Konstantin Dmitriev
email: konstantin.dmitriev@tum.de

Shanza Ali Zafar
email: shanza.zafar@tum.de

Kevin Schmiechen
email: kevin.schmiechen@tum.de

Yi Lai
email: yi.lai@tum.de

Micheal Saleab
email: micheal.saleab@tum.de

Pranav Nagarajan
email: pranav.nagarajan@tum.de

Daniel Dollinger
email: daniel.dollinger@tum.de

Markus Hochstrasser
email: markus.hochstrasser@tum.de

Florian Holzapfel
email: florian.holzapfel@tum.de

Stephan Myschik
email: stephan.myschik@unibw.de

A Lean and Highly-automated Model-Based Software Development Process

Keywords: 178C, DO-331, software assurance, safety critical systems, lean software development, model-based development, requirements management, agile development

published or not. The documents may come

I. INTRODUCTION

Software is an essential part of modern air vehicles and it usually implements complex safety-critical functions. To ensure safety of airborne software, the aviation community uses the standard DO-178C [START_REF]Software Considerations in Airborne Systems and Equipment Certification[END_REF] and its supplements (e.g. DO-331 [START_REF]Model-Based Development and Verification Supplement to DO-178C and DO-278A[END_REF] addressing model-based aspects) as a primary guidance for airborne software development. They describe in detail "objectives for software life cycle processes, activities that provide a means for satisfying those objectives, descriptions of the evidence in the form of software life cycle data [...] [and] variations in the objectives [...] by software level [and] additional considerations (for example, previously developed software)" [1, p. 1]. However, achieving compliance with DO-178C significantly increases cost and time of development. The growth of project expenses for DO-178C level C software can exceed 150% compared to the development of typical high-quality consumer software per Capability Maturity Model Integration (CMMI) Level 2 or 3 [START_REF] Thomas | Certification cost estimates for future communication radio platforms[END_REF]. While this expense may be acceptable to some extent for large transport aircraft (given the perception of risk in this category), it is a major hindrance to the advancement of technology -especially avionics -in normal category airplanes and rotorcraft. The availability of cost-effective qualified avionics solutions for these categories could prevent several general aviation (GA) accidents, such as controlled flight into terrain in poor weather or loss of control. This challenge has received increased visibility in recent years, owing to the growth of rapidly emerging and innovative markets such as urban air mobility (UAM) and unmanned aircraft systems (UAS).

Manufacturers and component suppliers developing avionics solutions for GA, UAS/UAM are cooperating with certification authorities to develop alternative means of compliance for software assurance other than DO-178C. The recently created EUROCAE and RTCA joint working group WG-117 is targeting to develop a software standard that will be specific to lower risk UAS and GA applications [START_REF]New working group: Wg-117 / topics on software advancement[END_REF]. ASTM International has released standards on the following topics intended to streamline avionics certification: system-level verification to assure safety of the intended function (ASTM F3153 [START_REF]Standard Specification for Verification of Avionics Systems[END_REF]), run-time assurance of complex functions (ASTM F3269 [START_REF]Standard Practice for Methods to Safely Bound Flight Behavior of Unmanned Aircraft Systems Containing Complex Functions[END_REF]), dependability of software used in UAS (ASTM F3201 [START_REF]Standard Practice for Ensuring Dependability of Software Used in Unmanned Aircraft Systems (UAS)[END_REF]). These standardization development efforts target applicants with little or no experience with certification, especially in the aerospace industry. At the same time, it is also expected that software certification for high-risk operations in UAS/UAM will still require conformity to DO-178C processes.

Many developers also use rapid prototyping methods during their research, development and flight testing phases. With constrained resources, a lack of knowledge and a still developing certification environment for their products, these companies are looking for processes as agile as their development cycles. However, certain DO-178C objectives make it difficult to reuse software previously developed out of DO-178C context. For example, in case of poor traceability between requirements of all levels down to source code, it may be easier to redo the development from scratch, rather than re-engineer trace data, improve requirements and rework source code accordingly. This aspect also contributes towards the lean though scalable development life cycle for prototype and experimental airborne software. For such categories of software products, we deem it beneficial to establish a lean but scalable software development life cycle, which helps to achieve a high level of software quality and provides a basis for potential reuse of experimental software for further certification in accordance with DO-178C.

Use of advanced development techniques like model-based design [START_REF] Marcil | MBD, OOT and Code Generation: A Cost-Effective Way to Speed Up HMI Certification[END_REF] or agile process models [START_REF] Coe | A model-based agile process for DO-178C certification[END_REF] along with automation of development and verification activities with qualified tools [START_REF] Hochstrasser | A process-oriented build tool for safety-critical model-based software development[END_REF] can help to reduce the development effort while achieving full compliance with DO-178C and DO-331. Below, we discuss the lean model-based software development life cycle (custom workflow), which utilizes these advance techniques along with a further reduction of the development effort by introducing the custom subset of DO-178C and DO-331 objectives. We selected the objectives for the custom subset based on criteria of importance, automation and reuse with the following goals:

1) Reduce non-critical process activities to minimize development efforts while maintaining a software quality level similar to DO-178C level C. 2) Enable the completion of software development to achieve full compliance with DO-178C per level C or higher in the future without wide rework of the data produced using the custom workflow. This paper is structured in the following sections. Section II describes the methodology for the selection of the custom subset of objectives. In section III, a general overview of the workflow to satisfy the selected objective using MathWorks and own tools is given. This is followed by an explanation of in-house processes and tools to facilitate the custom workflow in sections III-A to III-D. Section IV describes the achieved level of compliance to DO-178C and DO-331 using the custom workflow. A case study is performed by developing an Autopilot Manual Disconnection System (AMDS) using the proposed workflow and is described in section V. Section VI discusses the planned enhancement for the custom workflow. At the end, conclusions are given in section VII.

II. OBJECTIVES SELECTION CONCEPT

We considered the following criteria to select the DO-178C and DO-331 objectives for the custom subset:

• Importance of the objective 4 . Level of potential reuse was considered as another factor due to the increased value of the artifacts, which can be leveraged without major modification across multiple projects. The value of such artifacts and corresponding objectives versus efforts spent for their development is multiplied by reuse and therefore such objectives are considered more relevant to the custom subset. For example, certain parts of project development and verification plans and standards can be written in a generic way to be reusable for other development projects being implemented in a similar environment.

We evaluated DO-178C and DO-331 objectives and assigned each objective with a high, medium and low level of applicability for each selection criteria. Based on the total score qualitatively assessed as a combination of all three criteria levels, we selected DO-331 and DO-178C objectives for the custom workflow. This qualitative assessment was based on consensus between the authors. Fig. 1 and2 show the summary of the selected DO-331 objectives applicable to MBS components and DO-178C objectives applicable to manually coded low-level software (LLS) components respectively. Some of the objectives are not applicable to the custom workflow and shown as N/A on the figures. For example, certification liaison objectives are not applicable because a formal certification process is not implemented in the custom workflow. These figures also indicate the compliance level achieved for each objective in the implemented custom workflow. This is further discussed in section IV. Planning activities can require significant manual effort but the reusability of artifacts across different projects is high as mentioned in section II. For our lean custom workflow, planning activities include defining the life cycle in form of an interactive user guide detailing the activities to be performed. This guide also includes the description of the tools to be used and how to use them for MBS and LLS components. Another aspect of the planning process are software development standards. For MBS, DO-331 also requires a Software Model Standard. As a part of this, Modeling Guidelines based on a subset of MathWorks modeling guidelines [START_REF]Modeling guidelines[END_REF] are developed at our institute for Design Models. These are models which are used to generate source code directly. Additional guidelines are also added to overwrite or further restrict functionalities based on experience gathered during previous projects (e.g. for testing or to avoid rounding errors and overflows). Naming Conventions are also developed at our institute for consistency and compliance with MISRA C [START_REF]Guidelines for the Use of the C Language in Critical Systems[END_REF] and the Modeling Guidelines with a focus on flight dynamics and control.

Development Activities' entry point are textual requirements authored in Polarion. In model-based development, a textual requirement may represent different levels of system and software requirements, depending on the selected scenario of model usage as described in DO-331 MB.1.6.3. The custom workflow is implemented based on the MB Example 5 practice (see DO-331 Table MB.1-1) for MBS components. We capture system requirements in textual format and further implement Fig. 3. Development and verification workflow using MathWorks based toolchain for safety critical systems them as Design Models in Simulink for the MBS part (implementing functional capabilities) and refine textual software requirements for the LLS part (scheduling layer, hardware interfaces). Simulink models represent low-level requirements and software architecture. Source code is then automatically generated from Design Models using Embedded Coder. Further details about the modeling environment used for Design Models can be found in [START_REF] Hochstrasser | Aspects of a consistent modeling environment for do-331 design model development of flight control algorithms[END_REF].

For the LLS part, source code is manually written based on the refined LLS requirements and intended to be generally reused across projects implemented on the same hardware. Finally, LLS code is integrated with the auto-generated code for MBS code and compiled to get target compatible object code.

Verification activities can be greatly automated and performed early for MBS using Design Models. DO-331 allows simulations as means of compliance for the key objectives in table MB.A-3 (Verification of Outputs of Software Requirement Process) and further objectives in table MB.A-4 (Verification of Outputs of Software Design Process). Example of these objectives include high-level requirement comply with system requirements, requirements are accurate and consistent, algorithms are correct). Requirement-based simulation cases can be further fully reused for software-in-the-loop (SIL) and Hardware-in-the-loop (HIL) testing of the executable ob-ject code to satisfy some objectives of table MB.A-6 (Testing of Outputs of Integration Process). Using Simulink Test6 for simulation and testing helps achieving objectives in table MB.A-7 (Verification of Verification Process Results) by facilitating structural coverage collection, requirement traceability, and reviewing and managing test results. Reusability of test cases for HIL using Simulink Test is further discussed in subsection III-D.

Checking models during development for design errors using Simulink Design Verifier 7 and for conformance to the Software Model Standard using Simulink Check 8 helps fulfilling other objectives of MB.A-3 and MB.A-4 (Verification of Outputs of Software Design Process). Furthermore, some objectives corresponding to the verification of source code (both manually coded for LLS and auto-generated for MBS) in table A-5/MB.A-5 (Verification of Outputs of Software Coding and Integration Process) are automated using static code analysis techniques for compliance with standards like MISRA C, detecting run-time errors and for proving absence of some run-time error through Polyspace Bug Finder and Polyspace Code Prover. Additionally for MBS, objectives for source code compliance to low-level requirements and software architecture in table MB.A-5 are by Simulink Code Inspector.

Configuration management activities are implemented by using Polarion for requirements management and GitLab for other artifacts. These tools implement essential activities required for the DO-178C/DO-331 Control Category 2: identification, traceability and change tracking. More stringent activities required for the DO-178C/DO-331 Control Category 1 may hinder rapid prototyping and are not included in the custom workflow.

Quality assurance activities are implemented using the tool mrails described below and are limited to tracking the completion status of the planned activities. For example, the left panel of the mrails status overview window presented in Fig. 3 shows the status of the planned workflow activities.

The proposed custom workflow enables high automation in both development and verification activities owing to MBD, which puts the foundation for a lean workflow based on DO-178C. Few examples of MBD for safety critical systems in literature are [START_REF] Estrada | Best practices for developing do-178 compliant software using model-based design[END_REF]- [START_REF] Erkkinen | Safety-critical software development using automatic production code generation[END_REF].

In the following subsections, we will discuss the specific solutions employed at the institute which facilitate the implementation of the lean custom workflow in addition to the MathWorks tools mentioned above.

A. Requirements Management

This section presents the requirement management setup for our custom workflow. We used the tool Polarion, which is a web-based application life cycle management solution by Siemens Digital Industry Software, to manage the textual requirements and their trace data. While writing the requirements, we applied the FRETISH language of the tool FRET (Formal Requirements Elicitation Tool) as much as possible.

It was developed at NASA Ames Research Center and was presented in [START_REF] Giannakopoulou | Formal requirements elicitation with fret[END_REF]. The tool SimPol, which was developed at our institute, is used to create bidirectional traceability between requirements on Polarion and Design Models and test cases in Simulink Test. Further details in the context of requirement derivation, simulation and validation are discussed in [START_REF] Schmiechen | Traceable and model-based requirements derivation, simulation, and validation using matlab simulink and polarion requirements[END_REF], [START_REF] Meidinger | A model-based requirement validation process for handling qualities of evtols[END_REF].

Artifact Hierarchy for our custom workflow is shown in Fig. 4. It includes the work item types (e.g. requirements) but also the link roles. Lower level requirements refine upper level requirements, however, as a simplification, it is also possible that requirements refine those from the next but one level (e.g. from software to system) or that requirements refine other requirements from the same level (e.g. component) because a higher level of detail is necessary within one level. Even though the arrows are only pointing in one direction, the traces are still bidirectional (e.g. forward trace: refines / backward trace: is refined by). Additionally, review checklists are used to hold traceability evidence based on the automatic trace reports described below. The other verification objectives of tables A-3/MB.A-3 and A-4/MB.A-4 of DO-178C/DO-331, which require manual review, can be included in the review checklist when increasing the compliance level with respect to the standard.

Cross-Platform Artifact Linking is done with SimPol between the requirements on Polarion and the Design Models and test cases in MATLAB/Simulink. The tool creates model and test case surrogate work items as described in Fig. 4, which serve as a representation on Polarion for the actual models and test cases. Automatic highlighting of links where either side has changed enables an impact analysis of such changes. The available links can also be used to identify the impact of changes to other work items before the changes are even made.

In accordance with the wording of DO-331, the Design Models have the link role implements to software requirements and to those component and system requirements that are allocated to software. Model-based test cases have the link role verifies to requirements on Polarion. An overview of the steps to link between Polarion and Simulink Test is given in Fig. 5. In the first two steps, the requirements on Polarion are linked with the Design Models in Simulink and the test cases in the Simulink Test Manager. The link from model-based test case to Design Model is already established during the creation of the test case and its harness. The third step is to upload the test run records to Polarion. A custom routine processes the records from Simulink Test Manager into an XML file. A custom extension on the Polarion server processes this XML file, creates the test run records and links them to the test case surrogates.

Automatic Trace Reports can be generated on Polarion with a custom widget as soon as the work items are created and linked with each other. These reports correspond to parts of Trace Data required by section 11.21 of DO-178C. In addition to the actual trace table, the report also consists of a pie-chart with the distribution of the trace status of the work items for a quick overview. Derived requirements, which are identified by a custom field, are one example where it is justified that a requirement does not have an upstream trace.

The custom widget was inspired by a widget for test case coverage that is part of the default Polarion installation, however, our widget was developed to be applicable to our requirement traceability and even more use cases. It also supports checking traces in both directions (e.g. also from lower to higher level requirements).

B. Automation of Life cycle Activities

A process-oriented build tool (mrails) for MBS using the MathWorks toolchain was developed at our institute by Hochstrasser [START_REF] Hochstrasser | A process-oriented build tool for safety-critical model-based software development[END_REF] which greatly reduces the efforts required for certification-ready software development by automating the life cycle activities discussed in section III. In Fig. 3, activities supported and automated by mrails in the overall workflow are highlighted.

For the development of Design Models, mrails integrates the modeling environment and supports the creation of 'readyby-construct' building elements such as reusable models, or Simulink bus objects compatible with Modeling Guidelines. Mrails also automates the execution of verification activities, named jobs, for Design Models and auto-generated source code. Furthermore, it supports the generation of manual reviews lists for verification such as to check compliance with Modeling Guidelines which cannot be automated by Simulink Check.

In case of software changes after certification, the question which artifacts needs to be reevaluated often leads to a 'Big Freeze' problem (i.e. baselining the software) [START_REF] Hochstrasser | Application of a process-oriented build tool for flight controller development along a DO-178C/DO-331 process[END_REF]. A solution to this is implemented in mrails. For all jobs, an artifact dependency graph is generated between the manually modifiable source files like requirements, models and the auto-generated derived artifacts like reports, test results. Mrails uses the dependency graph to perform a change impact analysis. This analysis identifies the affected artifacts that are needed to be regenerated. Running the analysis again only generates the missing or outdated artifacts, which is faster than to brute-force regenerate all artifacts. This feature of mrails facilitates the continuous and incremental certification approaches mentioned in [START_REF] Comar | Open-do: An open-source initiative for the development of safety-critical software[END_REF].

Mrails provides a web-based interface summarizing the results of jobs along with the status showing the validity of dependent artifacts (i.e. whether the source has changed and the artifacts are outdated). The advantage of this interface is that it can be used outside the MATLAB environment and helps in the reviewing process. In [START_REF] Hochstrasser | Application of a process-oriented build tool for flight controller development along a DO-178C/DO-331 process[END_REF], an example using mrails for flight control development is provided. Mrails interacts well with Continuous Integration (CI) by providing a simple MATLAB command-line interface that can be easily used on a CI server.

C. Continuous Integration

Continuous Integration (CI) is a common practice nowadays in software development. It provides the benefit of integrating features more frequently, e.g. daily, by automating building and testing as much as possible and detects integration errors in early stages. In our model-based software development process, we use CI to extensively automate the execution of model static analysis, simulation-based testing, unit testing and static analysis of manual source code. With Mrails, which was described in section III-B, the CI requires only minimum configuration since most of the tasks are as simple as running a job in Mrails. While many CI tools and services, e.g. Jenkins9 , Travis CI10 , provide similar generic features that are used in our process, we have chosen Gitlab CI/CD as CI tool because it is natively supported by the source control tool GitLab that was already in use at our institute.

Docker 11 containers are used to guarantee that the software testing environment is clean and reproducible. MATLAB Parallel Server can be applied to parallelize time-consuming simulations, such as Monte Carlo simulation. Currently, the CI servers are running on discarded desktop computers at the institute. However, one can also choose to run them in the cloud with Docker and Docker Machine 12 and gain scalability with minimum additional effort. Fig. 6 the overview of the CI process. Based on the contents of a new commit from the developers to the source control server, certain series of tests, which are mostly in the form of Mrails jobs, are triggered. The test results are automatically fed back to the developers via GitLab and to Polarion via the pre-configured links between the requirements, Design Models and the test cases that are described in section III-A. A git branch merge into the release or master branch will be rejected if the tests do not pass. This guarantees the quality of the software and allows merges to be performed more often without waiting for manual review. HIL simulations operate a unit-under-test within a representation of its real-world environment [START_REF] Bacic | On hardware-in-the-loop simulation[END_REF]. Therefore, a target which executes the developed software is connected to a real-time simulation of the later environment the target will be operating in. The basic concept of HIL uses the target's original interfaces for input stimulation from the simulation environment as well as for collecting the target's output into the simulation environment. Thus, a HIL simulation allows to evaluate the target's integrity under real world conditions like input-output interaction, real-time behavior, interface delays and jitters.

Certain objectives in DO-178C pertaining to the verification of Executable Object Code cannot be satisfied with simulation alone and need to be executed on the target environment [START_REF]Complete verification and validation for do-178c[END_REF]. A classical approach is the definition and creation of HIL test cases for requirements-based testing. These test cases are run in HIL simulation and demonstrate, if passed, that the software satisfies the requirements and can be considered as successfully verified [START_REF] Ray | Chapter 6 -functional and nonfunctional design verification for embedded software systems[END_REF].

Since HIL testing is a time-consuming process [START_REF] Ray | Chapter 6 -functional and nonfunctional design verification for embedded software systems[END_REF], already available test cases from previous verification methods are reused to reduce the implementation effort.

As already introduced in section III-A, test cases are created in Simulink Test and linked to the corresponding requirement.

These test cases are used to verify the functional software requirements implemented by the Design Model in Simulink via MIL simulations. To avoid additional effort in creating dedicated test cases for HIL simulation, thus also reducing an error prone manual transfer between MIL and HIL simulation test cases, Simulink Test Manger is used to execute identical MIL test cases in HIL. Besides streamlining the verification process by reducing manual effort, another benefit is that traceability between requirements and HIL test cases is automatically ensured as the test case itself is already linked to the requirement.

In order to be able to apply the same test case as MIL in HIL simulation, the connection of test case vectors to the Design Model's inputs and outputs, is substituted by a hardware interface between the development environment which is running the Simulink Test Manager and the HIL realtime simulation as shown in Fig. 7. We have used UDP communication between the Simulink Test Manager which is running the test cases test sequence and the HIL real-time simulation. UDP was selected as a standardized interface between physical machines which can be easily adapted to test cases depending on their input and output vectors also known as test data. Simulink furthermore directly provides a block-set for UDP communication. In our example, it is assumed that both the development environment and the HIL real-time simulation are on different computing units or physical machines. The software running on the target platform is receiving the same stimuli from the HIL realtime simulation as the design model receives during MIL simulation. The same holds for its outputs. Using this method, the MIL and HIL test case results are obtained from an identical test case and the results of both tests are supposed to be equivalent as long as the software is implemented correctly.

IV. LEVEL OF COMPLIANCE

DO-178C and DO-331 specify various activities, which should be implemented to achieve the objectives of these standards. The artifacts to be produced during the activities is specified in section 11 of DO-178C and DO-331. Some of the required activities and elements of the artifacts have considered as not applicable to the custom workflow. While implementing the custom workflow, we identified and assessed such inapplicable activities and artifact elements. If they were considered as reproducible without major rework of preexisting artifacts, we excluded them from the custom workflow. Examples are:

• Elements of the planning data intended for a formal certification process with certification authorities do not apply to the custom workflow (e.g. certification considerations and schedule, system and software description). • Activities of the configuration management process specific to the operation phase of the aircraft (e.g. software part numbering, load control and aircraft configuration records). We also omitted some activities, which cannot be efficiently automated with the tool, however, can be reproduced without major rework afterwards for formal certification. For example:

• Completeness of traceability between requirements, models, test cases and results was verified in the custom workflow using automated trace reports. However, manual verification of trace data for consistency and correctness was skipped as a time-consuming manual task, which can be implemented afterwards for formal certification. • Verification activities for LLS requirements which cannot be automated and need extensive manual review. Omitted activities or artifact elements resulted in partial compliance for some of the objectives implemented in the custom workflow. We identified the following levels of compliance for the selected objectives:

• Full when all activities associated with the objective implemented and artifacts produced • Partial when some activities associated with the objective are not fully implemented or artifact elements not produced. A summary of the compliance level achieved in the custom workflow is shown in Fig. 1 for DO-331 and Fig. 2 for DO-178C.

V. A CASE STUDY

The custom workflow explained above was applied to the development of an experimental Autopilot Manual Disconnection System (AMDS). The simplicity of the system ensured that a complete workflow from aircraft requirement authoring in Polarion down to HIL testing could be demonstrated with limited project resources.

Using AMDS, the pilot has aircraft command priority over the autopilot by having the ability to manually disconnect the autopilot at any time during the flight. External interfaces of AMDS are shown in Fig. 8. The pilots interact with the AMDS using two pushbuttons, one on each of the control inceptor. Under normal mode of operation, if any of the pushbutton is pressed, the system disconnects the autopilot within 100 ms by controlling the transmission clutch.

A control unit with two isolated and independent channels simultaneously processing the desired function is used. This redundancy ensures that a single failure doesn't lead to loss of primary function. The control unit also implements features typical for airborne controllers, including comprehensive builtin tests and operation-safe maintenance capabilities.

We developed the AMDS software according to the custom workflow and tools discussed in section III. After eliciting the requirements on Polarion as described in section III-A, the AMDS functionality is implemented in Simulink, whereas test cases assessing the temporal behavior and mode logics based on requirements are authored in Simulink Test. Trace data is created between Simulink models and Simulink test cases, and requirements on Polarion using SimPol.

During the development, we used mrails described in section III-B to execute code generation and all the model and code verification activities shown in Fig. 3 (excluding HIL testing which is implemented in a real-time environment). A snippet of mrails' status overview showing model coverage is given in Fig. 9. After pushing to Gitlab, the CI executes the whole set of tests and static checks to make sure that the modifications are ready to be merged.

The auto-generated software (MBS) is integrated with LLS and hardware which are reused from the real flight control computer (FCC) described in [START_REF] Nürnberger | Execution time analysis and optimisation techniques in the model-based development of a flight control software[END_REF]. Building the final loadable executable object code including both MBS and LLS parts is implemented in CI.

To satisfy target specific objectives of requirement-based testing, HIL simulations are performed using TechSAT ADS2 13 . As described in section III-D, MIL test cases are reused for HIL simulations using the UDP interface between HIL and Simulink environment. Equivalence between MIL, SIL and HIL cases have shown that the implemented software works as expected in the target environment and complies with requirements.

By implementing the proposed workflow for the AMDS

VI. FUTURE WORK

In future work we are planning on upgrading the developed prototype to DO-178C/DO-331 level A and estimate the efforts required to close the gap between the custom workflow and formal DO-178C/DO-331 certification. Another work in progress is applying the custom workflow to a more complex control system to study the compatibility of the approach with a full-scale development project.

For requirements management, we will evaluate the possibility to integrate FRET into Polarion as an extension. We will also apply the analysis capabilities of FRET for linear temporal logics. The custom widget of the automatic trace reports can also be used for coverage reports of model-based validation which will be part of our extended custom workflow. The uploaded test run records on Polarion are also not yet used for automatic verification reports but this will be implemented in the near future. It is also possible to configure Polarion to link manually written C/Java/XML code to work items. These links have not yet been included in the trace reports but they are planned for implementation in the future.

For CI integration, we plan to include automatic HIL tests on the HIL testbed with target hardware in the CI.

VII. CONCLUSIONS

The paper has introduced a lean, highly-automated and scalable software development workflow intended for prototype and experimental airborne systems. The proposed workflow is based on the subset of DO-178C and DO-331 objectives which we selected based on criteria of importance, available automation and reuse potential to streamline the development. Extensive automation of development and verification activities using the qualified model-based commercial toolchain along with the own custom tools and continuous integration environment was leveraged to reduce manual development effort while maintaining a high software quality. This custom workflow is aimed to be used a basis for potential future certification in full compliance with DO-178C/DO-331 without wide rework of the produced data.

Using the proposed custom workflow, we developed a small system prototype to study the advantages and limitations of this method. We showed that development fulfilling the selected DO-178C objectives using the custom workflow can reduce development efforts by about 50% comparing to average metrics observed in the industry for DO-178C level software. Yet, a high software quality was achieved with respect to the number of bugs detected and compliance to coding guidelines.

We plan in our future work to estimate the efforts needed to close the gap between the custom workflow and level A software development and also explore the relevance of the workflow to a full-scale development of a complex system.

Fig. 1 .

 1 Fig. 1. DO-331 Compliance Summary for Model-based Software

Fig. 2 .

 2 Fig. 2. DO-178C Compliance Summary for Low-level Software

4 .

 4 Fig. 5. Requirement, Model and Test Case Linking

Fig. 6 .

 6 Fig. 6. Continuous Integration Overview

Fig. 7 .

 7 Fig. 7. HIL Environment

Fig. 8 .

 8 Fig. 8. External Interfaces of AMDS

Fig. 9 .

 9 Fig. 9. Mrails Status Window

•

  Level of automation for objective implementation• Level of potential reuse of objective data (artifacts)

	Importance of the objective was evaluated based on
	following factors:
	1) In DO-178C, the objectives that need to be satisfied
	during software development depend on software Levels
	A to E resulting from the safety assessment process.
	Level A corresponds to the most critical Catastrophic
	failure condition category and requires most objectives
	to be satisfied with maximum rigor while Level E corre-
	sponds to No Safety Effect and requires no objectives to
	be satisfied. Objectives applicable to all software levels
	from A to D are considered more important than the
	objective assigned to only higher levels (i.e. level C or
	higher). Examples include the definition of high-level
	software requirements and testing of executable object
	code for compliance with high-level requirements.
	2) Relevance of the objectives to other aerospace and
	non-aerospace software development standards (ASTM
	F3201 [7], ISO 26262-6 [11], ISO 26262-8 [12], EN
	50128 [13] have been considered). For example, trace-
	ability down to source code is not required by DO-
	178C/DO-331 for Level D, but EN 50128 and ISO
	26262-8 recommend the complete traceability down to
	source code.
	Level of automation was another key factor for selecting
	the objectives for the custom subset. If the objective can
	be automated using a tool, it can help to improve overall
	software quality without significant increase of manual efforts.
	Examples include:
	• Requirements verification objectives (tables MB.A-3 and
	MB.A-4 of DO-331) which can be substantially au-
	tomated for model-based software (MBS) components
	leveraging model simulation. Test cases and procedures
	developed for model simulation can be further seamlessly
	reused for executable code testing.
	• Code verification objectives (table A-5/MB.A-5 of DO-
	178C/DO-331). These objectives are not applicable to
	lower software levels (Level D and below) and hence
	are not assigned with high importance as per the cri-
	teria above. However, they can be efficiently automated
	leveraging Simulink Code Inspector 1 [14], Polyspace Bug
	Finder 2 and Polyspace Code Prover 3 tools with very little
	additional manual effort.
	• Objectives for code structural coverage (table MB.A-7
	of DO-331), which can be automated for MBS code,
	reusing the test cases for model simulation and applying
	the Simulink Coverage tool

https://www.mathworks.com/products/simulink-code-inspector.html

https://www.mathworks.com/products/polyspace-bug-finder

https://www.mathworks.com/products/polyspace-code-prover

https://www.mathworks.com/products/simulink-coverage

https://www.ansys.com/products/embedded-software/ansys-scade-suite

https://www.mathworks.com/products/simulink-test.html

https://www.mathworks.com/products/simulink-design-verifier

https://www.mathworks.com/products/simulink-check

https://www.jenkins.io/

https://travis-ci.com/

https://www.docker.com/

https://docs.docker.com/machine/

https://techsat.com/technology-and-products/ads2/


Nicolas Passat

Camille Kurtz

Antoine Vacavant

Editorial -Virtual Special Issue: "Hierarchical Representations: New Results and Challenges for Image Analysis"

Image representations based on hierarchical, scale-space models and other non-regular grids have become increasingly popular in various image processing and computer vision tasks over the past decades. Indeed, they allow a modeling of image contents at different, complementary levels of scales, resolutions and semantics. Methods based on such image representations have been able to tackle various complex challenges such as multi-scale image segmentation, image filtering, object detection, recognition, and more recently image characterization and understanding, potentially involving higher semantic levels. This Virtual Special Issue, entitled "Hierarchical Representations: New Results and Challenges for Image Analysis" was opened to extended and updated versions of papers published at the recent ICPRAI 2018 conference 1 , as well as any submission proposing innovative methods in the field of image representation with emphasis on computer vision and image processing, medical imaging, 2D and 3D imaging, multi-modality, remote sensing image analysis, image indexation and understanding.

The main topics of this Virtual Special Issue include, but are not limited to:

• image decomposition on the basis of frequency spaces (Fourier, wavelets, etc.);

• hierarchies linked to the image space, mathematical morphology, connected operators;

• scale-space representations;

• non-regular / irregular grid image representations;

1 https://users.encs.concordia.ca/ ~icprai18

• multi-scale representation in computer-vision;

• evaluation of hierarchical image representations.

The aim of this Virtual Special Issue is to popularize the use of hierarchical methods in image processing and analysis. Indeed, although these methods have become very popular in computer vision over the last 20 years, their potential impact is largely underexploited.

Contributions

We received 36 high-quality manuscripts from 17 different countries all around the world (Brazil, Canada, China, France, Germany, Hungary, India, Israel, Japan, Lithuania, the Netherlands, Singapore, Spain, Sweden, United Kingdom, USA, Vietnam), emphasizing the international interest of the community for the topics of hierarchical representations.

Each of them was reviewed by two referees, according to the guidelines and standards of the Pattern Recognition Letters journal. Finally, 23 manuscripts were selected for publication in this Virtual Special Issue.

Hereinafter, we briefly point out and summarize these articles, that have been published in different volumes of Pattern Recognition Letters, edited in 2019 and 2020.

Hierarchical representations often require to use specific data-structures, most often trees. The following contributions are geared towards optimizations of existing data-structures, or even the development of new ones. [START_REF] Silva | Incremental bit-quads count in component trees: Theory, algorithms, and optimization[END_REF] focus on the computation of node attributes in the component-tree. They present a review of a previously published method to compute such attributes, by incrementally counting patterns while traversing nodes of the component tree.

The method foundation is detailed by presenting a novel theoretical background and algorithm correctness intuition. Algorithmic improvements for run-time execution and precision analysis are also proposed. [START_REF] Morimitsu | Efficient component-hypertree construction based on hierarchy of partitions[END_REF] propose an improved way of building the component-hypertree (that generalizes the concept of component-tree to multiple, increasing neighborhoods). They present some properties used to obtain optimized neighborhoods for component-hypertree computation. From these properties, they explore a new strategy to obtain neighboring elements based on hierarchy of partitions, leading to a more efficient algorithm. [START_REF] Ouzounis | Segmentation strategies for the alpha-tree data structure[END_REF] proposes two new ways of building an alpha-tree, namely the non-target clustering and attribute maximization strategies, that give access to segments that could not be defined with previous variants of alpha-tree constructions. Collectively they enable the handling of texture-rich regions that cannot be clustered into meaningful segments, and compute the unsupervised segmentation of images by seeking for extreme attribute values. [START_REF] Gigli | On minimum spanning tree streaming for hierarchical segmentation[END_REF] investigate the construction of the minimum spanning tree in streaming for images. They focus on the problem of computing a minimum spanning tree of the union of two graphs with a non-empty intersection. They show how the solution to that problem can be applied to streaming images, by decomposing the data into a stable part and an unstable part that needs further information before becoming stable. The correctness of the proposed algorithm is proven and the approach is applied to a hierarchical morphological segmentation task. [START_REF] Alves | Image segmentation based on ultimate levelings: From attribute filters to machine learning strategies[END_REF] investigate ultimate levelings, a family of operators that extract image contrast information from a scalespace based on levelings. They introduce a new hierarchical structure, called residual tree, to discriminate relevant regions vs. undesirable regions from ultimate levelings. From this structure, they extract attribute vectors, which can be involved in image processing and machine learning approaches. [START_REF] Huynh | Connected filters on generalized shape-spaces[END_REF] introduce an extension of the tree-based shape-space for segmentation of objects of interest made of many connected components. Building upon the concept of second-generation connectivity and tree-based shape-spaces, they propose an extension of the usual shape-space paradigm into a generalized shape-space. This new paradigm allows to analyze any graph of connected components hierarchically and to filter them thanks to connected operators.

The following contributions aim at modifying, simplifying or combining trees. [START_REF] Damiand | Merge-and-simplify operation for compact combinatorial pyramid definition[END_REF] propose a simplification strategy for the combinatorial pyramids, that provide topological information at different levels of details, at the cost of a high memory consumption. They define a compact version of combinatorial pyramids, based on the definition of a new operation that simultaneously merges regions and simplifies their boundaries. This approach leads to a new representation that uses less memory space and improve computation time. [START_REF] Perret | Removing non-significant regions in hierarchical clustering and segmentation[END_REF] propose an efficient algorithm that removes unimportant regions from a hierarchical partition tree, whereas preserving the hierarchical partition structure. The re-gions of the simplified hierarchy are regions or unions of regions of the initial hierarchy. The method can be used as a preor post-processing step to enhance the quality of hierarchical segmentation algorithms. [START_REF] Adão | Learning to realign hierarchy for image segmentation[END_REF] propose an approach dedicated to realign a tree modeling an image so that every region containing an object (or its parts) is at the same level. They explore the use of regression models to predict score values for regions belonging to a hierarchy of partitions, which are used to realign it. They also propose a new score calculation and a new assessment strategy considering all user-defined segmentations that exist in the ground-truth.

Santana Maia et al. ( 2019) study the problem of combinations of hierarchical watersheds, that can be characterized through binary partition trees. After analyzing which combinations evaluated in a previous work result in flattened (simplified) hierarchical watersheds, they provide a sufficient condition for a combination to always output flattened hierarchical watersheds, and a new combining function that outputs flattened hierarchical watersheds.

The following contributions propose new methods that build upon hierarchical data-structures for various image processing and analysis purposes.

Grossiord et al. ( 2020) use component-trees for analyzing Positron Emission Tomography (PET) images in the context of oncology. They show that the second-order paradigm of shaping, which broadly consists of computing the component-tree of a component-tree, provides a relevant way of generalizing the threshold-based strategies classically used by medical practitioners for handling PET images. [START_REF] Brandt | Efficient binocular stereo correspondence matching with 1-D max-trees[END_REF] propose a stereo matching method for applications where limited computational and energy resources are available. The algorithm is based on a hierarchical representation of image pairs by max-trees, which is used to restrict disparity search range. They propose a cost function that takes into account region contextual information and a cost aggregation method that preserves disparity borders. Such a method is suitable for use on embedded and robotics systems. [START_REF] Tuna | Component trees for image sequences and streams[END_REF] investigate the ways to represent and analyze image sequences with morphological hierarchies. A review of different strategies to build spatial, temporal and spatial-temporal hierarchies from an image sequence is provided. They propose algorithms to update such trees when new images are appended to the series and they compare them with tree building from scratch. They apply these approaches for the min-and max-tree on grayscale data provided by satellite image time series.

Beyond the actual data-structures, the underlying concepts of scale-spaces and space of hierarchies are also explored by the following contributions. [START_REF] Molina-Abril | Generating (co)homological information using boundary scale[END_REF] investigate a new boundary scalespace theory. They introduce the homology boundary scalespace (hbss) model that consists of a hierarchical graph whose nodes are the homology generators of the different boundary scale levels and whose edges are specified by homology generators of consecutive boundary scale indices linked by preserving homology classes. Various codes for each connected sub-graph of an hbss model are defined, which besides being fast and efficient similarity measures for cellular structures, are also relevant interpretive tools for the hbss-model. [START_REF] Fehri | Combinatorial space of watershed hierarchies for image characterization[END_REF] propose a framework for image characterization using hierarchies of segmentations. They organize the space of hierarchies using the Gromov-Hausdorff distance, and they explore different ways of combining hierarchies and study their properties thanks to this distance. They expose how to leverage the combinatorial space of hierarchies to derive efficient image representations, opening a path for a controlled exploration of the combinatorial space of hierarchies.

Cayllahua Cahuina et al. ( 2020) investigate hierarchical segmentation based on the Felzenszwalb-Huttenlocher dissimilarity that computes for each edge of a graph the minimum scale in a hierarchy at which two regions linked by this edge should be merged. They provide an explicit definition of the (edge-) observation attribute and Boolean criterion that are at the basis of this method. Then, the authors propose an algorithm to compute all the scales for which the criterion holds true. Finally, they propose new methods to regularize the observation attribute and criterion and to set up the observation scale value of each edge of a graph.

Multiscale analysis is also an important topic, studied from various points of view in the following contributions.

Sahu and Chowdhury (2020) address two problems in egocentric video analysis: generating multiscale summaries, and priority-based ranking of various actions present in such videos. A new algorithm, Multiscale Egocentric Video Summarization and Action Ranking, with agglomerative clustering as its backbone, is proposed to tackle the above problems. This algorithm follows an "analyze once, generate many" principle to generate multiple summaries in a single run and subsequently rank actions from the generated summaries. Nguyen et al. (2020b) propose a method to overcome issues that negatively impact on encoding chaotic motions for dynamic texture representation. After a multiscale Gaussianbased kernel pre-processing pointing out robust and invariant features, the Local Rubik-based Pattern is introduced to capture both shape and motion cues of dynamic textures. In addition, they also address a novel thresholding to take into account rich spatio-temporal relationships extracted from a new model of neighborhood supporting region. [START_REF] Giraud | Multi-scale superpatch matching using dual superpixel descriptors[END_REF] introduce the dual superpatch, a novel superpixel neighborhood descriptor. This structure contains features computed in reduced superpixel regions, as well as at the interfaces of multiple superpixels to explicitly capture contour structure information. A fast multi-scale non-local matching framework is introduced for the search of similar descriptors at different resolutions in an image dataset. The proposed dual superpatch enables to accurately capture similar structured patterns at different scales and can be involved in supervised labeling applications. [START_REF] Bejar | Efficient hierarchical graph partitioning for image segmentation by optimum oriented cuts[END_REF] propose a hierarchical graph partitioning based on optimum cuts in graphs. This method encompasses as a particular case the single-linkage algorithm by minimum spanning tree and gives superior segmentation results compared to other approaches, usually requiring a lower number of im-age partitions to accurately isolate the regions of interest with known polarity. The method is supported by new theoretical results involving the usage of non-monotonic-incremental cost functions in directed graphs and exploits the local contrast of image regions.

Finally, hierarchical representations are also investigated in the field of deep neural networks, in the following contributions. [START_REF] Ak | Semantically consistent text to fashion image synthesis with an enhanced attentional generative adversarial network[END_REF] introduce an enhanced Attentional Generative Adversarial Network, for semantically consistent hierarchical text-to-image synthesis. An integrated attention module utilizes both sentence and word context features and performs feature-wise linear modulation to fuse visual and natural language representations. Several enhancements are proposed to improve image quality and text/image similarity whereas stabilizing the training. Nguyen et al. (2020a) tackle the issue of handwritten mathematical expressions analysis. They propose a method based on CNNs to extract the representations for an handwritten mathematical expression. Symbols in various scales are located and classified by a combination of features from a multi-scale CNN. The authors use weakly supervised training combined with symbols attention to enhance localization and classification predictions. Then, they propose a multi-level spatial distance between two representations for clustering purposes. [START_REF] Radvanyi | Peeling off image layers on topographic architectures[END_REF] explore the automatic detection of information patterns. They propose a general, task independent method that locates interesting patterns on binary images by creating a hierarchical layered structure based on neighborhood topography of connected components, and identifies object groups applying saliency principles. The proposed algorithm mostly contains standard topographic instructions and can then be implemented on processor arrays.


Amal El-Ghazaly

J Gorchon

Richard B Wilson

Akshay Pattabi

Jeffrey Bokor

Progress towards ultrafast spintronics applications

published or not. The documents may come

This is a PDF file of an article that has undergone enhancements after acceptance, such as the addition of a cover page and metadata, and formatting for readability, but it is not yet the definitive version of record. This version will undergo additional copyediting, typesetting and review before it is published in its final form, but we are providing this version to give early visibility of the article. Please note that, during the production process, errors may be discovered which could affect the content, and all legal disclaimers that apply to the journal pertain.

• ∆ ∼ ∆ ∆ ∆ ∆ ∼ ∆ 1/∆t ∼ ∆ ∼ > ∼ ∼ ∆T ep E g ep ∆T ep ≈ σE 2 g ep σ ∼ σ ≈ 10 6 S/m g ep ≈ 10 18 W m -3 µ µ µ µ ∼ ∼ E ∼ 10 7 V /m

  article as: A. El-Ghazaly, J. Gorchon, R.B. Wilson, A. Pattabi, J. Bokor, Progress Towards Ultrafast Spintronics Applications, Journal of Magnetism and Magnetic Materials (2020), doi: https://doi.org/10.1016/ j.jmmm.2020.166478

∆ ∼ µ µ µ µ µ ∼ ∼


MD Sophie Delplanque

MD Maela Le Lous

Marie Fl Évin

MD Estelle Bauville

MD Pierre Yves Moquet

MD Ludivine Dion

MD Arnaud Fauconnier

Sonia Gu

MD Jean Leveque

Vincent Lavou

Nyangoh Krystel
email: krystel.nyangoh.timoh@chu-rennes.fr

Timoh

MD Marie Flévin

MD Sonia Guérin

MD Vincent Lavoué

MD Krystel Nyangoh Timoh

Doctor Nyangoh Timoh

Effectiveness of conservative medical treatment for non-tubal ectopic pregnancies: a multicenter study

Keywords: Cesarean scar pregnancy, Interstitial pregnancy, Local methotrexate, Non-tubal ectopic pregnancy, Systemic methotrexate

Effectiveness of conservative medical treatment for non-tubal ectopic pregnancies a multicenter study

Introduction

Ectopic pregnancy (EP) accounts for 1 to 2 % of all pregnancies. The term EP includes tubal ectopic pregnancy [START_REF] Skubisz | Combination gefitinib and methotrexate compared with methotrexate alone to treat ectopic pregnancy[END_REF][START_REF] Marret | Overview and guidelines of off-label use of methotrexate in ectopic pregnancy: report by CNGOF[END_REF], which is the most common form, and non-tubal ectopic pregnancy (NTEP), which is rare and accounts for fewer than 10% of all EPs [START_REF] Barnhart | Clinical practice. Ectopic pregnancy[END_REF][START_REF] Bouyer | Sites of ectopic pregnancy: a 10 year population-based study of 1800 cases[END_REF][START_REF] Hunt | Management of non-tubal ectopic pregnancies at a large tertiary hospital[END_REF][START_REF] Panelli | Incidence, diagnosis and management of tubal and nontubal ectopic pregnancies: a review[END_REF].. Compared with TEPs, they are associated with a higher mortality, life-threatening hemorrhage and emergency surgery such as hysterectomy [START_REF] Parker | Non-tubal ectopic pregnancy[END_REF][START_REF] Petersen | Cesarean scar pregnancy: a systematic review of treatment studies[END_REF]. Recent advances in imaging techniques have facilitated earlier diagnosis, which allow non-surgical treatment for patients with few symptoms or nonlife threatening NTEP.

In the setting of NTEP, because of its low incidence, no consensus exists for the therapeutic management. Case series indicate that minimally invasive management like local (or "in situ") injection of MTX can be safe and effective in the setting of NTEP, but also systemic MTX [START_REF] Ramkrishna | Comparison of management regimens following ultrasound diagnosis of nontubal ectopic pregnancies: a retrospective cohort study[END_REF].

In contrast, the therapeutic strategy for TEP is well codified and a high success rate (82% to 95%) is obtained with injection of systemic methotrexate (MTX) which constitutes the standard medical treatment [START_REF]ACOG Practice Bulletin No. 94: Medical management of ectopic pregnancy[END_REF].

We conducted a retrospective study to assess the efficacy of conservative medical management of NTEP in a large multicentric case series.

J o u r n a l P r e -p r o o f

Materials and Methods

Study Design

We conducted a multicenter retrospective study from January 2008 to March 2018 at University Hospital of Rennes, the Intercommunal Hospital of Poissy, and La Sagesse Medical Center (Rennes), France. The study was approved by the Ethics Committee of the National College of the French Gynecologists and Obstetricians (CEROG 2018-GYN-1201).

Patients

We included women aged over 18 years who had been diagnosed with interstitial (IP), cervical (CP), cesarean scar (CSP) or ovarian (OP) pregnancies (figure 1) by 2D or 3D ultrasonography and managed by primary medical treatment. Patients managed by primary surgery were excluded as well as patients with tubal, cornual (i.e pregnancy developed in the horn of a uterus with congenital malformation), or abdominal pregnancy.

The cases were identified using the PMSI (the French hospital medical information system) diagnostic code for "ectopic pregnancy" for patients consulting with gynecological emergencies of the three departments. All cases were reviewed and classified according to the location of the pregnancy if the NTEP was confirmed by ultrasound findings.

Management of NTEP

Choice of therapeutic option

Therapeutic

J o u r n a l P r e -p r o o f

All the patients were monitored clinically and biologically at least weekly, with control of hCG levels until the level fell below 5UI/L. A pelvic ultrasound was systematically performed on the 7th day or in the case of symptoms or stagnation of hCG, and at resolution.

Expectant management (EM):

This approach was reserved for patients with no or few symptoms and consisted of a weekly clinical exam and hCG monitoring until resolution.

Systemic injection of MTX (IM-MTX):

Patients with normal pre-therapeutic lab workup were eligible for IM-MTX. The dose of MTX used was 50 mg/m2 of the body surface area.

Local injection of MTX (L-MTX):

Similarly, patients eligible for L-MTX had to have a normal pre-therapeutic lab work-up. The dose of MTX used was 1 mg/kg or 50 mg/m 2 body surface area according to the operator. The approach was either laparoscopic or utrasoundguided transvaginal under local or general anesthesia depending on the location of the pregnancy, its accessibility via the vaginal route and the clinical condition of the patient. The vaginal approach was the preferred route when possible. All L-MTX procedures began with mechanical aspiration of the contents of the gestational sac, followed by slow installation of MTX. The material used included a 16 or 18G oocyte puncture needle for the ultrasoundguided transvaginal route, and an 18G catheter for the laparoscopic approach.

Combined MTX injection (C-MTX):

This approach consisted of IM-and L-MTX administration on the same day at a dose of 1 mg/kg per injection. The pre-therapeutic lab work-up had to be normal.

Local injection of hyperosmolar glucose serum:

This protocol was the same as for L-MTX using a dose of hyperosmolar (30%) glucose solution.

Oral misoprostol:

The dosage was six 200μg tablets divided into three intakes at 4 hourly intervals

Additional treatments

Additional treatments were decided on by the medical team and included:

J o u r n a l P r e -p r o o f Medical treatment: An additional treatment by injection of MTX, systemic or local, was carried out if the hCG level had increased, stagnated or decreased by < 15% of the initial level on the 7th day, or when the pregnancy was found to be progressing on ultrasound.

Surgical management:

A surgical procedure was performed if trophoblastic retention tissue was diagnosed on ultrasound, or if there was suspicion of a rupture. The specific approach was decided on according to the clinical status of the patient and the location of the pregnancy.

Endpoints

The primary endpoint was the final success rate of the conservative medical treatment for NTEP. Management was considered to be successful when the hCG level had dropped to < 5 IU/L. Failure was defined by the need for emergency surgical treatment for life-threatening hemorrhage.

Secondary endpoints were: evaluation of initial success; i.e. success of the primary management (without any additional medical or surgical treatment).

Collected data

Data were collected from ultrasound image archives or imaging reports, and review of the electronic or paper medical records.

Gestational age was determined according to the last menstrual period and ultrasound findings.

The hCG monitoring values were collected and time to hCG and ultrasound resolution recorded on successful management.

The time to hCG and imaging resolution, time to obtain a decrease of ≥ 15% in hCG, treatment toxicity and complications, and the obstetric outcome are also reported.

Complete sonographic resolution was defined by the absence of a gestational sac without trophoblastic retention or any other anomaly on transvaginal ultrasound.

Statistical analysis

J o u r n a l P r e -p r o o f

Statistical analysis was based on the Student's t test for continuous variables, and the Chi-square test for categorical variables, as appropriate. A P-value < 0.05 were considered to denote significant differences.

J o u r n a l P r e -p r o o f 3. Results

Characteristics of the patient population

During the study period, 76 patients were diagnosed with NTEP. Twelve patients were excluded: one because of an abdominal pregnancy diagnosed in the 2nd trimester and 11 because of a first-line surgical management. Finally, 64 patients with conservative medical management of NTEP were included. Of these, 37 (57.8%) had an IP, 23 (35.9%) had a CSP, two (3.1%) had a CP, and two (3.1%) had an OP (Figure 2). The mean follow-up time was 41 months.

The characteristics of the study population are summarized in Table 1.

The median maternal age was 32 years ,. The median gestational age at diagnosis was 6.4 gestational weeks (GW) (4-12).

Clinical symptomatology

The most frequent symptomatology was the combination of metrorrhagia and pelvic pain ( 22(34.4%) patients. Fourteen (21.9%) patients had no symptoms.

Laboratory findings

The median hCG level was 6089 IU/L (56-109740) at time of diagnosis of NTEP.

Characteristics of NTEP on imaging

The median of the largest diameter of the GS was 22 millimeters (2-66). (Figure 3).

NTEP management (Table 2)

The overall final success rate of conservative management was 92% (59/64).

The overall initial success rate of conservative management was 57,8% (37/64). The median time for hCG resolution was 45 (21-112) days and for NTEP disappearance on pelvic ultrasound 3.3 months (1-6).

Expectant management (EM)

J o u r n a l P r e -p r o o f

Six patients (9.4%) had a first-intention EM. The initial success rate was 50% (3/6). The final success rate was 100% (6/6). Two (33.3%) patients had an additional effective L-MTX injection because of HCG stagnation. One patient (16.7%) with a CSP underwent second-line surgery (dilatation and curettage) for vaginal bleeding with retention. The average time for ultrasound resolution was 4.5 months.

Systemic MTX injection (IM MTX) management

Twenty-four (37.5%) patients had first-intention IM-MTX. Initial primary management success was observed for 10 patients (41.7%). The final success rate was 87.5% (21/24).

Four (4/24, 16.7%) patients had second-line surgical management (laparoscopic cornual resection for three IPs and ovariectomy by laparotomy for one OP) because of NTEP rupture for the OP and 2 IPs, and for evolution of the pregnancy for one IP despite the IM-MTX injection.

Local MTX (L-MTX) injection management

Twenty-eight patients (43.8%) had first-intention L-MTX management. The injections were performed by laparoscopy for 11 patients (39.3%) and by transvaginal-guided ultrasound for the remaining 17 (60.7%). Initial primary management success was obtained for 18 (64.3%) patient. The median time for hCG resolution was 54 days (21-91) and for a drop of ≥ 15% in hCG level 12 days. The median time for ultrasound resolution was 3.5 months (1-6).

Final success rates were 96,4% (27/28). One patient had a NTEP rupture treated by laparoscopic cornual resection.

Other managements :

Datas are shown table 2.

Predictive factors

No predictive factors for medical conservative management were found (table 3)

1.3.
Failure management.

J o u r n a l P r e -p r o o f

Rupture of the NTEP occur for five (5/9, 55%) patients. Three (one OP and 2 IPs) occurred during the IM-MTX follow-up (12,5%, 3/24), another (IP) occurred immediately after the L-MTX injection by laparoscopy (1/28, 3,5%), and the last (CSP) after misoprostol management.

No hysterectomies were performed.

Toxicity

Two (3.5%, 2/58) patients had serious side effects: one hepatic cytolysis and oral aphtosis (after C-MTX injection) and the other a hepatic cytolysis (after a unique L-MTX injection).

Hepatic function returned to normal spontaneously in both cases.

1.5.

Long term follow-up:

Trophoblastic retention

Four patients (6.3%) had trophoblastic retention.

Subsequent pregnancies

Twenty-four patients (37.5%) had 32 subsequent pregnancies, including 20 live births. The median time to pregnancy was 24 (6-72) months after resolution of the NTEP. Seven miscarriages were recorded (21.9%), three (9.4%) recurrences of EP (one tubal EP and 2 NTEP) and one (3.1%) elective abortion. Ten (50.0%) patients had a vaginal delivery and nine (45.0%) a cesarean section. One patient (5%) had an artificial placental delivery for postpartum hemorrhage. No neonatal complications were found although five (25.0%) newborns were small for their gestational age. Among the 13 patients with prior infertility, two (15.4%) of them had a pregnancy including one recurrence of an IP and one live birth.

J o u r n a l P r e -p r o o f

Discussion

Main Findings

This study provides evidence to support that conservative medical management is highly effective with several MTX injections and safe to treat patients with NTEP with no or few symptoms wishing to preserve their fertility with a low risk of secondary surgery.

Strengths and limitations

We present a large series of 64 NTEPs managed by medical conservative treatment in a view to analyze the final successful outcomes (without emergency surgery) of conservative medical treatments. This was a pragmatic choice because the aim of conservative management is to avoid emergency surgery. Our study has some limitations. First, the final success rate does not evaluate the effectiveness of each type of management. This is why we took initial success as a secondary endpoint. Second, it was a retrospective study with a risk of bias such as loss of data and loss to follow-up. Nevertheless, the main information concerning the management of NTEP was collected without any loss. Third, its retrospective nature means that it was not possible to compare the initial success of IM-MTX and L-MTX as the pregnancies in the L-MTX were more advanced. Finally, although the inclusion of three centers gave a good-sized patient sample in this rare condition, routine patient management varied from center to center which also hindered comparison.

Interpretation

The final success rate for all the conservative medical managements was 92.2% and the initial success rate was 54.7%. These results are consistent with the literature [START_REF] Ramkrishna | Comparison of management regimens following ultrasound diagnosis of nontubal ectopic pregnancies: a retrospective cohort study[END_REF][START_REF] Cassik | Factors influencing the success of conservative treatment of interstitial pregnancy[END_REF][START_REF] Cheung | Local Methotrexate Injection as the First-line Treatment for Cesarean Scar Pregnancy: Review of the Literature[END_REF][START_REF] Alalade | Evidence-based management of nontubal ectopic pregnancies[END_REF]. The rate of second-intention surgery is similar to the other studies [START_REF] Hiersch | Effectiveness of medical treatment with methotrexate for interstitial pregnancy[END_REF][START_REF] Lau | Conservative medical and surgical management of interstitial ectopic pregnancy[END_REF]. Contrary to some studies, no hysterectomy was necessary [START_REF] Ramkrishna | Comparison of management regimens following ultrasound diagnosis of nontubal ectopic pregnancies: a retrospective cohort study[END_REF].

The initial success rate for IM-MTX in our series was 41.7%, which is lower than that usually reported. However, heterogeneity in study protocols and definitions of success somewhat complicates comparison between studies. In addition, several studies evaluate the efficacy of J o u r n a l P r e -p r o o f multiple MTX injections which is around 66% and 100% [START_REF] Cassik | Factors influencing the success of conservative treatment of interstitial pregnancy[END_REF][START_REF] Bodur | The efficacy of the systemic methotrexate treatment in caesarean scar ectopic pregnancy: A quantitative review of English literature[END_REF][START_REF] Jermy | The conservative management of interstitial pregnancy[END_REF]. We found an initial success rate of 64.3% for L-MTX and a final success rate of 96.4%, which is similar to findings in literature, ranging from 70% to 100% [START_REF] Cassik | Factors influencing the success of conservative treatment of interstitial pregnancy[END_REF][START_REF] Cheung | Local Methotrexate Injection as the First-line Treatment for Cesarean Scar Pregnancy: Review of the Literature[END_REF][START_REF] Kim | Therapeutic outcomes of methotrexate injection in unruptured interstitial pregnancy[END_REF][START_REF] Verma | Conservative management of nontubal ectopic pregnancies[END_REF][START_REF] Yamaguchi | Transvaginal methotrexate injection for the treatment of cesarean scar pregnancy: efficacy and subsequent fecundity[END_REF][START_REF] Tanigaki | Successful Treatment of Caesarean Scar Pregnancies by Local Treatment Only[END_REF]. To achieve success, 37,5% of patients have additional MTX injection after IM-MTX management. After L-MTX injection, 28,5% of patients have one additional injection to achieve success. For EP, only 22,5% of patients achieve success with one dose [START_REF] Marret | Overview and guidelines of off-label use of methotrexate in ectopic pregnancy: report by CNGOF[END_REF].

In current practice, the choice between systemic or local injection of MTX is still a matter of debate. There is a theoretical risk of per-or postoperative bleeding at the injection site for local injection and this was experienced by one (3.6%) patient in our series. The initial success rate was higher for L-MTX than for IM-MTX without reaching significance. Furthermore, the term of pregnancy and hCG levels were statistically higher in the L-MTX group rendering comparisons unrealistic. This can be explained by the strategy adopted by the medical team and practitioner's choice: L-MTX requires an obvious target lesionand would therefore be a more popular choice for later term pregnancies. In our study, the initial success rate of L-MTX for IPs was significantly higher than IM-MTX whereas this difference was not identified for CSPs.

Nevertheless, to our knowledge, no other study has found this difference. Overall then, we are unable to conclude whether one injection modality of MTX is more effective than the other.

This point deserves to be evaluated in prospective randomized studies. Nevertheless, 12.5% of the "lower" risk IM-MTX patients (3/24) had ruptured ectopics versus 3.6% (1/28) in the much "higher" risk patients in the L-MTX group. This data speaks to the more effective L-MTX therapy.

The choice of the first intention surgical management is still possible because of a high success rate. However, in the review of Mayeux et al, no comparison of treatment options between medical or surgical management was possible [START_REF] Maheux-Lacroix | Cesarean scar pregnancies: a systematic review of treatment options[END_REF]. Surgical management can lead to hemorrhage and hemostasis hysterectomy risk with fertility impairment of these patients of childbearing age. In the present study, we present high final success rate with IM-MTX and L-MTX injection with only (7,8%) emergency surgery for 5 patients. No hysterectomy was J o u r n a l P r e -p r o o f performed. For EP, 5,8% of patients require additional surgery after MTX treatment [START_REF] Marret | Overview and guidelines of off-label use of methotrexate in ectopic pregnancy: report by CNGOF[END_REF]. Thus, even if it is necessary to carry out several injections, this study highlight that medical management seems to be the best option to propose in first intention provided that it is under close supervision.

Fertility preservation is a major issue for women presenting with NTEP. Further studies must focus on this point J o u r n a l P r e -p r o o f

  options included: expectant management (EM), systemic (intramuscular) injection of MTX (IM-MTX), local injection of MTX (L-MTX), combined injection (systemic and local) of MTX (C-MTX), local injection of hyperosmolar glucose, or oral misoprostol. The therapeutic option was chosen by the physician based on the patient's symptomatology, the location of the pregnancy and the hCG level. Similarly, the on-call physician decided whether or not to prescribe adjuvant treatment depending on the decrease in hCG levels and progression of the patient's symptoms.

Figure 1 :

 1 Figure 1: The classification and prevalence of ectopic pregnancies J o u r n a l P r e -p r o o f

Figure 2 :

 2 Figure 2: Flowchart original study

Figure 3 :

 3 Figure 3: Cesarean scar and interstitial pregnancy

  r n a l P r e -p r o o f

Table legends Table 1 : Patient characteristics of the study population

 legends1

		Total N = 64
	Epidemiologic Characteristics
	Median maternal age (years) (min-max)	32 (22-45)
	Median gravidity (min-max)	3 (1-11)
	Median parity (min-max)	1 (0-5)
	Median BMI (kg/m 2 ) (min-max)	25.9 (16.7-40.6)
	Risk factor for ectopic pregnancy
	Smoking Tabaco n (%)	10 (15.6)
	Age > 35 years n (%)	19 (29.7)
	Intrauterine device n (%)	5 (7.8)
	Progesterone-only pill / Implant n (%)	0 (0)
	History of ectopic pregnancy n (%)	18 (28.1)
	History of pelvic inflammatory disease n (%)	2 (3.1)
	Previous Infertility n (%)	13 (20.3)
	Assisted reproduced techniques n (%)	12 (18.8)
	History of endometriosis n (%)	2 (3.1)
	Previous miscarriages n (%)	22 (34.4)
	Previous dilatation and curettage n (%)	17 (26.6)
	History of uterine surgery n (%)	2 (3.1)
	History of pelvic surgery n (%)	31 (48.4)
	Previous cesarean section n (%)	31 (48.4)
	History of uterine fibroids n (%)	7 (10.9)
	History of congenital uterine malformation n (%)	1 (1.6)
	Diagnostic characteristics
	Median gestational age on diagnosis (gestational weeks) (min-max)	6.4 (4-12)
	Clinical:
	No symptoms n (%)	14 (21.9)
	Pelvic pain n (%)	16 (25)
	Metrorrhagia n (%)	11 (17.2)
	Metrorrhagia and pelvic pain n (%)	22 (34.4)
	Hemodynamically unstable n (%)	1 (1.6)
	Laboratory results:
	Median hCG (IU/L) (min-max)	6089.0 (54-109740)
	Median progesterone (ng/mL) (min-max)	13.7 (0.8-46.9)
	Imaging findings:
	Median of the largest diameter of the gestational sac (mm) (min-
	max)	22.0 (2-66)
	Visualized fetus n (%)	31 (48.4)
	Mean fetal crown-rump length (mm)	6.6
	Fetal cardiac activity n (%)	25 (39.1)
	Abdominal Bleeding n (%)	6 (9.4)
	Second-line exam n (%)	8 (12.5)
	MRI n (%)	7 (10.9)

Table 2 : Success rate of medical conservative management and complicationsTable 2 : Success rate of conservative medical management and complications

 22

		EM	IM-MTX	L-MTX	C-MTX	Misoprostol Hyperosm
							olar
							serum
		Total N=6	Total N=24	Total N=28	Total N=3	Total N=2	Total N=1
	Initial success n (%)	3 (50)	10 (41.7)	18 (64.3)	3 (100)	0	1 (100)
	Final success n (%)	5 (83.3)	20 (83.3)	25 (89.3)	3 (100)	1 (50)	1 (100)
	Median initial HCG (UI/L) (min-max)	3693 (199-59483)	3732 (56-36024)	24489 85364) (1889-	66733 109740) (2713-	42	1123
	Average time interval for
	HCG resolution (days) (initial/Final success)	72/62	35/42	57/57	70/70	X/42	28/28
	Average time for 15%
	decrease of HCG (days)	11/12	11/13	11/12	9/9	X/14	7/7
	Initial/Final success
	Complications n (%)	2 (33.3)	5 (20.8)	4 (14.3)	2 (66.7)	1 (50)	0
	NTEP Rupture n (%)	0	3 (12.5)	1 (3.6)	0	1 (50)	0
	Blood transfusion n (%)	1 (16.7)	1 (4.2)	1 (3.6)	1 (33.3)	0	0
	Genital bleeding n (%)	1 (16.7)	3 (12.5)	2 (7.1)	1 (33.3)	1 (50)	0
	Surgical complication n	0	0	1 (3.6)	0	1 (50)	0
	(%)
	Trophoblastic retention n	1 (16.7)	1 (4.2)	2 (7.1)	0	0	0
	(%)
	Side effect from MTX n	0	0	1 (3.6)	1 (33.
	(%)

Acknowledgment

To Matrix Consultants for proofreading in English and the corrections made.

Funding statement

The submission has no funders to report.

J o u r n a l P r e -p r o o f

Contribution to authorship

Sophie Delplanque, participated of the management of the patient, collected the data from patients, analysed them, and participated in writing the article. Marie Flévin, Sophie Le Gouic participated of the management of patient and collected the data from patient and analysed them. Maela Le Louis, Jean Leveque, Estelle Bauville, Pierre-Yves Moquet and Arnaud Fauconnier participated of the management of patient, Vincent Lavoué and Krystel Nyangoh Timoh analyzed the data and participated in the writing of the article.

Ethics approval

The study was approved by the Ethics Committee of the National College of the French Gynecologists and Obstetricians on the date of February 2, 2019 (CEROG 2018-GYN-1201).