Gianluca Barbon
email: gianluca.barbon@inria.fr

Agostino Cortesi
email: cortesi@unive.it

Pietro Ferrara
email: pietro.ferrara@juliasoft.com

Enrico Steffinlongo
email: enrico.steffinlongo@unive.it

DAPA: Degradation-Aware Privacy Analysis of Android Apps

When installing or executing an app on a smartphone, we grant it access to part of our (possibly confidential) data stored in the device. Traditional information-flow analyses aim to detect whether such information is leaked by the app to the external (untrusted) environment. The static analyser we present in this paper goes one step further. Its aim is to trace not only if information is possibly leaked (as this is almost always the case), but also how relevant such a leakage might become, as an under-and over-approximation of the actual degree of values degradation. The analysis captures both explicit dependences and implicit dependences, in an integrated approach. The analyser is built within the Abstract Interpretation framework on top of our previous work on datacentric semantics for verification of privacy policy compliance by mobile applications. Results of the experimental analysis on significant samples of the DroidBench library are also discussed.

Introduction

Mobile applications have access to a large variety of confidential information like geographical data, and user identifiers (e.g., IMEI and phone number). Often the access to this sensitive data is essential for the functionality of the mobile app: a navigation system needs access to the current position of the user, while a photo editor accesses the picture gallery of the user. In addition, the business model might exploit this confidential information for contextual advertisement. On the other hand, a malicious app might exploit confidential information to capture sensitive data. For instance, the user might be tracked by recording and leaking the location and identifier of the mobile device.

The current Android model guards the access to sensitive data through permissions. For instance, an app should obtain the ACCESS FINE LOCATION permission in order to access precise geographical information. Therefore, each Android app has to list the permissions it needs in the manifest. The user is then asked to accept this list before installing the app or during the first execution of the app. However, this model allows an app to get only full or no access to a resource, and it does not take into account how the resource is accessed, and the information manipulated. In particular, the application might degrade the confidential information before leaking it. For instance, an app performing contextual advertisement exposing to the advertisement engine only the zip code of the user (instead of the full location) together with the user identifier. Degradation-unaware analysis would conservatively consider that the full location could be leaked, and the user could be precisely tracked.

Therefore, degradation-awareness is crucial to precisely infer what kind of and how much sensitive information is accessed, manipulated, and possibly leaked in a mobile app. In this scenario, we introduce a novel degradation-aware static analysis based on the abstract interpretation framework. Our approach tracks both explicit and implicit flows of information as well as the degradation levels of operators applied to the confidential data. We implemented our system in a prototype and applied to some representative examples taken from the DroidBench test suite [19]. Our experimental results show the practical interest of our solution.

The rest of the paper is structured as follows. In the rest of this Section, we introduce two motivating examples. Section 2 discusses the related work, while Section 3 formalizes the language, and the concrete and abstract semantics of our approach. The architecture of our tool is then described in Section 4, and Section 5 presents the experimental results. Finally, Section 6 concludes.

Motivating Examples

Consider the motivating example in Fig. 1, a simplified version of the ImplicitFlow1 test case from the DroidBench application set [19], an open source standard benchmark suite for information flow analyses of Android apps. This set has been created and maintained by the Secure Software Engineering Group of the Technische Universität Darmstadt. This program reads the device identifier (IMEI), and leaks it after some obfuscation steps. Obfuscation is performed by applying functions obfuscateIMEI and copyIMEI. Both the functions contain loops that are using the data derived from the IMEI as condition. This generates implicit flows which partially reveal confidential information about the original IMEI. Furthermore, it is interesting to notice that the functions and operators applied to the IMEI in the two methods are obfuscating it in different way, thus releasing implicitly different quantities of information.

In Fig. 2 another motivating example is shown. The program reads the IMEI and a user password. Then it hashes the password and it uses it as key for the encryption of the IMEI. Finally, the encrypted IMEI is explicitly released. In this example we can notice that, even if the program is leaking the password and the IMEI, it would not be possible to extract any sensitive information from the released values. Indeed the obfuscation steps performed through the hash and the encrypt operators make the reconstruction of the original values from the leaked ones hardly feasible.

Both examples show the need of a sound and precise analysis able to track (i) implicit flows and (ii) how the confidential information is obfuscated, by collecting the operators and functions that are applied to the confidential datum. Static [START_REF] Tripp | TAJ: Effective Taint Analysis of Web Applications[END_REF] and dynamic [START_REF] Enck | TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones[END_REF] taint analyses have been deeply investigated to enforce integrity and confidentiality properties. The main idea of this approach is to check if information coming from a source (e.g., the input of the user or the method providing the IMEI of the device) flows into a sink (e.g., the execution of a SQL query or an internet connection) without being sanitized (e.g., removing or modifying special characters or encrypting it). Taint analysis has been widely applied to Android app as well. Flowdroid [START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF] models precisely the Android app lifecycle, and it performs a precise static taint analysis to discover leakages of information. Taintdroid [START_REF] Enck | TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones[END_REF] is instead a precise dynamic taint analysis with a low overhead. Amandroid [START_REF] Wei | Amandroid: A precise and general inter-component data flow analysis framework for security vetting of android apps[END_REF] builds up a precise interprocedural call graph and data dependence graph, and it provides a framework to develop security analyses for Android apps. However, it can detect only explicit flows, and therefore it is not expressive enough to support our approach. Similarly, DroidSafe [START_REF] Gordon | Information-flow analysis of android applications in droidsafe[END_REF] proposes an accurate static information flow analysis, and HornDroid [START_REF] Calzavara | Horndroid: Practical and sound static analysis of android applications by smt solving[END_REF] introduces a fast and precise java bytecode analysis, but they do not track implicit flows. Taint analysis can track both implicit and explicit information flows, but it propagates only one bit of information (tainted or not). Instead, our approach tracks semantic information on how confidential data is processed and degraded. Implicit flows have been treated in [START_REF] Vogt | Cross site scripting prevention with dynamic data tainting and static analysis[END_REF][START_REF] Chugh | Staged information flow for javascript[END_REF][START_REF] Bandhakavi | Vex: Vetting browser extensions for security vulnerabilities[END_REF][START_REF] Just | Information flow analysis for javascript[END_REF], but all these works are related to browsers vulnerabilities and focus on Java Script, while we apply the implicit flow notion to the Android environment. Instead, [START_REF] Zanioli | SAILS: static analysis of information leakage with sample[END_REF] tracks impicit flows on Java programs, but it does not consider degradation operators.

Various approaches have extended standard taint analysis to track more precise information for mobile software. MorphDroid [START_REF] Ferrara | Morphdroid: Fine-grained privacy verification[END_REF] formalizes and implements a precise semantic analysis that infers what specific parts of confidential information are leaked (e.g., the zip code of the current location). However, it requires to manually define the semantics of degradation methods as well as tailored representation of each information of interest (e.g., IMEIs and locations), while our approach is agnostic on the type of information we deal with. BayesDroid [START_REF] Tripp | A Bayesian Approach to Privacy Enforcement in Smartphones[END_REF] dynamically detects information leaks through Bayesian reasoning, that is, by comparing confidential data with leaked values. If the similarity among these values is above a given threshold, then BayesDroid infers that confidential data is leaked. While this approach is quite more efficient than existing taint tracking, it does not track how confidential information is degraded. Another dynamic approach is represented by AppIntent [START_REF] Yang | AppIntent: Analyzing Sensitive Data Transmission in Android for Privacy Leakage Detection[END_REF], a tool that records all GUI events and asks a security analyst if the data computed through a sequence of GUI events can be leaked.

A different approach was studied by Quantitative Information Flow [START_REF] Mccamant | Quantitative information flow as network flow capacity[END_REF]. Instead of tracking taints, this approach is aimed at inferring the quantity of information leaked by a program. On the one hand, we share with this field of research the belief that is crucial, especially for mobile applications, to track precisely the amount of information that is leaked. On the other hand, our approach targets the sequence of degradation operations applied to confidential data rather than an estimation of the quantity carried on by a value.

An orthogonal field of research has been the development of security oriented specification languages [START_REF] Swamy | Fable: A language for enforcing user-defined security policies[END_REF] to cover a large variety of aspects (e.g., access control). Some of these languages like [START_REF] Cuppens | A deontic logic for reasoning about confidentiality[END_REF] were focused on confidentiality properties. However, these languages do not take into account how values are transformed and degraded, while this is the main focus of our work.

In our previous work [START_REF] Barbon | Privacy analysis of android apps: Implicit flows and quantitative analysis[END_REF], we introduced an information flow analysis that tracked the bit (i.e., quantity) of confidential information contained by each variable in a program. Instead, in this work we take a rather different approach by collecting the degradation operators (rather than a precise quantity) applied to the information stored in each variable. In this way, we overcome several limits of our previous solution, and in particular we track the implicit flow of strict equalities comparisons.

3 Concrete and Abstract Semantics

Syntax

As said in the Introduction, the target of our analyser are Android applications. For the sake of clarity, we will introduce our approach by restricting the view on a basic imperative language, supporting arithmetic, boolean and textual expressions, and arrays. Following [START_REF] Cortesi | Datacentric semantics for verification of privacy policy compliance by mobile applications[END_REF], the formalization is focused on three types of data: strings (s ∈ S), integers (n ∈ Z) and Booleans (b ∈ B). String, integer, and Boolean expressions are respectively denoted by sexp, nexp, and bexp. is used to represent (possibly sensitive) data-store entries, and lexp denotes label expressions. For instance, string expressions are defined by: sexp

::= s | sexp 1 • sexp 2 | enc(sexp, k) | pre(sexp, k) | hash(sexp) | read(lexp),
where • represents concatenation, enc the encryption of a string with a key k, pre the prefix substring of sexp of length k, hash the computation of the hash value, and read the function that returns the value in the data-store that corresponds to the given label.

Domain

By adexp we denote an atomic data expression that tracks the explicit and implicit data sources of a specific expression. Formally, an atomic data expression adexp is a set of elements , L dir , D dir , L imp , D imp where:

-Lab is the (finite) set of labels corresponding to possibly sensitive information sources stored in the device; -∈ Lab; -L dir = {(op j , j ) : j ∈ J}, says that the datum corresponding to label has been combined with data corresponding to labels j through operators op j to get the actual value of the expression. -D dir = {(op j , v j ) : j ∈ J} says that the actual value of the expression is obtained from the datum corresponding to label by applying the operator op j with values belonging to the set v j . -L imp = {(op j , j ) : j ∈ J}, says that the actual value of the expression implicitly depends on the datum corresponding to label combined with data corresponding to labels j through the operator op j . -D imp = {(op j , v j ) : j ∈ J} says that the actual value of the expression implicitly depends on the datum corresponding to label by applying the operator op j with values belonging to the set v j .

The set of atomic data expressions is defined by:

D = { i , L i dir , D i dir , L i imp , D i imp : i ∈ I ⊆ N, i ∈ Lab, L i k ⊆ ℘(Op × Lab), D i k ⊆ ℘(Op × V)},
where Lab is the set of labels, and Op is the set of operators, and V contains sets of uniform values (integer intervals, sets of string , etc.). For ∈ Lab, we denote by ˆ the (constant) value stored in . An environment relates variables to their values as well as to the set of atomic data expressions. Formally, Σ = Φ × Ψ , where (i) Φ : Var -→ (Z ∪ S ∪ {true, false}) is the usual environment that tracks value information, and (ii)

Ψ : Var -→ ℘(D) maps local variables in Var to a set { i , L i dir , D i dir , L i imp , D i imp : i ∈ I}.
The special symbol represents data coming from the user input and from the constants of the program.

Observe that the definition above refines [START_REF] Barbon | Privacy analysis of android apps: Implicit flows and quantitative analysis[END_REF], by introducing the explicit and implicit degradation sets that allow to keep track of the values the operators combine with the labels in Lab.

Concrete Semantics

We denote by S N : N exp × Σ → Z, S S : Sexp × Σ → S, and S B : Bexp × Σ → {true, false} the standard concrete evaluations of numerical, string, and Boolean expressions. In addition, S L : Lexp × Σ → Lab returns a data label given a label expression. An array c of lenght n is represented by n + 1 variables: c length , c[0], , . . . c[n -1] where c length stores the value of the lenght of the array c.

The semantics of expressions on atomic data S A : sexp × Σ → S × ℘(D) is described in Figure 1, for some basic unary and binary operators (like array selection, encryption enc and string prefix pre operators). Similar rules for numerical and boolean expressions are omitted here for the sake of space. Observe that the only new implicit flow is introduced when evaluating an array element, as the expression yielding the index may carry information that implicitly flows when accessing the corresponding array element.

The operator is defined on the degradation elements as follows:

D 1 D 2 = {(op, S 1 ∪ S 2 ) : (op, S 1 ) ∈ D 1 , (op, S 2 ) ∈ D 2 }.
The operator allows to inherit implicit dependences. Let A = (a,

{ 1 i , L 1i dir , D 1i dir , L 1i imp , D 1i imp : i ∈ I} ) and B = (b, { 2 j , L 2j dir , D 2j dir , L 2j imp , D 2j imp : j ∈ J}).
A B captures the fact that the expression represented by A implicitely reveals data contained in the expression represented by B.

Formally, A B = (a, { 1 i , L 1i dir , D 1i dir , j∈J (L 2j dir ∪ L 2j imp ) ∪ L 1i imp , j∈J (D 2j dir D 2j imp ) D 1i imp : i ∈ I}.
Given a statement c, we denote by Def(c) the set of variable that are assigned in the statement c.

The (concrete) semantics of statements is depicted in (Fig. 3). Observe that implicit flows are introduced in correspondence of if and while statements and arrays.

Example 1. Consider the following program:

(1) x = read( ); (2) input(y); (3) if (x < y){ (4) x = x + y; } (5) z = x + 1; S A [[s]](v, a) = (S S [[s]](v), { , ∅, ∅, ∅, ∅ }) S A [[n]](v, a) = (S N [[n]](v), { , ∅, ∅, ∅, ∅ }) S A [[x]](v, a) = (v(x), a(x)) S A [[read(lexp)]](v, a) = let = S L [[lexp]](v, a) in ( ˆ , { , ∅, ∅, ∅, ∅ }) S A [[ c[nexp] ]](v, a) = let (n, d) = S A [[nexp]](v, a) in (v(c[n]), a(c[n]) d) S A [[enc(sexp, n)]](v, a) = let (t, { i, L i dir , D i dir , L i imp , D i imp : i ∈ I}) = S A [[sexp]](v, a) in (enc(t, n), { i, L i dir ∪ {(enc, i)}, D i dir {(enc, {n})}, L i imp , D i imp } : i ∈ I}) S A [[sexp1 • sexp2]](v, a) = let (t1, { 1 i , L 1i dir , D 1i dir , L 1i imp , D 1i imp ) : i ∈ I}) = S A [[sexp1]](v, a) and let (t2, { 2 j , L 2j dir , D 2j dir , L 2j imp , D 2j imp ) : j ∈ J}) = S A [[sexp2]](v, a) in (t1 • t2, i∈I,j∈J ({ 1 i , L 1i dir ∪ {(•, 2 j )}, D 1i dir {(•, {t2})}, L 1i imp , D 1i imp ) }∪ { 2 j , L 2j dir ∪ {(•, 1 i )}, D 2j dir {(•, {t1})}, L 2j imp , D 2j imp ) }) S A [[pre(sexp, n)]](v, a) = let (t, { i, L i dir , D i dir , L i imp , D i imp : i ∈ I}) = S A [[sexp]](v, a) in (pre(t, n), { i, L i dir ∪ {(pre, i)}, D i dir {(pre, {n})}, L i imp , D i imp } : i ∈ I})
Table 1: Semantics of Textual Expressions on Atomic Data

S[[x := sexp]](v, a) = let (t, d) = S A [[sexp]](v, a) in (v[x → t], a[x → d]) S[[ c[nexp] := sexp ]](v, a) = let (t, d1) = S A [[sexp]](v, a) and let (n, d2) = S A [[nexp]](v, a) in (v[c[n] → t], a[c[n] → d1 d2]) S[[input(x)]](v, a) = let v read be the input value in (v[x → v read ], a[x → { , ∅, ∅, ∅, ∅ }]) S[[skip]](v, a) = (v, a) S[[send(sexp)]](v, a) = (v, a) S[[c1; c2]](v, a) = S[[c2]](S[[c1]](v, a)) S[[if b then c1 else c2]](v, a) = let (v1, a1) = S[[c1]](v, a) and let (v2, a2) = S[[c2]](v, a) in (v1, a 1 ) if S A [[b]](v, a) = (true, d) (v2, a 2 ) if S A [[b]](v, a) = (false, d)
where

a 1 (x) = a1(x) d if x ∈ Def(c1) a 1 (x) = a1(x) otherwise and a 2 (x) = a2(x) d if x ∈ Def(c2) a 2 (x) = a2(x) otherwise S[[while c1 do c2]](v, a) = S[[ if (c1) then (c2; while c1 do c2) else skip ]](v, a)

Fig. 3: Concrete Semantics of Statements

By applying the rules above, assuming that ˆ = 3 and that the input value assigned to y is 4, we get:

x (1) → (3, { , ∅, ∅, ∅, ∅ }) y (2) → (4, { , ∅, ∅, ∅, ∅ }) (x < y) (3) → (true, { , {(<, )}, {(<, {4})}, ∅, ∅) , , {(<, )}, {(<, {3})}, ∅, ∅) } (x + y) (4) → (7, { , {(+, )}, {(+, {4})}, ∅, ∅ , { , {(+, )}, {(+, {3})}, ∅, ∅ } z (5) → (8, { , {(+, )}, {(+, {1, 4})}, {(<, ), (<, )}, {(<, {3, 4})} , , {(+, )}, {(+, {1, 3})}, {(<, ), (<, )}, {(<, {3, 4})} }

Abstract Semantics

By following the Abstract Interpretation framework, in order to lift the concrete semantics to an abstract semantics, suitable abstractions of the domains of concrete values should be given, as well as operators on such abstractions that safely over-approximate the effects of the corresponding concrete ones. In our actual implementation, numerical values are abstracted in the lattice of Intervals [START_REF] Miné | Weakly relational numerical abstract domains[END_REF], while textual values are abstracted by the Prefix domain [START_REF] Costantini | Static analysis of string values[END_REF][START_REF] Costantini | A suite of abstract domains for static analysis of string values[END_REF]. The abstract semantics of expressions and statements strictly follows the concrete one, with the usual exceptions: (1) in the evaluation of the conditional and iterative statements the least upper bound operator is applied when the truth value of the conditional expression cannot be inferred, and (2) a threshold widening operator is applied on intervals when evaluating while loops to guarantee termination of the analysis, as the domain of intervals does not satisfy the ascending chain condition.

The least upper bound operator of abstract atomic data is [START_REF] Cortesi | Datacentric semantics for verification of privacy policy compliance by mobile applications[END_REF]. Abstraction and concretization functions are inherited from [START_REF] Cortesi | Datacentric semantics for verification of privacy policy compliance by mobile applications[END_REF]. The join operator is used to define the least upper bound of abstract values (numerical, boolean and string). The abstract semantics of statements are depicted in (Fig. 4). For simplicity, the abstract semantics of expressions are not explicitly described, since they corresponds to the concrete ones lifted to the abstract environment. Only the abstract semantic for the array get is defined here:

S a A [[ c[nexp] ]](v a , a a ) = let (n a , d a ) = SA[[nexp]](v a , a a ) in i v a (c[i]), i a a (c[i]) d a | i ∈ γ(n a ) ∧ i ∈ [0, . . . , c length ]
Given an abstract element (ã, { i , Li dir , Di dir , Li imp , Di imp : i ∈ I}), it represents concrete expressions whose value is represented by ã, and that may contain fingerprints of values stored in i . An over-approximation of the operations and values under which such (direct or implicit) fingerprints may be hidden in that value are collected in the last four components.

S a [[x := sexp]](v a , a a ) = let (t a , d a ) = S a A [[sexp]](v a , a a ) in (v a [x → t a ], a a [x → d a ]) S a [[ c[nexp] := sexp ]](v a , a a ) = let (t a , d a 1 ) = S a A [[sexp]](v a , a a ) and let (n a , d a 2 ) = S a A [[nexp]](v a , a a ) in i v(c[i] → t a ), i a(c[i] → (d a 1 d a 2 )) | i ∈ γ(n a ) ∧ i ∈ [0, . . . , c length ] S a [[input(x)]](v a , a a ) = let v a read be an abstract input value in (v a [x → v a read ], a a [x → { , ∅, ∅, ∅, ∅ }]) S a [[skip]](v a , a a ) = (v a , a a ) S a [[send(sexp)]](v a , a a ) = (v a , a a ) S a [[c1; c2]](v a , a a ) = S[[c2]](S[[c1]](v a , a a )) S a [[if b then c1 else c2]](v a , a a ) = let (v a 1 , a a 1 ) = S a [[c1]](v a , a a ) and let (v a 2 , a a 2 ) = S a [[c2]](v a , a a ) in (join(v a 1 , v a 2 ), a ) where S a A [[b]](v a , a a ) = (t, d a )
and Assume that the value of is bounded in the interval [START_REF] Bandhakavi | Vex: Vetting browser extensions for security vulnerabilities[END_REF][START_REF] Bohlender | Definition of the arithmetic operations and comparison relations for an interval arithmetic[END_REF], and that the input value assigned to y is bounded by the interval [START_REF] Barbon | Privacy analysis of android apps: Implicit flows and quantitative analysis[END_REF][START_REF] Braghin | Control flow analysis of mobile ambients with security boundaries[END_REF]. By applying the abstract semantics rules we get:

         a (x) = {(a a 1 (x) d a ) a a 2 (x)} if x ∈ Def(c1) a (x) = {a a 1 (x) (a a 2 (x) d a )} if x ∈ Def(c2) a (x) = {(a a 1 (x) d a ) (a a 2 (x) d a )} if x ∈ Def(c1) ∧ x ∈ Def(c2) a (x) = {a a 1 (x) a a 2 (x)} otherwise S a [[while c1 do c2]](v, a) = f ix(S[[ if (c1) then (c2; while c1 do c2) else skip ]](v, a))
x (1) → ([2, 4], { , ∅, ∅, ∅, ∅ }) y (2) → ([3, 5], { , ∅, ∅, ∅, ∅ }) (x < y) (3) → ( , { , {(<, )}, {(<, [3, 5])}, ∅, ∅) , , {(<, )}, {(<, [2, 4])}, ∅, ∅) } (x + y) (4) → ([5, 9], { , {(+, )}, {(+, [3, 5])}, ∅, ∅ , { , {(+, )}, {(+, [2, 4])}, ∅, ∅ } z (5) → ([3, 10], { , {(+, )}, {+, [1, 5]})}, {(<, ), (<, )}, {(<, [3, 5]})} , , {(+, )}, {(+, [1, 4])}, {(<, ), (<, )}, {(<, [3, 5])} }.
Observe that the value of the expression (x < y) (3) is the top element of the boolean lattice {⊥, true, false, } representing the fact that the abstraction does not allow to predict the truth value of such expression. Therefore, while computing z (5) both the branches of the conditional statement will be considered.

If we look at the abstract evaluation of z (5) , we can say that under the mentioned initial conditions:

the value of z at point (5) will definitely belong to the interval [START_REF] Barbon | Privacy analysis of android apps: Implicit flows and quantitative analysis[END_REF][START_REF] Costantini | A suite of abstract domains for static analysis of string values[END_REF]; the value of z may depend on either the value stored in , or from program constants, or from input values, but no other confidential information stored in j = may have affected the value of z, neither directly nor by implicit information flow; the only operator that might have been used to get the value of z out of is the numerical addition, with arguments that were never out of the interval [START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF][START_REF] Braghin | Control flow analysis of mobile ambients with security boundaries[END_REF]; the possible implicit information flow from to the value of z can be only due to a strict ordering comparison with values in the interval [START_REF] Barbon | Privacy analysis of android apps: Implicit flows and quantitative analysis[END_REF][START_REF] Braghin | Control flow analysis of mobile ambients with security boundaries[END_REF].

The DAPA tool

We developed DAPA, a static analysis tool based on the abstract interpretation framework. We adopted the Scala language for the development of the tool. Our tool is able to analyse both explicit and implicit flows and obtain a set of Degradation Elements from an Android app source code (translated in our language). It also computes results of functions and expressions in the form of abstract values, in order to collect them through the Degradation Elements. One of the main strength of the analyser is the capability to collect conditions of If and While constructs as implicit statements. This allows to propagate the implicit information flow throughout the analysis and to check whether confidential labels are present in the form of implicit information in sink points. The analyser is conceived in such a way to be modular and easily extensible in case of future improvements. We adopted Scala traits to mask the underlying implementation of the atomic data expression and lattices. This means that it is possible to modify the used abstraction by just providing an alternative implementation of the abstract types to the analyser, ensuring the modularity of the whole project. Standard join, meet and widening methods from the abstract interpretation framework are provided. In addition to these methods, a union function for atomic data expression is introduced, which allows to collect different behaviours for the over and under approximation. It performs the meet for the under approximation and the join for the over approximation of the elements of the atomic data expression. Operators present in statements are collected through an update function, which ensures the insertion of the operator in the atomic data expressions of all the involved labels. This method implements the operator defined in Section 3. The operator is also implemented in order to produce implicit flows.

Three types of basic abstract values are implemented: boolean, numerical and string, following the ones defined in the theory and adopting solutions described in [START_REF] Bohlender | Definition of the arithmetic operations and comparison relations for an interval arithmetic[END_REF][START_REF] Kulisch | Complete interval arithmetic and its implementation on the computer[END_REF][START_REF] Miné | Weakly relational numerical abstract domains[END_REF]. Also abstract values implementation is hidden through the use of common interface, ensuring modularity.

The output of DAPA consists in a list of adexp as defined in Section 3. This list of adexp highlights the degradation applied to every confidential label in the analysed app, by listing all the functions and operators applied to it, along with other labels involved as parameters. Specific information about the implicit flows will also appear in the output. A detailed explanation of the output is provided in Section 5.

Multiplicity of the Degradation Element

In the tool the Degradation Element is extended with a multiplicity notion, in order to associate the times it appears in a loop, allowing to track the number of repetitions of the element. These ones are tracked through an abstract interval, allowing proper handling during loop widening. This will contain the abstract number of times that such operator has been evaluated, giving a useful information to be associated to the degradation of the current label. This allows to abstract the operators present inside the scope of the loop. We also introduce information regarding position in the code of the statement in order to have an unambiguous element. The tool is thus more precise with respect to the semantics.

Widening of While loops While loops are analysed through the use of widening from the abstract interpretation framework. A threshold (or guard) can be modified by the user in order to stop loop iterations and start widening of the remaining ones. The under approximation in the resulting expressions will contain the smallest possible number of iterations (possibly, no iterations at all). Instead, the over approximation will be the set of all the possible iterations (the maximum possible number of iterations) of the loop.

Results

In this Section we present a qualitative analysis of the DAPA tool. Quantitative evaluation has also been made, in order to evaluate performances.

Motivating Examples

Results of the analysis of the motivating example ImplicitFlow1, introduced in Section 1, are here described. A special star label is used to collect every degradation that does not belong to any labels. The IMEI 0 label is the only confidential label used in this example. It contains the IMEI value associated to a device.

Explicit: [] Implicit: [IMEI_0 -> S: [{(length_1, IMEI_0), (<_1, star), (toCharArray_1, IMEI_0), (==_2, star)}: {(length_1, IMEI_0), (<_1, star), (toCharArray_1, IMEI_0), (==_2, star)}] D: [[(length_1, ImplicitFlow1.java@10.22) -> ({" * "}, [START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF][START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF]), (<_1, ImplicitFlow1.java@10.20) -> ([0,+oo], [START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF][START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF]), (toCharArray_1, ImplicitFlow1.java@9.17) -> ({" * "}, [START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF][START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF]), (==_2, ImplicitFlow1.java@12.21) -> ({"0"}, [START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF][START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF])]: [(toCharArray_1, ImplicitFlow1.java@9.17) -> ({" * "}, [START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF][START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF]), (==_2, ImplicitFlow1.java@12.21) -> ({"0"}, [START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF][START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF]), (<_1, ImplicitFlow1.java@10.20) -> ([0,+oo], [START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF][START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF]), (length_1, ImplicitFlow1.java@10.22) -> ({" * "}, [START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF][START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF]), (==_2, ImplicitFlow1.java@22.23) -> ({"5"}, [START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF][START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF])]]]

Explicit: [] Implicit: [IMEI_0 -> S: [{(toCharArray_1, IMEI_0), (strToInt_1, IMEI_0), (<_1, star)}: {(toCharArray_1, IMEI_0), (strToInt_1, IMEI_0), (<_1, star)}] D: [[(toCharArray_1, ImplicitFlow1.java@53.22) -> ({" * "}, [START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF][START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF]), (strToInt_1, ImplicitFlow1.java@58.27) -> ({" * "}, [START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF][START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF]), (<_1, ImplicitFlow1.java@56.20) -> ([0,+oo], [START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF][START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF])]: [(toCharArray_1, ImplicitFlow1.java@53.22) -> ({" * "}, [START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF][START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF]), (strToInt_1, ImplicitFlow1.java@58.27) -> ({" * "}, [START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF][START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF]), (<_1, ImplicitFlow1.java@56.20) -> ([0,+oo], [START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF][START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF])]]] Fig. 5: ImplicitFlow1 Results Fig. 5 contains the output of the analysis of ImplicitFlow1. The upper part of the figure corresponds to the first release of the IMEI with method writeToLog, while the lower one corresponds to the second release. The two calls to this methods correspond to two different obfuscation methods usage, the obfuscateIMEI and the copyIMEI respectively. These two methods have different obfuscation powers. Our tool was able to track these differences by reporting the usage of different operators.

Results are split into two sections, S and D, which in turn are divided into two parts by a colon, for under and over approximation respectively. The S part contains the atomic data expression composed by couples (operator, label), as defined in [START_REF] Barbon | Privacy analysis of android apps: Implicit flows and quantitative analysis[END_REF]. This allows to know which are the label that were combined through the related operator. The D part contains the degradation elements. It shows the operator, the position in the code, the abstract content and the number of iterations. Operators are annotated with an index. For instance, in the line 56 of the motivating example, the condition idx < len(imeiAsChar) will degradate IMEI by < 1 of idx, that is in position 1 of the arguments of <. While idx will be degradated by < 2 of imeiAsChar, but this is not listed in Fig. 5 since it belongs to the star label. The same holds for the S part. This allows to obtain an accurate explanation of the obfuscation. The position is composed of the name of the file, the number of row and the column in the code. Abstract values are related to the type of the label: numerical values are described through intervals, contained in square brackets, while strings are contained in braces. In this example, iterations are interval [START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF][START_REF] Arzt | FlowDroid: Precise Context, Flow, Field, object-sensitive and Lifecycle-aware Taint Analysis for Android Apps[END_REF], because there were no loops, thus no repeated elements. The user can in this way know which were the applied methods and operators used to obfuscate the IMEI.

Please notice that the only existing explicit flow is related to the special label star (not reported in the figure for the sake of space). This is because the value returned by the obfuscating methods does not explictly contains the IMEI label. On the other hand, this value contains implicit information about the IMEI label. This is correctly tracked by the DAPA analyser. In a similar way, in Fig. 6 the analysis results for the example in Fig. 2 are presented. Since no implicit flow is produced, only the explicit one is reported. The atomic data expression part S shows that an hash operator is applied to the password label. Then this hashed password is used by the encrypt operator as key to obfuscate the IMEI label.

These examples show that our analysis is able to track every degradation operation applied to confidential data.

Quantitative Evaluation: the DroidBench test set

The DAPA analyser has been tested using a set of simple Android-like apps from the DroidBench application set [19]. Where needed, the original Java code has been modified in order to be recognised by the analyser, since it still lacks support for actual libraries and some typical Java elements. Similar considerations must be taken into account for the Android libraries. The table in Fig. 7 describes analyser results in terms of time performances and detected leakage (explicit and implicit). The computer used for tests execution was equipped with an Intel i5 450M processor and 8GB of DDR2 RAM.

Even if the code in test cases contains some small differences with the original ones (with the exceptions of ArrayCopy1 and ImplicitFLow2, that were heavily modified), the DAPA tool was able to discover correctly explicit or implicit leaks when present.

Results Discussion

A quantitative test comparison with other existing tools, such as FlowDroid, DroidSafe, BayesDroid, was not possible. This is because the testing step has been made on simple basic applications. Nevertheless, the results obtained by DAPA are richer from a qualitative point of view when comparing to other tools. This is because we are performing a privacy degradation aware analysis, while common tools are more focused on pure taint analysis. This means that DAPA collects all the operations applied to sensible data, when such data are released. Moreover, when no degradations are applied to the confidential data, DAPA returns in any case richer results, since it is also capable to track implicit flows.

Conclusions

We introduced a new static analyser for information flow analysis of Android apps, that captures both explicit and implicit leakage and support degradation awareness. Our preliminary experimental results show the effectiveness of this approach, and the modularity of the analyser allows to tune the accuracy and efficiency of the analysis by plugging in more or less sophisticated abstract domains. Future improvements will consist in implementing objects in our language. A complete move to Java will be considered too, since it will introduce the possibility to analyse real Android app, without the need of conversions. Moreover, the evaluation of policies based on confidentiality and obfuscation notions [START_REF] Cortesi | Datacentric semantics for verification of privacy policy compliance by mobile applications[END_REF], already captured by the current analyser, should be considered in the future.

Finally, we would also consider to reuse the bit quantity introduced in [START_REF] Barbon | Privacy analysis of android apps: Implicit flows and quantitative analysis[END_REF] in order to define a function able to compute the final exported explicit and implicit quantity as a result of the degradation. Since the definition of this function would have required a considerable research effort about operators information release, it was outside the scope of this work, and we planned it only as possible future improvement.

classstaticFig. 1 :Fig. 2 :

 12 Fig. 1: ImplicitFlow1

Fig. 4 :

 4 Fig. 4: Abstract Semantics of Statements

Fig. 6 :

 6 Fig. 6: ObfuscatedFlow Results

Fig. 7 :

 7 Fig. 7: DroidBench Results


Paula Pérez-López
email: paula.perez_lopez@mines-paristech.fr

Benoît Gschwind

Philippe Blanc

Rolf Frischknecht

Philippe Stolz

Yvonnick Durand

Garvin Heath

Lionel Ménard

Isabelle Blanc

ENVI-PV: An interactive Web Client for multi-criteria life cycle assessment of photovoltaic systems worldwide

Keywords: PV Web Service, interactive tool, PV environmental performance, solar irradiation data, IEA PVPS Task 12, OGC standard, interoperability

Solar photovoltaics (PV) is the second largest source of new capacity among renewable energies. The worldwide capacity encompassed 135 GW in 2013 and is estimated to increase to 1721 GW in 2030 and 4674 GW in 2050, according to a prospective highrenewables scenario. To achieve this production level while minimizing environmental impacts, decision makers must have access to environmental performance data that reflect their high spatial variability accurately. We propose ENVI-PV (http://viewer.webservice-energy.org/project_iea), a new interactive tool that provides maps and screening level data, based on weighted average supply chains, for the environmental performance of common PV technologies. Environmental impacts of PV systems are evaluated according to a Life Cycle Assessment approach. ENVI-PV was developed using a state-of-the-art interoperable and open standard Web Service framework from the Open Geospatial Consortium (OGC). It combines the latest life cycle inventories, published in 2015 by the International Energy Agency (IEA) under the Photovoltaic Power Systems Program (PVPS) Task 12, and some inventories previously published from Ecoinvent v2.2 database with solar irradiation estimates computed from the worldwide NASA SSE database. ENVI-PV is the first tool to propose a worldwide coverage of environmental performance of PV systems using a multi-criteria assessment. The user can compare the PV environmental performance to the environmental footprint of country electricity mixes. ENVI-PV is designed as an environmental interactive tool to generate PV technological options and evaluate their performance in different spatial and techno-economic contexts. Its potential applications are illustrated in this paper with several examples.

Introduction

Electricity from photovoltaic (PV) systems is the second largest source of new capacity among renewable energies. It constitutes approximately one-third of the current renewable energy generation [START_REF]Renewable Energy: Medium-term market report 2015[END_REF]. The worldwide installed capacity is expected to increase from 135 GW in 2013 to 1721 GW in 2030 and 4674 GW in 2050 [START_REF]Technology roadmap: Solar photovoltaic energy[END_REF], according to the high-renewables scenario (hi-Ren) described by the IEA [START_REF]Energy Technology Perspectives 2014[END_REF]. PV systems are fed by an extensive renewable source, namely the sunlight, and cause very low emissions during the use phase [START_REF] Raugei | Life cycle impacts and costs of photovoltaic systems: Current state of the art and future outlooks[END_REF]. However, upstream and downstream processes corresponding to materials extraction, components manufacturing and transport and end-of-life management need to be taken into account to quantify the total environmental impacts [START_REF] Raugei | Life cycle impacts and costs of photovoltaic systems: Current state of the art and future outlooks[END_REF][START_REF] Beylot | Environmental impacts of large-scale grid-connected ground-mounted PV installations[END_REF][START_REF] Jungbluth | Life cycle assessment of crystalline photovoltaics in the Swiss ecoinvent database[END_REF]. Most of the available studies are based on Life Cycle Assessment (LCA) methodology and focus on greenhouse gas emissions and primary energy use as environmental indicators [START_REF] Beylot | Environmental impacts of large-scale grid-connected ground-mounted PV installations[END_REF][START_REF] Nugent | Assessing the lifecycle greenhouse gas emissions from solar PV and wind energy: A critical meta-survey[END_REF][START_REF] Wild-Scholten | Energy payback time and carbon footprint of commercial photovoltaic systems[END_REF]. Additional impact categories should also be taken into account to evaluate other environmental and human health concerns of the existing PV technologies according to a multi-criteria approach [START_REF] Beylot | Environmental impacts of large-scale grid-connected ground-mounted PV installations[END_REF][START_REF] Tsang | A comparative human health, ecotoxicity, and product environmental assessment on the production of organic and silicon solar cells[END_REF].

Technological, economic and planning aspects need to be taken into account to achieve the estimated future production level while minimizing environmental impacts [START_REF] Fthenakis | The technical, geographical, and economic feasibility for solar energy to supply the energy needs of the US[END_REF][START_REF] Ménard | Benefit of GEOSS interoperability in assessment of environmental impacts illustrated by the case of photovoltaic systems[END_REF].

Spatially-dependent factors that affect PV performance should also be considered [START_REF] Fthenakis | The technical, geographical, and economic feasibility for solar energy to supply the energy needs of the US[END_REF][START_REF] Ménard | Benefit of GEOSS interoperability in assessment of environmental impacts illustrated by the case of photovoltaic systems[END_REF][START_REF] Ito | Life cycle assessment and cost analaysis of very large-scale PV systems and suitable locations in the world[END_REF]. The development of PV systems requires the access to detailed data that support the decision-making process, such as local information on climate and soil characteristics (solar irradiance, number of sun hours per day, ground slope…) and technological data [START_REF] Ménard | Benefit of GEOSS interoperability in assessment of environmental impacts illustrated by the case of photovoltaic systems[END_REF][START_REF] Demirkan | Leveraging the capabilities of service-oriented decision support systems: Putting analytics and big data in cloud[END_REF][START_REF] Carrión | Environmental decision-support systems for evaluating the carrying capacity of land areas: Optimal site selection for grid-connected photovoltaic power plants[END_REF]. PV systems belong to an emerging sector with continuous technological changes [START_REF] Raugei | Life cycle impacts and costs of photovoltaic systems: Current state of the art and future outlooks[END_REF][START_REF] Wender | Illustrating anticipatory Life Cycle Assessment for emerging photovoltaic technologies[END_REF]. Thus, the environmental analyses should rely on updated databases that reflect the most recent designs. These data contribute to identify potential benefits and orient strategies at early stages of product development and implementation [START_REF] Beylot | Environmental impacts of large-scale grid-connected ground-mounted PV installations[END_REF][START_REF] Wender | Illustrating anticipatory Life Cycle Assessment for emerging photovoltaic technologies[END_REF]. PV systems should also be explored to position this technology within the current energy transition debate, in order to anticipate the changing technologies and possible progress [START_REF] Marini | A prospective mapping of environmental impacts of large scale photovoltaic ground mounted systems based on the CdTe technology at 2050 time horizon[END_REF].

For these reasons, we propose ENVI-PV (http://viewer.webservice-energy.org/project_iea), a new interactive Web Client that provides data and maps of the environmental performance of a set of common PV systems including current and future technoeconomic contexts. The calculation procedures are based on LCA, a standardized tool for the environmental assessment of products and processes applicable to renewable energies [START_REF] Nugent | Assessing the lifecycle greenhouse gas emissions from solar PV and wind energy: A critical meta-survey[END_REF]. The environmental results are provided at screening level, which means that life cycle impacts are calculated for worldwide average production rather than for the specific supply chain in each manufacturing country. The tool is based on the life cycle inventory updates published in 2015 by IEA PVPS Task 12 [START_REF] Frischknecht | Life cycle assessment of future photovoltaic electricity production from residential-scale systems operated in Europe. International Energy Agency (IEA)[END_REF][START_REF] Frischknecht | Life cycle inventories and life cycle assessment of photovoltaic systems[END_REF], as well as on PV scenarios from Ecoinvent database v2.2 previously published [START_REF] Jungbluth | Photovoltaics[END_REF]. ENVI-PV has a worldwide coverage with a multi-criteria scope, both in terms of alternative modeled systems and available environmental indicators [START_REF] Frischknecht | Life cycle assessment of future photovoltaic electricity production from residential-scale systems operated in Europe. International Energy Agency (IEA)[END_REF][START_REF] Frischknecht | Life cycle inventories and life cycle assessment of photovoltaic systems[END_REF][START_REF] Jungbluth | Photovoltaics[END_REF][START_REF] Frischknecht | Methodology guidelines on Life Cycle Assessment of photovoltaic electricity, 3rd edition[END_REF][START_REF] Frischknecht | Implementation of life cycle impact assessment methods[END_REF][START_REF]Climate Change[END_REF][START_REF] Jolliet | IMPACT 2002+: A new life cycle impact assessment methodology[END_REF][START_REF] Usetox | USEtox version 1.01[END_REF]. The user can compare the PV environmental performance to the environmental footprint of the corresponding country electricity mix [START_REF] Itten | Life cycle inventories of electricity mixes and grid[END_REF]. ENVI-PV results may allow analyzing the interest of integrating PV within national electricity mix across all available environmental indicators.

Examples of its potential uses are proposed to illustrate the various applications.

Web Client architecture

ENVI-PV provides the environmental performances of PV systems in the form of a Web Client invoking a Web Service [START_REF] Ménard | Benefit of GEOSS interoperability in assessment of environmental impacts illustrated by the case of photovoltaic systems[END_REF]. A Web Service is a software application built with an open standards-based interface that supports direct machine-to-machine interactions over the Web [START_REF] Alonso | Web Servicies. In: Web services: Concepts, architectures and applications[END_REF][START_REF] Ceri | Web Services Glossary[END_REF]. A Web Client is the software that provides the human-to-machine interface to access one or several Web Services through a Web Browser [START_REF] Lewine | Method for performing transactions on the world-wide web computer network[END_REF]. In our case, two Web Services, namely Web Maps Service (WMS) and Web Processing Service (WPS), combine algorithms for the calculation of PV life cycle environmental impacts and annual solar irradiation. The interoperability of the described architecture and its standard approach enables the access to our results of environmental performance maps obtained via the two Web Services. This interoperable architecture gives external entities, such as stakeholders or developers, the opportunity to develop new applications reusing these results.

The architecture based on Web Services facilitates the update of ENVI-PV and other future applications because they automatically use internal updates of the Web Services.

Environmental assessment and solar irradiation databases

The algorithms for the calculation implemented in ENVI-PV Web Services couple the application of LCA method for the quantification of environmental burdens with solar irradiation data computed from the worldwide NASA SSE database [START_REF]Surface meteorology and Solar Energy (SSE) Release 6.0 Methodology, version 3.1.2[END_REF].

Life cycle assessment approach

Renewable technologies and particularly PV systems exhibit remarkably lower emissions and better environmental performances than fossil sources during their utilization phase [START_REF] Raugei | Life cycle impacts and costs of photovoltaic systems: Current state of the art and future outlooks[END_REF]30]. However, their impact during manufacturing and installation as well as end-of-life management phases should also be quantified to assess their environmental sustainability [START_REF] Beylot | Environmental impacts of large-scale grid-connected ground-mounted PV installations[END_REF][START_REF] Jungbluth | Life cycle assessment of crystalline photovoltaics in the Swiss ecoinvent database[END_REF][START_REF] Troldborg | Assessing the sustainability of renewable energy technologies using multi-criteria analysis: Suitability of approach for national-scale assessments and associated uncertainties[END_REF]. Life cycle assessment (LCA) is one of the most widespread tools recommended for the environmental evaluation of emerging technologies such as PV systems [4-6, 8, 12, 16, 32]. LCA is a standardized method that aims at assessing the environmental impacts of products and processes over their whole life cycle, from the extraction and processing of raw materials to the use and end-of-life stages [START_REF]Environmental management -Life cycle assessment -Principles and framework[END_REF][START_REF]Environmental management -Life cycle assessment -Requirements and guidelines[END_REF]. The main advantage of LCA approach is that it allows quantifying the environmental impacts with no underestimations associated with the exclusion of any of the stages of the life cycle. Thus, it prevents individual stakeholders from shifting the environmental burdens from one stage to another instead of considering the reduction of the impact over the whole life cycle [START_REF]Communication from the Commission to the Council and the European Parliament. Integrated Product Policy -Building on Environmental Life-Cycle Thinking[END_REF]. The environmental impacts are quantified by classifying the emitted substances and extracted raw materials into specific impact categories and converting their values into reference units (e.g., kg CO 2 -eq to measure climate change impacts) through sets of characterization factors [START_REF]Environmental management -Life cycle assessment -Requirements and guidelines[END_REF].

In the case of ENVI-PV, the modeled processes are based on the life cycle inventories for 3 kWp slanted-roof laminates and panels and 570 kWp open ground PV systems developed within the IEA PVPS Program Task 12 [START_REF] Frischknecht | Life cycle assessment of future photovoltaic electricity production from residential-scale systems operated in Europe. International Energy Agency (IEA)[END_REF][START_REF] Frischknecht | Life cycle inventories and life cycle assessment of photovoltaic systems[END_REF], as well as on previous processes from Ecoinvent v2.2 database [START_REF] Jungbluth | Photovoltaics[END_REF]. The inventoried technologies include mono-and multi-crystalline silicon cells (mono-Si and multi-Si), ribbon-silicon cells (ribbon-Si), amorphous-silicon cells (a-Si), micro-silicon cells (micro-Si), cadmium telluride cells (CdTe) and copper indium gallium selenide cells (CIS). As above-mentioned, ENVI-PV outcomes consist in screening level LCA results calculated for worldwide average supply chains. The manufacturing countries and regions for each technology are listed in Table 1. The relative contributions of Asian & Pacific, Chinese, European and North American supply chains are weighted according to world market shares specific of each panel component. The inventories correspond to PV systems installed within Europe. Variations in transport distances between the production and installation locations for the different sites evaluated in section 4 are excluded from the LCA results. The latter two assumptions are justified by the fact that PV installation and transport have already been identified as marginal contributors to the total environmental impact of PV systems (with contributions well below 5%) in previous LCA studies [START_REF] Wild-Scholten | Energy payback time and carbon footprint of commercial photovoltaic systems[END_REF][START_REF] Ito | Life cycle assessment and cost analaysis of very large-scale PV systems and suitable locations in the world[END_REF][START_REF] Beloin-Saint-Pierre | Environmental impact of PV systems: Effects of energy sources used in production of solar panels[END_REF]. Thus, different approaches to compute their effect are expected to have a low influence on the total LCA results. S1 of the Supporting Information). Each scenario is selected by the user by choosing among 3 different "power output and mountings", 4

"techno-economic contexts" and 7 "technologies". The techno-economic context is taken into account by selecting either "current" or "prospective" (future) scenarios.

Future scenarios are provided for mono-Si and CdTe technologies, according to life cycle inventories from IEA PVPS Program Task 12 [START_REF] Frischknecht | Life cycle assessment of future photovoltaic electricity production from residential-scale systems operated in Europe. International Energy Agency (IEA)[END_REF]. Mono-Si PV laminates were selected as a widespread technology, since they currently cover approximately 40% of annual global production of PV power plants and CdTe was selected as an emerging and relatively inexpensive technology with approximately 6% global production [START_REF] Frischknecht | Life cycle assessment of future photovoltaic electricity production from residential-scale systems operated in Europe. International Energy Agency (IEA)[END_REF][START_REF]Photovoltaics report 2013[END_REF]. Additionally, the Web Client allows calculating the environmental footprint of the corresponding current country electricity mix according to the inventories developed by treeze Ltd. [START_REF] Itten | Life cycle inventories of electricity mixes and grid[END_REF], in full coherence with background data developed for the PV inventories from the IEA PVPS Task 12 [START_REF] Frischknecht | Life cycle assessment of future photovoltaic electricity production from residential-scale systems operated in Europe. International Energy Agency (IEA)[END_REF][START_REF] Frischknecht | Life cycle inventories and life cycle assessment of photovoltaic systems[END_REF].

The selection of available environmental indicators (i.e. impact categories) for the implementation in ENVI-PV was based on the description provided by the IEA report [START_REF] Frischknecht | Methodology guidelines on Life Cycle Assessment of photovoltaic electricity, 3rd edition[END_REF]. The environmental assessment method proposed in the report relies on the midpoint indicators of the European Product Environmental Footprint (PEF)

recommendation [START_REF]Commission Recommendation of 9 April 2013 on the use of common methods to measure and communicate the life cycle environmental performance of products and organisations[END_REF]. It is here referred to as ILCD 2011 Midpoint+. ENVI-PV also includes multi-criteria and single-issue environmental assessment methods reported in previous literature, such as IMPACT 2002+, USETox, Cumulative Energy Demand or IPCC 2013 [START_REF] Frischknecht | Implementation of life cycle impact assessment methods[END_REF][START_REF]Climate Change[END_REF][START_REF] Jolliet | IMPACT 2002+: A new life cycle impact assessment methodology[END_REF][START_REF] Usetox | USEtox version 1.01[END_REF].

The geo-localized environmental performances for energy systems are expressed as the ratio of their environmental impacts issued from LCA, over the generated energy along the whole production period, according to equation 1.

nvironmental performance otal impact over life cycle enerated electricity ( )

The performance is therefore expressed as the target impact in the reference unit (specific of each impact category and method) per kWh of electricity generated over the expected production period.

NASA SSE database for solar irradiation

The quantification of multi-annual mean of surface solar global irradiations enables estimating the total energy production of PV systems at a specific location over a given lifetime. The total electricity production is obtained from equation (2): enerated electricity peak rradiation ystlife oss ratio ( )

where Ppeak = nominal rated maximum power in kWp of the system based on 1 kW/m 2 radiation at standard test conditions (STC).

Irradiation = annual irradiation for the location and the specified orientation and inclination angles in kWh/m 2 /yr.

H STC = irradiance at STC equals 1 kW/m 2 .

PR = the performance ratio, which is an indicator of the efficiency of a PV system that measures the overall effect of losses on the overall performance [START_REF] Van Sark | Review of performance ratio development[END_REF]. ENVI-PV uses 80% as the default value, but a more accurate value ranging between 50% and 90% can be provided by the user [START_REF] Frischknecht | Methodology guidelines on Life Cycle Assessment of photovoltaic electricity, 3rd edition[END_REF][START_REF] Van Sark | Review of performance ratio development[END_REF][START_REF] Leloux | Review of the performance of residential PV systems in France[END_REF]. The PR takes into account the effect of temperature on the specific PV technology, the incomplete utilization of irradiation and component inefficiencies and failures. In general, new systems tend to have higher PR than older installations. Thus, values between 50-75% are common in PV systems installed in the late 1980s, 70-80% for systems of the 1990s and ratios above 80% for systems installed nowadays. More details on the estimation of PR can be found in [START_REF] Van Sark | Review of performance ratio development[END_REF] and [START_REF] Leloux | Review of the performance of residential PV systems in France[END_REF]. Systlife = PV system lifetime in years, also selected by the user. Possible values accepted by the tool range between 20 and 40 years. A default average lifetime of 30 years is recommended for current scenarios, while values from 30 to 40 years may be selected for future scenarios depending on the techno-economic context [START_REF] Frischknecht | Life cycle assessment of future photovoltaic electricity production from residential-scale systems operated in Europe. International Energy Agency (IEA)[END_REF][START_REF] Frischknecht | Life cycle inventories and life cycle assessment of photovoltaic systems[END_REF].

Loss ratio = a coefficient that accounts for the total efficiency lost during the panel life, estimated as 0.7% per year, according to the IEA recommendation [START_REF] Frischknecht | Methodology guidelines on Life Cycle Assessment of photovoltaic electricity, 3rd edition[END_REF]. The coefficient corresponds to the average loss ratio over the period, which is determined by applying equation (3):

oss ratio ∑ (i ) systlife i 7 (syslife ) ( )
The expected yearly electricity production of the PV systems has been computed by applying solar irradiation data from the freely available NASA SSE database (https://eosweb.larc.nasa.gov/sse). More precisely, the 1°x1° worldwide maps of multiannual average of monthly global and diffuse irradiations over a total period of 22 years have been used to compute the expected yearly global irradiations on the tilted plane corresponding to the PV systems. The algorithm for the calculation is the same as the one applied for the NASA SSE database itself, which corresponds to the RETScreen method [START_REF]Surface meteorology and Solar Energy (SSE) Release 6.0 Methodology, version 3.1.2[END_REF]. The multi-annual monthly global irradiations are estimated with a 3% uncertainty.

Results and discussion

ENVI-PV has been developed as an interactive user interface matching the foreseen needs of the users. These needs were identified by the consensus of a panel of experts from the main organizations in the field of renewable energies, including IRENA (International Renewable Energy Agency) and ADEME (French Environment and Energy Management Agency). After the selection of (1) the PV technology (CIS, CdTe, mono-i…), (2) the type of system (power output and mounting), (3) the technoeconomic context (current or prospective), (4) the performance ratio, (5) the orientation and inclination, (6) the PV lifetime and (7) the environmental impact assessment method and impact category, ENVI-PV users can obtain:

1. Worldwide maps of environmental performance for the selected impact category, consisting in screening level LCA results based on worldwide average life cycle inventories from existing supply chains.

2. For each point on the map: the environmental impact, the latitude and the longitude, the mean annual solar irradiation and the environmental performance (impact / kWh).

3. And the comparison of the PV environmental performance to the total environmental footprint of the corresponding country electricity mix, provided as net benefit (in %) for all the country supply mixes inventoried by [START_REF] Itten | Life cycle inventories of electricity mixes and grid[END_REF]. The complete list of country mixes available in ENVI-PV is provided in Table S2 The main differences in the parameters considered to model current and prospective scenarios are shown in Table 2. Electricity mixes were adjusted for the reference year 2050 according to the three prospective techno-economic contexts (BAU, REAL and OPT) following the data from NEEDS project [START_REF] Frischknecht | Life cycle assessment of future photovoltaic electricity production from residential-scale systems operated in Europe. International Energy Agency (IEA)[END_REF][START_REF] Frischknecht | LCA of background processes[END_REF]. Detailed unit process data per region are provided in the Supporting Information for current and prospective technoeconomic contexts. for mature technologies [START_REF] Frischknecht | Methodology guidelines on Life Cycle Assessment of photovoltaic electricity, 3rd edition[END_REF]. South orientation and 45° inclination were considered, since they are suitable conditions for PV energy production in the latitude of all the evaluated sites (north hemisphere locations). The 80% default value for the PR was used, according to average values reported by [START_REF] Van Sark | Review of performance ratio development[END_REF] and [START_REF] Leloux | Review of the performance of residential PV systems in France[END_REF]. The LCA results are provided for the environmental impact category of climate change (analogous to the carbon footprint) based on the ILCD 2011 Midpoint + method. ILCD 2011 Midpoint + characterization method was selected as a representative method following the specific LCA methodological guidelines for the PV sector from IEA PVPS Task 12 and the European PEF recommendation [START_REF] Frischknecht | Methodology guidelines on Life Cycle Assessment of photovoltaic electricity, 3rd edition[END_REF][START_REF]Commission Recommendation of 9 April 2013 on the use of common methods to measure and communicate the life cycle environmental performance of products and organisations[END_REF]. As shown in Figure 2, ENVI-PV allows the user to obtain direct comparisons between different installation sites that can be useful for the development of a PV project. Thus, the tool provides an intuitive representation of the environmental performance of a given PV system depending on the location. The locations with best environmental performances are indicated with green tone; the locations with higher environmental impacts correspond to the reddish area. Analogous maps can be obtained for 27 PV scenarios (including current and future technoeconomic contexts) and 18 impact categories from 9 impact assessment methods, which result in 52 different environmental indicators available. The provided data can be directly copied or visualized in a new window by clicking on "export". They include the geographical coordinates of the selected location (latitude and longitude), the yearly irradiation for the specified orientation and inclination angles, as well as the environmental impact of the laminate over the whole lifetime, the environmental performance (per kWh generated) of the PV system and of the corresponding country electricity mix.

Comparative environmental performance of PV electricity production according to "current" and "prospective" techno-economic contexts with country electricity mixes

The net benefit of the PV system compared to the electricity mix is also provided by ENVI-PV as the ratio obtained according to equation 3 and expressed as a percentage. et benefit of system relative to country electricity mix nviron perf country mix nviron perf system nviron perf country mix [START_REF] Raugei | Life cycle impacts and costs of photovoltaic systems: Current state of the art and future outlooks[END_REF] It should be noted that all the comparisons obtained by applying equation 4 are implemented in ENVI-PV according to the current country mixes. Although prospective electricity scenarios in 2050 were estimated for the main PV manufacturing countries to obtain the inventories of the prospective PV systems [START_REF] Frischknecht | Life cycle assessment of future photovoltaic electricity production from residential-scale systems operated in Europe. International Energy Agency (IEA)[END_REF], there are no equivalent scenarios available for all the countries listed in Table S2 of Supporting Information. A comparison of all systems to current electricity mixes was preferred when developing ENVI-PV, in order to estimate the net benefit for as many countries as possible. Thus, the comparison shall be interpreted as the highest potential improvement of future PV systems with respect to current situation, instead of comparing future country mixes to future PV systems.

Figure 3 shows the graphs built upon results obtained from ENVI-PV for the electricity production by 3 kWp mono-Si laminates integrated in a slanted roof. The results allow the comparison of electricity production according to "current" and "prospective" techno-economic contexts with respect to current country electricity mixes for five countries. Two locations were selected for each country, so as to have a low PV electricity production site (as a result of a low yearly irradiation) and a high PV electricity production site (as a result of a high yearly irradiation). The locations are indicated in Figure 2 and Table 3. Six indicators of the ILCD 2011 Midpoint + method according to the guidelines from IEA PVPS Task 12 [START_REF] Frischknecht | Methodology guidelines on Life Cycle Assessment of photovoltaic electricity, 3rd edition[END_REF] were evaluated: climate The trend of the comparative results depends significantly on the evaluated impact category. For environmental indicators such as CED (non-renewable), the environmental impact of the national electricity mix is remarkably higher than that of PV production by mono-Si systems, regardless of the analyzed country and technoeconomic context. Thus, the net benefit of PV mono-Si systems, calculated according to equation 4, is above 80% for all the evaluated scenarios. For categories such as climate change, human toxicity and land use, the net benefit of PV systems depends on the site and techno-economic context. For example, the environmental impact on climate change and human toxicity (cancer effects) for electricity production by a current mono-Si laminate installed in site 1 of France (location in the north with low yearly irradiation) is only 3% lower than that of the country electricity mix, whereas it is 35% lower in site 2 (location in the south with solar irradiation 49% higher than that of site 1). In the case of land use, no net benefit is expected from current mono-Si laminates in site 1, where the PV system results in 1% higher impacts than the current country mix.

The same technology has 32% lower land use than the country mix when considering site 2. For locations in the US, the electricity from the national mix has a climate change impact about 90% higher than the electricity from the current PV system. The contributions to human toxicity and land use are between 70% and 80% higher for the country electricity mix than for the PV system. The results for the French case are related to the specific characteristics of the French country mix. This country mix has a high percentage of nuclear energy (75% of total supply) and low production from fossil fuels (9% of total supply), which results in low emissions of greenhouse gases and heavy metals. In the second case, the US mix strongly relies on fossil sources. They constitute approximately 56% of the total supply. In particular, coal and lignite involve 73% of total supply from fossil sources. This energy profile explains the high climate change, human toxicity and land use impact compared to PV systems. Additional data on the electricity supply mixes for the analyzed countries can be found in the Supporting Information.

For other categories such as freshwater ecotoxicity or particulate matter (respiratory effects), PV scenarios result in higher environmental impacts than the national electricity mix for several countries and scenarios. In particular, electricity from current mono-Si laminates has an environmental impact between 1.2 and 3 times higher than the country mix in France, Germany and site 1 in Spain. BAU scenario has higher impact on freshwater ecotoxicity than the country mix for the same sites, whereas REAL scenario exceeds the contribution of the country electricity mix for France and Germany. The main subsystem responsible for the high impacts of PV electricity on freshwater ecotoxicity is the disposal phase at the end-of-life of the installation, associated with high emissions of heavy metals. Regarding the category of particulate matter, most of the future techno-economic contexts result in net benefits with respect to the country electricity mixes, except for BAU production scenario in the case of France. The main contribution of PV systems to this impact category is related to the raw materials for the wafer manufacturing.

Concerning the geographical dependence of the environmental performance of a given PV system within a single country, it can be analyzed by comparing the two sites that were selected as limit production conditions. The environmental performances obtained for the two representative sites of each country differ within the country in a range from 9% (for the two sites in Japan) up to 34% (for the two sites in US). France and the US are the countries with the highest differences between site 1 and site 2. This is due to the high variability of the annual solar irradiation, shown in Table 3, depending on the site for these two countries. The yearly irradiation determines the total energy production over the expected production period. When comparing all the sites, French site 1 and German site 2 present the lowest deviation between each other (3% difference for the two environmental performances). The small difference in the environmental performance of the two sites is due to the similarity of their irradiation conditions.

Regarding the greatest difference between locations, site 1 in Germany is the location with the highest impact per kWh produced, whereas site 2 in the US is the location with the lowest impact. These maximum and minimum values present a 44% difference.

Comparative multi-criteria LCA for "current" and "prospective" techno-economic contexts

As mentioned above, the effect of the techno-economic context on the environmental results can also be evaluated with ENVI-PV, as depicted in Figure 3. Figure 4 reports the environmental performance of the mono-Si current and prospective scenarios but with a multi-criteria representation: climate change, non-renewable CED, human toxicity (cancer effects), freshwater ecotoxicity, land use and particulate matter (respiratory effects). In a radar chart, the relative performance of a scenario B is calculated with respect to a scenario A (which is set as the scenario with a relative environmental performance of 100%) according to the following equation:

elative environ performance of ( ) is a constant ratio that does not depend on the site. The ratio of the energy production for the two scenarios can be expressed, by considering equation 2, as: peak ystlife oss ratio peak ystlife oss ratio

( )
Since the same assumptions regarding the orientation and inclination were considered for all scenarios, the yearly irradiation for each site does not depend on the technology and thus rradiation rradiation . Hence, under the assumptions that were considered in this study, equation 5 results in the same relative environmental performance for a given prospective scenario with respect to the current mono-Si scenario, regardless of the installation site.

According to Figure 4, the results show similar trends compared to the environmental performance reported by IEA [START_REF] Frischknecht | Life cycle assessment of future photovoltaic electricity production from residential-scale systems operated in Europe. International Energy Agency (IEA)[END_REF]. Thus, the BAU context may lead to impact reductions of 46% for climate change, 43% for the cumulative energy demand, 29% for human toxicity, 4% for freshwater ecotoxicity, 34% for land use and 48% for particulate matter. The REAL scenario (which considers a lifetime of 35 years instead of 30 years for the laminates) would result in improvements between 25% (for freshwater ecotoxicity) and 84% (for particulate matter), whereas the OPT scenario (40 years lifetime for the laminates) would involve impact reductions between 38% and 93%. Although the impact reduction associated with prospective scenarios is the same for all sites in relative terms, the absolute environmental effects vary significantly from one site to another. Figure 5 illustrates the difference with an example that shows the environmental performances with respect to climate change for all 3 kWp mono-Si systems installed in site 1 or site 2 in France. In this example, site 2 has a yearly irradiation nearly 50% higher than that of site 1. As a result, nearly 50% more electricity can be generated in French site 2, which reduces the greenhouse gases emitted per kWh generated. Regardless of the site, the current scenario has between 1.5 and 2 times higher emissions than the prospective scenarios installed in the same location. For the case of France, each PV system has 33% lower emissions when installed in site 2 than when installed in site 1. Due to the different electricity generation from one site to another, a PV system characterized by a high total impact can have an environmental performance comparable or at least closer to that of another PV system with lower total impact if it is installed in a different site. Thus, current 3 kWp mono-Si laminates installed in site 1 in France have 85% more emissions contributing to climate change than BAU scenario in the same site, whereas the current laminate installed in site 2 has only 24% higher emissions than BAU laminate in site 1. Similar trends are observed for REAL and OPT scenarios. Consequently, the development of future mono-Si systems may allow reductions from approximately 100 g CO 2 eq/kWh to less than 20 g CO 2 eq/kWh for the OPT scenario in site 1, given a total reduction of 80 g CO 2 eq/kWh. The range of reduction in site 2 is limited to approximately 60 g CO 2 eq/kWh, which is the difference between 70 g CO 2 eq/kWh for the current scenario and 10 g CO 2 eq/kWh for the OPT scenario.

Comparative multi-criteria LCA of "current" available technologies

Since ENVI-PV includes several common PV technologies, the tool also offers the possibility to compare their environmental performance in the current context. Figure 6 illustrates this potential use for 3 kWp laminates, for which five different technologies are available: CdTe, CIS, micro-Si, mono-Si or multi-Si. As in the case of current and future techno-economic contexts, relative environmental performances for the different technologies compared in Figure 6 are independent of the location. The demonstration is analogous, since equations 5 and 6 are also applied to obtain the comparison. Since the same assumptions for the orientation and inclination were considered in this study for all the current technologies, the ratio of irradiation for technologies A and B is again equal to 1. According to the values obtained with ENVI-PV, CdTe laminates would be the most efficient from an environmental perspective, with an impact between 30% and 70% lower than other technologies. The CIS system may also have significant environmental benefits compared to silicon technologies such as micro-Si and multi-Si, whereas mono-Si laminates exhibit the highest environmental impacts among the evaluated options. The differences between the results depend not only on the PV technology but also on the considered impact category. Among the categories presented in Figure 7, particulate matter has the highest difference between the technologies with the lowest and the highest environmental impacts, whereas freshwater ecotoxicity

shows the smallest variation. The main reason for the different spread in the results depending on the impact category is the share of the common components (inverter, electric installation, mounting structure) of each PV system in the total environmental impacts. For example, the freshwater ecotoxicity impacts are mainly influenced by copper production, which is predominantly used in the inverter and the electric installation. Since they are common elements, the five PV technologies do not differ significantly according to this indicator. On the contrary, the particulate matter emissions of the mono-Si PV system are mainly caused by electricity generation in coal power plants in China. The electricity is used in the supply chain of the mono-Si PV module. In contrast, the major part of the particulate matter emissions of the CdTe PV system is caused by the production of copper (inverter, electric installation), aluminum (mounting structure) and flat glass (PV module). These components are used in every PV system, whereas the production of the PV module itself only adds a minor contribution to the total emissions for the category. The environmental effect in absolute terms of substituting a PV technology with high impact by a lower impact technology can be observed in Figure 7 for the example of climate change. Again, as in the case of different techno-economic contexts, the potential environmental benefits of lower impact technologies may be more or less significant in absolute terms depending on the installation site. Thus, micro-and multi-Si laminates allow reducing the greenhouse gas emissions from more than 100 g CO 2 eq/kWh to nearly 60 g CO 2 eq/kWh in site 1. CdTe and CIS systems installed in the same site result in environmental performances of 31 and 48 g CO 2 eq/kWh, respectively. Mono-Si laminates installed in site 2 have an environmental performance of 69 g CO 2 eq/kWh, which is close to the performance of micro-and multi-Si in site 1.

The environmental performance of mono-Si laminates in site 2 can only be improved to 40 g CO 2 eq/kWh approximately for micro-and multi-Si systems, 32 g CO 2 eq/kWh for CIS system and 20 g CO 2 eq/kWh. According to these results, it may be more interesting from a combined economic and environmental point of view to invest in non-silicon-based technologies in sites with low irradiations, since their potential improvement is higher in absolute terms. For sites with high irradiation, the high electricity generation potential seems to compensate higher total impacts, so siliconbased technologies may be suitable.

Limitations of ENVI-PV current version

It should be noted that the comparison between the different PV scenarios has to be carefully interpreted. ENVI-PV results rely on the STC condition. The PV efficiency gaps due to inherent deviations from STC are only taken into account within the PR.

The PR is not defined with respect to the chosen PV technology and the local conditions, but is a free parameter. Thus, the user can increase or decrease the PR value for a given PV system and local condition according to their own knowledge and the available literature [START_REF] Van Sark | Review of performance ratio development[END_REF][START_REF] Leloux | Review of the performance of residential PV systems in France[END_REF].

Providing screening level results based on average production instead of site-specific supply chains increases the uncertainty level, which is not analyzed in this tool. The main purpose of ENVI-PV is offering the user the PV environmental performance within different countries based on average inventories rather than precise values for specific manufacturing sites. Hence, the uncertainty of ENVI-PV results is not included in the current version of the tool yet. Future improvements will focus on the addition of uncertainty of the obtained LCA results linked to the choices and assumptions for the life cycle inventories. The comparison between PV environmental performances and country electricity mixes will benefit from this uncertainty assessment, helping the user to decide whether the differences between both sources are relevant or not. Moreover, the implementation of modular inventories will increase the accuracy of the LCA results by separately modeling each life cycle subsystem. This improvement will also allow analyzing the environmental effect of different manufacturing locations. Such modular inventories based on country specific markets may come either from future progress within IEA PVPS Task 12 or from other existing databases, such as Ecoinvent v3 [START_REF]Ecoinvent Database[END_REF].

Conclusions and perspectives

The This first version of ENVI-PV provides results at screening level. The aim is offering the user a general overview of average PV technologies installed in locations worldwide rather than accurate environmental performances for each specific case study.

Improvements on this tool should focus on the implementation of modular inventories.

Modeling the different sub-systems separately would allow evaluating the individual contribution of each phase of the life cycle as well as the environmental effect of the spatial localization for specific manufacturing sites. Another key issue to be included in future versions is the uncertainty level of ENVI-PV results, linked to the implemented life cycle inventories.

Open access to this key information is essential to feed the debate on energy transition.

Being interoperable and compliant with open standards enables ENVI-PV to be included in future developments and exploit this first initiative within LCA for energy pathways. Moreover, the same principles and architecture can be applied to other renewable energy systems. As an example, a similar tool was developed for offshore wind farms within the EU project EnerGEO [START_REF] Guermont | Environmental impact for offshore wind farms: Geolocalized Life Cycle Assessment (LCA) approach[END_REF], and analogous Web Services may be created in the future to evaluate other systems such as on-shore wind or marine energy sources.

  The interactive tool was developed using a state-of-the-art interoperable and open standard Web Service framework from the Open Geospatial Consortium (OGC), which includes WMS and WPS. ENVI-PV is available through internet via a new Web Client derived from a previous tool developed by our team in 2010 and provides a combination of tailored scenarios. It is integrated within the collection of Web Services and applications offered by the Spatial Data Infrastructure (SDI) www.webserviceenergy.org. This SDI aims at providing the users with a unique point of access for renewable energy and environment resources from a geospatial data catalogue and a set of online interactive tools. It is operated by the Center for Observation, Impacts, Energy (O.I.E, MINES ParisTech) since 2008[START_REF] Ménard | Benefit of GEOSS interoperability in assessment of environmental impacts illustrated by the case of photovoltaic systems[END_REF].The SDI is currently recognized as a Global Earth Observation System of Systems (GEOSS) community portal that connects users to thousands of Web Services. It integrates tools based either on standards, formats and protocols from the World Wide Web Consortium (W3C) and from the Open Geospatial Consortium (OGC). These include Web Service Description Language (WSDL), Simple Object Access Protocol (SOAP), Web Feature Services (WFS), WMS, WPS and Sensor Observation Services (SOS).

Figure 1 .Figure 1

 11 Figure 1. Available production scenarios provided by the Web Client. Each scenario is defined by 3 components: power output and mounting, techno-economic context and technology. The links between components in this figure represent currently implemented scenarios

1 .

 1 years 35 years 40 years 30 years 30 years 35 years 40 yearsTo illustrate what ENVI-PV can provide to users, we propose the following applications: Comparative environmental performance of a given PV system depending on the location 2. Comparative environmental performance of PV electricity production according to "current" and "prospective" techno-economic contexts with country electricity mixes 3. Comparative multi-criteria LCA of "current" and "prospective" technoeconomic contexts4. Comparative multi-criteriaA of "current" available technologies4.1. Comparative environmental performance of a given PV system depending on the locationThe data visualization obtained with ENVI-PV (http://viewer.webserviceenergy.org/project_iea/) is presented in Figure2for the environmental performance of a current 3 kWp mono-Si PV laminate integrated in a slanted roof. A 30-year lifetime was assumed for the current scenario, following the recommendations of IEA PVPS Task 12

Figure 2 .

 2 Figure 2. Worldwide map showing the evaluated sites and the climate change impacts for a 3 kWp mono-Si laminate integrated in a slanted roof with a 30 years lifetime, oriented to the south, with a 45º inclination in the "current" techno-economic context

Figure 3 .

 3 Figure 3. nvironmental performances (impact/kWh of electricity generated) of "current" and "prospective" mono-Si systems (lifetimes according to Table 2) for a 3 kWp mono-Si laminate integrated in a slanted roof; oriented to the south, with a 45° inclination compared to the current country electricity mix. Environmental indicators according to ILCD 2011 Midpoint + method [20]: Climate change, Cumulative Energy Demand (CED, non-renewable), Human toxicity (cancer effects), Freshwater ecotoxicity, Land use and Particulate matter (respiratory effects)

Figure 4 .

 4 Figure 4. Radar chart for the comparative evaluation of the environmental performance of 3 kWp mono-Si laminates depending on the techno-economic context (results obtained for south orientation and 45° inclination) according to 6 environmental indicators from ILCD Midpoint + method[START_REF] Frischknecht | Methodology guidelines on Life Cycle Assessment of photovoltaic electricity, 3rd edition[END_REF]

Figure 5 .

 5 Figure 5. Comparative evaluation of the environmental performance in absolute terms of "current"and "prospective" kWp mono-Si laminates (results obtained for south orientation and 45° inclinations in the two sites in France) for the impact category Climate change of ILCD Midpoint + method[START_REF] Frischknecht | Methodology guidelines on Life Cycle Assessment of photovoltaic electricity, 3rd edition[END_REF]

Figure 6 .

 6 Figure 6. Radar chart for the comparative evaluation of the environmental performance of 3 kWp laminates of different technologies available in ENVI-PV: CdTe, CIS, micro-Si, mono-Si and multi-Si (results obtained for south orientation and 45° inclination) according to 6 environmental indicators from ILCD Midpoint + method[START_REF] Frischknecht | Methodology guidelines on Life Cycle Assessment of photovoltaic electricity, 3rd edition[END_REF]

Figure 7 .

 7 Figure 7. Comparative evaluation of the environmental performance in absolute terms of 3 kWp mono-Si laminates of CdTe, CIS, micro-Si, mono-Si and multi-Si technologies (results obtained for south orientation and 45° inclinations in the two sites in France) for the impact category Climate change of ILCD Midpoint + method[START_REF] Frischknecht | Methodology guidelines on Life Cycle Assessment of photovoltaic electricity, 3rd edition[END_REF]

  interactive tool ENVI-PV, developed using an interoperable and open standard Web Service framework from the OGC, is the first tool to propose a worldwide coverage of environmental performance of PV systems. It combines the latest life cycle inventories, published in 2015 by the IEA Task 12, and the solar irradiation database computed from the worldwide NASA SSE database for 18 inclinations and 3orientations. Although the number of evaluated impact categories is restricted to six for simplicity in the provided examples, the impact categories implemented in ENVI-PV cover 18 environmental issues. This multi-criteria approach is in line with current environmental policies, including the European PEF recommendation[START_REF]Commission Recommendation of 9 April 2013 on the use of common methods to measure and communicate the life cycle environmental performance of products and organisations[END_REF], and may contribute to the optimization of PV systems based on environmental criteria.The Web Client can be used as a tool to generate a representative number of 27 alternative PV scenarios and evaluate PV performance in different spatial and temporal contexts. Providing comparisons of the PV performance to the performance of the corresponding national electricity mix enhances the understanding to position PV relying on a multi-criteria assessment.

Table 1 .

 1 Regions of PV panel manufacturers per technology according to IEA PVPS Task 12[START_REF] Frischknecht | Life cycle assessment of future photovoltaic electricity production from residential-scale systems operated in Europe. International Energy Agency (IEA)[END_REF]

	Technology		Region / Country
			China
			Europe
	Mono-and multi-crystalline	Si
	(Silicon)		United States
			Asia and Pacific (mainly South
			Korea and Japan)
			Asia and Pacific (Malaysia)
	CdTe (Cadmium Telluride)
			United States
	CIS (Copper, indium, gallium selenide)	Europe (Germany)

Table 2 .

 2 Key parameters for mono-Si and CdTe technologies in current and future scenarios according to IEA PVPS Task 12[START_REF] Frischknecht | Life cycle assessment of future photovoltaic electricity production from residential-scale systems operated in Europe. International Energy Agency (IEA)[END_REF] (BAU=Business-as-usual; REAL= realistic improvements; OPT= Optimistic improvement)

			Mono-Si			CdTe
	Parameter	Current	BAU	REAL	OPT	Current	BAU	REAL	OPT
	Cell efficiency	16.5%	25.0%	27.0%	29.0%	15.6%	22.8%	24.4%	26.0%
	Derate cell to
	module	8.5%	8.5%	6.8%	5.0%	13.9%	10.0%	7.5%	5.0%
	efficiency
	Module efficiency	15.1%	22.9%	25.2%	27.6%	13.4%	20.5%	22.6%	24.7%
	Wafer
	thickness/layer	190 μm	150 μm	120 μm	100 μm	4.0 μm	2.0 μm	1.0 μm	0.1 μm
	thickness
	Electricity
	demand CdTe laminate in	N/A	N/A	N/A	N/A	100%	86%	81%	74%
	manufacture
	Kerf loss	190 μm	150 μm	120 μm	100 μm	N/A	N/A	N/A	N/A
	Silver per cell	9.6 g/m 2 9.6 g/m 2 5.0 g/m 2 2.0 g/m 2	N/A	N/A	N/A	N/A
	Fluidized-bed
	reactor (FBR)
	share of poly Si
	production

Table 3 .

 3 Geographical coordinates and irradiation data obtained by ENVI-PV for PV systems with south orientation and 45° inclination placed in the selected locations

Acknowledgements

This research has been undertaken within the framework and financial support of the International Energy Agency in the framework of Task 12 of the Photovoltaic Power Systems Program (PVPS), as well as with the financial support provided by ADEME (France) under contract No. 1505C008 and by the Swiss Federal Office of Energy (SFOE) under contract No. SI/500738.