Georges Habchi
email: georges.habchi@univ-smb.fr

Christine Barthod

An overall methodology for reliability prediction of mechatronic systems design with industrial application

Keywords: Mechatronic systems, Reliability, Mission profile, Dependencies, Interactions, Modeling, Simulation

We propose in this paper an overall ten-step methodology dedicated to the analysis and quantification of reliability during the design phase of a mechatronic system, considered as a complex system. The ten steps of the methodology are detailed according to the downward side of the V-development cycle usually used for the design of complex systems. Two main phases of analysis are complementary and cover the ten steps, qualitative analysis and quantitative analysis. The qualitative phase proposes to analyze the functional and dysfunctional behavior of the system and then determine its different failure modes and degradation states, based on external and internal functional analysis, organic and physical implementation, and dependencies between components, with consideration of customer specifications and mission profile. The quantitative phase is used to calculate the reliability of the system and its components, based on the qualitative behavior patterns, and considering data gathering and processing and reliability targets. Systemic approach is used to calculate the reliability of the system taking into account: the different technologies of a mechatronic system (mechanics, electronics, electrical ...), dependencies and interactions between components and external influencing factors. To validate the methodology, the ten steps are applied to an industrial system, the smart actuator of Pack'Aero Company.

Introduction

Mechatronics

The field of mechatronics has evolved as a highly powerful and most cost effective means for product realization. This is due to advances in microchip and developments in powerful computer technology including microprocessors, Application Specific Integrated Circuits (ASICs), computational techniques, that have bridged the gap between traditional electronic, control and mechanical engineering. Indeed, the development of mechatronic systems is a revolution for the industrial area, it affects a wide spectrum of fields such as manufacturing, transportation, energy and domestic devices. The field of transport and in particular the automotive sector is widely affected. The use of these systems is spreading rapidly and now reaches all sectors of the industry. Mechatronics has revolutionized the design and manufacturing of complex systems. In particular, its introduction in the automotive sector has deeply changed the development and manufacturing processes. Thus, a car is no longer conceived as a mechanical device that carries some electronic controls, but as a mechatronic system [START_REF] Bertram | Modelling and simulation for mechatronic design in automotive systems[END_REF], where the components of different technologies are fully integrated [START_REF] Desjardin | A day in the life of mechatronic engineers 10 years from now[END_REF].

The term mechatronics was first proposed by an engineer from Yaskawa Electric Co. in Japan, in 1969, to designate the control of electric motors by computer [Yaskawa Electric, 1969]. This term has subsequently evolved and mechatronics gained legitimacy in academic circles with the publication of at least two dozens of definitions or descriptions in the literature. One such description is proposed by the international journal Mechatronics, published for the first time in 1991: "Mechatronics in its fundamental form can be regarded as the fusion of mechanical and electrical disciplines in modern engineering process. It is a relatively new concept to the design of systems, devices and products aimed at achieving an optimal balance between basic mechanical structures and its overall control" [START_REF] Daniel | [END_REF]. The international journal IEEE/ASME Transactions on Mechatronics [START_REF] Godfrey | Mechatronics: Principles and Applications[END_REF] created in 1996, proposes the following meaning: "Mechatronics is the synergetic combination of mechanical engineering with electronics and intelligent computer control in the design and manufacturing of industrial products and processes". The official definition of the Industrial Research and Development Advisory Committee of the European Community: "Mechatronics is the synergistic combination of precision mechanical engineering, electronic control and systems thinking in the design of products and manufacturing processes" [Comerford, 1994], [START_REF] Grimheden | What is mechatronics proposing a approach to mechatronics?[END_REF]. This definition is adopted by the technical committee on mechatronics formed by the International Federation for the Theory of Machines and Mechanisms, in Prague, Czech Republic [START_REF] Leondes | Mechatronic Systems[END_REF]. Whichever description is adopted, the general process and great significance of mechatronics are apparent. It establishes the multidisciplinary nature of mechatronics, which combines several sectors of different technologies in the designing and manufacturing of a product. Mechatronics is not inherently a science or technology: it must be regarded as an attitude, a fundamental way of looking at and doing things, and, by its nature, requires a unified approach [START_REF] Millbank | [END_REF]. Ashley, then Alciatore and Histand also have summarized several definitions for Mechatronics [START_REF] Ashley | Getting a hold on mechatronics[END_REF]], [START_REF] Alciatore | Introduction to Mechatronics and Measurement Systems[END_REF]. Indeed, it can be said that Mechatronics relates to the design of systems, devices and products aimed at achieving an optimal balance between basic mechanical structure and its overall control. Particular importance must be attached to the aspects of innovation in mechatronics design philosophy which illustrate the benefits obtainable by an a priori integration of functionality with embedded microprocessor control (International Journal of Mechatronics). The synergy induced by mechatronic systems leads to an intelligent combination of technologies which leads to solutions with higher performance that cannot be obtained in separate applications. Then, it is important that the system is designed as a whole [START_REF] Shetty | Mechatronic Systems Design[END_REF]Kolk, 1997] [Breedveld, 2004].

The advent of mechatronic systems in industry has led to new constraints, such as: the incorporation of several technologies, the interactions between different functional entities, taking into account the dynamics of the system, the inability to perform exhaustive tests, etc. Despite these constraints, mechatronics brings undeniable benefits such as: cost reduction, customer satisfaction by the proposed innovative solutions, the positive response to societal demands increasingly important (pollution, consumption, safety) [START_REF] Millbank | [END_REF], [START_REF] Hewit | Mechatronics design -the key to performance enhancement[END_REF], [Kortum et al., 1998], [START_REF] Grimheden | What is mechatronics proposing a approach to mechatronics?[END_REF], [Rzevski, 2003], [START_REF] Ollero | Mechatronics, robotics and components for automation and control: IFAC milestone report[END_REF], [START_REF] Isermann | Mechatronic systems -innovative products with embedded control[END_REF], [START_REF] Yeong | PBGA packaging reliability assessments under random vibrations for space applications[END_REF].

The most important concepts characterizing mechatronic systems are: re-configurability, dynamics, hybridity and dependency (interaction). A system is reconfigurable if it is intended to perform several functions alternately or perform a function by using its resources in several different ways. Indeed sometimes, a reconfiguration of the control system is carried out without interruption of the mission to ensure safety. It is under these conditions that the reconfiguration is dynamic [START_REF] Moncelet | Application des Réseaux de Petri à l'évaluation de la sûreté de fonctionnement des systèmes mécatroniques du monde automobile[END_REF], [START_REF] Medjoudj | Contribution à l'analyse des systèmes pilotés par calculateurs : Extraction de scenarios redoutés et vérification de contraintes temporelles[END_REF]. The dynamics of the system lies in its aptitude to change its state during time. The presence of continuous phenomena and discrete events into the different states of the system characterize the hybrid concept. The dependency or interaction is described here by the effects produced by the action of a component to another component in the system changing its operating performances, in terms of degradation. Then, guarantee and security in terms of dependability and reliability becomes essential in the development of mechatronic systems [START_REF] Rieuneau | Sûreté de fonctionnement en phase de développement des systèmes embarqués automobiles[END_REF], [START_REF] Desjardin | A day in the life of mechatronic engineers 10 years from now[END_REF], [Borner et al., 2002], [START_REF] Demmou | Critical scenarios derivation methodology for mechatronic systems[END_REF], [START_REF] Schoenig | Définition d'une méthodologie de conception des systèmes mécatroniques sûrs de fonctionnement[END_REF], [Siemers et al., 2005].

Reliability Design

On the other hand, reliability has been increasingly used in firms over the last few years. This exponential use can be explained by the following reasons: safety improvement, failure and product lifetime control, customer satisfaction enhancement, maintenance improvement, product cost reduction, etc. The methods for analysis and evaluation of the reliability of a device are numerous [START_REF] Lyonnet | Fiabilité Technique et Humaine[END_REF]. They are characterized according to three criteria: inductive or deductive, qualitative or quantitative, and tracked objectives. In inductive methods, we start with the causes to deduce the consequences, whereas in deductive methods we start with the consequences to infer the causes. In qualitative methods, the reliability is analyzed from a qualitative point of view to determine the modes of failures and risks, whereas quantitative methods seek to assign quantified value to reliability over time. Otherwise, according to the assigned objectives a reliability assessment method is chosen to make an objective analysis. This classification has a direct influence of the period of the lifecycle (design, manufacture, use) in the choice of the reliability method. Indeed, depending on the period in the lifecycle of the device, the reliability can be predicted, experimental (estimated) or operational (mission).

During the design phase, predicted reliability is mainly calculated using a mathematical model, based on a functional/dysfunctional decomposition of the system into subsystems and/or components and on the specific reliability of each. During the manufacturing phase, experimental reliability is assessed. Its calculation is based on the data processing of industrial testing, and on the finding of theoretical models / distributions (exponential, normal, gamma, Weibull …) of the processing results. During the use phase, operational reliability is calculated. This is based on statistical processing of the data gathered from users (failure times) and on the findings of mathematical distributions. But also methods of reliability assessment can be categorized by technology area: mechanical, electrical, electronics, software, etc. For all these reasons, the evaluation of the reliability of a system, as multi-technological mechatronic system, is complex. Thus, methods of reliability are numerous. Not limited to, the main methods include: fault trees, reliability block-diagrams, Failure Mode and Effects Analysis (FMEA), event trees, Markov chains, Petri networks, Bayesian networks, … It is not a question here to describe all these methods, but the goal is to offer an overall methodology based on some of these methods. For indeed, it is clear that each of these methods is specific and cannot cover alone the whole field of reliability. Our investigation of the state of the art, concerns methodologies dedicated to complex or mechatronic systems.

Research in this area is still in the phase of development despite the few attempts in this direction [START_REF] Ziegler | Sûreté de fonctionnement d'architectures informatiques embarquées sur automobile[END_REF], [START_REF] Moncelet | Application des Réseaux de Petri à l'évaluation de la sûreté de fonctionnement des systèmes mécatroniques du monde automobile[END_REF], [START_REF] Mihalache | Reliability evaluation of a complex mechatronic system: antilock brake system (abs)[END_REF], [START_REF] Khalfaoui | Méthode de recherche des scenarios redoutés pour l'évaluation de la sûreté de fonctionnement des systèmes mécatroniques du monde automobile[END_REF], [START_REF] Guerin | Reliability estimation by Bayesian method: Definition of prior distribution using dependability study[END_REF], [START_REF] Schoenig | Définition d'une méthodologie de conception des systèmes mécatroniques sûrs de fonctionnement[END_REF], [START_REF] Schoenig | An aggregation method of Markov graphs for the reliability analysis of hybrid systems[END_REF]], [START_REF] Mihalache | Modeling and evaluation of the reliability of mechatronic systems: application on embedded system[END_REF], [START_REF] Sadou | Aide à la conception des systèmes embarqués sûrs de fonctionnement[END_REF], [START_REF] Turki | Ingénierie système guidée par les modèles : Application du standard IEEE 15288, de l'architecture MDA et du langage SysML à la conception des systèmes mécatroniques[END_REF], [START_REF] Demri | Contribution à l'évaluation de la fiabilité d'un système mécatronique par modélisation fonctionnelle et dysfonctionnelle[END_REF], [Belhadaoui, 2011]. These methodologies are based on methods such as Petri nets, FMEA, Markov Chains and fault trees. In a recent article [START_REF] Liu | A reliability-based design concept for lithiumion battery pack in electric vehicles[END_REF], a method on the design and analysis of lithium-ion (Li-ion) battery pack from the reliability perspective is presented. The analysis is based on the degradation of the battery pack, which is related to the cells configuration in the battery pack and the state of health (SoH) of all the Li-ion cells in the pack. Other studies, exist in the bibliography. They relate to methodologies based on Bayesian networks. For example, [START_REF] Martins | Application of Bayesian Belief networks to the human reliability analysis of an oil tanker operation focusing on collision accidents[END_REF] proposed a study on the application of Bayesian networks to the human reliability analysis (HRA) of an oil tanker operation focusing on collision accidents. This study uses a four-phase methodology (familiarization, qualitative analysis, quantitative analysis, incorporation) to accomplish HRA [START_REF] Swain | Handbook of human reliability analysis with emphasis on nuclear power plant applications[END_REF] using the integration of fault trees and Bayesian networks [START_REF] Droguett | Human analysis through Bayesian networks: an application in maintenance of transmission lines[END_REF]. Also, to specify the reliability for new product development, [START_REF] Murthy | Investment in new product reliability[END_REF] developed a new model of product life cycle in which the life cycle was divided into eight phases and grouped into three stages (Predevelopment, Development, Post-development). [START_REF] Peng | Life cycle reliability assessment of new products -A Bayesian model updating approach[END_REF] used this model for their study on life cycle reliability assessment of new products.

Among the methods dedicated to reliability, graph theory provides an appropriate tool to describe and graphically exploit the dependency relationships or independencies between variables. Probability theory brings, meanwhile, a formalism to quantify the dependency relationships by associating each variable a conditional probability law. Probabilistic graphical models, specifically Bayesian networks, initiated by Judea Pearl in the 1980s [START_REF] Pearl | Bayes on inference engines: A distributed hierarchical approach[END_REF] proved to be useful tools for representing uncertain knowledge and reasoning from incomplete information.

The graphical part of the Bayesian network indicates the dependencies (or independencies) between variables and gives a visual tool of knowledge representation, more easily comprehensible tool by its users. The use of probabilities can take into account the uncertainty in quantifying the dependencies between variables. Each node is associated with a conditional probability distribution that defines the probability of each of its values, knowing the values of the direct predecessor's nodes in the graph. [START_REF] Pearl | Fusion, propagation, and structuring in belief networks[END_REF] and [START_REF] Pearl | Causality: Models, Reasoning, and Inference[END_REF] also showed that Bayesian networks allow to represent compactly the joint probability distribution on the set of variables. Sometimes it is difficult or impossible to represent some systems with a fault tree or a reliability diagram. However, the concepts of minimum cuts and minimum success paths allow to fully define the relationships between the states of the system and the component states.

The paper presented by [START_REF] Pulido | Reliability analysis for preventive maintenance based on classical and Bayesian semi-parametric degradation approaches using locomotive wheel-sets as a case study[END_REF] undertakes a general reliability study using both classical and Bayesian semi-parametric degradation approaches. The goal is to illustrate how degradation data can be modelled and analyzed to flexibly determine reliability to support preventive maintenance strategy making, based on a general data-driven framework. The article proposed by [START_REF] Mkrtchyan | Bayesian belief networks for human reliability analysis: A review of applications and gaps[END_REF] is a review of applications and gaps on the use of Bayesian networks for human reliability analysis (HRA). The same authors suggest in a recent article [START_REF] Mkrtchyan | Methods for building Conditional Probability Tables of Bayesian Belief Networks from limited judgment: An evaluation for Human Reliability Application, Reliability Engineering and System Safety[END_REF] some methods for building Conditional Probability Tables of Bayesian Belief Networks from limited judgment for HRA. In [START_REF] Musharraf | Assessing offshore emergency evacuation behavior in a virtual environment using a Bayesian Network approach[END_REF] the authors suggest in a recent article assessing offshore emergency evacuation behavior in a virtual environment using a Bayesian Network approach. In this paper [START_REF] Foulliaron | Dynamic bayesian networks for reliability analysis: from a Markovian point of view to semi-markovian approaches[END_REF] some specific DBN structures are introduced in order to improve the degradation modeling and perform reliability analysis, integrating the concept of conditional sojourn time distributions that allow considering simultaneously several degradation dynamics.

The analysis of different approaches used to study the reliability for mechatronic systems, enabled us to identify some lacks of reliability for these systems:

 The various phases of operation of a mission profile, are not taken into account, therefore there is no mission profile built on these phases.  The physical and functional interdependencies generated between the different technological parts are not studied.  An evaluation of the overall reliability of the system does not exist.

In more detail, Table 1 summarizes the studied points and gaps in relation to certain criteria or items we considered relevant to the achievement of the methodology. "+" sign indicates that the item was considered by the used methodology while the "-" sign indicates that it was not.

- + + + + Interaction - - - - - - - - - + Mission Profile - - - - - - - - - - Influence Factors - - - - - - - - - - Human Reliability Analysis - - - - - - - - - +
Besides the listed lacks (mission profile, interdependencies, overall reliability) and which we seek to answer, the proposed methodology makes some improvements:

 The analysis of the physical location of the components which allows identification of collateral failures in addition to intrinsic functional failures and shortcomings identified by organic architecture.  The dysfunctional analysis using FMEA enriched by the classification of defects according to their nature, their establishment speed and amplitude.

 The analysis of interdependencies by building the interactions matrix.  Modeling and simulation with consideration of the mission profile and interactions.

Therefore, our goal is to provide an overall methodology for assessing the reliability of a mechatronic system as a whole and taking into account: the technology sectors, the phase of the lifecycle, and the application field wherein the product is immersed.

The paper is organized as follows: section 2 presents the overall ten-step evaluation methodology: section 3 introduces an application to a case study of an industrial project and concentrates on results analysis, and section 4 summarizes the findings from the study.

Proposed overall methodology

The V-Cycle

To meet the challenges of quality, cost and time constraints imposed by the market, a new approach for system design is necessary to enable the safe integration of different technologies. This approach should definitely consider the goals of reliability and safety from the design phase of the device.

Before discussing the methodology, we propose a common definition of a (complex, mechatronic, etc.) system. Such a system can be described as a set of interacting elements among themselves and with the environment whose behavior depends on:

 Individual behavior of its components,  Rules of dependencies and interactions between elements (interfaces, algorithms, protocols),  The topological organization of the elements (architectures). Complex industrial systems are characterized by the fact that they result from a combination of subsystems of different technologies. The V-cycle was first used as a model of development in different technologies: mechanical [START_REF] Tollenaere | Conception de produits mécaniques -méthodes, modèles et outils[END_REF], electronics [START_REF] Molla | Defect detection oriented lifecycle modeling in complex product development[END_REF] and software [Gaudel et al., 1996]. It was then generalized to the development of complex systems, particularly mechatronic systems to have a common terminology and propose an overall methodology with shared stages to the different technologies. There are other types of development cycles, the best known being the cascade or spiral cycles.

The development model according to the V-cycle (Fig. 1) organizes the different phases of development, from specification to product validation [START_REF] Desjardin | A day in the life of mechatronic engineers 10 years from now[END_REF], [START_REF] Isermann | Mechatronic systems -innovative products with embedded control[END_REF]. The V-cycle is characterized by a horizontal axis representing time and a vertical axis representing the level of integration of the system. It can be described as a succession of five phases having an integration degree that evolves over time: analysis / specification, design, implementation / manufacturing, verification and validation. For a mechatronic system, the major difficulty is the translation of the system specification into specifications for each component with different technologies [START_REF] Rieuneau | Sûreté de fonctionnement en phase de développement des systèmes embarqués automobiles[END_REF], [START_REF] Desjardin | A day in the life of mechatronic engineers 10 years from now[END_REF]. The complexity of the system and the interpretation of specifications by different teams, are particularly sensitive to be taken into account in the design phase. When developing a system, the manufacturer specifies not only the functionality but also the objectives in terms of dependability. Thus, it is increasingly necessary to integrate security into the operating system approach, very early in the project, in the first phase of the development cycle [START_REF] Desjardin | A day in the life of mechatronic engineers 10 years from now[END_REF]. This integration leads not only to multiply the studies of reliability, availability, maintainability and safety, but also to develop a collaborative methodology that promotes their inclusion in projects and through the different communities related to the development of mechatronic systems.

Fig. 1. The V-cycle

Overall ten-step methodology

Thus, the methodology presented in Fig. 2 shows all the steps to consider during the downward phase of the V-cycle, when designing a mechatronic product. The ten main steps are organized into two stages. The first one is to deploy qualitative analysis while the second provides a quantitative analysis of the product reliability.

Design Specification

(1) System requirements specification, Objectives, Mission profile…

Users constraints, Mission profile, Reliability objectives

(2) Main functions and constraints, Interactions between the system & its environment

Synoptic of the extended basic process model

Inputs

Objectives

Outputs I. EXTERNAL FUNCTIONAL ANALYSIS FUNCTION Methods

APTE, Octopus Diagram…

(1) + ( 2)

Users

Qualitative Analysis Quantitative Analysis

Fig. 3. Proposed Overall Methodology (Functions: Inputs, Objectives, Methods, Outputs) Fig. 3 presents an overview of all steps with a summary of the inputs, outputs, objectives and methods associated with each step. Each step is based on the basic process model (Fig. 3) which can be seen in any function or activity and represents a balance of energy going into a process and coming out. This model is extended in order to appear the objectives and the methods / tools used for a given function. The ten steps of the overall methodology are presented in detail in the following paragraphs.

It is important to note that in a conventional design process of new products, analysis methods such as external functional analysis, internal functional analysis, risk analysis, FMEA, ... are used. However, these methods are used separately by different people. They are not necessarily associated in a unique and overall process and do not reflect necessarily reliability problems. So the proposed methodology aims to structure the process of analysis and evaluation of reliability in order to be considered at the earliest stages of design. The analysis part is not necessarily increased, but it is rather better organized. Nevertheless, for whatever the considered system, one of the main difficulties in its reliability evaluation is to identify the dominating elements in terms of reliability. A mechatronic system is generally composed of numerous components. Most of the time, only feedback and experience can help to select the relevant elements, in terms of reliability evaluation. Moreover, it seems important to list all the components in order to be able to identify the interactions. Consequently, to reduce the calculations, the selection of the dominating components should be done only after the step IV "interactions analysis".

External functional analysis

A function can be defined as the action of an entity or one of its components expressed in terms of purpose. It is necessary to distinguish the functions and the structure (or hardware architecture support).

For simple or complex systems, a basic principle used in analysis, is to divide and conquer. This means to apprehend the overall system, partition it into subsystems (components) and then try to understand each subsystem (component) and its relationships (external and internal).

The APTE (APplication des Techniques d'Entreprise / Application of Corporation (Professional) Methods) method was created by Gilbert Barbey in 1964[START_REF] De | La méthode APTE : Analyse de la valeur, analyse fonctionnelle[END_REF]. It is a method of functional analysis and value analysis to conduct innovation and optimization projects. The first tool of the APTE method is a chart of benefits also called "horned beast". Its use allows identifying the purpose of the study. The second one is the "octopus diagram" or "interactions graph". It is used as a tool illustrating the relationship between the system and its environment. It allows highlighting the main functions and constraints functions for the system. The following points are realized at the external functional analysis (EFA) step [Lyonnet, 2006]:  Identification of the purpose of the study,  Identification of the components of the external environment,  Identification of the main functions and constraints functions,  Characterization of the main functions and constraints functions,  Definition of the mission profile of the system, that means the conditions of use in terms of temperature, vibration, humidity...

Internal functional analysis

The IFA establishes relationships between the EFA and possible solutions to meet the need. It allows the definition of the functions identified into internal technical functions. In addition, the FAT supplies some selection criteria to compare objectives between different solutions.

Organic analysis

The objective of the organic analysis (OA) is to define the architecture of the system, the decomposition into sub-systems and components, and the identification of the functional interactions between the different elements of the system. The term interaction is defined here as a functional dependence between the components of the system producing a change in the reliability of the system. The OA is built according to the following points [START_REF] Cetim | Guide de conduite d'un projet mécatronique. Analyse fonctionnelle et organique[END_REF]:

 Definition of the components associated with the internal functions  Decomposition of the system into subsystems and components  Design of the organic system architecture  Identification of the functional interactions between the components of the system (functional interactions matrix)  Identification of the collateral interactions between the components of the system (physical location of the components).

Physical implementation

Physical location or Implementation (PI) aims to identify possible collateral damage among the different elements of the system to identify principally second type of failures, which are caused by the operation or the failure of another contiguous component of the system. It allows visualizing the locations of the parts or organs. It highlights the physical proximity of components and collateral interactions that may result.

Therefore, it identifies one or more collateral interactions between two components due to changes in environmental parameters such as temperature, vibration… which could generate second type of failure, directly produced by another part of the system.

Dysfunctional analysis

The objective of the dysfunctional analysis is to identify the dysfunctional failure modes and degradation of the system components and then analyze their effects on the system. To achieve this analysis, the outputs of the functional and organic analyzes are needed.

The main methods used in a dysfunctional analysis are: the Preliminary Risk Analysis (PRA), Failure Modes, Effects and Criticality Analysis (FMECA), Analysis of the Effects of Software Errors (AEEL), Trees Failures (ADD), etc. [START_REF] Mihalache | Reliability evaluation of a complex mechatronic system: antilock brake system (abs)[END_REF], [START_REF] Guenzi | Reliability evaluation of common-cause failures and other interdependencies in large reconfigurable networks[END_REF]. Except the AEEL method that is dedicated to software, the other methods are used for technologies such as mechanical, electronic, electric, etc.

Failure Modes and Effects Analysis (FMEA) is one of the first systematic approaches to analyze failures [START_REF] Villemeur | Sûreté de fonctionnement des systèmes industriels : fiabilité, facteurs humains, informatisation[END_REF], [START_REF] Villemeur | Sûreté de fonctionnement des systèmes industriels[END_REF]. It was developed by the U.S. Army and is in the first guideline Military Procedure MIL-P-1629 "Procedures for performing a failure mode, and effects analysis" of 9 November 1949. Thereafter, it was developed by the aerospace industry in mid 60s. The FMEA analysis describes inherent causes of events that lead to system failure, determines their consequences, and formulates methods to minimize their occurrence or recurrence. Therefore, it allows identifying the critical elements of security (causing critical or catastrophic events) and dormant faults.

There are basically two types of FMEA: design and process FMEA.

Design FMEA is used to evaluate the failure modes and their effects for a product before it is released to production. It is usually applied at the component and subsystem levels. Its objectives are:  To identify failure modes and rank them according to their effects on the product performance,  To identify design actions to eliminate potential failure modes or reduce the occurrence of the respective failures,  To document the rationale behind product design changes.

Process FMEA is used to analyze manufacturing and assembly processes. Its objectives are to identify:

 Failure modes that can be associated with manufacturing and assembly process deficiencies,  Highly critical process characteristics that may cause the occurrence of particular failure modes,  Sources of manufacturing/assembly process variations.

However, it is important to mention some limitations of FMEA:

 Limited insight into probabilistic system behavior,  FMEA is performed for only one failure at a time. There may be multiple failure modes with comparable likelihoods,  Limited insight into the functional relationships between components,  Time element in system operation cannot be represented.

FMEA is the main method used for dysfunctional analysis. To meet certain limitations, additional information has been added to specify the type of failure (intrinsic, collateral, and functional), its nature (first or second), its establishment speed (sudden or progressive) and its amplitude (partial or complete). Also, this enriched FMEA being realized, the interactions matrix between the components and, the qualitative and quantitative modeling, fill the other gaps. Finally, the formalization and the analysis of the physical implementation of the components highlight the failure modes issued from collateral interactions (second nature mode), that are not usually identified.

Dependence analysis of interactions

Compared to a conventional design approach, we propose here an additional analysis of the dependencies between system components in order to identify potential interactions. This step aims to:  Identify interactions defined and classified in the enriched FMEA (a criticality analysis will be necessary).  Allow to make the choice of interactions to be considered in modeling the system in terms of reliability.

The interactions between components of a mechatronic system are identified from its organic architecture for functional interactions and the physical implementation of the system components for the collateral interactions.

The identified interactions can be transcribed in a component / component matrix (Table 2) allowing a visual analysis of their classification. Each component may act on another component. To improve the readability of the matrix of interactions, we propose to adopt the following notation: UF for unidirectional functional interaction, BF for bidirectional functional interaction, UC for unidirectional collateral interaction and BC for bidirectional collateral interaction. A thorough analysis must be carried out on all the identified interactions in order to surround their effects in the reliability evaluation of the system. Thus, it is important to identify the interactions causes as they probably influence the defined using conditions (temperature, vibration, shock…) or the intrinsic functioning of the system (friction, heating, wear…). The influent factors being identified; the main difficulty of the approach is to quantify how the reliability laws of the interactive components may be modified.

Qualitative modeling

The objective of qualitative modeling is to model the functional and dysfunctional behavior of the system and its components. Achieving this analysis depends on all analyzes carried out previously. The deployment of FMECA method, enhanced by the classification of failure modes of components depending on their nature (first or second), their establishment speed (sudden, progressive) and their amplitude (partial or complete) allows us to introduce new failure modes and additional states. Indeed, the failure modes commonly used in modeling are intrinsic failure modes of components (failure of first type as classified by nature). To take into account the interactions inducing collateral damage, the failure modes of second type was added.

Petri nets

The most appropriate methods for modeling of mechatronic systems are state-transition models such as state graphs (Markov graphs, Bayesian networks) and approaches based on Petri nets [START_REF] Bertram | Modelling and simulation for mechatronic design in automotive systems[END_REF]. Petri nets can be used for modeling the functioning and non-functioning states of complex systems [START_REF] Charki | Mechatronic system reliability evaluation using Petri networks and phi2 method[END_REF]. This method provides a convenient graphical representation of a placetransition net which consists of: places (circles) which model states, tokens (black dots) which represent the specific value of the states, transitions (rectangles) which model activities/events that change the values of states, and arcs which specify the interconnection of places and transitions thus indicating which states are changed [START_REF] David | Du Grafcet aux réseaux de Petri[END_REF], [START_REF] Daniel | Les réseaux de petri stochastiques pour l'évaluation des attributs de la sûreté de fonctionnement des systèmes manufacturiers[END_REF], [START_REF] Dutuit | Dependability modeling and evaluation by using stochastic Petri nets: Application to two test cases[END_REF]. However, some generic tools and their implementation could form an obstacle to their deployment in the industry. Despite this barrier, for qualitative modeling of mechatronic systems, we can use Petri nets because they allow:

 Modeling of all integrated technologies,  Compatibility with all stages of the V-cycle,  Analyzing functional and dysfunctional behaviors,  Modeling continuous and discrete events (hybrid systems),  Taking into account the dynamic behavior of the system,  Modifying their internal structures (re-configurability),  Specifying interactions between the components.

Reliability Block Diagrams

Using a Reliability Block Diagram (RBD), a qualitative analysis of reliability is to structure the system and then calculate the combination of components that leads to system failure. To express the combination of components causing the failure, analysts use two concepts: the paths to success and cuts.

Fig. 5 shows an example of an RBD with success paths and cuts.

Fig. 5. Example of paths to success and cuts

The set of components of a system of order n is 𝐶 = {1,2,3, … , 𝑛}.

A path to success set, P, is a subset of C which by functioning ensures that the system is functioning. A path set is minimal if it cannot be reduced without losing its status as a path set (it contains no subpath).

A cut set, K, is a subset of C which by failing causes the system to fail. A cut set is minimal if it cannot be reduced without losing its status as a cut set (if removing any component in the list, the system is not faulty). The size (or order) of the cut is the number of elements in the list. Knowledge of minimum cuts used allows establishing qualitatively the list of critical components from the functional organization of the system.

The structure function for an RBD is a function ∅(𝑥 1 , 𝑥 2 , … , 𝑥 𝑛 ) associated with a given system, such that 𝑥 = ∅(𝑥 1 , 𝑥 2 , … , 𝑥 𝑛 ) where 𝑥 𝑖 denotes the state of component or subsystem i and 𝑥 denotes the state of the entire system. For 𝑥 𝑖 = 1 the component or subsystem is functioning and for 𝑥 𝑖 = 0 it is failed. For 𝑥 = 1 the system is functioning and for 𝑥 = 0 the system is failed.

Data gathering and processing

The objective of this step of the methodology is to identify the distributions of reliability (lifetime distributions) associated with the components and then gather, and process the data in order to calculate their parameters values. Generally, for simplicity in reliability calculation, it can be assumed that the equipment is in a constant hazard rate phase of the bathtub curve, where failure rate  is constant and the failures are independent of time and will not increase or decrease with the age of the equipment. We consider this hypothesis to the electronic technology since several databases exist. The most used ones

𝐾1 = {𝐶𝑜𝑚𝑝1, 𝐶𝑜𝑚𝑝4} 𝐾2 = {𝐶𝑜𝑚𝑝2, 𝐶𝑜𝑚𝑝4} 𝐾3 = {𝐶𝑜𝑚𝑝3} 𝑃1 = {𝐶𝑜𝑚𝑝1, 𝐶𝑜𝑚𝑝2, 𝐶𝑜𝑚𝑝3} 𝑃2 = {𝐶𝑜𝑚𝑝4, 𝐶𝑜𝑚𝑝3}
are FIDES, MIL-HDBK 217F, and RDF 2000. Indeed, the most suited distribution for this technology is exponential. And it is quite easy to calculate the failure rate or Mean Time Between Failures (MTBF) taking into account several factors. For other technologies, databases are available for some standard components but are very limited. The experiment is essential for these technologies and achievement of tests in site is often necessary. In some cases, tools such as simulation or expertise are used. However, Table 3 presents some of the main reliability (failure) distributions used to evaluate the reliability of components and the associated parameters for some types of technology. The reliability distribution is defined once its parameters are identified (the exponential model depends on failure rate . The normal and lognormal models depend on average  and standard deviation , and the three-parameter Weibull model depends on shape parameter , location parameter  and scale parameter ). [START_REF] Musa | Software Reliability: Measurement, Prediction, Application[END_REF] With:

: Failure Rate :

Calculating the failure rate of electronic components using FIDES database

The expression of the failure rate depends on several factors: design technology, manufacturing technology and environmental operation of the component. Then, according to FIDES, the failure rate depends on a basic failure rate of the component, weighted by factors of technology, design, manufacture, use, environment, etc. [Demri, 2010]. The failure rate can be written as follows: It seems important to emphasize the problem of the data gathering. Indeed, an efficient modeling will provide bad results if the feeding data are not relevant. As far as predictive reliability is concerned, the main limit of the methodology is the lack of reliable data, in particular concerning mechanical parts where no database exists. So, this step has to be carried out and validated jointly by the analysts and the industrials.

𝜆 = 𝜆 𝑃ℎ𝑦𝑠𝑖𝑐𝑎𝑙 × 𝛱 𝑃𝑎𝑟𝑡_𝑀𝑎𝑛𝑢𝑓𝑎𝑐𝑡𝑢𝑟𝑖𝑛𝑔 × 𝛱 𝑃𝑟𝑜𝑐𝑒𝑠𝑠 × 𝛱 𝑅𝐹-𝐻𝐹 × 𝛱 𝐻-𝑀 × 𝛱 𝐿𝐹

Analytic calculation, modeling and simulation

The objective of this step is to evaluate the reliability function for the system and its components (sub-systems) over time and according to the mission profile of the system. A system's overall reliability can be determined by the development of reliability models. The complexity of these models is dependent upon various factors such as mission profiles (usage profiles), function criticality, redundancy characteristics, interactions between components, etc. The general approach is to capture the modeling effort with the use of graphical methods such as Reliability Block Diagrams, Petri Nets, Markov Chains, etc.

Two methods are used into the proposed methodology:

 Petri Nets for behavioral modeling (functional and dysfunctional) and Monte Carlo simulation for convergence of results  Modified Reliability Block Diagrams, adapted in order to take into account the mission profile and the considered interactions for analytical calculation.

The comparison of the results obtained by both methods is necessary to verify and validate on the one hand, Petri nets model and the parameters chosen for simulation, and on the other hand, the calculation method developed in the context of reliability block diagrams considering the mission profile and interactions.

Petri nets modeling and Monte-Carlo simulation

Carl Adam Petri has proposed in his thesis (1962), a new tool dedicated to the modeling of controllers. Following this work, Petri nets have undergone several extensions. Among other developments, in the 80s, J.P. Signoret and A. Leroy used Petri nets as behavioral models to perform Monte Carlo simulations (for large systems). Much research is being done on the subject, including MOCA-RP tool [START_REF] Marsan | Modelling with Generalized Stochastic Petri Nets[END_REF]], the SHARPE Software Package [START_REF] Sahner | Performance and Reliability Analysis of Computer Systems: An Examplebased Approach Using the SHARPE Software Package[END_REF], [START_REF] Trivedi | Probability and Statistics with Reliability, Queuing and Computer Science Applications[END_REF], [START_REF] Wang | Integration of specification form modeling and specification for system design[END_REF], [START_REF] Katerina | Architecture-based approach to reliability assessment of software systems[END_REF].

Petri nets are a good tool to model the dysfunctional behavior of a system. It is well-adapted to understand the various failures and their impact on the system. As a reminder, a Petri net is a directed graph with two types of nodes: places (states or conditions) represented by circles and transitions (or events) symbolized by bars. These nodes are interconnected by directed arcs of places to transitions (upstream arcs) and transitions to places (downstream arcs) exclusively. Circulating tokens (indivisible markers), symbolizing the presence in a given instant of information or any special initialization to places where they reside, allows dynamic modeling of system behavior (both desired and unwanted) to within the network. A stochastic Petri net (or in our case reliability net) is an extended Petri net as it associates with each transition a period of random or deterministic firing (zero or not). If the deterministic period is 0, it is called immediate transitions. A complete presentation can be found in the book [START_REF] Marsan | Modelling with Generalized Stochastic Petri Nets[END_REF]].

The quantitative evaluation of a Petri net is usually done either by processing the Markov model available from the marking graph of the Petri net, each non-vanishing marking corresponding to a state of the Markov chain, or by animating Monte-Carlo simulation directly on Petri net and not its reachability graph model. The principle of Monte-Carlo consists in playing a number of scenarios of evolution of the Petri drawing pseudo-random delays associated with transitions and making statistics values with an interest such as the number of shots for a transition, the average residence time in one place, etc. Disadvantages of this approach involve the accuracy of the variable that depends on the number of simulations thus the processing time is long and potentially can hardly be applied to rare events. The two main structures are: the simulation clock that records the mission time for a simulation, and the list of events that are held in a chronological order. The events occurrence dates are randomly generated according to their probability distributions. The simulation then proceeds as follows: (i) choose the most recent event for execution, (ii) run the event and then remove it from the list, (iii) update data (list of events, observation variables, etc.), (iv) advance the clock to the date of the next event, (v) stop simulation if one of the following two conditions is true: the simulation mission time is exceeded, the event list is empty.

Reliability Block Diagrams

Historically, the diagram method of reliability or success is the first to have been used to analyze systems. An RBD also known as a Dependence Diagram (DD) is a graphical representation of the components of the system and how they are reliability-wise related. The diagram represents the functioning state (i.e., success or failure) of the system in terms of the functioning states of its components. To define the reliability characteristics of each component, we can use software to calculate the reliability function for the entire system and obtain a wide variety of system reliability analysis results, including the ability to identify critical components and calculate the optimum reliability allocation strategy to meet a system reliability goal.

Using an RBD, a quantitative analysis of reliability allows structuring the system, assigning the probabilities of failure of basic blocks, and then assessing the probability of failure of the entire system.

An RBD or DD provides a success oriented view of the system, a framework for understanding redundancy, facilitates the computation of system reliability from component reliabilities. An RBD is drawn as a series of blocks connected in parallel or series configuration. For punctual reliability computing, each block represents a component of the system with a failure rate () or a Mean Time Between Failures (MTBF). For temporal reliability computing, each block represents the parameters of failure or reliability distribution (exponential, normal, lognormal, Weibull, etc.). Parallel paths are redundant, meaning that all of the parallel paths must fail for the parallel network to fail. By contrast, any failure along a series path causes the entire series path to fail. An RBD may be converted to a success tree (ST) by replacing series paths with AND gates and parallel paths with OR gates. A success tree may then be converted to a fault tree (FT) by applying de Morgan's theorem.

In order to evaluate RBD, closed form solution is available in the case of statistically independence among blocks or components. Where the statistically independence assumption is not satisfied, specific formalisms and solution tools, such as Dynamic RBD [START_REF] Salvatore | Dependability Evaluation with Dynamic Reliability Block Diagrams and Dynamic Fault Trees[END_REF], have to be considered. DRBD is a powerful notation to model system reliability, derived from RBD. If the components of a DRBD are independent, it can be analyzed by applying the combinatorial structure equations [START_REF] Rausand | System Reliability Theory: Models, Statistical Methods, and Applications[END_REF], obtaining the total reliability function analytically. Unfortunately, the combinatorial/analytic method cannot be extended to DRBD models.

Modeling of interactions

Statistically dependent failures are defined as events in which the probability of each failure is dependent on the occurrence of other failures. In general, statistically dependent failures are handled using Dynamic Methods such as Markov models, Petri nets, Dynamic Reliability Block Diagrams, etc. However, in systems with redundant identical components static techniques may be used, for a generalization of the factor method and other methods see [START_REF] Rutledge | Dependent-Failures in Spacecraft: Root Causes, Coupling Factors, Defenses, and Design Implications[END_REF]. factor can be interpreted as the probability that component failure occurs to a common cause event. The β factor method is an approximation method used for the quantitative evaluation of Common Cause Failures (CCFs) that are single faults resulting in the failure of multiple components. Typical examples include impact, vibration, temperature, contaminants, miss-calibration, improper maintenance, etc. In a recent study [START_REF] Lahokallio | Effects of different test profiles of temperature cycling tests on the reliability of RFID tags[END_REF], the effects of different temperature cycling profiles were studied by altering temperature ranges, extreme temperatures, soak times to extreme temperatures and transition times between extreme temperatures. It was observed that the different temperature cycling profiles affected the failure mechanisms detected. Also in another recent study [START_REF] Yeong | PBGA packaging reliability assessments under random vibrations for space applications[END_REF], the authors investigated Plastic Ball Grid Array (PBGA) packaging reliability assessments under random vibrations for space applications. Then, the specimens were undergone severe random vibrations with two different levels of 22.48 root mean square acceleration (grms) for one minute, and 31.78 grms for two minutes.

A β factor is estimated such that β% of the failure rate is attributed to the CCF and (1-β)% to the random failure rate of the component [START_REF] Mosleh | Guidelines on Modeling Common-Cause Failures in Probabilistic Risk Assessment[END_REF]]:

(1)𝜆 𝑇 = 𝜆 𝐶 + 𝜆 𝐼

(2)𝜆 𝐶 = 𝛽𝜆 𝑇 (3)𝜆 𝐼 = (1 -𝛽)𝜆 𝑇 Where: 𝜆 𝑇 is the total failure rate 𝜆 𝐶 is the common cause failure rate 𝜆 𝐼 is the independent failure rate A point estimate for  is given by: (4)𝛽 = 2𝑛 𝐶 (𝑛 𝐼 + 2𝑛 𝐶 ) ⁄

Where: 𝑛 𝐼 is the number of independent failures 𝑛 𝐶 is the number of common cause failures

The internal functional analysis is needed to establish the model (RBD or PN). Indeed, the system may perform more than one function at the same time but also, a function may be performed by more than one set of components. The mission profile is a multi-mode mission. The operating conditions of the system change in successive phases of mission although the basic physical configuration of the system remains the same. Thus, component failures affect system failure, depending on phase and operational conditions at the time. The consequence for the model is that different phases might represent different reliability configurations. This situation cannot be depicted accurately using basic RBDs and changes have to be made to address this modeling problem.

Analytic methods and modeling and simulation are organized according to the following three points: (i) Implementation of the quantitative models according to the qualitative analysis, (ii) Reliability calculation without interactions consideration, (iii) Reliability calculation considering interactions and hypothesis.

Results analysis

The objective of the results analysis step is the establishment of a final report which analyzes and discusses the results in terms of reliability. The objectives considered in the first step of the methodology are compared with the results obtained. Proposals are then submitted to make the changes if it is proved necessary to improve reliability and achieve the objectives.

The validation of the results will be effective only when the experimental results can be compared to simulation. However, as the methodology concerns predictive reliability, no return data are available. At this state, the best validation that can be done is to compare the results obtained by two different methods.

Case study application

The objective of this study is to evaluate the predictive reliability of the PACK'AERO "Smart Actuator" using the proposed methodology. In addition to a conventional actuator, the smart actuator must provide additional functions such as control, monitoring, communication, information processing, etc. Thus, it should address several issues such as:

 Moving from passive system to active system (active vibration control, shock, etc.),  Use of a direct linear action instead of indirect linear action (linear actuator),  Optimization of an instantaneous response to meet the needs,  Integration of electric locking functions with or without electric power consumption (magnet).

External functional analysis Context

The smart actuator is a product that should be used in a chain of continuous sorting may include a number of trucks that can go from 200 to 1000 depending on the application (Fig. 6). The trucks transport parts from one station to another of the chain in continuous motion. The smart actuator contributes to the realization of the function of wagons unloading. The finger of the smart actuator is used as a stop to open the shutter and release (let go) the load of wagon without stopping.

Fig. 6. Sorting chain

Environment elements, main and constraint functions identification and description

The octopus diagram of Fig. 7 presents the environment elements in relationship with the smart actuator as well as the main and constraint functions. Using this diagram, the analysis shows the presence of one main function (MF) and five constraint functions (CF) described as follows:

MF: Allows wagon shutter opening when the wagon arrives at the unloading station, CF1: Withstands the thermal environment, CF2: Works with the installed electrical power, CF3: Meets the requirements of legislation, CF4: Meets the normative standards requirements, CF5: Allows the master system to order operating (ON/OFF).

Fig. 7. Octopus diagram of the smart actuator

We present in Table 3, operating conditions, the characteristics of main function and constraints functions as well as some objectives related to reliability.

Mission profile

The mission profile also called life profile determines the conditions of use of the product related to its environmental context. For the smart actuator, the yearly operating profile is defined by the main function and the constraint function CF1 (Table 3). The influence factor of the different phases of operation is the temperature, the level of thermal environment is organized as follows (Table 4): 3 operation months for "temperate" phase, 4 operation months for "cold" phase, 3 operation months for "temperate" phase, 2 operation months for "hot" phase.

Smart Actuator

Unloading Station

Environment Wagon Shutter

The used yearly mission profile is shown in Table 3 where operating durations are given in hours and number of cycles: the annual duration represents the total duration of each phase in hours for a year, the number of cycles represents the sum of cycles to be executed during each phase, operating time represents the time spent during the execution of cycles for each phase, and temperature column provides the value in Celsius degrees in which the smart actuator should operate. Is the number of cycles that will be used as usual duration for the quantification of reliability.

Internal functional analysis

The internal functional analysis identifies the key internal functions that are necessary to achieve the main function (MF) of the smart actuator. Fig. 8 describes the bloc diagram of the functional architecture for the smart actuator in which we have identified 8 internal functions.

Organic analysis

The purpose of the organic analysis is to define the architecture of the system, the decomposition into sub-systems and components and the interactions between the different elements of the system.

Identification of components to be associated with internal functions

Based on the internal functional analysis, it is therefore possible to identify the components that should carry out internal functions. The identified components are summarized in Table 5 for each function.  Electrical connects (power supply/actuator body, power between the circuit board and the moving equipment),  Mechanical support of the circuit board/actuator body,  Mechanical fixation of the actuator body on the machine.

Physical implementation

The physical implementation aims to identify collateral damage among the different elements of the system to identify failures principally seconds, i.e., those which are caused by another adjacent component that is poorly designed, poorly machined or poorly defined.

Regarding electronics, a single double-sided printed circuit board should include both the control and diagnosis and the conditioning circuit board for Hall sensor. The design process predicts a control circuit board integrating 43 electronic components and a conditioning circuit board integrating 30 electronic components. This information is to calculate the failure rate of electronic subassemblies.

Dysfunctional analysis

The organic architecture and the physical implementation of the smart actuator, allow identifying the functional damages that can affect the operation of the system. The physical location of the components, allows identifying collateral damage which causes failures of type "second". Intrinsic damages are damage-specific components i.e. that lead to failures of type "first".

Dependability analysis (Interactions analysis)

To study the dependability between the components of the smart actuator, we constructed a component by component matrix based on the organic architecture, the physical implementation and the dysfunctional analysis as it is expected by the overall methodology. However, in order to not overload the paper, the matrix is presented as a list of possible unidirectional and bidirectional interactions:

 Power supply acts on controlled power and on H-bridge,  Controlled power acts on micro-controller,  H-bridge acts on current sensor and on coil,  Micro-controller acts on H-bridge and on master system,  Current sensor acts on micro-controller,  Coil acts on shutter,  Magnet acts on tappet and on Hall sensor,  Coil acts on inductor & magnet / inductor & magnet acts on coil,  Magnet acts on shutter / Shutter acts on magnet.

Qualitative modeling

The objective of the qualitative analysis is to model the functional and dysfunctional behaviors of the smart actuator. The models are based on all the steps upstream developed.

The FMEA study supplemented by the classification of failure modes of the components according to their nature (first or second), their establishment speed (sudden, progressive) and their amplitude (partial or complete) requires introducing failure modes and additional states. Indeed, failure modes commonly used in modeling are first failure modes. To take into account the interactions inducing collateral damage, the second failure modes are added.

Similarly, the states: "operation", "breakdown", "idle" and "repair" should be enriched with the state "degraded" which takes into account the magnitude of the failure. A "degraded" condition is defined as a condition in which the characteristics of the element are altered: the element remains functional but admits lower performance.

The figures (Fig. 10,Fig. 11,and Fig. 12) have a qualitative modeling of single step, of the single coil and the two elements with consideration of the interaction between the two. The states considered for the different elements are then:  Actuator states: idle, operating, breakdown (whatever the mission profile phase), repair and degraded,  Sub-system states: idle, operating, breakdown (depending on the phase "tempered", "cold" or "hot"), repair and degraded.

Data gathering and processing

This step is to make a wise choice of reliability distributions and parameters associated with each component to achieve the modeling steps and dynamic simulation. Table 6 presents the reliability distributions and parameters for each component of the actuator according to its technology. It should be noted that during the phases "cold" and "temperate" of the mission profile, the value of parameters is constant while during the "hot" phase the value of parameters evolves according to linear laws for both interaction levels.

For components having mechanical technology, this is the two-parameter Weibull distribution which was chosen while for electrical and electronic components or subsystems, we considered the exponential distribution.

With respect to the phases of the mission profile, the different values of the "mean time between failures" and the "failure rate" of the electronic components and/or sub-systems have been obtained using FIDES approach and EasyRel software.

For mechanical components, the values of the parameters of the Weibull distribution and their evolution are issued from the industrial know-how.

Warming of bearing

Repair degraded interaction between the bearing and coil is taken into account during the hot phase of the mission profile, the values of eta diminish linearly into two periods corresponding to the two states of degradation of the bearing: level0 and level1 damage. Fig. 13. Evolution of Weibull Eta parameter for the bearing according to the mission profile Also, Fig. 14 shows the evolution of the MTBF parameter of the exponential distribution for the coil depending on the mission profile. For the same reasons, the vertical scale has been transformed into logarithmic one. MTBF values are in millions of cycles. Likewise, during the hot phase, the values of MTBF diminish linearly into two periods corresponding to the two states of interaction of the coil with the bearing: level0 and level1 interaction.

Modeling and simulation

Modeling approaches

As discussed previously, two modeling approaches are used to implement the reliability calculation of the smart actuator and its components: Petri Nets & Monte-Carlo simulation, and Reliability Block Diagrams. The comparison of the results achieved by the two approaches is necessary to verify and validate models for both methods. Two tools were used: MOCA-RP for Petri Nets modeling and ADONIS for reliability block diagrams calculation. In order to compare the results, we used the same assumptions for computing reliability using reliability block diagrams, i.e., the calculation step and the duration of ten years.

Results analysis

Reliability analysis, phase by phase without interaction

The reliability results issued from the execution of the two approaches are presented graphically in Fig. 20 to Fig. 26. For all of these graphs, the horizontal axis represents the time in millions of cycles and the vertical axis the reliability (value between 0 and 1).

First, the three Figs. 20 to 22 have the reliability of the smart actuator and its components independently, during the three phases of the mission profile: "cold", "temperate" and "hot". These graphs are obtained both by simulation of the PN model and the reliability block diagram, assuming no interaction between components.

From Fig. 20, we can perceive that if the smart actuator operated continuously according to "cold" phase, its reliability remains of the order of 0.99 after 10 years of operation. Indeed, some of its components keep reliability of the order of 1. Likewise, as shown in Fig. 21, the reliability of the smart actuator reached 0.8 after 10 years of continuous operation, depending on the phase "temperate". This interprets into about 20% of failed products during this period. Whereas, as shown in Fig. 22 the lifetime of the smart actuator hardly reaches 5 years (67.7 million cycles), if it operated continuously along the "hot" profile. Indeed, the reliability of the smart actuator falls sharply during the first two years to about 0.1. Whatever the considered phase of the mission profile, the least reliable components are the guide bearing and the magnet inductor. Fig. 20. Reliability of the smart actuator and its components during the "cold" phase Fig. 21. Reliability of the smart actuator and its components during the "temperate" phase Fig. 22. Reliability of the smart actuator and its components during the "hot" phase Fig. 23 shows the reliability of the smart actuator during the three phases of the mission profile independently considered, assuming no interaction between components. The temperature appears to be a very influential factor on the reliability of the considered system. The more the temperature rises less its lifetime is long. Actually, after 5 years of operation (67.7 million cycles): according to the "cold" phase 99% of the products are reliable, depending on the phase "temperate" 90% are still alive, and according to the "hot" phase 100% of products are not in use.

Reliability analysis, with consideration of the interaction

In this part, we consider the interaction bearing guide / coil during the "hot" phase of the mission profile. We notice on Fig. 24 that after a 6 million operating cycles, the reliability of the two components in question drops sharply to zero after about 14 million cycles. The reliability of the smart actuator is also zero after only one year of operation. Fig. 24. Reliability of the smart actuator and its components during the "hot" phase with consideration of the bearing/coil interaction Fig. 25 shows the reliability of the smart actuator for the "hot" phase without and with consideration of the interaction. It is important to emphasize that the effect of the interaction is significant on system failure, and it can be concluded that it is absolutely necessary to consider dependencies between components in a complex system because reliability is greatly influenced. ,54 27,08 40,62 54,16 67,7 81,24 94,78 108,32121,86 135,4 Hot Phase with interaction Hot Phase without interaction Reliability analysis according to the mission profile Fig. 26 (left) shows in both cases, with and without consideration of the interaction bearing guide / coil, the reliability of the smart actuator for 10 years, according to the mission profile. Reliability decreases by corresponding bearings in successive hander at different phases of mission profile. It is easy to notice on the right graph of Fig. 26, the succession of phases in the following order: "temperate", "cold", "temperate", "hot". Indeed, the slope of the reliability curve depends on the considered phase, so that the temperature surrounding the system during operation. This slope is almost flat in the "cold" phase and very abrupt in the "hot" phase. Also, we can notice that during the "cold" and "tempered" phases the slope does not change whatever the case with or without interaction, whereas the slope is stronger with interaction during the "hot" phase compared to the case without interaction. Finally, we can observe the effect of the interaction taking into consideration in modeling the reliability of the system. Without consideration of interaction, about 15% of products can achieve a lifetime of 10 years, while considering the interaction bearing guide / coil, no product reached a lifetime of eight years.

Conclusion

In this article, we analyzed some of the problems associated with the reliability of mechatronic systems and we proposed an overall detailed ten-step methodology evaluating the predictive reliability that takes into account the specificities of these systems.

To evaluate the overall predictive reliability of a mechatronic system, it is necessary to have a model because the system doesn't exist at this stage of the development and cannot be physically tested. That is why the first part of the proposed methodology is a qualitative analysis that provides all the necessary information on the functioning and malfunctioning of a mechatronic system. The second part of the methodology is a quantitative analysis to estimate and quantify the reliability of the mechatronic system taking into account its specific conditions of use. This ten-step approach allows formalizing the consideration of reliability at each step of the system design. The use of an enriched FMEA allows to identify the failure modes of the components and to classify them according to their nature (first or second), their establishment speed (sudden, progressive) and their amplitude (partial or complete). Following the proposed approach, the FMEA must rely on the dysfunctional analysis to select the functional failure modes. The collateral interactions may be determined by analyzing the physical implementation of the components. Thus, introducing new failure modes and additional states, a behavioral model can be built taking into account the mission profile (with different conditions of use), the progressive wear of components (if necessary), and the collateral and functional interactions.

The functional and dysfunctional behavior can be modeled thanks to data gathering and processing and by using either Petri Nets, or reliability block diagrams. We validated this methodology through industrial mechatronic examples. These examples are selected in collaboration with our partner CETIM which has very special relations with many companies working in the field of mechatronics. Also, we deepened our analysis on more theoretical questions, to respond in particular to the problems of specification and modeling, collateral and functional interactions in terms of reliability and the influence of the mission profile on the distribution laws for component reliability. Although the presented study considered only one environmental parameter (temperature), the approach allows taking into account simultaneously the influence of several factors as vibration, humidity… The main limit of the methodology is, once more, the lack of reliability data, in particular concerning mechanical pieces where no database exists. Moreover, to be able to take into account progressive damaging and collateral interaction, behavior laws in specific conditions of use for components are required. But, such data are time and money consuming.

Compared with the literature review synthesized in Table 1, this methodology responds positively to all the addressed items with the exception of "human reliability analysis" and to a lesser extent "transverse dimension".

Fig. 2 .

 2 Fig. 2. Proposed Overall Methodology evaluating the predictive reliability of mechatronic systems

Fig. 4 .

 4 Fig. 4. Example of a Petri net for both functioning and failed states

  depending on the dynamic structure of the program p: Number of executions per time unit N0: Initial number of faults in the program

  failure rate 𝜆 𝑃ℎ𝑦𝑠𝑖𝑐𝑎𝑙 : Physical failure rate (Represents the physical contribution) 𝛱 𝑃𝑎𝑟𝑡_𝑀𝑎𝑛𝑢𝑓𝑎𝑐𝑡𝑢𝑟𝑖𝑛𝑔 : Reflects the quality and technical control of component manufacturing 𝛱 𝑃𝑟𝑜𝑐𝑒𝑠𝑠 : Reflects the quality and technical control of the processes of developing, manufacturing and use of products containing the component 𝛱 𝑅𝐹-𝐻𝐹 : Reflects the quality and control of the radiofrequency (RF) or high frequency (HF) product lifecycle 𝛱 𝐻-𝑀 : Reflects the quality and control of design and manufacturing of hybrid or MCM (Multi-Chip Modules) 𝛱 𝐿𝐹 : Reflects the transition factor to lead-free processes Along with FIDES, the failure rate of electronic components is calculated according to the following  Defining the mission profile information (phases, duration, temperature, humidity, vibration, etc.)  Calculating the values of Π factors (Π Process , Π Part_Manufacturing , Π Placement , C Sensivity , Π Application , Π Ruggedising , Π RF-HF , Π H-M , Π LF )  Calculating the failure rates (EASYREL tool).

Fig. 8 .

 8 Fig. 8. Functional architecture bloc diagram of the smart actuator

F3:

  Control the movement of the spindle, Diagnosis the operating state of the actuator F5: Measure the current F4: Supply electric current to the coil F6: Convert the current to strength, Ensure linear movement of the spindle, Withstand the transverse strength by the shutter, Ensure the return position of the spindle F7: Measure the spindle position F8: Communicate with the micro-controller

Fig. 10

 10 Fig. 10 shows the functional and dysfunctional model of the guide bearing considered alone.

Fig. 10 .

 10 Fig. 10. Functional and dysfunctional model of the guide bearing.

Fig. 11

 11 Fig.11shows the functional and dysfunctional model of the coil considered alone.

Fig. 11 .

 11 Fig. 11. Functional dysfunctional model of the coil.

Fig. 12

 12 Fig. 12 shows the qualitative model of the bearing and coil taking into account the unidirectional interaction bearing/coil.

Fig. 13

 13 Fig.13shows the evolution of the eta parameter of the Weibull distribution for the bearing depending on the mission profile. Because of the very low values of the parameter eta during the "hot" phase, the vertical scale has been transformed into logarithmic. Eta values are in millions of cycles. If the

Fig. 14 .

 14 Fig. 14. Evolution of Exponential distribution mean for the coil according to the mission profile

Fig. 15

 15 Fig. 15 and Fig. 16 show by way of example the PN models of the coil and the smart actuator. For the coil, the model shows the detail needed on all phases of the mission profile taking into account both the ability to interact or not with the bearing guide.

  Fig. 15. Petri net model of the coil component considering profile mission and interaction modeling

Fig. 17 .

 17 Fig. 17. Reliability Block Diagram series model of the smart actuator

Fig. 18 .

 18 Fig. 18. Weibull distribution for bearing component with initial values of parameters

Fig. 23 .

 23 Fig. 23. Reliability of the smart actuator during the three phases of the mission profile

Fig. 25 .

 25 Fig. 25. Reliability of the smart actuator during the "hot" phase without and with consideration of the interaction

Fig. 26 .

 26 Fig. 26. Reliability of the smart actuator during mission profile phases without and with consideration of the bearing/coil interaction

Table 1 .

 1 Synthetic analysis of the state of the art according to

certain criteria Study Domain Safety and/or Dependability Reliability

		Author	Ziegler 1996	Moncelet 1998	Khalfaoui 2003	Schoenig 2004	Sadou 2007	Turki 2008	Belhadaoui 2011	Mihalache 2007	Demri 2009	Martins 2013
		Reliability	-	-	-	-	-	-	+/-	+	+	+
		Mechatronics	-	+	+	+	+	+	+	+	+	-
		Modeling	+	+	+	+	+	+	+	+	+	+
		Simulation	-	+	-	+	+	-	+	+	+	-
		Transverse Dimension	-	-	-	-	-	-	-	-	-	-
	Addressed Items	Vertical Dimension Qualitative Study Quantitative Study	--+	-+ +	-+ -	--+	-+ +	-+	+ -	+ -	-+	-+

Table 2 .

 2 Dependence matrix between components (interactions)

			Sub-system 1			Sub-system 2
	Acts on	Comp 1	Comp 2	Comp 3	Comp i	Comp k	Comp n
	Sub-system 1	Comp 1 Comp 2 Comp 3	UF		BF
	Sub-system 2	Comp i Comp k Comp n	BC		UF	UC

Table 3 .

 3 Reliability distributions associated with the technology of components

	Technology	Reliability distribution	Parameters
	Electronic, Electrical	Exponential	
	Mechanical [Doyle,	Weibull	, , 
	1991]	Normal, Lognormal	,
	Software	Exponential	=kpN0 (Musa model)

Table 4 .

 4 Characteristics and objectives of the main function and constraint functions

	Function Criteria/Target	Value/Information
		Average number of opening/closing cycles before the occurrence of a first failure (MTTF)	10 million of cycles
		Desired lifetime	10 years
	MF		Intermittent operation
			Electric power: 1 slot ON-OFF/60 ms
		Operating information	Duration of an opening/closing cycle: 40 ms
			Time between two cycles: 1.67 s
			Operation time 20 h/24, 6 days/7
		Temperature and duration of the hot phase	120°C for 2/12 of cycles
	CF1	Temperature and duration of the cold phase	5°C for 4/12 of cycles
		Temperature and duration of the temperate phase	70°C for 2 times 3/12 of cycles
	CF2	Electric power and voltage	10 W and 24 V +/-5%
			Low Voltage Directive: NSC 20-030
	CF3	Meet the legislation requirements	Directive clean machine (Example: Noise
			emitted by equipment NFEN 11201)
	CF4	Meet the normative standard requirements	Degree of electrical protection: NFEN60529 Noise emitted by equipment: NFEN 11201
	CF5	Working order Stop order	TOR function (1) TOR function (0)

Table 5 .

 5 Annual mission profile of the smart actuator

	Phases	Annual duration (h) Number of cycles Operating time (h) Temperature (°C)
	Temperate	1565	3 380 400	38	70
	Cold	2087	4 507 200	50	5
	Temperate	1565	3 380 400	38	70
	Hot	1043	2 253 600	25	120
	Stop	2500	0	0	25
	Total	8760	13 521 600	151

Table 7 .

 7 Values of distribution parameters for the components and/or subsystems

Parameters value during profile mission phases (Millions of cycles for MTBF and )

	Distribution	Component/ Subsystem	Failure Mode	Cold	Temperat e	Hot
	Weibull (-)	Bearing	Intrinsic Level0 Damage Level1 Damage	2 92 000	2,5  1 000	1,5 -31,24 : 31,24  29,68 : 29,68  23,43
			Intrinsic			42,373
		Coil	Level0 Interaction	122 358	1 352	42,373  40,254
	Exponential (MTBF)	Control Conditioning	Level1 Interaction Intrinsic Intrinsic	3 916 179 8 835 645	197 685 215 917	40,254  31,78 1 858 12 544
		Magnet Inductor	Intrinsic	122 358	1 326	42,27
		Sensor	Intrinsic	17 824	17 824	17 824

The internal functional analysis (IFA) identifies the internal functions that are necessary to achieve the main functions of the system, taking into account the constraints functions identified at the previous step. An internal functional description can usually be done either by function or to a given level. A description of each level is a hierarchical tree. There are several methods to achieve this analysis. We include for example, SADT, FAST, Functional tree, functional block diagram, etc.The Functional Block Diagram (FBD) is a tool used to map the key internal functions and the relationships between these functions. The FBD usually leads to a Functional Analysis Table(FAT) for synthesizing all data.

Acknowledgements

We would like to thank the APS (Assemblée des Pays de Savoie) and the CETIM (Centre Technique des Industries Mécaniques) who funded and supported this research. We would also like to thank Pack'Aero who has agreed to apply the approach on a mechatronic product developed by the company.

Organic architecture of the smart actuator

The decomposition of the smart actuator into sub-systems and components is described in Fig. 9.