Methodology for Model Architecting and Failure Simulation Supported by Bond-Graphs—Application to Helicopter Axial Piston Pump

: This paper reports work performed to support the development of condition monitoring strategies through extensive use of simulation. The aim is to deﬁne and implement a methodology that makes the development of lumped-parameter models more efﬁcient and straightforward. This is achieved by considering the model architecting and the approach adopted for fault injection early in the process. Various options are proposed and compared for both these activities. The Bond-Graph formalism is extensively used for its ability to focus on the model structure and interfaces, the nature of the phenomena considered, and potential causality issues. The interest of the proposed methodology is illustrated with the example of a pressure-compensated axial piston pump that supplies the ﬂight control actuators in helicopters. The pump model architecting and the fault injection are presented, with special attention to jamming and erosion of the pump compensator valve. From these examples, it is shown that the proposed methodologies provide an efﬁcient model-based means of identifying fault signatures and implementing low-cost condition monitoring features in an industrial context.


Introduction
Safety, reliability and profitability have long been the main sinews of war in industry. If progress is to be made on these three important concerns, it is of interest to improve maintenance and its management. It was in this context that the concept of predictive maintenance arose. This maintenance paradigm is defined in parallel with that of stateof-the-art preventive maintenance, in which the systems are subjected to maintenance either according to a maintenance schedule or upon failure. Predictive maintenance allows the maintenance schedules to be optimized through proper condition monitoring (and assessment) of the industrial systems and components.
This last point is of great interest in the helicopter industry as helicopter fleets are scattered all around the globe, and some helicopters operate in very remote places. Predictive maintenance would enable replacement parts to be shipped before failure actually occurs so as to reduce the helicopter downtime due to maintenance. The present study deals with the condition monitoring of hydraulic axial piston pumps, which supply hydraulic power to the flight controls, in the aim of control force amplification on heavy-and medium-class helicopters. These pumps are under scrutiny as their malfunction could lead to the helicopter being grounded and flight operations being cancelled.
When the intention is to implement predictive maintenance, it is necessary to go through several steps to make use of all the potential benefits of this concept, as shown in Figure 1. The first one lies with the implementation of a condition monitoring system , which supplies information about the health of the system under scrutiny. This information which supplies information about the health of the system under scrutiny. This information is then used in a second step to forecast the evolution the monitored system behaviour, as mentioned in block ➋. Predictive maintenance then refers to planning corrective maintenance actions based on such a forecast, as indicated in block ➌.

Maintenance schedule update/creation
Prediction of health state evolution Evaluation of system current state Measure of system key physical quantities Condition monitoring system Condition monitoring ➊ should be able to provide the correct health status of the observed system, which includes the detection and diagnosis of any failed/failing part. According to [1], fault detection is defined as the "determination of the faults present in a system and the time of detection", while fault diagnosis is the "determination of the kind, size, location and time of detection of a fault". Fault detection and diagnostics (FDD) methods are of several kinds and have been extensively studied in the literature, e.g., as highlighted in [2][3][4].
Several types of approach have been used for condition monitoring and fault detection and diagnosis of hydraulic pumps. For example, Succi and Chin [5] used a datadriven FDD method based on measured vibration signals to detect three failed pumps. The first one was producing too low a pressure, the second one was making clicking sounds and the last one was overheating. Kwan et al. [6] designed a signal-based approach using the noise level of case drain flow measurements to detect and identify the overall degradation of aircraft hydraulic pumps. The authors of [7][8][9] used a signal-based method relying on discharge pressure measurement signals. They studied the ability of their approach to diagnose worn piston shoes and worn swashplate faults. In [9], Gao and Zhang also evaluated their approach against discharge valve wear.
Before defining a condition monitoring approach and algorithm, it is mandatory to acquire knowledge of the degradation patterns, so as to monitor the most relevant physical quantities. If knowledge is already sufficient to provide information on the link between fault and/or failure types and the variation of some measurable physical quantities, Condition monitoring should be able to provide the correct health status of the observed system, which includes the detection and diagnosis of any failed/failing part. According to [1], fault detection is defined as the "determination of the faults present in a system and the time of detection", while fault diagnosis is the "determination of the kind, size, location and time of detection of a fault". Fault detection and diagnostics (FDD) methods are of several kinds and have been extensively studied in the literature, e.g., as highlighted in [2][3][4].
Several types of approach have been used for condition monitoring and fault detection and diagnosis of hydraulic pumps. For example, Succi and Chin [5] used a data-driven FDD method based on measured vibration signals to detect three failed pumps. The first one was producing too low a pressure, the second one was making clicking sounds and the last one was overheating. Kwan et al. [6] designed a signal-based approach using the noise level of case drain flow measurements to detect and identify the overall degradation of aircraft hydraulic pumps. The authors of [7][8][9] used a signal-based method relying on discharge pressure measurement signals. They studied the ability of their approach to diagnose worn piston shoes and worn swashplate faults. In [9], Gao and Zhang also evaluated their approach against discharge valve wear.
Before defining a condition monitoring approach and algorithm, it is mandatory to acquire knowledge of the degradation patterns, so as to monitor the most relevant physical quantities. If knowledge is already sufficient to provide information on the link between fault and/or failure types and the variation of some measurable physical quantities, then the process of defining the variables to be monitored is quite straightforward.
However, when the existing knowledge is weak, two additional approaches: experimentbased and model-based, can be combined to increase knowledge, as shown in block of Figure 1. When knowledge is lacking and cannot be acquired by experimental means, the model-based approach can help define the most efficient monitoring method. It is indeed attractive to use such approach to identify the key physical quantities required for condition monitoring (see Figure 1). For example, Bayer and Enge-Rosenblatt [10] modelled an axial piston pump with signs of wear to determine adequate features for the detection of cylinder valve abrasion and increased piston-slipper clearance. The models can be data-driven or physics-based, depending on the amount and kind of data that is available. At present, data recorded in situ for helicopter axial piston pumps is scarce. This makes the physics-based modelling approach the best candidate. Nowadays, this can be supported by numerous commercially available simulation environments. However, there is a real need for a methodology that structures the model-based approach when it is intended to identify the above mentioned key physical quantities. As a consequence, the current project focuses on the boxes with bold text in Figure 1: model based approach, and the link between failure type and variation of the measurable physical quantities. Figure 2 emphasizes the model-based approach, which is applied in the current study. This approach follows a sequence of steps to provide well-developed and validated models. Then, using the validated models, simulation can be used to link the failure to the variation of the system's physical quantities. then the process of defining the variables to be monitored is quite straightforward. However, when the existing knowledge is weak, two additional approaches: experiment-based and model-based, can be combined to increase knowledge, as shown in block ➍ of Figure 1. When knowledge is lacking and cannot be acquired by experimental means, the model-based approach can help define the most efficient monitoring method. It is indeed attractive to use such approach to identify the key physical quantities required for condition monitoring (see Figure 1). For example, Bayer and Enge-Rosenblatt [10] modelled an axial piston pump with signs of wear to determine adequate features for the detection of cylinder valve abrasion and increased piston-slipper clearance. The models can be data-driven or physics-based, depending on the amount and kind of data that is available. At present, data recorded in situ for helicopter axial piston pumps is scarce. This makes the physicsbased modelling approach the best candidate. Nowadays, this can be supported by numerous commercially available simulation environments. However, there is a real need for a methodology that structures the model-based approach when it is intended to identify the above mentioned key physical quantities. As a consequence, the current project focuses on the boxes with bold text in Figure 1: model based approach, and the link between failure type and variation of the measurable physical quantities. Figure 2 emphasizes the model-based approach, which is applied in the current study. This approach follows a sequence of steps to provide well-developed and validated models. Then, using the validated models, simulation can be used to link the failure to the variation of the system's physical quantities.  In an industrial context, the physics-based models must be developed to meet durability requirements so as to ensure that the model will last and efficiently fulfil the company's need for a long time. To reach this goal, the model must allow easy understanding, In an industrial context, the physics-based models must be developed to meet durability requirements so as to ensure that the model will last and efficiently fulfil the company's need for a long time. To reach this goal, the model must allow easy understanding, reuse (even partial) and evolution. This can be achieved through the definition of proper  [11], which is considered a major step in the model-based approach of Figure 2. A methodology is proposed in the present paper (Section 2), to meet this target with resort to a proper model architectural view.

Model requirements definition
An axial piston pump model is designed as part of the project research, whose aim is to define and assess candidate approaches for the detection of pump degradation on a helicopter. An important step of the model development process of Figure 2 is then the creation of solutions for the simulation of pump degradation. Proposals as to how to model and inject faults in order to simulate the effect of degradation on the physical variables of interest (e.g., pressure and flow) are made in this paper.
Fault injection techniques have been extensively researched in the particular field of software and computer systems, e.g., [12]. However, fault injection in physics-based models of hydraulic systems and components is still rarely addressed. One reason for this is that, in this type of models, simulation of the faulty behaviour of an equipment item can amount to simply tweaking some parameters. An example of such a "parameter modification" approach can be found in, Bayer and Enge-Rosenblatt 's model. When considering simulation models developed to enable the effect of degradation on the physical outputs of a system to be studied, it is of interest to simulate temporal variations of faults. Some authors, e.g., [13], discuss the matter in the literature, but never from the point of view of implementation. On the basis of this status, the authors have introduced in the proposed methodology an approach that takes advantage of the Bond-Graph formalism to support the fault injection and the simulation of the response to the fault. This will be illustrated in Section 3 with the example of the jamming of the axial piston pump compensating valve.

Need for Architecture
In the industry, designing long lasting, reliable and profitable products is of great importance. The same should be true for the development of models, which can be considered as products: it is not desirable to spend resources on models that will be used only once or only during one project. Nonetheless, as each research project is different, it is obvious that models will constantly be enhanced or adapted to the current need. Consequently, it is preferable to create models that could be reused, even partially, in several projects. Thus, model development should be subjected to requirements of both realism and durability, just like any other product. It is then of utmost importance to properly identify the needs and constraints and define the requirements for the models during the first phases of a project.
In the current project, durability requirements have been listed for the axial piston pump model, and are highlighted in Table 1. Table 1. Durability requirements for the axial piston pump model.

1
Be as generic as possible for further modifications, easy to assemble and modify (e.g., change the number of pistons) 2 Allow modifications of parameters and mathematical expression 3 Give easy access to the basic components of the model 4 Be usable as a digital twin, also as "plug and simulate" (only applicable to the whole pump model) It was stated in the introduction that a proper model architecture can greatly help model reuse and understanding. However, model architecting is seldom discussed in literature as it is a product of pragmatism. When architecture is needed in models, it is generally managed implicitly thanks to the modellers' experience. Data-driven models, which are often black boxes, need less attention to architecting, except for their possible interaction with other models. Physics-based models can be classified as distributed-parameter models, which consider the physical phenomena to be spatially distributed, or lumped-parameter models, where the real distributed behaviour is approximated by discrete elements. Physicsbased distributed-parameter models have explicit architecture as they tend to be the local image of the real product. This is not the case for physics-based lumped-parameter models. Only a few published papers deal with architected lumped-parameter models. They ignore or poorly address architecting or structuration methodology, e.g., [13], [14] or [15]. In [16], the authors define an electro mechanical actuator model architecture derived from the product topology. Maré, after defining "Workshare" and "Capitalization" requirements, emphasizes that a topology-based architecture allows those requirements to be partially met as it helps model understanding and reuse. Then, [17] states that architecture should be fixed during the first phases of a project, yet anticipate future modifications.
Although some authors show interest in architecting, almost none of them really discuss methodology. For this reason, an architecting process is proposed below. This architecting process is applied to a physics-based lumped-parameter model here.

Architecting Process
Architecting a product, e.g., a model, can be defined as the process of defining it as a structure (or architecture) of organized and interacting elements, from a given point of view (e.g., functional, logical, conceptual, physical or technological). Here, the structure elements are considered as "blocks", and the interactions are modelled using links that represent the "interconnections" between these elements and the product environment. A "port" is a lumped interface of a block where an interconnecting link can be attached.
The proposed modelling process, Figure 3, is separated into "Architecting" and "Modelling" tasks, coming in a sequence. As the architecture must be defined in the early phases of a project, blocks, which are box-like objects meant be filled with models, must be ready for any future evolution or upgrade of the underlying models. In consequence, any possible interconnection has to be anticipated and potentially enabled through spare ports, during the first two steps of the process ( and in Figure 3). tion with other models. Physics-based models can be classified as distributed-parameter models, which consider the physical phenomena to be spatially distributed, or lumpedparameter models, where the real distributed behaviour is approximated by discrete elements. Physics-based distributed-parameter models have explicit architecture as they tend to be the local image of the real product. This is not the case for physics-based lumped-parameter models. Only a few published papers deal with architected lumpedparameter models. They ignore or poorly address architecting or structuration methodology, e.g., [13], [14] or [15]. In [16], the authors define an electro mechanical actuator model architecture derived from the product topology. Maré, after defining "Workshare" and "Capitalization" requirements, emphasizes that a topology-based architecture allows those requirements to be partially met as it helps model understanding and reuse. Then, [17] states that architecture should be fixed during the first phases of a project, yet anticipate future modifications.
Although some authors show interest in architecting, almost none of them really discuss methodology. For this reason, an architecting process is proposed below. This architecting process is applied to a physics-based lumped-parameter model here.

Architecting Process
Architecting a product, e.g., a model, can be defined as the process of defining it as a structure (or architecture) of organized and interacting elements, from a given point of view (e.g., functional, logical, conceptual, physical or technological). Here, the structure elements are considered as "blocks", and the interactions are modelled using links that represent the "interconnections" between these elements and the product environment. A "port" is a lumped interface of a block where an interconnecting link can be attached.
The proposed modelling process, Figure 3, is separated into "Architecting" and "Modelling" tasks, coming in a sequence. As the architecture must be defined in the early phases of a project, blocks, which are box-like objects meant be filled with models, must be ready for any future evolution or upgrade of the underlying models. In consequence, any possible interconnection has to be anticipated and potentially enabled through spare ports, during the first two steps of the process (➀ and ➁ in Figure 3).  As blocks are prepared for model enhancement, some ports may remain unused for a given level of modelling implemented in step . These ports must be managed in step , according to the simulation software constraints and features. In the case of architecting a lumped-parameter model from a power transmission viewpoint, interconnections are Sustainability 2021, 13, 1863 6 of 20 mainly related to power transfers from one block to another. However, some ports denote signal type interconnections. If possible, readability can be improved by making the distinction between the two types of interconnections explicit, using colour or line format. Colours are also welcome to make difference between physical domains, e.g., mechanical, hydraulic, thermal, electromagnetic, etc.
In the next section, an example of step is provided, within the context of the current helicopter axial piston pump model.

About Axial Piston Pumps
Most of the hydraulic axial piston pumps used on helicopters, Figure 4, are main rotor gearbox-driven, variable-displacement, and hydro-mechanically pressure-compensated. The shaft is driven by an external source of mechanical power (the helicopter main gear box), driving the barrel into rotation with respect to the pump housing. The pumping effect comes from a combination of motions: pistons are forced to rotate by their cylindrical pair joint with the barrel, while their head is forced to follow the plane imposed by the swashplate due to its planar joints with the piston slippers . As a result, the translation of pistons inside the barrel, combined with the porting at the valve-plate (not explicit on Figure 4 but marked ) generates the pumping effect between the suction and discharge ports. The swashplate tilt, setting the pump displacement, is controlled through the pressure compensating device. This device comprises a compensating valve that drives the motion of the stroking piston to vary the swashplate tilt angle. The compensating device also includes the rate piston , which generates a spring recall torque and a damping effect on the swashplate with respect to the pump housing (or case) . This pressure compensation mechanism makes the pump a source of near-constant pressure in its operational range. The pump parts are completely immersed in hydraulic fluid inside the pump case. The case drain port collects the pump internal leakage flows, which can be seen as functional (lubrication and cooling), as well as parasitic (loss of volumetric efficiency).
As blocks are prepared for model enhancement, some ports may remain unused for a given level of modelling implemented in step ➄. These ports must be managed in step ➅, according to the simulation software constraints and features. In the case of architecting a lumped-parameter model from a power transmission viewpoint, interconnections are mainly related to power transfers from one block to another. However, some ports denote signal type interconnections. If possible, readability can be improved by making the distinction between the two types of interconnections explicit, using colour or line format. Colours are also welcome to make difference between physical domains, e.g., mechanical, hydraulic, thermal, electromagnetic, etc.
In the next section, an example of step ➀ is provided, within the context of the current helicopter axial piston pump model.

About Axial Piston Pumps
Most of the hydraulic axial piston pumps used on helicopters, Figure 4, are main rotor gearbox-driven, variable-displacement, and hydro-mechanically pressure-compensated. The shaft ➊ is driven by an external source of mechanical power (the helicopter main gear box), driving the barrel ➋ into rotation with respect to the pump housing. The pumping effect comes from a combination of motions: pistons ➌ are forced to rotate by their cylindrical pair joint with the barrel, while their head is forced to follow the plane imposed by the swashplate ➍ due to its planar joints with the piston slippers ➎. As a result, the translation of pistons inside the barrel, combined with the porting at the valveplate (not explicit on Figure 4 but marked ➏) generates the pumping effect between the suction and discharge ports. The swashplate tilt, setting the pump displacement, is controlled through the pressure compensating device. This device comprises a compensating valve ➐ that drives the motion of the stroking piston ➑ to vary the swashplate tilt angle. The compensating device also includes the rate piston ➒, which generates a spring recall torque and a damping effect on the swashplate with respect to the pump housing (or case) ➓. This pressure compensation mechanism makes the pump a source of near-constant pressure in its operational range. The pump parts are completely immersed in hydraulic fluid inside the pump case. The case drain port collects the pump internal leakage flows, which can be seen as functional (lubrication and cooling), as well as parasitic (loss of volumetric efficiency).

Definition of the Axial Piston Pump Model Structure Outline
In the current project, a lumped-parameter model of a helicopter axial piston pump is developed. Considering the process defined in Figure 3, the first step towards the pump modelling is the definition of the model structure.
There are several candidate viewpoints for structuring the pump model. Here, the authors address two of them: model structured "by function" and model structured "by topology". Both structures are displayed in Figure 5, which also includes a transparent view of the pump for reference. For the sake of clarity, only mechanical (light green) and hydraulic (dark blue) interconnections are shown on these diagrams. In Figure 5, in order to keep the schematics as simple as possible, asterisks (*) are used to highlight hydraulic interconnections with the "Collect leakage" block in Figure 5b and "Case drain volume" block in Figure 5c. The limits of the structure related to the pump are represented by dotted boxes to highlight the interfaces of the complete pump model.
In the current project, a lumped-parameter model of a helicopter axial piston pump is developed. Considering the process defined in Figure 3, the first step towards the pump modelling is the definition of the model structure.
There are several candidate viewpoints for structuring the pump model. Here, the authors address two of them: model structured "by function" and model structured "by topology". Both structures are displayed in Figure 5, which also includes a transparent view of the pump for reference. For the sake of clarity, only mechanical (light green) and hydraulic (dark blue) interconnections are shown on these diagrams. In Figure 5, in order to keep the schematics as simple as possible, asterisks (*) are used to highlight hydraulic interconnections with the "Collect leakage" block in Figure 5b and "Case drain volume" block in Figure 5c. The limits of the structure related to the pump are represented by dotted boxes to highlight the interfaces of the complete pump model. In total, two candidate options were considered for the axial piston pump model architecture. However, only one structure is planned to be implemented. In order to help with selecting the architecture, the benefits and drawbacks of each structure are summarized in Table 2. In total, two candidate options were considered for the axial piston pump model architecture. However, only one structure is planned to be implemented. In order to help with selecting the architecture, the benefits and drawbacks of each structure are summarized in Table 2. In addition, the requirements defined in the first step of the modelling approach can be referred to in order to refine the choice of structure. Considering the information given  this table and the durability requirements defined in Table 1, the authors decided to use the architecture by topology for the current pump models. However, care should be taken to always analyse the possible model architectures in every project, as some special requirements could completely disregard the pragmatic architecture by topology, e.g., for systems or components with highly complex topology.

About Model Architecture and Causality
The model can be implemented with its architecture in several types of simulation software. Most of the simulation software packages are still causal and model implementation can raise causality issues. Causality deals with cause and consequence. In modelling and simulation, causality is about defining the sequence of computation, the input data and the output to be calculated. In a causal simulation environment, the sequence of computation of a given model is pre-defined following the software causality rules (e.g., avoiding numerical derivation and algebraic loops [19]).
Depending on the models used and their combination, causality clashes can be generated. In non-causal simulation environments, the solver deals with resolving the model equations by itself during compilation, given known variables. A-causality can be seen as the best option for a simulation environment, as the user does not need to manage sequences of computation. However, letting the software manage them on its own may sometimes increase the computation time, fail to compile (when numerous algebraic loops of high index are interlaced), or involve numerical derivations, low-pass filtering of which introduces phase lags and therefore alters the simulation accuracy. Finally, causal simulation environments remain massively used, given their maturity (and interest for realtime simulation).
In the present project, the models are implemented in the commercial simulation environment, Simcenter AMESim, which is causal: once the model is implemented, according to the model architecture selected, the block causalities are frozen. Consequently, reuse of the blocks constrains the models to use the same causalities at their interfaces. This is an implementation issue, which could be anticipated when specifying the block interfaces. However, this is not always possible as causality requirements can be induced by-or derived from-the features of the selected simulation environment.

Methodology for Fault Injection in Simulation
Fault injection can be implemented in hardware, software, and models [20]. Modelimplemented fault injection is easier, faster, cheaper and more versatile than the other two options. It allows the early identification of components or system design deficiencies. In the current approach, fault injection is used to study the behaviour of a helicopter pump against degradation, through the simulation of a physics-based model.
In recent years, tools have been developed to facilitate the implementation of fault injection in simulation environments. For example, van der Linden [21] proposed a standard code for the Modelica language, which allows centralized parameterization and triggering of faults during physics-based model simulations. Both parameter faults (ones with large time constant with regard to the simulation horizon, thus considered constant), and variable faults (ones with low time constants which generate transients in the simulated system) are supported.
One thing that seems to be missing from the literature, when considering fault injection and simulation in physics-based models, is related to methodology: although tools have been developed, very few examples of simulation of time variable faults are discussed. The reason for that is the simplicity with which the model parameters can be changed so as to simulate degraded states. For example, Bayer and Enge-Rosenblatt simulated the wear of axial piston pump cylinder valves through the slight variation of the cross section of each valve. In the same manner, Maia Neto and Góes [22] simulated degradation of an aircraft hydraulic brake system, amongst other things, by modifying the parameters of the associated friction model. These considerations have driven the author to develop a methodology for fault injection in simulation that takes advantage of the Bond-Graph formalism. It is detailed below.

Proposal for Fault Injection in Simulation Using Bond-Graphs
Bond-Graphs (BG) are oriented graphs intended to show the energy transfers from one system or object to another. They were first introduced in 1961 [23]. BG are mainly meant to model the dynamics of power systems with a lumped-parameter approach. BG models can be simulated directly using BG-oriented software, e.g., [24], or after extraction of equations for implementation, e.g., in a block diagram form. They also facilitate model building and analysis in icon-based simulation environments, which allow submodels to be connected through power links; for example, Simcenter AMESim or Dymola. The process of BG creation has been well established for decades and is not detailed in this paper. More detailed information on BG modelling can be found, for example, in [25] or [26]. Bond-Graphs define the model in a graphical way that is independent of the simulation platform used. Therefore, they facilitate knowledge capitalization, reuse and applicability. Another interesting feature of BGs lies in their ability to address causality graphically. The BG formalism is widely used due to its benefits: it provides a uniform approach that is applicable to any physical domain, it gives rapid access to the power paths, causal paths, dynamics, and causality issues. BG are attractive for condition monitoring, and are especially employed for fault detection and isolation using analytical redundancy relations [27] or algebraic observers [28], and to define the most suitable locations of sensors [29]. BGs have also been used for prediction of the remaining useful life, e.g., with particle filters in [30], and in [31].
In the current approach, BGs are used as a tool to support the development of models to simulate failures so as to define the proper physical quantities to be monitored. One example of the use of BGs in such a context of failure simulation and fault injection can be found in [13], where the authors simulate the temporal deterioration of the traction system of the Chinese high speed train. However, although they disclose the degradation models used, they do not address the methodology used for fault injection.

Methodology Proposal
Concerning fault injection in physics-based models, two options can be identified, depending on the physical phenomenon to be simulated. If the failure mechanism in question directly influences a parameter of an existing model, this parameter can be varied and, therefore, becomes a time variable. If not, an additional physical phenomenon should be added. These two possibilities are slightly different in terms of implementation.
Care should be taken not to add unrelated new components that meet the need for introducing the fault but that are not directly related to the physical phenomena at hand. For example, to simulate jamming, one could add a brake model. Unfortunately, this significantly alters readability and understanding because there is no brake in the system considered. Increasing the level of friction between moving pieces is therefore preferred and more realistic. Of course, for earlier top-level activities in the design process, faults can be introduced in a more logical way (e.g., "if jamming, then no motion").
A methodology for fault injection in physics-based models that follows the steps defined below is proposed:

•
Step 1: Define the failure mechanism(s) and associated fault(s) to be studied in the system of interest. Care should be taken to identify the physical phenomena involved.

•
Step 2: Make a functional BG of the system. Identify the BG element(s) affected by the fault(s) selected in Step 1.

•
Step 3: Write the equations of the affected BG elements. If the fault impacts a parameter, modulate the BG element with its value. If the fault cannot be simulated with the initial BG architecture, add a model of the fault physical behaviour to the existing BG. In both cases, the BG element is modulated by a signal.

•
Step 4: Based on the BG drawn, implement the model in the desired simulation environment. A fault is injected by modulating the relevant parameter(s) or physical phenomena.
This fault injection methodology is illustrated in Section 3.1.2 through the example of increasing wear in an actuator nut-screw.

Illustration of the Fault Injection Methodology for a Nut-Screw
The fault addressed is the increase in wear, which reduces the preload (when it exists to remove backlash) then generates increasing backlash. As mentioned above, the intention is to model the fault by altering a single parameter of the transmission model. In this attempt, the transmission preload/backlash is modelled as follows, according to the representation given in Figure 6. In this figure, two translating bodies are considered ( and ) to include backlash or preload in the translational motion axis of the nut-screw. Forces are transmitted between and through unilateral elastic contacts (1L and 1R). The single parameter x 0 denotes preload when it is negative and backlash when it is positive. The value of this parameter increases with length of service, as a result of wear. To avoid unrealistic rebounds, damping at contacts can be introduced as, e.g., indicated in [32]. Damping at contacts is not displayed in the figure. The stiffness of a positive mechanical transmission is represented by plotting the contact force at facing solids ➊ and ➋ vs. their relative displacement, − . An example is given in Figure 7 for linear elastic contacts. Varying the parameter from a negative value to a positive value produces a continuous change in the transmission characteristic. In the backlash domain, no force is transmitted by contacts whatever the relative displacement − . In the preload domain, the two elastic contacts are active and sum their forces. This doubles the local stiffness. The stiffness of a positive mechanical transmission is represented by plotting the contact force F c at facing solids and vs. their relative displacement, x 1 − x 2 . An example is given in Figure 7 for linear elastic contacts. Varying the parameter x 0 from a negative value to a positive value produces a continuous change in the transmission characteristic. In the backlash domain, no force F c is transmitted by contacts whatever the relative displacement x 1 − x 2 . In the preload domain, the two elastic contacts are active and sum their forces. This doubles the local stiffness.
The corresponding BG is given in Figure 8. The left-hand side of the figure explicitly shows the contribution of the left (1L) and right (1R) contacts between solids and of Figure 6. The right-hand side BG gives a more compact model. Although it violates the BG rules about energy conservation (no modulated C permitted), it can be used when the aim is to represent only a slow variation of x 0 , with negligible energy exchange in comparison with the energy flowing in the modelled mechanical transmission.
As highlighted by the causality marks (short red lines perpendicular to the bond end), neither representation points out any causality issue: neither derivation nor algebraic loop.
The stiffness of a positive mechanical transmission is represented by plotting the contact force at facing solids ➊ and ➋ vs. their relative displacement, − . An example is given in Figure 7 for linear elastic contacts. Varying the parameter from a negative value to a positive value produces a continuous change in the transmission characteristic. In the backlash domain, no force is transmitted by contacts whatever the relative displacement − . In the preload domain, the two elastic contacts are active and sum their forces. This doubles the local stiffness. The corresponding BG is given in Figure 8. The left-hand side of the figure explicitly shows the contribution of the left (1L) and right (1R) contacts between solids ➊ and ➋ of Figure 6. The right-hand side BG gives a more compact model. Although it violates the BG rules about energy conservation (no modulated C permitted), it can be used when the aim is to represent only a slow variation of x0, with negligible energy exchange in comparison with the energy flowing in the modelled mechanical transmission.
As highlighted by the causality marks (short red lines perpendicular to the bond end), neither representation points out any causality issue: neither derivation nor algebraic loop.

Preload force
Relative displacement

Application to the Axial Piston Pump Compensating Valve
In helicopters, hydraulic system pressure is very important as its loss and/or instability can cause manoeuvrability (i.e., safety) issues. The compensating valve controls the pump displacement and, thus, the pressure in the hydraulic system. Consequently, failure mechanisms of the compensating valve are of high interest in the current framework.
Some of the most usual faults of the axial piston pump compensating valve are jamming due to fluid particle pollution, and erosion, which tend to appear mainly at the valve metering edges [33]. It was decided to apply the proposed fault injection methodology to the compensating valve using these two faults.

Compensator Model and Fault Injection
The model of the pump displacement control is given in Figure 9. It includes the compensating valve, the compensating piston and spring, the stroking piston and the swashplate. For greater clarity and comprehensibility, physical domains are not shown in this figure. However, signal bonds and causality marks are highlighted using red lines. It is important to mention that the architectural view described in Section 2.2.2 was successfully applied to make this BG model.

Application to the Axial Piston Pump Compensating Valve
In helicopters, hydraulic system pressure is very important as its loss and/or instability can cause manoeuvrability (i.e., safety) issues. The compensating valve controls the pump displacement and, thus, the pressure in the hydraulic system. Consequently, failure mechanisms of the compensating valve are of high interest in the current framework.
Some of the most usual faults of the axial piston pump compensating valve are jamming due to fluid particle pollution, and erosion, which tend to appear mainly at the valve metering edges [33]. It was decided to apply the proposed fault injection methodology to the compensating valve using these two faults.

Compensator Model and Fault Injection
The model of the pump displacement control is given in Figure 9. It includes the compensating valve, the compensating piston and spring, the stroking piston and the swashplate. For greater clarity and comprehensibility, physical domains are not shown in this figure. However, signal bonds and causality marks are highlighted using red lines. It is important to mention that the architectural view described in Section 2.2.2 was successfully applied to make this BG model.

Compensator Model and Fault Injection
The model of the pump displacement control is given in Figure 9. It includes the compensating valve, the compensating piston and spring, the stroking piston and the swashplate. For greater clarity and comprehensibility, physical domains are not shown in this figure. However, signal bonds and causality marks are highlighted using red lines. It is important to mention that the architectural view described in Section 2.2.2 was successfully applied to make this BG model. See Figure 10   Focusing now on the compensating valve, where the fault injection methodology is applied, Figure 10a shows a cross sectional view of the compensating valve used in this study. The compensating valve is composed of a spool, a sleeve and a spring. The sleeve is rigidly linked to the pump housing. The pump discharge pressure is sourced at the pressure port, while the load port is connected to the chamber of the stroking piston. When the delivery pressure overcomes the spring force, the valve spool moves to the left. This progressively closes the path from the load port to the return port, and increases the path from the pressure port to the load port. As a result, the stroking piston extends and reduces the pump displacement by lowering the swashplate tilt angle. Figure 10b displays the BG model of the compensating valve with fault injection, once the proposed methodology has been applied. It is assumed that the compensator sleeve and pump housing are fixed. The 1 junction depicts Newton's second law applied to the spool. If it is non-negligible, the kinetic energy due to the moving parts of the spring can be taken into consideration by increasing the spool mass parameter M spool by 1/3 of the spring mass. The two transformers and ' model the hydro-mechanical power transformation occurring at the two ends of the spool. The three metering edges a, b and c are modelled by R-fields α, β and γ, which are modulated by the valve opening. Resort to an R-field is interesting because it is thus possible to introduce:

•
The functional variable hydraulic resistance effect. According to the causality applied, this links the flow, Q, at the metering orifice to the orifice pressure difference, ∆P, as a function of the valve opening, x. x [34].
Finally, each R-field can be written in matrix form: The C element models the elastic recall caused by the spring. It is also used to model the elastic contact force when the spool reaches its end-stop on the sleeve. The structural damping, not explicitly modelled here, can be added if needed, e.g., as mentioned in [16]. The C element models the fluid compliance in the annular domain at pressure P i . Although this phenomenon has a negligible influence on the valve behaviour, it is introduced to remove the algebraic loop that would otherwise be caused by the serial association of the R elements of orifices α and β. Focusing now on the compensating valve, where the fault injection methodology is applied, Figure 10a shows a cross sectional view of the compensating valve used in this study. The compensating valve is composed of a spool, a sleeve and a spring. The sleeve is rigidly linked to the pump housing. The pump discharge pressure is sourced at the pressure port, while the load port is connected to the chamber of the stroking piston. When the delivery pressure overcomes the spring force, the valve spool moves to the left. This progressively closes the path from the load port to the return port, and increases the path from the pressure port to the load port. As a result, the stroking piston extends and reduces the pump displacement by lowering the swashplate tilt angle.    The injection of both jamming and valve erosion faults can be seen on Figure 10b:

•
In the case of jamming, it was decided to model the fault globally at the spool/sleeve friction level because there is no particular advantage in accurately locating where the jamming force occurs. The friction effect, modelled by the R element , was made variable in order to increase the breakaway force F f rict , depending on the type of friction model used [35].

•
Erosion is easy to model here because the variable orifice models already consider the metering edges to be rounded: this enables the valve pressure gain and leakage flow to be reproduced accurately [36]. The erosion fault can be directly injected by increasing the X 0 /2 radius parameter, which models the rounding of the orifice edges (see valve flow equations from [34]). The increase in edge radius is applied evenly to each metering orifice. However, it can be applied differently to each orifice for deeper investigation of the consequences of the fault.
Of course, it is possible to apply the methodology to the simulation of several other faults that can occur in axial piston pumps:

•
Wear of sliding piston surfaces in the cylinder block can be simulated by modulating the piston/bore clearance parameter. As for the compensating valve erosion, the piston surface interface can therefore be modelled by a modulated R-field [34]. It links the mechanical and hydraulic domains to calculate both leakage flow and friction force from the pressure difference and relative velocity.

•
The same approach can be applied for the slipper wear, through the increase in the maximal gap between slipper and swashplate. • Solid to solid friction between solids (e.g., at piston/cylinder or barrel/porting plate interface), can be injected through a sporadic increase in friction, as done for the compensating valve jamming. • Friction, jamming or wear at bearings (swash-plate tilt of drive shaft hinges) can also be simulated using these approaches.

Fault injection Implementation and Simulation
In order to illustrate the response to fault, the compensator model with fault injection was implemented in the Simcenter AMESim environment, as shown in Figure 11. Note that the model architecture displayed on Figure 9 is also upheld here.

Fault injection Implementation and Simulation
In order to illustrate the response to fault, the compensator model with fault injection was implemented in the Simcenter AMESim environment, as shown in Figure 11. Note that the model architecture displayed on Figure 9 is also upheld here.  The model of the pressure compensating device and the effectiveness of the fault injection process are tested in a simple way, using the virtual test bench shown in Figure 12. It is composed of a perfect variable-displacement pump model (in which leakage is added), and the hydraulic circuit supplied by the pump. This circuit is modelled by combining a constant hydraulic capacitance with a variable hydraulic resistance that is created by the loading valve, the throttling of which fixes the pump operation point. The hydraulic resistance is piloted to reproduce the conditions of pump dynamic testing, including from full flow to null flow, and from null flow to full flow. In addition to the hydraulic components listed previously, a pressure relief valve is added to the circuit. It allows for bypassing the loading valve in case of over pressure in the hydraulic system. In the present work, the cracking pressure of the relief valve is set at 230 bar. At rated power, the pump is driven at 4600 rpm, generates a pressure difference of 160 bar and delivers an The model of the pressure compensating device and the effectiveness of the fault injection process are tested in a simple way, using the virtual test bench shown in Figure 12. It is composed of a perfect variable-displacement pump model (in which leakage is added), and the hydraulic circuit supplied by the pump. This circuit is modelled by combining a constant hydraulic capacitance with a variable hydraulic resistance that is created by the loading valve, the throttling of which fixes the pump operation point. The hydraulic resistance is piloted to reproduce the conditions of pump dynamic testing, including from full flow to null flow, and from null flow to full flow. In addition to the hydraulic components listed previously, a pressure relief valve is added to the circuit. It allows for bypassing the loading valve in case of over pressure in the hydraulic system. In the present work, the cracking pressure of the relief valve is set at 230 bar. At rated power, the pump is driven at 4600 rpm, generates a pressure difference of 160 bar and delivers an output flow of 27.17 L/min, the pump leakage flow at case drain being 0.63 L/min.
The model of the pressure compensating device and the effectiveness of the fault injection process are tested in a simple way, using the virtual test bench shown in Figure 12. It is composed of a perfect variable-displacement pump model (in which leakage is added), and the hydraulic circuit supplied by the pump. This circuit is modelled by combining a constant hydraulic capacitance with a variable hydraulic resistance that is created by the loading valve, the throttling of which fixes the pump operation point. The hydraulic resistance is piloted to reproduce the conditions of pump dynamic testing, including from full flow to null flow, and from null flow to full flow. In addition to the hydraulic components listed previously, a pressure relief valve is added to the circuit. It allows for bypassing the loading valve in case of over pressure in the hydraulic system. In the present work, the cracking pressure of the relief valve is set at 230 bar. At rated power, the pump is driven at 4600 rpm, generates a pressure difference of 160 bar and delivers an output flow of 27.17 L/min, the pump leakage flow at case drain being 0.63 L/min.  Before jamming (t < 0.5 s), the pump operates normally. When the flow demand becomes zero at t = 0.25 s, the discharge pressure suddenly increases. It modifies the force balance at the compensator spool, which starts moving. This feeds the stroking piston, which motion drives the swashplate tilt angle towards zero and finally cancels the pump displacement.
When the compensator spool jams (at t = 0.5 s), the pump operates in open loop without any control of the delivery pressure. The pump displacement being greater than required, the delivery pressure increases continuously. At time t = 0.562 s, the delivery pressure makes the pilot force on the compensation valve spool sufficient to overcome the breakaway friction force produced by the jamming fault. Consequently, the valve spool starts moving until it sticks again, leading to a continuous decrease in the pump displacement and of the discharge pressure. At t = 0.78 s, the driving forces on the compensating valve spool become again sufficient to overcome the breakaway friction and therefore move the spool in the opposite direction. This limit cycle lasts until the jamming fault disappears, at time t = 1.1 s. The pressure compensation becomes again fully functional. When a full flow demand occurs at t = 1.25 s, the pump reacts normally with the expected response time. During this virtual test, the pressure relief valve opens for a few tens of milliseconds at times t = (0 564; 0.822; 1.007) s. and swashplate tilt angle (from top to bottom). The pump is subjected to a dynamic load cycle, in the presence of sporadic jamming of the compensating valve. The loading valve is initially set to make the healthy pump run at its rated point of operation. At time t = 0.25 s, the loading valve is closed to simulate a flow demand falling to zero. It opens again at time t = 1.25 s. The jamming fault is initiated by setting the breakaway friction by 25 N at the compensator spool/sleeve interface for 0.6 s, at time t = 0.5 s. The faulty operation is highlighted by the yellow time window in Figure 13.  Figure 13. Simulated response of the pump to the jamming fault at the compensating valve. Figure 13. Simulated response of the pump to the jamming fault at the compensating valve.

(b) Erosion at valve metering orifices
Fluid velocity can be high at the metering orifices of the compensating valve. Consequently, the sharp edges of the valve spool and sleeve are progressively eroded and become more and more rounded. This is illustrated with the experimental data reported in [33], where erosion was accelerated by adding special testing quartz dust in the hydraulic fluid. This reference shows that erosion modifies the shapes of the sleeve and spool edges differently. However, it is not possible to model and parameterize the real and complex changes of these shapes exactly. This explains why erosion is modelled by increasing the equivalent radius of both rounded edges, at the spool and sleeve metering orifices.
The proposed methodology is now applied to investigate the effect of erosion on the pump characteristics. For this purpose, the signal defining the loading valve relative opening is made up of two components, as illustrated in Figure 14. The mean shape of the loading signal varies the delivered flow slowly to cover the whole operating range of the pump (zero flow for full valve opening, 27 L/mn when the valve is closed). This component enables the static hydraulic characteristic of the pump to be pointed out. A pulse, having a magnitude of 10% (2.7 L/mn) and a frequency of 0.5 Hz, is added to simulate the dynamic response of the pump to transient flow demands. The model is simulated twice: for a new pump, the compensating valve of which has sharp-edged orifices (2.5 µm equivalent radius), and for a pump having accumulated a long duration of service and showing well-rounded orifices (50 µm equivalent radius). The discharge flow and pressure are plotted in Figure 14 middle and bottom, respectively. The zoomed view given in Figure 15 shows details of the effect of erosion on the pump dynamics. It can be concluded that even a huge increase in the equivalent radius of the metering edges does not affect the pump behaviour too much. The pump static characteristic (delivery pressure vs. delivered flow) only drifts down by 2 bars, while the dynamics of the pressure compensation is almost unaffected. This is mainly due to the design of the compensating valve, which involves 3 variable orifices to control one hydraulic port. With such a design, it was verified by simulation that the pressure gain (load pressure vs. valve opening) of the compensating valve remains quite independent on erosion.  (c) Perspectives More details on the proposed concepts and their application to helicopter pumps can be found in [37]. In the last part of this document, the first author has used them extensively to propose a low-cost condition monitoring strategy, using the pressure measured at the pump case port as input.  (c) Perspectives More details on the proposed concepts and their application to helicopter pumps can be found in [37]. In the last part of this document, the first author has used them extensively to propose a low-cost condition monitoring strategy, using the pressure measured at the pump case port as input.

(c) Perspectives
More details on the proposed concepts and their application to helicopter pumps can be found in [37]. In the last part of this document, the first author has used them extensively to propose a low-cost condition monitoring strategy, using the pressure measured at the pump case port as input.

Conclusions
A methodology has been introduced for architecting lumped-parameter models and injecting faults. The objective was to identify the key physical quantities to be used in condition monitoring strategies, and to design and assess the said strategies. This methodology defines a well-structured process that takes benefit of the Bond-Graph formalism as the main modelling tool.
In total, two candidate architectural structures have been proposed: "by topology" and "by function". The architecture by function allows a high-level view to be used and is consistent with the top-down development process that is widely used in model-based systems engineering. The structure by topology provides a better link between the physicsbased simulation models and Computer Aided Design (CAD) software. It makes models easier to implement for virtual prototyping or high-fidelity simulation. There is still a need to develop bridges to structure the transformation process between the two types of architectural structures.
The methodology proposed to inject faults is based on the identification of the relevant physical effects, and the alteration of their parameters. The use of the Bond-Graph formalism has permitted continuity to be ensured between the different activities of architecting, fault injection modelling and model implementation. It has enabled the interfaces of the system under study to be considered in the very early phases of the model development. For causal simulation environments, it also provides effective means to structure and implement the model in a way that does not introduce any causality conflict.
The proposals have been illustrated using the example of a helicopter axial piston pump, with special focus on the pressure compensating valve. The methodology has been applied with success to implement an advanced model of the pump displacement control, with injection of jamming and erosion faults at the compensator valve level. The outcomes of this work have provided the authors with an efficient model-based means of identifying fault signatures and implementing low-cost condition monitoring features in an industrial context.