Philippe Hellard

Fanny Guimaraes

Marta Avalos
email: <marta.avalos@isped.u-bordeaux2.fr

Nicolas Houel

Christophe Hausswirth

Jean-François Toussaint

Modeling the association between HR variability and illness in

Keywords: Adult, Autonomic Nervous System, physiopathology, Female, Heart Rate, physiology, Humans, Male, Multivariate Analysis, Muscle, Skeletal, injuries, physiopathology, Posture, physiology, Respiratory Tract Infections, physiopathology, Seasons, Swimming, physiology, Young Adult Swimming, upper respiratory tract and pulmonary infections, muscular affections, mixed-effects logistic regression models

teaching and research institutions in France or abroad, or from public or private research centers.

Modeling the association between HR variability and illness in elite swimmers

Philippe Hellard 1 2 , Fanny Guimaraes 3 4 , Marta Avalos 3 * , Nicolas Houel 1 5 , Christophe Hausswirth 5 , Jean Fran ois Toussaint

INTRODUCTION

International and Olympic swimming competition can be characterized by a rise in the level of the performances ( , ). Moreover, 28 37 the higher the performance level, the smaller the differences in performance. For example, during the Rome World Championships in 2009, the mean difference for all the swimming finals was 2.9 0.9 between the World Champion and the poorest (8th) performance, ± % while for the national championships this difference was 5.1 2.8 . In such a competitive context, the training must be optimized to reach

± %
the highest level of performance, and the risk of infection must be carefully monitored during the most intensive training periods and actual competition ( , , ). For example, the swimmers from the Australian team who fell ill in the six weeks preceding the 17 27 29 Commonwealth Games were found to have a 60 greater risk of turning in a poor performance ( ).

% 29

Yet reducing the risk of infection during prolonged and intensive training and competition periods depends on several factors ( , , 17 21 ). High-level swimmers like many international athletes encounter many sources of stress in addition to the physiological and biological 29 stress of intensive training. These include stresses due to environmental conditions (e.g., heat and humidity, altitude, air pollution, traveling great distances and through several time zones), lifestyle factors (e.g., professional obligations, cohabitating, dietary practices), and psychological factors (e.g., personal and psychosocial factors, competition and training stresses) ( , , ). This accumulation of 17 [START_REF] Kuipers | Training and overtraining: an introduction[END_REF] 29 acute and chronic stress factors has been shown to disturb several immune parameters, which in turn lowers resistance to common minor illnesses like upper respiratory tract infection ( , , , ).

12 13 17 35 Several studies have also established that physical and psychological stresses disturb autonomic regulation ( , , , , ). These 2 18 21 25 31 authors observed disturbances in autonomic regulation during periods of long and intensive training overload, manifesting first by a shift in autonomic balance toward sympathetic predominance (sympathetic form of overtraining) ( , , , ), which then progressed to 18 21 25 31 complete exhaustion of the neuroendocrine system (parasympathetic form of overtraining) when recovery periods were omitted from the training schedule ( , , , ). 2 10 18 21 Several lines of evidence suggest that autonomic imbalance compromises immune regulation and thus increases the risk of illness. For example, the hypothalamus is known to communicate with the immune system via the autonomic nervous system ( ). Lymph organs like 4 the spleen, lymph nodes and thymus are innervated by noradrenergic fibers from sympathetic neurons ( ) and cholinergic fibers ( ). 8 4

Functionally, sedentary subjects with autonomic imbalance characterized by sympathetic predominance were found to be predisposed to gastrointestinal diseases like inflammatory bowel disease or active ulcerative colitis ( ). 34

It is generally assumed that sympathetic control promotes the inflammatory response while the parasympathetic arm is protective ( , 22 ). For instance, a study by provided initial human evidence that vagal activity inhibits the production of 34 [START_REF] Marsland | Stimulated production of proinflammatory cytokines covaries inversely with heart rate variability[END_REF] proinflammatory cytokines by activated monocytes/macrophages and thus decreases local and systemic inflammation.

However, no study has yet investigated the effects of disturbed autonomic nervous activity on the incidence of infection in elite athletes under the intense stress of training and competition.

This study tested the hypothesis that a shift in autonomic balance toward sympathetic predominance would be associated with a higher risk of infection. The presence of infection and variations in autonomic activity as assessed by heart rate variability were thus assessed weekly in 18 elite swimmers over a two-year period.

MATERIAL AND METHODS

Subjects

Eighteen elite swimmers (10 men and 8 women; 7 elite international and 11 national) aged 19-30 yr were followed longitudinally weekly between 2003 and 2005 (1508 weeks of observation for the whole cohort). The study was approved by the Institutional Review Board of the host site, and written informed consent was obtained from all athletes. These athletes all trained in the same location and followed the same training program.

Infections and affections

The study was conducted in two Olympic preparation centers. Both centers have a medical service located 500 meters from the pool. The same two physicians followed the swimmers over the course of this study. These two physicians developed the questionnaire that was used to document all upper respiratory tract, pulmonary, gastrointestinal, gynecological and urological infections, and all neurological symptoms and muscular affections. The questionnaire was derived from the WURSS-44 and the questionnaire of . On [START_REF] Pyne | Characterising the individual performance responses to mild illness in international swimmers[END_REF] a weekly basis, the physicians thus documented the following symptoms: for upper respiratory infections: sneezing, stuffy nose, runny nose, hoarseness, sore throat, sinus pain, sinus pressure, sinus drainage, swollen glands, ear infection, ear ache, plugged ear, ear discomfort, watery eyes, eye discomfort, headaches, sweats, chills, feeling feverish, feeling tired, irritability, and feeling depressed; for pulmonary infections: chest congestion, chest tightness, cough, and sputum. The term muscular affections referred to the following: muscle injury (violent pain requiring exercise cessation), pulled muscles (muscle pain during exercise insufficient to stop exercise), tendinopathies (tendon pain with swelling and altered function), delayed-onset muscle soreness persisting more than 24 hours after training, shoulder pain syndrome and knee pain syndrome. Upper respiratory tract and pulmonary infections, muscular affections and all-type pathologies were only recorded if the swimmer showed signs or symptoms for more than 48 hours, required medication, and missed at least one training session as a result of illness. A recurring illness was defined as any upper respiratory tract or pulmonary " infections, muscular affections, or all-type pathologies occurring within one week of a previously recorded episode and was not retained " for analysis ( , ). At the appearance of any signs or symptoms, the swimmers were immediately (within 1 to 6 hours) seen by one of 9 32 the two physicians for a complete clinical examination. Once a diagnosis was made, the swimmer was asked to complete the questionnaire daily during the period of illness. For each episode of illness the following indices were noted: type, duration (number of days), and peak severity (mild no change in training program, moderate training program modified, severe complete cessation of training). An illness

= = =
was defined and taken into account for the study when a swimmer reported one or more signs or symptoms on two or more consecutive days or when the severity was rated as either moderate or severe ( ). 9

For statistical reasons (small samples, rare events), the infections were grouped into three responses of primary interest for physicians and trainers: upper respiratory tract and pulmonary infections (URTPI), muscular affections (MA), and all types of pathologies (AP).

Heart rate variability (HRV) analysis

All tests were conducted every Monday at 9 am in identical conditions. The swimmers did not train the day before testing to avoid the effects of exercise on the test results. They were also instructed not to ingest any medication, tea or coffee before the test.

After a 15-min rest, testing began, with each test lasting 16 min: 8 min in supine position (SUP) and 8 min in orthostatic position (OR). Recordings made during the last six minutes of each position were retained for analysis. The time between two consecutive R waves of the recorded cardiac electrical activity (R-R interval) was measured with a Polar S810 HR monitor (Polar , Kempele, Finland).

®

The heart rate monitor signal was transferred to the Polar Precision Performance Software, version 4.03.040 (Electro Oy, Kempele, Finland), and the R-R intervals were exported under ASCII format. Prior to HRV analysis, raw R-R intervals from Polar S810 recordings were edited to discriminate error caused by S810 acquisition, nonsinus beats or artifacts. S810 artifacts were edited using the automated default protocols in the Polar software. This software corrected for artifacts using an error filter and beat protection zone function. A moderate filter power set at a minimum beat protection of six beats.min was used. Following removal of abnormal intervals, the Polar 1 software linearly interpolated the removed intervals using system-specific algorithms. Each data file was again visually inspected for artifacts, which were manually corrected. The signal was then considered to be normal and to provide normal-to-normal (N-N) intervals. The stationarity of each R-R series was assessed with the paired t-test for equality of means and the Levene's test for equality of variances adapted to paired data. Samples characterized by means and variances that varied over time were excluded from the study (7.5 of the % total data). The corrected files were then transferred under ASCII format to the Nevrokard HRV software (Nevrokard , Medistar, ® Ljubjana, Slovenia).

An analysis of the R-R interval recordings was made with the Poincare method, which consists of plotting the length of each R-R interval against the length of the previous R-R interval. SD1 and SD2 are two standard Poincare plot descriptors ( ). SD1 is a measure of 2 instantaneous variability (successive beats) and is taken as an indicator of parasympathetic activity, whereas SD2 represents long-term variability and indicates both parasympathetic and sympathetic activities ( ).

2

Two R-R segments of 360-s were selected during the last six minutes in the two positions, orthostatic and supine. These 360-s segments were detrended by interpolation of a polynomial function adjusted on a sliding window of 30 R-R intervals by an algorithm minimizing the residual sum of squares between the simulated curve and the experimental curve. The 30-point window size was chosen in order to achieve the correct trade-off between noise reduction and avoiding the introduction of bias. The new function (RR interval vs. time) adjusted by the polynomial function was thus resampled at 2 Hz to obtain equidistant data (720 points). The segment was then windowed using a Hanning window to reduce the spectral leakage resulting from edge effects when using finite data periods. On this resampled R-R interval series, the first integer power-of-two points were selected (512 points) on which the Fast Fourier Transform " "

(FFT) was applied. The spectral power was measured by frequency bands in ms.Hz according to the recommendations of the Task Force . of the European Society of Cardiology and the North American Society of Pacing and Electrophysiology (1996) The following HRV indices were computed: total power and spectral power in the low-frequency (LF; 0.04-0.15 Hz) and high-frequency (HF; 0.15 Hz-0.40Hz) bands expressed in absolute values (ms ) and normalized units (HFnu, LFnu), which represent the 2 relative value of each power component in proportion to the total power minus the very low-frequency component (VLF; 0.01-0.04 Hz).

≤

The HF component primarily reflects the variability of vagal outflow (i.e., parasympathetic activity) to the heart, whereas the LF component reflects both sympathetic and parasympathetic influences. However, LF power often contains a substantial amount of parasympathetic influence, which would explain why HF power and LF power are frequently directly correlated (as seen in our subjects) and why decreased levels in HF power and LF power both predict cardiovascular outcome in the same direction ( ). The LF/HF power 33 ratio quantifies the sympathovagal balance, with relatively higher ratios indicating relatively more sympathetic than parasympathetic modulation of the heart rhythm ( ).

The three outcome variables were the presence or absence of URTPI, MA or AP (for each subject at each observation time). The explanatory variables were the HRV measures performed during the same week and during the previous week (w-1). The adjustment variables were time variables (sport season: 2003-2004 and 2004-2005; and semiseason: winter, from September to March, and summer, from April to July) and individual characteristics such as age, sex, and competition level.

Analysis was conducted using mixed-effects logistic regression models. Logistic regression is a standard tool for analyzing the dependence of binary variables on explanatory variables. The logistic regression model, which assumes that all observations are independent of each other, is nevertheless not appropriate for analyzing several types of correlated data structures, particularly longitudinal data (i.e., repeated observations within subjects). For analysis of such data, random subject effects can be added into the (fixed effects) regression model to account for the correlation of the data. The resulting model is a mixed model including the usual fixed effects for the explanatory variables (thus, the effects common to the population are estimated using all the data) plus the random effects (to take into account individual heterogeneity) ( ). 38

In particular, in random intercept models only the intercept parameter is assumed to vary independently from one subject to another according to a common distribution. Logistic random intercept models were fitted using the NLMIXED procedure of SAS version 9.1 (Cary, NC). Coefficients were interpreted in terms of the odds ratio of an average subject.

The recommendation is to rescale mixed models with random effects, which are expected to have small variability, in order to enlarge the covariance parameters and thus prevent algorithm convergence problems ( ). Therefore, we expressed each HRV variable as a 38

percentage of its maximum during the study period. This rescaling also facilitated comparison of HRV data from one individual to another.

A univariate analysis was performed: the time variables and individual characteristics were included alone as single fixed effects in a logistic random intercept model.

After the univariate pre-selection of variables, multivariate analysis was performed. All pertinent combinations of HRV indexes and significant adjustment variables were included in the models as fixed effects, as well as a subject-specific intercept.

For interpretability reasons, the HRV data from the supine and orthostatic positions were not included simultaneously in the models. Interactions were not statistically significant and were not included.

Model selection relied on the Akaike Information Criterion (AIC). Among the models with the smallest AIC, those with significant variables were selected. A significance level of 0.05 was used for all tests. In further analyses, receiver-operating characteristic (ROC) curves and the associated area under the curve (AUC) with its 95 confidence interval were calculated for each retained model to express % the discriminating power of each model. Finally, a subject influence study was performed.

RESULTS

Time variables and individual characteristics

shows the percentage for each category of infection or affection for the 1508 weeks of observation. Table 1 shows the effects of the time variables and the individual characteristics on the three outcome variables. The number of Table 2 occurrences of each variable is also presented in terms of sex, competition level, season, and semi-season. The risk of URTPI was significantly lower for the international swimmers compared with the national swimmers. A significant negative effect of winter compared with summer was found for URTPI, MA and AP, especially for ORL or pulmonary infection.

Modeling results

Eight HRV variables were quantified in supine and orthostatic positions.

summarizes the average HRV measures for each Table 3 position as a function of the occurrence or absence of infection.

Univariate analyses showed that the increase in the parasympathetic indexes in SUP assessed one week earlier was linked to a higher risk of URTPI (increase in HF and SD1, p<0.05, AUC 0.69, 95 CI(AUC) 0.64, 0.75 ), and to a higher risk of MA (increase in HF,

= % =[ ] p<0
.05, AUC 0.78 0.72, 0.85 ).

= [ ]

Concerning the results measured during the same week, the risk of MA in SUP was statistically linked with an increase in sympathetic (SD2) (p<0.05, AUC 0.73 0.68, 0.78 ) and parasympathetic (HF) autonomic regulation indexes (p<0.05, AUC 0.67 0.59, 0.75 ), as well

= [ ] = [ ]
as a gain in the LF/HF power ratio (p<0.05). Concerning the OR position, our results showed that a decrease in HFnu was associated with an increased risk of MA measured during the same week, with excellent model discriminating power (p<0.05, AUC 0.83 0.76, 0.89 ). We presents the parameter estimations for the three selected multivariate models. All models outline individual variability, with a Table 4 significant random intercept standard deviation (p <0.05).

All-type pathologies

Multivariate analyses showed a higher AP risk in winter (model 1 in

), and for an increase in the total power of HRV Table 4 associated with a decline in SD1 in SUP (p<0.05), AUC 0.7 0.64, 0.76 .

= [ ]

In OR position in winter the decrease in HF during w increased the risk of all-type pathologies, AUC 0.8 0.73, 0.85 , (model 2 in

1 - = [ ]
). Table 4 Muscular affection Increased LF and decreased SD1 in OR position were associated with an increased risk of muscular affection, AUC 0.89 0.83, 0.96 ,

DISCUSSION

The main results of this study were the following: (1) in winter, national-level swimmers showed a greater risk of pathology than international-level swimmers; (2) the weeks which preceded the appearance of upper respiratory tract and pulmonary infections but also muscular affections were characterized by an increase in autonomic parasympathetic activity in supine position. Conversely, in orthostatic position and in winter, the weeks which preceded the appearance of all-type pathologies were characterized by a drop in parasympathetic activity; (3) during weeks characterized by upper respiratory tract and pulmonary infections, a shift was noted in the autonomic balance toward sympathetic predominance in supine position and a drop in parasympathetic drive in orthostatic position; and (4) in winter and in orthostatic position, a drop in parasympathetic drive associated with an increase in sympathetic drive was linked to an increased risk of muscular affection.

During and after intensive and stressful physical work (e.g., long and intensive competitive trials, long-term habitual intense exercise, altitude training), studies have shown both a shift in autonomic balance toward sympathetic predominance ( , ) and 25 31 immunosuppression ( , , ), possibly linked ( , , ) or not ( , ) to an increased risk of pathology. 12 14 17 13 15 17 14 16

To our knowledge, no study has yet associated the risk of illness with autonomic functioning as reflected by heart rate variability. We hypothesized that a shift in autonomic balance toward orthosympathetic predominance would increase the risk of pathology.

In agreement with earlier studies of athletes exposed to prolonged and/or intense stress, such as training overload or competition ( , 9 12 , , , , , ), upper respiratory tract infections (URTI) were the most frequent pathologies observed in this study. Only one of the 17 24 31 32 35 18 swimmers did not fall ill during the two-year study period, and 118 of the 1508 weeks were characterized by illness (7.82 infection in ten of the swimmers (45 of the study population).

%

An increased risk of URTI has been associated in athletes ( ), and particularly swimmers ( , , ), with a decrease in systemic 32 12 13 14 antibodies ( , , ) and laryngopharyngeal mucosal antibodies like salivary immunoglobulin A (S-IgA) ( , , ). Some studies of 12 17 21 12 13 17 the laryngopharyngeal mucosa questioned a direct causality between S-IgA concentration and the risk of URTI ( , , ). These authors 14 15 17 hypothesized that the minor drop in general and local immunity induced by intensive training and stress did not directly cause illness but instead lowered resistance to potential viral ( ) or nonviral pathogens, thus increasing the risk of URTI ( , , ). 15 16 17 32 Lower viral resistance would explain the higher risk of infection in the winter observed in our study and often reported in the epidemiologic literature ( ), as winter is characterized by a surge in viral outbreaks that increase the risk of infection, particularly in cases 3 of lowered immune defense ( ). 3

The frequency of gastrointestinal (GI) symptoms (1.26 of the reported illness) was much lower than that observed in runners during % intensive training ( , , ). In fact, twice as many GI infections were observed during running (reported by up to 20-50 of runners 9 14 24 % during heavy exercise) than during swimming ( ). These findings were explained as the result of less mechanical bouncing during 24 swimming, which has limited up and down movements ( ). Although splanchnic blood flow is greatly reduced during highintensity 24 running, leading to ischemic damage associated with inflammatory response ( ), the horizontal position of swimming prevents this 24 phenomenon.

Of particular interest was the finding that pathology risk was lower in the international swimmers than in the national swimmers, despite similarities in age and training. Epidemiological studies will need to confirm this finding of lower susceptibility to pathology in high-level athletes and determine whether it is genetically determined, as observed in other populations ( ), and/or due to the athletic 36 lifestyle (emphasis on sleep quality and nutrition, immunonutrition supplementation) ( , ). 17 23

To our knowledge, this is the first report to point out a relationship between autonomic activity and the pathology potential in high-level athletes.

The interpretation of these results remains speculative because the autonomic control of potentially infected systems can only be inferred from the measure of heart rate variability ( ). Future research will have to highlight the synergy between cardiac autonomic 22 regulation and the autonomic regulation of respiratory, gastrointestinal and muscular systems, as seen in the studies on the autonomic regulation of three functional domains: sudomotor, cardiovagal, and adrenergic ( ). Moreover, we did not measure immunological or 20 neuroendocrine parameters, although this might have provided insight into the mechanisms of action of the autonomic regulation of immune system activity.

The results of the present study suggest a biphasic time-dependent relationship between autonomic activity and upper respiratory tract and pulmonary infections. The weeks which preceded the appearance of upper respiratory tract and pulmonary infections but also muscular affections were characterized by an increase in autonomic parasympathetic activity in supine position. This period preceding the clinical expression of the illness could correspond to the incubation phase, for which the mean duration was estimated to be five days upper respiratory tract and pulmonary infections ( ). During this first asymptomatic incubation phase, the 3 increase in the vagal pathway could play a protective role by modulating the magnitude of early immune responses to inflammatory stimuli ( , ). Indeed, it is hypothesized that afferent vagal neurons relay sensory information regarding early inflammatory activity to 3 22 the brain, which results in reflexive activation of the efferent vagal fibers leading to the suppression of proinflammatory cytokine release ( ). This efferent pathway, termed the cholinergic anti-inflammatory pathway is proposed to play an important role in preventing 39

" "

excessive inflammatory responses and maintaining health ( ). Experimental animal studies also showed that the increase in 39 parasympathetic autonomic activity could counterbalance an excessive sympathetic activity which down regulates the immune responses to viral and cellular antigens ( ). 30

During the second phase corresponding to the symptomatic clinical expression of infections, the subjects of the present study were characterized by a shift of the autonomic balance towards a sympathetic dominance. The symptomatic phase shows a multiplication and then a scattering of viral and bacterial exogenous pathogenic agents into the blood stream. These pathogenic agents activate the macrophages which produce endogenous pyrogens (such as the proinflammatory cytokines IL-1 , TNF-et IL6) and migrate into the

β α
blood stream to the endothelial and perivascular cells of the blood-brain barrier, inducing the coding of a mediator, prostaglandin (PG) E2 ( ). In various areas of the hypothalamus and brain stem, PGE2 mediates different components of the acute phase reaction such as the 30 thermogenesis activation by the sympathetic nervous system ( ). 30

Other investigators have found that disturbances in immuneneuroendocrine regulation and direct autonomic neural circuits can induce immune system alterations in the laryngopharynx ( , , ). For example, nonviral infections of the laryngopharynx were more frequent 5 25 32 when the mucosal lining of the nasopharynx or the normal comensal flora were altered due to autonomic-dependent vasomotor modifications ( ). Animal studies have shown that long-term removal of parasympathetic ( ) or sympathetic ( ) nerve impulses in the 32 26 5 submandibular glands reduced S-IgA concentration in saliva.

In active men, exercise intensity can provoke a shift toward orthosympathetic predominance in the salivary glands, which disturbs mouth and nasopharyngeal ecology ( ). When S-IgA lowers and the mucus membranes dry out, bacteria proliferate, predisposing to 1 mucosal damage and inflammation, which could compromise resistance to common minor illnesses, such as URTI ( , , ).

5 17 26 This type of autonomic imbalance in elite swimmers could increase the impact of other risk factors, such as mucosal irritation caused by hyperventilation, high exposure to nonvirulent and virulent pathogenic and opportunistic microorganisms concentrated in the water surface film, and repeated exposure to chemical disinfectants like chlorine, which can cause mucosal irritation and inflammation ( ). 17

Multivariate analysis revealed that the drop in parasympathetic control of heart rate and the concomitant rise in the orthosympathetic regulation were linked in winter to an increased risk of muscular affection.

In orthostatic conditions similar to our conditions, the increase in LF power indicated mostly sympathetic control predominance because cardiac autonomic balance favors vasomotor control through sympathetic dominance over parasympathetic influences ( , ).

11 [START_REF]Task Force of the European Society of Cardiology, and the North American Society of Pacing and Electrophysiology Heart rate variability . Standards of measurement, physiological interpretation, and clinical use[END_REF] An autonomic profile characterized by decreased parasympathetic regulation and higher sympathetic input has been suggested as one of the first responses to an overtraining stimulus, as previously reported for high-intensity training ( ). This response, termed sympathetic overtraining syndrome, is characterized by complete abolition of the sympathetic regulation of skeletal muscle as manifested by a loss of strength and power, and delayed muscular recovery ( , ). 10 40 investigated the mechanisms by which this type of overtraining lowers performance and muscle recovery. They [START_REF] Fry | Adrenergic receptor down regulation and performance decrements during high-intensity resistance exercise Β 2 overtraining[END_REF] showed in eight overtrained weight-trained men that intense muscle stress provoked a 49 increase in nocturnal urinary epinephrine % concentration and a decrease in the density of muscular adrenergic receptors, indicating desensitization. They hypothesized that β 2- desensitization of adrenergic receptors due to sympathetic overtraining affected the mitogen-activated protein kinases, a complex that marked by increased of the inflammatory markers like C-reactive protein (CRP) and interleukin-6 (IL-6) can be regulated by autonomic influences through the cholinergic antiinflammatory pathway induced by vagal nerve stimulation ( ). 39

Many reports have emphasized that exposure to multiple stressors (physical, psychological and environmental) acting in concert may have interactive or cumulative effects that disturb the neuroendocrine and immune systems and increase the risk of infection ( , ). For 16 17 the first time to our knowledge, our study presents statistical evidence of the impact of several variables, such as wintertime, swimming level, and a shift in autonomic balance toward sympathetic predominance, on the risk of infection.

This study has some limitations. First, we were unable to measure biological parameters of mucosal or general immunity and inflammatory markers because of the long study period and the high number of subjects. Such measures would have provided insight into the mechanisms of autonomic regulation of immune and neuroendrocrine systems and the effect on the risk of infection ( ). Without 16 these measures, our hypotheses remain essentially speculative. Second, we did not perform analyses to determine the etiology of illness and thus could not distinguish pathogens from inflammatory causes, as suggested by .

Spence et al. (2007)

Several tools have been proposed to monitor the effects of physical and psychological training stresses in high-level athletes and to prevent the risks of overtraining and infection ( , , ). These include regular measures of maximal heart rate, the maximal blood 17 29 23 lactate level corresponding to the perception of effort, plasma cortisol concentration, and fatigue and mood state as assessed by questionnaire ( , ). 17 21

The results of this study argue that HRV is a rapid and noninvasive tool to indicate autonomic function, which provides complementary information that may help to reduce the risk of infection in elite swimmers. Weekly HRV monitoring would indicate a drop in parasympathetic regulation, which increases the likelihood of pathology. The clinical recommendation in the case of signs or symptoms of illness and recovery from illness is to avoid or attenuate high-risk periods such as winter, overtraining with increased training volume and intensity ( , , ), competition, travel through several time zones, and altitude training ( ), all of which may induce a 21 25 35 31 shift in the autonomic balance toward orthosympathetic predominance. Another recommendation is to intensify medical surveillance and institute prophylactic measures when autonomic balance shows a sudden increase in parasympathetic indices in the supine position, which progresses some days later toward sympathetic predominance in the supine and orthostatic positions.

  also found that a gain in the LF/HF power ratio was statistically linked to an increase in URTPI (p<0.05, AUC 0.68 0.61, 0.75 ) and MA

β 2 -

 2 relays extracellular stimuli to the nuclear domain of the muscle cell ( ). 10Moreover, muscular affections like delayed-onset muscle soreness, which is characteristic of cell damage, cause local tissue inflammation linked to the production of inflammatory mediators ( , ). Recent experimental studies have shown that local inflammation 6 7

1 :

 1 Probability of all-type pathologies (AP) presence as a function of total power of HRV in supine position (TP in SUP) and instantaneous variability in supine position (SD1 in SUP) adjusted by semi-season (reference category: Summer), number of observations n 419, for 18 subjects. Model 2: Probability of AP presence as a function of the high frequency component of HRV in orthostatic = position assessed one week earlier (HF in OR w ), n 288, for 18 subjects. Model 3: Probability of muscular affection (MA) presence as a function of the low frequency component of HRV in 1 -= orthostatic position (LF in OR) and instantaneous variability in orthostatic position (SD1 in OR) adjusted by semi-season, n 283, for 17 subjects. AUC, area under the curve.

=

  of the total

				%
	observation period). In comparison,	Spence and colleagues (2007)	observed 21 URTI episodes in 20 elite triathletes and cyclists studied
	for five months.	Fricker et al. (2005)	reported that 42 weeks (17.5 ) were characterized by URTI episodes in 15 elite runners studied over %
	240 weeks.	Gleeson et al. (2000)	observed 22 elite swimmers for 12 weeks of summertime training in 1999 and diagnosed at least one

Table 1

 1 Incidence of infectious disease during the study period. Over the 1508 weeks of observation, we counted the number of weeks in which each type of infection or affection was reported. The weeks characterized by infection/affection were then added to give the category of all types of infection/affection combined.

	Infection or affection type

Table 2

 2 Incidence (N), odds ratio and 95 confidence interval (CI) for the association between adjustment variables and pathologies for the 1508 weeks of follow-up of 18 subjects.

	%
	Variable	AP

Table 3

 3 HRV data (ms ) in the supine and orthostatic positions as a function of all-type pathologies presence or absence

	2
	HRV variable	Position	N	Mean	Infection presence SD	N	Mean	Infection absence SD
	SD1	SUP	108	58.4	30.6	311	63.2	35.3
		OR	74	20.9	15.8	209	22.7	16.8
	SD2	SUP	108	124.3	60.0	311	120.9	57.4
		OR	74	94.2	54.0	208	97.6	51.4
	PT	SUP	108	28760.2	62417.0	311	25564.2	50243.4
		OR	75	23130.5	45939.6	212	27343.9	59571.8
	VLF	SUP	108	23743.0	60007.9	311	20282.6	49116.0
		OR	75	20807.9	44762.1	212	24761.5	58556.5
	LF	SUP	108	2551.7	2223.7	311	2560.4	2436.5
		OR	75	1930.7	1959.7	212	2108.0	2235.9
	HF	SUP	108	2454.3	2470.1	311	2722.9	3213.4
		OR	75	399.9	647.8	212	474.4	963.0
	LF/HF	SUP	108	1.5	1.3	311	1.5	1.5
		OR	74	11.6	10.4	211	12.2	12.2
	HFnu	SUP	108	47.1	17.4	311	48.0	16.8
		OR	75	14.0	12.8	212	15.3	14.0

Table 4

 4 Estimations of the multivariate models selected according to the statistical Akaike information criterion.

	Model	Outcome variables	Explanatory variables	Estimation (SD)	P	Random effects P	AUC 95 IC %
	1	AP	intercept	-0.414 (0.379)	0.290	0.029	0.70 0.64, 0.76 [	]
			TP in SUP	0.013 (0.005)	0.022
			SD1 in SUP	-0.015 (0.007)	0.036
			Summer	-0.999 (0.321)	0.006
	2	AP	intercept	-0.630 (0.344)	0.084	0.005	0.79 0.73, 0.85 [	]
			HF in OR w 1 -	-0.015 (0.007)	0.052
			Summer	-1.188 (0.366)	0.005
	3	MA	intercept	-1.950 (0.771)	0.022	0.007	0.89 0.83, 0.96 [	]
		LF in OR	0.039 (0.015)	0.018
			SD1 in OR	-0.044 (0.020)	0.039
			Summer

[START_REF] Fry | Adrenergic receptor down regulation and performance decrements during high-intensity resistance exercise Β 2 overtraining[END_REF]

[START_REF] Fry | Adrenergic receptor down regulation and performance decrements during high-intensity resistance exercise Β 2 overtraining[END_REF]

[START_REF] Fry | Adrenergic receptor down regulation and performance decrements during high-intensity resistance exercise Β 2 overtraining[END_REF]

[START_REF] Fry | Adrenergic receptor down regulation and performance decrements during high-intensity resistance exercise Β 2 overtraining[END_REF]

[START_REF] Fry | Adrenergic receptor down regulation and performance decrements during high-intensity resistance exercise Β 2 overtraining[END_REF]

[START_REF] Fry | Adrenergic receptor down regulation and performance decrements during high-intensity resistance exercise Β 2 overtraining[END_REF]

[START_REF] Fry | Adrenergic receptor down regulation and performance decrements during high-intensity resistance exercise Β 2 overtraining[END_REF]

[START_REF] Fry | Adrenergic receptor down regulation and performance decrements during high-intensity resistance exercise Β 2 overtraining[END_REF]

Ackowledgements:

The results of the present study do not constitute endorsement by ACSM. The authors have received no funding for the research on which their article is based from NIH, Welcome Trust, HHMI, or any other funding agency.

Footnotes:

The authors have received no funding for the research on which their article is based from NIH, Welcome Trust, Disclosure of funding: HHMI, or any other funding agency.


Julien Dormoy
email: jdormoy@lifc.univ-fcomte.fr

Olga Kouchnarenko
email: okouchnarenko@lifc.univ-fcomte.fr

Arnaud Lanoix
email: arnaud.lanoix@univ-nantes.fr

Using Temporal Logic for Dynamic Reconfigurations of Components

Dynamic reconfigurations increase the availability and the reliability of component-based systems by allowing their architectures to evolve at run-time. This paper deals with the formal specification and verification of dynamic reconfigurations of those systems using architectural constraints and temporal logic patterns. The proposals of the paper are applied to the Fractal component model. Given a Fractal reference implementation of a component-based system, we specify its dynamic reconfigurations using a temporal pattern logic for Fractal, called FTPL, characterizing the correct behaviour of the system under some architectural constraints. We study system reconfigurations on which we verify these requirements, in particular by reusing the FPath and FScript tools.

Introduction

Component-based development provides significant advantages like portability, adaptability, re-usability, etc. when developing, e.g., Java Card smart card applications or when composing components or services within Service Component Architecture (SCA). The adaptability means that component-based systems must be adapted, or even adapt themselves [START_REF] Kephart | The vision of autonomic computing[END_REF] to their environments during their lifetime, and there is a need to support dynamic reconfigurations, including unanticipated ones [START_REF] Redmond | Supporting unanticipated dynamic adaptation of application behaviour[END_REF]. To take up this challenge, this paper deals with the formal specification and verification of dynamic reconfigurations of componentbased systems, and uses temporal patterns to monitor them.

The present paper makes the following contributions. The first contribution is a formal definition of the semantics of component-based systems with reconfigurations. To specify system reconfigurations, the second contribution is the definition of a linear time temporal logic based on architectural constraints which are first order configuration properties, and on event properties. For temporal operators, its expressive power is related to the well known linear time temporal logic (LTL) [START_REF] Manna | The Temporal Logic of Reactive and Concurrent Systems: Specification[END_REF]. The third contribution is the application of the paper proposals to the Fractal component model [START_REF] Bruneton | The fractal component model and its support in java[END_REF]. For the Fractal component model, run-time verification issues are addressed to monitor reconfigurations during system lifetime.

More precisely, this paper follows the line of reasoning suggested in [START_REF] David | FPath and FScript: Language support for navigation and reliable reconfiguration of Fractal architectures[END_REF], where the system consistency during its dynamic reconfigurations relies on integrity constraints-predicates on assemblies of architectural elements and component states. To go further, we propose to support dynamic reconfigurations by using more complex architectural constraints and linear temporal logic patterns. These temporal patterns have been inspired by the pragmatic work of the SanTos Specification Pattern Project [START_REF] Dwyer | Patterns in property specifications for finite-state verification[END_REF], and works on temporal extension of JML [START_REF] Trentelman | Extending jml specifications with temporal logic[END_REF][START_REF] Bellegarde | Verification of liveness properties with JML[END_REF][START_REF] Giorgetti | Verification of class liveness properties with java modelling language[END_REF] helping Java programmers in writing formal specifications. We refer to this temporal extension as FTPL, for Temporal Pattern Language, prefixed by an 'F' to denote its adaptation to Fractal-like component systems and to first-order integrity constraints over them.

The proposals of the paper are applied to the Fractal component model. Given a Fractal reference implementation of a component-based system, we specify its dynamic reconfigurations using FTPL, characterizing the correct behaviour of the system under some architectural constraints. We monitor system reconfigurations by reusing the FPath and FScript tool supports.

The remainder of the paper is organised as follows. After giving a motivating example in Sect. 2, we formally define the semantics of component-based systems with reconfigurations in Sect. 3. To support system reconfigurations, Sect. 4 introduces a linear time temporal logic based on architectural constraints and events. Then, the proposals of the paper are applied to and illustrated on the Fractal component model in Sect. 5. Finally, Section 6 concludes before discussing related work.

Motivating Example

To motivate and to illustrate our approach, let us consider an example of a HTTP server from [START_REF] Chauvel | Composition et expression qualitative de politiques d'adaptation pour les composants Fractal[END_REF]. The architecture of this server is displayed in Fig. 1. The RequestReceiver component reads HTTP requests from the network and transmits them to the RequestHandler component. In order to perform a request, RequestHandler can either use the cache (with the component Basically, a component-based system with reconfigurations is characterized by a set of configurations and a set of actions that allow the modification of configurations.

Component-based architectures

In general, the system configuration is the specific definition of the elements that define or prescribe what a system is composed of. We define a configuration to be a set of architectural elements (components, interfaces and parameters) together with a relation to structure and to link them. We consider a graphbased representation as proposed in [START_REF] Léger | Fiabilité des Reconfigurations Dynamiques dans les Architectures à Composant[END_REF][START_REF] Léger | Reliable dynamic reconfigurations in a reflective component model[END_REF]. Definition 1. A configuration c is a tuple Elem, Rel where:

-Elem is a set of architectural elements, and -Rel ⊆ Elem × Elem is a relation between architectural elements.

In our model, the architectural elements are the core entities of a componentbased system: components, required or provided interfaces, and parameters. Definition 2. The set of architectural elements Elem is defined by:

Elem = Component Interf ace P arameter T ype
where -Component is a non-empty set of the core entities, i.e components; -Interf ace = Required P rovided is a set of the (required and provided) interfaces; -P arameter is a set of component parameters; -T ype is a set of data types associated with parameters.

Each data type is a set of data values. For the sake of readability, we identify data type names with the corresponding data domains. The architectural relation Rel then expresses various links between architectural elements. For example, it allows specifying that a component has an interface or a parameter, or that a component contains other (sub-)components, or that an interface is linked to another one. 2 illustrates main lines of Definition 3 on the example from Section 2. In this figure, the architectural elements are depicted as boxes and circles, whereas architectural relations are represented by arrows. For example, the request architectural element (at the bottom on the left) is an interface provided by RequestReceiver. The RequestReceiver architectural element is a subcomponent of the HttpServer composite component which provides the httpRequest interface. The request interface delegates results passing to the httpRequest interface.

Dynamicity of Component Architectures

To support system evolution, some component models provide mechanisms to dynamically reconfigure the component-based architecture, during their execution. These dynamic reconfigurations are then based on architectural modifications, among the following primitive operations: run is an action renaming one or more running operations.

Given a component architecture and the set R run of reconfiguration operations, the behaviour of the component architecture is defined as a transition system labelled over R run .

Definition 5. The evolution of a component architecture is defined by the transition system C, R run , → where:

-C = {c, c 1 , c 2 , . . .} is a set of configurations, -R run is a finite set of evolution operations, -→ ⊆ C × R run × C is the reconfiguration relation.
Given the evolution of a component architecture, we can now define the useful notions of path, trace, etc. Definition 6. Given the model M = C, R run , → , an evolution path (or a path for short)

σ of M is a (possibly infinite) sequence of configurations c 0 , c 1 , c 2 , . . . such that ∀i ≥ 0.∃r i ∈ R run .c i ri → c i+1 ∈→)).
We use σ(i) to denote the i-th configuration of a path σ. The notation σ i denotes the suffix path σ(i), σ(i + 1), . . ., and σ j i denotes the segment path σ(i), σ(i + 1), σ(i + 2), ..., σ(j -1), σ(j). The segment path is infinite in length when the last state of the segment is repeated infinitely often.

Temporal Logic for Dynamic Reconfigurations

This section presents the syntax and the semantics of the temporal logic for dynamic reconfigurations. This logic, called FTPL, is inspired by the temporal logic in [START_REF] Trentelman | Extending jml specifications with temporal logic[END_REF] designed to help Java programmers in writing formal specifications.

Syntax of the Logic

Let us first give the FTPL syntax:

<TempProp> ::= after <Events> <TempProp> | before <Events> <TraceProp> | <TraceProp> until <Events> | <TraceProp> unless <Events> | between <Events> <Events> <TraceProp> | <TraceProp> <TraceProp> ::= always ConfigProp | eventually ConfigProp | never ConfigProp | <TraceProp> ∧ <TraceProp> | <TraceProp> ∨ <TraceProp> <Events> ::= <Event> , <Events> | <Event> <Event> ::= ReconfigOp called | ReconfigOp normal | ReconfigOp exceptional | ReconfigOp terminates
This language consists of different layers:

the configurations properties, the reconfiguration operations, the trace properties, the temporal properties.

Semantics of FTPL

Let us now give the FTPL semantics. It is defined by induction on the form of the formulas.

Configuration properties Basically, there is a need to express properties on the configurations, i.e constraints on the architectural elements and the relations between them. These constraints are specified using first order logic formulas, sets and relational operations on the primitive sets and relations given in Sect. 3.

Given the model M , we say that a configuration property cp is valid on a configuration c = Elem, Rel , written M, c |= cp, when the evaluation of cp on the configuration c = Elem, Rel is true. When M is understood, we simply write c |= cp.

The configuration properties are expressed at different specification levels. At the component model level, the constraints are common to all the component architectures. In addition, some constraints must be expressed to restrict a family of component architectures (a profile level), or to restrict a specific component architecture (an application level). It expresses that the component CacheHandler is connected to RequestHandler. For the evolution path from Fig. 3 we have: c3 |= CacheConnected whereas c2 |= CacheConnected.

Event properties

We want to observe reconfiguration action effects, for example when a reconfiguration is called or when it terminates, to specify and verify properties over them. Given a reconfiguration operation r in R, we consider the following events: r called denoting that the reconfiguration r has been invoked, r normal denoting that the reconfiguration r has terminated normally, r exceptional denoting that the configuration r has rollbacked. Definition 7. Let σ be an evolution path in M , and r a reconfiguration operation in R. Given an event property e, depicted <Event> in the FTPL syntax , its validity on the i-th configuration of σ, denoted σ(i) |= e, is inductively defined on the form of e by:

σ(i) |= r called iff ∃σ(i + 1).(σ(i) r → σ(i + 1) ∈→) σ(i) |= r normal iff i > 0 ∧ σ(i -1) |= r called ∧ σ(i -1) = σ(i) σ(i) |= r exceptional iff i > 0 ∧ σ(i -1) |= r called ∧ σ(i -1) = σ(i) σ(i) |= r terminates iff σ(i) |= r normal ∨ σ(i) |= r exceptional
Given an evolution path σ, and a list of event properties E = e 1 , . . . , e n , depicted <Events> in the syntax, we say that E is valid on the i-th configuration of σ, denoted σ(i) |= E, iff at least one event of the list E is valid on σ(i). Trace Properties A trace property expresses a constraint which must be true when the component-based architecture changes, i.e on the evolution path. Definition 8. Let σ be an evolution path, and cp a configuration property. Given a trace property trp, depicted <TraceProp> in the FTPL syntax, its validity on σ, denoted σ |= trp, is inductively defined on the form of trp by:

σ |= always cp iff ∀i.(i 0 ⇒ σ(i) |= cp) σ |= eventually cp iff ∃i.(i 0 ∧ σ(i) |= cp) σ |= trp1 ∧ trp2 iff σ |= trp1 ∧ σ |= trp2 σ |= trp1 ∨ trp2 iff σ |= trp1 ∨ σ |= trp2
Intuitively,

-always cp is valid on an evolution path σ iff cp is valid on each configuration of σ; -eventually cp is valid on an evolution path σ iff cp is valid on one configuration of σ, at least; the semantics of conjunction and disjunction is classical.

In the syntax a keyword never is introduced: never cp being an abbreviation for always ¬ cp.

Let us remark that architectural invariants as presented in [START_REF] Léger | Fiabilité des Reconfigurations Dynamiques dans les Architectures à Composant[END_REF][START_REF] Léger | Reliable dynamic reconfigurations in a reflective component model[END_REF], can be handled within the FTPL framework by using always cp, where cp represents the considered architectural invariant.

Temporal Properties Temporal properties are based on all the properties above, i.e. they exploit architectural constraints, event properties and trace properties, together with some temporal patterns, like in [START_REF] Trentelman | Extending jml specifications with temporal logic[END_REF]. Let us recall that the SanTos Specification Pattern Project [START_REF] Dwyer | Patterns in property specifications for finite-state verification[END_REF] has identified these temporal patterns as useful in practice. Definition 9. Let σ be an evolution path, E, E 1 and E 2 be lists of events, trp a trace property. Given a temporal property tpp, depicted <TempProp> in the FTPL syntax, its validity on σ, denoted σ |= tpp, is inductively defined on the form of tpp by:

σ |= after E tpp iff ∀i.(i 0 ∧ σ(i) |= E ⇒ σi |= tpp) σ |= before E trp iff ∀i.(i > 0 ∧ σ(i) |= E ⇒ σ i-1 0 |= trp) σ |= trp until E iff ∃i.(i > 0 ∧ σ(i) |= E ∧ σ i-1 0 |= trp) σ |= trp unless E iff ∀i.(i 0 ∧ σ(i) |= E ⇒ σ |= trp) ∨ ∃i.(i 0 ∧ σ(i) |= E ∧ σ i-1 0 |= trp)
Intuitively,

the property after E tpp is valid on an evolution path σ iff the validity of the event property E on a configuration of σ implies the validity of the temporal property tpp on the suffix of σ starting at this configuration; -before E trp is valid on an evolution path σ iff for each configuration of σ, the validity of E on it means that the trace property trp is valid on the prefix of σ before the considered configuration; trp until E is valid on an evolution path σ iff there is a configuration of σ satisfying the event property E, and the trace property trp is valid on the prefix of σ ending before this event occurs; trp unless E is valid on an evolution path σ iff either the event property E is not valid on σ implying that the trace property trp is valid on σ, or there is a configuration of σ satisfying the event property E, and the trace property trp is valid on the prefix of σ before the corresponding event occurs;

A formula between E 1 E 2 trp has the same semantics as after E 1 (trp until E 2 ), i.e. the trace property trp is valid on the segment of σ consisting of the configurations in-between the configuration where E 1 holds (including it), and the configuration where E 2 holds (excluding it).

Application to the HTTP Server Example

Let us now illustrate the FTPL language use by expressing some properties for the example of HTTP server from Sect. 2.

et us consider a temporal property saying that after the invocation of the reconfiguration operation AddCacheHandler, the CacheHandler component is always connected to RequestHandler, i.e. the CacheConnected configuration property from Example 3 holds on the path configurations after the invocation. This property is valid on the evolution path σ depicted in Fig. 3: σ |= after AddCacheHandler called always CacheConnected.

The following property expresses an architectural constraint saying that at least there is always one file server component connected. These examples show that architectural invariants and properties on immediate predecessors or target configurations of reconfiguration operations can be expressed by FTPL formulas. Further, they show that FTPL is more expressive than the proposals in [START_REF] David | FPath and FScript: Language support for navigation and reliable reconfiguration of Fractal architectures[END_REF]. Indeed, FTPL allows expressing event properties and temporal properties involving different kinds of properties satisfying temporal patterns which have been shown useful for practical applications.

On the Expressiveness of FTPL

Before considering FTPL temporal properties, let us recall that configuration properties are first order logic formulas.

Let us now consider temporal patterns. As explained in Sect.4, FTPL has been inspired by proposals in [START_REF] Dwyer | Patterns in property specifications for finite-state verification[END_REF], and works on a temporal extension of JML [START_REF] Trentelman | Extending jml specifications with temporal logic[END_REF][START_REF] Bellegarde | Verification of liveness properties with JML[END_REF][START_REF] Giorgetti | Verification of class liveness properties with java modelling language[END_REF], called JTPL. The semantics of JTPL temporal formulas and translation rules into JML annotations are detailed in [START_REF] Trentelman | Extending jml specifications with temporal logic[END_REF] for safety properties and in [START_REF] Bellegarde | Verification of liveness properties with JML[END_REF] for liveness properties.

Let LTL k () denote a function translating the FTPL properties of the kind k into LTL properties. We adapt the above-mentioned works and propose the following translation of FTPL patterns into LTL formulas. In this translation cp is a configuration property, trp, trp 1 and trp 2 are trace properties, E, E 1 and E 2 are lists of event properties, and tpp is a temporal property. In FTPL, there is a way to decide whether a list of event properties is valid on a configuration or not. The following functions suppose that the same decision procedure exists in LTL.

Leaving aside the FTPL and LTL models, it is easy to see that FTPL trace properties can be rewritten in LTL as follows:

LTLT race(always cp) G(cp) LTLT race(eventually cp) F(cp) LTLT race(trp1 & trp2) LTLT race(trp1) ∧ LTLT race(trp2) LTLT race(trp1 | trp2) LTLT race(trp1) ∨ LTLT race(trp2)
For example, if in LTL atomic properties could be configuration properties, the safety property specifying that always there is at least one file server component connected, would be written in LTL as follows: G(∃getServer ∈ Interf ace.(RequiredBy(getServer) = RequestDispatcher ∧ ∃i ∈ Interf ace.Binding(i) = getServer))

For temporal properties, we have:

LTLT emp(after E tpp) G(E ⇒ LTLT emp(tpp)) LTLT emp(after E trp) G(E ⇒ LTLT race(trp)) LTLT emp(before E trp) F(E) ⇒ LTLT race B (E, trp) LTLT emp(trp until E) F(E) ∧ LTLT race B (E, trp) LTLT emp(trp unless E) LTLT race C (E, trp) LTLT emp(between E1 E2 trp) LTLT emp(after E1 (trp until E2)) LTLT emp(trp)
LTLT race(trp)

where:

LTLT race B (E, always cp) cp U E LTLT race B (E, eventually cp) ¬(¬cp U E) LTLT race C (E, always cp) G(cp) ∨ (cp U E) LTLT race C (E, eventually cp) F(cp) ∧ ¬(¬P U E)
Remark that a trace property is translated into LTL according to the temporal context in which the property is used, that is why we define two auxiliary functions LTL T race B and LTL T race C . The LTL T race function translates a trace property which either does not depend on a temporal property, or is inside an after temporal property. The LTL T race B function is used to translate a trace property which is inside a before or an until temporal properties. Finally, the LTL T race C function translates a trace property bounded by a unless temporal property.

For example, the property specifying that the deviation must always be lower than 50 until the AddCacheHandler reconfiguration operation terminates normally can be written in LTL as follows: F(AddCacheHandler normal) ∧ ( ∃deviation ∈ P arameter.(P arameterOf (deviation) = RequestHandler ∧ deviation < 50) U AddCacheHandler normal)

Application to the Fractal Component Model

The Fractal component model [START_REF] Bruneton | The fractal component model and its support in java[END_REF] is one of the motivations of the present work because of its native support for dynamic architectures. Fractal also provides means for introspection and reconfigurations. Existing implementations for Fractal and its extensions offer a framework to experiment with FTPL-based reconfigurations. This section briefly describes some Fractal features and the existing language support for reconfigurations, before reporting on our experiments.

Overview of Fractal, FPath and FScript

The Fractal model is a hierarchical and reflective component model intended to implement, deploy and manage software systems [START_REF] Bruneton | The fractal component model and its support in java[END_REF]. A Fractal component is both a design and a run-time entity that consists of a unit of encapsulation, composition and configuration. A component is wrapped in a membrane which can show and control a casually connected representation of its encapsulated content. This content is either directly an implementation in case of a primitive component, or sub-components for composite components.

FPath [START_REF] David | FPath and FScript: Language support for navigation and reliable reconfiguration of Fractal architectures[END_REF] is a domain-specific language inspired by the XPath language that provides a notation and introspection mechanisms to navigate inside Fractal architectures. FPath expressions use the properties of components (e.g. the value of a component attribute or the state of a component) or architectural relations between components (e.g. the subcomponents of a composite component) to express queries about Fractal architectures.

FScript [START_REF] David | FPath and FScript: Language support for navigation and reliable reconfiguration of Fractal architectures[END_REF] is a language that allows the definition of reconfigurations of Fractal architectures. FScript integrates FPath seamlessly in its syntax, FPath queries being used to select the elements to reconfigure. To ensure the reliability of its reconfigurations, FScript considers them as transactions and integrates a back-end that implements this semantics on top of the Fractal model.

From the FTPL Model to Fractal

As explained above, the architectural model presented in Sec. 3 has been developed to capture the Fractal component model, among other component-based models with reconfigurations, like CCM, GCM, etc. To illustrate our proposals, in this section we give a part of the Http Server example encoded using our model (Fig. 4) as well as its implementation in FractalADL (Fig. 5). Let us recall that FractalADL 4 is the architecture description language for Fractal which allows implementing the Fractal component model.

We then use the FScript language to specify the reconfiguration operations presented in Sec. 3, and the FScript tool support to execute them. FScript is focused on the manipulation of architectural concepts and provides complete control of the architecture of the systems modeled in Fractal. Concretely, FScript takes an architecture of a current Fractal configuration and dynamically changes it according to a FScript file in order to create a new target architecture. The FScript implementation features guarantee that FScript reconfigurations always terminate and keep the system in a consistent and usable state.

For example, we specify the AddCacheHandler reconfiguration in FScript as presented in Fig. 6. This reconfiguration consists in creating a new instance of CacheHandler (name) and in specifying its name (set-name). Then, the component is integrated into the architecture (add) and the binding with the component RequestHandler is set (bind). Finally, the component CacheHandler is started (start).

Dynamic Verification

We now report on our experiments evaluating the feasibility of a run-time monitoring of FTPL properties. The monitoring on the execution of the architectural reconfiguration model depends on the property to be verified; It is either the satisfiability of a configuration property on one configuration, or the satisfiability of a temporal property on a sequence of component-based system architectures.

Verification of configuration properties. We use the FPath language support to verify a configuration property on one configuration. Indeed, any first order 4 http://fractal.ow2.org/fractaladl/ 1 < d e f i n i t i o n name=" H t t p S e r v e r "> 2 < i n t e r f a c e name=" h t t p R e q u e s t " r o l e=" s e r v e r " s i g n a t u r e=" j a v a . l a n g . Runnable " /> 3 <component name=" R e q u e s t R e c e i v e r "> 4 < i n t e r f a c e name=" r e q u e s t " r o l e=" s e r v e r " s i g n a t u r e=" j a v a . l a n g . Runnable " /> 5 < i n t e r f a c e name=" g e t H a n d l e r " r o l e=" c l i e n t " s i g n a t u r e=" H a n d l e r " /> 6 <c o n t e n t c l a s s=" R e q u e s t R e c e i v e r I m p l " /> 7 </ component> 8 <component name=" R e q u e s t H a n d l e r "> 9 < i n t e r f a c e name=" h a n d l e r " r o l e=" s e r v e r " s i g n a t u r e=" H a n d l e r " /> 10 <c o n t e n t c l a s s=" R e q u e s t H a n d l e r I m p l " /> 11 < a t t r i b u t e s s i g n a t u r e=" R e q u e s t H a n d l e r A t t r i b u t e s "> Fig. 6. AddCacheHandler Reconfiguration specified in FScript logic formula specifying a configuration property can be translated into an FPath expression, the FPath language having the same expressive power [START_REF] Léger | Fiabilité des Reconfigurations Dynamiques dans les Architectures à Composant[END_REF].

For example, the CacheConnected configuration property from Example 3 can be expressed in FPath by: $HttpServer / child :: Reque stHandle r / interface :: getCache / binding :: cache / → component :: CacheHandler

Verification of temporal properties. Once the configuration properties are handled thanks to FPath, there is a need to deal with FTPL temporal properties. In [START_REF] Basin | Runtime monitoring of metric first-order temporal properties[END_REF], it is shown that the monitoring works well on specific safety properties. In FTPL the safety properties are properties containing only the keywords after, before, unless and always; The safety properties are also properties containing the eventually keyword iff they contain the before keyword to bound the eventually part. The other properties are liveness properties.

We have studied the feasibility of the safety properties monitoring by developing a controller in Fractal. This controller supervises the properties of interest each time a reconfiguration operation occurs. It retains the configurations appearing during the system execution to build a history and to use it for verification purpose. In order to make the monitoring easier, the controller divides the property into sub-properties and keeps each sub-property until it manages to validate it. For example, for the property after AddCacheHandler called always CacheConnected, the controller tries first to find a configuration where the AddCacheHandler called event property holds. Once such a configuration is found, the controller continues with the monitoring of the CacheConnected configuration property for all the following configurations.

The FTPL properties can be divided into two classes: the properties dealing with the past and the properties dealing with the future. As it is possible to determine what has happened in the past thanks to the history built by the controller, all the past properties can be monitored. But, due to the run-time verification, there are properties that cannot be ensured by the controller. For any property about the future containing always, the controller only ensures that the current configuration does not violate the property at the moment. For any property about the future containing eventually key-word, the controller cannot conclude neither.

As explained before, the controller is able to monitor the safety properties about the past, where as for the properties about the future, it only ensures their non-violation until the current configuration. An LTL-derived logic is proposed in [START_REF] Bauer | Comparing LTL Semantics for Runtime Verification[END_REF] to specify and verify that a system behaviour will "presumably" conform or violate the property in the future. In [START_REF] Basin | Runtime monitoring of metric first-order temporal properties[END_REF], the monitoring of safety properties necessitates time intervals bounded in the past as well as in the future. To go further within the Fractal-based approach, and to handle liveness properties, a solution would be to exploit a variant specification of the Loop clause [START_REF] Giorgetti | Verification of class liveness properties with java modelling language[END_REF], to which liveness properties can be reduced.

Conclusion

In this paper we have developed a theoretical framework for dynamic reconfigurations of component-based systems. As a calculus for expressing and analysing reconfiguration and integrity constraints, we have utilised linear temporal logic, since formulas are interpreted over configuration sequences which naturally represent dynamic behaviour of component-based systems. For the Fractal component model, we have studied the feasibility of monitoring dynamic reconfigurations during system lifetime.

Related work Dynamic reconfiguration of distributed applications is an active research topic [START_REF] Cornejo | Specification and Verification of a Dynamic Reconfiguration Protocol for Agent-Based Applications[END_REF][START_REF] Aguirre | A temporal logic approach to the specification of reconfigurable component-based systems[END_REF][START_REF] Basin | Runtime monitoring of metric first-order temporal properties[END_REF][START_REF] Léger | Reliable dynamic reconfigurations in a reflective component model[END_REF] motivated by practical applications like those modelled in Fractal [START_REF] Bruneton | The fractal component model and its support in java[END_REF]. In the context of dynamic reconfigurations, ArchJava [START_REF] Aldric | Using types to enforce architectural structure[END_REF] gives means to reconfigure Java architectures, and the ArchJava language guarantees communication integrity at run-time. Barringer and al. also give a formal temporal logic based framework to reason about the evolution of systems [START_REF] Barringer | From runtime verification to evolvable systems[END_REF].

The idea of using graph-based models to specify dynamic reconfigurations is not new at all. In [START_REF] Baldan | A temporal graph logic for verification of graph transformation systems[END_REF], a temporal logic is proposed to specify and verify properties on graph transformation systems. In the Fractal-based framework, in [START_REF] Léger | Reliable dynamic reconfigurations in the fractal component model[END_REF][START_REF] Léger | Reliable dynamic reconfigurations in a reflective component model[END_REF] the authors have defined integrity constraints on a graph-based representation of Fractal, to specify the reliability of component-based systems. There are tools to allow the user to ensure the reliability of those reconfigurations at run-time.

Our model in Sect. 3 is closely related to the model proposed in [START_REF] Léger | Reliable dynamic reconfigurations in a reflective component model[END_REF] for the Fractal component systems but unlike [START_REF] Léger | Reliable dynamic reconfigurations in a reflective component model[END_REF], our model lays down only general architectural constraints. In this sense it can be considered as a generalisation of the Fractal-oriented model. Moreover, our model seems to be general enough to give operational semantics to other component-based systems. On the integrity and architectural constraint side, the FTPL logic allows us to specify architectural constraints more complex that only architectural invariants in [START_REF] David | FPath and FScript: Language support for navigation and reliable reconfiguration of Fractal architectures[END_REF].

Among other applications, our proposals aims at an active monitoring of component-based systems. The active monitoring involves interpreting a configuration data set and acting on those data to (re-)configure the system accordingly. This may simply be a validation of the target configuration, or a reconfiguration operation interruption. In [START_REF] Basin | Runtime monitoring of metric first-order temporal properties[END_REF][START_REF] Basin | Policy monitoring in first-order temporal logic[END_REF], Basin and al. have shown the feasibility of monitoring temporal (safety) properties and, more recently, security properties using a runtime monitoring approach for metric First-order temporal logic (MFOTL). The semantics of MFOTL has been defined with respect to timed temporal structures. Like the model in [START_REF] Basin | Runtime monitoring of metric first-order temporal properties[END_REF], our model is a first-order structure, but instead of considering a sequence of time stamps, we focus on reconfiguration operations. Although our main motivation and hence the model are different, their algorithms for monitoring temporal safety properties would be adapted for performing dynamic reconfigurations of component-based systems.

Fig. 1 .

 1 Fig. 1. HTTP Server architecture

Fig. 2 .Definition 4 .

 24 Fig. 2. Graph representation of the HTTP Server example

Fig. 3 .

 3 Fig. 3. Part of an evolution path of the HTTP server example

Example 3 .

 3 Let CacheConnected be a configuration property defined by ∃cache, getCache ∈ Interf ace.(P rovidedBy(cache) = CacheHandler ∧ RequiredBy(getCache) = RequestHandler ∧ Binding(cache) = getCache).

Example 4 .

 4 Let us consider again the evolution path displayed in Fig. 3. We have: c3 |= MemorySizeUp called, c5 |= AddFileServer normal and c2 |= RemoveCacheHandler exceptional.

  always ∃getServer ∈ Interf ace.(RequiredBy(getServer) = RequestDispatcher ∧ ∃i ∈ Interf ace.Binding(i) = getServer) Let us now specify that the deviation must always be lower than 50 until the AddCacheHandler reconfiguration operation terminates normally: (always ∃deviation ∈ P arameter.(P arameterOf (deviation) = RequestHandler ∧ deviation < 50)) until AddCacheHandler normal The following property says that between the exceptional termination of either the MemorySizeUp reconfiguration or the DurationValidityUp reconfiguration, and the normal termination of the AddCacheHandler reconfiguration operation, the number of used file servers is greater than 1: between MemorySizeUp exceptional, DurationValidityUp exceptional addCacheHandler normal ∃getServer ∈ Interf ace.(RequiredBy(getServer) = RequestDispatcher ∧ ∃i, i ∈ Interf ace.(i = i ∧ Binding(i) = getServer ∧ Binding(i ) = getServer)

Fig. 4 .

 4 Fig. 4. HttpServer example using Definitions 2 and 3

  Definition 3. The architectural relation Rel is defined by: Component is a total function which gives the component of a considered parameter; -T ypeOf : P arameter → T ype is a total function which gives the type associated with a considered parameter; -V alueOf : P arameter → type∈T ype type such that ∀p ∈ P arameter :

	V alueOf (p) ∈ T ypeOf (p), is a total function which gives the current value
	of a considered parameter;
	-ChildOf ⊆ Component × Component is a irreflexive and antisymetric re-
	lation linking composite components to their sub-components 3 such that:
	• ∀ c, c	∈ Component. ((c, c ) ∈ ChildOf	⇒ ∀ p ∈
	P arameter. (P arameterOf (p) = c)), i.e, composite components have
	no parameter;
	• Let ChildOf + be the transitive closure of ChildOf . Then, ∀c, c ∈
	Component. ((c, c ) ∈ ChildOf + ⇒ c = c ), i.e., ChildOf is an acyclic
	relation;
	-Binding : P rovided → Required is a partial function such that ∀ ip ∈
	P rovided, ir ∈ Required. (Binding(ip) = ir ⇒ P rovidedBy(ip) =
	RequiredBy(ir) ∧ ∃ c ∈ Component. ((c, P rovidedBy(ip)) ∈ ChildOf ∧
	(c, RequiredBy(ir)) ∈ ChildOf )), i.e., two linked interfaces do not belong to
	the same component, but the corresponding components are sub-components
	of the same composite component;
	-Delegate	:	Interf ace	→	Interf ace is a partial injec-
	tive function to specify the delegation from a sub-component
	interface to the composite interface such that ∀ i, i	∈
	Interf ace. (Delegate(i) = i ⇒ (P rovidedBy(i ), P rovidedBy(i)) ∈
	ChildOf ∨ (RequiredBy(i ), RequiredBy(i)) ∈ ChildOf ), i.e., when
	delegating, the component providing i is a sub-component of the component
	providing i , or the component requiring i is a sub-component of the
	component requiring i .
	Example 1. Figure
	Rel =	P rovidedBy T ypeOf	RequiredBy V alueOf ChildOf P arameterOf Binding	Delegate
	where
	-P rovidedBy : P rovided → Component is a total surjective function which
	gives the component having a provided interface;
	-RequiredBy : Required → Component is a total function which gives the
	component with a required interface;

-P arameterOf : P arameter →

For any (p, q) ∈ ChildOf , we say that p has a sub-component q, i.e. q is a child of p.