Pierre Schuck

Anne Dolivet

Serge Mejean

Romain Jeantet

HOW TO ANTICIPATE THE BEHAVIOUR OF FAT-FILLED POWDER TO SPRAY DRYING

may come     How to anticipate the behaviour of fat filled powder to spray drying : Drying by desorption: a method to determine the water availability in dairy concentrate to dry and in non-fat cheese

INTRODUCTION & OBJECTIVES

Drying is an effective method for preserving biological products, since it does not involve severe heat treatment and it allows storage at an ambient temperature. Large amounts of liquid dairy products and food are dried in order to produce feeds, food and ingredients. Most of these powders are spray-dried. This process consists in spraying the concentrated liquid in droplets of about 50 µm into a large drying chamber containing air heated at around 200°C. The temperature of the product itself lies between the wet bulb temperature and the temperature of the outlet air, i.e. it remains below 100°C. Since drying occurs within a few seconds, thermal damage is limited.

Improvement in the quality of new dairy and food powders can be obtained only with the integration of new parameters such as glass transition temperature, water activity, residence time distribution, surface composition and surface temperature. The latter consists of drying modeling based on heat and mass transfer and balance equations. Two approaches can be considered: an overall approach, developed by [START_REF] Schuck | Thermohygrometric sensor: a tool for optimizing the spray drying process[END_REF], in which the model results in a mass and energy balance over the entire dryer, which can be a black box between both ends that which efficiently predicts the settings and overall performance of the spray dryer before production starts for varying weather /product conditions, and a micro approach developed by [START_REF] Chen | Air Drying of Milk Droplet under constant and time-dependent conditions[END_REF] which considers the drying kinetics and balance at the droplet level to determine information regarding the condition of the droplet (temperature / water content) as it dries. This reaction engineering approach makes it possible to model the drying droplet of various dairy products and is a new and interesting approach for improved control of the surface temperature of the droplet and subsequently the powder. This model can be used to predict certain aspects of powder quality / functionality. Whatever the approach used, one difficulty remains: i.e. how to take into account the water availability in the product, except for pure water.

The aim of this study was to propose a new and useful method of drying by desorption in order to determine major drying parameters according to food components in relation to their interactions with water (bound and free water) and linked to water transfer kinetics.

MATERIAL & METHODS

Concentrates were dried at 45°C (constant temperature) in a device (Rotronic, Bassersdorf, Switzerland) which consists of a 2 compartment cell, one (the smallest) containing the product (about 160 mg) and the other containing an excess of zeolite. The mass ratio is approx 100 g zeolite to 1 g productWater transfer takes place because of this vapor pressure gradient, in a similar way to the water transfer that occurs during drying. The main difference is in the kinetics of the transfer, which here

RESULTS AND DISCUSSION

The main aim of this study was to develop a method to simulate the transfer conditions (energy and water) of spray-drying. Typical curves were registered with the water activity meter on water, dairy and food concentrates (Fig. 2.). These curves showed that the relative humidity (RH) from the pressure sensor as a function of time can be represented by a sigmoid equation [START_REF] Schuck | Simulation of water transfer in spray drying[END_REF].

Fig. 2. Kinetic of drying by desorption

24th International Conference on Bioencapsulation -Lisbon, Portugal -September 21 -23, 2016 -Templates Two phases can be identified on the curves obtained for pure water and milk concentrates:

Initially, at the beginning of desorption, there was a constant RH (ie rate of drying) phase. This constant phase corresponds to free water evaporation. The second phase was the falling rate period, which was very short for pure water and much longer for milk concentrates, whatever the total solid content. We assumed that this corresponded to the evaporation of bound water, which involves extra energy (∆E) in order to overcome binding (indirectly the bound strength of water). The area under the curve of each part thus represents the amounts of free and bound water desorbed, respectively. ∆E is calculated as a function of the drying kinetics according to the desorption curves (Fig. 2.). If the drying kinetic is two slower, energy requirement is two higher than for pure water. The difference with the latent heat of evaporation required for pure water determines ∆E. Analysis of the desorption curve combined with knowledge of the temperature, total solids, density and specific heat capacity of the concentrate, air flow rates, theoretical water content in relation to water activity and relative humidity (RH) of the outlet air, the current weather conditions, cost per kWh and the percentage of drying in the integrated fluid allowed determination of enthalpy, T (Temperature), RH (including ∆E) for each air, concentrate and powder flow rate, energy specific consumption, energy and mass balance, yield of the dryer and cost (in € or in $) to remove 1 kg of water or to produce 1 kg of powder. All these results are summarized in Fig. 3. This figure is a representation of the software delivery and can be broken down into three parts:

Air: Summarizing all the parameters concerning air entering and leaving the drying chamber (temperature, absolute humidity, relative humidity, mass flow rate).

Product: Summarizing all the parameters concerning the concentrate (mass water flow rate, volume, temperature, total solid content and cp) and powder (mass flow rate and moisture content).

Energy: summarizing economic (kWh cost, cost per ton water removed or per ton of powder produced) and energy (droplet temperature during spraying, dew point temperature at the air outlet, energy balance, energy consumption ratio and yield) results for the equipment.

Fig. 3. Synthesis table for spray drying parameters

CONCLUSIONS

This study shows that drying by desorption is an excellent tool to determine the major spray-drying parameters in relation to biochemical composition according to water availability, and to their desorption behavior (calculation of the ∆E). The experimental device differs from the spraydrying installation in terms of duration of drying, temperature of drying, surface / volume ratio, etc. However, for these reasons some computational tools have been developed to improve the method by taking this into account. Validation tests (> 100 products) indicated that this method could be applied to a wide range of food products and spray-dryer types. For reasons of calculation speed and reliability, this method has been computerized and it can already be used in the determination of parameters of spray drying for food products. The name of the new software is "Spray Drying Parameter Simulation and Determination Software" (SD2P®) registered under the following identification: IDDN.FR.001.480002.003.R.P.2005.000.30100. By variation of drying parameters and concentrate parameters with the helpful on the INRA software (SD2P®) for prediction, the results showed -the high interest to increase, the total solid of the concentrate and the temperature of the inlet air before heating, -of the integrated fluid bed for easy or difficult product to spray dry, -of the dehumidification the air (to increase the production or/and to have regular spray drying parameters or/and to decrease the powder temperature), -to invest in order to reduce the energy cost, because an little increase in unitary energy cost have an high effect on the energy and total cost of dairy powder production.

ACKNOWLEDGES

24th International Conference on Bioencapsulation -Lisbon, Portugal -September 21 -23, 2016 -Templates This articles uses information from the author's original paper entitled "Drying by desorption: a tool to determine spray drying parameters" in Journal of Food Engineering 94, 199-204 (2009).

  takes 2 hours compared to a few seconds during spray drying. This device was described by Schuck et al (1998) (Figure1.). One relative humidity (RH) sensor (Rotronic, Bassersdorf, Switzerland) over the 2 compartments makes it possible to plot RH in the cell as a function of time.

Fig. 1 .

 1 Fig. 1. Schematic device for drying by desorption.


Comment citer ce document : Nougayrede, J.-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd.

Escherichia coli : a commensal bacterium of the intestinal tract with considerable pathogenic potential E. coli belongs to the initial microflora colonizing the newborn gut E. coli is a leading cause of infant acute diarrhea and the primary cause of E. coli is the predominant facultative anaerobe in the adult gut (10 3 to 10 8 /g of feces)

travelers' diarrhea.

E. coli is an emerging foodborne pathogen.

About 10 to 20 percent of women have had at least one episode of urinary tract infection due to E. coli in their lifetime.

E. coli causes 10-50% of nosocomial infections.

Comment citer ce document : Nougayrede, J.-P. ( 2016

"Commensal" isolates pks+

Colibactin is a virulence factor for E. coli… … but the pks island is also frequently found in "commensal" isolates, in adults and infants "Colibactin" = a mixture of molecules with various activities ?

A number of molecules are specific to each strain, suggesting that "colibactin"

  ). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd. document : Nougayrede, J.-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd. A 52 kb "pks" genomic island confers toxicity Comment citer ce document : Nougayrede, J.-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd. Colibactin in silico predicted Comment citer ce document : Nougayrede, J.-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd. Control Infection with E. coli pks+ induces host cell cycle arrest Cell cycle (G2) arrest Infection E. coli pks+ Comment citer ce document : Nougayrede, J.-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd. .-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd. Comment citer ce document : Nougayrede, J.-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd. What impact on the host ? Comment citer ce document : Nougayrede, J.-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd.

  document : Nougayrede, J.-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd. document : Nougayrede, J.-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd. .-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd.

«

  E. coli at 3 days of life (15% total) Comment citer ce document : Nougayrede, J.-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd. .-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd. E. coli strains Comment citer ce document : Nougayrede, J.-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd. .-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd. et al, PNAS 2010 Comment citer ce document : Nougayrede, J.-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd. pks-pks+ Senescence-associated β-galactosidase Secher et al, Plos One 2013 Cougnoux et al, Gut, 2014 Comment citer ce document : Nougayrede, J.-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd. et al, PNAS 2010 Comment citer ce document : Nougayrede, J.-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd. of DSS Cougnoux et al, Gut, 2014 Comment citer ce document : Nougayrede, J.-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd. Mutaflor is a microbial drug containing live E. coli strain Nissle 1917. It is the first probiotic drug for which efficacy in maintaining remission of ulcerative colitis was proven by a confirmative clinical study ». Comment citer ce document : Nougayrede, J.-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd. A non-genotoxic Nissle 1917 mutant is impaired for probiotic activity Olier et al, Gut Microbes 2012 Comment citer ce document : Nougayrede, J.-P. (2016). The genotoxin colibactin. In: Toxins: New Targets and New Functions (p. 74-75). Toxicon, 116. Presented at 22nd Meeting of the French-Society-of-Toxinology (SFET), Paris, FRA (2014-12-10 -2014-12-11). GBR : Elsevier Ltd.

pks island is frequent in extra- intestinal pathogenic E. coli

	1 5 8 10 11 25 2 3 9 12 4 6 16 22 7 14 13 18 19 20 21 17 24 15 23 58 67 26 27 69 The 27 Yersiniabactin Enterobactin 69 28 45 29 32 33 34 30 68 70 71 72 51 52 54 56 57 55 65 61 62 63 64 53 59 60 66 35 36 38 39 40 41 46 49 50 44 47 48 31 43 37 42	•Nougayrède et al. 2006 (n=97) •Johnson et al. 2008 (n=62) •Putze et al. 2009 (n=205) •Dubois et al. 2010 (n=146) ExPEC pks+ 53% 58% 37% 32%

Payros et al, GutMicrobes, 2014


est destinée au dépôt

Nutrient metabolism alterations caused by co-infection by swine influenza virus and mycoplasma hyopneumoniae in pigs -mitigating effects of feed restriction

Nathalie Le Floc'H, Céline Deblanc, Elodie Merlot, Jean-Noël Sialelli, Fabien

Vautrin, Roland Cariolet, Gaelle Simon

To cite this version: Nutritional strategies can be effective to improve the ability of pigs to cope with disease. Indeed, inflammation is responsible for changes in nutrient partitioning between growth and functions devoted to body defense. Reciprocally, many nutrients are involved in metabolic pathways modulating inflammatory and immune responses. European avian-like swine H1N1 is a major pathogen of the porcine respiratory disease complex together with Mycoplasma hyopneumoniae (Mhp). We studied the impact of a moderate feed restriction on the ability of pigs pre-infected with Mhp to cope with an H1N1 influenza challenge and its consequences on nutrient metabolism and performance. Post-prandial nutrient utilization was used to identify nutrients whose metabolism was modified.

Two groups of 8 SPF pigs were intra-tracheally inoculated with Mhp and H1N1 21 days apart.

One group was fed ad libitum (AL) whereas the other one was applied a 40% feed restriction (FR) 1 week before H1N1 infection. One mock-inoculated AL and 1 mock-inoculated FR group of 4 pigs each were included. All pigs were fitted with a jugular catheter. Three days post-H1N1 infection and after an overnight fast, 200g of feed was given to all animals and serial blood samples were performed during 4h for measuring post-prandial plasma nutrient concentrations. Pigs were slaughtered 7d post-H1N1 infection. Clinical signs were observed throughout the study.

Both FR and infection modified postprandial kinetics of glucose and amino acid (AA) concentrations showing dramatic changes in nutrient metabolism. Glucose, arginine and threonine plasma concentrations were lower in infected pigs. The lower threonine concentrations might be related to the greater concentrations in plasma immunoglobulins that are rich in this AA. Feed restriction hardly modified the plasma nutrient response to infection. However, FR pigs presented a shorter hyperthermia as well as a positive mean weight gain over the 3 first days following H1N1 infection while animals fed AL lost weight during that period. This trial confirmed that feeding practices could be a strategy to help animals to overcome an influenza infection.

  Nutrient metabolism alterations caused by co-infection by swine influenza virus andMycoplasma hyopneumoniae in pigs -mitigating effects of feed restriction N. Le Floch 1 , C. Deblanc 2 , E. Merlot 1 , J.-N. Sialelli 3 , F. Vautrin 3 , R. Cariolet 4 , G. Simon 2

	1 INRA, UMR1348 PEGASE, F-35590 Saint-Gilles; 2 Anses, Swine Virology Immunology Unit, F-
	22440 Ploufragan; 3 FARM'APRO, F-22640 Plestan; 4 Anses, Production of decontaminated
	pigs and testing, F-22440 Ploufragan

Nathalie Le Floc'H, Céline Deblanc, Elodie Merlot, Jean-Noël Sialelli, Fabien Vautrin, et al.. Nutrient metabolism alterations caused by co-infection by swine influenza virus and mycoplasma hyopneumoniae in pigs -mitigating effects of feed restriction. 7. European symposium of porcine health management (ESPHM), Apr 2015, Nantes, France. 2015, 7th European symposium of porcine health management : proceedings. hal-01210979


Dirk Seifert
email: dirk.seifert@loria.fr

Conformance Testing based on UML State Machines Automated Test Case Generation, Execution and Evaluation

We describe a comprehensive approach for conformance testing of reactive systems. Based on a formal specification, namely UML state machines, we automatically generate test cases and use them to test the input-output conformance of a system under test. The test cases include not only the stimuli to trigger the system under test, they also include the test oracles to automatically evaluate the test execution. In contrast to Harel Statecharts, state machines behave asynchronously, which makes automatic test case generation a particular challenge. As a prerequisite we have completely formalized a substantial subset of UML state machines that includes complex structured data. The TEAGER tool suite implements our test approach and proves its applicability.

Introduction and Related Work

The impact of embedded systems in our everyday life is steadily growing. They are present not only in very specific contexts, but also in nearly every electrical device we use. In general, embedded systems comprise of hardware and software components interacting with a specialized technical environment via sensors and actors. The main reason for their success is the combination of specific or high-performance hardware with the flexibility of software. The software is responsible for controlling the hardware and software components and for calculating reactions as responses to received events. Erroneous systems annoy the costumers and are a high commercial risk in mass customization. Moreover, size and complexity of nowadays systems demand for improved and automated processes: for development as well as for quality assurance.

In a model-based development approach, models of the system which have to be built, guide and control the development process. There are various types of models differing in the level of abstractions or in their intended use. In the first steps, the models are used to analyze the problem domain and to ease the information exchange among developers. Later on, they form the basis to design and implement the system, serve as documentation, and are also used for quality assurance purposes. For example, the Unified Modeling Language (UML) comprises thirteen diagram types to specify the structure and the behavior of a system or a system component [START_REF]UML2: Unified Modeling Language: Infrastructure and Superstructure[END_REF]. The included state machines are used to either describe the discrete reactive behavior (behavioral state machines) or to describe the usage protocol (protocol state machines). In our approach we use the behavioral state machines to specify the states a system can take and actions 1 it can execute during its lifetime in response to internal and external events. The discrete reactive character of state machines and the possibility to completely specify the behavior of a system make state machines appropriate to model reactive systems. They also allow to automatically generate test cases that include test oracles. Testing means executing a system under test (SUT) with selected but real data to evaluate its conformance, whereat conformance is evaluated on the basis of the observations made on the system under test. It aims in falsification, that means to show inconsistencies between the specification and the SUT. It benefits from the fact that the actual system is brought to execution, and thus, the interaction of the real hardware and software can be evaluated. It also benefits from the fact that it is applicable at different levels of abstraction and at different stages of the development.

The contribution of our work is twofold: first, we formalized a substantial subset of UML state machines that includes the manipulation of complex structured data. Second, we present a conformance test approach based on UML state machines that allows automatic generation, execution and evaluation of test cases on the level of unit testing. To our knowledge there is no formalization related to the latest UML standard [START_REF]UML2: Unified Modeling Language: Infrastructure and Superstructure[END_REF] that precisely formalizes data aspects. We focus on the reactive behavior and skip real time aspects in this paper (in short: we allow to manually specify lower and upper timeout limits for every event). Considering real time behavior is still a challenge for automated processes. It is one of our prospects for future work.

Our formalization of UML state machines is influenced by several works (e.g., [START_REF] Balser | Interactive Verification of UML State Machines[END_REF][START_REF] Lilius | Formalising UML State Machines for Model Checking[END_REF][START_REF] Latella | Automatic Verification of a Behavioural Subset of UML Statechart Diagrams Using the SPIN Model-checker[END_REF]). Most approaches focus on model checking and the chosen representation is not always appropriate for automated test case generation. Moreover, there have been major changes in UML 2 that require a revision of previous works. We present an operational semantics that is complete with respect to the considered subset and includes all necessary definitions. Moreover, it is the first formalization which includes all definitions related to complex structured data. De Nicola and Hennessy [START_REF] De Nicola | Testing Equivalences for Processes[END_REF] introduce a formal theory of testing on which (later on) Brinksma [START_REF] Brinksma | Protocol Specification, Testing and Verification[END_REF] and Tretmans [START_REF] Tretmans | Test Generation with Inputs, Outputs and Repetitive Quiescence[END_REF] build approaches to derive test cases. For basic work on testing based on transition systems and (extended) finite state machines we refer to the surveys [START_REF] Lee | Principles and Methods of Testing Finite State Machines -A Survey[END_REF][START_REF] Petrenko | Fault Model-driven Test Derivation from Finite State Models: Annotated Bibliography[END_REF][START_REF] Brinksma | Testing Transition Systems: An Annotated Bibliography[END_REF]. A lot proposals only deal with deterministic systems and require that the model must be strongly connected [START_REF] Fujiwara | Test Selection Based on Finite State Models[END_REF][START_REF] Yang | Protocol Conformance Test Generation using multiple UIO Sequences with Overlapping[END_REF][START_REF] Chow | Testing Software Design Modeled by Finite-State Machines[END_REF], or assume the testing process to communicate synchronously with the system under test [START_REF] Brinksma | Protocol Specification, Testing and Verification[END_REF][START_REF] Brinksma | Testing Transition Systems: An Annotated Bibliography[END_REF]. More recent research allow some of these requirements to be relaxed (see e.g. [START_REF] Luo | Test Selection Based on Communicating Nondeterministic Finite State Machines Using a Generalized Wp-Method[END_REF][START_REF] Gnesi | Formal Test-case Generation for UML Statecharts[END_REF][START_REF] Offutt | Generating test data from state-based specifications[END_REF]) but most refer to older UML standards, consider different subsets, or do not consider complex structured data. Moreover, we allow nondeterminism in the specification as well as in the SUT, and asynchronous communication between the SUT and its environment. A further difficulty in using transition or finite state machines based techniques is that transitions in state machines are labeled with input-output pairs associated to a single transition. The underlying semantic model builds on the steps of the whole state machine. Those comprise the execution of several transitions including changing the current configuration and executing actions such as those that generate output events. In such a step the atomicity of input processing and output generation is preserved. Mapping the semantics to transition systems or input/output automata to apply classical techniques would require to introduce intermediate states and transitions. On the one hand this would break the correspondence of a state machine step and a semantic step, and on the other hand such a multi-step approach unnecessarily complicates the formalization and use of state machines.

Latella et al. [START_REF] Gnesi | Formal Test-case Generation for UML Statecharts[END_REF][START_REF] Latella | A Formal Testing Framework for UML Statechart Diagrams Behaviours: From Theory to Automatic Verification[END_REF][START_REF] Latella | On Testing and Conformance Relations for UML Statechart Diagrams Behaviours[END_REF] follow (as we do) a "semantics-first" approach in which a sound basic kernel of the notation is considered and extended, only if the main features are investigated. In contrast to our work they do not consider complex structured data (i.e., interpret a state machines data space or event parameters). They also refer to an older UML standard and do not consider different transition orders, which become relevant if data are regarded. Offutt et al. [START_REF] Offutt | Generating Tests from UML Specifications[END_REF][START_REF] Offutt | Generating test data from state-based specifications[END_REF] present techniques to generate test cases from UML state diagrams on class-level testing. In contrast to our work, they have a data-centric view and focus on change events and boolean variables. The generated test suites are related to full-predicate coverage. Moreover, it is not clear how far the applied semantics follows the UML standard. The work around the AutoFocus tool [START_REF] Pretschner | Model based Testing in incremental System Development[END_REF] is interesting but they use proprietary notation which does not include all aspects of UML state machines and a formal, but synchronous, semantics. Another mentionable industrial approach are the AGEDIS tools [START_REF] Hartman | The AGEDIS Tools for Model Based Testing[END_REF], but the used semantics is not completely clear. Spec Explorer developed at Microsoft Research ( [START_REF] Campbell | Model-Based Testing of Object-Oriented Reactive Systems with Spec Explorer[END_REF] and related publications) is an industrial approach that uses finite state machines as the underlying model for automated testing. They also test against nondeterministic systems and address problems of data instantiation. The general principle to explore the specifications state space is comparable to our approach. In contrast, the focus is on (synchronous) method calls.

In Sec. 2 we introduce the syntax and semantics of state machines we need in this paper by means of an example. In Sec. 3 we present our test approach to automatically generate test cases out of a state machine specification. We describe the underlying theory, the test case generation algorithms, how approximation techniques are used to increase the efficiency and how the test case generation and execution can be controlled and evaluated. In Sec. 4 we present our TEAGER tool suite and discuss experimental results. In Sec. 5 we conclude our work and give an outlook to ongoing research.

State Machines

UML state machines [START_REF]UML2: Unified Modeling Language: Infrastructure and Superstructure[END_REF] are an object-oriented extension of the classical Harel Statecharts [START_REF] Harel | Statecharts: A Visual Formulation for Complex Systems[END_REF]. We use them to describe the sequence of states a system or system component can take and the actions it executes when changing these states. State machines are mathematical models with a graphical representation: the nodes depict simple or composed states of the system and the labeled edges depict transitions between these states. Composite states are used to hierarchically and orthogonally structure the model, thus reducing its graphical complexity. Labels express conditions under which transitions can be taken and the actions that will be executed when the transitions are taken. Events are used as triggers to activate transitions and can be parameterized to exchange data. Optional, every state machine has a data space that can be read and manipulated by the state machine during execution. More precisely, it is possible to read data values to describe specific conditions when a transition can be taken or to manipulate data values and exchange information within actions. A transition comprises a source state, a trigger event, an optional guard, an optional effect (which consists of a sequence of actions), and a target state. A guard describes a fine-grained condition (with reference to the sys- tem's state) that must evaluate to true to enable the transition. Hence, the activation of the source state, the trigger event and the fulfilled guard condition constitute the necessary constraint to fire a transition. An action can either be a statement manipulating the data space or the generation of new events. The action sequence and the subsequently active target state constitute the overall effect of the transition. In opposite to the classical Statecharts, the event processing takes place in a so-called run-to-completion step [START_REF]UML2: Unified Modeling Language: Infrastructure and Superstructure[END_REF]. This asynchronous event processing demands the processing of the previous event to be completely finished before the next event can be processed. In the following we briefly describe state machines by means of an example. Afterwards we discuss semantic issues which pose a challenge for automated test case generation. A complete and detailed description as well as a precise definition of the semantics (including the integration of complex data) can be found in [START_REF] Seifert | An Executable Formal Semantics for a UML State Machine Kernel Considering Complex Structured Data[END_REF][START_REF] Seifert | Automatisiertes Testen asynchroner nichtdeterministischer Systeme mit Daten[END_REF].

Example

We use a state machine model specifying the behavior of a simple sound device in a car to demonstrate the state machine notation. The requirements for such sound device could be as follows: It should be possible to turn the Car Audio System on and off. When turned on, it should play one of three different audio sources, namely radio, tape or compact disc, respecting the presence of a tape or a compact disc. It should be possible to change between available sources. Furthermore, it should be possible to switch between four radio stations, to spool a tape backward or forward, or to select the previous or the next track of a compact disc.

We introduce the following events to model the required behavior: power, src (to switch between the different sources), next, back and play. We also introduce events signaling the insertion and the ejection of a tape or a compact disc as well as events to signal system reactions. Furthermore, we use data variables to store detailed information about the current state. For example, we use an integer variable trackCount to store the number of titles of an inserted compact disc. Figure 1 shows a state machine model of the sound device including the related data space.

At the highest level of abstraction the model consists of an orthogonal state comprising three regions. The two regions CD Player and Tape Player model the information if a tape or a compact disc is inserted into the system or not. The more complex region Audio Player models the control of the system. The region is refined by two states: Off and On. Initially the system is assumed to be switched off, expressed by the small arrow leaving a bullet and ending at the Off state. When the event power is processed the system is switched on and starts to play the radio (again expressed by a small arrow). The composite state On is refined into states modeling the three signal sources. The transitions between these states describe the changes between the sources as reaction to an event src. For example, when the system is in Tuner Mode and a tape and a compact disc are inserted into the system (i. e. both in-predicates are true) and the event src is processed, the system can either switch to the tape mode or switch to the compact disc mode because both transitions are enabled and can fire. All three substates of Audio Player are further refined to describe the particular behavior in reaction to the events next, back and play in each state.

State Machine Semantics

The semantics of UML state machines is adapted from the STATEMATE semantics [START_REF] Harel | The STATEMATE Semantics of Statecharts[END_REF] to fit into the object-oriented paradigm. As described above a state machine can be refined by simple composite and orthogonal states. Simple composite states contain exactly one region and orthogonal states contain at least two regions. In every region only one substate can be active at a time. The state which is entered by default when a region is entered is marked by an arrow emanating from a filled circle. The hierarchical ordering of states forms a tree structure with a region as the root node, simple states at the leave nodes and in between (alternating) composite states and regions.

Due to orthogonal regions a state machine can have several active states at a time. We call the set of all active states configuration. For the same reason it is possible that more than one transition can fire at a time -one in every active orthogonal region. We call the set of all jointly firing transitions firing transition set (FTS). Due to the hierarchical structure it can happen that two transitions are enabled for firing on different hierarchy levels of a state. Taking both would lead to a configuration which is not wellformed. A similar situation arises if a transition leaves an orthogonal region. In this case the transition cannot fire together with an enabled transition in another orthogonal region. In both cases the transitions are said to be in conflict with each other. Conflicts are identified if two transitions leave identical states in the state hierarchy. The UML describes a two-step process to resolve conflicts. In the first step a priority scheme is used. A transitions emanating from a state deeper in the state hierarchy has priority over the other transition. Thus the more refined transition is taken. This differs from classical Statecharts, but it reflects the object-oriented inheritance behavior. However, not all conflicts can be resolved using this priority scheme. In the second step only transitions are selected which are not in conflict to each other allowing for maximal progress of the system. A so-called transition selection algorithm selects all maximal sets T ⊆ T of enabled transitions fulfilling the following requirements:

∀ t : T • enabled (t, c, e, d) (1)
∀ t 1 , t 2 : T | t 1 = t 2 • t 1 t 2 (2) ∄ t ′ : T \ T | enabled (t ′ , c, e, d) • ∀ t : T • t t ′ ∨ t ′ ≺ t (3)
First, all transition in the set must be enabled regarding the current configuration, the trigger event and the current data assignments. Second, all transitions in the set are mutually conflict free (expressed by the operator). Third, there is no enabled transition outside the set which is conflict free with all transitions in the set or with higher priority than a transition inside the set. Thus, transitions with the highest priority are taken and maximal sets are chosen. Result is a set of firing transition sets (FTSs). It is important to mention that for execution one FTS is arbitrarily chosen, and that the order in which the transitions in this set are fired is arbitrarily chosen, too. In consequence, all set choices and transition permutations form the set of all possible semantic steps of the state machine at a time. This is important if we want to compute the possible correct behavior for an input sequence to evaluate the test execution. In opposite to classical Statecharts, the event processing takes place in a so-called run-to-completion step. This asynchronous event processing demands the processing of the previous event to be completely finished before the next event can be processed. Therefore it is necessary to buffer received events in an event store. Consequently, the occurrence of an event and its processing are asynchronous (i.e., take place at different times). It follows that a possible (observable) reaction of the system also takes place asynchronously.

The semantic model of state machines builds on the semantic steps a state machine can execute during its lifetime. Such a step moves the state machine from one semantic state to another semantic state while receiving events from and emitting events to the environment. A semantic state (called a status) comprises three components, namely a configuration (a set of active states), an event store, and the variable assignments. We depict the components of a status in double square brackets [[c, q, d ]] and a semantic step

[[c, q, d ]] in, out ---→ [[c ′ , q ′ , d ′ ]]
. Note that the chosen set of firing transitions and the execution order of these transitions can be identified (if necessary) from this representation. Assuming a state machine to be input enabled (cf. the next section) a semantic step can be described as follows:

q =<> q ′ = ⊕(q, E in ) [[c, q, d ]] E in , --→ [[c, q ′ , d ]] (4) q ∈ ran ⊕ (q ′′ , e) = ⊖(q) c ′ = (c \ ∀ t:T exits (t)) ∪ ∀ t:T enters (t) A seq ∈ perm({t : T • effect (label (t)(e))}) (d ′ , E gen ) = performAll( / A seq )(d) (E int = E gen ↾ E SM ) ∧ (E out = E gen ↾ E env ) q ′ = (q ′′ ⊕ E int ) ⊕ E in [[c, q, d ]] E in ,E out ----→ [[c ′ , q ′ , d ′ ]] (5)
We have to distinguish two situations. First, the situation when the event store does not contain any event (4). During the step, only the events received from the environment (E in ) are added to the event store (⊕(q, E in )). The active configuration and the data assignments are left unchanged. Second, the situation when the event store contains events for processing [START_REF] De Nicola | Testing Equivalences for Processes[END_REF]. During the step, the trigger event will be selected from the event store (⊖(q)). The next configuration c ′ results from leaving all states the transitions exit, and entering all states the transitions enter. Next, an execution order for the FTS is chosen (perm), and the effect of this transition sequence is calculated (performAll). The effect includes the new data assignments (d ′ ) and the sequence of newly generated events (E gen ). Finally, this event sequence is processed. The generated internal events (E int ) and the events received from the environment (E in ) are added to the event store. The remaining external events (E out ) are sent to the environment. Now we can describe the execution of a state machine based on this definitions as a concatenation of semantic steps. We call such a sequence of semantic steps a computation.

[[c 1 , q 1 , d 1 ]] in 1 , out 1 ----→ [[c 2 , q 2 , d 2 ]] in 2 , out 2 ----→ . . . in n-1 , out n-1 -------→ [[c n , q n , d n ]]
We use this execution model to define our test approach. Only a precise and clearly interpretable mathematical model as we presented here offers the basis for automated processes. Our complete state machine semantics can be found in [START_REF] Seifert | An Executable Formal Semantics for a UML State Machine Kernel Considering Complex Structured Data[END_REF][START_REF] Seifert | Automatisiertes Testen asynchroner nichtdeterministischer Systeme mit Daten[END_REF].

Test Case Generation

In the UML standard and in our semantics, too, not all semantic details are completely determined. These open issues are called semantic variation points. They prevent unnecessary restrictions in the semantics and allow some degrees of freedom for the implementation of the semantics. The user has to instantiate them before working with the semantics. Unfortunately, many problems with the UML semantics arise from semantic variation points. On the one hand some of them are not obvious in the standard and on the other hand decisions taken are often not propagated to the public. Concerning our test approach the most interesting semantics variation points are: the nature of the event store, events not enabling any transition, the selection policy of possible firing transition sets, and the execution order of the transitions in a chosen set.

We instantiate the two first semantic variation points and do not instantiate the latter two, thus the test approach works correctly for different implementations of a state machine specification. Precisely, we neither want to restrict how to choose a possible set of firing transitions (if there is more than one) nor do we want to restrict the order these transitions will be executed. This is different for the event store. In order to be able to calculate the possible correct behavior allowed by the state machine specification, we need to know the nature of the event store, or with other words, we have to decide for a specific nature. In most practical contexts a FIFO queue is used to store events for further processing. Hence we assume an unbounded reliable FIFO queue as event store. Second, we assume that events that do not enable a transition when they are processed are deleted and the next event from the event store will be processed. This implies that the state machines do not block. an event queue is introduced into the semantic model of state machines, non-enabling events from the queue will be omitted, and we need to respect different firing transition set selection and execution strategies in our test approach.

Conformance Relation for State Machines

As mentioned in the introduction, an embedded system usually comprises of hardware and software components. Hence, we treat the SUT as a black box to reflect this circumstance. We only require the SUT to have so-called points of control and observations. With these it is possible to control and observe the SUT. (i.e., to send inputs and to observe the outputs of the SUT). Figure 2 shows this abstract test assembly. As a consequence only the inputs to the SUT and the outputs of the SUT are visible in the environment and thus for the tester. This particularly implies that the event queue is not visible from the outside. To generate test cases and especially the test oracles we need to restrict the test generation to the observable parts of a SUT, but must respect internal details, which influence the possible behavior. Consequently, we need to extract the observable parts of the computations we defined for the semantic model of state machines. These are the events received from the environment and the generated events sent to the environment. Corresponding to the computation defined above we yield an observable computation by extracting and concatenating these events:

in 1 out 1 . . . in n-1 out n-1 (6)
We assumed the event store to be a queue so that received events will be stored one after another in sequence. Furthermore, we assume that transitions and actions on transitions are executed in sequence. Hence, generated events are also stored in sequence. The set of all observable computations form our observable execution model of state machines and the basis for the test case generation.

A prerequisite to automatically evaluate whether a SUT conforms to its specification is a precise definition of conformance. De Nicola and Hennessy studied various possible characterizations of conformance [START_REF] De Nicola | Testing Equivalences for Processes[END_REF][START_REF] De Nicola | Extensional Equivalences for Transition Systems[END_REF]. Brinksma and Tretmans studied various implementation relations for synchronous transition systems [START_REF] Brinksma | Protocol Specification, Testing and Verification[END_REF][START_REF] Tretmans | Test Generation with Inputs, Outputs and Repetitive Quiescence[END_REF]. In general, relevant implementation relations are based on the same idea of an external observer. Here, an implementation I conforms to its specification S, if and only if, all observations obs any external observer o : O can make on the implementation, can be related to the observations this observer can make on the specification:

I ≤ o S ⇔ ∀ o : O • obs(I, o) ⊑ obs(S, o) (7)
To get an applicable relation you need to define the type of observers (O), which observations these observers can make (obs), and how to relate these observations (⊑). We use sequences of inputs to the SUT as observers. The observations these observers can make are the resulting outputs (i.e., the generated events). The relation we use to compare observations of the system under test with the observations of the specification is set inclusion (⊆). We argue that a system under test conforms to its specification, if and only if, the output sequences for all possible input sequences are included in the set of all output sequences of the specification for the same input sequence [START_REF] Lee | Principles and Methods of Testing Finite State Machines -A Survey[END_REF]. Following Tretmans [START_REF] Tretmans | Test Generation with Inputs, Outputs and Repetitive Quiescence[END_REF] we restrict the set of possible inputs to that of the specification (seq E S ). The set of outputs we calculate from the set of observable computations of a specification [START_REF] Petrenko | Fault Model-driven Test Derivation from Finite State Models: Annotated Bibliography[END_REF]. Precisely, the set of all observations out(S, σ ) for S with input sequence σ results from all observable computations of S (otraces(S)) for which σ denotes the input sequence (σ = δ ↾ E S ) and δ ↾ E env denotes the resulting output sequence.

I ≤ out S ⇔ ∀ σ : seq E S • out(I, σ ) ⊆ out(S, σ ) (8) out(S, σ ) == {δ : otraces(S) | σ = δ ↾ E in • δ ↾ E out } (9)
Now we have a precise meaning of conformance and a guideline how to compute test cases and test oracles: based on the specification we need to calculate the traces of the state machine for all possible inputs and extract the possible correct observations. For testing we need to stimulate the SUT with the particular inputs, observe the outputs and compare them to the pre-calculated possible correct observations. That means to check for their existence. Obviously a problem arrises when thinking about practical testing -the set of inputs is usually infinitely large or at least pretty huge.

Selecting Inputs for Test Case Generation

When testing in practice we are only interested in relevant and interesting test cases to advantage the quality assurance process, and to use time and computation power at an optimum. Therefore, we generate test cases for pre-selected input sequence. This twostep process clearly separates the input selection problem from the test case generation problem. Hence it is possible to use different selection strategies with the same generation process and it allows to adapt the input selection process to different test purposes or to different project stages.

In the TEAGER tool suite we implemented several input selection strategies. The strategies range from using given fixed input sequences to using specific models describing the environment. The former allows special value testing and is used for very specific test purposes like the coverage of a certain path or state. The latter allows to model varied behavior of an environment based on probabilities. The most general one is an environment in which all inputs can happen at any time with the same probability (uniform distribution). In a more specific environment different probabilities are assigned to the inputs (a prior distribution). Thus the occurrence of specific inputs can be influenced. We also use a variant of this strategy where we adapt the probabilities once an input is chosen (dependant distribution). For every input a weight is assigned and decremented if the input is selected. If all weights are equal to zero the initial assignments will be used. With this strategy we ensure that eventually every event is chosen.

The most expressive way to describe the environment is to model it with probabilistic state machines. Using state machines allows to model dependencies among inputs in a sequence. It also allows to completely reassign input probabilities depending on the assumed state of the system under test. For example, the probability of dialing a number before lifting the receiver of a telephone is certainly different from the probability of dialing after lifting the receiver. In summary, we use different complex strategies to describe assumed environments to select relevant and interesting inputs. For a detailed description of our input selection strategies we refer to [START_REF] Seifert | Using UML Protocol State Machines in Conformance Testing of Components[END_REF].

Test Case Generation Algorithm

During test case generation we consider a finite set of finite sequences of inputs and calculate all possible correct observations for these inputs. We use these observations to automatically evaluate the test execution process. Considering complex data during the test case generation process is not scope of this paper and we skip the corresponding details here. The problem which specific data to choose is part of ongoing research. In the current approach data are chosen randomly during the test case generation.

To calculate the possible correct observations we stepwise explore the state machine's state space for the given input. The challenge is to correctly consider all semantic subtleties. We do this in a two step algorithm. First, we initialize the state machine with its initial status (i.e., with its initial configuration, an empty queue and an initial data assignment). We insert the first input event to the event queue and apply a semantic step to this configuration. This includes that we calculate all possible FTSs. For every FTS and every possible execution order of the transitions inside these sets we calculate the resulting status. It is important to note that we calculate a fix-point for this set. That means, that no new status can be reached from any calculated status. Thus we yield a set of all reachable status including all intermediate status for the first event. To store the intermediate status is important for handling possible interleavings of input and internally generated events. Second, we insert the next event to every reachable status in the previously calculated set. Thus we respect possible interleavings of events in the event queue. Then we again calculate all reachable status for this input and proceed in the same way for the remaining inputs. Consequently, we calculate the graph of all execution paths including the reachable status. Only this stepwise calculation of all reachable status ensures that all possible execution paths for the given input sequence are calculated. This includes all non-determinism in the specification (modeled and arising from the semantic model of state machines) and effects from processing events asynchronously. Figure 3 visualize the principle of the calculation of an execution graph for the abstract input sequence [a,b,c]. The red parts show the newly calculated parts in the subsequent step. For example we can see that by processing the queue [a,b] we reach different status than by processing both events separately.

In the following we illustrate the key point of the algorithm by means of an short abstract example. Let us assume that an internal event i is generated when processing an event a. Let us further assume that processing an i will produce an internal event j. For the next test case we want to process the input sequence a•b. During test execution we have to trigger the SUT first with a and then with b with an (currently) undefined time gap between the events. The challenge is that we cannot predict the actual queue of the SUT during test case generation. Consequently we do not know how event b will interleave with the internally generated events i and j. For this reason we first insert a into the queue and calculate the three reachable status:

[i],[j],[].
The first queue results from just processing a. The second results from processing a and then i and the third results from processing a, then i and then j. By inserting b into all reached queues we prepare for respecting all possible interleavings. The resulting queues are [i,b], [j,b], [b] and during the next step [b,j] which properly respects one possible interleaving. Event b will also be inserted to the queue [a] resulting in queue [a,b]. This reflects the situation that we triggered both inputs before the system under test processed the first one. Figure 3 visualize this situation in the second graph.

After processing all events from the input sequence we can identify among the set of all reached status those status which are finally reached. These status (located at the hull of the execution graph) are quiescent. That means that their event queue is empty and thus they cannot proceed without a new input from the environment. Figure 4 shows at the right side an execution graph with the reached status at the hull. We extract from these the observations that would be emitted (i.e., the events the state machine sends to the environment) when executing this particular path. The extracted observation sequences comprise all possible correct observations we can make when triggering the system under test with the input sequence. Now the idea is to treat all observations as the alphabet of a language and the calculated observation sequences as accepted words of these language. Accepted observation sequences cause the test execution to pass. All other sequences cause the test execution to fail. Now we just need to build an acceptor for the calculated observation sequence and use them as the test oracle.

Finally, we need to overcome one open problem which can arise when calculating the execution graph. We previously mentioned that we determine for an input sequence the fix-point for the reachable status. Due to the fact that state machines can generate (internal) events and produce internal infinite loops the calculation of these fix-points does not terminate in any case (we also subsume the problem that the time to calculate the fix-point is unacceptable high). To overcome this problem we limit the number of steps needed to calculate all subsequent status to an upper bound. Technically, every reached status has got a counter for the number of steps necessary to reach this status. If a counter reaches the specified upper bound we mark this status and abort further processing of this status. Figure 4 shows this in the lower left corner.

As a consequence we calculate two types of observation sequences. One which could be calculated within the given bound, and one which could not. The latter type could be interpreted as follows: all observations made so far are correct, but not all observations could be calculated. For the test execution and evaluation this means that after processing all calculated observations, we have no further observations to which we can compare the remaining outputs of the SUT. We can neither say that further observations are correct nor can we say that they are not. We can only stop testing the SUT with this input sequence and give an inconclusive test verdict. This verdict says that all observations so far are correct but that we stopped further processing the current execution path. It would also be possible to decide for a pass or a fail verdict. But introducing a third verdict allows a finer distinction of differently caused test execution results. Hence, we distinguish two sets of possible observation sequences and the acceptance graph we build out of these sets comprises two accepting nodes. One for all observation sequences which could completely be generated and one for all observation sequences which were bounded. The acceptor itself is a deterministic finite automaton accepting both sets of observation sequences. A test case execution finishing in one of these nodes results in a pass or an inconclusive verdict. All observations not covered by the acceptance graph result in a fail verdict. On the right side of Fig. 4 you can see an acceptance graph for the execution graph on the left side.

A test case comprises the input sequence to stimulate the system under test and an acceptance graph to automatically evaluate the execution of this test case. The length of a test case and the number of test cases can be influenced by the selection policy of input sequences as explained above. The generated test suite is sound. That means that no correct systems under test will be rejected due to a test case. Instead, the test verdict fail will only be assigned if the observation of the system under test cannot be explained by the possible correct observations of the specification (see the conformance relation for state machines). This is true because we calculate all possible execution paths to generate the sets of possible correct observations. With unlimited computation power and time the presented algorithm is able to compute a complete test suite, which is capable to exactly differentiate between correct and incorrect implementations.

Algorithm 1 shows the control structure of the test case generation algorithm. The loop will be executed as often as inputs should be sent to the system under test in the test case. The inner while-loop controls the fix-point calculation of reachable status. While there are newly generated status the simulation step is successively repeated to calculate all reachable status. If there are no newly generated status the algorithm proceeds with the next input event. The results of the loop are a set of all completely calculated observation sequences and a set of all incompletely calculated observation sequences. Out of these sets an acceptance graph will be calculated.

Algorithm 2 shows the calculation of the successive status for the calculated status in the previous step. First, the state machine is initialized with the configuration from the status and the next trigger event is selected from the corresponding event queue. Then, all possible FTSs and all possible transition execution orders are executed to estimate the resulting status and the generated events. This includes: saving reached configuration, adding internal events to the input queue, and saving generated events which should be sent to the environment. The latter events are the possible correct observations which we use to build the acceptance graphs. Both the successive status and the generated events will be stored in a new simulation node. The set of all new simulation nodes will be returned as the result of the simulationStep.

The presented algorithm has exponential complexity. This complexity arises from the branch factor introduced by the different sets of firing transitions, the different possible execution orders of transitions, and the necessity to consider possible interleavings in the event queue (asynchronous event processing and non-observable event store). The effort to calculate a test case grows with the length of an input sequence x and indirectly by the number of internally generated events (expressed as a functional relation: f (x)). The branch factor is bounded by the finite number of transitions and the finite number of events (c). Thus we can approximate the effort A to generate a test case for a given input sequence of length x as follows:

A(x) ∼ e c • (x + f (x)) (10)
This exponential effort is visualized in the left diagram in Figure 5 by the gray doubly dotted graph. Due to the character of state machines this exponential effort cannot be avoided when pre-calculating test oracles. To weaken this problem we are also working on strategies to split input sequences and to combine test cases, respectively.

Combining Test Sequences

When testing non-terminating reactive systems it is also interesting to execute longer input sequences. To reduce non-determinism in the specification is not possible without any further knowledge about the system under test. Thus we concentrate on the asynchronous event processing. The lion's share of the calculation effort results from respecting all interleavings of the input sequence with internal generated events. We can argue that it is not necessary to consider all of these interleavings. For example, in practice it is the case that the system under test immediately starts to process the first received input. It usually does not wait until "ten" events are received from the environment. With the distance of two events in the input queue the probability decreases that an internally generated event (as a consequence of processing the first event) interleaves with the second one.

Based on this idea we developed various strategies to reduce the calculation effort. To demonstrate the core idea we implemented a strategy where we introduce so called observation points. Observation points are points in time where we give the system under test enough time to calculate its reaction. Related to our semantic model of state machines the system under test reaches a status in which the event queue is empty. Hence, no more reaction can be produced for the given inputs. This is true for all status at the hull of the execution graph from the previous section. Continuing after such an observation point now means: to enqueue the next input to all (non-inconclusive) status on the hull of the previously calculated execution graph (note that for these status the event queue is empty). We also reset the collected possible observations and calculate the corresponding acceptance graph. This is possible because we assumed that the system under test has completely calculated its reactions. Now we proceed to calculate the possible correct observation sequences for the complete next input sequence. An improvement of this strategy is to collect possible correct observations for more than one observation point and then generate one acceptance graph for all input sequences.

The reduction in the computation effort results from the fact that we do not consider possible interleavings resulting from events in the previous input sequence with events in the next input sequence. The left diagram in Figure 5 visualizes this procedure. We repeatedly calculate only the first part of the exponential curve. The overall calculation effort follows from adding the efforts needed to calculate the observations for the individual input sequences (the red graph). The average effort has a linear gradient depicted by the blue dotted graph. Compared to the effort for processing one input sequence with the length of the sum of all sub-sequences this is an enormous reduction in the calculation effort. The effort for combined test sequences still grows exponentially with the length n of the particular input sequences but linear with the number x/n of combined sequences and consequently with the length x of the overall input sequence: As a consequence of generating multiple acceptance graphs we would over-approximate the possible correct behavior. That means that we consider more observation sequences to be correct. This follows from the fact that observation sequences from different acceptance graphs can be combined in any possible order. This would not be possible for a complete input sequence. Consequently, the generation of an acceptance graph should be delayed as much as possible (e.g., in relation to the memory consumption). The generated test cases are still sound if the introduction of observation points is valid for the SUT.

A comb (n, x) ∼ e c • (n + f (ñ)) n • x (11)
Depending on the used testing strategy we can parameterize how test cases should be generated and combined. On the one hand by the effort we need to process the total count of inputs, and on the other hand by the reduction capability when splitting the input sequence into smaller parts. Figure 6 shows the structure of a test case with multiple input sequences and corresponding acceptance graphs. When reaching a pass node we continue to trigger the SUT with the next input sequence and check the newly generated output of the SUT at the next observation point. Experiments with this "static" strategy showed that if we can introduce such observation points for the system under test this strategy works quite well. But we also work on more elaborate "dynamic" strategies (e.g., to take advantage of specific properties of used events of the event store, probabilistic strategies to specify possible event interleavings, or memory and time consumption).

Evaluating the Test Process

If a test suite is generated with the algorithm above and if a SUT is tested with this test suite we would like to know how extensively we tested the system under test. The number of test cases and the length of the input sequences in the test cases only conditionally allow to draw conclusions related to that question. Still today the question is hard to answer. The mostly used approach is to measure the coverage of different elements of the system under test or the specification. For program code this is common practice. The used criteria are usually based on control flow or data flow information in the code or on functional description in the specification. With our test approach we address embedded reactive systems composed of hardware and software components. You can apply well known techniques to measure coverage in the software components, but our impression is that this is not sufficient for such systems. To measure coverage in the hardware components is usually not possible. The only way to regard the whole system is to use the specification. In further work we develop meaningful criteria for state machines. Our current work introduces different criteria based on structural elements of state machines, like states and transitions, and on semantic elements, like configurations and sets of firing transitions. Especially semantic criteria are able to evaluate the behavior in a more meaningful manner. An interesting question is whether it is possible to use such criteria to control the test case generation process (i.e., to measure coverage while generating test cases and to select the next inputs according to this coverage).

Experimental Results

To evaluate our complete test approach we implemented the TEAGER tool suite [START_REF] Santen | Teager -Test Automation for UML State Machines[END_REF]. TEAGER consists of an environment to automatically generate and execute test cases, and additionally of an environment to execute state machine specifications. We use the latter to analyze the execution behavior and the testability of a state machine, and to measure coverage on a state machine specification to evaluate generated test suites. Figure 7 shows this general architecture. We us the TEST CASE GENERATOR to automatically generate test cases out of a state machine specification. A state machine specification is executed to compute the possible correct observation sequences for selected inputs. Based on them an acceptance graph is generated as the test oracle. Input sequences and acceptance graphs are stored for each test case in separate files for later execution. The TEST DRIVER in turn loads saved test cases and executes them. The execution includes both: stimulating the system under test and comparing the observation to the computed possible correct behavior in the acceptance graphs. The communication with the system under test takes place over a socket connection using pre-implemented adaptors. This concept offers a flexible way to connect the system under test. It also offers the possibility to use our STATE MACHINE EXECUTOR as a system under test stub. Thus we can analyze the execution behavior of state machine specification or measure the coverage of a used specification. The complete test case generation process is parameterized to have maximal control over the structure of test cases and the effort needed to calculate them. For more information about the TEAGER tool suite, its individual components, and the used parameters, we refer the interested reader to our web site (swt.cs.tu-berlin.de/ ∼ seifert/teager.html).

We applied two case studies on Pentium IV 2.6 GHz to evaluate our test case generation and execution. First, the Car Audio System from Section 2 and second, a system to control the sun blinds of an office building [START_REF] Seifert | Automatisiertes Testen asynchroner nichtdeterministischer Systeme mit Daten[END_REF]. Generally speaking the results from both case studies allow the same interpretation. In the following, we briefly review some results from the Car Audio System case study to give an impression of the execution behavior of our test approach. We present two different experiments. In the first experiment we demonstrated the exponential calculation effort needed to calculate the possible correct observations. In the second experiment we demonstrated the effect of combining multiple input sequences. We used the state machine model from Figure 1 as specification. In all experiments we generated a test suite comprising 25 test cases. In the first experiment we varied the length of the input sequence and in the second experiment we fixed the length of the input sequences but varied the number of combined sequences.

Figure 8 illustrates the results of the two experiments. The red graph in the left picture clearly shows the exponential calculation effort of the test generation process. But it also shows that a relatively long input sequence can be processed even for a complex system. The blue graph shows that executing a test case takes considerably less time, and that the time need only slightly increases the longer the input sequences are. From this it follows that the strategy to spend more time in test case generation to generate longer test cases and to save the test cases to be able to execute them multiple times is worthwhile. The blue graph (burst size of 15) and the red graph (burst size of 17) in the right picture visualize the results of the second experiment. The unequal gradients of the subsections in the graphs result from the different calculation effort for the particular inputs (which were selected by a random strategy). To verify this we executed the experiments multiple times and calculated the mean values (the lower blue graph). This graph shows that the generation times converge towards a linear graph. Additionally, we experimented with a deterministic and a non-deterministic specification (the green and magenta graph). The graphs clearly show the expected linear gradient. Finally we mention that the execution effort increases due to the higher number of observation points (which requires to wait for all system reactions). In practice, we need to choose an optimum with respect to the calculation effort and the execution time.

Summary and Outlook

Testing benefits from the fact that the actual system is brought to execution. Thus, the interaction of the real hardware and the real software can be evaluated. It is applicable at different levels of abstraction and at different stages of the development. It aims in falsification, that means to show inconsistencies between the specification and the developed system.

Our test approach allows to use UML state machines in quality assurance to precisely specify the reactive behavior of a system, and thus, to serve as the basis for the automated test case generation, execution and evaluation. To generate tests we select relevant input sequences and calculate the possible correct observation sequences for them. Based on these observations we calculate the test oracles which we use to automatically evaluate the test executions. Manually performed, this is a difficult and time consuming task. The approximation techniques we applied make the generation process efficient. It is possible to control the complete process via parameters depending on the time and computation power you want to invest. The modularization of the tasks gives our approach a clear structure and makes it interesting for further research. All discussed strategies are implemented as modules of the TEAGER tool suite. Thus, different strategies for selecting inputs, for combining test cases to reduce the calculation effort, or to select relevant data during test case generations can be studied independently from each other. Moreover, in practice this allows adaptation to different needs. We use a precisely defined semantics for UML state machines which includes complex structured data. We do not restrict state machines to ease test case generation. Instead, we follow the semantics description of the UML standard [START_REF]UML2: Unified Modeling Language: Infrastructure and Superstructure[END_REF] as much as possible. Only misleading or conflicting statements are clarified. We address all semantic details which arise from the different sources of non-determinism. In particular we address the problem of asynchronous communication which is introduced by the run-to-completion semantics of state machines. Many real life systems can show such behavior.

Our ongoing research deals with a comprehensive integration of our approach into an UML-based development. In particular we address questions: how to combine our approach with a component-based development approach and how to combine our technics with other successfully applied testing technics. Furthermore we integrate more and more syntactical elements into our formal semantics and analyze their influence on the automated test generation process. Perspectively we address two challenges, namely specifying and testing timed behavior and considering complex data to generate "interesting" test cases. We also develop techniques to control and evaluate our automated processes. Measuring coverage, especially on the specification, is one step into this direction. We are analyzing criteria based on state machines and their semantic model.

Fig. 1 .

 1 Fig. 1. State machine specification for the Car Audio System.

Fig. 2 .

 2 Fig. 2. Abstract test assembly for reactive systems.

Fig. 3 .

 3 Fig. 3. Stepwise state space exploration for the input sequence [a,b,c].

Fig. 4 .

 4 Fig. 4. Execution graph and the resulting acceptance graph with an inconclusive verdict.

Fig. 5 .

 5 Fig. 5. Linearization of the exponential Complexity.

Fig. 6 .

 6 Fig. 6. General structure of a combined test case.

Fig. 7 .

 7 Fig. 7. Architecture of the TEAGER tool suite.

Fig. 8 .

 8 Fig. 8. Results for the first and second experiment.

  Technically they are called input enabled. In summary,

		Environment
		Test Envirionment
	PCO	PCO
	seq E in	State Machine SM	seq E out
	IN	OUT


Stéphanie Klaedtke

Pierre M Stassart

Véronique Chable

Stephanie M Klaedtke
email: stephanie.klaedtke@rennes.inra.fr

An alternative approach to plant health: The procedural concept applied to common bean seed systems

Introduction

Small scale organic seed producers market seed of traditional vegetable cultivars on a national or regional scale in Western Europe. For common bean (Phaseolus vulgaris), several seed-borne pathogens represent a challenge to seed production. Common Bean Blight (CBB), caused by pathogenic bacteria, is regulated as quarantine pest in the European Union. We hypothesise that different conceptions of plant health are confronted in debates concerning the management of CBB and seed quality. While some stakeholders define plant health as "absence of disease" and objective, measurable entity, others argue for a salutogenic position focussing on more complex interactions between plants, pathogens, other microorganisms and their environment in order to evolve towards health.

Perspectives and Challenges

In the debate procedure, the rules for debating are as important as the topics themselves. While the objective here is to develop an approach to plant health from the perspective of small scale organic seed producers, the link of this perspective with its wider framework will be made by including other types of stakeholders in the research. Working with local networks and artisan techniques entails very different management strategies than the large scale seed production on a global market. It is important to note that results of this form of research are situated and contextualized. A holistic approach to research which does not consider research results without their context calls for the participation of and active interaction between stakeholders (researchers included) in a research process that is not defined beforehand.

Materials and Methods

A procedural concept for the definition of plant health, proposed by Döring et al. (2011), is applied to the case of small-scale organic bean seed production. Different conceptions can be incorporated by addressing a set of five topics. The aim is to develop an approach to plant health in partnership with concerned farmers and to reflect on the management of seed-borne diseases from their point of view. Ecological plant protection relies on interactions in the ecosystem to provide regulation of pathogens and may be more likely to embrace a salutogenic position. To explore their understanding of phytosanitary issues, a qualitative survey will be realized with bean seed producers, researchers and other stakeholders, including topics such as seed quality, seed and crop management strategies and forms of social organization.

The socio -technical network

Past research on common bean pathogens has lead to a wide range of scientific literature on the effect of pathogens on plant functions and on the development of pathogens under certain pedoclimatic conditions. It provides elements to better understand the pathosystem and to situate field observations.

Pathosystem and biology

The epidemiological development of pathogenic bacteria is strongly dependent on plantpathogen-environment interactions and farmer practices. Since 2012, 4 traditional bean varieties and one commercial check are produced and resown on 3 farms with contrasting pedoclimatic conditions in France and Luxembourg. The development of seed-borne diseases in the plant populations is assessed over 3 growing seasons.

Epidemiological aspects

Specific adaptation of crops to their environment and the interaction of plants and beneficial microorganisms are considered important factors for crop resilience in an alternative approach to plant health. In the field trials, the specific adaptation of bean cultivars is studied, as well as their interactions with symbiotic soil microorganisms (arbuscular mycorrhizal fungi and Rhizobium sp.) and seed microbial communities.

Crop environment

Small-scale organic producers of traditional bean cultivars are seldom interested in the genetic yield potential under optimal conditions, but rather in the adaptation to their local crop environment. Beyond grain yields and measurable product quality, the role of local agricultural systems and the importance of agro-biodiversity are only two topics that need to be discussed for individual communities.

Anthopocentric perspective

  Döring T F, Pautasso M, Finckh MR & Wolfe MS (2012): Concepts of plant health -reviewing and challenging the foundations of plant protection: Concepts of plant health. Plant Pathology 61, 1-15.

  eprint number 24027 SOLIBAM (Strategies for Organic and Low input Integrated Breeding and Management -2010-2014) is funded by the European Community's Seventh Framework Programme (FP7/2007-2013) under the grant agreement n. 245058. The PhD research is supported by the Fonds National de la Recherche, Luxembourg (project 5126594).


domain: sdv sde

text:
Françoise Watteau

Jean-Claude Begin

Hermine Huot

Geoffroy G Séré

Jean-Louis Morel

Micropedology to understand Technosol functioning: technogenic substrate structures on thin sections

Keywords: Technosol evolution, micromorphology, biological activity, soil processes

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Micropedology to understand Technosol functioning: technogenic substrate structures on thin sections

Françoise WATTEAU, Jean-Claude BEGIN, Hermine HUOT, Geoffroy SERE, Jean Louis MOREL Laboratory of Soils and Environment, UL-UMR INRA 1120, Vandoeuvre les Nancy, France Micropedology contributes to provide a better understanding of soil processes. Technosol micromorphology may so improve the knowledge about the evolution and future management of such soils (Adderley et al., 2010). Large sources of technogenic substrates and diversity of soil processes justify the importance to identify anthropogenic microstructures and to specify their formation and evolution in terms of mineral weathering, organic matter degradation or aggregate formation. Such qualitative information may also be correlated to porosity quantification by images analysis of thin sections (Jangorzo et al., 2013). Here, we studied two contrasted Technosols: (1) a 10year constructed one for which we characterized the parent materials (paper mill sludge, green waste compost and thermally treated material) and the micromorphology at several different times after the set up of the soil (Séré et al. 2010) and (2) a 60-year Technosol developing on iron industry deposits where a forest has established (Huot et al., 2014) for which thin sections of the different layers were morphologically characterized and some analysed by SEM-EDS. Regarding the specificity of the Technosol constituents (e.g. hydrophobicity, coarse texture), the preparation of soil thin sections has been adapted. Such various anthropogenic features as paper-mill sludge, thermally treated material, droplets or laminar structures of iron industry deposits were identified as specific microstructures. Biological activity was underlined by evidences of the progressive degradation of the organic matter brought by the constructed Technosol's parent materials, but also by new associations formed with organic constituents coming from the spontaneous colonising plants. Organo-mineral associations were also described showing the aggregation genesis due to the impact of pedological factors.

Micropedology has to be developed in the study of Technosol pedogenesis. It can so be considered as a relevant tool to study the evolution of man-made soils, as it is well-adapted to consider the diversity of the Technosol constituents, their large heterogeneous spatial localization and the specific intensity of soil processes.


Erwan Cutullic

Luc Delaby

Philippe Faverdin

Low protein degr adability and precision protein feeding improve nitrogen efficiency of dairy cows

EAAP -65 th Annual Meeting, Copenhagen 2014

Animal per for mance and carcass char acteristics of cattle fed different levels of yer ba mate A. Berndt 1 , M.P. Vidal 1 , R.T. Nassu 1 , R.R. Tullio 1 , M.E. Picharillo 1 and D.R. Cardoso 2 1 EMBRAPA Southeast Livestock, Rod. Washington Luiz, 234, P.O. Box 339, 13560970, Brazil, 2 Chemistry Institute of São Carlos -IQSC/USP, Av. Trab. São Carlense, 400, P.O. Box 780, 13560970, Brazil; alexandre.berndt@embrapa.br Animal performance and carcass characteristics of cattle fed diets containing different levels of yerba mate (Ilex paraguariensis, St. Hilaire) were evaluated in order to obtain a healthier and higher oxidative stability meat. Forty-eight Nellore steers with an average age of 21 months and an initial weight of 419 kg were individually fed during 94 days with the same base diet, differing only by yerba mate levels (0, 0.5, 1.0 and 1.5% w/w). Diets were composed of maize silage and concentrate (60:40 w/w) with 11% crude protein and 72% of total digestible nutrients. Diets were balanced using 0, 0.5, 1.0 and 1.5% w/w of Kaolinite (kaolin), an inert ingredient. The experimental design was completely randomized with 4 treatments and 12 replications, with diet as a ¿ xed factor. Dry matter intake (DMI) was calculated by weighting offer and leftover daily. Animal live weights were obtained every 28 days. Hot carcass weights were collected immediately after slaughter and the rib eye area and backfat thickness were measured in longissimus muscle between the 12 th and 13 th ribs. Statistical data treatment was performed using XLSTAT statistical program with a signi¿ cance level, P-value, at 0.05. There were no signi¿ cant differences (P-value>0.05) between diets in DMI, average daily gain, feed conversion, fasted slaughter weight, hot carcass weight, carcass yield, backfat thickness and rib eye area. The addition of yerba mate extract, at vaying levels from 0.5 to 1.5% w/w, in the diet of feedlot cattle did not affect performance and carcass characteristics of the animals, showing expected values for feedlot-¿ nished Nellore cattle. These results were positive as the use of the yerba mate is recent and there is a lack of information about the use of yerba mate as an antioxidant in diets for beef cattle.

Low protein degr adability and precision protein feeding improve nitrogen ef¿ ciency of dair y cows E. Cutullic 1,2 , L. Delaby 1,2 , N. Edouard 1,2 and P. Faverdin 1,2 1 Agrocampus Ouest, UMR1348 PEGASE, Rennes, 35000, France, 2 INRA, UMR1348 PEGASE, St-Gilles, 35590, France; philippe.faverdin@rennes.inra.fr

The low ef¿ ciency of nitrogen (N) intake in dairy cows can increase feed costs and ammonia emissions. At the rumen level, decreasing degradable N to improve the urea reuse in microbial protein synthesis, can increase N ef¿ ciency (Neff=Nmilk/Nintake). Moreover, at the animal level, the metabolisable protein (MP) ef¿ ciency varies greatly between dairy cows. Applying precision feeding, with adjustment of the diet according to individual observations, could increase this MPeff. The objective of this study was to improve both N and MP ef¿ ciencies by combining a reduction in rumen degradable protein (RDP, factor N) with an individual adjustment of MP content in the diet (factor E) in a 2×2 factorial design with 4 groups of 11 cows for 12 weeks fed maize-based diet. Factor N was either at the reference level of INRA for RDP (N0) or at a reduced level (N-10) of -1.4 g of degradable protein per MJ of net energy for lactation (NEL). Factor E was either constant with 14.8 g of MP per MJ NEL (EC), or variable (EV), from 12.0 to 15.5 g MP/ MJ NEL and calculated for each cow according to its MPeff on a 4-week reference period. The lower the ef¿ ciency was, the lower the applied MP/NEL ratio was. No interaction occurred between the 2 factors. The decrease in RDP had no signi¿ cant effect on intake and production. The milk production of EV was 1.7 kg/ day lower than EC, but the energy ef¿ ciency (kg of milk/kg of DMI) was unchanged. The RDP reduction improved Neff (35.7 vs 32.2%) and individual protein feeding mainly improved MPeff (69.1 vs 59.3%). Between extreme treatments (N0_EC vs N-10_EV), crude protein content decreased from 14.9 to 12.5%, Neff varied from 32.1% to 36.4%, and estimated urine urea-N excretion was reduced by 56%. Reducing degradable N content of the diet and applying precision feeding to dairy cows fed indoors is thus a way to better use proteins and to reduce ammonia emissions.

Session 48

Theatre 5

Session 48 Theatre 4


Pierre Fernique

Anaëlle Dambreville

Jean-Baptiste Durand

Christophe Pradal

Pierre-Eric P.-E Lauri

Frédéric Normand

Yann Guédon

Pierre- Eric Lauri

Characterization of mango tree patchiness using a tree-segmentation/clustering approach

Keywords:

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.