V Guillard

C Guillaume

S Destercke

Parameter uncertainties and error propagation in modified atmosphere packaging modelling

Keywords: MAP modelling, fresh fruits and vegetables, interval analysis, sensitivity analysis, biological variability

► Interval analysis is proposed to study error propagation in MAP modelling for 3 fresh produce ► Results are compared to a probabilistic Monte-Carlo approach ► Low computational costs to estimate upper and lower O2 and CO2 limits ► MAP optimisation generates robust solutions for O2 and CO2 permeabilities, expressed as fuzzy sets ► Experimental efforts should focus on produce physiology for better accuracy of prediction

Introduction

The treatment of uncertainties is crucial in food engineering and in mathematical modelling of process units. Indeed, in such mathematical models input parameters are sometimes physical constants or measurable quantities that are exactly known, but more often than not they refer to properties that cannot be directly measured and that are calculated from linear or non-linear (multiple) regressions obtained from experimental data. The accuracy of calculated parameters then depends on the experimental uncertainty. Accuracy of such parameters is crucial, as they are then used in mathematical models to perform simulation or even identification of a third parameter (as is the case here).

Modified atmosphere packaging (MAP) for fresh fruit and vegetables relies on the modification of the atmosphere inside the package in order to extend the food shelf life by reducing the respiration of the product and consequently its degradation rate. Atmosphere composition within the package is the result of both respiration of the commodity and diffusion/permeation of gases through the film until a steady modified atmosphere is reached [START_REF] Floros | Introduction to modified atmosphere packaging[END_REF]. This steady atmosphere must be quickly reached and as close as possible to optimal gas concentrations specific to each product. To do so, gas transfer properties of the packaging must correctly match physiological requirements of the product.

In order to design MAP for fresh fruit and vegetables, mathematical models that simulate the evolution of internal gas composition in the packaging as a result of food respiration and mass transfer through the packaging material can be used to identify optimal values of gas permeabilities that will provide maximal shelf life to a given product [START_REF] Charles | Active modified atmosphere packaging of fresh fruits and vegetables: Modeling with tomatoes and oxygen absorber[END_REF][START_REF] Mahajan | Development of userfriendly software for design of modified atmosphere packaging for fresh and fresh-cut produce[END_REF]. Optimised packaging can then be designed accordingly to these identified values. Examples of such mathematical models are available through webapplication (PackInMap [START_REF] Mahajan | Development of userfriendly software for design of modified atmosphere packaging for fresh and fresh-cut produce[END_REF] or www.tailorpack.com). These mathematical models require specifying a lot of input parameters such as film thickness, area, mass of packed vegetables, gas permeabilities for the packaging material, etc., and, of course, the respiration characteristics of the product, i.e., at least, the maximal respiration rate (or ) and the apparent Michaelis-Menten constant () necessary to model the physiology of aerobic respiration using a Michaelis-Menten formalism, the most encountered enzymatic kinetic mechanism describing respiration [START_REF] Fonseca | Modelling respiration rate of fresh fruits and vegetables for modified atmosphere packages: a review[END_REF]. These parameter values are estimated from experimental data and are characterised by high uncertainties due to the biological variation [START_REF] Hertog | The impact of biological variation on postharvest behaviour of tomato fruit[END_REF]Hertog et al., 2007a;Hertog et al., 2007b). For instance, a search for available data in the literature concerning the maximal respiration rate of a same variety of mushrooms (Agaricus biporus L.) gives more than five different references that each provide different values of respiration rates and Michaëlis-Menten constant (Table 1). It is obvious from Table 1 that a single value of respiration rate cannot faithfully represent biological variability, even if products come from a unique plot (same climatic exposition, time of harvest, etc.). Also, it would be hazardous to use these data to evaluate a probability distribution, as their heterogeneity is high (different batch, location, labs, etc.). A more reliable model would be to consider a range of possible values reflecting this biological variability. In any case, modelling this variability would increase the reliability of simulations used, for instance, to design MAP for mushrooms.

Although uncertainty treatment is an essential part of robust design, this subject has been seldom considered in food engineering. We can mention [START_REF] Baudrit | Uncertainty analysis in food engineering involving imprecision and randomness[END_REF][START_REF] Baudrit | Joint treatment of imprecision and variability in food engineering: Application to cheese mass loss during ripening[END_REF] who study the impact of jointly propagating variability and imprecision in models of weight loss during cheese ripening process, Hertog et al. (Hertog et al., 2007b;[START_REF] Hertog | Monte Carlo evaluation of biological variation: Random generation of correlated non-Gaussian model parameters[END_REF] who evaluate the impact of biological variation on vegetables postharvest behaviour (tomato colour or stem length of Belgian endive for example) and Iqbal et al. (2009b) who evaluate the impact of mushroom respiration rate () variability on the concentration of oxygen and carbon dioxide in the packaging headspace at equilibrium. All these previous studies mostly use classical probabilistic models [START_REF] Bedford | Probabilistic Risk Analysis. Foundations and Methods[END_REF] with Monte Carlo simulations (in the case of [START_REF] Baudrit | Joint treatment of imprecision and variability in food engineering: Application to cheese mass loss during ripening[END_REF], these methods were mixed with imprecise probabilistic models). Such simulations require to (i) know and specify the (possibly imprecise) distribution of each input variable, (ii) specify the dependency structures between all input variables and (iii) perform (computationally costly) numerical analyses to evaluate the output uncertainty. Meeting such requirements necessitates a great amount of information and data as well as lengthy computational time. When not enough information is available (a situation that often happens), distribution shapes (e.g., normality) and dependence assumptions (e.g., independence between all variables) are usually chosen accordingly to some purely practical criterion. The validity of such choices, if not confirmed by experiments or available knowledge, may be questioned as well as the validity of subsequent analysis results [START_REF] Ferson | Different methods are needed to propagate ignorance and variability[END_REF]. Indeed, they may provide misleading conclusions, which may in some cases lead to unwarranted and non-robust design choices.

When few data are available, an alternative is to use interval analysis [START_REF] Jaulin | Applied Interval Analysis[END_REF] to perform the uncertainty analysis. It comes down to considering that only the bounds in which each input variable and parameter may vary are known, or in other words, that (i) input variable distributions are unknown (up to their bounds) and (ii) the dependence structure between input variables is unknown. Compared to probabilistic analysis, interval analysis can therefore be seen as a conservative analysis, in the sense that it does not make any additional hypothesis with regard to the available information, and possibly ignores some of the available information. It will therefore provide more robust, but less informative, conclusions than probabilistic analysis.

Actually, interval and probabilistic analysis can be seen as two extreme methods of uncertainty treatment: the former relies on very few assumptions and provides robust yet poorly informative results, in the sense that only bounds are provided, while the latter requires a lot of information but provides very informative results (e.g., in the shape of confidence intervals, frequencies) whose reliability is nevertheless questionable if information is missing and hypotheses have to be made. Most practical situations are situated between these two extremes and the choice between the two methods often depends of the application goals.

In this paper, we use interval analysis to study the impact of parameter uncertainties in a MAP model describing the gas composition evolution inside the package, and presented in Section 2. We propose in Section 3 a method relying on interval analysis to perform uncertainty analysis (propagation and sensitivity analysis) and to determine (in a reverse optimisation step) optimal values of packaging oxygen and carbon dioxide permeabilities. This approach is tested in Section 4 on three case studies covering various scenarios: chicory, mushrooms and blueberry. Indeed, they span high (mushrooms) and low (endive and blueberry) respiration rates, important CO 2 inhibition (blueberries) or not (mushrooms and chicory), great O 2 sensitivity (chicory) or not (mushrooms and blueberry). Collected information also presents significant differences: higher (mushrooms and blueberry) and lower variability (chicory), data from a single reference (chicory and blueberry) or a set of references (mushrooms). Finally, in section 5 we discuss the whole method and make some comparisons with a probabilistic approach, emphasizing their differences as well as their complementarities.

Modelling modified atmosphere packaging (MAP)

In MAP, oxygen and carbon dioxide partial pressures in packaging headspace evolve and settle to steady values after a transient phase until a deviation phase occurs, which marks a microbial growth or a change in the metabolic pathway of the product (close to end-life). This evolution in the internal gases partial pressures is due to the mass balance between oxygen and carbon dioxide flux through the packaging material on one hand and to the O 2 and CO 2 consumption/ production of the product respiration on the other hand (Figure 1). Here, gas evolution is modelled as follows: where the first part of the right-hand side of f 1 and f 2 describes gas flux per time unit through the packaging material, while the second part describes gas consumption (and emission) by the vegetable or fruit modelled using a Michaelis-Menten-type equation, considering no inhibition, non-competitive CO 2 inhibition or uncompetitive inhibition (eq. 3, 4 or 5, respectively), that have been extensively studied [START_REF] Fonseca | Modelling respiration rate of fresh fruits and vegetables for modified atmosphere packages: a review[END_REF]. When CO 2 influence is investigated on respiration, the non-competitive inhibition is preferred among the three equations due to its simplicity of use and good fit with most existing data concerning common products [START_REF] Fishman | Model for gas exchange dynamics in modified atmosphere packages of fruits and vegetables[END_REF][START_REF] Peppelenbos | Evaluation of four types of inhibition for modelling the influence of carbon dioxide on oxygen consumption of fruits and vegetables[END_REF], nevertheless uncompetitive inhibition might be more accurate in some cases [START_REF] Fonseca | Modelling respiration rate of fresh fruits and vegetables for modified atmosphere packages: a review[END_REF]. It should be noted that for higher flexibility in MAP modelling, the combined types of inhibition might be applied as a single equation that includes all Michaelis-Menten types of inhibition as well as no inhibition [START_REF] Hertog | A dynamic and generic model of gas exchange of respiring produce: the effects of oxygen, carbon dioxide and temperature[END_REF][START_REF] Peppelenbos | Evaluation of four types of inhibition for modelling the influence of carbon dioxide on oxygen consumption of fruits and vegetables[END_REF]. Table 2 summarises the different parameters, their names and units used in Eq. ( 1) to (5).

For a given fruit or vegetable, it is possible to experimentally determine (up to some uncertainties) oxygen and carbon dioxide partial pressures that will result in an optimal preservation. It is then possible to find optimal packaging permeabilities by using the mathematical model of eq. ( 1) and (2) [START_REF] Charles | Active modified atmosphere packaging of fresh fruits and vegetables: Modeling with tomatoes and oxygen absorber[END_REF] with an optimisation procedure (e.g., Levenberg-Marquard) to fit predicted partial pressures to optimal ones. Several input parameters are required for this model such as respiration rate, respiratory quotient, packaging geometry, or environment variables such as temperature. Determining exactly the values of the various parameters (S, e, , etc) involved in Eq. (1) to (5) is a difficult task. In practice, only a handful of measurements are performed and parameter values are imprecisely known, and an uncertainty analysis is necessary to ensure design robustness. Unfortunately, it is not routinely done. In the next section, we introduce an interval analysis method to do so easily on the model given by eq. ( 1) and (2), before presenting some case studies.

Interval analysis and design optimisation

Performing a probabilistic analysis on Eq. ( 1) and (2) and on similar dynamical models is a computationally heavy task requiring a lot of information (or making many assumptions). In contrast, interval analysis requires a minimal amount of information and, in some specific cases -such as in Eq. ( 1) and (2) -it may be computationally far easier to perform than probabilistic analysis.

Basics of interval analysis

In computational literature, interval analysis was first developed to account for numerical errors [START_REF] Moore | Methods and applications of Interval Analysis[END_REF]. However, interval analysis is now mostly used to perform robust analysis in applications (robotics [START_REF] Jaulin | Guaranteed robust nonlinear estimation with application to robot localization[END_REF], chemistry, biology, etc.) where the variable value is imprecisely known [START_REF] Jaulin | Applied Interval Analysis[END_REF]. In interval analysis, precise numbers are replaced by intervals, i.e. variable x is described no longer by a precise number but by an interval , with x -and x + the lowest and highest possible values of variable x. describes our uncertainty about the true value of x about which we only known that it lies between x -and x + . The classical problem of interval analysis consists in replacing, in a function , the variables by intervals and to compute bounds f x [ ] ( ) of the function such that . That is, the output is not a precise value but a set including all outputs obtained by choosing a precise

x Î x [ ] .
For example, if (here, n = 2 and m = 1) and

] 5 , 2 [  x
, , then . The two bounds 5 and 12 are obtained for , y=3 and , y=7, and all other possible values of x, y give an answer between 5 and 12. We can see that, in this case, to obtain the bounds of f ([x],[ y]), we have to consider only two extreme combinations of values of x and y and no others (the single computation of the precise case is then replaced by two computations).

In general, it will not be possible to retrieve the exact bounds of given interval uncertainty, but it may be easy to get outer approximation, and we will then speak of inclusion functions

[ f ] when considering such approximations. In the previous example, is an illustrative example of inclusion function (there may be different inclusion functions, depending on the approximation method used). Among possible techniques to compute such bounds is interval arithmetic, where classical arithmetic operations {+,*,/,-} are replaced by their interval equivalent. The quality of approximation

[ f ]([x]
) and the time to compute it both depend on the technique used and of the characteristics of the model. In our particular case, the model makes it possible to have exact bounds and efficient computations, as we shall see.

Interval analysis to propagate uncertainties in dynamical systems

In this paper, we are concerned with the problem of evaluating the solution of the dynamical system given by Eq. ( 1) and (2) combined with either Eq. (3) or Eq. ( 4) when parameters become interval. The computational aspect of this case has already been extensively studied in another paper (Destercke et al., 2011), and only the main assumptions are recalled here. Eq. ( 1) and (2) are particular instances of general systems where function describes the evolution of state variables by m ordinary differential equations (ODE"s) . Here, we have two equations f 1 and f 2 describing the evolution of partial O 2 ( ) and CO 2 ( ) partial pressures, respectively.

For a given time t, the solutions of such systems are here m values x i (t). The evolutions of state variables are then obtained by solving the equations for each (discretised) time step. In the following, we denote by the time domain of the model and assume that it is discretized in a finite number of time steps. In our case, the time domain will be the life-span of the product.

As in the previous section, if parameter p values become interval, the outputs x i (t) at each time step become two intervals, hence the evolutions of each variable become two (discretized) functions of time, a lower and an upper one, that have to be estimated. In our case, the problem is to compute the evolution of gas partial pressures, given intervals of some of the parameters given in Table 2.

We will call a function f i dynamically increasing w.r.t. a parameter p or a variable x if it satisfies the following inequalities:

or f i is dynamically decreasing if the inequalities are reversed (i.e., lower than or equal to zero). Normally, estimating lower and upper bounds for each variable x i and each discretized time-step t, i.e., to determine the lower and upper envelopes of is a difficult problem.

However, if every function f i of is either dynamically increasing or decreasing w.r.t. each of its parameters and variables, one can concentrate only on specific extreme combinations of the interval-valued parameters and variables (initial conditions) to compute lower and upper envelopes [START_REF] Delanoue | A new method for integrating ode based on monotonicity[END_REF][START_REF] Ramdani | Computing reachable sets for uncertain nonlinear monotone systems[END_REF][START_REF] Singer | Bounding the solutions of parameter dependent nonlinear ordinary differential equations[END_REF], thus reducing the computations to find extrema. In such cases, one only needs to solve the system twice with usual methods (one for the upper envelope, one for the lower) for each variable.

Compared to probabilistic methods, this is indeed very efficient.

Under fair assumptions (positivity of parameters of Table 2 and of , negativity of

, constant values of external gas partial pressures p i ext ), it can be shown that Eq. ( 1) and ( 2) are dynamically monotonic. Table 3 summarises those monotonicities with respect to (w.r.t.) each input parameters for function f 1 and f 2 .

Table 3.

Parameters optimisation

Parameter optimisation consists in searching parameters value that satisfies some objectives, i.e. to find values of some parameters p such that if they are used in function f i to predict x i (the values of the other parameters remaining the same), the prediction [x i (t)] will be within or close to some specified goal  

) ( ˆt x i on x i .
Here, we consider that the goal is specified as an interval over some time-domain T Í T that is a subset of the whole domain.

Goals are then specified as intervals     T t x i : ) ( ˆ, as even optimal goals may be imprecisely known (or multiple optimal values are possible).

In our problem, the parameters to optimise are the packaging permeabilities

Pe O2 to O2 and Pe CO 2 to CO 2 . The goals   ) ( ˆt x i will be gas partial pressures [ ppkg O2 (t)] and [ ppkg CO2 (t)]
known to provide longer shelf-life to the product. The time domain T will be restricted to the steady phase.

Note that this way of formulating an optimisation problem is not usual, even in interval analysis literature [START_REF] Raïssi | Set membership state and parameter estimation for systems described by nonlinear differential equations[END_REF], where the goals and objective functions are usually precisely valued (e.g., correspond to precisely observed outputs). Again, such problems are in general difficult to solve, however we propose here an easy solution that again uses the monotonic properties of the system.

Consider a particular point value D p ˆof a design parameter p D . is said to be a guaranteed (resp. possible) solution if (resp. ) for every , given interval uncertainty on other parameters p and initial conditions x(0). A guaranteed solution is such that, despite interval uncertainties, we are certain that with the given design parameter values, the true answer lies within the goal bounds, while a possible solution is such that, with the given design parameter values, the true answer may or may not lie within the goal bounds. Solutions that are totally outside goal bounds are said to be non-admissible. In practice, estimating sets of guaranteed and admissible solutions can be difficult (as they are usually multivariate sets of design parameter values with complex shapes). However, it is possible with a simple procedure to provide for each design parameter p approximated evaluations of guaranteed and admissible solutions in optimal values for the permeabilities of O 2 and CO 2 , respectively.

The obtained sets [G p ] and [S p ] for each design parameter p can then be transformed into fuzzy sets [START_REF] Zadeh | The concept of a linguistic variable and its application to approximate reasoning-i[END_REF]. Indeed, while guaranteed solutions all provide the same satisfaction to the designer (they all insure that the true solution is within the goal boundaries), possible solution can be seen as having gradual satisfaction degrees for the designer, as some of them will have a more significant overlap with the goal bounds than others. First recall that a fuzzy set is a mapping from a space to the unit interval, where is the membership degree of element x. A trapezoidal fuzzy number is defined by a tuple of four numbers and is such that Equation 6

In our case, the fuzzy set degree expresses some satisfaction degree [START_REF] Dubois | The three semantics of fuzzy sets[END_REF] provided by a parameter value w.r.t. an interval-valued objective . We propose, for , to build the trapezoidal fuzzy number such that if and otherwise. Figure 2 (see Section 4)

illustrates the concept of fuzzy set.

Sensitivity analysis

An uncertainty analysis usually comes with a sensitivity analysis [START_REF] Helton | Sensitivity analysis in conjunction with evidence theory representations of epistemic uncertainty[END_REF] that consists in quantifying the contribution of each input parameter and variable uncertainty to the output uncertainty. It shows where uncertainty reduction would be the most beneficial to reduce output uncertainty, hence where experimental efforts should be focused. In contrast with probabilistic approaches, there are only very few works dealing with interval sensitivity analysis [START_REF] Moens | Interval sensitivity theory and its application to frequency response envelope analysis of uncertain structures[END_REF].

In this paper, we propose to use a very simple means to perform this sensitivity analysis for a given function f i . The details of the methodology are given in (Destercke and Guillard, 2011) and are just briefly given in the following. Let be the interval-valued output resulting from initial interval uncertainty. Then, if we denote by the length of , we define the overall

imprecision of i x as Equation 8
that is, the sum of interval lengths obtained at each time step. Now, to quantify the impact of each parameter and variable uncertainty on the output imprecision, we propose the following procedure (similar to some existing propositions in imprecise probability literature [START_REF] Ferson | Sensitivity analysis using probability bounding Reliab[END_REF] In our problem, the result of this sensitivity analysis for a particular product can be used to detect which parameters are the most responsible for the uncertainty in the gas partial pressures, eventually deciding that further experiments (or the use of more precise measurement devices) should be done on it.

Application

In this section, we apply the above framework to design Modified Atmosphere Packaging (MAP) for some fresh fruits and vegetables: chicory, mushrooms, and blueberry. The system given by Eq. ( 1) and ( 2) with either Eq. ( 3) to Eq. ( 5) are considered for modelling the respiration of produce. Numerical solving of the nonlinear ODE system (Eq. 1 to 5) was carried out using the ode45 solver of Matlab software (The Mathworks Inc., Natick, MA, USA). This routine adjusts the size of the step of time for calculations according to the importance of partial pressure variations. As f 1 and f 2 are dynamically monotonic w.r.t. each of their parameters and variables (cf. Table 3), this means that one can concentrate only on specific extreme combinations to compute lower and upper envelopes (cf. Section 3). Values of each input parameter are extracted from various references and indicated for each case study with their uncertainty. When it was not specified in literature, an uncertainty of 10% was applied on the value (it is the case for instance for the surface and the volume of the pouches, the mass of chicory, etc). Note that, in all applications, initial conditions (initial values of the two variables and ) are considered as perfectly known (e.g. initial partial pressures are the same as in air: 21.27 kPa for oxygen and 0 kPa for carbon dioxide) but they also may vary (20.62 ± 1.21kPa and 0.80 ± 0.69 kPa; Fonseca et al., 2000). Interval analysis was computed using Matlab software.

Case study 1: chicory

The considered food is chicory, which has been previously studied, but without any proper uncertainty analysis [START_REF] Charles | Modeling of active modified atmosphere packaging of endives exposed to several postharvest temperatures[END_REF]. Chicory is usually packed in consumer-size flexible pouches (polyethylene, PE, or polypropylene, PP) containing between 0.5 and 2.0 kg of produce [START_REF] Moras | Le préemballage des légumes et des fraises (Hortipratic)[END_REF]. In this case study, 0.5 kg of chicory is considered packed in a 2L low density PE (LDPE) pouch with an average film thickness equal to 50 μm and a total surface of 1400 cm 2 . Considering the dimension of packaging and the product mass, LDPE has been selected on the basis of its mass transfer properties (i.e. gas permeabilities) that should correctly match the respiration requirements of the commodity1 [START_REF] Charles | Modeling of active modified atmosphere packaging of endives exposed to several postharvest temperatures[END_REF]. Storage temperature is fixed at 20°C and all input parameters are considered at this temperature. According to [START_REF] Charles | Modeling of active modified atmosphere packaging of endives exposed to several postharvest temperatures[END_REF], respiration of chicory could be modelled using Eq. 4. In Equations ( 1) and ( 2), environmental parameters subject to uncertainties are and design parameters are . Note that, when the probabilistic approach is used, no less than 9 probability distributions must be specified, and independence between variables must be consequently assumed, with some of the parameters sometimes measured only 3 times (see section 5). Note that to reach a reasonable numerical accuracy, Monte-Carlo propagation usually needs at least 100 samples, while estimating boundaries by interval analysis for and requires only 4 simulations in this case.

Uncertainty propagation. Knowing the permeability of the packaging material classically used to pack chicory, the mathematical model described by Eq (1), (2), and (4) was used to simulate the evolution with time of the internal O 2 and CO 2 partial pressures at 20°C.

Parameters with their interval uncertainty are summarised in Table 4. Maximal shelf life at 20°C is estimated to be 7 days (i.e. around 170 hours), therefore the simulation time domain is

T=[0, 170].
Table 4.

The results of interval analysis are displayed in Figure 1, and at the steady states, and . This means that, given the specified uncertainties in Table 4, the O 2 and CO 2 levels in the packaging can vary between their respective lower and upper curves.

These curves include simulated curves obtained by [START_REF] Charles | Modeling of active modified atmosphere packaging of endives exposed to several postharvest temperatures[END_REF] in the same conditions without considering uncertainties (not shown in Figure 1 to preserve the readability of the graph). In the MAP experiment using the same conditions as in this simulation, and if the uncertainties were well estimated, the experimental O 2 and CO 2 measurements at the steady state could potentially vary between 1.6 and 8.1 kPa, and 1.9 and 5.3, respectively. Note that, due to the conservativeness of interval analysis, these ranges may be over-estimated. However, with this methodology, only four simulations where needed (two for each gas) to estimate the bounds, and no unverified assumption (e.g., independence of all variables) has been made. It also provides worst cases referring to the lowest O 2 and highest CO 2 contents that are determinant to anticipate risks of anoxia and CO 2 phytotoxicity, respectively. Those two critical points are main causes of failure in MAP design marked by the development of off-flavour and off-odour as well as discoloration of the commodity. In the case of chicory, the interval analysis ensures that the recommended storage atmosphere is within the modelled interval during a shelf life of 7 days (3-4% O 2 and 4-5% CO 2 according to [START_REF] Mannapperuma | Design of polymeric packages for modified atmosphere storage of fresh produce[END_REF], and that neither anoxia (O 2 lower than 1%) nor excessive CO 2 content (higher than 10%) would occur even during the transient period (Van de [START_REF] Van De Velde | Influence of storage atmosphere and temperature on quality evolution of cut Belgian endives[END_REF][START_REF] Vanstreels | Red discoloration of chicory under controlled atmosphere conditions[END_REF]. This kind of certainty is very helpful to guarantee no detrimental deviation in produce quality. Optimisation step. When the best oxygen and carbon dioxide permeabilities suiting a particular fruit or vegetable are not known a priori, the MAP model, Eq. ( 1), (2), and (4), is used to perform a reverse engineering task. In this case, optimal oxygen and carbon dioxide concentrations in the modified atmosphere packaging have to be known and specified. Then, an identification step of the optimal permeabilities can be run by taking into account the parameters uncertainty (specified in Table 4) of every environmental parameter. To ensure that optimal O 2 and CO 2 concentrations (the goals) were considered for the steady state and and CO 2 permeabilities obtained. There are some guaranteed solutions, that all provide the same satisfaction degree to the designer (reaching the maximal value 1 in Figures 2A &2B).

These solutions will all insure that the true solution is within the goal boundaries, pkg o p 2 ˆ and .

There are some possible solutions that can be seen as having gradual satisfaction degrees (between 0 and 1 on the fuzzy set in Figures 2A &2B) for the designer, as some of them will have a more significant overlap with the goal bounds than others. According to Figures 2A & 2B, guaranteed solutions, ranged from 1.04 to 1.59×10 -15 mol.m -1 .s -1 .Pa -1 and 4.39 to 6.28×10 -15 mol.m -1 .s -1 .Pa -1 for respectively O 2 and CO 2 permeability. Possible, but not guaranteed solutions, , ranged from 0.27 to 5.11×10 -15 mol.m -1 .s -1 .Pa -1 and 1.09 to 23.68×10 -15 mol.m-1 .s -1 .Pa -1 . Figure 3 shows the result of the interval analysis done with optimal parameters belonging to and the resulting oxygen and carbon dioxide partial pressures lie well within the objectives. It is obvious from the fuzzy sets of Figures 2A & 2B

that, with a 10% variation, the O 2 and CO 2 permeabilities of LDPE chosen for generating uncertainty propagation does not fully meet the guaranteed solution. With a higher precision during assessment of mass transfer properties, this material could be part of guaranteed solution. Sensitivity analysis. Table 5 summarises the sensitivity analysis performed according to the method previously presented. For each variable and , we have evaluated the gain in uncertainty after an imprecision reduction of 50% of each (environmental and design)

parameter. The last row (All) indicates the gain in the output precision when all parameters uncertainty is reduced by 50 %.

The results indicate, among other things, that uncertainties of packaging permeabilities have the highest impact on gas internal partial pressure: while O 2 permeability uncertainty has an important impact on both O 2 and CO 2 internal partial pressure (the reduction resulting in a gain of about 10% for each), CO 2 permeability uncertainty only impacts the CO 2 internal pressure, and has almost no effects on O 2 internal pressure. The great influence of surface and thickness uncertainties on gas internal partial pressures was not surprising since they are part of the equation of gas permeation through the packaging material, with permeability values.

The effect of was more important on O 2 content than CO 2 . As expected, the uncertainty of the respiration quotient (RQ) only impact on the CO 2 internal pressure, while uncertainty, due to the large value of , has no impact on the resulting uncertainty for both variables. It is worth noting that cumulating all the gains obtained following a reduction of 50% on all input parameters uncertainty, more than 50% of precision could be gained on O 2 and CO 2 internal partial pressure!

Case study 2: mushrooms

Contrary to the previous case study (chicory) where all the parameters and their uncertainty came from a single work, the case of mushrooms is a bit more complicated since several scientific publications dealing with respiration parameters of mushrooms are available. While its respiration pathway can be considered in its simple formalism (Mickaëlis-Menten type with no CO 2 inhibition), various values of respiration parameters for common mushrooms (Agaricus biporus L) are provided, as shown in Table 1. The large difference in respiration rate is mainly due to the considered strain, flush and stage of maturity, but also to the method of determination used. In order to take into account this physiological variability in the prediction of O 2 and CO 2 partial pressure ( and ) at equilibrium in the packaging of mushrooms, these multiple sources were taken into account to define a range of probable for mushrooms. This range was considered as input parameters in the model (Eq. ( 1), ( 2) and ( 3))

(Table 6). Mushrooms are usually placed in punnets, which are then wrapped into plastic pouches. A possible packaging material commercially available is, for example, stretchable PVC film [START_REF] Guillaume | Biobased packaging for improving preservation of fresh common mushrooms (Agaricus bisporus L.)[END_REF][START_REF] Lopez Briones | Modified atmosphere packaging of common mushroom[END_REF]. The system considered in this study was a mass of 250 g of mushrooms wrapped with a stretchable PVC film of 11 microns of thickness [START_REF] Guillaume | Biobased packaging for improving preservation of fresh common mushrooms (Agaricus bisporus L.)[END_REF], considering a total volume of 1.0 L and 676 cm 2 of total surface area (http://www.champignons-paris.com/). All the characteristics of the mushrooms / packaging system used in the simulation are described in Table 6 and considered at 20°C. Table 6.

Uncertainty propagation. Knowing the O 2 and CO 2 permeabilities of the stretchable PVC film (Table 6), the mathematical model (Eq. ( 1), ( 2) and ( 3)) was used to simulate the evolution with time of O 2 and CO 2 internal partial pressure. An interval analysis was used to assess the impact of input parameters uncertainty on the prediction. The targeted shelf life of fresh mushrooms at 20°C is 5 days at the very most; the time domain for simulation was then h. The results of interval analysis are displayed in Figure 4. At the steady states the O 2 and CO 2 partial pressure ranges are and . Using this classical PVC film for packing mushrooms, anoxia is reached in the packaging in less than 10h when considering all uncertainties on input parameters and the largest upper and lower limit for maximal respiration rate () taken from the different sources found on this food product. This might induce a turn into fermentative catabolism responsible for off-flavours and off-odours in most fresh produce; but the case of mushrooms is quite peculiar. Some authors demonstrated that their respiration rate remained constant whatever the O 2 level, even around 0.2 kPa, with a respiratory quotient equal to unit [START_REF] Lopez Briones | Storage of common mushroom under controlled atmospheres[END_REF][START_REF] Varoquaux | Respiratory parameters and sugar catabolism of mushroom (Agaricus bisporus Lange)[END_REF]. They also determined a negligible value (<0.1 kPa) that has been considered in the present work for modelling purpose. Considering this literature, mushroom catabolism is supposed to be aerobic until 0.2 kPa. Then the anoxic condition of 0.2 -0.3 kPa, identified upon modelling, would not be detrimental to this fresh commodity. However, it may cause safety issues by favouring growth of Clostridium botulinum, moreover when it is combined with high CO 2 content [START_REF] Gonzalez-Fandos | Effect of packaging conditions on the growth of micro-organisms and the quality characteristics of fresh mushrooms (Agaricus bisporus) stored at inadequate temperatures[END_REF]. While the lowest limit for maximal respiration rate led to CO 2 partial pressures equal to or lower than 5 kPa within the time domain defined, the highest limit for maximal respiration rate displayed CO 2 partial pressures higher than 5 kPa and even more than 10kPa during the transient period. The threshold value of 5kPa has been previously determined at 10°C as an initiator of mushroom discolouration such as yellowing [START_REF] Lopez Briones | Storage of common mushroom under controlled atmospheres[END_REF]. Based on these simulations and interval analysis, this packaging material did not match the gas permeabilities requirement necessary for mushrooms. Hopefully, in real conditions of use, mechanical stretching of PVC may alter its barrier properties by increasing both O 2 and CO 2 permeabilities [START_REF] Guillaume | Biobased packaging for improving preservation of fresh common mushrooms (Agaricus bisporus L.)[END_REF][START_REF] Trommer | Nonrigid Microporous PVC Sheets: Preparation and Properties[END_REF]. Optimisation step. The next step was to identify the O 2 and CO 2 permeabilities that are best suited to the packing of mushrooms and to evaluate the impact of parameters uncertainty on the reliability of the prediction using interval analysis. Eq (1), ( 2) and (3) were used to perform a reverse engineering task as described for chicory. For mushrooms, literature gave some optimal O 2 and CO 2 concentrations for the storage of mushrooms at 20°C which are respectively and for the steady state period [START_REF] Lopez Briones | Storage of common mushroom under controlled atmospheres[END_REF].

Identification of and that best suit mushrooms was then performed by taking into account uncertainties on input parameters reported in Table 6. In this condition, no guaranteed packaging solutions could be found that best suited the requirements of mushrooms as illustrated in Figures 5A &5B. Figure 6 illustrates well that the upper and lower envelops for the O 2 and CO 2 internal partial pressures lay beyond the targeted ranges for these two gases following the uncertainty propagation during the optimisation step. Sensitivity analysis. In order to identify the parameter(s) and its(their) uncertainty(ies) that impact the prediction the most, a sensitivity analysis was performed. As for case 1, the gain in uncertainty was evaluated after applying an imprecision reduction of 50% for each variable successively. The results are given in Table 7. The results of Table 7 indicated that among all parameters uncertainty has the most important impact on O 2 internal partial pressure (the reduction of 50% applied on uncertainty resulted in a gain of more than 50% on the precision of O 2 partial pressure prediction) while packaging permeabilities,and , have the greatest impact on CO 2 partial pressure prediction (reduction of uncertainty of around 20%) followed by RQ (reduction of uncertainty of around 10%). This result was expected. Indeed, mushrooms are characterized by a high biological variability and then the reproducibility of the measure of respiration parameters is touchy. That"s why a large range of variations was noticed for between the different sources (Table 6). This sensitivity analysis illustrated well that an accurate experimental determination of the respiration parameters (especially when is not influent as we considered herein) could be crucial to provide reliable predictions of internal gas partial pressure. Contrary to O 2 partial pressure, CO 2 partial pressure was more dependent on RQ which appears logical because in Eq. ( 2), was directly calculated from and RQ. It is worth noticing that, as for chicory, cumulating all the gains obtained following a reduction of 50% on all input parameters uncertainty, more than 50% of precision could be [START_REF] Cliffe-Byrnes | Effects of gas atmosphere and temperature on the respiration rates of whole and sliced mushrooms (Agaricus bisporus) -Implications for film permeability in modified atmosphere packages[END_REF][START_REF] Varoquaux | Respiratory parameters and sugar catabolism of mushroom (Agaricus bisporus Lange)[END_REF] or not (Iqbal et al., 2009). While the effect of a high amount of CO 2 seems to be detrimental to their whiteness whatever the source, the decrease in O 2 content might exhibit almost no effect either on their respiration [START_REF] Varoquaux | Respiratory parameters and sugar catabolism of mushroom (Agaricus bisporus Lange)[END_REF] or quality attributes [START_REF] Lopez Briones | Storage of common mushroom under controlled atmospheres[END_REF][START_REF] Lopez Briones | Modified atmosphere packaging of common mushroom[END_REF], or it might slow down their respiration (Iqbal et al., 2009) as well as delay their development as cap opening, veil breaking, stem elongating [START_REF] Roy | Fresh mushroom quality as affected by modified atmosphere packaging[END_REF]. Such differences are mainly attributed to the material used. Most often, the complete identification of common white mushrooms is not mentioned but it is obvious that strain, number of flush and development stage should be considered to improve the knowledge on their physiological behaviour and reduce uncertainties on physiological parameters. This would lead to more reliable simulations and maybe possible guaranteed packaging solutions.

Table 7.

Case study 3: blueberry

A third vegetal product was chosen, "Duke" blueberry, which is characterized in the model by a significant uncompetitive CO 2 inhibition (significant value of ). Small berries such as blueberries are commonly packaged and sold to consumers in vented petroleum-based clamshell containers or pouches. In this study, 200g of blueberries were considered packed in a 0.6 L LDPE pouch with a surface area of 690 cm 2 as in the study of [START_REF] Song | Modeling respiration-transpiration in a modified atmosphere packaging system containing blueberry[END_REF]. According to [START_REF] Song | Modeling respiration-transpiration in a modified atmosphere packaging system containing blueberry[END_REF], respiration of blueberries could be modelled using Eq. 5 describing uncompetitive inhibition. All input parameters required in Eqs. ( 1), ( 2) and

(5) are given in Table 8 and considered at 25°C. Uncertainty propagation. To perform the simulation, the shelf life of blueberries was According to [START_REF] Beaudry | Modified atmosphere packaging of blueberry fruit: effect of temperature on package O2 and CO2[END_REF], who worked on MAP of "Highbush" blueberries at various temperatures, minimal O 2 partial pressure at equilibrium should be at 4kPa at 25 °C to avoid a turn into fermentative metabolism. Assuming that "Duke" blueberries may tolerate the same level of O 2 and considering the uncertainty propagation, the chosen LDPE package could induce off-flavours and off-odours, since the lower O 2 limit was found at 0.2 kPa.

Optimisation step.

Results previously obtained point out the fact that by using an LDPE pouch, if O 2 partial pressure is significantly reduced in the packaging (below 10%), CO 2 is moderately increased (the upper limit for CO 2 is only 5%). In general, berries have prolonged postharvest shelf life when exposed to levels of CO 2 above 15% [START_REF] Almenar | Equilibrium modified atmosphere packaging of wild strawberries[END_REF][START_REF] Beaudry | Effect of carbon dioxide partial pressure on blueberry fruit respiration and respiratory quotient[END_REF][START_REF] Beaudry | Modified atmosphere packaging of blueberry fruit: effect of temperature on package O2 and CO2[END_REF] [START_REF] Beaudry | Modified atmosphere packaging of blueberry fruit: effect of temperature on package O2 and CO2[END_REF][START_REF] Beaudry | Effect of carbon dioxide partial pressure on blueberry fruit respiration and respiratory quotient[END_REF][START_REF] Almenar | Equilibrium modified atmosphere packaging of wild strawberries[END_REF]). The packaging material commercially used for blueberries is thus not satisfactory. An identification of the packaging permeabilities suitable to reach optimal O 2 and CO 2 concentration favourable to the conservation of blueberries was then performed. For this purpose, it is necessary to first define the range of targeted O 2 and CO 2 concentrations suitable for MAP of blueberries. For O 2 , several authors [START_REF] Kim | Influence of modified atmosphere on quality attributes of blueberry[END_REF][START_REF] Rosenfeld | MAP of highbush blueberries: sensory quality in relation to storage temperature, film type and initial high oxygen atmosphere[END_REF] claim less-than-or-equals 9% O 2 as the optimum amount. We can thus consider that has to be focused on 9% with a reasonable range of variation between 8 and 10%.

Different CO 2 optimal concentrations have been reported to prolong blueberry shelf life.

While several authors [START_REF] Kim | Influence of modified atmosphere on quality attributes of blueberry[END_REF][START_REF] Rosenfeld | MAP of highbush blueberries: sensory quality in relation to storage temperature, film type and initial high oxygen atmosphere[END_REF] claim between 15% and 18%

CO 2 as the optimum amount, [START_REF] Harb | Controlled atmosphere storage of highbush blueberries cv[END_REF] reported that "Duke" blueberries react to increased CO 2 amounts (>12%) with loss of firmness and acidity content and a negative impact on flavour. CO 2 is not only a respiration inhibitor but also an antifungal compound. Its effect is dependent on concentration, exposure time and application time following fruit harvest. Therefore high levels of CO 2 are usually required in MAP of blueberries to delay fungi growth and prolong shelf life. As regards this antifungal effect, [START_REF] Harb | Controlled atmosphere storage of highbush blueberries cv[END_REF] also reports that a minimal amount of 6% CO 2 is needed to retard B. cinerea (one of the main spoilage moulds) growth in blueberries stored near 0 degree C. In absence of a clear consensus for optimal CO 2 concentration in MAP of blueberries, we will thus consider in this study that may vary between 6 and 15% at equilibrium.

By using these optimal partial pressures and the parameters listed in Table 8, the window of optimal permeabilities suitable for maintaining blueberry quality at 25°C during 5 days were identified. While no guaranteed solutions were found for O 2 permeability, a range of guaranteed solutions was identified for CO 2 (between 1.20 to 1.59×10 -15 mol.m -1 .s -1 .Pa -1 ).

That means that by using a packaging material having a CO 2 permeability in this range, and in the conditions used for this simulation (geometry, mass of blueberries, uncertainty on input parameters given in Table 8, etc.), we are sure, even in the worst case, to reach the targeted CO 2 range of 6-15% at equilibrium in the packaging (upper and lower CO 2 simulated curves lay between 7 and 14%). On the contrary, O 2 curves lay between 4 and 13% (curves not shown). In this case, only possible solutions could have been identified, ranging from 0.76 to 2.89×10 -15 mol.m -1 .s -1 .Pa -1 . It is important to point out that even if these solutions are only possible but not guaranteed solutions, the O 2 concentrations reached in the headspace at equilibrium will never drop below 4kPa, which is satisfactory from the vegetable/fruit point of view. This impossibility to identify a set of guaranteed solutions for O 2 permeabilities could be explained by the fact that the targeted O 2 range is narrow, and given the uncertainties of input parameters and the conservative interval analysis used here, the possible range of O 2 concentrations at equilibrium is large.

Sensitivity analysis. Table 9 summarises the sensitivity analysis performed on the blueberry case study. The results indicate that both packaging and respiration parameters impact the precision on and . The uncertainty has the most important impact on O 2 and CO 2 internal partial pressures uncertainty (50% reduction on uncertainty results in a gain of around 10% on and ), followed by and uncertainties, which impact in the same manner (around 8-9%) O 2 and CO 2 internal pressures. Surprisingly, uncertainty has a very low impact on and precisions. Indeed, it was expected that this parameter uncertainty could significantly impact the prediction because of its importance in the modelling of blueberries respiration (uncompetitive inhibition). It seems that uncertainty is more impacting than that of or even .

Table 9.

Discussion

In this paper we propose interval analysis as a useful alternative to probabilistic analysis that requires far less information in order to give reliable results. Interval analysis results are easy to compute when functions satisfy certain monotonicity properties, as is the case for functions used in MAP modelling. We have used this method for two purposes: (1) classical uncertainty analysis during MAP modelling, including propagation (prediction of O 2 and CO 2 internal partial pressures) and sensitivity analysis (quantification of input uncertainty impact on output uncertainty), and (2) robust design under uncertainties (identification of O 2 and CO 2 permeabilities that are best suited to a targeted product). The approach is applied to three case studies: chicory, mushrooms and blueberries, chosen for their differences. Chicory displays moderate maximal respiration rate , while mushrooms are characterised by a high respiration rate. Blueberries display moderate maximal respiration rate and a significant CO 2 inhibition whereas this inhibition is negligible for chicory and mushrooms. For chicory and blueberries, uncertainties indicated in the reference where used in the interval analysis (or, if it is not precise, an uncertainty of 10% was applied). For mushrooms, respiration parameters come from different references that yield to a larger variation range for those parameters (especially). It was thus interesting to study this case.

Biological variability and interval analysis

A first remark is that guaranteed solutions for permeabilities seldom occur (for which we are sure that the O 2 and CO 2 internal pressures will lay in optimal range of the product). This is due to the combination of interval analysis conservativeness and of the important biological variability of fresh fruits and vegetables. Multiplicity of references (such as for mushroom respiration parameters) makes the problem even worse. Also, optimal ranges may be too narrow to find guaranteed solutions (blueberry case). However, interval analysis is able to handle all these cases (even when dealing with very heterogeneous sources, as was the case for mushrooms) in a straightforward but conservative way. It is also important to recall that guaranteed solutions are very robust solutions, and that possible solutions that were obtained in all cases may be sufficient for a given application. The analysis has also stressed some important facts, such as the need to clearly identify the upper and lower bounds of the equilibrium atmosphere for the product concerned and to deepen the knowledge of the behaviour of fresh fruits and vegetables at those bounds.

Sensitivity analysis has shown in all cases that a reduction of 50% on each parameter uncertainty enables to gain a precision on the predicted O 2 /CO 2 internal partial pressure of around 50% and even more than 60% for mushrooms (for ). Results have shown that uncertainty has an important impact if its value is high (mushrooms and blueberries), while its impact is lower if value is low (chicory), and in this case the uncertainty on packaging parameters (permeabilities, thickness, surface, etc.) impact more on and uncertainties. Surprisingly, even if a CO 2 inhibition is significant and cannot be neglected in respiration modelling (case of blueberries), has a low impact on and precision. The final conclusion from these first studies is that experimental efforts must be carried out on the determination of accurate values, and then, on packaging characteristics ( , ,S,e).

However, it should be kept in mind that the performed sensitivity analysis of this paper, apart from the conclusions mentioned above, are largely illustrative. Indeed, sensitivity analysis is a useful tool to detect which parameters have the most impact on the output precision of a and standardizing the methods used to assess this parameter since each of the methods used had some limitations [START_REF] Fonseca | Modelling respiration rate of fresh fruits and vegetables for modified atmosphere packages: a review[END_REF].

Interval analysis versus Monte Carlo probabilistic method

We now compare interval analysis to Monte Carlo probabilistic method for the three cases.

To perform Monte Carlo simulation and ensure sufficient accuracy, m = 2000 data were randomly drawn between the bounds of their respective uncertainty (see Tables 4, 6 and8) using a procedure already used by [START_REF] Pénicaud | Ascorbic acid infood: development of a rapid analysis technique and application to diffusivity determination[END_REF]. As the distribution of each input variable is not known a priori and could not be experimentally determined (less than 5 determinations for each parameter), a uniform distribution was considered. The generation of these virtual parameters was carried out on Matlab software (The Mathworks, Inc., Natick, MA, USA) using a routine function (rand.m). For each set of virtual parameters generated, either a MAP modelling or an optimisation step was performed.

Considering uncertainty propagation by using MC simulations during the simulation of internal O 2 and CO 2 partial pressures, intervals of possible values (with bounds taken as the 95% confidence interval) at the steady state are, for the three cases, narrower than those obtained with interval analysis, which is in agreement with the theory (i.e., that all MC simulations are within the interval analysis bounds). For example, O 2 may vary between for chicory (vs. with interval analysis), for mushrooms (vs.

with interval analysis) and for blueberries (vs. with interval analysis). Indeed, Monte-Carlo analysis corresponds to choosing a particular distribution within the bounds, as well as independence between the variables, while interval analysis corresponds to a "worst" and "best" case analysis (for instance, there are no averaging or counterbalancing effects with interval analysis, as can happen with MC analysis).

Concerning the optimisation steps, MC simulations provided distributions of optimal values for and . We represented these results as histograms, probability densities and fuzzy sets assuming value 1 for the mean optimal value and bounded by the 95% confidence . Two facts can be noticed: MC analysis usually provide sharper and more informative distributions (allowing one to build confidence intervals), and although the two analyses roughly agree on the range of optimal values, they sometimes point to different best options. Indeed, while for chicory interval analysis proposes a best O 2 permeability between 1 and 1.5 ×10 -15 mol.m -1 .s -1 .Pa -1 , probabilistic analysis recommends a value around 2.5 mol.m -1 .s -1 .Pa -1 . In this case, guaranteed solutions of interval analysis should be preferred, as they do not make any unsupported hypothesis. The same happens for mushrooms and CO 2 permeability, however in this case interval analysis is unable to provide guaranteed solutions, and "best" solutions proposed by the probabilistic analysis (around 11×10 -15 mol.m -1 .s -1 .Pa -1 )

are not discarded by interval analysis, and could be considered as a potential alternative.

In practice, industry may be satisfied with designs that prolong the shelf life of a given percentage of products (for instance, 95% or 99% of the products remaining edible may be enough), particularly if it saves important costs. It should be noted that interval analysis does not provide such information (only providing bounds and no statistical information), while probabilistic analysis does. However the reliability of the more detailed information provided by a probabilistic analysis may be questioned when only little data or information is available.

In practice, the two methods can be seen as two extreme solutions to handle uncertainty: interval analysis needs a minimal amount of information and gives a poorly informative but robust result, while proper probabilistic analysis requires a great amount of information and gives a very informative result whose reliability may be questioned if unverified assumptions had to be made. In practice, the real state of available information will be in the middle: more than simple bounds, but not enough to estimate reliable probability distributions.

Hence, rather than being opposed, the two methods should be seen as complementary:

interval analysis can be performed as a first quick and robust analysis, and a subsequent probabilistic analysis can be used to refine prediction. Any disagreement between their conclusions (such as O 2 permeability for chicory) can then be detected and investigated more closely. Another solution is to consider imprecise probabilistic theories. Indeed, such theories are more flexible and can model information states that cannot be adequately handled by intervals or probability distributions. However while such models combine the advantages of each method (robustness and statistical estimation), they also (partially) share their respective drawbacks (higher computational cost and tendency to give large uncertainty bounds).

Conclusion

In this paper, we have used interval analysis to study the impact of uncertainty propagation during MAP modelling and during a design optimisation step (using MAP models in a reverse manner) to quickly produces optimal values for O 2 and CO 2 permeabilities. This design optimisation step takes account of interval uncertainty and can cope with imprecisely specified goals (range of targeted O 2 and CO 2 internal partial pressure), distinguishing between possible solutions (potentially satisfying the targeted O 2 /CO 2 concentrations) and guaranteed solutions (certainly satisfying the goal). The difference between the two kinds of solutions is represented by the means of fuzzy sets describing optimal solutions. We have also proposed an easy method to perform some first sensitivity analyses.

Figures captions

Figure 1: Uncertainty propagation during the modelling of modified atmosphere packaging in the case of chicory (case I) packed in LDPE pouches (simulation carried out at 20°C with parameters listed in Table 4)

  the form of intervals [G p ] and [S p ], with G p é ë ù û Í S p é ë ù û . An empty set means that there is currently no solution (no values of ) that could satisfy the goals. Roughly speaking, the algorithm detailed in Destercke and Guillard (2011) takes advantage of the known monotonic properties of the model to compute boundary values of [G p ] and [S p ]. In our problem the algorithm will result in four intervals and proposing

  ): reduce, for each parameter and variable, its uncertainty by a given fraction , such a reduction coming down to transform an interval [a,b] into an interval [a',b'] such that Equation 9 with the middle and length of the interval, respectively. Such a reduction gives a new interval-valued solution included in the previous one, and with an overall imprecision . If is the output obtained after reducing the imprecision of parameter p by r%, the gain in the output precision generated by this reduction can then be defined as Equation 10

  Figure 1.

  not for the transient phase, we have taken and the time domain was maintained at around 7 days T=[0, 170] . The optimal concentrations at the steady state were fixed as and for every , according to previous work (Charles et al. 2005) since oxygen partial pressure has to be between 2 and 10 % and carbon dioxide partial pressure between 2 and 5 % at the steady state. Levenberg-Marquardt Algorithm (Nocedal and Wright, 1999) was used to identify the optimal permeabilities. Figures 2A & 2B show the range of O 2

  Figure 2.

  Figure 3.

  Figure 4.

  Figure 5.Figure 6.

  gained on O 2 and CO 2 internal partial pressure (even more than 60% for O 2 )! Both the optimisation step and sensitivity analysis clearly demonstrate the importance of having a good knowledge on physiological behaviour and precise input parameters with low uncertainty for prediction concerns. Up to now the state of the art on common white mushroom respiration and storage is still too controversial to foresee accurate prediction and guaranteed packaging solutions. For instance respiration of mushrooms might be considered following a Michaëlis-Menten-type equation with no inhibition (Cliffe-Byrnes and O[START_REF] Cliffe-Byrnes | Effects of gas atmosphere and temperature on the respiration rates of whole and sliced mushrooms (Agaricus bisporus) -Implications for film permeability in modified atmosphere packages[END_REF][START_REF] Varoquaux | Respiratory parameters and sugar catabolism of mushroom (Agaricus bisporus Lange)[END_REF] or uncompetitive[START_REF] Cliffe-Byrnes | Effects of gas atmosphere and temperature on the respiration rates of whole and sliced mushrooms (Agaricus bisporus) -Implications for film permeability in modified atmosphere packages[END_REF] Iqbal et al., 2009b), and the Michaëlis-Menten constant, , as negligible (Cliffe-Byrnes and O'

considered as 5

 5 days at 25°C. The simulated curves (not shown) obtained taking into account uncertainty propagation during MAP simulation are in agreement with the experimental and predicted ones determined by Song et al. (2002) at two temperatures (15 and 25 degrees C). However, these authors did not study the effect of error propagation in their simulation studies. By considering the uncertainties of all input parameters, the O 2 partial pressure at equilibrium may potentially vary between 0.3 and 10%, , and CO 2 between 3 and 6%, . These upper and lower bounds for O 2 and CO 2 are equivalent to a 10°C variation (from 25 to 15 degrees C) as observed by Song et al. (2002)!

  interval of the MC simulation (see Figures 2C & 2D and Figures 5C & 5D for chicory and mushrooms respectively)

Figure 2 :Figure 3 :Figure 4 :Figure 6 :

 2346 Figure 2: Optimal O 2 (A and C) and CO 2 (B and D) permeability range for case I: chicory. Results of interval analysis (guaranteed and possible solutions) are on the left and of Monte Carlo simulation on the right (histograms, densities and fuzzy sets centred on mean value and with support equal to 95% confidence interval) Figure 3: Uncertainty propagation during identification step of optimal O 2 and CO 2 permeabilities in the case of chicory (case I) Figure 4: Uncertainty propagation during the modelling of modified atmosphere packaging in the case of mushrooms (case II) packed in plastic tray (simulation carried out at 20°C with parameters listed in Table 6) Figure 5: Optimal O 2 (A and C) and CO 2 (B and D) permeability range for case II: mushrooms. Results of interval analysis (guaranteed and possible solutions) are on the left and of Monte Carlo simulation on the right (histograms, densities and fuzzy sets centred on mean value and with support equal to 95% confidence interval) Figure 6: Uncertainty propagation during identification step of optimal O 2 and CO 2 permeabilities in the case of mushrooms (case II)

Figure 1 :Figure 2 :

 12 Figure 1: Uncertainty propagation during the modelling of modified atmosphere packaging in the case of chicory (case I) packed in LDPE pouches (simulation carried out at 20°C with parameters listed in Table4)

Figure 3 :

 3 Figure 3: Uncertainty propagation during identification step of optimal O 2 and CO 2 permeabilities in the case of chicory (case I)

Figure 4 :Figure 5 :

 45 Figure 4: Uncertainty propagation during the modelling of modified atmosphere packaging in the case of mushrooms (case II) packed in plastic tray (simulation carried out at 20°C with parameters listed in Table6)

  Figure 6.

Figure 6 :

 6 Figure 6: Uncertainty propagation during identification step of optimal O 2 and CO 2 permeabilities in the case of mushrooms (case II)

Table 1 .

 1

Equation 1 Equation 2 With Equation 3 or Equation 4 or Equation 5

Table 2 .

 2

Table 5 .

 5

Table 8 .

 8

  mathematical model, but it makes sense only if it is performed to achieve certain goals (i.e. to know on what parameter experiments or technological innovation should focus, given certain time, technical or cost constraints). For instance, in MAP modelling for chicory, it appears difficult to gain precision on the thickness since it is inherent to the constraints of shaping processes. Conversely, in the case of mushrooms, uncertainties on respiration rate could be reduced by focusing on specific strains (limiting the population of interest) or by improving

Table 3 : Monotonicity of each function f 1 and f 2 with respect to input parameters

 3

	Parameter	f1	f2
		 N.A.
		N.A. 
	S	 
	e	 
		 
		 
		 
		 
		 
	m	 
	RQ	N.A. 

Table 7 : Effect of 50% of decrease on input parameter uncertainty on the reliability of internal partial pressure obtained at equilibrium in the case of mushrooms Parameter Decrease of uncertainty

 7

		6.77	15.07
		0.57	17.92
	S	6.15	2.11
	e	0.68	0.20
		50.10	3.35
		0	0
	m	11.51	0.34
	RQ	0.47	11.90
	all	63.07	50.77

Table 9 : Effect of 50% of decrease on input parameter uncertainty on the reliability of internal partial pressure obtained at equilibrium in the case of blueberries Parameter Decrease of uncertainty p o 2

 9

			pkg
			2.34	1.16
			0.37	3.12
	S		6.61	7.94
	e		7.97	8.84
	RR		9.43	8.11
	O 2 max
	Km	0.24	0.24
		appO
		2
	Ki u	co	1.55	1.40
		2
	m		5.06	4.00
	RQ		1.51	11.50
	all		43.30	48.49

Note that optimal internal gas partial pressures are goals, and are not part of the models per se. They will be considered during the optimisation step

Acknowledgements

The authors gratefully acknowledge the ANR (ANR-07-PNRA-029) for its financial support to the development of the Tailorpack website.

Methodological perspectives to this work include the development of more precise methods, eventually ending up with more accurate and multi-dimensional approximations of the sets [G] and [S] of guaranteed and possible answers. Also, it may be desirable to extend the current approach to hybrid uncertainty models mixing interval and probabilistic uncertainty, as information concerning different parameters may vary in quantity and quality.

However, these two perspectives would involve more computationally demanding procedures, thus reducing the number of models one could work with. More applied perspectives include the combination of the optimisation system with a decision support system where a user can search a database for optimal packaging (fuzzy sets describing sets of optimal solutions would then be used as user preferences). parameter cannot be determined more precisely and was considered as a fixed value.


Pierre De Saqui-Sannes

Jérôme Hugues

Combining SysML and AADL for the Design, Validation and Implementation of Critical Systems

Keywords: Modeling Process, Real-Time, SysML, AADL, Model Verification, Model-Based Code Generation

The realization of critical systems goes through multiple phases of specification, design, integration, validation, and testing. It starts from high-level sketches down to the final product. Model-Based Design has been acknowledged as a good conveyor to capture these steps. Yet, there is no universal solution to represent all activities. Two candidates are the OMG-based SysML to perform high-level modeling tasks, and the SAE AADL to perform lower-level ones, down to the implementation. The paper shares an experience on the seamless use of SysML and the AADL to model, validate/verify and implement a flight management system.

Introduction

Model-Based Engineering (MBE) has emerged as a key set of technologies to engineer complex systems. An MBE approach associates modeling languages and tools to a rigorous design process from requirement elicitation to design, implementation, integration and testing. The objective is to come up with a seamless process that bridges system and software engineering.

The paper proposes a seamless process for critical embedded systems relying on SysML and AADL. SysML [START_REF] Behtaji | An AADL-Based SysML Profile for Architecture level Systems Engineering: Approach, Metamodels, and Experiments[END_REF] is the System Modeling Language standardized by the Object Management Group. AADL [START_REF]SysML[END_REF] is the Architecture Description Language supported by the SAE AS2-C working group. SysML and AADL provide two distinct views of the same system. A SysML model furnishes a high-level view for the system engineer. AADL makes it possible to build up a lower-level view for the engineer in charge of the implementation as an embedded system, combining hardware, operating system and code implementing all functions. In other words, SysML supports the early stages of system engineering, while AADL supports the design, and analysis of embedded systems. In the context of critical systems, SysML and AADL are complementary.

Again, our objective is to reduce the gap between system engineers and architects. The rationale of the process proposed by the paper is as follows: the real-time variant of SysML named AVATAR enables requirement capture, use-case and scenarios analysis, and architectural/behavioural design using blocks and state machines. An AVATAR model may be debugged and formally verified using TTool [3] and UPPAAL [START_REF] Knorreck | TEPE: A SysML Language for Timed-Constrained Property Modeling and Formal Verification[END_REF]. Once approved by the system engineer team, the AVATAR model is transformed into an AADL model that maps system blocks onto execution resources and details behaviours so as to achieve schedulability or dimensioning analysis using Ocarina [START_REF]SysML[END_REF].

The paper is organized as follows. Section 2 defines a process for critical systems design. Section 3 introduces the case study: a longitudinal flight management system. Section 4 applies AVATAR and TTool to the case study. Section 5 applies Ocarina to the AADL model derived from the AVATAR model. Section 6 surveys related work. Section 7 concludes the paper and outlines future work.

Process

SysML and AADL are notations, not methods. Our first concern is to introduce a method for embedded system design.

Requirement Capture

A requirement diagram defines a tree-structure of general requirements, refine them into technical requirements, and connect requirements to stereotyped test cases that we term as "properties" by reference to the properties used to formally verify design diagrams.

Modeling assumptions

A model abstracts a real system; it is valid under a set of assumptions that apply to the system itself as well as to the language, tools and method in use.

Analysis

A use-case diagram characterizes the system by its boundary, the functions (or use-case) it should implement, and the set of external actors it interacts with. Scenarios expressed by sequence diagrams document the use cases.

Design

A block diagram defines the static architecture of the system as a set of blocks internally defined by extended finite state machines. The design diagrams are formally checked against logical and timing errors. The benefits of formal verifications will be optimal if the design step is incremental.

The design step includes two main sub-steps that respectively output a functional and an organic architecture. The former defines functional and communicating blocks that describe high-level interactions between abstractly described functions. The latter describes a physical architecture, which serves as starting point to create the AADL architecture. The designer maps each function to actual execution resources. This is the design objective of the AADL language.

Detailed Design

AADL is a component-oriented modeling framework. A model is a set of interconnected component instances. A component instance is one particular incarnation of a component type that defines its interface (parameters, ports, requirement to access to other elements), and the corresponding component implementation that refines its internals.

AADL has been defined so that a software engineer can use the vocabulary and concepts of his/her domain. A component type is categorized by its nature: software (thread, subprogram, process), hardware (processor, device, bus, memory) or hybrid (system, abstract). A component is defined by a type, an implementation and a set of properties attached to its actual semantics or to resources requirements. Thus, one may model a set of tasks, connect them to match data flow requirements as part of a process implementation, and bind this process to an operating system, supported by a processor. This includes nonfunctional properties, such as actual data type representation, worst-case execution time, and priority ranges.

Detailed analysis

The AADL language is supported by a large variety of analysis tools for scheduling, resource dimensioning, model checking, security, and fault-propagation analysis, just to mention a few. Most of them are available as Open Source software [START_REF]SysML[END_REF].

Actually, SysML and AADL provides two distinct views of the same system: one high-level view for the system engineer, one lower-level view to the software engineer, in charge of the implementation as a full-fledged embedded systems.

Case Study

The Longitudinal Flight Management System (LFMS) allows the pilot to put the plane in the right direction according to the altitude and therefore to manage risings and descents. The LFMS is active throughout the entire flight, including take off and landing. The LFMS does not manage yaw angle. It solely commands the elevators to control the pitch position. It also triggers alarm lights for the pilot.

Assuming an execution cycle of 5ms, the LFMS is connected to functions as various as flight parameters computation, flight command management, automatic pilot and alarms.

The development of a LFMS has to abide to a stringent development process. The DO-178B standard mandates various activities to be performed to achieve certification of each function and then airworthiness of the full aircraft. One key objective is to ensure traceability from high-level requirements to actual implementation, and between all intermediate artifacts. Next revision of DO-178 will allow MBD as part of the engineering process. In the following, we illustrate how traceability between all model elements can be carried out, while allowing for early validation of the system at each step, and then its full generation.

LFMS Modelling in Avatar

The process defined in section II starts with requirement capture. Three requirement diagrams respectively address the inputs (sensors, human operator), the outputs (display, actuators) and the LFMS functions. Figure 1 identifies a set of general requirements attached with the LFMS's inputs and derives technical requirements from general ones. The AVATAR model developed from elicited requirements is valid under a set of assumptions categorized by their origin (system, language, tools, process), their type (e.g. "not implemented function") and their description in plain text. The model discussed in the paper thus ignores failures and maintenance operations.

Figure 1 attaches the UnexpectedIncidenceAlarm property to the Incidence requirement node. The property will be used to verify design diagrams. The use-case diagram depicted Figure 2 conveys a functional view of the system and identifies which other part of the plane the LFMS interacts with. For space reasons, the sequence diagrams that document the uses cases are not provided in the paper.

Figure 3 depicts the architecture of the LFMS system as a set of block instances that communicate via ports. The diagram merges block instances and types definitions (attributes and methods). The above architecture connects the system to input and output devices emulators, thus making the global system a closed one, an important step for simulation and verification. Each block in the architecture has a behavior described by an extended state machine. Figure 4 depicts the state machine associated with the stallAlarm component. This alarm is triggered whenever the incidence angle is greater that 12°. The design model made of the architecture and state machines is now ready for debugging using the simulator integrated to the TTool toolkit. TTool generates simulation traces in terms of scenarios that identify how block instances internally evolve and communicate with one another. Also, TTools graphically animates the state machines and makes it easy for the designer to connect simulation results to the original AVATAR model. Usual functions like scenario replay and statistics are also available.

Thus, TTool includes a model simulator. It also offers a press-button interface to the UPPAAL model checker via the connection it maintains between the AVATAR model and the timed automata specification derived from that model. Formal verification search for deadlocks and verifies reachability as well as liveness properties on the states and actions of the protocol machines. To decide whether some action is reachable or not, or to study the liveness of that action, it suffices to right click on the symbol of that action. The UPPAAL model checker is invoked with the corresponding CTL formula, and the result of reachability / liveness properties is displayed by TTool. This way the use of TTool does not require preliminary knowledge of CTL or other logics.

Formal verification with TTool also relies on observers. An observer is a UML object manually or automatically [START_REF]Simulink[END_REF] included in the model of the system in order to drive formal verification. Given an observer O checking an AVATAR model against requirement R, O must behave as follows: each time R is violated, a transition label in the reachability graph must unambiguously identify R's violation. A quick search of requirement violation labels thus enables identification of unmet requirements.

Whatever the verification approach, one needs to express the properties to be verified. AVATAR reuses SysML parametric diagram to pictorially depict properties. As an example, Figure 5 uses a parametric diagram and the TEPE language to depict the UnexpectedIncidenceAlarm property.

AADL and Ocarina

Once the high-level design has been validated, the engineer team may focus on its implementation on a target platform. Thus, one needs to map SysML model elements onto actual implementation blocks. SysML design diagrams define functional blocks, their interface and their behavior as state machines.

The next step is to bind all these functions to execution resources. To preserve the properties validated on the AVATAR model, and to ensure a seamless process, we propose to use AADL to model all these parts, and then derive an implementation. We now sketch this modeling process, using AADLv2 standard notations.

AADLv2 has facilities to support incremental modeling and validation. Our entry point is a set of SysML diagrams, blocks with interfaces. This is equivalent to AADLv2 abstract component category. An abstract component simply indicates the intent of a function; it is later refined onto a concrete component category (e.g. a thread, a process or a device).

It is the exact counter part of a SysML block. For all blocks, we define one abstract component type with the same interface, and derive some non-functional properties from the state machines (modes, data types, timing requirement, etc.). This one to one mapping may be automated. Besides, it ensures a strict boundary between the SysML world, and the AADL one, with a possibility to do a reverse mapping. This feature is highly beneficial for ensuring traceability.

The second feature from AADL we use is component refinement. Following object-oriented principles, one may refine a type and extend it. In the case of an abstract component type, to derive a concrete type, and in the case of concrete elements to build an inheritance tree, we refine interfaces to go from an opaque type such as "pressure" to an actual type such as 32-bits floating type. Each refinement builds a new intermediate component type. This refinement mechanism allows the designer to navigate through its hierarchy of types, each of which illustrates one design choice.

AADL defines annex languages to model specific concerns such as Integrated Modular Avionics (IMA) systems, or their behavior as timed state machines as part of the AS5506/2 standard. The IMA annex is used to map functions to execution resources in the context of avionics systems following the ARINC653 standard runtime. The behavior annex is used to capture the behavior of a component. In our context, it is derived from the SysML automata.

This iterative process will ultimately converge with the binding of actual source code implementing each function to AADL subprograms component type, the definition of threads, devices supporting interaction with operators, sensors and actuators, and the configuration and binding of these threads to a runtime environment.

It is important to mention that AADL models may be validated at each refinement: first when combining abstract types, then when performing refinements, and finally when binding refined modules to the execution platform. Validation is syntactic and semantic: we ensure that the architecture being modeled is notionally sound. Depending on the properties used, the validation may also apply to the system's behavior (for instance to check composition of blocks with respect to the use of a particular interconnection bus); or to its schedule.

From this set of principles, we instantiated the process as follows (see figure 6): 1. From the set of requirements, a set of AADL components can be defined as potential building blocks for the system. Information about the application domain, such as the avionics domain is likely to force the choice of particular CPU or network architecture. 2. SysML Block diagrams are mapped onto AADL abstract components; connections between SysML block diagrams are reflected in the interconnection of the AADL blocks. 3. SysML State machines are mapped onto AADL behavioral annex elements, and directly bound to the corresponding AADL abstract component. This strong link between the two elements is important to ensure interfaces between both models match.

From this step, we may now follow on a more traditional modeling processing based only on the AADLv2: 1. Abstract components are refined to concrete component types (e.g. devices, processors, threads, …).

Components are selected from a repository of AADL models, det; 2. These components are combined in a bottom-up fashion to build all terminal elements, sub-systems and finally systems. This combination of models follows the instantiation process as defined in the AADLv2 standard. We modeled a subset of this case study as a proof of concept, and applied checks we discussed in previous work [11]. They allow us to check additional legality rules to ensure the system does respect modeling patterns for avionics system and IMA. ). It is preferred to model safety-critical system so as to maximize traceability.

Several functions compute outputs from the same set of inputs (e.g. speed or pressure). Besides, these are simple computations based on physical laws. To reduce overhead, a design decision is to merge functions in the same thread. This is the role of the "ParameterCalculator" that merges slope, pressure and altitude computation. Alarm managers are not merged.

Although they also implement simple computations, it is safer to leave them separated, as each one raises a separated alarm signal.

Once the model has been validated, once can focus on its implementation. Two options are available: implement each function directly as C or Ada programs; or model them using Simulink [START_REF] Delange | A MDE-based process for the design, implementation and validation of safety critical systems[END_REF] or SCADE [START_REF]Simulink[END_REF]. In both cases, these descriptions can be bound to the AADL model by pointing leaf model elements (modeled as AADL subprograms) to the corresponding model or source code artifact. Then the Ocarina code generator can generate the complete application: process bound to an operating system, thread configured using model non-functional properties and then thread execution pattern for periodic or sporadic threads calling user-defined code or models [START_REF] Gilles | Expressing and enforcing user-defined constraints of AADL models[END_REF].

These validation and code generation steps help ensuring the model respects all domain-specific constraints for critical systems, and traceability between model and source code. For now, the code generated follows stringent guidelines for space and avionic systems, ensuring it can be later fully tested following code coverage criteria such as MC/DC for avionics system, but also worst-case evaluation techniques, or symbolic execution.

Related Work

Authors in [6] discuss the use of SysML, UML and model-checking for space applications. Authors reuse the process defined by the European Cooperation for Space Standardization body. For each step, one may easily find a counter part in the early stages of the process introduced in Section II. Like the UML tool Rhapsody, TTool is interfaced with UPPALL, but with improved user-friendliness. By contrast, the detailed design and schedulability analysis achieved using AADL and Ocarina have no counterpart in this work.

As suggested by the acronym, AADL fundamentally address architectural issues, which means design issues. AADL does not provide any notation for the requirement capture and analysis phase. Therefore, the notations used as front end to the design step in AADL are numerous.

Authors in [START_REF] Mcgregor | Modeling Software[END_REF] leaves requirement capture and analysis apart the AADL modeling process. Temporal formal verification is achieved at the AADL level where the approach proposed in this paper enables both earlier detection of design errors, and detailed verification. Early verification is a key requirement to reduce design cost.

Finally, [START_REF] Araujo | Geração de Dados de Teste a Partir de Modelos de Sistemas Embarcados: Uma Revisão Sistemática[END_REF] outlines a life cycle that sequentially uses SysML, AADL and UML, giving some hints at how to combine them. Contrary to their approach, the process we propose provides an implemented solution, applied to a full case study as a proofof-concept. It supports formal verification of SysML-AVATAR design diagrams and starts using AADL at the detailed

Figure 1 -

 1 Figure 1 -Requirement Diagram Figure 2. Use-case Diagram

Figure 3 .

 3 Figure 3. Block Diagram (organic architecture) Figure 4. State Machine Diagram

Figure 5 .

 5 Figure 5. TEPE parametric diagram

Figure 6 :

 6 Figure 6: Integration between SysML and AADL

Figure 7 :

 7 Figure 7: LFMS in AADLv2Figure6represents the threads forming the software part of the LFMS. The process (enclosing box) has input and output ports modeling data flows from sensors or to actuators. Each thread is a refinement of the corresponding abstract function imported from the SysML block diagram. This graphical model has been derived from the textual AADLv2 representation we used to model the full system. The textual notation is more verbose, and allows for finer traceability between model elements (ports, threads, etc.). It is preferred to model safety-critical system so as to maximize traceability.

Acknowledgements

Ludovic Apvrille has developed TTool and co-designed the AVATAR language with the first author. Daniel Knorreck has contributed on TEPE's definition and TTool's development. The case study reuses fragments of a SCADE model developed by Frédéric Camps and ISAE students. Ocarina is a joint-project between ISAE, Telecom ParisTech and ESA. It is also part of the TASTE toolchain.

design step. Code generation is not delegated to a UML tool, but fully integrated to the AADL part of the process. The approach illustrated in the paper further introduces schedulability analysis, which is not addressed by the authors.

Conclusions

The paper proposes a global model-based approach for the design, validation and implementation of critical embedded systems, combining standardised and tooled SysML (with AVATAR real-time profile) for system level modelling, requirement capture, use case and scenarios analysis, architecture description, and AADL at software level down to implementation. A flight management system serves as running example.

SysML-AVATAR and AADL are two complementary modeling languages supported by TTool and Ocarina, respectively. SysML/AVATAR enables requirement capture, use-case and scenario driven analysis, and verification-centric design. AADLv2 accepts a preliminary design from TTool and refines it terms of architecture and behaviour. The resulting AADL model is also the basis for reachability analysis and code generation, taking as input a more detailed view of the system. A bridge between these two notations is introduced. V&V process includes model-checking of SysML activities using UPPAAL, as well as code generation, scheduling analysis, and model coverage using Ocarina.

Combining the two notations allow for a combined process that merges high-level modeling consideration and low-level modeling notation geared towards implementation. Seamless integration has been defined through carefully chosen SysML diagrams and their AADL counterparts.

Ongoing developments include automatic translation of AVATAR models into AADL. We also plan to extend TTool and Ocarina libraries of patterns that will contribute to achieve model reusability, and methodological assistants to ease transitioning from SysML to AADL. Extending the number of SysML diagrams as inputs must be contemplated, based on existing experiments around the SysML. This is subject to further study. Finally, testing is a key issue [START_REF] Da Silva | Integrando SysML e model checking para v&v de software crítico especial[END_REF] not addressed in the paper. We plan to develop test-case generators for SysML and AADL.