Mathilde Lorscheider

Nicolas Tsapis

Mujeeb Ur Rehman

Françoise Gaudin

Ivana Stolfa

Sonia Abreu

Simona Mura

Pierre Chaminade

Marion Espeli

Elias Fattal

Dexamethasone palmitate nanoparticles: an efficient treatment for rheumatoid arthritis

Keywords: nanomedicines, prodrug, glucocorticoid, arthritis

Dexamethasone palmitate (DXP)

Introduction

Rheumatoid arthritis (RA) is one of the most widespread chronic rheumatic diseases worldwide, with a prevalence of 0.5-1% in the developed countries [START_REF] Tobón | The environment, geo-epidemiology, and autoimmune disease: Rheumatoid arthritis[END_REF]. RA is defined as a chronic, autoimmune rheumatic disease that affects all type of patients with a strong prevalence in 60-80 years old women and a female:male ratio of 3:1 [START_REF] Alamanos | Epidemiology of adult rheumatoid arthritis[END_REF]. RA evolves with inflammatory flares associated with inflammation of the joint synovial membrane, progressive bone and cartilage destruction and accompanied with strong pain [START_REF] Khurana | Clinical aspects of rheumatoid arthritis[END_REF]. Over the course of the disease, patients generally undergo a decreased quality of life, a potential disability and a reduction in life expectancy of about 10 years [START_REF] Erhardt | Factors predicting a poor life prognosis in rheumatoid arthritis: an eight year prospective study[END_REF]. Like all autoimmune diseases, RA is caused by a disregulation of the immune tolerance leading to infiltration of the synovial membrane by immune cells (neutrophils, macrophages, T and B cells), pannus formation and proliferation of the lining cells of the synovial membrane [START_REF] Scott | Rheumatoid arthritis[END_REF]. Moreover, enhanced angiogenesis and high permeability of the newly generated vessels in a dense network all over the inflamed synovia, correlated with high vascular endothelial growth factor (VEGF) serum levels were reported in RA patients [START_REF] Szekanecz | Angiogenesis in rheumatoid arthritis[END_REF][START_REF] Colville-Nash | Angiogenesis and rheumatoid arthritis: pathogenic and therapeutic implications[END_REF][START_REF] Paleolog | Modulation of Angiogenic Vascular Endothelial Growth Factor By Tumor Necrosis Factor Ix and Interleukin-1 in Rheumatoid Arthritis[END_REF].

Within the RA therapeutic strategy, glucocorticoids (GCs) administration is limited to short period treatment to relieve joint inflammation during flares up due to their severe side effects [START_REF] Ferreira | Glucocorticoids and Rheumatoid Arthritis[END_REF]. GCs chronic administration for long-term treatment of RA, although not indicated, is used in association with first line treatment methotrexate or second line biologics by 1/3 of RA patients, preventing inflammation exacerbations. However, chronic misuse of GCs leads to the emergence of strong side effects such as diabetes, high blood pressure or Cushing syndrome [START_REF] Mcdonough | The epidemiology of glucocorticoid-associated adverse events[END_REF][START_REF] Saag | Low dose long-term corticosteroid therapy in rheumatoid arthritis: an analysis of serious adverse events[END_REF]. Because of the ubiquitous expression of the GC receptor [START_REF] Nicolaides | The human glucocorticoid receptor: molecular basis of biologic function[END_REF][START_REF] Vandevyver | On the trail of the glucocorticoid receptor: into the nucleus and back[END_REF], GC local therapeutic activity is diluted by side activity in other organs. Therefore, patients require repeated administrations of high GCs doses strength to reach a sufficient anti-inflammatory activity in the tissue of interest [START_REF] Saag | Low-dose corticosteroid therapy in rheumatoid arthritis: balancing the evidence[END_REF].

Nanotechnologies are taking advantage of the specific physiopathology of inflamed tissues and of a vascular enhanced permeability effect to address encapsulated molecules to the tissue of interest by passive diffusion in diseased area [START_REF] Pham | Nanotherapeutic approaches for the treatment of rheumatoid arthritis[END_REF][START_REF] Dolati | Utilization of nanoparticle technology in rheumatoid arthritis treatment[END_REF]. Accumulation of therapeutic nanoparticles in inflamed joints could therefore improve anti-inflammatory activity while avoiding administration of high doses and thus reducing side effects [START_REF] Ozbakir | Liposomal corticosteroids for the treatment of inflammatory disorders and cancer[END_REF].

Previous studies reported that in spite of their increased accumulation in pathologic areas, most of the nanocarriers used so far faced a very low GC drug loading, below 10%w/w [START_REF] Gómez-Gaete | Encapsulation of dexamethasone into biodegradable polymeric nanoparticles[END_REF][START_REF] Avnir | Amphipathic weak acid glucocorticoid prodrugs remote-loaded into sterically stabilized nanoliposomes evaluated in arthritic rats and in a Beagle dog: a novel approach to treating autoimmune arthritis[END_REF][START_REF] Anderson | Liposomal encapsulation enhances and prolongs the anti-inflammatory effects of water-soluble dexamethasone phosphate in experimental adjuvant arthritis[END_REF], and a fast destabilization because of lipophilic GC crystallization in aqueous media impairing their efficacy. In the present study, we designed a new type of PEGylated nanocarrier made of dexamethasone palmitate (DXP). DXP is a prodrug of dexamethasone on which a palmitic chain is covalently linked by an ester bound. The presence of a C 16 chain confers to the molecule a very high hydrophobicity and strong interactions with phospholipid aliphatic chains due to hydrophobic interactions [START_REF] Teshima | Prednisolone retention in integrated liposomes by chemical approach and pharmaceutical approach[END_REF][START_REF] Benameur | Liposome-incorporated dexamethasone palmitate : Chemical and physical properties[END_REF][START_REF] Hong Kee | Liposomes with antiinflammatory steroid prednisolone palmitate[END_REF]. These PEGylated DXP nanoparticles (DXP-NPs), obtained by the sole addition of DSPE-PEG 2000 as stabilizer, exhibit a high drug loading and stability over time. The collagen induced arthritis (CIA) mouse model was used to assess whether DXP-NPs display greater anti-inflammatory activity than free dexamethasone. Our results demonstrated that DXP-NPs lead to specific joint accumulation, strong reduction of joint inflammation and histopathological signs of arthritis without increased side effects.

Material and methods

DXP-NP preparation and physicochemical characterization

Nanoparticles were prepared by an emulsion-evaporation process. Briefly, 10ml of milliQ water were prechilled at 4°C. The desired amounts of DXP and DSPE-PEG 2000 , respectively 50mg and 25mg, were dissolved in 1ml chloroform. The organic phase was injected into the water phase before preemulsification by vortexing for 30 seconds followed by ultrasonication during 2min at an amplitude of 40% in an ice bath (Branson, USA). The organic phase was evaporated under reduced pressure using a rotary evaporator. After full evaporation of the solvent, the suspension was stored at 4°C protected from light. Fluorescent nanoparticles were obtained by the same procedure, incorporating 4% (mol/mol DSPE-PEG 2000 ) of the hydrophobic and poorly-water soluble probe DID (1,1'-dioctadecyl-3,3,3',3'-tetramethylindodicarbocyanine, 4-chlorobenzenesulfonate salt) in the chloroformic phase.

After each preparation, nanoparticles size (d H ), polydispersity index (PdI) and surface charge (zeta potential) were evaluated using a Malvern NanoZS at 173° angled laser (n=3 per sample, n=5 samples at least). Nanoparticle stability was followed up to 21 days while nanoparticles were stored in a cold room at 4°C. Size measurements were carried out in water and zeta potential at a 1/10 dilution in NaCl 1mM. Concentrations of DXP and DSPE-PEG 2000 encapsulated were determined by HPLC-ELSD (evaporative light scattering detector) detection using a mobile phase of MeOH:ACN:Ammonium acetate (200mM, pH4) 70:28:2 added with 0.043% acetic acid and 0.104% trimethylamine, nebulization temperature of 35°C and evaporation temperature of 45°C, 30µl of samples were injected. DXP-NPs morphology was observed by TEM after negative staining with uranyl acetate at 2%(w/w) for 30 seconds and cryo-TEM images. Internal structure was examined by X-ray powder diffraction on the concentrated nanoparticle suspension (Supplementary information) compared to the crystalline form of dexamethasone obtained by recrystallization in acetone, using a Rigaku rotating copper anode automated diffractometer operating at 50kV and 200mA using Cu Kα radiation.

In vitro plasma release of Dexamethasone from DXP-NPs

DXP-NPs were diluted in water to yield a final equivalent concentration of dexamethasone (DXM) of 260 μg/mL. 180 μL of murine plasma were introduced in an Eppendorf tube and 20 μL of DXP-NPs were added and incubated at 37°C upon gentle mixing for different times up to 24h. After the desired incubation time, 400 μL of acetonitrile containing 4µg/mL dexamethasone acetate as an internal standard was added followed by vortexing vigorously for 30 seconds to precipitate out enzymes/proteins present in plasma. Then, centrifugation was performed at 13, 400 rpm for 10 minutes (ST16R centrifuge, rotor TX-400, Thermo Scientific, France). The supernatant organic phase was collected and DXM was quantified by HPLC-UV as follows. A Waters 717 Plus autosampler chromatographic system was employed equipped with a Waters 1525 binary HPLC pump, a Waters 2487 dual λ absorbance detector, and a Breeze software. The analysis was performed at 240nm wavelength using a SymmetryShieldTM RP18 column (5 µm, 250×4.6 mm; Waters, Saint-Quentin-en-Yvelines, France). The column temperature was maintained at 40°C. The mobile phase was composed by a mixture of acetonitrile and milliQ water (35/65 v/v). The mobile phase flow rate was 1.2mL/min, the injection volume was 50L and the run time was 30min. Retention times were 9min for DXM and 26min for dexamethasone acetate. Calibration curves of DXM were linear in the range 0.1-100g/mL (R²=0.9974, y=1.056x+0.1445).

In vitro anti-inflammatory effect

To verify that DXP-NPs were able to exert an anti-inflammatory effect equivalent to the free drug, RAW 264.7 cells were seeded in 24-well plates at a cellular density of 4x10 4 cells/well in culture medium and were incubated for 48 hours until 80% confluency. Then, the medium was replaced by fresh medium alone or fresh medium with LPS at 0.1 µg/mL to induce inflammation, and plates were incubated another 3 hours. Afterwards, DXP-NPs were added at a subtoxic concentration [checked by the MTT (3-[4,5-dimethylthiazol-2-yl]-3,5-diphenyl tetrazolium bromide) colorimetric assayunpublished data] diluted in culture medium: 100µg/mL of DXP and free dexamethasone phosphate (DSP) at 82µg/mL in culture medium, which correspond to 100µg/mL DXP considering molecular weight ratio. Culture medium alone was used as negative control and LPS 0.1 µg/mL as positive control. After 24 hours of incubation with the treatments, cell supernatants were collected and frozen at -20°C until analysis was performed. Cells were detached and counted. Mouse inflammatory cytokines TNFα and MCP-1 were quantified using a Cytometric Beads Array (CBA) detection kit (BD Biosciences, USA). In each test tube, 50µL of mouse inflammation capture bead suspension was added, completed with either 50µL of standards solution (20-5000pg/mL) or 50µL of supernatants samples. Phycoerythrin (PE) detection reagent was added 50µl to each tube and incubation during 2h at room temperature was performed. Samples were washed with 1mL wash buffer provided in the kit and tubes were centrifuged (200g, 5min) to recover the pellet. 300µL of wash buffer was added to resuspend the pellet and samples were quantified with the BD Accuri C6 Cytometer (BD Biosciences, USA). Cytokines results were analyzed with the FACP Array™ Software and were obtained as pg/mL concentrations. All measurements were performed in triplicate.

Animal studies

In vivo experimental procedures using DBA/1OlaHsd mice were approved by the ethical committee No 026 and by the French ministry of education and research (Accepted protocol No 2842-2015110914248481_v5). 9-12 weeks-old male DBA/1OlaHsd mice were purchased from Envigo (UK) and let for one week after shipping for adaptation before starting experiments. Mice were kept in a separate animal room under climate-controlled conditions with a 12h light/dark cycle, housed in polystyrene cages containing wood shavings and fed with standard rodent chow and water ad libitum.

Collagen induced arthritis mice model

At day 0, 10-13 weeks-old male DBA/1OlaHsd mice were injected intradermally at the base of the tail with an emulsion of Complete Freund's Adjuvant (CFA) and type II collagen (CII). At day 21, mice received a boost injection of the same composition. From day 21, mice were evaluated every 2 days during the first week after boost and every day from day 28. Weight and arthritis symptoms were monitored, based on a visual scoring scale (0-3) of the paws with evaluation of the erythema, swelling and ankylosis of each paw (Fig. S3) and hind paw volume was measured with a plethysmometer (Harvard Apparatus). Special care was paid to ensure sufficient food and water access to mice.

Assessment of the therapeutic efficacy in mice

CIA mice were divided in 5 groups (n=8) on day 31 based on the inflammation score and hind paw volume to create the most homogeneous groups in terms of inflammation. On days 32, 34 and 36, mice received intravenously PBS or free dexamethasone sodium phosphate at 0.1 mg/kg (eq.DXM) or 1mg/kg (eq.DXM) or DXP-NPs at 0.1 mg/kg (eq.DXM) or 1mg/kg (eq.DXM). From day 21 to 37, arthritis was monitored as described above. Mice were sacrificed on day 37, paws were removed for histology experiments.

DXP-NPs joints accumulation

Healthy (n=4) and CIA mice (n=4 at least, at day 32 post CIA induction) were injected intravenously with (i) fluorescent DXP-NPs-DID4% at 1mg/kg (eq. DXM) or (ii) a solution of free DID in DMSO/glucose5% 1/9 v/v (i.e. control). DXP-NPs and free dye-treated mice received comparable amounts of DID (0.1mg DID/kg). The kinetics of nanoparticles and free DID biodistribution were evaluated by NIR in vivo imaging using the IVIS Lumina ® LT Series III (PerkinElmer, USA). After excitation at 640nm the signal was recovered at 745nm emission filter. First fluorescence images were recorded at t=4h post injection and then mice were imaged daily until the disappearance of the fluorescent signal (day=14). Images of each mice before treatment were used to determine the baseline level of fluorescence (i.e., auto-fluorescence) which was subtracted to the recorded signal.

Mice were imaged both in ventral and dorsal position. Images were processed using the Living Image software (PerkinElmer, USA). A region of interest was automatically identified, and quantification was performed using the Average radiant efficiency value (threshold of 30%). Results are expressed as [fluorescence signal on the analyzed surface subtracted by the auto-fluorescence acquired before injection] as a function of the inflammation score of each paw.

Histopathology studies

After sacrifice of the mice, hind legs were removed on day 37 from CIA mice at the end of the efficacy study. Skin and muscles were removed, and hind legs (from above the knee to the end of the foot) were fixed 24h in 4% paraformaldehyde and decalcified for 8h in Microdec (Microm Microtech, France). Hind legs were included in paraffin blocks and sectioned in 4µm thick slides. Haematoxylineosin-safran (HES) staining was performed and synovial cell infiltration, pannus formation and proliferation and bone erosion were individually scored on a 0-3 scale as follows [START_REF] Anderson | Liposomal encapsulation enhances and prolongs the anti-inflammatory effects of water-soluble dexamethasone phosphate in experimental adjuvant arthritis[END_REF][START_REF] Quan | Nanomedicines for inflammatory arthritis: Head-to-head comparison of glucocorticoid-containing polymers, micelles, and liposomes[END_REF]. The score for every histopathologic feature was summed for each animal.

Synovial infiltration. 0: normal; 1: minimal infiltration of cells in synovium and synovial membrane; 2: mild infiltration with minimal synovial hyperplasia; 3: severe infiltration in synovium and periarticular tissue.

Pannus. 0: normal; 1: minimal pannus formation, marginal zones; 2: mild cell proliferation and expansion; 3: severe infiltration with large pannus expansion.

Bone and cartilage erosion: 0: normal; 1: slight erosion, bone and cartilage thickness reduced; 2: mild bone and cartilage structure modification, thin bone and cartilage thickness; 3: severe erosion, total destruction of joint architecture.

Adverse effect evaluation

CIA was induced on 30 DBA/1 mice as described in the dedicated section above. On day 31, mice were divided into 3 groups (n=10), based on the inflammation score and hind paw volume to create the most homogeneous groups in terms of inflammation. After 3 IV injections on days 32, 34 and 36 with PBS or DSP 1mg/kg (eq.DXM) or DXP-NPs 1mg/kg (eq.DXM), CIA mice were sacrificed on day 37.

Blood was recovered by intracardiac puncture, one part of total blood was dedicated to complete blood count (CBC) and the other was centrifuged to recover plasma. Quantification of plasmatic glucose, alanine-aminotransferase (ALAT), aspartate-aminotransferase (ASAT) and creatinin; and complete blood count (CBC) from total blood were performed by Cerbavet (France). Standard values presented on graphs correspond to mice standard values, without distinction between strains.

Statistical analysis

Results were reported as mean ± standard error of the mean (SEM). Statistical analysis was performed using the GraphPad Prism 6.0 software.

Results and discussion

DXP-NPs preparation and characterization

DXP-NP formulation process is based on the emulsion-evaporation method (Fig. S1). Briefly, DXP and DSPE-PEG 2000 were dissolved in chloroform and injected in pre-chilled aqueous phase. Emulsion was obtained through vortexing and sonication steps followed by chloroform evaporation leading to the formation of nanoparticles. DXP alone did not form nanoparticles. However, in combination with DSPE-PEG 2000 , recognized as biocompatible and approved by the Food and Drug Administration for medical use [START_REF] Wang | Application of poly(ethylene glycol)distearoylphosphatidylethanolamine (PEG-DSPE) block copolymers and their derivatives as nanomaterials in drug delivery[END_REF], and due to hydrophobic interactions between the palmitic chain of DXP and stearic chains of the PEGylated lipid [START_REF] Doi | Physicochemical properties of dexamethasone palmitate, a high fatty acid ester of an anti-inflammatory drug: polymorphism and crystal structure[END_REF], the emulsion-evaporation method led to the formation of spherical nanoparticles. The obtained nanoparticles presented a hydrodynamic diameter (d H ) of 130nm and a negative surface charge of -55mV (Fig. 1a), contributing to the stability and preventing nanoparticle aggregation upon storage. The polydispersity index (PdI) of 0.2 confirmed a monodisperse population of DXP-NPs, correlated to transmission electron microscopy (TEM) pictures also showing the spherical structure of DXP-NPs (Fig. 1c). The poor water solubility of DXP usually induces its crystallization in the nanoparticle suspension [START_REF] Doi | Physicochemical properties of dexamethasone palmitate, a high fatty acid ester of an anti-inflammatory drug: polymorphism and crystal structure[END_REF], leading to a low drug loading [START_REF] Gómez-Gaete | Encapsulation of dexamethasone into biodegradable polymeric nanoparticles[END_REF] and destabilization of the suspension overtime. The presence of DSPE-PEG 2000 clearly avoided the formation of prodrug crystals and DXP-NPs with an amorphous structure were obtained. Indeed, no diffraction peaks were observed by X-ray diffraction for DXP-NPs, however a bump characteristic of an amorphous organization was detected. On the contrary, DXP crystals exhibited many diffraction peaks as expected [START_REF] Benameur | Liposome-incorporated dexamethasone palmitate : Chemical and physical properties[END_REF][START_REF] Doi | Physicochemical properties of dexamethasone palmitate, a high fatty acid ester of an anti-inflammatory drug: polymorphism and crystal structure[END_REF]. Cryo-TEM images (Fig. 1b and1c) confirmed the amorphous structure as no crystals were observed. In addition, DXP-NPs presented a very high DXP encapsulation efficiency of 98%w/w corresponding to a prodrug loading of 78%w/w and a drug loading of active dexamethasone (DXM) of 48.9%w/w. Compared to previous literature, our approach thus led to a much-improved loading efficiency. For example, the DXP-loaded lipid emulsion currently marketed in Japan and in Germany under the trademark Limethason  or Lipotalon  for the treatment of chronic inflammatory pathologies incorporates only 4%w/w of DXP/lipids [START_REF] Mizushima | Tissue distribution and anti-inflammatory activity of corticosteroids incorporated in lipid emulsion[END_REF]. Moreover, the encapsulation of DXP within solid lipid nanoparticles (SLN) by Kim at al. [START_REF] Kim | Uniformity of drug payload and its effect on stability of solid lipid nanoparticles containing an ester prodrug[END_REF] leads to a DXP loading of 4-25%w/w lipids, in line with the 2.2 and 6.6%w/w lipids incorporation rate obtained by Lu and al. [START_REF] Lu | Nanoparticles containing anti-inflammatory agents as chemotherapy adjuvants: optimization and in vitro characterization[END_REF] . The high drug loading of DXP-NPs could facilitate the administration of efficient therapeutic doses with low excipients amounts. In the DXP-NPs, 53% of initial DSPE-PEG 2000 was encapsulated in DXP-NPs, the remaining being present in the formulation as micelles along with DXP-NPs suspension. DXP-NPs stability was assessed over 21 days under storage at 4°C and presented an excellent profile with no modification of size, polydispersity, surface charge or internal structure as assessed by X-ray diffraction (Fig. 1b and1d). The good stability most probably arises from the presence of encapsulated DSPE-PEG 2000 . PEG chains exposed at DXP-NPs surface confer stability by steric repulsions whereas stearic chains associated to palmitic chains of DXP by hydrophobic interactions prevented DXP crystallization. PEGylated DXP-NPs were obtained without any addition of surfactants or stabilizers that could reveal toxic after administration, such as chitosan, poloxamer or PVA [START_REF] Grabowski | Surface coating mediates the toxicity of polymeric nanoparticles towards human-like macrophages[END_REF].

This simple preparation process with low amounts of PEGylated lipids presents obvious advantages from a toxicological point of view over common solid lipid nanoparticle formulations and from a formulation point of view with an increased drug loading and DXP stability. PEGylated DXP-NPs were incubated and the release of free DXM was monitored by an HPLC method (Fig 1e). The release profile shows that about 60% of dexamethasone is released before reaching a plateau more likely due hydrolysis through esterases present in plasma. The reason for which DXM is partly unreleased is unclear but might result from partial degradation of dexamethasone. Nanoparticles exhibited a monodisperse population of 130nm with negative surface charge and high drug loading of 49%w/w (eq. DXM/particle) b. X-ray diffractogram of DXP crystals (green) presented several diffraction peaks characteristics of a crystalline structure. By contrast, no peaks were observed for DXP-NPs either the day of preparation (red) or after 3 weeks of storage at 4°C (blue). c. Cryo-TEM (left) and TEM (right) images confirmed size measurements and the amorphous structure of DXP-NPs. d. DXP-NPs size, zeta potential and polydispersity index (PdI) stability at 4°C were followed up to 21 days. Results are presented as mean ± SEM (n=5 samples at least, each sample was analyzed in triplicate). e. In vitro release in plasma of dexamethasone from DXP-NPs.

In vitro anti-inflammatory effect

To ensure that the anti-inflammatory activity of DXM was conserved after formulation, the release of the pro-inflammatory cytokines MCP-1 and TNFα by LPS-activated macrophages into the cell culture medium was quantified after their exposition to DXP-NPs at the concentration of 100µg/mL DXP or free DSP at 82µg/mL, corresponding to 100µg/mL of DXP. A decrease of cytokines concentration was clearly observed resulting from the anti-inflammatory effect of DXP-NPs (Fig. 2). The MCP-1 chemokine (Fig. 2) was strongly and significantly reduced by DXP-NPs in presence of LPS. The same conclusions hold for the secretion of TNFα (Fig. 2). These results demonstrate the maintenance of a similar anti-inflammatory activity between free drug and the drug released from the DXP-NPs.

In vivo activity on rheumatoid arthritis and inflamed joint accumulation

To assess DXP-NP efficacy on rheumatoid arthritis, a collagen-induced arthritis (CIA) model was developed on DBA/1 male mice [START_REF] Brand | Collagen-induced arthritis[END_REF]. The effect of DXP-NPs on paw arthritis inflammation score and volume of hind paw edemas was compared to free dexamethasone sodium phosphate (DSP) and PBS as negative control (Fig. 3). A low dosage, 0.1mg/kg (eq.DXM), injected intravenously three times every two days was compared to a medium dosage at 1mg/kg (eq.DXM), with the same injection pattern. These doses were considered since the administration of 1mg/kg (eq.DXM) is widely used in the literature as a medium dose to treat animals in arthritis mouse models without induction of side effects [START_REF] Rauchhaus | Separating therapeutic efficacy from glucocorticoid side-effects in rodent arthritis using novel, liposomal delivery of dexamethasone phosphate: long-term suppression of arthritis facilitates interval treatment[END_REF]. Before the first injection (day 31), mice were randomly divided into 5 groups with the same average total arthritis score of 7.5 per mouse. The first injection took place at day 32 after the induction of CIA, a time point corresponding to the peak of the disease (Fig. S3). The activity of DXP-NPs 0.1mg/kg (eq.DXM) was evaluated by measuring the total arthritis score on all 4 paws for each mouse and showed no significant reduction of the inflammation compared to free drug or PBS after statistical analysis on the whole length of the experiment. Indeed, the arthritis score on day 37 of DSP 0.1mg/kg (eq.DXM) group was 6.1±1.4 whereas the equivalent dose of DXP-NPs exhibited an arthritis score of 7.7±1. However, a significant difference was observed on hind paw volumes between DXP-NPs at 0.1mg/kg (eq.DXM) (0.15±0.006ml), free drug at 0.1mg/kg (eq.DXM) (0.18±0.01ml) and PBS (0.2±0.01ml) on day 34 (Fig. 3c). The discrepancy between the two evaluation methods may arise from the fact that arthritis score measurement is based on several parameters such as paw edema, swelling, redness and the number of affected fingers (Fig. S3), whereas hind paw volume measurement is only based on the edema evaluation. Moreover, arthritis score is measured on all 4 paws whereas paw volumes is measured only on hind paws. Thereby a slight reduction of edema will immediately affect the paw volume but not the total arthritis score. Strikingly, a medium dose of 1mg/kg (eq.DXM) of DXP-NPs showed a strong activity on disease progression with a significant reduction of the arthritis score compared to free dexamethasone (DSP) at the same dose and to the control group (PBS). After three injections of DXP-NPs 1mg/kg (eq.DXM), the total arthritis score dropped down to 2.5±0.7, significantly differing from what we observed for the groups DSP 1mg/kg (eq.DXM) (5.5±1.1) and PBS (9.1±0.8) at day 37. The analysis of hind paw volume on day 34 and up to ay 37 (Fig. 3c and3b) confirmed the strongest therapeutic efficacy of DXP-NPs (0.14±0.003ml) (eq.DXM) with significant reduction compared to the free drug DSP at 1mg/kg (0.15±0.006ml) and the PBS group (0.2±0.01ml). By analyzing hind paw volumes, we can also conclude that treatment with DXP-NPs 0.1mg/kg (eq.DXM) exhibited the same anti-inflammatory activity at day 34 (0.15±0.006ml) than DSP 1mg/kg (eq.DXM) (0.15±0.006ml). Therefore, a reduction of the administrated dexamethasone doses through replacement of free drug by DXP-NPs could be considered. Numerous studies reported the accumulation of nanoparticles in inflamed sites [START_REF] Anderson | Liposomal encapsulation enhances and prolongs the anti-inflammatory effects of water-soluble dexamethasone phosphate in experimental adjuvant arthritis[END_REF][START_REF] Metselaar | Complete remission of experimental arthritis by joint targeting of glucocorticoids with long-circulating liposomes[END_REF] associated with an increased number of vessels in synovium induced by the high VEGF serum concentration [START_REF] Lu | Vascular endothelial growth factor expression and regulation of murine collageninduced arthritis[END_REF]. Angiogenesis is correlated to clinical arthritis score and new vessels present high endothelial permeability to allow diapedesis of activated macrophages and lymphocytes leading to synovial infiltration [START_REF] Szekanecz | Angiogenesis in rheumatoid arthritis[END_REF][START_REF] Szekanecz | Vascular involvement in rheumatic diseases: "vascular rheumatology[END_REF]. Thereby, long-circulating nanoparticles may passively diffuse through endothelial pores and specifically accumulate in inflamed joints due to extravasation and further macrophage uptake [START_REF] Garrood | Targeting the inflamed synovium: the quest for specificity[END_REF]. DXP-NPs with stealth properties due to the presence of PEG at their surface could circulate longer in blood vessels and produce a rapid, significant anti-inflammatory activity on inflamed joints, leading to a complete remission of rheumatoid and persistent arthritis observed after treatment with 1mg/kg (eq.DXM) DXP-NPs. Indeed, as shown by preliminary biodistribution studies, the stealth effect favors a lower uptake by the liver compared to the free drug (Fig. S7). The mechanism by which such nanoparticles exert their anti-inflammatory effect is not totally clear. Nanoparticles might be taken up intact by synovial lining macrophages (more likely M1) as described [START_REF] Hofkens | Liposomal Targeting of Prednisolone Phosphate to Synovial Lining Macrophages during Experimental Arthritis Inhibits M1 Activation but Does Not Favor M2 Differentiation[END_REF], however we cannot rule out the possibility that the nanoparticles are degraded at the extracellular level, releasing free DXM that enter freely into macrophages without any specificity. volume of DXP-NPs 0.1mg/kg (eq.DXM) group (pink) was significantly different from free drug 0.1mg/kg (eq.DXM) (light blue) and from PBS group, proving the superior efficacy of DXP-NPs. At a higher dose of 1mg/kg (eq.DXM), DXP-NPs (red) group presented a significantly lower hind paw volume than DSP (dark blue) and PBS. Statistical analysis was performed with Mann-Withney test (*p<0.05, **p<0.01, ****p<0.0001).

To confirm the hypothesis of accumulation of stealth DXP-NPs in inflamed joints, fluorescent nanoparticles were formulated to monitor the in vivo distribution of DXP-NPs after IV administration.

DID (1,1'-dioctadecyl-3,3,3',3'-tetramethylindodicarbocyanine, 4-chlorobenzenesulfonate salt) (Fig. S2a), a lipophilic fluorescent label containing two aliphatic chains was introduced in the organic phase before emulsification (4%mol with respect to the DSPE-PEG 2000 ). No significant differences in terms of size and PdI were observed between fluorescent NPs and non-fluorescent ones (Fig. S2b).

CIA and healthy mice received a single intravenous injection of fluorescent DXP-NPs-DID4% at a dose of 1mg/kg (eq.DXM). Day 32 post-disease induction was selected for the treatment as it corresponded to the peak of the inflammation. Due to the heterogeneity of joint inflammation inherent to the CIA model not all paws of all injected mice were affected, and we took advantage of this to assess DXP-NP accumulation in inflamed vs. non-inflamed paws from the same animal. After injection of the fluorescent NPs, near infrared (NIR) images of mice were recorded non-invasively for up to 14 days, and the fluorescence signal on the 4 paws of each mouse was quantified. At 4h post NP injection, a slight increase of fluorescence signal was observed in the paws of healthy mice, which corresponded to the presence of nanoparticles in the vasculature. However, the signal, reached the baseline value (mouse auto-fluorescence) at 24h, without further modification until the end of the study (Fig. 4a and4c). Among four CIA-treated mice, an intense fluorescent signal was measured in the paws of mice, which displayed a severe paw inflammation (arthritis score = 3). This signal peaked at 24 hours post-injection and then progressively decreased to baseline value by day 14 (Fig. 4a and4c). As expected, in absence of inflammation, (arthritis score = 0) the fluorescence signal in the in the paws of CIA mice overlapped that recorded after injection of NPs in healthy mice, thus clearly revealing that joint accumulation of DXP-NPs was dependent on edema and neovascularization. An intermediary level of fluorescence intensity was recorded in the paws displaying an arthritis score between 1 and 2 (pooled results for a better statistical analysis), thus demonstrating the impact of inflammation stage on neoangiogenesis and therefore on DXP-NPs accumulation. Of note, the same profile was observed both on ventral and dorsal images (Fig. 4b and Fig. S4). Fig. 4b presents the average radiant efficiency (fluorescent signal) at 24h after injection on dorsal images with a significant difference between strongly inflamed paws (arthritis score = 3) and slightly (arthritis scores = 1 and 2) or not inflamed paws (arthritis score = 0 and healthy). The same trend was obtained when ventral pictures were analyzed (Fig. S4).

As a control, a DID solution containing the same amount of probe than DXP-NPs-DID4% was also injected to CIA and healthy mice (Fig. S5). The fluorescence signal detected was slightly correlated to the inflammation score due to the high vessel density in inflamed joints. However, the fluorescence intensity was significantly higher (1.5 to 2 times higher) on inflamed paws after DXP-NPs-DID4% administration compared to free DID solution, supporting that joint accumulation is linked to DXP-NPs diffusion and not to an inherent DID property. These results clearly confirm the accumulation and cellular uptake of nanoparticles in the inflamed joints 5 times higher than in non-affected joints.

This accumulation and retention further explain the improved therapeutic efficacy of DXP-NPs compared to the free soluble DSP, which does not accumulate specifically in inflamed joints.

Whether this accumulation is due to macrophage uptake in the synovial fluids very likely as suggested by several authors [START_REF] Hofkens | Liposomal Targeting of Prednisolone Phosphate to Synovial Lining Macrophages during Experimental Arthritis Inhibits M1 Activation but Does Not Favor M2 Differentiation[END_REF][START_REF] Metselaar | Liposomal targeting of glucocorticoids to synovial lining cells strongly increases therapeutic benefit in collagen type II arthritis[END_REF]. Another possibility would be that nanoparticles are taken up by monocytes that are then being used as carriers to the inflammation site. Particle are then cleared from the paws as demonstrated by a slow and progressive reduction of fluorescence that occurred after 24 hours. This decrease of fluorescence might be related to particle degradation at the site of action and further elimination of the probe. To confirm the therapeutic efficacy of DXP-NPs observed on a macroscopic scale (Fig. 2), histological structures of knees were evaluated. After treatment with three IV injections (days 32, 34, 36) of PBS, DSP 0.1mg/kg (eq.DXM) and 1mg/kg (eq.DXM) or DXP-NPs 0.1mg/kg (eq.DXM) and 1mg/kg (eq.DXM), mice were sacrificed on day 37 post collagen injection and knee joints were observed and inflammation was scored after HES staining. As expected, the control group injected with PBS presented a high level of inflammation with pannus formation associated with an important synovial infiltration, a synovial lining cell proliferation and strong bone erosion. DSP treatment at both doses did not demonstrate a significant impact on the knee histopathology compared to the PBS control group. Although not statistically significant, the administration of DXP-NPs at 0.1mg/kg (eq.DXM)

tended to decrease the histological severity of the inflammation. In striking contrast, the medium dose of DXP-NPs 1mg/kg (eq.DXM) led to a significant reduction of inflammatory histological signs compared to the same dose of DSP and to PBS. A good correlation between the histological scores and the macroscopic arthritis scores determined on each paw before sacrifice was obtained confirming the soundness of our first analysis (Fig. 4c). In the DXP-NPs 1mg/kg (eq.DXM) treatment group, a very few number of knee joints presented mild synovial hyperplasia with cell proliferation and fibrosis. These histological results are in agreement with therapeutic efficacy and joint accumulation results described above. Therefore, the benefit of three IV injections of DXP-NPs 1mg/kg (eq.DXM) was clearly demonstrated compared to the free DSP at the same dose.

Effect of formulation on glucocorticoids side effects

Chronic administration of high doses of GCs generally leads to appearance of strong side effects such as hepatic and renal impairment, diabetes or hematologic abnormalities [START_REF] Khurana | Clinical aspects of rheumatoid arthritis[END_REF][START_REF] Hofkens | Liposomal Targeting of Prednisolone Phosphate to Synovial Lining Macrophages during Experimental Arthritis Inhibits M1 Activation but Does Not Favor M2 Differentiation[END_REF][START_REF] Metselaar | Liposomal targeting of glucocorticoids to synovial lining cells strongly increases therapeutic benefit in collagen type II arthritis[END_REF][START_REF] Shoenfeld | Prednisone-induced leukocytosis[END_REF], which therefore, limit their use in chronic auto-immune diseases such as RA. DXP-NPs proved their superior therapeutic efficacy in our CIA mouse model after three IV injections of a medium dose of 1mg/kg (eq. DXM) compared to DSP (Fig. 3a). Adverse event assessment was designed to compare DXP-NPs to DSP, currently considered as the standard IV treatment, at the same therapeutic dose of 1mg/kg (eq.DXM) and PBS as negative control, 24h after the last IV injection. Hepatic enzymes were quantified to evaluate liver function. Alanine aminotransferase (ALAT) plasmatic concentration (Fig. 6a) did not present significant increase between groups. Asparagine aminotransferase (ASAT) (Fig. S6) showed a very slight increase for the DXP-NPs treatment group compared to PBS but no difference was observed with DSP. DSP and DXP-NPs exhibited a similar and moderate increase of creatinin plasmatic concentration and blood glucose concentration (Fig. 6b and6c) compared to control (PBS) but no difference between both treatment groups was detected, indicating no damage of liver, pancreas, or kidneys after DXP-NPs administration. The fact that there is no difference between treatment in relation with markers in line with liver function (glucose, liver enzymes) might results from liver biodistribution observations. Indeed, although DXP-NPs and DXM display different level of liver distribution (lower than 5% and higher than 15% of the injected dose, respectively) (Fig. S7), DXM resulting from the prodrug hydrolysis induces an equivalent liver distribution (around 12%) (Fig. S7) both just enough to induce hyperglycemia or slight liver enzymes increase.

During the progression of the disease, the mice weight was monitored and no significant difference between groups in terms of weight loss were observed. All groups lost weight due to the strong impact of CIA inflammation, but DSP 1mg/kg (eq.DXM) treated group seems to undergo a greater weight loss with a maximum of -13% of their initial healthy weight. Hematological parameters (blood count and leukocytic formula) were evaluated on total blood samples after sacrifice on day 37. No modification of blood count was observed for DXP-NPs as well as for DSP compared to PBS group.

Hemoglobin concentration (Fig. 6e) and mean corpuscular volume (MCV) (Fig. 6f) were not affected by any treatment either. Mice did not present anemia, red blood cell count was slightly increased compared to standard values, hematocrit, mean corpuscular haemoglobin (MCH) and mean corpuscular haemoglobin concentration (MCHC) were comprised within standard values (SI Fig. 6)

showing no hematological adverse effects of DXP-NPs 1mg/kg (eq.DXM). White blood cell count (Fig. 6g) was similar between the DXP-NPs and DSP groups although they both exhibited higher values compared to the PBS control group. This leukocytosis is linked to neutrophilia and basophilia (Fig. S6) that are exacerbated in the GC treated groups. This pattern of leukocytosis is described as the typical response 24h after GC exposure [START_REF] Hofkens | Liposomal Targeting of Prednisolone Phosphate to Synovial Lining Macrophages during Experimental Arthritis Inhibits M1 Activation but Does Not Favor M2 Differentiation[END_REF]. Lymphocyte count was also slightly increased in the DSP and DXP-NP groups compared to the PBS group, but values remained within the range of standard values (Fig. 5h). No modification of eosinophils, monocytes and platelets was observed (Fig. S6).

These results confirmed that only mild adverse effects were observed after 3 IV injections of DXP-NPs 1mg/kg (eq.DXM). Moreover, these adverse effects were not significantly different from those observed after 3 IV injections of DSP at the same dose. Furthermore, it is important to note that DSP 1mg/kg (eq.DXM) do not induce such a drastic reduction of the inflammation as observed with DXP-NPs 1mg/kg (eq.DXM). Therefore, a higher dose of DSP would be needed to reach the same therapeutic efficacy as DXP-NPs 1mg/kg (eq.DXM) with potentially more severe associated side effects. Altogether, these results showed that DXP-NPs are safe after IV administration on CIA mice at a therapeutic dose of 1mg/kg (eq.DXM).

Conclusion

In this study, the lipophilic prodrug of dexamethasone, DXP, was successfully stabilized by the sole addition of DSPE-PEG 2000 to yield nanoparticles as perfect candidates for RA treatment. For the first time, these highly loaded, stable, and stealth DXP-NPs demonstrated their clinical relevance in the CIA mouse model. Owing to their small size of 130nm and dense PEG coating, DXP-NPs could benefit from the typical high vascular permeability of inflamed joints and diffuse passively to accumulate and be retained in the diseased sites as demonstrated by in vivo NIR fluorescence imaging. This accumulation in inflamed joints led to improvement of the joint inflammation and eventually disease remission. After three IV injections of DXP-NPs 1mg/kg (eq.DXM), the arthritis symptoms such as joint edema, swelling and ankylosis were significantly reduced compared to free hydrosoluble dexamethasone and to PBS injections. Moreover, this macroscopic evaluation was correlated with a significant reduction of histological signs of inflammation. Biologic and hematologic parameters were quantified to evaluate the potentially induced side effects of DXP-NPS at the efficient therapeutic dose of 1mg/kg (eq.DXM) and no adverse effects were detected for DXP-NPs. Considering the actual therapeutic scheme of RA patients, the developed DXP-NPs could be considered as a promising treatment for acute inflammation stage to prevent cartilage and bone erosion, in monotherapy or in combination with current 1 st line treatment such as methotrexate.

Fig. 1 :

 1 Fig. 1: Characterization and stability of DXP-NPs. a. Main physico-chemical parameters of DXP-NPs.Nanoparticles exhibited a monodisperse population of 130nm with negative surface charge and high drug loading of 49%w/w (eq. DXM/particle) b. X-ray diffractogram of DXP crystals (green) presented several diffraction peaks characteristics of a crystalline structure. By contrast, no peaks were observed for DXP-NPs either the day of preparation (red) or after 3 weeks of storage at 4°C (blue). c. Cryo-TEM (left) and TEM (right) images confirmed size measurements and the amorphous structure of DXP-NPs. d. DXP-NPs size, zeta potential and polydispersity index (PdI) stability at 4°C were followed up to 21 days. Results are presented as mean ± SEM (n=5 samples at least, each sample was analyzed in triplicate). e. In vitro release in plasma of dexamethasone from DXP-NPs.

Fig 2 :

 2 Fig 2: Cytokine production by Raw 264.7 macrophages without LPS induction (C-) or with LPS induction 0.1µg/mL (C+), DXP nanoparticles at 100µg/mL (LPS+DXP100) or DSP solution at 82µg/mL corresponding to 100µg/mL of DXP (LPS+DSP82). MCP-1 and TNF-α. Results are presented as mean±SEM (n=3) for all groups. Statistical analysis was performed with two-way ANOVA followed by Tukey's post test. * p<0.05, **p<0.01, ***p<0.001, ****p<0.0001 indicates differences with positive control (C+).

Fig. 3 .

 3 Fig.3. Therapeutic activity of DXP-NPs on a collagen induced arthritis (CIA) mouse model. 31 days after CIA induction, mice were divided into 5 groups (n=8) presenting similar arthritis score (7.5 average arthritis score). Each group received three intravenous injections of treatments or controls on days 32, 34 and 36. a. Arthritis score and b. hind paw volume. The negative control group received PBS (green diamonds), free drug groups received dexamethasone sodium phosphate (DSP) at 0.1mg/kg (eq.DXM) (light blue triangles) or 1mg/kg (eq.DXM) (dark blue triangles), DXP-NPs were administered at 0.1mg/kg (eq.DXM) (pink squares) or 1mg/kg (eq.DXM) (red circles). After three IV injections, DXP-NPs 1mg/kg (eq.DXM) induced a significant reduction on arthritis score compared to DSP at the same dose and to PBS. Statistical analysis was performed with two-way ANOVA and Newman-Keuls post-test (*p<0.05, ***p<0.001). c. Hind paw volume measured on day 34. The

Fig. 4 .Fig. 5 .

 45 Fig. 4. Accumulation of DXP-NPs in inflamed joints, impact of arthritis severity. After IV injection of fluorescent nanoparticles, the evolution of the NIR signal (dorsal view) in healthy mice (n=4) and CIA mice (n=4) was monitored according to the arthritis score for each paw. a. Fluorescent signal in paws segregated on the basis of their arthritis score after IV injection with DXP-NP-DID4% for 14 days. Paws of healthy mice (yellow diamonds) and score 0 paws of CIA mice (purple triangles) displayed the same basal level of fluorescence, score 1 and 2 paws of CIA mice presented an increase in

Fig. 6 .

 6 Fig. 6. DXP-NPs administration does not lead to adverse effects compared to DSP administration. Three groups of CIA mice (n=10) received PBS, or DSP 1mg/kg (eq.DXM) or DXP-NPs 1mg/kg (eq.DXM) on days 32, 34 and 36 after CIA induction. Mice were followed up to sacrifice on day 37, several biological parameters were analyzed. a. No difference between groups was detected for ALAT (alanine aminotransferase) plasmatic concentration. Plasmatic creatinin (b) and glucose (c) concentrations were similar for treatment groups (DSP and DXP-NPs) but presented a slight increase compared to PBS group. d. The weight of each animal was recorded from day 21 to day 37. No significant difference was observed although DXP-NPs treated mice lost less weight compared to PBS and DSP groups. e-h. Hematological parameters were analyzed on total blood, dotted lines on graphs represent standard values for healthy mice. No anemia was observed on any group of treatment or PBS with hemoglobin concentration values within the normal range (e) as well as for mean corpuscular volume (MCV) (f). CIA mice treated with PBS presented an increased white blood cell (WBC) count (g) compared to standard values. Leukocytosis was also observed for DSP and DXP-NPs group of treatments with a significant difference with PBS. h. The presence of lymphocytes slightly increased after DSP and DXP-NPs administration, but values were still consistent with standard ones.

Results are presented as mean ± SEM (n=10). Statistical analysis was performed with One-Way ANOVA followed by Tukey's post-test (*p<0.05, **p<0.01, ***p<0.001).

Acknowledgments

M. L. PhD fellowship has been funded by Ministère de l'Enseignement Supérieur et de la Recherche. M. R. was supported by a fellowship from Campus France. The present work has benefited from the core facilities of Imagerie-Gif, (http://www.i2bc.paris-saclay.fr), member of IBiSA (http://www.ibisa.net), supported by "France-BioImaging" (ANR-10-INBS-04-01), and the Labex "Saclay Plant Science" (ANR-11-IDEX-0003-02) with the precious help of C. Boulogne and C. Gillet.

Institut Galien Paris-Sud is a member of the Laboratory of Excellence LERMIT supported by a grant from ANR (ANR-10-LABX-33). M.E was supported by a Junior Team Leader starting grant from the LabEx LERMIT and an ANR @RAction starting grant (ANR-14-ACHN-0008).

Conflict of interest

None.


Helene Coullon
email: helene.coullon@imt-atlantique.fr

Claude Jard
email: claude.jard@univ-nantes.fr

Didier Lime
email: didier.lime@ec-nantes.fr

Integrated Model-checking for the Design of Safe and Efficient Distributed Software Commissioning

Keywords: Distributed software commissioning, Deployment, Model checking, Safety, Liveness, Efficiency, Component models, Petri nets

We present MADA, a deployment approach to facilitate the design of efficient and safe distributed software commissioning. MADA is built on top of the Madeus formal model that focuses on the efficient execution of installation procedures. Madeus puts forward more parallelism than other commissioning models, which implies a greater complexity and a greater propensity for errors. MADA provides a new specific language on top of Madeus that allows the developer to easily define the properties that should be ensured during the commissioning process. Then, MADA automatically translates the description to a time Petri net and a set of TCTL formulae. MADA is evaluated on the OpenStack commissioning.

Introduction

This paper focuses on one specific challenge related to distributed software deployment: distributed software commissioning. By software commissioning we mean the complete installation, configuration and testing process when deploying distributed software on physical distributed resources, with or without a virtualization layer in between. This process is complex and error-prone because of the specificity of the installation process according to the operating system, the different kinds of virtualization layers used between the physical machines and the pieces of software, the amount of possible configuration options [START_REF] Xu | Systems approaches to tackling configuration errors: A survey[END_REF]. Recently, commissioning (or configuration) management tools such as Ansible 1 , or Puppet 2 , have been widely adopted by system operators. These tools commonly include good software-engineering practices such as code reuse and composition in management and configuration scripts. It is nowadays possible to build a new installation by assembling different pieces of existing installations 3,4 which improves the productivity of system operators and prevents many errors. Many distributed software commissionings are nowadays written with one the two above tools and by using containers between the host operating system and the pieces of software, such that portability of installations is improved. For instance, OpenStack, which is the de-facto open source operating system of Cloud infrastructures, can be automatically installed on clusters by using the kolla-ansible project, which uses both Docker containers and Ansible.

Yet, even for such well-established software, there is still much room for improving the efficiency of the commissioning process (i.e., reducing deployment times, minimizing services interruptions etc.). As manually coding parallelism into commissioning procedures is technically difficult and error prone, automated parallelism techniques should be introduced. To this purpose, not only dedicated tools, including Puppet, but also academic prototypes such as Aeolus [START_REF] Di Cosmo | Aeolus: a model for the Cloud[END_REF] and Madeus [START_REF] Chardet | Madeus: A formal deployment model[END_REF], introduce parallelism capabilities within software commissioning, at different levels and by using different techniques more or less transparent for the user. For instance, we have observed a performance gain of up to 47% by using Madeus over the kolla-ansible reference approach (conducted on the Taurus cluster of the Grid'5000 experimental platform).

Madeus 5 is the commissioning model offering the highest parallelism level [START_REF] Chardet | Madeus: A formal deployment model[END_REF] in the literature, while offering a formal operational semantics. This makes Madeus the ideal candidate to further study challenges of efficient and safe distributed software commissioning. Madeus automatically handles the intricate details of parallelism coordination, by managing threads and their synchronizations for the user. However, users still have to design their parallel procedures, thus raising the following questions: (1) how to divide existing intricate commissioning scripts in interesting subtasks to introduce parallelism? [START_REF] Barros | Model-checking distributed components: The vercors platform[END_REF] how to find correct dependencies between commissioning tasks? and (3) how to avoid safety issues such as deadlocks, wrong order of configurations etc.?

We study the feasibility of using model checking techniques to help in the three above challenges in the design of safe and efficient distributed software commissioning. To this purpose we present MADA, an extension of Madeus that brings the following contributions: (1) the automatic transformation process from a Madeus commissioning to an equivalent time Petri net; (2) a domain specific language on top of Madeus to easily express qualitative and quantitative properties related to both safety and efficiency; (3) the automatic translation of MADA properties to temporal logic properties, including liveness, observers and causality, which is uncommon for software commissioning; and (4) an evaluation of MADA on the real case study OpenStack6 and compared to real experiments.

The rest of this paper is organized as follows. Section 2 introduces the related background. Section 3 presents MADA that is evaluated in Section 4 on the real commissioning of OpenStack. Finally, Section 5 comments the related work, and Section 6 concludes this work and opens some perspectives.

Madeus and Petri Nets

Madeus [START_REF] Chardet | Madeus: A formal deployment model[END_REF] is a component-based model where a component represents the configuration and the installation of a software module of a distributed system. A component contains a set of places that represent milestones of the deployment, and a set of transitions that connect the places together and represent actions to be performed between milestones (e.g., apt-get install). The internal commissioning behavior of a Madeus component is called in the rest of this paper an internal-net. In Madeus, a transition is attached to output and input docks of places, which are used to properly manage parallel actions in the operational semantics. Madeus components expose ports that represent connection points with other components. Four kinds of ports are available: service-provide and service-use ports to provide (resp. require) a service, and data-provide and data-use ports to provide (resp. require) a piece of data. Provide ports (service or data) are bound to one or more places (i.e., called groups), illustrating the set of milestones where the component is able to provide a service or data. Use ports (service or data) are bound to one or more transitions where services or data are actually used. A component assembly (also sometimes called a configuration), is made of component instances and connections between ports.

Figure 1 shows an assembly composed of two components. The internal-net of the Server component (on the left) is composed of three places (circles) and two transitions (arrows). The Server's allocated place is bound to the ip dataprovide port (outgoing arrow), while the running place is within a group bound to the service-provide port (small black circle). The internal-net of the Client component (on the right) is composed of four places and four transitions, two of them being bound to (respectively) a data-use (incoming arrow) and a serviceuse (semi circle) ports. The ports of Server and Client are connected within the assembly forming data and service connections (i.e., dependencies).

The evolution of a Madeus deployment is modeled by a set of moving tokens within the internal-nets of components. The evolution of these tokens is handled by seven operational semantics rules which are specific to software commissioning procedures. Hereafter is an overview of these rules, which are formally detailed in [START_REF] Chardet | Madeus: A formal deployment model[END_REF]. Each initial place of a component (represented with a gray background in Figure 1) initially contains a single token. The token is allowed to leave a place belonging to a group only if this would not deactivate a service provide port with an active connection (i.e., under use). If so, and if the outgoing transition of a place is not bound to a use port, the token is directly able to move from the place to the transition. Otherwise, all the use ports have to be ready before the move can happen, which is the case when the associated use-provide connections are activated. When a token reaches a transition the associated deployment action is started. Several transitions can be fired simultaneously (e.g., Client in Figure 1). In this case, the token is duplicated on each transition. As soon as all the input transitions of a place have ended, their tokens are merged and go to the place. When a token moves to a place in a group that is bound to a provide port, the associated connection is activated, which eventually unlocks use ports of other components. Unlike the service-provide port, the data-provide port acts as a register and will never be disabled once being activated.

Petri nets [START_REF] Petri | Kommunikation mit Automaten[END_REF] are a classic formalism for the modeling of concurrent systems. We recall here the basic definition. A Petri net (PN) is a 3-tuple (P, T, F ), where P is finite set of places; T is finite set of transitions, with P ∩ T = ∅; and F : (P × T ) ∪ (T × P ) → N is the flow function that defines weighted arcs between places and transitions. A marking of a net (P, T, F ) is a function m : P → N. For a given marking m, we say that place p contains m(p) tokens. A pair (N , m 0 ), where N is a Petri net and m 0 is a marking, is called a marked Petri net, which we often call just Petri net, when clear from the context. Marking m 0 is called the initial marking of N . A transition t is said to be enabled by marking m, when ∀p ∈ P, m(p) ≥ F (p, t). A transition t enabled at marking m can be fired, producing the new marking m defined by: ∀p ∈ P, m (p) = m(p) -F (p, t) + F (t, p).

We also consider time Petri nets [START_REF] Merlin | A study of the recoverability of computing systems[END_REF], in which a time interval is attached to each transition. A transition can then only be fired (and must be fired or be disabled) after being continuously enabled for a duration in that interval. See [START_REF] Berthomieu | Modeling and verification of time dependent systems using time Petri nets[END_REF] for details.

At first sight a Madeus assembly looks fairly close to a Petri net. However, compared to Petri nets, Madeus assembly falls into the category of Domain Specific Languages (DSL) to model and execute distributed software commissioning. It therefore has a few high-level specific primitives, adapted to developers and system administrators, that do not have direct equivalent in Petri nets.

MADA

Madeus automatically handles the intricate details of parallelism coordination, by managing threads and their synchronizations for the user. However, users still have to design their parallel procedures. MADA (MADeus Analyzer ) uses model-checking to help Madeus users design their safe and efficient commissioning. First, MADA is responsible for the automatic transformation from a Madeus assembly to a time Petri net. Second, MADA offers a set of high level qualitative and quantitative properties that are automatically transformed to Timed Computational Tree Logic (TCTL) formulae.

From Madeus to Petri Nets

Table 1 show the five rules that illustrate the complete translation from Madeus assemblies to (time) Petri nets. Since the terminologies are similar we distinguish between m-place and m-transition for Madeus assemblies and pn-place and pntransition for Petri nets. As docks, ports and connections only concern Madeus, no special notations are introduced for them.

The first and second rule of Table 1 illustrate the basic constructions, when Madeus port are not involved in the component (i.e., no synchronization). One pn-place is created for each dock, one for each m-place, and one for each mtransition. Those are connected straightforwardly to ensure the Madeus sequence <source m-place, output dock, m-transition, input dock, target m-place >. When considering time, all pn-transitions are executed immediately (interval [0, 0]) except the end pn-transitions that bear the execution time interval of the associated m-transition, thus representing the time needed for the commissioning action.

Each provide port of Madeus is modeled by a dedicated pn-place. Thus, connections related to this provide port are available if and only if that pn-place is non-empty. Rule (3) models how the pn-place modeling m-transition t, that uses two provide ports port 1 and port 2 , checks for the connections availability by testing the non-emptiness of pn-places port 1 and port 2 . Note that for serviceprovide it is necessary to know whether some transition is currently using the port (as explained below). We therefore add two pn-places for each provide port, that are marked in exclusion, one to mark that a port is under use, the other one to mark the opposite: port 1 in use and port 1 not used in Table 1 (rule (3)), for instance. With this construction, the following property holds, thus respecting the Madeus semantics: Property 1. For any provide port port, pn-place port in use contains as many tokens as there are marked pn-places representing an m-transition that currently uses port. The total number of tokens in port in use and port not used is always the total number of m-transitions that require port. 1 models the activation of a data-connection. In Madeus as soon as m-place P is reached, the connection associated to the provide port port 2 is activated. Since a data-connection once activated will always remain so, in the equivalent Petri net a token is added in the pn-place port 2 once and for all at the same time as the pn-place P is marked. With this construction the following property holds: Property 2. The number of tokens in a pn-place modeling a data-provide port is equal to the number of pn-places modeling m-places bound to that port that has been marked. Finally, rule (5) models the most complex part of the transformation: a group of m-places that provides a service. In this case, we must first ensure that the connection is activated if and only if a m-place in the group is active, or a dock or a m-transition between two such m-places is active. In the Petri net, this is ensured in the following way: (1) whenever a pn-transition entering the group is executed, a token is added to the pn-place modeling the Madeus provide port (e.g., pn-transitions enter P1 and enter P2 ); (2) whenever a pn-transition leaving the group is executed (i.e., from one of the last m-place of the group), a token is removed from the pn-place modeling the Madeus provide port (e.g., pn-transitions exit P 1 and exit P 2 ); (3) whenever a pn-transition within the group

Rule (4) of Table

d o2 d i22 end t2 t 2 start t2 d o2 exit P2 P 2 enter P2 port1 port1 not used port1 in use 1 2 2
Table 1: Set of transformations from Madeus to Petri nets: (1) basic construction of a m-place and its associated docks, (2) basic construction of a m-transition and its source and destination docks, (3) data-use and service-use ports bound to a transition t, (4) data-provide port provided by a place P , (5) group of places bound to a service-provide port (i.e., source and destination pn-places within the group) that goes to or comes from a pn-place modeling a m-place is executed, we accordingly remove in the provide port pn-place as many tokens as input docks, and add in the same provide port pn-place as many tokens as output docks. Note that, in order to minimize the number of arcs in the Petri net, we actually compute the net effect on the port pn-place so that most transitions (leaving one dock for a place, or one place for a dock) do not modify the number of tokens in the port pn-place. Thus, only forks and joins within the group add and remove tokens in the port pn-place (e.g., exit P1 and enter P 2 in Table 1, rule ( 5)). With this construction the following property holds:

Property 3. The number of tokens in a pn-place modeling a service-provide port is equal to the number of marked pn-places modeling either active m-places or m-transitions or docks in the group.

Once the port activated, we need to keep it active until all m-transitions using the port are completed. Thus there are two ways to leave a group from a pn-place, first if the provide port is not used, and second if it is used but leaving the pn-place does not remove the last token of the pn-place modeling the service-provide port. In the Petri net, this is ensured in the following way:

(1) two outgoing pn-transitions are represented for each pn-place modeling a m-place that leaves a group (e.g., exit P 1 and exit P 1 for the m-place P 1 , exit P 2 and exit P 2 for the m-place P 2 , rule (5) of Table 1): (2) the first one tests if the pn-place not used associated to the service-provide port is equal to the total number of m-transition that may require this port; (3) the second one tests if the pn-place in use associated to the service-provide port is marked and checks that there are at least two tokens left in the pn-place of the provide port. With this construction the following property holds: Property 4. (1) At any given time, at most one of the two pn-transitions that go outside a pn-place modeling a m-place that leaves is enabled. (2) The pnplace modeling the service-provide port cannot be emptied if the number of tokens in the corresponding not used pn-place is not equal to the total number of m-transitions that can use the port.

We have focused on a high-level explanation of the translation but it would not be difficult, if a bit tedious, to formally prove a (weak) bisimulation between the formal semantics of Madeus given in [START_REF] Chardet | Madeus: A formal deployment model[END_REF] and the Petri net obtained by the process outlined above. We leave it out of the scope of the paper to improve its readability and due to space concerns.

Property Language and Temporal Logic

Using MADA, an equivalent Petri net of a given Madeus assembly, i.e., software commissioning, is automatically generated. This saves the user from the transformation burden and prevents possible errors in this process. Furthermore, Madeus users are not familiar with Petri nets. This also holds for the properties on the generated Petri net. For this reason, MADA extends Madeus with a set of property functions that abstract away from the user the details of temporal logic and that are easy to understand for systems operators.

def s e t i n t e r v a l ( s e l f , component , t r a n s i t i o n , min , max) def add deployment ( s e l f , name , d i c t c o m p o n e n t s p l a c e s ) def d e p l o y a b i l i t y ( s e l f , deployment name , w i t h i n t e r v a l s ) def s e q u e n t i a l i t y ( s e l f , o r d e r e d l i s t c o m p o n e n t s t r a n s i t i o n ) def f o r b i d d e n ( s e l f , l i s t m a r k e d , l i s t u n m a r k e d ) def p a r a l l e l i s m ( s e l f , f u l l a s s e m b l y , l i s t c o m p o n e n t s ) def g a n t t b o u n d a r i e s ( s e l f , deployment name , mini , maxi , c r i t i c a l ) Fig. 2: Methods signatures for MADA's Properties.

Figure 2 shows the set of functions offered by MADA in Python. First, a time interval can be associated to each m-transition of the Madeus assembly. A default interval is set to [START_REF] Alur | Model-checking in dense real-time[END_REF]100] and can be updated by the user. The interval of each m-transition can be specified by the user with the function set interval.

Once an interval is declared for each m-transition, a set of deployments can be defined by the user. A deployment is identified by a name and a set of places to reach. Then the library offers five properties divided in two categories: qualitative properties and quantitative properties. Quantitative properties are only available if intervals have been indicated in the time Petri net as they offer results related to time spent in m-transition. However, as it will be shown in Section 4 these intervals do not necessarily have to be precise.

Qualitative properties. Three such properties are available in MADA. First, for a given deployment D, its deployability is the property that all of the (modeled) paths eventually lead to D. The associated syntax is illustrated on the line 4 of Figure 2. In the Petri net, the deployability property can be verified as an inevitability property, that is an AF property in TCTL [START_REF] Alur | Model-checking in dense real-time[END_REF]. Secondly, if an assembly is well defined by the developer with the needed connections between components and the right synchronization of transitions, the sequential orders between transitions will be true by construction. However, designing a Madeus assembly could become tricky for large distributed software, and the resulting high concurrency level could lead to unwitting errors. For this reason, MADA offers a way to define with an easy syntax the sequential orders that must be ensured between transitions of the assembly. The function sequentiality takes an ordered list of tuples as input, where each tuple contains a component name and its transition name. The order in which are given the tuples is the sequence to check. Sequentiality is a safety property that can be checked in Petri nets using an observer subnet : add an error pn-place p err to the Petri net. Add also, for each pn-transition pnt t modeling the end of a m-transition t (i.e., timed pn-transition), a pn-place p t , initially not marked and a pn-place p ¬t , initially with one token. pn-transition pnt t moves the token from p ¬t to p t . Then for each ordered relation of m-transitions t << t , a pn-transition is added from p ¬t and p t to p err . That transition will be firable only if t has fired but t has not fired. Sequentiality is therefore equivalent to the impossibility of putting tokens in p err , which is a basic safety property: AG p err = 0 in TCTL. Finally, systems operators may want to ensure that a given configuration is not reachable during the software commissioning. To this purpose the method forbidden is available in MADA and checks that the following invariant holds: we always have at least one of the elements in list marked that is not marked or one of the elements in list unmarked that is marked. In the Petri net, the forbidden property is a basic safety property (AG). One can note that the opposite property could be easily added.

Quantitative properties. When a Madeus assembly is designed it is not necessarily easy, because of the global coordination with connections between components, to understand the level of parallelism reached during the execution. The method parallelism on line 6 of Figure 2 returns the level of parallelism achieved when executing the Petri net. It takes as arguments, first, a boolean indicating if the maximum parallelism level of the entire assembly has to be computed, and second, the list of components for which the parallelism has to be studied separately. To compute the (maximum) level of parallelism, we compute all the reachable markings and then compute for all of them the sum of all tokens in pn-places corresponding to m-transitions belonging to the components to check. The number we want is the maximum of those. The level of parallelism can be completed by a full Gantt diagram of all m-transitions execution. This result is longer to compute but offers a clear view of the behavior of the software commissioning. The function gantt boundaries takes the name of the deployment to check as input, as well as two booleans mini and maxi. In facts, a Gantt diagram can be computed and drawn by computing either the minimum or the maximum time to reach some markings in the Petri net [START_REF] Boucheneb | Optimal reachability in cost time petri nets[END_REF] and by asking the model checker to keep absolute time information in its trace. As a result, computation of a Gantt diagram also computes the minimum and/or the maximum boundaries of the software commissioning. One can note that the trace returned by the model checker has to be processed to be able to draw the Gantt diagram. Moreover, by starting with the last m-transition to execute and backtracking in the Gantt diagram, a clear causality trace can be obtained to identify the critical path that has led to the minimum or maximum execution time [START_REF] Beer | Explaining counterexamples using causality[END_REF]. For this reason, the last input of gantt boundaries is a boolean indicating if the critical path has to be extracted from the trace.

Evaluation

In this section, we describe how MADA has been used to build the Madeus OpenStack commissioning mentioned in Section 1 from a sequential original one. Before reaching the final efficient and safe version, a total of four versions have been incrementally written by using MADA. Thus, the goal of this evaluation is to illustrate on a real use-case how MADA can be used by a user to avoid safety issues and to identify where efficiency improvements can be performed thanks to quantitative properties. Finally, this section discusses the feasibility of the approach. OpenStack is the de-facto open source solution to address the IaaS (Infrastructure as a Service) level of the Cloud paradigm. In other words, OpenStack is the operating system of the Cloud responsible for the management of physical resources of a set of clusters, as well as the management of virtual machines and their life cycle. Following the Ansible installation procedure defined in Kolla, a popular tool to deploy OpenStack 7 , we have defined 11 Madeus components: Nova, Glance, Neutron, Keystone, MariaDB, RabbitMQ, HAProxy, OpenVSwitch, Memcached, Facts, Common. The coarse grain commissioning of OpenStack is depicted in Figure 3, without the detailed internal-nets of components.

All results are shown in Table 2 where the initial Madeus number of elements, the resulting number of elements in the generated Petri net, as well as the execution time of the transformation are given. For space reasons, this evaluation focuses on the most original properties of MADA compared to the related work: deployability that checks the inevitable end of the deployment, and the two quantitative properties parallelism and gantt boundaries related to the use of time Petri nets. The result of each property as well as its computation time are also shown Table 2. Each Gantt diagram is depicted in separated figures indicating in its caption the obtained critical path. The time intervals used in the experiments have been chosen according to real observed execution time traces. We have used the Roméo model checker for time Petri nets [START_REF] Lime | Romeo: A parametric modelchecker for petri nets with stopwatches[END_REF] in our experiments. Finally, all the materials used for these experiments are available online8 (i.e., MADA python files, Petri nets and results).

MADA evaluation

The first version (0-deadlock ) has been designed by introducing three straightforward parallel tasks in the three components Glance, Neutron and Nova. The same parallel tasks have been used in these components: pulling the docker image from the Docker registry at the same time as preparing the configuration of the container, and at the same time as registering the service to the Keystone component. This parallelism pattern is illustrated for the component Nova on the left of Figure 4.

An error was accidentally introduced in this first version of the Madeus Open-Stack commissioning (0-deadlock ). This error was due to the label "register" of a transition in the component MariaDB. In all components containing the same label as a transition, this transition was using the service of the Keystone component (for service authentication). However, in MariaDB this registering step has to be performed with the component Common. In fact MariaDB is globally installed before Keystone. For this reason, an incorrect sub-assembly has been accidentally built. By executing MADA on the Madeus assembly the deadlock has been detected and a clear trace leading to the problem has been returned. This problem occurs when both MariaDB and Keystone are waiting for each other.

The version 1-naive solves the deadlock detected by MADA in 0-deadlock and keeps the exact same set of components as well as the same assembly. By using MADA it appears that such a design is quite naive as the maximum level of parallelism in Nova is actually 1 while we were expecting 3 (Table 2). The Gantt diagram generated by MADA, shown in Figure 5a, explains that the transition Nova config cannot be executed at the same time as Nova pull because it has to wait for MariaDB deploy that ends after Nova pull. Similarly, the transition Nova register cannot be executed at the same time as the two other tasks because it has to wait for Keystone deploy that ends after both Nova pull and Nova config. Furthermore, thanks to the MADA critical path (indicated in the caption of Figure 5a), one can note that Nova deploy plays an important part in the overall execution time and could probably be divided into parallel subtasks. This information offers a very useful help to the user to know where to look first in order to improve the efficiency of the commissioning. Without these pieces of information we could have wasted time to understand scripts of Glance deploy while it is not in the critical path. Then, the second version 2-nova focuses on dividing the transition Nova deploy in parallel tasks. It appears that two long tasks responsible for database schemes can be performed in parallel, namely Nova upg api db and Nova upg db. Moreover, one subtask of Nova deploy is independent from the other and can be added as a parallel task with Nova config, namely Nova create-db (see Figure 4). By using MADA, we verify that the level of parallelism in Nova is increased to 2. The Gantt diagram of Figure 5b obtained by MADA shows that both Nova upg api db and Nova upg db wait for Nova register to end which is the reason why Nova deploy starts very late. One can also note that Nova register is in the critical path. Thanks to these results we have noticed that the dependencies of the parallel task Nova register were not well defined as it is entirely independent from other tasks except the last one Nova deploy.

In the third version 3-nova we have solved this issue as illustrated in Figure 4, by defining Nova register as an overall parallel task. The Gantt diagram shown in Figure 5c demonstrates that tasks of Nova are no longer in the critical path. As shown in Table 2 the expected boundaries (i.e., according to time intervals) were [575, 615] for 1-naive and are [400, 423] for 3-nova. Finally, in the Gantt diagram and critical path of Figure 5c one can note that the transition MariaDB deploy is responsible for the delay of many other tasks such as Keystone deploy, for instance.

In the fourth version of the commissioning 4-nova-mdb the parallelization of MariaDB deploy has been studied. This task has been divided in four tasks namely MariaDB bootstrap, MariaDB restart, MariaDB register and MariaDB check. The transition MariaDB bootstrap can be run at the same time as the already defined MariaDB pull transition. Moreover, MariaDB register and Mari-aDB check can be executed simultaneously. The resulting Gantt diagram is depicted in Figure 5d with the following expected boundaries: [377, 398]. These boundaries are much better than the observed execution time, greater than 750 seconds, of the reference Kolla scripts.

Discussion

Does it work? To answer this question we have conducted real experiments on the OpenStack commissioning. Figure 6a shows the Gantt diagram generated from the traces of one of the real experiments on 4-nova-mdb (same as the one mentioned in Section 1). One can note that the obtained diagram is very close to the one computed by MADA with time intervals in Figure 5d and that the obtained critical path fits perfectly with the one returned by MADA. This result is also observed for other versions of the commissioning 1-naive, 2-nova and 3-nova, available in the git repository previously indicated. Moreover, the computed boundaries for all versions also perfectly match the real experiments.

For instance, the boundaries of 4-nova-mdb are [377, 398] and the execution time of the run of Figure 6a is 389.8. This confirms that the approach works and that the transformation is valid as well as its implementation. In addition, we would like to emphasize once again that MADA has been very useful in working in the right direction, where tasks can be divided, saving time by avoiding the unnecessary exploration of complex scripts. Finally, by using MADA a separation of concerns is possible between the design phase and the experimental phase of the commissioning. Thus, MADA could be considered as a formal simulator to help the user in the design phase that avoids the burden of real experiments and associated technical issues (e.g., machines provisioning, commands errors, timeouts etc.).

Time intervals. The goal of MADA is not to precisely compute the execution time of the distributed software commissioning but to help identify where efficiency improvements could be made. Accordingly, it is not necessary to be precise about time intervals. However, to provide a good insight of possible efficiency improvements to MADA users, the order of magnitude for each transition is needed. To illustrate this claim, Figure 6b shows the Gantt diagram obtained by using MADA on 4-nova-mdb with additional errors on the time intervals. Errors are introduced as follows: for tasks representing less than 5% of the total execution time (11 tasks) we have introduced 95% of error on the duration of the interval (e.g., [START_REF] Boucheneb | Optimal reachability in cost time petri nets[END_REF][START_REF] Brockmeyer | Tamagotchis need not die -verification of statemate designs[END_REF] becomes [START_REF] Basu | Modeling heterogeneous real-time components in bip[END_REF][START_REF] Cimatti | Software model checking via IC3[END_REF]). Similarly, for tasks representing respectively between 5-10% (11 tasks), 10-20% (2 tasks), 20-30% (3 tasks), 30-60% (2 tasks) of the execution time we have introduced 90%, 80%, 70%, 40% of error on the duration of the interval (e.g., [98,106] becomes [61,143]). This method introduces an error that may be substantial (up to 95%) but that does not change the order of magnitude of intervals. One can note that even with this high error on time intervals the Gantt diagram has almost the same shape and the critical path of the execution stays valid. We think that it may be difficult for systems operators to give a precise execution time for a given task. However, giving an order of magnitude through a time interval is much easier as most software installation scripts contain the same types of commands (human expertise). Furthermore, thanks to the high frequency with which system commands appear, machine learning algorithms could also be designed.

Scalability Most computations performed on bounded Petri nets (with or without time) have a PSPACE worst-case complexity. This can be observed in Table 2 where execution time of properties are depicted for each version according to its size. For an increase of the number of places and transitions in the Petri net of 15% the execution time of the deployability increases of 73%. We have however to consider a few additional elements in our assessment of the usability of the approach. First, OpenStack is a large system, thus many existing distributed systems can certainly be analyzed with this approach. Second, the generated Petri net itself can be made easier to analyze, depending on the property of interest. Third, the MADA approach is largely independent of the model checker used, and many techniques from the model checking community can be leveraged to improve performance such as partial orders [START_REF] Holzmann | An improvement in formal verification[END_REF], BDD-like data structures [START_REF] Bryant | Graph-based algorithms for boolean function manipulation[END_REF], SMT-based techniques [START_REF] Cimatti | Software model checking via IC3[END_REF], and lazy model checking [START_REF] Jezequel | Lazy reachability analysis in distributed systems[END_REF] contributions of the related work that provide some model checking execution time [START_REF] Henrio | Integrated Environment for Verifying and Running Distributed Components[END_REF][START_REF] Hinz | Transforming bpel to petri nets[END_REF] (50 minutes for BPEL, up to 47 minutes for Vercors), MADA execution times can be fairly considered acceptable compared to the burden of testing real experiments on infrastructures each time a modification is made in the assembly (up to 600 seconds). This is due to the fact that Madeus is a relatively small language compared to BPEL and Vercors because of its specificity for distributed software commissioning.

Related work

MADA is specifically conceived to help in the design of safe and efficient distributed software commissioning on top of Madeus. Indeed, concurrency and parallelism introduced by Madeus comes at a price. First, parallelism can introduce liveness violation such as deadlocks. Secondly, even if the parallelism coordination is ensured by Madeus, designing a parallel software commissioning from a sequential one is difficult. Indeed, subtasks of the commissioning procedures and dependencies between subtasks and software components have to be identified while their exact internal behavior are not well known by operators, because implemented by other developers. Moreover, most of the time commissioning scripts are difficult to read and system commands do not clearly expose their behaviors and functionalities. As far as we know, no existing software commissioning tool or academic model is equipped with a formal way to help the user solving such problems when designing installation procedures. This is in line with the fact that the parallelism capabilities of existing tools and models for automatic software commissioning are very limited compared to Aeolus and Madeus, almost sequential in fact. Thus, in this context liveness issues are impossible, and finding subtasks and dependencies is useless. The contribution of this paper could partially be useful and applicable to Aeolus. However, Aeolus and its satellites [START_REF] Di Cosmo | Automatic deployment of services in the Cloud with Aeolus Blender[END_REF] are not maintained and were not equipped with such integrated model checking.

Yet, using model checking to help in the design of safe distributed software (not software commissioning) has been extensively studied in the literature. For instance, formal methods have been used in the domain of software components. The Vercors framework [START_REF] Henrio | Integrated Environment for Verifying and Running Distributed Components[END_REF][START_REF] Barros | Model-checking distributed components: The vercors platform[END_REF] uses parameterized networks of asynchronous automata (pNets) as an intermediate formalism representing behaviors of distributed software components, statically analyzed by the CADP model checker. BIP [START_REF] Basu | Modeling heterogeneous real-time components in bip[END_REF] (Behavior, Interaction, Priority) was initially a component-based model for heterogeneous real-time and reactive systems, and has been extended for distributed systems with heterogeneous interactions through HDBIP [START_REF] Kobeissi | Facilitating the Implementation of Distributed Systems with Heterogeneous Interactions[END_REF]. In BIP, finite state automata are used to represent the behavior of components and their composition. In these contributions, formal methods are used to verify the functional behavior of distributed systems, which is very different from modeling and checking the execution and coordination of software commissioning procedures. In particular, MADA offers quantitative properties related to the concurrency and parallelism introduced within a commissioning execution. This cannot be modeled by Vercors nor BIP. Moreover, this kind of properties can be expressed by using time Petri nets as an intermediate representation of the commissioning execution semantics. Finally, neither Vercors nor BIP clearly explain how verification formulae are expressed by users while MADA automatically generates TCTL formulae from function calls. Some languages for defining business processes, BPEL [START_REF] Hinz | Transforming bpel to petri nets[END_REF] and BPMN [START_REF] Dijkman | Formal semantics and analysis of bpmn process models using petri nets[END_REF] for instance, have been straightforwardly translated to Petri nets such that a formal semantics can be offered to the user instead of natural language and UMLlike semantics. In both of these contributions the Petri net translation has also been used to check liveness and safety properties to detect bugs in user-defined processes. However, quantitative properties such as the one proposed by MADA are not offered because helping the user to improve the process efficiency is not a goal. Moreover, details are missing regarding how translations and properties are integrated in a user-friendly framework. MACE [START_REF] Killian | Mace: Language support for building distributed systems[END_REF] is another language example that uses formal methods. MACE combines objects, events and aspects programming to address in a single framework concurrency and failures when designing distributed software. Guiding the users in their task and hiding from them the intricate details of static analysis is in line with MADA. However, MACE is more complete and complex than MADA and addresses many different problems at the same time thus raising the complexity of the overall framework. In other words, MADA is specific to software commissioning while MACE solves multiple issues related to distributed software design. The model checking in MACE targets liveness violation only. Causality is addressed by MACE to find failures origins, however, this causality is based on automatic logging instead of model checking. MADA offers an interesting separation of concerns between the design phase and the testing phase on real infrastructures. Quantitative information such as the critical paths for efficiency analysis are studied through model checking thanks to time Petri nets.

Finally, related work has studied how to simplify for a non expert the way properties could be expressed. This is for example one of the contributions around Statemate [START_REF] Brockmeyer | Tamagotchis need not die -verification of statemate designs[END_REF] where timing diagrams are used to generate CTL formulae for verification on reactive systems. The two main differences with MADA are: first the generalization of properties thanks to five function signatures instead of defining one timing diagram for each property to check in Statemate, and second the specific application domain of MADA to distributed software commissioning.

Conclusion

In this paper MADA has been presented as a useful approach for introducing model checking to help system operators design their parallel distributed software commissioning. MADA has been evaluated on the real use case of Open-Stack which is a very large and complex distributed system. Moreover, comparisons with experiments on real infrastructures have shown the feasibility of the approach. Future work will be focused on using other model checking algorithms to improve the scalability of MADA. Moreover, MADA will be extended to help the user build fault-tolerant distributed software commissioning.

Fig. 1 :

 1 Fig. 1: A Madeus assembly of a server-client software commissioning. Each component (Server and Client) is composed of an internal-net associated to ports.

Fig. 3 :

 3 Fig. 3: Coarse-grain Madeus assembly of the OpenStack commissioning.

  0

Fig. 4 :

 4 Fig. 4: Nova component evolution thanks to the analysis with MADA.

Fig. 5 :

 5 Fig. 5: Gantt diagrams generated by the gantt boundaries property of MADA

Fig. 6 :

 6 Fig.6: Experiment on Grid'5000 and experiment with errors on intervals.

Table 2 :

 2 Results by using MADA on five different versions of OpenStack commissioning in Madeus.

https://www.ansible.com/

https://puppet.com

https://galaxy.ansible.com/

https://forge.puppet.com/

https://gitlab.inria.fr/Madeus/mad

https://www.openstack.org/

https://gitlab.inria.fr/hcoullon/mada