Emmanuel Guivier
email: em.guivier@gmail.com

Jean-François Martin

Nicolas Pech

Arnaud Ungaro

Rémi Chappaz

André Gilles

Microbiota diversity within and between the tissues of two wild interbreeding species

Keywords: core microbiota, mucosal tissues, cyprinid species, introgressive hybridization

Understanding the role of microbiota as reproductive barriers or sources of adaptive novelty in the fundamental biological phenomenon of speciation is an exciting new challenge necessitating exploration of microbiota variation in wild interbreeding species. We focused on two interbreeding cyprinid species, Chondrostoma nasus and Parachondrostoma toxostoma, which have geographic distributions characterized by a mosaic of hybrid zones. We described microbiota diversity and composition in the three main teleost mucosal tissues, the skin, gills and gut, in the parental parapatric populations. We found that tissue type was the principal determinant of bacterial community composition. In particular, there was strong microbiota differentiation between external and internal tissues, with secondary discrimination between the two species. These findings suggest that specific environmental and genetic filters associated with each species have shaped the bacterial communities, potentially reflecting deterministic assemblages of bacteria. We defined the core microbiota common to both Chondrostoma species for each tissue, highlighting the occurrence of microbe-host genome interactions at this critical level for studies of the functional consequences of hybridization. Further investigations will explore to what extend these specific tissue-associated microbiota signatures could be profoundly altered in hybrids, with functional consequences for postmating reproductive isolation in relation to environmental constraints.

Introduction

Microbes are one of the major cell components of vertebrates, in terms of both their numbers (thousands of billions of cells), and their genomic diversity (thousands of highly diverse species) [START_REF] Ursell | Defining the human microbiome[END_REF]. The microbiota is not simply a neutral companion (biological community).

Through its myriad of dynamic interactions with the host, the microbiota is an active partner in many physiological functions, contributing to the overall performance of the organism in immune defense and nutrient assimilation [START_REF] Sommer | The gut microbiota -masters of host development and physiology[END_REF][START_REF] Shapira | Gut microbiotas and host evolution: scaling up symbiosis[END_REF][START_REF] Hird | Evolutionary biology needs wild microbiomes[END_REF]. The microbiota includes representatives from a large panel of phyla, including bacteria, archaea, fungi, and protozoans, but the bacterial community makes up the bulk of this ecosystem [START_REF] Ursell | Defining the human microbiome[END_REF][START_REF] Marchesi | Prokaryotic and eukaryotic diversity of the human gut[END_REF]. Bacteria are present on all interfaces between host tissues and the environment. Studies, essentially in humans, have shown that different body parts such as the skin, oral cavity, lungs and gastrointestinal tract (GIT), are characterized by their own microbiota [START_REF] Costello | Bacterial Community Variation in Human Body Habitats Across Space and Time[END_REF]. Indeed, the different host tissues have specific physical and biological properties, such that each constitutes a particular microhabitat favorable for specific bacterial assemblages [START_REF] Ursell | The interpersonal and intrapersonal diversity of human-associated microbiota in key body sites[END_REF].

Environmental factors shape microbiota composition, but similarities between genetically related individuals (e.g. between family members or within populations) have suggested that there may be a heritable component of microbiota composition. Numerous studies analyzing twins and genome-wide associations (GWA) have provided evidence for a genetic contribution to microbiota composition [START_REF] Spor | Unravelling the effects of the environment and host genotype on the gut microbiome[END_REF][START_REF] Wang | Analysis of intestinal microbiota in hybrid house mice reveals evolutionary divergence in a vertebrate hologenome[END_REF][START_REF] Goodrich | Cross-species comparisons of host genetic associations with the microbiome[END_REF][START_REF] Davenport | Elucidating the role of the host genome in shaping microbiome composition[END_REF]. These host genome-microbiota associations and their global contribution to host fitness, suggested that microbes might be involved in processes of speciation, based on Bateson-Dobzhansky-Muller (BDM) incompatibilities [START_REF] Brucker | Speciation by symbiosis[END_REF]. According to this hypothesis, there should be a detectable host-specific microbiota signature [START_REF] Baxter | Intra-and interindividual variations mask interspecies variation in the microbiota of sympatric Peromyscus populations[END_REF][START_REF] Colston | Invited review: microbiome evolution along divergent branches of the vertebrate tree of life: what's known and unknown[END_REF]. This signature is conceptualized in the term "core microbiota", which defines a consistent set of microbial taxa common to the individuals of a host species [START_REF] Roeselers | Evidence for a core gut microbiota in the zebrafish[END_REF]. Microbiota composition is a complex and heritable polygenic trait [START_REF] Benson | Individuality in gut microbiota composition is a complex polygenic trait shaped by multiple environmental and host genetic factors[END_REF]. Introgressive hybridization induces the disruption of a co-adapted genetic complex, and would therefore be expected to alter interactions between the host genome and microbiota, with potentially deleterious effects, leading to the maintenance of reproductive isolation [START_REF] Wang | Analysis of intestinal microbiota in hybrid house mice reveals evolutionary divergence in a vertebrate hologenome[END_REF][START_REF] Bordenstein | Host biology in light of the microbiome: ten principles of holobionts and hologenomes[END_REF]. However, genomic admixture could also lead to a transgressive phenotype with adaptive novelties in hybrids [START_REF] Nolte | Understanding the onset of hybrid speciation[END_REF]. Indeed, microbiota rearrangement in hybrids may lead to the emergence of favorable physiological functions, facilitating the exploitation of new ecological niches. Thus, changes in the microbiota of hybrids may lead to the establishment of a post-mating reproductive barrier, but they may also act as a potent factor in the ecological speciation or range expansion of one of the two parental species [START_REF] Wang | Analysis of intestinal microbiota in hybrid house mice reveals evolutionary divergence in a vertebrate hologenome[END_REF][START_REF] Brucker | Speciation by symbiosis[END_REF][START_REF] Janson | Phytophagous insect-microbe mutualisms and adaptive evolutionary diversification[END_REF]. The exploration of the microbiota in wild interbreeding species is therefore important for an understanding of the fundamental biological and ecological processes of speciation and range expansion, and the ecology of invasion.

In this study, we explored this exciting research perspective in two interbreeding fish species Parachondrostoma toxostoma (P. toxostoma) and Chondrostoma nasus (C. nasus).

These two cyprinids have been defined as two distinct and different species [START_REF] Durand | Insight into the origin of endemic mediterranean ichthyofauna: phylogeography of Chondrostoma genus (Teleostei, Cyprinidae)[END_REF], and some authors have even separated them into two genera [START_REF] Robalo | Re-examination and phylogeny of the genus Chondrostoma based on mitochondrial and nuclear data and the definition of 5 new genera[END_REF]. However, the range expansion of C. nasus in the area in which P. toxostoma is endemic, over the last century, has resulted in contact zones in which the two species engage in multiple bidirectional hybridization events, which have resulted in a mosaic of hybrid zones [START_REF] Costedoat | Evolution of mosaic hybrid zone between invasive and endemic species of Cyprinidae through space and time[END_REF]. Studies of hybridization and associated phenotypes in wildlife are challenging. In particular, determinations of the relative contributions of the parental genomes to hybrid phenotypes require calibration of the phenotypic characterization of specimens in the allopatric parental populations. However, the sampling strategies required cover different environmental conditions, making it more difficult to separate out the species and environmental effects. Conversely, the sampling of sympatric populations minimizes the environmental effect, but promiscuity and hybridization phenomena may make it difficult to characterize the parental phenotypes.

We therefore decided, as a first step in this research perspective, to characterize the microbiota associated with P. toxostoma and C. nasus in the geographically closest parapatric populations inhabiting the same upstream river separated by dams before the invasion of C. nasus. For the overall microbiota characterization in these interbreeding species, we investigated the microbiota associated with the three main mucosal tissues in teleost fish: skin, gills and gut tissues. These tissues differ in terms of their epithelial structure and immune barriers, physiological functions and the pool of bacteria to which they are exposed. The skin and gills can be defined as external mucosal tissues, due to their exposure to bacteria in the surrounding water. By contrast, the gut is an internal mucosal tissues exposed to the bacteria of the digestive content.

We aimed 1) to characterize the patterns of microbiota diversity and structure associated with mucosal tissues within and between the interbreeding species, 2) to decipher the relative contribution of species, tissue and sex to the defined microbiota composition, and 3) to determine whether the core microbiota of each species in this stream corresponded to a host-specific signature, by comparison with the core microbiota common to both Chondrostoma species.

Materials & Methods

1.

Field sampling

We focused on two freshwater fish species from the Chonsdrostoma species complex:

Parachondrostoma toxostoma (Pt) and Chondrostoma nasus (Cn). We conducted field sampling in August 2015, on two allopatric populations inhabiting the Suran river (France).

These two sampling sites, each characterized by the presence of one of the two species, were separated by 30 km of the watercourse and by a succession of dams, strongly limiting the contact between them and the potential for hybridization (figure 1). We sampled eight Pt specimens from the upstream station (Chavasnes-sur-Suran; latitude: 46.264383, longitude:

5.429392) and eight Cn specimens from the downstream station (Pont d'Ain, latitude:

46.048769, longitude: 5.324263). The collection design was balanced, with four males and four females collected for each species. Using sterile materials, we dissected the caudal fin, the gills (first arch, left side of the fish) and the gut, which we separated into two parts: the midgut and the hindgut (figure 2). A piece of each tissue was stored in 95% ethanol at -80°C for subsequent molecular analyses.

Molecular techniques

We extracted bacterial DNA from the various tissues, with the Qiagen Food Mericon kit (Qiagen, Venlo, Netherlands), according to a slightly modified version of the manufacturer's protocol. Briefly, we used sterile materials to isolate a piece of tissue weighing about 5 mg, which was lysed by incubation in 700 µL of Food Lysis Buffer with 3 µl proteinase K for 3 hours at 56°C. The lysis reaction was stopped by placing the sample on ice. We added 500 µl chloroform, centrifuged the sample at 14,000 x g for 15 min and collected the supernatant. We added 1.2 mL of PB buffer and transferred the sample onto silicate column.

The sample was cleaned with 500 µL AW2 buffer, and the bacterial DNA was eluted in 100 µL EB buffer. The extraction procedure was duplicated for eight samples, and we included three extraction-negative controls to evaluate potential contaminant at this step of the procedure.

We amplified a 251 bp fragment of the V4 region of the bacterial 16S rRNA gene in a slightly modified version of the dual-index method of Kozich et al. [START_REF] Kozich | Development of a Dual-Index Sequencing Strategy and Curation Pipeline for Analyzing Amplicon Sequence Data on the MiSeq Illumina Sequencing Platform[END_REF], as described by Galan et al. [START_REF] Galan | 16S rRNA Amplicon Sequencing for Epidemiological Surveys of Bacteria in Wildlife[END_REF]. Briefly, the forward and reverse V4 primers included 8-bp index and Illumina adapters. The various combinations of forward and reverse indexed primers made it possible to identify each PCR product for pooling and loading into a single MiSeq flow cell. We duplicated the 16S gene amplification for each sample using different tagged primer combinations, and we performed negative PCR controls, including both the DNA extractionnegative controls and two amplification-negative controls. We also amplified a commercially available mock community, the ZymoBIOMICS Microbial community standard (Zymo Research, Irvine, CA, USA) consisting of a mixture of known quantities of DNA from eight bacterial species, in quadruplicate, to evaluate the accuracy of the overall procedure. The conditions of DNA amplification, and the purification and pooling of PCR products were as described by Galan et al. [START_REF] Galan | 16S rRNA Amplicon Sequencing for Epidemiological Surveys of Bacteria in Wildlife[END_REF]. The final library was quantified with the Kapa quantification kit (Kapa Biosystems) and loaded into a MiSeq (Illumina) flow cell (expected cluster density, 120,000 to 140,000/mm 2 ) with reagent kit v3 (Illumina, 2x300 cycles). High-throughput sequencing of the 156 PCR products (72 duplicated samples, 4 mock community and 8 negative controls) was performed within a larger project corresponding to a total of 176 indexed PCR products.

Bioinformatics pipeline

The assembly, denoising, demultiplexing and clustering of the MiSeq dataset obtained were performed with Mothur v.1.34 [START_REF] Schloss | Introducing mothur: open-source, platform-independent, community-supported software for describing and comparing microbial communities[END_REF], according to the standard Mothur MiSeq system operating procedure for Miseq sequences (https://www.mothur.org/wiki/MiSeq_SOP).

Briefly, we merged R1 and R2 reads into contigs, with a threshold phred score quality >25, and we reattributed each sequence to the corresponding sample based on the exact specific index combination. We considered only sequences with no ambiguous nucleotide and a sequence length of 249 to 275 bp. We then aligned the sequence variants to Silva SSU Reference alignment v123 [START_REF] Schloss | Introducing mothur: open-source, platform-independent, community-supported software for describing and comparing microbial communities[END_REF]. We removed the sequences misaligned with the Silva alignment (position start=1968 end=11546) and the sequences matching with chloroplast, mitochondria, archaea and unclassified sequences in this database. We merged clusters of sequences differing by up to two nucleotides, considered as artifactual errors, and we removed the remaining singletons (unique sequences at the level of a sequencing run probably corresponding to sequencing errors). Finally, we detected and eliminated chimeric sequences with the Uchime algorithm

[26], as implemented in Mothur. We applied the entire bioinformatics pipeline to the larger but homogeneous dataset for 176 PCR products pooled for the same NGS run. We obtained a total of 11615,713 denoised sequences. We clustered the 89,714 variants into 11,332 operating taxonomic units (OTU), on the basis of average hierarchical clustering with 97% similarity as the lower threshold, to generate a BIOM-formatted OTU table. For further analyses based on the phylogenetic diversity index, we generated a phylogenetic tree for the representative sequences from each OTU (i.e. the most abundant sequence), using a FastTree algorithm [START_REF] Price | FastTree: computing large minimum evolution trees with profiles instead of a distance matrix[END_REF] implemented in QIIME v. 1.9.1 [START_REF] Caporaso | QIIME allows analysis of highthroughput community sequencing data[END_REF].

Validation of molecular and bioinformatics procedures

We obtained 158,500 to 163,895 denoised sequences for each quadruplicate of the mock community. Based on the known 16S rRNA sequences of the eight bacteria comprising this mock community, we estimated an average 0.05% global discrepancy confounding both PCR and Illumina errors. Moreover, the clustering of the denoised sequences into OTUs revealed that about 97% of the sequences for each mock community matched those for the eight expected OTUs.

We performed three duplicated negative controls for the DNA extraction step and two negative controls for the 16S rRNA amplification step. We obtained 489 to 4,738 denoised sequences for the three duplicated negative extraction controls, and 22 and 724 denoised sequences for the two negative amplification controls. These counts are low relative to the total number of sequences for each sample and were considered negligible given the average sequencing depth of 65,415 sequences for the 148 positive samples (72 duplicated tissue samples and quadruplicated mock community samples). Furthermore, the sequences obtained did not correspond to any systematic contamination. Finally, the detection of 14 to 94 sequences assigned to 16 unused tagged primer combinations indicated a negligible mistagging rate of 0.06% in our final dataset.

We observed a positive correlation between the sequencing depths of duplicates (Pearson's r = 0.99, p<0.001), reflecting strong repeatability of the amplification efficiency and no biases associated with nucleic acid tagging sequences. We normalized the data for sequencing depth, by performing a rarefaction procedure involving random re-sampling, without replacement, of sequences for each sample to the minimal sequencing depth observed in the whole dataset, in this case 13,000 sequences. We removed from the dataset for all subsequent analyses four samples with an insufficient sequencing depth (<7,083 sequences). The procedure was repeated 1,000 times to avoid potential sampling error due to the randomization process. For the 1,000 OTU tables produced, we estimated Good's coverage index and alpha diversity indices: the Shannon (binary logarithm) and phylogenetic diversity (Lozupone & Knight 2008) indices. Then, for each index, we considered the mean value estimated for the 1,000 OTU tables. The mean Good's coverage was estimated at 0.993, indicating that our sequencing depth covered the high degree of diversity of the microbiota studied. We observed strong correlations between duplicates for the Shannon (Pearson's r= 0.99, p<0.001) and phylogenetic diversity (Pearson's r= 0.99, p<0.001) indices, demonstrating the repeatability of PCR amplification and validating the bioinformatics. We therefore combined the sequences from duplicates for further analyses. From the resulting combined OTU table, generated from the merged duplicated samples, we performed a rarefaction procedure on 34,000 sequences, i.e. the minimal sequencing depth of merged samples. We

Statistical methods a. Microbial diversity within mucosal tissues

We characterized the alpha diversity of the microbiota in each tissue, by estimating the classical Shannon index (binary logarithm), and phylogenetic diversity (PD), a qualitative index based on the total branch length of the phylogenetic tree of OTUs [START_REF] Lozupone | Quantitative and qualitative diversity measures lead to different insights into factors that structure microbial communities[END_REF]. We hypothesized that species, tissues, and sex influence the composition and diversity of microbiota. We tested our hypotheses with generalized linear mixed models (GLMMs), in which the alpha index was the response variable, and species, tissue, sex and all two-way interactions were treated as fixed explanatory factors. The models included the specimen as a random factor, as repeated observations (different tissues) were made for each specimen. We also included a variance structure function, in accordance with assumptions concerning the heteroscedasticity of residuals by tissue and by species. The significance of the effects of fixed explanatory factors was determined in likelihood ratio tests. GLMMs were generated with the nlme [START_REF] Pinheiro | nlme: Linear and nonlinear mixed effects models[END_REF] package of R [START_REF] Core | R: A language and environment for statistical computing[END_REF].

b. Divergence of microbiota composition and structure

We estimated the divergence of microbiota composition and structure with four dissimilarity indices providing slightly different information: Bray-Curtis, binary Jaccard, unweighted Unifrac and weighted Unifrac. The Bray-Curtis and binary Jaccard indices are based on the abundance and presence/absence of taxonomic units, respectively, regardless of phylogenetic relationships. The Unifrac distance takes into account phylogenetic relationships between OTUs, by considering the fraction of the total phylogenetic branch length that is unique or common to the communities considered, with or without weighting for the abundance of the taxonomic units [START_REF] Lozupone | UniFrac: a new phylogenetic method for comparing microbial communities[END_REF]. We estimated these four dissimilarity indices for the 1,000 rarefied OTU tables and used the mean values obtained in subsequent analyses.

For each index, we performed a principal coordinate analysis (PCoA), in which the microbiota communities were ordered along axes maximizing the variance between statistical units [START_REF] Paliy | Application of multivariate statistical techniques in microbial ecology[END_REF].

This procedure allows provides geometric information about the contribution of each biological factor shaping the observed divergence of the microbiota. We hypothesized that stochastic and deterministic factors would have different effects on microbiota composition.

Deterministic factors should result in lower dissimilarities of microbiota composition and, thus, lower levels of dispersion away from the centroid of the factor considered, in this case, the tissue. For this purpose, we tested the homogeneity of dispersions of microbiota relative to the centroids between tissues for each species, in multivariate analyses of the homogeneity of group dispersion (the betadisper function of the vegan package [START_REF] Oksanen | vegan: community ecology package[END_REF] of R [START_REF] Core | R: A language and environment for statistical computing[END_REF]) for the four indices, with free and pairwise permutations in post-hoc tests (10,000 iterations).

We performed a main PERMANOVA (adonis function of the vegan package [START_REF] Oksanen | vegan: community ecology package[END_REF]), which is similar to AMOVA. It partitions the sum of squared deviations from the centroids [START_REF] Paliy | Application of multivariate statistical techniques in microbial ecology[END_REF] between explanatory factors. We tested the effects of species, sex, and tissue, and two-way interactions, on the variation of total dissimilarity between microbiota. The significance of the effect of each factor was assessed in an F test based on the sequential sum of squares estimated from a 10,000-permutation procedure. We performed pairwise PERMANOVA as a post-hoc nonparametric test, with 10,000 permutations and the determination of a p-value, the significance of which was determined according to the false discover rate (FDR) correction procedure of Benjamini & Hochberg [START_REF] Benjamini | Controlling the false discovery rate: a practical and powerful approach to multiple testing[END_REF]. Finally, we estimated for each tissue, the proportions of OTUs common to the two species and unique to each species.

c. Phyla associated with mucosal tissues

We characterized the microbiota associated with mucosal tissues at the level of the bacterial phylum, a conservative approach to define the divergence of microbiota composition between samples and grouping taxa with similar biological characteristics and potential physiological functions. We averaged sequence counts for the 1,000 rarefied OTU tables (34,000 sequences), and we then added mean OTU sequence counts at the phylum level.

We characterized the whole-tissue core microbiota as the bacterial phyla common to all tissue samples, firstly for each species considered separately, and then for the Chondrostoma species complex. We then determined the core microbiota of each tissue for each species separately and for the Chondrostoma species complex.

We compared the abundance of bacterial phyla between mucosal tissues for each species and between species for each mucosal tissue. We performed nonparametric t tests (10,000 permutations) in Qiime 1.9.1, with a threshold p-value for significance after FDR correction of 0.05 [START_REF] Benjamini | Controlling the false discovery rate: a practical and powerful approach to multiple testing[END_REF].

Results

Microbial diversity within mucosal tissues

We observed an effect of mucosal tissue on the Shannon and Phylogenetic diversity indices, but this effect differed between the two species studied (Shannon: tissues x species interaction, χ²=16.52, p<0.001; PD: tissues x species interaction, χ²=23.04, p<0.001). In C.

nasus, Shannon diversity differed principally between external (caudal fin and gills) and internal (midgut and hindgut) tissues, which had a less diverse microbiota (figure 3A). In P.

toxostoma, Shannon indices were similarly high for the caudal fin, midgut and hindgut, with only the gills presenting a slightly less diverse microbiota (figure 3A). The pattern of PD index variation discriminated between the external and internal mucosal tissues. Opposite patterns of PD variation between these tissues were observed in the two species. In P. toxostoma, the caudal fin and gills had a lower PD of bacteria than the internal tissues, whereas, in C. nasus, the PD was lower in the gut than in external mucosal tissues (figure 3A). However, the caudal fin-associated microbiota in P. toxostoma was characterized by a high Shannon index but a low PD (figure 3A), suggesting that these communities harbored diverse bacterial taxa that were closely phylogenetically related.

Sex also affected the Shannon and PD indices, and this effect differed between tissues (Shannon: tissues x sex interaction, χ²=11.30, p=0.010, PD: tissues x sex interaction, χ²=8.38, p=0.039). For both indices, we found that the microbiota diversity associated with the caudal fin and gills was characterized by a higher degree of sex dimorphism than observed for the gut microbiota (Figure 3B). The external tissue-associated microbiota was more diverse in females than in males, whereas the microbiota associated with internal mucosal tissues was similarly diverse in the two sexes (Figure 3B).

Finally, the species x sex interaction was not significant for either of the indices considered (Shannon: species x sex interaction, χ²=0.08, p=0.768, PD: species x sex interaction, χ²=0.03, p=0.859).

Divergence of microbiota composition and structure

The two first axes of the principal coordinate analyses highlighted, consistently for the four dissimilarity metrics, the divergence of microbiota composition relative to both mucosal tissue and species (unweighted Unifrac, figure 4; Bray-Curtis, Jaccard and weighted Unifrac distances, figure S2). Within particular, as previously shown for alpha diversity, we observed discrimination between external (caudal fin and gills) and internal (midgut and hindgut) mucosal tissues (figure 4A). We detected no differentiation between the microbiota associated with the two parts of the gut, regardless of the species considered, consistent with microbiota composition remaining constant throughout the length of the gut (midgut/hindgut). PCoA also showed strong homogeneity of gut microbiota composition in P.

toxostoma (figure 4A and4B). This observation was confirmed by analyses of within-group dispersion, which indicated lower levels of dispersion for the gut microbiota than for the caudal fin and gill microbiota in P. toxostoma (pairwise permutations tests, p<0.001, supplementary tables S1 and S2). By contrast, dispersion from the centroid did not differ significantly between tissues for the microbiota in C. nasus (pairwise permutations tests, p>0.05, supplementary table S1).

These graphical observations obtained by PCoA were confirmed by the principal PERMANOVA, which indicated, for the four dissimilarity metrics, a significant effect of tissue

x species interaction (p<0.001, see details for each metric in table 1). Mucosal tissue was the most important explanatory factor for microbiota dissimilarity, with an estimated R² of 0.11 to 0.22. Pairwise PERMANOVA revealed a differentiation of microbiota composition into three groups (caudal fin, gills and midgut/hindgut) within each species (p<0.05, see details for each metric in supplementary table S3). Indeed, the microbiota associated with the midgut and hindgut did not differ in composition, whatever the species considered (PERMANOVA, p>0.05). Finally, pairwise PERMANOVA performed independently for each tissue showed a dissimilarity of microbiota composition between the two species studied (PERMANOVA, p<0.05, see details for each metric in supplementary table S4).

The percentage of OTUs common to the two species was similar for each tissue, at 23% to 27% (supplementary figure S3). C. nasus was characterized by a large number of specific OTUs in the caudal fin and gills, accounting for 59% and 46%, respectively, of the total number of OTUs observed in these tissues. By contrast, P. toxostoma was characterized by a large number of specific OTUs in the midgut and hindgut, accounting for 56% and 58%, respectively, of the total number of OTUs observed in these tissues.

Phyla associated with mucosal tissues

We identified 11,332 OTUs from 41 phyla in our dataset. The all-tissues core microbiota contained OTUs from six phyla in C. nasus and eight phyla in C. toxostoma. The Chondrostoma species complex had an all-tissues core microbiota of five phyla: Acidobacteria, Bacteroidetes, Firmicutes, Proteobacteria and Verrucomicrobia. However, a breakdown by tissue revealed a greater complexity of tissue-specific core microbiotas. The core microbiotas for each tissue had the following compositions: 14, 11, 6 and 9 phyla for the caudal fin, gills, midgut and hindgut, respectively, in C. nasus; 11, 9, 14 and 17 phyla for the caudal fin, gills, midgut and hindgut, respectively, in P. toxostoma and 11, 8, 5 and 9 phyla in caudal fin, gills, midgut and hindgut, respectively, in Chondrostoma species complex (figure 5).

We detected several phyla that differed in abundance between tissues in the two species (figure 6, see details in table S5 and figure S4). The key exception was the microbiotas of the midgut and hindgut, which did not differ significantly in phylum composition, regardless of the species considered. We also found that the abundance of unclassified bacteria was higher in the gills than in the caudal fin in P. toxostoma.

In P. toxostoma, the abundance of Actinobacteria and Bacteroidetes was higher in the caudal fin than in the other three mucosal tissues. The midgut and hindgut were characterized principally by a higher abundance of Cyanobacteria and Proteobacteria than the caudal fin. The hindgut also harbored a higher abundance of Planctomycetes than the external mucosal tissues.

In C. nasus, the abundance of Actinobacteria and Deinococcus-thermus was higher in the caudal fin than in the other three mucosal tissues. Firmicutes bacteria were also more abundant in the caudal fin and gills than in the gut microbiota, which was characterized by a higher abundance of the CKC4 and Fusobacteria phyla than the external mucosal tissues.

All mucosal tissues except the caudal fin displayed differences in the abundance of several phyla between the two interbreeding species (figure 6, see details in table S6). The abundance of Firmicutes, CKC4 and Spirochaetae was higher in the gills of C. nasus than in the gills of P. toxostoma, although these phyla accounted for only a small proportion of the microbiota (mean proportion below 1%, table S3). The midgut of C. nasus harbored a high abundance of Bacteroidetes and CKC4, whereas the abundance of Planctomycetes was high in the midgut of P. toxostoma. A comparison of the hindgut microbiota of the two species highlighted a high abundance of CKC4 and Fusobacteria in C. nasus, and of Cyanobacteria in P. toxostoma.

Discussion

Understanding the role of the microbiota as a reproductive barrier or a source of adaptive novelty in the fundamental biological phenomenon of speciation is an exciting new challenge requiring explorations of microbiota variation in wild interbreeding species. We report here, in two wild populations of P. toxostoma and C. nasus, differences in the microbiota between mucosal tissues. In particular, we observed a strong differentiation of the microbiota between external and internal tissues, with opposite patterns of bacterial diversity in these tissues between the two interbreeding species. These findings suggest that specific environmental and genetic filters have shaped the microbiota and may reflect deterministic assemblages of bacteria. We defined a shared whole-body core microbiota common to the two Chondrostoma spp., but our results highlight crucial differences between tissues in which local microbe -host genome interactions occur. If genome plays an important role in the determination of microbiota, the specificity of the microbiota defined for each tissue and species could be profoundly altered by genetic admixture in hybrids in the sympatric area.

We found that the nature of the tissue was a critical primary determinant of microbiota diversity and composition. Intraindividual microbiota variation between tissues has been little explored in wild animal species [START_REF] Sabino-Pinto | Composition of the cutaneous bacterial community in japanese amphibians: Effects of captivity, host species, and body region[END_REF], and has been the subject of only a few studies in humans [START_REF] Costello | Bacterial Community Variation in Human Body Habitats Across Space and Time[END_REF][START_REF] Ursell | The interpersonal and intrapersonal diversity of human-associated microbiota in key body sites[END_REF][START_REF] Huttenhower | Structure, function and diversity of the healthy human microbiome[END_REF]. Our results highlight a "whole-body" view of the intraindividual microbiota in wild fish species. This intraindividual variation, which is consistent within a species, is driven by environmental and genetic factors [START_REF] Benson | Individuality in gut microbiota composition is a complex polygenic trait shaped by multiple environmental and host genetic factors[END_REF]. The different sources of bacteria in contact with mucosal tissues probably account for the major differences in the microbiota between external tissues (such as the caudal fin and gills, in contact with the surrounding water), and internal tissues (such as the midgut and hindgut, in contact with the bacteria present in the diet). River water is a favorable environment for bacterial growth, and the external mucosal barriers (the skin and the gills), are in constant contact with this source of bacteria. River water is also a source of bacteria for the gut microbiota [START_REF] Smith | Dietary input of microbes and host genetic variation shape among-population differences in stickleback gut microbiota[END_REF][START_REF] Giatsis | The impact of rearing environment on the development of gut microbiota in tilapia larvae[END_REF], but the structure of the GIT microbiota depends principally on the dietary regime of the fish [START_REF] Muegge | Diet drives convergence in gut microbiome functions across mammalian phylogeny and within humans[END_REF][START_REF] Ingerslev | The development of the gut microbiota in rainbow trout (Oncorhynchus mykiss) is affected by first feeding and diet type[END_REF][START_REF] Liu | The gut microbiome and degradation enzyme activity of wild freshwater fishes influenced by their trophic levels[END_REF]. A meta-analysis showed that the composition of the gut microbiota in different fish species was determined by their trophic level: herbivorous, omnivorous or carnivorous [START_REF] Sullam | Environmental and ecological factors that shape the gut bacterial communities of fish: a meta-analysis: Fish gut bacterial communities[END_REF].

In addition to local abiotic factors, such as temperature, pH and oxygenation, which can have selective effects on bacteria by providing favorable growth conditions, the physiology of the local host tissues, and their immune responses in particular, may select for a microbiota with a specific composition [START_REF] Hooper | Interactions between the microbiota and the immune system[END_REF]. Little is known about mucosal immunity in teleost fish, but the three main mucosal lymphoid tissues (skin, gills and gut) differ in their cellular organization and are characterized by different immune components [START_REF] Gomez | The mucosal immune system of fish: The evolution of tolerating commensals while fighting pathogens[END_REF]. We also observed an effect of sex on the diversity of the external tissue microbiota. Sex dimorphism in microbiota composition has been reported in many studies, but particularly for the gut microbiota [START_REF] Li | The influence of weight and gender on intestinal bacterial community of wild largemouth bronze gudgeon (Coreius guichenoti, 1874)[END_REF][START_REF] Bolnick | Individual diet has sex-dependent effects on vertebrate gut microbiota[END_REF][START_REF] Gomez | The gut microbiome in autoimmunity: Sex matters[END_REF]. Sex hormones can modulate host physiology strongly, particularly in terms of the development of effective immune responses to infection [START_REF] Nunn | On sexual dimorphism in immune function[END_REF]. The higher diversity of bacteria in the skin and gills of females than in those of males may therefore reflect differences in hormonal status, leading to a downregulation of defense barriers in females.

Further analyses of the relationships between tissue transcriptomes and the microbiota present could provide support for these close, local host-microbe interactions.

The two interbreeding species studied each displayed their own specific variation of microbiota diversity and composition between tissues. Our results highlight the absence of a similar general pattern in fish species for microbiota diversity in the external and internal tissues, indicating that interspecific microbiota comparisons are possible only for given tissues. The skin mucosa in teleost fish constitutes an important active dynamic immunological barrier to infection and the composition of the skin-associated microbiota may result from close interactions with host immune genes [START_REF] Larsen | Diversity of the skin microbiota of fishes: evidence for host species specificity[END_REF]. Simkova et al. [START_REF] Šimková | Genomic porosity between invasive Chondrostoma nasus and endangered endemic Parachondrostoma toxostoma (Cyprinidae): The evolution of MHC IIB genes[END_REF] reported differences in Mhc gene polymorphism between P. toxostoma and C. nasus, which had a smaller number of specific alleles. Conversely, C. nasus had a larger number of Mhc variants per specimen. This immunogenetic polymorphism between the two species may reflect interspecific variation of the phylogenetic diversity of the skin microbiota observed. The gut microbiota is also highly dependent on dietary regime. Chondrostoma nasus is a perilithon grazer with a diet composed of diatoms and chlorophytes, whereas P. toxostoma has a slightly more diverse regime based on algae and invertebrate prey [START_REF] Corse | Trade-off between morphological convergence and opportunistic diet behavior in fish hybrid zone[END_REF], although there is a dietary overlap between the two species, depending on environmental condition (i.e. particularly in similar environmental conditions, [53]). In heterogeneous environmental conditions, the difference in dietary regime between the two interbreeding species may account for the poorly diverse gut microbiota in C. nasus and the high diversity observed in P. toxostoma. However, the similarity of the environments from which these two species were sampled (parapatric populations) implies that the gut microbiota diversity observed probably results at least partly from the diversity of food ingested, but also from the bacterial functions required for nutrient assimilation and host compatibility. In particular, we detected a very strong homogeneity of gut microbiota composition in P. toxostoma specimens, suggesting that there may be strong deterministic factors, such as local host gene expression in gut tissue [54,55].

The core microbiota common to the two interbreeding species studied was restricted to five phyla: Acidobacteria, Bacteroidetes, Firmicutes, Proteobacteria and Verrucomicrobia.

These bacterial phyla are consistent with those generally described in fish microbiota studies (see review [56]). The core microbiota is the set of bacterial taxa systematically associated (i.e.

stable in space and time) with the host organism studied. In our study, the core microbiota were defined in only one locality and therefore was probably larger than a specific signature common in all environmental contexts. The existence of a core microbiota at a high taxonomic level should reflect associated functions common to the members of the phylum [START_REF] Bordenstein | Host biology in light of the microbiome: ten principles of holobionts and hologenomes[END_REF]. The stability of the core microbiota is also linked to the idea of consistent microbial communities associated with organisms and forming a biological unit: the holobiont [START_REF] Brucker | Speciation by symbiosis[END_REF]. However, even if defined to a specific environmental context in our study, the variation of the core microbiota between tissues highlighted the local tissue-specific interactions between bacteria and a host genome, a situation more complex than considering host-microbe interactions as a single unit at the whole-body scale. Indeed, we defined core microbiotas of six to 17 phyla, depending on the tissue and species considered. For example, the core microbiota in P. toxostoma consisted of 11 phyla in the caudal fin and 17 phyla in the hindgut, whereas the core microbiota of the corresponding tissues of C. nasus contained 15 and nine phyla, respectively.

This pattern highlights the dependence of the core microbiota in relation to host tissues and lead to the hypothesis of different impact of introgressive hybridization on the microbiota associated to the tissues considered.

The relative abundance of phyla varied between tissues and species. Phylum abundances in the gut microbiota differed between the two species, potentially due to differences in diet, as described above. In particular, the high abundance of Cyanobacteria and Planctomycetes in P. toxostoma was similar to that observed in the gut microbiota of the grass carp (Ctenopharyngodon idella), consistent with a basically herbivorous dietary regime [57].

In C. nasus, the abundance of Bacteroidetes, known to be associated with fermentative metabolism and the degradation of cellulose from plant materials [58], and Fusobacteria, known to produce large amounts of vitamin B12, may reflect requirements for metabolic functions [59]. These abundant phyla, their relevance in specific dietary conditions and for functional activities, suggest that changes to the gut microbiota in hybrids could have a profound impact on nutrient absorption and other critical physiological functions.

In conclusion, our study reveals intraindividual variation in the microbiota associated with particular mucosal tissues. The species signature of microbiota may reflect the role of deterministic factors, such as host genome in particular, in controlling the constitution of bacterial assemblages, even if environmental factors would also influence the microbiota composition observed. The close interactions between the host genome/transcriptome and tissue-associated microbiota could be profoundly altered by genetic admixture in hybrids, with an impact on performance relative to environmental constraints [START_REF] Wang | Analysis of intestinal microbiota in hybrid house mice reveals evolutionary divergence in a vertebrate hologenome[END_REF]60]. Further investigations will be required to explore microbiota rearrangement in hybrids and its consequences for post-mating reproductive isolation, shaping the geographic mosaic of hybrid zones.

Corse

  checked for a significant correlation between the eight extraction duplicates for the Shannon (Pearson's r=0.99, p<0.001 and PD (Pearson's r=0.99, p<0.001) indices. These results indicated no bias specific to a particular tissue type, and we stored one of the duplicated extraction samples, chosen at random. Finally, we generated rarefaction curves for the two alpha indices for 10 to 100,000 sequences, with 20 steps and 100 iterations. The patterns for both indices showed that the values rapidly reached a horizontal asymptote at a sequencing depth of 20,000 sequences (supplementary figureS1), confirming the consistency of the index values, estimated at 34,000 sequences. We considered the entire procedure, from DNA extraction to the estimation of the different diversity indices, to be validated, and we performed further analyses.

Figure 1 .

 1 Figure 1. Map of the Ain region (France) showing the two sampling sites in the Suran river.

Figure 2 .

 2 Figure 2. Diagram representing the locations of tissues sampled on fish species.

Figure 3 .

 3 Figure 3. Alpha diversity indices of microbiota in tissues in relation to A) species and B) sex.

Figure 4 .

 4 Figure 4. Principal Coordinates Analysis exploring the effect tissues and species on the

Figure 5 .

 5 Figure 5. Core microbiota of Chondrostoma species in each tissue at the phylum taxonomic

Figure 6 .

 6 Figure 6. Cumulative bar charts of main bacterial phyla present in mucosal tissues of C. nasus

  E, Pech N, Sinama M, et al (2015) When Anthropogenic River Disturbance Decreases Hybridisation between Non-Native and Endemic Cyprinids and Drives an Ecomorphological Displacement towards Juvenile State in Both Species. PLOS ONE 10:e0142592. doi: 10.1371/journal.pone.0142592

	54. Mansfield GS, Desai AR, Nilson SA, et al (2010) Characterization of rainbow trout
	(Oncorhynchus mykiss) intestinal microbiota and inflammatory marker gene expression
	in a recirculating aquaculture system. Aquaculture 307:95-104. doi:
	10.1016/j.aquaculture.2010.07.014
	55. Batista S, Ozório ROA, Kollias S, et al (2016) Changes in intestinal microbiota, immune-
	and stress-related transcript levels in Senegalese sole (Solea senegalensis) fed plant
	ingredient diets intercropped with probiotics or immunostimulants. Aquaculture
	458:149-157. doi: 10.1016/j.aquaculture.2016.03.002
	56. Llewellyn MS, Boutin S, Hoseinifar SH, Derome N (2014) Teleost microbiomes: the state
	of the art in their characterization, manipulation and importance in aquaculture and
	fisheries. Front Microbiol. doi: 10.3389/fmicb.2014.00207
	57. Wu S, Wang G, Angert ER, et al (2012) Composition, diversity, and origin of the bacterial
	community	in	grass	carp	intestine.	PLoS	ONE	7:e30440.	doi:
	10.1371/journal.pone.0030440
	58. Flint HJ, Bayer EA, Rincon MT, et al (2008) Polysaccharide utilization by gut bacteria:
	potential for new insights from genomic analysis. Nat Rev Microbiol 6:121-131. doi:
	10.1038/nrmicro1817
	59. Tsuchiya C, Sakata T, Sugita H (2007) Novel ecological niche of Cetobacterium somerae,
	an anaerobic bacterium in the intestinal tracts of freshwater fish. Lett Appl Microbiol
	0:071018031740002-??? doi: 10.1111/j.1472-765X.2007.02258.x
	60. Li Z, Wright A-DG, Si H, et al (2016) Changes in the rumen microbiome and metabolites
	reveal the effect of host genetics on hybrid crosses: Changes in rumen microbiome and
	metabolites. Environ Microbiol Rep 8:1016-1023. doi: 10.1111/1758-2229.12482

Table 1 .

 1 Main PERMANOVA exploring the effect of species, tissues and sex on dissimilarity distances between microbiota compositions. The models included species, tissues, sex and interaction of order 2 and were performed independently on Bray-Curtis, Jaccard, unweighted Unifrac and weighted Unifrac distance matrices. The terms were added sequentially and tested on pseudo-F value and random distribution estimated after 10,000 permutations.

	species
	C. nasus
	P. toxostoma
		Caudal fin Gills	Midgut	Hindgut
	Mucosal tissues	Mucosal tissues
	C. nasus	P. toxostoma

Acknowledgments:

We are grateful to Maxime Galan (UMR CBGP, Montferrier-sur-lez) for technical advices. We thank the plateform Genotypage -Séquençage (Université Montpellier, IRD, CNRS, EPHE), and particularly Frédérique Cerqueira for her technical help. We are also grateful to Benjamin Hérodet (Fédération de l'Ain pour la pêche et la protection des milieux aquatiques) for help in the carrying out of the field sampling. The study has been funded by Electricité de France within the project FACIES developing scientific advances in favor of Aquatic System Biodiversity.

Supplementary


Keywords: UML, MARTE, AADL, thread execution semantic

From UML to AADL: a Need for an Explicit Execution Semantics Modeling with MARTE

Matthias Brun 1 , Madeleine. Faugère 2 , Jérôme Delatour 1 , Thomas Vergnaud 3 1: ESEO, 4 rue Merlet de la Boulaye, 49009 Angers Cedex -France 2: Thales Research and Technology Software Research Group, RD 128 -91767 Palaiseau Cedex -France 3: CNES, 18 avenue Edouard Belin, 31055 Toulouse Cedex -France

Abstract:

A modeling process for real-time embedded systems may involve the coordinated use of several languages. Each of these languages are dedicated to a particular phase of development (specification, design, test, ...) and coupled with various tools (scheduling analysis, formal verification, model checker,...). The combined use of UML and AADL is an increasing practice. UML and its recent MARTE (Modeling and Analysis of Real-Time and Embedded systems) profile seem suitable for capturing requirements, analysis and preliminary design. AADL is tailored for the detailed design phase and offers linked validation and verification tools.

In order to combine UML/MARTE and AADL, translation mechanisms between these two formalisms have to be defined. Previous works have defined translations between the structural concepts of AADL and MARTE artifacts. However, the behavioral aspect have also to be treated. The presented work focuses on the translation of the thread execution and communication semantics. It is a pragmatic and on-going approach, validated in an industrial context, on representative examples.

Introduction

In order to overcome the increasing complexity of real-time embedded systems, the coordinated use of several modeling languages is more and more investigated. Indeed, different software specialists (in analysis, software architecture, design, real-time scheduling, test, safety...) must cooperate. For various reasons (cultural, educative, on the availability of validation and verification dedicated tools...), each of these specialists could use different modeling formalisms. The combined use of UML and AADL is an example of that kind of practice. UML and its recent MARTE (Modeling and Analysis of Real-Time and Embedded systems) profile seem suitable for capturing requirements, analysis and preliminary design. AADL is more tailored for the detailed design phase and offers tools such as scheduling analyzers, code generators.

In order to allow the use of UML/MARTE and then, AADL, translation from UML to AADL has to be defined. Different approaches could be considered. We choose to work on the study of the AADL concepts and their representations in UML/MARTE. Different reasons explain this choice: the semantic gap between these two formalisms could be huge (and some UML/MARTE concepts are certainly not present in AADL), UML/MARTE allowed different modeling styles (Object-Oriented, Component-Oriented) whereas AADL is a component approach, an annex to the MARTE standard already deals with the translation between AADL constructs (components and features) and MARTE artefacts. In this approach, we extend MARTE annex and previous work initiated by Thales [START_REF] Faugere | MARTE: Also an UML Profile for Modeling AADL Applications[END_REF] by the consideration of the behavioral semantics translation. The presented work focuses on the translation of the thread execution and communication semantics. These parts are those which are precisely defined in the AADL standard. The other parts, belonging to the behavioral aspect, are still in discussion in the AADL standard. After an overview of the UML/MARTE and AADL languages, a simple example will be presented. Based on this example, the translation of the thread execution semantics and the communication semantics will be detailed. Finally, we draw conclusions.

UML/MARTE and AADL overviews

UML/MARTE MARTE (A UML Profile for Modeling and Analysis of

Real-Time and Embedded systems) [START_REF]UML Profile for Modeling and Analysis of Real-Time and Embedded systems[END_REF] is the new UML profile extension for real-time and embedded systems standardized mid 2007 at OMG (Object Management Group). MARTE defines concepts in terms of UML extensions needed to model and analyze real-time and embedded systems (RT/ES). Today, UML is a well spread and used language in the Software Engineering Community, supported by many commercial tools. This unified language provides a useful abstraction to object-oriented language and approaches, facilitating application design as well as common and simple means of communication between designers. With MARTE, these capabilities are extended to real-time and embedded domains, enabling both 1) RT application, software platform and hardware design, and 2) validation when coupled to verification tools through analysis characteristics specification. MARTE proposes different artefacts to characterize a RTE system: 1) a non functional-property and value specification language 2) a rich time modeling extension allowing to explicitly design the relation of concepts to clocks (during modeling or analysis phases) 3) software and hardware modeling capabilities 4) allocation capabilities providing a link between applications and platforms, 5) support for quantitative analysis (i.e. scheduling and performance) [START_REF]UML Profile for Modeling and Analysis of Real-Time and Embedded systems[END_REF] [START_REF] Gérard | MARTE: A New Standard for Modeling and Analysis of Real-Time and Embedded Systems[END_REF]. The benefits of using this profile for the designers are manifold. First, this language provides a common way to share RTE models between designers: multiple views (functional, non-functional, analysis, software and hardware resources, components…) may be shared between different actors to validate specific application aspects. Secondly, UML/MARTE allows the modeling and thus the capitalization of specific RT languages, and operating systems through run-time or run-time API modeling. Such run-time libraries greatly help the designer to align application domain semantics to run-time behaviours. Finally, such explicit run-time features facilitate model transformation specification.

AADL

AADL (Architecture Analysis & Design Language) [START_REF] Sae Standard | Architecture Analysis and Design Language[END_REF] is an architecture description language (ADL) standardized by the Society of Automotive Engineers (SAE). It is particularly targeted at the description of distributed real-time and embedded systems. The AADL standard defines both textual and graphical syntaxes to describe architectures based on components. Unlike UML, AADL provides a single view (with different possible syntaxes) to represent models. Thus, all information can be integrated on a single diagram (or text file). The AADL standard defines several categories of components; each category corresponds to specific semantics. Processes, threads, thread groups, data, subprograms and subprogram groups are used to model software applications. They allow for the modeling of data structures and software topologies. Processors, virtual processors, memories, buses, virtual buses and devices are used to describe the hardware environment topology on which software applications are deployed. In addition, processors and devices can be used to describe the hardware elements of an application. AADL systems and abstract components are used as containers for other components or to allow for a certain level of inaccuracy in the early stages of the modeling process; they help in structuring architectures. Components can contain subcomponents; hence AADL architectures are hierarchical. AADL components can have interfaces, called "features". Features can be communication ports, required or provided accesses to subcomponents, or required or provided accesses to subprograms. Thus, the AADL syntax can explicitly describe common communication paradigms (message passing, remote procedure calls, distributed memory). Component composition describes the structure of architectures. AADL allows for the characterization of these components: properties can be associated with each architecture element (components, subcomponents, features, connections, etc.). AADL properties are used to specify constraints (e.g. execution time, memory size) or characteristics (e.g. period, thread dispatch policy). They can also be used to describe configuration parameters (e.g. the network address of a processor). AADL defines a set of standard properties and defines semantics for them, so that they can be interpreted by analysis and generation tools. AADL constructions describe application structures that encapsulate algorithms. Algorithms can be specified using some syntactical constructions, through a behavior annex, or by associating source code with AADL components. Algorithms control the execution of the application, according to the different parameters provided by the architecture description (topology and execution parameters given by AADL properties). AADL descriptions gather all required information to define applications. Therefore, they can be used as backbones for various processings, including documentation generation, simulations, formal analysis and code generation. Algorithms encapsulated in AADL components can interact with the outside environment through the component features. The AADL standard defines semantics associated with AADL constructions. Hence AADL specifies the actual behavior (regarding inter-component communications and execution) implied by the architectural constructions. AADL tools can rely on the same asumptions for their processings. The execution & communication semantics defined by the AADL standard restricts the possibilities for application design: for example, it is difficult to describe multimedia-oriented applications.

In counterpart, because of the implicit behavior specifications associated with AADL constructions, AADL models can be processed by application generators [START_REF] Vergnaud | Modeling and generating tailored distribution middleware for embedded realtime systems[END_REF] that produce source code from the AADL components. Generated source code is linked with algorithm source code through specified API. AADL applications are to be executed on the top of an AADL runtime that provides scheduling and communication services. Such a runtime is configured according to the architecture description.

A simple case study : a client/server architecture

In order to better communicate the need to make explicit the execution semantics of AADL components with UML/MARTE, the simple client/server architecture is used in this paper to illustrate the development process of a system with both UML/MARTE and AADL. This simple case study aims to illustrate the positioning of AADL relating to UML/MARTE during the development process. It also aims to underline the impact of the implicit concepts involved by the AADL standard. This section introduces the case study using UML 2.1.1 [9]. The client/server pattern involves major concepts met in real-time systems: concurrent entities (known as «schedulable resources» in UML/MARTE and «threads» in AADL) and communication between these kinds of entities. As shown in figure 1, at the highest level of representation, the client and the server are two entities that communicate. This can be described in UML. The communicated protocol are not specified at this level. In order to translate the UML/MARTE client/server description to an AADL description, AADL mechanisms (or concepts), such as AADL concurrent entities or AADL communication, have to be directly used during UML/MARTE modeling phases. Making explicit the semantics of such AADL mechanisms, with the UML/MARTE formalism, allows to make the designer aware of these semantics early in the development process. The following part introduces how to take into account (during UML/MARTE modeling phase) the AADL components relevant to the case study and how to make explicit their semantics using UML/MARTE (particularly thread execution semantics). The next part introduces the communications intended by the AADL standard and their corresponding UML/MARTE models.

AADL thread execution semantics model with UML/MARTE

AADL concurrent entities are designed with thread components. These components are bound to processor components and executed within the virtual address space of process components.

In this case study, architecture designers have then to specify which threads execute the client and the server. Moreover, they may have to specify the thread allocations on the processor(s). For example, in the case study, designers may choose to execute the client and the server each in its own thread, on separate processors. Without considering thread communications, figure 3 illustrates the AADL specification of the client/server case study with that configuration. Regarding the structure, UML/MARTE concurrent entities (corresponding to AADL threads) may be specified with the swSchedulableResource that is defined in the Software Resource Modeling package (SRM) [START_REF] Faugere | MARTE: Also an UML Profile for Modeling AADL Applications[END_REF]. In addition, to match the AADL components used in the case study with UML/MARTE entities, in a UML/MARTE description, the process is stereotyped with the SRM memoryPartition stereotype and the processor is stereotyped with both hwProcessor and Scheduler stereotypes. The hwProcessor stereotype, provided by the Hardware Resource Modeling package (HRM), allows to design the hardware processor.

The Scheduler stereotype, provided by the Generic Resource Modeling package (GRM), allows to design the software that is responsible for scheduling and executing threads. At last, the AADL system may correspond to a SysML block. Figure 4 illustrates the AADL platform used for the case study and expressed with UML/MARTE. To design the application, we can either use the AADL platform description (cf. figure 5) as a profile (creating and using stereotypes such as «AADL_Thread», etc.), or use directly the MARTE profile. Figures 5 and12 illustrate examples of the latter approach with the client/server case study expressed using UML/MARTE according to the AADL concepts.

Figure 5 : UML/MARTE system to specify the client/server case study (without communication)

according to the AADL approach.

Regarding the semantics, within the AADL standard, discrete and temporal semantics are described by hybrid automata notation. This notation consists of hierarchical finite state machine notation, augmented with real-valued variables to denote timing values. Using this notation, application startup that involve system, processors, processes and thread components is specified as well as thread execution semantics.

The application startup specified in the AADL standard (with system, processor, process and thread «states and actions» finite state machine) may be explicitly represented with a UML/MARTE sequence diagram (as described in figure 6). This diagram specifies the system startup that results from processor startup, process loading and thread initialization sequence according to the AADL standard. Moreover, each of the system, processor and process «states and actions» finite state machines within the AADL standard can be translated in a corresponding UML/MARTE state machine. However, AADL thread semantics describes more complex mechanisms than AADL system, processor or process components. It specifies the states, the dispatch (activation), the scheduling, the execution, the mode transition and the execution fault handling for thread components.

Without considering modes and fault handling, a UML/MARTE state machine (as described in figure 7) can make explicit part of the initialization and dispatch «states and actions» of threads conform to the AADL standard. Moreover, thread dispatch according to the dispatch protocol and thread scheduling (within the «compute» state) may be depicted using UML sequence diagrams, UML state machine and action languages. For this purpose, the runtime has to be specified either with an improved UML profile that is dedicated to operating system (OS) modeling, or by adding services to the relevant entities in the application model. We can notice that these services are out of the scope of the MARTE profile, because MARTE intends to model real-time embedded applications, not to model internal runtime mechanisms required for executing the application. For example, the MARTE Scheduler stereotype does not provide «resume» and «preempt» services (for the execution or the preemption of threads) because these services must not be available for the application. Thus, following the MARTE approach, specifying runtime within a separate model is a better solution to make explicit the AADL execution mechanisms, than specifying runtime services within the application model.

AADL communication semantics model with UML/MARTE

The AADL language allows different communication types through messages, notifications, shared data and services. Each communication type is represented either by a specific AADL concept (subprogram) or port type (event, event_data, data) linked to a specific run-time behavior. Domain application semantics must be in line with the runtime execution semantics, to make sense. Moreover, to make the validation/verification process at the model level more relevant, run-time specific behaviors need to be taken into account. Different ways to use UML/MARTE to explicit AADL communication semantics will be illustrated on the client/server case study (presented section 3), during a refinement process.

Although proposing some abstraction mechanismthrough abstract components and undefined portsto promote high level design, the AADL language is very close to the execution platform: AADL application components are described in terms of AADL threads, processes, and critical regions, exchanging information through ports. This representation merges application design information and run-time resource management. This shortcut greatly simplifies the view for a wellestablished and finalized design, enabling the designer to focus on analysis and non-functional properties, but will be a handicap for high-level design. UML/MARTE allows separating the different concerns like application design, software platform modeling and hardware platform. From a structural viewpoint, UML composite structures enriched with MARTE Message/Flow Ports typed by UML Signals, or interfaces (<<bFeatureSpecification>> stereotyped interfaces) are sufficient to distinguish AADL message/signal exchange from service request mechanisms (as illustrated Figure 8 and9). Each component or component behavior specified at the application design level will be executed by one or more threads, represented in UML/MARTE as swSchedulableResource as presented in section 4. MARTE's flexibility allows a fine-grain application-toplatform allocation as pictured Figure 12.

As one of MARTE's aims is to provide a generic language for software and hardware resource description and run-time API characterization, MARTE's resource concepts integrate the most important resource and resource management features. So, AADL messages sent by event data ports are represented by MARTE MessageComResources, as illustrated in figure 13, spooled in a queue. A part of AADL resource properties like Queue_Size, Queue_Processing_Protocol, Overflow_Handling_ Protocol, Dequeued_Protocol properties will be provided intrinsically by MARTE: the waiting_queued_policy tag stays for AADL Overflow_Handling_Protocol, message_queue_ policy for AADL Queue_Processing_Protocol, and waiting_queue_capacity for the AADL Queue_Size.

Conclusion

In this article a pragmatic approach for translating UML/MARTE detailed design into AADL design has been presented. We extend previous works in order to undertake part of the behavioral semantics translation. Rather than investigating the numerous possible UML/MARTE designs and their possible translations in AADL, we choose to map AADL concepts into UML/MARTE. It appears that some AADL concepts could not be defined in MARTE (for instance, port message queue policies). They will be proposed in the next MARTE version, enhancing MARTE -AADL concept alignment. Therefore, it implies that methodological guides for designers have to be defined so that their UML/MARTE designs conform to elements which could be easily translated. This guidance of the designer must include: UML/MARTE pattern modeling compliant with AADL, explicit representation of the AADL execution semantics and translation process divided in steps. This article presents part of this guide. Therefore an automatic translation could be envisaged. A prototype is currently under development at Thales.

Figure 1 :

 1 Figure 1 : A client/server architecture.

Figure 2

 2 Figure 2 details the communication describing the response of the server to a client's request.In this more detailed view, information flows 1 could be refined using message communication (synchronous or asynchronous) between client and server, or using remote procedure call (RPC) provided by the server for the client.

Figure 2 :

 2 Figure 2 : Client/Server communication flows.

Figure 3 :

 3 Figure 3 : AADL system to specify client/server case study (without communications) Therefore, the UML/MARTE model of the client/server (in the case study) express the application according to the structure and the semantics of the AADL components involved. To do that, during UML/MARTE design phases, each UML/MARTE entity corresponding to an AADL component must follow the semantics of that component. For example, UML/MARTE concurrent entities semantics is regarded as AADL thread semantics.

Figure 4 :

 4 Figure 4: UML/MARTE description of the AADL components for the client/server case study.

Figure 6 :

 6 Figure 6 : Application startup.

Figure 7 :

 7 Figure 7 : Thread initialization and dispatch (without modes and fault handling).

Figure 8 :

 8 Figure 8: Event exchange through ports

Figure 9 :

 9 Figure 9: AADL subprogram call as interface requested services Different implicit AADL behaviors and semantics are associated to these ports. So, AADL event data ports support a request/reply communication paradigm, while AADL event ports remain for notification. Different UML message types (synchronous messages, calls and replies will

Figure 10 :

 10 Figure 10: UML call and reply mechanism

Figure 12 :

 12 Figure 12: Application to software platform allocation.

Nevertheless, this translation will be partial. We have furthermore to investigate the other parts of the behavior and the translations of non-functional properties. Indeed, UML/MARTE allows to describe non-functional properties such as temporal constraints for which AADL properties have to be translated.

Acknowledgement

This work is partially funded by the Topcased project [START_REF]Toolkit in OPen source for Critical Applications and SystEms Development[END_REF] of the French "Aeronautic Valley" cluster.


I Perseil

L Pautet

COntinuuM, a CO-modelling Methodology for the Integration of Real-time Architecture Models

Keywords: Co-modeling, ADLs, Real-time Systems, Distributed and concurrent algorithms, Proof-based system engineering

The design of Distributed Real-time Embedded (DRE) architecture models for complex and critical systems with safety, liveness, timeliness, dependability concerns, forces the use of formal languages.

Because of the high level of criticity, proof techniques are required instead of model-checking with limitations relatively to the state space explosion problems. Proofs of these non-functional properties can only be established on the basis of formal languages with high verification capabilities (theorem provers).

Therefore, we have concentrated our efforts on the development of a methodology that would better integrate formal aspects into the design of DRE architectures, which is usually based upon the use of (semi-formal) Architecture Design Languages (ADLs). This methodology has both to support the traceability of non-functional property proofs (from the requirements to the deployment of a DRE system) and the integration of formal and non formal modelling languages.

The approach is bottom-up when the method states that each realization artifact, even hidden, has to be detected from the capture requirement stage (each possible realization artifact has to be identified during a prototype coding stage) As a consequence, language translations are not based on the MDA process that supposes some projections. These projections would be responsible for the gap between abstractions used to understand and describe the problem and those used for implementation.

To bridge those gaps is the major aim of the methodology, so we called it "Continuum" as it would help to restore the development process continuity.

The new aspects of this methodology (and its difficulties) are essentially the introduction of low level concepts (needed for the implementation stages) into the modeling language structures, usually more generic.

The methodology application is the development of an algorithmic language translator that enable the generation of a safe code.

Introduction

Architectural configurations of critical real-time systems have to be formally verified. Non-functional properties are often specified through algorithms that mainly involve process units, but these algorithms are not described so that we can easily trace both their impact and accuracy. Many of the architecture design languages are providing features concerning the dual possibility of describing software and hardware components, as well as the implementation process and non-functional property specifications. However they do not provide enough formal capabilities to describe component behavior. This is the reason while component behavior is often described separately.

Although ADLs are more focused on programming in the large, the behavior of a component is correlated to the behavior of its subcomponents. Consequently, we have chosen to build bridges between a strict and static design process that only focuses on the topology, and a dynamic process that raises all the design levels to bring the parameters of an optimal configuration to the upper levels, particularly, when we choose to implement an algorithm that involves atomic components (like threads).

Due to our new co-modeling methodology, we may follow each step of software design process without any discontinuity. Our approach is based on the introduction of algorithmic blocks at the highest level of the design. These blocks are instanced and optimized through an iterative process that allows feedback from successive implementations. In order to build a complete design of component behavior, we introduce methodical guidelines that ease the work of designers. Some elements of the design will be hidden in order to offer a more conceptual view, but from step to step, it will be easier (in terms of compliance) to show implementation details, than to generate them through a classical MDA approach.

To support our approach, we have fully integrated an algorithm language, +CAL, in the architecture design process, so that we can gather a code issued from an ADL (AADL) specification and a code issued from the +CAL specification. Therefore, we will present the +CAL/Ada translator we have realized and its integration in our Ocarina toolset that has been previously designed for AADL translations to Ada. The produced Ada code will be validate, once the TLA+ specifications, automatically generated from the +CAL specifications, are checked.

Introducing every concept in the earliest phases of design that might be taken in account by the final code, we save intermediate translations and model transformations which are often hard to validate. So at the same time, we dramatically reduce the software costs, improve the reuse and reinforce the necessary proof based system engineering for the critical real-time system we design.

Background

Context

Methods have been supplanted by standards. In the past, Methods dedicated to real-time systems design, like SART, for instance, had a very large scope and were applied in many fields. Systems were less complex and it was easier to adapt a generic method. Then came a strong wish to standardize best practices, and to start with the modelling language. After a while, the standardization process reached the patterns and then specific metamodels, e.g. UML profiles.

State-of-the-art (Related works)

Analysis and design of real-time architectures are realized without any standardized process or methods. Some well-known processes do exist but are not uniformly applied:

• Avionic standards as DO-178B, ARP4754 et proprietary guidelines The PBSE methodology, which is the most advanced among the proof methodologies, describes a potential cycle with feedback, but suffers from a lack of guidelines and has no language (neither theorem prover) support, in addition the use of this methodology is not yet applied with any modeling language.

A lot of research attempts of model-checking on semi formal ADLs models (AADL with CPN) or formal ADLs models (with Wright, Acme or Rapide) linked with non formal requirements exist with some results, but are not adopted by industrials, because of the implementation complexity.

Nowadays, a lot of prototyping methodologies are co-existing, far away to be generalized or standardized, and moreover, these methodologies are generally bypassing the requirement capture stages, taking the domain understanding and its modeling for granted.

So far, there exists a gap between the abstractions used to formalize the problem domain and those for the implementation. The MDA approach proposes some model transformations techniques to bridge the gap but this is not the only way to manage it.

Issues

This is a language integration problem. Languages are defining a system at different granularity levels, from one end to the other end of the life cycle.

MDA is not the solution for embedded systems, because the physical environment has an impact on the system behavior, so the software and the runtime framework cannot be separated, as it is proposed in the MDA approach.

The integration problem is located at many levels:

• There is no continuity between the development stages: requirements, analysis, design, coding, testing and verifications, 100% of traceability is far from reality, so how to rely different levels of abstraction? • The granularity and formalism language integration is difficult, considering a system through very different aspects: so how to rely these languages that have different levels of expressivity an from different types (functional, imperative…)

Objectives

The main objective is the development of a method that can both support specification proofs (for a given problem, the specification perfectly answer to the problem and a proof is provided) and to prove that the implementation is correct.

The other objectives are:

• The possibility to adapt concurrent algorithms, scheduling algorithms, distributed algorithms or fault tolerant algorithms to the target architecture configuration or vice versa in order to ensure a reliable architecture configuration: a best behavior expressivity and the proof on valid states.

• The methodology will be particularly achieved to answer to the co-design issues, when dealing with an embedded system that requires to reduce to the maximum the number of components meanwhile it has to answer to hard real-time constraints.

Proposed approach

The DRE systems design require both high level and low level languages. High level languages as algorithm languages (here +CAL) are most of the time used before describing the global architecture with an ADL (here the AADL a SAE standardized ADL), some kind of a low level language, very close to a programming language that will be used at the implementation stages.

Only the critical parts are requiring formal languages, so the problem to solve is really a languages integration problem.

We are striving to specify the behavior of each component in a continuous way, from the smallest granularity component (thread) behavior specification to the highest (modes configuration). Such an objective requires an integrated approach.

The main argument that leads us to expand the AADL language lies in the fact the real-time systems we are studying are using complex algorithms to specify their atomic component behavior which have a huge influence on the whole of the resulting architecture. Not including construction of algorithms in architecture design represents a high risk that they will never be totally taken into account when choosing the final architecture configuration. To ensure the requirements traceability in the analysis and design of the architecture, we consider therefore, that algorithms must appear as a significant element of the design.

Therefore, we propose to expand the AADL language in order to integrate the main algorithmic specifications that play a role in configurations. Including an algorithm language also provides an opportunity for automatic proof and clean code generation. Considering the previous target of encompassing critical system requirements, it is necessary to retrieve proof at each level of architecture design. It is not enough to claim that proofs must occur during the earliest steps of the design. The final mode configurations must be chosen using proof argumentations. This leads us to integrate a formal behavior specification language right inside the architectural specification.

The integration of an algorithm language, +CAL, into an AADL specification is under construction through an annex mechanism.

Application of the approach

Behavioral descriptions are associated with AADL components. Hence behaviors involving several threads cannot be directly described. The example on figure 1 describes a situation in which describing local behavior, attached to each AADL thread, is not sufficient. Two processes are bound to different processors.

Each process is actually made of one thread and encapsulates one data component. Both data components are shared by the two threads of the architecture.

Figure 1: Data shared between two processes Since behavioral descriptions in AADL can be associated with threads or subprograms, one can describe how the shared data should be processed by each thread. For example, it would be possible to describe that thread1 reads and writes in both data components, and that thread2 does the same, periodically. Accesses to data components are managed in each process by the AADL runtime. Therefore, we can specify a locking policy on each data component, handling the access requests sent from the AADL threads.

Descriptions of local behaviors are not sufficient to specify global behaviors. For example, we cannot ensure that the two threads access alternatively both data components, thus performing mutual exclusion on the two data components at a time. We cannot describe the management of the shared data, and the necessary distributed lock.

We have choosen a mutex algorithm implementation that can have an influence on the resulting configuration.

This algorithm guarantees mutually exclusive access to a critical section among a number of competing processes. ) do skip ; end while ; while ( ( Rank [ q ] / = 0) /\ ( ( Rank [ q ] , q ) < (Rank [ a process ] , a process ) ) ) do skip ; end while ; q :=q+1; end while ; \_The c r i t i c a l sec t ion Rank [ a process ] : = 0 ; \_ non-c r i t i c a l sec t ion . . .

end process end algorithm

Listing 1 : Lamport Bakery algorithm in +CAL

Integration in AADL Models

Given the following AADL description corresponding to figure 1, we will first analyze where is the most appropriate place to integrate algorithm structures. We would rather like to insert the +CAL algorithm within the global system implementation that represents the whole architecture. This system implementation is the place where the main components (i.e. the processes, the processors, etc.) are instantiated and connected. It is also the place to describe the way data are shared. In order to be compliant with the AADL annex behavior specification V1.5, atomic behaviors should also be attached to subprogram implementations.

From the +CAL description of the algorithm, we are able to produce source code. In order to create a complete description of the application, we have to merge the source code we generate with the description of the initial architecture (represented on figure 1). The implementation of the algorithm in itself implies some modifications in the code executed in the AADL threads, in order to add calls to procedures such as the "entering" Ada generated procedure from the +CAL algorithm.

procedure enter ing ( a process : in ( proc index ) is begin Ex t r a c t i o n ( a process ) := t rue ; Rank ( a process ) := 1 + maximum; Ex t r a c t i o n ( a process ) := f a l s e ; for q in 1 . .N loop loop delay 0 . 0 ; exi t when not Ex t r a c t i o n ( q ) ; exi t when (Rank ( q )=0) or (Rank ( a process)> (Rank ( q ) ) or ( a process > q ) end loop ; end loop ; end entering ; ----Ex i t Protocol procedure way out ( a process : in ( proc index ) is begin Rank ( a process ) := 0; end way out ; end algo Lamport bakery ;

Listing 2 : Lamport Bakery algorithm in Ada In addition, the Bakery algorithm relies on two variables, shared by all the threads. These variables have to be integrated into the architecture, as shown on figure 2. The shared data is instantiated in one of the AADL processes, and accessed by all AADL threads. The locking policy of the shared data is centralized at the level of one process, and can then be easily managed.

Conclusion

Architecture analysis and design is mostly performed without any standardized process or methodology. As a consequence, there is a very little traceability to handle the transition between the requirements, analysis and architecture design steps. On the one hand, in describing the global requirements, the functional is separated from the non functional properties. What is considered the most suitable algorithm is then chosen to fit the requirements of the non-functional properties. Unfortunately, there is no going-back on the choices we have made. In the prototype phase, it is often necessary to adapt the algorithms to the architecture configuration, and vice versa. Our method provides a way, when choosing and updating parameters, to dynamically build an optimal configuration. On another hand, we build architectures that follow the requirements but, make abstraction of all the behavior constraints. When the two branches of the overall development cycle meet, arises the eternal problem verifying that the architecture framework is a good foundation for the application. Our purpose is to complete the existing gap between requirements and analysis. At the same time, the complex algorithms that we have to manage in critical systems are provided with a formal shape which allows formal proofs.

-

  -algorithm bakery variables Ex t r a c t i o n = [ k \ i n 1 . .N |-> FALSE] , Rank= [m \ i n 1 . .N|-> 0 ] ; process a process \ i n 1 . .N var iable q ; begin Ex t r a c t i o n [ a process ] : = TRUE; Rank [ a process ] : = 1 + max(Rank [ 1 ] . . Rank [N] ) ; Ex t r a c t i o n [ a process ] : = FALSE; q :=1 ; while q /= N+1 do while ( Ex t r a c t i o n [ q ]

Figure 2 :

 2 Figure 2: Architectural impact of the Bakery algorithm

  the SAE) Architecture Analysis& Design Language ADL: Architecture Design Language DRE: Distributed Real-time Embedded MDA: Model Driven Architecture +CAL : The algorithm language of Lamport TLA: The Temporal Logic of Actions UML: Unified Modeling Language