Valentina Gaia
email: gaia.valentina.pennati@ki.se

MD Pennati

MSc Jeanette Plantin

PhD Loïc Carment

Pauline Roca

PhD Jean-Claude Baron

PhD Elena Pavlova

MD, PhD Jörgen Borg

PhD Påvel G Lindberg

Recovery and prediction of dynamic precision grip force control after stroke Authors

Keywords: Stroke/Complication, Recovery of function, Predictions and Projections, Brain Imaging, Corticospinal Tract NCT02878304

Background and Purpose: Dexterous object manipulation, requiring generation and control of finger forces, is often impaired after stroke. This study aimed to describe recovery of precision grip force control after stroke, and to determine clinical and imaging predictors of 6 month performance.

Methods: 80 first ever stroke patients with varying degrees of upper limb weakness were evaluated at 3 weeks, 3 and 6 months after stroke. Twenty-three healthy individuals of comparable age were also studied. The Strength-dexterity test was used to quantify index finger and thumb forces during compression of springs of varying length in a precision grip. The coordination between finger forces (CorrForce), along with Dexterity-score and Repeatabilityscore were calculated. Anatomical MRI was used to calculate weighted corticospinal tract lesion load (wCST-LL). Results: CorrForce, Dexterity-score and Repeatability-score in the affected hand were dramatically lower at each time point compared to the less-affected hand and the control group, even in patients with mild motor impairment according to Fugl-Meyer assessment. Improved performance over time occurred in CorrForce and Dexterity-score but not in Repeatabilityscore. The Fugl-Meyer hand subscale, sensory function and wCST-LL best predicted CorrForce and Dexterity-score status at 6 months (R 2 .56 and .87, respectively). wCST-LL explained most of the variance in CorrForce (R 2 .34) and Dexterity-score (R 2 .50) at 6 months. Absence of recovery in CorrForce was predicted by wCST-LL> 4 cc and in Dexterity-score by wCST-LL> 6 cc.

Conclusions: Findings highlight persisting deficits in the ability to grasp and control finger forces after stroke. Sensory and motor hand impairments together with wCST-LL can predict performance at 6 months and degree of CST lesion alone predicts lack of post stroke precision grip recovery.

STROKE/2019/026205 R3 Introduction

Impaired fine motor control of fingers is common after stroke, reducing the ability to grasp and manipulate objects and negatively impacting daily activities and quality of life. [START_REF] Ekstrand | Perceived ability to perform daily hand activities after stroke and associated factors: A cross-sectional study[END_REF] Accurate evaluation of precision grip (i.e., the ability to grasp an object between the tactile pads of the thumb and fingertips) is therefore likely to be important for prognosis and for the development of targeted upper limb interventions. Post stroke precision grip deficits, when grasping stable objects, have been well characterized and include impaired dosing of force (to the object being manipulated) and loss of coordination of grip and lift (upward) forces. [START_REF] Allgower | Fine motor skills predict performance in the jebsen taylor hand function test after stroke[END_REF][START_REF] Nowak | The impact of stroke on the performance of grasping: Usefulness of kinetic and kinematic motion analysis[END_REF] However, few studies have described dynamic finger force control (i.e., the ability to appropriately generate dynamically scaled and directed force by the digits while grasping unstable objects), which is frequently affected after stroke [START_REF] Seo | Altered digit force direction during pinch grip following stroke[END_REF] , or its longitudinally recovery [START_REF] Kurihara | Increased center of pressure trajectory of the finger during precision grip task in stroke patients[END_REF][START_REF] Pavlova | Impact of tactile sensation on dexterity: A cross-sectional study of patients with impaired hand function after stroke[END_REF] , leaving many aspects unclear.

The first aim of the present longitudinal study of 80 individuals with first ever stroke was to describe the recovery of dexterous manipulation as assessed by the Strength-dexterity test. This test allows to quantify the dynamic interaction between fingertip forces and measures the ability to stabilize an unstable object in a precision grip [START_REF] Valero-Cuevas | The strengthdexterity test as a measure of dynamic pinch performance[END_REF] . In addition, the coordination between finger forces (CorrForce), the ability to dynamically adapt applied finger forces (Dexterityscore) and the reproducibility of performance (Repeatability-score) were also investigated.

Since force generation is usually more compromised distally after stroke [START_REF] Colebatch | The distribution of muscular weakness in upper motor neuron lesions affecting the arm[END_REF] and differs in time course of recovery from individuated finger control [START_REF] Xu | Separable systems for recovery of finger strength and control after stroke[END_REF][START_REF] Lang | Recovery of grasp versus reach in people with hemiparesis poststroke[END_REF] , we hypothesized that precision grip force control measures would show a proportionally greater impairment compared to maximal power or pinch grip force and to upper limb motor impairment measured with the Fugl-Meyer assessment. The present study's second aim was to identify best predictors of both 6-month status and longitudinal recovery in precision grip force control after stroke. Based on previous reports, we hypothesized the strongest predictor would be the degree of lesion to the STROKE/2019/026205 R3 corticospinal tract (CST) [START_REF] Xu | Separable systems for recovery of finger strength and control after stroke[END_REF][START_REF] Feng | Corticospinal tract lesion load: An imaging biomarker for stroke motor outcomes[END_REF][START_REF] Wolbrecht | Finger strength, individuation, and their interaction: Relationship to hand function and corticospinal tract injury after stroke[END_REF] , but also that the best prediction model would additionally include measures of hand sensory [START_REF] Wolbrecht | Finger strength, individuation, and their interaction: Relationship to hand function and corticospinal tract injury after stroke[END_REF][START_REF] Semrau | Examining differences in patterns of sensory and motor recovery after stroke with robotics[END_REF] and motor impairment [START_REF] Hoffmann | Contributions of voluntary activation deficits to hand weakness after stroke[END_REF] .

Methods

The data supporting this study findings are available from the corresponding author upon reasonable request.

Study design and participants

Eighty post stroke subjects (57 male; age 52.7±9. Written informed consent was obtained from all participants. The study was approved by the Regional Ethical Review Board in Stockholm (DNR: 2011/1510-31/3). All procedures complied with the Declaration of Helsinki.

Clinical measures

Fugl-Meyer assessment of the upper extremity (FMA-UE) was used to measure upper limb motor function (excluding the three reflex-items, yielding a maximum of 60 points). [START_REF] Woodbury | Dimensionality and construct validity of the fugl-meyer assessment of the upper extremity[END_REF] Motor impairment levels were defined as: severe= 0-12, severe-moderate= 13-30, moderate-mild= 31-47 and mild= 48-60. [START_REF] Woytowicz | Determining levels of upper extremity movement impairment by applying a cluster analysis to the fugl-meyer assessment of the upper extremity in chronic stroke[END_REF]

Strength-dexterity test and performance measures

The Strength-dexterity test allows quantification of the dynamic regulation of fingertip forces during a pinch task. [START_REF] Dayanidhi | Developmental improvements in dynamic control of fingertip forces last throughout childhood and into adolescence[END_REF] The method measures the ability to compress and control a variety of springs (N= 8) which are unstable and prone to buckling and with diverse length (free length from 1.80 cm of spring 8 to 4.60 cm of spring 1), and therefore with different demands on strength and dexterity (spring 8= easiest, spring 1= most difficult to compress).

Dynamic index finger and thumb forces were recorded using two force sensors (unit: gramforce, gf) [START_REF] Dayanidhi | Developmental improvements in dynamic control of fingertip forces last throughout childhood and into adolescence[END_REF] , and analyzed off-line using Matlab R2017B (MathWorks, Natick, MA, USA).

Coordination of index finger and thumb forces was investigated by calculating a correlation coefficient between force signals (CorrForce).

A Dexterity-score was calculated:

where Max Spr= force required for full compression of that spring, Test Spr= average of maximal sustained compression forces achieved with the test spring, ∑ 𝑀𝑎𝑥 𝑆𝑝𝑟 (8 -i) (-1≤ m< 6). The Dexterity-score indicates the maximal level of instability that the patient's sensorimotor system is able to control, and higher values reflect better performance. The previous formula [START_REF] Dayanidhi | Developmental improvements in dynamic control of fingertip forces last throughout childhood and into adolescence[END_REF] was modified excluding dead bands of compression force of the test spring (i.e., the regions in the beginning and end of the compression range), to account for the characteristics of this study population in the sub-acute phase after stroke, which was mostly unable to maintain the subsequent longer spring in spite of the ability to produce enough force.

A Repeatability-score, evaluating the reproducibility of performance across the ten trials, was computed:

where SD Test Spr= standard deviation of the average of maximal sustained compression forces achieved with the test spring, Max Spr= force required for full compression of that spring, m= spring number (-1≤ m< 6). A high Repeatability-score indicated that the subject was able to reproduce similar dynamic force compression across trials.

Patients unable to perform dynamic compressions were assigned values equal to 0 for

CorrForce and Dexterity-score, indicating complete loss of precision grip.

For details on assessment procedure, please see Supplemental Material http://stroke.ahajournals.org.

Magnetic Resonance Imaging

Brain imaging was performed at T1 with an Ingenia 3.0T MR-system (www.usa.philips.com) with an 8HR head coil. High resolution T1-weighted anatomical images were acquired using TFE 3D (3D gradient echo-based sequence): FOV 250x250x181 mm, matrix 228x227, slice thickness 1.2 mm, slice spacing 0.6 mm and number of slices 301 (Echo time= shortest, relaxation time= shortest). T2 FLAIR images were also acquired.

Lesion maps

Statistical analysis

Group differences and effect of time were investigated using one way-ANOVA and two-way repeated measures ANOVAs. Bonferroni's post-hoc procedure was computed for mean comparisons. Spearman's rank order correlation test (Spearman's Rho, rs) was used to investigate relations between force control, clinical and MRI measures.

A multivariable linear regression analysis was performed to predict precision grip impairment at 6 months using the most significant clinical and imaging variables identified in the correlation analysis. Hierarchical linear regression models, in which wCST-LL was entered first, were used to ascertain the unique variance accounted for by the clinical variables.

Proportional recovery scores in precision grip measures were calculated. [START_REF] Prabhakaran | Interindividual variability in the capacity for motor recovery after ischemic stroke[END_REF] The study population was then divided into two groups, with recovery (recovery pos , score> 0) and absence of recovery (recovery abs , score≤ 0), and univariate logistic regression models were performed to test predictors of recovery.

STROKE/2019/026205 R3

The significance level was set at p≤ .05. All statistical analyses were performed using SPSS Statistics for Windows, Version 25.0 (Armonk, NY: IBM Corp). Predictive models were verified by leave-one-out cross-validation using R, Version 3.6.0 (R Core Team).

Results

Clinical measures

FMA-UE showed moderate-severe upper limb motor impairment in stroke patients, as shown in Table 1. Measures of sensory and motor functions were significantly reduced in the affected hand compared to the less-affected hand. BBT revealed number of patients with impaired gross manual dexterity, including in the less-affected side (n= 41 at T1 and n= 26 at T3).

Precision grip force control

Precision grip force profiles are shown in

Relation between clinical scales and precision grip force control in the affected hand

Age

STROKE/2019/026205 R3

Of all the patients with wCST-LL values greater than 4.42 cc, 60% presented no positive change in CorrForce while 77% of the patients with a lesion broader than 6.14 cc had no recovery in Dexterity-score.

Discussion

Recovering stroke patients had major difficulties in ability to grasp and control the springs, to coordinate finger forces and to perform reproducibly across trials. Although patients improved over time, many remained impaired in the precision grip force control at 6 months after stroke even in case of good overall upper limb and hand sensorimotor status as measured with clinical measures. Sensorimotor impairments early after stroke and CST lesion load predicted precision grip force control at 6 months and CST lesion load alone was a significant predictor of whether patients would be likely to recover force control during first 6 months post-stroke.

Precision grip recovery

Precision grip performance recovered relatively poorly over time in the affected hand, with 24% of patients unable to perform the Strength-dexterity test at T3. CorrForce and Dexterityscore measures improved, but values remained pathological in 39% and 67% of the patients, respectively (far from healthy control performance, Figure 2). In addition, recovery in Repeatability-score was not significant at group level. Decreased performance was even evident in patients with maximal FMA-Hand score (n= 16 at T1 and n= 31 at T3). Individual observations (Figure 3) indicate clinically relevant motor recovery at T3 as measured by FMA-UE despite remaining impairment in fine grip force control and fine manipulative tasks. The slower recovery in correlation of finger forces (compared to Dexterity-score) and the reduced prediction of this measure, support previous reports showing that recovery of strength occurs faster and mainly within the first 3 months after stroke compared to other aspects, such as the ability to manipulate objects and independence of finger movements. 9, 13, 20

STROKE/2019/026205 R3

A compromised ability to control dynamic grip forces was also identified in the less-affected hand, in accordance with previous studies [START_REF] Semrau | Robotic characterization of ipsilesional motor function in subacute stroke[END_REF] and possibly due to disruption of ipsilesional projections of the CST, disinhibition of the non-lesioned hemisphere or disturbance of bilateral frontoparietal-cerebellar networks.

Mechanism underlying impaired precision grip force control

Main predictors of poor precision grip force control at months were hand motor impairment, sensory impairment and CST lesion load. The hierarchical regression analysis confirmed our hypothesis that the wCST-LL was the most significant predictor [START_REF] Feng | Corticospinal tract lesion load: An imaging biomarker for stroke motor outcomes[END_REF] and that sensory function and hand motor impairments explained additional variance of grip force control, extending knowledge on predictors of functional outcomes post-stroke. [START_REF] Stinear | The prep algorithm predicts potential for upper limb recovery after stroke[END_REF][START_REF] Stinear | An update on predicting motor recovery after stroke[END_REF][START_REF] Nijland | Presence of finger extension and shoulder abduction within 72 hours after stroke predicts functional recovery: Early prediction of functional outcome after stroke: The epos cohort study[END_REF][START_REF] Stinear | Prep2: A biomarker-based algorithm for predicting upper limb function after stroke[END_REF][START_REF] Kim | Can neurological biomarkers of brain impairment be used to predict poststroke motor recovery? A systematic review[END_REF][START_REF] Boyd | Biomarkers of stroke recovery: Consensus-based core recommendations from the stroke recovery and rehabilitation roundtable[END_REF] The degree of lesion to the CST was a key predictor of precision grip force control at 6 months after stroke, reflecting the essential role of CST for fine motor control, especially for precision grip performance and finger individuation. [START_REF] Xu | Separable systems for recovery of finger strength and control after stroke[END_REF][START_REF] Wolbrecht | Finger strength, individuation, and their interaction: Relationship to hand function and corticospinal tract injury after stroke[END_REF][START_REF] Lemon | Descending pathways in motor control[END_REF] CST lesion load was the only significant predictor of positive change in precision grip control from 3 weeks to 6 months post-stroke. [START_REF] Riley | Anatomy of stroke injury predicts gains from therapy[END_REF][START_REF] Quinlan | Neural function, injury, and stroke subtype predict treatment gains after stroke[END_REF] This suggests that neurobiological processes involving residual CST integrity are critical for recovery of fine motor control of fingers after stroke. This is also supported by studies showing motor improvements in stroke patients recovering motor evoked potentials. [START_REF] Birchenall | Individual recovery profiles of manual dexterity, and relation to corticospinal lesion load and excitability after stroke -a longitudinal pilot study[END_REF][START_REF] Byblow | Proportional recovery after stroke depends on corticomotor integrity[END_REF] Quantitatively, however, the moderate predictive value of CST lesion load for recovery of precision grip force control points also to the likely contribution of other neural substrates and multiple pathways in support of the recovery process [START_REF] Rondina | Brain regions important for recovery after severe post-stroke upper limb paresis[END_REF] , such as cortico-cortical connections [START_REF] Schulz | Parietofrontal motor pathways and their association with motor function after stroke[END_REF][START_REF] Rinne | Motor dexterity and strength depend upon integrity of the attention-control system[END_REF] , cortico-basal ganglia loops and other descending motor pathways such as the reticulospinal tract. [START_REF] Xu | Separable systems for recovery of finger strength and control after stroke[END_REF] The FMA-Hand scores, in the predictive model with lesion load and sensory function, may be considered a surrogate measure of these other contributory factors.

Findings also confirms the importance of early sensory status after stroke for recovery of precision grip force control. [START_REF] Pavlova | Impact of tactile sensation on dexterity: A cross-sectional study of patients with impaired hand function after stroke[END_REF][START_REF] Meyer | Associations between sensorimotor impairments in the upper limb at 1 week and 6 months after stroke[END_REF] A high percentage of patients presented alterations in tactile STROKE/2019/026205 R3 sensation and/or in proprioception in the affected hand at three weeks after stroke. This was highly related with poor performance on the Strength-dexterity test at each time point. In manipulation of deformable or unstable objects, such as a compressed spring, somatosensory and visual feedbacks are critical for controlling the direction of fingertip force vectors. [START_REF] Johansson | Coding and use of tactile signals from the fingertips in object manipulation tasks[END_REF] Impaired sensory function due to aging or stroke likely explains some of the decline in dexterous manipulation [START_REF] Dayanidhi | Dexterous manipulation is poorer at older ages and is dissociated from decline of hand strength. The journals of gerontology[END_REF][START_REF] Lindberg | Precision in isometric precision grip force is reduced in middle-aged adults[END_REF] and has recently been shown to predict gains from robotic therapy in the chronic phase post-stroke. 40

Limitations

The timing of the first evaluation varied some between patients (2-6 weeks after stroke) but the variability was low for this kind of longitudinally study and did not affect predictive models.

It is recalled that a wCST-LL of 1.0 cc in the centrum semiovale has a different impact compared to a 1.0 cc lesion at the level of internal capsule, due to a higher concentration of CST fibers in the latter. Transcranial magnetic stimulation would have been useful to evaluate presence of a motor evoked potential, shown to be valuable for the prediction of hand impairment according to the Action Research Arm Test. [START_REF] Stinear | Prep2: A biomarker-based algorithm for predicting upper limb function after stroke[END_REF] Since reliability of the Strengthdexterity test has not been assessed in stroke patients, further studies are desirable. It is important to note that the study sample was a relatively young stroke group (mean age 52.70 years), which makes it difficult to generalize the results to the entire stroke population.

Conclusions

The current study provides evidence of impaired precision grip in the affected hand over the first 6 months after stroke, even in patients with no or mild-upper limb motor impairment. Early

  4 years) admitted as inpatients to the Department of Rehabilitation Medicine at Danderyd Hospital, Stockholm, Sweden with a firstever CT or MRI-verified stroke and upper limb muscle weakness (score≤ 4/5 on Manual Muscle Testing) were included. Exclusion criteria included history of any other neurological or rheumatologic disorders of the hand, cerebellar lesions, contraindications to MRI scan, and severe cognitive dysfunction. Twenty-three healthy adult individuals of comparable age (11 male; age 46.9±13.1 years) and with no history of neurological disease constituted a control group. Assessments in stroke patients were conducted bilaterally at 2-6 weeks (mean time 3 weeks, T1), three (T2) and 6 months (T3) after injury, and with the dominant hand in the healthy individuals.

  the eight springs of the forces required to compress to solid length, m= spring number 𝐷𝑒𝑥𝑡𝑒𝑟𝑖𝑡𝑦 -𝑠𝑐𝑜𝑟𝑒 = ∑ 𝑀𝑎𝑥 𝑆𝑝𝑟 (8 -𝑖) + 𝑇𝑒𝑠𝑡 𝑆𝑝𝑟 (8 -𝑚 -1)

Figure 1 .

 1 Dynamic compression forces were lower in amplitude and less stable in the affected hand and characterized by poor correlation between index finger and thumb forces (reduced CorrForce). Healthy subjects performed the Strengthdexterity test with an average of sustained compression force of 146.63 gf, and stroke patients at T1 with 109.51 gf with the less-affected hand and 43.7 gf with the affected hand. There was a statistically significant difference between groups in CorrForce, Dexterity-score and Repeatability-score [GROUP: F(2, 168)= 62.54, p< .001; F(2, 168)= 122.08, p< .001 and F(2, 130)= 7.51, p< .005, respectively]. Post-hoc tests revealed that the three variables were significantly lower in the affected hand compared to the less-affected side and to the healthy control group (p< .001). No significant difference between the less-affected hand and the control group was detected in the measures. CorrForce and Dexterity-score improved over time in stroke patients [TIME: F(2, 224)= 4.4569, p= .01265; F(2, 224)= 12.417, p< .001, respectively]. (Figure 2) Dexterity-score significantly improved between each time point (T1 vs T2 and T2 vs T3) in the affected-hand STROKE/2019/026205 R3whereas CorrForce showed a more gradual increase, with a significant difference between T1 vs T3 only (p< .005). Despite the improvement over time, both values remained significantly lower compared to the less-affected side at T3 (p< .001). Moreover, of the 33 patients with mild degree of residual impairment in FMA-UE at T3, four (12%) continued having pathological values in CorrForce and eleven (33%) in Dexterity-score (i.e.,< mean -2SD of healthy subjects). (Figure3) Repeatability-score in the affected-hand did not change significantly over time after stroke.

Figure 1 .

 1 Figure 1. Dynamic compression force profiles acquired in a patient with the less-affected hand

Figure 2 .

 2 Figure 2. Effect of time on CorrForce (A) and Dexterity-score (B) in the affected hand (Solid

Figure 3 .

 3 Figure 3. Correlation between Fugl-Meyer assessment of the upper extremity (FMA-UE) and

  Gross manual dexterity was assessed with the Box & Block Test

	STROKE/2019/026205 R3
	(BBT) and compared to normative data (please see http://stroke.ahajournals.org), maximum
	voluntary contraction (MVC) in power grip with the Jamar isometric dynamometer (Digital
	Hand Dynamometer, Saeham, South Korea) and in key-pinch with the Jamar pinch gauge
	(Pinch Gauge, B&L Engineering, USA). Tactile sensation of finger tips was examined with the
	Semmes-Weinstein Monofilament (North Coast Medical, Inc., USA) (from 0= absent
	sensation, to 5= normal sensation). Two-point (2p) discrimination was measured at the thumb
	and index finger tips with the Dellon-McKinnon Disk-Criminator (0= total absence of
	sensation, 1= perceived stimuli at a distance ≥ 12 mm, 2= ≥ 7 mm and 3= < 7mm, considered
	normal sensation).

  Before delineating lesion maps, T1-weighted images were normalized to MNI template using SPM12 (www.fil.ion.ucl.ac.uk/spm/software/spm12/). Cost function masking was used to avoid distortion of lesion by normalization procedure[START_REF] Brett | Spatial normalization of brain images with focal lesions using cost function masking[END_REF] , and the images were inspected visually to rule out poor normalization. Lesion maps were manually drawn on all axial slices of

	normalized	T1	anatomical	images	using	MRIcron
	(http://people.cas.sc.edu/rorden/mricron/index.html/) by researcher (PL) and verified by
	experienced neurologist (JCB) who were blinded to all clinical data except the lesioned
	hemisphere. Lesion location was verified on FLAIR images and lesion maps were binarized.

𝑅𝑒𝑝𝑒𝑎𝑡𝑎𝑏𝑖𝑙𝑖𝑡𝑦 -𝑠𝑐𝑜𝑟𝑒 = 1 -𝑆𝐷 𝑇𝑒𝑠𝑡 𝑆𝑝𝑟 (8 -𝑚 -1) 𝑀𝑎𝑥 𝑆𝑝𝑟 (8 -𝑚 -1)

STROKE/2019/026205 R3

Lesion volume (unit: cubic centimeter, cc) was calculated using MRIcron. Lesion maps were used to calculate weighted corticospinal tract lesion load (wCST-LL; unit: cubic centimetre, cc)

[START_REF] Zhu | Lesion load of the corticospinal tract predicts motor impairment in chronic stroke[END_REF]

using previously constructed CST template based on regions of interest in the precentral gyri, posterior limb of internal capsule, cerebral peduncle and anteromedial pons.

[START_REF] Birchenall | Individual recovery profiles of manual dexterity, and relation to corticospinal lesion load and excitability after stroke -a longitudinal pilot study[END_REF]

Acknowledgements

We express our appreciation to the patients who participated in this study and their families.

We thank the medical team of the Division of Rehabilitation Medicine, Danderyd Hospital that contributed to recruitment of patients and provided communication materials.

Sources of Funding

This study was supported by Grant from Lars Hedlund (Karolinska Institutet Dnr 2-1582/2016), Promobilia Foundation, STROKE-Riksförbundet and NEURO Sweden.

Disclosures

PGL is a shareholder in the company Aggero MedTech AB manufacturing a measurement instrument for spasticity and has patented a method for measurement of manual dexterity (EP2659835A1). He declares no conflict of interest with the present work.


Kenza Kraibi
email: kenza.kraibi@railenium.eu

Rahma Ben Ayed
email: rahma.ben-ayed@railenium.eu

Simon Collart-Dutilleul
email: simon.collart-dutilleul@ifsttar.fr

Philippe Bon
email: philippe.bon@ifsttar.fr

Dorian Petit
email: dorian.petit@uphf.fr

Analysis and Formal Modeling of Systems Behavior Using UML/Event-B

Keywords: Event-B, UML, Behavior, Formal Verification, Safety, Railway Signaling

come   L'archive ouverte pluridisciplinaire

I. INTRODUCTION

The dynamic behavior of critical systems is often expressed by formalism of automata or state machines as well as by various notations of graphical sequencing procedures. However, the absence of explicit formalization of these notations does not facilitate modeling. Within PRESCOM project, we are interested in modeling and analyzing formally the behavior of railway signaling systems. Railway signaling is, by nature, safe train movement management. It is based either on directives, in the form of procedures to be respected by railway actors, or it specifies dynamic behaviors to be respected for the control-command systems programming.

The goal of this work is to formalize the structuring of dynamic behaviors and define an explicit syntax for their description. UML [START_REF]OMG: Unified Modeling Language (OMG UML), superstructure[END_REF] as a known standard allows better understanding of the system structure but it lacks precise semantic description and does not guarantee the formal verification and validation which are highly recommended for safety-critical systems such as railway Manuscript received September 15, 2018; revised October 25, 2018. This work was supported by IRT Railenium within PRESCOM project.

Corresponding author email: kenza.kraibi@railenium.eu doi:10.12720/jcm.v.n.p-p signaling systems. As for the formal Event-B method [START_REF] Abrial | Modeling in Event-B: System and software engineering[END_REF], the extension of B method [START_REF] Abrial | The B-Book: Assigning programs to meanings[END_REF], its models have a strictly defined semantics and leave no possibility of divergence in their interpretation. However, these models require more advanced expertise and especially a good level in mathematics. In order to model graphically and reason formally on the specification, we use on the one hand UML behavioral dynamic diagrams: sequence and state machine. On the other hand, we translate the UML models into Event-B models for the systems validation as well as the verification of safety properties. In fact, our proposition is the joint use of sequence and state machine diagrams using a UML profile. This profile allows the restriction of UML modeling by combining both of the behavioral diagrams. Once the UML models are transformed into Event-B models, they are validated using the formal proof techniques. This paper is organized as follows. Section 2 gives an overview of the approach. Section 3 emphasizes the application of this approach to a railway case study. Then, section 4 illustrates related work and discussion. Finally, we conclude and provide some ideas for future work.

II. METHODOLOGY

Fig. 1 illustrates our three-stepped methodology. In a first step, we model in UML the system behavior stemmed from an informal specification. For this purpose, we use several types of UML diagrams: class, sequence and state machine diagrams, in order to obtain a complete model or almost complete in Event-B. In a second step, the models are transformed into Event-B. For the class diagram modeling and transformation, we opt for the use of B4MSecure tool to get sets, variables and invariants. The latter is recently used to structure B specifications of railway operating rules considering safety properties [START_REF] Ben Ayed | B formal validation of ERTMS/ETCS railway operating rules[END_REF], [START_REF] Ben Ayed | Formalismes basés sur les rôles pour la modélisation et la validation des régles d'exploitation ferroviaires[END_REF]. B4MSecure does not handle the transformation of sequence and state machine diagrams. For this reason, the proposed work can be an extension of this tool. Thereafter, in a third step, we proceed with the validation of the scenarios and the verification of safety properties.

Step 1: Modeling of Behavior. In UML sequence diagrams, an exchanged message between the actors of the system can be sending of a signal, invocation of an operation and creating or destructing an object. When the message is an invocation of a class operation, the state's changes of the class attributes cannot be specified directly in a sequence diagram. It is necessary to provide a specification for these states changes to complete the modeling of system behavior. Otherwise, the transformation of the invocations of class operations will provide only the signatures of Event-B events [START_REF] Weixuan | A method for the translation from UML into Event-B[END_REF]. This can be performed by conditions in class operations in the UML class diagram. But, UML class diagram is structural in nature.

We suggest here to model the state machine diagrams, which corresponds to an instance of a class, and to specify the state machine guards and transitions. Then, we define a UML profile which combines sequence and state machine diagrams. This profile regroups the different possible state changes in the sequence diagram for each message. Fig. 2 describes this UML profile:

-"Trans": extension of the meta-class "Transition" with tagged values "guard" (constraint) and "action" (behavior).

-"msg": extension of the meta-class "Message" takes "Trans" as the type of its first tagged value "trans" and defines "refine" to present the refined message if any.

Step 2: Transformation from UML to Event-B. A message is defined by a guard, one or more actions and the refined message (in case this message refines another one). Therefore, each message sending and receiving gives rise to an event. The event "message0 ≙ ..." is the translation of a message where the tagged value "refine" is empty, whereas the event {message1 ref message0 ≙ ...} is the translation of a message where "refine" takes as value "message0".

In order to represent the messages sequencing of UML sequence diagrams, we use a variable of sequence "seq" whose value is incremented at each event execution in order to guarantee this sequencing ("msgn+1" starts only after "msgn"). In sequence diagrams, combined fragments group conditional structures such as parallelism, loop and alternative. The parallel fragment contains several asynchronous messages. They are transformed by regrouping their actions together in one single event in the form of parallel actions:

EVENTS

"parallel_event ≙ guard: grd action: actmsg1 || actmsg2". Despite the enforcing of synchrony in this Event-B translation, we avoid the indeterministic sequencing of events when messages are translated separately into events [START_REF] Younes | Using UML activity diagrams and Event B for distributed and parallel applications[END_REF]. The reference fragment serves for including an interaction into another one in the same level of hierarchy. However, we transform this fragment into an event, that contains only the guard and the action of sequencing, in the abstract machine. Then, the messages of the reference interaction will be translated in the refinement machine in the form of new events refining the reference event. A loop combined fragment is repeated at least "minint" times. As long as a guard "grdloop" is true, the loop continues, at most "maxint" times. The variable "itloop" specifies here the iteration number. Each message in the loop is translated into an event "msgij".

The variable "seqloop" ensures the internal sequencing of the loop events. When "grdloop" is no longer satisfied or the "maxint" iterations are reached, the loop stops: the sequencing variable of the entire interaction "seq" is incremented in an additional event "msgi'" in order to leave the loop. Then, the next event "msgi+1" is triggered. Step 3: Formal Verification and Validation. The obtained models must be proved in order to ensure the verification of safety properties and to validate the system behavior. There are several techniques for the formal verification and validation, we use in this approach "Atelier B" tool which makes possible discharging the proof obligations. In addition, we use the animation tool "ProB" [START_REF] Leuschel | ProB: A model checker for B[END_REF], that identify the errors which are not easily discovered by "Atelier B". These tools are advocated as a way of increasing confidence in the system specifications. They are used in a complementary manner. In fact, "Atelier B" generates the proof obligations and proves automatically some of them. "ProB" animates the Event-B specifications, detects the invariants violations, and thus eases the continuation of the second stage of interactive proof.

III. APPLICATION TO RAILWAY SIGNALING CASE STUDY

The application of formal methods to the railway domain have been investigated by previous research projects: PERFECT1 for modeling railway operating rules [START_REF] Ben Ayed | B formal validation of ERTMS/ETCS railway operating rules[END_REF], [START_REF] Ben Ayed | Formalismes basés sur les rôles pour la modélisation et la validation des régles d'exploitation ferroviaires[END_REF] and NExTRegio 2 for modeling the railway signaling system. The ultimate goal is to produce methods for modeling railway systems efficiently while ensuring safety. As a continuity of these railway projects, PRESCOM reveals in particular the modeling of systems behavior. To illustrate the approach, we apply the methodology to a railway case study, also studied by Abrial in [START_REF] Abrial | Modeling in Event-B: System and software engineering[END_REF]: Train Control System that helps the traffic regulator to control the train movements. We rely on the same requirements specification as Abrial's case study.

Step 1: Modeling. The system is in charge of controlling the reservation process and the trains movements. The reservation process performs the reservation of routes, the positioning of points and the signal setting. The control of train movement manages the process of occupying and freeing the routes. Fig. 3 shows a part of the system specification as a UML class diagram. The model contains several state machine and sequence diagrams. We present only the Route state machine and the route reservation interaction. Fig. 4 describes the behavior of a Route instance. Fig. 5 shows two interactions: route reservation and route formation.

Step 2: Model Transformation. Fig. 6 illustrates an excerpt of the Event-B models resulting from the UML sequence diagrams of Fig. 5. In the abstract machine, two events are generated from the route reservation interaction. The events signatures are obtained from the messages. Guards and actions are obtained from the transitions of state machine. "route_formation" event contains only the sequencing variable. As explained in section 2, the messages of the reference interaction are translated in the refinement. Fig. 6 shows the transformation of reference interaction. Both of the "point_position" and the "form_route" events refine "route_formation". Step 3: Formal Verification and Validation. In order to check safety properties and validate the Event-B models, we use B tools, "Atelier B" for the proof and "ProB" for the animation. Actually, safety requirements of railway signaling are expressed in B language in the form of constraints while modeling in UML. Then, they are imported during the transformation into Event-B models. We notice that the obtained Event-B models verify the identified railway safety properties. Among them, we quote:

-

To avoid overtaking, a reserved block cannot be occupied by any other train than the one which reserved it. In other words, for each block belonging to the set of occupied blocks "occbl", an occupied block by a train is a reserved block by this train. This is expressed by this invariant:

! block.(block : occbl => reserve(block) = occupy(block))

with reserve : BLOCK +-> TRAIN and occupy : BLOCK +-> TRAIN are two partial functions from the set of "BLOCK" to the set of "TRAIN".

-

The occupied blocks cannot change their state to free without ensuring if the train has left these blocks. Specifically, each block neither reserved nor occupied is not associated to any train:

-! block.(block : BLOCK-{occbl \/ resbl} => block /: dom(reserve) & block /: dom(occupy))

IV. RELATED WORK AND DISCUSSION

Our approach combines a diagrammatic modeling notation (UML) with a formal modeling notation (Event-B). Essentially, UML diagrams model graphically the specification, in particular the behavioral aspect of the system, whereas Event-B serves for the verification of safety properties.

In this scope, several UML/B and UML/Event-B coupling approaches have been studied. In [START_REF] Boulanger | From UML to B {a level crossing case study[END_REF], [START_REF] Boulanger | Formal methods applied to industrial complex systems: Implementation of the B method[END_REF], a methodology suggests combining UML and B for modeling a railway case study (level crossing) using UML use case, class and state machine diagrams. However, this methodology lacks modeling the dynamic proceeding. Similarly, for [START_REF] Truong | Verification of UML model elements using B[END_REF], the proposed verification approach, using UML class, collaboration and state machine diagrams beside B method, does not address this issue. This same issue is nevertheless raised in [START_REF] Ben Ayed | B formal validation of ERTMS/ETCS railway operating rules[END_REF], [START_REF] Ben Ayed | Formalismes basés sur les rôles pour la modélisation et la validation des régles d'exploitation ferroviaires[END_REF], where a UML/B modeling approach is proposed for the validation of railway safety operating rules using B4MSecure tool. Authors of this work show the limits of scenarios modeling in B4MSecure.

In [START_REF] Snook | UML-B: Formal modeling and design aided by UML[END_REF], a UML modeler is proposed: UML-B plugin which is a UML-like and graphical front-end for Event-B. This graphical approach restrains modeling of UML class diagrams and state machine diagrams [START_REF] Snook | UML-B and Event-B: An integration of languages and tools[END_REF], [START_REF] Said | A method of refinement in UML-B[END_REF]. It lacks some characteristics comparing with standard UML tools with respect to the Object Management Group (OMG), e.g. the enumeration for class diagram and the terminate pseudo-state for state machine diagram. In [START_REF] Truong | Test of object-based specifications using B notations[END_REF], the authors use sequence diagrams and transform them to B by expressing the sequence in the refinement as operations call, which is not possible in Event-B.

In [START_REF] Weixuan | A method for the translation from UML into Event-B[END_REF], the authors present the translation of use case and sequence diagrams into Event-B. Despite its modeling of system behavior, this method provides only the signatures of events and does not express explicitly the state change of variables, i.e. the obtained events of Event-B model do not contain the body specification. Whereas [START_REF] Younes | Using UML activity diagrams and Event B for distributed and parallel applications[END_REF] focuses on the translation of activity diagrams into Event-B for distributed and parallel applications. This approach does not guarantee a parallel execution of the events, and it is presented as an interlaced execution of indeterministic events. Most of these works, do not consider refinement.

Our contribution in this paper deals with this shortcoming in addition to the dynamic proceeding modeling issue.

In a nutshell, the proposed methodology relies on: Specifying the body of Event-B events besides their signatures, considering the expression of complex behaviors such as parallelism, loop and alternative ones and taking in consideration the refinement.

V. CONCLUSION AND FUTURE WORK

In this paper, a UML/Event-B approach for analysis and formal modeling of systems behavior is presented. As a first step, we model the system from an informal specification using several UML diagrams. Furthermore, we combine the UML sequence and state machine diagrams by means of a UML profile. Then, the dynamic behavioral models of UML are transformed to Event-B models. Finally, we proceed with the formal verification and validation using B tools. In order to illustrate the contribution, this approach is applied on a case study of a railway signaling system. The use of UML and Event-B for modeling the behavior of safety-critical systems aims at two-fold goal. It makes easier to communicate and more understandable through the UML graphical modeling. In addition, it deals with different issues related to the formal validation of dynamic behavioral systems using Event-B formal method. The exploration of these transformation results allows identifying some limits of the syntax and the semantics of Event-B language with respect to the behavioral modeling. In fact, the underlying Event-B syntax and semantics do not allow modeling the behavior of the system without the use of ad-hoc variables such as those used for the combined fragments transformation (loop fragment for example).

Our goal is to seek for a better standardization of structuring dynamic behaviors and in particular for an explicit syntax for their specification. Also, we are working on the development of the transformation plugin from UML into Event-B as well as the expression of the constraints in a language which can be validated by UML modeler and transformed automatically to Event-B constraints, for instance OCL language [START_REF] Ledang | Integration of UML and B specification techniques: Systematic transformation from OCL expressions into B[END_REF].

  msgn ≙ guard: guardmsgn & seq = n action: actmsgn || seq := seq + 1 msgn+1 ≙ guard: guardmsgn+1 & seq= n+1 action: actmsgn+1 || seq := seq + 1

Fig. 1 .

 1 Fig. 1. Steps of the methodology

  EVENTSinteraction ≙ guard: seq = n action : seq := seq + 1 EVENTS Message ref interaction ≙ guard: grdMessage action: actMessage In the alternative, each message sending and reception is transformed into an event. 'else' message is presented by an event triggered when all the other guards are not satisfied. EVENTS msg1 ≙ guard: grd1 & not(grdmsg2) action: actmsg1 msg2 ≙ guard: grdmsg2 & not(grdmsg1) action: actmsg2 msg3 ≙ guard: not(grdmsg1) & not(grdmsg2) action: actmsg3

EVENTS msgi- 1 ≙

 1 guard: grdmsgi-1 & seq = i-1 action: actmsgi-1 || seq := seq+1 msgi1 ≙ guard: grdloop & grdmsgi1 & seq = i & seqloop = 1 & itloop < maxint action: actmsgi1 || seqloop := seqloop+1 msgi2 ≙ guard: grdmsgi2 & seqloop=2 & seq=i action: actmsgi2||seqloop:= seqloop+1 msgi3≙ guard: grdmsgi3 & seqloop=3 & seq=i action : actmsgi3 || itloop:=itloop+1 || seqloop:=1 msgi' ≙ guard: (not(grdloop) or itloop = maxint) & (itloop>minint) action: seq:=seq+1 msgi+1 ≙ guard: grdmsgi+1 & seq = i+1 action: actmsgi+1 || seq := seq+1

Fig. 3 .

 3 Fig. 3. Class diagram of the system

Fig. 6 .

 6 Fig. 6. Refinement

PERFECT: http://www.agence-nationalerecherche.fr/Projet-ANR-12-VPTT-0010

[START_REF] Abrial | Modeling in Event-B: System and software engineering[END_REF] NExTRegio: an IRT Railenium project in partnership with SNCF Réseau and Clearsy Systems Engineering.

ACKNOWLEDGMENT

This work is supported by PRESCOM (Global safety proofs for modular design/PREuves de Sécurité globale pour la COnception Modulaire) as a part of IRT Railenium projects in collaboration with ClearSy Systems Engineering.