Z E A Fellah

S Berger

W Lauriks

C Depollier

J Y Chapelon

Inverse problem in air-saturated porous media via reflected waves

Direct and inverse scattering problem in air filled porous materials is solved. A simple ultrasonic reflectivity method is proposed for measuring the porosity of porous materials having a rigid frame. The proposed method is based on a temporal model of the direct and inverse scattering problem for the propagation of transient ultrasonic waves in a homogeneous isotropic slab of porous material having a rigid frame. This time domain model of wave propagation was initially introduced by the authors ͓Z.

I. INTRODUCTION

Porous media filled with air, such as fibrous mats, plastic foams, and various felts, are heavily used in the automotive, aeronautical, and building industries to attenuate sound waves. In the recent past, low-frequency ͑i.e., in the range 20-600 kHz͒ ultrasonic techniques have amply proven to be a powerful tool to probe the acoustical properties of these materials. The determination of the properties of a medium using waves that have been reflected by or transmitted through the medium is a classical inverse scattering problem. Such problems are often approached by taking a physical model of the scattering process, generating a synthetic response for a number of assumed values for the parameters, and adjusting these parameters until a reasonable level of correspondence is attained between the synthetic response and the data observed.

One important parameter which appears in theories of sound propagation in porous materials [1][2][3][4][5][START_REF] Allard | Propagation of Sound in Porous Media: Modeling Sound Absorbing Materials ͑Chapman and Hall[END_REF][START_REF] Biot | [END_REF][8][9][10][START_REF] Zwikker | Sound Absorbing Materials ͑Elsevier[END_REF][START_REF] Champoux | [END_REF][13] is porosity. Porosity is the relative fraction, by volume, of the air contained within the material. Unlike other parameters included in the description of different various phenomena occurring in the acoustical propagation of porous media at high-frequency range such as tortuosity, [START_REF] Zwikker | Sound Absorbing Materials ͑Elsevier[END_REF] viscous characteristic length, 5 and thermal characteristic length, [START_REF] Champoux | [END_REF] or at low-frequency range such as flow resistivity [START_REF] Zwikker | Sound Absorbing Materials ͑Elsevier[END_REF] and thermal permeability, 13 porosity is a key parameter that plays an important role in propagation at all frequencies. As such, in studies of acoustical properties of porous materials, it is extremely useful to be able to measure this parameter.

Beranek 10 described an apparatus ͑porosimeter͒ used to measure the porosity of porous materials. This device was based on the equation of state for ideal gases at a constant temperature ͑i.e., Boyle's law͒. Porosity can be determined by measuring the change in air pressure occurring with a known change in volume of the chamber containing the sample. In the Beranek apparatus, both pressure and volume changes are monitored using a U-shaped fluid-filled manometer. An alternate technique for measuring porosity is a dynamic method proposed by Leonard. 14 Techniques that use water as the pore-filling fluid, rather than air, are common in geophysical studies. 15,16 Mercury has been used as the porefilling fluid in other applications. 17 However, for many materials, the introduction of liquids into the material is not appropriate. Recently, a similar device to that of Beranek's, involving the use of an electronic pressure transducer, was introduced by Champoux et al. 18 This device can be used to a͒ Electronic mail: fellah@lyon.inserm.fr accurately measure very slight changes in pressure, and the output can be recorded by a computer.

In this work, the inverse problem in porous material having a rigid frame is solved using reflected waves data and a simple ultrasonic method of measuring porosity by measuring a wave reflected by a slab of porous material is presented. This method is based on a temporal model of the direct and inverse scattering problem for the propagation of transient ultrasonic waves in a homogeneous isotropic slab of porous material having a rigid frame. This work was initially introduced by the authors of Refs. 1-4. The viscous and thermal losses of the medium are described by the Johnson et al. 5 and Allard 6 model modified by a fractional calculus-based method in order to be used in the time domain. Reflection and transmission scattering operators of a slab of porous material are derived at oblique incidence and thus the responses of the medium to an incident acoustic pulse are obtained.

The outline of this work is as follows. In Sec. II, a time domain model is given, the connection between the fractional derivatives and wave propagation in rigid porous media in the high-frequency range is established and the basic equations are written in the time domain. Section III is devoted to the direct problem and to the expressions of the reflection and transmission kernels in the time domain and numerical results are given. Section IV deals with the inverse problem and an expression of porosity based on the incident and reflected waves from a slab of porous materials is established. Finally, in Sec. V, the experimental results are given to validate this method.

II. MODEL

In the acoustics of porous materials, a distinction can be made between two situations depending on whether or not the frame is moving. In the first case, the dynamics of the waves due to the coupling between the solid frame and the fluid are clearly described by the Biot theory. [START_REF] Biot | [END_REF]8 In airsaturated porous media, the structure is generally motionless and the waves propagate only in the fluid. This case is described by the model of equivalent fluid which is a particular case in the Biot model, in which the interactions between the fluid and the structure are taken into account in two frequency response factors: The dynamic tortuosity of the medium ␣͑͒ given by Johnson et al. 5 and the dynamic compressibility of the air included in the porous material ␤͑͒ given by Allard. [START_REF] Allard | Propagation of Sound in Porous Media: Modeling Sound Absorbing Materials ͑Chapman and Hall[END_REF] In the frequency domain, these factors multiply the density of the fluid and its compressibility, respectively, and represent the deviation from the behavior of the fluid in free space as the frequency increases. In the time domain, they act as operators, and in the high-frequency approximation their expressions are given by Fellah and Depollier 1,2 and Fellah, Depollier, and Fellah 3,4 as

␣ ˜͑t ͒ϭ␣ ϱ ͩ ␦͑t͒ϩ 2 ⌳ ͩ f ͪ 1/2 t Ϫ1/2 ͪ , ͑1͒ ␤ ˜͑t ͒ϭ ͩ ␦͑t͒ϩ 2͑␥Ϫ1 ͒ ⌳Ј ͩ Pr f ͪ 1/2 t Ϫ1/2 ͪ . ͑2͒
In Eqs. ͑1͒ and ͑2͒, ␦(t) is the Dirac function, Pr is the Prandtl number, and f are the fluid viscosity and the fluid density, respectively, and ␥ is the adiabatic constant. The relevant physical parameters of the model are the tortuosity of the medium ␣ ϱ initially introduced by Zwikker and Kosten [START_REF] Zwikker | Sound Absorbing Materials ͑Elsevier[END_REF] and the viscous and the thermal characteristic lengths ⌳ and ⌳Ј introduced by Johnson et al. 5 and Allard. [START_REF] Allard | Propagation of Sound in Porous Media: Modeling Sound Absorbing Materials ͑Chapman and Hall[END_REF] In this model, the time convolution of t Ϫ1/2 with a function is interpreted as a semiderivative operator following the definition of the fractional derivative of order given in Samko et al., [START_REF] Samko | Fractional Integrals and Derivatives: Theory and Applications ͑Gordon and Breach Science[END_REF] D ͓x͑ t ͔͒ϭ 1

⌫͑Ϫ ͒ ͵ 0 t ͑ tϪu ͒ ϪϪ1 x͑u ͒du, ͑3͒
where ⌫(x) is the gamma function.

In this framework, the basic equations of our model can be expressed as

f ␣ ˜͑t ͒ * ץv i ץt ϭϪٌ i p and ␤ ˜͑t ͒ K a * ץp ץt ϭϪٌ•v, ͑4͒
where * denotes the time convolution operation, p is the acoustic pressure, v is the particle velocity and K a is the bulk modulus of the air. The first equation is the Euler equation, and the second is a constitutive equation obtained from the equation of mass conservation associated with the behavior ͑or adiabatic͒ equation. For a wave propagating at oblique incidence in the plan ͑xoz͒ and making an angle along the x axis, these equations become:

f ␣ ϱ ץv x ͑ x,z,t ͒ ץt ϩ 2 f ␣ ϱ ⌳ ͩ f ͪ 1/2 ͵ 0 t ץv͑x,z,t ͒/dtЈ ͱtϪt Ј dtЈ ϭϪ ץp͑x,z,t ͒ ץx , f ␣ ϱ ץv x ͑ x,z,t ͒ ץt ϩ 2 f ␣ ϱ ⌳ ͩ f ͪ 1/2 ͵ 0 t ץv͑x,z,t ͒/dtЈ ͱtϪt Ј dtЈ ϭϪ ץp͑x,z,t ͒ ץz , ͑5͒ 1 K a ץp͑x,z,t ͒ ץt ϩ 2͑␥Ϫ1 ͒ K a ⌳Ј ͩ f P r ͪ 1/2 ͵ 0 t ץp͑x,z,t ͒/dtЈ ͱtϪt Ј dtЈ ϭϪ ץv͑x,z,t ͒ ץx Ϫ ץv͑x,z,t ͒ ץz ,
where v x , v z are the components of the particle velocity along the axis ox and oz. In Eq. ͑5͒, the convolutions express the dispersive nature of the porous material. They take into account the memory effects due to the fact that the response of the medium to the wave excitation is not instantaneous but needs more time to take effect. The retarding force is no longer proportional to the time derivative of the acoustic velocity but is found to be proportional to the fractional derivative of order 1/2 of this quantity. This occurs because the volume of fluid involved in the motion is not throughout the whole length of the signal as it is in the case of a fully developed steady flow. The phenomenon may be understood by considering such a volume of fluid in a pore to be in harmonic motion. At high frequencies, only a thin layer of fluid is excited and so the average shear stress is high. At a lower frequency, the same amplitude of fluid motion allows a thicker layer of fluid to participate in the motion and, consequently, the shear stress is lower. The penetration distance of the viscous forces and, therefore, the excitation of the fluid depends on frequency. In the time domain, such a dependence is associated with a fractional derivative.

III. DIRECT PROBLEM

The direct scattering problem is that of determining the scattered field, as well as the internal field, that arises when a known incident field impinges on the porous material with known physical properties. To compute the solution of the direct problem, it is necessary to know the reflection and/or the transmission scattering operators which depends on the Green 3 function of the porous medium. In that case, the reflected field is given by the convolution of the reflection operator with the incident field, and the transmitted field is given by the convolution of the transmission operator by the incident field.

Consider a homogeneous slab of porous material which occupies the region 0рxрL. The geometry of the problem is shown in Fig. 1. This medium is assumed to be isotropic and to have a rigid frame. A short sound pulse impinges at oblique incidence on the medium from the left-hand side. It gives rise to an acoustic pressure field p(x,t) and an acoustic velocity field v(x,t) within the material, which satisfies the propagation equation 1-4

ץ 2 p͑x,z,t ͒ ץx 2 ϪA ץ 2 p͑x,z,t ͒ ץt 2 ϪB ץ 3/2 p͑x,z,t ͒ ץt 3/2 ϪC ץp͑x,z,t ͒ ץt ϭ0, ͑6͒
where the coefficients A, B, and C are constants, respectively, given by

Aϭ 1 c 0 2 ͑ ␣ ϱ Ϫsin 2 ͒, Bϭ 2␣ ϱ K a ͱ f ϫ ͩ 1 ⌳ ϩ ␥Ϫ1 ͱPr⌳ Ј ͪ , Cϭ 4␣ ϱ ͑ ␥Ϫ1͒ K a ⌳⌳ЈͱPr . ͑7͒
The first one is related to the velocity of the projected wave along the x axis cϭc 0 /ͱ␣ ϱ Ϫsin 2 . The other coefficients are essentially dependent of the characteristic lengths ⌳ and ⌳Ј and express the viscous and thermal interactions between the fluid and the structure. The constant B governs the spreading of the signal while C is responsible for the attenuation of the wave. Obviously, a knowledge of these three coefficients allows the determination of the parameters ␣ ϱ , ⌳, and ⌳Ј. One way to solve Eq. ͑7͒ with suitable initial and boundary conditions is by using the Laplace transform. The approach is quite simple although the inverse Laplace transform requires tedious calculus. 3 A suitable setting for the introduction of the time domain solution of the modified wave propagation ͓Eq. ͑6͔͒ is provided by the following model.

To derive the reflection and transmission scattering operators, it is assumed that the field and the flow velocity are continuous at the boundary of the material

p͑0 ϩ ,t ͒ϭ p͑0 Ϫ ,t ͒, p͑L Ϫ ,t ͒ϭ p͑L ϩ ,t ͒, ͑8͒ v͑ 0 Ϫ ,t ͒ϭv͑ 0 ϩ ,t ͒, v͑ L ϩ ,t ͒ϭv͑ L Ϫ ,t ͒,
where is the porosity of the medium and Ϯ superscripts denotes the limit from the left-and the right-hand side, respectively. The initials conditions are given by p͑x,t ͉͒ tϭ0 ϭ0, ץp ץt ͯ tϭ0 ϭ0, ͑9͒

which means that the medium is idle for tϭ0.

If the incident sound wave is launched in the region x р0, then the general solution of Eq. ͑6͒ in the region to the left-hand side of the material is the sum of the incident and reflected field Here, p 1 (x,t) is the field in the region xϽ0, p i and p r denote the incident and the reflected field, respectively. In addition, a transmitted field is produced in the region to the right-hand side of the material. This has the form

p 1 ͑ x,t ͒ϭ p i ͩ tϪ x cos c 0 ͪ ϩp r ͩ tϩ x cos c 0 ͪ , xϽ0.
p 3 ͑ x,t ͒ϭ p t ͩ tϪ L c Ϫ ͑ xϪL ͒cos c 0 ͪ , xϾL, ͑11͒
where p 3 (x,t) is the field in the region xϾL and p t is the transmitted field. The incident and scattered fields are related by the scattering operators ͑i.e., reflection and transmission operators͒ for the material. These are integral operators represented by

p r ͑ x,t ͒ϭ ͵ 0 t R ˜͑ ͒p i ͩ tϪϩ x c 0 ͪ d ϭR ˜͑t ͒ * p i ͑ t ͒ * ␦ ͩ tϩ x cos c 0 ͪ , ͑12͒ p t ͑ x,t ͒ϭ ͵ 0 t T ˜͑ ͒p i ͩ tϪϪ L c Ϫ ͑ xϪL ͒ c 0 ͪ d ϭT ˜͑t ͒ * p i ͑ t ͒ * ␦ ͩ t-L c Ϫ ͑ xϪL ͒cos c 0 ͪ . ͑13͒
In Eqs. ͑12͒ and ͑13͒, the functions R ˜and T ˜are the reflection and the transmission kernels, respectively, for incidence of waves from the left-hand side. Note that the lower limit of integration in Eqs. ͑12͒ and ͑13͒ is set to 0, which is equivalent to assuming that the incident wave front first impinges on the material at tϭ0. The scattering operators given in Eqs. ͑12͒ and ͑13͒ are independent of the incident field used in the scattering experiment and depend only on the properties of the materials. Using Eqs. ͑4͒, ͑6͒, ͑8͒, ͑12͒, and ͑13͒ and Laplace transform calculus, we can derive the reflection and transmission scattering operators given by

R ˜͑t ͒ϭ ͩ ␣ ϱ cos Ϫͱ␣ ϱ Ϫsin 2 ␣ ϱ cos ϩͱ␣ ϱ Ϫsin 2 ͪ ϫ ͚ nу0 ͩ ␣ ϱ cos Ϫͱ␣ ϱ Ϫsin 2 ␣ ϱ cos ϩͱ␣ ϱ Ϫsin 2 ͪ 2n ϫ ͫ F ͩ t,2n L c ͪ ϪF ͩ t,͑2nϩ2 ͒ L c ͪͬ ,
T ˜͑t ͒ϭ 4 cos ͱ ␣ ϱ Ϫsin 2 ͩ ͱ ␣ ϱ cos ϩͱ1Ϫ sin 2 ␣ ϱ ͪ 2 ϫ ͚ nу0 ͩ ␣ ϱ cos Ϫ ͱ ␣ ϱ Ϫsin 2 ␣ ϱ cos ϩ ͱ ␣ ϱ Ϫsin 2 ͪ 2n ϫF ͩ tϩ L c 0 ,͑2nϩ1 ͒ L c ͪ .

͑15͒

These expressions takes into account the n-multiple reflections in the material. For a positive constant k,F(t,k) is the Green function of the porous material given in Ref. 3 ͑Ap-pendix͒.

In most cases, for porous materials saturated by air, the multiple reflection effects are negligible because of the high attenuation of sound waves in this kind of media. So, by taking into account only the reflections at the interfaces x ϭ0 and xϭL, the kernel of transmission is given by R͑t ͒ϭϪ

T ˜͑t ͒ϭ 4 cos ͱ ␣ ϱ Ϫsin 2 ͩ ͱ ␣ ϱ cos ϩͱ1Ϫ sin 2 ␣ ϱ ͪ 2 F ͩ tϩ L c , L c ͪ ,
4 cos ͱ ␣ ϱ Ϫsin 2 ͩ ͱ ␣ ϱ cos Ϫͱ1Ϫ sin 2 ␣ ϱ ͪ ͩ ͱ ␣ ϱ cos ϩͱ1Ϫ sin 2 ␣ ϱ ͪ F ͩ t, 2L c ͪ ,

͑19͒

in the case of a semi-infinite medium when L→ϱ; F(t,2L/c)→0, and R ˜(t)→r(t) ͑Appendix͒. This means that r(t) is equivalent to the reflection at the interface xϭ0 and that R(t) is equivalent to reflection at the interface xϭL, which is the bulk contribution to the reflection. The part of the wave corresponding to r(t) is not subjected to the dispersion but it is simply multiplied by the factor (␣ ϱ cos Ϫͱ␣ ϱ Ϫsin 2 /␣ ϱ cos ϩͱ␣ ϱ Ϫsin 2 ). This shows that although tortuosity is a bulk parameter, it may be evaluated from the wave reflected at the first interface when the porosity is known and vice versa. Although generally speaking, it is easy to evaluate the tortuosity from transmitted waves, 3,4,[START_REF] Leclaire | [END_REF]21 this is not the case for porosity because of its weak sensitivity in transmitted mode. Figure 2 shows two simulated transmitted signals for a plastic foam M1, the first one ͑solid line͒ corresponds to the value of porosity 1 ϭ0.98 and the second one ͑dashed line͒ corresponds to 2 ϭ0.49. The parameters of the plastic foam M1 ͑thickness 1.1 cm, ␣ ϱ ϭ1.25, ⌳ϭ50 m, and ⌳Јϭ150 m) have been determined using conventional methods. 3,4,[START_REF] Leclaire | [END_REF]21 Readers can see the slight difference between the two curves for a 50% difference in porosity values, which is due to the dispersion phenomenon that is governed by viscous, thermal, and inertial effects contributed by ␣ ϱ , ⌳ and ⌳Ј, and plays a more important role in the Green function F(t,k) than .

Figure 3 shows the two contributions to the reflection: r(t) ͑solid line͒ and R(t) ͑dashed line͒ for a plastic foam M1 at normal incidence (ϭ0). The contribution of R(t) to the reflection is negligible when it is compared to the contribution of r(t). In Fig. 4 we show, by numerical simulation, the difference between the reflected wave at the first interface and the total reflected wave. The difference between the two curves is slight. This means that the wave reflected by the slab may be approximated by the reflected wave by the first interface r(t) with a good level of accuracy. It easy to verify that this approximation is valid for any incidence angle .In Sec. IV, we will show by solving the inverse problem how it is the possible to measure the porosity by measuring the reflected wave by a slab of porous material.

IV. INVERSE PROBLEM

A porous material having a rigid frame is characterized by four parameters in the high-frequency range, namely, porosity , tortuosity ␣ ϱ , the viscous characteristic length ⌳, and the thermal characteristic length ⌳Ј. These values are crucial for the behavior of the sound waves in such materials. So, it is therefore fairly important to work out new experimental methods and efficient tools to assess them. Therefore, a basic inverse problem associated with the slab may be stated as follows: To find the values of the parameters of the medium from the measurements of the transmitted and/or reflected signals outside the slab. As shown in Sec. III, the solution to the direct problem is the system of two operators expressed as functions on , ␣ ϱ , ⌳, and ⌳Ј. The inversion algorithm for finding the values of the parameters of the slab is based on a fitting procedure. To find the values of the parameters , ␣ ϱ , ⌳, and ⌳Ј such that the transmitted and reflected signal describes the scattering problem in the best possible way ͑e.g., in the least-squares sense͒. Solving the inverse problem using experimental data from transmitted waves is treated 3,4 and an estimation of ␣ ϱ , ⌳, and ⌳Ј has been given with a good level of correspondence from ultrasonic measurements. Here, we will try to solve the inverse problem using experimental reflected wave data for different FIG. 14. Spectrum of experimental incident signal ͑dashed line͒ and spectrum of experimental reflected signal ͑solid line͒ for ϭ13°. values of the incidence angle , with the aim of returning to the porosity which, because of its weak sensitivity, cannot be characterized in transmitted mode.

The inverse problem is to find the porosity value which minimizes the function

Uϭ ͚ iϭ1 iϭN ͑ p r ͑ t i ͒Ϫ p exp r ͑ t i ͒͒ 2 , ͑20͒
where p r (t i ) iϭ1,2,...,N represents the discrete set of values of the simulated reflected signal given by Eq. ͑12͒ and p exp r (t i ) iϭ1,2,...,N is the discrete set of values of the experimental signal. In the approximation that the reflected wave is essentially due to the reflection at the first interface xϭ0;

R
ͩ aϪ1 aϩ1 p i ͑ t i ͒Ϫ p exp r ͑ t i ͒ ͪ 2 ϭ0, ͑25͒ then 2 ͚ iϭ1 iϭN ͑ aϩ1 ͒Ϫ͑ aϪ1 ͒ ͑ aϩ1 ͒ 2 p i ͑ t i ͒ ͩ aϪ1 aϩ1 p i ͑ t i ͒Ϫ p exp r ͑ t i ͒ ͪ ϭ0 ͑26͒ and ͚ iϭ1 iϭN p i ͑ t i ͒ ͩ aϪ1 aϩ1 p i ͑ t i ͒Ϫ p exp r ͑ t i ͒ ͪ ϭ0,

͑27͒

which is equivalent to

aϭ ͚ iϭ1 iϭN p i ͑ t i ͒͑ p i ͑ t i ͒ϩ p exp r ͑ t i ͒͒ ͚ iϭ1 iϭN p i ͑ t i ͒͑ p i ͑ t i ͒Ϫ p exp r ͑ t i ͒͒ ϭ ␣ ϱ cos ͱ␣ ϱ Ϫsin 2 , ͑28͒
the expression of the porosity is

ϭ ͚ iϭ1 iϭN p i ͑ t i ͒͑ p i ͑ t i ͒Ϫ p exp r ͑ t i ͒͒ ͚ iϭ1 iϭN p i ͑ t i ͒͑ p i ͑ t i ͒ϩ p exp r ͑ t i ͒͒ ͩ ␣ ϱ cos ͱ␣ ϱ Ϫsin 2 ͪ . ͑29͒
The second derivative term:

ץ 2 U ץa 2 ϭϪ 8 ͑ aϩ1 ͒ 3 ͚ iϭ1 iϭN ͩ aϪ1 aϩ1 ͑ p i ͑ t i ͒͒ 2 Ϫ p exp r ͑ t i ͒. p i ͑ t i ͒ ͪ ϩ 8 ͑ aϩ1 ͒ 4 ͚ iϭ1 iϭN ͑ p i ͑ t i ͒͒ 2 , ͑30͒
from Eq. ͑26͒, we have

ץ 2 U ץa 2 ϭϪ 2 ͑ aϩ1 ͒ ץU ץa ϩ 8 ͑ aϩ1 ͒ 4 ͚ iϭ1 iϭN ͑ p i ͑ t i ͒͒ 2 , ͑31͒
when ץU/ץaϭ0, the condition ץ 2 U/ץa 2 Ͼ0 is always verified. Relation ͑29͒ is the expression of the porosity as a function of the tortuosity, the incidence angle , and the discrete set of values of the incident and reflected signal, we will use this relation in Sec. V to estimate the value of the porosity from experimental incident and reflected data.

V. ULTRASONIC MEASUREMENTS

As an application of this model, some numerical simulations are compared to experimental results. Experiments are carried out in air with two broadband Ultran NCT202 Figures 8͑a͒ and8͑b͒ show the spectra of the incident and reflected experimental signals, respectively, at the incidence angle 17°. Figures 9͑a͒ andshow the spectra of the incident and reflected experimental signals, respectively, at the incident angle 53°. From the spectra of the incident and reflected signals, the reader can see that they have the same bandwidths which means that there is no dispersion. This concurs with the theory which predicts that the reflected wave from the first interface xϭ0 is measured and simply attenuated by the factor (␣ ϱ cos Ϫͱ␣ ϱ Ϫsin 2 /␣ ϱ cos ϩͱ␣ ϱ Ϫsin 2 ).

Using the incident and reflected experimental data for the foam M2 and relation ͑29͒, the values of the porosity optimized by solving the inverse problem for each incidence angle are given in Table I. The average value of the porosity obtained is ϭ0.97.

Figures 10 and11 show the comparison between experimental reflected signals and simulated reflected signals for the optimized value of the porosity (ϭ0.97), the difference between the predicted and experimental curves are slight which leads us to conclude that the optimized value of the porosity is good. The value of the porosity of the foam M2 given by the porosimeter 10,18 is ϭ0.96Ϯ0.02. The flow resistivity of the plastic foam M2 is ϭ3000 Nm Ϫ4 s. This value is low compared with other plastics foams, and is the reason why the value of the porosity is very close to 1 and thus the reflected signals by the plastic foam M2 is very small near the incident signals.

Another plastic foam M3 is studied ͑thickness 0.6 cm͒. This has a high level of flow resistivity, ϭ125 000 Nm Ϫ4 s and the ultrasonic parameters are ␣ ϱ ϭ1.7, ⌳ϭ23 m, and ⌳Јϭ69 m. Figures 12 and13 show the incident and reflected signals at the incidence angles 13°a nd 39°, respectively.

Figures 14 and15 show their spectra, respectively. Here again, we can conclude from the spectra of the incident and reflected signals that there is no dispersion. By solving the inverse problem from the incident and reflected data and relation ͑29͒, the optimized values of the porosity for each incidence angle are given in Table II. The average value of the porosity obtained is ϭ0.82. Figures 16 and17 show the comparison between simulated reflected signals obtained by the optimized value of the porosity for each incidence angle and the experimental signals. The readers can see the slight difference between the experimental and simulated signals that proves the optimized value of the porosity. The main advantage of this method is its simplicity compared with the porosimeter, 18 which involves more complicated measurement steps and a more expensive experimental setup.

APPENDIX: GREEN FUNCTION OF THE MEDIUM

The Green function of the propagation ͓Eq. ͑6͔͒ is given in Ref.

FIG. 1 .

 1 FIG. 1. Geometry of the problem.

͑10͒FIG. 5 .

 5 FIG. 5. Experimental setup of the ultrasonic measurements in reflected mode. PG: pulse generator; HFF-PA: high-frequency filtering-preamplifier; DO: digital oscilloscope; C: computer; T: transducer; and S: sample.

͑14͒FIG. 8 .FIG. 9 .

 89 FIG. 8. ͑a͒ Spectrum of the incident signal (ϭ17°). ͑b͒ Spectrum of the reflected signal (ϭ17°).

͑16͒FIG. 10 .

 10 FIG. 10. Comparison between experimental reflected signal ͑solid line͒ and simulated reflected signal ͑dashed line͒ f o rM 2(ϭ17°).

FIG. 12 .

 12 FIG. 12. Experimental incident signal ͑dashed line͒ and experimental reflected signal ͑solid line͒ by the material M3 for ϭ13°.

FIG. 15 .

 15 FIG.15. Spectrum of experimental incident signal ͑dashed line͒ and spectrum of experimental reflected signal ͑solid line͒ for ϭ39°.

FIG. 16 .

 16 FIG. 16. Comparison between experimental reflected signal ͑solid line͒ and simulated reflected signal ͑dashed line͒ f o rM 3(ϭ13°).

FIG. 17 .

 17 FIG. 17. Comparison between experimental reflected signal ͑solid line͒ and simulated reflected signal ͑dashed line͒ for M3 (ϭ39°).

͑ 2 ͪ

 2 tϪk ͒ 3/2 exp ͩ Ϫ bЈ 2 k 2 16͑tϪk ͒ ͪ ,where h(,) has the following form: ͑ ͑,, ͒Ϫ1 ͒ d ͱ1Ϫ 2 , and where (,,)ϭ(⌬ͱ(Ϫ) 2 Ϫk 2 ϩbЈ(Ϫ)) 2 /8, bЈϭBc 0 2 ͱ, cЈϭC.c 0 2 , and ⌬ϭbЈ 2 Ϫ4cЈ, when k→ϱ, ⌶ and h(,) tend toward zero, then the Green function F(t,k) also tends toward zero.

TABLE I .

 I Optimized values of the porosity calculated by solving the inverse problem for the plastic foam M2.

	Incidence angle ͑degrees͒	01 72 33 5	5 3 . 5
	Porosity	0.969 0.969 0.971 0.973 0.969

TABLE II .

 II Optimized values of the porosity calculated by solving the inverse problem for the plastic foam M3. The received signals are amplified up to 90 dB and filtered above 1 MHz to avoid high-frequency noise. Electronic perturbations are removed by 1000 acquisition averages. The experimental setup is shown in Fig.5. The duration of the signal plays an important role, its spectrum must verify the condition of high-frequency approximation referred to in Sec. IV.Figures6͑a͒ and 6͑b͒show the incident and reflected experimental signals, respectively, at the incident angle 17°b y the plastic foam M2. The parameters of the plastic foam M2 are: thickness 4.1 cm, resistivity ϭ3000 Nm Ϫ4 s, ␣ ϱ ϭ1.07, ⌳ϭ230 m, and ⌳Јϭ690 m. Figures7͑a͒ and 7͑b͒show the incident and reflected experimental signals, respectively, at the incident angle 53°by the plastic foam M2.

	transducers having a 190 kHz central frequency in air and a
	bandwidth at 6 dB extending from 150 kHz to 230 kHz.
	Incidence angle ͑degrees͒ Pulses of 400 V are provided by a 5052PR Panametrics 0 1 32 33 94 9
	Porosity pulser/receiver.	0.820 0.821 0.820 0.821 0.821


Nikolena Christofi
email: nikolena.christofi@irt-saintexupery.com

Xavier Pucel

Claude Baron

Marc Pantel

Sébastien Guilmeau

Christophe Ducamp

Towards an agile, model-based multidisciplinary process to improve operational diagnosis in complex systems

Keywords: Satellite Systems, Health Monitoring, Online Diagnosis, Model-Based Systems Engineering (MBSE), Model-Based Safety Assessment (MBSA), Maintainability, Behaviour Trees, Model-Based Operations, Agile Techniques

Systems' online diagnostics require multidisciplinary system knowledge and experience by their operators. When the complexity of the system rises, operational (in-service) diagnostics become a complex task. In an effort to improve the efficiency while better handling the complexity of diagnostics during operations, the authors propose a methodology aiming to increase the agility in complex systems' development processes. This paper introduces a new way to construct operational models early on the development cycle so as to improve the performance of monitoring activities and, ultimately, increase the confidence on the systems' resilience provided by its design.

Introduction

To this day, monitoring activities and associated tools used for Fault Detection and Diagnosis (FDD) [START_REF] Kim | A review of fault detection and diagnostics methods for building systems[END_REF] during system operation are limited to specific functions provided by certain subsystems, while largely relying on the operators' experience [START_REF] Djebko | Model-based fault detection and diagnosis for spacecraft with an application for the sonate triple cube nano-satellite[END_REF]. Past data i.e. Return of Operating Experience (ROE), also feed the algorithms used for FDD. However, the ever growing complexity of embedded systems demand that the tools used for system monitoring have an underlying knowledge of the whole system structure and behaviour, so as to provide a faster, and more reliable diagnosis, especially when time is a key operational constraint. What is more, without precise knowledge of the system design, it is ambitious for diagnostic tools to be able to provide a unique possible failure source, or the correct troubleshooting procedure, in case the monitoring data contain alarm inconsistencies.

Diagnostic tools shall thus be able to provide the operators with dedicated views of the system, which will help them perform diagnosis more efficiently. These views must incorporate the appropriate system information with the defined level of detail while keeping monitoring and diagnosis in the main focus. An overly detailed view of the system would make the operation model too heavy and long to exploit, while if the view is too coarse or stays only at high level, the model might lack crucial information to assist in diagnosis. To this end, one approach consists in collecting available information from the system architecture designed during Systems Engineering (SE), as well as from the Safety Analyses (SA) documents and models, the latter regarding the potential failures. The aim would then be to use the collection of data, information and models, to produce a tool that will support the operators in their monitoring task: interpreting housekeeping data, troubleshooting problems, and performing system maintenance.

Our goal is thus to use the system design information to construct operational diagnosis tools. We postulate that this is possible with the introduction of an Operations-Dedicated Model (ODM), which shall include both system design information -SE data, as well as the information produced by selected system dysfunctional analyses -SA data. The latter shall help in the diagnosis activities by suggesting a possible source for the error, and its location in the system.

We explore Behaviour Trees (BTs) as a solution towards the construction of ODMs to be used for operational diagnosis. Considering that BTs can provide an intuitive way to model and simulate system behaviour, they can also be used to meet the needs for a diagnostic model which includes the system's dynamic aspects and not only its structural information -as it is the case for the currently available diagnosis models. BTs have shown a lot of potential in the last decade, mainly with their application to robotics and Artificial Intelligence (AI). Initially developed within the gaming community to replace Finite State Machines (FSM) with more user friendly models, their use could be widened to the field of operational diagnosis to model, implement and monitor the state of complex systems.

This paper explores the use of BTs to create a system behavioural model -namely ODM, oriented towards system monitoring, which can be exploited during operations in order to increase efficiency in diagnosis. We show in place that the BT model can be built during the design phase and along the production of other design models and documents, in a co-design manner, thus contributing to an agile system development process. The co-design of system and BT models is a process within which documents and models of system function and dysfunction and BT models of system monitoring for operational diagnosis are mutually constituted.

The structure of this paper is as follows. Section 2 outlines the context of our research and the problematic addressed. Section 3 presents a literature review on the involved topics. The proposed approach is presented in Section 4, using an illustrating example in Section 4.1, and perspectives on the use of ODMs inside monitoring tools for diagnostic purposes in Section 4.2. Finally, Section 5 draws conclusions and discusses future work opportunities.

Context and Motivation

Despite the recent flourishing of model-based languages, methods and tools for system development -system design and Verification and Validation -V&V activities, diagnostic tools created for the same systems, have known a different path. Existing diagnosis tools are often designed after the system is built; hence the opportunities to make the system easy to operate -which would be the case if the tools were constructed during system design, are lost. Either under the form of data-based [START_REF] De Kleer | Fundamentals of model-based diagnosis[END_REF] or model-based [START_REF] Lei | Applications of machine learning to machine fault diagnosis: A review and roadmap[END_REF], these tools are often targeting single system functions/subsystems -e.g formation flight [START_REF] Barua | Hierarchical fault diagnosis and fuzzy rule-based reasoning for satellites formation flight[END_REF], reaction wheels [START_REF] Baldi | Combined geometric and neural network approach to generic fault diagnosis in satellite reaction wheels[END_REF], or thrusters [START_REF] Pittet | A model-based diagnosis method for transient and multiple faults of aocs thrusters[END_REF][START_REF] Patton | Robust fdi applied to thruster faults of a satellite system[END_REF][START_REF] Valdes | A pulsed plasma thruster fault detection and isolation strategy for formation flying of satellites[END_REF]. Consequently, their specificity to one function or subsystem makes them non-generic, and thus not reusable.

Moreover, diagnostic models fail to include safety analyses methods' derived information; methods such as Failure Modes and Criticality Effects Analysis (FMECA), Fault Tree Analysis (FTA), Failure Logic Modelling (FLM) [START_REF] Lisagor | The illusion of method: Challenges of model-based safety assessment[END_REF][START_REF] Papadopoulos | Engineering failure analysis and design optimisation with hip-hops[END_REF], Failure Propagation Modelling (FPM) [START_REF]Guidelines and methods for conducting the safety assessment process on civil airborne systems and equipment[END_REF], or Model-Based Safety Assessment [START_REF] Lisagor | Model-based safety assessment: Review of the discipline and its challenges[END_REF][START_REF]Guidelines and methods for conducting the safety assessment process on civil airborne systems and equipment[END_REF]. On the other hand, system diagnostic tools can be very generic i.e. agnostic of the domain usage: they use general diagnosis techniques, such as Machine Learning (ML) [START_REF] Ibrahim | Machine learning techniques for satellite fault diagnosis[END_REF], not specific to spacecraft operations.

Moreover, operational diagnostics, as a core part of satellite maintenance, is limited by many constraints, should thus consist one of the major concerns in satellite design. Therefore, by integrating a diagnostic tool in the system development process and co-designing it along with the system itself, we can ensure that the operational diagnosis activities are well taken under consideration before the satellite deployment.

As mentioned in [START_REF] Wolf | Hardware-software co-design of embedded systems[END_REF], this would mean that the system design and its monitoring models influence each other. The proposed process is depicted in Figure 1, where it is illustrated with a space satellite system application. Following the system's deployment, the operator, having at their disposal the housekeeping data the Operation Centre (OC) has received from on-board the satellite, can perform diagnosis with the help of the monitoring tool. The latter is using the ODM built during the system development process (concurrently with the system design models) in the form of BTs. This would add confidence in the diagnosis results as well to the operations model. For the needs of our project we assume that the ODM is representative of the actual system emitting the monitoring data.

Figure 1: Overview of the proposed approach: creating ODMs during system design phase (along with SE & SA models), to be used as a basis for the "System Health Monitoring Tool".

Literature Review

This section consists of a description of the current State of the Art (SoA) in the fields of MBSE -section 3.1, and MBSA, as a prominent System Safety Assessment (SSA) methodology -section 3.2. The aim is to introduce the reader to the topics involved in our approach. Finally, subsection 3.3 presents the basic semantics of BTs, which is the formalism used to create the ODMs.

Model-Based Systems Engineering (MBSE)

MBSE facilitates the fulfillment of the SE requirements through design -structural and behavioural system modelling in various decomposition levels. SE models allow the engineers to verify the solution's design, functions and envisaged operations, early on in the development process, resulting to the reduction of the overall project cost. MBSE allows design alterations to take place in the beginning of system development and not when the solution is furtherly developed.

By applying MBSE, one can create architectural models (express system structure and decomposition), functional models (express system functions), and behavioural models (express system behaviour in different operational scenarios). To represent these models, several types of formalism are used, along with their associated languages and methodologies. The most common languages used in MBSE [START_REF]INCOSE -International Council on Systems Engineering, Guide to the Systems Engineering Body of Knowledge (SEBoK)[END_REF] are SysML [START_REF]Object Management Group (OMG), Systems Modeling Language (SysML)[END_REF] -based on OMG's7 UML [START_REF]Object Management Group (OMG), Unified Modeling Language (UML)[END_REF] standard, and EAST-ADL [START_REF]EAST-ADL Association, EAST Architecture Description Language (EAST-ADL)[END_REF]. ARCADIA [START_REF] Thales | ARChitecture Analysis & Design Integrated Approach (ARCADIA)[END_REF], IDEF [START_REF]Knowledge Based Systems, Inc. (KBSI), Integration DEFinition (IDEF)[END_REF], and OPM [START_REF]International Organisation for Standardization (ISO), Object Process Methodology (OPM)[END_REF] consist both MBSE languages and methodologies. In terms of tools, IBM's Rhapsody [23] and Magic Draw's Cameo [START_REF]Cameo Systems Modeler[END_REF]-both based on SysML, and Eclipses' open-source Capella [START_REF]Eclipse Capella TM[END_REF]-based on the Arcadia method, are the most popular.

System Safety Assessment (SSA) and Model-Based Safety Assessment (MBSA)

System Safety Assessment (SSA) is an analysis which leads to the production of a series of documents reporting all the identified hazards for the system in question, and the complying with the safety requirements [START_REF] Verrastro | Chapter 21 -morphing devices: Safety, reliability, and certification prospects[END_REF]. For each identified system Failure Condition (FC)-how the system could fail, characterised by their level of impact to the environment, humans and the system itself (for space systems: catastrophic, critical, major, minor/negligible) [START_REF]European Cooperation for Space Standardization[END_REF], an analysis shall be made, in order to identify the possible causes-and combination of, that can lead to these FCs.

A recently developed approach for performing SSA or Reliability, Availability, Maintainability and Safety (RAMS) analysis, is MBSA. It is a technique which models the system's structure and behavior in order to provide safety analysis results. In this approach, various SSA-related activities are based on formal models which contain system dysfunctional data. In order to perform dysfunctional analysis at system level, it is required to have a fundamental knowledge of (a) the nominal system behavior, limited to the scope and the level of abstraction useful for dysfunctional analysis, in particular the reconfiguration and protection systems defined in the SE model, and (b) the various ways the failures can occur and propagate inside the system [START_REF] Machin | Modeling Functional Allocation in AltaRica to Support MBSE/MBSA Consistency[END_REF].

Consequently, MBSA uses a formal model describing both the nominal system behavior and the possible faulty behaviors, to analyse combinations of faults and their consequences in terms of feared events, which affect operational availability (when a critical error occurs, the system is not available until the error is resolved). The resulting analytical models are manually built by safety engineers from the available SE information. These models can be used to compute quantitative and/or qualitative safety indicators. Several mathematical formalisms are used to support the computations, mainly Markov chains [START_REF] Brameret | Preliminary system safety analysis with limited markov chain generation[END_REF], Petri nets [START_REF] Leveson | Safety analysis using petri nets[END_REF] or Finite State Machines (FSMs) [START_REF] Chen | A fault propagation modeling method based on a finite state machine[END_REF], each with different variants. These types of underlying formalisms are important for the qualification of computation tools.

As in MBSE, a number of modelling languages supporting MBSA were developed, such as AltaRica (AltaRica LaBRI [START_REF]Laboratoire Bordelais de Recherche en Informatique (LaBRI), AltaRica Project -MEthods and Tools for AltaRica Language[END_REF], AltaRica DataFlow [START_REF] Boiteau | The altarica data-flow language in use: modeling of production availability of a multi-state system[END_REF], AltaRica 3.0 [START_REF] Prosvirnova | The altarica 3.0 project for model-based safety assessment[END_REF]), Figaro [START_REF] Bouissou | Knowledge modelling and reliability processing: Presentation of the figaro language and associated tools[END_REF], SAML [START_REF] Lipaczewski | Using tool-supported model based safety analysis -progress and experiences in saml development[END_REF], HiP-HOPS [START_REF] Papadopoulos | Hierarchically performed hazard origin and propagation studies[END_REF], Component Fault Trees [START_REF] Kaiser | Advances in component fault trees[END_REF], Generalized Stochastic Petri Nets [START_REF] Balbo | Introduction to Generalized Stochastic Petri Nets[END_REF] and Safety Architect [START_REF]ALL4TEC, Safety Architect -Model Based Safety Assessment software[END_REF]. In our approach we use the AltaRica language, since it has has become a de-facto European industrial standard for MBSA [START_REF] Bozzano | Safety assessment of AltaRica models via symbolic model checking[END_REF]. The most mature industrial tools for MBSA based on AltaRica are Dassault's Cecilia OCAS [START_REF] Bieber | Integration of formal fault analysis in ASSERT: Case studies and lessons learnt[END_REF] and Apsys' SimfiaNeo [START_REF] Machin | Simfianeo, complex systems, yet simple safety[END_REF].

Behaviour Trees

BTs were first invented as a tool to build modular Artificial Intelligence (AI) in computer games. A known alternative to FSMs, BTs are meant to provide better modularity, scalability, extendibility, adaptability and reuse of code [START_REF] Colledanchise | The Advantages of Using Behavior Trees in Mult-Robot Systems[END_REF][START_REF] Ogren | Increasing Modularity of UAV Control Systems using Computer Game Behavior Trees[END_REF][START_REF] Colledanchise | How Behavior Trees modularize robustness and safety in hybrid systems[END_REF][START_REF] Colledanchise | How Behavior Trees Modularize Hybrid Control Systems and Generalize Sequential Behavior Compositions, the Subsumption Architecture, and Decision Trees[END_REF][START_REF] Colledanchise | Learning of Behavior Trees for Autonomous Agents[END_REF][START_REF] Klöckner | Interfacing Behavior Trees with the World Using Description Logic[END_REF][START_REF] Rovida | Extended behavior trees for quick definition of flexible robotic tasks[END_REF], and to be easier to understand for humans, thus allowing incremental functionality design and efficient testing. On the benefits of modularity, Bagnell et al. state that "individual behaviors can be reused in the context of another higher-level behavior, without needing to specify how they relate to subsequent behaviors" [START_REF] Bagnell | An integrated system for autonomous robotics manipulation[END_REF].

According to Colledanchise and Ögren, "a Behavior Tree is a way to structure the switching between different tasks (assuming that an activity can somehow be broken down into reusable sub-activities called tasks) in an autonomous agent, such as a robot or a virtual entity in a computer game" [START_REF] Colledanchise | Behavior Trees in Robotics and AI: An Introduction[END_REF]. According to García et al., a Behavior Tree is "a mathematical model of plan execution that allows composing tasks in a modular fashion through a set of nodes representing tasks and connections among them" [START_REF] García | High-level mission specification for multiple robots[END_REF].

BTs are widely used in systems control since they provide an easy way to perform conditional state switching. However, the main reason we have chosen BTs as the means to construct the ODM is that they provide an answer to the question "What is the system currently doing?", which is precisely the first question the operators ask themselves, both when the system is in nominal mode, as well as when an issue has been identified.

One of the benefits of BTs we have additionally identified is that their elements can be in the form of blackboxes and be furtherly developed when new information is available; that being during the design phase or the operations phase -in the case of telemetry data reception. In the following section we demonstrate that BTs are easy to integrate within the design process. Based on the MBSE and MBSA models, and with operational objectives, we can create a model that can then be used inside a monitoring tool, suited for diagnosis. In our modelling approach we use the classic formulation of BTs as described in [START_REF] Colledanchise | Behavior Trees in Robotics and AI: An Introduction[END_REF], where BTs can be considered as a form of directed tree, where the flow amongst its nodes and edges is sequential in a left to right, depth first manner. The ticking execution sequence is illustrated in Figure 2.

BTs represent the possible system behaviours and their changes, in contrast to decision trees, which represent a logical formula, usually for automated decision purposes. BT nodes are visited at each time step (called "tick") during execution, starting from the root node. Parent nodes specify which children nodes must be visited, and in which order. Fallback and Sequence (parent) nodes define how the behaviour evolves when one of its child behaviour succeeds or fails. Action (child) nodes contain executable information. A classical BT formulation [START_REF] Colledanchise | Behavior Trees in Robotics and AI: An Introduction[END_REF] is depicted in Figure 3. Regarding our BT implementation to construct the ODMs, we use the PyTrees (python implementation of BTs) library [START_REF] Google | PyTrees Library Documentation[END_REF][55], which is relatively easy and intuitive to code with, so any engineer/scientist can build a BT model, with no particular programming background or developer skills. In our approach, BTs consist of sequential tasks: although PyTrees' ticking mechanism is compatible with parallel execution, we do not use this feature in our modelling approach, since no need has risen so far. Parallel execution in PyTrees is possible with the use of the the "parallel" composite node, which visits all its children simultaneously at each tick [START_REF] Google | PyTrees Library Documentation -Composites[END_REF].

In terms of the trigger mechanism, we propose a time-triggered (vs event-driven [START_REF] Ghzouli | Behavior trees in action: a study of robotics applications[END_REF] pg. 199) BT execution, in a way that the BT nodes are triggered in a time-increment manner and not by the order of the modelled events' occurrence. When representing structural system information, we often use time-triggered modelling -in contrast with dynamic system information, where event-driven modelling is preferred. Therefore, when dealing with highly complex systems, we prefer to represent them with time-triggered models that can periodically check for the occurrence (or not) of the modelled events, in an effort to reduce modelling complexity.

Regarding the periodicity of BTs, BT nodes are independent concurrent processes, that may or may not follow a mutual clock, e.g. they may terminate at any time. However, the BT is only active at every tick, which means BT events (starting a new action, mostly) only take place upon a tick. Ticks should be relatively fast with respect to the system's dynamics.

BTs can be modelled to be state-full i.e. having memory of all the visited nodes' state -state information can be either in the node type or the node instance (its source code), or state-less i.e. not "remembering" the state of multiple nodes, rather than saving only the state of the lastly triggered node. Clearly this option changes the behaviour of the composite nodes, while PyTrees can support both styles. By making the state-less modelling choice, one can affect the performance of the BT: state-less BTs offer less control over the workflow, thus this control must be implemented in the Action leaf nodes.

The BT implementation presented in this paper is using the default PyTrees' setting for Sequence and Fallback nodes, which is memory-full and memory-less, respectively. More specifically, the class syntax for the Sequence and Fallback nodes is respectively the following [START_REF] Google | PyTrees Library Documentation -Composites[END_REF]: class py trees.composites.Sequence(name=Sequence, memory=True, children=None) class py trees.composites.Selector(name=Selector, memory=False, children=None)

In regard to the interruption of BT behaviours, there may be many reasons to interrupt a node, some related to the BT, some completely unrelated. Action nodes are free to implement their internal interruption management mechanism: it integrates easily in the BT paradigm. However, many libraries (including PyTrees) also include an interruption mechanism for BT-related interruptions (in Fallback nodes mostly). In PyTrees, the memory parameter of Selector nodes inhibits the interruption mechanism, e.g. with memory=True the Selector node does not try to restart "high priority" terminated children, so there are no interruptions. With memory=False, the Selector node always queries the high priority children first, so they can "restart" and interrupt a currently running low priority child.

A simple example would be a system that tries to buy an item, but if it does not have enough money, works to earn it. The version without interruption could be:

• Acquire item (Sequence) -Work until enough money -Buy item In this version, the "Work until enough money" must internally check whether there is enough money, and terminate or perform work accordingly. The version with interruption could be:

• Acquire item (Selector(memory=False)) -Try to buy (Sequence) * Has enough money (Condition) * Buy item -Work In this tree, the "Has enough money" and "Work" activities are separated. Because of "memory=False", even when the "Work" node is running, the BT still executes the "Try to buy" node. When the latter fails, it goes back to the "Work" node. When the "Try to buy" node finally succeeds, the BT automatically interrupts the "Work" node.

Existing BT libraries are built for control purposes, and rely almost exclusively on the past behaviour statuses "success", "failure" and "running" to decide to start or interrupt other behaviours. In our approach, we require that the status of each behaviour can be enriched with health indicators, such as alarms, specific to each behaviour. This enriches the ticking mechanism with an alarm gathering mechanism, that can be used for User-Interface (UI) or automated reasoning purposes. This mechanism can be flexibly implemented in the PyTrees library through the use of visitors. This feature is illustrated in the next section.

Proposal

In traditional satellite system development process, the SE, SA and Operations stages occur sequentially -each stage commences after the precedent's completion, and evolve linearly in time -no recurring loop is connecting the three stages. There is however an exception regarding the SE and SA stages, the activities of which interlock during system design. Nevertheless, SE and SA activities finish long before the system operation phase starts. Therefore, if any issue is detected at operation time (which could have been avoided by a change in design), there will be no modification in the SE or SA documents and models, since the latter would significantly augment the project cost. This modification would thus be dismissed, even if the operational impact would be beneficial in the long term.

In our proposal, SE and SA documents and models are being concurrently developed with the ODM. Hence operational aspects can be taken into account in the SE and SA activities. This would not only increase the confidence of the system design in regards to its representation of the actual system, but also to the foreseeing of possible operational issues, which can be avoided by modifying the system design, early on the system life cycle [START_REF] Vaneman | The system of systems engineering and integration "vee" model[END_REF]. This would also decrease the system development cost, while optimising system design.

SE is defined by an iterative system development process. All teams involved in the system design (SE/MBSE, RAMS/SA) are striving for continued improvement through constant dialogue and joint meetings at each iteration step -concept of concurrent design [START_REF] Finger | Concurrent design[END_REF]. Our proposal consists in incorporating the ODMs' team in the feedback loop, so as to increase the agility of the system design process. This shall imply the involvement of more stakeholders (operators / ODM architects) in the design phase.

The proposed methodology implies the constant amelioration of system design at each iteration loop, which increases the efficiency of the system design activities. The co-conception and co-design of system models means that any modifications are made early on the life cycle development process; in contrast to making changes at the end, during the V&V and testing phase. Hence an increase of efficiency is achieved, by reducing the total time and cost of the design phase. The proposal thus not only is agile, but also improves the agility of current methodologies, widely used in the aerospace industry.

Illustration of the ODM construction process

As mentioned in section 3.3, one of the benefits of BTs is that its elements can be in the form of black boxes and be furtherly developed when new information is available. This way, BT models can be easily integrated within the design process. Based on the SE and SA models, and with operational objectives, we can create a model that can then be used inside a monitoring tool, suitable to diagnosis. An illustration of our proposal is presented in Table 1, where a juxtaposition of SE and SA information and the implementation into a BT is depicted.

As shown in Table 1, information can be added in the BT models gradually, when new information concerning the system is available. In this example we tackle the case of an Earth Observation satellite that shall fulfill its primary mission, which is to take photos of the area(s) of interest on Earth and transmit them back to the OC, as we can see in the first model iteration. The information coming from preliminary SE activities, here shown in the first column, is "Satellite must perform Earth Observation". This information can be translated in a BT model-as shown in the 3rd column, where a single action node "Observe Earth" is included in the tree, under the "Mission" node-here a Fallback node.

Throughout the system design development, the FMEA team can produce new system information, as shown in the second column, as for example, "Mission may fail". This information can be integrated in the BT model with the addition of a new action node ("Mission Fail"), on the right side of the "Observe Earth" node, which represents the system's nominal mode. This would mean that, if the "Observe Earth" node ticking returns "failure", the "Mission Fail" node will be ticked. If the "Observe Earth" node returns "success" or "running", the "Mission Fail" node will not be ticked.

In the third iteration, we assume the information "A mission fail can sometimes be mitigated by putting the Satellite on Standby Mode" is available by the SE team. This information can be integrated in the BT model by adding a new action node between the "Observe Earth" and "Mission Fail" node, which represents the "Standby" mode of the system. Consequently, if the "Observe Earth" node ticking returns "failure", the "Standby" node will be ticked. If the "Standby" node also returns "failure", the "Mission Fail" node is ticked. If the "Observe Earth" node returns "failure" and the "Standby" node returns "success" or "running" the "Mission Fail" node will not be ticked. The latter would signify-in case of system monitoring, that the system is currently in Standby mode.

The SE activities might then conclude that the Earth observation activity has three phases: capture photos, save photos, send photos to Operations Centre. The "Observe Earth" action node can then be turned into a Sequence node in the BT model, and have three children, namely "Capture photos", "Save photos" and "Send photos". This would mean that if the "Capture photos" activity is successful, then the "Save photos" activity can be performed. Similarly, if the "Save photos" activity is successful, the "Send photos" activity is able to be performed. If one of the activities cannot be performed, the "Observe Earth" activity will fail, and so the BT will return "failure" as well.

Lastly, we assume that the FMEA teams communicate to the SE teams that a fault leading to instrument overheating thus causing the mission to fail can be detected by the operator, if able to monitor the instrument's health status data during the "Capture photos" phase. The SE team can then conclude that adding temperature monitoring capabilities in the picture capturing instrument can help prevent system failure, and implement it in the system design. This new design modification shall also be added in the BT; this way the BT model is up-to-date with the SE and SA system models.

Exploitation of the ODM: Diagnostic Tools

The ODM is being created in parallel with the system functional and dysfunctional models and documents. How this activity ultimately improves the system's resilience is out of the scope of this paper, since there are many more steps in between. However, we can already point out that since the ODM is created at the design stage, it is possible to analyze it, identify design flaws that may impede operations, and derive new SE and SA requirements to address these flaws.

The most direct way to use the ODM is to build a UI component out of it, that displays the behaviour statuses in a hierarchical way, including possible alarms. The hierarchical nature of the model helps operators focus on relevant behaviours to quickly pinpoint problems and launch appropriate troubleshooting procedures.

Automated diagnosis techniques based on models [START_REF] De Kleer | Fundamentals of model-based diagnosis[END_REF] or data [START_REF] Lei | Applications of machine learning to machine fault diagnosis: A review and roadmap[END_REF] can easily be integrated when they focus on particular components or functions of the system. Their output can be used to raise alarms in the associated behaviours, or alternatively the automated diagnosis tool can be considered a behaviour in itself, that raises alarms when detecting abnormal situations.

The ODM is a model that can be used to support automated reasoning techniques. A pattern of alarms in some behaviours could be automatically associated to a diagnosis, or a troubleshooting procedure. There are many ways to implement such reasoning (case-based reasoning, decision rules, constraint programming), that depend on aspects specific to the system and its environment.

Taking the example illustrated in Table 1 as a use case, we created a tool to display the status of the BT nodes called at each execution i.e. the BT nodes' response to the embedded ticking mechanism, which can be one of the three: "Success", "Failure" or "Running". Each execution is defined by an incremental time step T (t n ), where t = t 0 , ..., t n-1 , n ∈ Z, t 0 = 0. We also implemented an "Alarm" feature, so that raised alarms associated with a behaviour can also also appear in the tool interface. Table 2 shows an example interface of a diagnostic tool using the BT model of the last row and column of Table 1 as its ODM, after 3 time executions. In this case scenario, we can observe that in the first execution (T0), the status of the root node "Mission" is "Running", since the status of its first node "Observe Earth" is also "Running". As a Fallback node, the "Mission" node "inherits" the status of its first successful or running child node. After another "Running" interval, the status of the satellite mission function returns "Sucess", indicating the mission's successful completion (with or without errors in between).

The Sequence node "Observe Earth" needs all of its children nodes to succeed in order for it to take the status "Sucess"; on the contrary, if at least one of its children nodes returns "Failure", the "Observe Earth" function would equally fail. In this case, its first child node "Capture Photos", along with the temperature check of its camera sensor has successfully completed its function. Then, we can see that the following function "Save Photos" is "Running", meaning that the satellite is in the process of saving the photos taken. Thus the function "Observe Earth" is in process, hence the satellite is currently undergoing its principal mission. However, we can see that the "Save Photos" function has raised an alarm, which would indicate to the operator that there might be a problem related to the On-Board Computer (OBC), the memory e.g. over-warmed electronics, etc. In such case, the operator shall have a troubleshooting sequence related to each error or alarm raised, which they would follow in order to establish a road-map leading to the fault resolution. In the next time interval (T1), we can safely assume that the satellite is in the process of sending the photos to the OC, while in the third (T2), that the satellite has successfully completed its mission for the moment.

If the operator had access solely to the information presented in the last column (T2), which only displays the results of the "Observe Earth" function -and not the underlying process, they would not be able to "see" the alarm raised during the photos saving function. A model-based diagnostic tool which uses an ODM with a BT formalism can have several benefits over traditional diagnostic procedures, such as the one illustrated in this use case scenario. Effectively, a comparison with current monitoring methods can only be made by using a real-life model of a complex satellite system, and feedback from operators. In this paper we present only a proof-of-concept.

Conclusion

Monitoring tools for diagnosis during system operations are, to this day, still lacking important information needed for the operators to perform their supervision and diagnostic tasks efficiently. They mainly rely on knowledge acquired through previous experience as well as engineers' and operators' know-how, rather than system design elements. For this reason we propose a methodology for the concurrent construction of a model dedicated to system monitoring for diagnosis, along with the system design (construction of SE and SA models). Our methodology would not only increase the agility of the system development process, but also the confidence on the system design by creating a monitoring tool which is equally based on its design information as well as ROE. Eventually, our proposal shall be validated by real-life operators, after having tested the model's integration in a specific tool, as part of a representative case study. We plan to evaluate it through feedback from industrial partners, research labs, and space agencies.

Figure 2 :

 2 Figure 2: BTs' sequence execution.

Figure 3 :

 3 Figure 3: BTs' basic elements.

Table 1 :

 1 Illustration of the first iterations of a satellite design. At each iteration, the BT model can incorporate information coming from the system design process related activities, while remaining at each step a valid model.

	Functional textual information	Dysfunctional textual information	Behaviour Tree
			Mission
	Satellite must perform
	Earth Observation		Observe Earth
			Mission
		Mission may fail
		Observe Earth	Mission Fail
			Mission
	A mission fail can sometimes be mitigated			Mission Fail
	by putting the Satellite on Standby Mode		Standby
		Observe Earth
			Mission
				Mission Fail
			Standby
	Earth observation activity
	has 3 phases: capture photos, save photos, send		Observe Earth
	photos to OC
				Send photos
			Save photos
		Capture
		photos
		A fault leading to instrument
		overheating causing the mission
		to fail can be detected by
		operator monitoring health
		status data during "Capture
		photos" phase
				Mission
				Mission Fail
				Standby
	Add instrument temperature monitor for operator		Observe Earth
				Send photos
			Save photos
		Capture photos
		→ Temperature

Table 2 :

 2 Diagnostic tool UI example.

	Type of	Behaviour	Status	Status	Status
	Node	Name	T0	T1	T2
	Fallback	Mission	Running	Running	Success
	Sequence	Observe Earth	Running	Running	Success
	Action	Capture Photos / Check Temperature	Success	Success	Success
	Action	Save Photos	Running !Alarm!	Success	Success
	Action	Send Photos	-	Running	Success
	Action	Standby	-	-	-
	Action	Mission Fail	-	-	-

The Object Management Group ® (OMG ® ) is an international, open membership, not-for-profit technology standards consortium, founded in 1989. OMG standards are driven by vendors, end-users, academic institutions and government agencies.