1 An introduction to Juergen Backhaus's "Lawyers' economics vs. economic analysis of law" Alain Marciano MRE and University of Montpellier, Montpellier, France1

Juergen Backhaus is undoubtedly one of the founders of law and economics in Europe [START_REF] Josselin | The Law, The Economy, The Polity. Jürgen Backhaus, A Thinker Outside the Box[END_REF][START_REF] Marciano | A Theory of Negligence[END_REF]. Partly because of his editorial activities and, of course, because of his writings. Among the latter, one can count the article that is reproduced below, "Lawyers' economics vs. economic analysis of law".

Although it was published forty years ago in the Munich Social Science Review, the article should still be read by people interested in law and economics or economic analysis of law.

Indeed, it provides a synthetic and critical presentation of "Chicago approach to law and economics" or "Chicago-type 'analysis of law'" or "Chicago legal economic analysis", emphasizing one of its most important, indeed central, aspect: efficiency and the role of the legal system in trying to promote it.

Actually, to be more precise, in his article, Backhaus only discussed one example given by one of the representatives of Chicago economic analysis of lawthe evaluation of the compensation to be given to a truck-driver victim of an accident used by Richard Posner in his Economic Analysis of Law (1972b). 2 Aware that he could have been blamed for "criticizing an entire approach by reference to a single author," Backhaus defended himself by saying that Posner was "a leading as well as a representative scholar in the field of legal-economic analysis of the Chicago type." Thus, he assumed that Chicago law and economics were perfectly represented by Posner's workthat was certainly exact, even though one can say that Ronald Coase, another representative of Chicago law and economics, was already very different from Posner. Also, he explained having chosen a "specific example" because his "paper [wa]s not intended to give complete critical assessment of Richard Posner's economic analysis of law." He was only targeting the idea that efficiency should not be used as "an important rationale of the law," what he called "lawyers' economics"that is a way of envisaging economics as a means to ''determine the proper content of legal rules and evaluate the performance of the legal system as a whole'' (Ackerman, 1977: 11, quoted in Backhaus).

With regards to this latter point, Backhaus was too modest or too cautious. One easily understands that his criticism goes largely beyond the case of this sole example. The claim he was criticizing was that the legal systemcourts, judges, juriesshould use efficiency as a normative criterion, as a goal or an end; that the legal system should try to promote efficiency, that "the logic of the law is really economics" (Posner, 1975: 764). Or, that the law should mimic the market. That was precisely the cornerstone of Posner's economic analysis of law -Backhaus noted it: "in Posner's economic analysis of law … economic efficiency sometimes seems to be assumed to be the goal of the entire legal system." And one can find it in his Economic Analysis of Law or in various articles published in the 1970s. 3That was also the idea that Posner would push further under the form of wealth maximization (1979) and that would trigger a huge controversyin particular with Ronald Dworkin (1980), Anthony [START_REF] Kronman | Wealth Maximization as a Normative Principle[END_REF][START_REF] Calabresi | An Exchange -About Law and Economics: A Letter to Ronald Dworkin[END_REF]. In other words, Backhaus had anticipated and made explicit what Posner would explicitly write one year later. His answer can also be said to have anticipated the criticisms made by others: efficiencywealth is not a value.

Indeed, Backhaus was one of the very firsts to claim that the law should not aim at promoting a Pareto efficient allocation of resources as the economy or markets do. The problem with this analysis, as Backhaus explained in his paper, is that it considers that efficiency should be the goal or end of the legal system as well as the end of the economy, and that forensic deliberationssuch as made in courtsand economic negotiationsthat took place in marketswere two different, alternative, means to reach this only goal. This, as Backhaus noted, "implies that at least in a theoretical sense the relationship between law and economics is one of substitutability." Thus, in the case of the accident of the truck-driver, the efficient compensation should be determined by the Court as it would be determined on the market, that is if the driver had not been the victim of an accident. The role of the Court, of a judge or a jury, was to compute and calculate "the precise amount of compensations to be paid in this case to the truck-driver."

To Backhaus, that view was wrong. These two procedures could and should not be put on the same footing, as if they were having the same role. The law and the economy complement each other. The role of forensic deliberations was not to do what markets would have done. It was not to decide on what was an efficient compensation. The "forensic procedures"that take place in courts -"fulfill a pacifying social function." And, in order to fulfill this function, "the forensic process has to generate a solution which appears to be just to those concerned and is acceptable to any citizen who might find himself potentially in the situation of one of the interested parties." Or, as Backhaus wrote, its purpose was to decide what was a "fair and just" compensation. 4 Once such a compensation has been decided, then, the economic part of the process could take place: that is, an efficient means to reach that "fair and just" compensation could be decided. In other words, efficiency was not a goal that should be pursued by the legal system; it was a means, a "technique" that could be used to reach a goal that had been decided elsewhere. This argument was particularly original. One should not forget that Backhaus was one of the firsts to make it. Publishing this article in the late 1970s was daring. Republishingand readingit today is important.

Alain Marciano, University of Montpellier, Department of Economics, Montpellier, France. Email: alain.marciano@umontpellier.fr

Backhaus used the second edition ofPosner's book, published in 1977.

From this perspective, one may be surprised by the fact that Backhaus did not chose to discuss other examples and in particular the decision made by Judge Learned Hand (seePosner, 1972a).

Let us note insist that Backhaus's claim was not normative. He did not say what "fair and just" meant. He seems to have favored a "contractarian" definition à la Buchanan (he cited him), that is, a solution is fair if it is accepted by the "individuals involved in the situation which poses the problem to be solved."


Keywords: Model of margin, Design under uncertainty, Industrial practice, Reliability

This paper develops a mathematical formulation of a margin problem in an automotive battery sizing use case. This formulation is done thanks to theoretical models of margin. This enables to use an approach with explicit margins, which is compared to a worstcase analysis and a probabilistic modeling. The models of margin are then adapted to a numerical implementation through the definition of patterns and presets adapted to the case study.

Models of margin: from the mathematical formulation to an operational implementation 1 Introduction

Uncertainties are generated all along the life cycle of large industrial systems, in their design, manufacturing, operation and even their end-of-life. Some quantitative methods, designated under the name of Uncertainty Quantification (UQ), have been developed to provide meaningful indicators for decision. A probabilistic modeling of these uncertainties is often used [START_REF]Uncertainty in industrial practice: a guide to quantitative uncertainty management[END_REF]. However it appears that, in some industrial collaborative contexts, UQ methods are not widely shared across the variety of engineering stakeholders who must interact together, thus limiting the opportunity to go beyond purely deterministic simulations. In these contexts, engineers keep using margins to ensure the reliability of the models, the simulations and the system in general. How-ever, the margins are often implicit or hidden, as they are not monitored [START_REF] Eckert | Design margins: a hidden issue in industry[END_REF]. Thus, they cannot be used as indicators to characterize the system.

To address this problem, some recent works, such as [START_REF] Eckert | Design margins: a hidden issue in industry[END_REF], focused on laying the theoretical foundation of the concept of margin in design science. In order to rigorously formulate problems on margins, independently from the engineering field or modeling practice, we proposed a formal mathematical framework to define margins in [START_REF] Touboul | A formal framework to define margins in industrial processes[END_REF]. More precisely, the concept of model of margin was proposed, describing the sufficient information to uniquely define a margin. This approach is pursued in this paper, based on a use case. A practical link between the model of margin and the risks prevented is presented hereafter. Section 2 gives a review of the literature on the formalization of margins. In Section 3, the industrial use case is introduced. Section 4 recalls the theory of the model of margin. Its application on the use case in Section 5 shows how models of margin can be used in an industrial context to formalize and generalize the margin practices. Section 6 presents a design pattern used to guide the numerical implementation of the margin presets for the use case.

State of the art 2.1 Scope of the work

The word margin has multiple meanings in engineering. The concept that we investigate can generally be described as an amount of something included so as to be sure of success or safety (Oxford Dictionary). It includes the notion of safety margin, that is defined for instance in [START_REF] Youngblood | Risk-Informed Safety Margin Characterization (RISMC): Integrated Treatment of Aleatory and Epistemic Uncertainty in Safety Analysis Idaho National Laboratory (INL)[END_REF] as something that is over and above what is strictly necessary and that is designed to provide for emergencies [...]. In other contexts, it can 1 be called performance margin, margin to damage, flexibility margin, and so on.

The margin of error in Statistics, which is the length of the confidence interval, does not exactly satisfy our definition, although some links could be established with it in some specific cases (e.g taking a safety margin because of a margin of error). The profit margin, which is the gain made by a given operation, is not studied in this paper.

Classic margin indicators

Some indicators from the literature of various disciplines can be identified as margins. The safety coefficients (γ1, . . . , γn), the reliability index βHL [START_REF] Lemaire | Structural reliability[END_REF], the capability process Cp [START_REF] Montgomery | Introduction to statistical quality control[END_REF] and the monetary risk measure ρ(X) [START_REF] Artzner | Coherent measures of risk[END_REF] are examples of indicators that are used to measure an extra amount of something preventing a risk. Thus, they can be described with a model of margin, which is presented in [START_REF] Touboul | A formal framework to define margins in industrial processes[END_REF]Sec 4.].

Existing margin frameworks

Some works have been conducted to manage the margins in more systematic ways. The task group on safety margins (SMAP) was motivated by the need for a unified definition to assess margins in power plants, in the context of the regulatory evaluation of design changes. One of their conclusions is that a change in safety margins must be measured with a change in probabilities of exceedance [START_REF] Hrehor | Andrej and others, Task Group on Safety Margins Action Plan (SMAP). Safety Margins Action Plan-Final Report[END_REF].

The quantification of margins and uncertainties (QMU) approach is interested in the computation of margins so as to assess safety goals in the storage of nuclear stockpiles [START_REF] Helton | Quantification of margins and uncertainties: Conceptual and computational basis[END_REF]. This framework focuses more on distinguishing the sources of uncertainties in order to have a relevant interpretation of margins than on exploiting the particular structure of margins.

In the field of complex system design, the topic of margin allocation has been the source of some recent works [START_REF] Thunnissen | Propagating and mitigating uncertainty in the design of complex multidisciplinary systems[END_REF][START_REF] Guenov | Margin Allocation and Tradeoff in Complex Systems Design and Optimization[END_REF]. The idea is to estimate the extra quantity to allocate to each design variable in early design phases. In [START_REF] Guenov | Margin Allocation and Tradeoff in Complex Systems Design and Optimization[END_REF], the margin on a design variable is defined as the difference between the chosen value and a requirement (either an upper or lower requirement). However, their margin definitions do not encompass the classic indicators such as the monetary risk measure ρ and the capability process Cp, as they cannot be taken on random variables.

The need for a margin definition which is general enough to encompass the majority of practices and precise enough to provide a good formulation of actual margin problems led us to propose our own model of margin in [START_REF] Touboul | A formal framework to define margins in industrial processes[END_REF]. While covering the classic indicators of Section 2.2, it did not contain a practical example of use of models of margin. Providing such an example is one of the aim of the remainder of this paper.

3 Industrial case: an automotive battery sizing

Initial problem

The use case presented in this section is typically part of a pre-design sizing study. To this end, simple models are used in order to get a first idea of the characteristics of the system. The numerical values used in this paper are provided for the purpose of the demonstration only and are not actual values used by our industrial partners.

The system of interest for this use case is a battery used to power the starting engine of an automotive combustion engine. The battery also supplies the vehicle components with power when the engine is not running. When the engine is running, the alternator provides enough power to charge the battery and to operate the car devices.

We concentrate hereafter on satisfying the requirement: the battery should store and supply enough energy to crank the engine running in tough conditions. It is refined as follows:

• The battery must handle at least 6 months of storage in warm, temperate and cold countries;

• To ensure that the engine actually start, there must be enough power to perform three cranking.

Modeled phenomena

The variables used in this section are classified and explained in Table 1 and Table 2. Due to the specific needs of our analysis, we chose to only model the following phenomena:

Self-discharge Because of their internal electric conductivity, batteries cannot keep their state of charge, even when unused. The conductivity is temperature-dependent and thus affects the self-discharge rate. We assume furthermore that the discharge rate is independent from the battery state of charge at a given time. The energy consumed during a period of inactivity of tin is approximated by:

E discharge = C batt V batt tin k0(θ dis -θ ref 1 ) α (1)
Post-cooling After the engine stops, some additional energy is required to cool the engine and avoid hot spots. The post-cooling energy is expressed as:

E cool =    0, if θ < θs P cool (tm + (tc -tm) θ cool -θs θc-θs ), if θ ∈ [θs; θc] P cool tc, if θ > θc. ( 2
)
Electronic Control Unit standby mode Most of the car embedded electronics components (ECU) -like the battery management system -keep operating periodically after the engine is stopped. This is modeled as a linear cost with respect to the parking duration:

Starting energy

The energy required to start the engine is dependent on the temperature. This has an impact on the duration of the starting phase, which is modeled by a dependency of the time on the temperature:

Estart = Pstart tstart + K1(θstart -θ ref 2 ) β + ( 4
)
Total energy consumed The starting energy is counted three times to match the requirements. The expression of the total energy consumed is:

E batt = E discharge + E cool + E standby + 3 Estart (5)
from which we deduce the expression of the total consumed capacity:

C batt = E batt V batt . ( 6
)

Aim of the analysis

The goal of the analysis is to determine the minimum battery capacity Creq that fulfills the requirements stated in Section is true. The temperature constraints θ + cool , θ + dis , θ - start represent the range of temperature for which the requirements must hold. The other limits, θ - cool , θ - dis and θ + start are not considered here, as they have no influence on our modeling.

Model of margin

A model of margin contains the information required from the analysis of a phenomenon to uniquely define a (effective) margin. This concept has been extensively developed in [START_REF] Touboul | A formal framework to define margins in industrial processes[END_REF] and the reader is invited to refer to it for a comprehensive introduction to the concept. In this section, we recall from [3, Sec 2.1] the notation used in the model of margin.

Model of margin

We call U the variable of interest, for which one is interested in computing a margin. U is a random variable on a probability space (Ω, F, P) and it takes its values in E.

Definition 4.1 (Problem description). The problem description is defined by the triple (E, C, A

). E is the state space. The set of problem constraints C and the acceptance set A are two subsets of the random variables on E, denoted by L 0 (Ω, E).

C characterizes the values that can be taken by the variables describing the phenomenon U due to constraints given by the model -such as physical or logical constraints.

A discriminates the values of U that are acceptable and then included in this set, and those that are not. Definition 4.2 (Probing set). Let (E, C, A) be a problem description. The family of probing sets is a family of subsets of E indexed by U ∈ C, and is denoted by (GU ) U ∈C . The intersection between a probing set and the problem constraints is

G U |C = GU ∩ C.
GU gives the extent of the point evolution that one wants to consider when computing a margin at the point U . The set of coordinates of interest S represents the quantities on which one wants to express a margin, which will be measured by the distance dS. φU is the coordinate function which associates each element of GU with its coordinates in S.

Definition 4.4 (Model of margin).

A model of margin is the combination of a problem description, a family of probing sets and a set of coordinates of interest with the corresponding coordinate functions. It is denoted by:

M = (E, C, A, (GU ) U ∈C , S, dS, (φU ) U ∈C ) (8)

Margin

m (U ; M) =    dS φU (U ), φU (A c ∩ G U |C ) if U ∈ A, -dS φU (U ), φU (A c ∩ G U |C ) c ∩ φU (G U |C ) if U ∈ A. (9)
Intuitively, the margin for a given point U is the distance from this point to the acceptance set, for some chosen evolution and focusing only on some coordinates describing the variable of interest. U can be a random variable, but the margin is ultimately expressed as a distance dS in a deterministic metric space S.

Directional margin

A model of directional margin is a special case of model of margin that consists in probingi.e exploring -the points in one specific direction from the reference point and measuring the distance from this point to the unacceptable points in this specific direction.

The state space E is a vector space and we denote by w ∈ E the specific direction of the directional model of margin M. The margin at the point U ∈ A has the following expression:

m (U ; M) = inf {λ ≥ 0 |U + λw ∈ A c ∩ C } .

Taking a margin

Taking a margin on a set of points

when one speaks of taking a margin m, most of the times they implicitly think of defining a model of margin M and imposing a minimum margin m > 0 for this model of margin. In that case, the requirement value m is called the demanded margin, by opposition to an effective margin, which is the margin actually measured for a point U . In this paper, instead of writing that the acceptance set A of the model of margin M is reduced by the condition m (U ; M) > m, we write that m margin is taken in M.

Taking a margin on a point

Sometimes, it is easy to choose the "best" point U * as a unique solution of:

U * = arg min U ∈A c(U ). ( 10
)
c is a cost function, and it can possibly be trivial to compute. It can be the value of one coordinate of U for instance. It might be easy as well to choose the best point V * from the "marged" acceptance set {V ∈ A|m (V ; M) ≥ m} for the same cost function. It seems common that, in that case, one says that "V * is the point U * with m margin".

Application to the industrial case

In this section, we compare two classic design methods to choose the battery capacity to an approach enabled by the model of margin, namely the design with explicit margins. Each of the three method have in common a formulation of an optimization problem under constraints:

C * req = arg min Creq∈D Creq. ( 11
)
The difference lies in the construction of the optimization space D.

Three design approaches

Worst-case design

The worst-case approach consists in taking each environment variable at its worst value for all the considered environments. Looking at the given reference values in Table 3, and considering the monotony of the capacity with respect to the environment variables, the worst case happens when θ + cool = 80 • C, θ + dis = 35 • C and θ - start = -18 • C. The optimization space D is then constructed by applying the condition of Equation [START_REF] Artzner | Coherent measures of risk[END_REF] with the aforementioned values. Thanks to the monotonicity of the model, we compute the optimal design as C batt (80, -18, 35), which leads to a numerical value of:

C * req = 92 A h. This approach is interpreted as a sequential margin accumulation in Section 5.2.

Environment θ

+ cool θ + dis θ - start probability Temperate 65 • C 20 • C 0 • C p temp Cold 65 • C 20 • C -18 • C p cold Warm 80 • C 35 • C 0 • C p warm
Table 3: Reference environment constraints depending on the environment.

Probabilistic design

in the probabilistic approach, each environment of Table 3 is assigned to an event. The universe is then composed of three exclusive events Ω = {ωtemp, ω cold , ωwarm}, modeling the event "being in a temperate (resp. cold and warm) country". A probability measure is constructed from data on the consumer profiles and assigns the probabilities ptemp,p cold and pwarm to each event. θ + cool ,θ + dis and θ - start are now random variables whose laws are given by the values associated to the probability of each scenario (see Table 3).

C batt is then also a random variable. The criteria is reformulated in "satisfying Equation [START_REF] Artzner | Coherent measures of risk[END_REF] with a probability of γ ∈ [0, 1]". The optimization space D is then given by the values Creq for which:

P C batt (θ + cool , θ + start , θ - dis ) ≤ Creq ≥ γ. ( 12
)
As illustrated in Figure 1, different choices of C * req are possible (43 A h, 63 A h or 69 A h), depending on the γ chosen.

One can remark that even for γ = 1, i.e when Equation ( 7) is always satisfied, the optimal value Creq is 69 A h, which is smaller than the worst-case value 92 A h. This characteristic is captured in margin framework, by performing a mutual accumulation on the margins instead of a sequential one, as explained in Section 5.2.

Design with explicit margins

the global motivation of the proposed approach is to ensure that all the margins considered in the analysis are relevant. Margins can be explicitly identified and described thanks to their models of margin.

In Table 3, one can see that a margin of -18 • C has been taken for θ - start in the cold environment, with respect to the temperate one. A margin of 15 • C for θ + cool and θ + dis has been taken in the warm environment.

As a car cannot be in a cold country and in a warm country at the same time, a simple rule is to consider that these margins must not be taken "at the same time", but instead separately. By applying this rule, one computes C * req as the maximum of C batt (65, 20, -18) and C batt (80, 35, 0). The numerical value is the same as the probabilistic modeling with γ = 1:

C * req = 69 A h. The rigorous interpretation of this use case in terms of models of margin is presented in Section 5.2. The rule is generalized in Section 5.3. Section 6 gives some insights to implement it globally as a numerical tool.

Detail of the design with explicit margins

We reformulate the industrial case within our margin framework. To do so, we first construct a deterministic problem description of the models of margin. The state space E is chosen to be the set of the design variables and the environment constraints given in Table 1. The set of the problem constraints C is given by the equations of Section 3.2. The acceptance set A is composed of the states satisfying the criterion of Equation [START_REF] Artzner | Coherent measures of risk[END_REF]. U represents a battery designed for temperate countries. We want to prevent two risks that are not modeled in the problem description:

• (R1): being parked in a cold country and running out of battery;

• (R2): being parked in a hot country and running out of battery.

We define M1, a directional model of margin in the direction of a decrease in θ - start . To prevent (R1), we take a margin of 18 • C in M1, i.e we impose a smaller minimum starting temperature. We define M2, a directional model of margin in the direction of an increase in θ + cool , θ + dis . To prevent (R2), we take a margin of 15 • C in M2, i.e we impose a greater maximum cooling and mean temperature.

These two margins lead to the conditions of Table 3 for warm and cold countries. In order to choose our best design, we use an informal design rule: When two risks are mutually exclusive, there is no need to add up the margins taken for each event. Instead, one could consider the possible designs with margins for each event separately and choose the best among their intersections. This rule actually describes an implicit consideration modeled in the probabilistic design. As a car cannot be parked in a cold country and in a warm country at the same time, the values of the constraints θ + dis = 35 • C and θstart = -18 • C should not be imposed at the same time. The optimization space D is then the intersection of the designs with a margin of 18 • C in M1 and of the designs with a margin of 15 • C in M2:

D = U ∈ L 0 (Ω, E) |m (U ; M1) ≥ 18 • C ∩ U ∈ L 0 (Ω, E) |m (U ; M2) ≥ 15 • C (13)
The impact of different strategies of margin accumulation is illustrated in Figure 2. With this method, our optimal value is:

C * req = 69 A h. ( 14
)
This result is the same as the probabilistic design with γ = 1.

Generalization of the industrial case

The example given in the previous section will help generalizing it. During the design process, multiple margins are taken to cover various risks. This process can be described as:

1. Starting with some failure criteria that define a set of acceptable designs A.

In the previous case, A is given by Equation (7).

2. Considering a first risk R1, that is not prevented by the failure criteria.

In the previous case R1 is "being parked in a cold country and running out of battery"'.

3. Taking some margins on some quantities to cover the risk R1. m1 = 18 • C margin in M1 has been taken in the previous case.

4. For each other risk Ri repeating Step 3.

Only R2 "being parked in a warm country and running out of battery" has been considered previously.

5. Getting a "marged" acceptance set Amarg covering all the risks considered. This set was denoted by D in the previous case.

6. Choosing an optimal design among Amarg.

The optimal design was Creq = 69 A h in the previous case.

Margin accumulation strategies

An interesting remark that can be made from the previous case is that there are (at least) two different ways to take two margins simultaneously. Let us denote by M(A) the model of margin M in which its original acceptance set is replaced with A. The two ways are:

Sequential accumulation considering a margin m1

has been taken in M1, take an additional margin m2 in M2.

A1 = {U ∈ A |m (U ; M1(A)) ≥ m1 } Amarg = {U ∈ A |m (U ; M2(A1)) ≥ m2 } . ( 15
)
An illustration of sequential margins accumulation is shown in Figure 3a. This leads to the worst-case design in the industrial case.

Mutual accumulation the points U are required to have m1 margin in M1 and m2 margin in M2:

Amarg = {U ∈ A |m (U ; M1(A)) ≥ m1 } ∩ {U ∈ A |m (U ; M2(A)) ≥ m2 } . ( 16
)
An illustration of mutual margins accumulation is shown in Figure 3b. This leads to the design with explicit margins in the industrial case. It is possible to prove that the "marged" acceptance set Amarg resulting from the sequential accumulation is always smaller than or equal to the one from the mutual accumulation. The argument is that, as A1 ⊂ A, the sequential marged acceptance set is included in {U ∈ A |m (U ; M2(A)) ≥ m2 } and also in A1. This is illustrated in the comparison of Figure 3c. Nonetheless, the sequential accumulation should not be forbidden. In fact, both strategies are relevant depending on the purpose of the accumulation.

The purpose of the sequential accumulation is first to prevent the risk R1 by taking a margin of m1 in M1. Then, assuming this risk occurs, one prevents a second risk R2 (potentially the same) by taking a margin of m2 in M2.

The mutual accumulation can be seen as preventing a risk R1 by taking a margin of m1 in M1 and a second risk R2 by taking a margin of m2 in M2. The case in which R1 and R2 happen at the same time is not considered, though.

It is now possible to rewrite the informal design rule as follows:

Assuming that R1 and R2 are two risks that cannot happen at the same time and a margin of m1 (resp. m2) has been taken in M1 (resp. M2) to cover R1 (resp. R2), the final acceptance set covering R1 and R2 can be constructed by the mutual accumulation of m1 taken in M1 and m2 taken in M2.

It is assumed that the models of margin M1 and M2 share the same problem description and, in particular, the same acceptance set.

On the construction of the acceptance set A

in an optimization context of the type:

U * = arg min U ∈{V ∈A|m(V ;M)≥m} c(U ) (17)
it seems to be a good practice to take margins on the intensity of the environment constraintsθ + cool for instancerather than on some actual values of the environment variablesθ cool for instance.

Taking a margin on a constraint only imposes a stronger constraint, e.g a greater θ + cool . Now, let us assume that θ cool is included in the point U instead of θ + cool . In that case, a temperate constraint θ cool > 65 • C would likely be included in the acceptance set, to make sure that the design would fulfill the temperate country requirements. A margin for the warm countries in an increase θ cool would forbid any θ cool value between 65 • C and 80 • C. Then, even a mutual accumulation would impose θ cool ≥ 80 • C. With a similar reasoning on the two other environment variables, the optimal design would be the worst-case, instead of the one with explicit margins.

Method

C req Worst-case 92 A h + The simplest.

-Very conservative.

Explicit margins 69 A h

+ No more additional phenomena modeling than in the worst-case, performs better, interpretation in terms of margins.

-Needs a modeling of the margins and of the risks.

Probabilistic model

Depends on γ, ≤ 69 A h + Takes into account the correlations.

-Requires a probabilistic framework.

): Boolean SubsetOfCoordinateOfInterest [1] * [1] * [1] * coordFunct [1] 1 [1] 1 [1] 1 probingSet [1] 1

Association

Composition Dependency

A B b [1] * A B b [1] 1 A B
A class A has an association with another class B if an object of class A needs to maintain a reference to an object of class B. [START_REF] Cranefield | formation Science Discussion Papers Series[END_REF] A composition is an unidirectional association, It means that A is composed of B.

A Dependency is a Relationship that signifies that a single model Element or a set of model Elements requires other model Elements for their specification or implementation. [START_REF]Object management Group[END_REF] Figure 4: Description of Margin metamodel using UML Class Diagram

Conclusion of the section

The margin that were taken during the design are now rigorously defined, thanks to the models of margin. This rigorous formulation helped us expressing a particular design margin rule for general cases. This illustrates the aim and the potential of the model of margin: to formulate problems on margins and their solutions in a rigorous, general way.

Structure of an implementation of a model of margin

The previous formulation of the model of margin allows an exhaustiveness to manage each model of margin. However, it may not be simple enough to be used by a specialist simulation designer. In this section, a software design pattern for the model of margin is built. This pattern enables the definition of presets that could be plugged to each concept of model of margin. A focus on the preset for the use case is presented. The pattern will be described thanks to a metamodel, that defines the concepts and the relationships be-tween these concepts.

Metamodel definition

The metamodel of model of margin describes its components, for the purpose of their software implementations. The Unified Modeling Language (UML) is used to describe the metamodel, although one does not need to be familiar with it to understand the patterns we expose. When some UML concepts are used in a figure, their meaning is given in a table below the figure.

A UML class, represented as a box, has the same meaning as classes described in programming language as C++, Java, or Modelica. It is a collection of properties and operations. Classes can be seen as a mold, where instances can be seen as items generated from a class.

Each mathematical object is modeled with an abstract class, which is a class that cannot be instantiated as is. The classes that are actually instantiated all inherit from the abstract classes. The process of inheritance consists in imposing the feature (attributes and methods/operations) interfaces of the parent abstract class to the classes that inherit from it. To differentiate abstract classes from other classes, the name of abstract classes is written in italic. For instance, in Figure 4, each model of margin must have a class inheriting from ProblemConstraints. Each of these classes must have an operation getState, which represents the computation of the state (inputs and outputs) with respect to the inputs. However, the operation getState can be different for two models of margin, as they can refer to different phenomena.

Problem description

the abstract class ModelOfMargin is associated with the ProblemConstraints, StateFactory and AcceptanceSet abstract classes. The three latter classes come from a prior modeling, without any margin consideration a priori. They can then exist without the model of margin, and consequently, an association link is used.

State space

The role of the state space E in the mathematical model of margin is to declare what are the variables that would be of interest in the model. The variables can either be input, intermediary or output variables. The numerical counterpart is the StateFactory, which defines how to instantiate the state.

The BatteryState of the use case (Figure 5) is implemented to be used in an optimization context. The distinction between the design parameters, the battery outputs and the environment variables allows to identify the variables on which an optimization algorithm can operate. These variables are taken from Tables 1 and2. The BatteryStateSpace has a method BuildBatteryState(. . . ) to construct a state instance.

Problem constraints as written in the introduction, an implementation of ProblemConstraints must have a method getState. This method is given by the models simulating the phenomenon.

Acceptance set For the numerical representation of A,

we only impose that any representation inheriting from Ac-ceptanceSet has an "oracle function" isStateAcceptable. This function returns "True" if the state given in argument is in acceptance set and "False" otherwise. The construction of this acceptance criterion may come from various sources. For instance it can be some requirements specifications documents, the simulation itself, or a demanded margin condition.

The initial acceptance set of the use case has come from the criterion of Equation ( 7) and was deduced from the high level requirements. The quantity ρ = C batt -Creq can be identified as a measure of the risk, that must be smaller than the threshold ρreq = 0. It can thus be modeled with a RiskMeasureAcceptanceSet, as shown in Figure 6 It has been stated that taking a margin consists in reducing the acceptance set by imposing m (U ; M) ≥ m (see Section 4.4.1). The implementation of this operation is illustrated in Figure 6 in the MarginThresholdRiskMeasure class. The condition can be expressed with risk measure, by defining ρ(U ) = -m (U ; M) and ρreq = -m.

Specific objects of the model of margin

The problem description comes from the modeling of the phenomenon. The other objects, such as the probing set or the coordinate functions are specific to the model of margin. Each model of margin specific object is defined as an abstract class. Theses classes could not exist without a model of margin and thus, they have a composition link with the ModelOfMargin abstract class.

Probing set for each state U , the classes inheriting from

ProbingSet must describe the value of the states that would be explored in the computation of the margin. In a directional model of margin, it is implemented as a vector. This direction vector represents the semi-line starting at the state U and going in the direction of the vector.

In the use case, the two models of margin defined in Section 5.2 are directional margins. The probing direction of M1 is -e θ - start , the unit vector in θ - start and the probing direction of M2 is e θ + cool + e θ + dis , the sum of the two unit vectors in θ + cool and in θ + dis .

Coordinates functions and coordinates of interest the specialization of CoordinateFunctions must carry the information to project any state in the ProbingSet to element of CoordinatesOfInterest.

In a directional model of margin, the coordinate of interest is formed by the abscissa of points on the semi-line. It can thus be deduced from the direction vector. In this case, the information of the CoordinateFunctions and Coordina-teOfInterest can be factorized with the information used to construct the probing set.

Distance the implementation of Distance must describe how to compute a distance between two elements of Coordi-natesOfInterest.

By convention, in a directional model of margin, the direction vector defining the ProbingSet (Section 6.1.2) is also the "unit vector" defining the Distance. However, the (mathematical) probing set and the distance remain two different conceptual objects.

Conclusion and future work

The application of the theoretical model of margin presented in Section 4 to the automotive case of Section 3 helped:

• Formulating a margin problem and formulating its solution in a rigorous way, in Section 5.2.

• Generalizing the solution so it can be applied in a approach of design with explicit margin, in Section 5.3. This approach consist in identifying the relevant margins.

• Deducing some software design patterns for a numerical use of the model of margin, in Section 6.

This is an encouraging sign for the ability of the model of margin to formalize practical margin approaches to handle risk. Some different axes can be identified for some future developments:

• Other margin practices and rules can be identified in industrial cases with different contexts. Their rigorous formulation with the model of margin could help to standardize these practices for interacting stakeholders.

• Taking a margin is closely linked to a risk to prevent. This risk is not formalized in the model of margin. Is it possible to construct an operating model of risk that keeps some of the genericity of the model of margin?

• On a more theoretical aspect, the model of margin is itself a mathematical object. Studying it can help providing some general classes of solutions for problems such as computing a margin or optimizing a design under a demanded margin constraint.

Definition 4 . 3 (

 43 Coordinates of interest). Let (E, C, A) be a problem description and (GU ) U ∈C a family of probing sets. A set of coordinates of interest is a metric space (S, dS), provided with a family of functions φU : GU → S indexed by U ∈ C. The family (φU ) U ∈C is called the family of coordinate functions.

Definition 4 . 5 (

 45 Margin). Let M = (E, C, A, (GU ) U ∈C , S, dS, (φU ) U ∈C ) be a given margin model and U ∈ C a variable of interest. The margin at the point U for the model M is defined as:

Figure 1 :

 1 Figure 1: Probability γ to satisfy the constraint with respect to the value of C req . This is also the cumulative distribution function of C batt .

Figure 2 :

 2 Figure2: Reduction of the optimization space depending on the accumulation strategy. D 1 is the optimization space in the design with explicit margins and D 2 is the optimization space in the worst case.

  (a) Sequential margins accumulation of a margin of 1 taken in M 1 then of margin of 0.5 taken in M 2 . (b) Mutual margin accumulation of 1 margin taken in M 1 and 0.5 margin taken in M 2 . (c) Comparison of both strategies (sequential is in plain grey and mutual is dotted).

Figure 3 :

 3 Figure 3: Two strategies of margins accumulation for the acceptance set A = (x, y)|y ≥ x 2 . M 1 is a directional model of margin on a decrease in x and M 2 is a directional model of margin on a decrease in y. A margin of 1 is taken in M 1 and a margin of 0.5 is taken in M 2 .

Table 1 :

 1 Description of model variables

	Variable Description	Unit
		Design parameters
	C req	Minimum battery capacity needed	A h
		Environment constraints
	θ + cool	Maximum cooling tempera-ture required	K
	θ -start	Minimum starting tempera-ture required	K
	θ + dis	Maximum mean temperature required	K
		Non-controllable variables
	C batt	Capacity consumed	A h
	E start	Energy required to start the vehicle	J
	E discharge Battery self-discharge energy	J
	E cool	Energy used to cooling engine	J
	E standby	Energy consumed by standby equipments	J
	θ dis	Mean battery temperature	K
	θ cool	Engine temperature (cooling)	K
	θ start	Engine temperature (start)	K
		E standby = E0 + P standby tin.	(3)

Table 2 :

 2 Description of model constants.

	3.1. The designer must choose the design parameter Creq
	such that for all θ cool ≤ θ + cool , θ dis ≤ θ + dis and θstart ≥ θ -start
	the inequation:
	Creq ≥ C batt (θ cool , θstart, θ dis ).	(7)

Table 4 :

 4 Comparison of the three design methods

		ModelOfMargin
		operations
	Problem description	getMargin( v: Inputs): Real
	StateFactory		ProbingSet
	ProblemConstraints
	operations	CoordinateFunction	CoordinateOfInterest
	getState( v: Inputs): State
	AcceptanceSet
	operations		Distance
	isStateAcceptable( u: State

  . In this specialization of AcceptanceSet, isStateAcceptable is True if and only if ρ(State) ≤ ρreq.

	EnvironementVariables
	attributes DesignParameters θ + cool : Real θ -dis : Real θ + start : Real	BatteryState attributes cool : Real θ + θ -dis : Real θ + start : Real	BatteryStateSpace StateFactory
	attributes	Cbatt: Real	operations
	Cbatt: Real BatteryOutputs	Edischarge: Real Ecool: Real Estandby: Real	BuildBattState( θ + cool ...
	attributes	Estart: Real
	Edischarge: Real
	Ecool: Real
	Estandby: Real
	Estart: Real
		Generalization
		A	B
	B class inherits from A class means that all charac-
	teristics of A class are included in B class
	Figure 5: State of case study
	ModelOfMargin		Risk
	previousModelOfMargins [1]	[*]
	1		RiskMeasure
	MarginThresholdRiskMeasure	attributes
	attributes		riskThreshold: Real [1]
	precedingMargins: Real		operations
			riskMeasure( u: State): Real [1..*]
	AcceptanceSet			[1..*]
			RiskMeasureAcceptanceSet
	riskMeasure(u)≤riskThreshold return true if	isStateAcceptable( u: State): Boolean operations	1

1 Figure 6: AcceptanceSet implementation for the case study .

Acknowledgment

The authors acknowledge Julien Reygner and Mouadh Yagoubi for their support during the redaction of the article. Exchanges with the members of the AMC team at IRT SystemX were also of great importance to shape up the margin concept.

* This research work has been carried out under the leadership of the Technological Research Institute SystemX, and therefore granted with public funds within the scope of the French Program "Investissements d'Avenir".