Mireille Chevallet

Catherine Aude-Garcia

Cécile Lelong

Serge M Candéias

Sylvie Luche

Véronique Collin-Faure

Sarah Triboulet

Dévy Diallo

Hélène Diemer

Alain Van Dorsselaer

T Rabilloud
email: thierry.rabilloud@cea.fr

Effects of nanoparticles on murine macrophages

la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers,

Introduction

Nanoparticles (NPs) are increasingly used for developing new tools for biotechnology, as well as manufacturing widely-used products. They offer interesting properties, regarding for example electromagnetic characteristics, mechanical properties, chemical and/or biological reactivity. Nanoparticles can be used for medical imaging and drug delivery, as well as for electronic devices [START_REF] Govender | Polymeric nanoparticles for enhancing antiretroviral drug therapy[END_REF][START_REF] Karlsson | Copper oxide nanoparticles are highly toxic: a comparison between metal oxide nanoparticles and carbon nanotubes[END_REF][START_REF] Maesaki | Drug delivery system of anti-fungal and parasitic agents[END_REF][START_REF] Kumar | Nanoparticle-mediated gene delivery: state of the art Expert[END_REF][START_REF] Wang | Nanoparticles for multiplex diagnostics and imaging[END_REF]. Moreover, many household products contain NPs of metal oxides, such as sunscreens, cosmetic products, or clothes [START_REF] Fahmy | Copper oxide nanoparticles induce oxidative stress and cytotoxicity in airway epithelial cells[END_REF][START_REF] Kasemet | Toxicity of nanoparticles of ZnO, CuO and TiO2 to yeast Saccharomyces cerevisiae[END_REF]. New tools have also been developed for biotechnology and life sciences, using metallic NPs as well as nanotubes, nanowires or quantum dots [START_REF] Hussain | In vitro toxicity of nanoparticles in BRL 3A rat liver cells[END_REF]. This massive development of nanotechnologies requires studies to assess potential associated biological risks.

Thus, there is an important corpus of literature assessing the effects of nanoparticles on living organisms. This literature can be split in two types of studies: on the one hand, there are in vivo studies on animal models where macroscopic results can be obtained [START_REF] Briley-Saebo | Hepatic cellular distribution and degradation of iron oxide nanoparticles following single intravenous injection in rats: implications for magnetic resonance imaging[END_REF][START_REF] Sadauskas | Protracted elimination of gold nanoparticles from mouse liver[END_REF][START_REF] Lam | Pulmonary toxicity of single-wall carbon nanotubes in mice 7 and 90 days after intratracheal instillation[END_REF][START_REF] Oberdorster | Manufactured nanomaterials (fullerenes, C60) induce oxidative stress in the brain of juvenile largemouth bass[END_REF]. However, because of the short lifespan of laboratory animals, long-term effects are difficult to derive. Moreover, the in vivo systems are so complex that it is almost impossible to get mechanistic data that would help to predict long term effects. On the other hand, there are in vitro studies on cells [START_REF] Fahmy | Copper oxide nanoparticles induce oxidative stress and cytotoxicity in airway epithelial cells[END_REF][START_REF] Hussain | In vitro toxicity of nanoparticles in BRL 3A rat liver cells[END_REF][START_REF] Jin | Cytotoxicity of titanium dioxide nanoparticles in mouse fibroblast cells[END_REF][START_REF] Kwon | Dose-dependent cytotoxicity of clinically relevant cobalt nanoparticles and ions on macrophages in vitro[END_REF][START_REF] Lanone | Comparative toxicity of 24 manufactured nanoparticles in human alveolar epithelial and macrophage cell lines Part Fibre[END_REF][START_REF] Wagner | Cellular interaction of different forms of aluminum nanoparticles in rat alveolar macrophages[END_REF][START_REF] Waters | Macrophage responses to silica nanoparticles are highly conserved across particle sizes[END_REF]]. This simplified system can be used to derive mechanistic data. However, most of this literature focuses on a few cellular parameters (survival, oxidative stress, cytokine productions) so that very little is known on the possible responses elicited by nanoparticles on cells.

In order to bring new, mechanistic knowledge, we have decided to use a wide-scope, proteomics approach. As a cell type, we have chosen the macrophage, i.e. the specialized cell type that will scavenge bacteria or viruses [START_REF] Mosser | Exploring the full spectrum of macrophage activation[END_REF] as well as any type of particulate material, nanoparticles [START_REF] Shukla | Biocompatibility of gold nanoparticles and their endocytotic fate inside the cellular compartment: a microscopic overview[END_REF]. Indeed, macrophages have been shown to be key players in the toxicity of asbestos fibers and silica nanoparticles, and thus in the etiology of asbestosis and silicosis, by the virtue of their stress response to the phagocytosis of these particles [START_REF] Dostert | Innate immune activation through Nalp3 inflammasome sensing of asbestos and silica[END_REF].

Thus, we have decided to apply proteomics to investigate the response of macrophages to TiO2 considering that this NP is widely produced and therefore, potential widespread exposure may occur during both manufacturing and use. We also compared the effects of TiO 2 with Cu, which at the difference of TiO 2 is a redox metal and can release cupric ions which can be toxic for cells. Moreover, Cu-NPs are also widely-used NPs because of their antibacterial properties. This work has shown changes in the central cellular metabolism, as well as a peculiar oxidative stress response.

Materials and methods

Mice

C57BL/6 mice were bred in the animal facility of the Commissariat à l'Energie Atomique, Grenoble, France. For hind legs recovery, 10-20 week-old mice were sacrificed by cervical dislocation in accordance with Atomic Energy Commission Care and Use Committee.

Primary macrophages

Unless otherwise stated, all chemical reagents and cell culture products were purchased from Sigma-Aldrich (Saint Quentin Fallavier, France). Murine primary macrophages were generated from bone marrow as described [START_REF] Schleicher | Generation, culture and flow-cytometry characterization of primary mouse macrophages[END_REF]. Briefly, the bone marrow cavities of femurs and tibiae were flushed several times with BM20 medium (DMEM supplemented with 10% FCS, 20% L929 cell-conditioned medium as a source of M-CSF, 5% horse serum, 1% glutamine and 1% sodium pyruvate). 40-60 x 10 6 cells were recovered per mouse and cultured in 50 ml of the same medium. At day 7, the supernatant was removed. Adherent cells were incubated for 10 min at 4°C in cold 0.02%EDTA in PBS. Cells were then recovered and transferred in 50 ml BM10 medium (same as BM20 but with 10% L929 cellconditioned medium) for 3 additional days. 20-30 x 10 6 cells were generated at the end of the differentiation process and most of the resulting cells (> 90%) were CD11b and CD14 positive, as assessed by flow cytometry. These mature macrophages, derived from bone marrow exactly as occurs in vivo, are therefore a good model of all the macrophages that exist in vivo, alveolar as well as peritoneal, dermal or hepatic.

Flow cytometry analysis

For the analysis of cell surface protein expression, bone marrow-derived macrophages were stained for 30 min at 4°C with conjugated antibodies in PBS containing 3% fetal calf serum and 0.16% sodium azide. Anti-CD11b and PE-conjugated anti-CD14 were from CliniScience (Montrouge, France), FITC-conjugated anti-CD86 (B7-2) and PE-conjugated anti IA b were from BD Pharmingen (le Pont de Claix, France). Data acquisition and analysis were performed with a FacsCalibur flow cytometer equipped with CellQuest software (Becton Dickinson).

Preparation of nanoparticle suspensions

Titanium oxide (TiO 2 , anatase, < 25nm, 99.7% purity) and Copper (Cu, < 50nm, 99.5% purity) were purchased from Sigma-Aldrich (France). For their sterilization, the NPs were suspended in 95% ethanol, at a concentration of 10 mg/ml. After 1h incubation at room temperature, the NPs were diluted to a final concentration of 1 mg/ml in polyvinylpyrrolidone 40 (PVP40) 0.2%, sonicated in a bath sonicator for 1h and stored at 4°C. PVP40 increases the dispersions of the NPs but there is still some aggregation in the culture media. Characterization of the particle size distribution was performed by Dynamic Light Scattering measurements (DLS) which indicated a Z-average of 318.9 nm for TiO2 NPs and of 427.8 nm for Cu NPs after 24h incubation in culture media. We chose to perform this polymer coating to mimic the opposite phenomena occurring when nanoparticles are in contact with a biological fluid, whether it is pulmonary surfactant, saliva, lymph or blood. On the one hand the salt concentration present in all these fluids promote aggregation, so that nanoparticles are never as dispersed in biological media as they can be in air or in pure water. On the other hand, the polymeric materials present in biological fluids (polysaccharides, proteins) will act as coating agents and limit particle aggregation. We have used PVP 40 for its lack of interference with our analyses, while being perfectly biocompatible and able to limit particles aggregation.

Exposure of macrophages to nanoparticles

Cells (5x10 6 ) were cultured in Petri dishes and treated for 24h with either 100 µg/ml TiO 2 or 10 µg/ml Cu-NPs. Two types of negative controls were done with and without PVP40.

Two-dimensional electrophoresis

Primary macrophage cells were harvested by scraping, rinsed 2 times in phosphate-buffered saline and pellets were suspended in homogeneization buffer (0.25 M sucrose, 10 mM Tris-HCl, pH 7.5, 1 mM EDTA). A buffer volume approximately equal to the packed cell volume was used. The suspension was transferred to polyallomer ultracentrifuge tubes, and cells were lysed by the addition of 4 volumes (respective to the suspension volume) of 8.75 M urea, 2.5 M thiourea, 25 mM spermine and 13 mM Tris carboxyethylphosphine. After 1 hour at room temperature, the extracts were centrifuged (30 min at 200,000 x g). The supernatant was collected and the protein content was determined by the Bradford protein assay using bovine serum albumin as a standard. The protein extracts were stored at -20 °C. The first dimension of electrophoresis was performed with immobilized pH gradients for isoelectric focusing. Linear 4-8 pH gradients were used. Home-made pH gradient plates were cast and cut into 4mm-wide strips [START_REF] Gorg | Two-dimensional electrophoresis of proteins in an immobilized pH 4-12 gradient[END_REF][START_REF] Rabilloud | Sample application by in-gel rehydration improves the resolution of two-dimensional electrophoresis with immobilized pH gradients in the first dimension[END_REF]. A total of 150 µg of proteins were diluted in 560 µl of rehydratation buffer (7 M urea, 2 M thiourea, 4% CHAPS, 0.4% ampholytes, 100 mM dithiodiethanol). The samples were applied onto the strips by in-gel rehydration overnight using a thiourea-urea mixture as denaturing agent [START_REF] Rabilloud | Improvement of the solubilization of proteins in two-dimensional electrophoresis with immobilized pH gradients[END_REF]. IEF was carried out for 60,000 Vh at a maximum of 3000 V using the Multiphor II system (Amersham-Pharmacia, Sweden). Strips were then equilibrated for 20 min in 0.15 M BisTris/0.1 M HCl, 6 M urea, 2.5% SDS, 30% glycerol. Strips were placed on top of a SDS-polyacrylamide gel. After migration, the gels were stained with silver [START_REF] Sinha | A new silver staining apparatus and procedure for matrix-assisted laser desorption/ionization-time of flight analysis of proteins after two-dimensional electrophoresis[END_REF]. Expression ratios were estimated by image analysis of pairs of gels with the Delta2D software (DECODON GmbH, Greifswald, Germany). Spots of interest (ratio >1.5) were cut and analysed by MS/MS.

MS/MS analysis

In gel digestion was performed with an automated protein digestion system, MassPrep Station (Waters Corp., Milford, USA). The gel plugs were washed twice with 50 µL of 25 mM ammonium hydrogen carbonate (NH 4 HCO 3 ) and 50 µL of acetonitrile. The cysteine residues were reduced by 50 µL of 10 mM dithiothreitol at 57°C and alkylated by 50 µL of 55 mM iodoacetamide. After dehydration with acetonitrile, the proteins were cleaved in gel with 10 µL of 12.5 ng/µL of modified porcine trypsin (Promega, Madison, WI, USA) in 25 mM NH 4 HCO 3 . The digestion was performed overnight at room temperature. The generated peptides were extracted with 60% acetonitrile in 5% acid formic. NanoLC-MS/MS analysis was performed using an Agilent 1100 series nanoLC-Chip system (Agilent Technologies, Palo Alto, USA) coupled to an HCT Plus ion trap (Bruker Daltonics, Bremen, Germany). The chip was composed of a Zorbax 300SB-C18 (43 mm × 75 m, with a 5 m particle size) analytical column and a Zorbax 300SB-C18 (40 nL, 5 m) enrichment column. Elution of the peptides was performed at a flow rate of 300 nL/min with a 8-40% linear gradient (solvent B, 98%ACN/0.1%FA) over 7 first minutes. The voltage applied to the capillary cap was optimized to -1750V and the mass range was 250-2500 m/z. For tandem MS experiments, the system was operated Data-Dependent-Acquisition (DDA) mode with automatic switching between MS and MS/MS. The three most abundant precursor ions were selected to be further isolated and fragmented. The MS/MS scanning was performed in the ultrascan resolution mode at a scan rate of 26.000 m/z per second. A total of six scans were averaged to obtain an MS/MS spectrum. The system was fully controlled by the ChemStation (v 5.3) and EsquireControl (Rev B.01.03) software (Agilent Technologies and Bruker Daltonics, respectively). For protein identification, the MS/MS data were interpreted using the MASCOT 2.2.0. algorithm (Matrix Science, London, UK). Spectra were searched with a mass tolerance of 0.2 Da in MS and MS/MS modes, allowing a maximum of one trypsin missed cleavage. Carbamidomethylation of cysteine residues and oxidation of methionine residues were specified as variable modifications. Following the guidelines for proteomic data publication [START_REF] Carr | The need for guidelines in publication of peptide and protein identification data: working group on publication guidelines for peptide and protein identification data[END_REF][START_REF] Wilkins | Guidelines for the next 10 years of proteomics[END_REF], and to avoid consideration of poor quality data, filtering criteria based on probability-based scoring of the identified peptides have been taken into account for high confidence identification and a decoy database was generated and searched to determine false positive rate in protein identification [START_REF] Elias | Target-decoy search strategy for increased confidence in largescale protein identifications by mass spectrometry[END_REF]. The Scaffold software (v.3, Proteome software Inc., Portland, OR) was used in order to validate identification using the following criteria: spectra were searched against a target-decoy version of the UniProtKB/SwissProt database restricted to Mammalia downloaded in January 2010 (1028424 target and decoy entries). Protein identifications were validated when at least two peptides with Mascot identity scores of greater than 10 were detected.

Results and discussion

Before adding the NPs onto the bone marrow-derived macrophages, we checked by flow cytometry that these cells were mature macrophages, expressing both CD11b and CD14. Moreover, the cells obtained could be activated by LPS, as shown by release of TNF and NO (data not shown). Using fluorescent beads, we also verified by flow cytometry that they were phagocytic. The concentration of NPs used was determined beforehand by viability tests (LD20). These doses are not intended to represent doses for a given body weight and a typical exposure. However, they are legitimate for a mechanistic study to exemplify what deleterious mechanisms can be at play during pathogenesis. Moreover, it should be kept in mind that doses per body weight are also an approximation, and that "overloads" can exist locally in vivo, e.g. in the dermis just below a wound in the case of cutaneous exposure, and that a single dose in vitro can also mimic the accumulation of low doses occurring vivo during the lifespan of a macrophage, as macrophages are known to accumulate nanoparticles [START_REF] Sadauskas | Protracted elimination of gold nanoparticles from mouse liver[END_REF]. Furthermore, in the case of cancers where a single event can lead to the pathology, this "hotspot" model is relevant. We performed two comparative proteomics analysis: control versus TiO 2 treated cells and control versus Cu treated cells.

Analysis of total proteome changes after NPs-TiO 2 exposure

A total of 9 protein spots with an increased intensity as well as 1 spot with a decreased intensity after TiO 2 treatment could be detected (Figure 1, Table 1). They were excised from gels and analyzed by MS. All these spots were identified. TiO 2 treatment altered metabolism as showed by increase of spots corresponding to malate deshydrogenase, aldehyde deshydrogenase and glucosidase. We also observed an increase in VDAC (mitochondrial porin), peroxiredoxin 4 (Prx 4), normal form and proteasome alpha6 subunit, which are usually seen in various stress conditions. All these proteins belong to the "déjà vu in proteomics" [START_REF] Petrak | Déjà vu in proteomics. A hit parade of repeatedly identified differentially expressed proteins[END_REF][START_REF] Wang | Generally detected proteins in comparative proteomics -A matter of cellular stress response?[END_REF]. Cells responded to such a "light stress" by increasing general metabolism and some classical proteins. We identified some more original proteins: Gnb1, a G-protein implicated in signal transduction, ferritin (light chain) implicated in iron homeostasis and O 2 -regulated protein, which is activated by hypoxia. This suggests that TiO 2 treatment may induce hypoxia-like conditions. At last, we noted that the subunit c1 of H + lysosomal pump was decreased. It is not surprising that the lysosomal pathway is altered by NPs phagocytosis as it is known that NPs can use the endosomelysosome pathway [START_REF] Shukla | Biocompatibility of gold nanoparticles and their endocytotic fate inside the cellular compartment: a microscopic overview[END_REF].

Analysis of total proteome changes after NPs-Cu exposure

The same process was repeated for the 6 protein spots increased after Cu treatment and for the one with decreased intensity (Figure 2, Table 1). Again, Cu treatment increased some proteins spots belonging to metabolism and "déjà vu" in proteomics, such as ATPase subunit d, prohibitin and HSP70 (chaperone). Cells responded to stress by increasing metabolism, energy production and by increasing chaperones for protein refolding. More interestingly, an increase in heme oxygenase and peroxiredoxin1 (Prx 1), oxidized form was a signature of an oxidative stress response. In basal condition, this spot is very weak but increased almost 4 times upon Cu treatment. The oxidized spot level of Prx is a well-known indicator of the oxidative injury to the cell [START_REF] Rabilloud | Proteomics analysis of cellular response to oxidative stress. Evidence for in vivo overoxidation of peroxiredoxins at their active site[END_REF]. Heme oxygenase is generally induced when the level of free heme increases and this is associated to an oxidative stress. Moreover, heme oxygenase appears to be a potential defense against oxidative stress [START_REF] Stocker | Induction of haem oxygenase as a defense against oxidative stress Free[END_REF]. This result is consistent with a metal redox stress. In addition, two proteins implicated in endosome-lysosome pathway were also modified. MVB prot 4b was decreased and the d1 subunit of H + lysosomal pump was increased.

Comparison of total proteome changes after TiO 2 -NPs and Cu-NPs exposure

When we compared the two lists of proteins, we observed that there was no protein in common (table1). In both cases, we found metabolic proteins and classical stress proteins. We found more of these groups of proteins after TiO 2 treatment than after Cu treatment. However, Cu treatment appeared to be more toxic as it clearly induced oxidative stress. With TiO 2 treatment, we just noted an increase in the normal form of Prx 4, while Cu induced an important increase in oxidized forms of Prx 1 and of heme oxygenase. Peroxiredoxins are enzymes detoxifying reactive oxygen species, but they can get inactivated by oxidation in case of severe oxidative stress [START_REF] Rabilloud | Proteomics analysis of cellular response to oxidative stress. Evidence for in vivo overoxidation of peroxiredoxins at their active site[END_REF]. Presence of oxidized form is thus a signature of a deleterious oxidative stress. It is not surprising that Cu, which is a redox metal, generated such an oxidative stress. After TiO 2 treatment, ferritin was increased, possibly to protect the cell against free iron and oxidative stress. In addition, the two NPs affected the endosome-lysosome pathway even if we did not find the same proteins and found that two subunits of the same complex (H + lysosomal pump) varied in an opposite way.

The results obtained were different in terms of proteins but consistent in terms of function (metabolism, core stress response and endosome-lysosome pathway). Cu-NPs appeared in our conditions to be more toxic than TiO 2 -NPs, and responsible of an oxidative stress. We observed with proteomics specific effects of Cu or TiO 2 -NPs treatment. The fact that we did not observe the same list of proteins with these two different NPs showed that NPs toxicity is depending primarily of the nature of the NPs.

Perspectives

From the above, proteomics appears to be a relevant approach for mechanistic studies of cellular responses to nanoparticles. However, it must be kept in mind that such mechanistic studies are hypothetical and must be ultimately verified on relevant in vivo models. Nevertheless, this preliminary study showed specific effects of Cu-NPs and TiO 2 -NPson murine bone-marrow macrophages. In this study, we looked at total cell extracts and thus only at more abundant and soluble proteins. To get further insights into the cell response to NPs, it will be of great interest to investigate different compartments and/or sub fractions of the cells. Such studies will bring more information on NPs toxicity pathways. We also consider to investigate toxicity of other NPs of different size and nature, to determine if a general pattern emerges or if each NP elicits a unique response.

Figure 1 .

 1 Figure 1. Comparison of the total extract patterns of control primary macrophages and TiO 2 -NPs treated cells. Primary macrophages were treated with 100 µg/ml TiO 2 -NPs for 24h. 150 μg of total proteins were separated by 2-D and detected with silver staining as described in Section 2. Gel images were analyzed by Delta-2D. (A) control cells, (B) TiO 2 -NPs treated cells. Solid and empty arrows point at increased (≥1.50-fold) and decreased (≤0.67) proteins, respectively.Cells responded to such a "light stress" by increasing general metabolism and some classical proteins. We identified some more original proteins: Gnb1, a G-protein implicated in signal transduction, ferritin (light chain) implicated in iron homeostasis and O 2 -regulated protein, which is activated by hypoxia. This suggests that TiO 2 treatment may induce hypoxia-like conditions. At last, we noted that the subunit c1 of H + lysosomal pump was decreased. It is not surprising that the lysosomal pathway is altered by NPs phagocytosis as it is known that NPs can use the endosomelysosome pathway[START_REF] Shukla | Biocompatibility of gold nanoparticles and their endocytotic fate inside the cellular compartment: a microscopic overview[END_REF].

Figure 2 .

 2 Figure 2. Comparison of the total extract patterns of control primary macrophages and Cu-NPs treated cells. Primary macrophages were treated with 10 µg/ml Cu-NPs for 24h. 150 μg of total proteins were separated by 2-DE and detected with silver staining as described in Section 2. Gel images were analyzed by Delta-2D. (A) control cells, (B) Cu-NPs treated cells. Solid and empty arrows point at increased (≥1.50-fold) and decreased (≤0.67) proteins, respectively.

Table 1 .

 1 Ratio NPs/control of the spots intensities measured by Delta 2D software on silver stained 2D gels.

	TiO 2		Cu
	VDAC 2	2.420	HSP 70	2.800
	Aldehyde deshydrogenase	2.240	Prohibitin	1.733
	Prx 4, normal form	1.793	ATPase subunit d	1.700
	Proteasome  6	1.763
	Glucosidase	1.737
	Malate deshydrogenase	1.498
	Ferritin (light chain)	5.630	Prx 1, oxidized form	3.920
	O 2 regulated protein	1.892	Heme oxygenase	3.250
	Gnb1	1.468	H+ lysosomal pump d1	1.670
	H+ lysosomal pump c1	0.580	MVB Prot 4b	0.652

Acknowledgments

This project belongs to the NanoBioMet consortium and is partially financed by the Toxicology transversal program.


Valérie-Anne Nicolas
email: vnicolas@univ-brest.fr

On Introducing Built-In Test for Software Components in AADL Models

This paper presents preliminary ideas to include a kind of built-in self-test for systems embedded software components. The study promotes contract-based testing applied to AADL modeling of hardware/software systems. The aim is first to help evaluating the testability of software components embedded in such systems, and next to improve the integration step, especially in the context of COTS design and development. We introduce an architecture to include a generic test system inside an AADL model, and then test specifications to handle the testing process. The paper exposes the main ideas of the proposed approach and its modeling but no implementation work. Next stage is an implementation work to assess the feasibility and the benefits of the proposed approach.

Introduction

COTS (Commercial Off-The-Shelf) based system design and development is a way to build new systems using already available components. Since the 90's, this technology is more and more widely used as it reduces components cost and development time, and promises better system performance and quality. However, experience revealed some drawbacks: increase in software component integration work, lack of precise specification and control of the components. The difficulty to figure out what is the real behavior of a component in a specific context leads to a complex yet not safe integration work.

We believe that testing is a way to tackle these difficulties. This paper presents a built-in self-test way to apply contract-based software testing [START_REF] Deveaux | Reliable Objects: Lightweight Testing for OO Languages[END_REF] to embedded software components in systems of hardware and software components. We use AADL [START_REF] Feiler | The Architecture Analysis & Design Language (AADL): An Introduction[END_REF] for system modeling purpose.

The paper is organised as follows: we first introduce the AADL language in section 2, and next contractbased testing in section 3. In section 4, we sketch our approach. In section 5, we present the proposed test architecture and the associated test engine and test specifications. We end with a discussion and a conclusion.

AADL Language

The AADL language (Architecture Analysis and Design Language) is a component-based hierarchical architecture design language [START_REF] Feiler | The Architecture Analysis & Design Language (AADL): An Introduction[END_REF]. AADL is a SAE standard [START_REF] Sae | Architecture Analysis & Design Language (AADL)[END_REF] whose first version V1.0 was published in 2004, and the second version V2.0 in 2009. The language benefits from an active community and is still evolving, being improved and including new functionalities and tools supported by the Open Source AADL Tool Environment (OSATE [START_REF]An Extensible Open source AADL Tool Environment (OSATE)[END_REF]).

First intended for avionics specific needs, AADL offers facilities to specify and model real-time embedded systems following an MDE (Model-Driven Engineering) approach. It allows the description of hardware and software components of distributed realtime embedded systems in a graphical and textual framework. A component (system, process, thread, subprogram, data, processor, bus…) is specified by an interface and properties (e.g. behavior, source code…). Components are linked by connections.

Applications in the scope of AADL have a high level of criticality and have to deal with hard constraints while executing (tasks scheduling…). AADL allows the specification of behavioral properties of components for specific analyses (e.g. nonfunctional properties such as temporal constraints) or automatic validation purpose using language annexes. Execution platforms also exist, based on code generators for several languages and associated runtimes [START_REF] Hugues | From the Prototype to the Final Embedded System Using the Ocarina AADL Tool Suite[END_REF]. From an AADL model it is then possible to automatically generate an executable code. Running it allows to collect or verify some functional properties about the system integration. One may think that it could also be used to run test data. But to our knowledge, testing needs are addressed by neither AADL core language nor annexes.

Contract-based testing

In component-based software engineering (using COTS), choosing the right component to achieve a given role in a specific integration context is not so easy. User must know, from the design phase, if a potential component fits his integration constraints. In other words, he needs a specification stating very precisely the component's behavior and using context, without entering implementation details. This is the notion of contract of a component, introduced in the Design by Contract approach for oriented-object languages [START_REF] Meyer | Object-Oriented Software Construction[END_REF]. This approach is especially implemented by the Fractal Architecture Description Language [START_REF]Component-based architecture: the Fractal initiative[END_REF]. Beside this, contracts are also used to build selftestable classes for object-oriented languages [START_REF] Deveaux | Reliable Objects: Lightweight Testing for OO Languages[END_REF]. We believe that this work can be transferred to AADL software components.

Built-In Self-Test for AADL

Context

As mentioned in section 2, AADL is dedicated to highly critical system design. AADL tools focus on the analysis of critical non-functional properties resulting from the integration of components, leaving aside the behavior of single components. This methodological choice is entirely consistent with COTS based system design and development, where components should be considered safe and reliable. However, experience shows that this assertion is not always guaranteed because of specification incompletness concerning system integration. Even if a single component may be considered safe, what about its real behavior in a specific integration context? What are the true context requirements (preconditions) needed by a component? These are real problems encountered during system integration of COTS components. They are especially true in AADL where bindings between software and hardware components are specified during the design stage. To face these difficulties, we believe it should be useful to be able to evaluate a software component behavior, on well chosen data, embedded inside its specific software/hardware integration context. The test approach sketched next section goes in that direction, and even further as it may also be used for maintenance.

Proposed test approach

The study outlined here is about a built-in self-test approach for AADL models. The idea is to adapt the hardware BIST concept to AADL software architectures. We chose the built-in characteristic to fit with AADL purposes of integration, reuse and validation during the design stage. Another reason is that it greatly facilitates future maintenance of the system. The self-test aspect is intended to automate as much as possible the test effort. Nowadays, most hardware components include BIST. That is why we focus here on the software parts of an AADL model. Unlike hardware, there is no generic software fault model. We therefore propose to use contracts for the user to specify testing information such as test criterion, test coverage type and rate, to enable embedded software components self-testing process. As stated in section 3, contract-based software testing is an instance of the BIST concept for software objectoriented languages. One goal of this study is to assess the feasibility of this kind of approach for software components in AADL models.

Next section, we first introduce an architecture to include BIST software facilities in AADL models, then a test engine to achieve the testing stages and test specifications (so-called test contracts) to describe testing process properties.

An architecture for AADL Built-In Self-Test

Test architecture

We define a BIST AADL system (Figure 1) as an architecture incorporating the AADL model of the application to be tested (so called user application) and a generic test model. The generic test model is the test engine providing the needed testing functionalities. To achieve a testing stage, the test engine must use the model of the user application. The execution of a BIST AADL system is parameterized by two operation modes (interface features): standard mode and test mode. Standard mode consists in executing the user application alone, the test engine being disabled. Test mode is to run the test engine, which itself executes the user application as needed, in order to manage the testing process.

Test engine

Test engine has to manage the overall testing process of software parts of an AADL model. It should offer facilities to generate test data, to run user application on these test data, to collect and interpret results (oracle), and finally to produce a test report.

We modeled the test engine as an AADL system with four processes: the monitor, the generator, the runner and the oracle (Figure 2). Each process contains a thread to achieve its task using subprograms. The test engine system also has a processor component and a bus component. We use AADL properties to connect the elements of the interfaces of the different processes, to link the processes and the bus to the processor and to connect with the bus. Using the AADL component data, we define four data types to model the different kind of information exchanged in the system: aadl_file, test_data, output_data, test_report. The monitor launches the testing process by sending to the generator the AADL user application model (aadl_file) to be tested, after that it will await the associated test report (test_report) from the oracle.

The generator analyses the input AADL model (aadl_file) in order to retrieve test specifications and to produce test data and associated expected results (we give more details on this stage in section 5.3, after introducing test specifications). Test data (test_data) are then sent to the runner and expected results (output_data) to the oracle.

The runner executes the user application on all the different test data (test_data) and saves the obtained results. It should be noted that this does not just unit testing but rather context embedded testing. These results (output_data) are sent to the oracle at the end of the running stage.

The oracle compares its two inputs (output_data), expected results from the generator and obtained results from the runner, to produce a test report (test_report) and send it to the monitor.

Test specifications

In order to have a relevant testing process, AADL models must contain information to guide the test engine. More precisely, the generator needs some test specifications to produce test data (cf. section 5.2). As we focus on AADL software parts testing, the test specifications have to be located in subprogram components. These test specifications should permit to define one's component testing policy: test strategies, criteria, metrics, expected results…

We propose a preliminary library (TestPropertySet) providing new AADL properties for specifying testing features of subprogram components. We distinguish four types of properties: test_strategy, test_criterion, test_coverage, test_data_file.

Test_strategy property may be DT_predefine or DT_criterion_applying. DT_predefine means that a file containing test data with associated expected results already exists and is available at the location written in the property test_data_file. DT_criterion_applying means that the test engine has to apply a given criterion, specified in property test_criterion, on the source code of the subprogram to generate test data.

Test_criterion property enables the choice of a structural test criterion if test_strategy = DT_criterion_applying (e.g.

instruction_testing, branch_testing, path_testing, mutation_testing…).

Test_coverage property states the criterion coverage rate needed for the test data generation step. For example a value below 100% allows dead code in the subprogram. It could also be useful when the coverage of a criterion can not be determined statically without approximation. This property is enabled when test_strategy = DT_criterion_applying.

Test_data_file property specifies the location of the file needed when test_strategy = DT_predefine.

dependency BIST AADL System

Test engine System

User application System

We focus on safety testing, specific real-time distributed embedded properties being studied by dedicated AADL tools. As the source code of the subprogram is available in the AADL model, we use classical software structural testing criteria. Functional criteria could also be used if a behavioral description of the subprogram is available.

From considered test criteria, automatic test data generation is easily done, but associated expected test results production remains a problem. To face this, the user may be asked to provide expected results to the test engine. This solution presents a lot of disadvantages: not automatic, time expansive, error prone, and difficult especially concerning embedded third-party components. Otherwise an executable specification or a behavioral model of the component is needed to automatically compute the expected test results, using model-based testing methods [START_REF] Utting | Practical Model-Based Testing: A Tools Approach[END_REF].

These component embedded test specifications are needed to produce test data, but they also may be seen as contracts, allowing knowing by what criterion and to what extent a component is well tested. They may also be used to assess component's testability. In fact, we consider that test specifications are a tool to make testable components.

Discussion

We chose to add a BIST part in an AADL model at the system level in order to be able to integrate test data but also the test engine for every user application with a minimum extra cost for both the user and the system. In fact, test engine is generic, and if an implementation of the test engine is available as an AADL system, it is no cost for the user to package it with his model to obtain a BIST version. The only additional effort remaining for the user would be to add test specifications in his model. Another important advantage is that the application could be tested in-line in any new environment of deployment for design purpose but also during maintenance. For systems with very strong memory constraints, the extra memory cost of the test engine could already be too important. In that case, a BIST version of the system could not be deployed on a real target, however it could be used during the design stage and off-line maintenance.

A different option would be to add the BIST part at the component level but it would lead to a lot of redundancy as the test engine may be the same for the different components and to a memory overcost unacceptable for such real-time embedded systems. Moreover, some testing functionalities need to be at the system level in order to achieve integration testing.

Conclusion

This study shows that introducing test specifications (or test contracts) in software parts of AADL models is a way to define their testability and could ease the integration step. Combined with a test engine at the system level, it could generate and run test data automatically in the manner of a BIST during design and maintenance stages. One advantage is that software parts are tested in their integration context.

However, to broaden the range of supported test criteria, to enable the oracle and to fully automate the testing stage, behavioral models of subprograms are required. The previously proposed library for test specifications is to illustrate the approach and also needs to be enriched (e.g. properties to declare the hardware/software binding constraints). Next stage is an implementation to assess the feasibility and the benefits of the proposed approach.

Figure 1 :

 1 Figure 1: BIST AADL system architecture

Figure 2 :

 2 Figure 2: Test engine system model