Senior Member, IEEE Guang-Jin Li
email: g.li@sheffield.ac.uk

Xiao-Bin Liang

Zi-Qiang Zhu

Fellow

Javier Ojeda
email: javier.ojeda@satie.ens-cachan.fr

Mohamed Gabsi
email: mohamed.gabsi@satie.ens-cachan.fr

Keywords: acoustic noise, modular machine, permanent magnet, sound pressure level, vibration

This paper investigates the vibrations and acoustic noise behavior of some equal tooth width, unequal tooth width and modular surface mounted permanent magnet machines. The investigations are based on finite element analysis (ANSYS) and the performances such as radial force (and airgap magnetic pressure), vibration modes (shapes and resonant frequencies), radial displacement and acceleration of the stator, and sound pressure level have been calculated and compared amongst different machines. It has been found that due to the existence of flux gaps in stator alternate teeth, at the same operating condition (phase current and rotor speed), the modular machines can reduce the sound pressure level by up to 15dB compared to the equal tooth width permanent magnet machines. A similar reduction in sound pressure level can be achieved by adopting the unequal tooth width permanent magnet machine.

I. INTRODUCTION ERMANENT magnet (PM) machines have attracted increasing interest in various applications ranging from domestic appliances (air conditioning, washing machine, etc.), through renewable energy (onshore and offshore wind power) to transportation (electrical or hybrid electrical vehicles -EV or HEV, and "more electric" aircraft). In the last decades or so, many different PM machine topologies have been proposed in industry and academia. They can be roughly classified into two categories: [START_REF] Zhu | Electrical Machines and Drives for Electric, Hybrid, and Fuel Cell Vehicles[END_REF] rotor mounted PM machines such as surface mounted PM (SPM) machines, interior PM (IPM) machines including I-shaped, V-shaped or ∇-shaped IPM machines; [START_REF] Taras | Combined Multiphysics Model of Switched Flux PM Machines Under Fault Operations[END_REF] stator mounted PM machines such as flux reversal (magnets on stator tooth surface), switched flux (magnets in the middle of stator teeth) and doubly salient (magnets in stator yoke) PM machines [START_REF] Zhu | Electrical Machines and Drives for Electric, Hybrid, and Fuel Cell Vehicles[END_REF]. Other unconventional PM machines such as magnetically geared, partitioned stator, or hybrid excited PM machines can also be classified into these two categories. Although some PM machines might be more suitable for certain specific applications, for example, the SPM machines are good for wind power application whilst the IPM machines are suitable for EVs and HEVs, they all exhibit inherent advantages such as high torque/power density, high efficiency over their induction or reluctance counterparts. However, due to the existence of PM, the fault tolerant capability of PM machines could be jeopardized. For example, if a short-circuit fault occurs in the stator windings, the short-circuit current could be a few times higher than the rated current due to high PM flux linkage. This could lead to local overheating, which can destroy the stator insulation, causing disastrous consequence to the entire machine [START_REF] Taras | Combined Multiphysics Model of Switched Flux PM Machines Under Fault Operations[END_REF]. In order to improve the fault tolerant capability of PM machines, single layer windings are often preferred compared to double layer winding. This is because the former can mitigate the mutual effect between adjacent coils (or phases) so to prevent the fault, the inter-turn short-circuit fault in particular, from propagating to the healthy coils (phases). In addition to the above magnetic isolation, there will also be physical and thermal isolations between adjacent coils, leading to significantly improved fault tolerant capability. In order to further reduce the mutual coupling between stator coils (or phase windings), modular machines with segmented stator are proposed in [START_REF] Spooner | Modular design of permanent-magnet generators for wind turbines[END_REF][START_REF] Dajaku | Low costs and high-efficiency electric machines[END_REF][START_REF] Li | Comparative studies of modular and unequal tooth pm machines either with or without tooth tips[END_REF], one example of such machines is shown in Fig. 1. There are flux gaps (FG), also called flux barriers in some literature, between adjacent stator segments, which minimize the mutual inductances between any two adjacent stator coils. It has also been found that by properly selecting the FG width and slot/pole number combination, the electromagnetic performance of modular machine can be improved, such as the average torque and efficiency can be increased whilst the torque ripple is reduced [START_REF] Li | Comparative studies of modular and unequal tooth pm machines either with or without tooth tips[END_REF]. In addition, because the stator segments can be wound outside of the frame, Vibrations and Acoustic Noise Analyses of Modular SPM Machines P the winding process could be simplified, leading to potentially improved slot fill factor. However, since the stator iron core is now segmented, the mechanical integrity of the stator is destroyed. This may significantly affect the mechanical performance of the modular machines. For example, the vibration modes including shapes and resonant frequencies can be changed. Together with the changed electromagnetic performance such as radial force and airgap magnetic pressure, the vibrations and also acoustic noise of modular machines might be significantly different from their unequal tooth width (UNET) and equal tooth width (ET) counterparts. This impact of modularity (or stator segmentation) on machine vibration behaviors has not been studied before, therefore is the main novelty and contribution of this paper. Both analytical and finite element methods can be used to calculate the vibration modes, radial displacement and acoustic noise of electrical machines. The analytical approaches can be much less time consuming and accurate enough [START_REF] Fiedler | Calculation of the Acoustic Noise Spectrum of SRM Using Modal Superposition[END_REF]. However, they are largely constrained by the machine structures, and might not be able to handle complex structures. Therefore, the multi-physics approach based on finite element modelling becomes more and more popular in prediction of vibrations and acoustic noise [START_REF] Pupadubsin | Comparison of vibration and magnetic force behaviours between different switched reluctance machine topologies[END_REF][START_REF] Liang | Comparative Study of Classical and Mutually Coupled Switched Reluctance Motors Using Multiphysics Finite-Element Modeling[END_REF]. Such method combines the electromagnetic and structural analyses to provide a powerful insight into the vibrations and acoustic noise behaviors of electrical machines with complex structures, e.g. with different frame ribs for cooling [START_REF] Castano | Acoustic Noise Analysis of a High-Speed High-Power Switched Reluctance Machine: Frame Effects[END_REF]. Therefore, it will also be adopted for the vibrations and acoustic noise analyses in this paper.

II. FEATURES OF MODULAR SPM MACHINES

The cross-sections of the UNET and modular SPM machines with a 12-slot/10-pole rotor are shown in Fig. 1. Other slot/pole number combinations can be achieved by using similar stator and rotor topologies. It is worth noting that the ET machine can be obtained by simply removing the FGs in the modular machine whilst the UNET machine can be achieved by filling the FGs in modular machines using the same iron material as the stator core. In addition, to avoid the increase in saturation level, in the modular machines, the iron section widths of the teeth with and without FGs are maintained the same. This means that when the FG width is increased, the slot area needs to be reduced, leading to increase in copper loss. However, as investigated in [START_REF] Dajaku | Low costs and high-efficiency electric machines[END_REF][START_REF] Li | Comparative studies of modular and unequal tooth pm machines either with or without tooth tips[END_REF], the significant increase in average torque could compensate the increase in copper loss. To be consistent, the windings are always wound on the narrower teeth in the UNET machine, whilst on the teeth without FGs in the modular machine, as shown in Fig. 2, leading to single layer winding structure for both machines. The stator segments can be wound outside then inserted into the frame. The keys (6 for 6 stator segments) on the inner surface of the frame are used to fix these wound stator segments. This makes the winding process much simpler and hence can potentially increase the slot fill factor. However, due to manufacturing tolerance, the loose contact between the keys and stator segments is often unavoidable, leading to potential radial and circumferential displacements of the stator segments. The recent studies in [START_REF] Ren | Study of Manufacturing Tolerance of Modular Permanent Magnet Machines: Segment Radial Displacement[END_REF] have shown that the modular machines suffer only minor increase in unbalanced magnetic force due to segment displacement. However, other performances such as the phase back-EMF, on-load torque, etc. are largely unaffected. This proves that the modular machines are not only tolerant to electromagnetic faults but also to mechanical ones. Due to the presence of FGs, the main flux path within the stator magnetic circuit of the modular machine has been significantly modified compared to the ET or UNET machines, as shown in Fig. 3. This will lead to change in the airgap flux density as well as the radial magnetic force and magnetic pressure on stator segments. In addition, because the mechanical integrity of the modular stator has been destroyed, and each stator segment is largely independent of each other. These changes in electromagnetic and also mechanical performances will lead to profound change in the vibratory behavior and emitted acoustic noise, which will be investigated in-depth in the following sections.

III. COMPARATIVE STUDIES BETWEEN ET, UNET AND MODULAR SPM MACHINES

A. Radial Force and Magnetic Pressure in the Airgap

As the main source of vibrations and acoustic noise in electrical machines, the radial force (𝐹 ) on each stator tooth can be calculated based on Maxwell Stress tensor by using (1). By way of example, the stator teeth of the modular machine [see Fig. 4] have been chosen for demonstrating how the radial force has been calculated in this section.

𝐹 = 𝑅 × 𝐿 2𝜇 (𝐵 -𝐵 ) 𝑑𝜗 (1)
where 𝑅 is airgap radius, 𝐿 is the stack length, 𝜇 is the permeability of free space, 𝜏 is the span angle in the airgap, e.g. equal to one slot-pitch for teeth numbered A, B and C in Fig. 4. 𝐵 and 𝐵 are the radial and tangential components of airgap flux densities, respectively. The stator teeth have been separated into 3 groups, i.e. group 1: main phase teeth A, B and C; teeth with FGs, group 2: #1, #3 and #5; and group 3: #2, #4 and #6. For a FG width of 2mm and a phase root-mean-square (RMS) current of 5A, the radial forces exerting on each tooth of the above 3 groups have been calculated using 2D FE software (ANSYS), as shown in Fig. 5. It is apparent that in each group, the 3 radial forces will have exactly the same amplitude but with a phase shift angle of 120 degrees due to the location of teeth in space. A comparison of radial force exerting on stator teeth has also been carried out between the ET, UNET (FG=2mm) and modular (FG=2mm) SPM machines. By way of example, only the results for tooth A have been selected and shown in Fig. 6. It can be seen that the DC component of radial force is generally reduced for UNET and modular SPM machines. However, this DC force component does not really contribute to vibrations and acoustic noise if the machine is balanced (no mode 0 vibration), which depend more on the variation in radial force. The 2 nd order harmonic (dominant force component) however will contribute to vibrations and also acoustic noise and reduces in the modular machine. It is worth noting that the amplitude of stator deformation, caused by the magnetic force waves, is inversely proportional to v 4 , where v is the force harmonic order [START_REF] Valavi | An Investigation of Zeroth-Order Radial Magnetic Forces in Low-Speed Surface-Mounted Permanent Magnet Machines[END_REF]. This reduction in 2 nd order force harmonic could lead to significantly reduced vibrations and acoustic noise, depending on the rotor speed and also natural frequency of each vibration mode of the modular stator. The same phenomena can be observed for the 6 th , 8 th and 10 th harmonics. However, the 4 th and 12 th order force harmonics can be increased if the UNET or modular machines are adopted. It is therefore important to design the modular machine carefully to avoid exciting the vibration modes which have the same natural frequencies as the relevant harmonic forces. For example, the modular machine should not be used in medium speed range because the 4 th order force harmonic (higher than ET and UNET machine) could reach the natural frequency of mode 2 (dominant vibration mode of investigated machines), therefore, leading to higher vibrations and acoustic noise level than the ET and UNET machines. However, low or high speed ranges, the vibrations and acoustic noise level could be lower, as will be investigated in section III.D.

To be complete, the radial magnetic pressure (𝑝 in MPa) in the airgap has also been calculated and compared between the ET, UNET and modular SPM machines. Since the stator iron core has much higher relative permeability (>1000), the flux entering the stator teeth from the airgap is assumed to be perpendicular to the tooth surface. In this case, it is generally safe to assume that the radial magnetic pressure only depends on the radial component of the airgap flux density, and can be calculated by

𝑝 = 𝐵 2𝜇 (2)
As shown in Fig. 7, it is found that UNET and ET have similar maximum radial magnetic pressure in the airgap, but both are slightly higher than that of the modular machine. This means that the modular machine can potentially achieve lower vibrations and acoustic noise level. But again, this depends on the operation conditions such as rotor speed, phase current, etc. as will be investigated in the following sections.

B. Modal Analyses

As mentioned previously, the change in stator structure, for example, using UNET or modular stator, may have significant impact on machine vibratory behaviors. This can be directly reflected in the change in vibration modes (shapes and also resonant frequencies), and will be investigated in this section. The modal analysis of machine stators has been carried out using 3D FEM. For simplicity, the stator windings have not been considered. The properties of materials such as stator core (FeSi) and frame (stainless steel) for the simulations are given in TABLE 2. The shapes and resonant frequencies of the main vibration modes are shown in Fig. 8 andTABLE 3, respectively. It is worth mentioning that for machines such as ET and UNET, the cases without considering the frame have also been investigated. However, due to space limitation, the results have not been shown in this paper. It is found that with the frame, the stator "yoke" (real yoke + frame) becomes more robust. Therefore, the resonant frequency is increased, and the increase depends directly on the materials used for the frame and also its thickness [START_REF] Pillay | An investigation into vibration in switched reluctance motors[END_REF]. A tight friction coupling between the laminations and frame is assumed [START_REF] Pillay | An investigation into vibration in switched reluctance motors[END_REF], this can be considered in the FE model by gluing the stator yoke to the frame. For the modular machine, the frame is necessary to fix the stator segments as shown in Fig. 2. From the results shown in TABLE 3, it is found that there are two natural frequencies for each vibration mode, but their difference is very small, and can be negligible. It is also apparent that using the UNET or modular stator structure, the resonant frequency for each vibration mode tends to be reduced. This is particularly the case for the modular machines, meaning that it might be easier to reach a given vibration mode for UNET or modular machines compared to the ET machine. Similar to other types of machines, it can be difficult to excite certain vibration modes. For example, the mode 3 or 5 would imply that there was an unbalance in the electromagnetic force, resulting, for example, from eccentricity due to rotor unbalance and/or a non-uniform airgap [START_REF] Long | Effectiveness of active noise and vibration cancellation for switched reluctance machines operating under alternative control strategies[END_REF]. Other higher mode numbers, e.g. mode 4 or 6, require higher fundamental frequency (or higher rotor speed) in order to be excited. Therefore, this paper will focus mainly on the influence of mode 2, which is also the most predominant mode shape in terms of vibrations and acoustic noise.

C. Radial Displacement and Vibrations

Using modular machines as example, the radial displacement and radial acceleration for different FG widths have been calculated by using 3D FEM, as shown in Fig. 9 and Fig. 10. It is assumed that an accelerometer is put at the back of the stator pole (corresponding to the tooth of phase A in Fig. 4) to measure the radial acceleration of the stator (and frame). The peaks appear at the frequency of around 2.5 kHz in the radial displacement and acceleration are corresponding to the resonant frequency of the mode 2. These peaks will determine the level of acoustic noise as will be investigated in section III.D. It is interesting to notice that if the FG width is properly selected, for example, FG = 2mm, both the radial displacement and also acceleration can be significantly reduced, leading to a potential reduction in acoustic noise as well. This is partially due to the reduction in radial force, particularly the 2 nd order harmonic, as shown in Fig. 6, and also due to the change in stator mechanical structure. A comparison in terms of radial displacement and acceleration between the ET, UNET and modular SPM machines with a FG width of 2mm has also been carried out, as shown in Fig. 11 and Fig. 12. It is apparent that both the UNET and modular stators can be effective in reducing the radial displacement and also acceleration (or vibration) provided that an appropriate FG width is selected.

D. Sound Pressure and Sound Pressure Level

The sound pressure (SP in Pa) is also calculated using FEM by solving the following acoustic wave equation [START_REF] Liang | Comparative Study of Classical and Mutually Coupled Switched Reluctance Motors Using Multiphysics Finite-Element Modeling[END_REF]:

1 𝑐 𝜕 𝑆𝑃 𝜕 𝑡 -∇ 𝑆𝑃 = 0 ( 3
)
where 𝑐 is the sound speed in air (344m/s).

In the FE model, it is assumed that a microphone is located at a certain distance (much larger than the stator outer radius for higher accuracy), 300mm in this paper, from machine center for measuring the sound pressure and the boundary of the air is regarded as a complete absorbing boundary. This means that a relatively large air region is needed for acoustic field analyses. In this case, to reduce the computation time for considering a large range of rotor speeds (or fundamental frequencies), a 2D model is used instead of 3D models used in previous sections. Since the machines investigated in this paper are all symmetrical ones, the results from 2D model can be deemed as satisfactory.

For a given speed, e.g. 2880 RPM (240Hz), the sound pressures for the ET, UNET and modular machines with a FG = 2mm have been calculated and compared as shown in Fig. 13. It can be seem that due to the reduction in radial displacement and also vibration, both the UNET and modular machines can achieve much lower level of sound pressure compared to the ET machine. It is also found that the UNET and modular machines achieve similar level of sound pressure due to similar level of radial displacement and vibration, as shown in Fig. 11 and Fig. For different rotor speeds or fundamental frequencies, a more commonly used parameter such as sound pressure level (SPL in dB) has been used for the analysis, which can be calculated by

𝑆𝑃𝐿 = 20log 𝑆𝑃 𝑆𝑃 ( 4
)
where 𝑆𝑃 is the reference sound pressure (2×10-5 Pa). It is worth noting that the measured sound pressure in (4) will always use its RMS value.

A comparison between the ET, UNET and modular machines in terms of the total SPL for different fundamental frequencies are shown in Fig. 14 whilst different SPL harmonic components are shown in Fig. 15. It is worth mentioning that all the peaks in the SPL plot are mainly due to the excitation of the vibration mode 2. For example, at a fundamental frequency of around 1.25 kHz, the 2 nd order force harmonic will generate the 2 nd order SPL harmonic. And because it coincides with the resonant frequency of the mode 2 (≈2.5kHz), a peak SPL will appear. However, the 4 th order force harmonic will generate the 4 th order SPL harmonic, and resonates with the mode 2 at a fundamental frequency of around 0.65 kHz.

Amongst all the investigated machines, it can be observed that at relatively low fundamental frequency (rotor speed) or higher frequency, the UNET and modular machines can reduce the SPL compared to the ET machine. This is particularly effective at lower fundamental frequency, e.g. 0.24 kHz, a significant reduction of about 15 dB in SPL can be observed between ET (67dB) and modular (52dB) SPM machines. The higher SPL emitted by the UNET and modular machines at medium frequency, e.g. 0.6 kHz, is mainly due to the higher level of 4 th order SPL harmonic generated by the 4 th order radial force harmonic. Therefore, in practical machines, the UNET or modular machines should avoid operating at this frequency in order to reduce the acoustic noise level.

IV. CONCLUSION

This paper investigates the vibratory behaviors of unequal tooth width (UNET) and modular surface mounted permanent magnet (SPM) machines. A comparison with their equal tooth width (ET) counterparts in terms of radial force, magnetic pressure, vibration modes, radial displacement, vibrations and also sound pressure level (SPL) has been carried out.

It is found that due to the change in stator structure, particularly for modular machines, the resonant frequency of each vibration mode is reduced compared to the ET machine. However, due to the reduced radial force (and magnetic pressure in the airgap), the modular and UNET machines can still achieve reduced radial displacement, vibrations and also SPL. For example, at a fundamental frequency of 0.24 kHz (equivalent to a rotor speed of 3.28×10 3 rpm), the SPL of the modular machine can be reduced by 15 dB compared to that of the ET machine.

  -sections of modular and unequal teeth (UNET) stators with 12-slot/10-pole. (a) UNET, (b) modular.

Fig. 2

 2 Fig.23D view of modular stator with segments inserted into the frame. One segment is removed to highlight the keys on the inner surface of the frame.

3

 3 Flux line distributions of investigated SPM machines, where the rotor position is for the phase A1 to have its maximum flux linkage. (a) UNET, (b) Modular. ET has similar flux line distribution as the UNET one.

Fig. 4

 4 Fig. 4 Stator tooth numbers for radial force calculation.

6

 6 Comparison between ET, UNET and modular SPM machines, in terms of radial force on one tooth of phase A. The phase current is 5Arms and the rotor speed is 2880 RPM. (a) waveforms, (b) spectra.

Fig. 7

 7 Fig. 7 Comparison of radial magnetic pressure in the airgap of ET, UNET and modular SPM machines supplied with 3-phase sinewave current, with a phase RMS current of 5A. The FG width is 2mm.

Fig. 8

 8 Fig. 8 Different modes of vibrations for the ET, UNET and modular SPM machines. The FG width of 2mm is chosen as example.

Fig. 9

 9 Radial displacement of modular SPM machine supplied with 3-phase current. The fundamental current is 5Arms and the rotor speed is 2880 RPM. (a) waveforms, (b) spectra. (a) (b) Fig. 10 Acceleration of modular SPM machine supplied with 3-phase current. The fundamental current is 5Arms and the rotor speed is 2880 RPM. (a) waveforms, (b) spectra.

  Comparison between ET, UNET, and modular SPM machines, in terms of radial displacement. The fundamental current is 5Arms and the rotor speed is 2880 RPM. (a) waveforms, (b) spectra. (a) (b) Fig. 12 Comparison between ET, UNET, and modular SPM machines, in terms of acceleration. The fundamental current is 5Arms and the rotor speed is 2880 RPM. (a) waveforms, (b) spectra.

12

 12

  .

  Comparison between ET, UNET, and modular SPM machines, in terms of sound pressure at 300mm from machine centre (240mm from frame outer surface). The fundamental current is 5Arms and the rotor speed is 2880 RPM (240Hz). (a) waveforms, (b) spectra.

Fig. 14

 14 Fig.14Comparison between ET, UNET, and modular SPM machines, in terms SPL vs fundamental frequency of current at 300mm from machine center (240mm from frame outer surface). The fundamental current is 5Arms.

TABLE 1 KEY

 1 PARAMETERS OF THE MODULAR SPM MACHINE

	Slot number	12	Air-gap length (mm)	1
	Pole number	10	Rotor outer radius (mm)	27.5
	Stator outer radius (mm)	50	Magnet thickness (mm)	3
	Stator inner radius (mm)	28.5 Magnet remanence (T)	1.2
	Stator yoke height (mm)	3.7	Number of turns per phase	132
	Stack length (mm)	50	Filling factor kb	0.37
	Frame thickness (mm)	10

TABLE 2

 2

	MECHANICAL PROPERTIES OF MATERIALS
	Material type	Density (kg/m 3 )	Young's Modulus (GPa)	Poisson's ratio
	Stator -FeSi	7700	200	0.3
	Frame -Stainless steel	7870	200	0.27

TABLE 3 MODE

 3

			NUMBERS AND CORRESPONDING NATURAL
	FREQUENCIES (Hz) OF DIFFERENT SPM MACHINES
		ET	UNET	UNET	Modular	Modular
		(0mm)	(2mm)	(4mm)	(2mm)	(4mm)
	Mode 2a	2674.7	2636.1	2608.4	2544.1	2517.4
	Mode 2b	2676.8	2638.3	2609.9	2544.5	2518.4
	Mode 3a	6737.1	6562.7	6402.0	6160.3	6044.3
	Mode 3b	6737.8	6699.0	6700.7	6408.0	6429.0
	Mode 4a	10576	10515	10445	8754.2	8761.3
	Mode 4b	10587	10528	10449	8761.3	8762.2
	Mode 5a	12529	12674	12695	9209.3	9264.6
	Mode 5b	12532	12703	12721	9222.1	9271.9

*: 0mm, 2mm and 4mm in the table is for FG width.


Nikolena Christofi
email: nikolena.christofi@laas.fr

Xavier Pucel
email: xavier.pucel@onera.fr

Claude Baron
email: claude.baron@laas.fr

Marc Pantel
email: marc.pantel@toulouse-inp.fr

David Canu

Jerome Golenzer

Christophe Ducamp

Introducing Operational Diagnosis Models for Ground Station Architectures using Behaviour Trees

Keywords: fault trees, behaviour trees, operational diagnosis, model-based systems engineering, model-based safety analysis, ground systems engineering Acronyms/Abbreviations Behaviour Tree (BT), Fault Detection and Diagnosis (FDD), Fault Detection, Isolation and Recovery (FDIR), Feared Event (FE), Finite

Although the use of models for the design of complex systems is nowadays prevalent, that is often not the case for their operations and maintenance. Complex systems are characterised by high criticality levels as regards to time and safety constraints. The lack of appropriate models for the monitoring of these systems, or the large volume and complexity of the existing ones e.g. system simulators, impose the need for the means and tools provision to the operators, to help them with their diagnostic tasks. The use of formal models for system monitoring and diagnostics can greatly augment the operators' comprehension of the system. To that end, we propose a methodology to create a new type of Operations-Dedicated Model from already existing system design models (functional and dysfunctional), using the Behaviour Trees formalism. With the assumption that Safety Analysis models describe dysfunctional aspects of the systemnotably via Fault Tree Analyses, we us Fault Trees as a direct input for the ODM construction. We demonstrate our proposed approach with an Earth Observation Satellite Ground Station example, and discuss how ODMs can improve systems' operations.

Introduction

Spacecraft operations are complex processes, requiring different levels of expertise by the operators in charge of the system monitoring, in combination with advanced embedded Fault Detection, Isolation and Recovery (FDIR) modules [START_REF] Ferrell | Lessons Learned on Implementing Fault Detection, Isolation, and Recovery (FDIR) in a Ground Launch Environment[END_REF]. Major key operational elements include availability, autonomy, robustness and trustworthiness [START_REF] Katoen | Towards Trustworthy Aerospace Systems: An Experience Report[END_REF][START_REF] Henry | Fault Detection and Diagnosis for Aeronautic and Aerospace Missions[END_REF][START_REF] Katoen | Trustworthy aerospace systems[END_REF]. A fault impeding access to satellite data can cause a major loss of timehence money, and a risk for the satellite itself. Consequently, the improvement of FDIR techniques on-board the satellite (satellite autonomy), and on the ground (diagnosis by operators) has been a constant challenge, since the beginning of the space age.

Operators' troubleshooting tasks vary depending on the health status of the system at each given moment, as indicated by the registered data. Per contra, if a symptomor a combination of symptoms, is unknown, i.e. system designers did not model the symptom or foresee the specific failure occurrence, operators are expected to perform troubleshooting, in order to eliminate the error, and restore functions to their nominal state (or the least degraded possible state). Troubleshooting consists of the tasks of requesting for the system for additional information or/and performing manual tests/manual investigation, etc. The operators' priority is to avoid losing the services the system is expected to provide. Thus, unless the anomaly has an associated troubleshooting procedure e.g. in a symptoms' database, the operators must take individual action i.e. carrying out a dedicated analysis and updating the system's knowledge database.

These actions are usually based on the operators' knowledge and experience. If this knowledge were to be supported by organized documentation of the system itself (architectural and behavioural, as well as functional and dysfunctional), operational diagnosis could be improved significantly. For this reason, we envisaged the creation of an Operations-Dedicated Model (ODM) to address Operations and Maintenance system tasks, in particular Fault Detection and Diagnosis (FDD).

As shown in Figure 1, system architecture and behaviour description modelscreated through Model-Based Systems Engineering (MBSE) activities, along with system dysfunctional behaviour modelsproduced during Model-Based Safety Analysis (MBSA) activities, are built in the beginning of the system lifecycle, during the system design phase. MBSE and MBSA models are used beyond the system design, particularly in the development and verification phasesin particular for traceability reasons. The first serves in meeting the requirements, and the latter in respecting safety objectives while complying with international standards and regulations, which are defined during the system design phasemostly the case for the aeronautics domain, not applicable in the aerospace sector (except for satellite end-of-life management). As illustrated in the schema, the activities related to system design (prior to system launch), as much as operations and maintenance (post-system deployment), are, although related and interdependent, disconnected and detached.

The ODM shall help the operators perform their diagnostics tasks more efficiently by reducing their response time to failure, but also facilitate access to documentation and dedicated procedures so as to optimise their troubleshooting actions. Hence, the ODM shall have the capability not only to provide the current system overview, but also to be exploited by a diagnosis tool. This way it shall provide possible fault candidates, in the case of a raised alarm, or erroneous received data.

Hence, the operators shall be able to exploit this new type of model, dedicated to system monitoring, during operations. One way to exploit the ODM is to drive a diagnosis tool, with which the operators could interact, through a dedicated Graphical User Interface (GUI). Moreover, the ODM can be built during the design phase and along the production of other design models and documents, in a co-design manner i.e. through a digital continuity between design, operational safety and ODM construction. Since our main research interest is aerospace, we illustrate the proposed approach with a space system use case; however, it can be extended to other domains, such as airplanes, drones, etc.

Methodological proposal for building ODMs

The ODM methodological approach consists in defining a model that describes the system's operational procedures, with particular emphasis on fault diagnosis activities. In this section we provide a step-by-step description of the proposed methodology. Moreover, we use an extension of the Behaviour Tree (BT) language, which we created for the needs of the method, with the aim to provide the language with the tools necessary to express ODMs using Fault Trees (FTs) as input artifacts, as well as to enrich the expressivity of its semanticsespecially as regards to fault detection, avoidance and mitigation. As illustrated in Figure 2, ODMs serve a double purpose. On the one hand, since they are concurrently created with the Systems Engineering (SE) & Safety Assessment (SA)/Reliability, Availability and Safety (RAMS) models, they can provide feedback to the designers, specific to the system's health monitoring and FDIR aspects. This allows the improvement of the system's structural and behavioural design. The left side of Figure 2 portrays these interactions, between system architects, safety experts and the ODM design team. The latter interacts with the operators as illustrated on the schema's right side.

On the other hand, following system deployment, the ODM can be used for system supervision and diagnosis. BTs are executable; hence, the ODM can facilitate the design of test scenarios, distribute diagnosis objectives across the various activities, and ensure that operators are given realistic tasks. This process is also illustrated at the right side of Figure 2. Note that the scope of this study solely tackles the ODM creation phase.

By not requiring particularly sophisticated skills prior to the initial trainingother than system modelling and knowledge of operations, we can ensure that the monitoring model is easy to maintain throughout the years. In the following section we illustrate our proposed methodology through its application in a use case scenario.

As mentioned above, our methodology uses FTs as input. A FT addresses a single Feared Event (FE), and investigates its possible causes. The root of the tree is the FE itself. Each tree node is an event that contributes to its parent event. At the bottom are basic events, that are combined through either AND-events (occur when all their children have occurred) or OR-events (occur when any one of their children have occurred). FTs are produced during SA activities.

The output of our methodology is a BT that describes the diagnosis activities that take place in the system. It aims at covering all diagnosis activities, both automated and manual, both on-board and on-ground. The question of allocating each diagnosis activity to an FDIR module or to an operator should be addressed in an ulterior step, and will be tackled in future work.

A BT is a tree that represents a concurrent process. Each node of the BT represents a process, and the tree root is the global process represented by the BT. At each time instant, an active BT node can be in three states: RUNNING, SUCCESS or FAILED. The leaf nodes of a BT represent the elementary activities that take place in the process. The BT combines these activities using composite nodes to create more elaborate processes. Several composite node types exist, as listed below. For a complete description of BT nodes and their semantics, we refer to [START_REF] Christofi | A Novel Methodology to Construct Digital Twin Models for Spacecraft Operations Using Fault and Behaviour Trees[END_REF][START_REF] Christofi | From Safety Assessment Models to Operational Diagnosis Models. 33rd International Workshop on Principle of Diagnosis -DX 2022[END_REF].

 The Fallback node provides mechanisms to recover from failures of its children;  The Sequence node waits for its childrens' success to call the next child;  The Parallel node launches all its children in parallel. There are two important types of Parallel nodes: the ParallelAll succeeds if and only if all its children have succeeded; the ParallelAny node succeeds as soon as one child has succeeded, and it interrupts the other children in this case. Our methodology consists of a two-step transformation process, from a FT into a BT:

1. The first step is automated, and derives the diagnosis objectives from the FT. Each fault event of the FT is transformed into a diagnosis objective. Diagnosis objectives are organized in a BT with the same structure as the original FT. The interest of this step is to take into account all the fault events that were considered during the FT analysis by the system safety analysts. 2. The second step is manual, and consists in eliciting the diagnosis objectives into a BT that represents the diagnosis process. In this step, the ODM designers use information from SE models, but in a manner that is specific to the system and the objectives, which makes this step impossible to automate. In particular, the aim of this transformation is to account for fault tolerance and robust control mechanisms, fault mitigation activities, the fact that some activities occur in a predetermined sequence or the fact that some faults may have different observable effects depending on the system configuration. One important aspect of our methodology is that every transformation is documented and justified. This guarantees that every fault event considered in the FT is either directly accounted for in the BT, or handled by one or several precisely identified behaviours. Regarding the expertise required for the building of the BT monitoring models, we propose that a dedicated team with operations background shall build the ODMs rather than the system architects or the safety analysts, so as to allow a distinct point of view. That would also ensure that the models would contain the necessary information for supervision and diagnosis only. Moreover, the construction of BTs with the PyTrees library is relatively easy and intuitive to code with. We hence believe that most system-modelling engineers with no specific coding background, provided with sufficient training, guidance and documentation, could create ODMs.

Case Study Illustration

In this section we illustrate our methodological approach proposal with the help of a satellite Ground Station (GS) use case. This Satellite Telemetry Image (TMI) receiving station includes the computing and control part of the GS.

Using the received plan information, the station's tasks include the following:

 acquisition/tracking phase initialisation;  satellite tracking and data acquisition launching;  metrics and log files generation, which reflect the TMI acquisition status;  GS Antenna physical piloting, before and after the acquisition phase.

The GS comprises of its own Scheduler and Antenna, in order to manage all the programmed passes, and to communicate with the Satellite in order to receive the TMI. The information regarding the possible faults that can occur within the GS system was provided through a faults' propagation mind map from GS operators, which we reduced and modified for the needs of this illustration study. The FE of this faults' map is the loss of the Satellite Telemetry (TM) data.

In essence, the loss of TM data can be related to four main causes: 1. Data reception failure; 2. Image files processing failure; 3. Site power distribution failure; 4. Wrong activation of the emergency shutdown feature. Each main failure of the GS can be traced back to one or several failure modes, through fault propagation sequences. Note that, although the notion of hierarchy between the faults' occurrence does exist, the analysis does not take into account the order in which each fault occurs and how that could impact differently the system as a whole. This means that the hierarchical relation is not the same as the classical FT parent/child relation. In an FT, a child "contributes to" its parent, and occurs before. Here, it is more that a child "is a more specific diagnosis" than its parent.

The reason is that this analysis is based on feedback from the operators, describing the faults often encountered while operating the GS, and not on formal safety analysis calculations. Moreover, the analysis does not take into account combinatory faults' induced failures. This insinuates that the occurrence of a sole fault leads to another fault, but never a combination of two or more faults at the same time (simultaneously or with time difference). This will reflect in the respective FT and BT.

We focus our study on the data receiving part of the GS, which includes the following three main subsystems:  Base-band subsystem,  Radio-Frequency (RF) subsystem,  Antenna subsystem. We used the information regarding the GS' functional and dysfunctional architecture provided by operators to build a SysML Activity Diagram. This diagram illustrates the GS' sequence of functions, from the moment the station receives the pass planning forecast for the day, until it successfully transmits the TMI it received from the passing Satellite. This process is divided into several operational phases, hence defining its overall Concept of Operations (ConOPS). The activity diagram depicting the functional scenario tackled in our case study is shown in Figure 3. Then, the FT of our case study targets the FE of losing the Satellite TMI data due to a malfunction of the Antenna pointing subsystem. For the needs of the study we make the assumption that the Antenna subsystem is isolated from the rest of the GS system. During a pass, there are a limited number of ways to mitigate faults due to the strict time constraints. To mitigate faults in the memory storage system, a redundant storage is present. Other failures, in the tracking of RF functions, lead to the loss of the pass data because there is no way to recover from the fault fast enough. Therefore, failures on the RF link and the tracking function cause the loss of the pass data. However, in order to mitigate this risk, equipment Verification & Validation (V&V) procedures are performed before the pass, to ensure the system is capable of receiving the Satellite TMI data. The FT that describes the possible causes for the loss of the Satellite TMI data is depicted in Figure 4, and described below. The loss of pass data is the FE of the FT. It is an OR node, meaning that the occurrence of any of its children causes its occurrence. Its children include the tracking function failures, RF failures, and memory failures. In particular, the pre-existing tracking failure, pre-existing RF link degradation, and memory failures, are AND nodes. This means that all of their children must happen for them to happen as well. The other nodes are basic events, and happen randomly with different probabilities. For example, the probability of a sudden tracking failure occurring during a pass is very low, while the probability of a failure having happened in the past may be higher. However, the probability of this preexisting failure being undetected by V&V activities is also very low. Systems Engineering and Safety Assessment address the various activities that take place during system design, but without particular focus on operational diagnosis. Consequently, faults that are difficult to handle are often "left for the operator" to handle, and the workload and complexity of operations is often taken into account late in the design, if at all. This leads to the development of systems that are difficult to operate especially when they age and become subject to faults.

The choice of BTs to represent operations is debatable, as any Discrete Event System (DES) formalism would suffice. However, their history shows that the people who initially created and later on promoted them were system operators and users, in the video game industry and in the robotics domain. This distinguishes them from the rest of the DES models designed by academics, which are often more suited for modelling and analysis purposes. Still, BTs were initially intended for system control, while our approach uses them for system monitoring. This led us to define new standard node semantics, such as the ParallelAny node, of the Fault avoidance nodes, to express diagnosis objectives.

Conclusions

In this paper we addressed the problem of taking operational diagnosis into account at design stage. We proposed a design methodology that results in the production of an Operations-Dedicated Model (ODM). This methodology benefits from the completeness of Fault Tree (FT) analyses and accounts for a large set of faults. It allows experts with operational experience to take part in the system design and take advantage of their point of view. It produces a model of operations in which every fault event of the FT is associated to an operation that is in charge of handling it. It offers a way to detect early during design if the system is difficult to operate, because the functional objectives or because of the diagnosis objectives.

Figure 1 :

 1 Figure 1 : ODM Approach Overview: created during design, and exploited in operations.

  17 th International Conference on Space Operations, Dubai, United Arab Emirates, 6 -10 March 2023. Please input the preferred copyright option as mentioned in the attached "SpaceOps-2023 Copyright Policy for Manuscripts and Presentations" e.g. "Copyright ©2023 by the Mohammed Bin Rashid Space Centre (MBRSC) on behalf of SpaceOps. All rights reserved." SpaceOps-2023, ID # 442 Page 3 of 8

Figure 2 :

 2 Figure 2 : Overview of the proposed methodology for the construction and exploitation of an ODM

Figure 3 :

 3 Figure 3 : SysML Activity Diagram representing the operational scenario (sequence of operational activities) of an image telemetry data receiving Ground Station within one satellite passage (single satellite pass cycle). We tackle this operational scenario in our case study.

Figure 4 :

 4 Figure 4 : Fault Tree for the Ground Station use case regarding the loss of Satellite TMI data.

  Please input the preferred copyright option as mentioned in the attached "SpaceOps-2023 Copyright Policy for Manuscripts and Presentations" e.g. "Copyright ©2023 by the Mohammed Bin Rashid Space Centre (MBRSC) on behalf of SpaceOps. All rights reserved."Finally, classic diagnosis approaches fail to take into consideration the actual benefit to the operators. Some exhaustive diagnosis approaches can return thousands of diagnosis candidates, and are rarely useful to operators in realistic timecritical systems.

	SpaceOps-2023, ID # 442	Page 8 of 8

th International Conference on Space Operations, Dubai, United Arab Emirates, 6 -10 March 2023.

Acknowledgements

The authors would like to thank all individuals, companies and research institutes involved in the S2C project of IRT Saint Exupéry and in particular, Airbus Defence and Space (ADS) for proposing and funding this research topic. The results presented in this paper are part of the work of an interdisciplinary PhD undertaken by N. Christofi, supported by the French National Research Agency (ANR). Special thanks to Paul Albessard (ADS), for his contribution on the topic of Ground Segment Operations.

State Machine (FSM

The first version of the BT, automatically derived from the FT is depicted below. Each node of the FT, representing a fault event, is transformed into an equivalent operational objective. For example, the node "Noise on RF link" is transformed into the behaviour "Avoid noise on RF link". OR-nodes, namely the FE "Loss of pass data", are transformed into ParallelAll nodes, since, to avoid an OR-event, it is necessary to avoid all its possible causes. Conversely, AND nodes are transformed into ParallelAny nodes, since to avoid an AND event, it is sufficient to avoid at least one of its possible causes. This transformation applies the De Morgan law in a straightforward recursive manner. BT-v1 is represented in Figure 5.

The second version of the BT is obtained by manually eliciting the diagnosis objectives in the first version of the BT. For example, noise on the RF link is due to environmental perturbations, such as the weather, or poor equipment quality. However, there is nothing that the operators can do to avoid having excessive noise on the RF link. Thus, this objective is derived into a single operational activity "Operate RF", although it can also be derived into a robustness requirement for the RF function, which is out of scope for this paper. BT-v2 is represented in Figure 6.

The same consideration applies to each atomic behaviour of BT-v1. This is due to the fact that for readability purposes, we stopped the FT analysis at a depth that is appropriate for building our ODM. In practice, FTs are usually much deeper than required for building a BT. For example in a real FT analysis, the "Noise on RF Link" may be a fault event with hundreds of basic events underneath, that transforms into hundreds of diagnosis objectives in the first BT. However, from an operational point of view, all these fault events are undistinguishable, because their associated diagnosis objectives in the first BT are all derived into the same operational activities. Thus, the ODM designer can address the whole subtree at once by deriving the "Avoid RF Noise" objective directly.

The converse is also true: some events in the FT transform into complex diagnosis objectives that only an elaborate operational procedure can meet. This is the case for the events "Avoid pre-existing tracking failure", "Avoid preexisting RF failure" and "Avoid memory failure". Let us focus on the first objective: "Avoid pre-existing tracking failure". It is composed of two sub-objectives "Avoid degradation of tracking component", and "Avoid V&V failure of tracking function", that are respectively derived into the operational activities "Track satellite" and "V&V tracking components", as indicated in the previous paragraph. While these two activities contribute to the same diagnosis objective "Avoid pre-existing tracking failure", they do not take place at the same time in the operations: the former takes place during the pass, while the latter occurs during the preparation for the pass. The existence of these two phases requires the use of a Sequence node as the root of the second BT, with the two children "Prepare GS for reception" and "Perform reception", each being the parent of its respective behaviour.

The same reasoning applies to the "Avoid pre-existing RF failure" that is also mitigated by a prior V&V of the RF link components. Consequently, the corresponding two activities "V&V RF components" and "Operate RF link" are children of respectively "Prepare GS for reception" and "Perform reception". On the contrary, the "Avoid memory failure" involves a "hot" redundancy mechanism that can be activated during the pass. Thus, it is implemented in a more local manner as a Fallback node: use the main memory in first intent, and fall back to using the backup memory if this fails. The second BT is our ODM, as it describes the operations for operating the Ground Station, but our methodology offers several advantages. First, by starting from an FT Analysis, a very large set of faults is accounted for. In particular, most diagnosis approaches and tools do not take into account their own failure, but FT analyses systematically consider the case of false negatives in fault detection devices (and false positives as well). Second, the size of the BT is a good indicator of the complexity of the operational procedures. When the FT contains millions of events, and is too large for human manipulation (which is the norm in the industry), the first BT contains millions of diagnosis objectives. If we have some operational procedures that address high-level objectives, the second BT stays small and provides a succinct operational procedure. If not, the size of the second BT becomes unmanageable, which suggest that the system will be difficult to operate, and should be revised. Finally, our transformation helps tracing each fault in the FT to an activity that has the responsibility of handling it. In our example, this is illustrated in Table 1 below. Fault events that are handled by complex activity patterns are associated to the first node that is the parent of all associated activities. This is particularly useful to verify that the detection and mitigation means associated to low-level diagnosis objectives are correctly coordinated to achieve the high-level diagnosis objectives.

Discussion

To our knowledge, this topic has received little attention in the literature. Diagnosis is often treated from the automation point of view, which carries several limitations. First, the diagnosis objectives must be defined at input, which is often quite difficult. Second, failures of the diagnosis functions themselves are rarely taken into account.

Fault event Handling operation