Sophie Holowacz
email: s.holowacz@larenasante.com

Charlotte Guigne

Gerald Chene

Sandrine Mouysset

Angèle Guilbot

Christian Seyrig

Ge ´ rald Che ˆne

Ange ` Le Guilbot

Marc Dubourdeau

A

A multispecies Lactobacillus-and Bifidobacterium-containing probiotic mixture attenuates body weight gain and insulin resistance after a short-term challenge with a high-fat diet in C57/BL6J mice

Introduction

Obesity, with its constellation of related metabolic diseases, such as type 2 diabetes (T2D), has become a major public health problem worldwide in view of its associated morbidity and mortality, and the increasingly large number of individuals affected. Greater consumption of energy-dense foods and an overall shift towards more sedentary lifestyles are important factors contributing to this unprecedented rise in prevalence [START_REF] Temelkova-Kurktschiev | Lifestyle and genetics in obesity and type 2 diabetes[END_REF], with genetic predisposition apparently playing a relatively minor role [START_REF] Devaraj | The human gut microbiome and body metabolism: implications for obesity and diabetes[END_REF][START_REF] Chatelier | Richness of human gut microbiome correlates with metabolic markers[END_REF]. More recently, the gut microbiome has elicited a surge of interest as a possible contributor to the pathogenesis of obesity and T2D. Obesity appears to be associated with reduced bacterial diversity and changes in the relative abundance of different bacterial species [START_REF] Chatelier | Richness of human gut microbiome correlates with metabolic markers[END_REF][START_REF] Tagliabue | The role of gut microbiota in human obesity: recent findings and future perspectives[END_REF]. Studies have indicated differences in gut microbiota between obese and lean individuals [START_REF] Devaraj | The human gut microbiome and body metabolism: implications for obesity and diabetes[END_REF], as well as between diabetic and non-diabetic individuals [START_REF] Larsen | Gut microbiota in human adults with type 2 diabetes differs from non-diabetic adults[END_REF][START_REF] Qin | A metagenome-wide association study of gut microbiota in type 2 diabetes[END_REF]. Experiments in various animal models have consistently demonstrated that the gut microbiota affects host metabolism in numerous ways. In particular, it can modify the amount of energy harvested from the diet, the integrity of the intestinal barrier, the qualitative composition and metabolism of fatty acids in adipose tissue and the liver, the secretion of gut-derived peptides, and lipopolysaccharide (LPS)-induced inflammation [START_REF] Musso | Interactions between gut microbiota and host metabolism predisposing to obesity and diabetes[END_REF]. A multispecies Lactobacillus-and Bifidobacterium-containing probiotic mixture significantly reduced the adverse metabolic and inflammatory effects of a 14-week high-fat diet in wild-type C57/BL6J mice gavaged 5 days a week with the probiotic mixture or vehicle. Recent evidence indicates that the gut microbiome may play a decisive role in the onset of obesity and associated chronic metabolic diseases, such as type 2 diabetes, by modulating nutrient absorption and factors conducive to development of a persistent low-grade inflammatory state. By modifying the gut microbiome, probiotics might constitute an effective dietary strategy for managing these metabolic disorders. The tested probiotic mixture significantly attenuated the increase in body weight, serum glucose concentration and insulin resistance induced by the high-fat diet. Furthermore, it significantly reduced the up-regulation of expression of several genes encoding pro-inflammatory adipokines and leukotriene pathway enzymes (CCL-2, IL-6 and leukotriene C 4 synthase in adipose tissue, leukotriene C 4 synthase and leukotriene A 4 hydrolase in the gut). It also significantly counteracted the down-regulation of adipose tissue gene expression related to the anti-inflammatory adipokine adiponectin in mice fed the high-fat diet. These results suggest that the mechanism underlying the beneficial metabolic effects of the probiotic mixture might involve inhibition of gut and adipose tissue inflammation.

Abbreviations: CLAs, conjugated linoleic acids; CT, control diet; FIAF, fastinginduced adipocyte factor; GLP-1, glucagon-like peptide-1; HF, high-fat diet; HF-Pb, high-fat diet with probiotic mixture; 5-HPETE, 5-hydroperoxyeicosatetraenoic acid; IBS, inflammatory bowel syndrome; LPS, lipopolysaccharide; LTA 4 H, leukotriene A 4 hydrolase; LTC 4 S, leukotriene C 4 synthase; Pb, probiotic mixture; SREBP-1, sterol regulatory element-binding protein 1; T2D, type 2 diabetes; Treg cells, T regulatory cells.

Metabolic disorders, including obesity and T2D, are associated with a state of chronic, low-grade inflammation in peripheral tissues and the circulation [START_REF] Gregor | Inflammatory mechanisms in obesity[END_REF]. Expansion of adipose tissue is accompanied by enhanced secretion of pro-inflammatory adipokines, e.g. IL-6 and CCL-2, and reduced secretion of the anti-inflammatory and insulinsensitizing adipokine, adiponectin [START_REF] Bremer | Adipose tissue dysfunction in nascent metabolic syndrome[END_REF]. This results in chronic, lowgrade inflammation affecting multiple tissues and organs, including the liver, skeletal muscle and heart [START_REF] Jung | Obesity and its metabolic complications: the role of adipokines and the relationship between obesity, inflammation, insulin resistance, dyslipidemia and nonalcoholic fatty liver disease[END_REF]. Adipose and peripheral inflammation may favour the development of debilitating behavioural symptoms, including depressive symptoms and cognitive impairment [START_REF] Lasselin | Chronic low-grade inflammation in metabolic disorders: relevance for behavioral symptoms[END_REF], as well as various chronically painful conditions, such as osteoarthritis [START_REF] Arranz | Effects of obesity on function and quality of life in chronic pain conditions[END_REF]. Spinal adiponectin mRNA expression was found to be modified in obese rats, suggesting that adiponectin may also promote centrally mediated pathological changes underlying obesity-related exacerbation of pain and inflammation [START_REF] Iannitti | Increased central and peripheral inflammation and inflammatory hyperalgesia in Zucker rat model of leptin receptor deficiency and genetic obesity[END_REF].

A logical corollary of these observations is that manipulation of the gut microbiota by qualitative and quantitative changes in the intake of specific food components, such as fatty acids [START_REF] Shen | Influence of dietary fat on intestinal microbes, inflammation, barrier function and metabolic outcomes[END_REF], highprotein diets [START_REF] Iannitti | The obese patient: clinical effectiveness of a high-protein low-calorie diet and its usefulness in the field of surgery[END_REF], probiotics [START_REF] Arora | Probiotics: interaction with gut microbiome and antiobesity potential[END_REF][START_REF] Karlsson | Effects on weight gain and gut microbiota in rats given bacterial supplements and a high-energy-dense diet from fetal life through to 6 months of age[END_REF] and prebiotics [START_REF] Delzenne | Modulation of glucagon-like peptide 1 and energy metabolism by insulin and oligofructose: experimental data[END_REF][START_REF] Delzenne | Modulation of the gut microbiota by nutrients with prebiotic properties: consequences for host health in the context of obesity and metabolic syndrome[END_REF] could be an effective dietary strategy to manage lifestyle-related metabolic disorders such as obesity and T2D. Besides decreasing abdominal adiposity and total cholesterol, probiotics can normalize low-grade inflammation and favour mucosal integrity [START_REF] Mallappa | Management of metabolic syndrome through probiotic and prebiotic interventions[END_REF]. Recent studies have indicated that certain bacterial strains may prevent diet-induced obesity and related disorders. Lactobacillus rhamnosus PL60 and L. plantarum PL62, bacterial species capable of producing conjugated linoleic acids (CLAs) conducive to body fat reduction, have been shown to exert beneficial effects on dietinduced obesity in mice. Consumption of fermented skimmed milk containing Lactobacillus gasseri SBT2055 regulated adipose tissue growth in rats, possibly through inhibition of dietary fat absorption. Lactobacillus curvatus HY7601 and L. plantarum KY1032 reduced weight gain and fat accumulation in diet-induced obesity in mice by modulating pro-inflammatory genes in adipose tissue and fatty acid oxidation-related genes in the liver [START_REF] Arora | Probiotics: interaction with gut microbiome and antiobesity potential[END_REF].

In the study presented here, we investigated whether treatment with a multispecies probiotic mixture comprising five bacterial strains (Lactobacillus acidophilus, L. plantarum, L. salivarius and two strains of Bifidobacterium lactis) could attenuate experimental obesity induced in mice by a high-fat diet. Previous studies conducted by our group demonstrated the anti-inflammatory properties of this probiotic mixture [START_REF] Drouault-Holowacz | Anti-inflammatory potential of the probiotic dietary supplement Lactibiane Tolerance: in vitro and in vivo considerations[END_REF] and also showed that it can prevent disruption of the gut epithelial barrier and up-regulate the expression of tight-junction proteins [START_REF] Ne ´bot-Vivinus | A multispecies probiotic protects gut barrier function in experimental models[END_REF]. Our objective was to further explore the metabolic effects of the probiotic mixture and the potential mechanisms underlying its anti-inflammatory action.

Materials and methods

Probiotic mixture

The tested probiotic dietary supplement (Lactibiane Tole ´rance 1 , PiLeJe, France) comprises a mixture of five viable lyophilized lactic acid bacterial strains (B. lactis LA 303, B. lactis LA 304, L. acidophilus LA 201, L. plantarum LA 301 and L. salivarius LA 302) at a total concentration of 1 Â 10 10 colony-forming units (CFU) per capsule. Fresh suspensions of the lyophilized probiotic mixture (Pb) were prepared daily in sterilized phosphate-buffered saline (PBS) and administered intragastrically to mice at the dose of 1 Â 10 9 CFU/mouse (in 0.2 mL of PBS) on 5 consecutive days a week for 14 weeks.

Animals and experimental diets

The study was performed according to French government guidelines for animal experiments (protocol number 12/1048/03/ 15). Twenty-seven male C57/BL6J mice aged 6 weeks at the beginning of the experiment (Charles River Laboratories, France) were housed in groups of three per cage in a controlled environment (12-h daylight cycle) with free access to food and water. After two weeks of acclimatization, the mice were randomly allocated to receive for 14 weeks one of three different experimental diets (n = 9/group): (1) a control (CT) diet (A04, SAFE, Villemoison-sur-Orge, France) containing (w/w) 16.1% protein, 60% carbohydrate and 3.1% fat (total energy supply: 2.9 kcal/g consumed); (2) a high-fat (HF) diet (Research Diet Inc.) containing 26% protein, 26% carbohydrates and 35% trans-type saturated fats (total energy supply: 5.2 kcal/g consumed); (3) the HF diet plus the probiotic mixture (1 Â 10 9 CFU/mouse administered in 0.2 mL sterilized PBS by oral gavage on 5 consecutive days per week) (HF-Pb diet). The groups allocated to the CT and HF diets received the same volume of sterilized PBS alone by oral gavage on 5 consecutive days a week during 14 weeks.

At the end of the experiment, the mice were killed by cervical dislocation. The small intestine (from duodenum to ileum), colon, and subcutaneous and perigonadal adipose tissues were excised, rinsed with physiological saline solution, weighed and stored at À70 8C pending further analysis.

Body weight and fat mass measurement

Body weights were recorded in all three groups of mice once a week. Body fat percentage was measured at week 13 by nuclear magnetic resonance (NMR) using an EchoNMR TM 100H apparatus (Echo Medical Systems LLC, New York, USA). Mice were placed in a clear plastic holder for scanning, without sedation. Fat and lean masses were determined on the basis of the differences in relaxation times of the hydrogen proton spins in disparate environments. Fat mass corresponds to the mass of all fat molecules in the body and is expressed as the equivalent weight of canola oil. Lean (muscle tissue) mass corresponds to all watercontaining body parts excluding fat, bone minerals, hair, claws, etc. At the end of the study (week 14), perigonadal and subcutaneous adipose tissues were excised and weighed separately.

Determination of blood glucose, insulin and homeostasis index (HOMA-IR)

Blood samples (5 mL) were taken from the tail, after a 6-h fast, at baseline (before allocation to the experimental diets) and at weeks 6 and 12. Serum glucose and insulin concentrations were determined using a glucometer and by ELISA, respectively. The glucometric assay was chosen for measurement of serum glucose concentrations as it requires small blood volumes, reducing stress on the animals. Insulin resistance was determined as HOMA-IR, calculated according to the equation HOMA-IR = fasting serum glucose concentration (mg/mL) Â fasting serum insulin concentration (mIU/mL)/22.5.

Expression of genes encoding pro-or anti-inflammatory agents in adipose (perigonadal or subcutaneous) and gut (small intestine or colon) tissues

Tissues were disrupted using a tissue homogenizer (Precellys 1 , Ozyme, France) in the presence of lysis buffer (QIAzol 1 , Qiagen, France; 1 mL per 100 mg of tissue). Total mRNA was isolated from adipose tissues and gut using a solid-phase RNA purification kit (GenJET 1 , Fermentas, France) and by classical liquid/liquid (phenol/ chloroform) extraction, respectively. Reverse transcription was then performed on 1 mg samples of mRNA from each tissue using a SupersScript II kit (Invitrogen, France), according to the manufacturer's protocol. Samples were prepared for high-throughput real-time qPCR on a BioMark 96.96 Dynamic Array (Fluidigm, France) according to the manufacturer's protocol. Real-time qPCR was chosen for this analysis as being the most appropriate means of assessing several genes in a single real-time experiment.

Statistical evaluation

Data are expressed as means AE standard deviation (SD). CT, HF and HF-Pb treatment groups were compared using one-way ANOVA for multiple comparisons with Tukey's post hoc test. Repeated measures ANOVA was used to determine the statistical significance of intergroup differences in body weight at successive time points. The 95% confidence interval was calculated and statistical significance was concluded at p < 0.05.

Results

Anti-obesity effect of the probiotic mixture

As expected, body weight increased to a greater extent in mice fed the high-fat diet than in those consuming the control diet, the difference between these two groups being significant from 6 weeks onwards. However, the body weight increase induced by the high-fat diet was reduced by concomitant administration of the probiotic mixture, the difference between the HF and HF-Pb groups being statistically significant from week 10 to the end of the study at week 14 (Fig. 1). The mean body weight gains during the total 14 weeks of experimental diet consumption were 6.23 AE 1.67 g, 18.71 AE 1.53 g and 15.20 AE 0.65 g in the CT, HF and HF-Pb groups, respectively, the difference between the HF and HF-Pb groups being statistically significant. The mean total weight gain determined at the end of the study (week 14) was 41.9 AE 3.1% higher the HF group and 28.3 AE 4.4% higher in the HF-Pb group than in the CT group. The HF-Pb group showed a lower proportion of fat mass (30.7 versus 36.1%) and a higher proportion of lean mass (54.4 versus 49.1%), compared to the HF group (Fig. 2, panels A andB), but the differences between the two groups were not significant (p > 0.05). Perigonadal and subcutaneous adipose tissue weights were significantly decreased, by 22.1% and 21.2% respectively, in HF-Pb mice compared to HF mice (Fig. 2, panels C and D).

Serological analyses

Mean serum glucose and insulin concentrations determined at week 12 were significantly higher in the HF and HF-Pb groups than in the CT group, but significantly lower (by 17 and 37%, respectively) in the HF-Pb group compared to the HF group (Table 1). Similarly, mean HOMA-IR, a representative index of insulin resistance, was significantly higher in both the HF and HF-Pb groups than in the CT group, but significantly reduced by 47% in the HF-Pb group compared to the HF group (Table 1).

Expression of genes encoding pro-or anti-inflammatory agents in adipose and gut tissues (high-throughput real-time qPCR analysis)

Effect of the probiotic mixture on adipokine gene expression in adipose tissue

Compared to the CT group, the HF group showed 12.6-fold and 7.2-fold higher expression levels of the gene encoding the proinflammatory adipokine CCL-2 in the perigonadal and subcutaneous adipose tissue, respectively (Fig. 3). These elevations in CCL-2 gene expression induced by the high-fat diet were significantly reduced (2.6-and 1.7-fold, respectively) by concomitant intake of the probiotic mixture (Fig. 3). In contrast, CCL-2 gene expression in the small intestine and colon did not differ significantly between the HF and HF-Pb groups. The elevation of IL-6 gene expression induced by the HF diet in the perigonadal adipose tissue was significantly (1.6-fold) reduced by concomitant intake of the probiotic mixture. Expression of the gene encoding the antiinflammatory adipokine, adiponectin, in this tissue was significantly (1.8-fold) increased in the HF-Pb group compared to the HF group, approaching the level observed in the control group (Fig. 4). In the perigonadal adipose tissue, no significant differences were observed between the CT and HF-Pb groups with regard to CCL-2, IL-6 and adiponectin gene expression.

Effect of the probiotic mixture on the expression of genes encoding enzymes of the leukotriene pathway

The mRNA expression of leukotriene A 4 hydrolase (LTA 4 H), implicated in the production of LTB 4 , and that of leukotriene C 4 synthase (LTC 4 S), an enzyme involved in the synthesis of the cysteinyl leukotrienes C, D and E, were also evaluated (Fig. 5, panels A and B respectively). Statistically significant inhibition of LTA 4 H gene expression in adipose and colon tissues was observed in the HF-Pb group compared to the HF group. LTC 4 S gene expression was also significantly inhibited in the HF-Pb group compared to the HF group with regard to gut (small intestine and colon) tissues. The level of LTC 4 S gene expression in the perigonadal and subcutaneous adipose tissues did not differ significantly between the HF and HF-Pb groups. Administration of the probiotic mixture in conjunction with the high-fat diet also led to significantly (1.5-fold) up-regulated expression of the gene encoding the LXA 4 receptor Fpr2 in the colon, compared to that observed in mice receiving the high-fat diet alone (Table 2).

Effect of the probiotic mixture on T regulatory gene expression

The mRNA expression of three T regulatory genes encoding agents modulating inflammation, namely Foxp3, CD25 and IL-10 in colon tissue was up-regulated in the group consuming the high-fat diet compared to their expression in the control group. Concomitant administration of the probiotic mixture significantly increased the expression of these T regulatory genes in colon tissue by 1.5-2.3-fold compared to the HF group (Table 2). A trend towards enhanced (1.6-fold) expression of CD25 in perigonadal adipose tissue and small intestine tissue was observed in the HF-Pb group compared to the HF group.

Discussion

The role of the gut microbiota in the pathogenesis of obesityrelated disorders is increasingly recognized and may involve the provision of additional energy by the conversion of dietary fibres to short-chain fatty acids, effects on gut-hormone production, and increased intestinal permeability leading to elevated systemic lipopolysaccharide (LPS) levels [START_REF] Blaut | Intestinal microbiota and obesity[END_REF]. The ability of probiotics and prebiotics to reduce intestinal permeability has been tested in various animal models of metabolic disorders [START_REF] Tavares Da Silva | Intestinal microbiota; relevance to obesity and modulation by prebiotics and probiotics[END_REF]. The aim of our study was to investigate the effects of concomitant administration of a probiotic mixture to mice fed a high-fat diet on body weight, glucose metabolism and the expression of genes encoding agents modulating inflammatory processes, as obesity is known to be associated with a state of chronic low-grade inflammation [START_REF] Gregor | Inflammatory mechanisms in obesity[END_REF]. Previous studies have demonstrated the anti-inflammatory properties of the tested probiotic mixture [START_REF] Drouault-Holowacz | Anti-inflammatory potential of the probiotic dietary supplement Lactibiane Tolerance: in vitro and in vivo considerations[END_REF] as well as its capacity to restore epithelial barrier disruptions induced by LPS, stress or soluble factors associated with irritable bowel syndrome (IBS) and to down-regulate the response mediated by the inflammatory cytokine TLR-4 in vitro and in vivo [START_REF] Ne ´bot-Vivinus | A multispecies probiotic protects gut barrier function in experimental models[END_REF]. In this study, administration of this probiotic mixture for 14 weeks to mice fed a high-fat diet diminished the increase in body weight gain and body fat mass observed in mice receiving the same highfat diet alone. It also protected mice from the insulin resistance induced by the high-fat diet as shown by the HOMA-IR values determined in the HF and HF-Pb groups.

[ ( F i g . _ 1 ) T D $ F I G ]

The chemokine CCL-2, produced by adipocytes, has a pivotal role in the recruitment of macrophages into the peripheral adipose tissue and contributes to the insulin resistance and hepatic [ ( F i g . _ 3 ) T D $ F I G ] steatosis associated with obesity. Previous studies have shown enhanced expression of the CCL-2 gene in genetically obese diabetic (db/db) mice and in wild type mice with obesity induced by a high-fat diet [START_REF] Kanda | MCP-1 contributes to macrophage infiltration into adipose tissue, insulin resistance, and hepatic steatosis in obesity[END_REF], in obese mice compared to normal mice [START_REF] Takahashi | CCL2 as a trigger of manifestations of compensatory anti-inflammatory response syndrome in mice with severe systemic inflammatory response syndrome[END_REF] and in adipose tissues of obese patients compared to lean controls [START_REF] Panee | Monocyte Chemoattractant Protein 1 (MCP-1) in obesity and diabetes[END_REF]. In our study, the increase in CCL-2 mRNA expression in perigonadal and subcutaneous adipose tissue observed in mice consuming the high-fat diet compared to the control diet was significantly reduced by intake of the probiotic mixture. Concomitant administration of the probiotic mixture also significantly inhibited the up-regulation of IL-6 and down-regulation of adiponectin in perigonadal adipose tissue observed in mice fed a high-fat diet. Inflammation of the intestine, which is closely connected to the visceral adipose tissue via blood vessels has also been observed in the early phase of developing obesity [START_REF] Bleau | Crosstalk between intestinal microbiota, adipose tissue and skeletal muscle as an early event in systemic lowgrade inflammation and the development of obesity and diabetes[END_REF]. In this study, the expression of genes implicated in inflammatory processes in the gut was explored using microfluidic tools. Real-time PCR analysis revealed a significant impact of the tested probiotic mixture on the expression of genes encoding enzymes of the leukotriene pathway and Treg genes in colon tissue from mice fed a high-fat diet, demonstrating its effect on inflammatory processes. The leukotriene precursor arachidonic acid 5-hydroperoxide (5-hydoperoxyeicosatetraenoic acid; 5-HPETE) may be converted into either LTB 4 , via the activation of LTA 4 H, or into LXA 4 , via inhibition of this enzyme, LTC 4 , LTD 4 and/or LTE 4 being produced via activation of LTC 4 S. Our study showed a decrease in LTA 4 H and LTC 4 S mRNA expression in mice receiving the probiotic mixture in addition to the high-fat diet. This suggests that inhibition of both enzymes might lead to enhanced LXA 4 production in gut tissue. The hypothesis that probiotics affect the expression of genes involved in immunosuppression and resolution of inflammation is supported by the increase in expression of Fpr2 (LXA 4 receptor) mRNA observed in mice receiving the tested probiotic mixture in addition to the high-fat diet.

[ ( F i g . _ 2 ) T D $ F I G ]
Chen et al. recently investigated the effects of LTB 4 on the differentiation of immunosuppressive CD4 + CD25 + Foxp3 + Treg cells in vitro and found that LTB 4 dose-dependently decreased the percentage of Treg cells and the mRNA expression of Foxp3 [START_REF] Chen | Effects of leukotriene B4 and prostaglandin E2 on the differentiation of murine Foxp3+ T regulatory cells and Th17 cells[END_REF]. Foxp3 + Treg cells, defined by expression of the forkhead family transcription factor p3 (Foxp3) and high levels of the IL-2 receptora chain (CD25), constitute a subset of CD4 + Treg cells with the function of suppressing immune responses and maintaining selftolerance [START_REF] Peterson | Regulatory T-cells: diverse phenotypes integral to immune homeostasis and suppression[END_REF]. The proportion of circulating CD25 + CD127 À Foxp3 +- + Treg cells in the total CD4 + cell population is inversely correlated with indices of adiposity such as body weight, body mass index and circulating leptin levels, particularly in obese subjects. Moreover, significantly fewer Treg cells are seen in individuals exhibiting elevated markers of systemic inflammation (hsCRP) or impaired glucose tolerance (HbA1c) [START_REF] Wagner | Circulating regulatory T cells are reduced in obesity and may identify subjects at increased metabolic and cardiovascular risk[END_REF]. A link between the leukotriene pathway enzymes and Treg cells was observed by Bo ¨rgeson et al. [START_REF] Bo ¨rgeson | Lipoxin A4 attenuates adipose inflammation[END_REF] who showed that LXA 4 increased expression of the antiinflammatory cytokine IL-10 in adipose tissue explants from perigonadal fat depots of mice. In our study, we demonstrated that probiotic supplementation not only modified the expression of genes encoding enzymes implicated in the leukotriene pathway in mice fed a high-fat diet but also significantly increased Foxp3, CD25, and IL-10 mRNA expression in colon tissue.

In conclusion, probiotic supplementation significantly attenuated body weight gain and protected mice from glucose intolerance and insulin resistance induced by a high-fat diet. Gene expression analysis indicated that these effects are at least in part due to the anti-inflammatory actions of this probiotic mixture. In adipose tissue, probiotic treatment reduced expression of the gene encoding CCL-2, an important chemokine for macrophage infiltration of adipose tissue. In colon tissue, this treatment increased the expression of genes involved in the immunosuppression and resolution of inflammation. However, full-scale clinical trials would be required to assess the value of the tested probiotic with regard to the development of obesity and associated inflammatory processes in humans. Further studies would also be needed to elucidate the exact mechanisms underlying the effects of the tested probiotic mixture with regard to its anti-inflammatory impact on the gut immune system, its modification of gut microbiota, its ability to reduce overall energy intake and its modulation of gut hormone expression. The gut microbiota may participate in the regulation of energy metabolism, i.e. the energy harvested from the diet, as well as the regulation of fat storage (expression of FIAF), fat lipogenesis (aceyl-CoA carboxylase, fatty acid synthase, SREBP-1), and fatty acid oxidation (AMPK activity) [START_REF] Cani | The role of the gut microbiota in energy metabolism and metabolic disease[END_REF]. Modulation of gut peptides involved in appetite regulation, such as GLP-1 and PYY, could be another mechanism by which the gut microbiota might control energy and glucose homeostasis. Data obtained in experimental models and in clinical studies have already shown that changing the gut microbiota by means of prebiotics (such as fructans) [START_REF] Delzenne | Modulation of glucagon-like peptide 1 and energy metabolism by insulin and oligofructose: experimental data[END_REF][START_REF] Parnell | Prebiotic fibres dose-dependently increase satiety hormones and alter Bacteroidetes and Firmicutes in lean and obese JCR:LA-cp rats[END_REF] or probiotics (such as Lactobacillus casei W8) [START_REF] Bjerg | Lactobacillus paracasei subsp paracasei L. casei W8 suppresses energy intake acutely[END_REF] may contribute to regulating gut peptide synthesis and controlling food intake. So it might be interesting to complete this study by investigating whether the beneficial effect of our probiotic mixture on body weight gain could be explained by reduced food intake and/or increased energy expenditure, and to investigate more precisely the underlying mechanisms of action.

Layperson's summary

The nature of the microorganism population in the gut was recently identified as a potential contributor to the increased prevalence of obesity and type 2 diabetes. In this study, we investigated the effects of a probiotic mixture in mice fed a high-fat diet conducive to the development of obesity. The weight gain and increases in blood glucose level and insulin resistance induced by this diet were significantly reduced by probiotic supplementation. Improvement in the inflammatory state of the gut and adipose tissue might be a possible mechanism underlying the anti-obesity effect of the probiotic mix studied.

Fig. 1 .

 1 Fig. 1. High-fat diet and probiotic effect on body weight (g). The mice fed the control diet (CT) (^), the high-fat diet (HF) (~), and the high-fat diet plus the probiotic mixture (HF-Pb) (4) were weighed once a week and the results averaged. Data are presented as the mean AE SD. a p < 0.05 HF versus CT; b p < 0.05 HF-Pb versus HF.

Fig. 2 .

 2 Fig. 2. High-fat diet and probiotic effects on fat mass (A), lean mass (B), perigonadal adipose tissue (C) and subcutaneous adipose tissue (D) weights. a p < 0.05 HF versus CT; b p < 0.05 HF-Pb versus HF; c p < 0.05 HF-Pb versus CT.

Table 1

 1 Serum glucose and insulin concentrations and HOMA-IR determined 12 weeks after the start of experimental diet consumption. Control diet (CT) (n = 9) High-fat diet (HF) (n = 9) High-fat diet + probiotic mix (HF-Pb) (n = 9) Glucose (mg/dl) 124 AE 7 176 AE 6 a 146 AE 8 b Insulin (pmol/mL) 484 AE 15 1315 AE 167 a 835 AE 94 b HOMA-IR 1.209 AE 0.076 4.705 AE 0.747 a 2.483 AE 0.359 b Data are presented as the mean AE SD. a p < 0.05 versus the CT group. b p < 0.05 versus the HF group.

Fig. 3 .

 3 Fig. 3. Relative expression of CCL-2 mRNA in adipose and gut tissues mice fed a control diet (&), a high-fat diet alone ([ T D $ I N L I N E ] ) or a high-fat diet plus the probiotic mixture (&). a p < 0.05 HF versus CT; b p < 0.05 HF-Pb versus HF; c p < 0.05 HF-Pb versus CT.

[

  ( F i g . _ 4 ) T D $ F I G ]

Fig. 4 .

 4 Fig. 4. Relative expression of IL-6 and adiponectin mRNA in perigonadal adipose tissue of mice fed a control diet (&), a high-fat diet alone ([ T D $ I N L I N E ] ) or a high-fat diet plus the probiotic mixture (&). a p < 0.05 HF versus CT; b p < 0.05 HF-Pb versus HF.

Fig. 5 .

 5 Fig. 5. Relative expression of LTA 4 H (A) and LTC 4 S (B) mRNA in adipose and gut tissues of male C57/BL6J mice fed a control diet (&), a high-fat diet alone ([ T D $ I N L I N E ] ) or a high-fat diet plus the probiotic mixture (&). a p < 0.05 HF versus CT; b p < 0.05 HF-Pb versus HF; c p < 0.05 HF-Pb versus CT.

Table 2

 2 Relative LXA 4 receptor (Fpr2) and T regulatory gene mRNA expression in colon tissue.

		Control diet	High-fat diet	High-fat diet + probiotic
		(CT) (n = 9)	(HF) (n = 9)	mixture (HF-Pb) (n = 9)
	Fpr2	1.00 AE 0.09	2.01 AE 0.27 a	2.98 AE 0.29 b
	Foxp3	1.00 AE 0.19	2.88 AE 0.36 a	4.46 AE 0.60 b
	CD25	1.00 AE 0.05	1.86 AE 0.20 a	2.97 AE 0.28 b
	IL-10	1.00 AE 0.12	1.16 AE 0.12	2.64 AE 0.44 b,c

Data are presented as the mean AE SD.

a p < 0.05 versus the CT group. b p < 0.05 versus the HF group. c p < 0.05 versus the CT group.

Acknowledgements

This study was supported by the European Community's seventh framework programme (FP7 -2007-2013) under the grant HEALTH-F4-2011-282095-TARKINAID (provided to MD, CG and GC for the microfluidic tool). Product analysis and editorial/ writing support was funded by PiLeJe, Paris, France.

The authors would like to thank the members of the histopathology core facility of the UMS006 unit, Philippe Valet for his help with the diets, Marcy Belloy for ANOVA analysis and Paula Harry, PhD (MediBridge SA, Ve ´lizy, France) for editorial/ writing support.


Salick Diagne

Thierry Val

Abdou Karim Farota

Bouya Diop

Comparative Analysis of Ranging Protocols for Localization by UWB in Outdoor

Keywords: Outdoor Location, UWB, Ranging, ToF, TWR, DecaWiNo

The rapid evolution of technology in the field of wireless telecommunications and micro components using MEMS technologies (Micro-electromechanical systems) has contributed to the expansion and rapid development of wireless sensor networks (WSN). This rapid development has contributed to the appearance of sensor and actuator networks (WSAN) or even to the Internet of Things with DL-IoT (Device Layer-Internet of Things). This rapid evolution of WSN is due to the enthusiasm generated by this last in industry and research. This new technology is used in several applications, particularly in the outdoor location of communicating nodes. The process of distance calculation between nodes (ranging) is a primordial phase for a precise location of these nodes. This paper presents the result of measurements does with three ranging protocols (TWR, TWR_Skew and SDS-TWR) implemented on De-caWiNo nodes. DecaWiNo nodes use the Ultra-Wide Band (UWB) radio links, proposed by the IEEE 802.15.4 standard amendment of the year 2007, which provides a high-performance ranging by ToF (Time of Flight) [1] [2]. The results are very promising with precision errors of the order of 50 cm over 20 meters.

Introduction

We notice in recent years, agriculture increasingly oriented towards a widespread use of new technologies. We no longer talk about the mechanization of agriculture, but rather a smart agriculture. This type of agriculture uses WSAN technology to improve crop yields, in particular by controlling the humidity level of the plants [3] or for a much more precise irrigation [START_REF] Lópezriquelme | Wireless Sensor Networks for Precision Horticulture in Southern Spain[END_REF]. Its field of application also covers intrusion detection, or more recently the mobile target tracking, especially with military security.

Our goal is to use this technology in mobile target tracking but applied to agriculture for crop protection. This idea was born from an observation made from the destruction of crops in the paddy fields of West Africa, particularly those of Senegal.

Indeed, the destruction of agricultural crops by grain-eating birds has always been a fundamental problem, especially in West Africa. According to [START_REF] Mallamaire | La lutte contre les oiseaux granivores en Afrique Occidentale (Mauritanie, Sénégal, Soudan, Niger)[END_REF], these birds, such as quelea, the golden sparrows, village weaver with a strong beak, cause very serious damage that can be estimated each year to several hundred thousand tons. They attack rice, maize, sorghum and wheat by eating the mature and milky grains. This is how we asked ourselves this fundamental question that guided our approach:

Why not use the advantages offered by this new technology (DL-IoT) to help these farmers to protect their crops without harming the birds? However, to achieve this, one of the first functions that this network must accomplish is to be able to efficiently locate its own nodes. This first function of our network is also the subject of this document in which we make the comparative study of some protocols of distance calculation between nodes (ranging) by ToF based on the UWB, in order to find the best protocol suited for our application type. This work emphasizes the metric performances of DecaWiNo nodes in outdoor.

In fact, these performances were until then studied in indoor [START_REF] Fofana | Thierry Prototypage et analyse de performances d'un système de ranging pour une localisation par UWB. 16 éme Colloque Francophone sur l'Ingénierie des Protocoles[END_REF], thus this result obtained will complete the DecaWiNos metric study with the main protocols using the ToF for a more general use of these nodes (Indoor and Outdoor). So, after this introduction, we will first present the most traditional ranging protocols namely TWR, TWR_Skew and SDS-TWR. In the following we will present in Section 3 titled Outdoor measurements, the material used for measurements in particular the DecaWiNos nodes, the procedures and measurement results of the various protocols as well as their interpretation. Then in Section 4, we will discuss the results obtained. And finally, the conclusion will allow us to emphasize the possibilities of using our results as well as the research perspectives arising from this work.

The Ranging Protocols

For most sensor and actuator network applications, the event detected by a node is useful only if the information about its geographical location is provided. For this, the network needs to locate its nodes. So many algorithms and localization The Range-Free technique, like those of the DV-Hop family, is based on topology and connectivity information, assuming an isotropic network where the number of jumps between the nodes is proportional to their distance. But this solution is not very accurate (because of the malfunctions and the not guaranteed network connectivity).

The Range-Based localization, uses the distance (or angle) measured between two nodes (Ranging) to determine the position of a node.

There are several techniques to measure the distance (or angle) between two nodes: The Time of Flight (ToF), the Time Difference of Arrival (TDoA), the Angle of Arrival (AoA), and the Received Signal Strength Indicator (RSSI).

In ToF or ToA (Time of Arrival), we exploit the relationship between distance travelled by the signal and the time taken. For this technique, synchronization between transmitter and receiver is often required.

The TDoA uses the same principle as ToA with some differences to measure the distance between two close nodes. It uses the time difference taken by two signals sent by the same node and whose propagation speed is different. In general, we use ultrasound (V 340 m/s in air at 15˚C) or sound waves (C 3.10 8 m/s) to have this difference. This technique has drawbacks related to the energy consumption (because of the two signals emitted), the short range and its limited use in outdoor due to ultrasound for example.

The technique based on the AoA allows the location of a node by measuring the arrival angle of a signal. In this technique, the nodes measuring the angle are equipped with small antennas or ultrasonic receiver. The receiving node uses the arrival time or signal phase to calculate the arrival angle.

These ultrasonic antennas and receivers (imposing small distances between receiving nodes) constitute the major disadvantage in terms of cost and size for this method.

Finally, for the RSSI technique that uses the physical characteristic of the radio channel (the RSSI signal strength). In theory more the distance between two nodes increases more the signal is attenuated (the RSSI power indicator decreases). Thus, it is possible for a receiving node to calculate the distance that separates it from a transmitting node based on the power of the received signal. This method has an advantage over the cost since the nodes are already equipped with RF devices. But it is not very precise compared to other methods.

Because of its sensitivity to noise, interference, asymmetry of the communication link (no-conformity of the RSSI), obstacles and types of antennas capable caused errors exceeding 50% of the range of the communication device [START_REF] Kara | Réseau de capteurs sans fil: étude en vue de la réalisation d'un récepteur GPS différentiel à faible coût[END_REF].

Although requiring a perfect synchronism of the transmitting and receiving nodes, the technique based on the ToF is much more precise than the other techniques especially with the use of the UWB technology (ensuring an acceptable synchronization).

Thus, several works propose methods of distance calculation between nodes (Ranging) based on the ToF. These methods of calculation often called Ranging protocols are presented in the following sections.

TWR (To Way Ranging)

This is the simplest protocol using two-node messages and taking the clock from one of the nodes as a reference. Because most of the time, nodes in communication are often asynchronous. The TWR protocol is based on a set of three messages, two of which, (START and ACK) necessary for stamping and obtaining time-of-flight measurement information (Figure 1).

In this protocol, the node A, initiator of the exchange sends its first frame (START) and marks its time of emission t 1 . On receipt of this frame, the node B in turn marks the reception time t 2 of this frame and after a certain time sends an acknowledgment frame (ACK) while marking its sending time t 3 . The node A, on receipt of the ACK frame, marks the reception time t 4 . The four time stamps are collected on the node A side after receiving the DATA_REPLY frame containing the tags t 2 and t 3 of the node B. This last frame will allow node A to calculate the flight time noted in Equation ( 1) and distance in Equation (2). The principal disadvantage of this protocol is the drift of the clocks which causes temporal imprecision. Indeed, the two clocks of the nodes A and B are not based on the same quartz, they cannot be perfectly synchronous. Thus, an overestimation or underestimation of the measurement of the flight time could lead to an absurd location of the nodes.

TWR_Skew

The TWR_Skew is a protocol based on the simple TWR, it is presented in [START_REF] Ibrahim | Contribution aux architectures protocolaires pour un système de localisation dans un réseau de capteurs sans fil basé sur une couche physique 802.14.4a UWB[END_REF]. Its objective was to evaluate the impact of TWR ranging accuracy in normal traffic by introducing a variable artificial delay in order to compensate for imprecision due to delay. This delay introduced between the messages START and ACK actually represents the delay introduced by the usual traffic especially the method of access to the medium. The authors of [START_REF] Ibrahim | Contribution aux architectures protocolaires pour un système de localisation dans un réseau de capteurs sans fil basé sur une couche physique 802.14.4a UWB[END_REF] propose a correction of the introduced error, based on the parameter k which represents the ratio of the frequency f B of the clock of the node B and the frequency f A of the clock of the node A. By introducing this parameter k into Equation ( 1), this results in a new general ToF equation:

4 1 3 2 TWR_Skew

ToF

, with 1 2

t t k t t k (3)
The communication modules that we use with DecaWiNo and also used in [START_REF] Ibrahim | Contribution aux architectures protocolaires pour un système de localisation dans un réseau de capteurs sans fil basé sur une couche physique 802.14.4a UWB[END_REF] offer functionality, the Clock Offset evaluating the difference in frequency between the two clocks. This difference called Skew is the origin of the name of this protocol.

It is affirmed in [START_REF] Ibrahim | Contribution aux architectures protocolaires pour un système de localisation dans un réseau de capteurs sans fil basé sur une couche physique 802.14.4a UWB[END_REF] that this correction makes it possible to correct both the drift errors introduced by the temperature variations and those due to delays between messages (Figure 2).

The SDS-TWR Protocol (Symmetrical Double-Side Two-Way Ranging)

In order to reduce or eliminate the error introduced by the clock drift, another protocol symmetries the ranging session by adding an additional message to the classical session of the TWR protocol: this is the SDS-TWR protocol.

1) The Double-sided component: The protocol is based on two symmetrical sessions of the TWR protocol (TWR A-B and TWR B-A ). 2) The Symmetrical component: the response time between the two nodes is assumed to be identical (T R-A = T R-B, with T R = Response Time) (Figure 3).

Each node marks its own transmit and receive stamps. All the timestamps will be collected on the side of the node A after the reception of the DATA_REPLY Because of the frequency shift at the nodes, the return times for the response of A and B are evaluated differently. An average of two "round trip" times of A and B will allow reducing the error induced ranging. This specificity of the protocol will therefore reduce the difference between the actual distance and that which will be measured by the SDSTWR protocol without completely eliminating it [START_REF] Ibrahim | Contribution aux architectures protocolaires pour un système de localisation dans un réseau de capteurs sans fil basé sur une couche physique 802.14.4a UWB[END_REF].

Outdoor Measurements

Often, simple analyses based on simulation software are enough to provide a result on the performance of a given system. However, these programs are based on too idealistic models that do not often consider the imperfections and physical realities of the material and the measurement environment.

When the system to be studied is a WSAN, the fact that these parameters are not considered may lead to a different operation from the deployment than that provided by the simulation software.

Thus, certainly, the best approach would be to perform analyses on real nodes (sensors and actuators) and in a real physical environment. This explains why our analysis approach is based on measurements with real nodes.

Description of Measurement Equipment

For the measurements, we use two DecaWiNo nodes: the first fixed and located at a height of 1.5 m from the ground, the second always at the same height is linked to a mobile pole. The pole here serves only to vary the distance between our two nodes. See Figure 4.

DecaWiNo Node

DecaWiNo is part of the family of WiNo nodes (Wireless Node) [9] developed at IRIT by the RMESS team. The WiNo family is based on the Arduino environment and its components are developed in Open Hardware, allowing to setting up a wide variety of WiNos (see Figure 5). Table 1 summarizes the principal features of the developed WiNo nodes.

As we said earlier in this study, we will use DecaWiNo. This type of WiNo is composed of an Arduino board (Teensy 3.2) and the DecaWave DWM 1000 module with a UWB transceiver and an antenna. For node management, the DecaDuino library was developed by the RMESS team in the Arduino environment (Figure 6).

Measurement Procedures

For each of the three protocols, we carried out measurements on 19 points, and on each point 100 measurements were collected which makes a total of 5700 measurements.

Measurements are made in external environment, considering the two nodes in line of sight (LOS) and always starting for each protocol with a taking at 0.5 m.

After this, we start from 1 m to 5 m in steps of 1 m. Then 5 m to 30 m in steps of 2 m and always pass by the point 20 m.

Measurement Results

We present in the following sections the results obtained with the various protocols mentioned as well as their graphical representation.

Ranging by TWR Simple

We summarize in Table 2 the measurements made with the TWR protocol.

However, with the number of takes made: 100 for each point, we will only give the average value measured by the TWR protocol for each point as well as the average, minimum and maximum errors.

The representation of the error according to the real distance (Figure 7)

shows in a general way that the absolute average error varies from 0 to 1.10 m with extremums ranging from 1 cm to 1.18 m over a real distance of 0.5 to 30 m.

In particular, for real distances with less than 14 m, the average error does not exceed 20 cm and the maximum error is 25 cm. These average and maximum absolute errors are around 50 cm over distances between 14 and 22 meters. And for distances between 22 and 30 meters, these values are around 60 centimetres for the average value and 58 to 98 centimetres for the extremums. And finally, we find that the error committed by the TWR is greater than 1 meter for the real distances greater than or equal to 30 meters.

We also notice that for distances of less than 9 meters, the TWR overestimates the actual distance.

Ranging by TWR_Skew

Under the same conditions and measurement parameters as those of the TWR, we performed measurements with the TWR_Skew protocol. The results are summarized in Table 3 and graphically represented in Figure 8.

We note here that the average error varies generally from 20 cm to 1.5 m with absolute extreme values ranging from 37 cm to 1.63 m over real distances from 0.5 to 30 meters.

In particular, it can be seen on the one hand that for real distances of less than 13 meters the absolute errors (means and extremums) do not exceed 50 cm. And on the other hand, that the absolute average error evolves rapidly from 50 cm to 1.50 m with absolute extremums of 60 cm to 1.63 m over distances between 13 and 30 meters.

We can also notice that with the TWR_Skew protocol, the actual distances are in general underestimates.

Ranging by SDS_TWR

Still in the same conditions as previously experiments with TWR and TWR_Skew protocols, we performed measurements with the SDS_TWR protocol. The results obtained are recorded in Table 4 and represented in Figure 9.

The average absolute error varies here from 20 cm to 1.30 m with extremums of 17 cm to 1.43 m over distances of 0.5 to 30 meters. As for the TWR_Skew, we also note that for distances less than 13 meters the absolute errors (means and extremums) do not exceed 50 cm. Beyond 13 meters,

Discussion

The observation of the average errors shows that the errors made by the TWR_Skew and SDS_TWR protocols are quite close. Even though the TWR_Skew error is slightly smaller for distances less than 28 meters, the error committed by these two protocols exceeds 50 cm for the real distances greater than 13 meters.

On the other hand, for the TWR protocol, the error made here is much smaller, going up to an absolute distance of 50 cm from that made by the TWR_Skew protocol. In addition, for this protocol, the error does not exceed 50 cm for distances less than or equal to 22 meters (see Figure 10). This result obtained with the TWR protocol seems very interesting especially for applications where the distance between the nodes does not exceed 22 meters and a precision of the order of 20 cm (for distances less than 14 meters) or 50 cm maximum (for distances between 14 and 22 meters).

Thus, given the number of measurements taken per point, we can say that comparatively the TWR ranging protocol is better than the TWR_Skew and SDS_TWR ranging protocols in outdoor; even though these last two protocols have been established to correct the mistakes of TWR. But the validation tests of the correction of TWR errors by the TWR_Skew and SDS_TWR have been done

until then in indoor environment with a lot of reflections because of the walls and ceiling, and low ranges not exceeding 10 meters.

Conclusion

In this paper, we have implemented three ToF ranging protocols (TWR, TWR_Skew and SDS-TWR) on DecaWiNo nodes incorporating UWB technology. These nodes allowed us to make ranging measurements whose graphical These performances offer us several perspectives, first of all on the integration of the TWR protocol on our application whose maximum distance between nodes is 20 meters; since this protocol is the one that better estimates the distance between nodes among the three studied in this document. But also, perspectives on the search for mechanisms that can help reduce the error committed by the TWR protocol, as well as the study of the impact of the error made by this protocol on the accuracy of mobile target location algorithms.

[3] Jacquot, A., De Sousa, G., Chanet, J.P. and Pinet, F. (2011) Réseau de capteurs sans l pour le suivi de l'humidité du sol des vignes. ECOTECHS' 2011, Capteurs et systèmes de mesures pour les applications environnementales. Montoldre, France.

  techniques in outdoor have been developed. These algorithms and localization techniques use a variety of communication technologies, offering to users adapted location systems according to the criteria required by the different DL-IoT type applications. These criteria are often the range of communication, the transmission rate or the energy consumption. Technologies such as infrared, Bluetooth, Zigbee or UWB are used in this sense by localization systems. The most frequent localization techniques in literature can be classified into two groups: Range-Free localization and Range-Based localization.

Figure 1 .

 1 Figure 1. TWR protocol performing ToF measurement between two "asynchronous" nodes.

Figure 2 .

 2 Figure 2. Ranging protocol session TWR_Skew.

Figure 3 .

 3 Figure 3. SDS-TWR protocol performing ToF measurement between two "asynchronous" nodes.

Figure 4 .

 4 Figure 4. Principle of taking measurements. (a) Fixed DecaWiNo; (b) DecaWiNo carried by the mobile pol.

Figure 5 .

 5 Figure 5. The WiNos nodes. (a) WiNoRF22; (b) TeensyWiNo; (c) DecaWiNo and (d) Wi-NoIR.

Figure 6 .

 6 Figure 6. Components of DecaWiNo.

Figure 7 .

 7 Figure 7. Representation of the TWR error depending the distance.

Figure 8 .

 8 Figure 8. Representation of TWR Skew error depending on the distance.

Figure 9 .

 9 Figure 9. Representation of SDS_TWR error depending on the distance.

Figure 10 .

 10 Figure 10. Error representation of different protocols depending on the real distance.

Table 1 .

 1 Characteristics of WiNos developed[START_REF] Ibrahim | Contribution aux architectures protocolaires pour un système de localisation dans un réseau de capteurs sans fil basé sur une couche physique 802.14.4a UWB[END_REF].

		WiNoRF22	TeensyWiNo	DecaWino	WiNoVW	WiNoLoRa	WiNoIR
	CPU/RAM/Flash		ARM Cortex M4 (32 bits) 72 MHz, 64 kB RAM, 256 Kb Flash (PJRC Teensy 3.1)
	Transceiver	HopeRF RFM22b: 200 -900 MHz, 1 -125 kbps,	DWM 1000: UWB IEEE	Variés	RFM95	RF22 + Diodes
		GFSK/FSK/OOK, +20 dBm	802.15.4			IR
	Librairie	RadioHead	DecaDuino	VirtualWire	RadioHead	IrRemote
			Température,
			Luminosité,
	Capteurs	Température, Luminosité	Baromètre, Magnétomètre,		Température, Luminosité
			Accéléromètre,
			Gyromètre
	Usage	WSN, IoT	IoT avec Ranging, localisation en intérieur, courte portée	Communication très bas débit sur médiums non conventionnels	Longue portée, très bas débit
	Disponibilité	DIY	snootlab.com		DIY (Do It Yourself, à assembler soi-même)

Table 2 .

 2 Summary of TWR measures (m).

	Real Distance Average distance TWR	Average error	Minimum Error Maximum error
	0.5	0.65	0.15	0.07	0.19
	1	1.19	0.19	0.15	0.23
	2	2.1591	0.1591	0.12	0.19
	3	3.14	0.14	0.09	0.2
	4	4.12	0.12	0.06	0.16
	5	5.20	0.20	0.16	0.25
	7	7.04	0.04	-0.01	0.07
	9	9.00	-0.00	-0.05	0.03
	11	10.9481	-0.05	-0.1	0.03
	13	12.87	-0.13	-0.19	-0.08
	15	14.72	-0.28	-0.33	-0.23
	17	16.62	-0.38	-0.43	-0.32
	19	18.47	-0.53	-0.57	-0.48
	20	19.49	-0.51	-0.56	-0.46
	22	21.48	-0.52	-0.56	-0.48
	24	23.33	-0.67	-0.74	-0.58
	26	25.21	-0.79	-0.84	-0.71
	28	27.08	-0.92	-0.98	-0.86
	30	28.89	-1.11	-1.18	-1.05

Table 3 .

 3 Summary of TWR_Skew Measures (m).

	Real Distance	Average distance TWR	Average error	Minimum Error	Maximum error
	0.5	0.26	-0.24	-0.31	-0.19
	1	0.80	-0.20	-0.28	-0.13
	2	1.7757	-0.2243	-0.34	-0.15
	3	2.77	-0.23	-0.37	-0.12
	4	3.76	-0.24	-0.33	-0.13
	5	4.83	-0.17	-0.26	-0.1
	7	6.66	-0.34	-0.43	-0.26
	9	8.61	-0.39	-0.50	-0.30
	11	10.6028	-0.40	-0.48	-0.31
	13	12.48	-0.52	-0.60	-0.44
	15	14.32	-0.68	-0.80	-0.59
	17	16.26	-0.74	-0.86	-0.63
	19	18.09	-0.91	-0.99	-0.78
	20	19.11	-0.89	-1.00	-0.81
	22	21.09	-0.91	-1.03	-0.83
	24	22.94	-1.06	-1.23	-0.92
	26	24.83	-1.17	-1.26	-1.07
	28	28.50	-1.32	-1.46	-1.18
	30	28.50	-1.50	-1.63	-1.36

Table 4 .

 4 Summary of SDS-TWR measurements (m).

	Real Distance	Average distance TWR	Average error	Minimum error	Maximum error
	0.5	0.29	-0.21	-0.25	-0.17
	1	0.76	-0.24	-0.27	-0.21
	2	1.7743	-0.2257	-0.26	-0.19
	3	2.76	-0.24	-0.28	-0.19
	4	3.74	-0.26	-0.3	-0.21
	5	4.67	-0.33	-0.36	-0.3
	7	6.64	-0.36	-0.39	-0.33
	9	8.57	-0.43	-0.47	-0.39
	11	10.5078	-0.49	-0.56	-0.38
	13	12.43	-0.57	-0.62	-0.53
	15	14.32	-0.68	-0.71	-0.64
	17	16.22	-0.78	-0.82	-0.73
	19	18.11	-0.89	-0.92	-0.86
	20	19.09	-0.91	-0.94	-0.85
	22	20.94	-1.06	-1.10	-1.03
	24	-22.97	-1.04	-1.15	-0.87
	26	24.68	-1.32	-1.43	-1.21
	28	28.63	-1.25	-1.30	-1.19
	30	28.63	-1.37	-1.42	-1.31
	these absolute average errors evolve rapidly from 55 cm for a real distance of 13
	meters to 1.35 m for a real distance of 30 meters, with extremums ranging from

53 cm to 1.43 m respectively. The SDS-TWR protocol always gives an underestimated value of the real distance.

Acknowledgements

The authors would like to thank CEA-MITIC of the UFR SAT at the University Gaston Berger of Saint-Louis/Senegal for his financial support for the travel to Toulouse (in France) and the publication of this work.

Conflicts of Interest

The authors declare no conflicts of interest regarding the publication of this paper.


Ludovic Apvrille
email: ludovic.apvrille@telecom-paristech.fr

Alexandre Becoulet
email: alexandre.becoulet@telecom-paristech.fr

Prototyping an Embedded Automotive System from its UML/SysML Models

The paper introduces a fast approach to prototype embedded systems. Software components are first modeled and formally verified using a SysML environment named AVATAR, supported by a free software named TTool. Simulation and formal verification of AVATAR components can be performed at the push of a button. The C/POSIX code of AVATAR components can also be generated directly from TTool. The generated code along with the selected operating system can then be compiled, linked together, and executed on the SoCLib virtual prototyping platform. The latter has simulation models to build custom hardware platforms simulators and supports several real-time and embedded operating systems, including MutekH. Debugging features provided by the SoCLib platform offers straightforward debugging features, either with a command-line debugger -such as the GNU debbuger -or directly in TTool which presents execution results in a UML way using sequence diagrams, thus requiring no specific skill on the target platform. An automotive embedded application is used to present the whole AVATAR methodology, with a particular focus on the prototyping phase.

I. INTRODUCTION

The prototyping of an embedded system is usually a cumbersome task, especially when multiple hardware targets must be taken into account. This paper proposes a new prototyping approach relying on high-level models, on code generation, as well as on a SoC prototyping platform running an embedded operating system. Moreover, the approach is integrated in a SysML environment offering simulation and formal verification capabilities. More precisely, our approach is based on:

• A SysML environment named AVATAR [START_REF] Knorreck | Tepe: A sysml language for time-constrained property modeling and formal verification[END_REF]. AVATAR supports requirement capture, and the design of software components. A particular emphasis is put on timing issues, both at requirement and design levels. AVATAR is fully supported by an open-source toolkit named TTool [START_REF] Apvrille | Webpage of TTool[END_REF]. Starting from an AVATAR design, TTool can perform intensive simulations and accordingly animate SysML models at the same time. TTool can also perform formal proofs directly from models: no knowledge about underlying formal techniques (UPPAAL [START_REF] Bengtsson | Timed automata: Semantics, algorithms and tools[END_REF]) is thus required. • A C-POSIX code generator. TTool can generate C-POSIX code from SysML models, and link it against libraries implementing AVATAR features (synchronous communications, timers, etc.). • An open platform for the virtual prototyping of complex Systems-on-Chip: SoCLib [START_REF] Soclib | SoCLib: an open platform for virtual prototyping of multiprocessors system on chip (webpage)[END_REF]. SoCLib is a SystemC library of component models. It supports several models of processors (Mips, Arm, PowerPC, Sparc, MicroBlaze, etc.), of buses, of memories, and several operating systems, including eCos, MutekH and RTEMS. MutekH is an embedded operating system used on multiprocessor platforms in various research projects. It was originally designed with native support for processors heterogeneity in mind [START_REF]Mutekh[END_REF]. SoCLib supports two simulation models (Transaction Level Modeling and Cycle Accurate Bit Accurate), and comes with debugging features like a GNU debugger server and a memory access checker similar to Valgrind. The paper is organized as follows. A prototyping methodology based on AVATAR is first presented in section II. The automotive-based case study that will be used in this paper is then described in section III. Sections IV and V present the requirements and design models of the case study, respectively. Models are then simulated and formally verified in section VI. Section VII is the main contribution of this paper since it addresses the prototyping of the example application. The related work section VIII discusses other prototyping contributions. At last, section IX concludes the paper.

II. METHODOLOGY

Using the above mentioned tools, our prototyping methodology is as follows (see Figure 1); all those methodological steps will be further explained in next sections with an automotivebased case study:

1) Requirements. Requirements of the system are first captured with SysML Requirements Diagrams. Requirements are organized in a tree-based fashion. Both safety and security requirements can be captured. 2) Design. The general structure of the system is modeled with SysML block Diagrams. The behaviour of each block is described with a state machine. 3) Simulation and formal verification. A press-button approach makes it possible to perform simulations with model animation. Safety and security proofs can also be performed directly from the design models without prior knowledge about underlying formal verification techniques. Models can then be modified depending on verification results. Safety and security proofs rely on UPPAAL [START_REF] Bengtsson | Timed automata: Semantics, algorithms and tools[END_REF] and on ProVerif [START_REF] Blanchet | Automatic verification of correspondences for security protocols[END_REF], respectively. 4) Code generation. The TTool code generator can output C/POSIX code from design models. The generated ap-plication code can then be compiled along with MutekH using the appropriate kernel configuration and crosscompiler to target a PowerPC based SoCLib platform. 5) Prototyping with SoCLib. The SoCLib simulator can then be started and the code -generated and compiled during previous step -is loaded and executed like on real hardware. Debugging can be performed at two levels using both the GNU debugger, and simulations traces. Simulations traces can be displayed in TTool during code execution or later. These traces are displayed in the form of sequence diagrams. Models can then be further modified as needed in order to generate a new code. Simulation and formal proofs are meant to be executed during first iterations on the system model. On the contrary, the prototyping of the system is expected to be performed during the last iterations, that is, on more refined models. In all cases (simulation, verification and prototyping), results are directly displayed by TTool in a SysML fashion, therefore facilitating the identification of problems directly on SysML models.

III. CASE STUDY

The AVATAR methodology is illustrated in this paper with an automotive embedded system designed in the scope of the European EVITA project [START_REF] Evita | E-safety Vehicle InTrusion protected Applications[END_REF]. Recent on-board Intelligent Transport (IT) architectures comprise a very heterogeneous landscape of communication network technologies (e.g., LIN, CAN, MOST, and FlexRay) that interconnect in-car Electronic Control Units (ECUs) [START_REF] Seudié | Secure on-board architecture specification[END_REF] [START_REF] Schweppe | Secure on-board protocols specification[END_REF]. The increasing number of such equipments triggers the development of novel applications that are commonly spread among several ECUs to fulfill their goals. An automatic braking application serves as a case study [START_REF] Kelling | Specification and evaluation of e-security relevant use cases[END_REF]. The system works basically as follows: An obstacle is detected by another automotive system which broadcasts that information to neighbor cars. A car receiving such an information has to decide whether it is concerned with this obstacle, or not. This verification includes a plausibility check function that takes into account various parameters, such as the direction and speed of the car, and also information previously received from neighbor cars. Once the decision to brake has been taken, the braking order is forwarded to ECUs responsible for performing the emergency braking. Also, the presence of this obstacle is forwarded to other neighbor cars in case they have not yet received that information.

IV. REQUIREMENT CAPTURE

AVATAR relies on SysML Requirement Diagrams to capture both safety and security related requirements.

A. AVATAR requirement diagrams

In our proposed AVATAR framework, and as explained in one of our previous paper [START_REF] Idrees | A framework towards the efficient identification and modelling of security requirements[END_REF], both safety and security requirements can be modeled in SysML Requirement Diagrams (RD). In [START_REF] Balmeli | An overview of the systems modeling language for product and systems development -part 1 requirements, use-case, and testcase modeling[END_REF], capabilities of SysML diagrams are explored to describe the different aspects of an automotive embedded system such as context, requirement, and behavior of the system. Different SysML profiles are deployed to support the conceptual stages of the product development life-cycle. For instance, this includes decomposition of system needs and representing them as requirements in the model. The SysML Block Definition Diagram (BDD) is used to manipulate the structure of the system, whereas the system behavior is specified by using Interaction, State Machine and Activity diagrams. Another characteristic of a SysML is: Requirement Containment and Derive Dependency formalisms used to define relationships between requirements. We have more particularly used SysML containment, dependency -deriveReqt, and reuse in different namespaces copy relationships for defining safety and security requirements. As explained in [START_REF] Omg | SysML[END_REF], the containment relationship can contain multiple sub-requirements in terms of hierarchy and thus enables a complex requirement to be decomposed into its containing child requirements whereas, deriveReqt determines the multiple derived requirements that support a source requirement. These requirements normally present the next level of requirement hierarchy. A Security Requirement stereotype is introduced to make a clear distinction between functional requirements and security requirements of the system. In this way system engineers can model both functional and non-functional requirements of the system in a single modeling environment. Furthermore, a Kind parameter is defined to specify the category of the security requirement such as, confidentiality, access control, integrity, freshness, etc,.

B. Example: security requirements of the case study

We exemplify the use of AVATAR requirements diagrams with security requirements, therefore demonstrating how SysML requirement diagrams have been improved in AVATAR. An EVITA technical report [START_REF] Ruddle | Security requirements for automotive on-board networks based on dark-side scenarios[END_REF] presents all requirements of this case study. In the scope of this paper, only requirements (and properties) related to Denial of Service attacks are presented (see Figure 2). Basically, two main requirements are modeled : PreventBrakeDoSWhenEmergencySituation and PreventBroadcastBrakeDoSWhenEmergencySituation.

The security kind of those two requirements is "Availability". Those two requirements are themselves composed of subrequirements, two of which are copied from a requirement named EnsureCorrectDecisionOfEmergencySituation that has been defined in another view. At last, a property named DoSAttackOn CU And CSC Prevention is meant to verify the requirement named BrakeTotalResponseTime.

In this example, requirements are identified in order to further define properties expected to be proved on the system design.

V. DESIGN

Apart from their formal semantics, AVATAR Block and State Machine Diagrams only have a few characteristics which differ from the SysML ones.

A. AVATAR design

An AVATAR block defines a list of attributes, methods and signals. Signals can be sent over synchronous or asynchronous channels. Channels are defined using connectors between ports. Those connectors contain a list of signal associations. A block defining a data structure merely contains attributes. On the contrary, a block defined to model a sub-behavior of the system must define an AVATAR State Machine. AVATAR State Machine Diagrams are built upon SysML State Machines, including hierarchical states. AVATAR State Machines further enhance the SysML ones with temporal operators:

• Delay: af ter(t min , t max ). It models a variable delay during which the activity of the block is suspended, waiting for a delay between t min and t max to expire. • Complexity: computeF or(t min , t max ). It models a time during which the activity of the block actively executes instructions, before transiting to the next state: that computation may last from t min to t max units of time. The combination of complexity operators (computeF or()), delay operators, as well as the support of hierarchical states -and the possibility to suspend the activity of a substateendows AVATAR with main features for supporting real-time system schedulability analysis. • Blocks dedicated to the modeling of the environment.

B. Designing the active braking application with AVATAR

They model messages received via wireless connections, data received from sensors, and data output to actuators. Those blocks are located at the top of the diagram. For instance, the block CarPositionSimulator models the car traffic around the considered automotive system. This car traffic generates location information to the system. Another example is the GPSSensor that regularly records the car position. • Blocks dedicated to the modeling of the system itself.

Blocks are grouped within a parent block whose name is the one of the modeled ECU. For example, the PTC block models the Power Train Controller ECU. Basically, the system contains four ECUs:

- speed. This policy depends on the degree of emergency. The policy might also include the decision to brake. In that latter case, an order to brake is forwarded to the BrakeManagement block. -Power Train Controller ECU (PTC): It contains only one block DrivingPowerReductionStrategy which enforces the engine torque modification request.

VI. SIMULATION AND FORMAL VERIFICATION

In TTool, simulations and formal verification can be performed from AVATAR models at the push of a button.

A. Simulation

Block instances must be completed with state machine diagrams. Their behavior can therefore be simulated. At simulation step, TTool can draw a sequence diagram representing all actions and communication performed in the system. Additionaly, TTool offers diagram animations, that is, TTool accordingly animates the state machines diagrams with the following information: the last transition being taken, the next possible transitions and all previously taken paths are specifically colored. Usual simulation commands can also be performed from TTool to pilot the simulation trace: reaching the next breakpoint, step-by-step simulation with transition selection, going back one transition, etc. Simulation traces display synchronous and asynchronous communications between instances, logical actions performed by instances (e.g., variable settings and method calls), and delays between actions or communications. The right side of Figure 4 represents the state machine of the GPSSensor block. The previously executed action is an empty transition, and the sending of the synchronous signal setPosition is enabled. We also know that this is the first time this trace is taken in GPSSensor since the transition after the sending of the signal has never been taken (no green check next to the transition). On the contrary, previous transitions and actions were already taken in the past since they've got that green check on their right. On the right part of the same Figure 4 is displayed the main simulation control window. The top left part of that window is dedicated to actions on the simulation (execute one transaction, go back one transaction, etc.). The top right part is dedicated to information about simulated elements (e.g., value of variables of simulated blocks). At last, the lower part of the figure displays the simulation trace in the form of a sequence diagram. One can notice a delay of 80 units of time followed with two variable settings, and then the sending of

B. Formal verification

Formal verification generally distinguishes between general properties which can be applied to a large class of systems (e.g., absence of deadlock situations) and properties specific to the system under study. TTool can formally verify properties using UPPAAL [START_REF] Bengtsson | Timed automata: Semantics, algorithms and tools[END_REF]. AVATAR design models are first translated to timed automata that are further provided as input to UPPAAL. In TTool, properties to be verified can be expressed in the following ways:

1) The absence of deadlock can be easily verified by checking a specific option in the formal verification dialog window. 2) Reachability and liveness of given elements of state machine can be evaluated with a simple right-click on those elements. As an example, Figure 5 presents the TTool dialog window when studying the reachability and liveness of the state (EmergencyTakenIntoAccount) defined in the PlausibilityCheck block. 3) A given CTL formulae can be verified directly from TTool. Unfortunately, the CTL formula has to be provided according to the UPPAAL automata corresponding to the AVATAR model. Differently said, an engineer who wants to prove a given CTL formulae has to understand the UPPAAL automata produced by TTool from the SysML models. 4) Observers are blocks which are added to the system design in order to check for given properties. Observers have to be written by hand, and are supposed to be non intrusive on the system. Observers generally contain a specific error state that the observer reaches whenever one of the properties it observes is not satisfied. Using TTool, it therefore suffices to search for the non reachability of those error states. 5) SysML diagrams can also be used to formally express system properties. Indeed, we have defined TEPE, a property language settled on SysML parametric diagrams. TEPE can be used to express properties in terms of logical and temporal relations between system events and attributes [1] [16]. Today, TTool can automatically take into account only basic TEPE properties, and so, complex properties have to be translated by hand into another form, e.g. in CTL or as system observers. TEPE is formally defined with Metric Temporal Logic (MTL) [START_REF] Koymans | Specifying Message Passing and Time-Critical Systems with Temporal Logic[END_REF] and Fluent Linear Temporal Logic (FLTL) [START_REF] Letier | Fluent temporal logic for discrete-time event-based models[END_REF], but those two temporal logic remain hidden in TTool.

VII. PROTOTYPING

Again, from an Avatar design model, TTool generates a C/POSIX code at the push of a button. The code can be compiled for the local host, or for the SoCLib platform: in that latter case, MutekH, the generated code and the AVATAR runtime are compiled and linked against the generated C/POSIX code. The prototyping phase is intended to be applied on refined models. Indeed, the prototyping phase is particularly useful to evaluate whether a given hardware platform is well suited to execute a given set of software components. A refined model is a model in which some abstractions of a more abstract model have been resolved. For example, AVATAR designs make it possible to abstract algorithms with their estimated durations: a computeFor(minDuration, maxDuration) can be added to state machines transitions. Another example of abstraction is to let branches of choices undetermined, that is, at a high level of abstraction, all branches of choices may be considered. At formal verification level, this means that all branches have to be explored. But on a more refined model, branches of a choice are not randomly taken, but they are usually rather selected according to the result of operations. Finally, abstractions shall be resolved before doing the prototyping phase. To do so, an AVATAR user could use the AVATAR state machines to put more information in its model. Unfortunately, when coming to complex algorithms -e.g., in our case, cryptographic algorithms -, a graphical model based on state machines is not practical. Therefore, the best option is probably to directly replace given elements of an AVATAR design with its corresponding implementation code, e.g. replacing a computeFor(minDuration, maxDuration) by the C algorithm it models. If this C code included into the model is actually ignored by the integrated simulation and formal verification capabilities of TTool, this code can be automatically included in the POSIX/C code generated by TTool. Finally, the most abstract AVATAR models performed with TTool generally represent the control part of applications, and are thus often amenable to simulation and formal verification. On the contrary, more refined models resolve non determinism behaviors with low-level representations (e.g. in C) of data and algorithms. Those refined models are not amenable to simulation and formal verification, but are definitely useful for prototyping purpose.

We now basically explain how TTool generates C/POSIX code from AVATAR designs.

A. Code generation

Basically, the C/POSIX code generator of TTool works as follows:

• One .c and one .h file which contains a representation of the state machine are generated for each block. The translation of operations on variables, method calls and tests is quite straightforward. On the contrary, synchronous data exchange, asynchronous data exchange, and time manipulation are more complex and are thus handled by the AVATAR library (i.e., the AVATAR runtime). • The main file (main.c) is in charge of defining one thread per block, setting the attributes of those threads (e.g., on which CPU each thread must be executed, which scheduling policy to use, etc.), starting all threads, and finally waiting for their termination.

B. The AVATAR runtime

The AVATAR runtime is a set of libraries that handle all synchronous and asynchronous communications between blocks. Basically, it relies on data structures to store requests from blocks, and on mutex and condition variables to achieve necessary synchronization between threads of blocks. Its implementation is lightweight (about 2000 lines of C code). The AVATAR runtime is automatically linked against the generated code when compiling the latter.

C. Example with the automotive application

The model of the active braking system can be prototyped as described here. The generated source code is usually first prototyped on the local platform. A simple reason for this is that the final hardware target may not yet be available, or even clearly defined. However, when the hardware platform has been specified, the prototyping phase is as follows:

1) Generation of the cross-compiler. A cross-compiler for the target platform must be generated. In our example, we have used gcc-based cross-compilers. In the scope of our example, we have prototyped the active baking application on various 32-bit processor architectures, including PowerPC, Arm, Mips and Sparc. 2) Generation of the C/POSIX code. From an AVATAR model in which non deterministic behaviors have been resolved (ideally), TTool generates a set of .c and .h files, as explained in previous sections. The main file describes how threads are mapped on the different CPUs. 3) Compilation of the code. The generated C code, the AVATAR runtime, and MutekH are compiled with the cross-compiler, and linked together as one executable file. The executable file could obviously be run on the real hardware or a virtual prototyping platform built using SoCLib. 4) Prototyping with SoCLib. The SoCLib simulator is started with the desired hardware configuration which runs the executable file generated at previous step.

Our example has been tested on several processors: PowerPC, which are wildly uses in automotive systems, but also Mips, Arm and Sparc processors. In all cases, we have used a 5 processors: one CPU per ECU, and one CPU to execute the environment blocks. 5) Result analysis. Results of the prototyping simulation can be visualized either in the console, or directly in TTool as a UML sequence diagram (see Figure 6). The GNU debugger gdb can also be used to have more information about the execution of the code, e.g., about memory allocations, to perform step-by-step execution, to monitor which threads are currently executing, etc.

Using traces, important prototyping information can be obtained. In our case, the latency between the receiving of an emergency message and the corresponding braking action can be clearly evaluated for each processor type.

VIII. RELATED WORK AND DISCUSSION

The contribution presented in this paper is twofold. First, it is based on a SysML-based modeling environment (TTool). Second, the prototyping phase relies on a prototyping platform (SoCLib based) and an embedded operating system (MutekH).

A. Modeling and verification environments

Like many other formalized UML-based environments, AVATAR gives a formal semantics to design diagrams, and integrates the possibility to formally express properties with a SysML diagram, a feature usually not supported by other environments. Indeed, the latter commonly rely on formalisms external to UML, e.g., temporal logic formulae, or CCSL in MARTE [START_REF] Mallet | The clock constraint specification language for building timed causality models[END_REF]. The environment presented in [START_REF] Da Silva | Integrating sysml and model-checking techniques for the v&v of space-based embedded critical software[END_REF] offers verification capabilities from UML diagrams captured in the Rhapsody toolkit. But, contrary to AVATAR and TTool, this environment does not support a full engineering process, and in particular, it does not offer any facility for requirement capture or prototyping. Verification takes as input CTL formulae. In TTool, reachability or liveness properties of an action can be verified with a right-click on that action.

The OMEGA environment [START_REF] Ober | Omega2: A new version of the profile and the tools[END_REF] integrates requirement capture in its methodology and toolkit. Unfortunately, properties can not be easily derived from requirements and used within the verification framework. Both TTool and OMEGA do not support continuous streams. On the contrary, the Artisan toolkit [START_REF] Atego | Artisan studio[END_REF] supports them, and also allows for probabilities on transitions, and manages interruptible regions.

The TopCased environment [START_REF] Farail | The topcased project: a toolkit in open source for critical aeronautic systems design[END_REF] is developed within the Eclipse framework, itself recently enriched with Papyrus [START_REF] Cea | Papyrus[END_REF]. TopCased regroups several model analysis tools and code generators mostly implemented with model transformation techniques. As a whole, TopCased has probably much more functionalities than TTool. the latter is more focused on an engineering process with dedicated third-party tools.

UML/SysML to ESL [START_REF] Vielhl | Formal performance analysis and simulation of UML/sysML models for ESL design[END_REF] targets the modeling of Systemon-Chips and supports simulations and formal proofs from UML models. Worst case execution times can be computed as well. But the communication semantic is more limited than in AVATAR. More generally, research on high-level electronic design has led to the definition of several environments: SysML to VHDL-AMS [START_REF]Sysml-companion: Virtual prototyping from sysml models[END_REF] or SysML to Simulink [START_REF] Vanderperren | From UML/SysML to Matlab/Simulink: current state and future perspectives[END_REF]. In mechanics also, SysML is used conjointly with Modelica [START_REF] Paredis | An overview of the sysml-modelica transformation specification[END_REF].

Other non-UML environments make it possible to model a system and formally verify it. UPPAAL [START_REF] Bengtsson | Timed automata: Semantics, algorithms and tools[END_REF] is a good example of such environments. UPPAAL can indeed model a system in terms of communicating temporal automata. The formal verification of CTL properties is directly embedded into the toolkit. But, UPPAAL can definitely not support a whole engineering process nor it can support the documentation of a project. This remark applies to other formalisms -and their related toolkits -such as Petri nets and the TINA toolkit [START_REF] Berthomieu | Time petri nets analysis with tina[END_REF], or LOTOS and the CADP toolkit [START_REF]The CADP toolkit[END_REF].

B. Prototyping platforms

Prototyping platforms have been proposed at different levels of abstractions. At a very high-level of abstraction, the DIPLODOCUS/TTool approach [START_REF] Apvrille | A UML-based Environment for System Design Space Exploration[END_REF] targets the design space exploration of Systemon-chips. Application functions can be mapped on abstract CPUs or hardware accelerators, and then can be evaluated with simulation [START_REF] Knorreck | Fast simulation techniques for design space exploration[END_REF] or formal verification techniques [START_REF]Formal system-level design space exploration[END_REF]. However, results that can be expected at that level of abstractions are related to bus or CPU loads, rather than to a precise timing execution on a hardware platform. SystemC is a widely spread set of C++ libraries and simulation kernel for modeling and implementing electronic systems [34] [35]. Several levels of abstraction have be defined in SystemC, ranging from transactional level modeling to a cycle accurate level modeling. The SoCLib library of component models [START_REF] Soclib | SoCLib: an open platform for virtual prototyping of multiprocessors system on chip (webpage)[END_REF] is based on SystemC. SoCLib supports two levels of abstractions: TLM (Transaction Level Modeling) and CABA (Cycle Accurate Bit Accurate). Other open prototyping platforms like SkyEye [START_REF] Skyeye | Webpage of SkyEye[END_REF] and QEmu are not based on SystemC components.

C. Embedded operating systems

Multiple operating system projects are available for use as a target POSIX platform for code generation which have different features and memory footprints. As our approach is based on free software projects for modeling or performing simulations and proofs, the operating system running on the target platform had to be free. This thus rules out VxWorks and similar proprietary operating systems from the scope of our demonstration even if the use of such software is technically possible in our toolchain. The SoCLib prototyping platform has a number of supported operating systems, including UNIX like implementations such as NetBSD as well as some lightweight embedded operating systems.

NetBSD and various Linux flavors are system-call based and require a separate set of user library packages in order to build and run applications. System start-up of such large operating Most embedded operating systems can be used without system-call interfaces, the application is thus compiled along with the kernel and all objects files are linked in a monolithic binary file. Some well known operating systems based on this approach include FreeRTOS, eCos and RTEMS. eCos and RTEMS may suit our needs because of their support in SoCLib, and their implementation of the thread POSIX interface. We expect to support them in the future. The operating system chosen in the scope of our study is MutekH. It offers similar features: it's highly configurable and comes with suitable libraries, and with the additional benefit of heterogeneous multiprocessors support and a better SoCLib integration.

Moreover, when used along with the SoCLib platform, MutekH can be configured to provide necessary information related to memory allocation and execution stack boundaries to the MemoryChecker SoCLib module. This information along with details of memory accesses performed by the processors allow this module to track suspicious memory access and report them to the developer. This feature is of great help on hardware were no Memory Management Units can be used which prevents relying on memory protection to find bugs or undersized stacks [START_REF] Pouillon | A generic instruction set simulator api for timed and untimed simulation and debug of mp2-socs[END_REF]. Those debugging features apply to both operating system and user codes. In our approach, the user code refers both to the generated code and also to the C code directly provided by the user as design model parameters.

IX. CONCLUSIONS AND FUTURE WORK

The combination of AVATAR/SysML/TTool and SoCLib/-MutekH offers an integrated platform for embededd systems engineering and prototyping. Indeed, this platform offers at the same time a well-known modeling language (UML, SysML), an easy-to-use proof environment and a prototyping simulation platform comprising several commonly used microprocessors and operating systems. Simulation, proofs and prototyping can be performed at the push of a button and their results are displayed directly in the model. The paper presents the whole AVATAR methodology and illustrates the contribution with an active braking automotive application. In particular, the formal validation phase demonstrates that emergency messages may result in automatic braking actions. Additionaly, the prototyping phase enables an accurate evaluation of the latency between an emergency message and the braking of the car, taking into account hardware components used in the target platforms.

Our future work intends to apply this methodology to a wider set of embedded systems, including aeronautics platforms.

Fig. 1 .

 1 Fig. 1. Overall methodology

Figure 3

 3 Figure 3 represents the internal block diagram of the active braking use case. This internal block diagram comprises two kinds of blocks:

Fig. 2 .

 2 Fig. 2. Excerpt of the requirement diagram: Denial of Service related security requirements

Fig. 3 .

 3 Fig. 3. Block diagram of the Active braking use case

Fig. 4 .

 4 Fig. 4. Simulation of the active braking automative system

Fig. 5 .

 5 Fig. 5. Reachability and liveness of the state "EmergencyTakenIntoAccount" of the block "PlausibilityCheck"

Fig. 6 .

 6 Fig. 6. Prototyping environment based on TTool, MutekH, and SoCLib