L Jaeger
email: jaeger@lgmt.ups-tlse.fr

T Jorquera
email: tom.jorquera@irit.fr

S Lemouzy
email: lemouzy@irit.fr

C Gogu

S Segonds

C Bes

Uncertainty propagation in multi-agent systems for multidisciplinary optimization problems

Keywords: Optimization, uncertainty, multi-agent, security coefficient, multidisciplinarity

Because of uncertainties on models and variables, deterministic multidisciplinary optimization may achieve under-sizing (without design margins) or over-sizing (with arbitrary design margins). Thus, it is necessary to implement multidisciplinary optimization methods that take into account the uncertainties in order to design systems that are both robust and reliable. Probabilistic methods such as reliability-based design optimization (RBDO) or robust design methods, provide designers with powerful decision-making tools but may involve very time-consuming calculations. New optimization approaches have been developed to deal with such complex problems. Auto-adaptive Multi-Agent Systems (AMAS) is a new approach developed recently, allowing to take into account the various aspects of a multidisciplinary optimization problem (multi-level, computation burden etc.). This approach was suggested for solving complex deterministic optimization problem. Now, the question of the integration of uncertainties in this multi-agent based optimization arises. The aim of this paper is to propose a new methodology for integrating the treatment of uncertainties in an adaptive multi-agent system for sequential optimization. The developed method employs a single loop process in which cycles of deterministic optimization alternate with evaluations of the system reliability. For each cycle, the optimization and the reliability analysis are decoupled from each other. The reliability analysis is carried out at agent level and only after the resolution of the deterministic optimization, to verify the feasibility of the constraints under uncertainties. Following the probabilistic study, the constraints violated (with low reliability) are shifted to the area of feasibility by integrating adaptive safety coefficients whose calculations are based on the agent-level reliability information. The method developed is applied to a conceptual aircraft design problem. 2.

Introduction

The models which are used in preliminary design are often derived from empirical equations or simplified physical models. Modeling uncertainties generated by the models are prevalent and the resulting system following a deterministic optimization may not achieve the required performance when subjected to a more detailed analysis in the following phases of the design. Therefore it is necessary to implement methods taking into account the uncertainties since the early stages of design optimization in order to design systems that are both reliable and robust and thus ensure the success of the project on time and budget. Probabilistic methods such as reliability-based design optimization (RBDO) and robust design methods [START_REF] Beyer | Robust optimization -a comprehensive survey[END_REF] provide designers with powerful decision-making tools but imply sometimes very time-consuming calculations, since the optimization procedure involves a double loop: iteration of the deterministic optimization process followed by a probabilistic analysis. Indeed, in order to determine the probabilistic characteristics of the system performances at a design point, it is necessary to perform some analysis, either by using approaches such as Monte Carlo simulation, importance sampling, subset simulations, or by using various analytical methods for probabilistic analysis as FORM, SORM. Many studies have been conducted before on this basis leading to the development of efficient technics with low computational time and to take into account the uncertainties in the design process of systems engineering.

Alongside these developments, new optimization approaches have also been proposed to deal with large industrial problems. Indeed, nowadays, systems are increasingly complex and design methods deployed involve aspects of multilevel and multi-disciplines [START_REF] Sobieszczanski-Sobieski | Multidisciplinary aerospace design optimization: survey of recent developments[END_REF]. The classical optimization methods can be difficult to implement in order to address these complex problems for which the number of variables and models is too high [START_REF] Welcomme | A self-organising multiagent system managing complex system design application to conceptual aircraft design[END_REF]. The difficulties of solving such optimization problems have motivated the development of new methods based on the adaptive multi-agent system (AMAS) approach. The multi-agent approach has been especially proposed for solving complex problems such as aircraft preliminary design in which we are particularly interested in this paper. The question of the integration of uncertainty in the multiagent framework arises. Our work attempts to give a first answer to this question by proposing a new methodology for taking into account uncertainties in a sequential multi-agent optimization problem. This paper is organized as follows. In the section 4, we explain the developped reliability design optimization method which is based on a single loop calculations: in a cycle, a deterministic optimization is solved, then a probabilistic analysis is conducted based on the determination of the reliability constraints. The violated constraints will be shifted with the introduction of a global safety coefficient. After having first explained the principle of solving a deterministic optimization problem by multi-agent method in section 4.1, we explain the proposed method for taking into account uncertainties in a multi-agent system in sections 4.2 and 4.3. In the section 5 we apply the developed method for managing uncertainty on a preliminary aircraft design test case. Finally, conclusions and perspectives will be presented.

4. Methodology for managing uncertainties in a problem solving by multi-agent 4.1. Principle for solving a deterministic problem by a multi-agent system Nowadays, most of design problems are complex multidisciplinary optimization problems involving both the optimization of design parameters (masses, geometries, etc..) and performance optimization (for exemple the maximum takeoff length in the case of an airplane). The use of appropriate methodologies of MDO type (Multidisciplinary Design Optimization) facilitates the convergence and reduces the computational time to obtain a performant optimal solution. In the current work conducted within the ID4CS project (Integrated Design for Complex System ), a specific theory called Adaptive Multi-Agent System (AMAS) is applied to carry out the solving of an MDO problem. The goal of the project is to develop a system which permits to take into account all MDO aspects and help engineers in solving complex optimization problems, with applications being implemented in the domain of aeronautical design. The AMAS system is a system composed of several autonomous entities called agents. An agent has one or more local targets and interacts with other agents to meet its objectives. Studies have shown that this type of system can be used for solving optimization problems [START_REF] Welcomme | A self-organising multiagent system managing complex system design application to conceptual aircraft design[END_REF]. We explain the principle of a multi-agent system with a simple test case: a study case inspired by Alexandrov [4]. This study case 1 is representative of a multidisciplinary optimization problem (feedback loops between the disciplines): . Like the objective agent, it is a specialisation of a model agent and it computes only one ouput value. It acts in order to keep this value greater or lower than a constant value (generaly 0). The agent sends directly requests to its input variables in order to achieve this goal. a variable agent: represents the variables of the problem. A variable agent can be connected as an input of one or several model, constraint or objective. In this case, the variable provides its value which enable connected agents to figure out their own ouput values. A variable agent can also be connected to one (and only one) model agent as an output. Its value is then the output value of the model agent. When a variable agent is only connected as an input, it is able to satisfy any value modification request by directly changing its internal value. When the agent is connected as an output of the model m, and because it's own value depends on the value computed by m, it will be only able to change its value indirectly by sending a request to m.

     min l1,l2,s 1 2 (a 1 ➨ + 10a 2 ➨ + 5(s -3)➨) s -10l 1 -1 ≤ 0 -s + l 2 + 2 ≤ 0 (1) with a 1 = l1-a2
As the function of the different agents was introduced, we can briefly introduce now the resolution approach for solving multidisciplinary optimization problem through a multi-agent system. In this simple example it is assumed that the variables and the input parameters have arbitrary initial values. We also assume that the objective-function agent (in which the performance to minimize is encapsulated) decides based on some internal decision algorithm to ask the variable a 2 to take another value in order to improve the system performance. The approach followed by the multi-agent system is now explained. a 2 is a variable associated with a model, it can not choose to change its own value, it must forward the request to the model. A local optimization is then performed at the level of the model agent to meet this demand. The optimizer returns the values of the model (a 1 and l 2 ) which are solutions of the problem. Then the model agent sends the necessary queries to its inputs. To simplify the explanations we assume that l 2 has the correct value (therefore no query is sent). Because the variable a 1 can not change the value itself, a query is sent to its model. The model uses the optimizer (which may be different from the one previously used) to process the request. The optimizer returns a value for a 2 and l 1 (again, we chose to simplify the example, a 2 has the required value). The model sends a message to the entry l 1 . l 1 is a parameter, it may itself decide to change its value. It accepts the request and informs the entities related to him that there is a change. The model can now calculate the new value of a 1 . As a 1 changes its value, it informs the entities related to it. The model can now calculate the new value of a 2 . Since the value of a 2 is changed, the model agent informs the entities related to him that there is a change. Thus, the model must calculate a new value for a 1 , etc.. This behavior is repeated up to a stopping criterion, generally up to stabilization of the system.

Sequential optimization methods implemented

To incorporate uncertainty management in an optimization problem solved by this multi-agent system, we opt in this paper for a single loop strategy. We adapt classical methods based on adaptive safety factors [START_REF] Wu | Safety-factor based approach for probabilistic-based design optimization[END_REF]. The implementation approach has the advantage of being easily coupled to the logic of a multi-angent resolution as discussed in more detail in this section. We present below a description of this approach.

In a probabilistic design, most calculations are performed in order to allow the assessment of the system reliability. Therefore, to improve the overall efficiency of the probabilistic optimization we need to minimize the number of reliability evaluations. To achieve this goal, we use a single loop method: a series of cycles of deterministic optimization and reliability assessment. Each cycle of the optimization process includes two decoupled analysis: a deterministic optimization and an analysis of the reliability of the system at the deterministic optimum point. The reliability study permits to verify if each constraint is met with a certain level of reliability which is imposed. In the approach we propose, the optimization problem is solved by a multi-agent system (see 4.1) then the reliability of the obtained optimum is measured (analytically or by Monte Carlo simulations according to the problem being addressed). If the performance is not achieved, we introduce a global safety factor in the calculation of the limit states, so that the constraints are met with a level of reliability at least equal to 90%. Then, we start a new determinist optimization cycle from the last obtained point (used for uncertainty propagation). We can notice that it is possible that the new constraints (with safety factors) are not satisfied at this point of the search space. If it could be a problem for standard optimisation methods like Pattern Search, the mutli-agent optimization approch used in this study doesn't need such kind of constraint satisfaction for the starting point. This method requires fewer iterations of the optimization process and reliability assessments in order to converge, thus making the process more efficient than double loops reliability methods. This process of probabilistic optimization problem solving is detailed in the following sections.

The proposed approach begins with a deterministic optimization cycle. In mathematical terms, the optimization can be expressed as follows [START_REF] Le Riche | Formulation de l'optimisation avec incertitudes dans le projet RNTL/OMD[END_REF]:

min x f (x) x ∈ S g i (x) ≤ 0, i = 1, ..., p (2)
with S the search space. Following this deterministic cycle, uncertainties are incorporated by introducing the reliability problem formulation:

min x E[f (x, δ)] x ∈ S P rob(g i (x, δ)) ≤ P gi fi i = 1, ..., p (3)
We assume that the random variables are gaussian or can be approximated by normal distributions.

Once the optimum point associated with the equation 2 is determined, the reliability of the different constraints is measured by P rob[g i (x, δ) ≤ 0] i = 1, ..., p where δ is the random vector representing the uncertainties involved in the problem. The reliability analysis of the system allows the proposal of coefficients (called safety factors) which will be used in a deterministic approach to ensure a certain level of reliability during the design phase for the system holding [START_REF] Pendola | Fiabilité des structures en contexte d'incertitudes statistiques et d'écarts de modélisation[END_REF]. The use of the safety factor is a common practice in optimization [START_REF] Wu | Safety-factor based approach for probabilistic-based design optimization[END_REF].

We implement a first sequential method based on two levels. The solving of the reliability based optimization is composed of two independent steps. The first one searches the deterministic optimal parameters in the physical space of the optimization variables and the second one allows to incorporate the uncertainties by solving the reliability problem given by the equation 3. The transition between the deterministic optimization and the reliability based optimization is performed once detecting a change in the constraints and in the objective function below a certain treshold ∆ during a number n of consecutive steps.

A second more advanced approach is also proposed. This technique is inspired by the sequential method SORA [START_REF] Tae | Reliability-based design optimization using convex linearization and sequential optimization and reliability assessment method[END_REF].Our approach is based on the use of global safety factors [START_REF] Wu | Safety-factor based approach for probabilistic-based design optimization[END_REF], which lead to a better integration in the multi-agent solving approach developed in the ID4CS project. In the developed method we employ a single loop process [START_REF] Du | Sequential optimization and reliability assessment method for efficient probabilistic design[END_REF] wherein a series of cycles of deterministic optimization and reliability system evaluation succeed each other. For each cycle, the optimization and the reliability are decoupled and the evaluation of the reliability is only carried out after the resolution of the deterministic optimization problem in order to verify the feasibility of the constraints under uncertainties. When the reliability constraints of the optimization problem are not satisfactory, we introduce an adaptative safety factor in the calculation of the limit states, so that the constraints are met with a level of reliability equal to a target value (in our case this value is often taken as equal to 90%). In our study, the global safety coefficient s fi is determined under the assumption of normality as follows:

P rob[g i (x, δ) -s fi ] ≤ α i s fi = E[g i (x, δ)] + Φ -1 (α i )σ gi ( 4
)
where α i is the required level of reliability and σ gi the standard deviation of the studied constraints. An illustration is given in 2a. The new agent-level search point of the next optimization cycle K + 1 is then the last evaluated search point which was used for updating the safety factors s K+1 fi . We consider that the algorithm has converged to a solution when the evolution of all the s fi is becoming relatively small, that is to say:

|s K fi -s K+1 fi | ≤ ǫ, ∀i (5)
where ǫ is the convergence detection threshold. A flowchart of this method is given in figure 2b. For the first cycle (K = 1), the value of the current point is arbitrarily imposed and the safety factor is equal to zero. Following the resolution of the equation 2 (deterministic optimization), some constraints can be active. For an active constraint g, the optimum point X is located on the boundary of this deterministic constraint. When considering the random nature of X, the current reliability (probability that the constraint are respected) may be inferior to the imposed threshold. Thus, if after assessing the reliability, the deterministic optimum does not meet the required reliability threshold, we modify the deterministic constraints by introducing a global safety factor to ensure the feasibility of the constraints.

For the next cycle (K = 2), we start a new deterministic optimization where each constraints g i are updated with a new safety factor s K fi . This optimisation starts from the last evaluated point of the search space. These steps are repeated until convergence. The sequential single loop method requires fewer iterations of the optimization process and reliability assessments, in order to converge (no reliability assessment at each current point of the optimization), thus making the process more efficient than double loop reliability methods.

Agent level uncertainty propagation and management

Since a multi-agent system is a set of agents operating in a common environment, our goal is to propagate uncertainties through this set of agents, from the inputs to the outputs and define a strategy permitting the multi-agent system to satisfy the new constraints which are formulated in terms of reliability and robustness. Uncertainties can be of two different types: the modeling uncertainty and the parameter uncertainties. Modeling uncertainties are due to the difference between the model predictions and the reality. Another potential source of uncertainty in the outputs of our system comes from the uncertainty in the input parameters. In preliminary aircraft design for example, these variations can result from the differences between the idealized models which are used and the final design system at the end of the various design phases.

To propagate uncertainties we integrate additional information in each agent. The random variables can be represented in different ways: by a cloud of sample points or by their probability distribution. To keep a relatively generic approach for uncertainty representation we have chosen the beta-mystique distribution developed at Airbus which allows to represent through four parameters the most commonly used probability laws: the uniform law, the normal law, the Gumbel distribution and the triangular distribution as well as possible variations in these laws. We describe now how to manage the uncertainties for each type of agent. There are different types of agents that are involved in the propagation: ❼ The model agent: a model representing a certain physical system is encapsulated. The agent takes a vector of random parameters x c as input. Each random parameter x i component of the vector x c is characterized by its mean x mi at the current optimization point and its random characteristics (eg its standard deviation σ xi or the four parameters of the beta-mystique law, etc.). The output of the agent is then written: f (x i ) + δ model where δ model is the modeling uncertainty. The uncertainty δ model is characterized by one of the representation given above (a cloud of sample points, and various probability laws can be for example represented thanks to the beta-mystique law) and obtained by the uncertainties propagator associated with this representation. These can be either exact propagators in simple cases, or propagators that give an approximation based on first order calculation. It is then sent to the rest of the multi-agent system (variable agents taking as input the agent output: the consumers agents).

❼ The objective-function agent: the specific objective of this agent is to minimize the objective function of the system (this agent encapsulates the performance function of the optimization problem). It ensures that the obtained performances are consistent with the requirements of the problem. The agent takes as input a vector of random parameters x c with their associated uncertainty representation. The output of the agent is

E[f (x i )].
The mean of the function f is calculated on the basis of the results of the uncertainty propagation which also permits to determine the standard deviation of the objective function (we can then obtain information about the robustness of the system).

❼ The constraint agent: the constraint agent can determine the level of reliability reached by each constraint. It takes as input a vector of random parameters x c . Each random component x i has an associated uncertainty representation (cloud of sample points or probability distribution). The agent checks internally whether the constraint is satisfied by measuring the level of reliability. This probability can be written as P rob[g i (x i ) ≤ 0] and obtained directly from samples for an uncertainty representation by a cloud of sample points or it can be calculated by P rob[g i (x i ) ≤ 0] = Φ(-µcontrainte σcontrainte ) under the hypothesis of normality for uncertainties represented by probability distributions. For non-Gaussian variables, such expressions may still represent a good approximation for the reliability evaluation, considering the central limit theorem and the fact that for complex problems the constraint agent usually depends on a large number of uncertainty source. A normality test can be implemented prior to the estimation of the probability in order to test this hypothesis. If the constraints do not meet reliability thresholds which are imposed α i , a global safety factor s f is introduced (see equation 4) in order to take into account the dispersion of the constraint (see figure 2a): P rob[g i (x i ) -s K fi ≤ 0] = α i where α i is the required level of reliability. The new search point for the following optimization cycle is then the last point used for reliability study. As already said before, it is possible that the safety factor implies that the new constraints are not satisfied at this point of the search space. If it could be a problem for standard optimisation methods like pattern search, the mutli-agent optimization approch used in this study doesn't need such kind of constraint satisfaction for the next optimization cycle. The interactions defined in the constraint agent are shown on figure 3.

Note that when uncertainties are modeled by normal laws characterized by variance σ and mean µ, the uncertainty propagation can be simplified. According to the available information at the output of the agent (accessibility of the gradient or the structure model), the uncertainty propagation is different. Then, we differentiate two cases: ❼ The encapsulated model is linear or quadratic: mean and standard deviation of the agent output are determined analytically.

❼ The encapsulated model is ordinary: if the gradient is available or can be evaluated the propagation is performed analytically using a first order approximation. Otherwise, we use Monte Carlo simulations in order to define the characteristics of the uncertainties on the agent output.

In this section a method for managing uncertainty for solving optimization problems by multi-agent system was introduced. In the next section we set up a test case to validate the proposed approach. Thus, Figure 3: Uncertainty propagation through a constraint agent the methods described in this section are applied in section 5 in the context of a preliminary aircraft design problem.

Preliminary aircraft design test case

Presentation of the problem

The preliminary aircraft design problem that we consider (inspired from [10] [11]) involves the ratio power/weight P T O m T O and the wing loading

m M T O S W
as aircraft variables. The objective of this problem is to minimize the weight of the aircraft at takeoff m M T O and get the lowest possible power/weight ratio and the highest possible wing loading. The deterministic optimization problem is formulated as follows:

M in m M T O S W , P T O m M T O m M T O ( m M T O S W , P T O m M T O ) g i ( m M T O S W , P T O m M T O ) ≤ 0 i = 1, 2, 3 (6)
where the constraints g i are only the active constraints: the cruise speed(block 1, figure 4a), the landing field length (block 2) and the takeoff field length (block 3).

We first determine the optimum point of our problem without uncertainty through a standard algorithm. The algorithm used is of Pattern Search type, which provides the optimum in 110 evaluations of the objective function: m M T O SW = 377kg/m ; P T O mMT O = 187W/kg and m M T O = 20945kg. The preliminary design is a design phase which proves to be crucial but complex for several reasons: decisions are made in a context where few things are defined and the data of the problem are still poorly known. The search space of the solutions must remain general enough to not exclude potential solutions, and finally the models used are often relatively coarse. At this stage of the design, uncertainties are significant and are mainly modeling uncertainties. We wish to design a system weakly sensitive to changes and having statistically the best performance. To this end the deterministic problem is modified to include reliability constraints. The problem is as follow:

M in m M T O S W , P T O m M T O E[m M T O ( m M T O S W , P T O m M T O , δ)] P rob[g i ( m M T O S W , P T O m M T O , δ) ≤ 0] ≥ 90% i = 1, 2, 3 (7)
Uncertainties are introduced on the following parameters: the maximum lift coefficient during landing C L,max,L , the maximum lift coefficient during the takeoff phase C L,max,T O , the lift to drag ratio E and the propeller efficiency η P,CR . These random variables were chosen on the advice of experts.

Result obtained by the multi-agent method

The deterministic problem defined by the equation 6 is solved by a multi-agent method, the optimum is represented by a black dot on the figure 4b. These results are validated by comparison with a standard optimization method (see table 1). The results obtained through the two different methods are close, however there is a difference in the number of iterations required to achieve convergence: the multi-agent method requires 42 iterations while the classical optimization algorithm (Pattern Search) requires 110 iterations, or about 3 times more. The convergence is considered as reached once detecting a change in the constraints and in the objective function below a certain treshold during a number m s of consecutive steps.

Table 1: Comparison of the results between the multi-agent method and the classical optimization in the case of the deterministic optimization

We now take into account the uncertainties and solve the problem given by equation 7. Different cases are implemented in order to test the developped methods. Thus the uncertainties are taken into account by: Monte-Carlo simulations (50 000 draws are done), the variables are modelized by normal distributions with constant mean and standard deviation which are specific to each uncertain variable.

Analytic calculations, the mean and the standard deviation of each random variable are determined analytically. We assume that all the random variables are uncorrelated. This approximation will be verified by implementing the same method but with Monte Carlo simulations.

The different results obtained are presented in table 2a and compared to a classical optimization method in table 2b.

In the various studied cases we observe that the multi-agent approach provides solutions close to those obtained by a conventional optimization method. Nevertheless, we can notice a slight difference between the results obtained through the two algorithms for the propagation of uncertainties by Monte-Carlo simulations when they are modeled by log-normal law. Indeed the Pattern Search algorithm does not provide stable results (for the same initial point) as opposed to multi-agent. The Pattern Search algorithm is sensitive to noise caused by the Monte-Carlo draws, and this sensitivity to uncertainty is even more important when the variables follow a log-normal law. We also note that the assumptions made in order to perform an analytical uncertainty propagation are validated. Indeed, in the table 2a we can see that we get the same results when the uncertainties are propagated analytically or by Monte-Carlo simulations (the uncertainties are modeled by log-normal law).

The multi-agent approach appears to significantly reduce the number of simulations. On the other hand, whatever the initial selected point, the multi-agent method also appears more robust because it permits to obtain the same optimum point each time, which is not the case for the Pattern Search algorithm. When we compare the deterministic optimization results with those obtained for the reliability optimizations we see an increase in the cost function (see table 1 and figure 4b): the takeoff weigth is more important in the case of the reliability optimization (normal tendency when setting up a reliability and/or robust optimization problem: the presence of margins in reliability optimization causes the moving of the optimum). The constraints represented in 4b are deterministic constraints. The takeoff weigth of the airplane increased but we have taken into account the uncertainties impacting the parameters which generate the greater sensitivity of the objective function and performances, we are now able to guarantee a design satisfying a certain level of reliability (the active constraints have a reliability threshold equal to 90%) in contrast to the deterministic optimization.

In this first solution of the preliminary design problem, probabilistic uncertainties are taken into account from the beginning of the optimization. Thus, if the initial point of the optimization algorithm is far from the reliability optimum and when Monte-Carlo simulations are required, the management of uncertainties can be very expensive. So, we now want to implement the previously developed method using a single loop procedure in which a series of cycles of deterministic optimization and reliability assessments of the system succeed each other. This method is thus applied and compared with a two loop sequential method. The results are given in table 3. As for the analytical test case, the optima which are obtained by the two methods are close and despite of a higher number of deterministic evaluations, the sequential single loop method is more efficient because it requires only three reliability assessments.

Table 3: Sequential optimization results

The developed methods were used to take into account the uncertainties of different natures (modeling uncertainties and parameter uncertainties) and in order to set up a system having statistically the highest level of performance in a multi-agent method. The multi-agent system is very promising for solving complex problems (multidisciplinary problem with interrelated disciplines). This resolution can be very complicated when implementing a standard optimization method (computation time, important problems of convergence etc..).

Conclusion

Nowadays systems to optimize are more and more complex: the number of parameters to be determined is high, sometimes several interrelated disciplines are involved, as well as different levels of granularity. The classical optimization methods (algorithm based on the calculation of gradients, research methodology etc..) can thus be difficult to implement in order to solve such complex problems. This motivates the development of new methods to address optimization problems with a large number of variables which may have multi-level and multi-disciplines aspects. Methods based on the use of adaptive multi-agent systems (AMAS) are interesting alternatives to address this problem. The question of the integration of uncertainties in the multi-agent problem-solving approach arises. In this paper we detail a new methodology we developed which allows the consideration of uncertainties in a sequential multi-agent optimization problem. Thus we have proposed several methods for managing uncertainty, based on the calculation of adaptive safety factors. The proposed approach solves the problem sequentially (deterministic resolution then optimization under uncertainty) in order to accelerate the convergence in most cases. Finally, the last proposed method reduces even more the computation time by developing a sequential approach with adaptive criterion for assessing the level of reliability. These three approaches have been tested and validated on a preliminary aircraft design test case. Future work will be dedicated to test our method on a more detailed preliminary aircraft design.

2 and a 2 = l2-a1 2 Figure 1 -

 2221 Figure 1 -Decomposition of Alexandrov test case a constraint agent: represents a constraint of the MDO problem (i.e. c 1 ). Like the objective agent, it is a specialisation of a model agent and it computes only one ouput value. It acts in order to keep this value greater or lower than a constant value (generaly 0). The agent sends directly requests to its input variables in order to achieve this goal.

  (a) Modification of the constraint (b) Flowchart of the reliability optimization method

Figure 2

 2 Figure 2

( a )

 a Figure 4

( a )

 a Results obtained by the multi-agent method for the reliability optimization (b) Results obtained by a classical algorithm for the reliability optimizationTable 2


Lucas Gerin
email: gerin@cmap.polytechnique.fr

The Page-Rényi parking process

Keywords: Mathematics Subject Classifications: 60C05,68R05 discrete packing, discrete parking, random deposition, coupon collector, Poissonization

In the Page parking (or packing) model on a discrete interval (also known as the discrete Rényi packing problem or the unfriendly seating problem), cars of length two successively park uniformly at random on pairs of adjacent places, until only isolated places remain.

We use a probabilistic construction of the Page parking to give a short proof of the (known) fact that the proportion of the interval occupied by cars goes to 1e -2 , when the length of the interval goes to infinity. We also obtain some new consequences on both finite and infinite parkings.

1 The Page parking

The model

For n ≥ 2, we consider a sequence of parking configurations x t = (x t i ) 1≤i≤n in {0, 1} n , given by the following construction. Initially the parking is empty: x 0 = 0 n . Given x t one draws uniformly at random (and independently from the past) a number i in {1, 2, . . . , n -1} and, if possible, a car of size 2 parks at i:

• if (x t
i , x t i+1 ) = (0, 0) then (x t+1 i , x t+1 i+1 ) = (1, 1) and n -2 other coordinates remain unchanged;

• if (x t i , x t i+1 ) = (0, 0) nothing happens.

After some random time T n (which is dominated by a coupon collector process with n -1 coupons, see Section (3.2) below) parking is no longer possible, in the sense that in x Tn there are no adjacent coordinates (i, i + 1) such that x Tn i = x Tn i+1 = 0. We set X n = x Tn and X n (i) = x Tn i . Below is an example where X n = (1, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 1).

1 2 3 n 4 5 6 7 We are mainly interested in the numbers M n of places occupied by a car:

M n = card {1 ≤ i ≤ n, X n (i) = 1} .
We obviously have 2 n/3 ≤ M n ≤ n and we expect M n /n to converge, at least in some sense. Page obtained the following law of large numbers.

Theorem 1 (Page (1959)). When n → +∞, M n n prob.

→ 1e -2 = 0.8646647 . . . The fact that E[M n ]/n converges to 1e -2 was in fact already observed by Flory [START_REF] Flory | Intramolecular reaction between neighboring substituents of vinyl polymers[END_REF] in 1939. The proof of Theorem 1 is essentially obtained on conditioning on the position i of the first car. This gives the recursion identity

M n (d) = M I-1 + M n-I-1 + 2,
where I is uniform in {1, 2, . . . , n -1} and M I-1 , M n-I-1 are independent conditionally on I. This gives recursions for both sequences E[M n ] and E[M 2 n ], which can be handled using generating functions. Theorem 1 can also be found in [START_REF] Friedman | Solution to: An unfriendly seating arrangement (problem 623)[END_REF][START_REF] Fan | Random sequential adsorption on a ladder[END_REF][START_REF] Ph | A seating arrangement problem[END_REF][START_REF] Pinsky | A One-Dimensional Probabilistic Packing Problem[END_REF] with similar proofs.

The Page parking problem has a long story, it has been studied by many people and under different names. It is equivalent to the unfriendly seating problem [START_REF] Friedman | Solution to: An unfriendly seating arrangement (problem 623)[END_REF], and sometimes also called the discrete Rényi Packing model [START_REF] Hemmer | The random parking problem[END_REF], more generally, it is a toy model for random deposition. We refer to [START_REF] Flory | Intramolecular reaction between neighboring substituents of vinyl polymers[END_REF][START_REF] Page | The distribution of vacancies on a line[END_REF][START_REF] Mackenzie | Sequential filling of a line by intervals placed at random and its application to linear adsorption[END_REF] for some interpretations of the model in polymer chemistry. Besides, we mention that much is known when cars have size > 2, see [START_REF] Klaassen | Discrete Spacings[END_REF][START_REF] Ph | A seating arrangement problem[END_REF][START_REF] Pinsky | A One-Dimensional Probabilistic Packing Problem[END_REF].

The first aim of the present paper is to present a probabilistic (and new) proof of Theorem 1 and to study the asymptotic behavior of T n (the numbers of cars that have tried to park). We also prove a law of large numbers for the infinite Page parking and extend a formula due to Hemmer [START_REF] Hemmer | The random parking problem[END_REF] for a continuous-time version of the Page parking.

The probabilistic construction

An alternative way of defining M n is the following. Let ξ = (ξ i ) 1≤i≤n-1 be i.i.d. nonnegative random variables with continuous distribution function F (hereafter we will take F (t) = 1e -t ). By convention we set ξ 0 = ξ n = +∞.

Then the order statistics ξ σ(1) < • • • < ξ σ(n-1) give the order in which the cars park:

• at time t = ξ σ(1) , the first car parks at (σ(1), σ(1) + 1),

• at time t = ξ σ(2) , the second one parks (if possible) at (σ(2), σ(2) + 1),

• ...

• at time t = ξ σ(n-1) , a car parks (if possible) at (σ(n -1), σ(n -1) + 1) and the process is over.

It is easy to see that we obtain the same distribution, this was already observed by previous authors (see [START_REF] Runnenburg | Asymptotic normality in vacancies on a line[END_REF]). Let us collect for further use some obvious features of this construction.

Remark 2.

• The configuration X n only depends on the ordering of the ξ i 's.

• If i is a local minimum of ξ (i.e.if ξ i-1 > ξ i < ξ i+1 ) then places i and i + 1 are empty at time t = ξ - i and then a car parks at time ξ i at (i, i + 1). • To define X n from the ξ i 's, one can treat separately the intervals defined by two successive local minima.

Here is a sample of ξ (here ξ σ(1) = ξ 6 ) and the corresponding configuration X n :

1 2 3 n ξ 1 ξ 3 ξ 2 4 5 6 7 ↓ 1 2 3 n 4 5 6 7
It does not seem that this construction was used to its full extent, yet it gives a very simple way to characterize positions i occupied by a car. We need a few definitions.

We say that there is a rise of length at i if i ≥ + 2 and (recall ξ 0 = ξ n = +∞)

ξ i--1 > ξ i-< ξ i-+1 < ξ i-+2 < • • • < ξ i-1 or if i = + 1 and ξ 1 < ξ 2 < • • • < ξ i-1 .
There is a descent of length at i if i < nand

ξ i > ξ i+1 > • • • > ξ i+ -1 < ξ i+ or if i = n -and ξ i > ξ i+1 > • • • > ξ n-1 .
Consistently we say that there is a rise (resp. a descent) of length 1 at i if ξ i-2 > ξ i-1 (resp. if ξ i < ξ i+1 ), so that for every i there is a rise and a descent at i. Note that by construction for each i, , the two events { rise of length at i } and { descent of length at i } are independent. Lemma 3. There is no car at i ( i.e. X n (i) = 0) if and only if there is a rise of even length at i and a descent of even length at i.

Here is an example of a rise of length 2 = 6 at i and a descent of length 2k = 4:

i-2 i-1 i ξ i-1 ξ i ξ i-2 ξ i+2k-1 i-1 i-1 i+2k ↓ i-2 i-1 i i-1 i-1 i+2k
Proof of Lemma 3. As already said, if i is a local minimum then a car parks at (i, i + 1). Consider now the case where i is inside a rise: ξ r-1 > ξ r < ξ r+1 < ξ r+2 < • • • < ξ i < ξ i+1 for some r. Then cars successively park at (r, r + 1), (r + 2, r + 3), . . . , until (i -1, i) or (i, i + 1) (depending on the parity of ir). Then X n (i) = 1, and the same applies in the case where i is inside a descent. Therefore the only case where X n (i) could be zero is if i (or i -1) is a local maximum for ξ. Define m i (resp. m i ) as the closest local minimum of ξ on the left of i (resp. on the right). A rise begins at m i and a descent ends at m i and m i = is, mi = s -1 where s, s are the lengths of these rise and descent.

Cars successively try to fill places of the rise (m i , m i + 1), (m i + 2, m i + 3), . . . from left to right and places of the descent (m i , m i + 1), (m i -2, m i -1), . . . from right to left. If only s is odd (resp. only s ) then i is occupied by a car of the rise (resp. descent). If both are odd a car parks at (i -1, i) or (i, i + 1) depending on wether ξ i-1 < ξ i or not. If both are even the rightmost car of the rise parks at (i -2, i -1) and the leftmost car of the descent parks at (i + 1, i + 2), leaving i unoccupied.

The infinite parking

An interesting feature of the probabilistic construction is that it allows us to define the model (X ∞ (i)) i∈Z on Z, by considering a doubly-infinite sequence (ξ i ) i∈Z .

We first set X ∞ (i) = X ∞ (i + 1) = 1 for every i such that ξ i is a local minimum. Then we define X ∞ (i) as before, using only the ξ's between m i , m i . Recall that m i (resp. m i ) is the closest local minimum of ξ on the left of i (resp. on the right) and note that with probability one, for all i one has m im i < +∞. Lemma 3 also holds for the infinite parking. Theorem 4. In the infinite Page parking:

1. For every i ∈ Z, P(X ∞ (i) = 1) = 1 -e -2 . 2. When n → +∞, X ∞ (1) + • • • + X ∞ (n) n prob. → 1 -e -2 .
Proof. We first prove the first statement. By construction the rise at i and the descent at i are independent. By Lemma 3 we have P(X n (i) = 0) = P( even rise at i )P( even descent at i ) = P( even descent at i

) 2 = ≥1 P (ξ i > ξ i+1 > • • • > ξ i+2 -1 < ξ i+2 ) 2 = ≥1 P (σ 1 > σ 2 > • • • > σ 2 < σ 2 +1 ) 2 ,
where σ is a uniform permutation of 2 + 1 elements. We get

P(X n (i) = 0) = ≥1 P (σ 1 > σ 2 > • • • > σ 2 ) -P (σ 1 > σ 2 > • • • > σ 2 > σ 2 +1 ) 2 = ≥1 1 (2 )! - 1 (2 + 1)! 2 = ≥0 1 (2 )! - 1 (2 + 1)! 2 = (1/e) 2 .
We now turn to the law of large numbers. We will prove that there exists a constant c > 0 such that for every i, j

|cov(X ∞ (i), X ∞ (j))| ≤ c |j -i|/3 ! . ( 1
)
The convergence in probability will follow since (1) implies that

Var(X ∞ (1) + • • • + X ∞ (n)) = O(n).
which gives the desired convergence.

Let us prove [START_REF] Durrett | Probability: Theory and Examples[END_REF]. First note that cov(X ∞ (i), X ∞ (j)) = P(X ∞ (i) = 0, X ∞ (j) = 0)e -4 . By translation-invariance we can fix i = 1 j = p and take p larger than, say, 10, 0 ≤ P(X ∞ (1) = 0, X ∞ (p) = 0) -P even rise at 1, even descent smaller than p/3 at 1, even rise smaller than p/3 at p, even descent at p.

≤ P( even descent larger than p/3 at 1 ∪ even rise larger than p/3 at p) and the latter probability is less than 2/ p/3 !. Now, P even rise at 1, even descent smaller than p/3 at 1, even rise smaller than p/3 at p, even descent at p.

= e -1 ×   : 2 ≤ p/3 2 (2 + 1)!   2 × e -1 = e -4 + O 1 ( p/3 )! .
This proves (1) for |j -i| ≥ 10, by taking a possibly larger c we obtain the proof for every i, j.

Note that the probabilistic construction also allows us to compute explicitly some shortrange correlations. Clearly, by construction, if

X ∞ (1) = 0 then X ∞ (2) = X ∞ (3) = 1, so the simplest non-trivial computation is P(X ∞ (1) = 0, X ∞ (4) = 0) = P(X ∞ (1) = 0, X ∞ (2) = 1, X ∞ (3) = 1, X ∞ (4) = 0)
= P( even rise at 1 )P (ξ 1 > ξ 2 < ξ 3 ) P( even descent at 4 ) = e -2 /3.

As one could expect, this is greater than P(X ∞ (1) = 0) × P(X ∞ (4) = 0) = e -4 .

Evolution of the continuous-time process

We now consider the process given by the time arrivals of cars. As above X ∞ (i) is the indicator that there is eventually a car at i. We define the continuous-time process (X t ∞ ) t≥0 with values in {0, 1} Z by

X t ∞ (i) = 1 if X ∞ (i) = 1 and τ i ≤ t, 0 otherwise.
Here, τ i = ξ i-1 if the car parked at i is parked at (i -1, i) and τ i = ξ i if this car is at (i, i + 1). Then τ i is indeed the time arrival of the corresponding car, we set τ i = +∞ if there is no car at i. Recall that F denotes the distribution function of the ξ i 's. If F (t) = 1e -t then (X t ∞ ) t≥0 defines a homogeneous Markov process and in this case the distribution function of τ i was identified by Hemmer ([7] eq. ( 19)). Here we generalize his result to any F .

Theorem 5 (Evolution of the density of cars).

Let τ i be the arrival time of the car i,

E[X t ∞ (i)] = P(τ i ≤ t) = 1 -e -2F (t) .
Of course we recover P(X ∞ = 1) = P(τ i < +∞) = lim t→+∞ 1e -2F (t) = 1e -2 .

Proof. By translation-invariance we assume i = 0. Lemma 3 gives that τ i ≤ t if and only if

• there is an odd rise at 0 and ξ -1 ≤ t,

• or there is an odd descent at 0 and ξ 0 ≤ t.

These two events being independent we have

P(τ i ≤ t) = 2f (t) -f (t) 2 = f (t) (2 -f (t))
where f (t) = P(ξ 0 ≤ t; odd descent at 0 ). Now,

f (t) = P (t ≥ ξ 0 < ξ 1 ) + k≥1 P (t ≥ ξ 0 > ξ 1 > • • • > ξ 2k < ξ 2k+1 ) = t 0 (1 -F (r))dF (r) + k≥1 t 0 P (t ≥ ξ 0 > ξ 1 > • • • > ξ 2k-1 > r ; r < ξ 2k+1 ) dF (r), = t 0 (1 -F (r))dF (r) + k≥1 t 0 P (t ≥ ξ 0 > ξ 1 > • • • > ξ 2k-1 > r) P (r < ξ 2k+1 ) dF (r),
at second line we have conditioned respectively on {ξ 0 = r} and on {ξ 2k = r}. Set A = {ξ 0 , ξ 1 , . . . , ξ 2k-1 ∈ (r, t)}, then P(A) = (F (t) -F (r)) 2k and conditional on A these random variables are ordered as a uniform permutation:

f (t) = t r=0 (1 -F (r))dF (r) + k≥1 t 0 1 (2k)! (F (t) -F (r)) 2k (1 -F (r))dF (r) = t 0 k≥0 1 (2k)! (F (t) -F (r)) 2k (1 -F (r))dF (r) = F (t) 0 k≥0 1 (2k)! (F (t) -s) 2k (1 -s)ds = F (t) 0 cosh (F (t) -s) (1 -s)ds = 1 -exp -F (t) .
3 Parking on an interval

Coupling with the infinite parking

Recall that M n is the number of places occupied in the finite parking of size n.

Theorem 6. For every n ≥ 2,

E[M n ] -n(1 -e -2 ) ≤ 14. ( 2
)
This estimate is not as sharp as 1) which has been proved by Friedman [START_REF] Friedman | Solution to: An unfriendly seating arrangement (problem 623)[END_REF] (see also [START_REF] Ph | A seating arrangement problem[END_REF]). Yet the proof we provide here provides a simple estimate on P(X n (i) = 0) which will be useful later. We use ξ i 's to define a coupling between finite and infinite parkings.

E[M n ] = n(1 -e -2 ) + (1 -3e -2 ) + o(
Proof. Let (ξ i ) i∈Z be as before a sequence of i.i.d. continuous random variables of common distribution function F , we use the same ξ i 's to define (X n (i)) 1≤i≤n and (X ∞ (i)) i∈Z . Let m (resp. m ) be the leftmost (resp. rightmost) local minimum of (ξ i ) i∈Z in {1, . . . , n -1}. We set m = n, m = 0 if there is no local minimum.

By construction, if there is a local minimum, X n (i) and X ∞ (i) coincide for every m ≤ i ≤ m + 1. Therefore

E[M n ] -n(1 -e -2 ) = n i=1 E[X n (i)] -E[X ∞ (i)] ≤ E [card {i; X n (i) = X ∞ (i)}] ≤ E[m -1] + E[n -m -1] = 2E[m -1].
There are different ways to bound E[m], an easy one is to observe that local minima appear independently at 2, 5, 8, . . . , with probability P(ξ 1 > ξ 2 < ξ 3 ) = 1/3. We get P (m ≥ i) ≤ (2/3) i/3 which yields E[m -1] ≤ 7 for every n.

Note that as a by-product of the proof we get that

P(X n (i) = 0) -e -2 ≤ P (m > i ∪ m < i -1) ≤ 2ε i , (3)
where

ε i = max (2/3) i/3-1 , (2/3) (n-i)/3-1 .
We also can deduce the convergence in probability of M n /n by using

n i=1 |X n (i) -X ∞ (i)| ≤ m -1 + (n -m -1)
and the fact that m/n, (nm )/n both converges to zero in probability.

Number of trials: Poissonization

Let T n be the number of cars that have tried to park before the parking process is over. It is clear that T n is stochastically smaller than the number of trials needed to pick each number in {1, . . . , n -1} at least once, i.e. stochastically smaller than a coupon collector with n -1 coupons. Thus, the lim sup (in probability) of T n /(n log n) is less than one.

In order to estimate T n we use another construction of the arrival process, in order to take into account the arrivals of cars that tried but did not succeed in park. We now are given for each i ∈ {1, . . . , n} a sequence of random variables (ξ j i ) j≥1 , the family ξ j i i,j being i.i.d. exponentially distributed with mean one. At (i, i + 1), cars try to park at times

ξ 1 i , ξ 1 i + ξ 2 i , ξ 1 i + ξ 2 i + ξ 3 i , . . .
For simplicity, we write as before ξ i = ξ 1 i for the first arrival of a car at i. Let τ be the arrival of the last car that succeeds in parking:

τ = max {τ i , τ i < +∞} .
Here is a picture that sums up notations (here the last car parks at (i, i+1), we have T n = 12):

1 2 3 n 4 ξ 1 1 ξ 1 2 ξ 2 1 i ξ 1 i 1 2 3 n 4 i τ
By construction and by Markovianity we have

T n (d) = n i=1 max j; ξ 1 i + • • • + ξ j i ≤ τ , since max j; ξ 1 i + • • • + ξ j i ≤ t
is the number of cars that tried to park at (i, i + 1) before time t.

Theorem 7 (Number of trials).

T n n log(n) prob.

→ 1.

Proof. Upper bound. As noted above, T n is stochastically smaller than a coupon collector with n -1 coupons. It is classical (see for instance [START_REF] Durrett | Probability: Theory and Examples[END_REF] Example 2.2.3) that for each ε > 0 we have

P T n n log(n) ≥ 1 + ε → 0
Lower bound. The strategy is the following: Theorem 5 suggests that, as long as i is bounded away from 0 and n, we have P(u ≤ τ i < +∞) ≈ e -2(1-e -u )e -2 ∼ u→+∞ 2e -2 e -u . The τ i 's being weakly dependent, we expect τ = max {τ i ; τ i < +∞} to be of order log(n).

To conclude, we will use the fact that T n ≈ n × τ .

Lemma 8. For every δ > 0,

P(τ ≥ (1 -δ) log(n)) n→+∞ → 1.
Proof of Lemma 8. For two integers i, such that [i

-, i + ] ⊂ [1, n], let A i, (u) be the event E i, (u) ∪ F i, (u) ∪ F i, (u) where E i, (u) = odd rise of length ≤ -2 at i, ξ i-1 ≥ u, even descent of length ≤ -2 at i F i, (u) = even rise of length ≤ -2 at i, ξ i ≥ u, odd descent of length ≤ -2 at i G i, (u) = odd rise of length ≤ -2 at i, ξ i-1 ≥ u, ξ i ≥ u, odd descent of length ≤ -2 at i .
The intuition for A i, (u) is that, at least for large , this event says that a car will arrive at i, but not before time u. Event A i, only depends on {ξ i , i -+ 1 ≤ i ≤ i + -1}. Again by Lemma 3 we have

{u ≤ τ i < +∞} ⊃ A i, (u) ⊃      u ≤ τ i < +∞,
and there is a local minimum among ξ i-+2 , . . . , ξ i-1 and there is a local minimum among ξ i , . . . , ξ i+ -2 .

Then 0 ≤ P(u ≤ τ i < +∞) -P(A i, (u)) ≤ P no local min. between i -+ 2 and i -1

or no local min. between i and i + -2

≤ 2(2/3) ( -2)/3 ≤ 2(2/3) /4
for large . (Here we have re-used the fact that local minima appear independently at i + 1, i + 4, i + 7, . . . , i + with probability 1/3.)

Besides,

P(u ≤ τ i < +∞) = 1 -P(τ i = +∞) -P(τ i < u) = 1 -P(τ i = +∞) (4)
-P ξ i-1 < u; odd rise at i ∪ ξ i < u; odd descent at i

Aside from the boundary effects, the arguments of the proof of Theorem 5 are still valid and we get for i ≥ 2

P ξ i-1 < u; odd rise at i = i/2 -1 k=0 P ξ i-(2k+2) > ξ i-(2k+1) < ξ i-2k < • • • < ξ i-1 ≤ u = F (u) 0 i/2 -1 k=0 1 (2k)! (s -F (t)) 2k (1 -s)ds = δ i + F (u) 0 cosh (s -F (t)) (1 -s)ds = 1 -exp -F (u) + δ i ,
where |δ i | ≤ 2/i! (δ i is obtained by bounding the remainder of the Taylor series of cosh). By symmetry i ↔ ni we have the symmetric estimate on P ξ i ≤ u; odd descent at i . Plugging this into (5) and combining with our estimate (3) on P(τ i = +∞) we obtain for i ≥ 2, since ε i ≥ δ i P(u ≤ τ i < +∞) ≥ e -2F (u)e -2 -10η i ≥ 2e -2 (1 -F (u)) -10η i = 2e -2 e -u -10η i , where |η i | ≤ max (2/3) i/3-1 , (2/3) (n-i)/3-1 . Now, events A , (u), A 3 , (u), A 5 , (u), . . . A n/ -1 , (u) are independent and (we skip integer parts in order to lighten notations):

P(τ ≤ u) ≤ P not A , (u), not A 3 , (u), not A 5 , (u), . . . , not A n/ × , (u)

≤ n/ j=1
1 -2e -2 e -u + 10η j + 2(2/3) /4

≤ n/ -log(n) j=log(n)

1 -2e -2 e -u + 10η j + 2(2/3) /4 .

Choose now = 50 log(n) and take u = (1δ) log(n), so that for large n every term of the product is less than 1e -2 e -u , where Poiss i (λ) are i.i.d. Poisson with mean λ. The first term in the right-hand side goes to zero thanks to Lemma 8, so does the second one by taking δ = ε/2 and using Chebyshev's inequality.

P(τ ≤ (1 -δ) log(n)) ≤ 1 -e -2

n 1

 1 -δ(n/50 log(n)-2 log(n))≤ exp(-n δ/2 ), for large n.We now conclude the lower bound:P(T n ≤ (1ε)n log(n)) ≤ P(τ ≤ (1δ) log(n)) + P(T n ≤ (1ε)n log(n); τ > (1δ) log(n)) ≤ P(τ ≤ (1δ) log(n)) + P n i=1 max j; ξ 1 i + • • • + ξ j i ≤ (1δ) log(n) ≤ (1ε)n log(n) ≤ P(τ ≤ (1δ) log(n)) + P n i=1 Poiss i ((1δ) log(n)) ≤ (1ε)n log(n) ,

Acknowledgements

I learned about the Page model in the very nice book [11] by Ross Pinsky. I also would like to thank Marie Albenque and Jean-François Marckert for stimulating discussions, and an anonymous referee for her/his careful reading.

Supported by grant Anr Graal.


Philippe Rauffet
email: philippe.rauffet@univ-ubs.fr

Christine Chauvin
email: christine.chauvin@univ-ubs.fr

Gael Morel
email: gael.morel@univ-ubs.fr

Pascal Berruet
email: pascal.berruet@univ-ubs.fr

Designing sociotechnical systems: a CWA-based method for dynamic function allocation

Keywords: Cognitive Work Analysis, Design method and tools, Social Organization and Cooperation Analysis, Dynamic Function Allocation. ACM Classification H.1.2 User/Machine Systems (Human factors). I.5

Dynamic function allocation (between human agents or between human and technical agents) is a crucial issue in complex sociotechnical systems, particularly in changing or demanding situations. This issue has not yet been explicitly addressed in the Cognitive Work Analysis framework. This paper presents a conceptual and methodological proposal for designers that supplements the existing CWA tools. The new tool is integrated into the Social Organization and Cooperation Analysis (SOCA) stage. It formalizes different kinds of associations between work functions and elementary work situations and between resources and work functions. It enables the identification of conflicts (impossible allocations) when examining a complex situation resulting from the conjunction of several elementary situations. When conflicts are resolved, it is possible to choose the best configuration among a set of possible associations between resources and work functions. This proposal is illustrated with the case study of an electric pedal-assist bike.

INTRODUCTION

Socio-Technical Systems Engineering (STSE) focuses on the design of complex systems with interconnected human, technical, and organizational components [START_REF] Baxter | Socio-technical systems: From design methods to systems engineering[END_REF]. In particular, this approach raises the issue of the role of operators faced with increasingly autonomous technical systems in dynamic, risky, and sometimes unforeseen situations.

The distribution of activities between humans and machines is a central process in Socio-Technical System (STS) design and operation [START_REF] Challenger | Function allocation in complex systems: reframing an old problem[END_REF]. Function allocation and, more precisely, dynamic function allocation (DFA), can help a system maintain a satisfying performance in complex situations. This issue must be taken into account as early as the preliminary design phase of a project [START_REF] Mod | Defence Standard 00-25[END_REF][START_REF] Goom | Function allocation and MANPRINT[END_REF].

Several methods have been proposed to design sociotechnical systems. Among them, Cognitive Work Analysis (CWA), proposed by [START_REF] Rasmussen | Information Processing and Human-machine Interaction[END_REF], [START_REF] Rasmussen | Cognitive Systems engineering[END_REF] and further developed and codified by [START_REF] Vicente | Cognitive work analysis: Toward safe, productive, and healthy computer-based work[END_REF], appears as one of the most comprehensive. It combines the contributions of engineering and human factors to provide designers with a powerful framework for STS design. As depicted on table 1, it is a formative constraint-based approach, consisting of five successive stages: a) Work Domain Analysis (WDA), b) Control Task Analysis (ConTA), c) Strategies Analysis (StrA), d) Social Organization and Cooperation Analysis (SOCA), and e) Worker Competencies Analysis (WCA).

The issue of function allocation is addressed at the fourth stage, namely SOCA. This issue is a crucial one, but the exploration of the social and organisation phase has received less attention than the application of the WDA or ConTA [START_REF] Jenkins | Using cognitive work analysis to explore activity allocation within military domains[END_REF].

SOCA does not deal explicitly with the dynamic distribution of functions between humans and machines [START_REF] Chauvin | Integration of Ergonomics in the Design of Human-Machine Systems[END_REF]. No modelling tools existed for this stage before the recent proposals made by [START_REF] Jenkins | Using cognitive work analysis to explore activity allocation within military domains[END_REF] or [START_REF] Stanton | How a submarine returns to periscope depth: Analysing complex sociotechnical systems using Cognitive Work Analysis[END_REF]. In this paper, we propose to make up for these weaknesses.

This paper aims at improving the SOCA stage and at integrating explicitly DFA into the CWA framework. It proposes a tool for designers that will enable them to verify that a particular solution will meet the purpose of the system, regardless of the work situation.

It is divided in three parts. The first one presents, among the CWA levels and associated tools, those that provide useful data for function allocation; it also shows the limits of the existing tools. The second part introduces the methodological proposal. The last part provides a case study in order to illustrate and discuss the anticipated benefits. WDA deals with the constraints that are placed on actors by the functional structure of the field or environment in which the work occurs [START_REF] Naikar | Work domain analysis: Concepts, guidelines, and cases[END_REF]. This phase is associated with a modelling tool, the AH. This tool enables the description of a work domain in terms of five levels of abstraction: functional purpose (the purpose of the work domain, its "raison d'être"), value and priority measures (the criteria ensuring that the system progresses toward the functional purpose), purpose-related functions (the general functions that are performed in order to achieve the functional purpose), object-related processes (processes and capabilities characterising the objects used by the general functions), and physical objects.

ConTA is related to the activity required for achieving a system's purpose with a set of specific resources. Naikar, Moylan, and Pearce (2006) and [START_REF] Naikar | Work domain analysis: Concepts, guidelines, and cases[END_REF] propose to characterize this activity as a set of recurring work situations, work functions, or control tasks. These authors introduce the CAT for modelling activities in work systems. This template highlights the contextual relationships between the various elements of ConTA and graphically illustrates all of the combinations of work situations, work functions, and control tasks that are possible. [START_REF] Naikar | Analysing activity in complex systems with cognitive work analysis: concepts, guidelines and case study for control task analysis[END_REF] explain that the decomposition of activity into work situations is appropriate in systems where work is segmented according to time and space (in hospitals or schools for example), whereas activity is better characterized by its content, independently of its temporal of spatial characteristics, in other systems. In those cases, it is appropriate to decompose activity into a set of work functions. Work functions are related to functions to be performed in a work system. They are defined at the purpose-related functions level or at the object-related processes level in the AH [START_REF] Jenkins | Using cognitive work analysis to explore activity allocation within military domains[END_REF]. In a research laboratory, activity is divided into work functions such as writing papers, conducting experiments, and reading.

The CAT is designed to represent activity both in terms of work situations and work functions. A graphical code is used to distinguish work situations in which a work function can occur and those in which a work function will typically occur. According to [START_REF] Stanton | How a submarine returns to periscope depth: Analysing complex sociotechnical systems using Cognitive Work Analysis[END_REF] and as depicted in Figure 1, a work function -in a given situation -may be qualified as expected (it can occur and typically occurs), optional (it can occur but does not typically occur), or impossible (it never occurs). The decision ladder is then used to decompose activity into a set of control tasks for each work situation and/or work functions.

SOCA addresses the constraints governing how the team communicates and cooperation [START_REF] Jenkins | Using cognitive work analysis to explore activity allocation within military domains[END_REF]. It aims to determine the distribution of work demands, communication, and cooperation amongst the actors (i.e. the different resources of the system under investigation). [START_REF] Jenkins | Using cognitive work analysis to explore activity allocation within military domains[END_REF] propose to map actors (represented by means of a colour code) onto the AH and more precisely onto the functions described at the levels of the purposerelated function and of the object-related processes (SOCA-AH). In the same way, they map actors onto the CAT in order to show where these can have an influence on the system (SOCA-CAT). They take into account, at this stage, the actors' capability to perform a certain work function during a certain work situation. Cells occupied by more than one actor indicate that either or all of the identified actors can support the activity. According to these authors, this representation of constraints helps to identify and evaluate potential combinations of working practices in order to determine optimal practices. This analysis may be carried out according to Rasmussen et al.'s (1994) six criteria: (a) actor competencies, (b) access to information and means of action, (c) coordination demands, (d) workload, (e) safety and reliability, and (f) existing regulations. These criteria are either input data to model DFA problems (e.g. actor competencies) or evaluation criteria to choose allocations (e.g. workload).

The existing tools of the CWA enable the identification of potential allocations of resources to work functions. However, they do not provide the means to evaluate and optimize these according to the work situation characteristics and, most importantly, according to the work situation variations.

SOLVING DYNAMIC FUNCTION ALLOCATION PROBLEMS WITH CWA

Defining a dynamic function allocation entails taking dynamic situations and resource availability into account. For that purpose, designers need a definition of work situations and a modelling of resource constraints adapted to the specific problem, as well as a method used to formalize and to evaluate the STS according to different complex situations.

The notion of work situation seems to be very useful to deal with the question of DFA although its "modern" definition [START_REF] Naikar | Analysing activity in complex systems with cognitive work analysis: concepts, guidelines and case study for control task analysis[END_REF], used in the works of [START_REF] Jenkins | Using cognitive work analysis to explore activity allocation within military domains[END_REF][START_REF] Stanton | How a submarine returns to periscope depth: Analysing complex sociotechnical systems using Cognitive Work Analysis[END_REF] was not originally thought to model this specific problem. The use of this concept for DFA problems raises therefore new questions: [START_REF] Naikar | Analysing activity in complex systems with cognitive work analysis: concepts, guidelines and case study for control task analysis[END_REF], work situations are characterized by some absolute or relative constants of time or location (work can occur at a specific place or at a specific distance of a moving position, and work can occur at a specific moment or just before or after a mission phase). For instance, in the context of aircraft system analysis, [START_REF] Naikar | Analysing activity in complex systems with cognitive work analysis: concepts, guidelines and case study for control task analysis[END_REF] described five different situations fitting with mission phases ("on ground not in aircraft", "on ground in aircraft", "enroute to station", "on station", "enroute to base"). However, could the situation "flying in bad weather conditions" be considered as a spatio-temporal situation? This kind of work situation can occur at any place and any time, as there is no unit of time and place, or relationship with a mission phase or a moving place. [START_REF] Cuny | Decision-making in controlling development of driving/piloting situations[END_REF] remind that "in ergonomic psychology, the situation theoretically includes all variables forming a system of potential interactions with the activity as its operational framework". Work situations can be therefore more generally influenced and characterized by the external and internal conditions of the system (the information level or the nature of the system environment, temporal pressure, etc.). "When" and "where" questions should be thus completed or replaced by the question "In which internal and external conditions does the system operate?" so as to define work situations.

Are time and location sufficiently detailed to distinguish all the work situations? According to

Do work situations include incidental or critical situations?

The recent applications of the CAT [START_REF] Jenkins | Using cognitive work analysis to explore activity allocation within military domains[END_REF][START_REF] Stanton | How a submarine returns to periscope depth: Analysing complex sociotechnical systems using Cognitive Work Analysis[END_REF]) are centred on nominal phases of the mission. However, the dynamic function allocation could also take some degraded situations into account (the failure of some system components, uncertainty or absence of knowledge regarding information relative to the mission, etc.).

Are work situations independent from each other?

The different work situations are independent from each other if they are defined according to time or location. However, if we also consider work situations according to internal and external conditions, the situations « enroute to station » and « flying in bad weather conditions » could occur in parallel. [START_REF] Naikar | Analysing activity in complex systems with cognitive work analysis: concepts, guidelines and case study for control task analysis[END_REF] assert that the decomposition of activity into work situations and work functions can be done at different levels of detail or granularity. They provide an example of this granularity issue. Situations such as "On ground not in aircraft", "On ground in aircraft", and the "in the air" situations ("enroute to station" and "enroute to base") are typically the conjunction of two elementary situations, defined by the location of the activity in relation to the plane and to the ground ("on ground" versus "in the air", "in aircraft" versus "not in aircraft"). The different elements of internal and external conditions could therefore be a unit of description of work situations.

What is the granularity of the modelling of work situations?

How can forgetting work situations and a combinatorial explosion of situations be avoided?

The number of situations could increase very fast if numerous conditions are considered and combined. For instance, taking into account the weather conditions (cloudy or sunny), tactical conditions (in fight zone, not in fight zone) and system capacity conditions (full tank of fuel, almost empty tank) and the five situations given by [START_REF] Naikar | Analysing activity in complex systems with cognitive work analysis: concepts, guidelines and case study for control task analysis[END_REF] results in having to consider and model 40 different situations. Complex situations should be considered as the result of the conjunction of several elementary situations that are not always independent from each other.

The modelling of resource availability in dynamic situations is also a crucial question for dealing with DFA issues. [START_REF] Jenkins | Using cognitive work analysis to explore activity allocation within military domains[END_REF] and [START_REF] Stanton | How a submarine returns to periscope depth: Analysing complex sociotechnical systems using Cognitive Work Analysis[END_REF] propose to map resources and actors, especially on the AH and CAT. However, they do not formalize in detail the constraints that can occur between these resources in dynamic situations, which is necessary to define the DFA problem. Selecting to allocate a resource to a function could be dependent on the use of this resource or another one for another function. This relation of dependence among resources can be expressed at the design stage (modelled in SOCA-AH) or in the case of a situation that creates some unavailability or dependence (modelled in SOCA-CAT). The following list represents an attempt to model these constraints: a) binary constraints: a resource can be allocated or not to a function; b) disjunctive constraints: one or several resources can be allocated to the same function; c) exclusive constraints: two resources cannot work in parallel the same or on different functions; d) capacity constraints: the number of functions allocated to one resource or both resources is limited; e) conditional constraints: a resource can be allocated to a function only if one or several resources are allocated to one or several functions; f) antecedence constraints: this is a special case of conditional constraints to which a temporal dimension has been added; a resource may be allocated to a function only if one or several resources were previously allocated to one or several functions. Using these elements of detail or adaptation of CWA leads to proposing a method using SOCA-AH and SOCA-CAT models and SOCA criteria so as to formalize and solve the DFA problem.

SOCA-AH is centred on the analysis of functions and resources and would be used to assess the choices made by the designers regarding the composition of the system. The model provides a means of assessing whether a function is statically allocated to a resource (only one resource is planned in the system to carry out the function: there is only one coloured actor in a box of AH) or whether a function is admissible for dynamic allocation to a resource (several resources are planned and some of them could carry out the function: there are at least two coloured actors in a box of AH).

SOCA-CAT is centred on the analysis of situated functions and resources and would be used to assess the choices made by the designers regarding the functioning of the system in dynamic situations. The model provides a means to assess the potential risks of the DFA in different complex situations and to find, when it is possible, the best system configuration to deal with situations. The SOCA-CAT is composed of the designers' choices that are represented by different types of functions actionable in a given elementary situation. A function can be "expected" (a function with a bar inside a dotted box can occur and typically occurs), "optional" (a function inside a dotted box without a bar can occur but does not typically occur) or "impossible" (a function outside the dotted box can never occur). Moreover, some functions are designed with different allocation possibilities (different resources or configurations of resources can carry out the function).

When complex situations are considered, namely when the conjunction of several elementary situations is examined, designers should check whether there is no conflict between the choices made for the elementary situations. They must look for functions that are "expected" in an elementary situation and that are "impossible" for all resources of the system in other elementary situations. Let us consider situation S* as the conjunction of elementary situations Si and Sj. SOCA-CAT would be useful to model:  a minimal configuration list MinConfig(S*) of functions that can be allocated to a resource and are "expected" in a complex situation. The list is composed of the functionresource couples, noted Fi-Ri, that are at least considered once as "expected" in situation Si and Sj.

 a list Pot(S*) representing all the functions that can be allocated to a resource and are "possible" (i.e. "expected" or "optional") in a complex situation. The list is composed of the Fi-Ri couples that are considered in all situations Si and Sj as "expected" or "optional".

From these two lists, the designers could first check whether there are any design conflicts between concurrent elementary situations modelled with SOCA-CAT, i.e. whether MinConf(S*) is included in Pot(S*). Hence, they deal with a decision problem, depicted in Figure 2, which can be written as:

Figure 2: Decision problem of function allocation

If the answer to the decision problem is positive, that is, if there is no design conflict, the designers could then deal with an optimization problem. They look for the best configuration in the list Pot(S*) that minimizes a criterion of dynamic function allocation defined in SOCA (e.g. the workload of some resources). This problem can be written as:

∀𝑆*, m𝑖𝑛𝑖𝑚𝑖𝑧𝑒 DFA_Criterion(𝑆𝑜𝑙𝑢𝑡𝑖𝑜𝑛(𝑆*)), 𝑤𝑖𝑡ℎ 𝑀𝑖𝑛𝐶𝑜𝑛𝑓(𝑆*) 𝑆𝑜𝑙𝑢𝑡𝑖𝑜𝑛(𝑆*) Pot(𝑆*).

The following section presents an implementation of this method on a case study.

EXAMPLE OF APPLICATION

The proposed CWA-based DFA method was applied on a human-machine system composed of technical components (an electric pedal-assist bike, a GPS navigation system, physiological sensors, a battery gauge) and a human agent (a cyclist). The system can be considered as an instance of STS. It is both an intentional and a causal system: the system reacts to the variations on the road due to actions of other road users and to the laws of nature. This "simple" case study was chosen to illustrate the method proposed in this paper. The application example must therefore be considered as a first proof of concept. It simulates a design problem inspired by the new needs resulting from the recent popularization of pedal-assist bikes and the development and integration of new technologies. Indeed, new uses have appeared: cyclists want to avoid daily battery recharging, or they wish to integrate unplanned routes to their usual routine without having to do without power assist on the final slopes before arriving home. Hence, the assist capacities of electric bikes need to be better adapted to the cyclists' individual goals (such as duration and length of trips) and to dynamic situations (ascents, wind, road traffic). Adaptation also involves improved battery use and assistance optimization any time on the route while securing the bikers' safety. Furthermore new technologies enable adding physical and software devices onto the electric bikes so as to guarantee bikers a safe and effective ride. Designers thus need to be given a method to evaluate whether the resources and the dynamic function allocation are sufficient to meet these objectives of safety and performance.

Defining function allocation with the existing CWA tools

CWA modelling tools were used to model the functional constraints (AH), the situational constraints (CAT), and the resource constraints related to the DFA problem.

Work Domain Analysis (Abstraction Hierarchy)

The functional purpose of the system is to guarantee a safe and effective ride towards a desired destination. Meeting this objective entails that the system must comply with some values and priorities related to performance and safety, shown in Figure 3 from left to right. The safety priorities from the smallest to the largest scale of the system are the following ones: minimal battery level for cyclists' safety; system integrity; adaptation of the system to the road; adaptation of the system to the road management system. The performance priorities are related to the management of the location objective (the system must help the cyclists reach the desired destination), the management of the path duration, and the management of the cyclists' tiredness. Consideration should be given to the humanmachine cooperation issue, in terms of the following purpose-related functions, which can be cognitive and motor functions: supplying propulsion to ride the bike and to reach the location objective; route planning means regularly geolocating the system and choosing an adapted path; controlling system capacities to monitor internal conditions (in this case, the energetic states of human and technical components of the system that could result in an accident or underperformance); controlling the environment (i.e. monitoring external conditions such as the weather, road grade and quality, stop signs, etc).

Figure 3: Abstraction Hierarchy and SOCA-AH

The object-related processes and the physical objects are defined in relation to the hybrid nature of the humanmachine system. The human actor is situated within the system; hence, the physical objects can be defined in terms of human capacity (for instance muscles or the nervous system) and technical capacity (for instance motor or sensors). This dichotomy between human and technical parts will be used in the SOCA phase to categorize the resources to which the functions could be allocated.

Control Task Analysis (Contextual Activity Template)

The work situations were modelled with different internal and external conditions, as indicated in the proposal of the method (see Figure 4). As in the example given by [START_REF] Naikar | Analysing activity in complex systems with cognitive work analysis: concepts, guidelines and case study for control task analysis[END_REF], some situations (S2 to S5) could result from the conjunction of elementary conditions (knowledge level of the cyclists on the path to reach their destination, and difficulty level resulting from the road quality, grade, and traffic). Other situations depend on only one condition (speed, GPS signal access). The distinction between "expected", "optional", and "impossible" situation-related functions was examined in this CWA phase and then refined in SOCA-CAT. The detailed design choices of this function classification are explained in the following paragraphs dealing with SOCA.

Social-Organization and Cooperation Analysis (reuse of previous models)

Only two resources (actors) were considered to investigate this DFA within a human-machine system. In Figures 3 and4, the functions allocated to human were coloured in blue (they will be noted Fi-H in the following paragraphs, with i as index), and those allocated to machine were coloured in green (noted Fi-M). The AH and the CAT were therefore coloured according to functional and situational design choices, providing what Jenkins et al. ( 2008) call SOCA-AH and SOCA-CAT models. The SOCA-AH model shows that the function F4 is chosen by designers to be achieved by human (it is therefore a static allocation). The SOCA-CAT model enables designers to refine the situational design choices according to human and technical resources. Some functions can be "expected" for human and "optional" for machine in certain conditions (in the good situation S4, the cyclists typically pedal, and electric assist is not typically activated, even if it is possible), or they can be "expected" for both human and machine (in the difficult situation S2, electric assist is typically activated). Some functions can also be « impossible » for human or machine in certain conditions. For instance, when the speed exceeds 30 km/h, the electric assist cannot be activated; when the battery is low, a design choice could be the deactivation of the GPS receiver and physiological sensors power for the benefit of the sole electric propulsion power; or when the cyclists know the route or when they are tired, they never planned the path to the desired destination. Some other constraints -resource constraints -have to be considered on the SOCA-AH and SOCA-CAT. The system under investigation is a "pedal-assist" bike, i.e. the electric motor would be activated only if the cyclists pedal (this is a conditional constraint: F1-M can be allocated only if F1-H is allocated). The system is also not equipped with sensors able to monitor the road environment (so F4-M is "impossible" and only F4-H can exist). Moreover, the other functions are ruled by a disjunctive constraint: functions must be allocated to at least one of the two resources.

Solving a dynamic function allocation problem with CWA

The use of previous CWA modelling tools would help designers assess whether their function-and situationdependent choices of resources generate conflicts threatening the safety or the performance of the activity of bike riding, and would allow them choosing an optimal situated function allocation when there is no conflict.

In Figure 4 only eight « elementary » or « simple » situations were defined, arising from the consideration of six variables of internal or external conditions (speed, road difficulty, knowledge of route, GPS signal access, user tiredness, and battery level). The proposed method entails verifying whether the function allocation choices onto the eight modelled elementary situations can deal with complex situations (i.e. the different conjunctions of the elementary situations), instead of considering and modelling all the combinations of the six condition variables. In the latter case, if only two modalities were considered for each variable (e.g. difficult or easy road conditions), up to 64 situations should be completely examined and defined by the designers. The proposal seeks to deal with this combinatorial explosion and to reduce this number by stressing the conflictual conjunctions that should be modelled in addition to these eight elementary situations.

Let us consider two cases: S*=S1US4US6, a rather favorable conjunction of elementary situations (Speed>30km/h, known route, easy road conditions, no GPS cover), and S**=S2US7US8, a difficult complex situation (unknown route, difficult road conditions, tired user, and low battery). The notation Fi-H and Fi-M explained in the proposal is kept for dealing with these examples.  MinConfig is the list of all the Fi-H and Fi-M that are "expected" (with circle and whiskers) in at least one elementary situation composing the complex situation. For this minimal list, it should be noted that only one resource is sometimes sufficient to allocate to a function like F2 or F3 (this is therefore an exclusive constraint noted XOR). Moreover, for the specific case of F1 (ruled by a conditional constraints of F1-H on F1-M), F1-M is expected as well as F1-H in S2, S3 or S7.

In the complex situation S*, F4-H is expected in S1, both F1-H and F4-H are expected in S4 and in S6, so MinConf(S*)={F1-H, F4-H}. In the complex situation S**, all modeled Fi-H and Fi-M of SOCA-CAT are expected in S2. So MinConf(S**)={F1-H ; F1-M; F2-H XOR F2-M ; F3-H XOR F3-M ; F4-H}.  Pot is the list of all the Fi-H and Fi-M that are not "impossible" (not outside dotted boxes) in every elementary situation composing the complex situation (i.e. the list of all the Fi-H and Fi-M that are "expected" or "optional" in every considered elementary situation).

For this maximal list of potential Fi-H and Fi-M, two resources can be allocated separately or together to the same functions: they are therefore both included in the list. Moreover, the conditional constraints are taken into account (e.g. for the specific case of F1, the constraint will be noted F1-M if F1-H). In the case of S*, F2-M is impossible in S6, F2-H and F3-H are both impossible in S4. So Pot(S*)={F1-H ; F1-M if F1-H ;F3-M ; F4-H}.

In the case S**, F2-H is impossible in S7, and both F2-M and F3-M are impossible in S8, whereas all the Fi-H and  If the answer is positive, there is at least one admissible allocation in the complex situation that meets the system functional purpose. This happens in the case S*, where MinConf(S*) is included in Pot(S*).

When possible, an optimization problem can then be solved with DFA criteria. For instance, let us consider the physical and mental workload of the cyclist, or the consumed power of the machine (i.e. the allocation of functions must be minimal respectively on the human or on the machine). The solutions of DFA in S* are thus:  Solution(S*, min cyclist workload)={F1-H; F1-M; F4-H}: electric assist must be implemented to decrease the physical workload, and the automated monitoring of system capacities F3-M is deactivated to avoid an information overload.

 Solution(S*, min energy consumption)={F1-H ;F4-H}:

the machine can be completely deactivated for propulsion and information processing, so as to keep enough battery to help the cyclist in hard road conditions.

DISCUSSION

At the theoretical level, this paper proposes a method that follows the formative nature and the focus on constraints modelling of CWA so as to deal with the DFA issue. This At the methodological level, the proposal is intended to help designers deal with the combinatorial explosion resulting from the combination of the different conditions that form complex situations. Instead of modelling all these complex situations, designers would be able to simply add new condition variables to the previously examined elementary situations and to observe the DFA properties of emergent situations. The analysis of the conjunctions of elementary situations in SOCA-CAT would then enable them to detect design conflicts. In this case, these conflictual complex situations should be completely defined and modelled by designers. Otherwise, that means the dynamic function allocation works in these complex situations, and the DFA problem can be considered as a local optimization problem (the best configuration is looked for in each situation according to specific criteria).

In terms of future perspectives, the proposed method could be further developed by integrating the temporal dimension: in the early design stages, situational constraints could be tested according to baseline scenarios to help designers assess the quality and the influence of their choices on the safety and the performance of the system in realistic situations. The number of design conflicts or the total cost generated from the DFA criteria could then be calculated to assess different design solutions. Considering the temporal dimension is also a way of thinking of a DFA problem not only as a local optimization but also as a global optimization problem (i.e. over entire scenarios).

Moreover, it would also be necessary to take into account the constraints modelled at other stages of CWA, such as the decisional constraints and the strategic constraints respectively defined in SOCA-DL (Decision Ladder in ConTA) and SOCA-IFM (Information Flow Map in StrA). Different cognitive styles could be distinguished that influence DFA (for instance the consideration of a person who always uses the GPS, even if this use is optional in certain situations).

Table 1 :

 1 CWA methodology summary (adapted from Jenkins et al., 2008 and Stanton and Bessell, 2014) DEFINING FUNCTION ALLOCATION WITH THE EXISTING CWA MODELS Dynamic function allocation (DFA) requires knowing the work functions that should be allocated (what), the situations in which they may be allocated (when and where), and the ressources that could be associated with a given function (who). Three phases of the CWA (WDA, ConTa, and SOCA) provide these data through two main existing tools: the Abstraction Hierarchy (AH) and the Contextual Activity Template (CAT).

Figure 1 :

 1 Figure 1: CAT Layout (from Bessell and Stanton, 2014)

Figure 4 :

 4 Figure 4: Contextual Activity Template and SOCA-CAT

Fi-M are

  possible in S2. So Pot(S**)={F1-H ;F1-M if F1-H ;F3-H; F4-H}. First the problem decision must be solved: " "  If the answer is negative, there exist a design conflict, and there is no admissible solution to the problem of dynamic function allocation in the situation under investigation. This happens in the case S**, where neither F2-H nor F2-M are present in Pot(S**) whereas they were in MinConf(S**) under the form F2-H XOR F2-M: MinConf(S**) is not included in Pot(S**). This design conflict is represented in Figure 4, in purple.

  contribution aims at continuing the work made on SOCA around the DFA question (Jenkins et al., 2008; Stanton and Bessell, 2014) by considering: a) SOCA-AH as a means to examine the constraints relative to the design choice of resources in terms of static function allocation (one sole resource for one function) or potential dynamic function allocation (several separate resources for one function); b) SOCA-CAT as a means to examine the constraints relative to the activation of resources in different situations that would influence the possibility and the choice of dynamic function allocation. This last consideration especially involved revisiting the concept of work situation defined by Naikar et al. (2006) relative to the specific question of DFA by characterizing it in terms of external and internal conditions.