ARTICLE IN PRESS

Reliability Engineering and System Safety 93 (2008) 234253

www.elsevier.com/locate/ress

Formalisation of a new prognosis model for supporting proactive

maintenance implementation on industrial system
Alexandre Muller, Marie-Christine Suhner, Beno t Iung
Centre de Recherche en Automatique de Nancy (CRAN), Nancy Universite, UMR 7039 CNRSUHPINPL, Faculte des Sciences1er CycleBP239,
54506 Vandoeuvre-Les-Nancy Cedex, France
Received 13 February 2006; received in revised form 10 October 2006; accepted 6 December 2006
Available online 7 January 2007

Abstract

The importance of the maintenance function has increased because of its role in keeping and improving system availability and safety,
as well as product quality. To support this role, the maintenance concept has undergone several major developments that have led to
proactive considerations mainly based on a prognosis process, which normally allows selection of the best maintenance action to be
carried out. This paper proposes the deployment and experimentation of a prognosis process within an e-maintenance architecture. The
deployment follows a methodology based on the combination of both a probabilistic approach for modelling the degradation mechanism
and of an event one for dynamical degradation monitoring. The feasibility and benets of this new prognosis process is investigated with
an experiment using a manufacturing TELMA (TELe-MAintenance) platform supporting the unwinding of metal bobbins.
r 2007 Elsevier Ltd. All rights reserved.

Keywords: Proactive maintenance; Prognosis; Degradation; Process approach; Dysfunctional analysis; Dynamic Bayesian network

1. Introduction is regarded as the key element for acting on the opera-

The growth in awareness of sustainable development
practices in industry has imposed on industrial companies
a need to integrate into their development strategy not only
the current economical nality but also some social and
environmental requirements [1]. These requirements are
then, at least, passed on to the life cycle of the product and
production system. For example, in the operation phase of
the production system, the sustainability objective is
mainly materialised at the manufacturing execution system
(MES) level through the concept of system maintaining in
operational conditions (SMOC). This concept is close to
that of integrated logistic support and its purpose is to
satisfy the primary mission for which the system was
designed and used (i.e., to maintain the expected perfor-
mance). Thus, SMOC engineering is considered as an
integrated part of the system engineering process /http://
www.incose.org/S. SMOC implements concretely a set of
logistics means and processes such as maintenance, which
Corresponding author. Tel.: +33 3 83684438.
E-mail address: Benoit.iung@cran.uhp-nancy.fr (B. Iung).
tional requirements to carry out the global system
performance [2].
Nevertheless, it is difcult to control global performance
because the system environment is changing, its function-
ing mode is dependent on product ow and component
ageing continuously modies the system characteristics.
To address these new constraints, the current SMOC
structure must evolve into new more cooperative and
proactive forms that are capable of anticipating the
performance deviation. Thus, the maintenance process
has undergone several major developments that have led to
proactive considerations and the transformation of the
traditional fail and x practices into the predict and
prevent e-maintenance methodology [3]. The anticipation
action, which characterises this proactive maintenance
strategy, is mainly based on monitoring, diagnosis,
prognosis and decision-making modules. The implementa-
tion of these modules within a unique system ends in an
integrated system of proactive maintenance (ISPM) [4].
Nevertheless, despite being facilitated by the emergence of
information and communication technology (ICT), the
ISPM development encounters difculties with regards to

0951-8320/$ - see front matter r 2007 Elsevier Ltd. All rights reserved.
doi:10.1016/j.ress.2006.12.004
 ARTICLE IN PRESS
A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253
industrial constraints because of the lack of methods and
tools for modelling and integrating these fundamental
maintenance processes. This is even true for the prognosis
process, given its prediction capabilities [5]. Thus, our
contribution aims at formalising the generic prognosis
process for a methodology that combines both a probabil-
istic approach for (system) degradation mechanism model-
ling and an event-based one for dynamical degradation
monitoring. Indeed, prognosis has to analyse the impact of
degradation on the component itself and on the other
elements of the production system to predict system
failures and investigate (future maintenance) actions for
satisfying the primary mission (availability, productivity,
safety, etc.). Accordingly, it enables one to offer a
maintenance-aided decision-making tool capable of assist-
ing in selecting the best maintenance strategy.
Following this introduction, Section 2 outlines a clear
statement on the prognosis process. From this state of the
art, Section 3 describes the attack we proposed for a new
formalised prognosis in terms of prognosis modelling
concepts and its implementation mechanisms within an e-
maintenance architecture. The application and feasibility
of this prognosis deployment on a subset of the TELMA
experimental platform are shown in Section 4. Finally, a
review and conclusions are developed in Section 5.
2. Statement on the prognosis process
Prognosis is usually dened as the ability to perform a
reliable and sufciently accurate prediction of the remain-
ing useful life of equipment in service [6]. Consequently,
the primary function of the prognostic is to project the
current health state of equipment into the future by taking
into account estimates of future usage proles. To support
the SMOC purpose, this denition has to be generalised by
extending the concept of equipment at different abstraction
levels of a system (function, subsystem, etc.). Indeed, most
Functioning Monitoring
data process
Current state of
the process
Operating
knowledge
Direct/indirect
maintenance
costs
Fig. 1. The integrated system of proactive maintenance (ISPM).
235
of the existing prognosis methods are component oriented
without really taking into account system performance.
Thus, on this basis, we propose to consider prognosis as
the ability to perform the future of an item from its
present, its past, its degradation laws and the maintenance
actions to be investigated. This denition implies a degree
of uncertainty because prognosis involves a projection into
the future and the future cannot be predicted with
certainty. Therefore, the result of the prognosis process
can be summarised as follows:
 If the forecast situation of a degraded system is
considered as safe or satisfactory to perform the
system goals, no action needs to be planned. The system
will evolve to another acceptable degraded state and it
can drift under control.
 If the forecast situation is not acceptable, several
maintenance alternatives must be investigated through
the prognosis process.
In the latter case, it means that the current situation
identied by the monitoring process will be used to assess
new forecast situations resulting in the virtual deploy-
ment of each alternative (combining simultaneously the
degradation and the restoration of the system). Then,
the results of the different assessments will be used by
the aided-decision-making module to select, by compar-
ison, the most efcient maintenance policy. The execution
of the prognosis process is therefore related to its
integration with the monitoring and decision-making
processes (Fig. 1).
From an engineering point of view, the deployment of
the prognosis process can come from three types of
approaches as classied by Byington et al. [7]:
 Experience-based prognostics: use statistical reliability
to predict probability of failure at any point in time.
Conceivable
maintenance plan
Prognosis
process
Estimation of the system future
performances
Aided-decision
making process
Selected
maintenance
plan
 ARTICLE IN PRESS
236 A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253

 Evolutionary/statistical trending prognostics: multi-

c

Co
variable analysis of system response and error patterns

nv
en
compared to known fault patterns. Model-Based

tio
 Model-based prognostics: fully developed functional

na
Causality Prognostics

lP
and physics-of-failure models to predict degradation Model

ro
b

gn
rates at given loads and conditions.

os
Event Model

tic
Evolutionary or

s
Degradation indicators Trending Models

Ap
Even if these approaches allow the development of

pr
Maintenance actions

oa
operational prognosis, they are not efcient enough to a

hc
support and address the new industrial constraints and the Probabilistic Model
complex assessment of the future system situations (i.e., Experience-based
Behavioural model
performance related to multi-criterion, multi-levels, multi- Prognostics
Degradation process
actors, etc.) as requested in an SMOC environment. In that
way, the prognosis process is still considered the Achilles Fig. 2. Positioning of the proposed methodology.
heel of ISPM, even though its goal is fundamental for
implementing prediction capabilities [8]. This is because
most of the time: 3. Methodology proposed for prognosis process development

 The approaches are component oriented
 The degradation concept and its impact are not taken
into account
 A gap exists between the complexity of the model
proposed and the real system.
To be more efcient, the three different approaches are
often used in combination as proposed in our work [9] for
exploiting prognosis not only at the component level but
also at the function and system levels (function is
supported by several components). In general, a compo-
nent is subject to degradation phenomena such as ageing,
wear or erosion. It implies that a function is subject to the
consequences of degradation occurring in all of its
components. The degradation mechanism obtained is
complex but the function state can be determined from
the combination of the states of each component. There-
fore, the methodology developed for the prognosis process
modelling must be generic regardless of the level considered
(component, function or system); however, the degradation
attributes and the meaning of degraded functioning mode
will be dedicated to each level.
To address this issue, our investigations led us to
propose [4] the implementation of a prognosis process that
is able to operate on different system levels within a holistic
maintenance approach in the enterprise. In order to
specify, design, develop and integrate the prognosis process
into the ISPM, a complete methodology is dened. The
benet of this methodology is the combination of different
types of knowledge for the prognosis process development.
Indeed, the methodology is based on a combination of (a)
stochastic models of degradation based on prior knowledge
and expert judgement (experience-based prognostics), (b)
degradation indicators usable by the monitoring process
(data-driven prognostics), and (c) the causal relationships
expressed by the physical laws on system evolution (model-
based prognostics) (Fig. 2).
For developing the right models at generic and particular
levels, the methodology proposed is structured in three
stages, as detailed below:
 The R&D phase aims at formalizing a set of generic
construction mechanisms required in the next steps for
developing the specic prognosis process. These me-
chanisms are fully independent of support tools and of
application areas.
 The Engineering stage is intended to select a set of
methods or tools for supporting in a concrete way the
generic mechanisms previously dened. Thus, these
mechanisms can be used by an engineer (a specialist)
for designing prognosis processes related to this
industrial system.
 The Operational stage denes the resources required for
the integration and implementation of the previously
designed prognosis process on a given ISPM architecture.
This paper does not aim at developing the Engineering
and Operational phases which are detailed and justied in
[23] but more focus is on the R&D phase. However, a brief
description of the two last stages is given at the end of
Section 3.6.
The generic (i.e., independent of the tools selected and
independent of the application) R&D mechanisms are
dened through ve modelling steps of the industrial
system in general (Fig. 3):
 Mechanisms related to the functional modelling of the
industrial system.
 Mechanisms related to the dynamical modelling of the
industrial system.
 Mechanisms related to the elaboration of a behavioural
model based on the rst two steps.
 Mechanisms related to the elaboration of an event
model from the operational data issued from the
monitoring and the decision-making processes.
 ARTICLE IN PRESS
A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253 237

Prognosis
model Goal
Event model building Probabilistic and Process
event coupling
formalize P Event model
Maintenance integrates
Input Flow Function
actions Output flow

Degradation Behavioral (Mass, (Mass,

indicators model Energy or Energy or
Information) Information)
Probabilistic model building Support
Generic building
define results from...
mechanisms Dynamical
Functional model Fig. 4. Process formalisation.
model

results from...
Functional
Dysfunctional
analysis analysis
Fig. 3. The proposed methodology (NIAM /ORM formalism11 [10]).
 Mechanisms related to the prognosis model denition
through the integration of the event model with the
behavioural model.
3.1. Functional modelling of the industrial system
The rst modelling step consists of formalising the
interactions between the system components by means of
causal qualitative relationships. To perform this action, a
dual functioningmalfunctioning reasoning of the indus-
trial system is proposed. It is based on:
(a) A process approach, which breaks down the whole
system into processes and identies the components
supporting the processes and the ows consumed and
produced by the processes.
(b) Causal modelling, this studies the degraded and failed
states of the process model objects (components and
ows) and their consequences on the behaviour of the
industrial system.
(a) Firstly, the industrial system to be considered is
modelled through a functional analysis such as the
process approach [11]. This step allows dening all the
transformation processes of the systems at all the
abstraction levels. The abstraction levels of a system
allow to study rst, the why (goal) and then, the
what (the function performing the goal) until the
how (the component supporting the function). A
1
NIAM (natural language information analysis method)/ORM (object-
role modeling).
results from...
particular (goal) process (Fig. 4) is thus broken up into
several sub-processes, and the same mechanism is
applied from the sub-processes until the expected level
of abstraction is reached (e.g., component).
Stochastic
processes The proposed denition of a process relies on the four
concepts (goal, function, behaviour and structure)
introduced by Lind [12] and interpreted as follows
 Support (or Structure) represents an arrangement of
physical components.
 Goal represents the purpose of the process (what the
process is intended to do in relation to the product
being transformed).
 Function is a desired action without considering
why or by what means this action is performed.
 Behaviour explains how a system does what it is
intended to do. The process behaviour is desc-
ribed by a rule-based approach, which takes into
account the causal relationships between its input
ows, the support and output ows. It can be
identied as nominal (function fullled), degraded
(partial loss of the function) or failing (total loss of
the function).
A process is linked to another by the ows it
produces or consumes. By denition, a ow (classed
as Mass, Energy or Information) is composed of
objects characterized by attributes (Fig. 5).
Let us assume that the performance (goal achieve-
ment) of a process is directly measured on the
produced ows and, more precisely, on the value of
its attributes.
(b) Secondly, the causal modelling determines the non-
nominal states of each support and each ow from
the previous model. Then, the causes and effects of
these states on the industrial system behaviour are
studied. Actually, this step consists of qualitatively
dening all the causal relationships: object degradation
statecauseconsequences Ri, which are collated in
Table 1.
 R1 is associated to Nominal Behaviour
 R2, R3 and R4 are associated to Degraded
Behaviour
 R5, R6 and R7 are associated to Failing Behaviour.
 ARTICLE IN PRESS
238 A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253

Current cycle

Product-cycle temporal specification

Previous cycle
is of

has
Information Flow

Energy Flow Flow

is characterized by characterizes Flow variable
(flow)

Mass Flow
is constituted by
constitutes Attribute

Object is characterized by characterizes State variable

(O)

Fig. 5. Flow concept formalisation.

Table 1
Causal relationships typology (adapted from [13])

F Flow Xn Nominal state

SP Support iF Input ow Xd Degraded state
R Relation oF Output ow Xf Failing state
Input ow Support Output ow Behaviour Causal relationship Type

IFn SPn OFn Nominal iFn4SPn-oFn R1

IFd SPn OFd Degraded iFd4SPn-oFd R2
IFn SPd OFd Degraded iFn4SPd-oFd R3
IFd SPd OFd Degraded iFd4SPd-oFd R4
IFd SPd OFf Failing iFd4SPd-oFf R5
IFf SPn/SPd or SPf OFf Failing iFf4(SPn3SPd3SPf)-oFf R6
IFn or IFd SPf OFf Failing (Fen3Fed)4SPf-oFf R7
Interaction between deterioration processes SP1d3SP1f-(SP2d3SP2f)4(SP3d3SP3f) R8

 For example, R4 and R5 materialise the same
relationships but for a behaviour going from
degraded to failing state.
 R8 is related to the common-mode degradation
(failure) when the degradation of a component may
induce the degradation of other components.
3.2. Dynamic modelling of the industrial system
The previous functional modelling, which represents the
system from a synchronic point of view, does not allow the
elaboration of the behavioural model required by the
prognosis process by itself. To build this behavioural
model, it is also necessary to model the system degradation
evolution (diachronic vision). This stage consists of
modelling all the physical mechanisms of deterioration,
such as wear, cracks and corrosion, affecting the process
supports previously identied.
This modelling phase begins with the selection of the
critical degradation/failure modes and the identication of
the dependencies between the deterioration processes
responsible for the appearance of modes (formalisation of
the causal relationships R8). In a complex system, the
dependencies are represented by many interactions between
the deterioration mechanisms such as common cause
failure, cascade failure, redundancy,y Usually, these
mechanisms are modelled by stochastic processes and
often by Markovian or semi-Markovian ones [14]. In
this study, the selected deterioration mechanisms were
formalised using discrete time Markov processes (DTMP)
with nite state space. This choice is justied in view
of the computation constraints met in the continuous
domain [15].
The representation of an independent deterioration
process {Xk} is made up of the identication of its discrete
state space wX and, then, the elicitation of its transition
 ARTICLE IN PRESS
A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253
matrix PX. If {Xk} is a semi-Markovian process, the phase-
type method is implemented. It allows substituting the
initial process by a DTMP whose behaviour can be
considered as equivalent to the semi-Markovian process
one [17]. The transition probabilities pij (k) p(Xk xj/
Xk1 xi) can be independent (homogeneous case) or not
independent (non-homogeneous case) of the value of k.
In order to model stochastic dependent processes, we
have chosen a simple method, which consists of aggregat-
ing the interactive process into a single model [16]. For
example, the combination of two processes {At} and {Bt}
leads to the elaboration of a macro-process {ABt}
dened by the following:
 The states wAB result from the combination of the states
wA and wB (with the creation of a failing macro-state
Af4Bf and the removal of the non-reachable states).
 The parameters pik,jl evolution result from the product
of the parameters pij and phl according to Eq. 1(a)
(Change of state for A) and Eq. 1(b) (Change of state
for B). X representing dependence relations among the variables.
pih;il 1  pim phl , (1a)
mai
X
pih;jh 1  phn pij .
nah
3.3. Behavioural modelling of the industrial system
The denition of the (probabilistic) behavioural model
results from the integration of the functional (see Section
3.1) and dynamic (see Section 3.2) models in a unied
formalism. For this reason, the selected formalism must be
able to integrate simultaneously the structure of the
industrial system (described by the processes and the
ows), the causal mechanisms (qualitative/quantitative
equations) and the deterioration processes (DTMP). In
addition, it would be better that a computation method
(and/or a tool) be interfaced with the selected formalism in
order to make the quantitative analysis of the system
behaviour easier.
Among the methods generally used in (dynamic)
reliability engineering, ve solutions seem to full all the
previous requirements:
 Markov chains (MC) [18].
 Stochastic Petri nets (SPN) [19].
 Dynamic Bayesian networks (DBN) [20].
 Dynamic fault trees (DFT) [21].
 Boolean logic driven Markov processes formalism
(BDMP) recently introduced by [22].
We decided to use DBN [23] based on the following
criteria: on the one hand, the strength of this formalism,
the difculty of construction and the graphical model
239
legibility and, on the other hand, the quality of the results,
the execution time and the available tools.
Introduced by [24], DBN are directed graphical models
of stochastic processes (deterioration ones, for instance).
The DBN graphical structure provides an easy way to
specify these conditional independencies and, hence, to
provide a compact parameterization of the model. In
addition, DBN allows the merging, in the same model, of
sources of knowledge different to those depicted in the rst
step of the methodology: operative knowledge database
(OKD), expertise (expressed under logic rules, equations or
subjective probabilities), observations, etc.
3.3.1. BN/DBN generalities
Before describing the behavioural modelling step, let us
introduce some BN/DBN notations:
 B (z, y) is a Bayesian network if z (X, E) is a
directed acyclic graph (DAG) of nodes representing a set
of variables X {X1,y, Xn}, and a set of arcs E
 The conditional probability table (CPT) yXi associated
with each node contains the probability of each state of
(1b) the variable given every possible combination of states
of its parents: p(Xi/XPa(Xi)) in z.
 Considering a variable X[k], which evolves temporally,
the DBN represents the probability distribution over the
states of this variable during the period [0, T]. It can be
modelled by a static BN with T+1 variables (X[0], X[1],
y, X[T]) or by a compact form according to the
canonical formalism introduced by Dean and Kanasawa
[24], and then resumed in the dynamic reliability context
by Welch et al. [25]. In this second case, the DBN is
dened as a pair, (Xk; Xk+1), where Xk is a BN that
denes the prior P(X[0]), and Xk+1 is a two-slice
temporal Bayes net (2TBN) that denes P(X[k]/
X[k1]). With this model, the future slice (k+1) is
conditionally independent of the past, given the present
(k) (i.e., Markov properties).
Because of this canonical form, DBNs allow the
decreasing effect of combinatorial explosion in reliability
estimation by a synthetic description of the system.
Explosion means that the number of states needed to
model a complex system increases exponentially (a state for
each combination of elementary states) [26].
As the DBN representation (Fig. 6) is based on the
modelling of process entities, the obtained model is more
compact and readable than the corresponding MC model
(Fig. 7). However, Weber et al. demonstrate the equiva-
lence of the DBN and the MC models from a computa-
tional point of view [26].
3.3.2. DBN-building mechanisms
From these general DBN concepts, the proposed
methodology introduces at the R&D level a set of generic
 ARTICLE IN PRESS
240 A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253

Flows are represented by m static nodes related to

p(Xk+1/Xk)
Xk Xk+1
p(Xk+1/Xk) X1 X2 X3 X4
X1 - p12 p13
X2 0 - p23
X3 0 0 - p34
X4 0 0 0 -
Fig. 6. DBN modelling.
p13
p12 p23 p34
X3
X1 X2 X3
p24
Fig. 7. DMC modelling.
mechanisms used from the process model to develop the
probabilistic behavioural model in three times:
(a) Identication of the DBN variables,
(b) Elaboration of the network structure by creating the
directed edges,
(c) DBN parameters elicitation.
(a) The main rule of the DBN building is to associate a
dynamic variable Xi[k] (dynamic node) to each
deterioration mechanism and a static variable Xj to
each ow attribute.
As previously dened, the deterioration processes,
which affect the support, can be considered indepen-
dent (i.e., there is no relation between the degradation
mechanisms) or dependent. In the former case, a
support of the process is represented by l dynamic
variables associated to their l degradation modes. In
the latter case, it is necessary to amalgamate the s
correlated deterioration processes into a complex
deterioration process (consequently, the support is
represented by ls+1 dynamic variables). This manip-
ulation is due to the difculties that persist in the exact
inference of DBN. However, the suitability of BN to
represent complex dependencies is not questioned.
The state space wX i k of each dynamic variable has
already been dened in the dynamic modelling step.
When the phase-type method is implemented, the states
xi do not have a physical meaning. In contrast, in the
case of a step-down deterioration, the states xi
correspond to degradation thresholds of the concerned
support. These thresholds are so dened either by their
physical meaning (e.g., oxidation) or by the conse-
quence of the degraded state on the process perfor-
mance (e.g., loss of conductivity).
their m identied attributes. Thus, the state of a
ow F is dened as a reachable combination of the
states of its m attributes (e.g., water ow is chara-
cterized by its volume, ow rate and pressure). The
0 static variables Xj representing the ow attributes
P24 are generally quantitative and continuous. Never-
theless, as the continuous running of DBN is difcult,
the static variables must be studied at discrete
times. This operation consists of cutting Xj into
intervals with the same range by determining the
discrete pitch dXj adapted to the continuous state
space wXj.
(b) The network structure is constructed by creating the
directed edges. An edge is indicative of a conditional
dependency between the variable that it links (e.g.,
X4
the impact of the supports degradation on a pro-
duced ow). As the processes are linked together by
their common ow (an output ow for the upstream
process can be an input ow for the down-
stream process), the model structure consists of
specifying the oriented edges E (directed edges repre-
sent the dependencies (causality) between the variables)
that represent the causal relationships Ri between
the input ows, the support, and the output ows
(Table 1). For example, an edge [Xi[k]-Xj] linking
Xi[k] and Xj, denes the impact of the deterioration
mechanism i on the ow attribute j. By default, each
output ow attribute can have for parents every
attribute of the input ow and every degradation mode
of the related process. The result of steps (a) and (b) is
shown in Fig. 8.
(c) The last step of the DBN building is probably the most
difcult; it is the denition of all the CPTs. Each CPT
contains conditional probabilities of a child node
(e.g., an output ow) being in a specic state given the
states of its parents (e.g., support and input ows).
Fig. 8. DBN construction.
 ARTICLE IN PRESS
A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253
Monitoring process
Degradation
event
modeling
Aided-decision process Maintenance
event
modeling
Fig. 9. Event modelling.
To carry out this task, two solutions (eventually
combined) can be used:
 Learning the parameters on the dataset,
 Calling on an experts judgment.
The choice depends on the sources of knowledge
available for the studied industrial system.
The rst alternative requires the possession of an OKD
supporting the implementation of learning algorithms. If
all the DBN variables are observable, the learning amounts
to a simple counting. By contrast, the learning algorithms
become more complex when several variables are hidden
[27]. Obviously, the quality of learning depends on the
quantity and the efciently of the available data. Among
the conceivable algorithms for this, the simplest consists of
parametric learning (i.e., probabilities resulting from the
count of the individuals found in the database).
With the second alternative, the transition probabilities
of Markovian processes may be derived a priori from any
combination of process knowledge, statistical correlations
and expert judgment, depending on the type of information
available about that particular mechanism. The efciency
of this solution is totally dependent on the expert abilities.
However, because of the Bayesian approach, the collected
operating data allow periodic updating of the conditional
probabilities [28]. For static variables, the CPT elicitation
can be realized by using the physical law governing the
causality between the ow attributes and their parents.
In that case, the law, which can be described by a
determinist equation, is directly encoded in the CPT (see
Section 4.1.3).
This elicitation phase is the last in the construction of the
DBN behavioural model, which will be also used to design
the event model (see Section 3.4) and, then, the prognosis
model (see Section 3.5).
241
Event model
Ix (t) Indicators
3
Ix=I3
SPn 2
SPd SPd
Ix=I2
1
Ix=I1 SPf
Time
Conceivable interventions
Support Type Date / Periodicity
Cmp A Repair -
Cmp B Substitution Every 100days
System C Check Each day
3.4. Event modelling of the industrial system
The event model aims at ensuring the consistency of the
prognosis regarding the systems real evolution. Actually,
the event model is dedicated to providing the state of the
variables dened in the previous DBN behavioural model.
Therefore, it contains two types of variables (Fig. 9):
(a) A set of degradation variables related to the indicators
provided by the monitoring process.
(b) A set of maintenance variables related to the con-
ceivable maintenance actions (the Future) on the
support of each process provided by the aided-decision
process.
(a) The degradation variables dene the current situation
of the system (the Present). They can be monitored on
line through the monitoring process of the ISPM.
Normally, the behavioural model has been used for
designing the monitoring process: as far as possible,
each DBN variable Xi should be associated with a real-
time indicator Z X i . The set of these indicators
constitutes the degradation part of the event model,
and so the current values of all the indicators determine
the current state of the degradation event model.
(b) The maintenance part of the event model allows the
prognosis process to take into account the maintenance
plan (the Future), as dened by the aided-decision
process. It synthesizes the conceivable maintenance
action applicable to the process supports (elementary
components or systems). In practice, a maintenance
action is integrated within the event model by means of
a Boolean variable ICmp. This variable is associated
with the intervention I applicable on the component
(support) Cmp. When this action is pre-programmed at
 ARTICLE IN PRESS
242 A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253

the time l, the event variable ICmp is equal to 1 at time These modications are directly related to the efciency
t l, Else, the variable ICmp is equal to 0. of the maintenance action from which three main
categories are usually distinguished [29]:

3.5. Prognosis model of the industrial system
The prognosis model results from the integration of the
event model into the behavioural model. This integration
consists of creating a set of event DBN variables that
correspond to the degradation (a) and maintenance (b)
events formalized in the last phase (3.4).
(a) An observation variable Z(Xi) reects (eventually) the
current value of each indicator Z X i provided by the
event model. Z(Xi) is dened in the same way as Z X i .
An edge [Z(Xi)-Xj] links this new variable to its
observed variable Xi (Fig. 10.). In addition, the CPT of
Xi is updated according to the following rule: If
Z(Xi)6unspecied, then Xi Z(Xi).
(b) A maintenance variable ICmp is dened for each
planned/unplanned intervention carried out to main-
tain or restore a component/function to acceptable
working conditions. ICmp has an impact on each
deterioration process that affects the component
(support) Cmp (Fig. 10). The impact quantication
on system performances (i.e., impact on the support
degradation) can be achieved by two ways in the CPT
of the selected deterioration process. Firstly, the repair
is considered as a modication of the probability
density associated with the states of the degraded/failed
component. Secondly, the repair acts on the deteriora-
tion process whose parameters are updated every time
an intervention on the component occurs.
 Perfect maintenance (as good as newAGAN): this
means that the component is considered new after each
maintenance intervention. This maintenance is repre-
sented in the DBN by hard evidence, which restores the
component to its nominal state at intervention time (k).
Then, the inference process updates the probabilities of
all the variables connected directly, or indirectly, to the
component.
 Minimal maintenance (as bad as oldABAO): a
minimal maintenance action leaves the system in the
same state as it was before failure. With regard to the
DBN model, it consists of doing nothing because, rstly,
the state of the component before and after the
intervention is the same and, secondly, the degradation
process does not change.
 Imperfect maintenance: generally, a maintenance action
is somewhere between AGAN and ABAO. Imperfect
maintenance materialises this fact and reduces either the
age or the ageing rate of the component, better
than it was but worse than it could be as new. This
maintenance is represented in the DBN by soft evidence
materialised by a vector of the probability distribution
over the variable possible values (component states).
For example, if it is impossible to know the exact
component state after repairing but, if there is a
probability of X that the maintenance will be perfect
and a probability of Y that the component will be
restored to its rst degraded state, then a soft evidence
(likelihood) [X Y y] is entered in the model [9]. In

Behavioral model
Ix (t) Indicators
3
Ix=I3 Degradation
SPn 2 event If Z(Xi) Unspecified,
SPd integration ThenXi = Z(Xi)
Ix=I2 SPd
1
Ix=I1 SPf
Time Z(Xi) Xi

REPCMP A A deterioration

Conceivable interventions
Maintenance
Support Type Date /Periodicity event
CMP A Repair - integration
SUBCMP A A deterioration[k-1]
CMP A Substitution Every 100 days
C deterioration
System C Check Each day
CHSYST C

C deterioration[k-1]

Fig. 10. Event model integration.

 ARTICLE IN PRESS
A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253 243

summary, we have introduced (through the construction
of several models) a set of generic mechanisms that
allow the development of a prognosis process. However,
these mechanisms should be still supported by a set of
concrete methods and tools to be implemented by an
engineer (a specialist).
3.6. Implementation of the R&D mechanisms
The industrial deployment of the previous prognosis
approach is supported today, in engineering phase, by
different tools to help engineer for developing particular
prognosis related to the system to be maintained. The tools
are the following:
 MEGA tool /http://www.mega.comS to support pro-
cess approach (process model of the system),
 CASIP tool /http://www.predict.frS to support causal
relationship studies through the implementation of
failure modes and effects analysis (FMEA) [30] and
hazard and operability studies (HAZOP) [31] methods.
 ACCESS database to support the event model,
 BAYESIALAB tool /http://www.bayesia.comS to
support the development and the implementation of
the probabilistic models (among the prognosis ones).
The results of this engineering phase are synthesized in
the application architecture diagram depicted in Fig. 11.
However, the concrete implementation of this applica-
tion architecture required the integration of its elements in
a unique software/hardware infrastructure [32]. Assem-
bling the previous tools to form a whole (efcient) ISPM is
a difcult task because of the problems of inter-operability.
Inter-operability is seen as the ability for a system or a
product to work with other systems or products without
special effort of the part of the customer /http://interop-noe.
org/INTEROP/presentationS. This is why we propose
at the operational stage to develop such a technical
architecture [9]. This technical architecture is built using
a set of various technical solutions such as PLCs, OPC
server, eld buses, real-time database, Ethernet, Oracle
database,y (Fig. 12) and materialises a rst appli-
cation based on ICT components of the e-maintenance
concept [35].
With these architectures, engineers will have at their
disposal a formalised guide based on method combina-
tion for helping them in the design of the prognosis process
models, as well as the execution of the prognostic.
4. Implementation of the proposed methodology on a
TELMA platform
In relation to the operational phase, the deployment of
the prognosis process is made today according to
experimentation in order to demonstrate prognosis feasi-
bility and potential benets. This experimentation con-
cerns the TELMA /http://www.aip-primeca.netS platform
whose technical architecture is built on the industrial
CASIP product.
TELMA is a platform materialising a physical process
dedicated to unwinding metal strip. This process is similar
to concrete industrial applications such as sheet metal
cutting and paper bobbin cutting. The physical process is
divided into four parts: bobbin changing, strip accumula-
tion, punchingcutting and advance system (Fig. 12). Each

Dysfunctional analysis
C
CASIP
CASIP of supports
FMEA

Dysfunctional
CASIP analysis of flows
HAZOP

MEGA Functional Deterioration

decomposition of Functional
Process processes
the system model

Knowledge of Causal relationships Dynamic

the maintenance model
actions
ACCESS 7
Probabilistic Markovian
Event model processes
model
Knowledge of
the degradation Event variables Probabilistic variables
indicators

BAYESIA
Prognosis Lab
model

Fig. 11. Application architecture.

 ARTICLE IN PRESS
244 A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253

Internet Network
EMPACix Customer
CASIP FMECA HAZOP CMMS EMPACix CASIP Customer
CASIP Customer

TDMS SQL TDMS Oracle

Server CASIP EMPACix

Server PC Server PC CMMS PC (Sciences

CASIP Ethernet AIP Lorrain EMPACIX Campus or ESSTIN)
Switch AIP Lorrain
Touch screen API_DEF : Failure generator API_CDE : Control/Command OPC & SAM
MAGELIS TSX Premium PLC TSX Premium PLC Servers

Vlan
Industrial Ethernet RLI
Web
Inputs/Outputs Altivar 58
Altivar 58
Momentum Cam 240v-370W
2
240v - 370W

System consol Bobbin Strip Punching- Advance

Changing accumulation cutting WEB
Break cam
Pneumatic
Bobbins tour cylinder

Accumulation motor Advance motor

Fig. 12. TELMA platform description.

part is composed of several components such as pneumatic
cylinder, chuck and a marking system.
4.1. Prognosis process development
The prognosis process development, detailed hereafter, is
focused on the punchingcutting part of TELMA and
more precisely on the subset whose nal purpose is to
punch the strip. The translation movement (used to operate
the punching/cutting) is induced by a camshaft that drives
a crosshead. Two springs allow the punch to remain in
contact with the cam and so to follow the up and down
motion.
4.1.1. Punchingcutting functional modelling
As explained in Section 3.1, the rst modelling action is
intended to design the process model of the punching
cutting part of TELMA.
The process to punch/cut the strip is therefore dened
as described in Fig. 13:
 Its support, the Punching subsystem.
 Its goal, directly measured on the output ow attributes,
i.e., the properties of the Finished product.
 Its function, to punch/cut the strip.
 Its behaviour, described by all relationships existing
between the input ows (Advance output rotation and
Advanced provided by the Advance process) and the output
ows (Finished product, Scraps and Punching state).
Fig. 14 shows the breakdown of this process into ve
elementary sub-processes, (respectively, supported by the
Punching belt and pulley system, the Camshaft system, the
Sensors SQ101 & SQ102, the Punching split and slide
system and the Punching/cutting tool).
This process breakdown is then used as the common core
of the dysfunctional analysis (FMEA and HAZOP).
Firstly, the FMEA determines, for each process support,
the causes and the consequences of the listed degradation
modes. An occurrence of a degradation mode (caused by a
deterioration process) generates one or more ow devia-
tions. Fig. 15 presents, for example, the FMEA of the
Punching belt & pulley system, which supports the process
To transmit the punching rotation. According to this
study, the support is subjected to:
 Mechanical wear of the belt. This wear process leads to
the occurrence of the degradation mode Belt slip or/
 ARTICLE IN PRESS
A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253 245

Punching in top
Camshaft position
system Cam shaft SQ101
Punching Spilt system
DT282
& Slide system
Punching Spilt
& Slide system PLC part
Punching/ KA262 10.1
Cutting
tool Punching in low
Advanced strip To punch/cut Scraps SQ102 position
Advance the strip Finished products
Punching state DT283
output rotation
Punching sub-
PLC part
system KA263
10.2

Fig. 13. To punch/cut the strip process and system.

Advance output rotation

To transmitt the To transform the

punching rotation Punching rotation rotation in punching
movement

Punching belt & Camshaft system

pulley system To report the
punching position
Punching state
(low/high)

Output cam movement Sensors SQ101 &

SQ102
Slide translation (previous cycle)
To operate the
punching Slide translation

Punching split &

slide system

To execute the
Scraps
punching
Advanced strip Finished products

Punching/cutting
tool

Fig. 14. Punchingcutting process model.

Cause Degradation / Failure Consequence

Mechanical wear of the
Slip MORE of start time for the Shaft punching rotation
belt
NO start time for the Shaft punching rotation
Belt break
LESS of stop time for the Shaft punching rotation
Pulley wear Pulley misalignment NO start time for the Shaft punching rotation

Fig. 15. Extract of FMEA related to the Punching belt & pulley system.

then the occurrence of the failure mode Belt break. In
case of slip, this deterioration process causes the
deviation MORE of start time for the Shaft punching
rotation ow. In case of break, it causes the deviation
LESS of stop time or NO start time for the Shaft
punching rotation ow.
 Wear process of the pulley. This deterioration process
leads to the occurrence of the degradation mode Pulley
misalignment. It causes the deviation NO start time for
the Shaft punching rotation ow.
Secondly, the HAZOP table determines for each output
ow the causes and consequences of the deviations of their
attributes. The occurrence of the deviation of an output
ow is due to either the deviation of an input ow or the
occurrence of a support degradation/failure mode (cause).
 ARTICLE IN PRESS
246 A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253

Attribute Deviation Cause Consequence

Torque LESS LESS of torque for the Advance output rotation LESS of torque for the Output cam movement

MORE MORE of torque for the Advance output rotation MORE of torque for the Output cam movement

Angular LESS of angular velocity for the Advance output LESS of angular velocity for the Output cam
LESS rotation movement
Shaft punching rotation velocity
MORE of angular velocity for the Advance output MORE of angular velocity for the Output cam
MORE rotation movement
LESS LESS of start time for the Advance output rotation LESS of start time for the Output cam movement
NO start time for the Advance output rotation
Start NO NO start time for the Output cam movement
Belt break of the Punching belt & pulley system
Belt slip of the Punching belt & pulley system
MORE MORE of start time for the Output cam movement
MORE of start time for the Advance output rotation
LESS of stop time for the Advance output rotation
LESS LESS of stop time for the Output cam movement
Belt break of the Punching belt & pulley system
Stop
NO NO stop time for the Advance output rotation NO stop time for the Output cam movement

MORE MORE of stop time for the Advance output rotation MORE of stop time for the Output cam movement

Fig. 16. Extract of HAZOP related to the Shaft punching rotation ow.

It leads to the deviation of one or more output ows fOK; Degradation; HSg and a transition matrix
consumed by the downstream processes (consequences). PU bearings , which contains the bearings wear process
Fig. 16. presents, as an example, the HAZOP analysis of parameters, i.e., the transition probabilities pij
the Shaft punching rotation ow produced by the process p(Ubearings k Uj/Ubearings k1 Ui).
To transmit the punching rotation. The temporal attributes 2 3
 pOK; Degradation pOK; HS
start time and stop time (already introduced in the FMEA) 6 7
and two new shape attributes, the angular velocity and PU bearings 4 0  pDegradation; HS 5
torque of the rotation, are studied. They can be subjected 0 0 
to LESS or MORE deviations. PU bearings is a stochastic matrix, i.e., the entries in each
From the causality principle, the causes of these column are nonnegative real numbers whose sum is 1.
deviations are either the degradation/failure modes of the In the same way, the fretting wear process of the cam is
Punching belt & pulley system, which supports the To formalized by a Markovian process {Ccam} character-
transmit the punching rotation process, or the deviation of ized by a state space wC cam fOK; Degradationg and a
an attribute of the Advance output rotation ow consumed transition matrix PC cam .
by the same process. In the same way, the effects of the
Advance output rotation ow deviations concern the  
 pOK; Degradation
attributes of the Output cam movement ow produced by PC cam
0 
the To transform the rotation in punching movement process
below the studied process. PC cam is a stochastic matrix. There is no failed state for
The use of DBN formalism avoids the translation of this process because the probability of reaching it is
causal relationships issued from the FMEA and HAZOP considered negligible.
studies under causal equations. (b) The Punching belt & pulley system modelling
(Table 2) is related to the stochastic dependence case.
4.1.2. Punchingcutting dynamic modelling This support is subjected to two stochastically depen-
The dynamic modelling of the processes to transmit the dent deterioration mechanisms:
punching rotation and to transform the rotation in  Fatigue wear of the belt, which is formalized by a
punching movement details successively the stochastic (a) Markovian process {Fbelt} with three states (OK,
dependence and (b) independence situations depicted in Lengthening and Break) and three transition prob-
Section 3.2. abilities [p1, p2, p3], is dened as:
o p1 p(Fbelt k Lengthening/Fbelt k1 OK).
(a) The dynamic modelling of the camshaft system o p2 p(Fbelt k Break/Fbelt k1 Lengthening).
(support of the process To transform the rotation into o p3 p(Fbelt k Break/Fbelt k1 OK).
punching movement) illustrates the stochastic indepen-  A misalignment mechanism of the pulley, which is
dence. Actually, this support is subjected to two formalized by the Markovian process {Dpulley} with
deterioration mechanisms wear of bearings and three states (OK, Soft misalignment and Hard
fretting wear of the cam, which are assumed to be Misalignment) and two parameters [p4, p5], is
independent of each other. The bearings wear process is dened as:
formalized by a Markovian process {Ubearings} o p4 p(Dpulley k Soft M./Dpulley k1 OK).
characterized by a state space wU bearings o p5 p(Dpulley k Hard M./Dpulley k1 Soft M.).
 ARTICLE IN PRESS
A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253
Table 2
Punching belt & pulley system modelling
p1 p(Fbelt k Lengthening/Fbelt k1 OK)
p2 p(Fbelt k Break/Fbelt k1 Lengthening)
p3 p(Fbelt k Break/Fbelt k1 OK)
p4 p(Dpulley k Soft M./Dpulley k1 OK)
p5 p(Dpulley k Hard M./Dpulley k1 Soft M.)
The stochastic dependence is dened as follows:
 When the pulley reaches the soft misalignment state,
wear of the belt is accelerated. The set of parameters [p1,
p2, p3] are then substituted by another set [p0 1, p0 2, p0 3]
(p0 i4pi).
 When the pulley reaches the hard misalignment state,
the belt slip and the rotation transmission are broken.
The Punching belt & pulley system is thus failing.
The aggregation of {Fbelt} and {Dpulley} leads to the
elaboration of a macro-process {FDpunching} characterised
by a state space wFDpunching composed of:
 Nominal state: OK
 A degraded state with only lengthening of the belt :
Length.
 A degraded state with only soft misalignment of Pulley :
Soft M.
 A state with the simultaneous presence of two degrada-
tions: Length. & Soft M.
 A failing macro state: HS.
The evolution parameters of the process {FDpunching} are
obtained by combining the parameters of the initial
processes. The result is given by the following transition
matrix: PFDpunching
2 3
 p1 1  p4 p4 1  p1  p3 p1 p4 p3
60  0 p4 1  p2 p2 7 Fatigue wear of the belt (generalized Erlang distribution)
6 7
6 7
60 0  p0 1 1  p5 p5 p 3 1  p5 7
0
6 7
6 7
40 0 0  p5 p0 2  p5 p0 2 5
0 0 0 0  p3 0.047
All the parameters pi will be determined during the DBN
development.
4.1.3. Punchingcutting behavioural modelling
The DBN model of the process To punch/cut the strip
results from the implementation of the generic building
mechanisms by using the knowledge formalized in the two
previous steps (Sections 4.1.1 and 4.1.2).
(a) Each deterioration process identied during the FMEA
study is associated with a dynamic variable, whereas
each ow attribute identied during the HAZOP study
is associated with a static variable. This action leads to
the denition of six dynamic and 18 static variables
247
represented in Fig. 17. For example, the pro-
cess {Ubearings} associated with the dynamic variable
Ubearings[k] is represented by the nodes U bearings [k1]
and U bearings. The Punching rotation ow is, in
contrast, represented by four static variables, and so
four nodes are associated with its attributes: Punching
rotation.Start, Punching rotation.Stop, Punching rota-
tion.Torque and Punching rotation.Angular velocity.
(b) Afterwards, the DBN structure is established because
of the causal relationships, which have been formalized
during the functional/dysfunctional analysis. For ex-
ample, the causal relationships: LESS of Advance
output rotation.torque-LESS of Punching rotation.-
torque and MORE of Advance output rotation.tor-
que-MORE of Punching rotation.torque, leads to the
creation of the A1 edge (Fig. 17). Similarly, the relation
Belt break-NO Rotation punching.start lead to the
creation of the A2 edge.
(c) Finally, the last step of the DBN construction concerns
the elicitation of various parameters. A well-suited
learning algorithm included in BAYESIA Lab allows
the estimation of the transition probabilities pi from the
operational learning database available on TELMA.
The existing learning methods guarantee to produce
very good results given sufciently large data sets.
However, in the case of small data sets (this situation
concerns several deterioration processes on TELMA),
the parameters learning is not good and it is necessary
to combine existing frequency data with expert judg-
ment in order to obtain realistic results.
For a dynamic variable, such as FDpunching [k], the wear
processes are dened by a parameter set [p1, p2, p3, p4, p5,
p0 1, p0 2, p0 3] obtained from the operating data. These
transition probabilities are associated with the following
numerical values:
Without misalignment With a pulley misalignment
p1 0.026 p0 1 0.1
p2 0.026 p0 2 0.1
p0 3 0.05
Misalignment process of the pulley
p4 0.003 p5 0.03
As explained in Section 3.3, the CPT yFD punching
depicted in Table 3 is obtained with these parameters.
If the operational data related to the relevant deteriora-
tion process are insufcient, such as in the {Ccam} case, the
transition probabilities are obtained from knowledge of the
deterioration law. In this specic case, the degradation
apparition time of the cam follows a Weibull distribution
with a scale parameter of Z 12000 and a shape parameter
of b 5. Therefore, the CPT of the node C cam[k+1] can
be established by using the equation that denes the hazard
rate evolution (Table 4).
 ARTICLE IN PRESS
248 A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253

Fig. 17. DBN structure of to punch/cut the strip process.

Table 3
CPT yFDpunching

FDpunching k+1 OK Length. Soft M. Length. & Soft M. HS

FDpunching k OK 99.924 0.026 0.003 0 0.047

FDpunching k Length. 0 99.971 0 0.003 0.026
FDpunching k Soft M. 0 0 99.901 0.025 0.074
FDpunching k Length. & Soft M. 0 0 0 99.945 0.055
FDpunching k HS 0 0 0 0 100

Table 4
CPT of yCcam

Ccam k+1/Ccam k OK HS

OK 5
 k
4  b1  4
1  lk1  12000 12000 lk bZ kg 5
lk 12000 k
Z 12000
HS 0 1

As introduced in Section 3.3, the CPT of a static variable
(e.g., a ow attribute) can be determined according to a
physical law. This law, which governs the interactions
between the ow attribute and its parents, is described
by means of deterministic equations. Each of these
equations species the variable value with respect to the
value/state of their parent variables. For example, the
fullment of the CPT yPunching rotation.start is done from the
deterministic equation Punching rotation.start f
(FDpunching, Advance output rotation.start) as illustrated
by Fig. 18 and Table 5.
4.1.4. Punchingcutting event modelling
The event model interfaces the prognosis process with
the monitoring and aided-decision-making processes. As
explained in Section 3.4, two stages are identied in the
development of the Punchingcutting event model:
(a) The rst one is relating to the Punching subsystem
system current state.
(b) The second one aims at formalizing the maintenance
actions and their impacts on the support of the process
To punch/cut the strip.
 ARTICLE IN PRESS
A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253 249

Similarly, the belt substitution is a non-periodic main-

tenance action represented by the Boolean variable SUBBelt
that is by default in the False state.
FD punching [k-1] By contrast, it is in the True state when this action is
scheduled at a date l:
Punching rotation.start =
f (FD punching
Advance output rotation.start)  p (SUBBelt k True) 1 if k l
 p (SUBBelt k True) 0 if k6l
FD punching
4.1.5. Prognosis model of the punchingcutting system
Punching rotation.start The prognosis model of the process To punch/cut the
Advance output rotation.start Punching rotation.start strip results from the integration of the event variables
(indicator and maintenance action variables) in the
Fig. 18. Punching rotation.start CPT determination. previous behavioural model as depicted in Section 3.4.
Table 5
Punching rotation.start determination (a) The integration of the Punching period indicator (Flow
deviation indicator case) causes, for example, the
Punching rotation.start creation of a new DBN variable: Z(Punching period)
If Advance output rotation.start NO
which updates the state of the variable Punching
then Punching rotation.start NO, Else period (Fig. 19).
If FDpunching (OK or Pulley soft misalignment),
then Punching rotation.start Advance output rotation.start, The states of Z(Punching period) are based on the states
If FDpunching Belt Lengthening, of the variable Punching period in which the state
then Punching rotation.start Advance output rotation.start+0.5,
If FDpunching Belt Lengthening+Pulley soft misalignment,
Undetermined (i.e., no available information) is added.
then Punching rotation.start Advance output rotation.start+1, The impact of the punching period observation on the ow
Else Punching rotation.start NO. attribute Punching period is formalized in the CPT
yPunching by the following equation:

(a) The degradation part of the event model associated
with the process To punch/cut the strip is composed of:
 An indicator of the Punching period formalised by
the discrete variable Z (Punching period), continu-
ously updating using the instrumentation available
on TELMA.
 A failure indicator of the belt associated with the
Boolean variable Z (Fbelt), updated as soon as an
operator visually inspects the state of this component.
(b) The maintenance part of the event model falls into the
maintenance actions suggested by the aided-decision-
making process to improve the state of the process To
punch/cut the strip. These potential maintenance
actions can be periodic (period: p) or not:
 If Z(Punching period)6Undetermined, Then Punch-
ing period Z(Punching period).
Similarly, the integration of the belt wear indicator
(deterioration indicator of a component case) leads to the
creation of the variable, Z(Fbelt), which updates the state of
the variable FDpunching (Fig. 20).
As previously, the states of the variable Z(Fbelt) are
based on the states of ZFbelt in which the state Un-
determined is added.
The impact of observing the belt on the deterioration
process {FDpunching} is difcult to establish because of the

 Belt substitution  Camshaft repair

 Bearings lubrication (p)  Slide system repair
 Bearings substitution  Cutting tool sharpening (p) Slide translation.start
 Pulley balancing  Cutting tool substitution
 Springs substitution

The lubrication of the bearings is a periodic (T)

maintenance intervention. It is represented by the Boolean Slide translation.stop Punching period
variable Lbearings. This variable is in the state True when
the periodicity is reached:

 p (LBearings k True) 1 if k Tn with n natural Slide translation.linear speed Z (Punching period)

integer 40
 p (LBearings k True) 0 if k6Tn Fig. 19. Integration of the punching period indicator.
 ARTICLE IN PRESS
250 A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253
FD punching [k-1]
Z (F belt)
FD punching
Fig. 20. Support degradation indicator integration.
lack of direct correspondence between the states of the
indicator ZFbelt and those of the variable FDpunching.
Actually, the knowledge of the state of belt degradation
does not allow the exact determination of the state of the
process {FDpunching}. It also depends on the pulley
misalignment process. The update of the FDpunching state
is therefore partial. It is integrated in the CPT y FD punching
according to the deterministic equation FDpunching f Z
(Fbelt):
FDpunching
If Z (Fbelt) OK,
If FDpunching [k1] (OK4Length.),
then FDpunching [k] OK,
If FDpunching [k1] (Soft M.4Length &
Soft M.)
then FDpunching [k] Soft M.,
If FDpunching [k1] HS then FDpunching
[k] HS,
If Z(Fbelt) Degradation,
If FDpunching [k1] (OK4Length.),
then FDpunching [k] Length,
If FDpunching [k1] (Soft M.4Length. &
Soft M.),
then FDpunching [k] Length. & Soft M.,
If FDpunching [k1] HS then FD punching
[k] HS,
If Z(Fbelt) HS, then FDpunching [k] HS.
The integration of the maintenance actions (Belt
substitution and Pulley repair), which can be implemented
on the Punching belt/pulley system, enables the creation of
two DBN variables: SUBBelt and BALPulley (Fig. 21). These
variables update the state of the variable FDpunching, at each
maintenance intervention.
On one hand, the belt substitution is considered a perfect
maintenance action that restores this component in its
nominal state after the intervention. The maintenance
impact on {FDpunching} is formalized into the CPT
yFDpunching by means of the following conditional prob-
abilities:
p (FDpunching (k+1) OK/SUB Belt k & FDpunching k
OK4Length.) 1
p (FDpunching (k+1) Soft M./SUB Belt k & FDpunching k
Soft M.4Length. & Soft M.) 1
SUB Belt
FD punching [k-1]
BAL pulley Z (F belt)
FD punching
Fig. 21. Maintenance event model integration.
p (FDpunching (k+1) OK/SUB Belt k & FDpunching k
HS) 1*
* When a failure of the Punching belt/pulley system occurs,
there is a complete substitution of this system, and so the
system comes back to its nominal state (OK).
On the other hand, the pulley repair is considered an
imperfect maintenance action. The expertise says that, after
this intervention, there is a probability of 0.8 that the pulley
will be restored to its nominal state and a probability of 0.2
that it stays in the degraded state. The impact of the pulley
repair on the deterioration process {FDpunching} is also
formalized by the following conditional probabilities:
P (FDpunching k+1 OK/BAL Pulleyk & FDpunching k
OK) 1
P (FDpunching k+1 Length./BAL Pulley k & FDpunching k
Length.) 1
P (FDpunching k+1 OK/BAL Pulley k & FDpunching k
Soft M.) 0,8
P (FDpunching k+1 Soft M./BAL Pulley k & FDpunching k
Soft M.) 0,2
P (FDpunching k+1 Length./BAL Pulley k & FDpunching k
Length. & Soft M.) 0,8
P (FDpunching k+1 Length. & Soft M. /BAL Pulley k &
FDpunching k Length. & Soft M.) 0,2
P (FDpunching k+1 OK/BAL Pulley k & FDpunching k
HS) 1*
*When a failure of the punching belt/pulley system occurs,
there is a complete substitution of this system, and so the
system comes back to its nominal state (OK).
This was the last step concerning the design of the
prognosis model. Now, we are going to run the prognosis
process in the operational phase.
4.2. Prognosis process operation
By using the prognosis model (DBN), the prognosis goal
is, from the current state of the punching/cutting subsystem
and the maintenance alternative dened by the aided-
decision-making process, to assess its future situation and
its related performance X time units later. This operation is
supported by the tool BAYESIA Lab, which runs the DBN
 ARTICLE IN PRESS
A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253
simulation required by the prognosis process using its
iterative inference algorithm. The simulation usually
unfolds in two stages:
(a) Initialization of the prognosis model. The event model
state is integrated within the prognosis model by means
of an observation le (text le) generated by the Event
model database (Fig. 11).
(b) Simulation stage. The simulation is made on the basis
of the system evolution from its current state to a
future time (k X) and by assessing the state reached
at this time with implementation of the maintenance
strategy dened in the event model. More precisely,
BAYESIA Lab updates at every time slice (k) the
probability distributions of all the DBN variables
during the requested period [0; X]. As soon as the
simulation is over, the state of all the variables at time
(k X) is available.
To punch/cut the strip prognostic
Assume that it is necessary to realize the prognostic of the
process To punch/cut the strip at time (k 1000). The
goal of the prognosis process is to determine at this time:
 The deterioration state of the punching system compo-
nents
 The state of the ows, which are consumed/produced by
the punching system. More precisely, the goals achieve-
ment of the process is measured by the state of the
produced ows: Punching period, Finished products.-
cutting state and Finished products. surface appearance.
(a) First, the export (and then the integration) of the event
model state into BAYESIA Lab allows the initialisa-
tion of the prognosis model. In this example, the
observation le contains the following information:
 Current state of the system at time (k 0)
o Z(Punching period)0 45.5
o p(F belt Degradation)0 p(F belt HS)0 0
 Maintenance alternative on period [k 0; k 1000]
o Periodic lubrication of the bearing each 100 time
units
o Gbearings 100 Gbearings 200 y G bearings 1000
True
(b) Then, the simulation is launched for the requested
period (i.e., 1000 time units). The duration of the
simulation is less than 3 min 30 s. As soon as it is ended,
the states of all the variables at time (k 1000) are
provided by BAYESIA Lab in terms of probability
distribution. From the results, there is a probability of
0.78 that the punching process would not be able to
full its nal goal 1000 time units later. Besides, the
attributes cutting state and surface appearance of the
ow Finished products are subjected to an important
degradation. They have, respectively, probabilities of
0.71 and 0.45 of being in the failing state HS at
(k 1000).
251
To highlight this fact, Fig. 22 depicts the evolution curve
of these three criteria for the period [0; 1000]. These curves
provide evidence of the impact of each bearings lubricant
performed at each 100 time units in the process. These
results, which constitute the estimation of the systems
future performance, are then transferred to the aided-
decision-making process, as dened in Section 2 (Fig. 1).
Indeed it is mandatory to take into account their
maintenance costs before analysing the expected perfor-
mance provided by the prognosis process. Otherwise, the
interpretation has no real meaning.
In this specic case, the prognosis process is launched a
second time because analysis of the previous results shows
that the degradation of the process Punching the strip
performances is mainly caused by deterioration of the
camshaft bearings and the punching split/slide system.
Therefore, it was decided to replace these components. This
decision implies the modication of the state of the event
model (i.e., new maintenance alternative). However, in this
simple case, the integration of these actions in the
prognostic can be done by injecting two hard evidences
into the prognosis model at time (k 1000). The new
results are again transferred to the aided-decision-making
process, which can repeat the action until a satisfactory
maintenance strategy with regards to the expected perfor-
mances is obtained.
5. Conclusion
The main contribution of this paper is a methodology
structured by generic modelling concepts for prognosis
process formalization and deployment based on a combi-
nation of both a probabilistic model and a dynamic
monitoring architecture. Moreover, experimentation on an
industrial system demonstrated the feasibility of this
methodology. Based on these results, further developments
should be implemented to extend the experimentation
context to the whole platform. It is also expected to
validate the added value of this methodology by comparing
1
0.9
Probability of remaining in the
0.8
nominal state (OK)
0.7
0.6
0.5
0.4
0.3
Finished products. cutting state
0.2 Finished products. surface appearence
0.1 Punching period
0
0 100 200 300 400 500 600 700 800 900 1000
Time
Fig. 22. Evolution of the punching system performance for the period [0;
1000].
 ARTICLE IN PRESS
252 A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253

its performance with performance data already obtained by Transition matrix: PX Transition probability: pij
conventional approaches. Event modelling step
In addition, other future developments will be devoted in Maintenance action:
Degradation indicator: ZX
the short term to take into account in the prognosis model Action typeComponent
the inuence of several operational/environmental condi- Dynamic Bayesian Network
tions on the deteriorations processes evolution [33], and in Dynamic variable: Xi[k] Static variable: Xj
the medium term to reinforce the weight of the event model Dynamic nodes: Xi & Static node: Xj
in the prognostic by extrapolating the values of the Xi1]
indicators in the future (using a data-driven approach Edge: [X-Y] CPT: yX
[34]) and by integrating it into the prognostic. Indicator variable: Z(X) Time: (time)
Finally, some improvements should be made to improve Cmp : Component ICmp Intervention on the
the degree of assistance of the prognosis process designer, component
notably during the ow attribute denition. One solution
would consist of adapting the dysfunctional analyses
FMEA/HAZOP to the treatment of temporal properties 2TBN two slice temporal Bayesian network
for ow attributes and to the formalisation of the ABAO as bald as old
dependencies between the deterioration processes. AGAN as good as new
BDMP Boolean logic driven Markov processes
Acknowledgements BN Bayesian networks
CPT conditional probability table
This research has been carried out within the group DAG directed acyclic graph
PRODEMAS (Maintenance decision-making processes for DBN dynamic Bayesian networks
controlling the dependability and productivity of industrial DFT dynamic fault trees
systems) of the CRAN. The authors thank all the DTMP discrete time Markov processes
PRODEMAS members for their comments and especially FMEA failure modes and effect analysis
Dr. Philippe Weber, for his support on the formalisation of HAZOP hazard and operability studies
the DBN model. We would also like to thank the ICT information and communication technology
PREDICT company and the AIPL people for their help ISPM integrated system of proactive maintenance
during the development of the ISPM technical and MC Markov chains
operational architectures. MES manufacturing execution system
The continuation of this work is devoted to the NIAM natural language information analysis method
implementation of the proposed approach at a business OKD operating knowledge database
level for a more strategic decision-making purpose. These ORM object-role modelling
future developments will be done with the support of SMOC system maintaining operational conditions
Professor Adolfo Crespo Marquez in the context of a new SPN stochastic Petri nets
project setting up between our university and the Uni- Telma tele-maintenance
versity of Sevilla. This project is called: Modeling policies
for the improvement of production systems dependability
(Project number DPI 2004-01843) and it is sponsored by References
the Spanish government.
[1] Venkatasubramanian V. Prognostic and diagnostic monitoring of
complex systems for product lifecycle management: challenges and
Notation opportunities. Comput Chem Eng 2005;29(6):125363.
[2] Al-Najjar B, Alsyouf I. Selecting the most efcient maintenance
Functional modelling step approach using fuzzy multiple criteria decision making. Int J Prod
Process: Process Function: Function Econ 2003;84:85100.
[3] Lee J, Ni J. Editorial of advanced engineering informatics. 2003;
Flow: Flow Finality: Finality 17(34): 107.
Support: Support [4] Leger J-B, Morel G. Integration of maintenance in the enterprise:
Dysfunctional modelling step towards an enterprise modelling-based framework compliant with
Degradation Mode: Causal relation: proactive maintenance strategy. Prod Plann Control 2001;12(2):
Degradation mode Cause-Consequence 17687.
[5] Provan G. Prognosis and condition-based monitoring: an open
Failure Mode: Failure Deviation type: systems architecture. In: Proceedings of the fth IFAC symposium on
mode DEVIATION fault detection, supervision and safety of technical processes.
Flow attributes: Attribute Washington, USA, 2003. p. 5762.
Dynamic modelling step [6] Lebold M, Thurston M. Open standards for condition-based
maintenance and prognostic systems. In: Proceedings of the fth
Deterioration process:
State space: wX annual maintenance and reliability conference. MARCON 2001,
{Deterioration process} Gatlinburg, USA, 2001.
 ARTICLE IN PRESS
A. Muller et al. / Reliability Engineering and System Safety 93 (2008) 234253
[7] Byington C, Watson M, Roemer M, Galie T. Prognostic enhance-
ments to gas turbine diagnostic systems. In: Proceedings of the IEEE
aerospace conference. Big Sky, USA, 2001.
[8] Wang P, Vachtsevanos G. Fault Prognosis using dynamic wavelet
neural networks. In: Proceedings of the AAAI spring symposium on
equipment maintenance service and support. Polo Alto, USA, 1999.
[9] Muller A, Suhner M-C, Iung B. Probabilistic vs. dynamical prognosis
process-based e-maintenance system. In: Proceedings of IFAC-
INCOM04, information control in manufacturing. Salvador, Brazil,
2004.
[10] Halpin TA. Object-role modelling (ORM/NIAM). In: Handbook
on architectures of information systems. Berlin: Springer; 1998
[Chapter 4].
[11] ISO International Organisation for Standardisation. ISO 9000:2000
quality management systemsrequirements. Geneva, Switzerland;
2000.
[12] Lind M. Modeling goals and functions of complex industrial plant.
Appl Artif Intell 1994;8:25983.
[13] Muller A, Suhner M-C, Iung B. Bayesian network based proactive
maintenance. In: Proceedings of the seventh international conference
on probabilistic safety assessment and management. PSAM 7 and
ESREL04, Berlin, Germany, 2004.
[14] Grall A, Berenguer C, Dieulle L. A condition-based maintenance
policy for stochastically deteriorating systems. Reliab Eng Syst Saf
2002;76:16780.
[15] Janssen J, Blasi A, Manca R. Discrete time homogeneous and non-
homogeneous semi-Markov reliability models. In: Proceedings of the
third international conference on mathematical methods in reliability.
MMR 2002, Trondheim, Norway, 2002.
[16] Muppala JK, Trivedi KS. System dependencies in Markov depend-
ability modelling. In: Fault-tolerant systems and software, FTS-95.
New Delhi, India: Narosa Publishing House; 1995. p. 3847.
[17] Limnios N. Semi-Markov processes and reliability. Boston: Birkhau-
ser; 2001.
[18] Billington R, Allan RN. Reliability evaluation of engineering
systems: concept and technics. New York: Plenum Press; 1983.
[19] Dutuit Y, Chatelet E, Signoret J-P, Thomas P. Dependability
modelling and evaluation by using stochastic Petri nets: application
to two test cases. Reliab Eng Syst Saf 1997;55(2):11724.
[20] Weber P, Jouffe L. Complex system reliability modelling with
dynamic object oriented Bayesian networks (DOOBN). Reliab Eng
Syst Saf 2006;91(2):14962.
253
[21] Dugan JB, Bavuso S, Boyd M. Dynamic fault-tree models for fault-
tolerant computer systems. IEEE Trans Reliab 1992;41(3):36377.
[22] Bouissou M, Bon JL. A new formalism that combines advantages of
fault-trees and Markov models: Boolean logic driven Markov
processes. Reliab Eng Syst Saf 2003;82(2):14963.
[23] Muller A. Contribution to the proactive maintenance of manufactur-
ing system: formalisation of the prognosis process. PhD thesis, Henri
Poincare University, Nancy, France, 2005 [in French].
[24] Dean T, Kanazawa K. A model for reasoning about persistence and
causation. Comput Intell 1989;5:14250.
[25] Welch R, Thelen T. Dynamic reliability analysis in an operational
context: the Bayesian network perspective. In: Proceedings of the
fourth workshop on dynamic reliability: future directions. 2000. p.
277307.
[26] Weber P, Jouffe L. Reliability modelling with dynamic Bayesian
networks. In: Proceedings of the fth IFAC symposium on fault
detection, supervision and safety of technical processes. Washington,
USA, 2003. p. 5762.
[27] Neapolitan RE. Learning Bayesian networks. New Jersey: Prentice
Hall, Upper Saddle River; 2003.
[28] Celeux G, Corset F, Lannoy A, Ricard B. Designing a Bayesian
network for preventive maintenance from expert opinions in a rapid
and reliable way. Reliab Eng Syst Saf 2006;91(7):84956.
[29] Pham H, Wang H. Imperfect maintenance. Eur J Oper Res
1996;94(3):42538.
[30] Lawley HG. Operability studies and hazard analysis. Chem Eng Prog
1974;70:10516.
[31] IEC 60812 standard. Analysis techniques for system reliabilitypro-
cedure for failure mode and effects analysis (FMEA). 1985.
[32] Leger J-B. A case study of remote diagnosis and e-maintenance
information system. Keynote speech of IMS2004, international
conference on intelligent maintenance systems. Arles, France, 2004.
[33] Weber P, Munteanu P, Jouffe L. Dynamic Bayesian networks
modelling the dependability of systems with degradations and
exogenous constraints. In: Proceedings of the 11th IFAC symposium
on information control problems in manufacturing. Salvador, Brasil,
2004.
[34] Schwabacher M. A survey of data-driven prognostics. In: Proceed-
ings of AIAA infotech@aerospace conference. Arlington, USA,
2005.
[35] Iung B. From remote maintenance to MAS-based e-maintenance of
an industrial process. J Intell Manuf 2003;14(1):5982.