Loïc Doeuvre

Laurent Plawinski

Florence Toti

MD, ScD. Eduardo Anglés-Cano
email: eduardo.angles-cano@inserm.fr

CELL-DERIVED MICROPARTICLES: A NEW CHALLENGE IN NEUROSCIENCE

Keywords: epidermal growth factor receptor, EPCR, endothelial protein C receptor, ITP, idiopathic thrombocytopenic purpura, MPs, microparticles, MS, multiple sclerosis, PS, phosphatidylserine, TF, tissue factor, TIA, transient ischemic attack, TNF-α, tumor necrosis factor α, uPA, urokinase-type plasminogen activator microparticles, hemostasis, neurovascular unit, ischemic stroke, multiple sclerosis, cerebral malaria

Microparticles (MPs) are membrane fragments shed by cells activated by a variety of stimuli including serine proteases, inflammatory cytokines, growth factors and stress inducers. MPs originating from platelets, leukocytes, endothelial cells and erythrocytes are found in circulating blood at relative concentrations determined by the pathophysiological context. The procoagulant activity of MPs is their most characterized property as a determinant of thrombosis in various vascular and systemic diseases including myocardial infarction and diabetes. An increase in circulating MPs has also been associated with ischemic cerebrovascular accidents, transient ischemic attacks, multiple sclerosis and cerebral malaria.

Recent data indicate that besides their procoagulant components and identity antigens, MPs bear a number of bioactive effectors that can be disseminated, exchanged and transferred via MPs-cell interactions. Furthermore, since activated parenchymal cells may also shed MPs carrying identity antigens and biomolecules, MPs are now emerging as new messengers/biomarkers from a specific tissue undergoing activation or damage. Thus, detection of MPs of neurovascular origin in biological fluids such as CSF or tears, and even in circulating blood in case of blood brain barrier leakage, would not only improve our comprehension of neurovascular pathophysiology, but may also constitute a powerful tool as a biomarker in disease prediction, diagnosis, prognosis and follow-up.

Introduction

Brain functions and survival of its multiple cellular components depend on blood flowing through a patent vascular microcirculation that ensures selective exchange of vital elements (e.g. glucose, oxygen and hormones), excretion of metabolic products and transmigration of competent cells. The structural/functional-integrated network that regulates these physiological functions is the neurovascular unit.

It is now well known that a number of stress conditions and inflammatory mediators may stimulate and activate vascular and blood cells. One of the earliest manifestations of cell activation is plasma membrane blebbing and shedding into body fluids of membrane fragments known and designated hereafter as microparticles (MPs) [START_REF] Freyssinet | Cellular microparticles: what are they bad or good for?[END_REF]) -other designations in the literature are: microvesicles, ectosomes, shedding vesicles, exovesicles.

Plasma membrane remodelling is an early event observed in cells entering apoptosis as well.

MPs characteristically display procoagulant properties and behave also as a storage pool of bioactive molecular effectors, messengers of cell activation and apoptosis (Morel et al. 2004c).

Cells in the neurovascular unit or its vicinity including the endothelial lining and neural cells (neurons, astrocytes, oligodendrocytes and microglia) are also subjected to stress by a variety of stimuli (e.g. oxygen radicals, inflammation, ischemia…) known to induce membrane shedding in vascular cells. It is therefore possible that shedding of cellular MPs in the neurovascular network may be linked to the onset and progression of a variety of CNS diseases including stroke, vascular dementia, inflammatory and age-related neurodegenerative disorders. In this review we analyze the state of the art on MPs in the CNS and provide clues that may improve our knowledge in the field. The review also examines MP detection and characterization as possible tools for identification of new markers and biological signal conveyors in stroke and other CNS diseases.

Circulating blood microparticles: haemostatic and inflammatory effectors Plasma membrane blebbling and shedding of microparticles

The most characterized cellular MPs are those originating from platelets, leukocytes, erythrocytes and endothelial cells, detected in circulating blood [START_REF] Morel | Procoagulant microparticles: disrupting the vascular homeostasis equation?[END_REF]. A number of studies have demonstrated that stimulation of these cells triggers a characteristic activation pattern of events: increased levels of cytoplasmic calcium associated to translocation of phosphatidylserine (PS) from the inner to the outer leaflet of the membrane and activation of calpains that, by cleaving cytoskeletal filaments, facilitate MP shedding [START_REF] Pasquet | Calcium influx is a determining factor of calpain activation and microparticle formation in platelets[END_REF].

The increase in intracellular calcium concentration induces a disordered state in the phospholipid membrane asymmetry of quiescent cells that is maintained by the concerted activity of lipid transporter proteins [START_REF] Bevers | Lipid translocation across the plasma membrane of mammalian cells[END_REF][START_REF] Daleke | Regulation of transbilayer plasma membrane phospholipid asymmetry[END_REF]. The ATP-dependent flippases (e.g. aminophospholipid translocase) and floppases (including the ATP-binding cassette transporter A1, ABCA1) are respectively inward-and outward-directed transporters, whereas the calcium-dependent scramblases (e.g. phospholipid scramblase receptor-1, PLSCR-1) facilitate bidirectional movement between the membrane leaflets (Fig. 1). The rate of PS translocation has been found to be sensitive to the altered expression of ABCA1 in knock-out mice [START_REF] Hamon | ABC1 promotes engulfment of apoptotic cells and transbilayer redistribution of phosphatidylserine[END_REF].

In summary, the mechanism governing the plasma membrane PS redistribution is of a complex nature and implicates various membrane (lipid transporters, receptors, calcium channels) and cytoplasmic (cytoskeleton, calpains) actors [START_REF] Zwaal | Surface exposure of phosphatidylserine in pathological cells[END_REF]. Recent data indicate that the formation and integrity of lateral transient membrane microdomains termed rafts, rich in cholesterol and sphingolipids [START_REF] Hancock | Lipid rafts: contentious only from simplistic standpoints[END_REF][START_REF] Brown | Lipid rafts, detergent-resistant membranes, and raft targeting signals[END_REF], may provide an appropriate platform for the assembly of some of these regulatory elements and be essential for the transmembrane redistribution of PS [START_REF] Sun | Plasma membrane phospholipid scramblase 1 is enriched in lipid rafts and interacts with the epidermal growth factor receptor[END_REF][START_REF] Kunzelmann-Marche | Loss of plasma membrane phospholipid asymmetry requires raft integrity. Role of transient receptor potential channels and ERK pathway[END_REF], Lopez et al. 2005). PS exposure was indeed colocalized with membrane lipid raft regions [START_REF] Fischer | Antigen recognition induces phosphatidylserine exposure on the cell surface of human CD8+ T cells[END_REF]. Rafts are dynamic features that may appear and disappear as a function of the state of activation and types of stimuli [START_REF] Hancock | Lipid rafts: contentious only from simplistic standpoints[END_REF]. Raft microdomains in the outer leaflet of the plasma membrane are coupled to microdomains in the inner leaflet that contain signalling kinases, able to initiate transmembrane signalling transduction pathways [START_REF] Michel | Lipid rafts in health and disease[END_REF].

Consequences of phosphatidylserine exposure

Transfer of PS to the outer leaflet of the membrane is an early sign of cell activation or apoptosis. Whereas the intensity and duration of PS exposure during viable cell activation depends on cell type and agonists, in apoptotic cells it constitutes a prerequisite for engulfment by phagocytes before any loss of plasma membrane integrity [START_REF] Balasubramanian | Aminophospholipid asymmetry: A matter of life and death[END_REF]. Apoptotic bodies, the fragments of apoptotic cells (size > 1 µm) containing fragmented DNA, also expose PS and follow the same fate on a delayed time scale. In the vascular territory, exposed PS serves as a catalytic template or functional surface for the assembling of blood coagulation factor complexes, thus promoting in situ hemostasis, a physiological function of activated platelets and shed platelet MPs. As prime sensors of procoagulant stimuli, platelets are main contributors to MP circulating levels (Morel et al. 2008b). Platelet-derived MPs can thus be found at low levels in the circulation of healthy individuals probably as a result of low grade surveillance activation of the haemostatic system [START_REF] Berckmans | Cell-derived microparticles circulate in healthy humans and support low grade thrombin generation[END_REF].

In vitro, the interaction of membrane-PS with coagulation factors is inhibited by its affinity ligand annexin V in presence of calcium [START_REF] Gidon-Jeangirard | Annexin V delays apoptosis while exerting an external constraint preventing the release of CD4+ and PrPc+ membrane particles in a human T lymphocyte model[END_REF]. This property of annexin V is exploited experimentally and in clinical practice in the detection of MPs using various assays eventually combined with fluorescence labeling (flow cytometry, capture assays, fluorescence MP tracking).

Microparticles' identity unveil activated or suffering cells

Membrane glycoproteins distinctive of the parental cells are present on circulating MPs allowing thereby identification of their cellular origin. Antibodies directed against cellspecific antigenic determinants are used for this purpose in flow cytometry or antibody capture assays. Elevated circulating levels of distinct MPs are now considered as an indicator of either platelet, endothelial or leukocyte activation.

Identification of MP origin constitutes therefore a solid advantage to determination of their sole number and represents a robust parameter in systemic or inflammatory diseases [START_REF] Chironi | Circulating leukocyte-derived microparticles predict subclinical atherosclerosis burden in asymptomatic subjects[END_REF] or when associated to vascular complications like in diabetes (Sabatier et al. 2002a). Identification of MPs of practically any cell origin in plasma or other biological fluids (CSF, tears, exudates, Fig. 2) would become possible provided that antibodies directed against cell-specific antigenic determinants were available [START_REF] Cook | Simultaneous measurement of six cytokines in a single sample of human tears using microparticle-based flow cytometry: allergics vs. non-allergics[END_REF], Morel et al. 2008a). Detection of a distinct MP population would then be considered a direct message from a specific tissue undergoing activation or damage.

Haemostatic properties of blood microparticles

The procoagulant activity of platelet MPs was initially identified in the precipitate of plateletfree plasma obtained at high-speed centrifugation (30 000g, 120 min) [START_REF] Chargaff | The biological significance of the thromboplastic protein of blood[END_REF] and containing electron dense "platelet-dust" [START_REF] Wolf | The nature and significance of platelet products in human plasma[END_REF]. These seminal discoveries established the basis for the isolation of MPs from plasma and opened up a new avenue in thrombosis research culminating in the discovery that circulating tissue factor (TF), the cellular trigger of blood clotting, is mostly associated with circulating MPs [START_REF] Giesen | Blood-borne tissue factor: another view of thrombosis[END_REF]). It has also been suggested that platelets may recover TF present in raft of leukocytederived MPs [START_REF] Rauch | Transfer of tissue factor from leukocytes to platelets is mediated by CD15 and tissue factor[END_REF], Del Conde et al. 2005[START_REF] Falati | Accumulation of tissue factor into developing thrombi in vivo is dependent upon microparticle P-selectin glycoprotein ligand 1 and platelet P-selectin[END_REF]) and that endothelial MPs may stimulate the expression of TF by leukocytes (Sabatier et al. 2002b). Current knowledge suggests that coagulation factors VII and IX, once bound to membrane-PS in the presence of calcium, are activated by MP-borne TF thereby initiating the coagulation cascade leading to thrombin generation and in fine to the formation of a fibrin-platelet clot. Thus, TFexpressing MPs released by leukocytes upon soluble P-selectin stimulation enhance thrombus formation [START_REF] Andre | Procoagulant state resulting from high levels of soluble P-selectin in blood[END_REF]. P-selectin is a cell-adhesion molecule released by thrombinactivated platelets and endothelial cells into the circulation and its soluble form is a useful biomarker in ischemic events such as stroke [START_REF] Nadar | Platelet morphology, soluble P selectin and platelet P-selectin in acute ischaemic stroke. The West Birmingham Stroke Project[END_REF]. In this regard, it was recently shown that mice producing abnormally high plasma levels of soluble P-selectin, had local uneven blood brain barrier disruption, silent brain infarctions and increased infarct size volumes in a experimental model of middle cerebral artery occlusion [START_REF] Kisucka | Elevated levels of soluble P-selectin in mice alter blood brain barrier function, exacerbate stroke and promote atherosclerosis[END_REF].

First clinical evidences of the haemostatic properties of procoagulant MPs were shown in patients with idiopathic thrombotic purpura (ITP see below) in whom high MP circulating levels were found protective against secondary hemorrhages. Conversely, in Scott syndrome, a very rare bleeding disorder, platelet PS exposure, membrane remodeling and MP shedding are defective and can be treated by platelet transfusion [START_REF] Weiss | Scott syndrome: a disorder of platelet coagulant activity[END_REF][START_REF] Toti | Scott syndrome, characterized by impaired transmembrane migration of procoagulant phosphatidylserine and hemorrhagic complications, is an inherited disorder[END_REF].

Ultimate evidence of the haemostatic properties of MPs was given in engineered hemophiliac mice in which circulating leukocyte MPs correct hemostasis [START_REF] Hrachovinova | Interaction of P-selectin and PSGL-1 generates microparticles that correct hemostasis in a mouse model of hemophilia A[END_REF].

Most clinical studies have focused on the procoagulant role of platelet-and leukocyte-derived MPs as a determinant of the risk of cardio-and cerebro-vascular ischemic accidents as well as in thrombotic associated disorders (Morel et al. 2004a[START_REF] Simak | Circulating endothelial microparticles in acute ischemic stroke: a link to severity, lesion volume and outcome[END_REF][START_REF] Chironi | Endothelial microparticles in diseases[END_REF]). However, it has recently been suggested that endothelial-derived MPs may also express anticoagulant or profibrinolytic properties, thereby complementing their procoagulant activity. The anticoagulant property of MPs is based, in part, on their ability to promote activation of protein C by thrombin, both assembled on their respective surface receptors thrombomodulin and endothelial protein C receptor (EPCR). Activated protein C (APC) bound to MP-EPCR inactivates procoagulant co-factors Va and VIIIa, thereby downregulating thrombin generation [START_REF] Satta | The significance of human monocyte thrombomodulin during membrane vesiculation and after stimulation by lipopolysaccharide[END_REF][START_REF] Perez-Casal | Activated protein C induces the release of microparticle-associated endothelial protein C receptor[END_REF]. Endothelial MPs also express matrix metalloproteinases (EC 3.4.24) [START_REF] Taraboletti | Shedding of the matrix metalloproteinases MMP-2, MMP-9, and MT1-MMP as membrane vesicle-associated components by endothelial cells[END_REF] and MPs from the atherosclerotic plaque bear the TNF-α-converting enzyme (TACE) that are able to enhance endothelial cell surface processing of TNF-α and EPCR [START_REF] Canault | Microparticles of human atherosclerotic plaques enhance the shedding of the tumor necrosis factor-alpha converting enzyme/ADAM17 substrates, tumor necrosis factor and tumor necrosis factor receptor-1[END_REF]). The recent discovery of a profibrinolytic activity on MPs adds further to their contribution in the maintenance of vascular integrity. MPs shed by TNFα-stimulated endothelial cells, serve indeed as a surface for assembly of plasminogen and its conversion into plasmin (EC 3.4.21.7) by urokinase (uPA; EC 3.4.21.73) bound to its receptor (uPAR) [START_REF] Lacroix | Activation of plasminogen into plasmin at the surface of endothelial microparticles: a mechanism that modulates angiogenic properties of endothelial progenitor cells in vitro[END_REF]). This capacity of endothelial MPs to promote plasmin generation confers them new profibrinolytic and, in concert with matrix metalloproteinases, proteolytic functions [START_REF] Doeuvre | Cell-derived microparticles unveil their fibrinolytic and proteolytic function[END_REF]. The proteolytic activity of MPs may be of relevance in fibrinolysis, cell migration, angiogenesis, dissemination of malignant cells, cell detachment and apoptosis.

Beyond hemostasis: microparticles are dynamic pools of bioactive effectors

Apart from being membrane templates that harbor procoagulant, fibrinolytic and proteolytic factors as well as their distinctive glycoproteins, MPs may also carry molecular components (membrane receptors, cytokines, transcription factors, mRNA), veritable indicators of the activation status of the parental cell. MPs thus constitute a disseminated dynamic pool of bioactive effectors or messengers, as documented by several in vitro studies [START_REF] Ahn | Cell-derived microparticles: 'Miniature envoys with many faces[END_REF], Morel et al. 2004c). Some of these MP components may exert in situ functions such as local fibrinolytic and proteolytic activities induced by uPA and metalloproteinases [START_REF] Lacroix | Activation of plasminogen into plasmin at the surface of endothelial microparticles: a mechanism that modulates angiogenic properties of endothelial progenitor cells in vitro[END_REF][START_REF] Taraboletti | Shedding of the matrix metalloproteinases MMP-2, MMP-9, and MT1-MMP as membrane vesicle-associated components by endothelial cells[END_REF][START_REF] Graves | Proinvasive properties of ovarian cancer ascites-derived membrane vesicles[END_REF]). The intercellular transfer by MPs of mRNA [START_REF] Deregibus | Endothelial progenitor cell derived microvesicles activate an angiogenic program in endothelial cells by a horizontal transfer of mRNA[END_REF][START_REF] Ratajczak | Embryonic stem cell-derived microvesicles reprogram hematopoietic progenitors: evidence for horizontal transfer of mRNA and protein delivery[END_REF][START_REF] Bruno | Mesenchymal Stem Cell-Derived Microvesicles Protect Against Acute Tubular Injury[END_REF] or membrane proteins like platelet glycoprotein GPIIb/IIIa to leukocytes [START_REF] Salanova | Beta2integrins and acquired glycoprotein IIb/IIIa (GPIIb/IIIa) receptors cooperate in NF-kappaB activation of human neutrophils[END_REF] or endothelial progenitor cell cultures [START_REF] Prokopi | Proteomic analysis reveals presence of platelet microparticles in endothelial progenitor cell cultures[END_REF], leukocyte TF to platelets [START_REF] Falati | Accumulation of tissue factor into developing thrombi in vivo is dependent upon microparticle P-selectin glycoprotein ligand 1 and platelet P-selectin[END_REF]

Microparticles are different from exosomes

The isolation of MPs follows a very precise protocol including a succession of various centrifugations at 20 000g. A consensus on a method of isolation has not been obtained as yet, but it appears clear that the relative gravitational force necessary to sediment MPs (15 000 to 20 000g, 45 to 90 min) is quite different from that used to isolate exosomes (as verified by light scattering measurement, authors' unpublished data). Exosomes are vesicles of endosomic origin, of smaller size (<100 nm) than MPs and are therefore isolated by sequential ultracentrifugation at very high speed (100 000g) [START_REF] Thery | Isolation and characterization of exosomes from cell culture supernatants and biological fluids[END_REF]. They are secreted in the extracellular medium after fusion of multivesicular endosomes with the plasma membrane (for review, see [START_REF] Thery | Exosomes: composition, biogenesis and function[END_REF]). Exosomes and MPs are biochemically and morphologically distinct, and have different patterns of protein composition [START_REF] Thery | Proteomic analysis of dendritic cell-derived exosomes: a secreted subcellular compartment distinct from apoptotic vesicles[END_REF]. Exosomes are particularly enriched in tetraspanins, annexins and major histocompatibility complex class II molecules. Since membrane vesicles isolated at 50 000g to 100 000g may contain both exosomes and MPs, molecular components or pathophysiological involvement cannot be ascribed to the effect of single vesicles, however.

Effects of microparticles on inflammation and apoptosis

Vascular MPs behave as a dynamic storage pool of bioactive effectors able to tune the haemostatic balance, achieve vessel protection and complete restoration of blood flow. In addition, vascular MPs have been recognized as inflammatory actors via the transcellular delivery of bioactive lipids, chemokines (RANTES) or cytokines (IL-1 ß) [START_REF] Barry | Transcellular activation of platelets and endothelial cells by bioactive lipids in platelet microparticles[END_REF][START_REF] Mause | Platelet microparticles: a transcellular delivery system for RANTES promoting monocyte recruitment on endothelium[END_REF][START_REF] Mackenzie | Rapid secretion of interleukin-1beta by microvesicle shedding[END_REF][START_REF] Mesri | Leukocyte microparticles stimulate endothelial cell cytokine release and tissue factor induction in a JNK1 signaling pathway[END_REF]. The question arises whether these transcellular cross-talk are all pathophysiological, i.e. deleterious [START_REF] Freyssinet | Cellular microparticles: what are they bad or good for?[END_REF][START_REF] Morel | Microparticles in endothelial cell and vascular homeostasis: are they really noxious?[END_REF], or as suggested by recent in vitro data, a beneficial effect may be expected.

For instance, neutrophil-derived MPs were shown to inhibit the macrophage proinflammatory response to lipopolysaccharide and up-regulate macrophage TGF-ß secretion [START_REF] Gasser | Activated polymorphonuclear neutrophils disseminate anti-inflammatory microparticles by exocytosis[END_REF]. Furthermore, MPs shed from adherent neutrophils convey annexin I, an anti-inflammatory protein able to inhibit further neutrophil adhesion thereby providing a negative regulatory loop to their recruitment at the inflamed endothelium [START_REF] Dalli | Annexin 1 mediates the rapid anti-inflammatory effects of neutrophil-derived microparticles[END_REF]. Similarly, on endothelial cell cultures, early cytoprotection may also occur through the sorting of deleterious pro-apoptotic factors like caspase 3 in MPs, a mechanism that would prevent endothelial cell detachment and apoptosis [START_REF] Hussein | Inhibition of microparticle release triggers endothelial cell apoptosis and detachment[END_REF]). In a very recent report, RNA-dependent apoptosis resistance and in vitro proliferation was conferred to tubular epithelial cells by MPs derived from human bone marrow mesenchimal stem cells [START_REF] Bruno | Mesenchymal Stem Cell-Derived Microvesicles Protect Against Acute Tubular Injury[END_REF]. Recovery of cultured rat oligodendrocytes from complement mediated attack through MPs shedding of membrane-attack complexes, may protect cells from complementmediated lysis (Scolding et al. 1989, Pilzer et

Current Analytical Methods

Because of the increasing importance of MPs as potential biomarkers, messengers or mediators of disease pathophysiology, particular attention has been given to pre-analytical sample conditioning and to biophysical methods for their detection and characterization (Jy et al. 2004a, Hugel et al. 2004). Appropriate blood collection to avoid artefactual cell activation and rigorous sample processing to isolate exosome-free MPs (see above) are indispensable.

Among the available detection methods, the most currently used is flow cytometry. It allows characterization and quantification of MP subpopulations in heterogeneous samples and may be directly used to analyse MPs in plasma samples [START_REF] Robert | Standardization of platelet-derived microparticle counting using calibrated beads and a Cytomics FC500 routine flow cytometer: a first step towards multicenter studies?[END_REF]). However, its main pitfall is that MPs with a size range below 500 nm (under the limit of the laser beam wave length) cannot be accurately detected. Therefore, quantitative analysis of MPs should be interpreted cautiously. An alternative capture assay using annexin V measures all procoagulant MPs bearing PS irrespective of size and origin. This functional assay provides quantitative results in terms of nmol/l of PS equivalent by comparison with a calibration curve constructed with synthetic vesicles containing known amounts of PS [START_REF] Hugel | Measuring circulating cell-derived microparticles[END_REF]). Annexin V-coated beads have also been used for MP visualization [START_REF] Bianco | Astrocyte-derived ATP induces vesicle shedding and IL-1 beta release from microglia[END_REF].

Newer methods for the measurement of MP size and distribution may be envisaged using their physical properties. Thus, photon correlation spectroscopy of back scattered light

Microparticles in central nervous system pathologies

The association of blood-derived MPs with a variety of inflammatory and/or prothrombotic states has been extensively studied (Morel et al. 2004b[START_REF] Diamant | Cellular microparticles: new players in the field of vascular disease?[END_REF][START_REF] Distler | Microparticles as regulators of inflammation: novel players of cellular crosstalk in the rheumatic diseases[END_REF][START_REF] Pilzer | Emission of membrane vesicles: roles in complement resistance, immunity and cancer[END_REF][START_REF] Leroyer | Role of microparticles in atherothrombosis[END_REF][START_REF] Morel | Procoagulant microparticles: disrupting the vascular homeostasis equation?[END_REF]. At present, all available reports on MPs in CNS or neurovascular pathologies have also focused on endothelial-or blood cells-derived MPs [START_REF] Horstman | Cell-derived microparticles and exosomes in neuroinflammatory disorders[END_REF]). The survey of the literature we have made on MP involvement in CNS pathophysiology until April 28, 2009, concerns a limited number of diseases as reported here. Although virtually any cell type may be constrain to release MPs, little is know about MP release from brain structures or cells of the neurovascular unit. Yet, the presence of galactocerebroside-containing MPs, suggesting oligodendrocyte origin, has been reported in CSF of patients with multiple sclerosis (MS) [START_REF] Scolding | Vesicular removal by oligodendrocytes of membrane attack complexes formed by activated complement[END_REF]) and in vitro studies indicate that MPs can be isolated from the supernatant of glial cells like astrocytes using annexin V-coated beads [START_REF] Bianco | Astrocyte-derived ATP induces vesicle shedding and IL-1 beta release from microglia[END_REF][START_REF] Bianco | Acid sphingomyelinase activity triggers microparticle release from glial cells[END_REF]).

Ischemic stroke

A potential pathophysiological link between elevated concentration of platelet-derived MPs and development of cerebrovascular infarction was first reported in patients with prosthetic heart valves [START_REF] Geiser | Mechanisms of cerebrovascular events as assessed by procoagulant activity, cerebral microemboli, and platelet microparticles in patients with prosthetic heart valves[END_REF]. A limited number of prospective studies on MPs of endothelial and blood origin in ischemic stroke have then been reported. For instance, a significant high concentration of platelet-derived MPs was found in peripheral blood within 7 days and at 6 month follow-up of ischemic stroke [START_REF] Cherian | Endothelial and platelet activation in acute ischemic stroke and its etiological subtypes[END_REF]. This increase in platelet MPs after stroke was confirmed by other studies and was counteracted using a combination of the anti-platelet drugs aspirin and clopidogrel [START_REF] Serebruany | Effects of clopidogrel and aspirin in combination versus aspirin alone on platelet activation and major receptor expression in patients after recent ischemic stroke: for the Plavix Use for Treatment of Stroke (PLUTO-Stroke) trial[END_REF][START_REF] Serebruany | Antiplatelet profiles of the fixed-dose combination of extended-release dipyridamole and low-dose aspirin compared with clopidogrel with or without aspirin in patients with type 2 diabetes and a history of transient ischemic attack: A randomized, single-blind, 30-day trial[END_REF][START_REF] Pawelczyk | The influence of hyperlipidemia on platelet activity markers in patients after ischemic stroke[END_REF]). The severity, lesion volume and outcome of acute ischemic stroke were also associated with an increased number of circulating endothelial-derived MPs [START_REF] Simak | Circulating endothelial microparticles in acute ischemic stroke: a link to severity, lesion volume and outcome[END_REF]. However, in all these reports, the prognostic value of these findings on recurrence of stroke and survival free of handicap could not be established. Furthermore, a comparison of endothelial MPs levels in acute ischemic stroke versus stroke mimic patients showed no difference [START_REF] Williams | Endothelial microparticle levels are similar in acute ischemic stroke and stroke mimics due to activation and not apoptosis/necrosis[END_REF]). Since it is currently impossible to determine the anatomical origin of the endothelial MPs (systemic or neurovascular ischemic stimulation), it is difficult to ascertain whether MPs are epiphenomenal markers or active players in ischemic stroke. Elevated levels of platelet MPs have been also observed in patients with transient ischemic attacks (TIA) and small vessels cerebro-vascular accidents including lacunar infarcts, and multiinfarct dementias [START_REF] Lawrie | Elevated platelet microparticles in transient ischemic attacks, lacunar infarcts, and multiinfarct dementias[END_REF][START_REF] Geiser | Mechanisms of cerebrovascular events as assessed by procoagulant activity, cerebral microemboli, and platelet microparticles in patients with prosthetic heart valves[END_REF]. Although in patients with TIA the number of platelet MPs may be importantly decreased under anti-platelet drug therapy, benefits for prevention of second stroke have not been reported et al. 2008).

Transient ischemic stroke in idiopathic thrombocytopenic purpura ITP is an autoimmune disorder in which autoantibody-coated platelets are cleared by the mononuclear phagocytic system [START_REF] Neylon | Clinically significant newly presenting autoimmune thrombocytopenic purpura in adults: a prospective study of a population-based cohort of 245 patients[END_REF]. Since some of these autoantibodies bind to glycoproteins that induce platelet activation, platelet MPs are frequently elevated in these patients and thrombotic complications may develop despite severe thrombocytopenia and few signs of bleeding [START_REF] Ahn | Vascular dementia in patients with immune thrombocytopenic purpura[END_REF]. Patients with chronic late onset ITP (mean 56 years), may develop a syndrome characterized by neurological complications resembling transient cerebral ischemic attacks (TIA-like syndrome) and evolving from dizzy spells in mild cases to coma, seizure, or progressive memory loss and cognitive dysfunction in advanced cases [START_REF] Jy | Clinical significance of platelet microparticles in autoimmune thrombocytopenias[END_REF]. TIA-like syndrome in patients with ITP is indeed associated with magnetic resonance imaging findings (periventricular and subcortical white matter lesions) consistent with ischemic small vessels disease that may be a consequence of platelet MP-induced microthrombi [START_REF] Ahn | Vascular dementia in patients with immune thrombocytopenic purpura[END_REF]. Recent in vitro data suggest that the release of endothelial MPs and the extravasation of leukocytes may also contribute to development of the ischemic brain disease [START_REF] Jimenez | Transendothelial migration of leukocytes is promoted by plasma from a subgroup of immune thrombocytopenic purpura patients with small-vessel ischemic brain disease[END_REF]. These data suggest that ITP and ischemic stroke are not mutually exclusive events [START_REF] Theeler | A patient with idiopathic thrombocytopenic purpura presenting with an acute ischemic stroke[END_REF]. If proper identification of this syndrome (e.g. measurement of MPs) is made, therapy could then be targeted at prevention of thrombotic complication rather than hemorrhages. Indeed, ITP patients, with elevated MP levels were shown to be at lower risk of hemorrhages, probably because procoagulant MPs behave as alternate procoagulant catalytic surfaces under circumstances of cytopenia [START_REF] Jy | Clinical significance of platelet microparticles in autoimmune thrombocytopenias[END_REF].

Microparticles in cerebrospinal fluid

Recently, it was shown that the plasma and the CSF of patients suffering from traumatic injury (Morel et al. 2008a) contain PS exposing MPs mainly of platelet and endothelial origin.

Procoagulant MPs were also found significantly elevated in the CSF of patients with hemorrhagic stroke as detected by annexin V binding/procoagulant assay [START_REF] Huang | High concentrations of procoagulant microparticles in the cerebrospinal fluid and peripheral blood of patients with acute basal ganglia hemorrhage are associated with poor outcome[END_REF]).

The sustained generation of these procoagulant MPs in the CSF of some patients could contribute to a poor clinical outcome. MPs (0.1 to 0.5 µm in diameter) reactive with antibodies to complement membrane-attack complex neoantigen and galactocerebroside were identified in CSF of multiple sclerosis patients by electron microscopy [START_REF] Scolding | Vesicular removal by oligodendrocytes of membrane attack complexes formed by activated complement[END_REF] suggesting that reversible complement-mediated injury contributes to myelin damage in vivo.

In patients with glioblastoma, membrane vesicles were identified in CSF after sequential centrifugation at 10 000g and 200 000g [START_REF] Huttner | The stem cell marker prominin-1/CD133 on membrane particles in human cerebrospinal fluid offers novel approaches for studying central nervous system disease[END_REF], a procedure frequently used to separate exosomes. These membrane particles (previously identified as 50-80 nm particles [START_REF] Marzesco | Release of extracellular membrane particles carrying the stem cell marker prominin-1 (CD133) from neural progenitors and other epithelial cells[END_REF])), contained the neural stem cell marker prominin-1/CD133, but neither PS nor cell identity antigens were reported. Prominin-1/CD133 is a marker that decline postnatally until 10 years of age and was found elevated in glioblastoma patients. A proteomic analysis of human embryo CSF revealed a heterogeneous mixture of functionally diverse proteins including proteins with extracellular matrix functions, secreted proteases and their inhibitors, and cell adhesion proteins [START_REF] Zappaterra | A comparative proteomic analysis of human and rat embryonic cerebrospinal fluid[END_REF]). Interestingly, the presence of membrane proteins, signaling molecules and other intracellular proteins are most likely of MP and/or exosome origin that have been previously described in CSF [START_REF] Marzesco | Release of extracellular membrane particles carrying the stem cell marker prominin-1 (CD133) from neural progenitors and other epithelial cells[END_REF][START_REF] Scolding | Vesicular removal by oligodendrocytes of membrane attack complexes formed by activated complement[END_REF]).

Cerebral Malaria

Circulating endothelial-derived MPs are increased in patients with severe cerebral malaria (1 to 8 % of Plasmodium falciparum infections) complicated with coma as compared with uncomplicated malaria or healthy control [START_REF] Combes | Circulating endothelial microparticles in malawian children with severe falciparum malaria complicated with coma[END_REF]). Parasite-derived products activate platelets and promote monocyte TNF-α production, a well-known inducer of endothelial MPs in vitro. Binding of activated platelets to TNF-α-primed endothelial cells would lead to platelet adhesion and blood clogging, and the release of MPs within brain microvasculature with subsequent induction of permeability changes, ischemia, endothelial cell apoptosis and cerebral oedema (van der Heyde et al. 2006).

Combes et al. provided major insights in the mechanism of action of MPs in cerebral malaria [START_REF] Combes | ABCA1 gene deletion protects against cerebral malaria: potential pathogenic role of microparticles in neuropathology[END_REF]. These authors reported that in a mouse model, ABCA1, a membrane transporter that mediates cholesterol translocation and a casual floppase known to facilitate the transbilayer distribution of PS to the outer leaflet of the membrane (Fig. 1), might contribute to cerebral malaria via MP shedding. Indeed, external exposure of PS is impaired in ABC-1 knockout mice that also show low circulating MP levels and a complete resistance to cerebral malaria (ablated platelet accumulation in brain microvessels). These data suggest, but do not prove, that endothelial MPs are directly implicated in the mechanism of human cerebral malaria. Interestingly, some biological manifestations (impaired PS exposure and defective vesiculation by EBV-lymphocytes) of a patient with impaired plasma membrane expression of ABCA1 are found in patients with Scott syndrome and normal ABCA1 [START_REF] Albrecht | A novel missense mutation in ABCA1 results in altered protein trafficking and reduced phosphatidylserine translocation in a patient with Scott syndrome[END_REF][START_REF] Toti | An ABC for Scott syndrome?[END_REF].

Multiple sclerosis

MS is characterized by the presence of inflammatory white and gray matter lesions in the brain and spinal cord [START_REF] Frohman | Multiple sclerosis--the plaque and its pathogenesis[END_REF]. Demyelination and oligodendrocyte degeneration are hallmarks in MS. Oligodendrocytes activated by inflammatory cells recover from cell injury via the release of MPs enriched in complement membrane-attack complexes [START_REF] Scolding | Vesicular removal by oligodendrocytes of membrane attack complexes formed by activated complement[END_REF]. Such oligodendrocyte-derived MPs have been found in the CSF of MS patients thus underlining their pathophysiological relevance [START_REF] Scolding | Vesicular removal by oligodendrocytes of membrane attack complexes formed by activated complement[END_REF]. Activation of leukocytes adhering to the neurovascular endothelium and their release of inflammatory cytokines (IFN-γ, TNF-α) that in turn activate the endothelium is thought to be another crucial step in the formation of demyelinating lesions. As a consequence, elevated levels of circulating MPs have been documented in MS. They reflect endothelial dysfunction induced by the inflammatory cytokines and could be associated with a poor clinical outcome [START_REF] Minagar | Blood-brain barrier disruption in multiple sclerosis[END_REF]. High plasma levels of endothelial MPs carrying CD31 (PECAM-1, platelet endothelial cell adhesion molecule) were detected during disease exacerbation and returned to nearly control value during remission [START_REF] Minagar | Elevated plasma endothelial microparticles in multiple sclerosis[END_REF]. The presence of such MPs was in positive association with contrast-enhancing lesions by brain magnetic resonance imaging. These authors suggested that a high rate of CD31-endothelial MPs in plasma would rather be a marker of exacerbation (acute injury of endothelium) while endothelial MPs carrying CD51 (vitronectin receptor) may reflect MS relapse (chronic injury of endothelium).

These markers reflecting the state of the endothelium are not distinctive of MS, but can be of help in follow-up, once the diagnosis of MS has been established. For instance, treatment of relapsing-remitting MS patients with interferon-β1a significantly reduced plasma levels of CD31-endothelial MPs [START_REF] Sheremata | Interferon-beta1a reduces plasma CD31+ endothelial microparticles (CD31+EMP) in multiple sclerosis[END_REF]). In the absence of any specific probe, the ratio of endothelial MPs carrying CD54 (ICAM-1, intercellular adhesion molecule-1) to monocyte number was proposed as a better parameter of MS since it was found increased during the acute phase compared to remission or healthy controls (Jy et al. 2004b). The value of this ratio has also been used to appreciate the response to interferon-β1b treatment [START_REF] Sheremata | Interferon-beta1a reduces plasma CD31+ endothelial microparticles (CD31+EMP) in multiple sclerosis[END_REF]. In an in vitro study, it has indeed been shown that interferon-β1b partially inhibits MS plasma-induced endothelial MP formation as well as the transmigration of monocytes or monocytes/endothelial MP complexes [START_REF] Jimenez | Elevated endothelial microparticle-monocyte complexes induced by multiple sclerosis plasma and the inhibitory effects of interferon-beta 1b on release of endothelial microparticles, formation and transendothelial migration of monocyteendothelial microparticle complexes[END_REF].

Experimental studies

In vivo murine experiments have shown that cancer cell-derived MPs may be involved in the propagation of oncogenes. For instance, the membrane oncogenic epidermal growth factor receptor EGFRvIII can be exchanged between cultured U373 glioma cells by a PS-dependent intercellular transfer of MPs. Incorporation of EGFRvIII into the U373 plasma membrane resulted in a consistent increase in Erk1/2 phosphorylation. Furthermore, subcutaneously injected tumor cells into immunodeficient mice causes extracellular and systemic release of microvesicles carrying the EGFRvIII oncoprotein, suggesting that these MPs may serve as vehicles for rapid intercellular transfer of the transforming activity between cells populating brain tumors [START_REF] Al-Nedawi | Intercellular transfer of the oncogenic receptor EGFRvIII by microvesicles derived from tumour cells[END_REF]. The horizontal transfer (without cell-cell contact) of this receptor to naïve cells may contribute to propagation of oncogenes and their associated transforming phenotype. Such a mechanism may be operative in a variety of human brain tumors and disseminates via blood to distant sites.

Conclusion and perspectives

Because the plasma membrane is the primary sensor of cell interactions with the microenvironment, plasma membrane remodeling including PS exposure and release of MPs

  or the monocyte chemokine receptor 5 (CCR5) to endothelial cells (Mack et al. 2000), might have pathophysiological consequences for intercellular communication. MPs may also be conveyors of infectious agents delivered to target cells (human immuno deficiency virus, prions) (Simak et al. 2002) and of oncogens transferred from glioma MPs to naïve cells (Al-Nedawi et al. 2008). Despite difficulties in the assessment of membrane proteins, proteomic approaches combining two-dimensional electrophoresis and mass spectrophotometry, have expanded the number of identified proteins harbored by MPs of various origins (Miguet et al. 2006).

  al. 2005). Other cytoprotective mechanisms rely on the MP-mediated modulation of apoptosis-related genes or pro-inflammatory cytokines, as recently shown in endothelial cells treated by APC-bearing MPs and confirmed in heatstroken baboons treated by recombinant human APC (Pérez-Casal et al. 2009, Bouchama et al. 2008). In addition, it has been recently suggested that MPs bearing EPCR would contribute to the cytoprotective effects of therapeutical APC, known to reduce mortality in sepsis and provide neuroprotective benefit in ischemic stroke (Soriano et al. 2005, Kerschen et al. 2007). The adjustment between deleterious or beneficial responses to MP signals deserves extensive investigation and probably relies on multiple actors, including intracellular signaling kinases (Al-Nedawi et al. 2008, Schoenwaelder et al. 2009). New experimental approaches are needed to decipher the mechanisms governing the sorting out of beneficial or deleterious molecules into MPs and their relevance in distinct pathophysiological settings.

(

  Lawrie et al. 2009) and enhanced laser microscopy microparticle tracking (K Braeckmans, University of Ghent, personal communication) are emerging in the field of cellular MPs. The latter has the advantage of identifying the cellular origin of MPs with the use of specific fluorescent-labeled antibodies (Braeckmans K and authors' unpublished data).

  is a characteristic feature of blood/vascular cell response to different type of stimuli. The identity of circulating MPs of endothelial, platelet and leukocyte origin is indeed a reliable indicator of their activation in CNS diseases such as stroke, TIA, cerebral malaria and MS. The most characterized property of MPs is their procoagulant activity and a number of studies have established a clear relationship with thrombosis development in cardiovascular and cerebro-vascular ischemic diseases. By virtue of the increasing number of biomolecules identified on/in MPs, cell-derived MPs are emerging as mediators of intercellular communication and new messengers/biomarkers from tissues undergoing activation or damage. They could be reliable markers of CNS pathophysiological processes useful in biomedical research and clinical medicine. For that purpose, efforts should be made to develop new biological tools and methods able to detect brain/neurovascular tissue-specific MPs. This challenging approach may open new perspectives and developments in the field of neuroscience, particularly in pathologies, such as Alzheimer's disease, still virgin to MP detection.

Figure 1 .

 1 Figure 1. Blebbling and shedding of membrane microparticles during cell activation. Cell membrane phospholipid asymmetry results from the concerted activity of lipid transporters responsible for their inward (flippases), outward (floppases) or bidirectional (scramblases) translocation. Accordingly, aminophospholipids, mainly phosphatidylserine (polar head blue) and phosphatidylethanolamine are sequestered in the internal leaflet of the plasma membrane. Upon cell activation and calcium influx, scramblase activity overwhelm flippase activity and phosphatidylserine is rapidly translocated to the external membrane leaflet. Cleavage of the cytoskeleton promotes budding of the stimulated cell membrane and shedding of microparticles. Formation of transient membrane cholesterol-rich microdomains termed raft may provide an appropriate platform for the assembly of regulatory elements and cell agonists, and the initiation of transmembrane signaling pathways. Shed microparticles bear cell-specific proteins (CD xx) as well as bioactive molecular components (e.g. growth factors, proteolytic enzymes, mRNA…) from the parental cell cytoplasm and from the plasma membrane.

Figure 2 .

 2 Figure 2. Microparticles : new biomarkers in central nervous system pathology. Cells in the neurovascular unit are subjected to activation by different types of stimuli (e.g.oxydants, inflammation and ischemia). As a consequence, activated cells release membrane microparticles (Fig.1). Microparticles carry identity proteins and bioactive molecules from the parental cell. Their detection and identification in blood, CSF and other body fluids (e.g. tears, nasal mucus) would then be considered as a direct indicator of activation or damage from specific cells or tissues.

Table 1 .

 1 Cell-derived microparticles in CNS diseases.

	Pathology	Compartment	MP pattern	Technique used Reference
	Stroke	Blood	Elevated platelets-derived MPs	Flow Cytometry Cherian et al. 2003
			Elevated platelets-		Pawelczyl et
			derived MPs Association of		al. 2009 Simak et al.
			endothelial MPs with		2006
			lesion
	Transient ischemic stroke		Elevated platelets-derived MPs		Lee et al. 1993
	Malaria		Elevated endothelial-		Combes et al.
			derived MPs		2004
	Multiple Sclerosis	Plasma	endothelial MPs High level of		Jy et al. 2004
		CSF	Presence of	Electron	Scolding et al.
			oligodendrocyte-derived MPs	microscopy	1989
	Traumatic Brain	Plasma and	Presence of platelet	Prothrombinase	Morel et al.
	Injury	CSF	and endothelial MPs	assay	2008
	Glioblastoma	CSF	Presence of platelet	Immunoblot	Huttner et al.
			and endothelial MPs		2008

Acknowledgements

Authors are indebted to O. Morel (Université de Strasbourg) for productive discussion. EAC thanks deeply Denis Vivien for sharing research resources and insights making possible new developments on microparticles in neurovascular pathology within the frame of the Inserm U919 project. Authors are members of the ARISE (Affording Recovery In Stroke) project from the European Community (FP7/2007-2013, grant n° 201024). EAC is a recipient of a "Contrat d'Interface Inserm-CHU de Caen" promoted by Prof. F. Viader. Support for this research by Inserm is acknowledged. Figures were realized with the help of Servier Medical Art.


David Monniaux

Léo Gourdin

Sylvain Boulmé

Olivier Lebeltel

Testing a Formally Verified Compiler

Keywords: Software Engineering, Formal Proofs, Experimental Validation

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

CompCert is a formally verified compiler, which compiles a large fragment of the C programming language to assembly code. "Formally verified" means that there is a machine-checked proof (here with the Coq proof assistant) that if compilation succeeds, the possible executions of this assembly code match those of the C source [START_REF] Leroy | Formal verification of a realistic compiler[END_REF]. Hence, CompCert's formal proof aims at forbidding miscompilation, i.e., compiled programs with unexpected behaviors.

Miscompilations being potentially very unsafe for final users, eradicating them is highly desirable. However, according to [START_REF] Zhou | An empirical study of optimization bugs in gcc and llvm[END_REF], in mainline compilers-without formal proof-such as GCC and LLVM, more than half of the bugs in optimization passes are miscompilations. This indicates that eradicating them is nonetheless very difficult with standard software engineering methods.

While developing new features for CompCert, we realized that formal proofs were not enough, and that testing was required. We thus greatly extended the testing system present in the GitHub repository of CompCert. This paper describes the challenges that we experienced and the solutions we found. 1 Here are some incorrect behaviors not prevented by CompCert's formal proof and that we experienced. [START_REF] Boulmé | Formally Verified Defensive Programming (efficient Coq-verified computations from untrusted ML oracles)[END_REF] Unexpected compilation failure (compiler internal error): the formal proof assumes that compilation succeeds; always failing would trivially satisfy this criterion. Failing when incorrect behavior occurs protects against miscompilation, as detailed in §2. (2) Compilation timeout: compilation may loop forever or take prohibitively long. (3) Error during assembling or linking: reasons for this range from details in the syntax comment of certain assemblers to the use of short branch instructions. 2 The above behaviors are not miscompilations, but compile-time errors. In contrast, the following may lead to miscompilation, revealing issues in the Trusted Computing Base (TCB) which the formal proof relies on. (4) Source semantics mismatch: the C language is surprisingly complicated, and its semantics as formally defined in CompCert may diverge from the informal one defined in the standard, or in CompCert's manual. [START_REF] Guthaus | MiBench: A free, commercially representative embedded benchmark suite[END_REF] Assembly semantics mismatch: the semantics of assembly language, plus platform-dependent peculiarities (e.g., how to access global symbols), may contain unexpected pitfalls (such as out-of-range operands resulting in a wrap-around behavior). Furthermore, some instructions present in CompCert's "assembly" languages are actually macros expanded by trusted (unverified) OCaml code. Some of these macros were inexactly specified, for instance by forgetting a clobbered register-this went unnoticed as long as the compiler did not take advantage of the value in that register being preserved [START_REF] Monniaux | The trusted computing base of the compcert verified compiler[END_REF]. [START_REF] King | Symbolic execution and program testing[END_REF] Assembly language mis-expansion or misprinting: we also found rare miscompilations in the expansion or printing of macros-instructions. For instance, a rarely selected instruction was misprinted; our macro-instruction for stack frame allocation did something incorrect but that almost always worked.

Some of these issues had not been detected for months, which indicated that testing was insufficient. We thus gradually developed a testing and continuous integration framework, which we ported to the other targets supported by Comp-Cert, leading to new discoveries [START_REF] Monniaux | The trusted computing base of the compcert verified compiler[END_REF].

Here is an outline of the paper. Section 2 explains how we deliberately rely on compiler failures-issue (1) above-in order to simplify our formal proofs. Indeed, compiler failures seem a lesser evil than other issues, and testing is anyway necessary for these other issues. The remainder of the paper examines methods for identifying all these issues. Section 3 introduces an extended suite of tests. When a new bug is triggered, we describe in Section 4 how to produce a minimal example. CompCert's TCB is intended to be as small as possible, but it is almost inevitable to rely on trusted parts for both ends of the pipeline: the C and assembly semantics, as well as the expansion of assembly macro-instructions. Details about these sensitive parts and possible solutions are provided in Section 5. Another important aspect of testing is the benchmarking: measuring the performance of the generated code faithfully is not trivial, and require a rigorous strategy. Section 6 covers this topic, and presents our evaluation toolkit to compile, execute, and analyze representative benchmarks with multiple compilers, including CompCert. Finally, Section 7 concludes. Some complements are given in Appendix A.

Formally Verified Defensive Tests

CompCert's formal proof assumes compilation success, and states nothing in case of failure. This allows for Formally Verified Defensive Programming (FVDP) [START_REF] Boulmé | Formally Verified Defensive Programming (efficient Coq-verified computations from untrusted ML oracles)[END_REF]: complex computations are delegated to efficient functions, called oracles, whose implementations are both untrusted and hidden from formal proofs; only a defensive test of their result is formally verified.

For example, we introduced a hash-consing factory, formally verified using only defensive pointer equality tests [1, §3.3.2][23, §4.4]. We use translation validation [START_REF] Necula | Translation validation for an optimizing compiler[END_REF][START_REF] Pnueli | Translation validation. In: Tools and Algorihtms for the Construction and Analysis of Systems[END_REF][START_REF] Tristan | Formal verification of translation validators: A case study on instruction scheduling optimizations[END_REF], in particular by symbolic execution, an approach for compiler testing [START_REF] King | Symbolic execution and program testing[END_REF][START_REF] Samet | Compiler testing via symbolic interpretation[END_REF]: the same formally verified translation validator is used to check many untrusted transforms [START_REF] Six | Formally Verified Superblock Scheduling[END_REF]. We validate fixpoints, computed using imperative data structures that cannot be easily modeled in Coq, by a verified checker [START_REF] Monniaux | Formally verified loop-invariant code motion and assorted optimizations[END_REF].

Such a design induces simpler formal proofs, high modularity, while allowing for arbitrarily complex oracles.

In short, FDVP is a systematic approach for turning miscompilations into compiler failures (behavior (1) of §1). It helps us formally prove the absence of miscompilation (w.r.t. the TCB). Furthermore, such a compiler failure helps in debugging; the uncaught exception raised by the compiler directly points to the issue: either an incorrect oracle or a too coarse defensive test. For this, we still need testing for compiler failures extensively.

Test Suite for Compiler Correctness

AbsInt markets a version of CompCert suitable for qualification for safety-critical applications, e.g. nuclear power plants and avionics [START_REF] Kästner | CompCert: Practical experience on integrating and qualifying a formally verified optimizing compiler[END_REF]. To our knowledge, this involves a large test suite, including the standard compliance suite SuperTest. 3This test suite not being publically available, we extended the regression tests of CompCert's GitHub repository 4 with tests produced by off-the-shelf random generators, a form of compiler fuzzing [START_REF] Marcozzi | Compiler fuzzing: how much does it matter?[END_REF], as well as the gcc "torture test" suite. The purpose of adding new tests here is to avoid both compile-time errors (especially failures and timeouts in our translation validators) and any form of miscompilation. Testing can help identify the six bad behaviors mentioned in §1. For each program generator i (items (a) and (b) below), N i programs are generated by varying the random seed of the generator from 0 to N i -1, ensuring reproducibility. (a) Csmith 2.3.0 & YarpGen 1.1: 5 The produced code-which is supposed to be compilable and devoid of undefined behaviors-is compiled with both CompCert and gcc and run on the target processor or an instruction set simulator (e.g. qemu). The results are then compared (differential testing). Yet this code may fail to terminate, thus a timeout is used; the test is considered valid if both programs yield the same value, or fail to terminate within the timeout. The timeout value is large enough to avoid cases where only one program, better optimized, terminates while the other does not, but would with more time. (b) CCG: 6 Its programs are not expected to run correctly, so we thus just test that they compile correctly. (c) gcc 12.2.0 tests: Finally, we added gcc's C torture tests, both for compilation only and for compilation + execution, except those that relied on gcc-specific extensions (such as SIMD vectors), gcc-specific behaviors on undefined or unspecified cases, and those that tested the limits of the compiler (i.e. very large number of declarations).

Each newly added generator or suite triggered new bugs (in our own extensions, or in upstream recent extensions not yet covered by AbsInt's tests). The full test suite, including the three items above, is triggered from continuous integration for a variety of targets. 7 Generally, test cases that triggered bugs had to be reduced ( §4) before the bug could be investigated. In addition to making us more confident about the reliability of our validators by detecting compilation failures ( §2), the tests helped to discover miscompilations ( §5) and intolerable compilation running-times. We have also another framework for evaluating the performances of the generated code, briefly described in §6 (the test suite of this section is not designed to measure performance).

Reducing Test Cases

Random and application test cases are often too large for the compiler developer to identify bugs. Finding a reduced test case that exhibits the same bug is the first step for understanding what went wrong [START_REF]GCC bugs[END_REF]. Reducing cases by hand is tedious and error-prone; we thus automated this task using C-Reduce. 8C-Reduce takes as input a C program (possibly several source or header files) and a predicate (typically a shell script), which must be satisfied by this original program, and gradually reduces the program by removing or simplifying declarations and statements, as long as the predicate is satisfied, until a minimal test case is produced. A timeout may be specified for evaluating the predicate, as well as other parameters (e.g. the number of cores for parallel execution).

On a compiler failure, the predicate is easy to write: simply execute the compiler and check that it crashes with the same error. For a timeout error, run the compiler with a timeout and check that it really reaches the timeout. For assembling (resp. linking) errors, check that the compiler runs successfully, but that assembling (resp. linking) fails with the same error.

When the error is miscompilation, the predicate is much harder to write. The main test is then to compile the program with CompCert and another compiler (gcc or clang), run both versions (on either the target processor or an instruction set simulator), and compare execution results: miscompilation is detected if their results diverge (either they print different values, or the version produced by CompCert crashes while the other does not). However, this criterion works only if the program does not have undefined behavior. Indeed, if a program has undefined behavior, such as reading from an uninitialized variable, it is normal that it gives one result with one compiler, another with another compiler. Unfortunately, if given the opportunity by a lax predicate, C-Reduce will write programs that have undefined behavior: this is what usually happens if one removes statements haphazardly from a program, such as statements that initialize variables. The predicate should thus refuse programs that have undefined behavior.

An obvious method is to compile the program using gcc and/or clang and run the resulting program under Valgrind, 9 which checks for undefined behaviors at the object code level, such as accessing data outside currently allocated blocks, or branching (or conditionally moving data) according to a test on uninitialized values. In addition, if both gcc and clang are used, the program should give exactly the same output. Another approach is to compile the program using gcc and/or clang using the "sanitizers", which insert code that detects at runtime that certain undefined behaviors have happened. The categories of bugs that Valgrind and the "sanitizers" can detect overlap, but are not identical.

However, running the program under an instruction set simulator or under Valgrind is costly. It is thus very beneficial to exclude programs that evidently are likely to exhibit undefined behavior prior to running them. We ask gcc and clang to print error (as opposed to warning) messages when they discover certain undefined behaviors such as the use of an uninitialized variable.

Finally, some sanity checks on programs results are performed: for reducing a miscompilation bug that results in the gcc and CompCert versions printing out different checksums (e.g. for programs generated by Csmith), we check that the output indeed includes a line printing out a checksum. See Figure 1 in Appendix.

Checking the Trusted Computing Base

Formal C semantics [issue (4) of §1] Two mismatches between the C formal semantics of CompCert and that of the standard were identified: (a) memory allocation is supposed to always return a valid pointer (e.g. not NULL), unlike the standard's malloc function; (b) storing a bitfield in an otherwise uninitialized structure, then reading from it, yields an undefined (uninitialized) value whereas it should yield the value stored (truncated to the appropriate size); this is because initialized-ness is defined at word level, not bit level.

The second one was identified when using CompCert's reference C interpreter on reduced test cases. Neither can currently cause miscompilation, because CompCert's optimizations do not exploit these shortcuts of the formal semantics.

Unit testing of the assembly (macro-)instructions [issues ( 5) and ( 6) of §1] The formally verified part of CompCert ends with an abstraction of assembly code: (a) machine instructions are seen as operating over values, with the value datatype defined as a disjoint union of 32-and 64-bit integers, 32-and 64-bit floating-point values, and pointers, whereas in reality they are all bitstrings; pointers are pairs of a block identifier and an offset within this block, whereas in reality they are (in a flat memory model) just integers; (b) memory copy, used either as an intrinsic or for implementing C structure assignment, is a macro whose expansion depends on the block size; (c) memory is seen as independent blocks, and it is impossible to move from one to another by pointer arithmetic; each stack frame is an independent block; macros implement the creation and destruction of stack frames by expanding into a sequence that saves the previous frame's address and adjusts the stack pointer; (d) certain basic operations may be macro-instructions: taking the address of a global symbol may entail splitting it between high-and low-order bits or more complicated schemes;10 on a 32-bit platform, adding two 64-bit numbers split in 32-bit registers involves propagating carry bits, which may not be reflected in the assembly semantics; etc.

The expansion of macro-instructions-miscompilation (6) of §1-has been identified as the main source of miscompilation bugs in CompCert (which, however, remain rare) [START_REF] Monniaux | The trusted computing base of the compcert verified compiler[END_REF], especially if they involve case analyses over arguments (register aliasing, constants): rarely exercised cases could be incorrect. Also, in some cases, wrong but syntactically correct instructions were printed.

Possibly, the definition of the formal semantics of the regular assembly instructions-mismatch (5) of §1-could also feature incorrect corner cases. However, our testing approach currently lacks a complete unit testing system that would match the semantics of abstract (pseudo-)instructions in their formal specification to that on the target processor. Such testing would not only need to check that the result values of the instruction fit the specification, whether these values are in processor registers or in memory, but also that values that the specification lists as unmodified were unaffected. Based on our coverage measurements, our tests do not validate the entire OCaml code of the TCB.

Testing the Performance of Generated Code

Developing a new pass require ensuring that its results are not only beneficial on every target, but also that it does not interfere with existing optimizations [START_REF] Curtsinger | STABILIZER: Statistically Sound Performance Evaluation[END_REF]. Since most instruction set simulators are not capable of counting cycles, we measure and compare the code performance of various CompCert configurations directly on the target core. Firstly, such measures are often subject to many subtle biases [START_REF] Mytkowicz | Producing Wrong Data Without Doing Anything Obviously Wrong![END_REF], among which are the runtime environment, the size of the benchmarks, as well as decisions by the operating system kernel: frequency scaling, migration between cores, etc. We address this by running multiple execution of each test, and by forcing the process to remain on the same core (e.g. with taskset), under the same shell environment. Then, we average out the different executions to filter them when the relative standard deviation exceeds a certain threshold (noise elimination), so that too small or unreliable tests are removed.

Secondly, for the comparison to GCC or Clang to be fair, we have to compare compilers on a common basis of applicable transformations. Notably, we disable options that would not be correct in the CompCert semantics-e.g. "fast-math", or replacing ab + c by a fused multiply-add, 11 and instruction set extensions that CompCert cannot use-e.g., vector (SIMD) instructions.

For the measure to be representative and to avoid concluding on an overfitted subset of benchmarks, we combine several test suites: (a) an extended version of LLVMtest12 (various concrete applications); (b) the computational oriented Poly-Bench; 13 the embedded oriented suites (c) MiBench [START_REF] Guthaus | MiBench: A free, commercially representative embedded benchmark suite[END_REF] and (d) TACLeBench [START_REF] Falk | TACLeBench: A benchmark collection to support worst-case execution time research[END_REF]; (e) and our own test suite with multiple types of tests (from small sorting algorithms to OCaml or GCC whole applications). See details in Appendix A.2.

We developed a performance measuring toolkit, 14 based on a JSON configuration that details, for each compiler to measure, sets of options to compare. Shell scripts then automatically (a) build; (b) copy to the target machine (e.g. via rsync); (c) run N times on a fixed core; and (d) gather tests results as CSV files. Finally, a Python/Pandas script filters and analyses CSVs to yield (in text or as a plot) the observed gains w.r.t. a reference compiler with options set pair.

Conclusion on Testing Formally Verified Software

Extensive testing on formally verified software is necessary for at least two reasons. First, the formal specification may not guarantee all the properties expected by users, but only critical ones (e.g. no miscompilation for CompCert). Second, critical bugs may still remain, because the formal specification might not exactly fit reality. However, in this case, critical bugs are in the-much smaller and simpler-TCB. For example, in our experience, bugs in CompCert's TCB are fixed a few days after their discovery. This seems to contrast with critical bugs in usual optimizing compilers which remain, on average, more than one year before being fixed [START_REF] Zhou | An empirical study of optimization bugs in gcc and llvm[END_REF].

Moreover, formally verified defensive testing-as introduced in §2-may drastically reduce the overall proof effort. It is also much more powerful for finding bugs of untrusted optimizations than usual testing: it detects all their miscompilation bugs for a given input file, without even running the code they generate. In contrast, in a usual compiler devoid of independent verification of the optimization passes, some of the bugs that we detected because compilation aborted would have resulted in miscompilation, which may have been unnoticed by usual testing.

See https://www.absint.com/ and https://solidsands.com/products/supertest.

See directory "test" of https://github.com/AbsInt/CompCert/.

https://github.com/csmith-project/csmith[START_REF] Yang | Finding and understanding bugs in C compilers[END_REF] with packed structures (gcc extension) disabled.https://github.com/intel/yarpgen (One random seed value is excluded because on ARM it leads to register allocation causing out of memory. Large auto-generated programs causing resource exhaustion in the compiler is not considered a bug[START_REF] Leroy | Answer to CompCert bug #137[END_REF].)

https://github.com/Mrktn/ccg. We disabled the generation of ternary conditional operators with omitted middle operand, a gcc extension not supported by CompCert.

x86, x86-64, AArch64, ARMv7 with software and hardware floating-point, 32-bit PowerPC, 64-bit RISC-V, KVX. This even led us to find bugs in qemu for PowerPC.

https://embed.cs.utah.edu/creduce/[START_REF] Regehr | Test-case reduction for C compiler bugs[END_REF].

https://valgrind.org/[START_REF] Nethercote | How to shadow every byte of memory used by a program[END_REF][START_REF] Nethercote | Valgrind: a framework for heavyweight dynamic binary instrumentation[END_REF][START_REF] Seward | Using Valgrind to detect undefined value errors with bit-precision[END_REF]

E.g., we implemented using symbols in thread-local storage (TLS) because some platforms put some C library globals in TLS even if the program is not multithreaded.

An "fma" rounds differently from a × followed by a +. Replacing the latter by the former thus is a semantic change, which runs afoul of CompCert's soundness criteria.

https://github.com/lac-dcc/Benchmarks

http://web.cs.ucla.edu/ ∼ pouchet/software/polybench/

Acknowledgement. We thank Xavier Leroy for his useful feedbacks on a preliminary version of this paper.

⋆ Work partially supported by the LabEx PERSYVAL-Lab (ANR-11-LABX-0025-01). 1 Get our code on https://gricad-gitlab.univ-grenoble-alpes.fr/certicompil/Chamois-CompCert. 2 A short branch and its target must be close, which may be false on large functions.

A Appendix

A.2 Experimental evaluation of our CompCert version

We compared performance of generated code with GCC -01 (11.3.0) and our CompCert version versus the mainline CompCert (3.12). Our version includes several additional optimizations not present in the mainline CompCert: superblock prepass scheduling [START_REF] Six | Formally Verified Superblock Scheduling[END_REF], CSE3 (Common Subexpression Elimination) [START_REF] Monniaux | Formally verified loop-invariant code motion and assorted optimizations[END_REF], a variant of LCM (Lazy Code Motion) & LSR (Lazy Strength-Reduction) [START_REF] Knoop | Lazy code motion[END_REF][START_REF] Knoop | Lazy Strength Reduction[END_REF], and loop-unrollings (here, we only activated the first loop iteration unrolling).

The execution time gain is computed using the formula gain(C) = ((R -C)/C) × 100 where C is the new compiler (e.g. GCC or ours) and R the reference one (e.g. mainline CompCert); a higher result indicates a better performance. To obtain representative and not biased measurements, we filtered results whose relative standard derivation was exceeding 2% over five runs on the target machine (as explained in §6). All our benchmarks were run on a SiFive U740 core (HiFive Unmatched), a dual-issue, in-order RISC-V processor, using the toolkit and test suites described in §6.

Globally, our version is 20.7% faster than the mainline CompCert on the LLVM test suite; 14.7% on MiBench; 22.83% on TACLeBench; and 42% on our own suite (the fifth one of §6); results for the full PolyBench suite are at line "PolyBench/*" in Table 1. A sample of results is provided in Table 1, illustrating the performance variability depending on the input: GCC is far more performant on some benchmarks, but way slower on some others, and the same applies to CompCert. For instance, the poor result on MiBench/Stringsearch comes from the loop-unrolling, which lengthens the code and makes other optimizations dramatically increasing register pressure. On this benchmark, if we disable the first loop iteration unrolling, our CompCert version yields a gain of 39.4% w.r.t. mainline CompCert. Nonetheless, except on rare tests like this one, unrolling is usually very beneficial in terms of performance. Overall, we improved the performance of about 30% in average on RISC-V comparing to the mainline version, which is a great step towards closing the gap with GCC.