Alexandre Cortier

Jean-Paul P Bodeveix

M Filali

Gérald Garcia

E Morand

Marc Pantel

Ana-Elena E Rugina

Martin Strecker

Jean-Pierre P Talpin

Synoptic: a DSML for On-Board Real-Time Software Design

Keywords: IDM, DSML, Embedded Systems, synchronous semantics

niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

A satellite is an unmanned spacecraft. The system architecture is usually specialized according to the satellite mission. There are two main subsystems: the payload is an application equipment such as specific scientific instrumentation for instance; the platform consists of mechanical structure, sensors and actuators used by the payload and devices for communication with ground stations. The ANR SPaCIFY exploratory project focuses on the flight software embedded in the satellite to manage its platform, also called on-board software. The flight software is a real-time software that provides services that are common to whatever missionspecific payload the spacecraft is assigned. Typical services include reaching and following the desired attitude and orbit, managing thermal regulation systems, power sources, monitoring system status, managing on-board network (MIL-STD-1553, OBDH, SpaceWire), and communicating with ground stations. Even after the satellite has been launched, flight software must be adapted. Satellites are subject to high energy particles that may damage hardware components. Such damages cannot be fixed except by installing software workarounds. Bug fixes and software updates should be propagated to flying satellites. In addition, mission extensions may require functional enhancements. As flight software is critical to the success of the mission, space industries and agencies have worked on engineering processes in order to help increase reliability. For instance, the European Space Agency has published standards (ECSS-E-40) on software engineering and (ECSS-Q-ST-80) on product assurance. These standards do not prescribe a specific process. They rather formalize documents, list requirements of the process and assign responsibilities to involved partners. Regarding updates, standards stipulate for instance that the type, scope and criticality must be documented; that updates must be validated; and so on. Industries are free to come up with their own conforming processes. The SPaCIFY project aims to define such a process and supporting tools based on Model-Driven Engineering (MDE), synchronous languages and the Globally Asynchronous Locally Synchronous System (GALS) paradigm.

Models used

Two main kinds of models are commonly used in order to design the platform software: on the one hand, the description of the platform itself, its hardware and software architecture, CPU, memory, storage, communication buses, sensors, actuators, hardware communication facilities, operating system, tasks, software communication facilities, and on the other hand, the command and control algorithms involved in the management of the platform. All these models have common features. First, the notion of mode is central to represent the various states or configurations of both hardware and software (for example: init, reset, on, low power, failure, safe). The modes and their management are usually expressed using finite automata. Second, the functional blocks, data exchange buses and signals are used to represent both the hardware and software architectures, and the command and control software. However, the current models only provide a partial account of the constraints that the final system must satisfy. The designers usually encode these hidden constraints using the available constructs in the modeling languages, even if this was not the initial purpose of the construct used. This is usually the case for hard real-time constraints. The designers will rely on explicit management of the control-flow in dataflow models in order to manage the concurrency between the activities. But, the real timing constraints are not explicitly given in the model, they are handled by the designers who sequence the activities, but there is no real specification of the intended result. Thus it requires a very difficult verification phase that can only occur on the final target. This is the current main difficulty: using model constructs for other purposes than their intended ones without any formal, model-level traceability to the initial constraints.

Currently, industrial main actors are relying on the Matlab toolboxes, Simulink and Stateflow from the MathWorks [START_REF]Simulation and Model-Based Design[END_REF] for expressing the command and control algorithms for the various sub-systems of the platform. These models are built by command and control engineers taking into account several kinds of constraints:  the hardware which is usually known very early (in particular if it handles timing and synchronization constraints related to sensors and actuators, which must be activated and will produce results in very precise timing patterns);  the system mode management that impacts the execution of the various sub-systems;  the specification of the intended sub-system.

The Simulink and Stateflow toolboxes allow a very wide range of modeling methods, from continuous partial differential equations to graphical functional specifications. Each industrial actor has a well defined process which defines the restricted subset of the modeling language that will be used at each phase of the development cycle. In the ITEA GeneAuto project [START_REF] Toom | GeneAuto: An Automatic Code Generator for a safe subset of SimuLink/StateFlow[END_REF], a subset of these toolboxes was defined that fits the needs for the modeling of space applications from early design to automated target code generation. The industrial partners of SPaCIFY took also part in GeneAuto. This subset aimed at providing a solid semantic background that would ease the understanding and the formal verification of models. This subset was chosen as an entry point for the design of the Synoptic language. One key point is the use of control-flow signals and events (called in Simulink function call events) in order to manage explicitly the sequencing of the blocks in dataflow models. This is an important point which is significantly different on the semantics side from the classical dataflow modeling languages such as SCADE [START_REF] Dormoy | Scade 6: a model based solution for safety critical software development[END_REF] or RT-Builder [START_REF]RT-Builder : solutions for Real-Time design, modeling and analysis of complex, multiprocessors and multi-bus systems and software[END_REF] which do not provide a specific modeling construct for this purpose, but allow to encode it through empty data signals that are added between each block in the intended sequencing path. The key point is that the intended hard real-time constraints are not explicit. Thus it is mandatory to handle the control-flow construct exactly in its usual semantics not using an approximate encoding which only works most of the time but is not proven to work in all cases. Several studies have been conducted by industrial main actors regarding the modeling of hardware and software architecture. HOOD [START_REF] Peter | Hierarchical object-oriented design[END_REF] and CCM [START_REF]CORBA Component Model 4.0 Specification[END_REF] have been used for many real projects; AADL [START_REF] Rolland | AADL modes for space software[END_REF][START_REF]As-2 Embedded Computing Systems Committee SAE: "Architecture Analysis & Design Language (AADL)[END_REF], SysML [START_REF] Friedenthal | A Practical Guide to SysML: The Systems Modeling Language[END_REF] and UML/MARTE [START_REF]A UML Profile for MARTE, Beta 2[END_REF] have been evaluated using already existing projects that could be modeled and the results compared with the real systems. Once again, these languages provide a very wide range of modeling constructs that must be reduced or organized in order to be manageable. In the European ASSERT project [START_REF]ASSERT Project: Automated proof-based System and Software Engineering for Real-Time Systems[END_REF], two tracks were experimented related to these languages, one mainly synchronous based on the LUSTRE [START_REF] Halbwachs | The synchronous dataflow programming language LUSTRE[END_REF] and SIGNAL [START_REF] Le | Polychrony for System Design[END_REF] languages, the other mainly asynchronous based on the RAVENSCAR Ada [START_REF] Burns | Guide for the use of the Ada Ravenscar Profile in high integrity systems[END_REF] profile. The industrial partners from SPaCIFY were also part of ASSERT. Thus, the results of these experiments were also used as entry points for the design of the Synoptic language. In the current software development process, command and control models are formal specifications for the software development. These specifications have been validated by command and control engineers by using model simulators. The hardware architecture is currently defined in a semiformal manner through structured documents. In the near future, models in AADL, or in a subset of SysML/UML/MARTE similar to AADL, will be used to give a formal specification of the architecture. Then, software engineers either develop the software and verify its conformance to the specification, or use automated code generators; the software is then split in parts that are mapped to threads from the RTOS. They are then scheduled according to the real-time constraints. The know-how of engineers lies in finding the best splitting, mapping and scheduling in order to minimize the resources used. One of the purposes of introducing Model Driven Engineering is to be able to automate partly these manual transformations and the verification that their result satisfies the specification. The Synoptic language should thus allow importing command and controlling models expressed in Simulink/Stateflow, and hardware architecture models expressed in AADL. The associated toolset should assist in the reorganization of the model, and allow to express the mapping and scheduling. The satellite management software is usually divided in parts that are quite autonomous one from the other, even if they share the same platform and resources. Inside each of these parts, the subparts are most of the time strongly linked and must cooperate in a synchronous manner. These parts usually exchange information but with less time critical constraints, thus relying on asynchronous exchanges. This kind of system is usually called Globally Asynchronous, Locally Synchronous (GALS).

Synoptic : DSML for aerospace systems

GALS systems

The SPaCIFY approach involves the design and development of such systems using a GALS architecture dedicated to space. Fig. 1 shows the high level architecture used by the consortium. The flight software consists of a set of subsystems, called synchronous islands, which encapsulates the main functionalities of the system as the Attitude and Orbit Control System (AOCS). These blocks can communicate with each other, with other equipment or with the ground station via the middleware services. The middleware is built on a real-time kernel that provides basic services such as tasks management and synchronization primitives. The middleware provides high level services such as a PUS interpreter (Packet Utilization Standard) [START_REF]ECSS-E-70-41 -Telemetry & Telecommand -Packet Utilisation[END_REF] responsible for routing telecommands to other services.

The main abstraction service provided by the middleware is the concept of external variables. External variables are used as interfaces between the application tasks of the flight software (i.e. synchronous islands) and the services of the middleware. The external variables are instantiated in the source code as memory cells which are associated with specific treatments. The treatments performed are defined by the configuration of the middleware, in particular through contracts specified in the design. In such an architecture, the middleware provides a synchronous abstraction of the real-world to the application tasks of the system. He is responsible for ensuring the synchronization of read and write access to external variables in order to guarantee the determinism of synchronous islands.

Synoptic overview

Synoptic is a Domain Specific Modeling Language (DSML) designed to cover a large part of embedded flight-software design. As such, Synoptic consists of heterogeneous modeling and programming principles defined in collaboration with the industrial partners and end users of the SPaCIFY project. Used as the central modeling language of the SPaCIFY model driven engineering process, Synoptic allows describing different layers of abstraction: at the highest level, the software architecture models the functional decomposition of the flight software. This is mapped to a dynamic architecture which defines the thread structure of the software. It consists of a set of threads, where each thread is characterized by properties such as its frequency, priority and activation pattern (periodic, sporadic). At the lowest level, the hardware architecture permits to define devices (processors, sensors, actuators, busses) and their properties. Synoptic permits to describe three types of mappings between these layers (Fig. 2):  mappings which define a correspondence between the software and the dynamic architecture, by specifying which blocks are executed by which threads;  mappings which describe the correspondences between the dynamic and hardware architecture, by specifying which threads are executed by which processor:  and mappings which describe a correspondence between the software and hardware architecture, by specifying which data is transported by which bus for instance.

Our aim is to synthesize as much of these mappings as possible, for example by appealing to internal or external schedulers. However, to allow for human intervention, it is possible to give a fine-grained mapping, thus overriding or bypassing machinegenerated schedules.

Anyway, consistency of the resulting dynamic architecture is verified by the SPaCIFY tool suite, based on the properties of the software and dynamic model. At each step of the development process, it is also useful to model different abstraction levels of the system under design inside a same layer (functional, dynamic or hardware architecture). Synoptic covers this capability by providing an incremental design framework and refinement features.

To summarize, Synoptic deals with dataflow diagrams, mode automata, blocks, components, dynamic and hardware architecture, mapping and timing. In this section we focus on the functional part of the Synoptic language which permits to model software architecture. This sub-language is well adapted to model synchronous islands and to specify interaction points between these islands and the middleware platform using the concept of external variables. Synchronous islands and middleware form a Globally Asynchronous and Locally Synchronous (GALS) system. Software architecture. The development of the Synoptic software architecture language has been tightly coordinated with the definition of the GeneAuto language [START_REF]Altarica Project[END_REF]. Synoptic uses essentially two types of modules, called blocks in Synoptic, which can be mutually nested: dataflow diagrams and mode automata. Nesting favors a hierarchical design and allows to view the description at different levels of details. By embedding blocks in the states of state machines, one can elegantly model operational modes: each state represents a mode, and transitions correspond to mode changes. In each mode, the system may be composed of other sub-blocks or have different connection patterns among components.

Apart from structural and behavioral aspects, the Synoptic software architecture language allows to define temporal properties of blocks. For instance, a block can be parameterized with a frequency and a worst case execution time which are taken into account in the mapping onto the dynamic architecture.

Synchronous formal semantics

Synoptic has a formal semantics, defined in terms of the synchronous language SIGNAL [START_REF] Talpin | Modular interpretation of heterogeneous modeling diagrams into synchronous equations using static single assignment[END_REF]. On the one hand, this allows for neat integration of verification environments for ascertaining properties of the system under development. On the other hand, a formal semantics makes it possible to encode the meta-model in a proof assistant. In this sense, Synoptic will profit from the formal correctness proof and subsequent certification of a code generator that is under way in the GeneAuto project.

Synoptic is equipped with an assertion language that allows to state desired properties of the model under development. We are mainly interested in properties that permit to express, for example, coherence of the modes such as : 'if component X is in mode m 1 , then component Y is in mode m 2 or can eventually move into mode m 2 '. Specific transformations extract these properties and pass them to the verification tools Altarica [START_REF]Altarica Project[END_REF]. Block Interface. A block interface consists of communication ports. A port can be either an event port or a data port and is characterized by its direction (in or out). Data ports can be typed using simple data types. However, typing data ports is optional in the early stages of design to give the designer the flexibility to describe abstract models. As shown in Fig. 3, which represents a part of the Synoptic meta-model, it is possible to encapsulate a set of ports within a single entity called group of ports (PortGroup in Fig. 4). 4). In the latter case, the model is abstract: the designer must implement all the block interfaces used to type sub-blocks in order to obtain a concrete model. As such, Synoptic environment design promotes a top-down approach.

Automata. An automaton block models state machines. A Synoptic automaton consists of states and transitions. As for dataflow, a state can be represented by an instance of dataflow, automaton or block interface. Dataflow diagrams and automata can be hierarchically nested; this allows for a compact modeling of operational modes.

Apart from the ongoing actions of automata (block embedded in state), it is possible to specify entry and exit actions in an imperative style. Transitions between are guarded and equipped with actions. There are two types of transitions in Synoptic: strong and weak transitions. Strong transitions are used to compute the current state of the automaton (before entering the state), whereas weak transitions are used to compute the state for the next instant. More precisely, the guards of weak transitions are evaluated to estimate the state for the next instant, and the guards of strong transitions whose source is the state estimated at the previous instant, are evaluated to determine the current state.

Externals.

A common practice in software industry is the re-use of external source code: designers must be able to introduce blocks representing existing source code into the model. Moreover, for modeling flight software functional units, it is necessary to use primitive operations such as addition, cosine, division... Synoptic provides the concept of external block to model primitive blocks and external source code. Primitive blocks are encapsulated in a Synoptic library. The Synoptic tool suit recognizes these primitive operations during code generation. For embedding an external source code, the procedure is quite different. The designer must build his own external block by defining its interface, by giving the source code path which will be used at code generation time, and by specifying pre/post conditions and the Worst Case Execution Time of the functional unit.

Example. Fig. 6 shows the graphical decomposition of the nominal mode of the Attitude and Orbit Control System (AOCS/NM) depicted in (Fig. 3 (c)). The header of the block tells us that NM is an instance of the NM_dtf dataflow block. In nominal mode, AOCS can either use its sun pointing sensors (SUP) to define its position or, during eclipse, use its geocentric pointing sensors (GAP). To model this activity, the nominal mode of the AOCS flight software encapsulates two sub-blocks: one dataflow block (TEST_ECLIPSE) which detects an eclipse occurrence and one automaton block (SUP_OR_GAP) which ensures the change of submode (SUP or GAP) depending on the outcome of the eclipse test block.

Modelling synchronous islands of GALS systems

A functional model consists of synchronous islands. A synchronous island is a synchronous functional unit in interaction with the middleware. The middleware supports the execution of code generated from the Synoptic model: it provides a synchronous abstraction of the asynchronous real world. To ensure proper integration of the generated code with the middleware platform, it is essential to locate all interactions between the middleware and the application. Our approach is to locate all these interactions into a single concept in Synoptic: the concept of external variables.

External variables allow to represent in Synoptic models the following domain specific and technical concepts: telecommand, telemetry, constants database systems, shared variables and persistent variables (on reboot). The specification of external variables is used for code generation and middleware configuration. Therefore a Synoptic synchronous island is a block in which all input and output signals are connected to external variables. The OBSW block of our case study is one such synchronous island, Fig. 3 (b).

Contractual approach.

An external variable is a variable managed by the middleware. It can be read or written by multiple clients (components of the application). Contracts are used to specify how to control this access. The configuration of an external variable is done using four levels of contracts:  a classical syntactic contract that includes its name and type ;  a remote access contract (through telemetry) ;  a persistence contract that specifies if the variable is persistent on reboot or not ;  a synchronization contract that describes the possible concurrent interactions when the variable is shared. Each component using such a variable must also provide a usage contract that defines the protocol it will use to access the variable. These contracts allow the middleware to manage these variables. Thus, the synchronization contract will indicate if locks are needed and when they should be used. The persistence contract will indicate how the variable should be stored (RAM or permanent memory). The monitoring functions of the variable that the middleware must implement are defined by the remote access contract and the usage contracts.

Control and temporal properties

As described before, blocks are functional units of compilation and execution. Block execution is controlled using two specific control ports: trigger and reset ports. These ports are inherited from the Simulink/Stateflow approach. These ports appear as black triangles in the upper left of the block, Fig. 3 and6. Trigger port. The trigger port is an event port. The occurrence of a trigger event starts the execution of the block and its specification may then operate at its own pace until the next trigger is signaled. Subblocks have their own trigger control ports and can thus operate at a different rate. Without event signal connecting its control port, a sub-block inherits the control signals of its parent block. Explicit clock and adaptors. The trigger port stands for the clock of the block. In our case study, the trigger control port of blocks is never connected: the clock of the block is explicitly defined using a period or a frequency property. Adding this frequency property is semantically equivalent to connecting the trigger control port with a 20 Hz clock. By convention, all input signals of the block are synchronized with the trigger of the parent block. This constraint may be too strict: it is thus possible to redefine the frequency of ports by adding an explicit property of frequency. Note however that the clock of ports must be a down-sampling of the parent trigger. Explicitly specifying a real-time constraint on ports and blocks can lead to difficulties when specifying a flow between two ports with different frequencies. Synoptic tools are able to detect such clock errors. The designer should use pre-defined clock adaptors to resample the signal, Fig. 6. Besides frequency properties, it is possible to specify the phase and the Worst Case Execution Time (WCET) of a block.

Reset port.

The reset port is a Boolean data port whose clock is a down sampling of the trigger signal. The reset signal forces the block to reset its state and variables to initial values.

Properties specification

Synoptic is equipped with an assertion language to state desired properties of the model under development. This assertion language makes it possible to express invariants, pre-and postconditions on blocks. Invariants are used to express coherence of modes. For instance, a typical assertion that we want to prove on the case study model is that if the MCS block is in SAFE mode, then the AOCS block is also in SAFE mode. Such an assertion is described in Synoptic as follows:

(OBSW.MCS.state=SAFE) (OBSW.AOCS.state=SAFE)

The Synoptic environment provides a tool to extract Synoptic models and their associated properties and pass them to the Altarica model-checker [START_REF]Altarica Project[END_REF]. Preand post-conditions can be either statically or dynamically tested. In the latter case, monitoring functions are implemented in the final software and raise events when properties are not satisfied. Monitoring functions are distinguished from assertion properties by raising an event to its environment when the property is not satisfied:  assertion : pre : a>10 ;  monitoring : pre : a>10 raise e! ; Here, a stand for an input data port and e for an event port and e! for an event emission on e port.

Synoptic components

Synoptic supports modular system development and parametric components. The latter are particularly useful for an incremental design and gradual refinement, using predefined development patterns. As mentioned in 3.2, there are two main categories of components: dataflow blocks and automata blocks. They exist on the type level (interfaces) and on the element level (instances). Components can be parametric, in the sense that a block can take other elements as arguments. Parametric components are similar to functors in ML-style programming languages, but parameters are not limited to be blocks. They can, among others,  be integers, thus allowing for variable-sized arrays whose length is only fixed during compile time  be types, thus allowing for type genericity as in Java 5 [START_REF] Gosling | Java(TM) Language Specification[END_REF].

 be entire components, thus allowing for component assembly from more elementary blocks.

Syntactically, the parameters of a block are specified after a requires clause, the publicly visible elements made available by the block follow in a provides clause, and there may be a private part, as shown in Fig. 7. Parameter types can be equipped with properties such as temporal properties. Instantiating these types gives rise to proof obligations, depending on the underlying logic. In some cases, an exact match between the formal parameter component and the actual argument component is not required. In this case, a mechanism comparable to a type cast comes into play: Take, for example, the case of a component C 20| triggered at 20Hz (as in Fig. 6) that is to be used by a parametric component C 10| operating at 10Hz. Component C 20| can be used as argument of C 10| , and a default frequency splitter will be synthesized that adapts the frequency of the C 20| to C 10| .

Incremental design and refinement features

The Synoptic environment promotes a top-down approach including incremental design and refinement features. In first steps of design, Synoptic allows to describe an abstract model. For instance, the designer can describe abstract interfaces where data ports are not typed and connect instances of these interfaces in a dataflow diagram. In a second step, the designer can refine its modelling by typing the block interfaces. The block interface can be then implemented with dataflow or automaton blocks. These features of the Synoptic environment are mainly 'edition refinement' which allows the designer to model a system in an incremental way. In doing so, the designer loses the link between the different levels of refinement: when the model is concretized, the initial abstract model is not preserved and therefore cannot be accessed. Synoptic offers a way to specify refinement and to keep a formal link between an abstract model and its concretization. As depicted in the metamodel, Synoptic provides two types of refinements: flow refinement and block refinement, Fig. 8. A flow refinement consists of refining a flow with a dataflow block. To be properly defined, the flow must be declared as abstract and the dataflow block must have a single input port and a single output port correctly typed. A block refinement consists of refining a block instance with a dataflow block. The main use of this type of refinement is to concretize an interface block with a dataflow.

Example. Fig. 9 illustrates a flow refinement. The first model is an abstract view of the global architecture of the case study. To consider this fact, flows are specified as abstract. The same applies to the flows between OBSW and actuators. Moreover, a real-time requirement is added to the flows: <<delay ≤ 20 µs >>. This requirement represents the maximum age of data: data consumed by OBSW must be aged less than 20µs. The second model shows how this abstract model is refined. Each flow is refined with a dataflow block composed of external variables. The concrete model confirms that data sent by the sensors are not synchronous flows but pass through the middleware. According to the real-time requirement of abstract model, the middleware is in charge of distributing data to flight software by respecting the limit of data aging. In addition, this refinement step displays the OBSW synchronous island.

Conclusion

The Synoptic language is equipped with tools based on the Eclipse EMF modeling framework. The purpose of the SPaCIFY project is not to develop a fully-integrated design environment but rather to equip the proposed design process with prototype tools in order to prove the feasibility of the approach. The development of the Eclipse-based modeling workbench started with the definition of the Ecore meta-model of the Synoptic language. The definition of this meta-model has relied on the experience gained during the GeneAuto project. This definition is the result of a collaborative and iterative process. A concrete syntax relying on the meta-model has been defined using academic tools such as TCS (Textual Concrete Syntax). This textual syntax was used to validate the usability of the language through a pilot case study described in this paper. These models have helped to improve the Synoptic language and to adapt it to industrial know-how. Once the language was stabilized, a graphical user editor was designed. A set of structural and typing constraints have been formalized, encoded in OCL (Object Constraint Language), and integrated into the environment. Along these activities, a formal semantics of the language was defined. The semantics of the functional part of the Synoptic language has been encoded in a typed sets theory using the B Method. This formalization has been performed in an incremental way. First, the Semantic Domain (SD) has been formalized. Our SD relies on the Model of Sequences [START_REF] Besnard | SIGNAL-V4: INRIA Version : Reference Manual[END_REF]. Then, we formalized an abstract syntax of the Synoptic language. Finally, we have defined a semantics function associating to each node constructor of our abstract syntax a term expressed in the Sequences Model. This formalization of the Synoptic semantics will be helpful to validate the existing transformation of Synoptic models to SME models. Another benefit of this semantics will be to establish links between Synoptic and other synchronous languages which semantics is expressed through the Tag Model [START_REF] Lee | Comparing models of computation[END_REF]. We now plan to exploit this formalization framework in order to study the formalization of domain specific transformations from Synoptic to more and more concrete Synoptic models close to an actual implementation, e.g., taking into account scheduling and mapping aspects. We will rely mainly on the concept of refinement.

Case studies. The Synoptic environment is being used to develop case studies of industrial size. Astrium intends to experiment the SPaCIFY technologies and tool chain. This case study targets on the one hand the evaluation of the Synoptic modeling language for early system engineering phases, and on the other hand the evaluation of the Altarica-based model-checker, especially with respect to its scalability. Thales Alenia Space conducts another case study which aims to model a complete flight software. This case study focuses on the use of external variables in the SPaCIFY design process, and on the use of the Polychrony platform for code generation purposes.

Future investigations. The Synoptic environment is based on model transformation. Thus, verifying this transformations is a key point. It has been addressed in the Geneauto project to certify sequential code generation from a Stateflow/Simulink based language. This work must be extended to take into account features of the execution platform such as timers, preemption-based schedulers, multithreading, multi-processors,… Work is in progress on the functional subset of the Synoptic language.

The Synoptic environment provides a toolset supporting a development process. Experience acquired during the SPaCIFY project with industrial partners has shed light two different processes and thus the need to parameterize the platform by the process. A SPEM-based specification of the development process could be used as input of a generic platform so that it could be configured to match end user current and future development methods. The Synoptic environment offers a limited support to refinement-based development process. This support could be extended and coupled with versioning to allow refinement checking between any couples of models or sub-models. It means a support for defining and partially automatically generating gluing invariants between models. Then proof obligations could be generated.

Figure 1 :

 1 Figure 1: GALS systems.

Figure 2 :

 2 Figure 2: Synoptic Global view.

Figure 3 :

 3 Figure 3: Case study : satellite positioning software.

3. 4

 4 Synoptic architecture models One typical case study under investigation in the project is generic satellite positioning software, Fig. 3 (a). It is responsible for automatically moving the satellite into a correct position before starting interaction with the ground. Block diagrams. A Synoptic model is a graphical block-diagram. A Synoptic block-diagram is a hierarchy of nested blocks. As such, you can navigate through different levels of abstraction and see increasing levels of model details. A block is a functional unit that communicates with other blocks through its interface.

Figure 4 :

 4 Figure 4: Synoptic Meta-model : Interface. A group of ports is used to group a set of ports which are conceptually linked. As specified by the synchronized property of the PortGroupDecl metamodel class, it is possible to specify a synchronization constraint on ports constituting the group. A block interface can be implemented by different types of blocks: dataflows, automata or externals, Fig. 5.

Figure 5 :

 5 Figure 5: Synoptic Meta-model : Model Diagram.

Figure 6 :

 6 Figure 6: AOCS nominal sub-mode.

17

 17

Figure 7 :

 7 Figure 7: A parameterized component.This example reveals parts of the textual syntax of Synoptic, which in this case is more perspicuous than a graphical syntax. The component C requires (an instance of) a block, called ADD, that is characterized by a component type having a certain number of in and out ports. C provides a dataflow that is composed of two blocks, one of which is defined in the private part of C. Parameterized blocks can be instantiated with elements that meet their typing constraints, in a large sense. In the case of simple parameter types (like integers), the typing constrains are evident. When instantiating a parameterized component having a parameter type P with a component C, the component C has to provide all the elements stipulated by the requires clause of P (but may provide more). Conversely, C may require some (but not necessarily all) the elements provided by P. Parameter instantiation is thus essentially contravariant. Some clauses of a component are not checked during instantiation, such as private.

Figure 8 :

 8 Figure 8: AOCS nominal sub-mode.

Figure 9 :

 9 Figure 9: Flow refinement. The abstract model consists of three dataflow blocks. Sensors send their data (position and attitude) to the central flight software. OBSW computes them and sends a new command to actuators. In this abstract block diagram, flows between actuators and the OBSW are obviously not synchronous signals: data are exchanged through an 1553 bus.To consider this fact, flows are specified as abstract. The same applies to the flows between OBSW and actuators. Moreover, a real-time requirement is added to the flows: <<delay ≤ 20 µs >>. This requirement represents the maximum age of data: data consumed by OBSW must be aged less than 20µs. The second model shows how this abstract model is refined. Each flow is refined with a dataflow block composed of external variables. The concrete model confirms that data sent by the sensors are not synchronous flows but pass through the middleware. According to the real-time requirement of abstract model, the middleware is in charge of distributing data to flight software by respecting the limit of data aging. In addition, this refinement step displays the OBSW synchronous island.


Anne Blanchard
email: anne.blanchard@aphp.fr

Sylvie Brailly Tabard

Antonin Lamaziere

Damien Bergerot

Valentina Zhygalina

Aurelien Lorthioir

Antoine Jacques

Delphine Hourton

Michel Azizi

Gilles Crambert

Blanchard

Brailly Tabard

Azizi

Adrenal adaptation in potassium-depleted men: role of progesterone?

Keywords: Potassium depletion, hypokalemia, progesterone, adrenal steroids, Gitelman syndrome

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

INTRODUCTION

Potassium is the most abundant cation in organisms, and the equilibrium between its low extracellular and high intracellular concentrations influences cellular processes and properties such as membrane resting potential and cell volume. The inability to maintain this equilibrium, and particularly to restrain extracellular plasma potassium concentration in a tight physiological range, is potentially life-threatening. The potassium balance is coordinated by mechanisms for potassium storage into and release from internal stores (internal balance) and mechanisms that regulate retention and excretion (external balance) [START_REF] Gumz | An Integrated View of Potassium Homeostasis[END_REF]. In this complex regulatory system, the kidney, mainly the distal part of the nephron, plays an important role. In steady-state conditions, renal excretion of potassium is similar to potassium intake. The distal nephron excretes potassium through ROMK and BK channels, which require a favorable electrical gradient generated by the activity of the amiloridesensitive Na + channel ENaC [START_REF] Giebisch | Renal potassium transport: mechanisms and regulation[END_REF][START_REF] Wang | Regulation of potassium (K) handling in the renal collecting duct[END_REF]. Potassium reabsorption is mediated by the H,K-ATPases, mainly the isoform HKA2 [START_REF] Crambert | H-K-ATPase type 2: relevance for renal physiology and beyond[END_REF]. Excretion and reabsorption are functional under physiological conditions [START_REF] Salhi | Circadian expression of H,K-ATPase type 2 contributes to the stability of plasma K(+) levels[END_REF]. In subjects on a low-potassium diet condition, the renal switch from a high rate of potassium secretion to efficient potassium conservation is mediated by a number of complementary mechanisms: 1) an increase in electroneutral (mediated by the Na-Cl cotransporter NCC) versus electrogenic (mediated by ENaC) Na + reabsorption [START_REF] Todkar | Mechanisms of renal control of potassium homeostasis in complete aldosterone deficiency[END_REF]; 2) a decrease in plasma aldosterone concentration, which induces a decreased activity of ENaC [START_REF] Frindt | Conservation of Na+ vs. K+ by the rat cortical collecting duct[END_REF]; 3) inhibition of ROMK through a pathway dependent on reactive-oxygen species [START_REF]Regulation of renal K transport by dietary K intake[END_REF]; 4) the progesterone-dependent stimulation of the HKA2 [START_REF] Crambert | H-K-ATPase type 2: relevance for renal physiology and beyond[END_REF][START_REF] Elabida | Chronic potassium depletion increases adrenal progesterone production that is necessary for efficient renal retention of potassium[END_REF]; and 5) the proliferation of tubular epithelial cells of the distal nephron, which occurs in chronic conditions [START_REF] Cheval | Plasticity of mouse renal collecting duct in response to potassium depletion[END_REF].

In rodents in a potassium-depleted state, there is stimulation of adrenal secretion of progesterone and progesterone-dependent stimulation of HKA2 expression suggesting that progesterone is not just a sex hormone [START_REF] Elabida | Chronic potassium depletion increases adrenal progesterone production that is necessary for efficient renal retention of potassium[END_REF][START_REF] Wingo | Progesterone: not just a sex hormone anymore?[END_REF]. This offers a new promising way in treating or preventing renal hypokalemia by stimulating potassium reabsorption rather than inhibiting its secretion. This potassium-sparing effect of adrenal progesterone has only been described in rodent while the stimulation of adrenal Progesterone synthesis by K depletion may not be effective in human. Indeed, the presence in human adrenal gland of the cytochrome p450 family member CYP17A1, an enzyme that is not expressed in rodent [START_REF] Perkins | Quantification of P450scc, P450(17) alpha, and iron sulfur protein reductase in Leydig cells and adrenals of inbred strains of mice[END_REF], metabolizes progesterone into 17-hydroxyprogesterone and may prevent progesterone accumulation [START_REF] Brock | Biochemical differences between rat and human cytochrome P450c17 support the different steroidogenic needs of these two species[END_REF] (Figure 1).

To address the role of progesterone in renal adaptation to potassium depletion in humans, we submitted healthy subjects to a potassium-depleted diet and studied their renal adaptation to potassium depletion, the changes induced in plasma adrenal steroid concentrations, and their responses to adrenocorticotropic hormone (ACTH) stimulation following tetracosactide (Synacthene®) administration. Finally, plasma adrenal steroids were quantified in patients with chronic severe renal hypokalemia related to a congenital saltlosing tubulopathy, the Gitelman syndrome.

SUBJECTS AND METHODS

SUBJECTS

The study was approved by the local Ethics Committee (P120906 -CPP Ile de France VI, NCT02297048). All subjects gave informed consent for genetic analyses before participating the study. The study was registered on clinical trial registry (NCT02297048).

The twelve healthy subjects included in the study were Caucasian males 18 to 35 years of age. Inclusion criteria were BMI ranging from 18 to 30 kg/m 2 , plasma ionogram and liver panel within normal range, estimated glomerular filtration rate (MDRD) > 60 ml/min/1.73 m 2 . Exclusion criteria were recent (within 7 days) diarrhea, gastric or duodenal ulcer, any current drug other than acetaminophen, drug allergy history or any severe allergy, drug or alcohol abuse, blood hemoglobin < 10 g/dl.

The ten patients with renal loss of potassium were Caucasian males 18 to 75 years old with genetically proven Gitelman syndrome. Exclusion criteria were recent (within 7 days) diarrhea, drug allergy history or any severe allergy, or blood hemoglobin < 10 g/dl.

INVESTIGATIONS

After a safety inclusion visit, healthy subjects were subjected twice to a 7-day period of potassium depletion. Potassium depletion was induced by 30 g daily sodium polystyrene sulfonates (Kayexalate®, Sanofi-adventis France) over two days, followed by 5 days under a low-potassium diet (25 mmol/d). We attempted to maintain a constant level of calories and of sodium intake during the diet period. A safety end-study visit was performed a 7-day washout period after the second potassium-depletion interval.

The day before admission for each experimental visit, participants were asked to collect urine for measurement of 24-h urinary output and determination of urinary concentration of electrolytes (Na, K, Cl, and creatinine) and of steroid metabolites. At the beginning (day 1, D1) or the end of potassium depletion (day 7, D7), blood samples were taken before drug administration at about 9:00 a.m. after an overnight fast and after 1 h of rest in the sitting position (time H0). Additional blood samples were taken 30 min after intravenous administration of 250 µg tetracosactide (time H1; Synacthene®, alfasigma). Samples at H0 allowed determination of plasma electrolytes including sodium, potassium, chloride, bicarbonate, creatinine, and plasma renin concentration, plasma aldosterone, plasma ACTH, and of steroids. At H1, plasma renin and plasma aldosterone were quantified. The patients with Gitelman syndrome were given the tetracosactide test once; the same parameters that were measured in the healthy volunteers were measured in the Gitelman syndrome patients.

METHODS

Plasma concentrations of a panel of 15 steroids were measured using a liquid chromatography coupled to tandem mass spectroscopy (LC-MS/MS) assay to avoid the risk of interference between steroids as previously described [START_REF] Fiet | A Liquid Chromatography/Tandem Mass Spectometry Profile of 16 Serum Steroids, Including 21-Deoxycortisol and 21-Deoxycorticosterone, for Management of Congenital Adrenal Hyperplasia[END_REF]. The steroids evaluated were pregnenolone, progesterone, corticosterone, deoxycorticosterone (DOC), aldosterone, 17hydroxypregnenolone, 17-hydroxyprogesterone, 11-deoxycortisol, 21-deoxycortisol, cortisol, cortisone, DHEA, delta 4-androstenedione, 11-β-hydroxyandrostenedione, testosterone.

Plasma renin concentration was assessed with commercial kit (Renin III from CisBio). Urinary concentrations of cortisol and plasma concentrations of ACTH were determined using chemiluminescent enzyme immunoassays (Immulite 2000 XPi, Siemens Healthineers).

Routine plasma and urinary aldosterone concentrations were also assessed with a commercial kit (DPC Coat-a-Count assay from Diagnostic Products Corp).

STATISTICAL ANALYSIS

Our hypothesis was that potassium depletion would increase adrenal progesterone and/or 17-hydroxyprogesterone synthesis. The primary outcome was the change induced by potassium depletion in the plasma progesterone concentration measured 30 min after intravenous administration of 250 µg tetracosactide. This was a pilot study without preliminary data in humans, therefore, there was no data that could be used to support the calculation of necessary sample size for statistical significance. In male mice subjected to potassium depletion, there was a stimulation of progesterone production by 300% [START_REF] Elabida | Chronic potassium depletion increases adrenal progesterone production that is necessary for efficient renal retention of potassium[END_REF].

Assuming only a 50% increase in progesterone after potassium depletion (mean difference +0.03 [IC95% : +0.02; -0.08];p < 0.2827), an estimated standard deviation (SD) of 0.05 pg/ml, and a two-sided type 1 error rate of 0.05%, a sample size of 12 evaluable subjects would yield 80% power.

Analysis of variance for normally distributed variables or the Kruskal-Wallis non-parametric test for non-normally distributed variables were used to compare the characteristics between genotypes. In most cases, data were log-transformed when they were not normally distributed. To compare values from D0 to D7 or from H0 to H1, paired t tests were performed, whereas independent sample t tests were used to compare values of Gitelman patients with values of healthy subjects. All analyses were carried out using SAS Statistical Software (version 9.4, SAS Institute), and p < 0.05 was considered to be significant. Results are expressed as median [IQR: Q1;Q3].

RESULTS

EFFECT OF POTASSIUM DEPLETION IN HEALTHY SUBJECTS

As expected, when values were compared for healthy subjects on D0 versus D7, plasma potassium concentration decreased (mean difference 0.3 ± 0.1 mmol/l, p= 0.0180, Table 1), and subjects became slightly hypokalemic without change in plasma concentrations of sodium, chloride, bicarbonate, creatinine, or estimated glomerular filtration rate (Table 1).

Potassium depletion induced a decrease (by a factor of 2) in daily urinary excretion of potassium (Table 1) without affecting daily urinary excretion or fractional excretion of sodium (Table 1).

As measured by immunoassay, plasma aldosterone concentration and urinary aldosterone excretion decreased by -55% ([IC95: -72%;-28%]; p=0.0068) and -69% ([IC95: -80%; -51%]; p=0.0001), respectively, from D0 to D7 in healthy subjects (Table 1). This is likely due to the inhibitory effect of potassium depletion on aldosterone secretion since the plasma renin concentration was not significantly affected (Table 1). Plasma ACTH and urinary cortisol excretion (nmol/mmol creatinine) (Table 1) and plasma cortisol (Table 2) were not affected by potassium depletion.

A week of potassium depletion did not affect any of the plasma steroid concentrations as assessed by LC-MS/MS (Table 2, healthy subjects, D0 vs. D7) with the exceptions of aldosterone, which decreased by -50% ([IC95% -80%;-10%]; p=0.0332)and 17hydroxypregnenolone, which increased by 45% [IC95% 9%; +67%]; p=0.0232). Of note, concentrations of plasma progesterone (mean difference 20% [IC95 % -24%; +49%], p=0.283) and its metabolite 17-hydroxyprogesterone (mean difference +11% [IC95 % -9%; +28%], p 0.237) were similar before and after a week of potassium, depletion (Table 2).

We then estimated enzymatic activity of adrenal steroidogenesis by calculating the ratio between the product and substrate of enzymes (Figure 1, Supplemental Table 1). This analysis identified two changes in important steps of the steroidogenesis in healthy subjects after potassium depletion. First, the activity of CYP11B2, estimated as the ratio of aldosterone to corticosterone was 3-4-fold decreased. Second, less expectedly, CYP17 activity, estimated as the ratio of 17-hydroxypregnolone to pregnolone, was increased by 60%. The stimulation of CYP17 was associated with no change in estimated activity of 3-βhydroxysteroid dehydrogenase (3βOHSD) in the glomerulosa and a decrease in estimated 3βOHSD activity in the fasciculata, which prevented conversion of 17-hydroxypregnolone into 17-hydroxyprogesterone.

Intravenous administration of 250 µg tetracosactide led to a 2-fold increase in plasma cortisol, a 4-fold increase in plasma aldosterone, and a significant increase in all plasma hormonal concentrations except renin, testosterone, and cortisone (Table 2). Post tetracosactide concentrations of steroids measured under usual diet (D0) and after a week under low potassium diet (D7) were similar.

EFFECT OF CHRONIC POTASSIUM DEPLETION

The effect of a severe and chronic depletion of potassium was addressed in patients suffering of a salt and potassium loosing nephropathy, the Gitelman syndrome (GS) (OMIM #263800). As shown in Table 1, patients with GS were older than healthy subjects (p< 0.0001) but had similar BMI (p=0.1765), and their diastolic blood pressure was slightly higher than that of healthy subjects (Table 1). Patients with the salt-losing tubulopathy had marked activation of the renin angiotensin-aldosterone system and high sodium intake (as demonstrated by higher levels of sodium excretion) as compared to controls (Tables 1 and3). They had marked hypokalemia, abnormal levels of potassium excretion (i.e., K excretion > 40 mmol/24 h and fractional excretion of K higher than 5%). Their plasma ACTH was similar to that of healthy subjects (Table 1).

Despite their chronic hypokalemia, GS patients did not display any differences in pretetracosactide plasma steroid concentrations compared to healthy subjects with the exceptions of lower levels of aldosterone (mean difference 69% [IC95 % +33%; +86%], p 0.0046) and of higher levels of 11-deoxycortisol and of delta 4-androstenedione (mean differences +44% [IC95% +1%; +68%], p=0.0471 and 19% [IC95 % +0%; +34%], p=0.0485, respectively) (Table 2).

GS patients had a stronger response to tetracosactide than healthy subjects (Table 3). As expected, in GS patients post-tetracosactide plasma aldosterone concentration was markedly higher than in healthy subjects (+67% [+44%; +80%], p=0.0003). In addition, the post-tetracosactide concentrations of pregnenolone, progesterone, corticosterone, DOC, and 11-deoxycortisol were about 40% higher in GS patients than in healthy subjects, whereas cortisol and delta 4-androstenedione levels were 20-30% higher. This exacerbated response to tetracosactide could be, depending of the steroid, related either to the observed chronic stimulation of angiotensin II or to chronic potassium depletion. To distinguish between these possibilities, we calculated the correlation between posttetracosactide plasma steroid levels and plasma renin (which are high when angiotensin II activity is high) or plasma potassium values. We found that progesterone, corticosterone, DOC, and aldosterone were correlated with both plasma renin and plasma potassium levels (Supplemental Table 2, Figure 2 A-D), whereas pregnenolone and delta 4-androstenedione only correlated with plasma potassium concentration (Figure 2 E-H). Interestingly, aldosterone (Figure 2 A-B) and DOC (Supplemental Table 2) best fitted with plasma renin concentration, whereas progesterone best fitted with plasma potassium level (Figure 2 C-D).

DISCUSSION

MILD REDUCTION OF POTASSIUM INTAKE DOES NOT INFLUENCE PROGESTERONE AND 17-

HYDROXYPROGESTERONE CONCENTRATIONS IN MEN

Although it is clear that steroid production by the adrenal gland changes in response to sodium and potassium content of the diet [START_REF] Hansen | Response of the collecting duct to disturbances of acid-base and potassium balance[END_REF][START_REF] Kaplan | The effect of ACTH, renin, angiotensin II, and various precursors on biosynthesis of aldosterone by adrenal slices[END_REF], almost nothing was known about adaptation of humans to a low potassium diet except that plasma aldosterone concentration falls markedly after 2-3 days of potassium depletion [START_REF] Tremblay | Regulation of rat adrenal messenger RNA and protein levels for cytochrome P-450s and adrenodoxin by dietary sodium depletion or potassium intake[END_REF]. Elabida et al. demonstrated in mice that potassium depletion but not sodium depletion, led to increase in adrenal progesterone production [START_REF] Elabida | Chronic potassium depletion increases adrenal progesterone production that is necessary for efficient renal retention of potassium[END_REF]. Potassium depletion induced an increased expression of steroidogenic acute regulatory protein (StAR), CYP11A1, and 3βHSD1 and was associated with decreased in CYP11B1 expression (a key enzyme in corticosterone synthesis) and in CYP11B2 expression (a key enzyme for aldosterone synthesis). Using a mathematical model of steroidogenesis in mice, Elabida et al. predicted that potassium depletion should result in an increase in plasma progesterone, a prediction confirmed experimentally in male mice and male men [START_REF] Elabida | Chronic potassium depletion increases adrenal progesterone production that is necessary for efficient renal retention of potassium[END_REF]. In mice progesterone regulates renal potassium handling both in males and females under potassium restriction, independently of its role in reproduction, and this adrenal progesterone was required for full adaptation to potassium depletion [START_REF] Elabida | Chronic potassium depletion increases adrenal progesterone production that is necessary for efficient renal retention of potassium[END_REF]. The mechanism was mediated by stimulation of the H,K-ATPase type 2 and was prevented by the progesterone receptor antagonist RU486. These results, however, were not immediately transferable to man since human adrenal steroidogenesis strongly differs from that of rodents as humans express CYP17, which metabolizes progesterone into 17hydroxyprogesterone, although Elabida et al. also established a weak correlation between plasma progesterone in men and their potassium intake [START_REF] Elabida | Chronic potassium depletion increases adrenal progesterone production that is necessary for efficient renal retention of potassium[END_REF].

To directly address the contribution of progesterone on renal adaptation to potassium depletion in human, we induced potassium depletion in healthy men. Although we did not measure intracellular potassium levels, the marked inhibition of plasma and urinary aldosterone concentrations were indicative of a state of potassium depletion. At the beginning and the end of the period, we performed a tetracosactide test to stress the adrenal response to potassium depletion and potentially reveal subtle modifications in adrenal steroidogenesis. Neither progesterone nor 17-hydroxyprogesterone concentrations measured before or after tetracosactide administration were affected by potassium restriction. However the potassium depletion we induced may have been too weak (decrease by 2-fold of potassium intake) or too short (7 days) or both as compared to what has been done in mice (decrease by 20-fold of potassium intake for 1 week). In male mice, the increase of progesterone appears to stimulate potassium reabsorption to counteract the deleterious effect of prolonged potassium restriction. This step was not observed in healthy subjects in our present study. In addition, the presence of a CYP17A activity in human adrenal glands may have prevented progesterone accumulation. In support of this, we observed a significant 50% increase in 17-hydroxypregnenolone and, unexpectedly, the estimated CYP17 activity increased by 60%. Our results suggest that this increase in CYP17 activity leads to 17-hydroxypregnenolone accumulation but that conversions of pregnenolone into progesterone and 17-hydroxypregnenolone into 17-hydroxyprogesterone are prevented by low 3βOHSD activity (Figure 1). Our study was powered to demonstrate a 50% increase in plasma progesterone and 17-hydroxyprogesterone concentrations, whereas 150 subjects would be required to demonstrate that the observed 20% increase in pretetracosactide progesterone concentration was significant.

PATIENTS WITH SALT-LOSING TUBULOPATHIES HAD ALTERED ADRENAL RESPONSE TO TETRACOSACTIDE BUT UNAFFECTED PROGESTERONE METABOLISM

We also studied the plasma steroid profile in patients with a congenital renal loss of sodium and potassium due to a Gitelman syndrome. These patients had a severe chronic hypokalemia (median 2.7 mmol/l, Table 1), a renal loss of sodium, resulting in marked stimulation in plasma renin and aldosterone concentrations, and high potassium intake. In contrast to observations in rodents, despite profound hypokalemia, GS patients displayed a hyperaldosteronism in response to their loss of salt and are under potassium supplementation to limit their hypokalemia. The levels of plasma progesterone and 17hydroxyprogesterone were similar to those observed in healthy subjects. Interestingly, after treatment with tetracosactide, levels of many steroids were more elevated in GS patients than in healthy subjects. These results indicate that patients with GS have a higher ability than healthy subjects to respond to ACTH stimulation in order to promote steroid production. Since, these patients displayed stimulation of their renin-angiotensinaldosterone system (Tables 2 and3), we suggest that the presence of high levels of angiotensin II sensitizes the adrenal glands of GS patients to ACTH. This synergic effect of angiotensin II and ACTH on steroid production was originally documented about 35 years ago [START_REF] Parker | Angiotensin II potentiates ACTH-stimulated adrenal androgen secretion[END_REF]. Indeed, angiotensin II not only increases the expression of CYP11B2, but also indirectly stimulates the activities of 3βHSD2 and CYP21 enzymes [START_REF] Nogueira | Role of angiotensin II-induced rapid response genes in the regulation of enzymes needed for aldosterone synthesis[END_REF]. GS patients are, however, in a paradoxical situation since they exhibit a profound hypokalemia that probably counteracts, at least partially, the effect of angiotensin II. When ACTH is given to GS patients, it disrupts this fragile equilibrium and reveals a "hidden" hyperactivity of the adrenal glands, which produce steroids like progesterone with a good correlation to plasma potassium level.

In conclusion, we provide evidence that potassium depletion induced in healthy men enhances CYP17 adrenal activity, blunting progesterone accumulation. It is important to note that our data do not exclude the possibility that an adrenal steroid-dependent pathway is involved in adaptation to more severe potassium depletion. We unexpectedly observed over-response to tetracosactide of non-mineralocorticoid steroids in GS patients suggesting that adrenal glands not only adapt to sodium depletion but also to potassium depletion and p values of the correlations were calculated using Prism 8 software. Potassium depletion was induced by 30 g daily polystyrene sulfonates for two days, followed by 5 days of a low-potassium diet (25 mmol/day). Blood and urine samples were taken at baseline (D0) and day 7 (D7). Results are median [IQR] and p value of geometric means. b p < 0.05 D7 vs. D0 . c p < 0.05 GS vs. healthy subjects D0. Abbreviations: BMI, body mass index;SBP, systolic blood pressure;DBP, diastolic blood pressure;eGFR, estimated glomerular filtration rate;ACTH, adrenocorticotropic hormone.

LEGENDS

FIGURE 1 :

 1 FIGURE 1: Effect of potassium depletion on adrenal steroidogenesis. Activities of the main enzymes of adrenal steroidogenesis were estimated by calculation of the product to substrate ratios, indicated in the circles. Significant changes after potassium depletion are indicated by red circles when enzymatic activity was enhanced and by grey dashed circles when activity was inhibited. As expected, potassium depletion dramatically depressed CYP11B2 activity (and thus aldosterone production). It also increased CYP17 activity, leading to an increase in 17-hydroxypregnenolone, and reduced 3bHSD activity in the fasciculate preventing transformation of 17-hydroxypregnenolone into 17hydroxyprogesterone. The decrease in 17-20 liase in the reticularis was not sufficient to prevent DHEA accumulation (due to transformation of 17-hydroxy pregnenolone into DHEA).

FIGURE 2 :

 2 FIGURE 2: Correlation of post-tetracosactide concentrations of plasma hormones with plasma renin or plasma potassium concentrations. The individual concentrations of plasma hormones were measured after administration of 250 µg tetracosactide in healthy subjects under normal diet or in Gitelman patients and correlated to the plasma renin concentration or the plasma K level. Nonparametric Spearman coefficient r [CI95%]

Table 1 : Baseline characteristics of healthy subjects and GS patients and effects of potassium depletion on hemodynamic, plasma, and urinary electrolytes and hormones. a

 1

	Healthy subjects (n=12)	GS patients (n=10)

Acknowledgments

This work was supported by the "Contrat de Recherche Clinique from the Assistance Publique des Hôpitaux de Paris" (grant #: CRC 12122). We thank the healthy volunteers and the patients who participated in the study. We thank Dr Valerie Paquet for the recruitment of healthy volunteers, the nursing staff of the Clinical Investigation Center who ran the protocol, especially head nurse Jeanne Meunier.

The DRIVING trial was supported by research grants from the French Ministry of Health (CRC 2012 grant # CRC12122). disclosures, no conflict of interest in relation to this study.

Conflict of interests:

There are no conflicts of interests and the results presented in this paper have not been published previously in whole or part.