Walid Fdhila
email: walid.fdhila@univie.ac.at

Stefanie Rinderle-Ma
email: stefanie.rinderle-ma@univie.ac.at

Aymen Baouab
email: aymen.baouab@loria.fr

Olivier Perrin
email: olivier.perrin@loria.fr

Claude Godart
email: claude.godart@loria.fr

On Evolving Partitioned Web Service Orchestrations

Keywords: decentralization, business process, change propagation, web service

Many researches argue that centralized Web Service (WS) orchestrations stop short in dealing with key requirements such as scalability, privacy and reliability. Consequently, fragmentation and decentralization have been proposed to overcome these limitations. In detail, the centralized orchestration is fragmented into behaviorally equivalent distributed partitions such that their combined execution recreates the function of the original orchestration. However, the evolving nature of business processes created the need for an efficient change support. Since the decentralization leads to the distribution of the activities, the control and data flows, it becomes difficult to specify the changes directly on the derived partitions. Therefore, it is more judicious to specify the changes on the centralized orchestration model and propagate them to the derived partitions. In this paper, we propose a comprehensive change framework for partitioned WS orchestration scenarios and demonstrate how to specify and propagate the changes from the centralized model to its resulting decentralized partitions.

I. INTRODUCTION

Globalization and the increase of competitive pressures created the need for agility in business processes, including the ability to outsource, offshore, or otherwise distribute its once-centralized business processes or parts thereof [START_REF] Khalaf | Supporting business process fragmentation while maintaining operational semantics: a BPEL perspective[END_REF]. In this sense, many works were proposed to partition a composite web service [START_REF] Fdhila | A flexible approach for automatic process decentralization using dependency tables[END_REF], [START_REF] Khalaf | Supporting business process fragmentation while maintaining operational semantics: a BPEL perspective[END_REF]. The partitioning transforms the centralized process into behaviorally equivalent distributed partitions such that their combined execution recreates the function of the original orchestration. The flexibility introduced by the decentralization on the other hand raises necessary requirements like adaptation to change. Changes may range from simple modifications to a complete restructuring of the business process to improve efficiency. In the context of the decentralized service orchestrations, applying these changes in a straightforward manner on the derived orchestration partitions is a complex maintenance task, since the control and data flows are decomposed over multiple partitions. Moreover, changing a derived partition may affect the way it interacts with others. In this sense, we have been investigating change propagation in decentralized composite web services [START_REF] Fdhila | Change propagation in decentralized composite web services[END_REF]. Given a wellbehaved structural update on a centralized orchestration, our approach automates the change forward propagation that consistently propagates the update to the derived decentralized

The work presented in this paper has been partly conducted within the project I743 funded by the Austrian Science Fund (FWF).

partitions. The main advantage of this method, is that only partitions concerned by the change are affected, and there is no need to recompute the whole decentralization or redeploy all the partitions. This paper is an extended and revised version of our previous work [START_REF] Fdhila | Change propagation in decentralized composite web services[END_REF]. With respect to this version, the extensions include the adopted change patterns, a revision of the actions for change propagation, the theoretical evaluation of the presented method and some implementation details. The remainder of this paper is structured as follows. Section II illustrates and motivates the importance of change propagation in decentralized orchestrations. While Section III presents the formal definitions, Section IV details the change propagation mechanism. Section V evaluates the approach and Section VI presents the related works. Finally, Section VII summarizes the contribution and outlines future directions.

II. MOTIVATION

To motivate and illustrate the methods presented in this paper, we make use of the sample orchestration (cf. Figure 1) presented in [START_REF] Fdhila | Optimized decentralization of composite web services[END_REF]. This orchestration model encodes a claims handling process at an insurance company IC. For more details about the example, the readers may refer to [START_REF] Fdhila | Optimized decentralization of composite web services[END_REF].

This centralized model presents many drawbacks since all interactions between the services are channeled through IC. The partitioning consists in splitting the latter into small partitions each of which executed by a separate orchestrator. The process is split according to a criterion, such as each partition include only activities which have the same properties (e.g. privacy, role, optimization, etc.). For instance, one could assign critical activities to the same partition to be executed by a high secure orchestrator while assigning others to a less secure ones. Figure 2 depicts a possible decentralized execution settings for IC which is split into three partitions P 1 , P 2 and P 3 . Each partition includes a subset of the initial activities and extra activities to communicate with other partitions (interaction activities). The connectivity between activities of the centralized process is translated to that between activities of different partitions, through message exchanges. Yellow activities represent data exchanges and gray activities are control flow connections. The partitioning of the centralized process model example uses the techniques presented in [START_REF] Fdhila | A flexible approach for automatic process decentralization using dependency tables[END_REF]. Now, lets consider the process model in Figure 1 and assume that IC wants to replace the fragment F by the new fragment F ′. In this change, the choice patterns (g 4 and g 5 ) are replaced by parallel patterns (g 7 and g 8 ) and two new activities a 8 and a 9 invoking the same service S are added as well as a data dependency between a 8 and a 6 . We assume that the added activities have the same properties as the activities of partition P 1 and therefore would be assigned to P 1 . The activity a 6 : B is also concerned by the change since it becomes in parallel with a 9 and consequently the replacement would mainly affect the partitions P 1 and P 3 (c.f. Figure 2). In Figure 2, the regions F 1 and F 2 in partitions P 1 and P 3 respectively, represent the fragments which are affected by the change. It should be noticed that handling the changes locally and propagating them avoid re-decentralizing the whole process. Indeed, redecentralizing the process model leads to the re-deployment of all partitions (even those not affected by the change). In this process example, the partition P 2 is not concerned by the change and would not be re-deployed.

III. PRELIMINARIES

In order to provide a generic approach for change propagation in partitioned composite services, we adopt a high level reasoning using an abstract notation. A process model specifies the control-flow and data-flow relations between activities, using a specialized language such as the Business Process Execution Language (WS-BPEL) or the Business Process Modeling Notation (BPMN).

Definition 1 (Process). A process P is a tuple (O, D, Ec, Ed, S) where

• O is a non empty set of objects which can be partitioned into disjoint sets of activities A, events (start, end) and control patterns Cp (choice, parallel, repeat, etc), • D is a set of data, • Ec is a set of control edges where, Ec ⊂ O×O,

• Ed is a a set of data edges where, Ed ⊂ A×A×D, • S is the set of services invoked by the process. In this paper, we assume that the processes are structured [START_REF] Vanhatalo | Faster and more focused control-flow analysis for business process models through sese decomposition[END_REF]. Recent work has shown that most unstructured process models can be automatically translated into structured ones [START_REF] Polyvyanyy | Structuring acyclic process models[END_REF].

Definition 2 (Activity). An activity a i ∈A is a tuple (in, out, prop) where in, out ⊂D are the set of a i 's inputs and outputs respectively, and prop is the set of a i 's properties (e.g. the role of a i in the process, the service it invokes, its security level, etc). The partitioning of a process model with respect to a criterion leads to a set of interconnected partitions, each defines the relationship between the objects it includes. Partitions communicate using the interaction patterns (i.e. send, receive, etc) [START_REF] Barros | Service interaction patterns[END_REF]. Next, we refer to the set of activities of the initial process which respond to the same partitioning criterion λ (e.g. activities having the same security level) as A i | ∪A i = A and ∀i, j, i = j, A i ∩ A j = {∅}.

Definition 3 (Partition). A partition P i is a tuple (O i , D i , Ec i , Ed i , S i ) where

• O i is a set of objects O i ⊂ O∪I i
, where I i is the set of interaction patterns used by P i (e.g. in Fig. 2: send d1 , receive sync2 , etc). • D i ⊂ D ∪ Sync, where Sync is the set of data used for synchronization with other partitions (e.g. in Fig. 2: sync1, sync2, etc).

• Ec i is the set of control edges, E c ⊂ O i ×O i • Ed i is the set of data edges, E d ⊂(A i ×A i ) ∪ (I i ×(I\I i )).
• S i ⊂ S is the set of services invoked by P i . In the following, we define a fragment as a structured single entry -single exit sub-graph of a process or a partition model.

Definition 4 (partitioning function). The Process partitioning is a total function f λ : π → {π i } i=1..N that takes a centralized process model P and produces a set of decentralized partitions {P i } using the decentralization criterion λ. Next, we extend this definition to take into consideration fragments partitioning.

Definition 5 (Preset, postset, transitive preset, transitive postset). We define the preset (postset) of an activity a i , denoted •a i (a i •), as the set of activities which may execute just before (after) a i and directly linked to it by a set of control dependencies (e.g. in Fig. 1 •a 4 = {a 1 , a 2 , a 3 }). We also define the transitive preset (resp., transitive postset) of an activity a i according to a partitioning criteria λ and denoted •T λ a i (T λ a i •), as the set of activities having the same criterion λ and which may execute just before (after) a i , and linked to it by a set of control patterns or activities with different criteria. The transitive preset of an activity in the centralized process model represents the preset of the same activity in the corresponding partition (e.g. in Fig. 1,• Inserts a new fragment into the process between the entry and exit edges in the centralized process model.

Delete(entry,exit)

Deletes a fragment between the entry and exit edges in the centralized process model.

Replace(fragment,entry,exit)

Replaces the existing fragment between entry and exit edges in the centralized process model by a new f ragment.

Update(activity, prop)

Update an activity's properties. For instance, its security level, its role or the service it invokes.

TABLE I CHANGE PATTERNS

since a 4 and a 1 belong to the same partition P 1 ; c.f. Fig. 2 ). Next, we extend the relations in Definition 5 to that between fragments. For instance the preset of a fragment F is the smallest fragment including all activities which can be executed just before it and directly connected to it.

IV. SPECIFICATION AND PROPAGATION OF CHANGE OPERATIONS

In general, process models can be decomposed into SESE fragments [START_REF] Vanhatalo | Faster and more focused control-flow analysis for business process models through sese decomposition[END_REF]. A SESE fragment is a non-empty subgraph in the process model with a single entry and a single exit edge. For every change in the process model, there is at least one enclosing fragment. Here, we consider only the smallest fragment that encloses the changes. This can be achieved using the process structure tree (PST) [START_REF] Vanhatalo | Faster and more focused control-flow analysis for business process models through sese decomposition[END_REF]. In the following, we consider that the fragments enclosing the changes are already identified. In this work, we consider a set of basic change patterns (c.f. Table I), based on which complex change patterns can be expressed [START_REF] Weber | Change patterns and change support features -enhancing flexibility in process-aware information systems[END_REF]. We also assume the well-behavedeness of the updates propagated by the business analysts. It means that the graph production on a business process model are consistent with the behavioral requirements.

In the following, we demonstrate how to propagate the changes made on a centralized specification of a web service orchestration to its resulting decentralized partitions. A change operation on the centralized process model is translated into several change operations each related to a partition. We also consider a process model P and its derived partitions {P i } i=1..n according to decentralization function f λ . An activity is assigned to a partition P i only if it responds to criterion λ. Next, we call g λ the function which maps each activity to a partition. We assume that an activity can not be assigned to more than one partition. It should be noted that the Replace change pattern can be replaced by the two consecutive operations Delete and Insert. However, during the change propagation, the number of derived operations resulted from the Replace pattern is less or equal to those derived from the concatenation of the Delete and Insert.

A. Change Pattern: Insert

P (F ′ , entry, exit)
The insertion of new fragment in P implies the insertion of new activities with different criteria, connected through data and control flows. In this paper, we consider the insertion in sequence but can be easily extended to take into consideration the insertion in parallel or with exclusiveness. The first step is then to identify the partitions affected by the change using g λ . To achieve this, we look for each partition which respond to the same criterion of at least one activity of F, •F or F•. Indeed, if we consider two activities a and b in sequence in the centralized process model P, such that they are assigned to different partitions P 1 and P 2 after partitioning. In this case, a and b would communicate through message exchange. If we insert a new activity c between them such it is assigned to a new partition P 3 , then we have also to update the old communication between a and b. Therefore P 1 and P 2 are also concerned by the change. Once all affected partitions identified, the second step consists in computing what to insert in each partition as well as the exact position for insertion. The idea is then to partition the new inserted fragment F according to the same partitioning function f λ and for each sub-fragment determine the exact position. We consider {F i } i=1..k the derived sub-fragments where a subfragment F i should be inserted in partition P i . Note that the insertion may result in the creation of a new partition. To insert F i in P i , we first compute the transitive preset and postset of F i according to λ in P (•T λ F i , T λ F i •). Note that •T λ F i and T λ F i • are directly connected in P i via control or interaction patterns (e.g. in Figure 2, a 0 and a 4 of P 1 are directly linked by interaction patterns while they were not directly connected in the centralized model). Then, the exact position for the insertion of F i in P i is between

•T λ F i and T λ F i •. The problem now is how to connect F i with •T λ F i and T λ F i •.
Indeed, the latter may already have other fragments or activities between them (e.g. two fragments in parallel with the same properties according to λ have the same transitive preset and postset). In this case, we have to identify the relations of F i with •T λ F i , T λ F i • and possibly the fragments between them. For this purpose, we calculate the control paths linking F i to •T λ F i and T λ F i •. Some of the control patterns of these paths may already exist in P i . To deal with this, we use a union function to merge F i with the the fragments that may exist between its transitive preset and postset. Finally, an update is required, if necessary, to update the connections between •T λ F i (T λ F i •) and its postset (preset) which may be on other partitions.

B. Change Pattern: Delete P (F.entry, Fexit)

The delete removes the set of activities enclosed in the fragment F ∈P. These activities are distributed over the partitions and linked through interaction or control patterns. In the centralized model, the deletion of F implies the deletion of its links with its preset and postset and the connection of the latter with each other. In the decentralized model, activities of F are partitioned over partitions and the deletion of an activity a implies the update of its links with a• and •a which may be in different partitions, and possibly with T λ a• and •T λ a which are in the same partition.

To cope with this, we partition F, identify the position of each F i in the respective partition P i and delete it. Indeed, since the partitioning function is idempotent, then if F ∈ P, f λ (F) is a subgraph of f λ (P). In the centralized process

Change pattern

Change actions

Insert P (F ′ , entry, exit) ∀ Fi′ ∈ f λ (F ′), (entryi, exiti)←P ositionOf (Fi′, Pi) ∀ Fi′ ∈ f λ (F ′), Insert P i (Fi′, entryi, exiti) ∀aj ∈ •F ′, update connection(aj , F ′) ∀a k ∈ F ′• update connection(F ′, a k ) Delete P (F .entry, F exit) ∀ Fi ∈ f λ (F ′), (entryi, exiti)←P ositionOf (Fi, Pi) ∀ Fi ∈ f λ (F ′), Delete P i (entryi, exiti) ∀aj ∈ •F , ∀a k ∈ F • update connection(aj , a k ) Replace P (F ′ , F .entry, F .exit) ∀ Fi ∈ f λ (F ), (entryi, exiti)←P ositionOf (Fi, Pi) ∀Fi∈ f λ (F ),Fj ′∈ f λ (F ′). if Pi=Pj , U pdate P i (Fj ′, entryi, exiti) ∀Fj ′∈ f λ (F ′)) s.t. ∄Fi∈ f λ (F ))∧pi = pj , Insertp j (Fj ′, entryj , exitj ) where (entryj , exitj )←P ositionOf (Fj ′, pj ) ∀Fi∈ f λ (F )) s.t. ∄Fj ′∈ f λ (F ′)∧pi = pj , Deletep j (Fi, entryi, exiti) where (entryi, exiti)←P ositionOf (Fj , pi) ∀aj ∈ •F , update connection(aj , F ′) ∀a k ∈ F • update connection(F ′, a k ) U pdate P (a, prop ′ )
if we consider a′ as the updated activity then, if f λ (a) = f λ (a ′ ) then Replace P (a ′ , a.entry, a.exit)

TABLE II CHANGE PROPAGATION ACTIONS model, if •F i (reps. F i •) /
∈F, then we update the decentralized model linking

•F i to F i • instead of F i (reps. F i • to •F i ).
Note that reduction rules may be applied to the changed partitions to eliminate unnecessary control or interaction patterns.

C. Change Pattern: Replace

P (F ′ , F.entry, F.exit)
This pattern replaces an existing fragment F by a new one F ′ in the centralized process model. To propagate this change to the concerned partitions, we decentralize F = {F i } i=1..l and F ′ = {F ′ i } i=1..k using f λ . According to the derived sub-fragments, we figure out two possible scenarios for each fragment of F and F ′ ; sub-fragments of F are either deleted or replaced and sub-fragments of F ′ are either inserted or used to replace existing sub-fragments of F. These scenarios are combined as follows.

• If two sub-fragments F i and F ′ i refers to the same partition P i then we derive Replace Pi (F ′ i , F i .entry, F i .exit).

• If a sub-fragment F i refers to P i such that no F ′ i refers to the same P i , then we derive Delete Pi (F P i .entry, F i .exit).

• If a sub-fragment F ′ i refers to P i such that no F i refers to the same P i , then we derive Insert Pi (F ′ i , entry, exit). Variables entry and exit are (•T F ′ i ).exit and (T F ′ i •).entry respectively. Note that an update phase is required to update the existing links with the modified sub-fragments. This update is similar to the Insert pattern mentioned previously. Formally, the replacement of F i by F ′ i corresponds to the deletion of all objects o ∈ O Fi , edges e ∈ Ec Fi ∪ Ed Fi and data exchanges, and their substitution by the objects, edges and data of F ′ i . Besides, the connection with its preset, postset, transitive preset and transitive postset should be updated.

D. Change Pattern: U pdate P (a, prop ′ )

This pattern updates the properties of one activity (e.g. its security level, its role,etc.). According to a partitioning function f λ , the properties determine to which partition an activity would be assigned. This leads to two scenarios; (i) The new properties prop ′ are invariant with respect to the decentralization criterion (e.g. we change the security level while λ is partitioning according to role), or (ii) prop ′ is variant and then the activity should be moved to another partition. In the latter case, we can either use sequently a Delete then Insert or simply the Replace pattern.

Table II resumes the main and simplified formal actions to achieve the change propagation. In this table, f λ represents the partitioning function, P ositionOf returns the position of a fragment or an activity in a partition, and update connection updates the dependencies links between two activities or fragments. For instance, let's consider two activities a and b in sequence in the centralized process model, such they belong to different partitions after decentralization. Then, if we insert a new activity c between them, we have to update the link between a and b, in the decentralized setting, by two new links (a, c) and (c, b).

E. Use case: Insurance Process Example

To have a better understanding of the change propagation approach, we refer to the claim handling process example and we consider the Figure 3. We remind that we want to replace the fragment F by F ′. As we already mentioned in Section II, only the partitions P 1 and P 3 are concerned by the change. As can be seen in Figure 3, the partitioning of the fragment F ′ leads to two fragments F ′ 1 and F ′ 2 connected by interpartition data and control edges (here we use the partitioning function defined in [START_REF] Fdhila | A flexible approach for automatic process decentralization using dependency tables[END_REF]). The partitioning of the fragment F leads to F 1 which is the same as F since it contains one activity. Since F ′ 1 and F 1 concern the same partition P 1 then we derive Replace(F ′ 1 , F 1 .entry, F 1 .exit). Only F ′ 2 concerns the partition P 3 and then we have to insert it in P 3 . Hence, we compute the position of the insertion which is between Receive sync3 and a 5 : DS. The generated change operation is then Insert(F ′ 2 , Receive sync3, a 5 : DS). However, since F ′ 2 should be in parallel with a 5 , then we enclose both of them with an AN D-split/AN D-join patterns. The change propagation is translated as follows:

Replace P (F ′ , F.entry, F.exit)⇒Replace P (F ′ 1 , F 1 .entry, F 1 .exit) ∧ Insert P (F ′ 2 ,
Receive sync3, a 5 : DS)).

V. EVALUATION OF THE APPROACH

This section presents the properties of our change propagator. Given a well-behaved structural update on the centralized process model and the derived decentralized sub-processes, our approach automates the change forward propagation that consistently transforms the update on the source into the related target partitions, as presented in Section IV.

A. Properties and Discussion

As described in Definition 4, the process partitioning is a total function of the type f λ : π → {π i } i=1..n that takes a source centralized process P and produces a target set of decentralized partitions {P i } i=1..n . It establishes a consistency relation, denoted C ⊆ π × {π i } i=1..n between the source and the target process models. Since the decentralization algorithm is idempotent, it can be applied multiple times without changing the result, then C is a total function. (P, f λ (P)) ∈ C means that P was previously decentralized into f λ (P). Next, we use {P i } instead of {P i } i=1..n . We use ∆ π : π ⇀ π and ∆ π : {πi} ⇀ {π i } as an abbreviation for the update types respectively on the processes and on the partitions. They represent the space of all partial functions describing the changes on each of the centralized and decentralized process models and which can be described by productions, i.e. the change operations defined in Section IV. Now, consider a source change δ that alters P to P ′ . The problem is to translate the well-behaved change δ of the source process into a well-behaved changes δ i on the target partitions, such that the application of both updates results in consistent process models. The change propagator that provides this function is of the type pr : π × ∆ π × {π i } → {∆ πi } × {π i }. For P ∈ π, δ ∈ ∆ π and f λ (P) ∈ {π i }, it computes the changes on the partitions (i.e {δ i } ∈ {∆ πi }) such that the updated models are consistent (i.e. (δ(P), {δ i (P i )}) ∈ C).

In our semantics, a process and its decentralization result (i.e., the derived partitions) are specified with graphs as introduced in Section II. Then, a change on a process implies a modification on the graph structure which can be expressed by graph rewriting rules [START_REF] Biermann | Precise Semantics of EMF Model Transformations by Graph Transformation[END_REF]. Formally, given a graph G, a graph rewriting rule (i.e., also called production) consists of injective morphisms of the form δ G : L → R that transform a source graph L into a target graph R. In order to apply this rewrite rule to the initial graph G, a match m : L → G is needed to specify which part of G is being updated. Then, the application of δ G to G via a match m for δ G is uniquely defined by the graph rewriting G ⇒ δ G ,m H. This rule application induces a co-match m ′ : R → H which specifies the embedding of R in the result graph H.

The most important criteria is change propagation correctness: a graph-based change propagator must return consistent process models. In this paper, we suppose that when applying a rewriting rule to a given graph G, it is enough to consider the case where the morphisms that matches L to G is injective, and that the match m is a total label-preserving, type-preserving and root-preserving [START_REF] Biermann | Precise Semantics of EMF Model Transformations by Graph Transformation[END_REF] graph morphism. However, to be correctly applied, the productions must satisfy the structural consistency of the centralized process constraints. Note that we assume the well-behavedeness of the updates propagated by the designers. It means that the graph production on a centralized process is consistent with the behavioral requirements, and after the production the process remains structured. Moreover, the fragment or process partitioning preserves by definition the well-behaved process semantic. Secondly, a fundamental law is that the change propagation should be deterministic: for each centralized process model input there is a unique decentralization result. In our case, the change propagator is modeled by a mathematical function. Given the same pair of the centralized and its decentralized models, and a finite set of changes (i.e., bounded within the SESE fragment) on the source centralized process model, our propagator produces the same changes on the target partitions.

Finally, to adapt f λ (P) to the changes induced by δ without re-decentralizing afresh the entire updated centralized process model, i.e. f λ (δ(P)), our change propagator enforces an inplace synchronization between δ ( P) and f λ (P) by translating the updates δ into well-behaved target updates (δ i ) to get (δ i (P i ))) consistent with δ(P). The change translation is a partial function of the type ∆ π ⇀ {∆ πi }. Indeed, the propagation of δ does not affect all partitions which make the complexity of our approach lower than the re-decentralization of the whole process coupled with diff-based methods [START_REF] Biermann | Precise Semantics of EMF Model Transformations by Graph Transformation[END_REF].

B. Proof of Concepts Prototype

The change propagator has been implemented and integrated with our previous development of the partitioning algorithm [START_REF] Fdhila | A flexible approach for automatic process decentralization using dependency tables[END_REF] as an extension to a BPMN Editor [START_REF] Yaoqiang | Open source bpmn 2.0 modeler: bpmn.yaoqiang.org[END_REF]. This BPMN editor is based on a graph visualization library, and it is used to model a source centralized process model, for instance the structured process of Figure 1. After applying our partitioning algorithm, we obtain the partitions depicted in Figure 2 using the graph library. Moreover, we have developed a filter that logs the process model editing operations presented in Section IV. Actually, the specification of the entry and the exit of a fragment is performed manually, for example as depicted in Figure 3, but it can be easily automated. The change propagation algorithm is implemented in the DROOLS [START_REF]Drools[END_REF] inference engine, and it automatically computes the graph editing operation sequence that manipulates the partitions.

VI. RELATED WORK

The topic of this paper is change in business processes. There is a multitude of approaches dealing with related issues, ranging from ad-hoc changes of single process instances to evolutionary changes of the entire process description [START_REF] Rinderle | Correctness criteria for dynamic changes in workflow systems -a survey[END_REF].

In a centralized process setting, all design and runtime information are available (e.g., process model and state of running process instances) and the process orchestration is not fragmented. In this basic setting, major challenges are correctness of the applied changes, efficient migration of running process instances to modified process descriptions, as well as proper inclusion of users [START_REF] Schonenberg | Process flexibility: A survey of contemporary approaches[END_REF], [START_REF] Rinderle | Correctness criteria for dynamic changes in workflow systems -a survey[END_REF]. Nowadays, there are even fully adaptive process management systems available, e.g., AristaFlow [START_REF] Dadam | The ADEPT project: A decade of research and development for robust and flexible process support -challenges and achievements[END_REF]. The main difference of the approach presented in this paper is obviously the fragmentation of the process orchestration, hence imposing new questions when compared to the central setting. However, many things can be transferred from the central case such as the need for correctness considerations and the implementation of change patterns as proposed in [START_REF] Weber | Change patterns and change support features -enhancing flexibility in process-aware information systems[END_REF] for decentralized process settings.

In the decentralized setting, [START_REF] Vanhatalo | Faster and more focused control-flow analysis for business process models through sese decomposition[END_REF] presents a formal model for a distributed workflow change management (DWFCM) that uses a rules topic ontology and a service ontology to support the needed run-time flexibility. The approach aims to generate a new workflow that is migration consistent with the original workflow. This work is different from our proposal, since they do not seek to propagate a pre-defined changes on a centralized process to that on the derived partitions. In [START_REF] Dahman | Towards consistency management for a business-driven development of soa[END_REF] the authors present a unidirectional model incremental transformation approach. Its central contribution is the definition and the realization of an automatic synchronizer for managing and reestablishing the structural consistency of heterogeneous source and target models. Other approaches addressing flexibility and change in decentralized or -as referred to in these papersdistributed process settings focus on the ad-hoc modification of single process instances at runtime [START_REF] Reichert | Supporting ad-hoc changes in distributed workflow management systems[END_REF], [START_REF] Atluri | Handling dynamic changes in decentralized workflow execution environments[END_REF]. The difference to our work presented is that these approaches do not physically change the partitions but just migrate some instances.

In WS choreographies there are few approaches addressing change and evolution . In DYCHOR [START_REF] Rinderle | Evolution of process choreographies in DYCHOR[END_REF], for example, it is investigated how a change initiated at one partner's side can be propagated to the other partners of the choreography. One similar approach is presented in [START_REF] Fdhila | Change propagation in collaborative processes scenarios[END_REF] where a structured model using RPST is used to model choreographies as well as the public and private views. The authors investigated structural and semantical propagation and dialed with the transitive effects of the changes. At a general level, techniques for evolving partitioned process settings exploit the knowledge on the different partitions such that they cannot be applied to choreographies where this knowledge is not at hand. Vice versa, techniques for evolving choreographies (e.g., [START_REF] Rinderle | Evolution of process choreographies in DYCHOR[END_REF], [START_REF] Fdhila | Change propagation in collaborative processes scenarios[END_REF]) could be applied to partitioned process settings, however this would require the construction of artificial private and public views as well as choreography model resulting in an unnecessary overhead.

VII. CONCLUSION

In this paper, we presented an approach to propagate changes form a centralized process to its derived decentralized partitions. The proposed approach is based on four basic change patterns and computes the partitions involved in the change as well as the regions to be modified. It also translates the initial change operation on the centralized process into several change operations for the partitions affected by the change. The introduced change operations can be composed to give rise to more complex change patterns with enhanced semantics (e.g., move of fragment, refactoring of fragments: splitting and merging). In worst case, the propagation of changes is equal in complexity to the re-decentralization of the whole process (i.e. the smallest fragment that encloses the change is equal to the process model). As a future work, we plan to study the impacts and management of many running versions of the partitions affected by the change.

Fig. 2 .

 2 Fig. 1. Insurance Claims Handling Process Example Partition P1

  T λ a 4 = {a 0 } Change pattern Description Insert(fragment,entry,exit)

Fig. 3 .

 3 Fig. 3. Change Propagation for the Insurance Example


G Medina Oliva
email: gabriela.medina-oliva@cran.uhp-nancy.fr

B Iung

L Barberá

P Viveros
email: pablo.viveros@usm.cl

T Ruin

Root Cause Analysis to Identify Physical Causes

Keywords: Bayesian Network, root cause analysis, system performances

This paper proposes a methodology to develop a root cause analysis (RCA) tool which purpose is to identify the physical bad actors that cause performances deviations of an industrial system. This model is based on the integration of several RCA tools such as fault tree, FMECA and HAZOP. The objective is to evaluate and identify perturbation factors in order to eliminate them and to optimize the enterprise maintenance performances. The methodology is formalized from functional, dysfunctional and informational studies of the technical industrial systems. This methodology is applied, for modeling a water heater system to identify the factors that causes deviation on its reliability and its output flow attributes.

INTRODUCTION

Several methods have been proposed in the literature for planning activities for industrial plant maintenance. Proactive maintenance utilizes tools such as Root Cause Failure Analysis (RCFA), Failure Modes and Effects Analysis (FMEA), Critical Analysis (CA), Acceptance Testing and Aging Exploration (AE). Some authors even make a distinction and identify a sub-branch in the Proactive Maintenance, called Radical Maintenance (RM), which involves the detection and prediction of root causes of failures, and subsequently take appropriate actions to eliminate the root causes or conditions that lead to them [START_REF] Gao | Informatization and intellectualization of the engineering asset[END_REF].

There is a wide variety of tools and methods for determining the root causes of certain events or failures (Barberá et al., 2010). They vary in complexity, quality of information required and applicability of their results. In general, the most commonly used are the 5 Why Analysis, Change Analysis, Current Reality Tree (CRT), Failure Modes and Effects Analysis (FMEA), Fault Tree Analysis (FTA), Pareto Analysis, Bayesian Inference and Ishikawa Diagram. These methodologies have substantial differences, and they can be categorized into qualitative (5 Why Analysis, Ishikawa Diagram, HAZOP, among others) and quantitative (Bayesian Inference, Pareto Analysis, Fault Tree Analysis [START_REF] Gano | Apollo Root Cause Analysis -A New Way of Thinking[END_REF] and [START_REF] Rossing | A functional HAZOP methodology[END_REF]. While qualitative methods are generally performed in the form of brainstorming; quantitative methodologies can even use complex mathematical methods. The importance of using Root Cause Analysis tools in Maintenance relies in the need to understand the main causes of failure on which Management or Operations may have some control, so that they can avoid the chronic failure and returning to a specified plan of action.

The flow chart below (Figure 1), based on the work of (Barbera et al., 2010) and [START_REF] Li | Study and application of Reliability-centered Maintenance[END_REF], shows the location of various methods of root cause analysis in a model of maintenance management by stages. Pareto Analysis is at the stage of critical equipment hierarchization, because in conjunction with the criticality matrix can help to determine which equipments are critical at a systemic level. FMEA can be used at the stage of Weaknesses Analysis of critical equipment, where an assessment of causes, failure modes and effects can be relevant. Critical Analysis helps to determine whether the weaknesses of critical equipment are significant in the system performance. FTA or Bayesian inference can be used to perform a more complex analysis for determining the root causes of equipment failures and critical weak points. For all the above, it is worth to note that the optimum performance of the methodologies is achieved when used properly for a particular requirement at a specific stage within the framework of the overall maintenance management process.

ROOT CAUSE ANALYSIS MODELS (RCA)

The root cause of a failure can be defined as the basics causes which can be reasonably identified and on which management has control [START_REF] Paradies | Root Cause Analysis at Savannah River Plant[END_REF]. The literature that supports this approach determines that there are three levels of root cause of the failure in a system:

-Physical Root Cause: Equipment failure caused by physical reasons.

-Human Root Cause: Equipment failure caused by human intervention.

-Latent Root Cause: Equipment failure caused by organizational-level decisions that trigger a fault event.

Failure Analysis (FA) or Root Cause Analysis (RCA) consists of examining in detail the items reaching the fault state to determine the root cause of it and improving system reliability (Sikos and Klem, 2010). This process identifies causal factors using a structured approach with techniques designed to achieve a proper orientation, thereby allowing the identification and resolution of problems. Its implementation eliminates or minimizes those root causes that can generate recurrent failures, not focusing on the actual consequences of failure [START_REF] Doggett | A statistical comparison of three root cause analysis tools[END_REF]. Within root cause analysis methods, four groups can be distinguished (American Institute of Chemical Engineers, 1992). Below the most used RCA methodologies in Reliability Engineering are:

-Failure Modes and Effects Analysis and Criticality (FMECA) [START_REF] Cai | Application manual of modern machine design method[END_REF], [START_REF] Li | Study and application of Reliability-centered Maintenance[END_REF].

-Fault Tree Analysis (FTA).

-Cause and Effect Diagram (CED) [START_REF] Doggett | A statistical comparison of three root cause analysis tools[END_REF].

-Hazard and operability study HAZOP [START_REF] Rossing | A functional HAZOP methodology[END_REF].

-Bayesian Inference.

Depending on the type and depth of analysis to be performed, it is necessary to evaluate each method to use only the one that best suits the needs addressed. While all methods have the ability to define the problem in question, Cause and Effect Diagrams do not show any causal relationships between the primary effect and the root causes nor are they able to deliver a clear path to the root causes, as only isolated causes are categorized or sorted into groups which produce a primary effect. However, they have a low level of requests for information and resources and are relatively easy to use [START_REF] Gano | Apollo Root Cause Analysis -A New Way of Thinking[END_REF]. The HAZOP study is an analysis structured as a brainstorming and developed by people highly internalized into the problem to solve, so it is highly dependent on the experience of managers and should be conducted in multiple sessions, requiring time and other resources. Their advantage lies in the plans developed to prevent recurrence [START_REF] Rossing | A functional HAZOP methodology[END_REF]. The FMEA is effective to find the causes of component failure, however, loses its ability to solve complex problems being unable to establish causal relationships beyond the failure mode being analyzed. The Fault Tree Analysis is a quantitative method that works extremely well in engineering problems, finding causes related to the original design of the system, identifying possible scenarios and selecting appropriate solutions, whenever they do not include human factors [START_REF] Gano | Apollo Root Cause Analysis -A New Way of Thinking[END_REF]. For its part, the Bayesian Networks (despite of requiring more resources and have less ease of use) has great ability to establish causal relationships for a large number of variables and is suitable as a support for making decisions to prevent recurrence. Its structure facilitates the combination of prior knowledge, obtained either causally or from observed data. Bayesian networks can be used to find causal relationships, to facilitate understanding and the best way of analyzing the problem and to predict future events [START_REF] Zitrou | Bayes geometrics calling model for common cause failure rates[END_REF], (Ben and Gal, 2007). Below, Table 2 presents a comparative summary table based on a set of criteria for the methods commonly used in RCA. [START_REF] Cai | Application manual of modern machine design method[END_REF], [START_REF] Li | Study and application of Reliability-centered Maintenance[END_REF], [START_REF] Doggett | A statistical comparison of three root cause analysis tools[END_REF], [START_REF] Dei | A Bayesian network approach to root cause diagnosis of process variations[END_REF], (Ben and Gal, 2007), [START_REF] Rossing | A functional HAZOP methodology[END_REF], [START_REF] Gano | Apollo Root Cause Analysis -A New Way of Thinking[END_REF].

Cause and Effect Analysis

High

    Low       HAZOP High       Low     Bayesian Networks High        Low    FMEA High      Low      Fault Tree Analysis High       Low    

RCA Methodology / Characteristics

Ability Using a single method may lead to an incomplete analysis, therefore, in some specific cases may be appropriate integration tools Root cause analysis, especially when dealing with complex systems, better results can be achieved [START_REF] Hitchcock | Integrating Root Cause Analysis Methodologies[END_REF]. In fact one of the common combinations to support the RCA analysis is FMECA and FTA [START_REF] Li | Study and application of Reliability-centered Maintenance[END_REF].

This research proposes a model representation of the system functioning, malfunctioning, and identification of physical causes of failure based on the integration of Bayesian networks, fault trees, FMEA and HAZOP study based on the statements of certain variables, given its dependencies, may trigger a state or event of failure.

KNOWLEDGE FORMALISATION

The proposed modeling approach consists, from functioning systemic analysis, (a) in representing the abnormal operation (malfunctioning) [START_REF] Muller | Formalization of a new prognosis model for supporting proactive maintenance implementation on industrial system[END_REF], (Weber and Jouffe 2006), (b) in representing the informational point of view and then (c) in formalizing and unifying these results in a unique model by means of a Bayesian Network.

System functioning modeling

The functional modeling of an industrial system consists in formalizing, by qualitative causal relationships, the interactions between the functions performed by each of the sub-systems until the component level (elementary functions). This type of formalization can be supported by a method such as the Structured Analysis and Design Technique (SADT). The system functioning modeling is based on the principle of activity and sub-activities until elementary activities, supported by components, are emerging; plus the notions of system's theory [START_REF] Mayer | Integrated manufacturing system meta-modeling at the shop-floor level[END_REF]. Each activity (Figure 2) fulfils finality, which is to modify a "product" carried out by the manufacturing system. It produces or consumes flows such as "Having to Do" (HD) materializing the Input/Output (I/O) finality, "Knowing How to Do" (KHD) materializing the I/O knowledge, "being Able to Do" (AD) representing I/O energies, resources, activity support and finally "Wanting to Do" (WD) materializing the I/O triggers. For example, the output flow WD is a report (RWD) that represents the informational result of the Input HD product flow transformed by the activity.

System Flow Informational Modeling

Each flow is characterized by the state of the variables related to its morphologic, spatial or temporal properties of the objects that composed it (i.e. objects and flow of objects) and by the flow variables that are express as the quantity of objects per time unit (such as a flow rate) [START_REF] Mayer | Integrated manufacturing system meta-modeling at the shop-floor level[END_REF]. So, the state variables and the flow variables can be regroup in one denomination called flow attribute. In that way, to measure the performance of a function, it is assume the hypothesis that it can be evaluated directly from the flow attributes. The object representation allows to identify these flow properties or attributes, and it can be represented on an entity-relationship diagram.

System Malfunctioning Modeling

The functional model could be used to develop by duality the malfunctioning analysis, whose objectives are to identify the degraded and failure states of the components and of the flows, and then to determine the causes and consequences of these states on the industrial system behavior.

The degradation is spread to the rest of the system through the flow exchanging between processes, according to the causality principle:

-The potential cause of the degradation of a process is the deviation of an input flow attribute or the deterioration of its support. -Contrarily, the potential effect of the degradation of a process is the deviation of an attribute of its output flows or its support (Figure 2).

The industrial system is in degradation or failure mode when there is a flow deviation and/or a deterioration of the supports of the process: the flow deviation is linked to the qualitative or quantitative deviation of a flow attribute compared to its nominal value and the support deterioration is related to the apparition of a physical mechanism of deterioration. When dealing with several functions e.g. two functions, the deviation on the output flow in function 1 (consequence), will become the cause of the deviation of the next output flow function (function 2)… This will lead to causality relations (Figure 3) [START_REF] Léger | Methodological approach to modeling of degradation detection and failure diagnosis in complex production systems[END_REF].

Consequences of malfunctioning (deviation on the output flow and effect on the

. Relations between different abstraction levels

Moreover when dealing with different abstraction levels, the degradation cause in a high abstraction level (e.g. A0) is the degradation on the lower level (e.g. A3) (Figure 3). On the other way, the consequence of degradation in a low abstraction level (e.g. A3), is the degradation of the function of higher abstraction level, in this case the function (e.g. A0). This relationships defined by Léger and Iung, (1998), leads to a causality chain of flows within a process. This chain will allow us to perform RCA in order to identify the physical causes that produce an event. For this aspect, there are used the following dependability methods:

-FMECA: to model failure modes of the functions, failure modes of the components, failure consequences (impact on the flow and other functions) and the criticality of the failure. -HAZOP: to model flow deviation, cause of flow deviation and failure consequences (impact on the flow).

The dysfunctional analysis also involves the identification of groups of elementary events or combination of events that lead to a failure event, as well as, the identification of the logical links between essential components to perform the system mission. For this aspect, the following dependability methods are used: Fault tree (FT), reliability block diagram or Bayesian networks (BN) to model the logical links of events or logical links between components.

PROPOSITION OF BAYESIAN NETWORKS (BN)

BN appear to be a solution to model complex systems because they perform the factorization of variables joint distribution based on the conditional dependencies. The main objective of BN is to compute the distribution probabilities in a set of variables according to the observation of some variables and the prior knowledge of the others. The principles of this modeling tool are explained in [START_REF] Jensen | An Introduction to Bayesian Networks Editions[END_REF] and [START_REF] Pearl | Probabilistic reasoning in intelligent systems: networks of plausible inference[END_REF].

Recall of BN characteristics:

A BN is a directed acyclic graph (DAG) in which the nodes represent the system variables and the arcs symbolize the dependencies or the cause-effect relationships among the variables. A BN is defined by a set of nodes and a set of directed arcs. A probability is associated to each state of the node. This probability is defined, a priori for a root node and computed by inference for the others.

A B

Figure 5. Basic example of a BN Table 3. A Priori probabilities of the node A

The computation is based on the probabilities of the parents' states and the conditional probability table (CPT). For instance, let's consider two nodes A and B; with two states (S *1 and S *2 ) each; structuring the BN (Figure 5). The a priori probabilities of node A are defined as (Table 3). A CPT is associated to node B. This CPT defines the conditional probabilities P(B|A) attached to node B with a parent A, to define the probability distributions over the states of B given the states of A. This CPT is defined by the probability of each state of B given the state of A (Table 4). Thus, the BN inference computes the marginal distribution P(B=S B1 ):

) ).P( P( ) ).P( P( ) P(

2 2 1 1 1 1 1 A A B A A B B S A S |A S B S A S |A S B S B = = = + = = = = = 1(1)
BN establishes cause-effect relationships between these factors for modeling their interactions. For example, BN can model the effect of maintenance actions and barriers' impact on the global system risk analysis (Leger, 2009). Besides, a general inference mechanism that permits the propagation as well as the diagnostic is used to collect and to incorporate the new information (evidences) gathered in a study. The Bayes´ theorem is the heart of this mechanism and allows updating a set of events´ probabilities according to the observed facts and the BN structure. To compare BN with other root cause analysis method such as the Fault Tree (FT), when multiple failures can potentially affect the components with several different consequences on the system (which is usually the case for risk and dependability analyses), the model needs a During the process operation, when there are abnormal changes in the conditions and they are not identified and corrected, they can generate events known as failures. A causal representation of the facts through the BN generates a chain of events and transitions, which are interesting for Root Cause Analysis under uncertainty and for the purpose of supporting decision making on appropriate corrective.

Bayesian networks have proved being useful for a wide variety of predictive and monitoring purposes. Related applications have been documented in the medical and image processing, among other areas [START_REF] Dei | A Bayesian network approach to root cause diagnosis of process variations[END_REF], [START_REF] Medina-Oliva | Bayesian Networks Applications on Dependability, Risk Analysis and Maintenance[END_REF]. In manufacturing has also been used as a method of monitoring and diagnosis in real time to identify component failures in multi-stage process [START_REF] Wolbrecht | Monitoring and diagnosis of a multi-stage manufacturing process using Bayesian Networks[END_REF].

Quantification of the causality relationships: Unification in a BN model

To model the different aspects of a system in a BN, it is required to take into account the different types of knowledge previously identified. Also, to integrate this knowledge within a BN, it is incorporated as new variables of a network or as a part of the required information to complete a conditional probabilities table (CPT) for these variables. The knowledge integration is based on the following rules:

1.-Formalization of the network structure from the functional analysis (input and output variables of a process). The input and output variables are defined from the functional analysis (different kinds of input flows on the SADT) and from the informational analysis (input flow attributes on the entity-relationship diagram).

2.-Definition of the input and output variable states, as it is described in the malfunctioning analysis. The states of input and output variables are defined on the malfunctioning system analyses of the system, such as failure modes or flow deviations (methods FMEA or HAZOP).

3.-Definition of the conditional probabilities given in the malfunctioning analysis (logical links between components), combinatory logic or expertise.

The conditional probabilities are related to the combinatory logic, to the frequency of failures defined on the malfunctioning analysis or to the expert's judgment. Moreover, to calculate the conditional probability of support of a function which is supported by two or more parallel components, it is possible to obtain the reliability of the support (AD support flow) of this function by means of a dynamic bayesian network, fault tree or a reliability block diagram. In Figure 7 it is shown how to integrate in a CPT the variables and the conditional probabilities according to the different system' point of view: functioning view, malfunctioning view and the informational view. Also, it is important to know that: -To represent the input flow (energy, information or material flow) of a function, there could be several variables for each flow.

-To define an output flow, there are necessary several CPT based on the input flows. There must be one CPT for each output flow.

Figure 7: Knowledge integration in a CPT

BN as a tool for the identifying the physical Root Cause Failure

Once the problems with highest significance and less expected effort are identified (Crespo, 2008), a diagnostic phase should be started. The BN allow to verify which are the most probable variables that cause a problem are. The idea is to verify which input flows are more likely to be in an abnormal functioning that caused performances deviations.

APPLICATION

To show the feasibility of the proposed knowledge formalization and the integration of the different kinds of knowledge into a BN, an application is illustrated. A classical example of a water heater process is presented in order to assess the reliability and the compliance of the output flow attributes. The objective of the thermal process (shown in Figure 8) is to ensure a constant water flow rate with a given temperature. The process is composed of a tank equipped with two heating resistors R1 and R2. The system inputs are the water flow rate Qi, the water temperature Ti and the heater electric power P that is controlled by a computer. After measuring process parameters by the corresponding sensors, the outputs are the water flow rate Qo and the temperature T.

System Functioning Modeling: SADT model Figure 9 presents the diagram A-0 of the SADT related to the process. This figure depicts the interaction between the process and the external environment through the AD, HD and RHD flows. The main functionality of the process is to provide warm water. System Malfunctioning Modelling: FMEA, HAZOP, dynamic bayesian networks. For this case, the study is applied to the function "to heat water", so the component of this function is indexed in the FMEA analysis (Table 5). The failure modes of the component are defined as well as their effects. The causes are linked with the component states or the unavailability of the electric energy required to supply the component.

Then, it is necessary to study the possibilities of flow deviation and their causalities through an HAZOP study (Table 6). The flow deviation is linked to the qualitative or quantitative variation of an attribute compared to its nominal value and it is a complementary study of the FMEA since the mal-functioning of an industrial system is caused when there is a flow deviation (HAZOP) and/or a deterioration of the supports of the process (FMEA). Since the heating resistors "R1" and "R2" work on parallel to fulfill the function "to heat water", it is possible to obtain the reliability of the support (AD support flow) of this function. The state of each heating resistor was defined as follow: 80% is available, 5% works in a maximum level, 5% there is power loss in it and 10% the heating resistor is unavailable. So with this information, it is possible to build a dynamic bayesian network as shown in the Figure 10. The result of support reliability of the function "to heat" shows that the AD support flow of this function is available 92% of the time, 5% works in a maximum level, 0,75% there is power loss in them and 2,25% the heating resistors are unavailable (results obtained with the software Bayesialab). Moreover, it could be possible to use fault trees or reliability block diagrams in these cases. They can describe the logical links of events in order to obtain the reliability of the support of a function in cases where there are redundancy or k/n relations between components. Their limitation is that they represent boolean variables, that is why it was not appropriated for this example.

Failuremodes of the function Stateof the supports Flow deviation

Table 5: Extract of the FMEA of the function "to heat water" Table 6: Extract of the HAZOP of the function "to heat water" This part of the CPT shows the link between the information integration available in the CPT and a part of the SKOOB language that allows to convert knowledge into a PRM.

a. As a diagnosis model: The diagnosis starts when the "RWD to heat water" is in abnormal functioning (state= maximum level of heating) for example. Initially, the input flows are checked to see which is the variable that has more probability of been in an abnormal functioning. For this case the water level has a probability of been in an non-nominal state of 4,03%, the electric power has 0%, the order T 0% and the heating resistors of 99,59%. The checking leads suspect that the heating resistors are the most probable cause that the function is not realized, because its probability of been in an abnormal functioning is the highest (99,59%) (Figure 13).

CONCLUSIONS AND FURTHER WORK

The proposed model based on the functioning (SADT), malfunctioning (FMECA, HAZOP analysis, 2TBN, FT) and informational studies (entity-relationship diagram) help to improve the automatic generation of a causality chain to identify the main causes that produce performances deviations. Also this methodology helps to integrate deductive and inductive methods that complement the information in order to improve the identification of "bad actors" affecting the system.

The difference of the BN when comparing with other classical methods is their capacity to represent this model allow to deal with issues such as prediction or diagnostic optimization, data analysis of feedback experience, deviation detection and model updating and multi-state elements. However, this methodology is a first step to identify physical causes in order to improve performances on the weak points of high impact equipments. There are other kinds of causes that also impact the performances such as the human and latent causes, so as further work; some other factors should be incorporated in the model such as human and latent causes.

Figure 1 .

 1 Figure 1. Location of RCA methodologies in Maintenance Management

  be transformed by function KHD allowing to know how to do function AD -having to be recycled -A deviation in the output flow

Figure 2 .Figure 3 .

 23 Figure 2. Technical Knowledge Formalization

Figure 6 :

 6 Figure 6: Network structure from functional and informational analyses

Figure 8 :

 8 Figure 8: Water heater process Figure 9: Diagram A-0 of the SADT Then the diagram A0 describes the four functions that are necessary to perform the main task of the system: -to transform pressure into Qi (A1), -to control V and P (A2), -to transform Qi into H and Ti into T (A3), -to transform H into Qo (A4).

  does not heat. No electric power (AD2) Deviation in the storage water (HD) No Order T (KD) T sensor is down Heating power loss Temperature lower than desired Power loss in the heating resistor

Figure 10 :

 10 Figure 10: DBN of the parallel heating resistors

Figure 11 :

 11 Figure 11: Extract of the entity-relationship representation of the flows of the "to heat water" functionUnification of Technical knowledge in a PRM modelFinally, it is shown the integration of the previous kinds of knowledge within the CPT of the variable: "water temperature" and its transformation into the SKOOB language (Figure12).

Figure 12 :

 12 Figure 12: Knowledge integration of the variable "Water temperature" in a CPT

Figure 13 .

 13 Figure 13. Bayesian Network of the water heater process

Table 1 .

 1 Classification of RCA techniques in groups, based on their approach

Root Cause Analysis Groups Description Deductive

	Non system	Non-oriented concepts and techniques as the previous ones. (Example: Change Analysis, Human Error
	oriented	Study Probability).
	techniques

This Approach involves reasoning from general to specific (Example: Fault Tree Analysis). Inductive This Approach involves reasoning from individual cases to general conclusions, providing a comprehensive approach (Example: Cause and Effect Analysis Diagram, HAZOP). Morphological Method based on the structure of the system under study. It is centered on the potentially dangerous items, focusing on factors that have the greatest influence on the system safety. (Example: Accidents Evolution, Barrier Techniques, Job Safety Analysis).

Table 2 .

 2 Comparison of several RCA methodologies

Table 4 .

 4 CPT of the node B given the node A.

		A	S A1	S A2
	B	S B1 S B2	P(B=S B1 |A=S A1 ) P(B=S B2 |A=S A1 )	P(B=S B1 |A=S A2 ) P(B=S B2 |A=S A2 )

  of multiple state variables. In this context, FT are not suitable. Another constraint is that the FT model is limited to assess just one top event. In contrast BN allow similar capabilities to the FT with the advantages of a multi-state variable modeling and the ability to assess several output variables in the same model.[START_REF] Castillo | Tail uncertainty analysis in complex systems[END_REF],[START_REF] Bobbio | Improving the analysis of dependable systems by mapping fault trees into Bayesian networks[END_REF], and[START_REF] Mahadevan | Bayesian networks for system reliability reassessment[END_REF] present a relevant contribution in which they explain how FT can be translated to BN, maintaining its Boolean behavior.

	A	S A1 S A2	P(A=S A1 ) P(A=S A2 )

representation

Acknowledgments

The research work was performed within the context of iMaPla (Integrated Maintenance Planning), an EUsponsored project by the Marie Curie Action for International research Staff Exchange Scheme (project acronym PIRSES-GA-2008-230814 iMaPla). From the French laboratory, the authors wish to express their gratitude to the French National Research Agency ANR for the financial support of the Structuring Knowledge with Object Oriented Bayesian nets SKOOB project. Ref. ANR PROJET 07 TLOG 021 (http://skoob.lip6.fr).