Elise De

La Rochebrochard

Patrick Thonneau

Keywords: Paternal age, Infecundity, Miscarriage

et de fausse couche lorsque l'homme est âgé de plus de 40 ans?

RESUME

Position du problème. Un âge maternel ≥ 35 ans est un facteur de risque bien connu de la reproduction humaine qui a été largement étudié par les démographes et les épidémiologistes. A l'opposé, la question d'un effet de l'âge paternel a été très peu soulevée. Notre objectif était d'effectuer une revue de la littérature analysant l'effet de l'âge paternel sur le risque d'infertilité et sur le risque de fausse couche.

Méthodes. Nous avons lancé une recherche dans MEDLINE et vérifié l'exhaustivité de notre liste de références. Nous avons trouvé 19 papiers analysant l'effet de l'âge paternel.

Résultats. Les études épidémiologiques analysant l'effet de l'âge paternel sur le risque d'infertilité apportent des éléments en faveur d'un effet de l'âge paternel après 35-40 ans.

Cependant, les quelques études basées sur des données de l'assistance médicale à la procréation (en particulier les données sur les FIV avec don d'ovocytes) n'ont pas permis, pour l'instant, de confirmer cet effet de l'âge paternel. Tous les travaux ayant analysé l'effet de l'âge paternel sur le risque de fausses couches montrent une augmentation de ce risque chez les hommes ≥ 35-40 ans. De plus, d'autres travaux apportent des éléments en faveur d'un effet de l'âge paternel sur la mortalité foetale tardive.

Conclusion.

Le risque d'infertilité et le risque de fausses couches augmentent avec l'âge paternel. Deux hypothèses majeures peuvent être tirées de la littérature. Premièrement, l'augmentation des risques survient chez les hommes âgés de plus de 35-40 ans.

Cependant, un effet de l'âge paternel plus tardif (après 45-50 ans) ne peut être exclu. Deuxièmement, dû fait d'une interaction entre l'âge des deux partenaires, le risque d'infertilité et le risque de fausses couches pourraient être plus élevés lorsque les deux partenaires sont âgés (femme de plus de 35 ans et homme de plus de 40 ans).

Mots-clés:

Age paternel. Infertilité. Fausse couche.

INTRODUCTION

Maternal age: an important risk factor that has been extensively investigated

It is well known that age is a major risk factor for human reproduction [START_REF] Tietze | Reproductive span and rate of reproduction among Hutterite women[END_REF][START_REF] Van Balen | Age, the desire to have a child and cumulative pregnancy rate[END_REF][START_REF] Breart | Delayed childbearing[END_REF]. The effect of maternal age on fecundity (the ability to reproduce) has been extensively investigated by demographers and epidemiologists. Fecundity is measured by time-topregnancy (TTP), which, for epidemiologists, is the time taken by a couple to obtain a pregnancy or, for demographers, the time taken to obtain a pregnancy leading to a live birth. TTP is a time variable that makes it possible to estimate the monthly probability of conceiving, which is called fecundability (or effective fecundability when considering only pregnancies leading to a live birth). TTP is a sensitive indicator of fecundity and can be studied retrospectively, with a long period of recall, using only a short questionnaire [START_REF] Baird | Reporting errors in time-to-pregnancy data collected with a short questionnaire. Impact on power and estimation of fecundability ratios[END_REF][START_REF] Joffe | A time to pregnancy questionnaire designed for long term recall: validity in Oxford, England[END_REF].

For example, Larsen and Vaupel modelled variations in effective fecundability with maternal age in the Hutterites population by using a frailty model of event histories [START_REF] Larsen | Hutterite fecundability by age and parity: strategies for frailty modeling of event histories[END_REF]. They estimated that effective fecundability decreases from 17.1% at 25 years of age to 9.9% at 35 years of age and then to 5.6% at 40 years of age.It is important to remember when considering the effect of maternal age on TTP that valid estimates are impossible if analysing TTPs of women who are pregnant or who have already given birth. The use of such fertile populations underestimates the effect of maternal age on fecundity, or can even inverse it (i.e. increasing fecundity with increasing maternal age), as sterile couples are excluded and less fecund couples are under-represented [START_REF] Juul | Retrospectively sampled time-to-pregnancy data may make age-decreasing fecundity look increasing[END_REF].

Other methods have been used to investigate the effect of maternal age on fecundity. Demographers have studied the risk of sterility (the inability to bear a child) by using historical data from populations not using birth control methods. These studies showed that the estimated risk of sterility increases from about 5-6% between 20 and 24 years of age to about 16% at 30-35 years of age [START_REF] Henry | Some data on natural fertility[END_REF][START_REF] Leridon | Human Fertility. The basic components[END_REF][START_REF] Menken | Age and infertility[END_REF]. Epidemiologists used observations from artificial insemination programmes with donor sperm (AID) involving women with azoospermic husbands [START_REF] Schwartz | Female fecundity as a function of age: results of artificial insemination in 2193 nulliparous women with azoospermic husbands. Federation CECOS[END_REF]. These data allowed the analysis of a maternal age effect without any effect of sexual activity or paternal confounding factors, which are highly correlated with maternal factors, especially age. The analysis showed that fecundity begins to slowly decrease at 30 years of age and then decreases more rapidly after the age of 35 years of age [START_REF] Schwartz | Female fecundity as a function of age: results of artificial insemination in 2193 nulliparous women with azoospermic husbands. Federation CECOS[END_REF].

The consequences of maternal age on pregnancy outcome have also been investigated. Numerous studies have shown that the risk of adverse pregnancy outcomes, especially miscarriage and ectopic pregnancy, increases sharply with maternal age [START_REF] Bouyer | Risk factors for ectopic pregnancy: a comprehensive analysis based on a large case-control, population-based study in France[END_REF][START_REF] Wood | A model of age-specific fecundability[END_REF][START_REF] Andersen | Maternal age and fetal loss: population based register linkage study[END_REF][START_REF] Leridon | Facts and artifacts in the study of intra-uterine mortality: a reconsideration from pregnancy outcome[END_REF].

The analysis of all outcomes of pregnancies declared in Denmark between 1978 and 1992 (more than one million pregnancies) showed that the risk of miscarriage was estimated at 8.9% at 20-24 years of age and at 74.7% when the woman is older than 45 years of age [START_REF] Andersen | Maternal age and fetal loss: population based register linkage study[END_REF].

Paternal age: first evidence of a paternal age effect

Very few studies have studied the effects of paternal age on pregnancy outcome.

Demographic studies provided the first evidence of a paternal age effect. Studies using large data sets of populations not practising birth control showed that, after controlling for maternal age, the probability of having a child decreases with increasing paternal age [START_REF] Anderson | Male age and infertility. Results from Ireland prior to 1911[END_REF][START_REF] Goldman | Fecundability and husband's age[END_REF][START_REF] Mineau | A specification of marital fertility by parents' age, age at marriage and marital duration[END_REF][START_REF] Strassmann | Predictors of fecundability and conception waits among the Dogon of Mali[END_REF]. Mineau and Trussell developed a model to analyse the effects on fertility of maternal age, paternal age and union duration [START_REF] Mineau | A specification of marital fertility by parents' age, age at marriage and marital duration[END_REF]. They showed that maximum fertility rates occurred when the man was 30-34 years of age, and that these rates then slowly decreased with increasing age. At 50-59 years of age, the paternal age effect was stronger than the effect of a maternal age of 40-44 years.

Clinical studies on the effect of male age on sperm characteristics also provided evidence of a paternal age effect. Although results concerning the effect of age on human sperm are conflicting, a recent review has concluded that sperm volume and motility are altered, and that the proportion of normal sperm decreases in men between ages of 30 and 50 years [START_REF] Kidd | Effects of male age on semen quality and fertility: a review of the literature[END_REF].

We recently investigated the effect of paternal age on the risks of infecundity and miscarriage by analysing a large European dataset [START_REF] De | Paternal age and maternal age are risk factors for miscarriage; results of a multicentre European study[END_REF][START_REF] De | Paternal age over 40 years: an important risk factor for infertility[END_REF]. We concluded, in agreement with the existing studies, that paternal age had an effect on both risks [START_REF] De | Paternal age over 40 years: the 'amber light' in the reproductive life of men?[END_REF].

Here, we carry out a review of the literature to investigate the effect of paternal age on the risks of infecundity and miscarriage.

MATERIALS AND METHODS

We used MEDLINE to search for articles analysing the effects of paternal age on the risks of infecundity and miscarriage. This procedure has been described in detail elsewhere [START_REF] De | Paternal age over 40 years: the 'amber light' in the reproductive life of men?[END_REF]. We checked the exhaustiveness of our search by crosschecking with related references (references cited in articles selected, PubMed related articles and our reference database). We identified 19 articles analysing the effect of paternal age on pregnancy outcome. Table I lists the 19 articles selected.

RESULTS

Table II

summarises the main characteristics of the 19 articles analysing paternal age effect. Ten articles looked at risk of infecundity with the other nine looking at risk of miscarriage. Seven of the studies on the risk of infecundity were epidemiological studies and four were based on assisted reproductive technologies (ART) data. For the risk of miscarriage, four articles were epidemiological studies and five were based on analysis of birth and foetal death certificates. Sixty-three percent of all articles were published in the last five years (1999)(2000)(2001)(2002)(2003). Most articles (69%) concluded that there was a paternal age effect on pregnancy outcome, but our subsequent analysis will show that not all studies were of equal quality.

We considered that two of the seven articles using epidemiological sources to analyse infecundity were particularly interesting because the studies used large datasets and included couples who had and couples who had not yet conceived, and because the studies controlled for maternal age. Our study on paternal age and infecundity was based on data from a European multicentre study in which women were retrospectively asked about their reproductive life [START_REF] De | Paternal age and maternal age are risk factors for miscarriage; results of a multicentre European study[END_REF]. We analysed, among 3287 couples, the risk of not having conceived after one year of trying after controlling for confounding factors. This showed that the risk of infecundity was higher among couples where the man was older than 40 years of age and the woman was aged 35 years or over (Figure 1a). Another study was based on a European dataset [START_REF] Dunson | Changes with age in the level and duration of fertility in the menstrual cycle[END_REF] and used prospective methods, which have recently been recognised as the gold standard for fecundity studies [START_REF] Tingen | Methodologic and statistical approaches to studying human fertility and environmental exposure[END_REF]. This study analysed the daily probability of conception, using data from 782 couples who were asked to note their daily sexual activity, using natural family planning methods to determine day of ovulation. It concluded that the daily probability of conception was reduced in couples composed of a woman aged 35-39 years and a man in his late thirties or older. It concluded that the daily probability of conception was reduced in couples where the woman was 35-39 years of age and the men was in his late thirties or older.

Five other epidemiological studies analysed the effect of paternal age on the risk of infecundity. One study showed an elevated risk of infecundity when the man is aged 35 years or over. However, the study was limited by a low number of observations and a two age class analysis [START_REF] Ford | PALS (pregnancy and lifestyle study): association between occupational and environmental exposure to chemicals and reproductive outcome[END_REF]. The four other articles were based on populations of couples including a pregnant woman or of couples having already given birth. This excluded sterile couples and under-represented less fecund couples. Despite this limitation, the four articles showed some evidence of a paternal age effect: two articles showed a paternal age effect after controlling for maternal age [START_REF] Hassan | Effect of male age on fertility: evidence for the decline in male fertility with increasing age[END_REF][START_REF] Ford | Increasing paternal age is associated with delayed conception in a large population of fertile couples: evidence for declining fecundity in older men. The ALSPAC Study Team (Avon Longitudinal Study of Pregnancy and Childhood)[END_REF] but the validity of one of them was debatable because of a wrong age definition [START_REF] Sallmen | Is the observed association increasing paternal age and delayed conception an artefact?[END_REF]; one showed a very weak paternal age effect [START_REF] Olsen | Subfecundity according to the age of the mother and the father[END_REF]; and one showed no paternal age effect on fecundity [START_REF] Joffe | Male and female factors in fertility[END_REF].

There were four articles analysing the effect of paternal age on fecundity based on data from ART. Only one of these articles showed a paternal age effect. The three other articles used data from in vitro fertilisation (IVF) with an ovum donor. In these cases, the age of the ovum donor is not correlated with paternal age. The analysis of 558 cycles done at a French IVF centre showed a significant decrease in pregnancy rate when paternal age was greater than or equal to 39 years [START_REF] Watanabe | Influence of husband's age on outcome of a shared oocyte donation program[END_REF]. However, this paternal age effect was only observed if there were less than five donated oocytes. The two other articles on IVF with ovum donation did not show any paternal age effect, however the studies did not control for the number of donated oocytes [START_REF] Gallardo | Effect of age on sperm fertility potential: oocyte donation as a model[END_REF][START_REF] Paulson | The lack of influence of age on male fertility[END_REF]. Similarly, in an analysis of sperm from 43 fathers and grandfathers, paternal age did not appear to affect the ability of spermatozoa to penetrate ova (HOP test) [START_REF] Nieschlag | Reproductive functions in young fathers and grandfathers[END_REF].

Four articles investigated the effect of paternal age on the risk of miscarriage. All four articles showed a paternal age effect. We analysed the outcomes of 3174 most recent pregnancies in the European multicentre study [START_REF] De | Paternal age and maternal age are risk factors for miscarriage; results of a multicentre European study[END_REF]. After controlling for maternal age and confounding factors, we found that the risk of miscarriage was higher when the man was aged 40 years or over. A very strong increase in the risk of miscarriage was observed in couples where the woman was aged 35 years or over and the man was aged 40 years or over (Figure 1b). The analysis of 1511 French women in semi-parametric models showed an increased risk of miscarriage when the man was aged 35 years or over [START_REF] Slama | Does male age affect the risk of spontaneous abortion? An approach using semiparametric regression[END_REF]. This study showed that the paternal age effect was stronger when the woman was young. The two other articles showed a paternal age effect on risk of miscarriage, but these studies were limited by the low number of pregnancies observed, a two age class analysis or lack of maternal age effect [START_REF] Ford | PALS (pregnancy and lifestyle study): association between occupational and environmental exposure to chemicals and reproductive outcome[END_REF][START_REF] Al-Ansary | Risk factors for spontaneous abortion: a preliminary study on Saudi women[END_REF].

Five articles investigated the effect of paternal age on late foetal death (after 20 weeks of gestation). These studies comprised very large datasets based on birth and late foetal death certificates and gave only very limited information on confounding factors.

Four studies showed a paternal age effect, especially after 35 years of age [START_REF] Selvin | Paternal age, maternal age and birth order and the risk of a fetal loss[END_REF][START_REF] Rychtarikova | Paternal age and child death: the stillbirth case[END_REF][START_REF] Gourbin | Paternal age and infant mortality[END_REF][START_REF] Astolfi | Late paternity and stillbirth risk[END_REF], with one showing no effect [START_REF] Resseguie | Paternal age, stillbirths and mutation[END_REF].

DISCUSSION

There are very few articles (n=19) that have investigated the effect of paternal age on the risks of infecundity and miscarriage. However, analysis of all published articles showed that interest in paternal age effects on pregnancy outcome has increased in recent years: in the last five years, twelve articles (63% of all articles found) studied a paternal age effect.

Epidemiological studies have shown that fecundity decreases as paternal age increases. It has been shown that restricting analysis to fertile couples (pregnant women or women who have already given birth) leads to an underestimation of the age effect or even an inverse age effect [START_REF] Juul | Retrospectively sampled time-to-pregnancy data may make age-decreasing fecundity look increasing[END_REF]. Thus, we were particularly interested in studies that did not select couples on the basis of their fertility. These studies, and the others to a lesser extent, showed a significant paternal age effect. Data from ART are complementary to epidemiological studies. ART data make it possible to analyse the age effect without any sexual activity effect. Furthermore, by analysing IVF with ovum donation, it is possible to analyse the age effect without the problems associated with paternal and maternal age being highly correlated. The ART data presented in this review did not provide clear evidence of a paternal age effect. However, these studies were very limited and need to be developed before firm conclusions can be drawn. All epidemiological studies that investigated the effect of paternal age on miscarriage concluded that the risk increased with paternal age. Register-based studies also showed some evidence of a paternal age effect on late foetal death.

We have concluded from these 19 articles that paternal age should be considered as a risk factor for infecundity and miscarriage. However, further research is required to describe this paternal age effect precisely. Environmental exposure may affect the male reproductive tract [START_REF] Auger | Decline in semen quality among fertile men in Paris during the past 20 years[END_REF][START_REF] Savitz | Review of epidemiologic studies of paternal occupational exposure and spontaneous abortion[END_REF][START_REF] Huyghe | Increasing incidence of testicular cancer worldwide: a review[END_REF] and determining the possible role of environmental factors on the paternal age effect would be useful . The evidence on paternal age we present here leads to two main hypotheses.

First, articles that showed a paternal age effect showed that the risks of infecundity and miscarriage increase when the man is over 35 or 40 years of age. This age corresponds well with the age limits of 40 years for sperm donors [START_REF] Bas) | British Andrology Society guidelines for the screening of semen donors for donor insemination (1999)[END_REF][START_REF] Asrm) | Guidelines for gamete and embryo donation[END_REF]. This limit was chosen by considering the risk of genetic anomalies [START_REF] Bordson | The appropriate upper age limit for semen donors: a review of the genetic effects of paternal age[END_REF] without considering the results of the articles reviewed here. Two of the reviewed articles showed a later paternal age effect occurring after 45 or 50 years of age [START_REF] Hassan | Effect of male age on fertility: evidence for the decline in male fertility with increasing age[END_REF][START_REF] Al-Ansary | Risk factors for spontaneous abortion: a preliminary study on Saudi women[END_REF]. Thus, further research is necessary to confirm that an effect occurs from 35-40 years of age.

Second, several articles showed that the paternal age effect is stronger when the female partner had reproductive risk factors, such as elevated age (over 35 years) or weak ovarian response (less than 5 oocytes) [START_REF] De | Paternal age and maternal age are risk factors for miscarriage; results of a multicentre European study[END_REF][START_REF] De | Paternal age over 40 years: an important risk factor for infertility[END_REF][START_REF] Dunson | Changes with age in the level and duration of fertility in the menstrual cycle[END_REF][START_REF] Watanabe | Influence of husband's age on outcome of a shared oocyte donation program[END_REF][START_REF] Astolfi | Late paternity and stillbirth risk[END_REF]. This suggests an interaction between paternal age and maternal factors. Our study (see Figure 1) showed that the risks of infecundity and miscarriage are particularly high in couples where the woman is aged 35 years or over and man is aged 40 years or over. A detailed prospective study on daily probabilities also came to the same conclusion. These studies suggested an interaction between paternal age and maternal age. However, two other articles gave contradictory results [START_REF] Hassan | Effect of male age on fertility: evidence for the decline in male fertility with increasing age[END_REF][START_REF] Slama | Does male age affect the risk of spontaneous abortion? An approach using semiparametric regression[END_REF]. Thus, the hypothesis of an interaction between paternal age and maternal age needs to be confirmed. Studies analysing the causes of infertility have also shown an interaction between maternal and paternal factors. An analysis of 1686 French couples who consulted a practitioner following one year of infertility showed that both partners presented reproductive disorders in 39% of cases [START_REF] Thonneau | Incidence and main causes of infertility in a resident population (1,850,000) of three French regions (1988-1989)[END_REF]. The authors concluded that this result confirms the notion that infecundity is essentially 'a couple's business'. Therefore, is age also 'a couple's business'? Infecundity may increase with paternal age because of alteration of sperm characteristics with increasing age. Indeed, fecundability varies with sperm characteristicssuch as concentration and morphology [START_REF] Bonde | Relation between semen quality and fertility: a population-based study of 430 first-pregnancy planners[END_REF][START_REF] Slama | Time to pregnancy and semen parameters: a cross-sectional study among fertile couples from four European cities[END_REF][START_REF] Zinaman | Semen quality and human fertility: a prospective study with healthy couples[END_REF]. A recent review on the effect of male age on sperm characteristics concluded that semen volume decreases, sperm motility decreases and sperm morphology changes between the ages of 30 and 50 years [START_REF] Kidd | Effects of male age on semen quality and fertility: a review of the literature[END_REF]. Thus, the paternal age effect may be caused by sperm characteristics, and especially sperm morphology. Genetic defects may also explain the increased in risks of miscarriage and of infecundity with paternal age. Indeed, embryo and (early) foetal death are often caused by chromosomal aberration and genetic defects [START_REF] Boue | Cytogenetics of pregnancy wastage[END_REF][START_REF] Jacobs | The role of chromosome abnormalities in reproductive failure[END_REF][START_REF] Cowchock | Chromosome errors as a cause of spontaneous abortion: the relative importance of maternal age and obstetric history[END_REF][START_REF] Wood | Dynamics of human reproduction, biology, biometry, demography[END_REF]. The effects of paternal age on the risk of foetal chromosomal aberration and genetic defects remain largely unknown.

However, it has been shown that the risk of autosomal dominant diseases among live births increases when paternal age is over 40 years [START_REF] Bordson | The appropriate upper age limit for semen donors: a review of the genetic effects of paternal age[END_REF][START_REF] Friedman | Genetic disease in the offspring of older fathers[END_REF][START_REF]ACOG committee opinion. Advanced paternal age: risks to the fetus. Number 189[END_REF]. If paternal age affects the risk of genetic defects among live births, it probably also has an effect on foetuses.

In conclusion, maternal age over 35 years has long been known to be a major risk factor for reproduction. Our review of the literature on the effect of paternal age has shown that paternal age over 40 years should also be considered a risk factor. Moreover, couples in which the woman is over 35 years and the man is over 40 years may have a particularly high reproductive risk.

High risk zone

Highest risk zone

Note: This figure is a schematic representation of the results presented in [START_REF] De | Paternal age and maternal age are risk factors for miscarriage; results of a multicentre European study[END_REF][START_REF] De | Paternal age over 40 years: an important risk factor for infertility[END_REF]

Table I . Studies on the effect of paternal age on the risks of infecundity and miscarriage

 I

	Reference	Population studied	Reproductive outcome	Paternal age classes *	Paternal age
					effect?
			INFERTILITY
	La Rochebrochard and	3,287 women trying to conceive	Infertility (12 months)	<30 / 30-34 / 35-39 / 40	+++
	Thonneau, 2003
	Hassan et Killick, 2003	2,112 pregnancies	Time to pregnancy	25 (ref)/ 26-30 / 31-35 / 36-40 / 41-45 / 46	+++
	Dunson et al., 2002	782 couples using natural family planning	Probabilities of pregnancy on various	19-26 / 27-29 / 30-34 / 35-39 / 40	+++
		methods	days of the menstrual cycle
	Paulson et al., 2001	558 IVF cycles with ovum donation	Clinical pregnancy	<38 / 38-41 / 42-46 / >46	-
	Watanabe et al., 2000	288 IVF cycles with ovum donation	Clinical pregnancy	<39 (ref) / 39	+
	Ford et al., 2000	8,515 planned pregnancies	Infertility (6 and 12 months)	24 (ref) / 25-29 / 30-34 / 35-39 / 40	++
	Gallardo et al., 1996	316 IVF cycles with ovum donation	Clinical pregnancy	31-40 / 41-50 / 51	-
	Joffe and Li, 1994	2,576 men aged 33 years who had	Time to pregnancy	<30 (ref) / 30-33	-
		fathered a child
	Ford et al., 1994	585 couples trying to conceive	Infertility (9 months)	<35 (ref) / 35	++
	Olsen, 1990	10,886 pregnancies	Infertility (12 months)	15-19 (ref)/ 20-24 / 25-29 / 30-34 / 35-39 / 40	-/+
	Nieschlag et al., 1982	43 men who had fathered a child	Ovum penetration (HOP test)	24-37 (ref) / 60-88	-
			MISCARRIAGE
	Astolfi et al., 2004	3.6 million birth and foetal death certificates Late spontaneous abortion	-	+++
	Rychtarikova et al., 2004	598,157 birth and foetal death certificates Late spontaneous abortion	15-19 / 20-24 (ref)/ 25-29 / 30-34 / 35-39 / 40-44 ++
	Slama et al., 2003	1,151 women having 2,414 pregnancies	Miscarriage	<35 / 35	+++
	de La Rochebrochard and	3,174 planned pregnancies	Miscarriage	20-29 (ref) / 30-34 / 35-39 / 40	+++
	Thonneau, 2002
	Gourbin and Wunsch, 1999	498,122 birth and foetal death certificates Late spontaneous abortion	25-34 / 35-44	+
	al-Ansary and Babay, 1994	Hospital patients: 226 miscarriages and	Miscarriage	<30 (ref) / 30-34 / 35-39 / 40-49 / 50	++
		226 controls
	Ford et al., 1994	484 planned pregnancies	Miscarriage (first trimester)	<35 (ref) / 35	++
	Selvin and Garfinkel, 1976	1.5 million birth and fetal death certificates Late spontaneous abortion	-	+
	Resseguie, 1976	Birth and fetal death certificates	Late spontaneous abortion	-	-

*: In case of multivariate regression analysis, the reference class is indicated by '(ref)'.

Table II . Description of articles analysing the effect of paternal age (n=19 articles) Number of articles Per cent of articles Outcome analysed

 II

	Figure 1.
	Infecundity	10	53%
	Miscarriage	8	42%
	Infecundity and miscarriage	1	5%
	Year of publication
	 1988	3	16%
	1989-1993	0	0%
	1994-1998	4	21%
	1999-2003	12	63%
	Data source
	epidemiological study	10	53%
	administrative source	5	26%
	data from ART	4	21%
	Conclusion on paternal age effect
	an effect	13	69%
	a weak effect	1	5%
	No effect	5	26%

Effect of paternal age on infecundity and miscarriage in logistic regression

  (adjusted Odds Ratio [95% Confidence Interval])

		a. Risk of infecundity
			Maternal age
	Paternal age		(in years)
	(in years)	20-29	30-34	35-39
	20-29
	30-34	reference 1.00
	35-39
	40-44			[1.	3.18

96-5.15] b. Risk of miscarriage

			Maternal age
	Paternal age		(in years)
	(in years)	20-29	30-34	35-39
	20-29
	30-34	reference 1.00	2.87
	35-39			[1.

86-4.45] 40-44 5.65 [3.20-9.98]

	Legend: comparison of risk zones
	Standard risk zone


A Mifdaoui

F Frances

C Fraboul

Real-time guarantees on Full-Duplex Switched Ethernet for military applications

Keywords: Full-Duplex Switched Ethernet, real-time communication, Traffic Shaping, priority handling, delay bounds

This paper is a proposal for a future method of avionics data communication in military aircrafts. The need for this proposal results from the increasing complexity of avionics systems that is pushing the MIL-STD-1553B well beyond the limits of its bandwidth. Among several high speed interconnection technologies, Full-Duplex Switched Ethernet is an attractive candidate to replace the MIL-STD-1553B for advanced military aircraft system interconnection but, unfortunately, it was not originally developed with the aim to deliver real-time communications. Therefore, we have to add new mechanisms over Switched Ethernet to achieve realtime behaviour with bounded delays. In this paper, we describe the most important existent real-time transfer solutions for the classic Ethernet and discuss their possible applicability over Switched Ethernet. Then, we compare their performances and their capacities to handle realtime constraints required by the military applications. A special care is given to the traffic shaping approach which allows to limit the congestions in the switch and to guarantee low delays. We will show in experiments that with the traffic shaping approach with the priority handling, we can achieve deterministic transmission that respect the military application's requirements.

Introduction

The increasing complexity of avionics systems has been pushing the limits of the traditional communication buses in aircrafts. This rapid progress has opened up the possibility for implementing a new high speed standard AFDX (Avionics Full-Duplex Switched Ethernet) which is integrated for the civil next generation aircraft (A380). In contrast, military avionics communication systems are still kept at relatively low speed. In fact, current military avionics data buses are MIL-STD 1553B which have been widely used in various military aircrafts for decades. These are 1Mbps command/response multiplexed data buses with a centralized system control. Nowadays, the number of MIL-STD 1553B data buses used in military aircrafts has increased and integration of new data buses with higher data rates has been required. In fact, the STANAG 3910 bus, that is designed to improve the throughput whilst maintaining MIL-STD 1553B compatibility, and the SCI (Scalable Coherent Interface) operating at 1Gbps, are used to support the increasing amount of information exchanged between the equipments in current military aircrafts. Clearly, these different data buses increase the complexity of providing end to end real time constraints guarantee and a new homogeneous interconnection system is needed to achieve this aim. Full-Duplex Switched Ethernet is a COTS network that has the potential to replace the MIL-STD 1553B and the other data buses used in the military aircrafts. This technology is not originally designed to deliver time-constrained communication, but some of its properties, such as its reduced cost, its flexibility and its expandability make it an attractive candidate. Full-Duplex Switched Ethernet LAN removes CSMA/CD arbitration since no collision can happen but, unfortunately, congestion may occur when simultaneous traffic data attempt to share network segments and messages can be lost if switch queues overflow. Thus, it is impossible to guarantee predictable delays in delivering packets to the end systems, in the general case. So, we have to add new mechanisms to avoid information loss and to guarantee hard real-time communication with low latency.

Various real-time transfer solutions exist for Ethernet; all of them add a transmission control to avoid possible collisions caused by the CSMA/CD arbitration. For example:

• TDMA where stations transmit messages at predetermined slots in a cyclic fashion with a precise clock synchronization. • FTT-Ethernet where a central master periodically distributes a group of tokens that allows slaves to send data for a specific amount of time.

• Token-Ring approach where a circulating token represents the permission to transmit data during a bounded access time. • Traffic shaping method that consists in applying traffic shapers to all transmitted data to achieve lower guaranteed delays and to avoid buffer overflow.

This paper deals with the applicability of these approaches over Switched Ethernet in real-time environments. The remainder of the paper is organized as follows: section 2 describes the MIL-STD 1553B protocol, defines the real-time constraints required by the military applications and then reviews the previous research to replace this data bus. In section 3, we describe the various approaches to achieve real-time communication over Ethernet and their possible adaptability to the Switched Ethernet; then, we compare their relative merits to support real-time constraints required by the military applications. A special care is given to the Traffic Shaping approach in sections 4 and 5.

We start by describing the characteristics of the Switched Ethernet model under consideration in section 4. Then, we detail our experimental study of this approach in Section 5. We present our conclusions in the final section.

Background

In this section, we describe the MIL-STD 1553B data bus protocol to better understand the real-time constraints required by the military applications. Then, we present the previous proposals to replace this data bus and justify our choice of the Switched Ethernet technology.

An overview of MIL-STD 1553B

Mil-STD-1553B has been the data bus for military avionics systems for the last three decades. This bus still fulfils most data communication needs for command and control applications and its success is due to its simplicity, its high reliability and its real time properties [START_REF] Sullivan | replacement for MIL STD 1553 and next generation military data bus[END_REF][START_REF]MIL-STD-1553 Tutorial[END_REF].

The Mil-STD-1553B data bus is a 1 Mbps serial data bus which provides an integrated centralized system control and a standard interface for all the connected equipments. With such a bus concept, the traffic on the data bus is accessible through a single connection for up to 32 equipments.

Switched Ethernet and real-time

The use of the classic CSMA/CD protocol to control the access to the shared medium results in a non deterministic access delay. Hence, many techniques have been developed to guarantee predictability on Ethernet in order to use the Ethernet network for real-time systems. These proposed real-time transfer solutions decrease the collision probability and ensure an exclusive access to the network medium.

The switching technology could make these proposals easier since Switched Ethernet provides a private collision domain to each of the ports of a switch, and when using Full-Duplex links on each of these ports, collisions do not exist. Clearly, by eliminating collisions, we have a better predictability of the protocol but it is still indeterministic because overflows might still occur in the switches and messages might be lost. So, the real problem when building real-time communication over Full-Duplex Switched Ethernet is to be able to guarantee the deadlines of time critical messages. The use of switches results in duplicating the time transmission when using a store and forward mode which is usually mandatory in safety conscious environments like embedded systems. In the rest of this section, we will only review the most interesting approaches used for the Ethernet that can be adapted to Full-Duplex Switched Ethernet to guarantee the real-time constraints and compare their relative merits.

TDMA

The simplest approach to have real-time guarantees on Ethernet is by using the TDMA (Time Division Multiple Access) approach [START_REF] Lee | a variable bandwidth allocation scheme for Ethernet-based realtime communication[END_REF][START_REF] Kopetz | distributed fault-tolerant real-time systems : the mars approach[END_REF]: time is divided into slots often of equal size, each terminal transmits during its own period of time called slot. Bus master sends a frame synchronization signal before each round of messages to synchronize clocks. The slots repeat continuously giving each terminal periodic access to the channel. In this method, network size is fixed during installation and slots are preallocated. H. Shin and J. Lee [START_REF] Lee | A bandwidth reallocation schema for Ethernet-based real time communication[END_REF] worked on the TDMA implemented Ethernet which makes each terminal transmit its message on predefined slot time based on the globally synchronized clock. They developed a variable allocation scheme that is based on the traffic characteristics to achieve an efficient use of bandwidth and to schedule more real-time task sets than the static allocation scheme. This bandwidth reallocation scheme consists of reporting changes, calculating a new schedule and reliably broadcasting the schedule. Using this protocol, TDMA implemented Ethernet becomes suitable for distributed real-time systems where traffic characteristics change dynamically.

As we can see, with the general TDMA protocol, the slots time are determined to be a fixed value before the run time, so, the waste of the bandwidth is unavoidable since even nodes that do not have any packets to send, will still reserve the network for their allocated slot. As different from this approach, on the TDMA implemented Ethernet, the slot and frame time are determined considering the traffic characteristics in a dynamic way to achieve an efficient bandwidth use and guarantee to meet realtime constraints.

The use of this method could be efficient to have a real-time behaviour over Full-Duplex Switched Ethernet. However, we must take into account the fact that the frame has to go through the switch before reaching its destination. This mainly affects the synchronization process: the slaves receive the synchronization frame after at least twice the time required on the classic Ethernet (one transmission from the master to the switch and the other from the switch to slaves). In the other hand, the use of switches has no effect on the slot allocation scheme: the one used on TDMA-Ethernet will drive the traffic both on the input links of the switch and on the output links (the same traffic pattern will exit only shifted in time).

FTT-Ethernet

A mixed approach is presented by Pedreiras and Almeida in FTT-Ethernet [START_REF] Pedreiras | The FTT-Ethernet protocol: merging flexibility, timeliness and efficiency[END_REF], which uses a masterslave organization with TDMA protocol. It follows the Flexible Time Triggered paradigm and supports different types of traffic: event triggered, time triggered, real-time and non real-time. The traffic is organized in elementary cycles of fixed size. Each cycle is divided into a synchronous window for guaranteed traffic and an asynchronous window for non real-time traffic. At the beginning of the elementary cycle, the master station broadcasts a synchronization message that contains the list of identifiers of messages that must be transmitted in the synchronous window of the cycle and the time at which the stations may transmit. The slave stations transmit then the data for a specific amount of time. After the synchronous window, the master polls some stations for possible asynchronous traffic. The master station plays the rule of system coordinator and it is responsible for keeping the functionalities required for proper system operation. A traffic scheduler is implemented in the master to guarantee the real-time constraints on synchronous messages and a fair access for non real-time traffic. Slave stations execute the application software required by the user and produce messages according to their identifier tables. At the end of the elementary cycle, there is a guard window. As soon as it begins, stations are no longer allowed to transmit.

Despite having been originally designed for Ethernet, this protocol can also work over Switched Ethernet. The FTT-Ethernet protocol can take advantage of Switched Ethernet features: the use of the switch eliminates possible collisions and this can reduce the need for synchronization mechanism between the slave nodes. In this case, upon reception of the trigger message, the terminals only need to identify which messages they should produce within the elementary cycle and transmit them immediately. Conversely, the use of FTT-Ethernet may contribute to reduce the congestion problem in the switch since it performs the traffic control required to guarantee bounded delays. However, using FTT-Ethernet protocol over Switched Ethernet requires the addition of extra idle time in each elementary cycle to support the forwarding delays on the switch to guarantee that every transmitted message arrives to its destination within the same elementary cycle as perceived by the master. Otherwise, the variable delay introduced by the switch could make some frames overflow the current cycle which in turn could delay the synchronization message of the next cycle and disturb the synchronization mechanism. So, the applicability of this approach over Switched Ethernet requires some modifications in the master scheduler in order to provide an efficient use of the network and to guarantee the real-time constraints.

Token passing

Token passing protocol was widely used to have a real-time transfer over Ethernet: a token is circulated among the stations and only the station that currently holds the token is allowed to transmit data during a bounded time. When it has exhausted its right, the station transfers the token to the next using a special message. The temporal properties of token-passing systems have been extensively studied [START_REF] Lim | A comparative study of three token ring protocols for realtime communications[END_REF][START_REF] Shin | Analysis of three contention protocols in distributed real-time systems[END_REF][START_REF] Yao | Performance of an extended IEEE 802.5 protocol in hard realtime systems[END_REF]. This protocol is based on two parameters, the timed token rotation time (TTRT) and the synchronous bandwidths. TTRT is the time elapsed between two consecutive receptions of the token at a given station. A fraction of TTRT is assigned as the synchronous bandwidth of an individual station. After a station receives a token, it will transmit its synchronous messages for a maximum period given by its synchronous bandwidth and then it can transmit its asynchronous messages only if it has received the token earlier than expected. Furthermore, it can transmit the asynchronous frames only for a period of time equal to the time by which the token has been early. These two parameters should be carefully calculated to ensure the protocol performance. In fact, the TTRT is very important: a smaller value limits network capacity and if TTRT is too large, the token may not arrive often enough at a station to meet message deadlines. In the other hand, the allocation of the synchronous bandwidths is critical; a too small value results in violating the deadline because the node has not enough network access time. Conversely, large value causes a long token rotation time and message deadlines might be missed.

The real-time network RETHER [START_REF] Venkatramani | supporting realtime traffic on Ethernet[END_REF], developed by Venkatramani and Chiueh, is implemented for existing Ethernet to provide bandwidth guarantees. There is two operating modes: a regular CSMA/CD mode in absence of real-time traffic and a token passing mode for real-time operations. When there are no nodes with real-time messages to send, the RETHER operates in CSMA/ CD mode like Standard Ethernet. As soon as a request for a real-time traffic arrives on a given terminal, this terminal initiates a transition to the token passing mode, all terminals have to acknowledge this transition and from this point the system operates according to the token passing protocol. In this later mode, terminals are divided in two groups: the RT group for terminals with real-time messages and NRT group for all the others. Access to the channel for both groups is regulated by a token. The RT group is given the priority to transmit messages. Each station of the RT group gets the token once every period and the station that do not have real-time traffic are visited as soon as all RT stations have been visited and there is still available time before the next token rotation period. The system goes back to CSMA/CD mode when the RT group becomes empty. The experimental results show that the system has important overheads in case of small packets because of switching between the two modes.

In our knowledge, there are no explicit proposals of using token passing protocol over Switched Ethernet. We think that the priority driven token ring protocol, which has been incorporated in the IEEE 802.5 standards [START_REF]Token Ring access method and physical layer specifications[END_REF], could be a good approach to have real-time communication over Switched Ethernet. In this protocol, the token contains a priority field which regulates station's access to the ring and we could accord a high priority to the stations that have urgent messages to transmit. With this control access, we can avoid congestion in the switch and guarantee the real time constraints by respecting the deadlines. But, we should take into account the delays introduced by switches which add an overhead to the token passing operations because no station is allowed to transmit before it has received the token. The token passing operation requires twice the time needed in the Standard Ethernet (from the emitting station to the switch and from the switch to he receiving station).

Traffic Shaping

Traffic Shaping is an interesting approach that has been initiated by Kweon and Shin [START_REF] Kweon | Achieving real-time communication over Ethernet with adaptive traffic smoothing[END_REF] to achieve real-time communication over Ethernet. The idea is that a smooth traffic, in which messages arrive at a constant rate, suffers less from collisions than a bursty traffic. Specifically, a traffic smoother is installed in every station between the Ethernet MAC layer and the UDP or TCP/IP layer: first it gives realtime (RT) packets priority over non real-time (NRT) packets, second it smoothes the NRT-stream to reduce collision with RT-packets from the other nodes. The smoothing process uses the token bucket principle [START_REF] Leboudec | network calculus[END_REF]: when a burst occurs, the messages are kept in a queue and sent one after the other at a rate which is lower than the arrival rate. The real-time traffic is not smoothed and is sent as soon as it arrives. The authors have shown that there is a significant reduction of RT packet deadline-miss ratio when both RT and NRT packets are transported over Ethernet with adaptive traffic smoothing. Traffic smoothing approach is efficient for soft real-time systems, but needs additional mechanisms to be applied to hard real-time systems. Despite its apparent attractiveness, traffic smoothing over Ethernet is less appealing because nowadays, the switched network architecture dominate future LAN environments and have less difficulty to transmit bursty traffics.

Based on the above experiences, Varadarajan and Chiueh [START_REF] Varadarajan | Ethereal: a host transparent real time fast Ethernet switch[END_REF] proposed a real-time Ethernet switch EtheReal that supports bandwidth guarantee over Switched Ethernet. EtheReal is based on a real-time connection setup algorithm that installs, per connection, bandwidth guarantee information along the network path from the source host to the destination host. It distinguishes two classes of traffic, best effort and real-time. When a station wants to transmit real-time traffic to another one, it sets a connection via its real-time communication daemon (RTCD). A connection request that contains the QoS parameters and the destination identifier is sent to the switch. If the switch accepts the QoS requirements, it returns an acknowledgment to the initiating node. In that moment, the initiating station RTCD creates a proxy IP address that is used to send real-time packets. Best effort traffic will be forwarded in a usual way without special guarantees. Unlike this approach where switches implement the improvements, the Traffic Shaping approach developed by Loeser and Haertig [START_REF] Loeser | Low latency hard real-time communication over switched Ethernet[END_REF] implements the improvements inside the stations. Their idea is: to guarantee some deterministic performances of the network, the incoming traffic has to be bounded. Therefore, traffic shaper is installed for each stream to regulate bursts and to make the stream as regular as possible in order to reduce the chances of congestions in the switch. The shaper uses the leaky bucket controller concept to model the arrival constraints representing each stream. A leaky bucket controller with leak rate r and bucket size b imposes that the traffic generation is bounded by an affine function f(t) = b + rt. This function represents the arrival curve of the traffic to the input of the switch. They show that, with the Traffic Shaping as node cooperation mean, reliable transmission with bounded delays could be guaranteed for the soft real time. In our case, we will analyze this approach over Full-Duplex Switched Ethernet used for a hard real time system interconnection and improve it by adding a priority handling method to guarantee the deadline constraint for the urgent messages.

Comparative Study

As we can see, it is difficult to design a perfect approach over Switched Ethernet to have real-time communications. With TDMA, the waste of bandwidth is unavoidable and the system flexibility is reduced because a static schedule, built before runtime, is used. This limitation is not severe when having a static real-time system, but the real difficulty is the impact of the additional delays introduced by switches that should be taken into account when developing the allocation scheme and maintaining the distributed clock synchronization. Unlike this approach, Token passing offers a flexible allocation bandwidth and a better bus utilization when the protocol parameters (TTRT and synchronous bandwidth) are carefully chosen. But, it introduces an important overhead with the use of switches especially when only one station has traffic to transmit. In the other hand, the use of the Flexible Triggered Time approach is interesting because it can take advantage of Switched Ethernet features. For example, the use of switches can decrease the importance of the synchronization mechanism since stations can transmit their messages immediately within the elementary cycle. In the other hand, FTT approach can perform the traffic control on the Switched Ethernet to guarantee bounded delays by reducing the congestion occurrence in switches.

Unfortunately, the use of switches increases the complexity of the master scheduler which has to take into account the forwarding delays on the switches. The traffic shaping approach seems the easiest one to adapt over Switched Ethernet. In fact, we determine the adequate traffic shaper characteristics for each stream to have controlled bus utilization with bounded incoming traffic that reduces congestions in the switch. Thus, a good knowledge of our system input characteristics can help us to determine the adequate parameters of each traffic shaper to have a reliable transmission with bounded delays. A better performance comparison of these different approaches could be made by leading experimental analysis on a real traffic case. In this paper, we have started by analyzing the traffic Shaping approach and the detailed study is given in next sections.

Traffic Shaping modelling

In this section, we explicit the characteristics of the circulating traffic that we should guarantee when replacing the MIL-STD 1553B data bus. Then, we describe a Full-Duplex Switched Ethernet model of the military system under consideration, which implements the Traffic Shaping approach to have real-time behaviour.

Traffic model

In military applications, as we have explained, there are two kinds of communications between the different equipments. The first represents the periodic exchanges which are exactly known in terms of quantity and frequency. The second is the sporadic traffic characterized by a maximal response time and a maximal length.

There are n sets of streams, one set for each node: (S 1 , S 2 ,…, S n ). Every set S i is formed by periodic and sporadic streams transmitted by the associated terminal i:

S i = {m i1 , m i2 … m iN }
• A periodic message m ij is characterized by a period denoted by P ij and a sporadic message m ik by the minimal inter-arrival time P ik (we suppose that a node generates at most one sporadic message of each type once every minor frame).

• The deadline of a periodic message is the end of the period in which it arrives; that is, if a message m ij arrives at time t, then its deadline is D ij = k*P ij where (k-1)*P ij ≤ t < k*P ij ; and the deadline of a sporadic message m ik that arrives at time t is D ik = t + R ik , where R ik is its requested maximal response time.

• The maximal length of each message m ij in set S i is L ij .

Network model

We consider the network topology as consisting of n Ethernet terminals connected with Full-Duplex links to a switch (these terminals represent the n existing equipments currently connected on the MIL-STD 1553B data bus that we compare to). In every terminal i, we associated a traffic shaper to each stream m ij based on a leaky bucket, characterized by b ij = L ij its maximal size and r ij = b ij / P ij its rate. A terminal is modelled by one multiplexer which sends the multiplexed flows to the central switch.

The Full-Duplex Switched Ethernet model depends on the behaviour of the switch. In our case, we consider a 10 Mbps switch in "store & forward" mode (waiting until the complete reception of the frame). Moreover, it is operating at wire speed, which means that all ports of a switch can simultaneously transmit or receive at their full bit rates. Thus we assume the switch is able to process a continuous flow of minimal-size Ethernet frames and we arbitrarily derive the technological switch relaying latency (τ ) from this wire speed behaviour.

We give an example here of the network architecture with four terminals and four sets of streams of three messages each (Figure 1). The transaction table is statically defined in such a way that all time constraints are enforced. In fact, the biggest message period is about 160 ms, so a major frame of 160ms is defined on of the MIL-STD 1553B; and the smallest message period is about 20 ms, so minor frames have a duration of 20 ms. Moreover, the most urgent sporadic message has a response time of 3 ms. So, the deadline of this type of message represents the hardest real-time constraint to respect when using Full-Duplex Switched Ethernet.

To investigate the effectiveness of the Traffic Shaping approach used over Switched Ethernet, we are interested in the maximal end to end delay bound in each port of the switch that we compare to the deadline of the urgent messages to be sure that even in the poor case of the arrival messages, we respect the hardest real-time constraint required by the military application.

To calculate the maximum queuing delay in the network switch, we use the network calculus introduced by Cruz [START_REF] Cruz | A calculus for network delay, Part 1 Network elements in isolation[END_REF][START_REF] Cruz | A calculus for network delay, Part 2: Network analysis[END_REF]: the delay bound of a transmit switch port depends on the traffic arriving at that switch port, described by its arrival curve and on the availability of the switch to transmit that data.

In our case, the arrival curve in a switch port depends on the multiplexed arrival curves of the different streams in each terminal. As we have explained when describing the Traffic Shaping approach, thanks to the use of traffic shaper, every stream m ij has a linear arrival curve α ij = b ij + r ij t . So, the maximal delay in each switch port is given by the time needed to transmit the bursts of the multiplexed traffic when using a FCFS multiplexer with a capacity C plus the delay imposed by the electronics of the switch. Thus, the bounded latency in switch port i is:

i ij j S i b D C τ ∈ = + ∑ [1]

Experiments and analysis

In order to have an experimental performance evaluation of the Traffic Shaping approach over Full-Duplex Switched Ethernet, we developed a computing tool based on our model system. Given the traffic characteristics in the input, this software constructs the different arrival curves and calculates the latency bound in each switch port. The delay bounds for the traffic shaping approach, applied to our real traffic, are demonstrated in figure 2.

We computed latency bounds in the 20 switch ports. Clearly, one can see that in some switch ports, like port 8, the delay bound is high (12 ms) and it is higher than the deadline of the most urgent sporadic messages (3 ms), so, the real-time constraints are violated when using the traffic shaping approach over switched Ethernet. We can conclude that despite the relative speed ratio between Switched Ethernet (10 Mbps) and MIL-STD-1553B (1 Mbps), real-time constraints are not necessarily respected and having a Switched Ethernet with a higher rate is not sufficient to satisfy the real-time constraints required by the military applications. In order to meet the delay requirements of the urgent packets, we propose to use a priority handling in addition of the traffic shaping approach. Therefore, we use the priority model of 802.3 (802.1p). This model defines a 3 bits priority field in the extended Ethernet frame. With these 3 bits, eight priority levels can be defined to handle real-time traffic. Current practice of switch manufacturers is to implement at most four queues of different priority per switch port.

In this approach, within a terminal, packets are given different priorities depending on their urgency and their deadline, and a non preemptive fixed priority scheduling is used in switch ports to transmit the different messages. We consider 4 priority types in each node:

• Priority 0 for the urgent sporadic messages with a requested maximal time of 3 ms

• Priority 1 for the periodic messages

• Priority 2 for the sporadic messages with a requested maximal response time ranging from 20 ms to 160 ms

• Priority 3 for the sporadic messages with a maximal response time bigger than 160 ms.

In this case, we model each terminal by a 4-FCFS multiplexer with four queues, one for each priority. It has been shown in [START_REF] Cruz | A calculus for network delay, Part 1 Network elements in isolation[END_REF][START_REF] Cruz | A calculus for network delay, Part 2: Network analysis[END_REF] that for a regulated arrival pattern set S i characterized by (b ij ,r ij ) j = 1,…,N to a 4-FCFS multiplexer with a capacity C, the maximal latency bound of the priority k, k = 0,… 3, in switch port is is: Intuitively, this means that packets arriving at a given priority are queued on a first-come, first serve basis. When, the link is free, the packet from the queue that has the highest priority among the nonempty queues is selected. If, just after the packet has started to be transmitted, a new packet arrives in a higher priority queue, the newly arrived packet will have to wait until the currently transmitted packet has been completely sent. There is a potential blocking time of the duration of the longest packet because emission may not be preempted.

{ / , } { / , } , { / , } max i ir l i ir l i ir l ij ij j r m P l k j r m P l k i k ij j r m P l k b b D C r τ ∈ ∈ > ∈ ∈ ≤ ∈ ∈ < + = + - ∑ ∑ [2]

Final results

In figure 3, we show the computed delay bounds for the traffic shaping approach with the priority handling method. We see that the latency bound for messages with high priority is lower than 3 ms, which represents their maximal response time. So, we respect the deadline constraints for the urgent sporadic messages. Moreover, the latency bound of periodic messages is smaller than the one obtained without using priorities. These results show that the priority handling method combined with the traffic shaping approach may be a good mean to improve the predictability of the message transfers and to respect the real-time constraints required by the military applications.

Conclusion

In this paper, we show that Full-Duplex Switched Ethernet could be an attractive candidate to replace the current military data bus, the MIL-STD 1553B, in the future military aircrafts. With an adequate approach to support hard real-time communication, we were able to guarantee a deterministic transmission over Full-Duplex Switched Ethernet operating at 10Mbps. Among the various real-time transfer solutions, we analyzed the traffic shaping approach with the priority handling. In order to reduce the possible congestions in the switch and to prevent switch queues from overflowing, each station is required to control its traffic to keep the global bus utilization controlled. Specifically, we have installed a traffic shaper per stream to impose a maximal arrival curve that respects the stream characteristics and reduce the possible bursts. Moreover, in each of the terminal equipments, the urgent messages with a small response time are given priority over the other messages. We have shown in experiments that the traffic shaping approach with priority handling can be used to achieve deterministic frame transmissions with bounded delays that conform to the real-time constraints required by military applications. In the proposed method, there are no modifications of the Ethernet hardware (neither in the switches nor in the Ethernet interface of the terminals), this allows a quick industrial path to the deployment of Ethernet as a real-time embedded network.

Future work will target other QoS guarantees, like jitter which is inherently low on the 1553B applications and we will try to adapt the Token Ring approach to the switched Ethernet, since it seems able to guarantee bandwidth and bounded access time for different stations. Then, we will make a comparative study between the two approaches and give the pros and cons of each one.

Figure 1 : 5 . Traffic Shaping performance evaluation 5 . 1

 1551 Figure 1: Terminal output port model

Figure 2 :

 2 Figure 2: Delay bounds for the traffic shaping approach

With

P

  is the set of messages with priority l.

Figure 3 :

 3 Figure 3: Delay bounds for the traffic shaping approach with the priority handling


Y Tanguy

S Gérard

François Terrier. A Radermacher

François Terrier

Model driven engineering for embedded real-time systems

Keywords: UML, MDE, RTES, Accord|UML, Methodology

published or not. The documents may come   L'archive ouverte pluridisciplinaire

Introduction

Due to growing competition among industries, engineers are forced to spend more and more time on their very core business domain to constantly improve the functionalities offered by the products they put on the market. The problem is that such a race for technological innovation tends to generate more complexity, higher costs and longer development cycles for every new generation of products! In parallel, the part of software embedded in these products keeps increasing, making them ever more difficult to design, test, and maintain. Moreover, embedded systems are real-time systems by nature due to their direct relation with their environment or their users. Such embedded realtime software must implement special features as they have to respect specific non-functional constraints and requirements, like responsiveness or periodicity which also tends to make them more complex.

Considering these issues, it appears that new development techniques should be adopted rapidly to relieve engineers of software development concerns allowing them to concentrate their efforts on their initial domain. Actually, when correctly supported by tools, the model paradigm support the use of multiple graphical views dedicated to explicit different aspects of the system, or dedicated to give the reader the most comprehensive abstraction level needed. Associated to efficient code generation tools, a part of the tedious and error prone coding process is relieved from developers giving them more time to spend on the functional part of their products. The model paradigm is hence likely to address these needs and could become quite an efficient way to get complexity under control, improving product quality, and reducing time-tomarket delays in the same time. To sum up, an emerging solution may be to ask developers to describe models rather than to write code.

Reliance and efficiency are two inherent requirements of any real-time embedded system (RTES) and this cannot be obtained unless the concerned software is built on top of precise specification and analysis. Model driven engineering (MDE) can be summarized in two major basic principles of software development which are: abstraction and refinement. Considering both aspects, model engineering can perfectly be derived and used in the development of RTES. This paper will discuss issues related to the two following model engineering aspects when mapped and valued in a RTES development context:

• Abstraction -the complete specification of a RTES requires the description of a set of complementary and consistent views dedicated to various aspects of the system like its functional analysis, real-time constraints or fault tolerance behavior. Furthermore, the embedded and real-time nature of such systems leads to specification where generic product features and implementation specific features are tightly stuck together and hard to distinguish. As a result, developers need one (or more) suitable language(s), with a sufficient level of richness, completeness and precision, to manage the various abstraction levels required in RTES development. Among RTES model properties, completeness, determinism and executability appear as essential features that a model needs to satisfy. The Model Driven Architecture approach, promoted by the OMG for a few years, puts the model paradigm in the center of the development process.

In this approach, the process activities rely on an intensive use of model transformations and tries as much as possible to separate concerns that are platform specific and platform independent. The CEA-List drives experiment and research in the field of RTES development for several years. In this scope, a lot of work has been done to apply the founding concepts of MDA [START_REF] Miller | Model Driven Architecture (MDA)[END_REF] (and model driven oriented approaches in general) in a development process dedicated to real time and embedded systems. This work resulted in the Accord|UML toolkit which consists of a complete UML based methodology and related supporting tools. This methodology covers the whole development cycle of RTES from very early specification activities to a first executable prototype.

The paper will analyze how model driven engineering can provide a significant contribution to RTES development through practical experiments conducted by the CEA-List group in the Accord|UML research project. This paper is divided into three main parts. In the first one we give general considerations regarding MDE approaches applied to real-time and embedded development. Then in a second part MDE modeling aspects are discussed paying a particular attention to the modeling language and the methodology aspects used to build efficient models. The last part of this document is focused on model transformations and how they can be used to improve and ease a RTES modeling process.

Adapting MDE for real-time embedded systems

Accord|UML [START_REF] Gerard | Using the model paradigm for Real-Time Systems Development[END_REF][START_REF] Mraidha | A two-aspect approach for a clearer behavior model[END_REF][START_REF] Robert | How ADLs can help in adapting the CORBA Component Model to Real-Time and Embedded Software Design[END_REF][START_REF] Tessier | A Component-Based Methodology for Embedded System Prototyping[END_REF] is both a modeling framework and a methodology which aims to assist RTES development. One of the main founding ideas behind Accord|UML is the fact that most of the realtime implementation concepts are masked and managed by the framework so that the developers can concentrate on the domain related aspects of the system (functional and non-functional aspects). An expected result is that developers are not asked As described on Figure 1, the method relies on the four well-known software-engineering tasks applied to modeling: analysis, design, prototyping and validation. The developer goes from one stage to another using precise model refinements used in a seamless iterative process.

Req. documents

The first modeling stage directly comes from a refactoring of requirements documents written for the system to be modeled. It mainly consists in rewriting existing requirements documents using UML as the modeling language, and following Accord|UML specification rules. At this stage, the system is seen as a black-box, which means that the developer focuses on its basic functions and its relationships with the environment without giving any realization information. The basic functions and external interactions are modeled as high level scenarii with the help of UML sequence and use case diagrams. Accord|UML offers the possibility to add high level non-functional requirements such as expected temporal constraints (deadline, ready time, etc...) in this first modeling stage. The model built during this stage is the preliminary analysis model (PAM).

This initial model is then refined in order to detail the system specification. The developer is supposed to build the static model which describes the system structure, and the dynamic models which describe the system behavior. For this latter, Accord|UML uses both sequence and state diagrams. Sequence diagrams are used to provide detailed scenarii which directly comes from a refinement of high level scenarii modeled in the previous phase. These diagrams give a detailed representation of interobject interactions and clarify expected temporal constraints. State diagrams are quite useful to describe object internal behavior. Obviously, the system structure is detailed through UML class diagrams. This second step produces a detailed analysis model (DAM). Such model remains independent from any implementation language and target execution platform.

This model may be enriched to produce a validation model. This kind of model allow temporal or performance constraints validation. This model may also be used as the initial model to generate test cases. Moreover, the detailed analysis model may also be refined and completed with platform specific information (or constraints) to obtain a prototype model. In that case, the model is necessarily mapped to an implementation language and contains the implementation for every real-time concept shadowed in previous models by the Accord|UML framework. Using this prototype model, code can then be generated and compiled against a given execution platform.

A model-centered approach

In the context of real-time and embedded systems, industrials are more and more interested in object oriented or component based approaches. Indeed, such approaches are well-known to offer abstraction and complexity management capacities. This allows various actors, with different understanding levels to efficiently work on the same model by using different model viewpoints or abstraction levels. Formerly used for documentation purpose, UML tends to take a growing importance in industry as a complete development tool per se.

UML is now considered as the de facto standard language for modeling. Two complementary UML profiles have been specified and adopted as new OMG standard that address RTES development specific issues: the « scheduling, performance and time » (SPT) profile [START_REF] Omg | UML Profile for Schedulability, Performance, and Time Specification[END_REF] and the « QoS and fault tolerance» profile [START_REF] Omg | UML Profile for Modeling Quality of Service and Fault Tolerance Characteristics & Mechanisms[END_REF]. These profiles do not fully meet RTES development needs and they should be considered as a generic basis to construct a specific modeling language to support RTES modeling.

High-level concepts

Developers need to be able to express real-time features in their models as soon as possible during the development process. To ensure this, it is absolutely necessary to provide expressive high level modeling concepts that are completely independent from any implementation consideration. In this scope, Accord|UML intends to let developers add non-functional features directly inside their own domain specific models. Specific MDE artifacts have been developed inside the Accord|UML toolkit for the description of non-functional features such as realtime, embedded or distributed modeling features.

In Accord|UML, two main concepts are dedicated to express real-time features [START_REF] Gerard | A UML-based concept for high concurrency: the Real-Time Object[END_REF]:

• The « RealTimeObject » stereotype extends UML with the possibility to model concurrent entities and which encapsulates concurrency control and object life-cycle management. • The « RealTimeFeature » is the other key concept. It provides a solution to express realtime temporal constraints in UML models. This concept directly inherits from the quality of service as defined in the SPT specification document.

Dedicated models for real-time

RTES modeling not only requires dedicated modeling concepts, but also well-formed models. To be considered as well-formed in a real-time context, models need at least to own the following properties: determinism, completeness and executability.

Determinism

System determinism means that considering a given initial state, the system always reacts to the same given set of stimuli by producing exactly the same behavior. Considering RTES, this definition may be extended saying that the expected behavior is supposed to appear at a precise date. Such property is very important for RTES. Determinism is critical in real-time modeling as such system may:

• Integrate control.

• Run for extended periods.

• Operate autonomously.

Indeed, real-time applications differ from generalpurpose applications in the temporal correctness of the results produced. Moreover, temporal correctness often needs to be proved or validated. Such proof requires the use of various behavior analysis techniques like schedulability analysis or deadlock detection analysis which is only possible in a determinist model.

As a generic modeling language the UML specification has a generic semantic description. But UML also offers a set of specialization facilities that allow anyone to adapt UML for his particular needs. Considering the semantic, this is achieved through the notion of semantic variation point. It consists of specific points of the specification where the UML semantic is voluntarily kept open. In fact any UML modeling tool or methodologies are supposed to clearly and precisely explicit the variation points with their own semantic. Unless semantic variation points are completed, it is not possible to state on the meaning of a UML model, in such a case it would be definitely impossible to build determinist models.

As described on the picture below, an example of variation point is the dispatching policy for messages stored in UML state machine message queue. Accord|UML specifies that the messages are managed with a message box and that the dispatching policy associated to this is an « Earliest Deadline First » (EDF) algorithm. In other word, a real-time feature is added to each message sent. The message that owns the closest deadline is extracted and treated in priority.

Completeness

Completeness is the next important property required for real-time models. A complete model can be intuitively defined as a model which contains all the necessary information required to represent the modeled system. This concept is obviously hard to be formally and precisely defined. In Accord|UML, a model is considered as complete if it contains every sub-models described in the methodology. For example, at the detailed analysis modeling stage, the complete model is supposed to describe the whole structure, behavior and interaction of the system. In Accord|UML the whole system behavior is here supposed to be completely described in an implementation-independent way. Building models independent from a target platform and implementation language enhances model reusability but requires a dedicated language to model any possible kind of actions.

Since its version 1.5, UML defines the clear and unambiguous abstract syntax of an action modeling language. Accord|UML proposes a concrete syntax [START_REF] Mrhaidha | Action Language Notation for ACCORD/UML[END_REF] compliant with UML action language abstract syntax. This language perfectly fits real-time needs, and due to its compliancy with UML 2.0 abstract syntax, it will also be compliant with any tool based on UML 2.0 specification such as a model execution engine.

Executability

A model is executable when it can be operated on a computer. There is mainly two ways to make a model executable.

The first solution requires a model execution engine, which is a kind of model interpreter that can read a model and directly operates on a computer (or any hardware execution unit).

The other solution consists in defining a transformation from the model to an existing executable platform and formalism. This is usually achieved through a code generation process.

Obviously, in both these two cases, the model to be executed needs to be complete and determinist (unambiguous at least). To achieve the executability property of models, Accord|UML provides a dedicated code generation facility and a real-time execution framework (the Accord kernel). This framework provides an operating support for high level real-time concepts defined in the Accord|UML profiles that extend the UML language. Hence, the Accord kernel gives sense to features defined in Accord|UML such as the "RealTimeObject" concept, by providing execution support to realize communication and message management associated to this kind of objects.

Consistency and complementarities

To manage the complexity of systems, a widespread software engineering technique is the separation of concerns. It consists in modeling the various aspects in the system separately with different views (structure, behavior …).

One advantage of this technique is that developers can focus on a particular view to solve a problem without being disturbed by the difficulty of managing the whole system. The issue inherently raised by the separation of concerns is the problem of the consistency between views. Indeed, it is important to keep in mind the fact that views are local points of view which all relates to the very same and unique model of the system. As a result, these views are not completely independent one from each other; the same model element often appears in several different views. While working on the different views separately, one can easily introduce inconsistencies or incoherencies in the model. A possible solution consists in defining a set of consistency rules that need to be verified by the whole model to ensure its global consistency. Such rules may be described using the object constraint language [10] (OCL). If the modeling tool offers an OCL expression evaluation service, the consistency rules may even be automatically checked during modeling.

Figure 3 Separation of concerns in Accord|UML

As shown on Figure 3, modeling real-time applications using Accord|UML relies on the previously described concept of separated views grouped as a consistent set. In the detailed specification stage, Accord|UML identifies three partial, complementary and coherent views of the system:

• The structural view defines the architecture of the application. This model is mainly based on UML class diagrams, and describes the whole application classes including their property and relationships. Interactions between classes are not treated here, relationships just model the fact that classes need or may need to have communication support. • The behavioral view focuses on the local behavior of the classes defined in the structural view. The goal of this view is to clarify both class and operation behavior. Class behavior relates to control aspects, while operation behavior is the algorithmic description of operations. This point will be further discussed in the paragraph 3.4. • The interaction view concerns the "instance layer" of the application model. It connects the various instances used in the application and describes explicitly how messages are exchanged at runtime between a set of instances to realize the tasks that the application is required to realize.

Modeling the system behavior

The UML state machine is the usual way to express behavior in models. This kind of diagram is added to system classes to describe their internal behavior. A possible way to proceed is to use a single state machine diagram to model both control and algorithmic aspects of class behavior.

However, merging these aspects in the same diagram presents two major drawbacks. Firstly, diagrams rapidly become hard to maintain as it produces very large state machine diagrams even for relatively simple behaviors, and hard to read due to the mix between control and algorithmic aspects.

The second drawback is a reusability issue. As the algorithmic aspects are interleaved with control aspects in the state machine diagram transitions instead of method body, most of useful object oriented language properties like inheritance, overriding, or polymorphism are no more usable. They need to be redefined and clarified to take into account state machine specifications. Moreover, any modifications in the algorithm may impact the whole behavior as a single diagram is used.

The separation of concerns applied to behavior modeling is an efficient way to avoid the drawbacks mentioned before. It mainly consists in a clear separation between control related aspect and algorithms. This modeling principle has been promoted for a long time by synchronous approaches in the context of reactive systems development. This principle is also promoted as a major modeling concept in Accord|UML (see Figure 4).

Class behavior = logic control

Class

Figure 4 Separation of class behavior aspects in Accord|UML

The control aspect of class behavior refers to the class logic control also known as the object lifecycle. This part of the modeling process uses a specialization of UML standard state machines specification: the protocol state machines. Protocol state machines have two main particularities:

• Actions are attached to transition (no state actions). • Transitions can only trigger class method, not an action sequence. Indeed, UML state machine can be either Moore or Mealey automaton, which means that actions can be respectively associated either with states or transitions. For readability reasons it is preferable to strictly restrict the use of state diagram either to Moore or Mealy style. In Accord|UML, state machines are supposed to be Mealy automaton. Using state actions in UML state machine may be tedious as the semantic is not intuitive and may even lead to concurrency issues in a real-time context.

[guard] trigger / Figure 5 Protocol state machine transitions

Transitions in a protocol state machine always refer to an operation which is defined in the context of the classifier that owns the transition. Such transition never triggers any actions or any set of actions, but only the execution of the method that implements the operation it refers to. With this kind of state machine, the user can describe which class methods are available for execution at a given instant and within a given state.

To describe how a method implements a given operation, Accord|UML proposes to use activity diagrams. These diagrams are quite well adapted to describe algorithms. It consists of action sequence and classical algorithmic control nodes (if … then … else …, loop …). Accord|UML action language [START_REF] Mrhaidha | Action Language Notation for ACCORD/UML[END_REF] is used to define actions in this kind of diagrams. An open source editor for this action language will soon be realized and made available for download on the Eclipse MDDi project website 1 .

Refinement with model transformations

Model transformations hold an important place in any MDE process. This part gives examples in which transformations can greatly improve and speed up developer's work.

Modeling assistance

An obvious possible use of model transformation is to provide modeling assistance to developers. The potential objectives are twofold.

First, transformation may be used in a given methodological context to ensure that the developer strictly follows a particular development process. For example, the user may be forced to use transformations to go from one modeling step to another. This requires that a methodology expert has prepared every model transformation used by developers in their development process.

The other possibility is to use (semi-) automated transformations to manage error prone or tedious modifications in models. For example, a simple naming correction in the model may impact a large set of elements to ensure traceability consistency. This is typically a case where models can be

Figure 6 Signal implementation pattern

Accord|UML provides such modeling assistance:

• Between the main modeling stages (cf. Figure 1). • To check model consistency, and in particular to ensure that state machines are valid and consistent with the system structure. • To refine and add implementation patterns to each real-time concepts introduced by Accord|UML. The Figure 6 presents such implementation pattern applied to a signal defined in the model.

Validation

In addition to modeling assistance Accord|UML provides bridges between UML and other formalisms. Such links are provided between UML and existing tools issued from formal technologies for validation purpose. Two experiments have been realized in this field: • Automatic test case generation.

• Schedulability analysis.

In both cases, model transformation rules were defined to transform Accord|UML models in a new formalism provided as input to the behavioral analysis tool: AGATHA [START_REF] Lugato | Verification and tests generation for SDL industrial specifications with AGATHA[END_REF]. The formal technological space is well-known to provide good validation tools. The problem is that such tools in general suffer from their inherent complexity that requires developers to be mathematics experts. The goal here is to hide such complexity with the help of UML models and related transformations. Formal tools are used and their results are retrieved and displayed in an appropriate form directly within the initial UML modeling tool.

Application synthesis

Real-time and embedded systems also differ from general-purpose systems because of the performance and quality of service constraints they are expected to verify. Moreover, RTES are often supposed to function autonomously on execution platform with limited and precise hardware and power resources. As a result, the produced software has to respect strong criteria like code size, performance or memory footprint.

In Accord|UML, the application is produced by a code generation process (C/C++ implementation).

To manage real-time implementation constraints, the code generation can be configured to give priority to memory consumption, or other criteria. For example, to produce a code optimized to use less memory and minimized energy consumption, a code generation strategy consists in reducing calculations.

Redundant and useless calculations can be removed or replaced by constant expressions in the generated code. Another possible optimization consists in replacing some instructions by faster equivalent instructions (a well-known example is "divide/multiply by 2" operation that can be replaced by binary shifts operation).

It is possible to add platform dependant optimization rules to the general strategies previously mentioned. The same way model transformations were used to reach formal validation tools; existing hardware/software optimization tools may be used to optimize the application for a given platform. This has been successfully experimented in the ACOTRIS project. ACOTRIS [START_REF] Tanguy | Méthode ACOTRIS[END_REF] was an RNTL 2000 labeled project which goal was to bridge the gap between a UML modeling process for real-time embedded applications and an implementation realized with a synchronous implementation language SIGNAL [START_REF] Guernic | Programming Real-Time Applications with Signal[END_REF] and a synchronous-based optimization tool SynDEx [START_REF] Grandpierre | Optimized Rapid Prototyping For Real Time Embedded Heterogeneous Multiprocessors[END_REF]. The picture above gives a simple overall description of the code generation transformation realized in the ACOTRIS project to reach the synchronous approaches technological space from Accord|UML models [START_REF] Tanguy | Modélisation ACCORD/UML -SIGNAL[END_REF][START_REF] Modiguy | Passerelle UML/SIGNAL[END_REF][START_REF] Besnard | SIGNAL -SynDEx translation[END_REF]. As formal approaches, synchronous languages and tools are recognized for their optimization and validation capacities but they require a high level expertise from developers to be used efficiently. Using the abstraction facilities offered by UML models to masked synchronous implementation specificities, ACOTRIS results potentially bring such tools to a much wider audience. As a result, once a synchronous code is generated, the SynDEx tool may be used to provide an optimized placement of the software components on each available execution unit.

Conclusions

The experiments conducted by the CEA-List around the Accord|UML methodology and tools shows that MDE artifacts can cover needs of real-time embedded system development:

• RTES development requires the ability to work on several views describing the same model. MDE language and UML in particular offers such facilities of local point of view description. Moreover, MDE artifacts may be built to ensure the coherence, consistency, and more generally well-formed modeling rules that are supposed to be verified. Such rules are crucial to be able to work independently with multiple views without risk to enforce the well-formed rules defined in the methodology, and introduce inconsistency issues in the model. • The targeted execution platform may differ. In a MDE process, a large part of the models may be described independently from any final implementation consideration (language or target platform). The platform itself may even be modeled and directly linked to the application developed. As a result, industrials may gain a better control on the application maintenance and reusability. It is now possible to capitalize not only on the source code which is firmly linked to an implementation language and an execution platform but directly on the MDE artifacts and models from which the code is generated.

Figure 1

 1 Figure 1 The Accord|UML process

Figure 2

 2 Figure 2 UML dispatching policy

Figure 7

 7 Figure 7 Overall view of ACOTRIS transformations

  • RTES performances should be managed. Heuristics and code generation techniques can perfectly handle this point. With efficient code generation, it is possible to construct high level models and, at the same time, to produce a code that is very close to the best hand tailored code. • Test and validation are critical activities in RTES development. As MDE artifacts, such as model transformations, can bridge the gap between UML and formal technological spaces, existing and efficient formal tools are available to test and validate UML models. The definition of a large set of model driven engineering artifacts dedicated to development, reusability, validation and maintenance of real-time embedded applications is one of the main concerns of CARROLL common research program settled by the CEA, INRIA, and Thales (www.carrollresearch.org).

	6.	Glossary
	UML Unified Modeling Language
	MDE Model Driven Engineering
	RTES Real-Time Embedded System
	PAM Preliminary Analysis Model
	DAM Detailed Analysis Model
	EDF Earliest Deadline First
	OCL Object Constraint Language
	MDA Model Driven Architecture
	PIM Platform Independent Model
	PSM Platform Specific Model
	QoS Quality of Service
	SPT Scheduling Performance and Time
	MDDi Model Driven Development integration
	7.