Dr Li Lu

Benjamin Contrand

Cedric Schweitzer

Blandine Gadegbeku

Cécile Delcourt

Emmanuel Lagarde
email: emmanuel.lagarde@u-bordeaux.fr.

Prescribed anti-glaucoma medication consumption and road traffic crash

Keywords: Prescription anti-glaucoma medication, Road traffic crash, drivers

come   L'archive ouverte pluridisciplinaire

Highlight

•

Prescribed anti-glaucoma medicine was negatively associated with road traffic crash.

• No relationship between anti-glaucoma medicine use and traffic crash responsibility among crash-involved drivers.

• Existing guidelines for safe driving for individuals using anti-glaucoma medications are reassuring.

• Our results also strongly suggest that driving behavior adaptation is effective mitigating potential traffic crash risks for people diagnosed with glaucoma.

Plain Language Summary

Glaucoma is one of the leading causes of visual impairment worldwide. Influence of visual defects associated with this condition, as well as potential side effects of anti-glaucoma medications on driving may be a relevant traffic safety concern.

This study used data from three French national databases that were extracted and matched as part of the CESIR (a combination of studies on health and road safety) project. The sample included 201,497 drivers involved in an injurious road crash in France from July 1, 2005 to December 31, 2015, and an age-and sex-matched control group (113,357 drivers) that was randomly drawn from the general population. The results showed that the proportion of drivers with prescribed anti-glaucoma medicine markedly increased with age. One type and two or more types anti-glaucoma medicine prescriptions were less frequent in crash-involved drivers than in controls. While one type and two or more types anti-glaucoma medicine prescriptions were not associated with crash responsibility. Our findings are reassuring as regard to existing guidelines for safe driving for individuals using anti-glaucoma medications. Our results also suggest that driving behavior adaptation is effective mitigating potential traffic crash risks for people diagnosed with glaucoma.

Background: Glaucoma is one of the leading causes of visual impairment worldwide. Influence of visual defects associated with this condition, as well as potential side effects of anti-glaucoma medications on driving may be a relevant traffic safety concern. This study therefore aimed to investigate whether and/or to what extent prescribed anti-glaucoma medicine consumption is associated with increased likelihood of crash risk, and traffic crash responsibility among drivers involved in road traffic crashes.

Methods: Data from three French national databases were extracted and matched as part of the CESIR (a combination of studies on health and road safety) project. The sample included 201,497 drivers involved in an injurious road crash in France from July 1, 2005 to December 31, 2015, and an age-and sex-matched control group (113,357 drivers) that was randomly drawn from the general population. Exposure to anti-glaucoma medications were compared between responsible and non-responsible drivers involved in a crash and between drivers involved in a crash and people from the control group.

Results:

The proportion of drivers with prescribed anti-glaucoma medicine markedly increased with age. One type (OR=0.79, 95% CI: 0.72-0.86) and two or more types (OR=0.82, 95% CI: 0.68-0.98) anti-glaucoma medicine prescriptions were less frequent in crash-involved drivers than in controls. One type (OR=0.99, 95% CI: 0.88-1.12) and two or more types (OR=1.04, 95% CI: 0.82-1.33) anti-glaucoma medicine prescriptions were not associated with crash responsibility.

Conclusion:

Our findings are reassuring as regard to existing guidelines for safe driving for individuals using anti-glaucoma medications. Our results also suggest that driving behavior adaptation is effective mitigating potential traffic crash risks for people diagnosed with glaucoma.

Introduction

People aged 65 or over represented 9.1% (703 million) of the worldwide population in 2019; the corresponding figure in France was 20.4% (13 million)

1 . The current growth of the elderly population is paralleled by a growth in the population of active older drivers, which has led to a rise in their contribution to the road safety toll. The age-related cognitive and physiological decline is a matter of concern for road safety and led to guidelines and restrictions for older drivers [START_REF] Ikpeze | The Geriatric Driver: Factors That Influence When to Stop Driving[END_REF] . These restrictions must be supported by the results of studies that seek to identify the pathologies and handicaps that are effectively linked to the greater vulnerability of this population. These studies must, however, take into account the fact that stopping driving for an elderly person may increase their dependence and precipitate a state of vulnerability both physically and psychologically [START_REF] Martin | Are the media running elderly drivers off the road?[END_REF] . Driving continues to be the key to independence for many individuals, particularly older drivers who live in an area where public transportation is limited or nonexistent [START_REF] Moon | Comparison of Unsafe Driving Across Medical Conditions[END_REF] . Driving cessation not only affects an individual's independence and freedom, but may also influence self-esteem and perceived locus of control [START_REF] Hill | Assessing and Counseling the Older Driver: A Concise Review for the Generalist Clinician[END_REF] . The balance between safety aspects and the independence of drivers with visual defects is therefore important [START_REF] Deshmukh | Older Drivers and Glaucoma in India: Driving Habits and Crash Risks[END_REF] .

Driving is a complex activity requiring a high level of motor and sensory integrity [START_REF] Klein | Cataract surgery and motor vehicle crashes--proceed with caution[END_REF] and a highly visual task [START_REF] Swan | The effects of simulated acuity and contrast sensitivity impairments on detection of pedestrian hazards in a driving simulator[END_REF] . The risk of unsafe driving varies greatly across medical conditions [START_REF] Moon | Comparison of Unsafe Driving Across Medical Conditions[END_REF] . It has been reported that cognitive and visual factors can explain 83%-95% of age-related variance in the capacity to drive safely [START_REF] Anstey | The role of cognitive and visual abilities as predictors in the Multifactorial Model of Driving Safety. Accident; analysis and prevention[END_REF] .

However, the relationship between visual function and driving is not straightforward [START_REF] Yuki | The relationship between central visual field damage and motor vehicle collisions in primary open-angle glaucoma patients[END_REF][START_REF] Desapriya | Vision screening of older drivers for preventing road traffic injuries and fatalities[END_REF] .

Glaucoma is the leading cause of irreversible blindness and one of the leading causes of visual impairment worldwide, and is characterized by optic nerve damage and associated visual field defects [START_REF] Yuki | The relationship between central visual field damage and motor vehicle collisions in primary open-angle glaucoma patients[END_REF][START_REF] Quigley | The number of people with glaucoma worldwide in 2010 and 2020[END_REF][START_REF] Kwon | Association between Glaucoma and At-fault Motor Vehicle Collision Involvement among Older Drivers: A Population-based Study[END_REF][START_REF] Bourne | Causes of vision loss worldwide, 1990-2010: a systematic analysis[END_REF] . Evidence from a laboratorybased assessment showed that compared to older drivers without glaucoma, those with glaucoma had delayed hazard response times, with associated changes in eye movement patterns [START_REF] Lee | Effect of glaucoma on eye movement patterns and laboratory-based hazard detection ability[END_REF] . The relationship between glaucoma and traffic crashes is widely documented in many studies based both on lab-based simulator systems (simulated glaucomatous visual field loss or other vision impairment, or simulated driving systems, etc.) and on real-world road traffic crashes. The designs of these studies, however, vary significantly, thus impeding the generation of consensus recommendations [START_REF] Kwon | Association between Glaucoma and At-fault Motor Vehicle Collision Involvement among Older Drivers: A Population-based Study[END_REF][START_REF] Kunimatsu-Sanuki | The role of specific visual subfields in collisions with oncoming cars during simulated driving in patients with advanced glaucoma[END_REF][START_REF] Blane | Through the Looking Glass: A Review of the Literature Investigating the Impact of Glaucoma on Crash Risk, Driving Performance, and Driver Self-Regulation in Older Drivers[END_REF][START_REF] Montana | Glaucoma and quality of life: fall and driving risk[END_REF] . Both findings from the real-world and simulation studies yield conflicts. For example, one French cohort study indicated that glaucoma did not increase crash risk [START_REF] Turrado | Chronic medical conditions and their association with crash risk and changes in driving habits: a prospective study of the GAZEL cohort. Injury prevention : journal of the International Society for Child and Adolescent Injury Prevention[END_REF] , whereas other studies reported drivers with glaucoma are more prone to traffic crash involvement than those without glaucoma in both the real-world and simulation studies [START_REF] Kwon | Association between Glaucoma and At-fault Motor Vehicle Collision Involvement among Older Drivers: A Population-based Study[END_REF][START_REF] Montana | Glaucoma and quality of life: fall and driving risk[END_REF][START_REF] Haymes | Risk of falls and motor vehicle collisions in glaucoma[END_REF][START_REF] Szlyk | Driving performance of glaucoma patients correlates with peripheral visual field loss[END_REF][START_REF] Kunimatsu-Sanuki | An assessment of driving fitness in patients with visual impairment to understand the elevated risk of motor vehicle accidents[END_REF] . The areas and degrees of visual field impairment probably play a key role here but no study was able so far to characterize it. For example, the simulation study including participants underwent testing in a novel driving simulator (DS) system [START_REF] Kunimatsu-Sanuki | An assessment of driving fitness in patients with visual impairment to understand the elevated risk of motor vehicle accidents[END_REF] was conducted only among patients with advanced visual field damage.

It should be noted that a consistency observed among most studies is that individuals with glaucoma are more likely to self-regulate and restrict their driving, especially in highly demanding situations [START_REF] Deshmukh | Older Drivers and Glaucoma in India: Driving Habits and Crash Risks[END_REF][START_REF] Blane | Through the Looking Glass: A Review of the Literature Investigating the Impact of Glaucoma on Crash Risk, Driving Performance, and Driver Self-Regulation in Older Drivers[END_REF][START_REF] Turrado | Chronic medical conditions and their association with crash risk and changes in driving habits: a prospective study of the GAZEL cohort. Injury prevention : journal of the International Society for Child and Adolescent Injury Prevention[END_REF][START_REF] Mcgwin | Is glaucoma associated with motor vehicle collision involvement and driving avoidance?[END_REF] . However, the simulation studies were not capable of reflecting the self-regulation behaviours on driving that people imposed.

With regard to prescribed anti-glaucoma medications, their side effects have been categorized as ocular and systemic, and they potentially interact with other systemic drugs [START_REF] Detry-Morel | Side effects of glaucoma medications[END_REF] . For example, it was stated that long-term applications of topical antiglaucoma medications damage the ocular surface [START_REF] Yalvaç | Effects of antiglaucoma drugs on ocular surface[END_REF] . Apart from the treatment benefits, the influence of the side effects of anti-glaucoma medications on driving may therefore be a relevant traffic safety concern. On the other hand, taking antiglaucoma medications can be probably regarded as a fairly good surrogate for glaucoma diagnoses when relevant studies are conducted. In addition, approximately 80 % of people who holds a driver's license were aware of the effects of pharmaceutical drugs on driving ability when they took prescribed medication [START_REF] Fukuda | Risk awareness, medication adherence, and driving behavior as determined by the provision of drug information to patients[END_REF] , which may lead them changing or limiting driving behavior. The arguments stated above lead us to speculate that the use of anti-glaucoma medications could be related to road traffic crashes.

We used data extracted and matched from three French national databases to investigate: 1) whether and to what extent glaucoma and/or prescribed antiglaucoma medicine use are associated with increased likelihood of crash risk; 2)

whether there is a relationship between prescribed anti-glaucoma medicine consumption and traffic crash responsibility among drivers involved in road traffic crashes.

Methods

The data collection methodology of the CESIR (a combination of studies on health and road safety) project has been described elsewhere [START_REF] Orriols | Prescription medicines and the risk of road traffic crashes: a French registry-based study[END_REF] . We extracted and matched the data from three French national databases: police reports, the national police database of injurious crashes (ICs) and the national health care insurance (HCI) database.

Data sources

Police reports (PRs)

French police officers are required to fill out a police report for each injurious crash occurring in the country (about 70,000 reports each year). A previous validation study showed that the national healthcare ID (NID) number was recorded for 28% of the drivers involved [START_REF] Orriols | Prescription medicines and the risk of road traffic crashes: a French registry-based study[END_REF] . Police reports available from July 1, 2005 to December 31, 2015 were collected and matched to the HCI database.

National police database of injurious crashes (ICs)

Details of each injurious road traffic crash are collected by the police forces and stored in a national database (Bulletins d'Analyse d'Accident Corporel)

administered by ONISR (Onservatoire National interministériel de Sécurité Routière). This standardized injurious crash database contains related information on the crash, vehicles and persons involved. The crash characteristics used in this study included age, sex and occupation of the drivers, vehicle type, blood alcohol concentration (g/L) and severity of injury. All drivers involved in a road traffic crash with injuries are supposed to be tested for the presence of alcohol using a breath test. If this test is positive (≥0.5 g/L), the driver refuses to take the test, or the severity of the crash makes the test impossible, then the blood alcohol concentration is measured.

Health care insurance database (HCI)

The HCI database (Système National d'Informations Inter Régimes de l'Assurance Maladie) covers the entire French population. In France, patients are fully reimbursed for health care expenses related to 30 recognized long-term chronic diseases (the most common being cancers, severe arterial hypertension, long-term psychiatric disorder and coronary diseases); it should be noted that glaucoma does not belong to the list [START_REF] Jáuregui | H1 antihistamines: psychomotor performance and driving[END_REF][START_REF] Orriols | Trends in benzodiazepine anxiolytics and z-hypnotics use among French drivers involved in road traffic crashes from 2005 to 2015: a responsibility case-control study[END_REF] . When a reimbursed prescription medicine is dispensed to an outpatient in a pharmacy, a record that includes the NID number, the date of dispensing and the 7-digit code which identifies the prescription medicine is added to the database.

NID extraction and matching procedures

The data matching procedures has been described in previous work in detail [START_REF] Orriols | Prescription medicines and the risk of road traffic crashes: a French registry-based study[END_REF] .

Drivers involved in an injurious crash in France, between July 2005 and December 2015, were included through their national ID, gender, and date of birth, as extracted from police reports by an automatic procedure. The NID number was used to link drivers to prescription drug reimbursement data around the date of the crash. The PRs were linked to the IC database records by a probabilistic linkage method [START_REF] Jaro | Probabilistic linkage of large public health data files[END_REF] .

Case group: drivers involved in a crash

The drivers included in the study were those involved in an injurious road crash in France from July 1, 2005 to December 31, 2015 and whose NID number, date of birth and sex were correctly documented in the police reports. A driver was excluded if the police report data extraction process failed or when the connection between the police report database and the injurious crash database could not be established.

Anti-glaucoma medication exposure

The use of prescribed anti-glaucoma medicine was estimated using prescription [START_REF]Enquête Permanente sur la Prescription Médicale (EPPM)[END_REF] . To ensure that prescribed medicines were not a result of the crash, medications dispensed on the crash day were not included in the analysis.

Determining crash responsibility

Crash responsibility levels were determined based on a standardized method adapted from Robertson and Drummer 32 , factors possibly mitigating drivers' responsibility in each accident were identified and scored. If a sufficient number of mitigating factors were identified a driver would be found to be either partly or totally exonerated from blameworthiness and scored either as a contributory or nonculpable driver [START_REF] Robertson | Responsibility analysis: a methodology to study the effects of drugs in driving[END_REF] . The methodology was described in more detail in our previous work [START_REF] Orriols | Prescription medicines and the risk of road traffic crashes: a French registry-based study[END_REF][START_REF] Orriols | Road traffic crash risk associated with prescription of hydroxyzine and other sedating H1-antihistamines: A responsibility and case-crossover study[END_REF] . The principle of responsibility analysis is to compare the probabilities of exposure on the day of the crash between the drivers deemed responsible for the crash and those non-responsible [START_REF] Orriols | Trends in benzodiazepine anxiolytics and z-hypnotics use among French drivers involved in road traffic crashes from 2005 to 2015: a responsibility case-control study[END_REF] . This determination method was validated in France using the national police database of fatal crashes (kappa =0.71) [START_REF] Laumon | Cannabis intoxication and fatal road crashes in France: population based case-control study[END_REF] , by considering various factors likely to reduce driver responsibility: road, vehicle and driving conditions, type of accident, traffic rule obedience and difficulty of the task involved. A score is assigned to each driver for each of these factors from 1 (favorable to driving) to 4 (not favorable to driving). The higher the sum of the scores, the less favorable the driving conditions, and consequently the more likely the driver will be considered not responsible for the crash. Drivers were further grouped into two levels of crash responsibility: responsible (score < 15) or non-responsible (score ≥ 15).

Control group: individuals from the general population

To estimate the level of exposure to anti-glaucoma medications, an age-and sex-matched control group was randomly derived from the entire HCI database, i.e., population based controls. The control group was built in order to have the same distribution of age and sex as individuals involved in a crash of the case group using the incidence density control sampling method. An index date equal to the matched case's crash date was attributed to each control and medicine

Statistical analyses

Two comparisons were performed in this study. The first one compares use anti-glaucoma medication between individuals involved in a crash (drivers in CESIR 2 and 3) and people with the same age and sex randomly drawn from the general population. The difference examined here is the result both of the potential impact of the medicine on crash risk and of potentially differential driving behaviors between those who used the medication and those who did not. The second is a responsibility comparison between responsible and nonresponsible drivers. The non-responsible group is used as a proxy of people driving vehicles but having no crash. The differences in the level of antiglaucoma medication use observed here are more likely to be related to the impact of the medicine consumption, or the severity of the condition itself on the risk of crash.

The selection of potential covariates and effect modifiers was conducted reviewing the existing related literatures [START_REF] Orriols | Prescription medicines and the risk of road traffic crashes: a French registry-based study[END_REF][START_REF] Orriols | Long-term chronic diseases and crash responsibility: a record linkage study[END_REF] and univariate analyses (supplemental table 1), then was incorporated into a directed acyclic graph (supplemental figure 1) that was used to guide the modeling strategy. Logistic regression models were adjusted for age and sex and the presence of at least one type of long-term chronic conditions, and for the responsibility comparison supplemented with occupation, vehicle type, blood alcohol concentration (g/L)

and severity of injury among drivers with road traffic crashes. Although this variable is the result of the crash itself, it was selected as an adjustment variable because of the strong relationship observed between the severity of injuries and the likelihood of being in the study sample. Sensitivity analyses regarding the first comparison were further conducted by restricting study samples to specific groups. The adjusted odds ratio (OR) and 95% confidence interval (95% CI)

were used to express the potential associations. Data analyses were performed using R Studio software, version 1.2.1335, ©2009-2019 RStudio, Inc.

Patient and public involvement

Patients and/or the public were not involved in the design, conduct, reporting or dissemination of this research. Confidentiality was ensured by using the personal information anonymization function of the health care insurance system [START_REF] Trouessin | FOIN: a nominative information occultation function[END_REF] . The study was approved by the French Data Protection Authority (CNIL 906030).

Results

Figure 1 shows the results of the extraction and matching procedures. 201,497 drivers who were involved in road traffic crashes were analyzed in this study and 48.6% (n=97,936) were considered responsible for the crashes. After matching age and sex as drivers in the period of CESIR 2 and 3 (n=128,812), 113,357 individuals from the general population in the control group were included.

The basic characteristics among drivers involved in traffic crashes and controls are presented in Table 1. The proportion of at least one type of prescribed anti-glaucoma medicine use in the drivers with road traffic crashes was 0.75% (n=1,506); the figure for the control group was 1.44% (n=1,628).

Figure 2 shows the distribution of anti-glaucoma medicine use in the sample by age group. As expected, the proportion of use of one or more types of prescribed anti-glaucoma medicine was higher in the elderly, and it was higher in the control group in each of the age categories.

After adjusting for age group, sex and long-term chronic conditions, logistic regression identified that use of one type (OR=0.79, 95% CI: 0.72-0.86) and two or more types (OR=0.82, 95% CI: 0.68-0.98) of prescribed anti-glaucoma medicine was less frequent in crash-involved drivers than in controls (Table 2).

By fitting the model in two separate age groups and among females and males separately, it showed similar associations between prescribed anti-glaucoma medicine consumption and crash involvement (Supplemental table 2 & 3).

Notably the younger group (individuals were less than 45 years) showed smaller estimate parameters. Responsibility analysis controlled for age, sex, the presence of long-term chronic conditions, occupation, vehicle type, blood alcohol concentration (g/L)

and severity of injury. There were no associations between one type (OR=0.99, 95% CI: 0.88-1.12) and two or more types (OR=1.04, 95% CI: 0.82-1.33) of prescribed anti-glaucoma medicine use and crash responsibility among drivers with road traffic crashes (Table 3).

Discussion

Using French national datasets, our study indicated there is a negative association between prescribed anti-glaucoma medicine consumption and road traffic crash involvement. Another finding is that, among crash-involved drivers, there was no significant association between prescribed anti-glaucoma medicine use and responsibility. Our findings provide clues concerning establishment of guidelines for safe driving and crash avoidance.

It is documented that the history of glaucoma among older male drivers is a significant predictor of crash involvement [START_REF] Hu | Crash risks of older drivers: a panel data analysis[END_REF] , and that older adults with glaucoma and limited useful visual field are more likely to be involved in an injurious crash [START_REF] Owsley | Vision impairment, eye disease, and injurious motor vehicle crashes in the elderly[END_REF] . Both real-world and simulation studies including simulated glaucomatous visual field loss or other vision impairment, or simulated driving systems, etc., have found that drivers with glaucoma are more prone to traffic crash involvement than those without glaucoma [START_REF] Kwon | Association between Glaucoma and At-fault Motor Vehicle Collision Involvement among Older Drivers: A Population-based Study[END_REF][START_REF] Montana | Glaucoma and quality of life: fall and driving risk[END_REF][START_REF] Haymes | Risk of falls and motor vehicle collisions in glaucoma[END_REF][START_REF] Szlyk | Driving performance of glaucoma patients correlates with peripheral visual field loss[END_REF][START_REF] Kunimatsu-Sanuki | An assessment of driving fitness in patients with visual impairment to understand the elevated risk of motor vehicle accidents[END_REF] . Compared to glaucoma patients with no visual field impairment in the worse functioning eye, those with moderate or severe field defects are at increased likelihood of being involved in a vehicle crash [START_REF] Mcgwin | Visual field defects and the risk of motor vehicle collisions among patients with glaucoma[END_REF] . In our study however, we identified a negative association between prescribed anti-glaucoma medicine consumption and traffic crash involvement. This is surprising as one could have expected biotherapy to ascertain an actual glaucoma. Another possible interpretation is that the antiglaucoma medications are keeping the disease from progressing to a more severe stage which could be dangerous for driving, and thus anti-glaucoma medications are in that sense protective against crashes. Besides, our results also strongly suggest that driving behavior adaptation is effective mitigating potential traffic crash risks for people diagnosed with glaucoma. Vision impairment among older drivers, such as impaired useful visual field [START_REF] Cross | Visual and medical risk factors for motor vehicle collision involvement among older drivers[END_REF] , severe contrast sensitivity impairment due to cataract [START_REF] Owsley | Visual risk factors for crash involvement in older drivers with cataract[END_REF] and glaucoma with severe pattern deviation field defects in the binocular field [START_REF] Mcgwin | Binocular visual field impairment in glaucoma and at-fault motor vehicle collisions[END_REF] can elevate at-fault crash risk. Older drivers with glaucoma are also more likely to have a history of at-fault motor vehicle collision involvement than those without glaucoma [START_REF] Kwon | Association between Glaucoma and At-fault Motor Vehicle Collision Involvement among Older Drivers: A Population-based Study[END_REF] .

Nevertheless, we did not identify the association between prescribed antiglaucoma medicine use and being responsible for road traffic crash among drivers involved in a crash.

Older drivers with glaucoma are less confident on roads and modify their driving habits [START_REF] Blane | Through the Looking Glass: A Review of the Literature Investigating the Impact of Glaucoma on Crash Risk, Driving Performance, and Driver Self-Regulation in Older Drivers[END_REF] . One cohort study in the USA demonstrated that older drivers with diagnosed glaucoma drove at least as safely as their peers without glaucoma and showed no greater crash risks [START_REF] Mcgwin | Is glaucoma associated with motor vehicle collision involvement and driving avoidance?[END_REF] . A Japanese study found that older glaucoma patients show greater driving self-restriction [START_REF] Ono | Driving self-restriction and motor vehicle collision occurrence in glaucoma[END_REF] . A great array of studies has also documented that in older drivers glaucoma is associated with driving avoidance, lower density driving and driving mileage, and less driving in challenging situations (such as at night, on the highway, etc.) [START_REF] Deshmukh | Older Drivers and Glaucoma in India: Driving Habits and Crash Risks[END_REF][START_REF] Turrado | Chronic medical conditions and their association with crash risk and changes in driving habits: a prospective study of the GAZEL cohort. Injury prevention : journal of the International Society for Child and Adolescent Injury Prevention[END_REF][START_REF] Mcgwin | Is glaucoma associated with motor vehicle collision involvement and driving avoidance?[END_REF] . Reduced driving exposure and increased apparent self-regulatory practices were also exhibited by the elderly with vision deficits, such as older drivers aged 70 years or over with contrast sensitivity impairment [START_REF] Sandlin | Association between vision impairment and driving exposure in older adults aged 70 years and over: a population-based examination[END_REF] . Since driving self-restriction was associated with a reduced prevalence of vehicle collision in male drivers with glaucoma [START_REF] Ono | Driving self-restriction and motor vehicle collision occurrence in glaucoma[END_REF] , individuals with glaucoma should be aware of their medical conditions and self-regulate in driving to mitigate potential traffic crash risks.

Finally, as expected, we found that the elderly had a greater prevalence of prescribed anti-glaucoma medicine use than other age groups. It is a fact that the elderly are more likely to have cognitive, motor and sensory defects, to suffer from chronic diseases, such as eye diseases, and thus to use medication that could unfavorably influence their driving performance [START_REF] Hu | Crash risks of older drivers: a panel data analysis[END_REF] . However, although older groups had poorer driving-related skills than younger groups, a previous study using an interactive driving simulator failed to discover significantly higher on-road accident rates among older than younger drivers [START_REF] Szlyk | Relative effects of age and compromised vision on driving performance[END_REF] . In the present study, drivers older than 65 years had a lower risk of being responsible for the crash than drivers younger than 25 years, although they had a somewhat increased risk by comparison with middle-aged drivers.

The merits of our study were that we relied on documented governmental data rather than self-reports, which tend to be less reliable, and crash responsibility was determined by a standardized method that could therefore alleviate potential deviations due to self-estimation. However, several limitations should be noted. First, we were unable to access the clinically ophthalmic diagnoses or field loss of the drivers, which made it difficult to document the relationship between disease-related effects and crash risk. In particular, many of the subjects using anti-glaucoma medications do not exhibit significant visual impairment and this may be another reason for the lack of association of crash responsibility. Conversely, one cohort French study showed that about 38% of people with glaucoma were undiagnosed [START_REF] Delcourt | Nutrition and age-related eye diseases: the Alienor (Antioxydants, Lipides Essentiels, Nutrition et maladies OculaiRes) Study. The journal of nutrition[END_REF] . Second, we just took age, sex and long-term chronic conditions into account and adjusted for in the model. Third, a very small proportion of individuals from the general population (0.1%) were likely to have been involved in a crash during the study period. It is therefore unlikely that this would lead to a significant bias in the relationship between antiglaucoma medication use and crash risk. As the matching process relied on the availability of NID, individual without NID were not included, which could lead to another possible systematic bias. Because NID were more often missing for the less severe cases, we considered severity in the models. In addition, selfmedication and the use of over-the-counter medicines were not captured in our study. About 15% of medicines sold in France correspond to non-reimbursable medicines, but most of these products have either no or a negligible influence on driving ability [START_REF] Orriols | Prescription medicines and the risk of road traffic crashes: a French registry-based study[END_REF] . We also did not know whether the medicines reported as delivered in our database were actually ingested or not. Non-compliance would result in exposure misclassification that would deserve further study. Lastly, in our study, only drivers' NID that could be matched between databases were included. The most injured drivers were more likely to be admitted to hospitals, so their NID were more likely to be noted in the police reports [START_REF] Orriols | Prescription medicines and the risk of road traffic crashes: a French registry-based study[END_REF][START_REF] Nee | Prescription medicine use by pedestrians and the risk of injurious road traffic crashes: A case-crossover study. case crossover study[END_REF] and they were consequently more likely to be part of our sample. This selection bias could lead to slight overrepresentation of drivers with more severe crashes in our sample, which may in part affect the results. In conclusion, prescribed anti-glaucoma medicine consumption was negatively associated with road traffic crash involvement and there was no evidence for a relationship between prescribed anti-glaucoma medicine use and traffic crash responsibility among crash-involved drivers. Our findings are reassuring as regard to existing guidelines for safe driving for individuals using anti-glaucoma medications.

Conclusion

  data recorded in the health care insurance database with the Anatomical Therapeutic Chemical (ATC) Classification System code: S01E (anti-glaucoma preparations and miotics), which include six types, i.e., sympathomimetics in glaucoma therapy (S01EA), parasympathomimetics (S01EB), carbonic anhydrase inhibitors (S01EC), Beta blocking agents (S01ED), Prostaglandin analogues (S01EE), Other antiglaucoma preparations (S01EX). Consumption of

  exposure was estimated around this date. The control sample therefore comprised individuals from the general population, not selected as being involved in a road traffic crash. It is, however, possible that a very small proportion of them were indeed involved in a crash during the study period. This sample was only available in the last two time periods of the study (cases in CESIR 2 (2009-2011) and 3 (2012-2015) were matched), since data from earlier periods had already been archived[START_REF] Orriols | Road traffic crash risk associated with benzodiazepine and zhypnotic use after implementation of a colour-graded pictogram: a responsibility study. just case-control analysis and maybe the same population with other studies. There are four periods based on the implement of colour-graded three-level pictogram[END_REF] .

Figure 2

 2 Figure 2 The distribution of anti-glaucoma medicine use in the sample by age group.

  10991557, ja, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/pds.5577 by Universite De Bordeaux, Wiley Online Library on [16/12/2022]. See the Terms and Conditions (https://onlinelibrary.

wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License

  10991557, ja, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/pds.5577 by Universite De Bordeaux, Wiley Online Library on [16/12/2022]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License

  10991557, ja, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/pds.5577 by Universite De Bordeaux, Wiley Online Library on [16/12/2022]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License

  10991557, ja, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/pds.5577 by Universite De Bordeaux, Wiley Online Library on [16/12/2022]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License

  10991557, ja, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/pds.5577 by Universite De Bordeaux, Wiley Online Library on [16/12/2022]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License

  10991557, ja, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/pds.5577 by Universite De Bordeaux, Wiley Online Library on [16/12/2022]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License Table 1 Basic characteristics of the included sample There were 39 cases that lacked information on responsibility. 10991557, ja, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/pds.5577 by Universite De Bordeaux, Wiley Online Library on [16/12/2022]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License

		Drivers with crash (N= 201,458)	Control group
	Variables	Non-responsible	Responsible	(N=113,357)
		(n=103,522)	(n=97,936)
		n	%	n	%	n	%
	Anti-glaucoma medicine use
	No use	102,767	99.3	97,185	99.2	111, 729 98.6
	One type	613	0.6	592	0.6	1,315 1.16
	≥ 2 types	142	0.1	159	0.2		313 0.28
	Age group (years)
	≤ 24	19,651	19.0	25,421	26.0	14,001 12.4
	25 -44	47,060	45.5	41,179	42.0	46,685 41.2
	45 -64	30,055	29.0	23,008	23.5	37,456 33.0
	≥ 65	6,756	6.5	8,328	8.5	15,215 13.4
	Sex
	Male	70,039	67.7	70,004	71.5	66,172 58.4
	Female	33,483	32.3	27,932	28.5	47,185 41.6
	Long-term chronic condition
	No	94,161	91.0	87,627	89.5	94,781 83.6
	Yes	9,361	9.0	10,309	10.5	18,576 16.4
	Occupation
	Professional driver	3,773	3.6	3,178	3.2
	Farmer	656	0.6	583	0.6
	Craftsman, shopkeeper, independent profession	4,208	4.1	3,848	3.9
	Higher managerial and professional occupations	5,342	5.2	3,984	4.1
	Middle manager, employee	32,156	31.1	23,787	24.3
	Workers	13,853	13.4	16,269	16.6
	Retired	9,286	9.0	10,206	10.4
	Unemployed	3,597	3.5	5,265	5.4
	Student	23,208	22.4	21,719	22.2
	Other	7,443	7.2	9,097	9.3
	Vehicle type
	Light vehicle	57,974	56.0	58,440	59.7
	Bicycle	7,492	7.2	3,483	3.6
	Scooter & motorcycle	29,079	28.1	27,391	28.0
	Commercial vehicle	4,505	4.4	4,809	4.9
	Heavy goods vehicle	2,094	2.0	1,743	1.8
	Other	2,378	2.3	2,070	2.1
	Blood alcohol concentration (BAC, g/L)
	< 0.5	89,146	86.1	75,736	77.3
	0.5 ≤ BAC < 0.8	296	0.3	1,004	1.0
	0.8 ≤ BAC < 1.2	275	0.3	1,767	1.8
	1.2 ≤ BAC < 2.0	451	0.4	4,223	4.3
	≥ 2.0	301	0.3	3455	3.5
	Missing	13,053	12.6	11,751	12.0
	Severity of injury
	Unhurt	29,659	28.6	29,364	30.0
	Slightly injured	44,041	42.5	28,406	29.0
	Seriously injured	29,011	28.0	37,783	38.6
	Killed	811	0.8	2,383	2.4
	CESIR (year)
	2005-2008	37,789	36.5	34,896	35.6
	2009-2011	35,582	34.4	34,457	35.2	55,342 48.8
	2012-2015	30,151	29.1	28,583	29.2	58,015 51.2
	Note:

Table 2

 2 Odds ratio of prescribed anti-glaucoma medicine use for road traffic crashes (98.9) 111,729 (98.6) 127,772 (99.2) 1.0 -Note: Adjusted for age group, sex and long-term chronic condition. * p<0.05; *** p<0.001 10991557, ja, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/pds.5577 by Universite De Bordeaux, Wiley Online Library on [16/12/2022]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License

	Anti-glaucoma medicine use	Overall (N=242,169) n (%)	Control group (n=113,357) n (%)	Drivers involved in a crash (n=128,812) n (%) OR 95% CI
	No use 239,501 One type 2,153 (0.9)	1,315 (1.2)	838 (0.7) 0.79 0.72-0.86 ***
	≥ 2 types	515 (0.2)	313 (0.3)	202 (0.2) 0.82 0.68-0.98 *

Table 3

 3 Odds ratio of prescribed anti-glaucoma medicine use in crash responsibility among drivers with road traffic crashes (N=201,458). Adjusted for age group, sex and long-term chronic condition, occupation, vehicle type, blood alcohol concentration and severity of injury. 10991557, ja, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/pds.5577 by Universite De Bordeaux, Wiley Online Library on [16/12/2022]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License

			Responsible
	Variables		(n=97,936)
		OR	95% CI
	Anti-glaucoma medicine use
	No use	1	-
	One type	0.99	0.88-1.12
	≥ Two types	1.04	0.82-1.33
	Note:

10991557, ja, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/pds.5577 by Universite De Bordeaux, Wiley Online Library on [16/12/2022]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License

The CESIR-A project was supported by the French Direction de la sécurité et de la circulation routières (DSCR) and the French National Institute of Health and Medical Research (Equipe INSERM). The present study is part of the Drugs Systematized Assessment in real-liFe Environment (DRUGS-SAFE) research program funded by the French Medicines Agency (Agence Nationale de sécurité du Médicament et des Produits de Santé, ANSM). Employees of ANSM participated in data collection. The funders had no role in study design and analysis, decision to publish, or preparation of the manuscript.

Ethics approval

Confidentiality was ensured by using the personal information anonymization function of the health care insurance system. The study was approved by the French Data Protection Authority.

Access to the French national by the French National Health Insurance (CNAMTS), Agira-TransPV and the National Interministerial Road Safety Observatory (ONISR). Access to the national healthcare insurance database and matching with other datasources requires the authorization of the Health Data Institute (Institut des donneÂes de Santé [IDS]) and the French Data Protection Authority (Commission nationale

healthcare insurance database, the police reports and the national police database of injurious crash have been respectively provided

Conflict of interest

None. * A random sample from the national health care insurance database was selected, matched on the age and sex distribution of the cases. This was done only for wave 2 and 3.

Author contribution


Sébastien Salva
email: sebastien.salva@uca.fr

Jarod Sue
email: jarod.sue@uca.fr

Test Case Backward Generation for Communicating Systems from Event Logs

Keywords: Communicating systems, Test Case Generation, Test Case Mutation

This paper is concerned with generating test cases for communicating systems. Instead of considering that a complete and up-to-date specification is provided, we assume having an event log collected from an implementation. Event logs are indeed more and more considered for helping IT personnel understand and monitor system behaviours or performance. We propose an approach allowing to extract sessions and business knowledge from an event log and to generate an initial set of test cases under the form of abstract test models. The test architecture is adaptable and taken into consideration during this generation. Then, this approach applies 11 test case mutation operators on test cases to mimic possible failures. These operators, which are specialised to communicating systems, perform slight modifications by affecting the event sequences, the data, or injecting unexpected events. Executable test cases are finally derived from the test models.

INTRODUCTION

This paper focuses on the test of communicating systems, i.e. systems made up of concurrent components, e.g., Web services or Internet of things (IoT) components, which interact through a message passing protocol, e.g. HTTP. Testing such systems is known to be a hard process due to the problems inherent in controlling or monitoring many concurrent components interacting with one another simultaneously. Several works proposed solutions to develop test architectures, which include points of observation (PO), to collect information from the implementation and points of control and observation (PCO), to collect information but also to control the interactions with the implementation. Others proposed to apply test strategies, or to perform Model-based Testing (MbT), e.g., [START_REF] Ulrich | Architectures for Testing Distributed Systems[END_REF][START_REF] Van Der Bijl | Compositional testing with ioco[END_REF][START_REF] Cao | Testing Service Composition Using TGSE tool[END_REF][START_REF] Torens | Remotetest: A framework for testing distributed systems[END_REF][START_REF] Kanso | Testing of Abstract Components[END_REF][START_REF] Aouadi | An active testing tool for security testing of distributed systems[END_REF]Hierons, 2001). Despite these significant contributions, generating test cases for this kind of systems is still difficult and long. With most of the approaches proposed in the literature, a complex specification must be written and verified, then a model-based testing approach is applied to generate test cases with respect to a static test architecture.

In the Industry, models are often neglected though. Writing models is indeed known to be a hard and error-prone task. Besides, keeping them up-todate is also difficult especially over the long term. Instead of using specifications, we propose to rely on event logs, collected from a system under test, which we denote SUT. Although no specification is given, some approaches might be yet considered to generate test cases:

• a basic record and replay technique: from an event log, it is possible to extract sessions, i.e. sequences of correlated events interchanged among different components. Then, these sessions could be converted to executable test cases to evaluate SUT again. Unfortunately, this technique does not work well for communicating systems, as SUT may include non deterministic components, or not testable ones (not observable, or not controllable). Test cases must be adapted w.r.t. these properties;

• model learning followed by test case generation: model learning is a research field gathering algorithms specialised in the construction of models by inference. On the one hand, active model learning algorithms interact with SUT by means of tests to get sequences of reactions encoded with models. Few approaches are specialised to communicating systems, e.g., [START_REF] Petrenko | Learning communicating state machines[END_REF] and these ones are time-consuming and cannot produce large models. On the other hand, passive model learning approaches, e.g., [START_REF] Mariani | Automated identification of failure causes in system logs[END_REF][START_REF] Beschastnikh | Inferring models of concurrent systems from logs of their behavior with csight[END_REF][START_REF] Salva | Cktail: Model learning of communicating systems[END_REF] are able to generalise behaviours retrieved in large event logs and to encode them into models. But, this generalisation might lead to the generation of incorrect test cases leading to false positives. Once models are retrieved, classical MbT approaches can be applied to produce test cases. These approaches (re-)generate test data along with concrete execution paths to construct test cases. Again this is a time consuming activity.

This paper presents another approach to generating test cases for communicating systems from event logs, which is devised with the previous attention points in mind. The resulting test cases aim at experimenting the whole system. In short, our approach performs an analysis of event logs to extract some business knowledge, reverse-engineers abstract test models (but no specification) from event logs, mutates them with specialised mutation operators and finally generates executable test cases. The test architecture, i.e. the number of PCOs, POs along with their capabilities (what they are able to observe), is adaptable and taken into consideration while the test case generation. Test case mutation [START_REF] Köroglu | TCM: Test Case Mutation to Improve Crash Detection in Android[END_REF][START_REF] Paiva | Test case generation based on mutations over user execution traces[END_REF] is an approach that builds new test cases by performing slight modifications on existing test cases in order to later check whether the system under test is resilient to errors, to security attacks etc. In other terms, we gather some advantages of passive model learning (extraction of sessions from event logs, knowledge extraction), which we associate with test case generation (test selection, generation of test cases w.r.t. the PCOs and POs) and test case mutation.

The paper is organised as follows: we provide some definitions used throughout the paper in Section 2. Our approach is presented in Section 3 with a motivating example. We present two algorithms to build test cases from event logs and 11 test case mutation operators specialised for communicating systems. Section 4 summarises our contributions and draws some perspectives for future work.

DEFINITIONS

We denote E the set of events of the form e(α) with e a label and α an assignment of parameters in P to a value in the set of values V . We write x := * the assignment of the parameter x with an arbitrary element of V , which is not of interest. The concatenation of two event sequences σ 1 , σ 2 ∈ E * is denoted σ 1 .σ 2 . ε denotes the empty sequence. For sake of readability, we also write σ 1 ∈ σ 2 when σ 1 is a (ordered) subse-quence of the sequence σ 2 . pre f ix(σ) denotes the set of initial segments of σ.

We also use the following notations on events to make our algorithms more readable:

• f rom(e(α)) = c denotes the source of an event;

• to(e(α)) = c denotes the destination;

• isreq(e(α)), isresp(e(α)) are boolean expressions expressing the nature of the event.

We formulate a test case with a deterministic Input Output Labelled Transition System (IOLTS) having a tree form and whose sink states are either labelled by the test verdicts pass, fail, or inconclusive. Its transitions are labelled by events in E ∪ {θ}, with θ a special label expressing the absence of reaction [START_REF] Phillips | Refusal testing[END_REF].

Definition 1 (Test Case) A test case is a deterministic IOLTS Q, q0, Σ, → where:

• Q is a finite set of states; Q contains three special states: pass, fail and inconclusive • q0 is the initial state; • (Σ ⊆ E) ∪ {θ} is the finite set of events. Σ I ⊆ Σ is the finite set of input events beginning with "?", Σ O ⊆ Σ is the finite set of output events beginning with "!", with

Σ O ∩ Σ I = / 0; • →⊆ Q × Σ ∪ {θ} × Q is a finite set of transitions
A transition (q, e(α), q ) is also denoted q e(α) --→ q .

TEST CASE GENERATION AND MUTATION

The ability of our approach to generate test cases from an event log produced by a communicating system SUT, is dependent on the following realistic assumptions:

• A1 Event log: the communications among the components can be monitored by POs using different techniques, e.g., wireless sniffers or server logs. These POs may have different observation capabilities. The latter are known and defined with a relation PO : Component × E → {true, f alse}. The resulting event logs are collected in a synchronous environment made up of synchronous communications. They include timestamps showing when the events occurred.

• A2 Event content: components produce communication events or non-communication events. Both include parameter assignments allowing to identify the source and the destination of each event. For non-communication events, both the source and the destination refer to the same component that has produced the event. Besides, a communication event can be identified either as a request or a response;

• A3 Component collaboration: Workflows of events are correlated by means of parameter assignments.

• A4 Component Controllability: we assume knowing the set of components that can be experimented, which is denoted PCO; Let's illustrate these notions of POs and their capabilities with the example of system and test architecture of Figure 1. Consider that we can observe for all the components c 1 , c 2 and c 3 any received request and the associated response. For c 1 , this can be formulated by PO(c 1 , e(α)) : (isreq(e(α)) ∧ to(e(α)) == c) ∨ (isresp(e(α)) ∧ f rom(e(α)) == c). Consider now that for c 2 nothing can be observed (there is no point of observation), we have PO(c 2 , e(α)) : f alse. The relation PO may indirectly be used to evaluate the capability of observation for every component. For a component c, we define this measure as follows: obs(c) = ∑ e(α)∈E PO(c, e(α)) == true. It is worth noting that dealing with all the potential events is not required; it is usually sufficient to consider the five event types illustrated in Figure 2.

Figure 3 illustrates the successive steps of the test case generation. The event log is initially segmented into sessions by means of A3. As a lot of sessions may express the same behaviours of SUT, Step 2 assembles those expressing similar behaviours and cov-Figure 3: Approach Overview ers them to extract knowledge, e.g., the fact that an event represents an error or a failure, the fact that an event sequence represents a token generation, etc. This knowledge, expressed under the form of labels will be used for the test case generation and mutation. This step returns a set of sequences of elements < e(α), l >, with e(α) an event whose parameter values are hidden and l a list of labels expressing knowledge. These sequences are called abstract traces.

Step 3 generates a first test case set from abstract traces. It applies a selection of abstract traces to keep in priority those that should trigger crashes and errors, and those allowing to cover the most components and events. This step also transforms the selected abstract traces to insert the notion of input and output and to take into consideration the capabilities of the POs. Then, test cases, given under the form of IOLTS trees, are generated. The next step applies 11 mutation operators on the initial test case set, which modify events or data. These operators mostly produce test cases dedicated to test the robustness or security of SUT. Finally, every test case tree is converted into an executable test case. These steps are detailed below.

Session Extraction

The recovery of sessions from an event log is quite straightforward when the parameters used to identify sessions, namely a correlation set, is known in advance. When, this is not the case, we proposed in [START_REF] Salva | Conversation extraction from event logs[END_REF] an algorithm (and a tool) to retrieve sessions by exploring the correlation set space that can be derived from an event log. Our algorithm can return the best session set that meet a predefined set of quality attributes defined by the user, or returns several solutions and sort them from the best to the lowest quality.

The tool returns a set S of sessions along with a correlation set Corr(σ) for every session σ ∈ S. All the assignments p := v found in σ whose parameters are also used in Corr(σ) are replaced by p := * .

Session Clustering and Knowledge Extraction

This step takes as input the session set S and builds a set of abstract traces of the form < e 1 (α 1 ), l 1 > • • • < e k (α k ), l k > such that the parameter values are replaced by "*" except for the parameters from, to. l 1 , . . . , l k are label lists expressing some business knowledge about the sessions, e.g., "error" or "crash".

Definition 2 (Abstract Traces) Let L be a set of labels. An abstract trace is a sequence < e 1 (α 1 ),

l 1 > • • • < e k (α k ), l k >∈ (E×L) * such that e i (α i ) 1≤i≤k ∈ E,
and every parameter in P \ { f rom,to} is assigned to "*" and l i ⊆ L(1 ≤ i ≤ k) is a set of labels.

To build abstract traces, we begin to partition the session set S into classes of equivalent sessions. We formulate that two sessions are equivalent if they share the same sequence of abstract events. Given an event e(α), an abstract event e(α ) simply results from the replacement of the parameter values by "*" excluding the parameters from and to. The equivalence relation between two sessions is defined by means of a projection, which performs this event abstraction:

Definition 3 Two event sequences σ 1 σ 2 ∈ E * , are equivalent, denoted σ 1 ∼ b σ 2 iff pro j { f rom,to} σ 1 = pro j { f rom,to} σ 2 with: pro j Q : E * → E * is the projec- tion e 1 (α 1 ) . . . e k (α k ) = pro j Q (e 1 (α 1 ) . . . e k (α k )) and α i = {x := * | x := v ∈ α i ∧ x / ∈ Q} ∪ {x := v | x := v ∈ α i ∧ x ∈ Q}
Now, given a class of equivalent sessions cl = {σ 1 , . . . , σ m }, we analyse the events and parameter values to extract knowledge by means of an expert system. The latter is an inference engine that applies a set of rules on a base of facts. In our context, the former base of facts is a session set. The rules encode expert knowledge about communicating systems and build abstract traces. It is worth noting that an expert system offers the benefit to save time by allowing its reuse on several communicating systems.

We represent inference rules with this format: When conditions on facts Then actions on facts (format taken by the Drools inference engine 1 ). To ensure that this step is performed in a finite time and in a deterministic way, the inference rules have to meet these hypotheses:

• Finite complexity: a rule can only be applied a limited number of times on the same knowledge base,

1 https://www.drools.org/ rule "LabelCrash 1" when $ev: Event(paramStatus>=500); then insert(new Aevent($ev, L("crash")); end We devised inference rules that analyse event content or event sequences to recognise crashes, errors, the authentication of users, and the generation of Access tokens, which temporally provide accesses to specific user's data. Figure 4 Figure 4 exemplifies a rule for recognizing a system crash with an HTTP status of above 500. It creates an abstract event having a new label "crash".

Once the equivalent class cl = {σ 1 , . . . , σ m } has been analysed by the expert system, we obtain one abstract trace of the form < e 1 (α 1 ),

l 1 > • • • < e k (α k ), l k >.
From the equivalent classes of sessions cl 1 , . . . , cl n , we obtain a set of n abstract traces, which is denoted ATraces. Figure 5 illustrates an example of 3 sessions extracted from an event log, itself produced by 3 components API, Produts and Pay, using the architecture of Figure 1. The two first sessions are equivalent as they share the same sequence of labels and parameters with different data. Our approach builds two clusters of equivalent sessions cl(t 1 ) and cl(t 2 ). It also builds 2 abstract traces. t 2 includes one new label "crash" as the expert system has detected that the last event expresses a crash of the component Pay.

Test Case Generation

Test cases are generated in the form of IOLTS trees whose final states are labelled by a verdict. The use of the IOLTS formalism allows to synthesize generic test cases from which, written with various languages, can be derived concrete test scripts. Besides, it is easier to define transformations or mutations on IOLTS test cases.

Test cases are built using the set PCO and the relation PO while taking the controllability and observability of the components into account. At this point, a user may decide to adapt the system's POs with regards to the available tooling. As the initial event log has been collected from every component c in accordance with a certain level of observability given by obc(c), the user may only lower this level by redefining PO(c, e(α)).

/order(from:=Cl,to:=API,m:=POST,body:=1,key:=*) /supply(from:=API,to:=Products,m:=POST,body:=1,key: =*) /payment(from:=Products,to:=Pay,m:=GET,key:=*) ok(from:=Pay,to:=Products,status:=200,key:=*) ok(from:=Products,to:=API,status:=200,key:=*) ok(from:=API,to:=Cl,status:=200,key:=*)

Abstract Trace t1

Abstract Trace t2 The test case generation is implemented by Algorithms 1 and 2. Algorithm 1 takes as input a set of abstract traces ATraces and returns the set SelectedATraces. As the set ATraces may be large, it performs a selection according to 3 criteria (lines 1-11): 1. Crash/Error coverage: it selects in priority all the abstract traces whose at least one event expresses a crash or an error; 2. Component coverage: it completes them with abstract traces in such a way that every component of SUT will be covered by the tests. This is performed with the relation < c , which sorts the abstract traces having the most events produced by components not yet referenced in SelectedATraces:

< c : t 1 < c t 2 iff | f rom({t 1 }) \ f rom(SelectedATraces)| >= | f rom({t 2 }) \ f rom(SelectedATraces)|, with f rom(E) = σ∈E { f rom(e(α)
) |< e(α), l >∈ σ}; 3. Event coverage: it also selects other abstract traces until the ratio of selected events over the total number of events reaches a given threshold. These events are selected with the relation < e , which orders the abstract traces having the most events not used in SelectedATraces:

t 1 < e t 2 iff |event({t 1 }) \ event(SelectedATraces)| >= |event({t 2 }) \ event(SelectedATraces)| with event(E) = σ∈E {e(α) |< e(α), l >∈ σ}.
Then, Algorithm 1 adapts the selected abstract traces with respect to PCO and PO. It only keeps the abstract traces whose first event is performed by a component c that can be experimented (c ∈ PCO). Besides, the algorithm also calls the procedure InOut, which covers the events of an abstract trace t to insert the notion of input and output. Meanwhile, the procedure filters out the unobservable events performed by a component with respect to the relation PO (the event e(α) such that PO( f rom(e i (α i )), e i (α i )) ∨ PO(to(e i (α i ), e i (α i )) is false is not kept to build a test case line( 17)).

Algorithm 1: input : ATraces output: SelectedATraces Algorithm 2 takes the set SelectedATraces and

1 foreach t ∈ ATraces such that ∃1 ≤ i ≤ k : "error" ∈ l i ∨ "crash" ∈ l i do 2 if to(e 1 (α 1 )) ∈ PCO
), l 1 > • • • < e k (α k ), l k > ): is 13 t 2 := ε; cl(t 2 ) := cl(t); 14 for 1 ≤ i ≤ k do 15 if (isreq(e i (α i )) ∧ (to(e i (α i ) == to(e 1 (α 1 )) ∧ ( f rom(e i (α i ) == f rom(e 1 (α 1 )) then 16 t 2 := t 2 . <?e i (α i ), l i >; 17 if PO( f rom(e i (α i )), e i (α i )) ∨ PO(to(e i (α i )), e i (α i )) then 18 t 2 := t 2 . <!e i (α i ), l i >; 19 if (isresp(e i (α i )) ∧ ( f rom(e i (α i ) == c) then 20 t 2 := t 2 . <!e i (α i ), l i >; 21 Update cl(t 2 ) w.r.t.

Test selection

Test pruning + input output produces IOLTS test cases. Given an abstract trace t, the algorithm selects one event sequence of the class cl(t) and builds an initial test case tc composed of parameter values (lines 2-4). The IOLTS tc is derived by means of the operator lts : (E × L) * × E * × { f ail, pass} → IOLT S, which takes an abstract trace, its related event sequence, a verdict v and returns an IOLTS Q, q0, Σ, → defined by the rule < e 1 (α 1 ),

l 1 > • • • < e k (α k ), l k >, e 1 (α 1 ) . . . e k (α k ), v q 0 e 1 (α 1 ),l 1 -----→ q 1 . . . q k-1 e k (α k ),l k -----→ v.
A verdict v of tc is established by means of the labels found in the abstract trace. This test verdict denoted v(< e 1 (α 1 ),

l 1 > • • • < e k (α k ), l k > is fail iff ∃1 ≤ i ≤ k : "crash" ∈ l i , otherwise v(< e 1 (α 1 ), l 1 > • • • < e k (α k ), l k > is pass.
Algorithm 2 now checks whether other events may be observed after experimenting SUT with an arbitrary event sequence of pre f ix(traces(tc)) (lines 5-9). After an execution of events in pre f ix(traces(tc)), depending on the SUT internal states, one might indeed observe the same output event with different parameter assignments, or different output events, or the fact that SUT does not react (formulated wit the label θ). Given an event sequence σ (collected from SUT), we formulate this notion of observation after the execution of σ p ∈ σ with:

out(σ, σ p ) = {!e(α)} if σ p !e(α) ∈ σ {θ} otherwise
We can now say that SUT may produce two different observations after being experimented with the event sequence σ p iff it exists two sessions σ 1 and σ 2 such that σ p ∈ pre f ix(σ 1 ) ∩ pre f ix(σ 2 ) and out(σ 1 , σ p ) = out(σ 2 , σ p ). Algorithm 2 hence covers every abstract trace t 2 and session σ 2 in cl(t 2 ) to check whether different observations are possible against the current test case tc (line 5). If this happens, an IOLTS tc 2 is built from σ 2 and tc is completed with tc 2 by means of the parallel synchronisation operator . Furthermore, as event logs do not necessarily encode all the behaviours of SUT, the test case tc is completed (line 10) with the operator compl : IOLT S → IOLT S defined by these rules:

r 1 :q 1 ?e(α),l ----→ q 2 , q 2 ∈ {pass, f ail} q 1 ?e(α),l ----→ q 11 θ - → q 2 , q 11 ! * -→ f ail, q 1 ! * -→ f ail r 2 :q 1 ?e(α),l ----→ q 2 / ∈ {pass, f ail} q 1 ?e(α),l ----→ q 2 , q 1 ! * -→ f ail r 3 :q 1 !e(α),l ---→ q 2 q 1 !e(α),l ---→ q 2 , q 1 ! * -→ inconclusive r 4 :q 1 !e(α),l ---→ q 2 , q 1 ?e(α),l ----→ q 3 / ∈→ q 1 θ - → f ail
The inference rule r 1 means that when the test case tc is finished by an input event, a transition to a verdict state and labelled with θ is added to formulate that the absence of event is expected. Two transitions to fail are added to express that the observation of any other output event (label !*) is incorrect. Similarly, r 2 targets the other transitions labelled by input events. r 3 completes the test case when an output event is expected. It adds a new transition q 1 ! *

-→ inconclusive modelling that we cannot conclude whether the behaviour is correct when we observe any other unexpected output event from q 1 . r 4 completes the previous rule in the case there are only outgoing transitions labelled by output events from q 1 . The rule adds a transition to fail modelling that the observation of no reaction is faulty.

Algorithm 2: input : ATraces output: TC Figure 6 illustrates a test case obtained from the abstract traces of Figure 5 after having removed the PO for the component "Products" (PO("Products, e()α) : f alse). The events /supply() and the response ok() were hence removed from the test case to comply with the new test architecture.

1 foreach t =< e 1 (α 1 ), l 1 > • • • < e k (α k ), l k >∈ ATraces do 2 Choose arbitrary σ ∈ cl(t) ; 3 cl(t) := cl(t) \ {σ}; 4 tc := lts(t, σ, v(t)); 5 foreach t 2 ∈ ATraces, σ 2 ∈ cl(t 2 ) such that ∃σ p ∈ σ∈traces(tc) pre f ix(σ) ∩ pre f ix(σ 2 ) : out(σ, σ p ) = out(σ 2 , σ p ) do 6 tc 2 := lts(σ 2 , v(t 2 )); 7 cl(t 2 ) := cl(t 2 ) \ {σ 2 };

Test Case Mutation

We now have an initial set TC of test cases, which somehow mimic the behaviours encoded in the event log w.r.t. observability and controllability of the components. This test case set is completed to experiment SUT with further executions. To generate additional test cases, we apply 11 mutation operators on TC whose purposes are to perform slight test case modifications to mimic possible failures. These modifications may affect the sequence of events (Event duplication, swapping, removal), change data (HTTP Verb change, Data alteration, Token removal, Alteration, Session id Alteration) or add unexpected events(Delay Addition, Session Closure, Stress Testing).

The list of mutation operators along with short descriptions are given in Table 1. Several operators refer to the notion of nested events, which occur between a request q 1 ?req(α),l -----→ q 2 and its response q 1 !resp(α ),l ------→ q 2 . These nested events have to be taken into account while the test case mutation. For instance, for Event Removal, if the operator deletes ?req(α) and its response into a test case, it also needs to delete the potential nested requests and responses !e 1 (α 1 ), . . . , !e k (α k ) such that to(?req(α)) = f rom(!e 1 (α 1 )), to(!e i (α i )) = f rom(!e i+1 (α i+1 ))(1 ≤ i < k) and to(!e k (α k )) = f rom(!resp(α )). 7: Test case example obtained with the mutation operator "HTTP Verb Change" If we take back the example of Figure 6 and if we apply the operator "HTTP Verb Change" we obtain the test case of Figure 7. The verb Post was replaced by Delete in the request /order; any output event not expressing a crash is allowed.

Finally, executable test cases are generated from the IOLTS trees. Some input events may still have assignments of the form p := * . These ones refer to parameter that belong to a correlation set. The first input event of a test case tc is completed by means of the data found in Corr(σ) and translated into source code. Every other input event of tc is also translated but the source code refers here to the correlation sets recovered in the output events preceding this input.

CONCLUSION

We proposed in this paper a solution to generate test cases for communicating systems from event logs. Instead of proposing a basic "record and replay" technique or an approach combining model learning and MbT, we presented algorithms allowing to extract knowledge by means of an expert system and generate an initial test suite made up of IOLTS test cases. By doing this, we intend to extract test verdicts, save computation time, and avoid the imprecision brought by models produced with passive model learning techniques. Besides, we proposed 11 test case mutation operators to expand the initial test case set.

We have implemented this approach in a tool prototype. Due to lack of room, we briefly summarise its features here: the tool is specialised for Web service compositions. It takes event logs as inputs and generates sessions by means of the tool presented in [START_REF] Salva | Conversation extraction from event logs[END_REF]. The tool Drools is the expert system used to analyse sessions. Then, our tools produces test cases written with the Citrus framework 2 . A complete evaluation will be presented in a future work.

Name

Def.

Desc.: all the test cases that can be derived from tc by Expected

Event Duplication

∀(?e(α), L) ∈ Σ I , add(tc, (?e(α), L), (?e(α), L))

adding just before ?e(α) a copy of the event followed by its related response at least the response, no error, no crash Event Swapping ∀(?e 1 (α 1 ), L 1 ), (?e 2 (α 2 ), L 2 ) ∈ Σ I , swap(tc, (?e 1 (α 1 ), L 1 ), (?e 2 (α 2 ), L 2 )) swapping two different input events and their related responses along with all their nested output events no crash Event Removal ∀(?e(α), L) ∈ Σ I , del(tc, (?e(α), L)) deleting an input event and its related response along with all the nested output events. tc must still hold at least one input event no crash HTTP Verb Change adding just before ?e(α) 100 copies of the event with overwhelming data no error, no crash

Figure 1 :

 1 Figure 1: Example of system made up of 3 components; the test architecture has 3 POs and 1 PCO

Figure 2 :

 2 Figure 2: Classical event types that can be considered for measuring PO observability

Figure 4 :

 4 Figure 4: Inference rule example • Soundness: the inference rules are Modus Ponens (simple implications that lead to sound facts if the original facts are true).

  Figure 5: Example of sessions and abstract traces

Figure 6 :

 6 Figure 6: Test case example

  ∀(?e(α), L) ∈ Σ I , Verb(tc, (?e(α), L)) changing the HTTP verb of the input event if available no crash Data Alteration ∀(?e(α), L) ∈ Σ I , dataAlt(α \{ f rom := c 1 ,to := c 2 , session id := id1,token := id2}) e(α), L) ∈ Σ I , add(tc, (?e(α), L), θ) adding a delay during which no reaction should be observed before every input event no error, no crash Token Removal ∀(?e(α), L) ∈ Σ I , "token" ∈ L : delToken(tc, α) delete the token in the input event error, no crash Token Alteration ∀(?e(α), L) ∈ Σ I , "token" ∈ L : tokenAlt(tc, α) replacing a token by another one error, no crash Session id Alteration ∀(?e(α), L) ∈ Σ I : sessionidAlt(tc, α) replacing a session id by another one error, no crash Session Closure closingSession(tc) adding a long delay and an input event at the end of every branch of the test case to check whether the session is terminated error, no crash Stress Testing ∀(?e(α), L) ∈ Σ I , add 100 (tc, (?e(α), L))

Table 1 :

 1 Mutation operators and short description (WS-Testing 2009), Los Angeles, United States. IEEE Computer Society Press. Hierons, R. (2001). Testing a distributed system: generating minimal synchronised test sequences that detect output-shifting faults. Information and Software Technology, 43(9):551-560.


Roxane Jouseau
email: roxane.jouseau@doctorant.uca.fr

Sébastien Salva
email: sebastien.salva@uca.fr

Chafik Samir
email: chafik.samir@uca.fr

Chafik Samir Data

Data quality in the context of classification tasks

Keywords: data quality, data repairing, data errors, classification

Data cleaning is an important step of a machine learning process to get the best results possible. The literature is rich, and there are many tools available, which makes choosing which tool to use complex. The objective of our work is to answer the question: Is it always best to repair data? We focus on numeric data for classification tasks. We decompose the question into five criteria, we propose a metric to measure how difficult using a repairing tool is. Then, we studied the impact of the degree of degradation of data, the type of errors present, the effectiveness of repairing tools, and the impact of different classification models. We found that error types such as missing values and outliers have more impact on accuracy and f1 score than other types of errors. Moreover, even though complex repairing tools were generally more effective, there is a point where data is so degraded that tools do not perform well. For low levels of errors, the tools also tend to have similar performances, the decision of which one to use can then be made according to their difficulty to use.

INTRODUCTION

Data is a the heart of machine learning, having quality data is therefore crucial to ensure exploitable results. The field of data cleaning and repairing is very active, from the bibliographic work we did we extracted four key points: 1. there is a lot of repairing methods in the literature (e.g: HoloClean [START_REF] Rekatsinas | HoloClean: Holistic Data Repairs with Probabilistic Inference[END_REF], Katara [START_REF] Chu | Katara: A data cleaning system powered by knowledge bases and crowdsourcing[END_REF], ZeroER [START_REF] Wu | Zeroer: Entity resolution using zero labeled examples[END_REF], CleanMl [START_REF] Li | CleanML: A study for Evaluating the IMpact of Data Cleaning on ML Classification Tasks[END_REF], REPAIR [START_REF] Li | REPAIR: Removing Representation Bias by Dataset Resampling[END_REF], OpenRefine [START_REF] Ham | OpenRefine (version 2.5). http://openrefine. org. Free, opensource tool for cleaning and transforming data[END_REF], BoostClean [START_REF] Krishnan | Boostclean: Automated error detection and repair for machine learning[END_REF], the data linter [START_REF] Hynes | The Data Linter: Lightweight, Automated Sanity Checking for ML Data Sets[END_REF] and many others), 2. data holds different levels of degradation [START_REF] Li | CleanML: A study for Evaluating the IMpact of Data Cleaning on ML Classification Tasks[END_REF], 3. repairing methods require various metadata which can sometimes be very complex to produce [START_REF] Rekatsinas | HoloClean: Holistic Data Repairs with Probabilistic Inference[END_REF], [START_REF] Chu | Katara: A data cleaning system powered by knowledge bases and crowdsourcing[END_REF], [START_REF] Wu | Zeroer: Entity resolution using zero labeled examples[END_REF], [START_REF] Li | CleanML: A study for Evaluating the IMpact of Data Cleaning on ML Classification Tasks[END_REF], [START_REF] Li | REPAIR: Removing Representation Bias by Dataset Resampling[END_REF] and, 3. data holds different types of errors [START_REF] Ziawasch Abedjan | Detecting Data Errors: Where are we and what needs to be done[END_REF], [START_REF] Chu | Data Cleaning: Overview and Emerging Challenges[END_REF], [START_REF] Azeroual | Data Quality Measures and Data Cleansing for Research Information Systems[END_REF].

From these points, we developed a research question: Is it always best to repair data? Our main contributions are a metric for the difficulty of using a repairing method and experimental results on classification tasks with deteriorated data.

SCOPE OF OUR WORK

Our work focuses on numeric data in the context of classification tasks with degradation at different levels of errors. We considered BDA 2022, October 24 -26 2022, Clermont-Ferrand, France © five types of errors: missing values ( [START_REF] Li | CleanML: A study for Evaluating the IMpact of Data Cleaning on ML Classification Tasks[END_REF], [START_REF] Rekatsinas | HoloClean: Holistic Data Repairs with Probabilistic Inference[END_REF], [START_REF] Chu | Katara: A data cleaning system powered by knowledge bases and crowdsourcing[END_REF]), outliers, domain value violations ( [START_REF] Krishnan | Boostclean: Automated error detection and repair for machine learning[END_REF]), exact duplicates ( [START_REF] Li | CleanML: A study for Evaluating the IMpact of Data Cleaning on ML Classification Tasks[END_REF], [START_REF] Hynes | The Data Linter: Lightweight, Automated Sanity Checking for ML Data Sets[END_REF], [START_REF] Ziawasch Abedjan | Detecting Data Errors: Where are we and what needs to be done[END_REF]), and partial duplicates ( [START_REF] Wu | Zeroer: Entity resolution using zero labeled examples[END_REF]). We used 7 numerical datasets with various sizes, dimensions, and subjects: mnist, fashion-mnist, olivetti, iris, adult, breast cancer, and wine [START_REF] Pedregosa | Scikit-learn: Machine Learning in Python[END_REF], [START_REF] Xiao | Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms[END_REF], [START_REF] Blake | UCI repository of machine learning databases[END_REF]. We also have decided to include the following classification models: Logistic regression, K-Nearest Neighbors, Decision tree, Random forest, Ada boost, Naïve Bayes, XGboost, Support vector classification, Gaussian process, Multi-layer perceptron, Stochastic gradient descent, and Gradient boosting [START_REF] Pedregosa | Scikit-learn: Machine Learning in Python[END_REF].

We answer the research question through five criteria. With the first criteria C1, we studied the perceived difficulty of using a method according to experts. To answer these questions we propose a metric to evaluate how difficult using a repairing method is (C1). C2 focuses on studying the impact of the degradation of the data. With C3, we study the impact of the type of error present in data. We also investigate the effectiveness of repairing tools with C4 and the impact of the classification model used with C5. For C2 to C5 we designed an experiment that allow us to observe the impact of data repairing on classification tasks at different levels of degradation of the data. In this paper we will first present the metric we developed for C1, we will then present the experiments we conducted for C2, C3, C4, and C5 with a summary of our results and conclusions concerning these criteria. Finally, we conclude on our main research question using the five criteria we identified.

PRELIMINARY RESULTS

Traditionally, repairing methods are evaluated and compared on the difference between their accuracy and f1 score on unrepaired and repaired data. This kind of comparison is very limited other criteria should be considered such as producing complex metadata for a repairing method which can be both complex and time-consuming. To account for this, we propose to evaluate repairing methods based on how difficult they are to use according to data scientists. We first started by breaking down the repairing methods we found in the literature into elementary tasks describing each action needed to use them including creating the metadata needed. Given an error type, and a repairing method R_X, we built a tree expressing the steps of R_X. For any other repairing method R_Y we completed the tree when required. The final nodes of the tree are elementary tasks. Figure 1 is an example of the tree constructed for repairing missing values. We then asked a panel of eight industry data scientists to rank every elementary task individually on a four-level scale from easy to hard. These rankings allowed us to compute a weighted mean for the difficulty of each elementary task. We finally derive an overall difficulty ranking of every method by using a linear combination of the elementary tasks.

To study the criteria C2, C3, C4, and C5 we designed an experiment where for each of the seven datasets we included, we We first injected the training dataset with one type of error at a percentage varying from 0 to 95% with increments of 5%. We applied a panel of repairing methods to different copies of the deteriorated dataset to obtain cleaned datasets. We then used them to train several classification models. Finally, we computed the accuracy and f1-score on the tests. We executed the complete process 30 times to reduce the bias for each percentage level. Mainly our results allowed us to extract these observations. With C2 and C3 we identified 2 categories of error types: category 1 (exact duplicates, partial duplicates, and domain value violations) of data degradation has little to no impact on the accuracy, and category 2 (missing values and outliers) the level of data degradation seems to have a big impact. Studying C4 showed us that some methods do perform better but at high levels of degradation the effectiveness of the different repairing methods seems to be leveled out. Moreover, at levels of degradation under 10%, most repairing methods perform well which means that depending on the accuracy we aim to obtain a simpler method could be sufficient. C5 mainly showed us that the error type classification models are the most sensitive to is outliers.

Figure 1 :

 1 Figure 1: Elementary tree decomposition for missing values

CONCLUSIONOur work studied the impact of repairing errors on classification tasks to answer the question: Is it always best to repair data? We presented five criteria to answer this question. Firstly we identified two categories of error types: low-impact and high-impact errors. In the case of low-impact errors, it seems unnecessary to use a very complex repairing method as the impact of the error is relatively low. Secondly, with all the error types we studied, there was a point where the data was too deteriorated, and all repairing methods were performing equivalently poorly. We were also able to identify cases where a simple and a more complex method performed similarly. In these cases, our difficulty ratings of the methods are particularly relevant for comparing both.Extensions of this work to applications other than classification tasks are possible directions for future work. Moreover, additional research could include more data types than numeric, especially more complex data types such as time series, which would imply more possible error types.