Valérie Miora

Mickaël Andrianjafimasy

Farid Febrissy

Brigitte Zerimech

Hans Dananché

Régis Kromhout

Mohamed Matran

Dominique Nadif

Catherine Oberson-Geneste

Vivi Quinot

Schlünssen

Miora Andrianjafimasy

Mickaël Febrissy

Farid Zerimech

Brigitte Dananché

Hans Kromhout

Régis Matran

Mohamed Nadif

Dominique Oberson-Geneste

Catherine Quinot

Vivi Schlünssen

Valérie Siroux

Jan Paul Zock

Nicole Le Moual

Rachel Nadif

Orianne Dumas
email: orianne.dumas@inserm.fr

Association between occupational exposure to irritant agents and a distinct asthma endotype in adults

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Montpellier: J Bousquet; Paris Cochin: A Lockhart (Egea1), R Matran (now in Lille); Paris Necker: E Paty (Egea1-2), P Scheinmann (Egea1-2); Paris-Trousseau: A Grimfeld (Egea1-2), J Just. Data management and quality: Inserm ex-U155, Paris: J Hochez (Egea1); Inserm U 1018, Villejuif: N Le Moual, L Orsi; Inserm ex-U780, Villejuif: C Ravault (Egea1-2); Inserm ex-U794, Evry: N Chateigner (Egea1-2); Inserm UMR 1124, Paris: H Mohamdi; Inserm U1209, Grenoble: A Boudier, J Quentin (Egea1-2). The authors thank all those who participated to the setting of the study and on the various aspects of the examinations involved: interviewers, technicians for lung function testing and skin prick tests, blood sampling, IgE determinations, coders, those involved in quality control, data and sample management and all those who supervised the study in all centers. The authors are grateful to the three CIC-Inserm of Necker, Grenoble and Marseille who supported the study and in which participants were examined.

They are also grateful to the biobanks in Lille (CIC Inserm), and at Annemasse (Etablissement français du sang) where biological samples are stored. They are indebted to all the individuals who participated, without whom the study would not have been possible.

We thank Theodore Lytras, Eva Andersson, Linnéa Lillienberg and Geza Benke for their contribution to the update of the asthma-specific job-exposure matrix (OAsJEM).

! !

Aim: The biological mechanisms of work-related asthma induced by irritants remain unclear.

We investigated the associations between occupational exposure to irritants and respiratory endotypes previously identified among never asthmatics (NA) and current asthmatics (CA)

integrating clinical characteristics and biomarkers related to oxidative stress and inflammation.

Methods:

We used cross-sectional data from 999 adults (mean 45 years old, 46% men) from the case-control and familial Epidemiological study on the Genetics and Environments of Asthma (EGEA) study. Five respiratory endotypes have been identified using a cluster-based approach: NA1 (n=463) asymptomatic, NA2 (n=169) with respiratory symptoms, CA1 (n=50)

with active treated adult-onset asthma, poor lung function, high blood neutrophil counts and high Fluorescent Oxidation Products level, CA2 (n=203) with mild middle-age asthma, rhinitis and low Immunoglobulin E level, and CA3 (n=114) with inactive/mild untreated allergic childhood-onset asthma. Occupational exposure to irritants during the current or last held job was assessed by the updated Occupational Asthma-specific Job-Exposure Matrix (levels of exposure: no/medium/high). Associations between irritants and each respiratory endotype (NA1 asymptomatic as reference) were studied using logistic regressions adjusted for age, sex and smoking status.

Results: Prevalence of high occupational exposure to irritants was 7% in NA1, 6% in NA2, 16% in CA1, 7% in CA2 and 10% in CA3. High exposure to irritants was associated with CA1

(adjusted Odds Ratio aOR, [95% confidence interval]: 2.7 [1.0-7.3]). Exposure to irritants was not significantly associated with other endotypes (aOR range: 0.8-1.5).

Conclusion:

Occupational exposure to irritants was associated with a distinct respiratory endotype suggesting oxidative stress and neutrophilic inflammation as potential associated biological mechanisms.

What this paper adds

What is already known about this subject?

• Epidemiological studies have suggested a role of repeated, chronic occupational exposure to low/moderate levels of irritant agents in causing asthma.

• Biological mechanisms by which exposure to irritant agents affect respiratory health remain unclear.

What are the new findings?

• High occupational exposure to irritants was associated with a respiratory endotype characterized by active treated adult-onset asthma, poor lung function, high blood neutrophil counts and high Fluorescent Oxidation Products level, a biomarker of damages related to oxidative stress.

• No other endotype was associated with irritants.

How might this impact on policy or clinical practice in the foreseeable future?

• Results provide additional knowledge on the biological mechanisms of irritant-induced asthma, suggesting oxidative stress and neutrophilic inflammation as potential mechanisms.

• If replicated, these findings may help improving the recognition and management of irritant-induced work-related asthma.

Introduction

Asthma is a heterogeneous chronic inflammatory disease encompassing several phenotypes that may have various risk factors including occupational exposures. [START_REF] Beasley | Risk factors for asthma: is prevention possible?[END_REF][START_REF] Dumas | Do chronic workplace irritant exposures cause asthma?[END_REF] More than 500 workplace sensitizing or irritant agents have been identified as possible risk factors for asthma. [START_REF] Dumas | Do chronic workplace irritant exposures cause asthma?[END_REF][START_REF] Tarlo | Occupational asthma[END_REF] Workrelated asthma is thus considered as a good model to study asthma in general. [START_REF] Malo | An Official American Thoracic Society Workshop Report: Presentations and discussion of the fifth Jack Pepys Workshop on Asthma in the Workplace: Comparisons between asthma in the workplace and non-work-related asthma[END_REF] Irritantinduced asthma remains poorly understood. Occupational asthma induced by irritants was first described as sudden onset of asthma after a single high peak of exposure to irritants. [START_REF] Vandenplas | EAACI position paper: Irritant-induced asthma[END_REF] In the last decade, several epidemiological studies have suggested a role of repeated, chronic exposure to low/moderate levels of irritant agents in causing asthma. [START_REF] Dumas | Do chronic workplace irritant exposures cause asthma?[END_REF][START_REF] Vandenplas | EAACI position paper: Irritant-induced asthma[END_REF][START_REF] Dumas | Occupational irritants and asthma: An Estonian cross-sectional study of 34 000 adults[END_REF] However, the biological mechanisms by which exposure to irritant agents affect respiratory health remain unclear. [START_REF] Tarlo | Occupational asthma[END_REF][START_REF] Vandenplas | EAACI position paper: Irritant-induced asthma[END_REF][START_REF] Dumas | Occupational irritants and asthma: An Estonian cross-sectional study of 34 000 adults[END_REF][START_REF] Corradi | Effect of exposure to detergents and other chemicals on biomarkers of pulmonary response in exhaled breath from hospital cleaners: A pilot study[END_REF] One of the biological mechanisms that could underlie irritant-induced asthma is oxidative stress that reflects the imbalance between reactive oxygen species (ROS) and antioxidant defenses in favor of the former. [START_REF] Dumas | Do chronic workplace irritant exposures cause asthma?[END_REF][START_REF] Czerska | Isoprostanes -A novel major group of oxidative stress markers[END_REF][START_REF] Dumas | Occupational exposures and fluorescent oxidation products in 723 adults of the EGEA study[END_REF] Neutrophilic inflammation [START_REF] Dumas | Do chronic workplace irritant exposures cause asthma?[END_REF][START_REF] Tarlo | Occupational asthma[END_REF] has also been suggested. However, few studies have examined the role of these pathways in irritant-induced asthma, especially in human. [START_REF] Corradi | Effect of exposure to detergents and other chemicals on biomarkers of pulmonary response in exhaled breath from hospital cleaners: A pilot study[END_REF][START_REF] Vizcaya | Functional and biological characteristics of asthma in cleaning workers[END_REF] Asthma heterogeneity has classically been approached by investigating different phenotypes, defined as a set of observable clinical characteristics. [START_REF] Howard | Distinguishing Asthma Phenotypes Using Machine Learning Approaches[END_REF] Endotypes, i.e. disease subtypes characterized by a distinct functional or pathobiological mechanism [START_REF] Kaur | Phenotypes and endotypes of adult asthma: Moving toward precision medicine[END_REF] would allow to better understand the biological mechanisms associated with irritant-induced asthma. [START_REF] Howard | Distinguishing Asthma Phenotypes Using Machine Learning Approaches[END_REF] In the Epidemiological study on the Genetics and Environments of Asthma (EGEA), we recently identified five respiratory endotypes using cluster analysis jointly integrating asthma clinical characteristics and biomarkers related to oxidative stress and inflammation. [START_REF] Nadif | Endotypes identified by cluster analysis in asthmatics and non-asthmatics and their clinical characteristics at follow-up: the case-control EGEA study[END_REF] In particular, we identified among asthmatics an endotype characterized by poor lung function, respiratory symptoms, high level of fluorescent oxidation products (FlOPs, a biomarker of damages related to oxidative stress), and high blood neutrophil counts. We hypothesized occupational exposure to irritants may be associated to this specific endotype.

The updated Occupational Asthma-specific Job Exposure Matrix (OAsJEM), [START_REF] Moual | Update of an occupational asthma-specific job exposure matrix to assess exposure to 30 specific agents[END_REF] of the former asthma-specific job exposure matrix,[15] has recently been published with improved assessment of occupational exposure, specifically for irritant agents. Taking advantage of these novel exposure data and the identification of respiratory endotypes in EGEA, we investigated the associations between occupational exposure to irritants and respiratory endotypes.

Methods

The Participants signed a written informed consent.

At EGEA2, participants with "ever asthma" were those recruited as cases at EGEA1, or family members or controls who answered positively to one of two standardized questions. Among participants with ever asthma, current asthma was defined by respiratory symptoms, asthma attacks or treatment in the past 12 months (see online supplement).

Selection of the study population

The present cross-sectional study was based on data collected at the first follow-up (EGEA2).

Participants less than 16 years old (n=31), those with ever asthma but without current asthma (n=125), or with missing data for any of the clinical and biological characteristics used to define endotypes (n=378) were excluded from the analyses. We also excluded participants who had never worked (n=60) or with missing data for occupational history (n=4). Finally, because our analysis focused on exposure to irritants, we excluded participants exposed only to occupational sensitizers in the current or last held job (n=5, all only exposed to high molecular weight agents). In total, 999 participants were selected (online supplementary Figure E1).

Occupational exposure to irritant agents

Complete occupational history was collected at EGEA2 with information on job, industry and tasks. Jobs were coded according to the International Standard Classification of Occupation 1988 (ISCO-88) by an experienced coder. Occupational exposures to 30 agents at risk for asthma classified in seven groups were estimated using the OAsJEM (http://oasjem.vjf.inserm.fr/index-en.htm). [START_REF] Moual | Update of an occupational asthma-specific job exposure matrix to assess exposure to 30 specific agents[END_REF] To improve the exposure estimate, the OAsJEM assessment was completed by an expert reassessment step for selected job codes defined a priori and regrouping jobs with heterogeneous tasks and/or industries. If the job description provided sufficient information, two experts (BD, DOG) reevaluated exposure levels case-bycase, independently of each other and blinded of asthma status. In case of disagreement between the experts, the final decision was taken by consensus (BD, DOG, CQ, NLM).

In the present study, we considered exposures to 19 agents known or suspected to cause asthma through irritant mechanisms, including chronic low-to-moderate level of exposures. Within this large group of irritant agents, two partly overlapping subgroups were further identified: highly reactive chemicals (eight agents) and biocides (five agents). In addition, we grouped three specific agents in a subgroup "cleaning products / disinfectants" (online supplementary Table E1). Among the 19 irritant agents, nine agents were also classified as low molecular weight (LMW) sensitizers, because for these nine agents both mechanisms have been suggested [START_REF] Moual | Update of an occupational asthma-specific job exposure matrix to assess exposure to 30 specific agents[END_REF] (online supplementary Table E1).

The OAsJEM classified exposures to each irritant agent into three classes: "high" for high probability of exposure and moderate-to-high intensity, "medium" for low-to-moderate probability or low intensity of exposure, and "no" for unlikely to be exposed. When analyzing groups of agents, the maximum exposure level among all agents in the group was considered.

In all analyses, the reference group included participants classified as "non-exposed" to all of the 30 agents of the OAsJEM.

Definition of respiratory endotypes

Five respiratory endotypes were previously identified by cluster analysis [START_REF] Nadif | Endotypes identified by cluster analysis in asthmatics and non-asthmatics and their clinical characteristics at follow-up: the case-control EGEA study[END_REF] and are described in E2.

Statistical analyses

Chi-squared tests and Fisher exact tests were used to study the association between occupational exposure to irritant agents and each endotype in univariate models. Logistic regression models using generalized estimated equation (GEE) were performed to take into account familial dependence, and adjusted for age (continuous), sex and smoking status (non-smokers, ex-and current smokers). In the main analyses, irritant agents were estimated by OAsJEM completed by the expert reassessment step. As clinical characteristics integrated in the definition of endotypes have been defined in the last 12 months and three endotypes have been defined

among current asthmatics, exposures of interest were evaluated for the current or last held jobs.

In a secondary analysis, we investigated the association between lifetime occupational exposure (instead of current exposure) to irritants and respiratory endotypes. In all models, the endotype of asymptomatic never asthmatics (NA1) was used as reference group for the outcome and "no exposure" to any OAsJEM agent was used as reference group for occupational exposure.

Three sensitivity analyses were carried out. First, we studied association between irritant agents estimated by OAsJEM only i.e without the expert reassessment step. Second, due to the partial overlap between the subgroups of irritants and LMW agents, we studied the associations between occupational exposures to LMW agents and endotypes. Third, the main analysis does not adjust for BMI as obesity has been described as an asthma comorbidity and asthma in obese patients may correspond to a specific asthma endotype. [START_REF] Peters | Obesity and Asthma[END_REF] However, as high BMI has also been described as a risk factor for asthma, [START_REF] Peters | Obesity and Asthma[END_REF] BMI was added to the other confounders in a sensitivity analysis.

Statistical analyses were performed using SAS statistical software (version 9.4; SAS Institute, Cary, NC, USA). A p-value of <0.05 was considered statistically significant.

Results

Characteristics of the study population

Table 2 shows the personal and clinical characteristics of the 999 participants and according to respiratory endotypes. The mean age of all participants was 45 years, 54% were women, 22%

were current smokers and 11% were obese. Among endotypes in never asthmatics, participants in NA1 (n=463) had an average age of 47 years, 55% were women. In NA2 (n=169), 65% were women, 30% were current smokers and 35% were overweight. Among endotypes in current asthmatics, participants in CA1 (n=50) had an average age of 53 years, 12% were current smokers, 30% were overweight and 26% were obese. In CA2 (n=203), 33% were ex-smokers, and 33% were overweight. Participants in CA3 (n=114) were younger with an average age of 32 years, 62% were men and 33% were current smokers.

Occupational exposure to irritant agents in each respiratory endotype is described in Table E3 in online supplement. Among all participants, 72% had no exposure to irritants, 21% had medium exposure and 8% had high exposure. Regarding subgroups of irritants 4% of all participants had high exposure to highly reactive chemicals or biocides and 3% had high exposure to cleaning and disinfecting products. CA1 had the highest percentage of participants with high exposure to any irritant agents as well as each subgroup of irritants. The job titles of the eight participants in the CA1 endotype with high occupational exposure to irritants are described in Table E4 (online supplement). After the expert reassessment step, the number of participants classified with high or medium exposure slightly decreased while the number of participants classified as unexposed slightly increased (online supplementary Table E5).

Associations between occupational exposure to any irritant agents and respiratory endotypes

We observed a positive and significant association between high exposure to irritant agents and CA1 (vs. NA1, adjusted odds-ratio (aOR) [95% CI] = 2.70 [1.00 -7.33], Table 3). No significant association was observed between medium exposure to irritants and CA1. We did not observe any significant association between any irritant agents and the other endotypes. Similar results

were observed with exposure to irritants estimated without the expert reassessment step (aOR 19 -6.56] for CA1 vs. NA1, online supplementary Table E6).

[95% CI] = 2.79 [1.
When we further adjusted for BMI, results remained similar with ORs>2.5 for the association between irritants and CA1 (online supplementary Table E7). We did not observe a significant association between lifetime occupational exposure to irritants and CA1 nor the other endotypes (Table 4).

Associations between occupational exposure to subgroups of irritants and CA1 endotype

Despite the small sample size, we observed an association between high exposure to biocides and CA1 (aOR [95%CI] = 3.13 [1.00 -9.83], online supplementary Table E8). Despite ORs higher than 2, there was no significant association between occupational exposure to highly reactive chemicals and cleaning products/disinfectants and CA1. Similar results were observed for subgroups of irritants estimated without the expert reassessment step. No significant association was observed between occupational exposure to LMW agents and CA1 (data not shown).

Discussion

The present study investigated the associations between occupational exposure to irritant agents and respiratory endotypes identified by a cluster analysis among never-asthmatics and among current asthmatics separately. We observed a significant association between current high exposure to irritant agents and an endotype predominantly characterized by adult-onset asthma, poor lung function, respiratory symptoms, high blood fluorescent oxidation product level and high neutrophil counts.

In our study, most of the asthmatics were recruited in chest clinics as asthma cases, with careful procedures set up to include true asthmatics, and others were mostly recruited as first-degree relatives of asthmatic cases, leading to the recruitment of participants with a wide range of asthma severity and control. The availability of key biomarkers related both to asthma and to inflammatory or oxidative stress pathways allowed identifying specific respiratory endotypes. [START_REF] Nadif | Endotypes identified by cluster analysis in asthmatics and non-asthmatics and their clinical characteristics at follow-up: the case-control EGEA study[END_REF] The characteristics included in the cluster analysis reflect as comprehensively as possible the participants' demographic, clinical and biological characteristics. We excluded variables missing for many participants such as the measurement of the exhaled fraction of nitric oxide (FeNO) which could have been useful to define the clusters. The EGEA study provides a relatively large sample of individuals with detailed characteristics on endotype (n=999). However, analyses by endotype resulted in smaller groups of individuals, in particular for the main endotype of interest (CA1, n=50), which is a limitation. Thus, although our findings are consistent with our a priori hypothesis of an association between occupational exposure to irritants and endotype CA1, they should be interpreted with caution and need to be confirmed in other studies. We used the recently updated OAsJEM [START_REF] Moual | Update of an occupational asthma-specific job exposure matrix to assess exposure to 30 specific agents[END_REF] to improve exposure assessment. Indeed, the number of estimated agents has increased, ranging from 22 agents estimated by the previous asthma-specific JEM [15] to 30 agents at risk for asthma by the new OAsJEM. These 30 agents have been classified in large groups distinguishing sensitizers from irritants which is of interest for studying their associations with distinct respiratory endotypes.

We investigated the association between several subgroups of irritants (biocides, highly reactive chemicals and cleaning products / disinfectants) and the endotype CA1. Despite the significant association for high exposure to any irritants, we did not observe significant association with specific subgroups. The analyses of subgroups of irritants were limited by the small sample size and should therefore be interpreted with caution. Nonetheless, they were consistent with those for the large group of irritants with ORs of the same order of magnitude (all >2.0). These subgroups of irritants were associated with asthma in previous studies. Indeed, associations between occupational exposure to pesticides, [START_REF] Mamane | Occupational exposure to pesticides and respiratory health[END_REF][START_REF] Levan | Vapor, dust, and smoke exposure in relation to adult-onset asthma and chronic respiratory symptoms: the Singapore Chinese Health Study[END_REF] classified in the biocides group in our study, and to cleaning products/disinfectants [START_REF] Vizcaya | Functional and biological characteristics of asthma in cleaning workers[END_REF][START_REF] Svanes | Cleaning at Home and at Work in Relation to Lung Function Decline and Airway Obstruction[END_REF][START_REF] Archangelidi | Cleaning products and respiratory health outcomes in occupational cleaners: A systematic review and meta-analysis[END_REF] and asthma have been reported. Beside irritant mechanisms, other biological mechanisms could be involved: cleaning products/disinfectants are mixtures of substances that can be irritants or sensitizers [START_REF] Saito | Characterization of Cleaning and Disinfecting Tasks and Product Use Among Hospital Occupations[END_REF] and pesticides have been associated with allergic asthma in some studies. [START_REF] Mamane | Occupational exposure to pesticides and respiratory health[END_REF] Studies with a larger sample size would be needed to precise the relationships for these subgroups and specific agents.

The association between current occupational exposure to irritants and CA1, and not with lifetime exposure might be related to the endotype definition. Indeed, since respiratory endotypes included clinical characteristics assessed over the last 12 months, reflecting the current activity of the disease, stronger associations were expected with current exposure rather than with past exposure. However, larger studies would be needed to study more accurately the temporal relationship between occupational exposures and endotypes. In addition, although CA1 included mostly participants with adult-onset asthma, we could not differentiate occupational asthma and work-exacerbated asthma, and the observed association may reflect both types of work-related asthma. We did not observe an association between occupational exposure to LMW agents and CA1 nor the other endotypes. These results are consistent with the hypothesis of different biological mechanism for LMW agents, possibly involving a specific immune response, with or without specific IgE production. [START_REF] Vandenplas | Are high-and low-molecular-weight sensitizing agents associated with different clinical phenotypes of occupational asthma?[END_REF][START_REF] Maestrelli | Mechanisms of occupational asthma[END_REF] The OAsJEM evaluated chronic exposure to low/moderate levels of irritants, considered as nonaccidental, and not peaks of exposure to irritants. The exposures estimated by the OAsJEM were completed by an expert reassessment step. Both the OAsJEM and the reassessment step have been developed by favoring specificity for high level of exposure rather than sensitivity. [START_REF] Moual | Update of an occupational asthma-specific job exposure matrix to assess exposure to 30 specific agents[END_REF][START_REF] Ge | Use and reliability of exposure assessment methods in occupational case-control studies in the general population: Past, present, and future[END_REF][START_REF] Bouyer | Retrospective evaluation of occupational exposures in population-based case-control studies: general overview with special attention to job exposure matrices[END_REF] This trade-off between sensitivity and specificity generally increases the positive predictive ability of a JEM. [START_REF] Ge | Use and reliability of exposure assessment methods in occupational case-control studies in the general population: Past, present, and future[END_REF] However, it also reduces the number of subjects classified as exposed, thus possibly decreasing statistical power to detect associations.

Nonetheless, our results were almost similar whatever the exposure estimation. Although the possibility of unmeasured confounding can never be ruled out, our analyses were adjusted for the confounders (age, sex, smoking status) usually used in the literature to study the relationships between occupational exposure and asthma, and further adjustment for BMI in a sensitivity analysis led to similar results. Analyses were not adjusted for education level or socioeconomic status as adding these variables may result in overadjustment in models investigating health effects of occupational exposures, and lead to biased results. [START_REF] De Matteis | Occupations associated with COPD risk in the large population-based UK Biobank cohort study[END_REF] Finally, previous analyses in this cohort have suggested a healthy worker effect, [START_REF] Dumas | Work related asthma. A causal analysis controlling the healthy worker effect[END_REF] which may have led to underestimated or null associations. However, it is notable that we observed a positive association between current exposure and endotype CA1 despite this potential bias.

To our knowledge, this study is the first to investigate the association between occupational exposure to irritants and respiratory endotypes identified by cluster analysis integrating personal, clinical, functional and biological characteristics. Among 2030 healthcare workers, Su et al. identified five asthma clusters using hierarchical clustering and differentially associated with five clusters of irritant exposures. [START_REF] Su | Clustering asthma symptoms and cleaning and disinfecting activities and evaluating their associations among healthcare workers[END_REF] However, the asthma clusters were identified without integrating biological markers and exposure was restricted to cleaning products, making direct comparison with our results difficult. Other studies conducted in clinical settings performed cluster analysis of occupational asthma integrating biological markers (FeNO, [START_REF] Lemiere | Occupational asthma phenotypes identified by increased fractional exhaled nitric oxide after exposure to causal agents[END_REF] blood level of neutrophils and eosinophils [START_REF] Mason | Cluster analysis of occupational asthma caused by isocyanates[END_REF]), and studied occupational exposures to specific agents (diisocyanates) or groups of HMW or LMW agents, [START_REF] Lemiere | Occupational asthma phenotypes identified by increased fractional exhaled nitric oxide after exposure to causal agents[END_REF][START_REF] Mason | Cluster analysis of occupational asthma caused by isocyanates[END_REF] but did not include patients with irritant-induced asthma.

Statistical clustering approaches are useful to identify disease endotypes based on a large number of clinical and biological characteristics in the context of highly heterogeneous diseases such as asthma. However, addressing the stability of the resulting clusters and their clinical interpretation is always challenging. Thus, comparison with studies using a priori definitions of asthma phenotypes/endotypes is important. Our results are consistent with previous studies which examined individually some of the asthma characteristics included in the definition of endotypes in relation to occupational exposure to irritants. The endotype CA1 was predominantly characterized by adult-onset asthma, poor lung function and respiratory symptoms. Previous studies have shown associations between cleaning products with respiratory symptoms and lower lung function among asthmatics [START_REF] Archangelidi | Cleaning products and respiratory health outcomes in occupational cleaners: A systematic review and meta-analysis[END_REF] or lung function decline independently of asthma. [START_REF] Svanes | Cleaning at Home and at Work in Relation to Lung Function Decline and Airway Obstruction[END_REF][START_REF] Moual | Occupational exposures estimated by means of job exposure matrices in relation to lung function in the PAARC survey[END_REF] Exposure to vapors, dust, gas and fumes, agents generally considered as irritants, has been associated with poor lung function or lung function decline in many studies. [START_REF] Moual | Occupational exposures estimated by means of job exposure matrices in relation to lung function in the PAARC survey[END_REF][START_REF] Omland | Occupational chronic obstructive pulmonary disease : a systematic literature review[END_REF] CA1 was also characterized by a high level of FlOPs, a biomarker of damages related to oxidative stress. In the EGEA study, [START_REF] Dumas | Occupational exposures and fluorescent oxidation products in 723 adults of the EGEA study[END_REF] we previously reported that among men without asthma, occupational exposure to irritants and chemicals was associated with higher level of plasma FlOPs. A few other studies investigated the association between biomarkers related to oxidative stress and occupational asthma induced by irritants. Corradi et al. [START_REF] Corradi | Effect of exposure to detergents and other chemicals on biomarkers of pulmonary response in exhaled breath from hospital cleaners: A pilot study[END_REF] showed that exhaled breath condensate (EBC) H2O2 level, was significantly higher in hospital cleaners as compared to controls. Casimirri et al. [START_REF] Casimirri | Biomarkers of oxidative-stress and inflammation in exhaled breath condensate from hospital cleaners[END_REF] showed that EBC malondialdehyde level, was higher among cleaners compared to non-exposed controls. In contrast, Vizcaya et al. [START_REF] Vizcaya | Functional and biological characteristics of asthma in cleaning workers[END_REF] did not observe an association between occupational exposure to cleaning products and 8-isoprostanes, another biomarker of lipid peroxidation. Although these studies differ in terms of biological compartment and type of biological marker (reactive oxygen species, lipid peroxidation), overall results including ours, support the role of oxidative stress as one potential mechanism by which occupational exposure to irritants may affect asthma.

Participants in CA1 were also characterized by a high level of neutrophil counts. To our knowledge, few studies investigated the role of non-eosinophilic inflammation in irritantinduced asthma. [START_REF] Matulonga | Women using bleach for home cleaning are at increased risk of non-allergic asthma[END_REF][START_REF] Mcgovern | Neutrophils mediate airway hyperresponsiveness after chlorine-induced airway injury in the mouse[END_REF] In the Lifelines cohort, occupational exposures to chemicals and pesticides were associated with a lower count of neutrophils at baseline, but no association was found in the longitudinal analysis. [START_REF] Faruque | Airborne occupational exposures and inflammatory biomarkers in the Lifelines cohort study[END_REF] In contrast, in EGEA, Matulonga et al. [START_REF] Matulonga | Women using bleach for home cleaning are at increased risk of non-allergic asthma[END_REF] reported an association between frequent use of bleach for home cleaning and high neutrophil counts in women with current asthma. In a murine model of irritant-induced asthma, McGovern et al. [START_REF] Mcgovern | Neutrophils mediate airway hyperresponsiveness after chlorine-induced airway injury in the mouse[END_REF] showed that neutrophils were significantly increased after exposure of mice to chlorine gas, a well-known irritant agent. Our results were consistent with the latter findings, suggesting a role of neutrophilic inflammation, in addition to oxidative stress, as potential mechanisms by which occupational exposure to irritants may affect asthma. This hypothesis appears especially relevant since these two mechanisms are closely related. [START_REF] Corradi | Effect of exposure to detergents and other chemicals on biomarkers of pulmonary response in exhaled breath from hospital cleaners: A pilot study[END_REF] In addition, the absence of association between irritants and the endotype characterized by allergic sensitization and high IgE level (CA3) observed in our study is consistent with the hypothesis of a non-allergic/nonimmunologic mechanism of irritant-induced asthma. [START_REF] Dumas | Do chronic workplace irritant exposures cause asthma?[END_REF]

Conclusion

Overall, our study shows that occupational exposure to irritants, including chronic low-tomoderate level of exposure, is related to an asthma endotype characterized by poor lung function, respiratory symptoms, high level of fluorescent oxidation products and neutrophil counts. Our results provide additional knowledge on the biological mechanisms of irritantinduced asthma, suggesting oxidative stress and neutrophilic inflammation as potential mechanisms. They support the usefulness of distinct asthma endotypes when studying risk factors for asthma. If replicated, our findings may help improving the recognition and management of irritant-induced work-related asthma. Other studies, in an epidemiological or clinical setting, and possibly including additional relevant pathways for irritant-induced asthma, such as neurogenic inflammation involving transient receptor potential (TRP) channels [START_REF] De Matteis | Respiratory Health Effects of Exposure to Cleaning Products[END_REF] would be useful to further characterize asthma endotypes related to irritant exposures. Data are presented as n (%) or mean ± SD unless otherwise stated. GM: geometric mean; Q1: 1 st quartile; Q3: 3 rd quartile. * Included as continuous variables in the cluster analysis. FEV1: forced expiratory volume in one second; IgE: immunoglobulin E; FlOPs: fluorescent oxidation products, a biomarker of damages related to oxidative stress; GM: geometric mean; §five-level of asthma symptom score based on the number of respiratory symptoms during the past 12 months [START_REF] Sunyer | Asthma score: predictive ability and risk factors[END_REF], not included in the cluster analysis.

Word counts: 3515 words

EGEA study

	EGEA is a French cohort started in 1990s with two follow-ups over 20 years. The first EGEA
	survey (EGEA1) included cases with asthma recruited in five chest clinics, their first-degree
	relatives and population-based controls (n=2047). A first follow-up of the participants was
	completed in 2003-2007 (EGEA2), including 1602 subjects with complete examination, almost
	exclusively adults (98%). At each survey, participants answered a standardized questionnaire
	on asthma, occupational history and environmental exposures. The protocol and participants'
	characteristics have been described previously,[16] and details are provided in online
	supplement. The EGEA collection was certified ISO 9001 (2006-2018) and is referenced in the
	Biobank network.[17] Ethical approval was obtained from the relevant institutional review
	board committees (Cochin Port-Royal Hospital and Necker-Enfants Malades Hospital, Paris).

Table 1

 1

: two among never asthmatics (NA) and three among current asthmatics (CA), after taking into account a total of 23 variables for never asthmatics and 28 variables for current asthmatics. Cluster analysis jointly considered personal (age, sex, smoking status and BMI), clinical/functional (age of asthma onset, respiratory symptoms, asthma treatments, dyspnoea, skin prick tests positivity for at least one of 12 aeroallergens, current rhinitis, ever eczema, asthma attacks, hospital or emergency admission, forced expiratory volume in 1 second (FEV1) and forced vital capacity (FVC), and biological (neutrophil and eosinophil counts, total IgE and level of Fluorescent oxidation products) characteristics. More details on variables and cluster analysis used to define respiratory endotypes are provided in online supplement. A detailed description of all characteristics included in the cluster analysis is shown in online supplementary Table

Table 1 : Description of the five respiratory endotypes

 1

	Name	Description	n (%)
	Among non-asthmatics
	NA1	Asymptomatic: absence of symptoms	463 (46.3)
	NA2	Respiratory symptoms and dyspnea,	169 (16.9)
		use of Inhaled Corticosteroids, high
		neutrophil and eosinophil counts
	Among current asthmatics
	CA1	Active treated (active asthma and use	50 (5.0)
		of asthma treatments), adult-onset
		asthma, poor lung function,
		respiratory symptoms, highest FlOPs
		level and neutrophil count
	CA2	Rhinitis and low IgE level	203 (20.3)
	CA3	Childhood-onset asthma, allergic	114 (11.4)
		sensitization, and highest IgE level

FlOPs: fluorescents oxidation products, a biomarker of damages related to oxidative stress; IgE: immunoglobulin E.

Table 2 : Description of personal, clinical and biological characteristics of the study population at EGEA2 (N=999) according to respiratory endotypes

 2

	All participants	Never asthmatics		Current asthmatics
	N=999	(n=632)			(n=367)
		NA1	NA2	CA1	CA2	CA3
		n=463	n=169	n=50	n=203	n=114

Table 3 : Associations between current occupational exposure to any irritant agents and respiratory endotypes (N=999) Occupational exposure to any irritant agents

 3 Significant results in bold. #n total (n in NA2, CA1, CA2 or CA3 vs. n in NA1); OR: odds ratio for the association between occupational exposure and each endotype (NA2, CA1, CA2 or CA3 vs. NA1) *adjusted for age, sex and smoking status; §for the univariate model (crudeOR), p-values correspond to p-values of Chi-squared test or Fisher exact test.

		No exposure	Medium	p §	High	p §
	NA2 vs. NA1
	n #	455 (122 vs. 333)	132 (36 vs. 96)		44 (11 vs. 33)
	crudeOR (95% CI)	1	1.03 (0.66-1.60)	0.92	0.91 (0.46-1.81)	0.80
	*adjustedOR (95% CI)	1	0.98 (0.61-1.56)	0.93	0.93 (0.46-1.89)	0.85
	CA1 vs. NA1
	n #	367 (34 vs. 333)	104 (8 vs. 96)		41 (8 vs. 33)
	crudeOR (95% CI)	1	0.78 (0.35-1.72)	0.62	2.53 (1.02-6.27)	0.05
	*adjustedOR (95% CI)	1	0.77 (0.34-1.74)	0.52	2.70 (1.00-7.33)	0.05
	CA2 vs. NA1
	n #	483 (150 vs. 333)	134 (38 vs. 96)		48 (15 vs. 33)
	crudeOR (95% CI)	1	0.85 (0.56-1.30)	0.55	1.02 (0.51-1.98)	0.98
	*adjustedOR (95% CI)	1	0.87 (0.56-1.34)	0.52	1.04 (0.52-2.10)	0.91
	CA3 vs. NA1
	n #	408 (75 vs. 333)	124 (28 vs. 96)		44 (11 vs. 33)
	crudeOR (95% CI)	1	1.28 (0.78-2.12)	0.30	1.49 (0.72-3.07)	0.29
	*adjustedOR (95% CI)	1	1.19 (0.69-2.07)	0.53	1.28 (0.56-2.90)	0.56

Table 4 : Associations between lifetime occupational exposure to any irritant agents and respiratory endotypes Lifetime occupational exposure to any irritant agents

 4 OR : odds ratio for the association between occupational exposure and each endotype (NA2, CA1, CA2 or CA3 vs. NA1) *adjusted for age, sex and smoking status. #n total (n in NA2, CA1, CA2 or CA3 vs. n in NA1).

		No exposure	Medium exposure	High exposure
	NA2 vs. NA1
	n #	303 (83 vs 220)	177 (50 vs 127)	151 (36 vs 115)
	crudeOR (95% CI)	1	1.04 (0.70-1.56)	0.83 (0.53-1.30)
	*adjustedOR (95% CI)	1	1.09 (0.71-1.67)	0.84 (0.52-1.35)
	CA1 vs. NA1
	n #	240 (20 vs 220)	141 (14 vs 127)	131 (16 vs 115)
	crudeOR (95% CI)	1	1.23 (0.61-2.46)	1.54 (0.76-3.12)
	*adjustedOR (95% CI)	1	1.28 (0.65-2.53)	1.37 (0.60-3.14)
	CA2 vs. NA1
	n #	324 (104 vs 220)	186 (59 vs 127)	155 (40 vs 115)
	crudeOR (95% CI)	1	0.97 (0.67-1.41)	0.73 (0.48-1.12)
	*adjustedOR (95% CI)	1	0.92 (0.62-1.35)	0.77 (0.49-1.21)
	CA3 vs. NA1
	n #	276 (56 vs 220)	166 (39 vs 127)	134 (19 vs 115)
	crudeOR (95% CI)	1	1.19 (0.76-1.86)	0.62 (0.36-1.09)
	*adjustedOR (95% CI)	1	1.04 (0.62-1.72)	0.69 (0.36-1.33)

Acknowledgements: EGEA cooperative group. Coordination: V Siroux (epidemiology, PI since 2013); F Demenais (genetics); I Pin (clinical aspects); R Nadif (biology); F Kauffmann (PI 1992-2012). Respiratory epidemiology: Inserm ex-U 700, Paris: M Korobaeff (Egea1), F Neukirch (Egea1); Inserm ex-U 707, Paris: I Annesi-Maesano (Egea1-2); Inserm U 1018, Villejuif: O Dumas, F Kauffmann, N Le Moual, R Nadif, MP Oryszczyn (Egea1-2), R Varraso; Inserm U 1209 Grenoble: J Lepeule, V Siroux. Genetics: Inserm ex-U 393, Paris: J Feingold; Inserm UMR 1124, Paris: E Bouzigon, MH Dizier, F Demenais; CNG, Evry: I Gut (now CNAG, Barcelona, Spain), M Lathrop (now Univ McGill, Montreal, Canada). Clinical centers: Grenoble: I Pin, C Pison; Lyon: D Ecochard (Egea1), F Gormand, Y Pacheco;Marseille: D Charpin (Egea1), D Vervloet (Egea1-2);

This work was funded by the Fonds AGIR pour les maladies chroniques, the French Agency for Food, Environmental and Occupational Health & Safety (ANSES/AFSSET, EST-09-15, PNR-EST 2017), Merck Sharp & Dohme (MSD), the National hospital program of clinical research (PHRC-National 2012, EvAdA), the National Research Agency -Health Environment, Health-Work Program (ANR CES-2009), and the Région Hauts de France.

Data availability:

Due to third party restrictions, EGEA data are not publicly available. Please see the following URL for more information: https://egeanet.vjf.inserm.fr/index.php/en/contacts-en.

Interested researchers should contact egea.cohorte@inserm.fr with further questions regarding data access.

Competing interest:

No, there are no competing interests for any author.

Ethics approval statements: Human participants

Ethical approval was obtained from the relevant institutional review board committees (Cochin Port-Royal Hospital and Necker-Enfants Malades Hospital, Paris). Participants signed a written informed consent.


Joelle Abou Faysal
email: joelle.abou-faysal@etu.univ-cotedazur.fr

Nour Zalmai
email: nour.zalmai@renault.com

Ankica Barisic
email: ankica.barisic@univ-cotedazur.fr

Frederic Mallet
email: frederic.mallet@univ-cotedazur.fr

EPSAAV: An Extensible Platform for Safety Analysis of Autonomous Vehicles

Keywords: Autonomous cars, Safety, Model development and verification, Testing and simulating, Formal methods, Rule-Based Planner

In this paper, a novel model related to the safety of autonomous vehicles (AVs) is presented. A simulation platform is designed to analyze the environment and the trajectory of AVs within a given Operational Design Domain (ODD). This platform relies on model-based systems and includes the environment model, safety rules and their priorities, and execution scenarios. The goal is to create a simulation environment that enables safety experts to detect rule breaches by analyzing problems at run-time using generated monitors. Therefore, this platform will help to reevaluate the existing rules in two ways: either by reconsidering rule priorities or by proposing new rules to be integrated into the existing safety model. The validation and verification of the generated rules will follow a process based on the history of the executed scenarios. All the aforementioned work is carried out by using the GEMOC initiative tool to coordinate models using logical time.

Introduction

With the advent of autonomous vehicles (AVs), engineers have witnessed several deaths and accidents that raise troubling questions about the safety of such vehicles and the current limitations of the technology. Automobile manufacturers are facing an increasing demand for reliable handling of these autonomous vehicles. It is, therefore, crucial to provide concrete evidence to measure how safe AVs are. Safety is associated with guarantees that certain conditions must be met when contingencies arise. If not, the behavior must be adjusted accordingly. In dynamic environments, real-time safety checks of the planned trajectories and the driver are sometimes lacking to ensure that the trajectories obtained from trip planning are safe. Nowadays, 90% of car accidents are caused by human errors, such as poor judgment due to a failure of human perception or the driver's lack of attention [START_REF] Vanbever | Self-driving networks: Breaking new ground in network automation[END_REF]. It is important to show that the autonomous vehicle makes better decisions than a human driver under all circumstances. One proposal to assess operational safety is to test-drive AVs in real traffic and observe their behavior. As logical as this may sound, it is not efficient because it poses significant risks to the environment. We can look at the Uber accident [START_REF] Kalra | Driving to safety: How many miles of driving would it take to demonstrate autonomous vehicle reliability?[END_REF] where the driver was doing mileage tests in Arizona. Several things went wrong while the driver was not paying attention to the road: there was no real-time driver safety check, and Uber did not have the resources in the vehicle to assess the driver's attention. Mileage testing requires a lot of time and testing to ensure safety, and that doesn't make them scalable [3]. The dilemma of how many miles autonomous vehicles would need to be driven to demonstrate safety leads to an answer of 8 billion miles in 400 years with a fleet of 100 vehicles driving all the time [3]. This is somehow impossible and unachievable as several works argue that AVs cannot express safety capabilities based on road tests alone [START_REF] Koopman | Challenges in autonomous vehicle testing and validation[END_REF]- [START_REF] Shalev-Shwartz | On a formal model of safe and scalable self-driving cars[END_REF]. Therefore, simulation testing becomes a promising alternative [START_REF] Yan | Distributionally consistent simulation of naturalistic driving environment for autonomous vehicle testing[END_REF]. Moreover, since AVs are currently tested only in limited Operational Design Domains (ODDs), they are not exposed to the wide variety of driving conditions and road user behaviors. Thus, we need rigorous and exhaustive approaches to ensure operational safety. In the typical software development lifecycle, we try to translate needs into natural language requirements and produce code that meets them. However, it is only after the code has been produced and tested that we discover errors between what was intended and what was built. The same problems occur when testing scenarios. To avoid these problems, Model-Based System Engineering (MBSE) approaches offer a promising alternative by enabling domain models as a communication medium between engineers instead of text documents and supporting automatic code generation. Many researchers now agree that MBSE approaches are a solution for security verification and are seen as an answer to these challenges [START_REF] Soremekun | Systems engineering challenges and mbse opportunities for automotive system design[END_REF]. MBSE helps to deal with the increasing size and complexity of systems [START_REF] Duprez | An mbse modeling approach to efficiently address complex systems and scalability[END_REF], and allows to reason on the model before deployment, Formal modeling and verification in automotive systems are essential to provide sufficient guarantees, especially in the case of dangerous and unforeseen situations.

In this paper, an MBSE approach is proposed based on a simulation environment where a safety rule monitor is specified and generated. It helps us to define types of breaches on an AV trajectory. The main goal is to develop a resilient and safe driver monitoring system that continues to operate safely as long as the assumptions about the environment are satisfied. To sum up, the proposed approach brings a light overview of the four goals pursued: (1) formal modeling of safety rules with their priorities alongside the assumptions and the environment on which they rely, (2) monitoring the behavior of the AV at run-time according to these rules and assumptions, (3) triggering alarms to the driver or safety en-gineer when the behavior of the AV violates some of the safety rules or some of the assumptions and (4) checking and verifying incoherences between the rules and producing the output of the functionality blocs in the planned trajectory. This paper is organized as follows. Section 2 discusses related work. Section 3 presents the technologies used by the approach, the illustrative real-life use case, and the Extensible Platform for Safety Analysis of Autonomous Vehicles (EPSAAV) approach to specifying the environment and the prioritized rules. It also details the approach to generate an execution policy from the behavior specification. Finally, Section 4 draws conclusions and details some possible future work.

Related Work

Due to the drawbacks of not having safety verification, many existing solutions have been proposed. Formal verification approaches are considered as candidates to reduce the intractability of empirical validation [START_REF] Seshia | Formal methods for semi-autonomous driving[END_REF][START_REF] O'kelly | Apex: Autonomous vehicle plan verification and execution[END_REF][START_REF] Althoff | Online verification of automated road vehicles using reachability analysis[END_REF]. One of these approaches is called Responsibility Sensitive Safety (RSS) [START_REF] Shalev-Shwartz | On a formal model of safe and scalable self-driving cars[END_REF] and has largely inspired our proposal. The authors have developed a white-box verification approach for interpreting safety requirements. They have developed redundant sensing systems with a complex environment. Their interpretable, mathematical model does not guarantee that a vehicle will not be involved in an accident. The limitation of the model also lies in the fact that assumptions and driving policies are taken explicitly to guarantee the safety of the vehicle. They assume that the data is reliable and independent of environmental conditions. The reality is different and there are a lot of possible scenarios depending on the weather, sensor reliability, and many other parameters. Our EPSAAV framework allows circumventing this difficulty by providing the possibility to add measures for safety and environmental conditions. Conceptually, we view our framework as a complementary safety assessment to [START_REF] Shalev-Shwartz | On a formal model of safe and scalable self-driving cars[END_REF]. The modularity of our simulation framework easily allows us to include more sophisticated notions of safety, such as temporal-logical specifications or implementations of RSS distances mathematical formulas.

In [START_REF] Jeannet | Debugging embedded systems requirements with stimulus: an automotive case-study[END_REF], the authors proposed a modeling and simulation environment called STIMULUS in which they developed and tested requirements in real-time, revealing inconsistencies and ambiguities. Even though textual requirements look simple and reasonable, they contain inconsistencies and ambiguities that lead to undesirable behavior and contradictions. Our framework will help detect these inconsistencies and help the experts to improve the system. Moreover, the tool used in [START_REF] Jeannet | Debugging embedded systems requirements with stimulus: an automotive case-study[END_REF] is proprietary and requires a license. However, what the world of autonomous driving needs is an accessible, open-source standard with formal semantics. On the other hand, Measurable Scenario Description Language (M-SDL), created by Foretellix [START_REF] Foretellix | Open measurable scenario description language (M-SDL)[END_REF], is an open-source solution that unfortunately does not include support for scenario description. Despite the open release, the modeling and simulation tools are proprietary solutions, and there is no way to specify the environmental properties (sampling rate, accuracy) to be captured.

Monitoring Platform Specification

Our approach provides a simulation platform that analyzes the environment and trajectory of autonomous vehicles within an operational domain design (ODD). It also aims to help safety designers and experts to verify safety breaches and problems. The information provided by hardware components represents our software architecture necessary for driving. The proposed Extensible Platform for Safety Analysis of Autonomous Vehicles (EPSAAV) is considered as a testing and verification tool to identify fault types and trigger alerts to the user. It is divided into three parts: (1) abstract description of EPSAAV (Fig. 4), (2) the autonomous vehicle environment and formal rules with priorities, and (3) generation of monitors to analyze rule violations and inconsistencies.

Technologies used by the approach

Limited expressiveness makes it harder to express wrong things and facilitates comprehension. Domain-Specific Languages (DSL) can solve some of these problems by raising the level of abstraction closer to the problem domain, rather than code [START_REF] Gray | Domain-specific modeling[END_REF]. Our framework uses GEMOC, an open-source tool based on Eclipse. This modeling environment focuses on design and validation problems in complex systems. One of them is enabling the evolution or creation of languages and models. It also integrates heterogeneous parts for different applications that work together to deliver a global service. Specification and simulation techniques aim to model and validate system design and architecture. They are combined with formal verification tools, in particular model checkers, to describe and simulate what a system should do. The use case of this paper is intended to illustrate this. To implement our DSL, we chose GEMOC Studio [START_REF] Combemale | Language engineering with the gemoc studio[END_REF] to combine several heterogeneous technologies. It covers all aspects of a DSL, from abstract and concrete syntax to semantic operations, as shown in Fig. 1. We started with the definition of the abstract syntax and the metamodel, as shown in Fig. 4. It is based on Eclipse Modeling Framework (EMF), which supports Ecore metamodel implementation. It is also interesting to note that the GEMOC framework generates an IDE with syntax checking. Once we have the final libraries, this generative approach allows us to generate various concrete syntaxes by using Xtext artifacts [START_REF] Bettini | Implementing domain-specific languages with Xtext and Xtend[END_REF]. Once the concrete syntax was processed, we needed the operational semantics to assign behavior to each of the declarations in our DSL. To do this, we use Xtend, a programming language used to implement the execution semantics of Ecore metamodels. We are generating two types of documents: one for the integration with the internal system, and the other human-readable that describes rules specification. This technology allows us to add methods and verify the defined properties. The next step will be combining the generated code from Xtend with Fig. 1: Overview of the GEMOC Execution Framework with the used technologies in our approach.

CCSL that helps to study temporal inconsistencies and concurrent behavior. To visualize the behavior, Sirius is also available for the graphical display implementation. Interestingly, the GEMOC framework is open source and easily integrates with other tools. It features easy code generation and adapts when settings are changed so that it works properly as development continues. In other words, the language allows us to express the Operational Design Domain (ODD) in a common, non-ambiguous language in which we can express the scenarios that need to be handled safely by a vehicle to achieve "certification" as discussed by [START_REF] Koopman | Certification of highly automated vehicles for use on uk roads: Creating an industry-wide framework for safety[END_REF]. To create this type of system, which is too complicated to do by hand, we use these technologies to shorten the development cycles and have an effective method of reasoning on these rules. The interesting thing about this approach is that we can adopt new requirements that we meet or change the existing ones without changing the language, so it is scalable.

Illustrative real-life use case

To apply operational safety to the trajectories of autonomous cars, we will need elementary data necessary for the system that is perception. We also need to know the rules that need to be defined with their types. Therefore, our use case relies on Renault's unsafe scenarios document, which describes the raw data of the abstract scenarios, their risks, and the actions to be taken. Renault's safety requirements are based on the Safety Of The Intended Functionality standard (SOTIF-ISO/PAS 21448) [START_REF] Koopman | A safety standard approach for fully autonomous vehicles[END_REF]. This document aims to determine most of the different use cases for the system based on the verification process. The objective is to verify that Renault can handle all the identified scenarios. We then need to manage each use case in the most different conditions that help us estimate that the other use cases are managed and validate all the other conditions regarding the scenario. Tests will be performed to verify and validate the use cases in each scenario handled by the ego vehicle, while we will focus on specific environmental conditions to show that the perceptual sensors can avoid any hazard, and to verify any scenario that was not successfully executed in the simulation. After that, we will use expert feedback from System, Fusion, and Safety teams.

Fig. 2 shows a use-case scenario where a neighboring car in traffic mode enters the lane of the autonomous vehicle. There is a risk of collision with this adjacent vehicle. The measures to be taken are a regulation of the safe distance, i.e. a stable control, and if this lasts longer than a certain time, we perform an emergency maneuver, as we called it emergency operation in our library (Fig. 5a). Based on this document, we could describe these unsafe scenarios more concretely in a specification document, in terms of rules and priorities, warnings and actions, as seen below in Fig. 3: The notion of priority consideration in the model will allow us to determine if the rules are complete, that is if they cover all situations or not. What will also be good is to see the gaps that are missing in this document when examining inconsistencies and rule violations.

Abstract description of the Extensible Platform for

Autonomous Vehicle Safety Analysis (EPSAAV)

Our metamodel in Fig. 4 is composed of three levels. The first level contains the Fig. 4: Abstract description of EPSAAV metamodel using EMF technology.

Rule-Based Planner RBP, which refers to a described scene and is composed of goals. The RBP is responsible for formalizing and specifying rules. Each driving task requires object and Event Detection and Response (OEDR). It helps to identify objects around the ego car, detect events that occur nearby, and then react to them. There are three crucial parts of perception: (1) Static Objects (e.g.: road structure, traffic lights, and signs), (2) Dynamic Objects (e.g.: vehicles and pedestrians), (3) Ego Module. For this reason, we created a scene specification, which is very important to describe the maximum capacity of perceived objects around the autonomous vehicle. The scene specifies the roles of these objects and their types. The goals consist of the conditions we want to apply, which relate to actions we can associate with the motion planner, and alarms we want to trigger for the user. This is at the second level of the metamodel. These conditions are described by logical expressions. The metamodel also can filter the rules either by library type or by role or even by expression. The third level defines the libraries in which we want to describe the properties for the ego and the obstacles. Creating this metamodel gives us the right to a more concrete description of the environment and the rules described in 3.4.

Concrete description of the Autonomous vehicle's environment

In this part, a concrete description of the environment is presented. The main feature of EPSAAV is to allow the user or safety expert to create multiple libraries to specify the properties. In our use case, the main goal was to have one library for the ego and another one for the obstacles. For future work, we can create properties related to pedestrians, for example, but for now, let us consider them as obstacles. This use case is edited to be able to insert everything that is shown in the Renault specification document. In the scene, as we said before, we specify the roles of the obstacles and their types with reference to the libraries created. We also created a library for actions and one for alarms in Fig. 5. Xtext files were needed too to create semantic forms for rules with priorities. Rules without priorities just don't make sense. Take the case of these two rules, one that applies slight acceleration to escape a crash with the rear vehicle, and one that says you have to brake because a pedestrian is crossing the road. Hence the notion of priority must be included in the syntactic part. Our model gives us the option to prioritize rules in an easy concrete way as seen in Fig. 6. The user can add new versions of his work and follow this helpful expressive formal specification to write the rules. If something goes wrong, the Rule-based Planner is responsible for informing the driver of the problem detected. It analyzes the event of a subsystem failure, then triggers the alert to the user. The description of the violation's type gives the user a hint when a takeover is requested. There is a possibility to link this description to the trajectory planner if we take it at a higher level in the taxonomy [START_REF] Sae Mobilus | Taxonomy and definitions for terms related to driving automation systems for on-road motor vehicles[END_REF]. The verification of the expressiveness of all the rules retrieved from the unsafe scenarios Renault's documents is done by creating generators described in the following part.

Generation of monitors to analyze the solution

We want to make sense of the environment and generate behaviors in it. Using Xtend technology, we created a document generator that describes all the resources and predefined libraries used, as well as the prioritized rules. This text generation has a documentary goal for a good description of our environment and the rules with their priorities. It will help safety experts to save their work whenever a change is made. We also created a code generator that will be used to check violations in an unsafe case and to test for inconsistencies between the priority of these rules and with the block functionalities for Renault. To do this, it is necessary to include in the code generator a function that adapts to the driving data and the rules, and that can access all the driving data from Fusion or the simulators. This is an ongoing work while retrieving structures of data in Renault's fusion runner. Our safety checker module adapts the rules and the input data and then returns the warnings and actions that were triggered in the Rule-Based Planner.

The next phase consists of examining the consistency of the rules. As seen in Fig. 7, we need to compare the output of our safety checker module with the output of a feature block, e.g. the Autonomous Emergency Braking (AEB) block, to see whether or not there is consistency with our actions in an unsafe case in the event of braking. Fig. 7: Study of the consistency between the outputs of the AEB functionality block and the rules described in the safety checker module.

Conclusion and Future Work

In this article, we propose an MBSE approach based on a simulation environment in which we specify and generate libraries and a set of safety rules. These rules have different priorities that help us define the types of violations along a trajectory. We also generated a human-readable document and a code for the internal system integration. The main contribution of this approach is to develop a resilient and safe driver monitoring system that continues to operate safely as long as the assumptions about the environment are met. This is a general approach that could be used for multiple domains. It is a checker that triggers alerts when rules are violated and detects inconsistencies between these rules. It facilitates the description of formal safety rules for experts and gives them the power to version any modification of the environment. The approach can also modify/replace decision-making in trajectory planning. This approach will also be used to find new scenarios to complete the verification of the operational safety on the databases. This is an ongoing work where we provided concrete syntax, completed our abstract metamodel, and developed the first generator. For future work, studying inconsistencies by scheduling analysis with CCSL based on priorities of the objectives, and adding a graphical interface using Sirius are the two following steps, along with the integration of other public simulators. Carla and Webots for automobiles show great promise as they are widely used by the community. The use of simulation and display tools at Renault is also possible, such as the running data of the fusion.

Fig. 2 :

 2 Fig. 2: Straddling Vehicle (SV) swerving over the Ego Vehicle (EV) to take over Preceding Vehicle's (PV) place.

Fig. 3 :

 3 Fig. 3: Formal rules specification based on the swerving case.

Fig. 5 :

 5 Fig. 5: Concrete description of the version 1: (a)action library Actionsv1.actions (b)alert library Alertsv1.alerts (c)scene scenev1.scene.

Fig. 6 :

 6 Fig. 6: Prioritizing rules in the RuleBasedPlanner RBP.rbp.


Joelle Abou Faysal

Nour Zalmai

Ankica Barisic

Frederic Mallet

An Approach to Ensure Safety of Autonomous Vehicles in Planned Trajectories

Keywords: Operational Design Domain, autonomous vehicles, model development and verification, test and simulation, specific design domains, automotive model-based safety design, formal rules

We propose a Model-Based System Engineering (MBSE) approach for the safety of Autonomous Vehicles (AVs) in planned trajectories. It is a simulation environment in which we specify and generate safety rules with priorities. Its objective is to create a resilient and safe driver monitoring system that continuously checks safety rules, and triggers alarms when violations occur. This framework will also help to detect rule inconsistencies for all the feature block decisions.

I. INTRODUCTION

A UTONOMOUS vehicle is currently one of the most rel- evant topics nowadays. It remains a substantial challenge for safety due to some wrong decisions taken by the autonomous vehicle. The unavoidable accidents and death caused by autonomous cars have sparked a debate on their safety and the current limits of technology. Automotive industries have started working on improving safety. Their acceptance in an urban environment, by road users as well as by the authorities, depends on the reliability of their behavior. The relatively large number of accidents involving autonomous vehicles and the difficulty in convincing the public are a reason to give scientific arguments that establish the conditions under which an autonomous system will be able to significantly reduce accidents. Self-driving cars can potentially identify hazards better than people in several circumstances. This will help to avoid human mistakes because autonomous vehicles can have good perceptions and can be less vulnerable to incapacitation, such as distraction or tiredness. To do so, they need to be specifically programmed to prioritize safety over factors.

II. OVERVIEW

One proposal to assess safety is to test autonomous vehicles in real traffic and observe their behavior. However, it is neither feasible nor sufficient because it poses significant risks to the environment and requires a lot of testing, which makes it non-scalable [START_REF] Kalra | Driving to safety: How many miles of driving would it take to demonstrate autonomous vehicle reliability?[END_REF]. An exhaustive listing of dangerous situations is impossible without precisely defining the conditions under which the vehicle operates. Therefore, we need rigorous and comprehensive approaches to ensure operational safety. So the interest is to work on an approach based on modeling, and which is a promising approach because it is an evolutionary solution that can treat complex systems, and which is considered as a means of communication between engineers instead of text documents. Many of the existing solutions use MBSE approaches, but most of the studies are done to create and generate new scenarios or review ones designed by other experts [START_REF] Schütt | Sceml: a graphical modeling framework for scenario-based testing of autonomous vehicles[END_REF]. They ease the scenario creation process but not formal safety rules description. Existing solutions have also provided new approaches without the need to use large mileage test traces. One of these approaches is called Measurable Scenario Description Language (M-SDL) [START_REF] Shenoy | A customizable dynamic scenario modeling and data generation platform for autonomous driving[END_REF]. Despite being released openly, the modeling and simulation tools are proprietary solutions, and there is no way to specify lowlevel details such as the characteristics of a sensor that are important for decision-making. Another solution is a modeling and simulation environment called RSS [START_REF] Shalev-Shwartz | On a formal model of safe and scalable self-driving cars[END_REF]. The downsides of their system are that a change in the software will require new data collection, and they lack the interpretability of the violations and rules. This model is not intended to guarantee that a vehicle will not be involved in an accident. It is, therefore, parametric and does not depend on environmental conditions. Building concrete evidence to measure the safety and security of autonomous vehicles is of critical importance. This is why the design process must be based on formal modeling and verification to give sufficient guarantees.

III. PROPOSED APPROACH

The proposed approach consists of ensuring the safety of autonomous vehicles (AVs). We have designed a simulation platform that analyzes the environment and trajectory of AVs and verifies safety based on rules and priorities. It is a domainspecific language that expresses safety properties, as well as scenarios to measure how safety properties can be satisfied. This Model-Based System Engineering (MBSE) approach is based on a simulation environment in which we specify and generate a set of safety rules. we will need elementary data necessary for the system which constitutes the perception. We will also need to know the rules to be defined with their types. This is why we used Renault's documentation called "Area2 known unsafe scenarios" which describes the raw data of the abstract scenarios, their risks and the measures to be taken. From these unsafe scenarios, we were able to describe them more concretely, in the form of rules and priorities, alarms, and actions. They are considered as our use case, and have different priorities or levels of urgency, depending on the current mode of operation. The goal of the approach is to dynamically build and update a model of the global scene from formal models typical of the actors involved (scene and traffic rules). This formal model makes it possible to monitor lower-level control systems, including trajectory planning, to ensure that they behave as expected in the context of usage scenarios under rules accepted by the authorities, manufacturers, and users. The rules will naturally take into account avoidance and safety behaviors in high-risk situations. The objective is, therefore, to establish a formal verification at run-time, with possible alerts. The behavior of an autonomous vehicle must be tested and verified to meet all requirements. More specifically, we firstly provided a metamodel with an abstract syntax of our safety rules and libraries using EMF technology which describes the Ecore implementation and acts as a meta-model in the UML way, as seen in Fig. 1. This is done by perceiving its environment which constitutes the scene, the alarms, the actions, and the properties defined in the libraries. Then, we described safety rules and priorities while providing unlimited user interaction. This is done by using Xtext that helped defining all aspects of a complete language infrastructure. After that, we generate monitors to analyze the solution and detect problems using Xtend technology. We generated a document for the rules and libraries for each modification, and we also generated the code allowing us to adapt the scenarios or the simulator with the described rules.

The objective after all is to test, check and graphically display rule violations and inconsistencies using CCSL and Sirius. All those technologies and functions are grouped in the GEMOC tool. Our language, therefore, aims to help safety engineers to verify operational safety issues. Its objective is to ensure the solution proposed by the Advanced Driver Assistant Systems (ADAS) teams. To study the consistency of the rules, we must compare the output of our safety checker module with the output of a feature block after applying perception algorithms, in our use case we will take the Automatic Emergency Braking (AEB) feature block. This will help us compare, in the event of braking, if there is consistency with our actions in an unsafe situation. The use of logical time to coordinate models is highlighted in the GEMOC initiative tool under Eclipse. This is why we used GEMOC to cover all aspects of a Domain Specific Language (DSL) from abstract and concrete syntax to semantic operations. It is also interesting to note that the GEMOC framework generates Java code easily. It generates an IDE with syntax checking.

IV. CONCLUSION

The goal of the proposed approach is to develop a resilient and safe driver monitoring system that continues to operate safely as long as the assumptions about the Operational Design Domain (ODD) are met. The backbone of the proposal is that it is an evolutionary system compared to others, and it uses GEMOC that is open-source. We want to let the user take control of creating new rules, adding on old ones, or even deleting existing ones. The simulation environment enables safety experts to detect rule breaches by analyzing problems at run-time using generated monitors. Interfacing this model with Renault's simulator with real scenarios is an ongoing work, and this will be helpful later to study inconsistencies between rules and feature blocks. This approach will also be used to find new scenarios or rules to complete the verification of the operational safety on the databases.

Fig. 1 .

 1 Fig. 1. Overview of the approach with the used technologies.