## 3 Application
### Timed CP-Net Models of the RBS
#### 3.1.1 RBS Timed Physical CPN Model  
Figure 3 below displays the timed physical CPN model. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Component** & **Type** & **Abbreviation in the Model** \\ \hline Pedal & Mechanical & Ped \\ Master cylinder & Mechanical & MC \\ Hydraulic group & Mechanical & HG \\ Reservoir & Mechanical & Res \\ Electrical machine & Mechanical & EM \\ Disc & Mechanical & Disc \\ Caliper & Mechanical & Cal \\ Brake Pad & Mechanical & BP \\ Tyre & Mechanical & Tyre \\ Speed sensor & Electronic & SS \\ DC-DC converter & Electronic & DC \\ Battery & Electronic & Bat \\ ECU & Electronic & ECU \\ Data analysis software module & Software & ADA \\ Input Output software module & Software & IO \\ OS software module & Software & OS \\ \hline \hline \end{tabular}
\end{table} 
Table 1: RBS components. Figure 2: Regenerative braking system. The places are defined to model the state of the RBS while the transitions represent the events that may occur. The blue, green, and pink colors are used to represent mechanical, electronic, and software components, respectively. The **RBS waiting** place is initially marked with an **rbs** token of type **RBS** indicating that we have one regenerative braking system at the initial time. Every other place in the physical model is originally unmarked. We assume that the system is operational at time 0. By removing the **rbs** token from the **RBS waiting** place and placing it in the **RBS working** place, the variable **r** enables the **Start RBS** transition. In the same transition, a transfer function is defined to execute random actions based on Weibull, Exponential, and Exponential-Musa distributions, explained in Appendix A, respectively, for the mechanical, electronic, and software components' times to failure. The minimal time to failure among all components' failure times is obtained using a defined minimum function intended to represent the moment when each RBS component is most likely to fail based on the components' probability distributions and comparing the obtained components' failure time values. The output token of this transition contains the variable **r**, components failure times (**Ped_MFT,MC_MFT,Res_MFT,EM_MFT,Disc_MFT,Cal_MFT,BP_MFT,Type_MFT,SS_EFT,DC_EFT,Bat_EFT,ECU_EFT,AData_SFT,OS_SFT,IO_SFT)**, **wait**, which is equal to the minimal time to failure among all failure times, and **wait**, the RBS global simulation time. Indeed, the RBS operates, and following, a delay, **wait**, the failure occurs and a failure transition is enabled. **RBS working** place is connected to the component failure transitions (the name of these transitions is preceded by the letter **F**). To select which failure transition will be enabled, a guard condition is defined, specifying that the failure time should be equal to **wait** the minimal failure time value. Let us take the example of the master cylinder of Figure 4, the transition **FMC** is enabled if the time to failure **MC_MFT** is equal to **wait**. Figure 3: Regenerative braking system: timed CPN physical model. Two arcs appear at the output of failure transitions, one is connected to **the RBS Status** place, and the other to the components' repair places. **RBS Status** is an important place, the output arc of a failure transition contains the variable **r**, the different component failure times **Ped_MFT**,**MC_MFT**,**Res_MFT**,**EM_MFT**, **Disc_MFT**,**Cal_MFT**,**BP_MFT**,**Type_MFT**,**SS_EFT**,**DC_EFT**,**Bat_EFT**,**ECU_EFT**,**ADA_SFT**,**OS_SFT**,**IO_SFT**,**wait**, a time **waitrep** (repair time, which is equal to 0 before the repair), and a Boolean false, informing that a failure occurs, this is used to inform the specifications model that a component is down.