Jacques Simonet
email: jacques.simonet@univ-rennes1.fr

Viatcheslav Jouikov

used as cathodic interfaces for scission of carbon-halogen bonds. Application to the building of anthraquinone-Au electrodes

Keywords: Graphene, 2-Bromomethylanthraquinone, Anthraquinone electrodes. Graphenegold interface, Gold redox surfaces

Gold and gold-graphene used as cathodic interfaces for scission of carbon-halogen bonds. Application to the building of anthraquinone-Au electrodes

Introduction

In research of new solid electrodes for achieving specific reactions, carbon and platinum electrodes are classically employed [START_REF] Peters | Organic Electrochemistry[END_REF]. For building new surfaces by means of free radical addition, the electrocatalytic reduction of alkyl halides (generation of alkyl radicals) was achieved at carbons modified by thin deposits of palladium, silver or copper. In the field of aryl radicals, the reductive scission of chemical bonds (chemical or electrochemical, essentially with aryl diazonium salts) permits immobilization of aromatic moieties onto carbons and graphite [START_REF] Bélanger | [END_REF]3].

Until now, the use of gold for functional modifications is limited. However, it appears that an interesting behavior of gold lies in its propensity to undergo strong adsorption of organic molecules. Thus, it is known that linear alkanes adsorb at gold with binding energy of 14-81 kJ mol -1 [4]. Concerning organic halides, a metastable adsorption of MeI at Au(100) [5] occurs (in first layer) with the C-I bonds parallel to the surface, practically without decomposition. A pre-reaction of iodoalkanes with gold was also reported, creating Au-C and Au-I bonds [6]. Very recently [7], such behavior of Au towards RIs was used to develop a new cathodic reactivity of gold for building stable organic layers robustly immobilized at the metal interface.

At this stage, the reactivity of interfaces gold/carbons (the latter in the form of graphites, fullerenes, and graphenes) deserves quite certainly beto be considered. The main goal of this communication is to focus a new light on gold as a cathode material. Moreover, the interest for gold is increased if it is associated with a graphene thin layer at its surface and applied to the cathodic cleavage of activated organic bromides, in particular from the family of benzyl bromides.

The present preliminary study focuses on the behavior of 2-bromomethylanthraquinone (BMAQ) and underlines comparing two kinds of grafting AQ moieties onto smooth gold and gold-graphene. As is shown hereafter, these two different AQ redox surfaces presented here differ quite dramatically from those already reported concerning both the mode of grafting and the nature of the resulting interfaces [8][9][10][11][12][13]. This work points out the use of aqueous and non-aqueous systems, stability of the deposits, and the totally unexpected interesting catalytic synergy {graphene-gold} that could be developed in the scission of carbon-halogen bonds at high potentials for generating and trapping free radicals within very thin layers.

Experimental

Electrochemical procedure; salts and solvents

Solutions of tetra-n-butylammonium and tetramethylammonium tetrafluoroborates (TMABF 4 and TBABF 4 ) in dimethylformamide (DMF) were used. The supporting salt concentration was 0.1 M. It is worth mentioning that the procedures given hereafter did not need extremely dry solutions (water content <1000 ppm). All electrochemical experiments were performed under inert atmosphere with bubbling of dry argon through the solution. The potentials are given versus aqueous Ag/AgCl/KCl (sat) . The electrochemical instrumentation has been previously described [7].

Working electrodes

The electrodes used for voltammetry had apparent surface areas of 0.8 mm 2 . Before being used as electrode materials, gold surfaces were carefully polished with silicon carbide paper (Struers 500 and 1200) or with Norton polishing paper (type 02 and 03) and rinsed with water, alcohol and acetone. Finally, each electrode was dried with a hot air flow during about 30 s.

Coulometric measurements and electrolyses of alkyl iodides reported in this work were carried out using three-electrode cells with a total catholyte volume of 5 to 10 mL. A fritted glass separated the two compartments.

Gold electrodes were prepared by sealing a gold wire in a glass tube with a non-electroactive glue (Torrseal, Varian), non soluble in DMF. Graphene was purchased from XG Sciences as XGnP Graphene Nanoplatelets-Grade C typically consisting of submicron platelets (particle diameter < 2µm, with thickness of a few nm). The average surface is of the order of 750 m 2 /g and TEM images permit one to detect almost transparent platelets. Oxygen content was < 2 wt % while that of carbon > 98.0 wt %. The deposition of graphene onto gold was achieved by firmly rubbing the metal electrode onto a glassy cardboard on which was dispersed a few mg of graphene. The electrode is ready to use when a transparent carbon film is covering the gold electrode. The thickness of the graphene film is estimated to be less than 1 µm.

Organic materials

2-Bromomethylanthraquinone (BMAQ) solvents, and supporting salts were purchased from Aldrich.

Results

The BMAQ was reduced under two fundamentally different conditions: (i) at smooth gold electrodes and (ii) at smooth gold covered by a very thin graphene layer. As mentioned above, the interest of graphene is both in accelerating catalytic scission of C-Br bond by gold and in trapping (to a large extent) AQ-CH 2

• radicals formed in the electrochemical process that takes place at the interface.

The reduction at gold (DMF/0.1M TBABF 4 ) is displayed in Figure 1, curve A1.

During the first scan, irreversible step a (E p = -0.58 V) is assigned to the reduction of the C-Br bond adsorbed at Au BMAQ. Two following steps correspond to the reversible reduction of the AQ moiety to give AQ radical anion and dianion (E p = -0.82 and -1.44V, respectively). In the second scan, the layer formed by grafting of the adsorbed BMAQ inhibits electron transfer at a and one observes then a large increase of the reversible reduction of free BMAQ possibly provoked by the redox catalysis brought by the AQ group. This assumption is confirmed by voltammetry of the modified surface obtained by dipping the Au electrode in a solution of BMAQ in DMF (with following rinsing and sonication) that shows the two steps of AQ. After holding the potential at the level of step a (or by fixed potential electrolysis at 0.6 V passing 0.310 -3 C), the redox behavior of the modified Au surface is shown in curve A2, Figure 1;

steps I and II are assigned to the reversible formation of AQ -and AQ = (with the main step I depicting a two-electron transition (E red = -0.75V and E ox = -0.72V). Repetitive scans show the robustness of the grafting. The prominence of the two-electron step is partly due to traces of moisture in the electrolyte, but essentially owing to Hofmann degradation (protonation of the dianion by the salt producing residual acidity at the surface during the oxidation scans). On the basis of the two-electron step (main reduction and oxidation), the superficial concentration of AQ could be calculated: Г AQ = (4.3±0.2)10 -10 mol cm -2 . Those values are very close to those reported for adsorbed long-chain alkanethiols bearing ferrocene and tetrathiafulvalenes [14,15], suggesting that almost pure grafting processes occur (therefore implying a quasiabsence of multilayers that might be due to non-selectivity of the addition of free radicals).

When BMAQ reduction was carried out at gold electrodes whose surfaces were doped with a very thin layer of graphene, a quite different grafting process was observed, with the immobilization of the AQ moiety onto the whole active surface (including graphene). First of all, the reduction of BMAQ takes place at a potential much less negative than that observed at bare Au (peak b, E p = -0.40V) along with a minor step a (Figure 1, B1) suggesting that a double activation may occur, one by graphene, the other by Au. It is expected that the reduction at the level of b corresponds to the catalytic reduction of the organic substrate and to the formation of a free radical (reaction 1, Scheme 1) at the graphene-Au interface (quite probably according to a synergistic effect) followed by a fast addition of this radical to graphene, acting as a radical trap. Consequently, neither inhibition of the Au surface described above nor the catalytic process induced by the grafted AQ layer takes place. Grafted AQ moieties are then principally immobilized within the carbon layer in quite high concentration and the catalytic efficiency of this new 3D AQ electrode may predict interesting perspectives in terms of catalysis. The coverage of the electrode by AQ appears robust, and currents in the course of repetitive scans stabilize quite fast: in TMABF 4 , in the absence of a large protonation by the salt, two sharp reversible steps are observed (Curve D, Figure 2) E I red = -0.92V, E I ox = -0. 82V and E II red = -1.29 V, E II ox = -1.20V. Current integration of the first one-electron peak (half-width 130 mV) suggests that the apparent superficial AQ concentration is quite large, 4.010 -8 mol cm -2 , which implies that the graphene layer incorporates about 50 to 100 equivalents of AQ immobilized in a monolayer at smooth gold.

The robustness of AQ anchoring onto Au-graphene was checked in buffered aqueous solutions (Figure 2, pH 5.5 and 10). Only large reversible two-electron steps could be seenwith a small shift between cathodic and anodic steps (E red -E ox = 100 mV) assigned to the motion of species within the graphene layers. The superficial concentration of immobilized AQ moieties was found to be Г AQ = (3.0 ±0.5)10 -8 mol cm -2 and is therefore quite close to those found above. The peak currents are linear with the scan rate ν.

Surface reflectance FTIR spectroscopy (Figure 2E) of the modified interfaces attests to the presence of the AQ moiety by its characteristic amide I and II bands. EIS measurements (Figure 2F) reveal an inhomogeneity of the immobilized graphene-anthraquinone layer: the zones with charge transfer resistance R CT of 520 , 9.1 and 164 k, related to three capacitive elements with different time constants, are distinctly seen in a Bode phase angle plot. Supposedly, their formation is governed by complex interplay of the grafting kinetics versus diffusion and steric demand, leading to three kinds of sub-structures within the immobilized 3D layer. Without graphene, the anthraquinone layer deposited at gold does not create substantial impedance to the charge transfer so only a diffusional low-frequency branch is revealed at these frequencies (Figure 2E,23).

Conclusion

The present work underlines that anthraquinone can be immobilized under a very simple and efficient procedure, on gold either bare or doped by thin graphene layers. The chosen method based on cathodic scission of the C-Br bond of in 2-bromomethylanthraquinone, and it appears that the grafting efficiency stems from the catalytic synergy brought on by both Au and graphene. At smooth gold, almost ideal mono-layers are obtained while coverage of gold with graphene yields 3D AQ-electrodes. The great interest of graphene specifically associated to gold arises from the addition of large amounts of radicals onto this material that remains conducting. This permits one to conceive new redox interfaces with graphene-based layers easily modifiable by a large palette of functions, that are could appear very useful for achieving many kinds of catalysis.

Figure 1 (

 1 Figure 1 (A1) Voltammetry (two first scans) of BMAQ (8.910 -3 mol L -1 in DMF/0.1M TBABF 4 ) at stationary gold cathode (area: 0.8 mm 2 ). Scan rate 50 mV s -1 . (A2) Response of the deposit (in DMF/0.1M TBABF 4 ) at gold after the potential hold at -0.6 V for 1 min. Scan rate 200 mV s -1 . (B1) Voltammetry of BMAQ (7.810 -3 mol L -1 in DMF/0.1M TBABF 4 ) at gold/graphene. (B2) Response after the potential hold at -0.3 V.

Figure 2 Deposition

 2 Figure 2

Scheme 1


Alexandru-Robert Guduvan
email: alexandru-robert.guduvan@cassidian.com

Hélène Waeselynck
email: helene.waeselynck@laas.fr

Virginie Wiels
email: virginie.wiels@onera.fr

Guy Durrieu
email: guy.durrieu@onera.fr

Yann Fusero
email: yann.fusero@cassidian.com

Michel Schieber
email: michel.schieber@cassidian.com

STELAE -A Model-Driven Test Development Environment for Avionics Systems

Keywords: test development, test language, test model, modeldriven engineering, development environment, automatic code generation I

In this paper we present STELAE, a model-driven test development environment for avionics embedded systems, implemented on top of a real integration test platform. It is the result of an R&D project between two research laboratories and a test solution provider, aiming to introduce model-driven engineering methodologies and technologies for the development of tests. Our work was motivated by the multiplicity of proprietary test languages in this industrial context, which no longer respond to the stakeholder needs. We present the early prototype functionalities (test model definition, automatic code generation and execution) on a case study inspired from real-life. Our feedback on the used technologies concludes this paper.

INTRODUCTION

This work deals with the implementation of tests for avionics embedded systems. The current practice is heterogeneous, as it involves a multiplicity of in-house test languages to code the tests. Test solution providers, equipment/system providers and aircraft manufacturers all have their own proprietary test languages and associated tools. No standardized test language has emerged, in contrast to other fields that use international standards, for example: the Abbreviated Test Language for All Systems (ATLAS) [START_REF]IEEE Standard Test Language for All Systems -Common/Abbreviated Test Language for All Systems (C/ATLAS)[END_REF] and the Automatic Test Markup Language (ATML) [START_REF]IEEE Standard for Automatic Test Markup Language (ATML) for Exchanging Automatic Test Equipment and Test Information via XML[END_REF] standards in hardware testing or the Testing and Test Control Notation Version 3 (TTCN-3) [START_REF]ES 201 873[END_REF] in the field of telecommunication protocols and distributed systems. These standards are not designed to address the specificities of our industrial context and as such are not directly reusable. The multiplicity of proprietary test languages is challenging for the different stakeholders of the avionics industry. Test solution providers have to accommodate the habits of different clients. The exchange of tests between aircraft manufacturers and equipment/system providers is hindered. A number of highlevel needs (portability, maintainability and customizability) are not answered by existing solutions.

These issues have been the basis for launching a three-year R&D project involving a test solution provider and two research laboratories. The aim is to introduce a model-driven approach for test development, responding to this wide range of needs. Model-driven engineering is a means to abstract away from the existing proprietary implementation solutions. It promotes the central role of platform-independent models in the development activity: models are developed, maintained and shared. The proposed shift from test code to test models is driven by the fact that test software is indeed software, and that test development can benefit from advanced software engineering methodologies [START_REF] Stahl | Model-Driven Software Development: Technology, Engineering, Management[END_REF].

The approach is based on the definition of a meta-model that captures the domain-specific concepts and constrains the building of models, in the same way that a language grammar constrains the writing of code. The employed meta-modeling technology also gave us access to a wide range of free opensource tools that led to the rapid development of our prototype, called STELAE (Systems TEst LAnguage Environment). STELAE gave us the opportunity to experiment with model-driven engineering and associated technologies. This first prototype allows us to demonstrate different test engineer activities:

 The definition of test models conforming to a test meta-model. We presented the test meta-model in [START_REF] Guduvan | A Meta-Model for Tests of Avionics Embedded Systems[END_REF]. We defined it using Ecore [START_REF]Eclipse Modeling -EMFT -Home[END_REF]. The test meta-model integrates a rich set of domain-specific concepts identified by our analysis of a set of proprietary test languages [START_REF] Guduvan | Test Languages for In-the-Loop Testing of Avionic Embedded Systems[END_REF]. Test models are also analyzed according to a set of rules we defined in the Object Constraint Language (OCL) [START_REF] Ocl | Object Constraint Language, Version 2.3.1[END_REF]. The definition of test models is performed:

o In a graphical editor for structural test elements. The graphical editor was developed using the Eclipse Modeling Framework (EMF) [START_REF]Eclipse Modeling -EMFT -Home[END_REF].

o In a textual editor for behavioral test elements. The textual editor was developed using Xtext [START_REF]Xtext[END_REF].

 The implementation of test models through model-totext transformations with template-based automatic code generation. We used Acceleo [START_REF]Acceleo[END_REF] for the implementation. The target is a Python-based executable test language developed at Cassidian Test & Services.

 The execution of the automatically generated files and code on top of a real integration test platform: the U-TEST Real-Time System [START_REF] Cassidian | [END_REF] developed by Cassidian Test & Services.

This paper presents the functionalities of STELAE on a case study inspired from real-life. It also gives our feedback on the open-source model-driven engineering technologies with which we experimented.

Section II introduces the industrial context. Section III presents a case study with two test cases that will guide the rest of the paper. Sections IV to VII discuss the functionalities offered by STELAE to test engineers, exemplified on the case study. Section VIII deals with related work. Section IX comprises our feedback on the different technologies that were employed and concludes this paper.

II. INDUSTRIAL CONTEXT

An avionics embedded system is typically a distributed system, with interconnected hardware elements: interconnected processors, memory modules, input/output cards, power supply devices, and others. Software elements running on the processors implement the functional logic. Among the verification and validation activities (for an overview see [START_REF] Ott | System Testing in the Avionics Domain[END_REF]) that accompany the system development process our focus is on the in-the-loop testing phases, which come in various forms: model/software/hardware-in-the-loop.

Avionics embedded systems have a predominantly reactive behavior: there are execution cycles to read the input data and compute the output ones. The system functionalities cannot be exercised unless all expected inputs are received from the environment at each cycle, with some time tolerance. This is the motivation for in-the-loop testing: the system under test (SUT) is coupled to a model of its environment that produces the data, together forming a (cyclic) closed-loop system.

As mentioned previously, standard test languages used in other fields are not directly reusable in ours. ATLAS and ATML target electronic circuitry manufacturing defects, detected by applying electrical signals at various places inside the circuit; while TTCN-3 targets the testing of open-loop systems, which are quiescent unless activated by some asynchronous messages.

In the avionics domain, communication between system components is achieved by buses, such as: AFDX (Avionics Full-Duplex Switched Ethernet) or ARINC 429 (Aeronautical Radio, Incorporated). The interfaces of a system are defined inside an Interface Control Document (ICD) (Figure 1). This document is organized into several hierarchical levels. Lower levels comprise connectors with pins. They are followed by buses attached to the pins. The higher levels comprise bus messages transporting application parameters as payload. As application parameters are meaningful to engineers, they are also called engineer variables. We shall refer to them as such in the rest of the paper. ICD elements are distinguished by unique string identifiers built from a path name traversing the tree-like structure of the ICD. Such identifiers provide an abstraction for accessing the SUT interfaces. For an engineer variable, an identifier would have the generic form:

'SUT/BUS/MESSAGE/ENG_VARIABLE'.

Various predefined test actions can be applied to SUT interfaces, at all of the ICD hierarchical levels (e.g. set/getValue() and timed stimulations, such as ramp(), for engineer variables; fault injection: start/stopEmission() on a bus).

In order to propose a model-driven approach for the development of tests for the in-the-loop testing of avionics embedded systems, we had to define the test meta-model underlying the approach. First we analyzed the current practice, by looking at the features offered by a sample of test languages currently deployed [START_REF] Guduvan | Test Languages for In-the-Loop Testing of Avionic Embedded Systems[END_REF]. The domain-specific concepts issued from this analysis were afterwards integrated within the test meta-model [START_REF] Guduvan | A Meta-Model for Tests of Avionics Embedded Systems[END_REF]. In this paper we focus on the prototype test model development environment we implemented, which is called STELAE.

III. CASE STUDY

For our demonstration of the STELAE functionalities, we chose a case study inspired from a real one targeting the ADIRS (Air Data Inertial Reference System) [START_REF] Durrieu | LETO -A Lustre-Based Test Oracle for Airbus Critical Systems[END_REF]. We developed a simulation of part of the ADIRS behavior. We implemented this case study on a real integration test platform: U-TEST Real-Time System [START_REF] Cassidian | [END_REF]. We chose the ADIRSinspired case study as it allowed us to demonstrate a number of domain-specific concepts that we integrated in the test metamodel (e.g., timed stimulations such as sine, the cycle-by-cycle test component). We also tested our approach on a real case study targeting the Flight Warning System, where we verify the synthesis of a global alarm from partial alarms in an aircraft engine fire situation. We do not present it in this paper as it would have allowed us to show only a limited number of concepts in comparison with the ADIRS case study.

ADIRS deals with the acquisition of several engineer variables necessary for the flight control system (e.g., altitude, speed, angle of attack). For each of these engineer variables redundant sensors exist and a consolidated value is computed from the set of available input values.

We deal here with the aircraft speed engineer variable. The values of three input engineer variables (AC_SPEED_1/2/3) are used to compute the value of the output consolidated engineer variable (AC_SPEED). The ADIRS logic is the following:

 Nominal behavior: The consolidated value is the median of the three input values, if the median does not diverge from the other two values. The divergence is measured as the differences between the median value and the other two values. The median is divergent if these differences exceed a certain threshold.

 Degraded behavior: If the median of the three input values diverges from the remaining two for more than three cycles, then the source having produced the median is permanently eliminated. The consolidated value is the average of the remaining two values.

For this system under test, we consider here two test cases verifying the behavior:

 Nominal behavior test case: Verify that the consolidated value remains equal to the median of the three input values in the presence of a small-amplitude sine oscillation that does not render the three input values divergent.

 Degraded behavior test case: Inject a divergence on one of the three input values and verify that the consolidated value is equal to the average of the two remaining values. Verify that the divergent source is permanently eliminated, even if the divergence is corrected.

These test cases should be executed on all combinations of input engineer variables.

For exemplification purposes, we assume that our simplified ADIRS employs ARINC 429 buses for transporting its input and output engineer variables.

IV. TEST SOLUTION PROVIDER AND USER SEPARATION

One of the main architectural choices we made was to separate the elements related to the test solution provider from those related to the test solution user inside the test metamodel. A high-level view of the test meta-model structure can be found in Figure 2. This separation allows the test solution provider to easily customize and maintain the test solution, by rendering available to test solution users different SUT interface types (e.g., types of buses, messages, engineer variables) and associated test actions (e.g. set and get the value of an engineer variable, start and stop the emission on a bus).

For our case study, let us assume that the following elements are already available to the test engineer: the AFDX bus type and the float engineer variables with the following predefined test actions: setValue(), getValue() and generateRampSignal(). But the test engineer will also need access to the ARINC 429 bus type and to the generateSineSignal() test action on float engineer variables. Consequently, the test solution provider can add them to the list of already existing ones using our predefined extension points. Test actions that do not correspond to interactions with the SUT are distributed inside toolkit structures. Such an example is the waitDuration() functionality, attached to a time management toolkit, that the test solution provider also makes available. Figure 3 shows the functionalities that are rendered available by the test solution provider for the example discussed above. In STELAE, a password-based access control system restricts access to the test solution provider section.

Once these elements are rendered available by the test solution provider, they can be used by the test engineers in order to model the ICD of their SUT and to call test actions on its different interface elements. For the definition of the structural aspects, the test engineer employs the graphical editor (Figure 8.a). For our prototype this editor is basic. It comprises a tree-like navigable view of test structural elements, with contextual menus and input data fields. In order to begin modeling the two test cases of our case study, the test engineer must first define a test context. A test context is a container for test cases applied to a SUT, together with an architecture of test components. This concept is inspired from the UML Testing Profile [START_REF] Utp | UML Testing Profile[END_REF]. A conceptual view can be found in Figure 4. We call the elements of a test context high-level structural elements.

Test components are executable elements that run in parallel during a test. They can access the interfaces of the SUT and call test actions. In addition, they also have access to an external pool of events (i.e., for synchronization) and shared data (i.e., for communication). For fault avoidance purposes, we defined a one producermany consumers policy. Clashes can thus be detected by means of OCL rules, for example when several test components target a same SUT interface with test actions that have side effects. Notice the SideEffectType attribute in the "Properties" view in Figure 3.

A test component can be instantiated several times inside a test case, with the test case being in control of the execution of each test component instance. Only the test case is able to start, stop or pause the execution of a test component instance.

For ever higher reuse capabilities, test components possess formal interfaces that we call accessors. It is the test architecture associated to a test case that indicates the connection between the formal interfaces and the interfaces of the SUT or the pool of events and shared data. In order to render the test components reusable, we add four formal interfaces to each one: three for the first input engineer variables (First_IN, Second_IN and Third_IN) and one for the output engineer variable (OUT). The connection to the corresponding permutations of input and output engineer variables of the ADIRS is defined within the test architectures owned by the test cases. Figure 4 shows the corresponding conceptual view for the nominal test case.

VI. TEST BEHAVIOR MODELING

Two types of behavior can be modeled: for the test case and for the test components.

Test cases are in charge of controlling the execution of test component instances. In our simplified case study the test cases execute a startExecutableElement() command on the two test component instances.

Let us now look at our two test components. First it is important to mention that our analysis of test languages revealed the fact that test engineers are accustomed to using high-level predefined test component constructs that hide the low-level multi-threading aspects. We identified three types of test components: simple ones such as sequential test components and test monitors, as well as the timed periodic test component type. A periodic test component executes the same behavior periodically, while the test monitor has a simple behavior of the form condition-> action. A cycle-by-cycle test component comprises elements that allow test engineers to precisely define the behavior of the test component "synchronized" with each cycle of the SUT, such as: cycle, repeated cycle or iterated cycle. A cycle has a behavior to be executed only once, for one of the SUT cycles. A repeated cycle has a behavior to be executed several times, depending on the evaluation of a logical condition. For fault avoidance purposes, we constrain the repeated cycle to be bound by a maximum number of times it is executed. An iterated cycle has a behavior to be executed for a fixed number of times. Figure 5 exemplifies the cycle-by-cycle behavior for the Degraded_Component test component. First the ADIRS is initialized with coherent values for the three input engineer variables. Next, one of the inputs is rendered divergent and the fact that the divergent source has been eliminated after three cycles is verified. Finally the divergent source is rendered coherent and the fact that it remains permanently eliminated is verified. Figure 6 shows the corresponding model in the STELAE graphical editor, while Figure 7 shows the behavior of the Initialization cycle in the STELAE textual editor. It is important to mention that the concrete syntax found in Figure 7 We also implemented some fault avoidance functionalities in STELAE, in order to identify and help in the removal of test model problems, at design level. We previously gave an example concerning clash detection.

In addition, a partition for specifiable behavior was defined on the different low-level structural elements depending on the test component type to which they are attached. For example, loops are always bounded in the case of periodic and cycle-bycycle test components, while this constraint is relaxed for sequential test components, where bounding is only optional.

For our periodic and cycle-by-cycle test components we also defined verifications that guarantee that the corresponding behavior is executed within the different periodicity time constraints. For example, we verify that the execution of the statements within a cycle does not exceed the duration of the cycle. If this happens, then the runtime automatically sets the verdict to error, informing the test engineer that the performance expected for the execution of the test was not met by the test platform. In addition to these verifications performed at runtime, we can also analyze the correctness of the test specification. For example, if a test action on a SUT interface, such as sine, is called within a cycle with a duration higher than the duration of the cycle, then it is clear that this specification is incorrect. This problem would be detected at runtime, but it is more useful to detect it before. In the case of the Degraded_Component such a rule is validated trivially, as we have no timed test actions that are being called. The OCL rules that we defined allowed us to analyze aspects such as those mentioned above.

VII. STELAE ENVIRONMENT OVERVIEW

Figure 8.a shows a screenshot of STELAE with the graphical ("UserData" view) and textual editors ("Behavior" view), on the Nominal_TestCase example. The "Console" view shows the execution traces of the automatically generated code for the Degraded_TestCase. Notice the two pass local verdicts corresponding to the two verifications inside the Degraded_Component. The "Tests Management" view shows the two test cases with their corresponding global verdicts (both are pass). The automatically generated files are seen on the left ("Model Projects" view). As mentioned previously, the STELAE prototype was integrated into the real integration test platform U-TEST Real-Time System [START_REF] Cassidian | [END_REF] developed by Cassidian Test & Services. STELAE was plugged in the Man-Machine Interface (MMI) software component of the test platform as an Eclipse perspective. The automatic code generation targeted a real Python-based test language executable on the test platform.

The graphical editor offers intelligent contextual menus and data input fields, while the textual editor offers syntax checking, auto-completion and code coloration functionalities.

As can be seen in Figure 8.athe central tree-like editor, we implemented several other test cases for the ADIRS in order to test our approach. This figure also shows the test context for our second case study concerning the Flight Warning System (FWS).

For the Nominal_TestCase, Figure 8.b shows the "Runtime" perspective of the U-TEST MMI component, where we can observe the modification of the values for our different application parameters during execution. The "Array" view on the left comprises a list of engineer variables that we observe during the execution of the tests. Notice the three AC_SPEED_1/2/3_STATUS variables. They are internal to our simulation of the ADIRS (i.e., not part of the ICD), corresponding to whether a source was eliminated or not because of its divergence from the other two. We rendered them observable in order to see the internal state of the simulated SUT. Notice the sine timed stimulation on AC_SPEED_2 in the first "Oscilloscope" view. The second "Oscilloscope" shows the values for the AC_SPEED_1/2/3_STATUS variables. The last "Oscilloscope" view shows the value for the AC_SPEED_OUT engineer variable. Notice its constant value, not influenced by the minor sine fluctuations on one of the input engineer variables.

VIII. RELATED WORK

Model-driven engineering is an active field of research. We focus here on work addressing the use of model-driven engineering for the development and implementation of tests. Work addressing the selection of abstract tests from system models (model-based testing) is outside the scope.

Most existing work on test development solutions uses UML for the test models. Many projects have addressed the integration of the standardized UML Testing Profile [START_REF] Utp | UML Testing Profile[END_REF] and TTCN-3 [START_REF]ES 201 873[END_REF]. Among these projects, [START_REF] Zander | From U2TP models to executable tests with TTCN-3: An approach to model driven testing[END_REF] uses the profile in order to produce TTCN-3 code (or code skeletons). In addition, a meta-model for TTCN-3 can be found in [START_REF] Schieferdecker | A Meta-model for TTCN-3[END_REF], later encapsulated within the TTworkbench platform [START_REF]TTworkbench -The Reliable Test Automation Platform, Testing Technologies[END_REF]. A similar project at Motorola [START_REF] Baker | Testing UML2.0 Models Using TTCN-3 and the UML2.0 Testing Profile[END_REF] uses the TAU tool suite [START_REF] Tau | [END_REF]. Some authors proposed their own UML profiles. A UML profile and model transformations for web applications testing is discussed in [START_REF] Hernandez | A Metamodel to Support Regression Testing of Web Applications[END_REF]. In avionics, UML-based modeling of simulation software for model-in-the-loop testing is proposed in [START_REF] Yin | On modeling approach for embedded real-time software simulation testing[END_REF]. Also in avionics, [START_REF] Efkemann | Model-Based Testing for the Second Generation of Integrated Modular Avionics[END_REF] proposes test models conforming to a test meta-model (integrating automata-based formalisms), for the second generation of Integrated Modular Avionics (IMA). Previous work by the same authors includes automatabased test modeling for their RT-Tester platform [START_REF]RT-Tester 6.X Product Information[END_REF] [START_REF] Dahlweid | Automated Testing with RT-Tester -Theoretical Issus Driven by Practical Needs[END_REF].

Neither UTP and UML, nor the various standardized test languages deployed in other domains do not offer the specific concepts our test engineers require. Moreover, UML does not seem to be a solution showcased by our industrial context. Consequently, the domain-specific concepts derived from our analysis of current practice were integrated inside our own test meta-model.

IX. FEEDBACK ON USED TECHNOLOGIES

The completion of STELAE required a total effort of 12 man-months. A team of five people, with four distinct roles, was involved in the project: the test meta-model architect, a software architect, a project manager and a developer. The distribution of the required effort for the different parts of our work was as follows: Most of the effort concerned the definition of the test metamodel. One of the challenges was to homogenously integrate all of the domain-specific concepts we had previously identified. We achieved this objective, but the resulting test meta-model is complex. It currently contains 190 EClass elements representing the different concepts. 340 EAttribute and EReference elements formalize their different characteristics and relations. 18 EENum elements were included as well. The size of the test meta-model exceeds that of other meta-models or domain-specific languages discussed in literature. For future industrialization purposes this complexity could be avoided by developing wizards to guide the test engineer and automatically instantiate a skeleton test model.

The development of the graphical and textual editors was very fast, as this first prototype required only basic functionalities. In their current state, the editors do not yet offer test engineers all the functionalities/shortcuts they would need. Our evaluation of the development of richer, more ergonomic editors, with technologies such as Graphical Modeling Framework (GMF) or Graphiti [START_REF]Graphiti Home[END_REF], leads us to believe that an industrial product would require a much greater effort than that for our first prototype. One challenging issue we encountered when developing the two editors was to ensure their synchronization. The current state of the technology is not optimized for a usage of several editors synchronized on a same model.

As mentioned previously, we used model to text transformations for the implementation of our test models. The automatic code generation from test models to test language files and code is quasi-instantaneous.

A well-known approach for an easy and rapid definition of automatic code generation templates is to first select a source simple example (in our case the test cases of the case study), then define the expected target (what the corresponding files and code are) and only afterwards develop the templates that map the two [START_REF] Czarnecki | Feature-based survey of model transformation approaches[END_REF]. Our experience confirms this, as we encountered no difficulty when developing the templates while being guided by the use case. Currently, 40% of the concepts present in the test meta-model have been implemented. The missing concepts where not implemented as the simple/medium complexity case study did not require them. Moreover, we targeted a relatively young test language that only offered access to the application parameter level of the SUT interfaces. Consequently, concepts related to the bus and message ICD hierarchical levels could not be implemented. For the implemented concepts we defined a total of 75 Acceleo modules, each with one template.

In conclusion, with limited previous experience with model-driven technologies, the STELAE project workgroup succeeded in the implementation of a first prototype. We can currently demonstrate the test model definition, automatic code generation and execution of simple to medium complexity test cases, on a real integration test platform. "Runtime" Perspective

Figure 1 .

 1 Figure 1. ADIRS-Inspired ICD Example Snippet

Figure 2 .

 2 Figure 2. Test Meta-Model High-Level View

Figure 3 .

 3 Figure 3. Test Solution Provider -SUT Interface Types and Test Actions

For

  our case study, a test engineer would define a unique ADIRS_Validation test context, comprising the two test cases: Nominal_TestCase and Degraded_TestCase. Two test components are added as well to the test context: Nominal_Component and Degraded_Component. Each test component is instantiated once within each previously mentioned test cases: Nominal_Component_1 and respectively Degraded_Component_1.

  Following discussions with test engineers, we also defined a new test component type: the cycle-by-cycle test component. The test meta-model integrates all of these test component types, although we illustrate only two of them in this paper. The Nominal_Component is a sequential test component, while the Degraded_Component is a cycle-by-cycle test component. The sequential test component executes its behavior only once, while the cycle-by-cycle test component has different behaviors for each SUT execution cycle or set of cycles. It can be "synchronized" with the SUT execution cycles.

Figure 4 .

 4 Figure 4. Conceptual View of the Test Context Each test component type has its behavior organized inside low-level structural elements. A sequential test component organizes its behavior within sequential blocks. The sequential blocks are executed one after the other, with each sequential block comprising a list of statements. Each sequential block can correspond to a different phase performed during a test, such as SUT initialization and stimulation. We defined three sequential blocks for the Nominal_Component sequential test component: Initialization, Stimulation and Behavior. The first sequential block initializes the SUT by setting three coherent values for the three input engineer variables (First/Second/Third_IN). Notice that we refer here to the formal interfaces of the test component. The second

  is only an example, as several ones can be defined for the test meta-model, catering to the individual needs and tastes of the different users. It is worthy to mention that special instructions are used for verifications of the SUT behavior inside a test component (e.g., for verifying that the output value is the median). The results of these verifications lead to the definition of a test verdict. A test verdict can have one of the five following possible values, among which an order relation was defined: none > pass > inconclusive > fail > error. This relation allows the automatic synthesis of a global verdict from local ones: the verdict of a test case is computed from the verdict of the different test component instances it possesses. For this verdict management we took inspiration from TTCN-3 [3]. In the Degraded_Component we have two verifications. If one of these verifications leads to a pass and the other to a fail then the local verdict of the test component is fail. As our Degraded_TestCase only has one test component instance, then its global verdict would be fail as well.

Figure 5 .Figure 6 .Figure 7 .

 567 Figure 5. Degraded_Component Behavior Description

Figure 8

 8 Figure 8.a. "STELAE" Perspective

ACKNOWLEDGEMENTS

The authors would like to thank all those implicated in the STELAE project: Gilles BALLANGER, Guilhem BONNAFOUS, Mathieu GARCIA and Etienne ALLOGO.


Alexandre Krupa
email: alexandre.krupa@inria.fr

3D steering of a flexible needle by visual servoing

Keywords:

published or not. The documents may come

3D steering of a flexible needle by visual servoing

Introduction

The needle is a tool used in many medical procedures as for example aspiration biopsy for cancer diagnosis. However, steering a needle requires a lot of skills from the clinician in order to reach the target successfully. A new community of researchers are currently working to provide robotic assistance solutions and more particularly for steering bevel-tip flexible needles [START_REF] Reed | Robot-assisted needle steering[END_REF]. By applying a translation motion to this kind of needle, this later bends during the insertion due to asymmetric forces exerted by the soft tissue onto the beveled tip. As a consequence the needle follows an arc in a 2D plane as reported in [START_REF] Webster | Nonholonomic modeling of needle steering[END_REF][START_REF] Misra | Mechanics of flexible needles robotically steered through soft tissue[END_REF]. This bending becomes an advantage for targeting anatomical elements that were not possible to reach with a standard rigid needle. Several research works have therefore been conducted to automatically steer a flexible needle actuated by a robot. In most approaches a path planning initial step based on inverse kinematics is required to predict the needle trajectory. A finite element mesh was also considered in [START_REF] Alterovitz | Planning for steerable bevel-tip needle insertion through 2d soft tissue with obstacles[END_REF] to predict soft tissue deformations and plan the path thanks to a numerical optimization. Probabilistic methods were also tested, like the Rapidly-Exploring-Random Tree (RRT) algorithm [START_REF] Lavalle | Randomized kinodynamic planning[END_REF], or the Stochastic roadmap [START_REF] Alterovitz | The stochastic motion roadmap: A sampling framework for planning with markov motion uncertainty[END_REF]. In [START_REF] Minhas | Modeling of needle steering via duty-cycled spinning[END_REF] a kinematic model was proposed for bevel-tip needle steering by constantly spinning the needle during its insertion. This model allows proportional control of the needle curvature and was used in a control-loop that online adapts the evolution of the needle trajectory along an arc in a 2D plane [START_REF] Wood | Needle steering system using dutycycled rotation for percutaneous kidney access[END_REF]. Other approaches based on the RRT algorithm were proposed to take into account obstacles during the path planning. For example, a RRT algorithm with backchaining was presented in [START_REF] Xu | Motion planning for steerable needles in 3d environments with obstacles using rapidly-exploring random trees and backchaining[END_REF] to steer the needle in 3D with obstacle avoidance. More recently, a combination of the RRT algorithm and duty-cycling control technique was proposed in [START_REF] Bernardes | Robot-assisted automatic insertion of steerable needles with closed-loop imaging feedback and intraoperative trajectory replanning[END_REF] for needle steering in a 2D plane. In this paper, we propose a new approach to steer a needle in 3D that has several advantages. First, it does not require a trajectory planning that can be time consuming. Second, it does not constraint the needle to follow a succession of planar arcs but allows non planar 3D trajectories. Third, with the proposed method the direct control of the two lateral angular velocities and the insertion velocity of the needle extremity is possible. This last point is crucial since, in opposite to approaches based on path planning, it opens numerous control scheme possibilities as for example visual control using the classical framework of visual servoing [START_REF] Chaumette | Visual servo control, part i: Basic approaches[END_REF]. The paper is organized as follows. Section 2 presents the kinematic model of the flexible needle and recalls the principle of the classic 2D duty-cycling control technique. We present in Section 3 our 3D duty-cycling strategy that allows to control the two lateral angular velocities and the insertion velocity of the needle. Section 4 presents the control scheme we propose for automatic soft tissue targeting using visual servoing. Finally, experimental results on the visual targeting task are reported and discussed in section 5.

Needle kinematic model and duty-cycling technique

Let F n and F w be respectively a Cartesian frame attached to the needle tip and the world frame as shown in Figure 1a. We describe the 3D pose p (with p ∈ SE(3)) of the needle tip with respect to F w by the homogeneous 4 × 4 transformation matrix :

w M n = w R n w T n 0 [1×3] 1 (1)
where w R n is a 3 × 3 rotation matrix representing the orientation of respect to F w and w T n is the 3× 1 translation vector defining the origin of F n in F w . We also denote the instantaneous screw velocity vector (n) v n of the needle frame F n with respect to the world F w . It is composed by the translational velocities (n) v x , (n) v y , (n) v z along each axis of F n and the angular velocities (n) ω x , (n) ω y , (n) ω z around each axis. Note that the upper script (n) indicates that this velocity is expressed in the frame F n . If we apply a forward insertion motion to the needle, then this later can only move in the plane y-z of F n . Thus, the velocity components (n) v x , (n) v y , (n) ω y are constraint to be null and only the insertion velocity (n) v z , and angular spin velocity (n) ω z can be applied by the user to steer the needle. As experimentally demonstrated in [START_REF] Webster | Nonholonomic modeling of needle steering[END_REF], the bending effect due to the asymmetric beveled tip introduces a rotation velocity around the x axis of F n that depends on the insertion velocity and natural curvature K of the needle such as

F n with r -! y n -! z n -! x w -! y w -! z w ω z v z F n F w (a) F w F w -→ x w -→ y w -→ z w -→ z w θ y θ x O O N N
ω x = K (n) v z .
The screw velocity vector is therefore linked to the needle input velocities by the following kinematic relation that expresses the nonholonomic contraints:

(n) v n = 0 0 1 K 0 0 0 0 0 0 0 1 T (n) v z (n) ω z (2)
The duty cycling method [START_REF] Minhas | Modeling of needle steering via duty-cycled spinning[END_REF] was introduced to allow the proportional control of the curvature of a bevel-tip needle during insertion. It works by alternating between time period T trans of pure insertion where the needle will follow an arc of maximum curvature K, with time period T rot of both insertion and rotation, where the needle will follow a helical curve. This later becomes a straight line if the rotation velocity is highly superior than the insertion velocity. Those two phases compose a cycle of period T = T rot + T trans . Therefore, it is possible to obtain a desired effective needle curvature K ef f = K(1 -DC) by controlling the duty-cycle ratio DC = Trot T . In [START_REF] Wood | Needle steering system using dutycycled rotation for percutaneous kidney access[END_REF][START_REF] Bernardes | Robot-assisted automatic insertion of steerable needles with closed-loop imaging feedback and intraoperative trajectory replanning[END_REF] this method has been implemented by inserting during each cycle the needle on a constant fixed distance ∆z, and by applying a constant rotational velocity ω z = ω c such as:

T rot = 2π ω c , T trans = T rot (1 -DC) DC , v z = ∆z T (3)
However, this technique applies a complete rotation (2π rad) during each cycle of period T which restricts the needle to evolve only in a plane.

3D duty-cycling new strategy

To overcome this limitation and allow a 3D trajectory that is not composed from a succession of 2D planar arcs, we propose a new duty-cycle strategy. Let us consider a new cartesian frame F ñ attached to the needle that corresponds to the current needle frame rotated with an angle θ around the z axis of F n . By expressing the rotational velocity of F ñ in F n and using the relation (2) with the effective curvature K ef f we obtain the following relation that links the angular velocity of F n to the needle input velocities (ñ) v z and (ñ) ω z expressed in

F ñ:   (n) ω x (n) ω y (n) ω z   =   cos(θ) -sin(θ) 0 sin(θ) cos(θ) 0 0 0 1     K ef f (ñ) v z 0 (ñ) ω z   (4)
As F ñ and F n have the same origin and their z-axis are aligned, we have (n) v z = (ñ) v z that we replace in (4) to formulate the angular velocity of F n by:

(n) ω x = cos(θ)K ef f (n) v z and (n) ω y = sin(θ)K ef f (n) v z (5)
One can notice that it is therefore possible to control the velocities (n) ω x and (n) ω y at each cycle period T by applying an angle θ around its z-axis before inserting the needle and applying then the desired curvature such as:

θ = atan( (n) ω y / (n) ω x ) and K ef f = ( (n) ω 2 x + (n) ω 2 y )/ (n) v z (6)
Note that if (n) v z is null we set K ef f = 0 since the needle is not moving in this case. In practice, our 3D duty-cycling approach is performed by the following successive steps:

1) measure the current absolute needle spin angle: θ a 2) compute the desired absolute spin angle to achieve by accumulating 2π rad and the control angle input θ given by eq. ( 6) such as: θ a = θ a + 2π + θ 3) compute the desired period T rot and desired spin angular velocity profile (n) ω z needed to achieve θ a based on a trapezoidal acceleration profile with a nominal needle spin velocity of ω c 4) compute the desired insertion distance ∆z = (n) v z T rot 5) perform the rotation and insertion thanks to the position-based robot lowlevel controller to reach the desired angle θ a and translation ∆ z 6) measure the real period T rot that was taken by the system 7) compute the desired duty-cycle ratio DC = 1 -K ef f /K with K ef f given by [START_REF] Alterovitz | The stochastic motion roadmap: A sampling framework for planning with markov motion uncertainty[END_REF], the desired pure translation period T trans = T rot (1 -DC)/DC and the desired insertion distance ∆z = (n) v z T trans 8) perform the insertion thanks to the position-based robot low-level controller to reach the desired relative translation ∆ z 9) go back to step 1) to start a new cycle.

Automatic targeting by visual servoing

We consider that a 3D image containing the needle is available thanks for example to the use of a 3D ultrasound probe. It is therefore possible to extract the shape of the needle by performing some image processing. We will not detail any method to extract the needle but the reader can refer for example to the RANSAC-based approach proposed in [START_REF] Uhercik | Model fitting using ransac for surgical tool localization in 3-d ultrasound images[END_REF]. By the use of such extraction algorithm it is therefore possible to obtain the current location of the needle tip point that we denoted N of coordinates w T n = (t nx , t ny , t nz ) and its tip direction orientation w R n with respect to the world frame F w . As the target coordinates that we denote w T o = (t ox , t oy , t oz ) are expressed in the world frame F w and not directly in the needle frame F n , it is more suitable to express the needle lateral angular control velocities in the fixed world frame F w . The lateral angular velocities applied to the needle frame will then be obtained from the lateral control velocities (w) ω x , (w) ω y expressed in F w thanks to the following relation:

(

n) ω x (n) ω y = w R n [2×2] T (w) ω x (w) ω y (7)
where

w R n [2×2]
T is the transpose of the [2 × 2] upper-left part of w R n . To perform the targeting task we propose to apply a constant needle insertion velocity (n) v z = v c and online adapt the angular control velocities (w) ω x , (w) ω y by visual servoing in such a way to orientate the needle z-axis toward the target. The set of visual features that we chose is s = (l xz , l yz ) where l xz and l yz are respectively the distances between the target point O and their orthogonal projections onto the needle line direction projected in the x-z plane and y-z plane of F w as shown in Figure 1b. Let us denote d xz and d yz the distances of the projections of vector --→ N O into the x-z plane and y-z plane of F w . We also define θ x and θ y as being respectively the angles around the world frame x and y axes that describe the relative orientation of the vector --→ N O with respect to needle unitary orientation vector w u (see Figure 1b). Note that all these geometrical features can be easily computed from the measured 3D positions of the needle and target. The visual features can therefore be obtained from: l xz = d xz sin(θ y ) and l yz = -d yz sin(θ x ). The visual servoing task consists then in aligning the needle line direction on the target by regulating s to the desired value s * = (0, 0). As we previously mentioned, one important advantage of our new 3D duty-cycling strategy is that we can apply the classical framework of visual servoing [START_REF] Chaumette | Visual servo control, part i: Basic approaches[END_REF]. Therefore we first determine the image jacobian J that relates the variation ṡ of the selected visual features to the needle velocity inputs and obtain the following expression from basic angular kinematic relationships:

ṡ = lxz lyz = J ωxy J vz =J   (w) ω x (w) ω y (n) v z   with J ωxy = 0 cos(θ y )d xz -cos(θ x )d yz 0
(8) and J vz = 0 0

T . Finally we applied the following classical control law that gives the control angular velocity inputs in such a way to obtain an exponential decrease of the visual error e = ss * :

(w) ω x (w) ω y = -λJ -1 ωxy e where λ > 0 is a proportional gain. ( 9)

Experimental results

The experiment setup is presented in Figure 1c. It is composed of a 6-DOF anthropomorphic robot holding a 22 gauge bevel-tip flexible aspiration biopsy needle of 20 cm length (Angiotech Chiba MCN2208). A homemade translucent gelatin phantom built relatively less flexible than the needle (assuring the model non-holonomic assumption) is employed to simulate a piece of organic soft tissues and is observed by two orthogonal video cameras. The cameras are used to perform a 3D localization of the needle tip, but another image modality could be used as for example 3D ultrasound as we plan to consider in future work. The flat screen monitor positioned behind the phantom is used to illuminate the phantom. The image processing and robot motion control is implemented on a PC equiped with a Dual-core 2.4 Ghz Intel Pentium. The needle tip 3D location is measured by first thresholding the images and applying basic morphological operations (erosion, dilatation). Then an algorithm that extracts connected pixels is employed to retain only the pixels corresponding to the needle shape. The tip location and direction vector of the needle is then computed in each image and their 3D coordinates are obtained thanks to the intrinsic parameters of the two calibrated cameras. We coarsely fixed the natural curvature value of the needle that is used in the control to K = 2 m -1 (corresponding to a radius of 0.5 m). In all experiments we applied a constant insertion velocity of 1 mm/s and the control gain of the visual servoing was empirically set to λ = 0.02. In order to simulate a target point in the phantom we manually inserted another needle from an entry point realized on a lateral wall of the phantom as shown in the bottom of the camera views presented in Figure 2. This allows us to obtain the target 3D coordinates ground truth by clicking on the tip of this motionless needle in the two images. We performed 25 trials of our automatic targeting task by visual servoing with different target positions that were fixed in a 3D region that is reachable by the needle. For each experiment the entry point of the needle actuated by the robot was slightly shifted for avoiding insertion in a previous hole of the phantom. For all these trials the target was successfully reached. Figure 2 3c shows the evolution of the distance between the needle tip and target and Figures 3d-3e show the projection of the needle trajectory onto the x-z and y-z planes of F w . The evolution of the duty-cycling control ratio DC input applied to our 3D duty-cycling low-level controller is reported in Figure 3f. The results also experimentally demonstrate that the targeting task by visual servoing is robust to modelling errors since we do not consider the torsional effect of the needle in its kinematic model and we employ a coarse estimated constant value of its natural curvature.

Conclusion

In this paper we presented a new duty-cycling strategy that allows to control the insertion velocity and the two lateral angular velocities of a bevel-tip flexible needle. Experimental results demonstrate the efficiency of our approach to steer the needle to reach a 3D target directly by visual servoing without relying like other methods on a computationally expensive path planning that generates a trajectory composed from successive planar arcs. We are currently implementing our approach to automatically steer a flexible needle by ultrasound visual servoing thanks to the use of a 3D ultrasound probe. We are also planning to design a hierarchical multi-task control law for obstacle avoidance.

Fig. 1 .

 1 Fig. 1. (a) needle beveled tip modeled by an unicycle following an arc of radius r. (b) Geometry of selected visual features. (c) Experimental setup.

Fig. 2 .

 2 Fig. 2. (a) right camera (x-z plane) and (b) left camera (y-z plane) views of the needle trajectory obtained with the targeting task by visual servoing for one trial. (c) right and left (d) views obtained for another trial. The extracted shape of the actuated needle is displayed in red and the needle tip location is shown by the green cross. The red cross corresponds to the target that was defined by indicating in the images the location of the tip of a second motionless needle that was previously manually inserted. One can see the hole in the phantom performed by other previous trials which also successfully reached the target.

Fig. 3 .

 3 Fig. 3. Results of one trial of the targeting task by visual servoing: (a)-(b) visual features errors. (c) distance between the needle and target. (d)-(e) obtained needle 3D trajectory projected in the x-z and y-z world frame planes. (f) applied duty-cycling ratio with a lower saturation of 0.2 to limit the period time of pure translation.

Table 1 .

 1 presents the needle trajectories observed in the left and right images Mean, standard deviation, maximum and minimum values of the final positioning error derror of the needle tip with respect to the target obtained from the 25 automatic targeting trials.for two trials. One can see that the target depicted by the red cross is perfectly reached by the needle tip. Table1reports the mean, the standard deviation, the maximum and minimum of the final positioning error that are obtained from the 25 trials. This error is defined as the euclidiean norm d error of the distance between the target and the needle tip. The evolutions of the visual errors for the trial corresponding to the views of Figures2a-2bare presented in Figures3a-3b. They correspond as expected to exponential decreases toward zero. Figure

	Mean (mm) Standard deviation (mm) Max (mm) Min (mm)
	0.432	0.262	1.023	0.113