) indicate the country and the year. FE c is a country fixed effect. As there is a general intercept (α 0 ), there is no fixed effect for one of the countries, which is here the US. I T,t = Max(0; t-T) are variables which allow us to take into account some possible tfp common trend breaks for all countries in our sample starting from different years T. This relation 3 is estimated using the OLS method on a panel of 18 developed countries5 over the period 1980-2017.

All coefficients have the expected sign. A decrease by one percent of the relative price of energy or of investment would decrease TFP by, respectively, 0.02% and 0.37%. Two global TFP trend breaks are estimated, a positive one in 1985 just at the starting point of a largely synchronised global growth recovery, and a negative one in 2012 after the financial crisis. In [START_REF] Alestra | Long-term growth impact of climate change and policies: The advanced climate change long-term (ACCL) scenario building model[END_REF], several robustness tests are conducted, showing in particular limited impacts of slight changes in the dates of the TFP trend breaks or dropping employment rate from the explanatory variables, but more significant impact of dropping country fixed effects, which captures unobserved country characteristics, in particular in terms of technical progress.

In a second step, we estimate the impact of regulations on labour and product market on the TFP level. A large body of literature investigates the productivity impact of product and labour market imperfections and of the anti-competitive regulations establishing and supporting them (see Cette et al., 2018, for survey). As shown in numerous papers, this impact could be large (see for instance [START_REF] Cette | Market regulations, prices and productivity[END_REF][START_REF] Cette | Rent creation and rent sharing: New measures and impacts on productivity[END_REF]. Country fixed effects estimated in the previous relation capture all the factors that may structurally impact TFP and are not explicitly taken into account in relation (3), for instance regulation, the quality of management, corruption, etc.

The estimated relation is the following simple one:

FE c = -0.108 * .REGUL c + β 0 + ε c (4)
Where REGUL c corresponds to the chosen regulation indicator. Several types of regulation indicators built by the OECD have been tried. As there is no time dimension in the estimates, and considering the availability period of the OECD indicators, we have used the average level of the regulation indicators over the period 1998-2013. These indicators are based on detailed information on laws, rules and market settings. The OECD product market indicators (here PMR for Product Market Regulations) aim to measure to what extent competition and firm choices are restricted when there is no a priori reason for government interference (see [START_REF] Koske | The 2013 update of the OECD product market regulation indicators: Policy insights for OECD and non-OECD countries[END_REF]. They take into account different domains, as state control or barriers to entry. The OECD EPL (Employment Protection Legislation) indicator aims to measure the procedures and costs involved in dismissing individual workers with regular contracts and workers on temporary contracts (see OECD, 2013, for more information).

The best results have been obtained on crossed product and labour regulation indicators, which correspond to the idea of a possible complementarity between the TFP impacts of these two types of regulations. As expected, regulations have a negative impact on TFP through the estimated fixed effects. Concerning PMR, it focuses on barriers to trade and investment, and concerning EPL it takes into account only regulations on individual dismissals. Robustness tests are presented in [START_REF] Alestra | Long-term growth impact of climate change and policies: The advanced climate change long-term (ACCL) scenario building model[END_REF].

From GDP without damage to global warming and GDP climate damage

Calculation of the total final consumption of energy

We start by estimating the relationship between the Total Final Consumption of energy (TFC) and the previous GDP and the Relative Price of Energy (RPE), on historical data for the most developed countries. Here, the TFC is considered as a proxy for energy use. Again, we chose to conduct the regression on these countries, as we need relatively long time series for the estimate, while we only need a few data points for the rest of the world on which we apply the estimated coefficients to uptake the simulations.

We thus build a panel database from 1980 to 2015 for 18 countries, using past data on the TFC of energy, in thousand tons of oil equivalent (ktoe) on a net calorific value basis, drawn from the IEA (International Energy Agency) Headline Global Energy Data (2017). We conduct the logarithmic regression detailed in the Eq. 5. Robustness checks (see [START_REF] Alestra | Long-term growth impact of climate change and policies: The advanced climate change long-term (ACCL) scenario building model[END_REF] demonstrate that our relationship holds (the price coefficient only slightly changes) when adding a trend variable or constraining the GDP elasticity to be equal to one. tfc c,t = 0.965 *** .gdp c,t-1 -0.670 *** .rpe c,t-1 + μ 0 + ε c,t [START_REF]Climate change widespread, rapid and intensifying[END_REF] Where tfc is the log of the total final consumption of energy, gdp the log of the Gross Domestic Product, rpe the log of the relative prices of energy, and ε the error term, for countries (or regions) c and year t.

Corroborating our expectations, we find a positive relationship of the log of the total final consumption of energy with the log of the lagged GDP and a negative one with the log of the lagged relative prices of energy, both with an elasticity less than unity. Hence, an increase of the past GDP by 1% should raise energy final consumption by 0.97%, while a similar growth of the energy relative prices should reduce energy final consumption by 0.67%, all other things being equal. The sign and magnitude of this first coefficient are similar to what can be found in the literature, for instance [START_REF] Csereklyei | Energy and economic growth: The stylized facts[END_REF]. The negative elasticity of energy consumption to its price reflects efficiency gains in energy consumption due to substitution of products with high energy content to products with low energy content or energy saving technologies.

Computation of the relative price of energy

RPE is derived from the relative prices of each types of energy weighted by their respective shares in the total consumption of energy.

RPE c,t = i RPE c, i,t × Ω c,i,t where Ω c,i,t = TFC c,i,t TFC c,t
Where Ω i is the share of the energy of type i in the total volume of the final consumption of energy. Data on energy prices come from the IEA Energy Prices and Taxes database, second quarter 2018: we chose a nominal index of total energy end-use prices (taxation included) for both industry and households, covering all types of energy, with the base year 2010. To calculate the relative prices of energy, we divide these data by the GDP deflator (index base 2010) from the OECD Economic Outlook (2018) database. We distinguish five distinct types of energy: coal, oil, natural gas and electricity that is derived from both "dirty" (CO 2 emitting) and "clean" (non-CO 2 emitting) energy inputs. 6 Their respective shares in the total final consumption of energy are computed using Eq. ( 6).

ΔΩ c,i,t = Ω c,i ,t-1 . j Ω c,j,t-1 . σ i,j . Δrpe c,j,t -Δrpe c,i,t (6)
Where is the variation within the time interval considered and σ i,j the pairwise elasticities of substitution between energy types, for all the various energy sources i / = j.

We select estimates of the pairwise substitution elasticities between coal, oil, natural gas and electricity from Stern's meta-analysis (2009), along with [START_REF] Papageorgiou | Substitution between Clean and Dirty Energy Inputs: A Macroeconomic Perspective[END_REF] appraisal for the elasticity of substitution between "clean" and "dirty" electricity inputs (see [START_REF] Alestra | Long-term growth impact of climate change and policies: The advanced climate change long-term (ACCL) scenario building model[END_REF] for the detailed set of elasticities). Therefore, knowing the projections of the TFC of energy, the past shares of each energy type in the final consumption, the substitution elasticities between energy types and the average annual growth rates of the projected relative prices of each energy type, we found the amount consumed for each energy source, until 2100, at the national and regional scales.

Converting energy consumption in CO 2 emissions

In order to consider the economic consequences of climate change, the consumption of energy is translated into global carbon dioxide emissions according to the Eq. ( 7):

CO2 t = i,c TFC i,t,c .γ i ( 7
)
Where CO2 is the world carbon dioxide emissions (in tonnes of CO 2 ) and γ i the default emissions factors for the energy of type i (see [START_REF] Alestra | Long-term growth impact of climate change and policies: The advanced climate change long-term (ACCL) scenario building model[END_REF] for the detailed set of default emissions factors). Projected emissions have thus been computed based on the past levels of total emissions from all sources adjusted by the yearly change in energy emissions, computed as the sum, across countries and energy sources, of the energy consumptions by energy types, weighted by their corresponding emissions factor. This implies that emissions stemming from non-energy sources such as animal husbandry are supposed to increase in a similar proportion as emissions from energy consumption7 and hence, that regulations preventing greenhouse gas emissions evolve in a similar way across sectors. Historical data on total CO 2 emissions arisen from fuel combustion, in million tons of carbon dioxide (Mt of CO 2 ), have been drawn from the IEA Headline Global Energy Data (2017). Default emission factors for fossil fuels and -both "CO 2 -emitting" and "non-CO2-emitting" -electricity have been collected from the CoM (Covenant of Mayors for Climate and Energy) report (2017).

We use a simplified carbon cycle constituted by using the Permanent Inventory Method (PIM) to model the increase of the worldwide stock of carbon dioxide by the aggregate CO 2 emissions. The flexibility of our tool offers the user the possibility to take account other climate-experts modelling of the carbon cycle. 8 Our PIM is depicted by the accounting relation 8:

StockCO2 t = (1 -ρ 1 ) . StockCO2 t-1 + (1 -ρ 2 ) . CO2 t -ρ 3t (8)
Where StockCO2 represents the worldwide stock of carbon dioxide (in giga tonnes of CO 2 ), CO2 the world carbon dioxide emissions (converted in giga tonnes of CO 2 ), whereas ρ 1 and ρ 2 are the coefficients of CO 2 sequestration by the carbon sinks of the planet (i.e., natural or artificial reservoirs capturing atmospheric CO 2 ) as a fix proportion of the stock or of the emissions and ρ 3 another type of possible CO 2 sequestration independent to both emissions and stock of CO 2 . This parameter allows also the user of our software to introduce some non-linearity in CO 2 emissions, coming from specific shocks. For instance, the large possible CO 2 emissions from permafrost if the temperature increase exceeds some threshold. Historical data for the stock of carbon dioxide are obtained from the world cumulative 1751-2014 gigatonnes of CO 2 in [START_REF] Marland | Global, regional, and national fossil-fuel CO2 emissions (1751-2014)[END_REF]. It appears to be no consensus in the scientific literature on the optimal way to model carbon dioxide sequestration, as well as on the precise value of its estimate. Therefore, we offer the user the possibility to choose and modify at will the different coefficients. By default, ρ 1 and ρ 2 are null as we set a fixed amount of annual CO 2 sequestration that is equals to a third of the 2015 carbon dioxide emissions.

Translating the stock of carbon dioxide in temperature rise

We convert the resulting projections of CO 2 emissions stock in a global warming of the Earth. Literature is not consensual concerning this relation, as shown by the large surveys from [START_REF] Matthews | Focus on cumulative emissions, global carbon budgets and the implications for climate mitigation targets[END_REF] or [START_REF] Hsiang | An economist's guide to climate change[END_REF]. We adopt the linear relation 9 calibrated using the RCP (Representative Concentration Pathway) 8.5 scenario (IPCC, 2014).

Temp t = η 1 . StockCO2 t ( 9
)
Where Temp is the increase in world temperatures from the pre-industrial era (in degree Celsius) and η 1 = 0.0008.

Global and regional climate-induced GDP damage

Different types of damage can result from higher temperatures (see for instance [START_REF] Hsiang | An economist's guide to climate change[END_REF]. Evaluation of damage from climate change suffer from large uncertainties (see for a synthesis [START_REF] Auffhammer | Quantifying economic damage from climate change[END_REF]. We consider them only in their direct or indirect GDP dimension. Uncertainties concerning this GDP damage are here taken into account by allowing the user to change the coefficient linking temperature changes to GDP damage.

Relation 10 describes how we finally obtain the economic damage generated by climate change, defined as "the fractional loss in annual economic output at a given level of warming compared to output in the same economy with no warming" (see [START_REF] Covington | The case for forceful stewardship (Part 2)[END_REF].

D GDP c,t = D GDP t . ω c ω (10) With D GDP t = θ 1 .Temp t + θ 2 .Temp 2 t + θ 3 .Temp 4 t
Where D GDP are the climate-induced damage as a percent of GDP, ω c and ω respectively the OECD (2015) regional and aggregate coefficients of climate induced damage.

The world damage hence follows a fourth degree equation with the temperature rise. Following the DICE model from Nordhaus, 2018, we use by default a quadratic relationship (θ 3 = 0), but the user can model tipping points in the damage function through θ 3 .9 Our default estimates (θ 1 = 0.6 and θ 2 = -0.6) are based on Nordhaus and Moffat's survey (2017). They reviewed 36 estimates from 27 papers and concluded, using a statistical method, that a 3 • C temperature increase (in comparison with pre-industrial levels) would diminish income (computed as a percentage of global aggregate GDP) by 2.04% (+ or -2.21), while a 6 • C warming scenario would imply a reduction of GDP by 8.06% (+ or -2.43), with respect to a scenario without global warming. This worldwide damage is then broken down into local damages using the share of the OECD (2015) regional coefficients of climate-damage (ω c ) in the OECD (2015) aggregate coefficient of climate induced damage (ω)-both at the 2060 horizon of the OECD study-, as a distribution key.

Global warming scenarios

The ACCL tool allows to perform simulations of climate change scenarios. For each country and region of interest, all the economic, energy and environmental hypotheses proposed by default can be modified by the user. Baseline specifications and scenarios are systematically offered, based on the estimated relationships, as well as the parameters and series paths documented beforehand.

In the scenarios below, we consider for each type of energy the same change in relative price in all countries/regions, assuming a coordinated climate policy (but leading to different carbon taxes expressed in volume). The default values for our scenarios can be found in [START_REF] Alestra | Long-term growth impact of climate change and policies: The advanced climate change long-term (ACCL) scenario building model[END_REF].

Four climate scenarios

Four analytical scenarios are simulated: no climate policy (i.e. "Business As Usual" scenario), decrease of non-CO 2 -emitting energy relative price (thanks to technological progress or subsidy), and low or high carbon taxation10 .

The BAU (for Business As Usual) scenario assumes no carbon taxation and so, we set the annual evolution of the relative price of each energy type to zero for the whole world from 2017 to 2100. The DREP (for Decrease of Renewable Energy relative Price) scenario is identical regarding all the different CO 2 -emitting energy sources, but it displays an average annual decrease of -2% for the relative price of non-CO 2 -emitting electricity in the entire world and over the whole time period. This decrease in the relative price of renewable energies may correspond to the effect of a subsidy or of technological progress, which reduces their production costs. With the LCT (for Low Carbon Tax) or HCT (for High Carbon Tax) scenarios, we introduce a climate policy that raises annually the relative price of coal, oil, natural gas and CO 2 -emitting electricity by 1% for LCT and 3% for HCT, in each country/region, for the whole period. The four considered scenarios are analytical and cannot pretend to correspond to realistic ones. They help appreciating the properties of the ACCL tool and considering very contrasted climate situations.

The economic hypotheses do not depend on the chosen climate policy scenario. The reduction in the relative price of investment is the main driving force of our TFP growth, alongside the improvement in the average education level of the population. Indeed, we define by default and for all countries/regions, a convergence of the average education level towards the country, in our database, with the highest level of education (Australia with about 13 years of schooling), thus reached in 2060 and then, a stagnation for the remaining period (2061-2100). Regarding the hours worked per employee, the employment rate or the regulation index, we suppose no variation as these effects are not among the ones we want to test.

Chart 1 presents the simulated World CO 2 net emissions in the four scenarios. It appears that, at the 2100 horizon, the net annual CO 2 emissions are, compared to their 2016 level, multiplied Chart 3 presents the impacts on Global GDP level of our four scenarios, compared to a situation without climate damage and climate policies. In the BAU scenario, this impact corresponds to the climate damage and, at the 2100 horizon, the GDP loss is almost 11%. In the three other scenarios, the net GDP impact corresponds to the sum of three components: the BAU damage, the TFP losses from climate policy, the avoided damage from a lower temperature increase than in the BAU scenario. In the DREP scenario, losses from climate policy are in fact gains, as energy price decreases. On the opposite, they are effective losses in the two carbon tax scenarios (LTC and HTC). Adding these three components, the net GDP impact at the 2100 horizon would be a loss of approximately 8.4% in the DREP, 7.6% in the LTC and 7% in the HCT scenario. The gap in net GDP losses between the two carbon tax scenarios is small, as the higher price increase of the CO 2 emitting energies in the HCT scenario compared to the LTC one results both in higher avoided damage and higher losses from the climate policy.

The BAU scenario and the two carbon tax scenarios illustrate what has been named the "tragedy of the horizon" by [START_REF] Carney | Breaking the tragedy of the horizon -climate change and financial stability[END_REF]. At the 2060 horizon, the net GDP impact is more detrimental in the LCT scenario than in the BAU one, and in the HCT scenario than in the LCT or the BAU ones. Indeed, losses from climate policies are higher than the avoided damage at this horizon. At the longer 2100 horizon, on the opposite, the net GDP negative impact is lower in the LCT scenario than in the BAU one, and in the HCT scenario than in the LCT and the BAU ones, losses from climate policies being themselves lower than avoided damage. This result implies that the sign of the actual net value of intertemporal GDP impact of climate policy implementation could depend on the discount rate. For very high values of the discount rate, climate policy implementation aiming at avoiding climate GDP impact could become irrelevant. Of course, for plausible values of the discount rate, the implementation of climate policies is highly relevant.

The "tragedy of the horizon" would be lowered (but would not disappear) from an increase of the convexity of the damage relation 10. If we assume that this relation is more than quadratic (θ 3 < 0) then the net GDP impact of the climate policies corresponding to scenarios LCT and HCT could become positive and not more detrimental than in the BAU scenario before the 2060 horizon.

Chart 4 presents the impacts on GDP at the country/regional level of the HCT scenario compared to the BAU scenario. It appears that the countries/regions that would benefit the most from the implementation of an ambitious climate policy would be those which are the most damaged in the BAU scenario. The gain is even slightly negative (more precisely non-significant) for numer-Chart 4. High Carbon Tax scenario (HCT) -Consequences on GDP (in % of GDP). For each country, first bar: 2060, second bar: 2100. ous developed countries. This illustrates what is usually called the "tragedy of the commons": to avoid high losses from global warming in some countries, mainly developing ones, climate policies have to be implemented in all countries and even countries where the gain from these policies could be small. It means that, in order to be efficient, climate policies need coordination and solidarity between countries.

Conclusion and policy implications

This paper presents a fully parametrisable tool to simulate the impact of climate change and of mitigation policies in a long-run, supply-side perspective. This tool emphasizes the effectiveness of energy price signals, which reduce the consumption of CO 2 emitting energies and, hence, could prevent major damage from climate change. As pointed by [START_REF] Gillingham | The cost of reducing greenhouse gas emissions[END_REF], a pigouvian tax on CO 2 emissions is the simplest and most efficient policy to reduce CO 2 emissions.

The proposed simulations illustrate the two tragedies of these mitigating policies. First, the "tragedy of the horizon" is reflected by the negative impact of mitigating policies in the medium run, even when accounting for the climate change damage avoided thanks to these policies. Hence, climate change requires a policy framework that adequately takes into account the long run, through a low-enough discount rate and an effective intergenerational solidarity. Second, the "tragedy of the commons" is reflected by the wide dispersion of climate change damage. Developing countries are among the most affected, while mitigating policies have to be implemented by all countries and especially by developed countries, with low climate change damage but high contribution to CO 2 emissions.

These scenarios remain optimistic, with mostly downside risks listed in the scientific literature. In particular, the relationship between CO 2 and temperature may not be linear, with several sources of tipping point, such as thawing permafrost, disruption of the thermohaline circulation, shift in El Niño-Southern Oscillation. . . On the positive side, we can mainly list potential technological improvement in CO 2 sequestration, not only at emissions but also for the existing atmospheric stock.

For all of these reasons, many environmental economists believe that contemporary values of the SCC are lower bounds of the true ones and so, that public policies are not bold enough, which our simulations fully support.

  Chart 1. World CO 2 emissions (in giga tonnes of CO 2 ). Note: BAU (Business As Usual Scenario), LCT (Low Carbon Taxation Scenario), DREP (Decrease in Renewable Energy relative Price), HCT (High Carbon Taxation Scenario). Chart 2. Global change in temperature (in • C). With respect to pre-industrial era. Note: BAU (Business As Usual Scenario), LCT (Low Carbon Taxation Scenario), DREP (Decrease in Renewable Energy relative Price), HCT (High Carbon Taxation Scenario). by a factor 4 in the BAU scenario, 3.5 in the DREP scenario and 2 in the LCT scenario. Net emissions are nil in 2100 in the HCT scenario, which means that the goal of nil net emissions corresponds to very ambitious climate policies, as also emphasised by the IPCC's (2018) special report. Chart 2 presents the global change in temperature (with respect to the pre-industrial era) of our four climate scenarios. At the 2100 horizon, the temperature increases by 4.8 • C in the BAU scenario, 4.5 • C in the DREP scenario, and 3.5 • C in the LCT scenario. The goal of an increase by 2 • C of the temperature would almost be reached in the HCT scenario, which means here again that such goal corresponds to very ambitious climate policies.

  Chart 3. Impacts on Global GDP level (in % of GDP). Note: BAU (Business As Usual Scenario), LCT (Low Carbon Taxation Scenario), DREP (Decrease in Renewable Energy relative Price), HCT (High Carbon Taxation Scenario).

Table 1

 1 Main series used in the scenario tool.

	Scenarios hypotheses	Results from estimated, calibrated or accounting relationships
	P NRJ i,t,c : Relative energy prices P GFCF t,c : Relative investment price EDU t,c Mean years of education H t,c Average hours worked per employee ER t,c Employment rate	GDP t,c Gross Domestic Product in volume and PPP 2010 C NRJ t,c Energy Final Consumption CO2 W t World CO 2 emissions t •W t Increase in world temperature from pre-industrial era D GDP t,c

The projection tool is available online at the following address: https://advanced-climate-change-long-term-scenariobuilding-model.shinyapps.io/ACCL Projection Tool/

In this equation and in the following ones, *: p<0.05; **: p<0.01; ***: p<0.001.

A short-term error correction model (ECM) relation has been estimated, based on residuals coming from the long-term estimate. As simulations are built over a very long period (with a horizon of 2060 or 2100), this short-term relation will not be used and simulations will be based only on the long-term relation here presented.

These countries are Australia, Austria, Belgium, Canada, Switzerland, Germany, Denmark, Spain, Finland, France, the United Kingdom, Italy, Japan, The Netherlands, New-Zealand, Portugal, Sweden, the United States.

As dirty means here CO 2 emitting, we consider the nuclear electricity production as a clean one, which could of course be contested from other dimensions.

According to FAO, total emissions from global livestock represent 14.5 percent of all anthropogenic GHG emissions, of which 80% is not related to fossil fuel consumption, and hence are not taken into account in our estimates of CO 2 emissions.

For a comprehensive review of the carbon cycle see[START_REF] Joos | Carbon dioxide and climate impulse response functions for the computation of greenhouse gas metrics: A multi-model analysis[END_REF] for IPCC (2014).

A "too-little, too-late" scenario is also available online at: https://advanced-climate-change-long-term-scenariobuilding-model.shinyapps.io/ACCL Projection Tool/.

We would like to thank, without implicating, Katheline Schubert and participants of the "Economic models and tools against climate change" TSE-Banque de France-ACPR conference, of the 2nd International Conference (EENR), University of Orléans, the 6 th AFSE-DGT policy evaluation conference, the 69th Congress of the AFSE, the Eco-Mod2021 conference, and the 20th International Conference on Credit Risk Evaluation for their advice on the paper. We would like to warmly thank Thomas Laboureau for his preparatory work on the model. This paper does not necessarily represent the opinions of the Banque de France or the Eurosystem. This work was supported by the French National Research Agency Grant ANR-17-EURE-0020 and by the Excellence Initiative of Aix-Marseille University -A*MIDEX.

Acknowledgements

This work was supported by the French National Research Agency Grant ANR-17-EURE-0020 and by the Excellence Initiative of Aix-Marseille University -A*MIDEX.