Kunal Suri

Gabriel Pedroza

Patrick Leserf
email: patrick.leserf@estaca.fr

Model-based Approach for Co-optimization of Safety and Security Objectives in Design of Critical Architectures

Keywords: MDE, HW Architecture, Optimization, Safety, Security

 and supports a multiconcern analysis by leveraging Model-Driven Engineering (MDE) techniques such as SysML modeling along with the transformation of SysML models into representations which are finally optimized via constraint solvers. Overall, the method and framework shall support the design of the system architecture from a repository of components based on possible configuration alternatives, which satisfy the system objectives such as reliability and cost. Such functions can help to evaluate the effects of integrating safety and security features thus showing their interplay. The overall approach is illustrated via an automotive CPS case study.

Introduction

Similar to information systems, the development of Cyber-Physical Systems (CPS) [START_REF] Lee | Cyber physical systems: Design challenges[END_REF], such as autonomous vehicles [START_REF] Fagnant | Preparing a nation for autonomous vehicles: opportunities, barriers and policy recommendations[END_REF] and industrial production systems [START_REF] Suri | Modeling business motivation and underlying processes for rami 4.0-aligned cyber-physical production systems[END_REF] (Industry 4.0 [START_REF] Kannan | Towards industry 4.0: Gap analysis between current automotive mes and industry standards using model-based requirement engineering[END_REF]), involves a complex System Development Life Cycle (SDLC 3 ) [START_REF] Eigner | System lifecycle management[END_REF]. Various stakeholders, namely systems engineers, software engineers, safety engineers, security engineers, are involved during the SDLC, wherein each of them is concerned with a specific aspect (or viewpoint) of the system. As CPS involves human users, it is essential to make them fail-safe by building them in a safety-aware manner. Likewise, these CPS must also be developed in a securityaware manner. This is because in the past many of the safety-critical CPS were constructed and used as standalone systems without giving much consideration to the security aspect. However, today most of these systems are highly interconnected and software intensive, which exposes them to the possibility of cyber-attacks which in turn may lead to safety related problems for the users [START_REF] Bozdal | A survey on can bus protocol: Attacks, challenges, and potential solutions[END_REF]. Even with the recent increase in the use of Artificial Intelligence (AI) and other automation technology for CPS development, designing these systems still involves a lot of human experts/engineers. Thus, it is important to provide the engineers with methods and automated frameworks that ease the integration of non-functional aspects like, for instance, co-optimization of both safety and security objectives, especially during the development of the system hardware architecture [START_REF] Lisova | Safety and security co-analyses: A systematic literature review[END_REF][START_REF] Paul | Over 20 years of research into cybersecurity and safety engineering: a short bibliography[END_REF]. For the same reason, the design phase is crucial within the SDLC, since errors or lacks introduced during the design time can propagate to other phases resulting in wastage of effort, time and resources [START_REF] Suri | Configurable iot-aware allocation in business processes[END_REF]. This makes it critical to design a sound and well-formed system architecture, which satisfies all the functional and non-functional requirements (i.e., multiple objectives) and to analyze the system objectives via simulations for the desired outcomes. In this way, the engineers will be able to find a set of quasi-optimal solutions before developing a physical prototype of the hardware.

In general, different engineer teams participate during the design process and in particular when safety and security aspects need to be integrated. Thus, it is not expected a single stakeholder having expertise in both domains. Thus, in order to perform the aforementioned multi-objective system analysis, engineers need methods and automated frameworks that will support them to perform the analysis related to safety and security requirements along with the ability to discover or trace the link between these requirements and the lower-level criteria of the system. In the context of this work, our focus remains on supporting the engineers during the design phase following a model-driven approach wherein we build on our previous work [START_REF] Leserf | Sysml modeling for embedded systems design optimization: A case study[END_REF] by extending it to handle the following: (1) multiple system components and (2) multiple objectives to be included in the optimization criteria for finding the quasi-optimal system architecture. Our method supports a multi-concern analysis by making use of Model-Driven Engineering (MDE) techniques such as SysML modeling along with the automatic transformation of SysML models into representations that can be optimized via relevant algorithms. We illustrate this method by reusing and extending the case study from [START_REF] Leserf | Sysml modeling for embedded systems design optimization: A case study[END_REF] with the security perspective. Overall, this method shall support the design of the system architecture from a repository of components based on possible configuration alternatives, which satisfy the system objectives such as reliability and cost which can impact or be related to both safety and security requirements.

The remainder of this paper is organized as follows: in Section 2, we introduce some preliminary information necessary to better understand various concepts used in this work. In Section 3, we detail our method along with the various steps (and sub-steps) and in Section 4, we detail the experimentation results and the automated framework developed for supporting this design-space exploration. In Section 5, we survey some related work and finally, in Section 6, we conclude the paper and provide some perspective on the future works.

Preliminaries

In this section, we briefly introduce various concepts and techniques necessary to understand the work detailed in this paper. These concepts are as follows:

-MDE in systems engineering has a large community of contributors and users along with the availability of mature tools (e.g. Eclipse Papyrus4 ). MDE uses models as the primary artifacts, which help to enhance the understandability of complex systems and aids in the reduction of the chances of error due to the use of principles, standards (e.g. work done by the Object Management Group (OMG5 )) and tools [START_REF] Leserf | Sysml modeling for embedded systems design optimization: A case study[END_REF][START_REF] Pedroza | Towards safety and security co-engineering[END_REF][START_REF] Pedroza | Avatar: A sysml environment for the formal verification of safety and security properties[END_REF]. MDE supports creation of a coherent model of a system that may be augmented with relevant information for different stakeholders. This model when transformed into different formats allows representing various formalization relevant for different domains. In this work, we make extensive use of SysML 1.4 language along with model transformation technique, which is briefly detailed as follows:

• Systems Modeling Language6 (SysML ® 1.4) is a general-purpose graphical modeling language developed by the OMG for systems engineering (SE). It reuses a subset of Unified Modeling Language (UML) and provides additional extensions to address the requirements in UML for SE. SysML is used to specify, analyze, design, and validate complex systems, which may include any type of system such as hardware, software and information. SysML comprises of the four essential diagrams that are referred to as the Four Pillars of SysML, which are: (1) Requirement, (2) Activity, (3) Block, and (4) Parametric diagrams. In this work, we mainly depend on the Requirements and the Block diagrams to model the system depicted in our case study. • Model Transformation plays a key role in MDE as it allows the generation, sometimes by refinement, of lower-level models from higher level (or abstract) models, eventually generating the executable codes (and vice-versa, i.e., reverse engineering). Model transformation allows the mapping and synchronization of models, which may be at the same or different levels of abstraction. As per Czarnecki et al. [START_REF] Czarnecki | Feature-based survey of model transformation approaches[END_REF], there are several major categories of model transformation. However, in our work, we use the model-to-text approach to generate executable scripts from our SysML models (based on a template). This template-based approach consists of target text along with the specific code that is generated based on the values provided in the model.

-Constraint Satisfaction Problems (CSPs) are mathematical problems, which are defined as a set of variables that have specific conditions that should never be violated while solving these problems (i.e., constraints) [START_REF] Brailsford | Constraint satisfaction problems: Algorithms and applications[END_REF].

In other words, a CSP consists of the following: (1) a finite set of variables (V 1 , V 2 , ..., V n ); (2) a non-empty domain having some values to be assigned to each variable (D V1 , D V2 , ..., D Vn ); and (3) a finite set of constraints (C 1 , C 2 , ..., C n ), wherein each of the constraint C i puts a limit on the values permitted or excluded for the variables (e.g., V 2 = V 3). CSP is used by researchers in AI to solve problems such as scheduling. The solution set can include a unique solution, all the solutions in the space, or an optimal solution. In this work, we support the engineers to find optimal solutions based on the values of the objective functions provided as input by the user in the SysML model. -Multi-Objective Optimization and Pareto Front is an optimization problem involving multiple objective functions. It broadly falls under the area of decision making involving multiple criteria. These problems are concerned with scenarios wherein it is crucial to simultaneously optimize more than one objective function such as either cost, reliability or performance. These metrics are applied in various domains such as economics, logistics and engineering, where optimal decisions are needed by managing the trade-offs between two or more conflicting objectives. For instance, minimizing the cost of an automobile while maximizing its safety. Likewise, in a multi-objective optimization problem involving several objectives, an optimal solution is called Pareto optimal if there exists no possibility to improve an objective function without degrading the others. Thus, a Pareto optimal solution is an optimal trade-off between various objectives. The set of all the Pareto optimal solutions is called as Pareto Front (also known as Pareto frontier or Pareto set), which is graphically visible in form of a distinct front of points.

In this work, we provide the engineers with a set of Pareto optimal solutions.

3 Method: Model-based Co-optimization of Objectives

Overview

In this section, we present the overview of our method that consists of two main steps as detailed in Section 3.3 and Section 3.4. This method is illustrated based on the case study detailed in Section 3.2, which depicts an Embedded Cognitive Safety System (ECSS) (see Figure 2 (source [START_REF] Leserf | Sysml modeling for embedded systems design optimization: A case study[END_REF])). This method is an extension of our previous work [START_REF] Leserf | Sysml modeling for embedded systems design optimization: A case study[END_REF], and is envisioned to illustrate the possibility of integrating both safety and security related objective functions as a way to support decision making so as to avoid unnecessary trade-offs. Furthermore, in this work, one of our major focus has been on the readiness and automation of the framework presented in [START_REF] Leserf | Sysml modeling for embedded systems design optimization: A case study[END_REF], i.e., to scale it for handling a dynamic range of hardware (HW) components to support the engineering needs. Figure 1 represent the steps (and sub-steps) of our method, which starts with capturing the safety and security based requirements from different stakeholders using SysML requirement diagram (see label 1 in Figure 1). The model-based requirement gathering allows to capture different requirements and supports traceability between them. Such traceability enables the engineers to see which requirements are related to each other and how they can be tackled together [START_REF] Kannan | Towards industry 4.0: Gap analysis between current automotive mes and industry standards using model-based requirement engineering[END_REF]. Next, a SysML model is created, that is annotated with all the relevant information related to the system components along with the values of objective functions from both safety and security aspects (see label 2). The SysML model also contains the information related to the type of variability needed to explore the design-space (detailed in Section 3.2). Next, the SysML model is transformed into text (i.e., executable python scripts) using a template-based approach that involves the generation of mathematical optimization models based on the information about variability choices added to the SysML model (see label 3) [START_REF] Bettini | Implementing domain-specific languages with Xtext and Xtend[END_REF]. Concretely, this model transformation step relies on Eclipse based technologies such as Xtext 7 . The variability choices are transformed into a set of 0-1 variables (integer programming). Then, based on the constraints defined between components of the SysML model, the problem can be solved as a CSP via some standard solvers. In our case, the generated Python scripts are executed using python specific CSP solver8 (see label 4 in Figure 1). The solver generates solutions that are visible as Pareto Front graphs. These solutions are based on the calculated value of the objective functions. In our case and to facilitate safetysecurity interplay, we rely upon basic objective functions which can be common to both safety and security, e.g., cost and reliability. An engineer can choose the best solutions among the trade-off solutions that fit their requirements. This method is implemented using the Eclipse Papyrus framework for both SysML modeling and model transformation. The ECSS must be developed in both safety and cyber-security aware manner as malicious attacks such as CAN bus attacks may expose the ECSS to component misbehavior or failure [START_REF] Bozdal | A survey on can bus protocol: Attacks, challenges, and potential solutions[END_REF]. In this context, we consider that the ECSS can be protected by integration of modules that include built-in security features like specific encryption mechanisms, Public key infrastructure (PKI), Trusted Platform Modules (TPM) or Hardware Security Modules (HSM) [START_REF] Wolf | State of the art: Embedding security in vehicles[END_REF], [START_REF] Wolf | Design, implementation, and evaluation of a vehicular hardware security module[END_REF]. As referred modules may also require to be redundant so as to satisfy safety requirements, an impact on the overall cost is expected due to security. Since built-in security features are often HW greedy, a non-negligible impact on performance and real-time safety constraints can occur, e.g., delayed braking CAN messages. Thus, a basic but relevant interplay between safety and security can be studied via the optimization of both cost and performance objective functions. In this work towards multi-objective simulation, we mainly focus on the cost function.

Explaining the Design-Space Exploration: To illustrate some of the complexity faced by engineers, we represent a HW setup wherein there are three slots available for each component of an ECSS (to allow redundancy). The Figure 3 represents the different types of variability involved in selecting a set of HW components for the ECSS. Hence, the number of slots plays an important role, as the solution space grows exponentially on its number. To better illustrate it, let us consider a HW type such as CPU, wherein three slots shall represent a variability matrix of M×3. Indeed, each row of this matrix represents a set of non-distinct CPU elements from one specific manufacturer. For example, we may assume that row 1 represents a Cortex-A9 from Samsung, while row 2 from STMicroelectronics (ST), row 3 from MediaTek (MT), and so on. This is because there could be several possible configurations used to allow CPU redundancy in the chipset. This M×3 array can accept three main configuration categories which are (1) instance variability (IV), i.e., replicas of the same component of the same type, (2) component variability (CV), i.e., components from a different manufacturer, and (3) mixed variability (MV), i.e., IV + CV. Since for each column of size M , any subset of it is also a configuration, the solution space can grow up to 3.(2 M ) configurations. As each of the CPU incurs a specific cost (i.e., product cost plus the cost of security features) and provides specific reliability, an engineer must find the optimal redundancy values and variability type for designing an architecture that satisfies the system requirements. Furthermore, this type of variability issue shall exist for each HW component of the system to be designed, making it quite a complex process to find the optimal set of solutions considering all the components and all the different variability configurations.

Step 1: SysML Modeling

Our method starts with developing a model to capture requirements in textual form and link them to the various modeling elements via relationships such as verify or derive. Figure 4 represents a SysML based requirement model consisting of standard requirement elements. In [START_REF] Leserf | Sysml modeling for embedded systems design optimization: A case study[END_REF] the authors introduced a new requirement type called <<ArchRequirement>> to model a specific type of architectural requirement by extending the standard requirement element using a stereotype. Likewise, in this work, we assist the engineers to model safety and security requirements by introducing <<SafeReq>> and <<SecReq>> respectively. The overall system requirements are composed of the aforementioned requirements, which shall be further refined based on the system needs. The <<ArchRequirement>> requirement is evaluated via an objective function <<HWCostEvaluation>>, which we introduce as a stereotype by extending the SysML Constraint Block. This objective function is related to the requirement via a dependency called Evaluate, depicting a design-time relationship between the elements. The architecture requirement called MaxRedundancy introduces a maximum limit to the redundancy of a component (e.g., max number of sensors = M/2). These types of restrictions are needed as the hardware redundancy incurs a cost that directly influences the overall system cost.

To better visualize and integrate the Multi-Objective Optimization (MOO) context into system modeling, i.e., a type of analysis context, a SysML Block Definition Diagram (BDD) is modeled (see Figure 5). This BDD consists of Constraint Blocks along with their relationships having a top-level block called ECSS MOO, which references the ECSS system block. This BDD also contains the objective functions that are a representation of the optimization model. The Pareto front is a result of the MOO context and provides various alternatives to the engineer. In this approach, the MOO context shall be passed to an external CSP solver. The results from the solver are provided to the engineer in form of the values of the Pareto front. The objective function extends the standard SysML Constraint Block and consists of the optimization goal (maximize or minimize). The ECSS MDO Context constraint block in Figure 5 represents the Pareto front via two value vectors, i.e., BestCost and BestRel, which are produced by the two objective functions. The BDD has constraint properties, i.e., HWCostEvaluation and SystemReliability, which are typed by the objective function. The System-Reliability function, represents the calculation of system reliability (R) based on the parameters received from the ECSS system (the component reliability) and the Zero-One model. Likewise, the HWCostEvaluation gets its values from the ECSS including both safety and security components. The Zero-One model represents the optimization model described in Section 3.4. It has a parameter and a set of constraints deduced from the ECSS and from the model itself.

As the main part of this step, a SysML BDD is developed for modeling the ECSS architecture (see Figure 6). Based on the requirement, it shall contain all the information about the underlying hardware resources and their composition.

In our method, the optimization problem to be solved involves finding the right balance between the optimal level for redundancy of each component and the cost of the component. During the first step, only the composition is known and not the redundancy level. We already detailed different types of variability configurations in Section 3.2. They help to explore the design space by permuting the redundant elements (including security features) to reach minimal global cost and the maximum redundancy allowed.

Step 2: Model-Transformation and Optimization

This section details the second step of the approach wherein a SysML BDD model (see Figure 6) is transformed into a mathematical formalism susceptible to optimization via a space search and constraint solver algorithm [START_REF] Brailsford | Constraint satisfaction problems: Algorithms and applications[END_REF]. The representation is based upon zero-one variables that can be solved via a CSP solver. The ECSS is composed of subsystems S i , wherein each S i is associated with a given block. A subsystem S i is nothing but a component slot set (vertical) to be configured by components of the same type selected from repository C i (provided by the same or different manufacturers). C ij represents the j th component in the repository C i : each selected component C ij shall have a position j in the repository C i and can be used at a position k in the subsystem S i . We define the following sets and parameters: To find optimal solutions, we first find all the possible solutions and then evaluate each different solution relying upon the mathematical representation of the objective function. For achieving this, we make use of the Python-based CSP package called Python-Constraint (version 1.4.0) as it is simple to use and is widely used in various research works.

Fig. 6: BDD for ECSS composition

For the use of zero-one programming, we assume that the range of components C ij will be a M×N matrix, where M is the number of slots for each component (vertical size), and N the number of components (horizontal size). Thus, the problem is defined as follow:

∀i ∈ S, j ∈ C i , k ∈ S i a ijk = 1, if C ij is used in system S i at position k 0, otherwise (1)
Constraints: Each system has some default constraints that are derived based on the decision variables. Even if the introduction of new constraints may not be straightforward, some of them have been previously prioritized in different application domains and can be reused, for instance, performance and energy constraints [START_REF] Roux | Communication-based power modelling for heterogeneous multiprocessor architectures[END_REF]. In our case study, the following constraints are modeled, such as at any position k in the final sub-system, there shall be only one component:

∀i, j, k a ijk 1 (2)
Based on the requirements, several other constraints can be included in the CSP program. This shall allow the solver to provides a better solution targeted to the specific objectives of the system design. For instance, the constraint on a digital connection (system BUS) that connects each sensor to a CPU and each CPU to a transceiver can be represented as:

j,k a 1jk β 1j j,k a 2jk α 2j (3)
Objective Functions: In our case study, we have a system cost and system reliability which are based on component redundancy and extended from functions in [START_REF] Leserf | Sysml modeling for embedded systems design optimization: A case study[END_REF]. As previously discussed, the total cost is an objective function that allows a safety-security interplay since components can include features impacting both. Thus, Cost = Cost saf ety +Cost security and the total cost is given by:

T otalCost = i,j,k Cost ij a ijk + exp θ i k a ijk (4)
The system reliability (R) is calculated by using the serial-parallel interconnection model, which is given as:

R = i 1 -j,k 1 -a ijk rel ij (5)
The goal of the optimization is to minimize the cost and maximize the reliability, i.e., min(T otalCost) and max(R) by using a different configuration of components based on variability types.

Experimentation Results

A proof of concept for our method is implemented using the Eclipse Papyrus framework for modeling SysML models and performing model-transformation (i.e., code generation). The code generation is based on the API's provided by Papyrus Designer9 and the experimentation is performed using multiple SysML models (visible in top left-side of Figure 6). Each of the SysML models has a set of different input values w.r.t the number of slots available on the hardware, values of the cost and reliability, and the number of sub-components in the systems. The information in these SysML models is used to generate the Python script, which is then executed. It uses the python-constraint API for creating a CSP problem and the related variables, which along with the added constraints provide the set of solutions. Each of these solutions is then used to calculate the objective functions, which are represented as a point on the graph.

An output generated is shown in Figure 7. It depicts two images with two types of variability, i.e., CV and IV. The solutions that are generated represent a quasi-optimal solution for a hardware architecture having slots for component types such as a CPU, Sensor and Transceiver. In this example, the hardware shall have three slots for each component type, i.e., to accommodate up to 3 elements of each type (3×3 matrix). For one of such experiments, the total number of discrete output solutions associated with CV is 16 and IV is 27. The X-axis of the graph represents the failure rate, while the Y -axis represents the total system cost. The engineers can use the framework to perform simulations to find the best suitable choice for the given requirement. The framework assists them by providing the Pareto Front and visual support of the threshold area based on acceptable cost or acceptable failure rates.

As seen in Figure 7, a visual assistance is provided in the form of the Pareto diagrams and acceptance threshold (e.g. system cost 150) which support the engineers to find a (quasi) optimized system having the reliability and cost as per the requirements allocated. In literature, various academic and industrial research works have addressed the problem of both safety and security for CPS [START_REF] Lisova | Safety and security co-analyses: A systematic literature review[END_REF] such as EU MERGE10 project or the EU AQUAS 11 project. Paul [START_REF] Paul | Over 20 years of research into cybersecurity and safety engineering: a short bibliography[END_REF] categorized such works into four main groups, that are: (1) independent analysis of safety and security, i.e., works analyzing either safety or security concerns during the SDLC without considering the other, (2) augmenting safety engineering with security techniques, i.e., works where various processes, methods and tools in the safety engineering domain are updated with concepts and features from the security domain, (3)augmenting security engineering with safety techniques, and (4) addressing safety and security co-engineering together, i.e., approaches considering a unification of processes, methods and tools to perform both the safety and security analysis in parallel. Various works have used the strengths of MDE for conduction a co-engineering analysis. Pedroza et al. [START_REF] Pedroza | Avatar: A sysml environment for the formal verification of safety and security properties[END_REF] proposed MDE based framework using a SysML-based environment called AVATAR that captured both safety and security related elements in SysML models. They also gave forth the importance to develop a CPS in a co-engineering manner with Safety and Security perspectives rather than in a standalone manner [START_REF] Pedroza | Towards safety and security co-engineering[END_REF]. Our work complements these approaches by providing a way to solve architecture composition and optimization problems whereas still addressing safety and security concerns. Some existing approaches such as [START_REF] Van Huong | Embedded system architecture design and optimization at the model level[END_REF][START_REF] Spyropoulos | Extending design capabilities of sysml with trade-off analysis: Electrical microgrid case study[END_REF] assist users to perform multiple analyses, however, they are mainly focused on optimizing the component parameters, such as CPU frequency or memory management, rather than in structural features as in our approach. Meyer et al. [START_REF] Meyer | Process planning in microwave module production[END_REF] proposed an optimization technique for their microwave module but a lack of redundancy constraints is observed. Other approaches such as Design-Space Exploration (DSE) [START_REF] Apvrille | Ttool for diplodocus: an environment for design space exploration[END_REF] and redundancy allocation problem (RAP) [START_REF] Coit | Optimization approaches to the redundancy allocation problem for series-parallel systems[END_REF] are similar to our approach which remains nonetheless quite generic and extensible, given the few SysML profile specializations introduced and the possibility to easily integrate new user-defined objective functions.

Conclusion and Perspectives

In this paper, we proposed a method and framework to perform a multi-objective optimization of system hardware architecture during the design-phase of the SDLC. The approach leverages MDE techniques, especially SysML modeling and model transformation, to assist engineers in the conception of the system architecture during design-space exploration. The tooled method starts with modeling the overall system requirements, including safety and security specific requirements, and then modeling the relevant information about the hardware components to be used and optimized via block diagrams. Such information includes values related to the objective functions, architectural constraints, number of slots, number of components and type of variability. Next, these SysML BDD models are automatically transformed into Python scripts based on the underlying mathematical representation, which includes integer variables, linear constraints and objective functions. The Python scripts are executable and are solved using Python-based CSP solvers. Based, on our case study, an engineer is presented with quasi-optimal solutions, i.e., specific configuration w.r.t hardware components that maximize the objective functions such as reliability while minimizing the global costs. Since the integration of safety features (like redundancy) and security features (like encryption modules) have in common certain objective functions (like cost), the optimization of the latter can help to evaluate the impact and interplay between both. As perspectives, we intend to extend our framework by including more common or specific objective functions related to security and safety to strengthen the approach and coverage of security engineering. Furthermore, we plan to test the approach's scalability with larger and more complex case studies from different CPS domains.

Fig. 1 :

 1 Fig. 1: Steps for finding optimal system architecture3.2 Case StudyFigure2is sourced from our previous work[START_REF] Leserf | Sysml modeling for embedded systems design optimization: A case study[END_REF] and depicts an Embedded Cognitive Safety System (ECSS). It is an integrated system on a chip (SoC) used

Fig. 2 :

 2 Fig. 2: Embedded Cognitive Safety System (ECSS)

Fig. 3 :

 3 Fig. 3: Design-space definition for HW architecture

Fig. 4 :

 4 Fig. 4: Requirement model for ECSS architecture optimization

  (a) Pareto Front for Component Variability (b) Graph depicting Instance Variability

Fig. 7 :

 7 Fig. 7: Graph depicting different variability types

https://www.eclipse.org/papyrus/

https://www.omg.org/index.htm

https://www.omg.org/spec/SysML/1.4

https://www.eclipse.org/Xtext/documentation/index.html

https://github.com/python-constraint/python-constraint

https://wiki.eclipse.org/Papyrus_Software_Designer

http://www.merge-project.eu

This work is the result of a collaborative project between CEA-LIST and ESTACA, a period during which Kunal was following a postdoctoral fellowship in ESTACA. 3 https


Michal Heger
email: m.heger@amc.uva.nl

Isabelle I Salles

Rick Bezemer

Martijn A Cloos

Serge R Mordon

Sylvie Bégu

Hans Deckmyn

Johan F Beek

Sylvie Be

Laser-induced primary and secondary hemostasis dynamics and mechanisms in relation to selective photothermolysis of port wine stains

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Selective photothermolysis (SP) is a standard treatment modality for superficial vascular anomalies such as port wine stains (PWS) and other vessel-related dermatological disorders [START_REF] Leffell | Lasers in dermatology and ophthalmology[END_REF]. SP is based on the conversion of radiant energy to heat by (de)oxyhemoglobin and the thermal denaturation of blood and vascular tissue as a result of heat diffusion, referred to as photocoagulation or the photothermal response. By employing an appropriate wavelength and irradiance, supracritical temperatures (>70 8C) can be generated in the vessel lumen and confined spatially when the pulse duration is shorter than the time required for cooling of the target structures [START_REF] Anderson | Selective photothermolysis: precise microsurgery by selective absorption of pulsed radiation[END_REF], i.e., 0.5-10 ms for PWS vessels of 30-300 mm in diameter [START_REF] Dierickx | Thermal relaxation of port-wine stain vessels probed in vivo: the need for 1-10millisecond laser pulse treatment[END_REF][START_REF] Selim | Confocal microscopy study of nerves and blood vessels in untreated and treated port wine stains: preliminary observations[END_REF]. Normal-sized capillaries and post-capillary venules (4-26 mm inner diameter [START_REF] Braverman | The cutaneous microcirculation[END_REF]) have relatively short thermal relaxation times and thus remain spared during longer pulse durations, inasmuch as heat diffusion from these vessels precludes the generation of supracritical temperatures.

Background: Superficial vascular anomalies such as port wine stains are commonly treated by selective photothermolysis (SP). The endovascular laser-tissue interactions underlying SP are governed by a photothermal response (thermocoagulation of blood) and a hemodynamic response (thrombosis). Currently it is not known whether the hemodynamic response encompasses both primary and secondary hemostasis, which platelet receptors are involved, and what the SP-induced thrombosis kinetics are in low-flow venules. Objectives: To (1) define the role and kinetics of primary and secondary hemostasis in laser-induced thrombus formation and (2) determine which key platelet surface receptors are involved in the hemodynamic response. Methods: 532-nm laser-irradiated hamster dorsal skin fold venules were studied by intravital fluorescence microscopy following fluorescent labeling of platelets with 5(6)-carboxyfluorescein. Heparin and fluorescently labeled anti-glycoprotein Ib-a (GPIba) and anti-P-selectin antibodies were administered to investigate the role of coagulation and platelet receptors, respectively. Lesional sizes were quantified by software. Results: Laser irradiation consistently produced sub-occlusive thermal coagula. Thrombosis was triggered in all irradiated venules in a thermal coagulum-independent manner and peaked at 6.25 min post-irradiation. Heparin decreased the maximum thrombus size and caused thrombosis to reach a maximum at 1.25 min. Immunoblocking of GPIba abated the extent of thrombosis, whereas immunoblocking of P-selectin had no effect. Conclusions: The hemodynamic response ensues the photothermal response in a thermal coagulumindependent manner and involves primary and secondary hemostasis. Primary hemostasis is mediated by constitutively expressed GPIba but not by activation-dependent P-selectin.

The therapeutic efficacy of SP with respect to PWS depends on the extent to which the target vasculature is afflicted by the photothermal response. Complete photocoagulation/occlusion of the vascular lumen is required for optimal lesional clearance [START_REF] Fiskerstrand | Photothermally induced vessel-wall necrosis after pulsed dye laser treatment: lack of response in port-wine stains with small sized or deeply located vessels[END_REF], which occurs in approximately 40% of patients [START_REF] Greve | Prospective study of port wine stain treatment with dye laser: comparison of two wavelengths (585 nm vs. 595 nm) and two pulse durations (0. 5 milliseconds vs. 20 milliseconds)[END_REF]. Contrastingly, moderately responding (20-46%) and recalcitrant (14-40%) PWS [START_REF] Greve | Prospective study of port wine stain treatment with dye laser: comparison of two wavelengths (585 nm vs. 595 nm) and two pulse durations (0. 5 milliseconds vs. 20 milliseconds)[END_REF][START_REF] Hohenleutner | Epidermal damage and limited coagulation depth with the flashlamp-pumped pulsed dye laser: a histochemical study[END_REF] exhibit varying degrees of incompletely photocoagulated vessels containing semi-obstructive thermal coagula (Fig. 1a-d). Consequently, alternative treatment strategies are needed to improve therapeutic outcomes in the poorly-to-non-responsive PWS patient population [START_REF] Heger | Endovascular lasertissue interactions redefined: shining light on novel windows of therapeutic opportunity beyond selective photothermolysis[END_REF].

Recently an experimental modality, site-specific pharmacolaser therapy (SSPLT) [START_REF] Heger | Towards optimization of selective photothermolysis: prothrombotic pharmaceutical agents as potential adjuvants in laser treatment of port wine stains. A theoretical study[END_REF], was proposed to ameliorate PWS recalcitrance to conventional SP. The conceptual framework of SSPLT is based on the occurrence of a hemodynamic response (thrombosis) following the photothermal response [START_REF] Hovig | Measurement of the platelet response to laser-induced microvascular injury. Ultrastructural studies[END_REF][START_REF] Wiedeman | Vascular reactions to laser in vivo[END_REF][START_REF] Kova ´cs | Evans blue: an ideal energyabsorbing material to produce intravascular microinjury by HE-NE gas laser[END_REF]. Accordingly, SP is combined with the prior administration of a prothrombotic-and/or antifibrinolytic-containing drug delivery system to instill complete occlusion, and thus complete removal, of semi-photocoagulated target vessels by the pharmacological augmentation of the hemodynamic response (Fig. 1e-h).

T h ea i m so ft h es t u d yw e r et od e t e r m i n et h er o l ea n dt h e kinetics of primary and secondary hemostasis in the hemodynamic response and to establish which key platelet surface receptors are involved in SP-induced thrombosis using a hamster dorsal skin fold model in conjunction with fluorescent labeling of platelets and intravital fluorescence microscopy. The findings comprise a basis for the continued development of SSPLT in an effort to optimize the laser treatment of aberrant cutaneous vasculature.

Materials and methods

1,2-Dipalmitoyl-sn-glycero-3-phosphocholine (DPPC) and 1,2distearoyl-sn-glycero-3-phosphocholine (DSPC) were purchased from Lipoı ¨d (Ludwigshafen, Germany). Polyethylene glycol-conjugated 1,2-distearoyl-sn-glycero-3-phosphoethanolamine (DSPE-PEG 2000 ) was provided by Genzyme Pharmaceuticals (Liestal, Switzerland). Alexa488-labeled (Molecular Probes, Eugene, OR) rat anti-mouse CD62P monoclonal antibodies (mAbs) (CD62P-Alexa488, clone RB40.34) and FITC-conjugated rat anti-mouse IgG 1k isotype control (IgG-FITC, clone R3-34) were obtained from Research Diagnostics (Flanders, NJ) and FITC-conjugated F(ab 0 ) 2 fragments of polyclonal rabbit anti-mouse IgG (Fab 2 -FITC) from Dako Cytomation (Glostrup, Denmark). Mouse anti-human CD42b (clone 11A4) mAbs were cloned as described [START_REF] Cauwenberghs | Epitope mapping of inhibitory antibodies against platelet glycoprotein Ibalpha reveals interaction between the leucine-rich repeat N-terminal and C-terminal flanking domains of glycoprotein Ibalpha[END_REF]. 5(6)-Carboxyfluorescein (CF) was acquired from Kodak Chemicals (Williston, VT), heparin Choay from Sanofi Winthrop (Gentilly, France), and fluorescent microspheres (FluoSpheres Red, Ø = 1 mm) from Molecular Probes.

Online supplemental material is indicated with a prefix 'S' throughout the manuscript.

Animals

The animal protocol was approved by the Lille University Hospital animal ethics committee. Animals were treated in compliance with NIH publication 86-23.

Sixty two male Golden Syrian hamsters (93-117 g, De ´pre ´, Saint Doulchard, France) were anesthetized by intramuscular injection of ketamine (200 mg/kg), xylazine (10 mg/kg), and buprenorfine (0.02 mg/kg) after pre-anesthesia with diethyl ether. The dorsal chamber, which has been employed previously as a preclinical Fig. 1. Cartoon illustrating the principles of selective photothermolysis (SP) vs. site-specific pharmaco-laser therapy (SSPLT). Irradiation of port wine stain (PWS) vessels with a yellow laser (a) is characterized by the photothermal response (b), resulting in the formation of a thermal coagulum (b, insert), and the hemodynamic response, which is characterized by thrombosis. In time the thrombus deteriorates (c), leaving a partially occluded lumen (insert: cross-sectional view: 1, thermal coagulum; 2, thrombus; 3, patent lumen). In (d), a histological section imaged by scanning electron microscopy is presented of a PWS blood vessel following 577-nm laser irradiation, exhibiting a similar damage profile as in (c) (scale bar = 10 mm). The vessel is partially occluded by a thermal coagulum (TC) composed of electron-dense, thermally denatured blood with numerous electron-lucent spherical structures (insert upper left, scale bar = 1 mm) and a thrombus (T) comprising aggregated platelets and associated fibrin. The rest of the lumen is patent (P) and contains intact erythrocytes (IE). Endothelial cells in the thermally afflicted region exhibit cytoplasmic vacuolisation and separation from the basal lamina (insert bottom right, arrow, scale bar = 1 mm). Image adapted from Ref. [START_REF] Heger | Towards optimization of selective photothermolysis: prothrombotic pharmaceutical agents as potential adjuvants in laser treatment of port wine stains. A theoretical study[END_REF]. SSPLT is an envisaged treatment modality for refractory PWS, whereby SP is combined with the systemic administration of a prothrombotic-and/or antifibrinolytic-containing drug carrier (e). It is aspired that, following conventional SP, the drug carrier accumulates in the thrombus (f) and its contents are released by a second stimulus (e.g., heat generated by a near-infrared laser pulse) (g), resulting in local hyperthrombosis and inhibition of fibrinolysis and complete occlusion of the vascular lumen (h). Clinical evidence suggests that complete occlusion of target vasculature (h, insert: 1, thermal coagulum; 2, thrombus) is associated with well-responding lesions. model for PWS vasculature [START_REF] Bezemer | Laser-induced (endo)vascular photothermal effects studied by combined brightfield and fluorescence microscopy in hamster dorsal skin fold venules[END_REF][START_REF] Babilas | Selective photothermolysis of blood vessels following flashlamp-pumped pulsed dye laser irradiation: in vivo results and mathematical modelling are in agreement[END_REF][START_REF] Jia | Long-term blood vessel removal with combined laser and topical rapamycin antiangiogenic therapy: implications for effective port wine stain treatment[END_REF], was implanted according to Bezemer et al. [START_REF] Bezemer | Laser-induced (endo)vascular photothermal effects studied by combined brightfield and fluorescence microscopy in hamster dorsal skin fold venules[END_REF]. Reagents were infused through the subclavian vein with a 30 G needle ($200 mL/30 s). The animals were sacrificed by intravenous administration of potassium chloride.

Liposome preparation

Liposomes (Ø = 132 AE 11 nm, section-S3) composed of DPPC:DSPC:DSPE-PEG 2000 (10:85:5 mole ratio) were loaded with a self-quenching concentration CF (100 mmol/L, section-S3) as described previously [START_REF] Mordon | Study of platelet behavior in vivo after endothelial stimulation with laser irradiation using fluorescence intravital videomicroscopy and PEGylated liposome staining[END_REF]. Unencapsulated CF was removed by dialysis (Spectra/Por 7, MWCO-100,000, Spectrum Laboratories, Rancho Dominguez, CA) in phosphate buffered saline (PBS) at room temperature (RT) until a residual solvent concentration of 40 mmol/L CF (measured spectrophotometrically, OD 450 = 0.59) was obtained during gentle stirring.

Raising the temperature above the phase transition temperature of the lipid bilayer (55.5 8C, Fig. S1) is associated with a gel-toliquid-crystalline phase transition of component phospholipids, leading to rapid release of CF and a reduction in fluorescence quenching. Hyperfluorescence during intravital microscopy following the laser pulse therefore served as an indicator for thermal denaturation of plasma components (>45 8C [START_REF] Takeda | Conformational change of bovine serum albumin by heat treatment[END_REF]) and erythrocytes (<51 8C [START_REF] Nilsson | Changes in optical properties of human whole blood in vitro due to slow heating[END_REF]), i.e., precursor events in thermal coagulum formation.

Intravital microscopy, laser-induced thrombosis

The microscopy and thrombus induction setup is explained in Fig. 2a. To verify that non-obstructive thermal coagula (Fig. 1c andd) were formed at the laser parameters employed for thrombus induction, the microscope optics were configured as described previously [START_REF] Bezemer | Laser-induced (endo)vascular photothermal effects studied by combined brightfield and fluorescence microscopy in hamster dorsal skin fold venules[END_REF]. Vascular patency was determined by infusion of fluorescent microspheres (2 Â 10 9 microspheres/kg, 100-mLi njection volume) [START_REF] Bezemer | Laser-induced (endo)vascular photothermal effects studied by combined brightfield and fluorescence microscopy in hamster dorsal skin fold venules[END_REF]. Thermal coagula (n = 15) were visualized using a filter set whose excitation wavelength range (l ex =540-580 nm) matches a high absorption range of thermally denatured blood [START_REF] Barton | Cooperative phenomena in twopulse, two-color laser photocoagulation of cutaneous blood vessels[END_REF] and whose emission range (l em = 605-655 nm) is broad enough to generate brightfield images in transillumination mode. In this configuration, simultaneous visualization of the laser-induced thermal coagulum (appearing dark against a lighter background), skin fold anatomy, and fluorescent microspheres (section 'Shear Rates') was possible. For thrombus imaging, mAband CF-labeled platelets were visualized at l ex =480AE 15 nm and l em =535AE 20 nm. In some antibody experiments, transillumina- tion was applied for contrast enhancement. Endovascular events were recorded for a period of 8 min in the thermal coagulum experiments and for 15 min in the thrombosis experiments.

Intravital platelet labeling

After implantation of the dorsal skin fold chamber, platelets were stained cytochemically by infusion of 180 mL of the liposome suspension (n = 17) to study the involvement of primary hemostasis. Resting and activated platelets endocytose free CF [START_REF] Heger | Fluorescent labeling of platelets with polyanionic fluorescein derivatives[END_REF],i n f u s e di n unencapsulated form and released from the liposomes, resulting in the formation of a fluorescent thrombus following laser-induced endovascular damage. High molecular weight heparin was administered after liposome infusion at a concentration of 2000 IU/kg (n = 11) to study the involvement of secondary hemostasis.

Platelets were fluorescently immunolabeled by infusion of mouse anti-human CD42b mAbs (350 mg/kg, n = 10) secondarily labeled with Fab 2 -FITC (250 mg/kg) during 15 min before infusion to assess the role of glycoprotein (GP)Iba in the hemodynamic For the analysis of CF-stained thrombi (top panel), the margins of the fluorescent lesion were manually contoured by 2 independent analysts. The contoured lesions were saved as separate image files (1) and quantified for pixel area (A pix ) and total intensity (I tot ) using dedicated software. For the analysis of antibody-stained thrombi (bottom panel), the vascular lumen was roughly contoured and saved as a separate image file ( 2). An intensity histogram of background (2, encircled) was collected from frames of each video sequence at t = 0, 2.5, 5.0, 7.5, and 10.0 min. To characterize the thrombus (3), a threshold range was defined in the programmed macro that had an intensity cut-on value of 5 units higher than the highest recorded intensity value in the 5 background frames. The thrombus was quantified for pixel area (A pix , the total number of 'thrombus pixels') and total intensity (I tot , cumulative intensity of the 'thrombus pixels'). Lesional size was calculated by normalized (A pix ) Á normalized (I tot ) and relative lesional size was calculated by [normalized (A pix Á I tot ) t /normalized (A pix Á I tot ) t=0 ], where t represents a time point in the video sequence and t = 0 represents the time point immediately after the laser pulse, defined as baseline.

[ ( F i g . _ 2 ) T D $ F I G ]
response. Fab 2 -FITC was used as negative control (250 mg/kg, n = 5). Fractional immunoblocking of GPIba ($3% of platelets, section-S5) with fluorescent CD42b mAbs allowed simultaneous visualization and quantification of platelet aggregation under mild inhibitory conditions. The anti-CD42b mAbs exhibited strong cross-reactivity with resting and activated hamster platelets (section-S4), reaching a level of saturation at $2.5 mg/10 6 platelets (section-S5), and induced a mild reduction in platelet count (section-S6).

Activated platelets were stained by infusion of CD62P-Alexa488 mAbs (500 mg/kg, n = 10) to assess the role of P-selectin in the hemodynamic response. IgG-FITC (500 mg/kg, n =4) was used as isotype control to determine the extent of non-specific binding. The anti-CD62P mAbs exhibited cross-reactivity with activated but not resting hamster platelets (section-S4), although some nonspecific binding to resting hamster platelets was observed (Fig. S2). The anti-CD62P mAbs induced negligible reduction in platelet count (section-S6). [ ( F i g . _ 4 ) T D $ F I G ] All mAbs were diluted with 0.9% sodium chloride solution to a final injection volume of 200 mL.

Laser irradiation

The target venules had a mean AE SD diameter of 157 AE 35 mm (range = 86-252 mm). Lesions were induced with a frequencydoubled Nd:YAG laser (532 nm, Entertainer, Laser Quantum, Cheshire, UK) at a power of 224 mW, a mean AE SD incident radiant exposure of 289 AE 38 J/cm 2 , a 2.3 Â 10 À3 -mm 2 spot size, and a 30-ms pulse duration [START_REF] Bezemer | Laser-induced (endo)vascular photothermal effects studied by combined brightfield and fluorescence microscopy in hamster dorsal skin fold venules[END_REF]. The pulse duration for this wavelength falls within the clinically employed range [START_REF] Lorenz | Variable pulse frequency-doubled Nd:YAG laser versus flashlamp-pumped pulse dye laser in the treatment of port wine stains[END_REF].

Shear rates

Blood flow measurements were performed using fluorescent microspheres. Shear rates were determined (n = 95) based on the measured blood flow velocity and vessel radius (section-S7). At a mean AE SD flow of 0.48 AE 0.21 mm/s and a mean AE SD venular diameter of 0.15 AE 0.03 mm, the mean AE SD shear rate was 7.0 AE 3.7 s À1 (range = 1.8-19.6 s À1 ).

Lesion quantification

The quantification of laser-induced lesions was performed differently for cytochemically (CF-) vs. immunolabeled platelets (Fig. 2b, section-S8). For the former, isolated video frames of laserinduced lesions were manually contoured and quantified for pixel area (A pix ) and total intensity (I tot ) in SigmaScan Pro (Systat Software, Point Richmond, CA). Contrastingly, immunolabeled thrombi were demarcated in SigmaScan Pro using a thresholding algorithm, whereby 'thrombus pixels' were defined as pixels with an intensity of 5 grayscale units above the highest background intensity, and quantified for A pix and I tot . For both quantification techniques, A pix was normalized to baseline (t = 0, lesional area immediately after the laser pulse) and I tot was normalized to the maximum total intensity.

Lesional size was defined by normalized (A pix )Ánormalized (I tot ) in both quantification methods and expressed comprehensively (thermal coagulum + thrombus) or individually (thrombus). Normalization of A pix and I tot and lesional size calculations were performed per experiment/animal. Lesional sizes were averaged per experimental group, normalized to baseline, and plotted as a function of time. The relative lesional size was calculated by dividing the lesional size at each time interval by the baseline value.

Additionally, a computational analysis method was developed for validating the manual image analysis. Good agreement was found between manual and automated analysis (section-S9).

Statistical analysis

Statistical analysis (means, standard deviations, and independent hetero-and homoscedastic Student's t-tests) was performed with SPSS (SPSS, Chicago, IL). Shapiro-Wilk tests confirmed the normal distribution of continuous data. The type of t-test used was based on Levene's test of equality of variances. A p-value of 0.05, designated by (*) throughout the text, was considered statistically significant. A p-value of 0.01 is designated by (**).

Results

Induction of subocclusive thermal coagula

The laser-induced formation of subocclusive thermal coagula (photothermal response) was investigated first to ensure that our model emulated the endovascular damage profile associated with SP-treated refractory PWS vasculature (Fig. 1d). Laser irradiation consistently resulted in the formation of subocclusive thermal coagula in all irradiated vessels as evidenced by the uninterrupted flow of fluorescent microspheres (Video-S1/S2). Thermal coagula remained attached to the vessel wall (Fig. 3a-d) or detached within a few seconds after the laser pulse (Fig. 3e-h).

The photothermal response triggers primary and secondary hemostasis

Next, the manifestation of primary hemostasis (platelet aggregation) following photothermolysis was studied. Platelets were labeled by the systemic infusion of CF and liposomes containing a self-quenching concentration of CF were co-infused to serve as a thermal damage indicator. Laser irradiation was associated with transient hyperfluorescence as a result of a heat-induced liposomal membrane transition and release of CF (Fig. 4b, arrowhead, Video-S3), confirming local denaturation of plasma proteins and erythrolysis (thermal coagulum formation).

Platelet adhesion and the development of a nidus occurred in all irradiated venules within seconds after thermal coagulum formation (Fig. 4a-f), which was characterized by a rapid growth phase during the first 1.25 min and a slow growth phase in the subsequent 5.0 min. At 6.25 min the comprehensive lesional size reached a maximum with a 9.5-fold greater volume with respect to baseline (**, Fig. 4m ando). The slow growth phase encompassed extensive thromboembolic activity in which clot build-up exceeded breakdown, given the zigzag pattern of the maxima and the upward trend of the lesional size curve, respectively (Fig. 4m). The slow growth phase was ensued by clot breakdown as evidenced by the rapid decline in lesional size after 6.25 min (Fig. 4m ando) and extensive embolization of large platelet aggregates (Video-S3). At 15.0 min, the lesions had gradually sloughed off to 58% of their maximum (**). Platelet adhesion and aggregation at the site of laser irradiation occurred in the presence and absence of a thermal coagulum (Fig. 5a-f).

[ ( F i g . _ 5 ) T D $ F I G ]

Heparin, an antagonist of factor (f)Xa and thrombin formation [START_REF] Bjo ¨rk | Mechanism of the anticoagulant action of heparin[END_REF], was infused to determine the involvement of coagulation (secondary hemostasis) (Fig. 4g-l). Heparin reduced the maximum lesional size to 49% of the heparin-untreated group (p = 0.07, Fig. 4n vs. m) and caused the peak of thrombosis to occur at 1.25 min (Fig. 4n ando). At this time point the comprehensive lesional size had increased 2.6-fold (Fig. 4o), whereby the maximum relative lesional size was 27% of that in the heparinuntreated group (*).

In contrast to the heparin-untreated group, clot breakdown started after 1.25 min (Fig. 4n) and encompassed extensive embolization of platelet aggregates and, in some instances, portions of the thermal coagulum. The breakdown phase plateaued at 6.25 min at a lesional size that did not differ from baseline (p = 0.08), suggesting that the presence of residual platelet aggregates was minimal and/or that the thermal coagulum had partly or entirely dissociated from the vascular wall. As reported for the heparin-untreated group, the presence of a thermal coagulum was not required for platelet adhesion and aggregation to occur at the site of laser irradiation (Fig. 5g-l).

The accumulation of CF-labeled platelets at the site of endovascular damage and the inhibitory effect of heparin demonstrate that the photothermal response triggers primary as well as secondary hemostasis, respectively, in a thermal-coagulum adhesion/embolization-independent manner. To examine which key platelet receptors are involved in cell adhesion/aggregation during the hemodynamic response, the hemodynamic response was studied following immunoblocking of GPIba (CD42b) and Pselectin (CD62P).

Partial inhibition of CD42b reduces the extent of laser-induced thrombosis

CD42b is a transmembrane subunit of the constitutively expressed GPIb-IX-V receptor complex with heterotypic binding sites for von Willebrand factor (vWF), Mac-1, CD62P, athrombin, fXI/XIIa, and high-molecular-weight kininogen [START_REF] Berndt | The vascular biology of the glycoprotein Ib-IX-V complex[END_REF]. Although the major physiological function of CD42b is the adhesion of circulating platelets to vWF in the subendothelial matrix at high shear, which leads to activation of integrin a IIb b III (GPIIb/IIIa) and subsequent aggregation [START_REF] Andrews | Molecular mechanisms of platelet adhesion and activation[END_REF], it has also been shown to mediate platelet adhesion under low shear conditions, i.e., in venules [START_REF] Kulkarni | A revised model of platelet aggregation[END_REF][START_REF] Andre | Platelets adhere to and translocate on von Willebrand factor presented by endothelium in stimulated veins[END_REF]. Inhibition of CD42b has further been correlated to significantly reduced platelet microparticle formation [START_REF] Pontiggia | Platelet microparticle formation and thrombin generation under high shear are effectively suppressed by a monoclonal antibody against GPIba[END_REF]. At a shear rate of 7.0 AE 3.7 s À1 in hamster venules, CD42b may therefore constitute an important receptor during the hemodynamic response, inasmuch as both platelet aggregation and coagulation prevail.

Anti-CD42b mAbs were infused to investigate the role of GPIba in the hemodynamic response (Fig. 6a-f). Fractional immunoblocking of CD42b imposed no deleterious effect on thrombus formation during the first 3.5 min compared to CF-stained lesions, but significantly reduced clot size during the subsequent 8.0 min (*, Fig. 6m). Thrombosis peaked at 2.75 min (Fig. 6ma n do ) followed by a steep deterioration phase, characterized by embolization of platelet aggregates and, sparsely, portions of the thermal coagulum, that stabilized at 4.25 min. Thrombi remained enveloped around the thermal coagulum up to 15.0 min (** vs. baseline, p = 0.09 vs. CF), suggesting that, at an estimated 3% GPIba inhibition, clot fortification by cross-polymerized fibrin imposed greater resistance to deterioration than a clot composed of predominantly platelets (Fig. 6m, CD42b vs. CF + Hep).

[ ( F i g . _ 6 ) T D $ F I G ]

Fig. 6. Aggregation of anti-CD42b-(a-f) and anti-CD62P-labeled platelets (g-l) at the site of laser-induced damage. A = arteriole, V = venule, arrows indicate direction of flow, and the time relative to the laser pulse is indicated in the upper right corner (min:sec). The arrowheads in (c) and (i) point to a residual thermal coagulum. The lesional sizes (hemodynamic contribution only) with corresponding minima (Min) and maxima (Max) are depicted vs. time for CD42b-labeled platelets (m, n = 10) and CD62P-labeled platelets (n, n = 10). Lesional sizes (normalized (A pix ) Á normalized (I tot )) were normalized to baseline (t = 0, lesional size immediately after the laser pulse) for each experiment and are presented as mean AE SEM per experimental group. The Min and Max values represent the minimum and maximum values of all lesional sizes calculated for all animals in an experimental group. In (o), the thrombus dynamics expressed as normalized relative lesional size are depicted for CF-labeled platelets in the absence and presence of heparin (Hep) and anti-CD42b-and anti-CD62P-labeled platelets. Mean values were normalized to maximum.

Inhibition of CD62P does not affect the extent of laser-induced thrombosis

CD62P is a cell adhesion molecule constitutively expressed in platelet a-granules [START_REF] Stenberg | A platelet alphagranule membrane protein (GMP-140) is expressed on the plasma membrane after activation[END_REF] and endothelial cell Weibel-Palade bodies [START_REF] Bonfanti | PADGEM (GMP140) is a component of Weibel-Palade bodies of human endothelial cells[END_REF] that, upon cell activation, is translocated to the outer membrane to mediate platelet-platelet [START_REF] Romo | The glycoprotein Ib-IX-V complex is a platelet counterreceptor for P-selectin[END_REF], platelet-leukocyte [START_REF] Norman | Leukocyte rolling in vivo is mediated by P-selectin glycoprotein ligand-1[END_REF], and platelet-endothelial cell interactions [START_REF] Frenette | P-selectin glycoprotein ligand 1 (PSGL-1) is expressed on platelets and can mediate platelet-endothelial interactions in vivo[END_REF]. In addition to cell recruitment, the expression of CD62P potentiates a procoagulant state by enhancing fibrin deposition [START_REF] Palabrica | Leukocyte accumulation promoting fibrin deposition is mediated in vivo by Pselectin on adherent platelets[END_REF] through the incorporation of P-selectin glycoprotein ligand (PSGL-1)-expressing, tissue factor-bearing microparticles derived from the abovementioned cells [START_REF] Furie | Role of platelet P-selectin and microparticle PSGL-1 in thrombus formation[END_REF]. As CD42b, CD62P may therefore play an instrumental role in the laser-induced hemodynamic response.

Anti-CD62P mAbs were infused to assess the role of P-selectin in the hemodynamic response (Fig. 6g-l). With the known inhibitory properties of the RB40.34 clone (section-S4), it was expected that the anti-CD62P mAbs would reduce the extent of thrombosis. Although a slight reduction in thrombus size manifested itself in the rapid growth phase, no inhibitory effect was observed the slow growth and breakdown phases vs. CFstained thrombi (Fig. 6n, black vs. dotted line, respectively). The maximum thrombus size was reached at 5.75 min and both lesional size curves (CD42b-and CF-stained thrombi) exhibited a similar progression up to 8.0 min. The 8.0-min time point marked a deflection in the downward trend in lesional size in the CD62P group, which may have been a result of increased CD62P expression (as evidenced by an increase in fluorescence intensity and not the lesional area, data not shown) and/or the nonspecific binding of the mAb (section-S4).

Discussion

A laser-mediated vascular injury model was employed with which the photothermal and hemodynamic response could be concomitantly studied in refractory PWS vessel analogues by intravital fluorescence microscopy. With this model we corroborated that primary hemostasis (platelet aggregation) comprises an integral component of endovascular laser-tissue interactions in semi-photocoagulated blood vessels [START_REF] Hovig | Measurement of the platelet response to laser-induced microvascular injury. Ultrastructural studies[END_REF][START_REF] Wiedeman | Vascular reactions to laser in vivo[END_REF][START_REF] Kova ´cs | Evans blue: an ideal energyabsorbing material to produce intravascular microinjury by HE-NE gas laser[END_REF]. Additionally, we demonstrated that (1) secondary hemostasis (blood coagulation) is triggered by SP, (2) primary and secondary hemostasis occur in the absence of a thermal coagulum, (3) CD42b is involved in the adhesion of platelets at the site of laser irradiation under low flow conditions, (4) the adhesion of platelets at the site of laser irradiation is accompanied by platelet activation, and (5) CD62P does not mediate platelet adhesion during the hemodynamic response. Moreover, the kinetics of laser-induced thrombosis in low-flow refractory PWS vessel analogues were established. Knowledge about the involved platelet receptor and thrombosis kinetics is particularly important in the continued development of SSPLT as a clinical modality.

As this study demonstrated, an intricate and causal relationship exists between the photothermal and the hemodynamic response. This relationship appears to be manifested at different levels: the nucleation centers (erythrocytes), the endothelium, and the thermal coagulum. Firstly, rapid heat build-up in erythrocytes causes the cells to swell and rupture [START_REF] Hovig | Measurement of the platelet response to laser-induced microvascular injury. Ultrastructural studies[END_REF][START_REF] Tan | Ultrastructural changes in red blood cells following pulsed irradiation in vitro[END_REF]. Erythrocytes contain adenosine diphosphate [START_REF] Van Wijk | The energy-less erythrocyte is lost: erythrocyte enzyme abnormalities of glycolysis[END_REF] and phosphatidyl serine [START_REF] Bratosin | Molecular mechanisms of erythrophagocytosis. Characterization of the senescent erythrocytes that are phagocytized by macrophages[END_REF] that, when liberated and exposed, trigger platelet adhesion [START_REF] Begent | Growth rate in vivo of platelet thrombi, produced by iontophoresis of ADP, as a function of mean blood flow velocity[END_REF] and activation [START_REF] Puri | ADP-induced platelet activation[END_REF] and initiation of coagulation [START_REF] Dahlba ¨ck | Blood coagulation[END_REF], respectively. Erythrocyte membrane disruption and complete disintegration have been reported to occur at 47-49 8C and 50 8C, respectively [START_REF] Nilsson | Changes in optical properties of human whole blood in vitro due to slow heating[END_REF][START_REF] Tan | Ultrastructural changes in red blood cells following pulsed irradiation in vitro[END_REF]. These temperatures were exceeded in the in vivo experiments as corroborated by the CF-encapsulating thermosensitive liposomes and by the consistent formation of thermal coagula at the employed laser settings. Furthermore, it has been shown that ruptured erythrocytes remain attached to the thermal coagulum [START_REF] Black | Chemical and structural changes in blood undergoing laser photocoagulation[END_REF], causing the biochemical template for thrombosis to become stationary following laser irradiation. Image analysis of laser-induced lesions confirmed that thrombo-embolic activity always occurred around the thermal coagulum, even when the thermal coagulum had attached to or was overlaying a nonirradiated portion of the vessel downstream of the irradiation site. Consequently, erythrolysis constitutes an important trigger of the hemodynamic response following the photothermal response. This is underscored by the finding that laser-induced thrombosis in vivo occurs in irradiated blood vessels perfused with washed erythrocytes, erythrocyte ghosts, or hemolysate but not with platelet-rich plasma, PBS, or a non-absorbing exogenous chromophore [START_REF] Wiedeman | Vascular reactions to laser in vivo[END_REF].

Secondly, the heat-afflicted endothelium evidently plays a role in the hemodynamic response. High-fluence laser irradiation of microvessels causes ultrastructural perturbation of the endothelial cell membrane and denudation of the endothelial monolayer [START_REF] Kova ´cs | Evans blue: an ideal energyabsorbing material to produce intravascular microinjury by HE-NE gas laser[END_REF][START_REF] Tan | Histologic responses of port-wine stains treated by argon, carbon dioxide, and tunable dye lasers. A preliminary report[END_REF][START_REF] Tan | Pulsed dye laser (577 nm) treatment of portwine stains: ultrastructural evidence of neovascularization and mast cell degranulation in healed lesions[END_REF], which triggers primary [START_REF] Spaet | The vascular wall in the pathogenesis of thrombosis[END_REF][START_REF] Arfors | Biolaser endothelial trauma as a means of quantifying platelet activity in vivo[END_REF] and secondary hemostasis [START_REF] Dahlba ¨ck | Blood coagulation[END_REF]. It should be noted that the volumetric heat production, m a Áf, where m a is the absorption coefficient (cm À1 ) and f is the fluence rate (J/cm 2 ), that led to such endothelial damage [START_REF] Kova ´cs | Evans blue: an ideal energyabsorbing material to produce intravascular microinjury by HE-NE gas laser[END_REF] was very high ($17,656 kJ/cm 3 , section-S10.1) and not representative for either the clinical setting or our model. However, Tan et al. [START_REF] Tan | Histologic responses of port-wine stains treated by argon, carbon dioxide, and tunable dye lasers. A preliminary report[END_REF][START_REF] Tan | Pulsed dye laser (577 nm) treatment of portwine stains: ultrastructural evidence of neovascularization and mast cell degranulation in healed lesions[END_REF], who employed a substantially shorter pulse duration and much larger spot size for treating PWS, showed that endothelial damage can be achieved at significantly lower m a Áf. Contrastingly, at a thousand-fold lower m a Áf of $16 kJ/cm 3 (section-S10.2), thermal coagulum formation and endothelial denudation were absent and only one component of the hemodynamic response (platelet adhesion and aggregation) prevailed, albeit transiently [START_REF] Mordon | Study of platelet behavior in vivo after endothelial stimulation with laser irradiation using fluorescence intravital videomicroscopy and PEGylated liposome staining[END_REF]. Inasmuch as our model produced a thermal coagulum at a m a Áf of $66 kJ/cm 3 at the blood-endothelium interface (section-S10.3), a contribution of thermally afflicted endothelium to the hemodynamic response is warranted. This was experimentally corroborated by the fact that thrombosis occurred in laserirradiated vessel segments where the thermal coagulum had dislodged (e.g., Fig. 3h, Video-S2) and is in agreement with previous reports [START_REF] Wiedeman | Vascular reactions to laser in vivo[END_REF].

Thirdly, photocoagulation is associated with protein denaturation [START_REF] Thomsen | Pathologic analysis of photothermal and photomechanical effects of laser-tissue interactions[END_REF][START_REF] Heger | Darkfield orthogonal polarized spectral imaging for studying endovascular laser-tissue interactions in vivo -a preliminary study[END_REF] that embodies conformational rearrangements and cross-linking/aggregation of unfolded/misfolded proteins [START_REF] Biagio | Interacting processes in protein coagulation[END_REF] and corollary amyloid fibril formation [START_REF] Chiti | Protein misfolding, functional amyloid, and human disease[END_REF]. There is increasing evidence that misfolded proteins/amyloids activate platelets via CD42b [START_REF] Herczenik | Activation of human platelets by misfolded proteins[END_REF] and initiate the contact activation pathway through the auto-activation of fXII by anionic surfaces [START_REF] Maas | Misfolded proteins activate factor XII in humans, leading to kallikrein formation without initiating coagulation[END_REF]. Inasmuch as thermal coagula are in part comprised of thermally denatured (unfolded/misfolded) proteins and anionic moieties exposed on the surface of ruptured erythrocytes, these laser-induced lesions may constitute the basis for the initiation of primary and secondary hemostasis that persisted around the thermal coagula. These postulations are, however, hypothetical and are currently being investigated in a separate study.

Although several specific pathways underlying endovascular laser-tissue interactions require further elucidation, it is unequivocal that SP affects both primary and secondary hemostasis in semi-photocoagulated vasculature. Primary hemostasis involves platelet adhesion, activation, and aggregation. The immunostaining experiments with anti-CD42b and anti-CD62P mAbs revealed that platelet adhesion to the thermal coagulum and/or to the thermally afflicted vascular wall is mediated by GPIba, but not CD62P, and that the platelets become activated upon adhesion, respectively.

For platelet aggregation, integrin a IIb b III (CD41) activation is required [START_REF] Nesbitt | Distinct glycoprotein Ib/V/IX and integrin alpha IIbbeta 3-dependent calcium signals cooperatively regulate platelet adhesion under flow[END_REF], which could not be studied directly because none of the assayed antibodies cross-reacted with hamster a IIb b III .

Nevertheless, experimental data confirms the activation of integrin a IIb b III , and thus aggregation, in the hemodynamic response.

Strong evidence is provided by the facts that a >9-fold expansion of the thrombus following laser irradiation cannot be accounted for by solely platelet adhesion and that embolization of large platelet aggregates was observed in the breakdown phase. The involvement of GPIba in the adhesion process further implies activation of integrin a IIb b III (concurs with the binding of ligands to the GPIb-IX-V complex during platelet adhesion [START_REF] Asazuma | Glycoprotein Ib-von Willebrand factor interactions activate tyrosine kinases in human platelets[END_REF]), which was supported by the reduction in thrombus growth following partial immunoneutralization of GPIba. Also, a IIb b III activation was corroborated by the positive immunolabeling of CD62P that is co-expressed when a IIb b III is activated [START_REF] Andrews | Platelet physiology and thrombosis[END_REF]. Finally, we performed the same experiments in the dorsal vasculature of 3 surplus BALB/c mice (where anti-CD41 antibodies do cross-react with the respective platelet epitope), and confirmed a IIb b III activation during laserinduced thrombosis (Video-S4).

During secondary hemostasis, prothrombin is converted to thrombin by the prothrombinase complex, which exerts pleiotropic effects on both platelets and coagulation. The binding of thrombin to the GPIb-IX-V complex induces platelet adhesion and spreading, dense granule secretion, and a IIb b III activation and subsequent aggregation [START_REF] Adam | Glycoprotein Ib-mediated platelet activation. A signaling pathway triggered by thrombin[END_REF]. It also accelerates the hydrolysis of protease-activated receptor (PAR)-1 (a thrombin receptor) [START_REF] De Candia | Binding of thrombin to glycoprotein Ib accelerates the hydrolysis of Par-1 on intact platelets[END_REF] that further contributes to platelet activation. With respect to coagulation, thrombin mediates the cross-polymerization of fibrin that acts as a support matrix in thrombus fortification. The complete inhibition of thrombin generation at high heparin concentrations did not completely abrogate thrombus formation but substantially reduced the extent and duration of thrombosis. These observations confirm the involvement of the previously mentioned primary hemostasis mechanisms, which do not require thrombin, and attest to a role of coagulation in the hemodynamic response.

Inasmuch as thrombin generation is antagonized by heparin at the level of fXa in the common pathway, it is impossible to deduce whether coagulation was initiated through the tissue factor pathway or the contact activation pathway. The activation of coagulation in our model is, however, in contrast with previous studies [START_REF] Hovig | Measurement of the platelet response to laser-induced microvascular injury. Ultrastructural studies[END_REF][START_REF] Kova ´cs | Evans blue: an ideal energyabsorbing material to produce intravascular microinjury by HE-NE gas laser[END_REF][START_REF] Povlishock | Injury of brain microvessels with a helium-neon laser and Evans blue can elicit local platelet aggregation without endothelial denudation[END_REF], where no fibrin cross-polymerization (secondary hemostasis) was found following laser-induced thrombosis. It should be stressed, however, that the influence of secondary hemostasis was considerably inferior to that of primary hemostasis given that very mild inhibition of CD42b and complete inhibition of thrombin formation generated comparable thrombus kinetics curves. This is quite surprising given the fact that venous thrombosis predominantly entails activation of coagulation rather than platelet aggregation [START_REF] Strachan | An experimental model for the study of venous thrombosis in vivo[END_REF]. Unfortunately, the lack of mouse anti-human fibrin mAb cross-reactivity with hamster fibrin (section-S4) precluded the intravital qualification and quantification of fibrin cross-polymerization in the thrombi.

In conclusion, the hemodynamic response ensues the photothermal response and involves the activation of primary and, to a lesser extent, secondary hemostasis. Laser-induced venular thrombi reach a maximum size at 6.25 min after laser irradiation under very low flow conditions. Primary hemostasis, encompassing platelet adhesion, activation, and aggregation, is mediated by constitutively expressed GPIba but not by activation-dependent Pselectin.

Fig. 2 .

 2 Fig. 2. Intravital microscopy setup (a), consisting of (1) fluorescence microsocope (10Â objective, NA = 0.30, Eclipse E800, Nikon); (2) Peltier-cooled CCD video camera, 25 fps, 720 Â 576 pixel resolution (model L3C65-06BPV01, E2V Technologies); (3) xenon lamp (transillumination); (4) xenon lamp (epi-illumination; model 68806, Oriel); (5) analogue shutter controller; (6) mechanical shutter; (7) frequency-doubled Nd:YAG laser; (8) xyz-translator stage; (9) digital video recorder; (10) monitor; (11) laser probe; (12) reflective mirror; (13) laser beam; (14) animal platform; (15) optical fiber connected to (14); (16) dorsal skin fold chamber; (17) mirror; (18) dorsal skin fold. The animals were placed on a microscope stage-fitted platform that contained three embedded pins that interlocked with holes in the dorsal chamber frames to mechanically secure the skin fold. Insert bottom left corner: microscope optics, arrows indicate the path of light. Filter A (l ex = 480 AE 15 nm) and filter B (l em = 535 AE 20 nm) with a dichroic mirror cuton at 505 nm (orange plane) were used for thrombus imaging (epi-illumination mode), whereas filter C (l ex = 560 AE 20 nm) and D (l em = 630 AE 25 nm) with a dichroic mirror cuton at 595 nm were employed for thermal coagulum imaging in trans-and epi-illumination modes (C-E, 3, 15, and 17). Image analysis procedure (b).For the analysis of CF-stained thrombi (top panel), the margins of the fluorescent lesion were manually contoured by 2 independent analysts. The contoured lesions were saved as separate image files (1) and quantified for pixel area (A pix ) and total intensity (I tot ) using dedicated software. For the analysis of antibody-stained thrombi (bottom panel), the vascular lumen was roughly contoured and saved as a separate image file (2). An intensity histogram of background (2, encircled) was collected from frames of each video sequence at t = 0, 2.5, 5.0, 7.5, and 10.0 min. To characterize the thrombus (3), a threshold range was defined in the programmed macro that had an intensity cut-on value of 5 units higher than the highest recorded intensity value in the 5 background frames. The thrombus was quantified for pixel area (A pix , the total number of 'thrombus pixels') and total intensity (I tot , cumulative intensity of the 'thrombus pixels'). Lesional size was calculated by normalized (A pix ) Á normalized (I tot ) and relative lesional size was calculated by [normalized (A pix Á I tot ) t /normalized (A pix Á I tot ) t=0 ], where t represents a time point in the video sequence and t = 0 represents the time point immediately after the laser pulse, defined as baseline.

Fig. 3 .

 3 Fig. 3. Laser-induced semi-obstructive thermal coagulum formation in hamster dorsal skin fold venules visualized in brightfield and fluorescence mode. Fluorescent microspheres were injected intravenously to monitor blood flow. Thermal coagula either remained attached (a-d) or detached immediately after the laser pulse (e-h) without causing luminal occlusion due to the limited penetration depth of 532-nm light in blood. Translucent aggregates resembling a thrombus appeared at the site of laser irradiation (arrowheads), even in the absence of a thermal coagulum (h, arrowhead). A = arteriole, V = venule, semi-opaque ellipses correspond to sites of laser impact, arrows indicate direction of flow, the time relative to the laser pulse is indicated in the upper right corner (min:sec).

Fig. 4 .

 4 Fig. 4. Aggregation of 5(6)-carboxyfluorescein (CF)-labeled platelets at the site of laser-induced damage in the absence (a-f) and presence (g-l) of heparin (Hep). The bright ellipse in (a) is the laser spot. A = arteriole, V = venule, arrows indicate direction of flow, and the time relative to the laser pulse is indicated in the upper right corner (min:sec). The arrowhead in (b) indicates a region of residual hyperfluorescence as a result of heat-mediated CF release from thermosensitive liposomes. The arrowhead in (g) points to a remnant thermal coagulum. The lesional sizes (hemodynamic contribution only) with minima (Min) and maxima (Max) are plotted vs. time for CF-labeled platelets (m, n = 14) and for CF-labeled platelets in the presence of heparin (n, n = 11). The Min and Max values represent the minimum and maximum values of all lesional sizes calculated for all animals in the experimental group. In (o), the relative lesional size is depicted vs. time. The vertical lines indicate peak sizes for CF (dark) and CF + Hep (light). In (m) and (n), lesional sizes (normalized (A pix ) Á normalized (I tot )) were normalized to baseline (t = 0, lesional size immediately after the laser pulse) for each experiment and are presented as mean AE SEM per experimental group.

Fig. 5 .

 5 Fig. 5. Laser-induced thrombus formation in the absence (a-f) and presence (g-l) of heparin (Hep) in venules (V) where the thermal coagulum had dislodged. Platelets were fluorescently labeled by the systemic administration of free and liposome-encapsulated 5(6)-carboxyfluorescein (CF). A = arteriole, white arrows indicate direction of flow, black arrows indicate the site of laser irradiation, the time relative to the laser pulse is indicated in the upper right corner (min:sec).

Acknowledgements

We thank Bruno Buys for technical support with the laser system, Nathalie Jouy for cross-reactivity analysis, the (biotechnical) staff at KULAK for peri-orbital blood drawing, and Mies Steenbergen for assistance with the DSC.

Funding sources

This work was partially supported by the Technological Collaboration Grant (TSGE 1048) of the Dutch Ministry of Economic Affairs (MH, JFB), a grant from Novo Nordisk Farma BV (MH), and the Bloodomics project (6th Framework Program of the European Union (LSHM-CT-2004-503485)) (IIS, HD). A patent has been filed for the proposed technology (PCT 2010050833).

Appendix A. Supplementary data

Supplementary data associated with this article can be found, in the online version, at doi:10.1016/j.jdermsci.2011.04.015.