Pauline Ribot

Elodie Chanthery

Quentin Gaudel

Senior Member, IEEE Matthew J Daigle

Hybrid Particle Petri Net Based Prognosis of a Planetary Rover

Keywords: prognosis, hybrid systems, diagnosis, modelbased monitoring, health management, uncertainty

This paper describes a model-based prognosis method for the health management of a planetary rover. Using a hybrid model of the rover, including a continuous part and a discrete part, a prognoser is generated that relies on the Hybrid Particle Petri Nets (HPPN) data structure. The prognosis process uses the current diagnosis of the system to predict its future states and to determine its End Of Life (EOL) or its Remaining Useful Life (RUL). The HPPN-based prognoser is initialized with a Stochastic Scaling Algorithm (SSA) that selects the diagnosis hypotheses with the highest beliefs. The SSA provides a compromise between performance and available computational resources through the setting of scaling parameters. The prognoser then uses the future commands to determine the hypotheses over the rover future trajectory and the RUL/EOL. The set of the future hypotheses associated with their belief degrees forms the current rover prognosis. The prognosis method is tested on different scenarios, with different scaling parameters, considering the future commands are known or not. Experimental results show that the approach is robust to real system data and computational performance constraints.

I. INTRODUCTION

Real systems, such as planetary rovers, have become so complex that it is often impossible for humans to capture and explain their behaviors, especially when they are exposed to failures. Prognostics and System Health Management (PHM) including an efficient health monitoring technique has to be adopted to detect, isolate and predict faults leading to failures. A diagnosis method is used to determine the current state from observations and identify the possible causes of failures that lead to this state. Prognosis is the prediction of the future states and the times of the fault occurrences that lead to these states. It is related to the determination of the End Of Life (EOL) of the system, that is the time at which the system is not operational anymore and of the Remaining Useful Life (RUL), that is the remaining period before it reaches the EOL [START_REF] Engel | Prognostics, the real issues involved with predicting life remaining[END_REF].

A system is considered as a hybrid system if it exhibits both discrete and continuous dynamics [START_REF] Henzinger | The theory of hybrid automata[END_REF]. Hybrid systems are convenient to describe systems that have multiple operating modes. Modes of such multimode systems represent their continuous evolutions (continuous dynamics) under different conditions [START_REF] Bayoudh | Hybrid systems diagnosis by coupling continuous and discrete event techniques[END_REF]. A discrete-event system (DES) defines the P. Ribot and E. Chanthery are with LAAS-CNRS, Université de Toulouse, CNRS, INSA, UPS, Toulouse F-31400, France (e-mail: pauline.ribot; elodie.chanthery@laas.fr).

Q. Gaudel is with EasyMile, 8 Rue des Trente Six Ponts, 31400 Toulouse, France (email: quentin.gaudel@easymile.com). M.J. Daigle is with NIO, 3200 N 1st St, San Jose, CA 95134, USA (e-mail: matthew.daigle@nio.io). changes of modes (discrete dynamics) with occurrences of events. The system discrete state is the current discrete state of the DES. The evolution of the system continuous state depends on continuous dynamics associated with the current system mode. Here, we are interested in modeling changes in system dynamics when one or several anticipated faults occur. As long as the system does not encounter any fault, it is in nominal mode. Tracked faults are assumed to be permanent, i.e. once a fault happens, the system moves from a nominal mode to a degraded mode (or faulty mode), in which the system realizes its mission either partially or under special conditions. Without repair, the system ends in a failure mode, in which it cannot realize its mission anymore.

Finally and for the sake of generality, we consider that a system can work with discrete and continuous variables (state variables, parameters, inputs and outputs), and that these variables are subject to uncertainty, particularly for real system studies. In such cases, the gap between models and reality must be taken into account, as for the discrete part (symbolic uncertainty) as the continuous part (numerical uncertainty) of the system. Symbolic uncertainty relates to inexact or improbable event sequences in the DES and to missing or false event observations. Numerical uncertainty relates to imprecise continuous dynamics and to noisy numerical data.

Our previous works introduced a data structure called Hybrid Particle Petri Nets (HPPN) that aims at capturing all the system knowledge. It is inspired by Petri nets and state representations used in particle filters. In particular, the HPPN marking contains all the necessary knowledge on the system to determine its diagnosis and prognosis. In [START_REF] Gaudel | Health Monitoring of Hybrid Systems Using Hybrid Particle Petri Nets[END_REF], we proposed to use HPPN to generate a diagnoser from a multimode description of a hybrid system. The diagnoser tracks the system current state under uncertainty. Its structure is a HPPN and its process is based on particle filters. System observations (inputs and outputs) are used to update the diagnoser marking and determine the diagnosis. A diagnosis at any time contains the hypotheses over its past trajectories. Each hypothesis is valued with a belief degree and includes estimates of the system discrete and continuous states, as well as the set of faults that occurred on the system until the current time. In [START_REF]Hybrid Particle Petri Nets for Systems Health Monitoring under Uncertainty[END_REF], we tested the diagnosis approach on a simulated three-tank system.

In this paper, we enrich the health monitoring approach with a prognoser, that aims at computing the prognosis of the system under uncertainty, based on the current diagnosis and future inputs. The prognoser structure is a HPPN generated from a multimode description of the hybrid system.

This paper has four main technical contributions:

1) We defined a prognosis methodology that meets the following criteria. (i) It manages hybrid systems that exhibit both discrete and continuous dynamics. (ii) It manages uncertainty related to inexact or improbable event sequences, to missing or false event observation, to continuous dynamics (imprecise dynamics and noisy numerical data), to current state and to future inputs. (iii) It takes into account an estimation of the current health state of the system given by a diagnosis process. 2) We implemented the methodology and quantitatively computed a RUL for a real system. This implementation faces the challenge of computational performances by proposing an original algorithm named the Stochastic Scaling Algorithm (SSA) that balances precision and computation time. All the codes were written in Python and are available upon request. 3) We experimented the methodology on the K11 planetary rover prototype of the NASA Ames Research Center. The K11 hybrid model proposed in [START_REF] Gaudel | Health Monitoring of a Planetary Rover Using Hybrid Particle Petri Nets[END_REF] is used to generate the HPPN-based prognoser. The model and the two scenarios data are available on the web 1 . 4) We proved that the methodology is relevant for real system data and constraints by evaluating the performance of the method with three metrics: diagnosis and prognosis computation times, and the maximum RAM used are studied for each scenario. Different scenarios with different types of future inputs are tested. This paper is organized as follows. Section II gives some related work on diagnosis, extended diagnosis and prognosis for hybrid systems. Section III presents the hybrid model of the K11 health evolution. Section IV explains the prognosis method including the use of the SSA, an algorithm that is used to initialize the prognoser given the current system diagnosis and three scaling parameters. Section V provides results obtained by testing the proposed method on the K11 on two scenarios studied in [START_REF] Sweet | Demonstration of Prognostics-Enabled Decision Making Algorithms on a Hardware Mobile Robot Test Platform[END_REF]. Conclusions and future works are discussed in the final section.

II. RELATED WORK

Hybrid systems are the center of interest of numerous researches in many areas, such as modeling, verification, control, and monitoring. In system modeling, different formalisms have been introduced to represent hybrid dynamics: hybrid automata (HA) [START_REF] Bayoudh | Hybrid systems diagnosis by coupling continuous and discrete event techniques[END_REF], hybrid bond graphs (HBG) [START_REF] Narasimhan | Model-Based Diagnosis of Hybrid Systems[END_REF], [START_REF] Daigle | An event-based approach to integrated parametric and discrete fault diagnosis in hybrid systems[END_REF], hybrid Petri nets (HPN) [START_REF] Du | Dynamic system reliability modeling using extended hybrid Petri nets[END_REF], etc. Such formalisms have largely been used or extended for hybrid system diagnosis. Structural approaches [START_REF] Cocquempot | Fault detection and isolation for hybrid systems using structured parity residuals[END_REF]- [START_REF] Daigle | A Structural Model Decomposition Framework for Hybrid Systems Diagnosis[END_REF] or conflict-based approaches [START_REF] Narasimhan | HyDE -a general framework for stochastic and hybrid modelbased diagnosis[END_REF] have also been used for diagnosis purpose.

Figure 1 presents some references to these works and compare the performances of the other approaches cited in this Section. Some works particularly focus on diagnosis with the intent to use it for prognosis purposes, and then generally consider degradation monitoring. This is what we call "Extended Diagnosis" in Figure 1. In [START_REF] Yu | Prognosis of Hybrid Systems With Multiple Incipient Faults: Augmented Global Analytical Redundancy Relations Approach[END_REF], isolation of faults is dynamically proceeded with a hybrid bond graph (HBG). A mode 1 https://homepages.laas.fr/echanthe/K11. dependent fault signature matrix is proposed and a waiting time is used to allow all faults to exhibit their symptoms on residuals, especially faults that are only detected with continuous signals. In [START_REF] Vianna | Interactive Multiple-Model Application for Hydraulic Servovalve Health Monitoring[END_REF], the diagnosis technique monitors both the system behavior and its degradation in order to have a better estimate as a start for the prognosis process via the Interactive Multiple-Model (IMM) algorithm, but the approach is limited to continuous systems. We aim at extending the diagnosis and the prognosis processes to hybrid systems. With the same purpose, we propose in [START_REF] Gaudel | Health Monitoring of Hybrid Systems Using Hybrid Particle Petri Nets[END_REF] to use HPPN to monitor the hybrid system degradation in addition to its behavior, considering many sources of uncertainty. However, this previous work only deals with extended diagnosis and do not address the prognosis problem.

In [START_REF] Chanthery | An Integrated Framework for Diagnosis and Prognosis of Hybrid Systems[END_REF], hybrid automata are used to model the system and to generate a prognoser that determines the system RUL. The method is demonstrated on a simulated study case in [START_REF] Zabi | Health Monitoring and Prognosis of Hybrid Systems[END_REF]. Even if both the behavior and the degradation are monitored, only the degradation knowledge is used for the prognosis process, making the approach limited. The approach does not take into account uncertainties. In [START_REF] Yu | Model-Based Prognosis for Hybrid Systems With Mode-Dependent Degradation Behaviors[END_REF], the authors propose to develop a model-based sequential failure prognosis for hybrid systems where some faults are detectable only after a waiting time. Dynamic fault isolation is performed with Hybrid Bond graph. The degradation behavior of each component is mode dependent and estimated by a hybrid differential evolution algorithm. The RUL of the component is computed by the estimation of the degradation and a threshold given by the user. A sequential prognosis algorithm, including a standard prognosis module and auxiliary module, is proposed. These works do not take into account uncertainty about observations and models. In [START_REF] Ribot | Generic characterization of diagnosis and prognosis for complex heterogeneous systems[END_REF], a generic characterization of the diagnosis and prognosis processes is proposed. The approach does not take into account uncertainties and does not provide any quantitative value for the RUL. In [START_REF] Daigle | Model-based Prognostics of Hybrid Systems[END_REF], the authors extend the model-based prognostics paradigm to hybrid systems. It relies on previously established methods for hybrid state estimation, and provides an approach to predict the RUL/EOL given a hybrid model, a hybrid state estimate, and a specification of future unknown input. It describes how the resulting probability distribution for the RUL/EOL may be multi-modal due to mode-switching in the predicted future behavior. Petri nets-based approaches often deal with the prediction of event occurrences from a predictability perspective, i.e. the system monitoring indicates either a fault can still occur, or not. The authors of [START_REF] Basile | Fault diagnosis and prognosis in Petri Nets by using a single generalized marking estimation[END_REF] use a generalized marking to consider unobservable event occurrences while minimizing the state space explosion, whilst the problem is approached with Partially Observed Petri Nets (POPN) in [START_REF] Lefebvre | Fault Diagnosis and Prognosis With Partially Observed Petri Nets[END_REF]. These works do not however provide any quantitative information about the RUL estimates.

This paper aims at providing a quantitative information about the RUL estimation. Prognosis process will be proceed in a highly uncertain framework, taking into account among others uncertainty on the health state of the system, on the observations and on the future actions. The health state of the system will be estimated by the diagnosis process and used by the prognosis process for the initialization step. By comparison with [START_REF] Daigle | Model-based Prognostics of Hybrid Systems[END_REF], we use a graphical formalism that looks like a Petri Net in order to be more compact and expressive. The HPPN data structure also aims at differentiating the continuous part and the discrete one from the degradation part of the system.

III. K11 MODEL FOR PROGNOSTICS

The K11 is a four-wheeled electric rover that is used by NASA Ames Research Center for diagnostics and prognosticsenabled decision making research [START_REF] Sweet | Demonstration of Prognostics-Enabled Decision Making Algorithms on a Hardware Mobile Robot Test Platform[END_REF], [START_REF] Balaban | Development of a Mobile Robot Test Platform and Methods for Validation of Prognostics-Enabled Decision Making Algorithms[END_REF], [START_REF] Daigle | Advanced methods for determining prediction uncertainty in model-based prognostics with application to planetary rovers[END_REF]. It is a test bed on which some fault and failures can be simulated. In this work, it is studied as an operating rover exposed to failures and executing missions. Its inputs are the wheel speed commands and its outputs are sensor measurements. This section presents the K11 hybrid model proposed in [START_REF] Gaudel | Health Monitoring of a Planetary Rover Using Hybrid Particle Petri Nets[END_REF] based on the discretization of its health evolution.

A. Platform Description

The K11 rover is powered by twenty-four 2.2 Ah lithiumion single cell batteries. A typical mission of the rover consists in visiting and performing desired science functions at a set of way-points and joining its charging station before the complete discharge of its battery. The rover wheels are denominated by their location: the front-left (FL) wheel, the front-right (FR) wheel, the back-left (BL) wheel and the back-right (BR) wheel. Each wheel is driven by an independent motor.The rover is a skid-steered vehicle, meaning that the wheels cannot be steered and it is rotated by commanding the wheel speeds on the left and right sides to different values. An onboard laptop computer runs a proportional-integral-derivative controller and a data acquisition software. Available data are provided by 65 continuous signals: the 4 commanded wheel speeds and the 61 sensor measurements that include the actual wheel speeds, the total current, the motor currents and temperatures and the voltages and temperatures of each of the 24 battery cells. More details on the K11 model can be found in [START_REF] Balaban | Development of a Mobile Robot Test Platform and Methods for Validation of Prognostics-Enabled Decision Making Algorithms[END_REF], in which it is studied as a continuous system.

Several fault types can occurred on the rover. These fault occurrences are considered as unobservable discrete events and their effects are summarized in the following subsection.

B. Modeling for Health Monitoring

A simplified multimode description of the rover health evolution, limited to the FL motor part, is presented in Figure 2. The entire rover health evolution can obviously be deduced from this description as the four motors have the same behavior. This simplified view of the system does not include multiple-fault modes. Graphically, the underlying graph vertices represent the modes and the edges represent the mode switches. Variables that can be observed or estimated with observations are underlined. In each mode, associated continuous dynamics and degradation dynamics are indicated.

As long as no fault has occurred, the rover is in mode Nominal with continuous dynamics C 1 . Fault f 1 occurrence represents the End Of Discharge (EOD) of the battery, i.e. the time when the battery is too discharged to power the system. This fault is assumed to occur when the battery voltage is lower than 3 V (approximately) and it leads to the mission failure (mode Discharged). Fault f 2 represents the emergence of a parasitic battery load.The parasitic load increases the total current and thus the battery drain (mode Parasitic load with continuous dynamics C 2 ), which causes the system to reach the EOD prematurely. The most feared scenario for a motor is an overheating: the heat will eventually destroy the insulation of the windings, causing electrical shorts and leading to motor failure. The overheating of the FL (resp. FR, BL and BR) motor is represented by fault f 3 (resp. f 4 , f 5 and f 6 ). The occurrence of any one of these faults leads to the rover failure (mode Overheated with continuous dynamics C 4 ) and thus represents the rover EOL. A motor is assumed to overheat when its temperature exceeds 70 • C.

The motor temperatures are measured by four sensors. These sensors, however, are known to fail unexpectedly, sending inconsistent values. These failures are represented by faults f 7 f 8 , f 9 and f 10 . We consider that the temperature model is not accurate enough without a correction step with observations. As a consequence, once fault f 7 (resp. f 8 , f 9 and f 10 ) has occurred, the occurrence of fault f 3 (resp. f 4 , f 5 and f 6 ) does not match with any condition on the FL (resp. FR, BL and BR) motor temperature (see the arc between Sensor FL fault and Overheated ). In Figure 2, mode Sensor FL fault with continuous dynamics C 3 represents the mode where the temperature sensor of the FL motor has failed.

As no degradation law is a priori known for this rover, all modes have the same degradation dynamics D 1 .

Considering all the motors and multiple faults, 192 modes and 240 mode switches can be identified 2 .

Continuous dynamics and degradation dynamics can be represented by differential equations. Because of the lack of knowledge about the rover components degradation in the NASA Ames Research Center model, all modes have the same degradation dynamics D 1 that has been defined as the identity function. C 1 is a set of differential equations that unifies the battery model with the rover motion model and the temperature models in the nominal case. It can be converted into a discrete-time representation and solved with a sample time of 1/20s, while the continuous observation sampling time is about 1s:

C 1 = x k+1 = f (x k , u k ) + v(x k , u k ) y k = h(x k , u k ) + w(x k , u k ) , (1)
where x k ∈ R nx is the vector of the n x continuous state variables, u k ∈ R nu is the vector of n u continuous input variables (n u = 4), f is the noiseless continuous state equation, v is the continuous process noise equation, y k ∈ R ny is a vector of n y continuous output variables (n y = 61), h is the noiseless continuous output equation, and w is the continuous output noise equation. We consider 32 state variables (n x = 32), including the rover 2-dimensional position (x, y), its relative angle position, the wheel control errors, the motor temperatures and motor winding temperatures. The 24 batteries are lumped into a single one to only consider 5 battery state variables (3 charges, the temperature and the voltage) instead of 120. Unifying the battery, motion, and temperature models, however, highly increases complexity and uncertainty.

Fault f 2 occurrence and effect are modeled as a time varying parameter. The parasitic battery load is captured as an additional current reaching a value between 1.5 A and 4.5 A from value 0 A in a few seconds after the fault f 2 occurrence. First, two parameters are added to the continuous state vector to monitor both the duration since the fault occurrence and the additional current value. Then, the uncertain rise of the additional current is modeled by adding a Gaussian noise, with a mean and standard deviation values starting respectively at 3 and 0.3 and decreasing to 0 and 0.01 as the duration since the fault occurrence increases.

Finally, the temperature model is quite uncertain, so temperature measurements are assumed to be reliable when sensors are not failed. Faults f 7 , f 8 , f 9 , f 10 are modeled by increasing significantly the motor temperature sensor noise because failed sensors only send inconsistent large values.

IV. HYBRID SYSTEM PROGNOSIS

Prognosis aims at predicting the system future states and its RUL/EOL from diagnosis and future inputs available from a mission scenario for example. During an arbitrary prediction horizon τ , the goal is to determine if and when the system will enter a failure mode and will not be operational anymore.

We propose to use the Hybrid Particle Petri Nets (HPPN) data structure to generate three different objects: a model, a diagnoser and a prognoser from a description of the hybrid system. An overview of the health monitoring architecture is given in Algorithm 1 and illustrated in Figure 3.

Algorithm 1 HPPN-based monitoring methodology

1: HPPN Φ ← CreateHPPNModel () 2: HPPN ∆ ← GenerateHPPNDiagnoser (HPPN Φ ) 3: HPPN Π ← GenerateHPPNPrognoser (HPPN Φ ) 4: for all k do 5: O k ← (U S k , u N k , Y S k , y N k ) 6: ∆ k ← Update(HPPN ∆ , k, O k ) 7: Π k ← Prognose(HPPN Π , ∆ k , U + k ) 8: end for
Although the health monitoring methodology obviously includes diagnosis and prognosis, this paper focuses on the prognoser generation and on the prognosis computation (lines 3 and 7). Functions GenerateHP P N Diagoser and U pdate are covered in previous work [START_REF] Gaudel | Health Monitoring of a Planetary Rover Using Hybrid Particle Petri Nets[END_REF] and are assumed to be given.

The first offline step (line 1) is the generation of the HPPN model HP P N Φ of the system. It can be directly built from a multimode description or created from expert knowledge. For example, for the K11, it is generated from the K11 hybrid multimode description given in Section III. The second offline step (line 2) is the automatic generation of a HPPN-based diagnoser HP P N ∆ from the system model HP P N Φ . The last offline step (line 3) is the automatic generation of a HPPNbased prognoser HP P N Π from the system model HP P N Φ .

The online process (line 4-8) uses the system consecutive observations O k (discrete and continuous inputs and outputs) to update the diagnoser marking [START_REF] Gaudel | Health Monitoring of a Planetary Rover Using Hybrid Particle Petri Nets[END_REF]. This marking contains all diagnosis hypotheses. The diagnosis ∆ k is given by the marking of the HPPN-based diagnoser HP P N ∆ and represents a distribution of beliefs obtained by particle filtering. To compute the system prognosis Π k at time k (line 7), the prognoser is initialized with ∆ k and its marking evolves according to a given set of future inputs U + k . The set U + k = {u κ |κ ∈ {k, ..., k + τ }} includes the system future inputs during the prediction horizon τ ∈ N, where u κ ∈ R nu is the continuous input vector at future time κ. The prognosis Π k is defined as the marking of the prognoser at the end of this process.

Uncertainty and computational performance are two substantial challenges for prognostics that cannot be ignored. The first one is related to the result accuracy and precision, whereas the second one is related to calculation time and computational resource management. Those challenges for prognostics are explained in the next subsections.

A. Uncertainty: a Challenge for Prognostics 1) Uncertainty about Diagnosis: The knowledge about the current state is a significant source of uncertainty for the prognosis process. In this work, we use the current diagnosis that contains all the hypotheses on the system. Diagnosis is performed by combining pseudo firing of transitions in the HPPN-diagnoser and particle filtering for continuous dynamics. Each diagnostic hypothesis provides a possible continuous state (represented with a distribution of particles), a possible discrete state (a mode of the DES) and a set of events that leads to the discrete state. The prognosis process predicts the system future states by simulating the future evolution of the diagnosis hypotheses. It also predicts events that will occur on the system. Particularly, from a hypothesis in ∆ k , we predict the possible sets of events that would lead the system to failure modes. Mode switches are simulated when some conditions on the continuous state vector are satisfied. The time of occurrence of an event that leads to a failure mode is a possible EOL of this hypothesis.

2) Uncertainty about Continuous Dynamics: Another source of uncertainty is continuous dynamics noise. In the K11 case study, fault f 2 time varying parameters are considered as state variables (see Section III-B) and are estimated during the diagnosis process. Process noise is negligible relative to other sources of uncertainty in prognostics so we choose to ignore it.

3) Uncertainty about Future Inputs: In real systems, determining the set of future inputs U + k is another source of uncertainty. Low level commands are difficult to predict accurately, even if the high level mission plan is known. Considering noise on mission plan and future commands is investigated as a solution to that problem. For the rover case study, we then consider three kinds of future input scenarios: (case 1) future commands are accurately known, (case 2) future commands are set to the maximum speed (the K11 is believed to go straight), (case 3) future commands are stochastically generated (the K11 is believed to move randomly).

B. Computational Performances Challenge

Sequential prognosis (based on simulation) for continuous systems are computationally expensive. In particle filter-based prognostics, the computation time is proportional to the number n of particles to simulate, where n ∈ N can be considered as the precision of the predictions. In HPPN-based monitoring, each simulated diagnosis hypothesis has its own set of particles and the difficulty is to select which hypotheses to select as initial condition for prognosis. In order to scale the prognosis computation time, we propose an original algorithm named the Stochastic Scaling Algorithm (SSA), to select which hypotheses to simulate and the precision with which they will be simulated. By setting three scaling parameters ρ min Π , ρ max Π and ρ tot Π , the operator is able to influence the prognoser performances. Parameters ρ min Π and ρ max Π are respectively the minimum and maximum precision needed to simulate the evolution of a hypothesis. Parameter ρ tot Π is the total particle number available to simulate the evolution of all the hypotheses.

The SSA determines, from a given finite set of values distributed on a starting range, a new set of values distributed on a specific arrival range. The objective is on one hand to change values range and one the other hand to change their cardinal. This scaling is a Monte Carlo process and uses three scaling parameters ρ min , ρ max and ρ tot . Parameters ρ min and ρ max are respectively the minimum and maximum bounds of the arrival range, and ρ tot indicates the maximum sum of the new set values. As the SSA is also used for diagnosis, these parameters are denoted ρ min ∆ , ρ max ∆ and ρ tot ∆ for the diagnoser and ρ min Π , ρ max Π and ρ tot Π for the prognoser. The SSA is given in Algorithm 2. It can be presented as a resource allocation problem solver where there are N J jobs to realize, here N J hypotheses to simulate. Belief degrees are associated with hypotheses to indicate their importance and are given in input as weights. Each hypothesis has a precision, considered here as resource, that is the number of particles used to simulate it. The higher the number of resources is allocated to a job, the better the job will be realized: in other words, the higher the number of particles is allocated to a

Algorithm 2 Stochastic Scaling Algorithm

Input: B list of the N J hypotheses belief degrees Input: ρ min , ρ max , ρ tot scaling parameters Output: R list of the particle numbers allocated to the N J hypotheses 1: J ← (1, ..., N J ) list of IDs of hypotheses to provide (all at start) 2: R ← (0|∀i ∈ t) list of particles numbers allocated to hypotheses 3: r ← ρ tot remaining particle number (all available at start) it remains resources and jobs to provide 7:

B J ← (Bi|∀i ∈ J)
belief degrees of the hypotheses to provide 8:

for o ∈ {1, ..., r} do repeat r times 9:

Jc ← Pick (J, B J ) pick over a normal distribution for all Ri ∈ R do 13:

if Ri > ρ max then constraint 2 not satisfied 14:

Ri ← ρ max handover the overload J ← (Ji|∀Ji ∈ J, RJ i < ρ max ) keep hypotheses to provide 22:

r n ← ρ tot - R i ∈R

Ri

new remaining particle number end if 28: end while hypothesis, the better the hypothesis will be simulated. The problem consists in allocating the ρ tot available particles to the N J hypotheses depending on their belief degrees.

Two constraints are added to the problem. Firstly, a hypothesis can only be simulated if a sufficient number of particles ρ min is allocated to it (constraint 1). Secondly, it is forbidden to allocate more than ρ max particles to a hypothesis because it does not improve the simulation (constraint 2).

The proposed solution to the problem is based on two steps: (1) the random allocation of all the available particles using a normal distribution depending on the hypotheses belief degrees (lines 8-11), (2) the handover of all the particles allocated to hypotheses that do not satisfy constraint 1 (underload) (lines [START_REF] Vianna | Interactive Multiple-Model Application for Hydraulic Servovalve Health Monitoring[END_REF][START_REF] Chanthery | An Integrated Framework for Diagnosis and Prognosis of Hybrid Systems[END_REF][START_REF] Zabi | Health Monitoring and Prognosis of Hybrid Systems[END_REF] and the handover of the unnecessary particles allocated to hypotheses that do not satisfy constraint 2 (overload) (lines [START_REF] Daigle | A Structural Model Decomposition Framework for Hybrid Systems Diagnosis[END_REF][START_REF] Narasimhan | HyDE -a general framework for stochastic and hybrid modelbased diagnosis[END_REF][START_REF] Yu | Prognosis of Hybrid Systems With Multiple Incipient Faults: Augmented Global Analytical Redundancy Relations Approach[END_REF]. These two steps are repeated until no more particles are available (line 5) or that the allocation remains unchanged after the execution of the two steps (line 24).

The SSA can return undesirable results with some extreme scaling parameter setups and belief distributions. For instance, the scaling of the sample example with parameters (ρ min , ρ max , ρ tot ) = (20, 120, 1000) never assigns any particle to the hypotheses, because the total number of available particles is too low (1000) compared to the number of hypotheses (200) and the minimum number of particles to allocate to each one of them [START_REF] Ribot | Generic characterization of diagnosis and prognosis for complex heterogeneous systems[END_REF]. In such cases, a recovery mechanism allocates the maximum number of particles ρ max to the hypotheses with the highest belief degrees until no more particle is available. A computational performance study comparing different values of the scaling parameters is provided in Section V-B. The choice of these parameters highly depends on the constraints on the computation time and the precision required on the results.

C. Prognoser Generation

The prognoser is defined with the HPPN framework. The HPPN structure, introduced in [START_REF] Gaudel | Health Monitoring of Hybrid Systems Using Hybrid Particle Petri Nets[END_REF], is an extension of Petri nets. The main advantage of the HPPN structure is that it can capture heterogeneous knowledge about the system, such as discrete evolutions with symbolic places, continuous evolutions with numerical places, and relations between each others with transitions via degradation.

Let us consider the HPPN model HP P N Φ of the system. The prognoser HPPN Π derived from HP P N Φ is a tuple P , T , A,A,E,X,D,C,D, Ω, M 0 where:

• P is the set of places, partitioned into symbolic places P S , numerical places P N and degradation places P D , • T is the set of transitions,

• A ⊂ P × T ∪ T × P is the set of arcs, • A is the set of arc annotations, • E is the set of event labels, • X ⊂ R n N is the state space of the continuous state vector, with n N ∈ N + the number of continuous state variables, • D ⊂ R n D is the state space of the degradation state vector, with n D ∈ N + the number of degradation state variables, • C is the set of dynamic equation sets associated with numerical places, representing continuous dynamics, • D is the set of dynamic equation sets associated with degradation places, • Ω is the set of conditions associated with transitions, • M 0 is the initial marking of the Petri net. The different steps of the generation of the HPPN-prognoser HP P N Π are described in detail in [START_REF] Ribot | Hppn-based prognosis for hybrid systems[END_REF].

The set of the event labels E = E o ∪ E uo is partitioned into observable event labels E o and unobservable event labels E uo . An event is defined as a couple e = (v, k) where v ∈ E is an event label and k the time of occurrence of e.

Symbolic places P S model the discrete states of the system and are marked by configurations. The set of all configurations at time k is noted M S k . A configuration δ k ∈ M S k is a symbolic token at time k whose value is the set b k of events that occurred on the system until time k: b k = {(v, κ)|κ ≤ k}.

Numerical places P N model the different continuous evolutions of the system. A numerical place p N ∈ P N is associated with a set of equations C ∈ C modeling system continuous dynamics without their associated numerical uncertainty. Noise functions v and w in Equation ( 1) are removed in the prognoser. Numerical places are marked with particles. The set of all particles at time k is noted numerical token at time k whose value is a possible continuous state x k ∈ X of the system at time k.

M N k . A particle π k ∈ M N k is a
A couple 'symbolic place' and 'numerical place' models a system operating mode. A symbolic or a numerical place can be used to model several modes (for example, if two modes have the same continuous evolution, they can be modeled with two symbolic places and only one numerical place). Figure 4 9 that is associated with continuous dynamics C 4 . Degradation places P D and dynamics D model the system degradation evolutions associated to modes [START_REF]Hybrid Particle Petri Nets for Systems Health Monitoring under Uncertainty[END_REF] and are marked with degradation tokens M D . In this work, our knowledge on the rover does not encompass such parallel evolution. As a consequence, we use only one degradation place (dotted place p D 10 in Figure 4) in HP P N Π that contains all the degradation tokens at any time k. Any degradation token d k ∈ M D links one configuration with one particle. These links are a particularity of the HPPN data structure. We note link(δ k , π k , d k ) = , where is the true value, if the degradation token d k links the configuration δ k with the particle π k .

These links are required to represent hypotheses on the system trajectories, i.e. its discrete and continuous states at time k and the set of events that occurred on it until time k. We define formally a diagnosis hypothesis at time k as a set of tokens {δ k , π 1 k , ...,

π n k k , d 1 k , ..., d n k k |∀i ∈ {1, ..., n k }, link(δ k , π i k , d i k ) =
} that contains all the knowledge on the continuous state at time k with the particles and the events occurred until time k with the configuration. The subset of particles represents the distribution of probability over the continuous state (as in particle filters). The number of particles n k is called the precision of the hypothesis at time k. Here, degradation tokens ensure the consistency of the hypothesis by linking a configuration with particles.

The marking M k of the HPPN-based prognoser is the distribution of the configurations, the particles and the degradation tokens in the different places at time k. The set M k denoted the set of all tokens at time k:

M k = M S k ∪ M N k ∪ M D k . (2)
Transitions in the prognoser model mode switches. A transition t ∈ T will have as input (resp. output) the set of places representing the outgoing (resp. ingoing) mode of the switch.

A transition t ∈ T may be fired:

• if there is at least one token in any of its input places,

• these tokens are linked together,

• with respect to its associated set of conditions Ω t ∈ Ω describing the mode switches. A condition ω t : M k → B, with ω t ∈ Ω t and B = { , ⊥} can be either a test on a token value, always satisfied ( ), or never satisfied (⊥).

The prognosis process works with future inputs only (discrete input events and continuous input vectors). As a consequence, only the mode switches triggered by continuous variables or input events are modeled in the prognoser. For the K11 case study, there is no discrete input event, so a transition is created only for the mode switches triggered by conditions on continuous state variables. It means that any set Ω t is composed of only one numerical condition ω N t . For example in Figure 4, only switches triggered by v < 3 or t F L < 70 are considered in the prognoser of the K11 as transitions t 1 , t 2 , t 3 , t 4 and t 5 . With this reasoning, fault occurrence conditions are ignored in the prognoser.

Arc annotations A, however, are used in the prognoser to update the configuration values during the transition firing and thus record fault occurrences. An arc a ∈ A that connects a transition t to a symbolic place p S , may be annotated with an event label v ∈ E. In such a case, a configuration δ that is moved to p S after the firing of t at time k, sees its event set b updated with the event (v, k). In Figure 4, each arc that connects a transition to a symbolic place is annotated with the fault label that conditions the mode switch in Figure 2.

D. Prognosis Process

The prognosis process may be performed at any time k and provides a prognosis Π k , as shown in Algorithm 1, line 7. Its inputs are the HPPN-based prognoser HP P N Π generated from a hybrid model HP P N Φ , the diagnosis ∆ k and the set U + k of the future system inputs at time k. Diagnosis ∆ k is provided by the marking of HPPN-based diagnoser HP P N ∆ at time k [START_REF]Hybrid Particle Petri Nets for Systems Health Monitoring under Uncertainty[END_REF], [START_REF] Gaudel | Health Monitoring of a Planetary Rover Using Hybrid Particle Petri Nets[END_REF] and thus contains hypotheses over the system past trajectories. Each diagnosis hypothesis is valued with a belief degree and includes discrete and continuous state estimates, as well as the set of faults that occurred on the system until time k. The prognosis process steps are given in Algorithm 3.

|M S k | = |M N k | = |M D k |. (3)
Without performance constraints, a diagnosis hypothesis is completely reproduced in the prognoser, i.e. m = n: any particle π k or degradation token d k in ∆ k is duplicated. To improve computational performance of the prognosis process, however, the hypotheses in ∆ k can be partially reproduced.

The SSA determines the precisions to associate to all the hypotheses, based on their belief degrees, and by using three scaling parameters ρ min Π , ρ max

|M k | ≤ 3 × ρ tot Π , (4)
because there are three types of tokens. Then, for any hypothesis in ∆ k , m particles and m degradation tokens are randomly selected and duplicated to form M k . The initialization process is illustrated in Figure 5. It shows how the initialization process creates 8 hypotheses of precision 1 in M k from the 4 hypotheses in ∆ k . are respectively the minimum and the sufficient precisions granted to the prognoser to simulate a hypothesis in the future. The prognoser scaling parameters thus provide a compromise between the number of hypotheses to project in the future and the precision granted to each one of them, relative to a maximum number of tokens to simulate. They are set up to fulfill performance constraints.

2) Prognoser Marking Evolution: Once the prognoser marking is initialized, the future evolutions of the selected hypotheses are simulated according to U + k (line 4). The prognoser marking evolves according to the future inputs U + k = {u κ |κ ∈ {k, ..., k + τ }}, where τ + 1 ∈ N is the prediction horizon. The prediction is stopped when all the inputs have been simulated (line 6) or before if all the hypotheses have reached a failure mode (lines 3-4), in order to reduce computation time.

The goal of the Update function described by Algorithm 4 is to predict the evolutions of the system from the generated prognoser and the inputs at time κ. For each continuous input vector u κ ∈ R nu at future time κ, the marking Mκ-1|k is updated to Mκ|k in two steps, the transition firing and the tokens value update. Three rules are given hereafter to define the transition firing step. a) Transition Firing: All enabled transitions are simultaneously fired using the following definitions and rules.

When a transition t ∈ T is fired, all the hypotheses in its input places satisfying conditions Ω t are moved to the output places of t.

Let • t and t • respectively denote the set of input and output places of t, and M κ (p) denote the set of the tokens in the place p ∈ P at time κ.

Let define the set S t κ as

S t κ = {(δ κ , π κ , d κ ) ∈ (M κ (p S ) × M κ (p N ) × M κ (p D ))| link(δ κ , π κ , d κ ) ∧ ω N t (π κ ) }, (5)
with

(p S , p N , p D ) ∈ (P S ∩ • t) × (P N ∩ • t) × (P D ∩ • t) and ω N t ∈ Ω t . Definition 1 (Enabled transition): A transition t ∈ T is enabled at time κ if |S t κ | > 0. (6)
Rule 1 (Transition firing): Let t ∈ T be an enabled transition. For each type of places in input and output of t, the firing of t at time κ is defined by

∀P o ∈ {P S , P N , P D }, p ∈ P o ∩ • t, p ∈ P o ∩ t • , M κ+1 (p) = M κ (p)\S t κ (p), M κ+1 (p ) = M κ (p ) ∪ S t κ (p), (7)
where S t κ (p) is the set of tokens of S t κ that are in the place p. b) Token Value Update: During the transition firing, configuration values are updated with the arc annotations A with Rule 2.

Rule 2 (Configuration value update): When a configuration moves through an arc a during the firing of a transition t at time κ, its event set b κ is updated with the event label v ∈ E that annotates a: b κ+1 ← b κ ∪ {(v, κ)}.

After the transition firing, all particle values are updated with Rule 3.

Rule 3 (Particle value update): The continuous state vector x κ of a particle is updated with the continuous state equation associated with the numerical place the particle belongs:

x κ+1 = f (x κ , u κ )
, where u κ is the continuous input vector at time κ. x κ ← update particle values with u κ-1 to applying Rule 3 6: end if 7: end for Concerning the complexity, the prognoser is initialized with a maximum of 3 × ρ tot Π tokens (see Section IV-D1) and the marking evolution does not create new token. So, the prognoser HPPN Π is 3 × ρ tot Π -bounded.

3) Prognosis Result:

The output of the prognosis process is the marking of the HPPN-based prognoser: Π k = MkEOP|k , where k EOP is the End Of Prediction: k EOP ≤ k + τ . The prognosis Π k is a distribution of beliefs over the system future modes until time k EOP . It especially contains the event occurrences that will lead to failure modes, and particularly the faults and their times of occurrences. It thus contains all necessary data to compute a belief distribution over the system RUL/EOL.

Whatever the value of the prediction horizon τ , k EOP always satisfies k EOP ≤ k + τ .

Let {δ, π, d} be a hypothesis in Π k and p S , p N and p D be the places where the tokens δ, π and d are. If places p S , p N and p D represent a failure mode, then the EOL of this hypothesis is the occurrence time of the last event contained in the event set b of the configuration δ:

EOL({δ, π, d}) max{κ|(v, κ) ∈ b}. (8)
With the EOL, we can retrieve the RUL:

RU L({δ, π, d}) EOL({δ, π, d}) -k. (9)
V. EXPERIMENTAL RESULTS

This section provides results obtained by testing the proposed prognosis method on the K11. Two scenarios fully described in [START_REF] Sweet | Demonstration of Prognostics-Enabled Decision Making Algorithms on a Hardware Mobile Robot Test Platform[END_REF] are considered in this section: a nominal scenario and a scenario during which a battery parasitic load fault (i.e. f 2 ) is injected. For the two scenarios, the rover mission is to visit 5 way-points and to go back to its starting position. It starts at 0s with batteries fully charged and with all components at the ambient temperature.

The K11 rover has actually two motor temperature sensors (FL and BL) failed. The sensors faults are diagnosed in one sampling period by the diagnoser if we consider the initial mode to be unknown. In the rest of the paper, we assume to know the rover initial mode as the degraded mode Sensor BL FL fault. For the sake of clarity, we also consider the End Of Discharge (EOD) as a Rover end Of Life (EOL).

The proposed methodology is implemented in Python 3.4. The tests were performed on a 4 Intel(R) Core(TM) i5 -4590 CPU at 3.30 GHz with 16 GB of RAM and running GNU/Linux (Linux 3.13, x86 64). In order to reduce computation time, the token value updates are multi-threaded on the 4 physical cores. The rest of the implementation uses one core.

The scaling parameters are chosen for the HPPN-based diagnoser in order to monitor between 18 and 37 hypotheses. In order to only simulate the future of hypotheses with high beliefs, but also to limit the prognosis computation time, the HPPN-based prognoser scaling parameters are firstly set to:

(ρ min Π , ρ max Π , ρ tot Π ) = (1, 5, 100) Π .
Thereby, 20 to 100 hypothesis evolutions will be simulated, with precisions varying between 1 and 5.

The prediction horizon is τ = 10000, because missions last a maximum of 150 minutes. For the two scenarios, future commands are based on recorded data, then the last command is repeated to fulfill the prediction horizon. Finally, the prognoser computes a prognosis result every 30 diagnoses.

A. Scenarios and Results

1) Nominal Scenario: In the nominal scenario, no fault is injected. The rover successfully visits the 5 way-points and returns to the charging station at 5064s.

Figure 6 shows the prognoser RUL estimates, i.e. the rover remaining times before entering a failure mode, all along the scenario. These RUL estimates are obtained from the HPPN-based prognoser marking and Equation [START_REF] Daigle | An event-based approach to integrated parametric and discrete fault diagnosis in hybrid systems[END_REF]. The RUL associated to all hypotheses simulated by the prognoser are drawn with different shades of gray; the ones with the highest belief degrees are black, while the ones with the lowest belief degrees are light gray. The real time of the End Of Mission (EOM) is drawn with a dashed line. The gap between 81s and 281s corresponds to a break during the experiment.

From Figure 6, it is possible to verify that the EOL with the highest belief degree is almost always around 8150s. These results are consistent with our expectations because there is a constant difference of about 3000s between the EOM and these EOL. EOM occurs before EOD. This illustrates that the diagnoser keeps the true mode Sensor BL FL fault in its set of possible current modes and assigns it a high belief all along the scenario.

Other modes are also considered by the diagnoser at any time because of the model-based uncertainty, leading to shorter RUL in Figure 6.

2) Parasitic Load Fault Scenario: In this scenario, a 2 A battery parasitic load fault (fault f 2 ) is injected between 772s and 784s and the rover is fully discharged at 4571s before returning to its starting point.

Figure 7 shows the belief degrees at any time of some modes, giving an overview of the system diagnosis. The belief degree of a mode at any time is represented by the thickness of the line and the highest belief degree of all the modes is plotted in blue. The belief degree of a mode at time k is the maximum of the belief degrees of all the hypotheses being in that mode at time k.

Figure 8 shows the prognoser RUL estimates and the real EOL (dashed line) for the faulty scenario. It illustrates that the HPPN-based prognoser succeeds to compute the expected RUL estimates and thus validates the model. Before the fault occurrence, we can see the same scheme as for the nominal scenario.

After the fault occurrence, the RUL estimates for hypotheses with the highest beliefs (in dark) underestimate the real EOL. After 3000s, estimates and real value coincide.

More precisely, between 750s and 2800s, two clusters of RUL stand: they correspond to the diagnosis hypotheses considering the system is still in the initial mode and the ones considering that f 2 has occurred.

After 2800s, a third cluster appears in the RUL estimates in Figure 8. It corresponds to diagnosis hypotheses stemming from the initial hypothesis and that consider a parasitic load recently appeared. These diagnosis hypotheses have however lower belief degrees than the others ones (light gray).

3) Comparison with Other Approaches and Exploitation: In comparison with other prognosis works on the rover [START_REF] Daigle | Advanced methods for determining prediction uncertainty in model-based prognostics with application to planetary rovers[END_REF], the main advantage of our approach is that the RUL estimates are not presented as an unique distribution but are clustered in several distributions, where each cluster corresponds to one of the main possible futures of the system. In case of decision making in a health management context, if the operator is pessimistic, the shortest RUL estimate will be obviously taken into account.

Some indicators on RUL estimates can qualify the results. A relevant indicator is the average relative error between the shortest RUL estimate and the real RUL. In the faulty scenario, between 760s and 4571s, it is -14.12%, which indicates the shortest RUL is most of the time shorter than the real one. Between 760s and 2676s, the error is -15.90%, and between 2677s and 4571s, it is -12.31%, indicating it is quite constant along the scenario. These results are summed up in Table II.

A real-time estimation of the system past and future trajectory can be more valuable than an estimation of the current mode and RUL/EOL. Figure 9 shows the distribution over the system trajectories at 781s. It combines the past hypotheses in the diagnosis and future hypotheses in the prognosis. Concerning the prognoses, it clearly details four possible futures of the system. This representation can be useful for the operator in case of complex decision making.

B. Performance Analysis

Diagnosis and prognosis computation times, and the maximum RAM used for different sets of scaling parameters, are given in Table I. Tests have been performed on three scenarios (including the nominal and faulty scenarios presented above) and run 12 times. 54403 diagnoses and 1822 prognoses were computed.

These metrics point out that computation times with the initial scaling parameters remain acceptable but do not respect real-time constraints; observations sampling is about 1s and the average diagnosis computation time is 4.54s. A prognosis process is launched every 30s, but the minimum prognosis computation time is 52.12s. This is mainly due to that both processes rely on parallel step-by-step simulations but it is also due to the rover model computational complexity.

The methodology complexity is difficult to evaluate because it depends on the continuous equations, the DES structure and the token number, among others. Moreover, software implementation, compilation optimization or virtual machine execution are also other performance factors difficult to evaluate in practice. This is why we propose in this work to approach performance constraints by tuning the scaling parameters.

We can see in Table I that reducing the scaling parameters reduces computation times and memory usages. RUL estimates (see Figure 10) are still acceptable, even if they are not as detailed as with the initially parameter sets (40, 80, 1500) ∆ and (1, 5, 100) Π .

Regarding the average relative errors between the shortest RUL estimate and the real RUL for the battery parasitic load fault scenario, we can see in Table II that reducing the scale parameters reduces the error. It also highlights that the error decreases along the scenario because the parasitic load estimation becomes more consistent with the model as explained is Section V. These results are consistent because less uncertainty is taken into account. This kind of performance analysis needs to be performed during the design of the health monitoring phase for choosing the relevant scale parameters. An interesting perspective of this work is to develop some solutions for automatically find the best scale parameters, knowing the required precision and the computation time constraints.

C. Unknown Future Commands

In this section, results of RUL estimation are given in the case where future inputs are unknown. In such a case, we propose to dynamically construct the set of future inputs U + k following a given rule. The construction consists in determining the wheel speed commands at any future time κ. Wheel speeds are commanded with value between 0 and 100, where 100 is the maximum speed value.

We propose two kinds of rules, inspired by [START_REF] Daigle | Stochastic Prediction of Remaining Driving Time and Distance for a Planetary Rover[END_REF]. The first one considers the rover will go straight at the highest speed. The 4 command variables of u κ are thus set to the maximum speed value 100, at any future time κ. The second rule considers the rover will move randomly and thus the future wheel speed commands are then randomly chosen. More precisely, for each time κ, the left-side (resp. right-side) wheel speed is randomly chosen between 0, 50 and 100.

Figures 11 (a) and (b) show the results of the use of the two rules for the battery parasitic load fault scenario. They show quite similar results than Figure 8. By looking at the average relative errors between the shortest RUL estimate and real RUL (Table III), we can see that both rules provide slightly smaller errors than those obtained with known future commands (between 1.45% and 9.57%). Using stochastic future commands divides by almost 2 the average error between 760s and 4571s, and by almost 4.5 the average error between 2677s and 4571s. We can deduce that in this particular case, the use of the stochastic rule corrects the model inaccuracy during the simulation of the future behavior of the K11. This case study leads to several conclusions on the HPPNbased prognosis method:

• it is adaptable to systems without discrete observations nor degradation knowledge, • it is robust to real system data and provides results that are consistent, • it is tunable to fulfill performance constraints (both the diagnoser and prognoser scaling parameter sets have an effect on the prognoser performance), • reducing the scaling parameters still provides acceptable results but does not respect prognosis real-time constraints for the rover with the current implementation, • it can be used without knowledge on the future commands, and it particularly provides interesting results when using stochastic future commands.

VI. CONCLUSION

This work proposes an original prognosis approach of hybrid systems based on Hybrid Particle Petri Nets, and its application on a real case study, the K11 planetary rover prototype. The main contributions are the uncertainty management and the compromise between performance and available computational resources, through the setting of scaling parameters in the SSA. Two scenarios are tested on the rover to illustrate the usability of the proposed methodology. Results are consistent and show that the prognosis method is robust to real system data. The metrics show its computational performance.

As said in Section V-B, an interesting perspective is first of all to develop some solutions for automatically finding the best scale parameters, knowing the required precision and the computation time constraints. Learning approaches or fuzzy logic could be investigated. Future works will also focus on the HPPN-based diagnoser and prognoser verifications. We aim at investigating how the HPPN-based prognoser results may influence the HPPN-based diagnoser results (and vice versa). The prognoser could, for example, increases the precision of the monitoring of a system hypothesis whose predicted trajectory is particularly critical.

Fig. 1 .

 1 Fig. 1. From Diagnosis to Prognosis.

Fig. 2 .

 2 Fig. 2. Streamlined description of the K11 health evolution.

Fig. 3 .

 3 Fig. 3. Overview of the health monitoring architecture.

4 : 5 :

 45 while r > 0 and |J| > 0 do 6:

Fig. 4 .

 4 Fig. 4. Prognoser HPPN Π of the K11 rover.

1 and p N 6 .

 16 shows the HPPN-based prognoser generated with the simplified hybrid model of the K11 rover presented in Figure 2. The 5 symbolic places (plain places p S 1 ,...,p S 5 ) represent the 5 discrete states of the hybrid automaton (Nominal ,...,Overheated ). The 4 numerical places (dashed places p N 6 ,..., p N 9 ) represent the 4 continuous evolutions (C 1 ,..., C 4 ). Mode Nominal is thus fully represented with places p S Modes Discharged and Overheated are symbolically represented with respectively places p S 4 and p S 5 , and they are both numerically represented with the same numerical place p N

Algorithm 3 3 : 4 :

 334 Prognose Input: HPPN Π , ∆ k , U + k Output: MkEOP|k 1: Initialize(HPPN Π , ∆ k ) 2: for all U κ ∈ U + k do if AllHypothesesFailed ( Mκ-1|k )==0 then Mκ|k ← Update(HPPN Π , κ, u κ ) end for 9: k EOP ← κ 1) Prognoser Initialization: The prognoser is initialized from the diagnosis ∆ k (line 1). To keep diagnosis uncertainty, the initial marking M k = M 0 of the prognoser HPPN Π is based on ∆ k , the set of configurations, particles and degradation tokens representing all the diagnosis hypotheses on the system at time k. During the Initialize procedure (line 1), the tokens of ∆ k are duplicated in a way that any diagnosis hypothesis of precision n is represented in the prognoser by m prognosis hypotheses with precision 1, where m ∈ N + is determined with the SSA (see Algorithm 2 in Section IV-B). The n jobs to realize are the simulations in the future of the n diagnosis hypotheses included in ∆ k . The resources are the hypotheses with precision 1. More formally, any diagnosis hypothesis {δ k , π 1 k , ..., π n k , d 1 k , ..., d n k } ⊂ ∆ k , where the n degradation tokens link the n particles to the configuration δ k , is reproduced in the prognoser initial marking M k and takes the form of an equivalent distribution {δ 1 k , π 1 k , d 1 k , ..., δ m k , π m k , d m k }, in which, for any i ∈ {1, ..., m}, d i k links δ i k and π i k , and any δ i k has the same value b k as δ k . Once initialized, the prognoser has as many configurations as particles and degradation tokens:

Π

  and ρ tot Π . It means that any m is chosen to satisfy the predicate ρ min Π ≤ m ≤ ρ max Π . It also means the total number of tokens in the prognoser |M k | always verifies:

Fig. 5 .

 5 Fig. 5. Illustration of HPPN Π initialization.

Algorithm 4 2 : 3 :

 423 Update Input: HP P N Π , κ, u κ Output: Mκ|k 1: for all t ∈ T do if t is enabled at time κ -1 then Mκ|k ← update the marking applying Rule 1 4: b κ ← update configuration values applying Rule 2 5:

Fig. 6 .Fig. 7 .

 67 Fig. 6. Nominal scenario -RUL estimates with (40, 80, 1500) ∆ and (1, 5, 100) Π .

Fig. 8 .

 8 Fig. 8. Battery parasitic load fault scenario -RUL estimates with (40, 80, 1500) ∆ and (1, 5, 100) Π .

Fig. 9 .

 9 Fig. 9. Battery parasitic load fault scenario -Hypotheses on the system trajectories at 781s with (40, 80, 1500) ∆ and (1, 5, 100) Π .

Fig. 10 .

 10 Fig. 10. RUL estimates -(a),(c): nominal scenario; (b),(d): battery parasitic load fault scenario; (a),(b): (40, 80, 400) ∆ and (1, 5, 100) Π ; (c),(d): (20, 60, 400) ∆ and (1, 1, 1) Π .

  (a) Maximum speed commands. (b) Stochastic commands.

Fig. 11 .

 11 Fig. 11. Battery parasitic load fault scenario -RUL estimates with (40, 80, 1500) ∆ and (1, 5, 100) Π , and unknown future commands.

Figure captions: Fig. 1 .

 1 Figure captions: Fig. 1. From Diagnosis to Prognosis Fig. 2. Streamlined Description of the K11 health evolution Fig. 3. Overview of the health monitoring architecture Fig. 4. Prognoser HP P N Π of the K11 rover Fig. 5. Illustration of HP P N Π initialization Fig. 6. Nominal scenario -RUL estimates with (40, 80, 1500) ∆ and (1, 5, 100) Π Fig. 7. Battery parasitic load fault scenario -Mode beliefs at any time with (40, 80, 1500) ∆ Fig. 8. Battery parasitic load fault scenario -RUL estimates with (40, 80, 1500) ∆ and (1, 5, 100) Π Fig. 9. Battery parasitic load fault scenario -Hypotheses on the system trajectories at 781s with (40, 80, 1500) ∆ and (1, 5, 100) Π Fig. 10. RUL estimates -(a),(c): nominal scenario; (b),(d): battery parasitic load fault scenario; (a),(b): (40, 80, 400) ∆ and (1, 5, 100) Π ; (c),(d): (20, 60, 400) ∆ and (1, 1, 1) Π Fig. 11. Battery parasitic load fault scenario -RUL estimates with (40, 80, 1500) ∆ and (1, 5, 100) Π , and unknown future commands

TABLE I COMPUTATIONAL

 I PERFORMANCES OF THE HPPN-BASED HEALTH MONITORING FOR DIFFERENT SCALING PARAMETERS.

	Scaling parameters	∆ min.	0.28	52.12
		max.	4.54	1188.48
		ave.	3.35	605.32	126.73
	(40, 80, 400) ∆ , (1, 5, 100) Π	min. max.	0.28 1.00	0.03 444.73
		ave.	0.56	108.00	122.15
	(20, 60, 400) ∆ , (1, 1, 1) Π	min. max.	0.22 0.98	0.03 33.50
		ave.	0.74	12.35	112.18

k time (s) Π k time (s) max. RAM (MB) (40, 80, 1500) ∆ , (1, 5, 100) Π

TABLE II BATTERY

 II PARASITIC LOAD FAULT SCENARIO -AVERAGE RELATIVE ERRORS BETWEEN SHORTEST RUL ESTIMATE AND REAL RUL (%).

	Scaling parameters	760s-4571s 760s-2676s 2677s-4571s
	(40, 80, 1500) ∆ , (1, 5, 100) Π	-14.12	-15.9	-12.31
	(40, 80, 400) ∆ , (1, 5, 100) Π	-9.32	-10.29	-8.34
	(20, 60, 400) ∆ , (1, 1, 1) Π	-1.55	-4.56	1.51

TABLE III BATTERY

 III PARASITIC LOAD FAULT SCENARIO -AVERAGE RELATIVE ERRORS BETWEEN SHORTEST RUL ESTIMATE AND REAL RUL (%).

	Future command types	760s-4571s 760s-2676s 2677s-4571s
	Known commands	-14.12	-15.9	-12.31
	Maximum speed commands	-11.33	-14.45	-8.16
	Stochastic commands	-7.66	-12.5	-2.74

The complete underlying DES of the K11 hybrid model is available at https://homepages.laas.fr/echanthe/K11.