## 3 Application
### Timed CP-Net Models of the RBS
#### 3.1.2 Timed CPN Specifications Model  
The timed CPN specifications model of the RBS is illustrated in Figure 5 (only software components are presented, the modeling methodology remains the same for mechanical and electronic components). It permits the recording of all data needed to carry out the performance analysis. Once a component is broken, the place **RBS Status** receives a token containing the variable **r**, the different failure times **Ped_MFT**,**MC_MFT**,**Res_MFT**,**EM_MFT**, **Disc_MFT**,**Cal_MFT**,**BP_MFT**,**Type_MFT**,**SS_EFT**,**DC_EFT**,**Bat_EFT**,**ECU_EFT**,**AData_SFT**, **OS_SFT**,**IO_SF**, **wait**, repair time **waitrep** (which is equal to zero initially), and the Boolean **false**. This information is shared with the component's corresponding failure transition instantaneously (transition name preceded by F, **FMC** in the case of Figure 6). In this context, once the instantaneous failure transition is enabled, the marking size of the pane place, preceded by the P letter (**PMC** in the case of the master cylinder of type **RBS_Panne**), will increase infinitely, which is known as the combinatorial explosion phenomenon [25]. In fact, CPN Tools executes instantaneous transitions before timed ones, then the failure transitions will always be enabled by the place **RBS Status**. We define a complementary place to solve this issue (anti-place in CPN Tools) [26]. The anti-place is looped between failure and repair transitions. They cannot have more tokens than the ones in the anti-place (in our case one token). The failure transitions will be enabled only once, the token from the anti-place will be removed via the variable **SystPanne**. Failure transitions will not be enabled again unless the token is removed from failure transitions and moved to repair transitions. Thus, the place Component name panne has, at maximum, one token.  
The output of panne transitions (PMC considering Figure 6) is the **wait** value. Access to the wait value is achieved using **#21 SystPanne**. Then, a token is placed on the place **System KO**, informing the system that a component is broken. Once a repair occurs, the bidirectional arc linking **RBS_Status** and repair transitions (starting by R letter, like **RMC** transition in Figure 6) contains the information about repair time.  
Figure 5: Regenerative braking system software components: timed CPN specifications model.  
In the same direction, considering that a system fails if one of its components fails, the bidirectional arc between **RBS_Status** place and **RBS Repair** transition contains the same information.  
We suppose that repair starts immediately after the occurrence of a failure.  
When we have a token in the place **System KO**, and the component is repaired, the **System Repair** transition is enabled. It is about an instantaneous transition. In this situation, we may encounter a concurrency between the **System repair** and repair transitions [27]. Since priority transitions are supported in CPN IOOLs, we can assign priorities to each transition: P_LOW, P_NORMAL,P_HIGH [28], we assign P_HIGH proprieties to our model for panne and repair to avoid this concurrency. Indeed, if a component is broken and then repaired, then the whole system is repaired.  
Lists are defined to collect data about components' mean time between failures and the mean time to the first failure. For instance, in Figure 6, the place **BFMCs** of type list **MTBFS** permits the collection of both the first and the current time to failure **wait** and the performance of subtractions to obtain the time between failures. Similarly, a list is defined to collect the mean times to failure for the whole system.