4.1 Existing failure analysis methods

Many methods for failure analysis take place late in the design process. Designers often use Failure Modes and Effects Analysis (FMEA) to decompose a system into sub-systems and components to explore possible failure modes and their effects on the system (Department of Defense 1980). The downside of FMEA is that it relies on engineering expertise, knowledge of the system, and historical data. This limits its usefulness for novel designs. Another widely used method, Fault Tree Analysis (FTA), shows paths leading to undesirable system states (Vesely et al. Reference Vesely, Goldberg, Roberts and Haasi1981). The usefulness of FTA, however, depends on the accuracy of the system representation, which can be lacking in the early design stages. Another design method is the use of a Reliability Block Diagram (RBD) (Jensen Reference Jensen2012). An RBD represents system architecture and component relationships graphically using failure rate information. If information is required for systems with dynamic behavior, it may be necessary to use a more advanced technique such as Markov analysis (Xue and Yang Reference Xue and Yang1995). A problem with such techniques is that they require accurate failure probabilities and independent failures (Jensen Reference Jensen2012). These may not always be the case in real-world complex engineered systems. These methods are therefore limited by the accuracy of the failure probabilities, independence of failures, and lack of usefulness early in the design process.

More recently, efforts have been made to move failure analysis to early stage design. This includes methods such as the Function-Failure Design Method (FFDM) (Stone et al. Reference Stone, Tumer and Van Wie2005). An extension of FFDM, Risk in Early Design (RED), takes into account likelihood estimates (Grantham Lough et al. Reference Grantham Lough, Stone and Tumer2007, Reference Grantham Lough, Stone and Tumer2008). FFDM and RED connect system failures to loss of function in order to identify potential failures. It then considers historical data so it can predict which failure modes are likely. It is therefore reliant on the availability of such data. Another method available in the conceptual design stage is Functional Failure Identification and Propagation (FFIP) (Kurtoglu et al. Reference Kurtoglu and Tumer2008). FFIP provides designers with information on failure behavior considering component, function, and behavior implementations. However, FFIP uses a behavioral simulation to determine fault propagation paths, which is computationally costly.

Taking an alternative approach, BNA makes the assumption that complex engineered systems can be represented by behavioral networks that abstract behavioral relations from a system and then represent those relations as a network. This network is the basis for the analysis of the tolerance of the complex engineered system to systemic failure.

4.2 Network analysis in engineering design

The fundamental idea behind BNA is that complex engineered systems can be represented as a complex network, a modeling formalism that has led to significant insights in multiple fields including social networks (Pattison et al. Reference Pattison, Wasserman, Robins and Kanfer2000), the world wide web (Albert et al. Reference Albert, Jeong and Barabási1999), and biology (Jeong et al. Reference Jeong, Tombor, Albert, Oltvai and Barabási2000; Sole et al. Reference Sole, Ferrer-Cancho, Montoya and Valverde2003). Complex network theory has already been applied to engineering design in a number of ways. A network approach has been used to analyze system modularity (Sosa et al. Reference Sosa, Eppinger and Rowles2007), analyze the effect of design changes (Ma et al. Reference Ma, Jiang and Liu2016), and predict customer responses to technological changes (Wang et al. Reference Wang, Sha, Huang, Contractor, Fu and Chen2016). Recent research has uncovered that the network structure of products and product development processes resembles many other real-world networks (Braha and Bar-Yam Reference Braha and Bar-Yam2004).

The idea behind using network analysis to understand system failures is to find an appropriate way to represent a complex engineered system as a complex network and use various techniques from network theory for analysis (Sosa et al. Reference Sosa, Mihm and Browning2011; Sarkar et al. Reference Sarkar, Dong, Henderson and Robinson2014). This is possible because of meaningful analogies between complex networks and complex systems (Mitchell Reference Mitchell2006), specifically with regard to failure behavior. The complex network perspective explicitly considers the relation between structure and function, that is, how entities come together in order to perform a function (intended purpose). It also explicitly considers the relation between structure and systemic risk of connectivity failure based on the interdependence of nodes. Simply put, the structure of the network affects how effectively a system accomplishes its functions and its resistance to systemic failure.

Much as a contagion spreads in a biological system, a failure in an engineered system can cause loss of performance downstream (Mehyrpouyan et al. Reference Mehrpouyan, Haley, Dong, Tumer and Hoyle2013a ). Failure in a complex network is described as fragmentation of the network into smaller, disconnected parts and is generally measured using size-based metrics such as the diameter of the network or the size of the largest connected component of the network. It is assumed that in the network’s original state, every node is connected to at least one other node in the network. An attack on a network can be either random or targeted, meaning nodes and edges are attacked (removed from the network) at random or due to specific properties such as their high degree of connectivity. A network’s ability to withstand attack has been well researched in other fields (Albert et al. Reference Albert, Jeong and Barabási2000; Sosa et al. Reference Sosa, Mihm and Browning2011). For instance, scale-free networks are vulnerable to targeted attacks on nodes having a high degree of connectivity but robust to random attacks (Albert et al. Reference Albert, Jeong and Barabási2000). In an engineering system, a random node attack is similar to a random failure whereas a targeted attack is similar to a failure initiated by a known external event that will impinge directly on the target node (design variable or parameter). For example, rain and fog can interfere with specific components in radar-based detection systems, compromising the system’s performance. For this reason, the transfer of knowledge about the failure of complex networks and complex engineered systems is possible.

4.3 Behavioral modeling

To understand how vulnerable a system is to the loss of function in an individual element in the system, previous work developed the concepts and mathematics behind network representations of engineering systems (Kasthurirathna et al. Reference Kasthurirathna, Dong, Piraveenan and Tumer2013; Mehyrpouyan et al. Reference Mehrpouyan, Haley, Dong, Tumer and Hoyle2013a ; Mehrpouyan et al. Reference Mehrpouyan, Haley, Dong, Tumer and Hoyle2013b ). The predominant modeling approach has thus far been to represent the components and their inter-relationships in the system as a network. The problem with using only the components in the network model is that the network model insufficiently represents behavioral interactions. Depending upon the assumptions used to create the component-based model, interactions between components may include physical connections or spatial interactions, such as a magnetic flux from one component that may impact nearby components. Any behavioral interaction is implied in the component model and it is not evident which interactions have been included and which have been excluded. In complex engineered systems, multiple design variables and parameters are often shared among components and sub-systems. Component models do not necessarily model the interaction between components due to these shared parameters. Taking into account behaviors rather than physical architecture alone means that a broader range of failure possibilities and sub-system interactions can be considered (Haley et al. Reference Haley, Dong and Tumer2014, Reference Haley, Dong and Tumer2016). Furthermore, while other methods of failure analysis rely on expert knowledge such as failure probabilities, failure behavior known through experience, and specific component selection, BNA does not. The advantage of BNA lies in early stage design, especially of novel systems, when this information is not known.

5.1 Prior work in behavioral network analysis

5.1.2 BNA system representation

The technique outlined in this section is based on the work by Haley et al. (Reference Haley, Dong and Tumer2014, Reference Haley, Dong and Tumer2016). The first step in BNA is to build the behavioral network from the system’s set of governing equations. Each individual function in the set of governing equations is referred to by a numbered function, for instance $F1$ . The network is bipartite which means it has two distinct types of nodes. In bipartite behavioral networks, these two nodes types are function nodes and parameter nodes. Any given node in a bipartite network can share an edge only with a node of the opposite type. A bipartite network can be transformed into a unipartite network through an appropriate transformation.

Next, a group of nodes is assigned to describe each function. In practice, the set of functions describing the behavioral network can be extracted from any mathematical or behavioral description of the system. In this project, the systems are derived from system models in OpenModelica, version 3.2.2 (OpenModelica 2016) and the sets of functions are extracted from the instantiation information. Two functions from an example model from the standard OpenModelica package, a rolling wheel, are shown below. They are called $F1$ (the first function in the set of governing equations of the system) and $F2$ (the second function in the set of governing equations of the system). A high-level description of this model is given in Appendix A. For each given function, such as the ones given below, there is one function node and at least one parameter node.

(1) $$\begin{eqnarray}\displaystyle & & \displaystyle F1:~\mathit{inertia.J}\times \mathit{inertia.a}=\mathit{inertia.flange}\_a.\mathit{tau}\nonumber\\ \displaystyle & & \displaystyle \quad +\,\mathit{inertia.flange}\_b.\mathit{tau};\end{eqnarray}$$

(2) $$\begin{eqnarray}\displaystyle & & \displaystyle F2:~\mathit{inertia.flange}\_a.\mathit{tau}+\mathit{torqueStep.flange.tau}=0.0;\end{eqnarray}$$

There are four parameter nodes in (1), one for each of the variables in the function. These are connected to the function node corresponding to the first function in the set of governing equations, $F1$ . The function node is $F2$ for (2). There are two parameter nodes corresponding to its two variables. This process, done for all functions, forms the system’s behavioral network. See Figure 1 for the behavioral network in which nodes are ovals and edges are lines drawn between nodes.

Figure 1. Network segment for basic BNA technique example from rolling wheel system for (1)–(2).

It is worth noting that for this example we have chosen two functions that share a design parameter. Not all functions in the set of governing equations will share a parameter. However, when the full graph is generated, all functions will be connected via at least one parameter node. Two given functions may not be connected together directly, but they will be connected together indirectly via other functions.

5.2 Bridging nodes

Since the focus of BNA is on finding vulnerabilities, and because of the analogy between complex engineered systems and complex networks, vulnerabilities in networks are relevant. Finding vulnerable nodes in a network is a key area of research in network science (Li et al. Reference Li, Li, Jia, Liu and Yang2013). Vulnerable nodes in a network are typically described as those for which the removal would disconnect a large group of nodes from the main portion of the network or greatly increase the path length between nodes. Recently, some researchers have focused on locating bridging nodes, which are nodes that connect communities (Zhu et al. Reference Zhu, Wang, Di and Fan2014; Liu et al. Reference Liu, Xiong, Shi, Shi and Wang2016). While there is some debate on the exact mathematical definition of a community in a network, the generally accepted definition of a community is tightly connected groups of nodes that have more connections to nodes within the community than to nodes outside of the community (Newman Reference Newman2010). Bridging nodes have been shown to be relatively more vulnerable than other types of nodes in the network (Hwang et al. Reference Hwang, Cho, Zhang and Remanathan2006).

Communities are located in a particular network using a community detection algorithm. There are many methods for community detection, but this paper will focus on methods based upon the concept of modularity maximization. Modularity maximization begins with an initial division of nodes into communities, which is often a random division into equally sized communities. Then, the change in modularity metric is calculated in the case that each node individually were to move to the other community. Those nodes for which their movement would increase the modularity metric by the largest amount (or those for which their movement would decrease the modularity metric by the smallest amount) and which have not already been moved are then moved to the other community. Once all the nodes have been moved, the algorithm saves this state and begins the process again. When the modularity metric no longer improves at the end of the process, the algorithm terminates (Newman Reference Newman2010).

Figure 2. Heat transfer of two masses behavioral network, unmodified.

The Q-modularity of a community or group in the network is calculated using the relation in (3), where $m$ is the number of edges, $A_{ij}$ is an element of the adjacency matrix, $k_{i}$ is the degree of vertex $i$ , $\unicode[STIX]{x1D6FF}(m,n)$ is the Kronecker delta, and $c_{i}$ is the community in which node $i$ belongs. The Q-modularity is always less than 1. A positive modularity indicates that there is more interconnectedness within a community than would occur by chance alone, whereas a negative modularity indicates that there is less interconnectedness within a community than would occur by chance alone (Newman Reference Newman2010).

(3) $$\begin{eqnarray}Q=\frac{1}{2m}\mathop{\sum }_{ij}\left(A_{ij}-\frac{k_{i}k_{j}}{2m}\right)\unicode[STIX]{x1D6FF}(c_{i},c_{j}).\end{eqnarray}$$

Bridging nodes are nodes that have at least one connection from a node within a community to a node in another community. In a community, there are many nodes that have connections internal to the community and few nodes that have connections outside of the community. The latter type of node is a bridging node. Bridging nodes essentially connect communities. The definition of bridging nodes, then, is inseparable from the definition of communities.

The conjecture presented in this article is that bridging nodes have a significant role in the failure tolerance of behavioral networks. This is an interesting research question because it suggests a link between the community structure of behavioral networks and their failure tolerance. Communities of nodes exist in almost all networks, and they do not exist by chance. Whether by self-organization or intent, elements form communities to perform a higher-level function. From a physical architecture perspective, these communities represent sub-systems that perform a specific function. In behavioral networks, these communities are a collection of design parameters which perform a behavior. Though it would be highly unlikely that communities would not exist in behavioral networks, communities are not completely evident in the set of governing equations. Other than communities that are defined by a single equation, ‘emergent’ communities arise from the structure of the set of equations describing the systems. Figure 2 shows the behavioral network of an engineering system. Figure 3 shows the same behavioral network with the communities circled for purposes of illustration. This behavioral network is for the heat transfer of two masses system, described at a high level in Appendix A. These communities were located using a modularity maximization community detection algorithm. If a bridging node were to fail, then these behavioral communities would become disconnected from other behavioral communities in the system. This could cause a potential fault. Given the established relation between the change in ASPL and system-level failure, this article tests whether or not the change in the ASPL of bridging nodes is higher than the change in the ASPL of non-bridging nodes.

Figure 3. Heat transfer of two masses behavioral network, communities circled.

6.1 Conceptual proof

Considering the definition of ASPL and the definition of a bridging node, it can be shown conceptually that an attack on a bridging node induces a larger change in ASPL than an attack on a non-bridging node. The ASPL formula, given in (4) (Newman Reference Newman2010), considers the shortest path between all pairs of nodes in the network. In (4), $n$ is the number of nodes in the network and $d$ is the shortest distance between two nodes. The indices $i$ and $j$ refer to individual nodes. The equation for ASPL indicates that a shorter distance between nodes decreases the ASPL. A visualization of this concept is shown in Figures 4 and 5. In Figure 4, a completely connected graph, each node neighbors every other node in the network. In contrast, in Figure 5, some nodes are farther apart, meaning the ‘path’ between these nodes is more than one edge long (in Figures 4 and 5, assume that all edge weights are equal).

(4) $$\begin{eqnarray}\text{ASPL}=\frac{1}{n^{2}}\mathop{\sum }_{ij}d_{ij}.\end{eqnarray}$$

The ASPL for any node under attack is always less than or equal to the nominal case because attack on a node decreases the edge weights of the nodes associated edges, thereby decreasing the length of the path between the nodes. Those edges that connect communities are like major freeways between cities in that they are the shortest path between a large number of nodes, in contrast to edges that are within a community which may only connect a few nodes that are within their community. If the edge weight of an edge that connects two communities is reduced, the shortest path between all those nodes connected by this edge is shortened even further, thus reducing the ASPL significantly. However, if the edge weight of an edge that connects nodes within a community is reduced, the shortest path between only those local nodes within the community is shortened, meaning there is less of an impact on the ASPL. This effect can be shown on the relatively simple behavioral network shown in Figures 6 and 7. Figure 6 shows the edges associated with a bridging node highlighted. Figure 7 shows the edges associated with a non-bridging node highlighted. The system shown here is a voltage divider circuit, described in Appendix A.

Figure 4. Small example network with $\text{ASPL}=1$ .

Figure 5. Small example network with $\text{ASPL}=2$ .

The nominal ASPL of the behavioral network with all edge weights equal to 1 is 8.05936. When the edge weights of the edges associated with the bridging node are reduced to 0.5, the ASPL is 7.79604. When the weights of the edges associated with the non-bridging node are reduced to 0.5, the ASPL is 7.81963. The bridging node, under attack, has a larger effect on the ASPL. These values can also be represented as  $\unicode[STIX]{x0394}\text{ASPL}$ by subtracting the failure values from the nominal value. This shows how much the ASPL has changed from the nominal. The  $\unicode[STIX]{x0394}\text{ASPL}$ of the bridging node is 0.26332 and the  $\unicode[STIX]{x0394}\text{ASPL}$ of the non-bridging node is 0.23973, meaning the bridging node has a larger  $\unicode[STIX]{x0394}\text{ASPL}$ than the non-bridging node. Either function nodes or parameter nodes can be bridging nodes, but only those bridging nodes that are parameter nodes are relevant to the method because those are the only nodes that are attacked. This small example tested on a relatively small, modular network illustrates why bridging nodes and ASPL are related. This intuitive example leads to the experimental study to show this observation more rigorously.

Figure 6. Behavioral network for voltage divider circuit with bridging node highlighted.

Figure 7. Behavioral network for voltage divider circuit with non-bridging node highlighted.

6.2 Description of method

The experimental study tests the hypothesis that bridging nodes have a higher  $\unicode[STIX]{x0394}\text{ASPL}$ than non-bridging nodes. To do this, first, a set of engineering systems was analyzed using the existing BNA method. For this study, each system was modeled in OpenModelica (OpenModelica 2016). In general, designers can obtain behavioral models using SysML or Simulink. After the behavioral model was obtained, the governing equations of each system were extracted from the OpenModelica instantiation information. The behavioral network was built from the governing equations using a text-processing MATLAB script. The text-processing script works by checking each function for its associated parameters and generating a list of nodes and edges with which to build the network. Once this information was obtained, Mathematica was used to generate the actual network that can be analyzed. The MATLAB script and Mathematica code make the computational time and human effort for this process trivial. This process for generating the network representation of each system was repeated for all forty systems.

After this step,  $\unicode[STIX]{x0394}\text{ASPL}$ values for each node in each system were obtained. Next, the modularity maximization algorithm built into Mathematica was used to find communities in the behavioral network for each of the forty systems. Then, the parameter nodes were split into two categories: bridging nodes and non-bridging nodes. To determine the categorization, all nodes that were in a specific community were considered and, using the accepted definition of a bridging node (Zhu et al. Reference Zhu, Wang, Di and Fan2014; Liu et al. Reference Liu, Xiong, Shi, Shi and Wang2016), these nodes were checked to determine if any were connected to a node in another community. In this case, this node was identified as a bridging node. This process was automated in Mathematica code and repeated for all nodes in the network. For each of the forty systems, the average  $\unicode[STIX]{x0394}\text{ASPL}$ of the bridging parameter nodes and the average  $\unicode[STIX]{x0394}\text{ASPL}$ of the non-bridging parameter nodes were calculated. This left forty data points for bridging nodes and forty data points for non-bridging nodes. To test the hypothesis that bridging nodes have a higher  $\unicode[STIX]{x0394}\text{ASPL}$ than non-bridging nodes, an independent samples t-test with unequal variances was used.

Recall that calculating the ASPL is not a recommended way of finding bridging nodes. The purpose of this experiment was simply to show that bridging nodes are associated with nodes having high  $\unicode[STIX]{x0394}\text{ASPL}$ . There are other, likely more efficient, algorithms that are being developed for finding bridging nodes (Hwang et al. Reference Hwang, Cho, Zhang and Remanathan2006; Li et al. Reference Li, Li, Jia, Liu and Yang2013; Zhu et al. Reference Zhu, Wang, Di and Fan2014; Liu et al. Reference Liu, Xiong, Shi, Shi and Wang2016). Nonetheless, the fact that nodes with a high  $\unicode[STIX]{x0394}\text{ASPL}$ tend to be bridging nodes shows that they are valuable to the study of behavioral networks and indicates the importance of the community structure of these networks. This is particularly significant given that the study was conducted using behavioral network models of real engineering systems.

6.3 Description of systems used

The forty systems used in the study were diverse in size, discipline, and governing equations. System size, as measured by number of edges, ranged from 33 to 1732 edges. See Figure 8 for a histogram of the different sizes of systems. In Figure 8 the size of a system was defined by the number of edges in its behavioral network. The systems came from multiple engineering disciples including electrical, mechanical, fluid/heat transfer, and magnetic. See Table 1 for a breakdown of number of systems by engineering discipline. Thirty eight of these systems were example models from OpenModelica, version 3.2.2 (OpenModelica 2016). One system was a simple voltage divider circuit model. One system was synthetic. The diversity of the sample set reduces the bias in our experiment and increases the external validity of the findings. The functions making up the governing equations of the system include continuous equations, discrete equations, embedded function calls, and many different mathematical operations. In size, discipline, and function type, then, the systems used should be representative of a wide variety of systems found in general engineering practice. A table with a high-level description of each of the systems can be found in Appendix A.

Figure 8. Sizes of systems studied.

Table 1. Characteristics of systems

A degree distribution plot is a commonly used type of plot to describe a network. It reveals structural characteristics of the network and can be used to differentiate between network types such as scale-free and random. It is essentially a histogram of the degree of connectivity of all the nodes in the network. The degree distribution plots for four of the resulting behavioral networks are given in Figures 9–12. These four networks are taken from each of the categories in Table 1 and are a representative sample of the forty systems. See Appendix A for a high-level description of these four systems. The shape of the degree distribution plots looks similar for all four and roughly follows the distribution of a homogeneous graph as opposed to a scale-free graph. A scale-free graph is robust to random attack and vulnerable to targeted attack (Albert et al. Reference Albert, Jeong and Barabási2000). However, the behavioral networks of these systems are not scale-free, which provides some insight into the failure tolerance of these systems simply from looking at their degree distribution plots. Given this characteristic, it is not a priori obvious whether bridging nodes will be more vulnerable (cause more significant degradations to system-level performance if they are attacked) than non-bridging nodes since both have a similar node degree.

Figure 9. Degree distribution plot for behavioral network of indirect cooling system.

Figure 10. Degree distribution plot for behavioral network of electrical multiphase rectifier system.

Figure 11. Degree distribution plot for behavioral network of simple drivetrain system.

Figure 12. Degree distribution plot for behavioral network of magnetic saturated inductor system.

In developing the behavioral networks for these systems, it was noted that there were some behaviors that existing modeling techniques could not handle. These behaviors had specific mathematical manifestations in the OpenModelica instantiation information. These mathematical constructs represent real behaviors in the real system. Therefore, modeling them correctly is critical. These modeling complexities were addressed before testing the hypothesis.

6.4 Modeling techniques

In this section, the modeling techniques developed in order to model more realistic systems are presented. First, a technique for modeling embedded behavior is presented. Then, a technique for modeling logical behavior is presented. With these techniques, systems with a wider range of behaviors can be modeled using BNA.

6.4.1 Modeling embedded behavior

An embedded function call represents embedded behavior. The function call may describe the behavior of a small sub-system or a mathematical tool in the governing equations used when a specific calculation needs to be performed several times. For instance, an embedded function could be used for converting a temperature in Celsius to a temperature in Kelvin. When these embedded functions are to be performed several times, each set of input parameters is unique, and therefore the output parameters of each function call are unique. In the governing equations, a function call occurs when an embedded function is defined and then referred to by at least one equation. An example is in (5)–(10). (5)–(9) comprise the function definition, while (10) demonstrates an equation calling the function. This example is from one of the systems used in the study. The embedded function definition may also include an algorithm to show how the output is calculated.

(5) $$\begin{eqnarray}\displaystyle & & \displaystyle \mathit{function}~\mathit{ToSpacePhasor}\end{eqnarray}$$

(6) $$\begin{eqnarray}\displaystyle & & \displaystyle \quad \mathit{input}~\mathit{Real}[3]~x;\end{eqnarray}$$

(7) $$\begin{eqnarray}\displaystyle & & \displaystyle \quad \mathit{output}~\mathit{Real}[2]~y;\end{eqnarray}$$

(8) $$\begin{eqnarray}\displaystyle & & \displaystyle \quad \mathit{output}~\mathit{Real}~y0;\end{eqnarray}$$

(9) $$\begin{eqnarray}\displaystyle & & \displaystyle \mathit{end}~\mathit{ToSpacePhasor};\end{eqnarray}$$

(10) $$\begin{eqnarray}\displaystyle & & \displaystyle F1:~(\mathit{electricalPowerSensor.i}\_,\_)=\mathit{ToSpacePhasor}\nonumber\\ \displaystyle & & \displaystyle \quad (\{\!\mathit{electricalPowerSensor.plug}\_p.\mathit{pin}[1].i,\nonumber\\ \displaystyle & & \displaystyle \quad \mathit{electricalPowerSensor.plug}\_p.\mathit{pin}[2].i,\nonumber\\ \displaystyle & & \displaystyle \quad \quad \mathit{electricalPowerSensor.plug}\_p.\mathit{pin}[3].i\!\});\end{eqnarray}$$

There are two outputs from the embedded function: $y$ and $y0$ . This is illustrated in (5)–(9). Because the outputs will be different depending on the inputs used, one cannot simply use those outputs every time the function is called. Otherwise, if the embedded function were used multiple times, the nodes associated with the outputs of the embedded function would have an inappropriately high node degree in the behavioral network. To handle this complexity, a new output parameter is created for each instance of the function being called. If the instantiation information has multiple function calls with different inputs, the name of the output must depend on the inputs used in the function call. The embedded function outputs for the function call are given in (11) and (12). To reiterate for clarity, embedded functions are not the same as the functions which are described by the governing equations of the system.

(11) $$\begin{eqnarray}\displaystyle & & \displaystyle y(\{\!\mathit{electricalPowerSensor.plug}\_p.\mathit{pin}[1].i,\nonumber\\ \displaystyle & & \displaystyle \quad \mathit{electricalPowerSensor.plug}\_p.\mathit{pin}[2].i,\nonumber\\ \displaystyle & & \displaystyle \quad \mathit{electricalPowerSensor.plug}\_p.\mathit{pin}[3].i\!\})\end{eqnarray}$$

(12) $$\begin{eqnarray}\displaystyle & & \displaystyle y0(\{\!\mathit{electricalPowerSensor.plug}\_p.\mathit{pin}[1].i,\nonumber\\ \displaystyle & & \displaystyle \quad \mathit{electricalPowerSensor.plug}\_p.\mathit{pin}[2].i,\nonumber\\ \displaystyle & & \displaystyle \quad \mathit{electricalPowerSensor.plug}\_p.\mathit{pin}[3].i\!\})\end{eqnarray}$$

The output parameters in (11) and (12), $\text{electricalPowerSensor.i}\_$ , and $F1$ comprise the list of nodes describing (10). The underscore on the left-hand side of (10) is not a parameter node because it is not a design parameter. A new function node must be added for the function call in (10). This is $F2$ . The nodes associated with $F2$ are the inputs and outputs of the function call. Figure 13 is the resulting network segment for this example.

Figure 13. Resulting network segment for function call example from SMEE generator system.

6.4.2 Modeling logical behavior

(13) $$\begin{eqnarray}\displaystyle & & \displaystyle \mathit{if}~\mathit{not}~\mathit{out}\_p.m\_\mathit{leakBEcurrentIsGiven}>0.5~\mathit{then}\end{eqnarray}$$

(14) $$\begin{eqnarray}\displaystyle & & \displaystyle \quad \mathit{out}\_p.m\_\mathit{leakBEcurrent}:=\nonumber\\ \displaystyle & & \displaystyle \quad \quad \mathit{out}\_p.m\_c2\times \mathit{out}\_p.m\_\mathit{satCur};\end{eqnarray}$$

(15) $$\begin{eqnarray}\displaystyle & & \displaystyle \mathit{end}~\mathit{if};\end{eqnarray}$$

Some systems included logical behavior, which shows up as discrete equations in the set of governing equations. An if-clause is one type of discrete equation. There is a relationship between the condition in the if-clause and the parameters contained in the body of the if-clause which cannot be ignored. All parameters in the body of the if-clause as well as the if-condition itself must be connected to a single function node. The same goes for parameters associated with an else-if or else statement.

Figure 14. Resulting network segment for if-clause example from electrical oscillator system.

An excerpt from the set of governing equations including an example of an if-clause is given in (13)–(15). Figure 14 shows the resulting network segment. Since all of the parameters in (13)–(15) are included in the same if statement, they are all connected to the same function node in the resulting network segment in Figure 14.

Other examples of discrete equations include when-clauses. There are also if-expressions and assert statements, which are handled the same as if they were structured as an if-clause. These modeling advances allowed all forty systems to be analyzed. In the next section, results of the empirical study are presented.