2.2.1.1. Technical-centered engineering

The “Guide to the Body of Knowledge in Systems-engineering” regularly makes international publications [BKC 17] on the variety of techniques available that have also been the subject of publications on a national scale, such as Discovering and understanding systems engineering [MÉN 12] and Engineering and architecture of multidisciplinary systems [FAI 12], under the expertise of active members within INCOSE and AFIS⁴. This body relies on certain generic principles of a systemic approach [BER 68] to apply standardized engineering processes in a recursive, iterative and concurrent manner, scheduled by project management templates. The model-based systems engineering approach aims to contrast with the traditional document-based approach by replacing the project basic artifact of “process” by that of “model” without, however, clearly addressing this tautological difference since it is always a case of homomorphic representation of a reality [LEM 95]. The perspectives that structure the modeling approach focus especially on the exploration of the solution space in such a way as to satisfy the operational users’ needs of a required system, prior to detailed architecting design of its components and their assembly. The allocation of an operational architecture and of its alternatives onto a physical architecture of constituents according to several levels of top-down and bottom-up implementation/abstraction is part of industrial best practices that we do not present in this chapter (Figure 2.3). Much effort is made to ensure the ontological harmony of these multiple representations in order to reach certain a multidisciplinary interoperability of knowledge [GIO 15]. Their multidisciplinary orchestration may also be carried out with a unified language of system-oriented modeling, such as the de facto standard SysML [CLO 15] or domain-oriented modeling, for example, multiphysics [RET 15], to translate the intention of the system architect to the design.

Let us note that this orchestration metaphor expresses, among other things, the nonlinear reasoning [KRO 14] of architecting a system. This very essence of systems engineering can be constrained by a procedural organization of a project that would not correctly articulate the sequential management of the system development with the concurrent management of the operational processes of multidisciplinary engineering (Chapter 6.3, Volume 1 in [FAI 12]). Here, a different hindrance to scientific harmony between communities comes into play which can limit the human capacities for heuristic resolution of the problem/solution coupling [NUG 15].

2.2.1.2. Human-centered engineering

Human factors are an essential part of the engineering of a technical system, mainly in studies of operationality [VOI 18] and experience feedbacks. In this sense, our first works [LIE 13] were related to the nature of an “Artifact-Human”⁵ interaction of an anthropocentric approach that is synthesized by the AUTOS model (Figure 2.4, middle). Due to experience feedback, the satisfaction of the function of control {T} of an artifact {A} by a field operator {H} in an organized situation {O} of a maintenance support system {S} is highlighted a posteriori using the color orange (Figure 2.4, top left). It should also be noted that from a technical point of view, the multidisciplinary specification of operational security that requires the functional and technological independence of the two constituents for closing and locking this artifact has not necessarily ensured a priori the logical conjunction {∧} of their operationality. The proof given with the “B” method thus leads us to question both the system-centered organization of the project and the written text of procedures that does not necessarily capture the formal building of the relative action sequences as actinomies.

This work focused on specifying the physical quantity of “good orange color (photons)” that the artifact must provide so that the “afforded” functionality, among others, is “correctly perceived” in order to “correctly act by detour” [BER 06] in a situation. Indeed, we recommend that study of “Artifact-Human” interactions requires an organic understanding of the transmission conditions of symbolic properties between a technical object “source” and a human object “sink” – written – to be able to specify measurable requirements of the technical source. We therefore suggest studying the physico-physiological nature of this transmission and looking at the conditions under which the physiological processes take place on the biological substrate, based on work in perception and action physiology as well as in integrative physiology.

Beyond this result, this work reinforced the need to system center a priori the multidisciplinary organization of engineering that acts as architect in each of its respective domains but not always in an interdisciplinary way in relation to reality.

We then explored this system dimension in the context of an extension of the problem frames approach in software engineering to socio-technical systems [HAL 05]. This approach demonstrates that the specification of a respondent system {S_oI} to a system requirement {R_oI} of a domain of interest {W_oI} must formally satisfy three concurrent specifications (Figure 2.4, right) according to the logical entailment ├:

The technical-centered specification prescribes the control {P_C} of the process dynamics {P_O} of an artifact in situation {W_oI} depending on the predicate:

The human-centered specification prescribes the human capacity {H_O} to control {K_C} an artifact in situation {W_oI} depending on the predicate:

The interface-centered specification prescribes the technical capacity {I_C} of an artifact to interact with a human {H_O} in situation {W_oI} depending on the predicate:

It should be noted that the technical specification must contain, in the absence of being able to control it, unpredictable interactions between reality {W_oI} and the human {H}.

Let us now note the genericity of this interface problem {I_C} that we encounter, for example, with the analogical buttons of control “Turn Push Lights” [CHÉ 12] whose digital substitution must conserve the affordance functionality of a situation of states that reflect a situation system in the human-centered paradigm of power plant control (Figure 2.4, bottom left). The same applies to other senses involved to build all the mental patterns of situation, monitoring and action such as:

• – touch to perceive the vibrations of a pump in operation, to operate manual valves, etc.;
• – hearing to perceive the “gargling” of water in a pipe, the whistling of air during ventilation operations, an alarm in the control room or in the field, etc.;
• – sight to perceive a water level in a tank, an indicator, an analog/digital display, etc.

In section 2.3, we give details of the study of a socio-technical situation of “Artifact-Human” interaction involving the sound perception of an alarm by a human operator, and we underline the prerequisite for right perception of this signal, described as sensory affordance adapted from Hartson [HAR 03] (Table 2.1).

Our approach to the measurability of “Artifact-Human” interaction properties aims to be able to anticipate certain human factors as early as possible by modeling and simulation (section 2.4) in order to limit in fine the feedback for the type of situations targeted. This is in line with the 2025 vision of systems engineering [INC 14] concerning anticipation of performances of critical systems and mastery of their development as early as possible in the project, in order to transform system virtual models into reality. Finally, it should be noted that the human factors also relate to organization of the system project for which it seemed appropriate to us to better exploit the human capacity to face, by detour, the dilemma of a system architect having to allocate a system function to a human or technical agent, or even to both (Designer’s Dilemma, in [MIL 14]), especially since the perception of knowledge by a project stakeholder with regard to another project stakeholder only very partially reflects the dynamics of their respective knowledge. In our opinion, this is a relevant issue for building an interdisciplinary knowledge.

2.2.2.1. System-centered orchestration of multidisciplinary knowledge

We primarily focus our work on exploring the constituent problem space of a situation system that depends on abstraction aptitudes for thinking in systems [ALL 16]. We support this heuristic pathway by the mental schema of the holonic paradigm (Figure 2.5, left) that is particularly appropriate for reassessing the uncertainty of a situation in order to explore its non-ordered domain beyond what is already known [KUR 03], such as the interactions implicitly considered to be contained by the system surroundings but perhaps not. This holonification of a situation system, as a possible filter for all the conceptualizations of a reality, enables one to “design for the unexpected” [VAL 17] a holarchical system architecture {holon, Holon} that considers any object of interest as potentially constituent {h} of a composite object {H} until it becomes an elementary component of a realized solution architecture [JIN 06]. Thus, we understand the powerful modeling based on “holon” [KOE 67] as a constituent block of the system DNA [BOA 09a] for orchestrating in a centripetal way an interdisciplinary specification. For example, a control operator is a human-centered part {h_human} of a control artifact {H_artifact} of an operational system, as well as a human-centered part {h_human} as a “sentient being” whole (Wilber, in Chapter 1 of [MEL 09]) {H_Human} originally requiring an evolution of a situation system. This is therefore the case for our study hypothesis which found the architecting togetherness on the physical tangibility of the {h_artifact-h_human} sensory interaction as necessary but not a sufficient prerequisite to keep the system whole. This binding into unity (oneness) is generalized around the “flowing object” which gives life into being to the system in a diachronic way – over time – through the stimulated interactions, as a complement to the usual synchronic way – between instants – (refer to [GAL 99] to understand the importance of this two-dimensional architecting requirements in practice).

The objective is to model the system dynamics as early as possible, not only of negative causality loops (balance) but also of positive causality loops (reinforcement) in order to designate what must be controlled or can be contained by an “artifact–human” whole. The designation of a system of interest in the form of systemigrams and causal loop diagrams results in an architecture-solution draft, the wholeness of which can be ordered according to the 21 concepts of the conceptagon (Figure 2.5, right). We understand that delimiting the boundary between the perceived situation system and its broader surroundings is not trivial and results from a dynamic refinement during the building of an interdisciplinary knowledge of the targeted reality.

The coupling diagram proposed by [LAW 10] points out, in particular, the control loop that a respondent system has to keep in wholeness relative to a specified situation system. The interpretation (Figure 2.6) that we make of it goes further into detail about the cognitive nature of the coupling relations between multidisciplinary and interdisciplinary engineering knowledge that together individually provide a partial response and together an holistic response to the requiring operational situation system. In addition, we detail the specifying nature of these system-centered coupling relations between requiring “problem space” and responding “solution space” in order to orchestrate an interdisciplinary knowledge between the various constituent multidisciplinary blocks.

Our proposed orchestration results from an integrative process of multidisciplinary knowledge that is potentially available over the course of the refinement process of the specifications of a system project. This integration dynamics results from an allocation process of available multidisciplinary knowledge assets that become appropriate throughout the specification refinement process. We note, for example, that recursively works as a control-artifact architect with regard to hardware-centered and software-centered multidisciplinary knowledge. With this in mind, the same goes for and with regard to component human-centered and physics-centered multidisciplines.

We argue that the organization of the system project must consequently align itself with the targeted situation system wholeness to orchestrate the multidisciplinary “problem–solution” alternatives that are characteristic of the system architecting rationale. Thus, we have considered that the unique human property, called simplexity, of making the most likely decision by “detour” [BER 09] when faced with complex operational situations must also be the privileged constituent of the interdisciplinary orchestration of the engineering system by benefitting from collaborative working technologies.

This orchestration metaphor promotes human-in-the-loop inquiry, analysis and synthesis of a suitable system-in-the-loop solution, with the difficulty that the partition must be specified (written) in a collaborative manner over the course of interdisciplinary knowledge building. We noted, as also demonstrated by Retho [RET 15] in multiphysics system design, that this dynamics of architecting a system also points out multidisciplinary impact factors beyond the basic ones. In feedback of our experiments, we have also observed the need to enable multidisciplinary interactions to orchestrate themselves between disciplinary knowledge assets, to a certain extent in a “centrifugal way” not directly aligned with the “centripetal way” required by the system project.

It is the system under architecting specification, and the situation system in our case, which is the interdisciplinary integrator of these multidisciplinary contributions, which can become company ontology constituents in response to recurring situations of interest to control in the broad sense. In the following sections, a scenario exemplifies certain “simplex” requesting-responding loops of this interdisciplinary orchestration process.

2.2.2.2. Model-based system-centered specification

We have adapted the interpretation of a specification addressed in software engineering by the problem frames approach to our domain [DOB 10].

The result of the system-centered engineering process is a specification in a world of interest {W_oI} if a proof is given that an implementation of this solution {S_oI}:

• – from a responding solution space of system-centered engineering-knowledge ;
• – in the requiring problem space of operational situation-centered operational-knowledge ;

satisfies the requirements of interest {R_oI} by successive iterations according to the entailment relationship:

[2.1]

By arguing that the source of requirements of interest {R_oI} is in reality {W_oI}, this approach distinguishes the informal designation of a {S_oI} from its formal definition by the nature of the properties of interest {P_oI} contained in {R_oI}. The “optative” properties explicitly express what the artifact of interest {A_oI} must control, but they subordinate that under the implicit assertion that other “indicative” properties are controlled by the situation system {SS_oI} itself or are contained in a non-direct manner by {A_oI}. With regard, for example, to a system-centered resilience requirement, it is therefore necessary to make visible as soon as possible the phenomena of interest {Ph_oI} contingent upon measurability of the interaction properties {P_oI}, as presented in section 2.2.3. This in-depth interdisciplinary knowledge of a situation system complements the original knowledge of a situation for incremental validation of the levels of system of systems-level maturity⁶. This overcomes the only conformity of a part and even of an assembly of parts, including based on formal techniques [ZAY 17], if the phenomenological source of the verification properties is not sufficiently well grounded.

The specification process of the problem frames approach was then explored by Jin [JIN 06] by revisiting the meaning of a requirements specification within the holonic paradigm framework. The interest of these works is to better distinguish the designation of a system from its definition, in particular by arguing that the system knowledge of the phenomena of interest, which are source and sink of interactions within the problem space, enables the derivation of a new specification relationship according to:

[2.2]

Our cognitive interpretation of these works generalizes a set of coupling predicates between a requiring problem space and a responding solution space, according to:

• – descriptive specification of problem-oriented requirements according to:
  [2.3]
• – verified specification of solution-oriented models according to:
  [2.4]
• – prescriptive specification of solution-oriented models according to:
  [2.5]
• – validated specification of problem-oriented models according to:
  [2.6]

The predicates [2.3] and [2.5] highlight a major difficulty of multidisciplinary knowledge interoperability for each source-sink interaction. The knowledge perceived by each requiring or responding source is indeed their only visible (known) representation of the broader potential knowledge of the corresponding targeted sinks. In order to ensure the individual cognitive dynamics to build by detour a partial multidisciplinary model in request or response to a specification, we limited in SysML language only the essentials of the interdisciplinary representation to be shared for system-centered orchestration.

The orchestration process results from refinement iterations based on the twin-peaks model [HAL 02], throughout the life cycle of a system project between multidisciplinary knowledge, respectively interacting as the source of problem-oriented requirements specification (predicate [2.3]) and the sink of solution-oriented models specification (predicate [2.5]), each being verified in its own domain (predicate [2.4]) before contractual validation (predicate [2.6]). We note that this “formal system” that found a specification requires the solution to be validated in fine in a real situation (predicate [2.1]) from which all the requirements are issued and traced.

In section 2.4, we demonstrate the implementation of an environment of co-modeling co-simulation that enables this collaborative orchestration process for the system-centered validation of the model prescriptive specification of our case study. This type of environment aims to break away from the in silo approach of multidisciplinary systems engineering in order to orchestrate the dynamic exchange of knowledge and models by overcoming document sharing. It is all the more a structuring environment in system-centered engineering since digital technology facilitates individual cobbling of hardware-software-in-the-loop partial solutions that can complicate system architecting.

2.2.3.1. Multidisciplinary knowledge elements of a situation

In a socio-technical context, we call “situation” all the moments during which interactions between humans and their environment (work, life, etc.) take place in the form of reciprocal actions (according to [ZAS 08]). These actions lead to a result subject to external requirements and conditions [GIR 01].

A situation is put into being and service by human intention as an entity, in terms of elements and their interactions [DEV 95] and it makes sense to its users [BOY 98, MIL 15, END 16]. Thus, in our study, field operators , trained to apply safety procedures, as well as operational engineering specialists are de facto constituents of the targeted control situation (Figure 2.6, left) due to their phenomenological understanding, among other types of expertise, of the situation complexity [FRA 14]. Our situation of interest must, in order to be operational, commit in its totality humans as well as artifactual elements (alarm and technical installations of instrumentation) and physical elements such as the water flow that must be controlled. This commitment of resources in the entire targeted situation enables delimiting its boundaries (drawn in Figure 2.6, left), which designates it in its immediate surroundings and contextualizes it within its critical industrial process environment.

Its operating procedures depend on safety aspects of the context [GIR 01] for which it has been designed. Its commissioning depends on Technical Specifications for Operation (TSO) [APP 98] which are suitable for but limit its actions within its operational environment [ZAS 08].

The problem frames approach and its extension to socio-technical systems demonstrated that the dynamics of a situation is made perceptible to its users through phenomena manifested by the changes of state of its elements. They afford their human, artifactual or physical nature, which de facto enables the designation of the constituents of our situation of interest. Moreover, our exploration of a logic of effects [DUC 96] and a states-based approach [APP 98] enables us to argue that the continuum of phenomena makes them the sources and sinks of all the interactions (Figure 2.6) of the targeted situation. So, for our study, we have defined as exogenous a phenomenon the origin of which is in the surroundings of the targeted situation and which is the source of interactions triggering internal actions of it or being the result of these actions, for example, the phenomenon of perception of an operator causing an action of cognition (Figure 2.7). We have defined as endogenous a phenomenon the origin of which is in the situation of interest and which is the source or the sink of interactions triggering internal actions of an element of the situation, for example, the phenomenon of computation of an artifact (Figure 2.7). In the rest of this section, we denote {PheE_H, PheE_A, PheE_P} and {PheI_H, PheI_A, PheI_P}, respectively, the exogenous and endogenous phenomena, having a human (H), artifact (A) and physical (P) origin. According to Hall and Rapanotti [HAL 05], a phenomenon of interest is described as causal when it can be controlled or contained within the targeted situation. It is described as biddable {PheE_Biddable} when it is the cause of a problem and that even when identified, it leads to non-determinism in a situation of interest, such as can be related to “human nature”.

Among these multidisciplinary understanding elements constituent of , we designate {phenomena} as a unit of specification of a situation as required in its operational reality. Thus, made visible, it becomes a source of the measurability of properties {P_oI} that are required to be expected of a situation.

2.2.3.2. Descriptive specification of the targeted control situation

These multidisciplinary knowledge elements are applied to designate the targeted control situation in response to a requirements specification requested by to the system architect.

Since these requirements are expressed in the operational reality of the situation, we adopt a systems thinker’s attitude (Figure 2.5, left) to model phenomena which are source and sink over time of interactions between its elements and with its surroundings. By applying the system dynamics approach [FOR 94], we designate, in the form of a causal loops model (Figure 2.7), the causal implications of these phenomena, whether they are of physical, artifactual or human nature (respectively, red, blue or green).

This initial relation [ROS 12] of the targeted situation in collaboration with enables us to model how phenomena can build an abnormal or normal operation of our situation of interest.

The presence of a reinforcement causal loop (R) (Figure 2.7) in the model, made up of only links (S), reveals the amplification of some phenomena that lead to an abnormal situation:

• – the more a manifestation of a phenomenon {PheE_{Biddable secondary circuit}} disturbing the phenomenon {PheE_P} of water circulation in the secondary circuit of the SG occurs, the more the phenomenon of emission {PheE_A} of an alarm sound occurs, the more the studied sensory interaction is realized;
• – but because of the presence of a non-deterministic phenomenon {PheE_Biddable}, the less the phenomenon of its perception {PheE_H} by an operator occurs, and therefore the less the interaction is taken into account, and consequently the less the control situation of emergency water circulation is commissioned.

So, it appears that the non-deterministic phenomenon {PheE_Biddable} is at the origin of the requirements specification by . The normal operation of our targeted control situation is designated in by a balance causal loop (B) (Figure 2.7):

• – the more a manifestation of a phenomenon {PheE_{Biddable secondary circuit}} disturbing the phenomenon {PheE_P} of water circulation in the secondary circuit of the SG occurs, the more the phenomenon of emission {PheE_A} of an alarm sound occurs;
• – the more the studied sensory interaction is realized, the more the phenomenon of its perception {PheE_H} by an operator occurs and thus the more the control situation of emergency water circulation is commissioned;
• – the less the manifestation of a phenomenon of emission {PheE_A} of an alarm sound, the more the control situation of emergency water circulation is operational.

The presence of links (O) and (S) in the causal loop means a certain mutual balance between the various phenomena and provides early indication of a certain operationality of the targeted control situation.

In short, this initial descriptive specification of the targeted control situation must from now on be refined in order to be executable for purposes of verification in our domain of multidisciplinary knowledge .

2.2.3.3. Prescriptive specification of the targeted control situation system

Our multidisciplinary knowledge of the system dynamics approach leads us to examine the targeted control situation as a system (targeted control situation system) [LAW 10], in a collaborative manner with the relevant multidisciplinary knowledge . The resulting specification is verified by the execution of the model before being transferred in SysML language to the system architect.

2.2.3.3.1. Multidisciplinary specification

The previous model is refined in the form of a stock-flow diagram (Figure 2.8) of the targeted control situation system with the Stella⁷ tool, a modeling and simulation technology for the “system thinker”. Here, our attitude is to identify and represent the operational behaviors realized by the phenomena and the interactions occurring in a normal as well as an abnormal situation.

is refined according to rules of correspondence between the causal links (O or S) previously specified and triplets {flow-stocks-flow} [PON 11]. Thus, we model (Figure 2.8) the phenomena of interest as stocks (illustrated by rectangles), where their dynamics, meaning their manifestations or not in the situation, are represented by empty or full stocks. We model the interactions that take place in the situation system as flows (illustrated by directional pipes and valves) that represent their circulation between their source phenomena and their sink. Lastly, the causal implications of changes brought about by the interactions, respectively, exiting or entering their source or sink phenomena are modeled by connectors (illustrated by an arrow). Thus, the commissioning of the targeted control situation is the consequence of an accumulation in the stock of emission phenomenon {PheE_A}, triggering the flow of the interaction with the result of an accumulation in the stock of the perception {PheE_Hphenomenon {PheE_H} relative to the field operators. A contrario, the “non-accumulation” in the stock of the perception phenomenon {PheE_H} reveals a bad flow of the interaction following an accumulation in the stock of biddable phenomenon {PheE_Biddable}, the causes of which can be an inappropriate or unsuitable behavior of the emission phenomenon stock {PheE_A}.

Simulation (Figure 2.8, right), in discrete time, by the execution of in the Stella tool, is realized by modulating the stocks {PheE_H} and {PheE_Biddable} in a binary manner. It allows verification of the optative and indicative properties of interest , as are required by . It highlights the importance of the quality of behavior of the emission phenomenon {PheE_A} to guarantee correct “flow” of the targeted sensory interaction in order to allow the relevant field operators to perceive correctly and act correctly (see Figure 2.15).

This second relation of [ROS 12] of the targeted situation carried out in our domain of multidisciplinary knowledge but in collaboration with results in a prescriptive specification of the targeted situation system. It must from now on be expressed in a language that facilitates its translation to the system architect as a response to the requirements specification and to its validation by the domain of operational knowledge .

2.2.3.3.2. Interdisciplinary specification

In the current state of the modeling-simulation technology previously used, it is not possible to validate by co-execution with all the models of the targeted system specification, as addressed in section 2.4.3.1. In order to avoid neglecting this stage of translation of the interdisciplinary knowledge gained in this prescriptive specification, we translate it in SysML language for system-oriented orchestration. The IBM® Rational® Rhapsody® tool enables us to describe the complete behavior of the phenomena in the form of a SysML activities diagram (Figure 2.9) that specifies the main part of .

Thus, the phenomena of interest are modeled as SysML actors, to which PIN SysML actions are associated (illustrated with squares that frame an arrow) in order to designate them as a source or sink of interactions of interest. The interactions are represented by SysML activities to which their ActorPin source and sink phenomena are systematically associated. The dynamic of the targeted situation is represented in the form of a single diagram linking activities and actors leading to its normal and abnormal operation. All of the operational scenarios are generated in the form of SysML sequence diagrams in order to partially validate this prescriptive specification with the system architect.

In summary, our integration in the system project led us to the prescriptive specification , in terms of phenomena, interactions and causal implications, of the targeted control situation to satisfy the requirements specification required by according to . By arguing that its source is in the operational reality of the situation, this specification reveals that it is:

• – explicitly the “optative” properties of the emission phenomenon {PheE_A} that must be verified as a source of controllability of the sensory interaction targeted in this study;
• – under the assertion implicitly that the “indicative” properties of other phenomena are the source of controllability of contingent interactions by the targeted situation itself … but this is not necessarily true.

Translated mainly into SysML language, this specification enables the system architect to orchestrate the refinement of the interdisciplinary knowledge by keeping the system completeness of this first architecture draft (triads of the conceptagon shown in Figure 2.8).

The system architect must then look in greater depth at the source and sink of phenomena of the physico-physiological interaction of targeted sensory perception to then pass judgment on to aid decision-making about the feasibility of the interactivity that is targeted by the change of system-architecture technology (section 2.4.1.1). In other words, this specification is used as a reference situation system (as-is, Figures 2.7 and 2.8) to move towards implementation of this new architecture (to-be) in the real situation.

2.3.1.1. Mathematical theory of integrative physiology

The explanation of the propagation of this physical quantity through different biological structural⁸ units relies on the mathematical theory of integrative physiology (MTIP⁹) defined by Chauvet [CHA 93, CHA 95]. This theory, making up a brick of multidisciplinary knowledge of the physiology-centered engineering solution space, is based on a mathematization that has the objective of building executable models in silico¹⁰, describing physiological processes as a combination of non-symmetric and non-local “functional interactions” between structural units located in a hierarchical space (Figure 2.10(a)).

In order to facilitate understanding of the model building of sound sensing by a physiology-centered engineering solution space, we describe in the rest of this paragraph the theoretical basis for the MTIP, essential for our work, that the “functional interaction” provides. The MTIP is a theoretical physiology approach that envisages the living organism in its entirety, meaning as part of a general integrated system. Its mathematization aims to define the integration of biological mechanisms in interaction in order to describe the operation of the human system based on its sub-systems, while referring to the laws of physics. Effectively, for Chauvet, even if “biology cannot be reduced to physics. […] The living organism, in spite of all its difference with non-living matter, is part of the physical universe and must naturally be subject to physical laws. It is therefore difficult to believe the biological world to be devoid of the unity that the wonderful harmony of the laws of the physical universe entices us to seek—the elusive unifying theory” [CHA 04, p. 11 and 15]. In addition, for him, the organism, that is, all the physiological processes that take place between the various biological structures, is a continuous and finite hierarchical system of structures as well as a combination of functional interactions between these structures.

A functional interaction is considered to be the elementary atom of a physiological process. It is defined as “the action of a biological structure on another” by the intermediary of a physical entity (which may be some ions, molecules, photons or more generally a certain physical quantity) that thus enables data to be propagated from a structural unit that is a source¹¹ towards a structural unit that is a sink¹² (Figure 2.10(a)). This interaction has several specific properties [CHA 93]:

• – non-symmetry: the functional interaction acts from a structural unit “source” towards a structural unit “sink”. It represents a unidirectional action; thus, at the same level of organization, the signal will not retract from the sink to the source;
• – event causality: the cause–effect relationship is due to the existence of an event; since this event existed as a cause in a previous instant (t), the effect is going to exist at an instant (t’). This is a non-local, or even remote, effect;
• – non-instantaneity: the speed of transport of an elementary function is finite;
• – non-locality: an elementary function acts remotely and creates couplings between structures that are far apart. The exchanged product is transported from one place to another non-neighboring one by propagating across structural discontinuities¹³.

With this in mind, a functional interaction expresses a mechanism of passing a product between at least two structural units, for example, between the auditory cortex and the cognitive cortex. This passing mechanism depends both on time and space. It can be mathematically represented in the theoretical framework of the MTIP by a differential equation known as a “field equation” that implies non-local field operators called S-Propagator [CHA 02].

This operator enables, if necessary, the exploration of the lower levels of the source and of the sink (Figure 2.10(b) and (c)) and which are involved in the propagation of the functional interaction between themselves, as much in the emission and reception phases, by introducing the density of connectivity according to a spatial distribution.

It should be noted, however, that the building of these executable models in the MTIP formalism requires a large amount of data relating to human anatomy, physiology and biochemistry which are not currently all available, sometimes due to a lack of technical possibility in experimentation.

However, our previous work has shown that the scale factor required for the implementation of the MTIP in numerical modeling with the dedicated tool PhysioMatica™ was not necessarily possible with regard to the available physiological data (e.g. cellular or synaptic density). On the other hand, contextualization with regard to a targeted situation system enables other more available physiological data to be taken into account in a more macroscopic manner (e.g. threshold of sound perception). In this sense, we interpret the physico–physiological interaction of sound sensing as a physical interaction, meaning that a physical flow is propagated from a technical element “source” towards a physiological element “sink” as long as the crossed medium does not require a transmutation in biological flows.

2.3.1.2. Functional representation of a sensory interaction of perception/action

As Berthoz points out, “the Amygdala, which is an extraordinarily complex centre (Figure 2.11) […] immediately attributes a value (danger, pleasant, positive, negative, etc.) to what is observed” while giving a reminder that “in the prefrontal cortex […] there are two areas, very close to each other, that are respectively implicated, one in analysis and decisions using information that arrives from the exterior, and the other, very close by, which is implicated in the analysis of information that come from inside the brain, the memory, the internal information” [BER 12, pp. 116–117]. It is still necessary, in certain situations, to guarantee the correct reception of information by the sensor or sensors of the sensory system involved (information that is in fact given in a perceptible form before possibly becoming intelligible), in the form of a certain physical quantity required (light, sound, etc.) and lastly as having the correct data available and stored in the memory, also from a human point of view.

Thus, initially to explain this “physiology of perception and action” [BER 12] in a didactic way, we chose the thyristor model as a functional analogy to translate a first gate related to sensory perception and a second gate related to the stimulation of a certain stored and potentially available knowledge [DUP 12] (Figure 2.12(a)). And by combining with certain components of the MTIP, we have introduced a necessary but not sufficient condition into this mechanism, relating to the physical quantity required to ensure the right perception and relating to the interaction between the source and the sink.

In addition, the MTIP framework describes the physiological mechanisms as a spatio-temporal arrangement of processes based on physiological laws. Thus, the behavior of the living being is explained as a set of functional interactions propagating from one structural unit to another, which become the source or sink in turn, through a tangible continuum of physical nature. And the thyristor model transposed to a structural unit (Figure 2.12(b)) enables to understand this sink/source change of state. Effectively, a structural unit that is potentially a “sink” is likely to be able to receive a certain required physical quantity (necessary condition) coming from a structural unit “source”. This condition is far from sufficient, but this structural unit must have a potential “source” stimulated by means of an intermediate mechanism triggered by this initial physical quantity. Once these conditions are met, the “sink” becomes a “source” by propagating a certain physical quantity (similar or not) towards one or more other sinks, or itself (e.g. such as autocrine cellular communication). According to the complexified nature of the structural unit and of this “sink becomes source” mechanism, the one or more involved S-Propagators need to be explicit.

In addition, this analogy has been repeated in the interdisciplinary orchestration (Figure 2.6), in which each engineering asset potentially possesses a certain multidisciplinary knowledge particular to its specific domain (e.g. physiology). Its stimulation requires not only a semantic interoperability in SysML language, for example, but also a physical one, for example, a verbal exchange in order to better perceive to better understand. It should be noted that this analogy reflects the intrinsic nonlinear behavior behind the reasoning for “thinking and acting as a system”.

2.3.2. Prescriptive specification of the targeted interaction of auditory perception

We have instantiated the elements of multidisciplinary knowledge that are described in this situation in order to specify in SysML language some Physico-physiological requirements of interaction of auditory perception in response to a situation system-centered specification of requirements according to the predicate .

2.3.2.1. Multidisciplinary physico-physiological knowledge elements

With regard to the MTIP, the functional interaction of auditory perception in humans is carried by a sound wave which is a physical quantity related to the propagation of mechanical vibrations [MÜL 12]. By instantiation of Figure 2.10(b) and (c) to the particular situation of this auditory perception, we introduce the binaural dimension of human hearing, which manifests itself by the presence of two external ears and makes it possible to determine the spatial origin of the sound source (Figure 2.13(a)).

For the representation of the auditory perception interaction targeted by the situation system, we consider by analogy with the thyristor model a sensory potential “sink” and a potential “source” of perception.

In the following, we focus on one of the two hearing organs at the cellular level, without having to go down into the biological organization to prescribe the first physico-physiological requirements (Figure 2.13(b)).

Sound waves reaching the ear through the external auditory canal cause the eardrum to vibrate. These vibrations produce waves of very low amplitude in the internal ear which stimulate cilium cells located at the surface of the basilar membrane. These cilium cells are primary hearing receptors (analogous to the photoreceptors in the eye). The oscillations of the basilar membrane cause action potentials to be emitted by these cells, which activate the fibers of the auditory nerve that innervate the cochlear nucleus of the brain stem. The ascending fibers reach the auditory cortex after relaying with the inferior colliculus and in the medial geniculate body of the thalamus (Figure 2.14(a)).

Figure 2.14(b) represents the delimitation of the area of good human¹⁴ auditory perception as a function of the sound frequency belonging to a spectral range between 16 Hz (infrasound) and 20 kHz (ultrasound) and its sound intensity {I _sound} expressed in decibels (dB) [GOL 09].

2.3.2.2. Interdisciplinary specification of physico-physiological requirements

From this multidisciplinary knowledge (Figure 2.14(b)), the physiology-centered engineering solution space derives a new measurable requirement characterizing the targeted interaction by the sound intensity {I _sound} of the signal expressed in decibels according to the inequalities shown in Figure 2.15.

In this case, HearingRangesMin(w) and HearingRangesMax(w) are two mathematical functions returning, respectively, the minimum and maximum values of the sound intensity defined by the human auditory domain as a function of the sound signal frequency {w}, assuming, and due to reasons of reasonable simplification, that the latter is a pure sound, then characterized by a single frequency, here written {w} [MÜL 12].

In addition, using this requirement the physiology-centered engineering solution space derives a new requirement (Figure 2.15) that specifies, depending on the signal frequency {w}, the minimum duration of sound signal to be emitted in order to guarantee “right” perception by a human “sink”.

Finally, in order to facilitate the “right” auditory sensing of the sound alarm, the physiology-centered engineer further recommends that the binaural sub-system (the two ears, Figure 2.13(a)) of the operator should be aligned with the sound source, thus introducing a new requirement that is anthropometric in nature (Figure 2.15).

This “source/sink” constituent contextualizes the interaction of auditory sensing of a pure sound (and more generally of a complex sound signal that results from the superposition of pure sounds) by mathematically defining the dependence of the sound intensity on the sound pressure, according to Müller and Möser [MÜL 12]:

[2.7]

[2.8]

[2.9]

with the parameters {P_rms = effective pressure, P = sound pressure that depends on the coordinates in space {r} and in time {t}, E = sound power of the sound source, c = speed of sound, ρ₀ = density of air, r = source – sink distance}.

It should be noted that the parameters {c} and {ρ₀} depend on the temperature, the humidity and the atmospheric pressure that are evaluated in the medium of sound propagation. In addition, equation [2.9] demonstrates that the sound power diminishes as a function of the distance from the source. In this sense, the sound interaction appears strongly contextualized by depending on parameters related to the medium of sound propagation. This is even more true in an industrial environment (such as that of control of an electrical power plant) where several sound sources can be superimposed. Referring to the standards in effect such as NF S32-001 (1975), the solution space of physiology-centered engineering derives a new requirement specifying that the intensity of a sound alarm {I_sound} must be at least 10 dB higher than the ambient sound level {I_noise}.

Taking into account the two previous specifications, this component “source” must satisfy, among other things, the requirement , relating to the quantity of pressure wave required to detect a sound; the physiology-centered engineering solution space derives a new requirement that constrains the technical object “source” with regard to the constraints of the operational environment, according to the law defined by Müller and Möser [MÜL 12].

All these physiology-centered engineering requirements define a first model of the physico-physiological interaction of sound sensing of an alarm and can thus be prescribed to the problem space of systems engineering in the form of a diagram for validation. However, this first descriptive level of modeling is not sufficient for our heuristics of system co-specification which requires prescribing a constitutive model of an overall execution with other models.

2.4.1.1. Multidisciplinary knowledge elements in system architecting

A major system requirement in experience feedback from the increasing digitization of control rooms involves the improvement of the “active” monitoring of the targeted process. It becomes necessary to aid field operators further to easily and rapidly update, anywhere, anytime, a system representation of the whole process, that is to say, to “perceive right” in order to “understand right” for “acting right”. With this in mind (Figure 2.16, left), the “man–machine interaction” overcomes the classic framework of “interface” in order to facilitate multiple agentsʼ “interactivity” not only with analogical and digital hybrid constituents, but also with other tangible elements such as the flowing “matter-energy”. This architecting paradigm change for distributed automation was initiated by an important process industry-led European R&D program in the late 1980s. From the technological opportunity to unify a continuum of data communication around a real-time field bus, these works have demonstrated the interest of distributing a form of “technical intelligence” as close as possible to the physical process in order to filter sensing and actuating through instrumentation feedback.

The resulting architecting pattern is an integrated control, maintenance and technical management system (CMMS) allocating intelligent actuation and measurement functions (IAMS) to distributed intelligent actuators and sensors [PÉT 98]. In pursuing this work, advantage has been taken of digital technology by augmenting the instrumentation “hardware–software” interoperability towards a certain ambient “human–artifact” interactivity in order to filter actions and observations to/from the physical process. A service-information bus that encapsulates the matter-energy flow through a data-driven channel thus aims to increase the control capacities of field operators by mirroring the whole process behavior in the best way possible. This interactivity surpasses the interface by more broadly contextualizing surrounding reality in order to better perform local decision-making. The control architecting pattern we targeted aims to designate the endogenous and exogenous phenomenological source of interactions that the respondent system must control or contain.

2.4.1.2. Control-centered architecting specification

We note that control is one – but no more than one – element of the {communication command control} (Figure 2.17, right) triad of the conceptagon that distinguishes what is required externally from what is put in place to act internally. This is why an intermediary refinement first leads to a control logical architecture over the power-oriented process (Figure 2.17, left) without specification of the physico-artifactual transmutation – the instrumentation – between the physical process and the logical control that reflects the essentials of the internal circular causality . The process logical model is a multiphysical representation of the flow of energy-matter (water is reducible) in order to specify not only the endogenous phenomena to control but also the exogenous ones that must be contained. This specification in Modelica language can be executed with the Dymola® tool from an event-driven system orchestration in SysML language. The control logical model is a computational representation of an intelligent proportional, integral and derivative corrector (i-PID) coupling an ultra-local process model with a power command PID model.

Our interest in this type of command in comparison with a classic command is to adjust, during operation, the difference between the process under control and its ultra-local model in compliance with the monitoring requirements of our architecting CMMS-IAMS pattern. Another interest is also for a functional specification that the implementation of this technique does not require organic (ontological) identification a priori. This prescriptive specification in Simulink® language is executable with the Matlab® tool from an event-driven system orchestration in SysML language, although certain computational blocks must be confidential¹⁵ “black-boxes”, as is usual in industrial practice. The result of this prescriptive control artifact specification of the required system of interest is a set of executable multi-models that temporarily satisfy: .

The system orchestration whole process developed by Bouffaron [BOU 16] leads by successive refinements to the specification, among many, of an executable model of “intelligent measurement”. The implementation pattern (Figure 2.17, right) is a constituent of a control system architecting pattern that is composed of other constituents of observation, decision and action. Each of these constituents has, in a recursive manner, a “cognitive” or computational model of representation of its surroundings with regard to the required mission, for example, “to observe”. This is a holonic interpretation [BOA 09a] that aims to specify in a recursive manner that each {holon} performs and reports on the requested mission while keeping its internal structure operational. These bio-inspired principles of system-architecting and the associated artificial rules of modeling are applied, for example, in the HMS (holonic manufacturing system) architecting paradigm to design for the unexpected [VAL 17], where it is argued to be necessary to update an executable model that reflects “on the fly” the surrounding and changing world of interest {WoI}.

Each of the models has the purpose of being interoperable to facilitate its system coupling on a simulation bus, where the overall harmony (togetherness) is ensured by the SysML orchestration model. We give more precise details in section 2.4.3 of the system validation of the targeted measurement executable model.

2.4.2.1. Model-based prescriptive specification

The diagram of this executable specification consists of three blocks, each satisfying the architecting requirements of a logical partition {source/interaction/sink} of the functional interaction .

The technical block that is a source of sound emission is characterized by the position (X_Source, Y_Source) of the alarm {I _sound}. The sound emitted by the technical source is characterized by its frequency (Source_Frequency_Value) and its power (Power_Value). The switch block enables the activation or deactivation of the sound emission according to the value of the variable “AlarmReq” (Figure 2.18(a)).

The physiological block “sink” is characterized by the position (X_Sink_Value, Y_Sink_Value) of the human as well as by a sub-function “fncPerception’_ whose objective is to calculate the correct sensing (or not) of the sound alarm (Boolean perception), taking into account the frequency (Sound_ Frequency) and the power (Physiological_ Power) of the sound source, as well as the background noise (Background _ Noise) (Figure 2.18(c)). In a more detailed way, this function “fncPerception” concretizes the physiological requirement by comparing the result of the calculation of sound intensity received in the auditory canal with the upper limit (HearingRangeMax(w)) and the lower limit (HearingRangeMin(w)) of the human hearing range (Figure 2.18(d)).

The interaction block “source/sink” (Figure 2.18(b)) formalizes the propagation of the sound wave {I_sound} through the contextualized medium of the targeted situation. In this sense, it takes into account the speed (or celerity {c}) of sound varying as a function of the temperature and of the density of the propagation medium (rho), as well as the distance between the technical element “source” (X_Source, Y_Source) and human element “sink” (X_Sink, Y_Sink) to evaluate the amplitude of the source signal at the level of the sink. We particularly understand its importance for an in situ validation.

2.4.2.2. Executable model-based verification

The resulting diagram enables the feasibility of a specification of human-centered intelligent measurement to be verified by model execution according to different test scenarios.

The first test scenario consists of verifying that the sound power carried by the interaction and received by the human block “sink” decreases as a function of the distance with the technical block “source”. This verification shows that, for a constant power and emission frequency, the sound power received by the block “sink” decreases as a function of the distance between the two blocks (Figure 2.19(a)). It should also be noted that from a certain threshold (sound power < 11 W), the sound alarm is no longer detected by the human block “sink”.

The second test scenario consists of verifying that the sensing of the sound signal by a human block depends on the human auditory domain. By observing the execution trace (Figure 2.19(b)), we note that for a sound signal frequency higher than 20 kHz, alarm sensing is no longer guaranteed. This corresponds to the expected results since the signal is no longer included in the human auditory domain.

The last test scenario that we present consists of verifying that background noise is taken into account in the interaction model of sound sensing. We observe in the execution trace (Figure 2.19(c)) that for a background noise more than 10 dB higher than the noise emitted by the sound source, the sensing of the alarm by a human block is no longer guaranteed. In this sense, the property of attenuation of the noise with respect to the background noise is taken into account for the constituent interaction model.

We then present the system validation in silico and then in situ of this verified specification , orchestrated in SysML language.

2.4.3.1. Architecting knowledge elements in executable model-based specification

This cognitive work of multidisciplinary knowledge orchestration is now performed in a simplified way thanks to the increasing maturity of new digital modeling and simulation technologies that aim to ensure a continuum of information between the various engineering domains through integrative platforms. The latter intervene both for the implementation of the system specification process (co-engineering) and for the validation of the system specification by execution of models (co-execution). Collaborative engineering platforms now offer various levels of system integration, whose choice depends on a trade-off that takes into account engineering, industrialization, costs, training, automatization, etc.

A first level of integration is ensured by collaborative platforms that enable the multidisciplinary knowledge to be structured in a shared directory and engineering knowledge in specific directories. This collaboration is also supported by different services such as messaging, file sharing and scheduling provided by these various platforms¹⁶.

A second level of integration is ensured by PLM (product life cycle management) platforms which manage and share all the engineering and operational data of a system throughout its life cycle. These platforms¹⁷ provide capabilities of requirements and technical data management, visualization of digital mockups, configuration and change management, manufacturing processes management, quality and project management, etc. In this context, we note the definition of a standard for the multidisciplinary integration between various engineering tools: OSLC (open services for lifecycle collaboration) [OAS 10] for sharing engineering data.

Among these two solutions, we have retained the collaborative workspace implemented with the tool Quickplace integrated into the IBM Collaborations Solutions. Indeed, the implementation of PLM platforms requires formalizing processes and engineering data exchanged at the interfaces of specialist engineering, whereas the deployment of the chosen solution requires little investment and configuration, thus facilitating rapid prototyping of the implementation of our system orchestration process between multidisciplinary knowledge domains, themselves shared between a “solution space” and a “problem space” [MOR 14].

This collaborative engineering implies the implementation of an architecting approach for verification and validation at system level, in relation to the various engineering domains required for model analysis. Thus, in the context of our case study of physico–physiological interaction of auditory perception, we have focused on the execution of models to reach this objective of interoperation, as recommended by Boy and Narkevicius [BOY 14].

Among the techniques of model execution, we have focused initially on full integration, which consists of capturing all the specialist models within the same tool, to execute the global behavior of the system [LIE 13]. Although this technique facilitates the integration of specialist models between themselves, it also limits the choice of tools, languages and engineering methods, etc., which is contrary to our working hypothesis. We then focused on the “co-simulation” that consists of executing all the specialist models in each of their dedicated tools. These models interoperate with each other around a co-simulation bus in charge of orchestrating the exchange of data between the latter. In this context, the standard FMI (functional mockup interface) opens up perspectives from an industrial point of view for the exchange and co-simulation of models between different engineering tools [BER 14].

At the beginning of our work, the definition of standard FMI was still in the early stage; in this sense, we focus our attention on an owner solution that enables our system modeling tool (IBM^® Rational^® Rhapsody^®) implementing the SysML language to be interconnected with other engineering tools. Our choice then turned to the co-simulation bus (CosiMate^®)¹⁸ that also has the advantage of allowing us to develop our own coupling modules. We have thus been able to design a module between the co-simulation bus and the OPC (OLE for process control) server of our experimentation platform, for validation (system-in-the-loop) of the artifact-part of control-command of our case study in an operational situation.

2.4.3.2. Executable model-based validation

The model of human-centered intelligent measurement is orchestrated in silico (Figure 2.20) in a first step by the system architect throughout the co-simulation bus for partial system validation.

A model of system orchestration completes the SysML translation of interfacing blocks with control models of the process in order to define a structural model of the control artifact [PÉT 06] (Figure 2.17, left). The control specification is partially validated – in an open loop with regard to the situation system – by the SysML translation of the Bloc that enables control procedures to be executed in compliance with the specification of the required system according to: . We note that this orchestration model also constitutes a specification for the configuration of the system co-simulation environment.

This architecting process is iterative and by nature leads us to refine the models to converge towards a common and consistent definition of the flows exchanged between the various specialist models. Thus, we have defined new interfaces for the operational model of the situation: {Background_Noise} that defines the background noise that is linked to the operation of the experimentation platform, {Medium_Density} that characterizes the volumetric mass of air and consequently the speed of propagation {Sound_Celerity} in this environment. Other interfaces enable the definition of the order {AlarmReq} for the commissioning of the technical sound agent (control model) or to emulate in the process model a physical data for the presence or not of a leak {Water_Presence} that describes an incidental situation of control.

This system validation in silico then enables testing some technical alternatives for an alarm according to the emulated control situation system . Let us consider two scenarios (Figure 2.21) that have the objective of validating the power of the technical alarm for a given frequency (20 Hz) so that the human agent can detect the auditory alarm “correctly”. In scenario 1, we can observe that in the specified control system situation, the power of the auditory alarm is not sufficient to be perceived by the human agent (perception). In scenario 2, the power of the alarm is increased by 0.5 W, which enables the human agent to perceive the auditory signal.

The choice of alarm of the second scenario is finally validated in situ in the operational control situation emulated by our experimentation platform {CISPI}. For example, the sound of water supply pumps or that of instrumentation valves confirms in reality the validation of the precondition of auditory perception according to .

However, this exploratory work, complementary to that of Lieber [LIE 13], raises the question of the system validation of the model in silico with regard to all the human factors encountered in a given system situation and not taken into account in the executable specification. Other works have demonstrated that our environment of co-simulation could support an iterative specification approach that includes plans of experiences in situ in a complementary or alternative manner to modeling the targeted sensory interaction in silico. This has been made possible by the development of an “auditory interaction” model immersed in the control system situation of our experimentation platform process and orchestrated via the co-simulation bus by specialist models of the control artifact. The execution of experience plans is then done in an operational environment that comes as close as possible to reality and on which we can vary various factors (sound power and frequency, atmospheric noise, age of individuals, position in space, etc.) in order to evaluate their influences on the correct sensing of the sound alarm. However, we note that the model in silico enables us to target, in addition to techniques of fractional experimental designs [TAG 87], certain relevant system interaction parameters in order to implement the right strategy to minimize the number of tests carried out and simultaneously maximize the number of factors to study.