6. Strategies for Mastering Uncertainty

Tristan Gally, Philip Kolvenbach, Anja Kuttich-Meinlschmidt, Alexander Matei, Marc E. Pfetsch, Johann M. Schmitt, and Stefan Ulbrich

The goal of truss topology design is to determine truss structures that are both, stable and lightweight. Stability here means that data uncertainty in the form of incertitude in the inputs, cf. Sect. 2.​1, is taken into account by a robust approach in the system design phase, see Sect. 3.​5. In the following, we concentrate on a particular approach via a semidefinite program (SDP), which was originally introduced by Ben-Tal and Nemirovski [17]. Exemplary alternatives to our treatment of uncertainty in truss topology design are described in [81, 101, 176]. For an overview of non-robust topology optimisation we refer to [18]. The approach, as presented here and in [111], is unique in the sense that dynamic uncertainty is mastered in robust truss topology design with SDP. Furthermore, another extension is the usage of binary variables for trusses introduced by Mars [122].

We first introduce the basic model and the corresponding optimisation problem for truss topology design. Then, we discuss the concept of robust optimisation as adopted in Sect. 6.1 with regard to this model. In the following paragraphs, we extend the basic optimisation problem to beam elements and dynamic truss models for vibration attenuation following [75, 111]. Finally, all these different models are compared using the example of the upper truss of the Modular Active Spring-Damper System, see Sect. 3.​6.​1.

In this paragraph, we present the basic model of a truss which uses a so-called ground structure, i.e. a simple directed graph \(\mathcal {D} =(\mathcal {V}, \mathcal {E})\) with n nodes \(\mathcal {V} = \{v_1, \dots , v_n\} \subseteq \mathbb {R}^d\). The edges \(\mathcal {E}\) represent possible bars. A subset \(\mathcal {V}_f \subset \mathcal {V}\) of size \(n_f\) of the nodes is freely movable, while the remaining ones are fixed. At each of the \(n_f\) free nodes d-dimensional forces are applied, which are contained in the vector \(f\in \mathbb {R}^{d_f}\) with \(d_f=d\cdot n_f\). These forces cause displacements \(u \in \mathbb {R}^{d_f}\), which are determined by the equilibrium constraint \(A(x)\, u = f\), where \(x\in \mathbb {R}^{\mathcal {E}}_+\) represents the cross-sectional areas of the possible bars in \(\mathcal {E}\). Here, \(A(x) = \sum _{e \in \mathcal {E}} A_e\, x_e\) is the stiffness matrix with \(A_e = b_e^{\phantom {\top }} b_e^{\top }\), where \(b_e = (b_e(v))_{v \in \mathcal {V}_f} \in \mathbb {R}^{d_f}\) andwhere E is Young’s modulus of the used material. One possible aim is to find the stiffest truss under the restriction of a total volume bound \(V_{\max }\in \mathbb {R}_+\). We measure the stiffness of the structure by the compliance \(c = \frac{1}{2}f^{\top }u\), which represents the potential energy stored in the deformed truss and has to be minimised to maximise stiffness. This yields the optimisation problemwhere \(l_e\) denotes the length of the edge \(e\in \mathcal {E}\). This optimisation problem can be reformulated as a semidefinite program (SDP)cf. [17]. Here, a symmetric, positive semidefinite matrix M is denoted by \(M \succeq 0\). Analogously, we can also minimise the volume of the truss for a given upper bound on the compliance \(c_{\max }\) which leads to a similar optimisation problem (6.3).

In mechanical structures, uncertainty often appears in the form of parameters that are not exactly known, e.g. loads acting on a truss. One main topic of this section is the modelling and the mathematical treatment of data uncertainty, see Sect. 2.​1. In the context of truss topology optimisation, even small changes of the considered load scenario may lead to severe instabilities. In order to cope with this problem, we use robust optimisation, see Sect. 6.1, where we consider uncertainty sets instead of fixed parameters. We consider the given force f to be uncertain. Then the robust optimisation problem corresponding to Problem (6.2) consists of finding a vector \(x\in \mathbb {R}_+^{\mathcal {E}}\) to such an extent that the compliance is minimal under the worst-case load scenario, i.e.where \(\mathcal {U}\) denotes an uncertain set of forces f. Note that (6.4) is of the same form as the robust formulation in Sect. 6.1 and can be reformulated as an SDP via the techniques of Ben-Tal and Nemirovski [17]. This SDP can be solved efficiently. Therefore, it is desirable to reformulate these robust problems as SDPs. Nevertheless, the results of Ben-Tal and Nemirovski [17] strongly rely on the special structure of the inner maximisation problem. For dynamic problems, which are also addressed in this section, these techniques cannot be applied, since we have to deal with ordinary differential equations as constraints. However, using the Bounded Real Lemma we can still reformulate the robust problem as an SDP.

There are different ways to choose the uncertainty set of forces \(\mathcal {U}\). One could for example consider polyhedral uncertainty sets \(\mathcal {U}\) which are given by the convex hull of \(s \in \mathbb {N}\) many forces \(f_1,\ldots ,f_s\). These can be integrated into the problem by adding an additional SDP constraint for each force. A second possibility is to work with ellipsoidal uncertainty sets, where \(\mathcal {U}=\{f=Qa:a^{\top }a\le 1\}\) for some scaling matrix \(Q\in \mathbb {R}^{d_f\times d_f}\). A common choice for Q is given by \(Q=[f_1,\ldots ,f_s, \theta e_1,\ldots , \theta e_{n_U}]\) with a scaling factor \(\theta >0\) and \(n_U=d_f-s\). The scenario set \(\mathcal F=\{f_1,\ldots ,f_s\}\) describes the “most important loads” and \(\{\theta e_1,\ldots , \theta e_{n_U}\}\) the “occasional loads”. Here, \(\{e_1,\ldots ,e_{n_u}\}\) is chosen as an orthonormal basis of the orthogonal complement to \(\mathcal {L}(\mathcal F)\) in \(\mathbb {R}^{d_f}\), where \(\mathcal {L}(\mathcal F)\subset \mathbb {R}^{s}\) denotes the linear span of \(\mathcal F\), see [17]. In case of ellipsoidal uncertainty sets, a major result of [17] is that (6.4) is equivalent toIn practice, often only a finite set \(\mathcal A\) of cross-sectional areas is available. Then, we introduce binary variables \(x^a_e\), which have value 1 if and only if the cross-sectional area of bar \(e\in \mathcal {E}\) is equal to \(a\in \mathcal {A}\). Integrating these binary decisions in our model, we obtain a mixed-integer SDP (MISDP) formulation as independently shown in [106, 122].

The Truss Topology Design Problem (6.5) uses an idealised model of pin-connected bars. This can be extended to beam elements which can also represent bending. The new stiffness matrix, which depends nonlinearly on x, can be computed by using a finite element approach and inserted into (6.5), see [63]. The obtained non-convex SDP can be solved by a sequential SDP method based on [37], in which the nonlinear SDP constraint is linearised and iteratively solved by applying a suitable step length rule. In addition to rigid connections, one can also model pin-connected beams by introducing binary variables, which are coupled via linear constraints and indicate the connection type. In this approach, the stiffness matrix has to be further modified and the resulting nonlinear mixed-integer SDP can be solved as in [75] by using a sequential SDP method which is embedded in a Branch-and-Bound algorithm solving a non-convex SDP in each node.

As described before, solving the problems arising from robust optimisation models, possibly incorporating integer decisions like a discrete choice of truss thicknesses or placing actuators (see Sect. 6.1.2), results in mixed-integer SDPs. For this class of problems, only very few software packages are available. Therefore, SCIP-SDP, a software system based on the framework SCIP [67] was created, which is publicly available [147]. SCIP-SDP contains interfaces to several SDP-solvers, such as Mosek, DSDP and SDPA. Moreover, it contains a variety of presolving techniques, branching rules and primal heuristics. The paper [65] describes some of the used techniques and provides an analysis of the preservation of strong duality when working in a branch-and-cut framework. More details are given in [62, 122, 123]. A parallel version of SCIP-SDP is also available, see [149].

As an extension to the static approach above, we consider a dynamic truss model which can be used for example to describe and reduce structural vibrations in mechanical systems resulting from time-dependent uncertain loads \(f : \mathbb {R}_+\rightarrow \mathbb {R}^{d_f}\). Within the dynamic model, the displacements u(t) are given by the solution of the ordinary differential equation systemwhere \(M(x)\in \mathbb {R}^{d_f\times d_f}\), \(D(x)\in \mathbb {R}^{d_f\times d_f}\) and \(K(x)\in \mathbb {R}^{d_f\times d_f}\) denote the mass matrix, the damping matrix and the stiffness matrix, respectively. We use the mean squared displacementas a measure of stability and stiffness. The time-dependent load \(f\in \mathcal {U}\) is again uncertain. Here, the uncertainty set is of ellipsoidal formwhere Q is chosen as explained before. Then the robust dynamic truss topology design problem readsRewriting (6.6) as a system of first order differential equationsand using the Bounded Real Lemma, see [11], we can reformulate the optimisation problem (6.7) aswhere a penalisation term \(\varepsilon _Y\,\Vert Y\Vert _{\text {F}}^2\) is added to the cost function, see [111]. Here, \(\Vert \cdot \Vert _{\text {F}}\) denotes the Frobenius norm and \(\varepsilon _Y\) is some positive constant. In [111], the optimisation problem (6.9) is solved by using a sequential SDP algorithm, see also [113].

In the following, we compare the models from this section using the example of the upper truss of the Modular Active Spring-Damper System, see Sect. 3.​6.​1 and Fig. 6.1a, where one possibly uncertain force is acting on the centre node. In Table 6.1, the cost function values for the solutions of the optimisation problems introduced in the subsections above are evaluated for the nominal case, i.e. one fixed force f is considered, and for the worst case scenario, where the acting force is uncertain. Moreover, we compare the corresponding solving times in the last column of Table 6.1. As we can see, in the non-robust static case (b) the compliance for the nominal force is quite small, whereas in the worst-case scenario it is much larger. This shows that the truss becomes unstable, if the force acting on the truss changes. In contrast to this behaviour, the values of the cost function in the nominal case and in the worst-case almost coincide for the robust problems, where the compliances in the robust static case with (d) and without discrete cross-sectional areas (c) are only slightly larger than in the non-robust static case. Nevertheless, we note that restricting the available cross-sectional areas to a discrete set or considering the dynamic model (f) leads to longer solving times.

In this section, we discussed robust truss topology design via an SDP-approach. We introduced a basic truss model and reformulated the minimum compliance problem for the robust case as a (mixed-integer) SDP. Furthermore, we compared static and dynamic models regarding the worst-case behaviour of the solution to the respective optimisation problem.

In Sect. 6.1.2, we are including active elements into the truss structure, where the corresponding robust optimisation problem is still an SDP. Unfortunately, when dealing with PDE this is no longer possible, such that fundamentally different approaches are necessary, see Sect. 6.1.3.

Tristan Gally, Philip Kolvenbach, Anja Kuttich-Meinlschmidt, Marc E. Pfetsch, Andreas Schmitt, Johann M. Schmitt, and Stefan Ulbrich

The usage of active elements, e.g. actuators, in order to master uncertainty is one topical focus of this book, see e.g. Sects. 3.​4 and 5.​4. As an extension to the example of robust truss design in Sect. 6.1.1, we integrate abstract actuators inspired by the technologies introduced in Sects. 5.​4.​6 and 5.​4.​7. The resulting active truss structures can employ additional forces \(f^{\alpha }\) in each of the different load scenarios. These forces form an additional design parameter, besides the cross-sectional areas of the bars. Thus, the robustness of the mechanical structure with respect to uncertain input data, e.g. the loads acting on the truss, can be further improved by the optimal design and placement of actuators. In Sect. 6.1.1 the robust optimisation approach as introduced in Sect. 6.1 is used to obtain robust truss topology designs. The incorporation of actuators into the model leads to more complex formulations compared to Sect. 6.1.1, e.g. certain actuators increase the number of stages in the robust optimisation problem. Nevertheless, we show that these can be reformulated as semidefinite programs (SDP). The objectives of this section are to integrate actuators into the truss topology models introduced in Sect. 6.1.1 and to reformulate the corresponding robust optimisation problems as SDPs to make these accessible to optimisation methods.

For this purpose, we present four models for the optimal design of active trusses, i.e. trusses incorporating active elements, such as actuators under uncertain loads. In the first model, the actuators generate a counterforce \(f^{\alpha }\in \mathcal {F}^{\text {act}}\) acting on each free node of the truss for each load scenario. Here, the set \(\mathcal {F}^{\text {act}}\) depends on the choice of the bars equipped with actuators. We call bars with integrated actuators active and those without actuators passive. This approach is considered in the paragraph below, see also [75]. Another possibility is the operation of the actuators via a parameterised algorithm, for example feedback controllers, where the parameters are considered as optimisation variables. This second model is examined in the next paragraph, cf. [111]. In the third model, we apply actuators with the aim to achieve an improvement of the buckling resistance of trusses, which is based on [64]. In the last paragraph, we introduce the fourth model, namely the optimal design of shunt damping for vibration attenuation as presented in [112].

Another approach for truss topology design with active elements was made by [116] using genetic algorithms but neglecting uncertainty. Further methods for the reduction of vibrations in mechanical systems by actuator placement can be found in [86, 140]. Buckling control has also been addressed by [16, 34, 139].

In the following, we extend the robust static truss topology design problem from Sect. 6.1.1 with actuators of the first type. We introduce the binary variables \(z\in \{0,1\}^{\mathcal {E}}\) with \(z_e=1\), if bar \(e\in \mathcal {E}\) is active and \(z_e=0\) otherwise. For all bars e, let \(f_e^{\max }\in \mathbb {R}^{d_f}\) be the maximal force that can be applied to the truss by the actuator and let \(\alpha _e\in [0,1]\) describe the exposure of the actuator, if the bar is active. Bywe denote the set of all possible forces which the actuators given by z can implement. The goal is to choose the cross-sectional areas \(x\in \mathbb {R}_+^{\mathcal {E}}\), \(z\in \{0,1\}^{\mathcal {E}}\) and the counterforces \(f^\alpha \in \mathcal F^{\text {act}}(z)\), in such a way that the compliance \(\frac{1}{2}f^{\top }u\) is minimal under the worst-case scenario with respect to the uncertainty of the force f. This leads towhere N is an upper bound for the number of active bars. In order to solve this problem, a key step in [75] is the splitting of (6.10) into an inner and an outer problem. The outer problem, which involves the decision for the binary variables \(z\in \{0,1\}^{\mathcal {E}}\), is solved by a Branch-and-Bound-type method. The remaining inner problem can be reformulated as a nonlinear SDP similarly to Sect. 6.1.1. This problem is solved by a sequential SDP algorithm, see [75]. We can analogously minimise the volume of a truss, where the compliance has to stay below an upper bound \(c_{\max }\). This leads to a similar optimisation problem as (6.10).

Finally, we present the example of Fig. 6.2 also given in Sect. 3.​4 to show that the usage of actuators can lead to substantial material savings. This also leads to significantly different trusses with minimal volume as shown by an optimal truss without actuators (\(N=0\)), Fig. 6.2a, and with (\(N=4\)) actuators, Fig. 6.2b. However, this does not consider the trade-off between potential actuator costs and material savings. Therefore, we show results in which we use the objectivefor some actuator penalty parameter \(\eta \). In the computations we model piezoelectric actuators for which \(f_e^{\max }\) is given bywhere E is the Young’s modulus of the used material, \(x_e\) denotes the cross-sectional area and \(l_e\) the length of bar e, \(\kappa _{\text {act}}\) denotes the stiffness of the actuator and \(F_{\text {Block}}\) the blocking force. This problem can be solved with the methods described above. In Fig. 6.2c, we illustrate the results for varying blocking force \(F_{\text {Block}}\) and penalty parameter \(\eta \) using the ratio of the total volume for the active case including penalty term and the total volume for the passive case. We see again that material savings are possible. However, high actuator costs can balance these savings.

If we consider dynamic load scenarios, the reduction of structural vibrations with uncertain inputs, such as uncertain loads acting on a truss, becomes important. The usage of adaptive elements is a possibility to achieve this; it makes mechanical structures safer and more resistant against effects of external disturbances. These components consist of a sensor, a control unit and an actuator, thus compensating external forces acting on the structure. In [111], feedback controllers for the adaptive components are considered, which produce a response \(f^{\alpha }(t)\) to external inputs based on a measurement of the current state y(t), i.e. \(f^{\alpha }(t)=Ky(t)\) for a matrix \(K\in \mathbb {R}^{d_f\times d_f}\). Then the system of first order differential equations from Sect. 6.1.1 readsHere, \(Q\,a(t)\in \mathbb {R}^{d_f}\) describes the uncertain loads lying in an ellipsoidal uncertainty set \(\mathcal {U}=\{f=Qa:\Vert a\Vert _{L^2(\mathbb {R}_+;\mathbb {R}^{d_f})}\le 1\}\). For more details concerning the matrices P(x), B(x), \(L\in \mathbb {R}^{d_f\times d_f}\) see Sect. 6.1.1. The matrix K is added to the Robust Dynamic Truss Topology Design Problem (6.9) as an additional optimisation variable. The corresponding optimal control problem is then given bywhere \(\varepsilon _Y\), \(\varepsilon _K\) and \(\varepsilon _W\) are positive constants. This optimisation problem can be solved by using a sequential SDP algorithm, cf. [111].

An additional critical failure mode to be considered is buckling due to axial loads. In the following, we show its inclusion presented in [64], for the case of discrete cross-sectional areas for each bar indicated by binary variables \(x^a_e\), where \(x^a_e\) is 1 if and only if bar \(e\in \mathcal {E}\) has the cross-sectional area \(a\in \mathcal {A}\), which we assume to be of circular shape, see also Sect. 6.1.1.

In order to model buckling, we need to know the bar force \(q_e\) for each bar e. Thus, we assume in the following a so-called statically determined truss, which allows to compute q using the invertible geometry matrix B and the equilibrium condition \(B q =f\) for a given force f. A compressed bar (\(q_e < 0\)) buckles if the bar force exceeds the critical buckling load. For the pinned-pinned Euler buckling case this load is given by \(\smash {{\pi E a^2}/{4 \ell ^2}}\), see e.g. [168], where E and \(\ell \) are the Young’s modulus and the bar’s length, respectively. For a bar with area a under tension (\(q_e > 0\)) an upper bound is given by \(\sigma _0 \;a\), where \(\sigma _0\) is the proportional limit after which the stress-strain curve deviates from the linearity, see [44].

Buckling can be avoided by increasing the diameters of the bars. Alternatively, actuators, as presented in Sect. 5.​4.​7, can be used to avoid buckling by increasing the critical buckling load of a bar. To optimally place these active elements into the truss structure, we assume their buckling load increase \(\rho \) to be additive and independent of the bar area. Then the binary variables \(z_e\), indicating whether the bar e is active, can be combined with the discussed buckling constraints in the inequalitiesIf one minimises the volume of the truss for a given upper bound on the compliance \(c_{\max }\), a bound N on the number of active bars and a polyhedral uncertainty set with forces \(\mathcal {S} = \{f_1, \dots , f_s\}\), we obtain the following mixed-integer SDPWe solve this problem using SCIP-SDP [147], see also Sect. 6.1.1. Exemplary, Fig. 6.3 shows optimal solutions, when minimising the total bar volume for two load-scenarios using no or at most two actuators on the ground-structure given by Fig. 6.3a. Without actuators one bar has to be bigger than the others, see Fig. 6.3b. Replacing this bar by an active one, the solution can be improved to use the smallest diameter everywhere, see Fig. 6.3c.

In addition to the methods described above, one can use shunted piezoelectric transducers to attenuate structural vibrations in mechanical systems, cf. Sect. 5.​4.​6. The attenuation of vibration strongly depends on the choice of the shunt parameters, where uncertainty in design and application may lead to a loss of attenuation performance. In [112], the Bounded Real Lemma is applied to formulate the corresponding optimisation problem as a nonlinear SDP, which is solved using a sequential SDP method for a demonstrating example.

In this section we described four mathematical models to incorporate active elements into the robust truss models as presented in Sect. 6.1.1 to handle uncertainty in load-bearing structures. The new models are more complex and often require new solving algorithms. Here, the forces acting on the nodes of the truss are considered to be uncertain. Section 6.3.4 extends this idea by also considering arbitrary bar-failures.

Optimisation tasks in engineering applications are usually described by (nonlinear) mathematical models and are often based on partial differential equations (PDE). However, these models depend on uncertain data in virtually every real-world application, for example, in the form of parameters that are not known exactly, cf. Sect. 2.​1. In the context of mathematical optimisation, it is well known that optimal solutions are often sensitive to the problem data to such an extent that even small perturbations in the uncertain data can severely reduce the quality of a solution and might even cause a solution to violate important design and safety constraints. As a consequence, it is very important to take uncertainty into account during the optimisation process in early stage product design, cf. Sect. 3.​1. One approach to achieve this is through robust optimisation, see also Sect. 6.1. In this subsection, a mathematical method to deal with robustness in the PDE-setting is depicted and applied to a truss structure that is derived from the Modular Active Spring-Damper System, see Sect. 3.​6.​1, and an integrated sensor element.

This exposition is based on [107, 150], which substantially extends the methods presented in [43, 178] by using a second order approximation instead of a linearisation of the worst-case function. Further methods to deal with nonlinear robust optimisation are investigated by [20, 36, 93, 121].

Recall the nominal optimisation problem from Sect. 6.1and its robust counterpartwhere x is the optimisation (or design) variable, \(p \in \mathcal {U}\) is a vector of uncertain parameters from an uncertainty set \(\mathcal {U}\), \(f^0\) is the scalar objective function, and \(f^i\), \(i \in I\), are finitely many scalar constraint functions.

In the case at hand, the objective and constraint functions depend on the physical state of the system, which in the following is the solution of a PDE. Therefore, the methods presented in Sects. 6.1.1 and 6.1.2 are no longer applicable and we develop alternative techniques. Problem (6.12) has infinitely many constraints but is easily seen to be equivalent to a two-level problem with finitely many constraints, i.e.The optimisation problem can be further simplified by using the worst-case functions \(\Phi ^i(x) = \max \{f^i(x,p):p\in \mathcal {U}\}\), \(i \in I_0 = I \cup \{0\}\), which yieldsWhile quite similar to (6.11) in form, the so-called robust counterpart (6.13) is decisively more difficult to solve because of its two-level structure and, in particular, because the lower-level maximisation problems are generally non-convex, but need to be solved globally in order to evaluate the worst-case functions. In addition, the worst-case functions are generally non-smooth functions, which hinders the application of efficient gradient-based optimisation methods. Even so, there has been considerable progress in the field of non-smooth constrained optimisation in recent years, such that suitable optimisation methods for (6.13) exist and are openly available; for example, see [38, 39].

An alternative way to deal with the non-smoothness is to lift optimality conditions, if available, of the lower-level problems to the upper-level problem, thereby obtaining an often smooth, single-level mathematical program with complementarity conditions (MPCC) eligible to tailored sequential quadratic programming (SQP) methods, see [114, 150].

The other difficulty—having to globally solve non-convex programs—is much more severe, especially in applications that involve PDE that make function evaluations of \(f^i\), \(i \in I_0\), extremely expensive. One approach is to approximate the functions \(p \mapsto f^i(x,p)\), \(i \in I_0\), by Taylor models of first or second order; see [6, 43, 107‐109, 150, 151]. Once the models are built, their global maxima (i.e. their worst cases) can be computed very efficiently without further function evaluations of \(p \mapsto f^i(x,p)\) and, hence, without further solving expensive PDE. Since Taylor models can only be expected to be locally accurate, strategies have been investigated to iteratively move the model expansion point in the course of the optimisation in order to increase the quality of approximation by closing the gap between the model and the modelled functions [6, 114]. In the following, we apply this approach to two examples of shape optimisation problems from structural mechanics.

As a first example, we consider a truss structure with 18 bars and ten connector nodes, see Fig. 6.4a, also considered in [107, 108]. The truss supported at two of its outer nodes is subject to an uncertain time-dependent diagonal load at the bottom, indicated by an arrow and an ellipse. The goal is to redistribute the volume between the 18 bars so as to minimise the \(L^2\)-norm of the displacement over space and time, with identical upper and lower bounds for all bar volumes. The physical behaviour is modelled by an equation of motion with linear elasticity. This PDE is discretised in space with a standard finite element method and a Newmark method in time, which leads to more than four million degrees of freedom in total. A scaled 10 % ellipsoid in the space-time domain, which is centred around a constant diagonal force, is chosen as the uncertainty set for the load.

Figures 6.4b, c show the optimal non-robust and optimal robust truss structures under their respective worst-case loads at the time point of maximum displacement; the greyscale indicates the von-Mises stress in MPa. The dynamic behaviour of the non-robust and the robust truss structures is displayed in the plots of Fig. 6.5. From both figures we infer that the non-robust structure not only has a considerably larger scale on the displacement \( y(t_k) \), but it is also clearly susceptible to resonance on the fixed time interval, unlike the robust structure. These observations illustrate that the worst-case behaviour of the robust structure is much better—in terms of the objective function by a factor of 13 in this example, compare Table 6.2.

Table 6.2 also demonstrates the cost of robustness in terms of the number of additional PDE that have to be solved (PDE s.). Even so, the increase can be mitigated by a factor of 10 by utilising specialised, i.e. so-called matrix-free, second-order optimisation methods for the lower-level problems; see row “Robust-2”.

When uncertainty is taken into account during the design phase of a mechanical structure, the designer usually has to have specific knowledge on the source of uncertainty. Since it is often too demanding to assume all potential sources of uncertainty are known, it is crucial to monitor safety-related structures during their usage phase. As an example, we consider a novel manufacturing process that integrates sensors into the inside of metallic structures such as bars enabling such monitoring; see Fig. 6.6. Specifically for bars, the sensor element needs to be sensitive to axial loads, but insensitive to transverse forces. At the same time, it should not be too sensitive, because otherwise the signal-to-noise ratio becomes unfavourable. In a collaboration between mathematicians and mechanical engineers [107, 109], we modelled this task as a shape optimisation problem. A robust optimisation approach has been applied in order to preserve the desirable sensor properties despite manufacturing tolerances. The physics are modelled by the three-dimensional equations of linear elasticity, which are solved with a finite element method with about 750 000 degrees of freedom in total.

Figure 6.7 shows the mantle of the cylindrically shaped sensor elements for the non-robust and the robust solution, respectively. The white areas are holes cut into the steel, compare to Fig. 6.6b; their shape is parameterised by cubic Bézier curves and chosen during optimisation. The black vertical lines show the desired but uncertain position of the four strain gauges used to measure the axial loads. The optimisation results are given in Table 6.3, where q stands for the ratio between transverse and tensile sensitivity (smaller is better) and \(\Vert c_+\Vert \) for the relative constraint violation of the sensitivity bounds. In both cases, the prefix “\(\max \)” indicates the respective value in the worst case under manufacturing tolerance. It can be seen that the robust solution is feasible in every scenario and even has a better worst-case sensitivity ratio than the non-robust solution, at the cost of a slightly worse sensitivity ratio in the undisturbed case, and greater computational effort (see columns it and eval). The optimal robust design, Fig. 6.7b, shows a perfect symmetry even though there was no symmetry constraint given. This result can be explained by the observation that tensile strains at one bar cause compression strains at the opposing bar. Thus, the solver tends to solutions in which opposing bars have nearly the same geometry. Furthermore, the cross-section of the bars has been reduced by the optimisation algorithm. This leads to an increase in the observed strains which seems very plausible since the solver has the task to increase the sensitivity of the sensor.

In conclusion, we have seen that second order approximations of the robust counterpart with moving model expansion point perform well in PDE-constrained optimisation of mechanical structures. This method is indeed able to increase the robustness and efficiency of structural components in various applications.

Uncertainty is ubiquitous in the production phase, as well as in the usage phase of products, see Sect. 1.​2. On the one hand, random fluctuations in the properties of the semi-finished parts or the raw material occur; on the other hand, uncertainty results from unpredictable process behaviour, or due to the fact that the behaviour of the end customers is difficult to predict, see also Sect. 3.​2. In this section, we showcase a mathematical modelling and optimisation method, which was developed to master uncertainty in process chains.

The goal is to provide a general framework to optimally solve multi-stage decision-making problems under uncertainty. To model this structure, the class of optimisation programs termed quantified problems (QP) by Subramani [156] is used. In these problems, each variable is associated with the existential or universal quantifier. This corresponds to the mentioned multi-stage structure, in which variables depend on the variables of previous stages. Therefore, we are able to model problems with a dynamic structure, e.g. decisions have to be made before an uncertain outcome is revealed.

Quantified programming has close ties to robust optimisation as introduced in Sect. 6.1. In fact, the decision version of every (integer) linear robust optimisation problem with an interval uncertainty set \(\mathcal {U}\) can be modelled as a quantified linear program consisting of existential quantifiers followed by universal quantifiers. However, due to the possibility of a mixed appearance of the two kinds of quantifiers leading to more than two stages, but also due to the integrality constraints, more general methods than the ones presented in Sects. 6.1.1, 6.1.2 and 6.1.3 are needed. In this section we present theoretical results and extensions to the QP-framework.

A quantified linear program (QLP) is the problem to decide whether the following logic formula in real variables \(x_1\), ..., \(x_n\) holds:Here, n is even, \(\ell \), \(u \in {\mathbb {Z}}^n\) are lower and upper bounds, and the coefficient matrix \(A \in {\mathbb {Q}}^{m \times n}\) as well as the vector \(b\in {\mathbb {Q}}^m\) define the linear constraints \(Ax \le b\). An arbitrary sequence of universally and existentially quantified variables is possible by including dummy variables. A quantified integer program (QIP) additionally restricts the variables to attain integral values.

One interpretation of quantified programs is given via two-person zero-sum games: The existential player plays against the universal player. During the game, the values of the existential \((\exists )\) and universal \((\forall )\) quantified variables are chosen in order 1 to n by the corresponding player in the given variable bounds \([\ell , u]\). In iteration i, the previous values \(x_1\) to \(x_{i-1}\) are known. The existential player wins if the condition \(A x \le b\) holds. The question is whether there is a winning-strategy for the existential player, i.e. can this player win the game independently of the universal player’s actions?

An illustration is the design and time-discretised operation of a technical system under an uncertain and time-varying load. If lower and upper bounds to the load are known, the first block of existential variables could model the selection of components, whereas the t-th following pair of universally and existentially quantified variable blocks models the worst-case load and the corresponding system’s operation at time t. In this way, the solution design will be able to handle every possible combination of loads.

It is known that QLP is coNP-hard and QIP is PSPACE-complete [157], i.e. their solution is theoretically hard, but QIPs make it possible to model a wide range of applications. The expressiveness of QIPs has been shown by using it to model the classical job-shop and car-sequencing scheduling problems in [49] and the PSPACE-complete game Go-Moku in [50]. Polyhedral properties have been researched in [118].

If there even exist several winning strategies for the existential player, a best choice with respect to a given measure can be considered. One example, see [119], is a min-max-objective for a vector of objective coefficients \(c\in {\mathbb {Q}}^n\):where \(F(x) = 0\) if x satisfies \(Ax \le b\) and \(F(x)=\infty \) otherwise. Thus, an optimal solution will be a winning strategy of the existential player with minimal cost and minimal worst-case cost of the universal player. This extension has greater expressive power. Problems with objective functions composed of costs or efficiency can be treated.

In recent works [77, 80], the above framework is extended to bound also the universally quantified variables using a polytope. Here, a player loses, if she is the first not being able to satisfy her system of inequalities. This makes it easier to formulate problems involving more constraints on universal variables, e.g., the maintenance of a machine (\(\exists \)-variable) prevents its failure (\(\forall \)-variable). Instances of this extension can be reduced to greater but polynomial sized instances of the interval case. Thus, obstacles when formulating application-problems as QIP are simplified without raising theoretical complexities.

To solve quantified programs, different techniques can be used. As it has been noted early in the literature, see [48], one possibility is to use the so-called deterministic equivalent problem (DEP), which contains the existential variables and includes the universal variables placed at their bounds for QLP or their integer feasible values for QIP. The multi-stage character of problems makes it possible to use a specialised nested Benders decomposition to solve the DEP of a QLP [48]. The interpretation as a game motivates the usage of the Alphabeta algorithm as shown in [51, 120]. By reordering the quantifiers in a given quantified program, the so called quantifier shifting, an efficient relaxation can be formed [174]. Further, a pruning technique is shown to be computationally efficient in [79].

These and more techniques are applied in the QIP-solver Yasol [47], which is used, e.g. to solve a resilient booster design problem [78].

Quantified programming is a framework to model multi-stage structure in optimisation problems. Many QIPs were solved by using the DEP, as implicitly done in [8] and [141]. Future research will hopefully allow to replace algorithms based on DEPs by improved methods, equally leading to a wider applicability of QIPs.

In principle, robust design follows the same objective as sustainable design. This means that products should be developed with regard to functionality, costs and availability to ensure that acceptance is by and large guaranteed, as described in the Sects. 1.​6 and 3.​5. This equally includes very different product usages and future changes in the entire product life cycle. The challenge for developers is particularly high when products are newly developed and when they have little experience with the planned product usage. This section presents how robust design can be applied to meet increased expectations, especially for new types of usage with intensive disturbance effects.

In view of rapidly changing technologies, markets and customer needs, innovative products are of great importance for the sustainable success of companies. New production processes and process chains as well as new types of usage processes and environments offer opportunities for the successful marketing of innovative products. However, their development is also associated with a high risk due to uncertainty.

Frequently, a high degree of innovation can only be achieved by developing a product from scratch. A lack of experience and missing reference products as well as working at a high level of abstraction at the beginning of the development represent great challenges. In particular, developers have to make far-reaching decisions in the early stages of the development process, even though the product is still widely unknown. Overall, the situation is characterised by a lack of reliable information, which correlates with a high degree of uncertainty as introduced in Sect. 1.​3 Therefore, mastering of uncertainty in the early phases of the development of innovative systems is of great importance. In addition, the new development of products and systems is very complex, since almost all properties have to be defined depending on different requirements, cf. [12].

To master the complexity, developments of new systems are performed systematically and supported by methods. Development processes according to the guideline VDI 2221 [172] are widely used. This guideline recommends a discursive development process, which is structured according to phases and work steps in which defined results are achieved. The basic phases are (i) task clarification and project definition, (ii) concept development, (iii) embodiment design and (iv) detail design.

The first two phases ‘task clarification and project definition’ as well as ‘concept development’ are called the early phases of product development [22]. In these phases the basic characteristics of the products and systems to be developed are defined.

Especially in innovation projects, the early phases are intensified, as the developers are able to greatly influence the subsequent production processes and usage properties here, thus making a significant contribution to the success of the product. On an abstract level, models of functional structures, physical effects and working principles are developed. Deviations from the ideal function, disturbance parameters and their influences are only rudimentarily known and initially not taken into account in solution synthesis. The current robust design methods therefore focus mainly on the ‘embodiment design’ and ‘detail design’, where more concrete models of the developed product are already available [52, 124].

However, the full potential for mastering uncertainty can only be exploited if robustness is considered as a central criterion from the beginning of the development process [12]. Therefore, we developed further robust design methods for the early phases of product development [124, 125]. These methods provide a decisive way to master uncertainty in innovation projects.

In the early phases of product development, products and systems are only modelled in the form of process models and functional structures, see Sects. 5.​2.​3 and 5.​1.​2. Since these models contain little specific information about the system to be developed, they are poorly suited for mathematical modelling and simulation. Therefore, methods that support developers in the synthesis of robust concepts are more important than analytical methods. Methods to support system syntheses ideally complement the uncertainty analysis according to the UMEA methodology from Sect. 5.​2.​1 and support robust design by providing additional models and tools.

In the following we focus on two essential elements of the robust design methodology for early phases:Assessment of uncertainty source in early phases of product development

In case of new product developments, the systems are considered as a whole in the ‘task clarification and project definition’ phase. Mainly, the process model is used to analyse the overall system in detail with regard to the expected benefits, the fulfilment of functions and the corresponding relationships with the system environment as shown in Sect. 5.​2.​3. On one hand, the planned use of resources and operation of the system, and on the other hand, disturbance parameters from the environment, as well as disturbing side effects on the system environment are considered.

With regard to robust design, especially potential disturbances and side effects have to be recognised, since they are the main identifiable sources of uncertainty in this phase. Side effects may not be acceptable, if they do not comply with restrictions, while disturbances can reduce the system’s performance as described in Sect. 5.​2.​3. In the ‘task clarification and project definition’ phase, the developers can be supported especially by checklists for the determination of potential disturbance parameters. The usefulness of such checklists is mainly determined by their applicability. The applicability of the checklist is based on the checklist’s structure, completeness and handling due to their scope and versatility listing the sources of uncertainty. The checklist’s focus on physical effects is purposeful, since a substantial part of the causes of disturbances is considered and can be structured in a well-founded way [124].

In addition, detected disturbance influences can be assigned to principle solutions during concept development, which allows a simple robustness evaluation of the solutions as shown below. Furthermore, the sole consideration of physical effects is not sufficient for the complete detection of potential disturbance parameters as Mathias states [124]. For example, uncertainty due to contamination or other external influences must be added based on experience. For load-bearing systems, in addition, it is purposeful to emphasise aspects of force flow. We therefore propose the structure shown in Fig. 6.8, based on the proposal of Mathias.

These checklists primarily support the identification of relevant disturbance parameters as safety-relevant requirements and their documentation in requirement lists. These serve as a basis for decision-making in the entire development process as discussed in Sect. 5.​1.

Furthermore, developers can be supported effectively in their search for solutions using reference objects as orientation. In the phase of ‘concept development’, very basic strategies and principles prove to be suitable as work is done at a high level of abstraction. The analysis of the system’s vulnerability follows the analysis of the system environment with regard to disturbance parameters as indicated in Fig. 6.9. Vulnerability describes the possibility of serious functional disorders of the system due to external disturbances. Both, the exposure and sensitivity of the system to the disturbance parameters, must be taken into account. Therefore, we derived three basic strategies for the development of robust concepts from the chain of effects of disturbance parameters as shown in Fig. 6.9: (i) eliminate disturbance parameters, (ii) reduce (or eliminate) the influence of disturbance parameters, (iii) avoid the impact of disturbance parameters, cf. [124, 125].

The elimination of disturbance parameters means to use the system only in an environment where no relevant disturbance parameters are present. Solutions restricted to these conditions are known as, for example, air-conditioned measuring rooms and particle-free clean rooms. For load-bearing systems, such solutions usually are impracticable or not very effective, since their area of application would be restricted.

The reduction of the influence of disturbance parameters is a frequently used strategy. In most cases shields, insulations, seals, housings or surface coatings reduce the influence of radiation, dirt or mechanical impact. These approaches can be understood as robust design in a broader sense. However, the application of this strategy is mostly associated with additional measures or components. Protective measures are often not an optimal solution in terms of additional effort, limited effectiveness and additional uncertainty.

By contrast, solutions that are based on the strategy to avoid the impact of disturbance parameters are understood as robust design in a narrower sense [12]. Typical robust solution approaches select functional principles based on physical effects that are basically not or only slightly influenced by the expected disturbance parameters [125]. For example, extreme temperatures have less effect on mechanical solution principles than on electronic solutions. Conversely, electronic components e.g. engine control units are less sensitive to strong accelerations. The strategy to avoid the impact of disturbance parameters must be prioritised because in most cases the overall solution is more cost effective and incorporates less uncertainty. In most cases, additional effort can be avoided from the beginning by considering the corresponding uncertainty.

The strategy to avoid the impact of disturbance parameters can also be applied in the ‘embodiment design’ phase. For example, a symmetrical design of components or materials with a high thermal conductivity can avoid component distortion due to heat impacts and the associated functional impairment as shown in [124].

In the ‘concept development’ phase basic solutions are determined. The principle solutions are described by the underlying physical effects, working principles and working structures, and are presented as simple sketches [22]. Due to the high degree of abstraction, uncertainty regarding the flow of forces cannot be estimated at this stage of the development process.

However, potential uncertainty influences can be estimated based on a principal evaluation of the robustness [124]. A rough estimation of uncertainty can be done by evaluating the principal correlations between the identified disturbances and the physical effects on which the intended overall solution is based. Thus, to assess the robustness of solutions on the principle level, only the influences of disturbance parameters on physical effects need to be known. This method abstracts the approach of Taguchi [162], that is based on the signal-to-noise ratio for the evaluation of the robustness. However, an exact calculation of the signal-to-noise ratio representing the robustness properties of the system, as Taguchi strives for as discussed in Sect. 3.​5, is neither possible nor necessary at this stage of the development. An estimation of the basic sensitivity to disturbance parameters is adequate for assessing uncertainty in this early phase. The sensitivity of physical effects to disturbances was summarised by Mathias in tables [124]. In addition, equations for the calculation of principal robustness values have been developed, which, however, are only suitable for a relative comparison of alternative solutions of the same system.

In the early phases of the development of new innovative products, the robust design approach contributes significantly to mastering uncertainty from the very beginning. In particular, it can be seen as a success factor in case of lack of experience.

The identification of disturbance parameters and the selection of suitable robust design strategies provide a reliable basis for the subsequent development work. According to the high level of abstraction, qualitative methods are applied. These methods provide only partially quantifiable guidance. It is very challenging for the developers to anticipate the systems to be developed with their properties and usage including uncertainty.

A technical system is said to be robust, when it does not only fulfil its predefined function at the design point, but also in the surrounding neighbourhood, the so-called uncertainty set. The accepted functional quality is guaranteed even under uncertain resources or disturbances by uncertain external influences as defined in Sect. 3.​5. Both, the constructional design and the development process of such systems, are referred to as robust design. The basic idea was developed by Genichi Taguchi [161, 162] and refined several times over decades, e.g. by Ulrich and Eppinger [170]. The characteristic of the system perceived by the user during usage under the influence of disturbance parameters is decisive and is determined by uncertainty [76]. Therefore, uncertainty has to be considered in the context with all phases of the product life cycle as described in Sect. 3.​2. In this section, we show how and by which measures in the design of parts and components uncertainty can be mastered over all phases of the product life cycle in the sense of robust design.

Uncertainty in load-bearing systems mainly affects the performance of the force transmission function. Unacceptable deformations or damage to the system or its components are typical functional deviations. The load carrying capacity of such systems is mainly determined by the life cycle phases prior to product use Sect. 1.​2. The product components are manufactured and assembled in production processes. These processes are performed by work equipment e.g. machine tools. Similar to usage processes, uncertainty also influences the production processes. Uncertainty of the network of manufacturing and assembly processes accumulates in deviations from product properties as explained in Sect. 5.​2.​3. A comprehensive mastering of uncertainty in robust design must therefore take all processes in the product life cycle into account when designing products and their components.

As a consequence, robust design demands that three basic requirements must be considered when developing load-bearing products:

The basic approach of robust design is to master uncertainty in the entire life cycle process network by designing the products. Therefore, we refer to this approach as process oriented robust design. This means that all life cycle processes and their interactions are not directly but indirectly defined by the embodiment design properties of the product components. In other words, process oriented robust design strives to reduce uncertainty of the properties of parts and components through their design by producing them in the tightest possible tolerances without additional effort or even with reduced effort. Process orientated robust design can therefore make an essential contribution to mastering uncertainty of load-bearing systems as part of life cycle engineering.

Uncertainty of system functions in usage processes comprises three types of sources:

Well-known approaches of robust design e.g. Ulrich and Eppinger [170] assume that external and internal uncertainty in load-bearing systems during usage can be mastered mainly by the design of the mechanical components. The mechanical components form the essential part of load-bearing products in mechanical engineering. They guide and transfer the forces in usage processes and are referred to collectively as mechanical system. Therefore, the comprehensive mastering of uncertainty by the design of the components of load-bearing products in the embodiment design phase is in the focus of the consideration.

While robust design in early phases considers the product as a whole, see Sect. 6.1.5, the consideration of uncertainty in the embodiment design requires more detailed models as the solutions become more specific. Therefore, we have further detailed the model of technical processes presented in Sect. 5.​2.​3 for depicting the mechanical system in order to categorise the sources of uncertainty like in Fig. 6.10. In addition to the external disturbance parameters in the usage processes outlined in Sect. 6.1.5, sources of uncertainty can be depicted in this model due to varying functions of the components with regard to the force flow and the interacting influence of the components. In this way it is possible to locate typical sources of uncertainty regarding power transmission within the mechanical system.

In the example of the 3D Servo Press introduced in Sect. 3.​6.​3 servo motors generate the drive forces. However, the heat loss that is generated can heat up the transformer components and thus influence the power transmission as well as the ram movement and position. These dependencies can be illustrated and analysed analogous to the robust design approach in the early phase of the specialisation of the detailed generic process model according to Fig. 6.10.

Uncertainty due to external influences and mutual influence of the components can be mastered in embodiment design analogous to the strategies in the early phases. In particular, ensuring an unambiguous force transmission can reduce the effect of uncertainty influences [57, 60]. This approach is also known as design for clarity [59]. Ensuring clarity is of significant importance in robust design. The basic character of clarity has already been recognised by Pahl [136] and formulated as the basic rule of design. Pahl even demands mandatory compliance with the basic rule of clarity. Kirchner has reworked these basic rules recently [103]. Here, clarity means the wide degree of independence of the force transmission and the resulting component stress from external influences as well as from component and part tolerances. For example, in the Modular Active Spring-Damper System, see Sect. 3.​6.​1, the load is clearly initiated via three points. In this way, a deviating force can be clearly recorded and the stress on the system components can be clearly calculated.

As stated above, robust design strives to minimise the accumulation of uncertainty in production processes to reduce deviations in usage processes. Uncertainty especially of critical production processes is mainly mastered by the design of the components. To cope with the high level of complexity of design and process-related interrelationships, we developed systematically structured procedures and assistances to support the robust design of load-bearing systems [57, 60]. For that, we structured the design advices and strategic procedures that serve as an orientation for the development of robust load-bearing systems. They are described based on a set of eleven robust design effects, see Fig. 6.11.

The robust design effects were determined based on a systematic analysis of the relationships between the properties of the product and in particular its components on the one hand and the life cycle processes on the other. These interrelationships summarise effective ways of influencing all life cycle processes by product and component design in terms of uncertainty. Thus robust design contributes directly and indirectly to mastering uncertainty of product usage. Furthermore, strategies were formulated to categorise the robust design effects. The order of the robust design strategies and effects recommends a prioritisation of their usage.

As stated above, ensuring clarity is of significant importance in robust design. This applies to mastering uncertainty in both usage and production processes. For example, there is ambiguity in force flow, if the mechanical system is kinematically overdetermined by multiple power transmission paths with high rigidity. Deviations in critical component dimensions usually lead to considerable constraining forces. Typical consequences are reduced functionality and unexpectedly high component stresses in the system that cannot be reliably calculated and lead to increased component wear. Dimensional deviations are often caused by uncertainty in component production, by elastic component deformation or by component deformation as a result of temperature influences. Ambiguous designs are generally only acceptable by considerable additional effort to guarantee narrow component tolerances. The clarity of robust structures can be supported by decoupling of power transmitting functions in order to avoid mutual influence of the power transmitting elements.

The strategy to reduce the sensitivity and exposure of components to disturbances corresponds to basic strategies for reducing uncertainty caused by disturbance parameters described in Sect. 6.1.5. While disturbances caused by the usage environment can only be reduced or eliminated to a limited extent in the total system, robust design offers the possibility of reducing influences (disturbances) from one system element to another. Typical examples are the prevention of waste, heat loss and wear particles, which reduce the component strength or can influence the functionality of other components through pollution. The influence of most disturbance parameters can be reduced or eliminated by robust design, for example by shielding or insulation. However, this requires additional components and system elements. Therefore, generally design solutions according to the robust design effect ‘reduce or eliminate effects of disturbance variables’ should be aimed at. As a rule, this can be achieved by an appropriate choice of material or component geometry that is insensitive to disturbance parameters. In order to master uncertainty, unambiguity and low sensitivity as prerequisites for robust design should be given the highest priority.

A detailed description of how robust design effects and strategies can be integrated in the development of products and components was provided by Freund [57]. As an aid for the application in robust design, he provides a comprehensive catalogue with examples (‘RopEx catalog: Design notes for mastering uncertainty in usage processes’ (German)) [57]. Typical examples for part and component design clarify the abstract robust design strategies and effects.

The formulation of the robust design strategies and effects presented here is mainly based on the power transmission functions of passive mechanical systems. The presented procedures, principles and instructions can be transferred analogously to semi-active and active systems.

The design of the components and parts, which is mainly determined in the embodiment design phase of product development, significantly defines the production processes and the interaction of the parts in usage. Thus, the process oriented robust design allows to master uncertainty, which arises during product usage due to the mutual influence of components and ambiguous force flow. Appropriately structured and prioritised robust design strategies and effects effectively support product developers by providing orientation. The applicability is considerably improved by demonstrative examples.

Servo presses like the 3D Servo Press presented in Sect. 3.​6.​3 fulfil the purpose of producing metal-formed parts with high accuracy. Besides increasing the passive stiffness, active compensation measures in terms of closed-loop control have been established. Control laws are based on knowledge about the machine model, e.g. robot control mainly focuses on inverse kinematic models [152]. Especially kinematic singularities are very sensitive to uncertainty and require a high model accuracy. A kinematic model is typically based on the assumption of rigid bodies that are connected by rigid joints. Uncertainty affects the whole lifecycle of a product, cf. Sect. 1.​2. In the case of a press, uncertainty occurs in form of inaccuracies during production and assembly, as well as thermal or elastic expansion during its use. Therefore, the geometric dimensions of the machine components are not exactly known. This data uncertainty as well as model uncertainty arising from ignored relevant physical phenomena, cf. Sects. 2.​1 and 2, result in instable regions at the kinematic singularities, i.e. the top dead centre (TDC) and bottom dead centre (BDC). While methods based on stiffness models presented in Sect. 5.​4.​1 are able to reduce this uncertainty, they are not able to eliminate it [71]. An alternative approach is to accept the uncertainty and to increase the robustness of a control. Robust methods seek to reduce the impact of uncertainty on the worst-case scenario, which is the control near a singularity.

Servo presses are electromechanical systems consisting of a controlled servo drive and a mechanical gear. The most common gear kinematics are eccentric and knuckle-joint kinematics, both containing singularities. Despite the fact that servo drives allow for real-time adaptions and therefore to control the ram of the tool centre point (TCP), the closed-loop control of the TCP still faces unresolved challenges. Therefore, in industrial applications, only the drives are controlled in a closed-loop way, and the kinematics are open-loop.

Dulger et al. have drawn a parallel to robotics and have adopted the approach of a model-based control [46]. It was possible to demonstrate the feasibility of the control qualitatively, but the question of stability at the singularities remains open. In the investigation of a master-slave approach, Kirchner et al. have shown an instability in the dead centres [104]. This stability problem also occurs in robot kinematics and is typically avoided by limiting the joint space [152]. However, the operating point of presses is close to the BDC, since the highest possible transmission ratio of the force is achieved here. Current robust control methods focus on linear systems, and are not able to cope with non-linearities that emerge especially at kinematic singularities [94]. To investigate the influence of uncertainty, the press system is subdivided into the drive and the kinematics. The drive control has the task of adapting the actual drive speed \(\dot{\varphi }\) to the setpoint speed \(\dot{\varphi }_\mathrm {ctrl}\). Since synchronous motors allow an almost step-like change of the drive torque, the controlled drive can be approximated as a time-invariant first-order transfer functionwith the settling time \(\tau \). Since all quantities of the differential equation can be measured or derived on the drive side, \(\tau \) can be identified by means of the step response as described in [92]. The transmission behaviour, however, depends largely on the load torque, which is governed by the coupled inertia of the machine, friction and the forming force. Since the eccentric angle \(\varphi \) changes the transmission ratio of the machine and thus the feedback of the mass inertias, \(\tau \) is dependent on \(\varphi \). While the smallest mass moment of inertia is applied to the drive in the dead centres, as the power transmission is theoretically infinite here, the mass moment of inertia is greatest between the dead centres. The interval of \(\tau \) can be obtained by identifying it in both points.

The position of the input \(\varphi \) and the kinematics of the machine \(f(\varphi )\) result in the position at the output x, which is the control variable. To derive a control law, the differential kinematics, i.e. the Jacobian Jis required. These can be determined from the nominal geometric values of the rigid bodies, but in practice are subject to uncertainty as shown in Fig. 6.12.

For the press system consisting of drive and kinematics, we seek to design a control law C shown in Fig. 6.13 that stabilises the control loop while maximising its performance. Performance criteria are the settling time of control deviations e and the overshoot, which are represented by the integral of e(t) in a time interval T. To investigate the stability, we assume J and C to be approximately constant and thus a linear ordinary differential equation can be used. This results in the transfer function of the closed control loop in the Laplace s-domainwith the complex eigenvalues of the denominator polynomial \(\lambda _{1/2} \in \mathbb {C}\). For a stable control, the real part of the eigenvalues must be negative \(\mathfrak {R}\{\lambda \} < 0\) and to prevent overshoot, there must be no imaginary part \(\mathfrak {I}\{\lambda \} = 0\), resulting in predictable requirements.

For a worst-case design, the maximum possible \(\tau \) can be derived as a design point. More problematic, however, is the dependence of the transfer function G(s) on J, since the sign of C must also change exactly with the sign of J. The common approach in robotics is to choose \(\dot{\varphi }_\mathrm {ctrl} = \hat{J}(\varphi )^{-1} K e\) with the estimated differential kinematics \(\hat{J}\) and a constant gain factor K. If the zero crossings of J and \(\hat{J}\) do not match, both the stability and the overshoot condition can no longer be fulfilled, resulting in very high \(\dot{\varphi }_\mathrm {ctrl}\). The resulting motion again leads to a change of J, back into the stable area. Hence, the instability is locally limited in a region around the TDC and BDC of \(\varphi \).

These instable regions are accompanied by undesirable acceleration peaks and thus jerk, which negatively affect the durability of bearings and guidance systems. While the accuracy of the machine is a process relevant criterion, machine relevant criteria, such as jerks, have to be taken into account. The jerks are modelled as A common approach in robot applications is to lock the dead centres by setting \(\hat{J}^{-1}\) to zero in a region around \(\varphi _\mathrm {TDC}\) and \(\varphi _\mathrm {BDC}\). However, since the dead centres of a press are a relevant operating point, this approach is not practical for presses. Another approach is the damped least-squares, which is based on a regularised inverse Jacobian [32]. This causes the inverse Jacobian to become increasingly damped near the singularity. While this reduces the effect of the instability and allows to control positions near the dead centres, the speed starts to creep, increasing the settling time dramatically. The result is getting stuck at the dead centres. Therefore, we investigate both, process and machine relevant criteria, in our proposed control.

As the desired motion of the machine typically is known before, it is possible to combine closed-loop control with a feedforward control. The task of motion control can then be split into the feedforward path, which generates the control speed for the open-loop kinematics \(\dot{\varphi }_0(t)\), and the closed-loop control, which only compensates for disturbances. Using the generalised regularisation of Tikhonov to find an optimal control lawallows to include a null motion in the regularisation term, which takes effect when approaching the singularities [166]. This null motion can be used to deduce a combined closed-loop and open-loop control law \(C_4\), which smoothly switches to open-loop via \(\dot{\varphi }_0 = \hat{J}^{-1} \dot{x}_\mathrm {des}\) close to the singularities. It corresponds to an additional zero in the transfer function and speeds up the settling time for changes in the setpoint \(x_\mathrm {des}\).

Based on the 1600 kN version of the 3D Servo Press presented in Sect. 3.​6.​3, we examine different control approaches in a simulation with uncertain parameters. The uncertainty is chosen according to the machine’s actual manufacturing tolerances, stiffness, actual sensor errors and noise.

The performance criteria for the control are the absolute error \(|e| = |x_\mathrm {des} - x|\), but also the magnitude of jerks \(\dddot{\varphi }, \dddot{x}\). Table 6.4 shows the results for an open-loop control \(C_1\), a closed-loop control with inverse kinematics \(C_2\), a closed-loop control with regularised inverse kinematics \(C_3\) and the combined control \(C_4\).

Because of the singularities, a large dependence on the operating point \(\varphi \) is to be expected. Therefore a trajectory for all control laws is chosen to cover the complete operating area of \(\varphi \in [0, 360^\circ ]\). To extract one feature for each performance criterion, the mean \(\mu (\cdot )\) of the time series is calculated. The variance of the error e is normalised to the stroke height h, which is the difference between the dead centres \(h = x_\mathrm {TDC} - x_\mathrm {BDC}=100\,\mathrm {mm}\).

The simulations show that an open-loop control \(C_1\) allows to smoothly control the machine with little jerks but neglects disturbances and uncertainty leading to a significant normalised position error. While an inverse kinematics control \(C_2\) increases the accuracy in x, it also leads to higher jerks, mainly at the dead centres. According to (6.18), high jerks in the drive \(\dddot{\varphi }\) have little effect on jerk in the ram \(\dddot{x}\) at the dead centres where \(J\approx 0\). Therefore, control design \(C_2\) leads to high jerks in the drive and moderate jerks in the ram. \(C_3\) finds a trade-off between accuracy and jerk in \(\dddot{\varphi }\). The only minor reduction in \(\dddot{x}\) shows, that the contributing jerks do not occur near the dead centres. All closed-loop controls share the drawback that they only react to position and errors are not able to anticipate. \(C_4\) combines the ability to compensate errors while anticipating trajectory changes. The result is a position error comparable to \(C_2\) and a drastically smoothed motion whose jerks are comparable to \(C_1\).

A typical approach to master uncertainty in the control of machines is closed-loop control. However, especially in servo presses, stability issues occur at their dead centres of motion, i.e. at their kinematic singularities. These lead to undesired jerks that affect the durability of bearings. Therefore, we presented and evaluated open-loop and closed-loop control methods taking into account process accuracy as well as machine criteria, i.e. jerk. The investigations have shown that a combination of open-loop and robust closed-loop resolves the conflicting objectives of high process accuracy and low machine jerk to the greatest possible extent.

As described in Sect. 4.​1.​3, machining processes that are used in the production of technical systems are generally affected by data uncertainty in form of incertitude, see Sect. 2.​1. For the manufacturing of the final component geometry, several individual processes are linked to form a process chain. Since the output of one process is the input for the following process, uncertainty propagates through the process chain, as shown in Sect. 3.​2. Therefore, regarding the final process of reaming or tapping, the uncertainty can have its origin in the preceding process (pre-drill geometry), the current process (runout error or synchronisation error), or the combination of the two individual process steps (positioning errors).

For reaming operations, a comparison of different uncertainty factors shows that an axis offset between the tool and the bore hole centre has major influence on the final geometry [82]. In the simulation of tool displacement in reaming an axis offset of 30 µm shows a resulting tool displacement of 2.8 µm. Due to the lack of radial guidance of the tool, the beginning of the penetration phase is a decisive point for the control of uncertainty. Tool deflection during the first cut leads to an inclination of the tool, which, due to the continuously increasing radial tool guidance, remains constant over the entire reaming depth [82]. This applies equally to tapping. For both processes uncertainty can be mastered by using a robust tool design, or by adapting the manufacturing strategies. Within this subsection different approaches based on the robust tool design and robust manufacturing strategies are presented for tapping and reaming.

In earlier investigations, uncertainty factors during reaming were eliminated by adjusting the macro geometry of a reaming tool. Schmalz [143] suggests an unequal distribution of the cutting edges in order to reduce roundness errors. This adaptation became state of the art in the industry. In further investigations on reaming, axis offsets are compensated by using tools with a chamfer angle of \(\kappa _R = 90^\circ \). By means of a simulation model for passive forces during reaming [82], we can show that, for a cutting speed of 60 m/min, a chamfer angle of \(90^\circ \) and different variations of cutting depths and tooth feeds, the simulated forces are smaller compared to the original reaming tool with a smaller chamfer angle. This results in a lower radial force, and in turn in lower tool deflection, during the penetration phase.

Based on further investigations on the influences of geometry elements, we modify the original tool geometry (Fig. 6.14a) to an adapted tool geometry (Fig. 6.14b). The key modification is a larger \(\kappa _R\) of the roughing cutting edge. In addition, two of the roughing teeth in the chamfer area are removed, since a lower number of teeth showed less deviation of the reaming tool in the simulation, especially if the tool is not yet guided through the secondary cutting edges. By applying these modifications, which are based on a mechanistic model (see Sect. 4.​1.​3), we can reduce the measured radial deviation by over 60 % [82].

The tool shown in Fig. 6.14b is adapted to reduce the effects of axis-offset errors of the pre-bore and the reaming tool. Under the assumption of an even drilling surface, an inclined pre-drilling has no effect on the radial course. It was therefore not considered in the tool design phase. However, if the drilling surface is not even, i.e. if the whole component is inclined, a chamfer angle of \(\kappa _R = 90^\circ \) has a negative effect due to the resulting lateral forces. Considering this effect, we reduce the chamfer angle to \(\kappa _R = 65^\circ \) and add a pilot reaming process. This leads to better results in terms of the lateral tool displacement and reduces the sensitivity of the process concerning uneven drilling surfaces [23].

When considering positioning inaccuracies in tapping, geometric modelling shows that these deviations can lead to an interrupted cut. This results in simultaneous removal of long chips as well as short thin chips, which increases the risk of chips jamming between tool and workpiece. We can detect the critical teeth using a geometric model [1]. One approach to increase the tool’s robustness and to ensure the removal of long chips, even under positioning inaccuracies, is to remove the first tooth that potentially leads to an interrupted cut. The adapted tool geometry cuts the thread with fewer teeth, reducing the number of chips per flute, while increasing the load on the subsequent teeth. Using the simulation tool from [1], we show that for axial-offsets of 0.1 mm, a disrupted cut can be prevented by removing the first cutting tooth of the tapping tool. In summary, it can be stated that an adaptation of the tool geometry during reaming and tapping can contribute to a reduction in sensitivity to certain uncertainty factors.

Adapted machining strategies, characterised by the combination of speed, feed and tool path, represent another approach for reducing the effects of uncertainty. As the majority of tool deflection arises during the penetration phase, this unsteady process phase is the main influencing factor for the reamer’s deflection over the bore depth [82]. To reduce the effects of uncertainty during this critical phase, we conduct tests with reduced feed rate during the entering phase. The test results show that a higher feed rate results in a higher deflection of the reamer. This matches theoretical considerations. A reduced feed rate leads to a decrease of forces, which deflect the tool in the unsteady phase. However, the application of special entry strategies, such as a cubic increase in the feed rate, shows no significant reduction of the medium deflection [74].

An alternative approach based on the active process control to reduce the effects of uncertainty in reaming is to apply suitable machining strategies [28]. The axis-offset is determined by the forces during the penetration phase with a sensor-integrated reaming tool. After the penetration phase, the reaming process is interrupted and the reaming tool is removed from the bore. This procedure can be compared to a countersinking process. Based on the integrated sensor data the axial misalignment is detected and quantified using a neural network. Thus, we can compensate the axial misalignment, before the actual reaming process is conducted. Despite a disrupted cut in the entry phase of the reamer, due to the compensation of the axial misalignment the countersinking process does not lead to a significant deterioration of the bore [28]. The proposed method is therefore suitable for compensating axial displacements and thus reaming the bores at the desired location.

Since the feed rate per revolution is much higher, this approach cannot be easily transferred to tapping. However, we can adapt the idea of an upstream countersinking process. To obtain threads that are true to gauge, the feed must fit the pitch of the thread. If the feed per revolution is smaller than the thread pitch, the tap would drill out the existing bore. Using simulations based on [1], we can show that by using an M8 tap with a feed of 0.09 mm/rev we can produce a chamfer to a pre-drilled bore that has the exact same angle as the chamfer angle of the tapping tool. This pilot process step could be used to provide a pilot bore with a defined chamfer that allows several teeth to be engaged with the workpiece material at the same time. As a result, the lateral forces partly compensate each other, which leads to a lateral support of the tap. To show the general feasibility of this approach, we carry out experimental investigations in 42CrMo4 steel on a 5-axis machining centre “Grob G350”. The pilot process is realised with an M8 machine tap, a feed of 0.09 mm/rev and a cutting speed of 60 m/min. The drilling depth of the countersinking process is varied between 1.25 and 3.75 mm, which equals 1 to 3 times the pitch of the tap. We carry out the subsequent tapping process using the same tool with a feed of 1.25 mm/rev and a cutting speed of 15 m/min. The resulting geometry is shown in Fig. 6.15. This is due to the removed material causing an air cut at the entrance to the bore. Furthermore, the effect of multiple teeth engaging with the material at the same time is visualised by the steps of the calculated chip cross-section A of each land of the tapping tool. With an increasing number of teeth being engaged simultaneously, the number of visible steps declines until the stationary process phase, when all teeth are engaged, is reached. For the pilot depth of 3.75 mm, which equals the chamfer length of the used tool, all of the chamfered teeth are engaged with the material at the same time.

By increasing the pilot depth, the starting time of the first material engagement is shifted backwards (see Fig. 6.16).

Since the depth of the pilot process affects the inner diameter of the thread in the penetration phase, a large pilot depth could lead to negative influences on the load-bearing strength of the thread. With a pilot depth of 2.5 mm, which equals two teeth of the tapping tool, the teeth with the biggest chip cross-section are already engaged simultaneously. However, the influence on the thread geometry is much smaller than for a pilot depth of 3.75 mm (see Fig. 6.16). Thus, the pilot depth of 2.5 mm can be seen as a good compromise between the conflicting goals of keeping the load-bearing strength of the thread and improving the process robustness by a simultaneous engagement of the teeth.

In this section, we demonstrate a number of approaches to master uncertainty in reaming and tapping. The approaches are, on the one hand, robust tool geometry design, and on the other hand, robust process design, e.g. with additional pre-machining steps. The approach of using the simultaneous engagement of all teeth of the tapping tool can be used to transfer findings from reaming to tapping by largely compensating the resulting radial forces during the penetration phase. This demonstrates the potential transfer of the existing knowledge on reaming to tapping. The fact that both processes are characterised by a penetration phase that is critical to the susceptibility to disturbance variables shows that there are parallels that should be pursued in future research activities.

Total flexibility can be further divided into four types, namely equipment flexibility, product flexibility, process flexibility and demand flexibility [154]. Equipment flexibility is defined as the ability of a system to integrate new products and variants of existing products. Product flexibility is the ability of a production system to adapt to the changing product spectrum. Process flexibility characterises the adaptability of the system to changes in parts processing, e.g. caused by changes in technology. Demand flexibility describes the ability of a production system to respond to changes in the demand of the market. Flexible manufacturing systems can cope with occurring fluctuations. Based on the four types of flexibility, different concepts for flexible assembly and cutting machines have already been intensively investigated in the past. However, uncertainty also influences the future market value of a specific forming machine, so the focus will be on forming machines [72].

Today’s forming machines are used for large series production with fixed selected forming processes, or for small series production with predetermined special tool movements. Consequently, the available flexibility in terms of adaptation to changing market conditions is limited [144]. The implementation of servo technology (see Sect. 3.​6.​3) is a first step towards increased flexibility by an extended process control of forming processes [73].

Forming machines and the associated processes differ in the number and type of degrees of freedom (DoF) in their driven movements. A DoF is defined as an independent way of moving a body. A three-dimensional space thus has three translational and three rotational degrees of freedom. This means that an input with one DoF can provide a maximum of one independent degree of process freedom at the output. In the following discussion, a forming system is considered, which is described only by the drives made available in the machine and thus the DoF.

The influence of the additional degrees of freedom on the flexibility types is analysed using continuous and discontinuous forming processes, see Fig. 6.17. It becomes obvious that with increasing degrees of freedom the flexibility of tool, product and process flexibility increases. However, due to longer tool paths, the demand flexibility decreases with the increasing number of degrees of freedom. Especially large series production is based on forming technologies, which are characterised by a one degree of freedom movement. This type of movement leads to low tool-to-workpiece contact times and thus high productivity.

Considering forming machines or processes with one rotational or translational DoF, such as rolling or deep drawing, the result is a low equipment flexibility. This results from the fact that the shape of the component cross section to be achieved is given by the shape of tools (Fig. 6.17). Due to the rigid tools, machines and processes with only one DoF in their movements possess a smaller product flexibility compared to processes with higher degrees of freedom. Additionally, they require more capacity for tool production and setup. The process flexibility is also low compared to processes with higher degrees of freedom, because of the limited usability of existing tools dedicated to previously executed production routes. In contrast, the demand flexibility of processes with few degrees of freedom is high since even a large number of parts can be produced on short notice. A control of process fluctuations is only possible to a limited extent, which is why the product quality is strongly dependent on the fluctuations in the semi-finished product. Conventional mechanical presses as well as servo presses allow translatory movements. Servo presses allow freely programmable speed-time sequences, which contribute to improved material flow, shorter setup times or increased product quality [73].

Forming processes with two degrees of freedom are, for example, flexible rolling or orbital forming. These processes not only allow the production of new products or variants by the development of new tools, they also allow the independent controllable speed-time curves for the respective DoF to react to the uncertainty of semi-finished product variations. By increasing the degrees of freedom, the tool contact time is increased in comparison to a movement with only one DoF. At the same time, the complexity of the control system is increased, which reduces the flexibility with respect to demand [73].

The increase to three DoF in the tool movement provides the so far conventionally established highest flexibility in machine, product and process design. By using three degrees of freedom, complex component operations can be produced in continuous and discontinuous processes. These include the processes of flexible roll forming and the Single Point Incremental Forming process. The Single Point Incremental Forming process was used for the production of spring elements in Sect. 5.​4.​8. These processes offer the possibility of producing a variety of three-dimensional geometries with a fixed tool geometry. Specific workpiece geometries are achieved by specific tool movements. Due to the flexibility of the tool, the set-up time is reduced to a minimum. The increased control effort and the associated increased manufacturing time reduce the flexibility of demand. Thus, the ability to react to increasing sales figures is significantly reduced [73].

Processes with one DoF offer the highest degree of demand flexibility, especially when considering the costs related to the batch size and the setup and maintenance effort. In the case of a smaller batch size, these production processes are not economically feasible due to their high fixed costs. Forming operations with two or three DoFs are in most cases designed for more complex products so that a smaller batch size of workpieces can be achieved. An increase in demand can usually only be achieved by using additional machines. The machines used for this purpose are mostly designed for special operations and are only capable for series production in a very limited way. Based on these findings, a forming machine has so far shown either high product, process and equipment flexibility or high productivity [73].

Frequently, used conventional presses provide a pure translatory relative movement of tool and workpiece. The investigation of forming processes shows that forming machines with flexible tool movements can have economic disadvantages in production technology (Sect. 3.​6.​3). In order to achieve the high productivity necessary for mass products in addition to complex products, the drive system of a forming machine should be usable for simple linear movements without reducing the production speed. This makes it possible to combine a flexible forming machine with high batch sizes. To realise a press with translatory stroke motion with additional degrees of freedom, three drive points of a plane are necessary. These three drive points can be driven by three axis-parallel translatory drives, see 3D Servo Press Sect. 3.​6.​3. By the simultaneous linear displacement of the three points, a translatory movement is realised similar to conventional presses. In contrast, the asymmetrical control of the three drive points results in a tilting movement of the point plane. The Tool Centre Point (TCP), which is located in the centre of the three drive points, shifts exclusively in the vertical plane, assuming small tilting angles. Based on these considerations, they can be transferred to a new press type [73].

In the following, a short description of the design is given. For the movement of the ram, a servo motor and a crank mechanism are used at each of the three drive points of the plane. These drives have a good controllability, and high stroke rates can be realised with them. Furthermore, the drives can be controlled independently of each other, so that the translation and tilting movements of the TCP can be controlled freely. The kinematics of the 3D Servo Press enables processes with one DoF of the ram such as punching, embossing and deep drawing. Furthermore, combined flexibly controlled processes, which are presented in [14, 70], are possible. Due to the additional degrees of freedom, the multi-technology machine can be used to investigate new and existing processes to extend existing process limits. The additional degrees of freedom in orbital forming processes offer the possibility of using the process strategy for a targeted control of product properties independently of the machine or tool kinematics (Fig. 6.18) [31]. Furthermore, Single Point Incremental Forming can be investigated for higher sheet thicknesses and high-strength steels. Previous investigations on these processes are limited to applications on special or milling machines. In comparison, the use of the 3D Servo Press offers the potential to explore new process limits and process control strategies.

Production technologies are confronted with uncertainty based on unknown material, product and demand influences. One way to master the uncertainty is to increase the flexibility of manufacturing systems. This can be done as described by increasing the degrees of freedom in machines and processes. Flexible manufacturing machines have advantages in comparison to conventional manufacturing systems, especially in uncertain demand scenarios. It becomes clear that the 3D Servo Press with its implemented control system is able to achieve a consistent product quality through different adopted process parameters. The total flexibility in forming technology shows a promising approach to cope with different types of uncertainty.

The concept of resilience has found its way into different disciplines where it is commonly used to describe the ability of an individual or a system to withstand and adapt to changes in its environment, cf. [55, 97, 148, 163]. In order to address the resilience of technical systems, a tailored definition and understanding, as well as suitable metrics to quantify resilience are required. In this subsection, we show first results on adapting the concept of resilience to technical systems, and address the following questions: (i) How to differentiate between robustness and resilience? (ii) How to quantify the resilience of a technical system?

Prior to engineering, resilience was introduced in the domain of human factors. Within this domain, special attention is paid to resilience for the design of socio-technical systems and safety management. According to Hollnagel, “a system is resilient if it can adjust its functioning prior to, during, or following events (changes, disturbances, and opportunities), and thereby sustain the required operations under both expected and unexpected conditions” [91]. Given this understanding, resilience of a technical system can be seen as a concept to master the unexpected and thus uncertainty.

While the human factor research community focuses on analysing the socio-technical interaction between humans and technology (cf. Sect. 6.3.3), in the following subsections of Sect. 6.3, we focus on transferring the idea of resilience to technical systems. We explicitly consider each product life phase as introduced in Sect. 3.​1 and show resilience principles and approaches that can be transferred to a broad range of systems, as for instance the example reference systems introduced in Sect. 3.​6. In the context of product development, resilience—as compared to robustness—can be regarded as a paradigm shift. According to Taguchi, [159‐161], robust design refers to functional characteristics of a system perceived by the user as being unaffected by disturbances and failures. Robust Design may be achieved by mathematical optimisation methods dealing with uncertainty, cf. [69]. Robust optimisation allows to optimise technical systems regarding user-specific objectives, while guaranteeing robustness of the design against uncertain input parameters, e.g. feasibility even in case of uncertain load parameters. The generated robust solutions fulfil their purpose not only at the design point, but also in a surrounding neighbourhood, the so-called uncertainty set, cf. [15]. For further details and examples of robust design and robust optimisation see Sects. 6.1.1–6.1.4.

New approaches to design products considering not only robustness, but also resilience, allow us to master ignorance or nescience (see Chap. 2 and Sect. 3.​5): Compared to a robust system, a resilient system is not only able to withstand expected disturbances and failures, but is also able to handle unexpected disturbances and failures which were not explicitly taken into account during the design phase. Robust systems guarantee performance for a known range of uncertain parameters (the uncertainty set), however, once outside this range, they might break down completely. Yet, resilient systems are characterised not only by their ability to withstand specific disturbances and/or failures, but are also “safe-to-fail” [2], yielding a minimum performance even in case of a failure and a subsequent ability to recover.

Thus, we use the definition already mentioned in Sect. 6.3: “A resilient technical system guarantees a predetermined minimum of functional performance even in the event of disturbances and failures of system components, and a subsequent possibility of recovering.”, cf. [7, p. 189].

In socio-technical or technical systems, the ability to recover is connected to maintenance measures, e.g. replacement of damaged components and/or capacity adaptations. In some rare cases, the technical system itself is able to recover to some extent, as shown for example by Bongard and Lipson in [27]. In this example, they describe an intelligent starfish-shaped robot that recovers autonomously from removing parts of its legs.

Given the ability of ideally resilient systems to be “safe-to-fail” [2] and to recover, the next logical step is to characterise resilient technical systems and to investigate how it is possible to specifically design the resilience.

One approach to master uncertainty by building resilient systems is given by Hollnagel [87‐89]. Hollnagel distinguishes four abilities/functions (monitoring, responding, learning, anticipating) that resilient systems should contain. They are shown in a systematic way in Fig. 6.19. We will address the transfer of this approach to the mechanical engineering domain in more detail in Sect. 6.3.8.

A first prerequisite to design the resilience properties of a system is to be able to assess them. Different qualitative and quantitative concepts for measuring resilience are proposed in the literature. For an overview see, e.g. [54]. While some metrics in the literature are either described in very general terms, or are not applied to technical systems, others are very specific to the system under consideration. For instance, for water distribution systems alone, more than 20 tailored resilience metrics were proposed by different authors [148]. Since many of the critical infrastructures that are examined with regard to their resilience, such as roads or supply systems for energy or water, are network-like, graphs can be used to describe them. Thus, also graph theoretical metrics (e.g. average path length, link density, central point dominance or k-shortest path length) have been proposed to assess resilience, see e.g. [85, 127].

Regarding general technical systems that are not necessarily network-like, a catalogue of design principles is proposed in [97], and the first author states that “the measurability of resilience should be a top priority topic for further research” [98, p. 35]. Since we characterise a resilient system by the fact that it can sustain the required operations even in the event of disturbances and failures, we use its performance under varying external and internal influencing factors i as the basis for assessing its resilience. Based on this understanding, we discuss a collection of different metrics, which we exemplify qualitatively. While there may be multiple external and internal influencing factors, which may influence the performance, we choose an univariate depiction for reasons of clarity.

In [7] we defined the performance range p of a technical system. It describes the subset of influencing factors for which the system is able to maintain a predefined minimum performance \(f_{\text {min}}\). Figure 6.20a depicts the performance range for an univariate function. Mathematically, the performance range can be expressed by the so-called ‘superlevel set’,Here, \(f:X \rightarrow \mathbb {R}\) is the system’s performance for varying arbitrary influencing factors \(x\in X\), cf. [7, p. 189]. Based on the performance range, several metrics can be introduced, e.g. the area under the curve above \(f_{\text {min}}\), or the performance range times a problem-specific weighting factor that gets smaller with a growing distance from the design point. As a general metric, we propose in [7] the radius of performance \(r_{\text {p}}\), cf. Fig. 6.20a. It measures the minimum distance between the design point and a realisation of an influencing factor for which the minimum performance can no longer be maintained.

In addition to the radius of performance, also the margin m can be used to assess the resilience of a technical system. It describes “how closely or how precarious the system is currently operating relative to one or another kind of performance boundary”, cf. [175, p. 23]. In [7], we proposed to quantify the margin by measuring the distance between the performance at the design point and the required minimum performance, see Fig. 6.20b for an illustration. Thus, it can be calculated bywhere m is the margin, f(d) is the performance of the system at the design point d, and \(f_{\text {min}}\) is the predefined minimum required performance of the system.

Resilient systems have been characterised to be safe-to-fail, cf. [2]. For this, it is important “how a system behaves near a boundary—whether the system gracefully degrades as stress/pressure increase or collapses quickly when pressure exceeds adaptive capacity.”, cf. [175, p. 23]. As such, resilience includes graceful degradation [68], once the system reaches its performance limit. In [7], we defined the gracefulness g of a system mathematically, being the directional derivative of the performance f in the direction of a given influencing factor or a vector of multiple influencing factors, cf. Fig. 6.20b. If the performance is non-differentiable, the limit from the direction of the design point may be used if it exists.

Another property of resilient systems is their buffering capacity. This term was first described in [175, p. 23] by Woods as “the size or kinds of disruptions the system can absorb or adapt to without a fundamental breakdown in performance or in the system’s structure”. In [7] we have defined buffering capacity as a quantitative measure of how much structural change the system can withstand while still fulfilling the predefined minimum performance. Depending on the context, the buffering capacity can assume continuous or discrete values. In the case of discrete values, the buffering capacity describes the number k of failed system components at which the minimum performance can still be maintained. In this case, the system may also be called k-resilient, cf. [10].

It is important to note that for assessing a system’s buffering capacity, the worst-case failure is always taken into account, i.e. the combinations of \(k = 1, 2, 3, \dots \) component failures, which are the most critical for the overall system. This is illustrated in Fig. 6.21 for \(k = 1\) and for a system consisting of three components A, B and C. The worst-case performance \(f_k (x)\) corresponds to the minimal performance over the set of all scenarios with up to k arbitrary failed components. Thus, a system has a buffering capacity of k (or is k-resilient) if, within an uncertainty set U of the influencing factors, its worst-case performance \(f_k (x)\) reaches at least the predefined minimum performance \(f_{\text {min}}\), i.e.where U is the uncertainty set. The smallest possible uncertainty set corresponds to the design point d.

While the above-mentioned metrics can be used to measure static characteristics of resilient systems, also its dynamic behaviour should be taken into account. The metric rapidity \(r_{\text {t}}\) was proposed for measuring the system’s capacity to recover its functionality in a timely way, [165]. For this purpose, the time period between the occurrence of the disturbance and/or failure and the restoration of functionality is measured, i.e. \(t_{\text {post}} - t_{\text {pre}}\), cf. Fig. 6.22.

Another measure for the dynamic aspects of resilience, also proposed in [165], is the so-called resilience triangle. Here, the total losses (e.g. in utility, revenue or performance) are measured until the system is recovered. These losses can either be approximated by a triangle, or calculated bysee, e.g. [163]. The triangle approximation is shown in Fig. 6.22 with hatched lines, while R is shown in grey.

While the presented metrics are intended to be suitable for the resilience assessment of general technical systems, their application in practical usage has to be proven. The next subsections show the application of the proposed metrics to practical engineering examples.

We consider resilient system properties as an extension of robustness to handle uncertainty caused by nescience, see Sects. 2.​3 and 6.3.1. A central aspect of resilient system behaviour is the adaptivity of the system. A purposive adaption is required to make the system continuously usable under changed internal or external system conditions, as introduced in Sect. 6.3.1. The condition changes also include disruptive changes, which can be external disturbances or internal component failures, that could severely damage the system. The resilient system shall cope with those changes using its resilient properties, cf. [142, p. 81]; [175, p. 21].

Resilience in engineering design implies a paradigm shift compared to robust design. To facilitate its realisation it is useful to support designers with a design methodology for addressing uncertainty using resilience during the product development process, see Sects. 1.​2 and 3.​5. In particular, systematic planning and design of the adaptivity for certain unforeseen system disruptions is of importance when developing resilient systems. Therefore, we present models and approaches in this Section.

Adaptivity in the resilience context is defined as the system’s ability to adjust to changing purposes or conditions in a suitable way. The desired adjustment aims at approaching a predetermined behaviour under the new conditions and indicates that the adaption of the system allows the maintenance of elementary system functionalities instead of a system failure and possible consequential damages, cf. [98, p. 107]; [96, p. 7].

Adaptivity in load-bearing systems can either be realised autonomously or externally induced as distinguished in Fig. 6.23. Autonomous or internal adaptivity includes all adjustments that happen within the system simply triggered by a change of conditions. Externally induced adaptivity usually requires a human operator or an additional external system that influences the system towards the desired adaption, cf. [142, p. 81]; [90, p. 224 et seq.].

The kinds of adaptions vary in the way of realisation and timing. Autonomous adaptions normally apply quickly because they are triggered by the disruption itself or correlating signals within the system, though in many cases the measures are only effective short-term. They necessitate the system’s ability to improvise. This can, e.g., be realised by physically or functionally redundant structures [142, p. 81]. A prompt reaction realised by autonomous adaptivity is often required due to sudden rapid disruptions. However, the disruptions can last for a long term, which makes additional measures necessary, if the autonomous measure is only applicable short-term. In many cases, the additional measures are externally induced. Externally induced adaptions can usually not be applied promptly, as a human operator’s response time is interjacent. In return, externally induced measures are effective for a longer period of time. Thus a combination of a prompt autonomous and a long-term externally induced adaptivity is recommendable. Externally induced adaptivity relies on the ability to convert, i.e. a replacement of the damaged subsystem by an identical one. Alternatively, the subsystem can be exchanged or even extended. We define the term exchange as the incorporation of a partly improved subsystem. Extension describes a significant improvement of the subsystem and requires an innovative capability, which usually implies the contribution of a human operator’s development work, cf. [142, p. 81].

An adaption is realised by implementing the resilience functions monitoring, responding, learning and anticipating, as introduced in Sect. 6.3.1 and evaluated in Sect. 6.3.8, cf. [90, p. 227]. Depending on the system’s complexity and the necessity of resilient functionalities, only one or several of the functions can be combined. The central resilience function is ‘responding’ because it describes the execution of the purposeful system adaption instead of an arbitrary reaction of the system. This means responding is always required in case a disruption, which is either an external disturbance or an internal failure, occurs. More sophisticated systems additionally use the resilience functions monitoring and anticipating. Monitoring means that parameters that have an influence on the system or quantities correlating to the influencing factors are measured. The anticipating function then describes the interpretation of the monitored data, which allows the system to foresee upcoming or potential disruptions and thus to react and apply measures before the disruption actually occurs, while responding only describes a reaction towards a disruption, cf. [90, p. 224 et seq.]; [175, p. 121 et seq.].

The resilience function learning exceeds anticipating by interpreting the data not only according to upcoming disruptions but also regarding the success or failure of the applied measure. Depending on the measure’s result, a learning system is able to adjust the reaction for the case of a repeating or similar disruption. The implementation of learning relies on an artificial intelligence (AI) or a human operator included within the system as contemplated in Sect. 6.3.3. The AI or human operator is able to take on the processing of the monitored data regarding the measure and its particular success or failure, respectively. As an AI or a human operator cannot be presumed in most technical systems, especially technical subsystems, the realisation of learning in technical systems is rather an outlook for further development. Nonetheless it is beneficial to design resilient subsystems, because such subsystems support the realisation of resilient properties in the superordinate system, cf. [90, p. 224 et seq.]. In the following, we focus on the resilience functions monitoring, responding and anticipating.

We developed the resilience application model to describe the interdependencies between the resilience characteristics and behaviour, as well as the disruption and the signal, respectively. The resilience application model is based on the definition of resilience for load-bearing systems, in particular, and on the definition of metrics regarding the system resilience characteristics and behaviour (Sect. 6.3.1), cf. [7, p. 189 et seq.]. The application model considers the resilience characteristics and behaviour as supplied before in Sect. 6.3.1 and adds the consideration of the disruption and a correlating signal progression. According to Jackson [96, p. 6] considering the disruption is of high importance for the realisation of resilience and the four resilience functions. In addition, the correlating signal is especially important for the functions monitoring, anticipating and learning, cf. [146, p. 1406 et seq.]; [145, p. 3 et seq.].

The resilience application model offers support for analysis and synthesis during the development process of resilient load-bearing systems. The analysis approach starts with the identification of the disruption and the determination of its temporal progression shown in Fig. 6.24c. If monitoring and anticipating are used within the system, the identification of a correlating signal, such as in Fig. 6.24d, and its progression are crucial, as monitoring is responsible for gathering data of a correlating signal, and anticipating relies on the gathered information. With knowledge of the resilience characteristics as shown in Fig. 6.24a, which provide the interrelation of the functional performance and different influencing factors, the impact of a disruption can be determined, as also described in Sect. 6.3.1. Based on the disruption, respectively signal progression and the resilience characteristics, the expected dynamic resilience behaviour can be determined as in Fig. 6.24b (see Sect. 6.3.1). During the synthesis, the aspired system properties can be described using the resilience application model. First, the aspired resilient behaviour is defined. Afterwards the required resilience characteristics for realising the behaviour can be deduced, e.g., the value of the required minimum performance or the system’s gracefulness. Furthermore, the necessity of monitoring the disrupted influencing factor or correlating signals for realising the required characteristics can be examined, cf. [146, p. 1406 et seq.]; [145].

For the depiction in Fig. 6.24 we chose the example of a system that is disrupted and applies a booster, which increases the possible performance of the system for a certain time. It shows how the four graphs of the resilience application model could look like for a particular case. A boosted system could, e.g., be a car using snow chains in case of the disruption of sudden black ice represented by a jump in the disruption graph. Figure 6.24 shows the exemplary progressions of the system in the resilience application model. Without snow chains the car is not able to deliver the required performance. Hence a measure is required to restore the functional performance to the minimum level \(f_\mathrm {min}\). The booster is represented by the upper grey graph in comparison to a system not applying a measure depicted in black. Applying snow chains increases the traction performance of the car on black ice. As soon as the disruption of black ice disappears, the snow chains can be removed and the car resumes its functional performance without additional measure, as shown by the upper grey curve which reaches its original value again, cf. [146, p. 1410 et seq.]. In case of the snow chains, it becomes apparent that this booster functionality is only useful during the disturbance phase because the snow chains increase traction and therefore allow to maintain the system’s essential ability to drive. However, they reduce the achievable velocity significantly, which is not desired under undisturbed conditions. Beyond conflicts of several desired system properties, it often also saves resources to apply the booster only for a certain period of time, like in case of emergency generators with limited energy capacity.

The central aspect for realising resilient behaviour is that a system is able to purposively adapt to new conditions. The purposive adaption is realised implementing the four resilience functions, while responding is the most important resilience function, as it describes the application of the adaption. The interrelations of the resilience properties, which comprise the resilience characteristics and the resilience behaviour, as well as the disruption progression and possible correlating signals are describable using the resilience application model. The model is also able to describe a desired behaviour and the complementing resilience characteristics for the system synthesis. The desired behaviour can be formulated as an ideal system and then be refined to an actual technical solution. The methodological approach is not fully composed yet, but we consider the presented models and methods as a useful support for making resilience amenable for designers that are unfamiliar with the approach.

The mastering of uncertainty plays an important role in complex systems, which can be divided into technical and socio-technical systems. Technical systems only include technical components and their interaction. In socio-technical systems, the human being and the technical components are taken into account. The effects of the interaction of humans and technology play a decisive role in the analysis of socio-technical systems. For the research on resilience it is relevant to integrate aspects of the interaction between humans and technology in order to implement certain functions that can lead to resilience. An extension of the technical system to a socio-technical system thus also enables the consideration of important influencing variables on the resilience and performance of a system. In socio-technical systems humans can be seen as an unpredictable source of both reliability and errors, which has an impact on the resilience of the system. The identification of different components of resilience is complex, especially the question, to what extent humans are involved as an actor in a resilient system. Most of the research in this field is taking place in the area of Resilience Engineering. The resilience of the systems here, is linked to safety management, faced with known or unknown situations. The context of the studies are sectors where humans and machines work together in critical situations, for example in aviation, healthcare, chemical and petrochemical industry, nuclear power plants, and railways [138]. In the following section of this overview, the possibility to integrate the human into a resilient system is outlined.

To classify the human in a socio-technical system, biological, cognitive, emotional, motivational or dispositional aspects can be considered. The consequences of these aspects are observable actions or decisions. In the case of modelling, it is therefore relevant to determine which part of the human being is to be investigated. The analysis of behaviour leads to behaviour models while the analysis of decisions leads to decision-making models. Behavioural models explain human behaviour as an outcome and model the upstream processes, for example cognitions. They can explain how a particular disposition leads to a particular behaviour of humans. In a socio-technical system, these variables have an influence on the entire system output. By manipulating the upstream processes, a certain human behaviour can be simulated and promoted. Examples for this can be found in numerous disciplines analysing and predicting behaviour in social systems [3]. A further class of human models are decision-making models. These can be used as process models to simulate resilience in human decisions [117]. Thereby criteria are defined, for example redundancy, and afterwards such a criterion can be applied to the human decision, understood as a process chain. This modelling is mainly used in safety-critical contexts. Figure 6.25 depicts an example of a decision-making model which shows the possibilities for the development of resilience triggered by human beings. Both types of models can be tested in various ways, for example with the fuzzy logic [40].

In order to measure resilience, metrics are established in Sect. 6.3.1. These metrics can be equally applied to the socio-technical system, depending on the type of the human modelling. In his Functional Resonance Analysis Method (FRAM), Hollnagel [89] outlines the application of four resilience functions in an organisational context. All four functions (learning, responding, anticipating, monitoring) are seen as cross-sectional claims. This means that people are also required to learn, anticipate, monitor and respond in order to create a resilient socio-technical system. They can, of course benefit from the resilience of the system as well, which is important, especially in safety contexts. These interactions are different for each system. A few authors have already assessed this framework (see [4, 35, 164]). Especially for the factors anticipating and learning, it makes sense to consider the human being as a source of resilience. While the responding and monitoring within socio-technical systems is often performed by the technical components, the human being is able to take over tasks which serve the learning and anticipation ability of the entire system. Human operators are able to gain experience and to learn by repeating their control tasks, thus improving their behaviour [134]. They can adjust themselves according to the dynamic changes of the socio-technical systems.This requires adaptive and proactive behaviour (i.e. resilient behaviour) to control the system performances, especially when faced with unexpected situations. The metrics introduced in Sect. 6.3.1 can also be applied to human capabilities, for example the performance range or the buffering capacity. The performance limits and reserves are defined in a socio-technical system by technical and human performance numbers. Human performance can, for example, be defined as strength or cognitive performance. This definition determines how reliable and measurable the performance limits are. Human performance often depends on intra-individual variance. This variance can also serve as a performance reserve. Examples of this can be found in safety research in the analysis of accidents in which people were able to activate performance reserves through unexpected behaviour (e.g. [164]). The buffer capacity can arise in a socio-technical system through redundancies or deliberate over-calculations. For example, humans can contribute to the buffer capacity by additionally securing certain processes within the scope of testing activities. Also the installation of transfer possibilities of the technical system by humans increases the buffer capacity of the entire socio-technical system.

In order to design systems resiliently, it makes sense to strive for a socio-technical modelling. In order to promote certain properties of the system human behaviour and decisions can be presented as a source of increasing resilience. Human modelling is also necessary to rule out opposing effects, such as a reduction of resilience because of human decisions or behaviour that can increase errors or uncertainty.

Tristan Gally, Philip Kolvenbach, Anja Kuttich-Meinlschmidt, Marc E. Pfetsch, Andreas Schmitt, Johann M. Schmitt, and Stefan Ulbrich

Truss structures are load-bearing systems that are found in many applications of mechanical engineering. This includes the Modular Active Spring-Damper System presented in Sect. 3.​6.​1. As introduced in Sect. 6.1.1, a typical truss design problem is to find a truss topology that is as light-weight as possible while being stable enough to withstand certain load scenarios. In these design problems, there are various sources of uncertainty that need to be accounted for. For instance, typical optimisation methods lead to truss designs that are stable only for a small, predetermined set of external forces; even small deviations from these forces can lead to extremely poor performance or failure of the structure. This issue is well studied in the field of robust optimisation, where the worst-case behaviour of a structure over a given uncertainty set of forces is decisive [17].

In Sects. 6.1.1, 6.1.2 and 6.1.3, we used robust optimisation to control uncertain loads for different models of truss topology problems. Robust optimisation can also be applied to other kinds of uncertain parametric dependency, e.g. material properties or manufacturing tolerances. However, sometimes sources of uncertainty are unknown or cannot be quantified. In these cases, it can be worthwhile to move the focus from the source of the uncertainty to its impact on the truss structure. One possible approach is to design resilient truss structures in the sense that the truss remains stable even if a predetermined number of bars fail, for whatever reason, i.e., we use resilience to master ignorance, see Sect. 3.​5. Following Sect. 6.3.1 we therefore also evaluate truss structures with respect to their buffering capacity. This strategy can be combined with robust parametric optimisation leading to light-weight robust and resilient trusses. To master the inherent structural uncertainty, cf. Sect. 2.​3, in the truss topology design, we use mathematical optimisation, which takes the complete solution space into account.

The consideration of complete bar failures in truss topology optimisation has started only recently except for [158], which considers only a small failure set. Continuous topology optimisation problems are considered by [99, 179]. Redundancy from coding theory applied to truss design is considered in [131]. Kanno [100] also designs resilient trusses according to our definition, however displacement constraints are not included in the model. Non-robust truss topology design under bar-failure is considered in [155]. In the following we will extend the robust truss topology design problems from Sect. 6.1.1 and 6.1.2 to include resilience as presented in detail in [7, 64].

In this section we extend the basic robust truss topology design problem to also consider bar failures as shown in [7]. This will allow the computation of a resilient and robust truss with minimal volume. The base is formed by the robust truss topology optimisation problemwhich finds an optimal cross-sectional area \(x_e\) for each bar e under a semidefinite stiffness constraint. Here, \(l_e\) denotes the length of bar e, \(A(x) = \sum _{e \in \mathcal {E}} A_e\, x_e\) is the stiffness matrix, Q describes uncertain forces on the nodes of the truss and \(C_{\max }\) is a bound on the compliance of the truss, which must not be exceeded. For more details see Sect. 6.1.1. A truss has a buffering capacity of k if the above semidefinite constraint still holds, even after up to k arbitrary bars have failed. This condition can be incorporated into the above formulation with the help of the set of failure scenarios \(\mathcal {Z} = \{z \in \{0,1\}^{\mathcal {E}} : \sum _{e \in \mathcal {E}} z_e \le k\}\). For a failure scenario \(z \in \mathcal {Z}\), bar e fails if and only if \(z_e\) is 1. The failure of a bar can be represented by removing its influence on the corresponding stiffness matrix. Therefore, the stiffness matrix for a given failure scenario z is given by \(A(x,z) = \sum _{e\in \mathcal {E}} A_e x_e (1-z_e)\). The resilient design problem then readsThe cardinality of \(\mathcal {Z}\), and thus the number of semidefinite constraints, increases exponentially with k, which makes this approach feasible only for small values of k, see [64]. For a different dynamic approach, see also the design of resilient water supply networks in Sect. 6.3.5. The following examples, however, use the complete set \(\mathcal {Z}\).

Our approach is in the spirit of robust optimisation, see Sect. 6.1, and the presented solution methods in Sects. 6.1.1 to 6.1.3, as \(\mathcal {Z}\) may be identified as an uncertainty set. However, a different solution approach is needed due to the discrete \(\mathcal {Z}\) in contrast to the continuous ellipsoidal uncertainty sets considered there.

Figure 6.26 shows three optimal crane truss structures with different buffering capacities k [7]. The nominal forces are displayed as arrows, the uncertainty sets as ellipsoids around them. In Table 6.5, the size of the failure set \(\mathcal {Z}\), the objective function value, and the runtime of the optimisation are displayed for three values of k. It is apparent and not unexpected that resilience does not come without a significant cost: Requiring the truss to be stable even after failure of any two bars, increases the volume by a factor of four and also the computational cost. Figure 6.27 shows the maximal increase of the nominal forces for different attack angles that the three trusses can sustain (\({0}^\circ \) means the forces face downward). It indicates a relationship between the different metrics to assess resilience defined in Sect. 6.3.1 as a greater buffering capacity leads to a greater performance range and margin, as well.

An important cause of failure for truss structures is the buckling of individual bars, which is caused by excessive axial compressive loads and which cannot be detected through the compliance condition alone, see Sect. 6.1.2. As shown in [64], the optimisation problem (6.20) can be augmented with buckling constraints to prevent bars to buckle in the optimal design. These buckling constraints also have to be copied for each failure scenario in \(\mathcal {Z}\) in order to obtain a resilient structure with buffering capacity. Furthermore, variables for the bar forces for each failure scenario must be added. These are determined by so-called indicator constraints, in contrast to the equilibrium conditions used in Sect. 6.1.2, as the geometry matrix after the failure of bars is possibly singular. For more details see [64]. A passive option to avoid bar buckling is to increase the width of vulnerable bars. An alternative that helps to reduce the mass of the truss is presented in Sect. 5.​4.​7. It introduces active buckling control by integrating piezoelectric stack actuators in compact piezo-elastic supports at the bar ends and has been integrated in the robust problem in Sect. 6.1.2.

Figures 6.28 and 6.29 show resilient truss structures with different buffering capacity and different number of active bars for the example presented in Sect. 6.1.2. The objective function values and computational costs are given in Table 6.6. It can be seen that active bars indeed help to decrease the volume of the truss, but at the price of increased cost due to the actors. Note that the added weight of the actuators is not considered in the model.

In this section we have shown how to include bar failures into truss topology optimisation to design light-weight but robust and resilient trusses. Future research could investigate, whether the increased size by additional variables and constraints for each failure scenario can be avoided.

This section presents optimisation methods to consider resilience, as introduced in Sects. 3.​5 and 6.3.1, in the design phase of a technical system. In order to master uncertainty, our goal is to find an optimal combination of different components constituting a resilient system structure, i.e. a structure which is able to tolerate and react to failing components. To assess and optimise resilience, we use the concept of buffering capacity described in Sect. 6.3.1: If a system has a buffering capacity of k, any k components can fail and a previously defined minimum system functionality is still fulfillable. We also say the system is k-resilient.

In [9, 10] we have analysed a Mixed-Integer Nonlinear Programming (MINLP) model to design a cost-optimal but k-resilient water supply system for a high-rise building and presented a solution approach. A similar model has been validated in [133] with the help of a test rig. In the following, we briefly summarise the model and the solution algorithm presented. Furthermore, we review the found characteristics of the resilient designs.

In comparison to Sect. 6.3.4, which presents the computation of k-resilient trusses, the basic models differ. Therefore, the computation of worst-case failures also differs and needs to be treated differently. In both cases, the design of a topology is considered, and structural uncertainty is present, see Sect. 2.​3. The consideration of buffering capacity further increases this uncertainty.

For an overview on using MINLP to optimise water distribution networks (WDN) we refer to [41]. The literature on resilient WDN focuses on measures to quantify resilience and testing these on existing networks, see e.g. the well know resilience index by Todini [169] and the overview article [148]. For an example for an optimisation of resilience using a surrogate measure in the context of WDN see [171]. The inclusion of component failures in layout optimisation can also be regarded as a defender-attacker-defender game model, see e.g. [5], in which the defender designs a layout. The attacker interdicts components in this layout, whereupon the defender reacts to these contingencies. These games can be understood as multi-stage optimisation/adjustable robust optimisation with integer variables, see [19, 102, 177]. In some cases the tri-level structure can be reformulated as a structure with only two levels, see e.g. [33] and the general bilevel solution approaches [53, 105, 129].

In high-rise buildings, pumps are used for pressure-boosting in order to supply all floors with water. In each pressure zone, a given pressure and volume flow demand has to be fulfilled. The aim of the optimisation model is to design a pump and pipe system which fulfils these demands and minimises operating and investment costs. In order to do so, each floor has to be connected to the ground floor either by connecting it directly or by connecting it to a lower floor. Thus, the topology as well as the diameters of the resulting pipe network have to be determined. These possible pipe layouts are restricted to be tree-shaped, i.e. each floor is connected to exactly one lower floor. Further discrete decisions concern the placement of pumps. The model equally determines the cheapest pump operation to provide water. Altogether, the model contains discrete decision variables, such as pipe and pump placement, as indicated in Fig. 6.30b, and nonlinear non-convex constraints to approximate the pump characteristic diagrams, as shown in Fig. 6.30b. This leads to a complex mixed-integer nonlinear problem which is already strongly NP-hard to solve for \(k=0\).

To obtain solutions which are robust against uncertain pump failures, we developed a method to find a k-resilient system which minimises the investment and operating costs in [9, 10]. In order to integrate this robustness we define the set of failure scenarioswhere we have enumerated all possible pumps in the building from 1 to n. Thus, for scenario \(z \in \mathcal {Z}\), the entry \(z_{i}\) is 1 if and only if pump i fails in the scenario. Using this set, we can guarantee resilient system structures by modelling the successful operation of the system for each failure scenario \(z\in \mathcal {Z}\), even though the pumps given by z fail.

Integrating all scenarios in \(\mathcal {Z}\) in the model would lead to exceedingly large solution times, due to the exponential growing cardinality of \(\mathcal {Z}\) with respect to k. Therefore, an iterative strategy is used. We solve models which only consider a subset \(\mathcal {Z}'\) of \(\mathcal {Z}\). For a solution, we compute a worst-case failure scenario in \(\mathcal {Z}\). If the solution can sustain this scenario, the optimal resilient solution is found. Otherwise, the failure scenario is added to \(\mathcal {Z}'\) and the model is solved again.

This scheme is further adapted to the use case of the high-rise building. Due to the tree-shaped network topology and the usage of only parallel pumps of the same type, the volume flows in each floor and in each pump are pre-determined for a fixed pipe topology. Thus, the number of nonlinear constraints decreases. Furthermore, for the optimal placement and operation of pumps on this topology, resilience can be modelled by a set of linear inequalities for each failure scenario. These inequalities can be separated by a simple dynamic program with running time polynomially bounded in the input parameters. Thus, a branch and bound scheme which branches on the pipe connections from the bottom to the top was developed. Computational tests in [10] show the computational benefits of this approach.

To further improve running times an alternative representation of the characteristic diagrams independent of the operating speed presented in [137] can be used. This representation is convex allowing the usage of perspective cuts introduced in [56]. New computational results for the combination of the branch and bound scheme and these cuts are presented in Table 6.7 for the test instances and test environment used in [10]. The modification allows solving instances with one more pressure zone and larger buffering capacity. An increasing computational burden for increasing k and an increasing number of pressure zones is observable.

In the following, we discuss some findings which can be useful to understand the advantages and properties of resilience. This is possible since we are able to rapidly compute resilient solutions with the above presented scheme. Thus, we can compare resilient solutions for different parameters.

Figure 6.31a shows the power consumption and investment costs of all Pareto-optimal solution topologies with respect to power consumption and investment costs of a building with six pressure zones and different levels of k-resilience. There exists no solution topology which, at the same time, is more energy-efficient and cheaper than the depicted solutions. We first note that larger investment leads to lower energy costs, since more pumps are built, which can then be operated more efficiently. It can be seen that the minimal investment increases, but also the worst power consumption achievable by a Pareto-optimal solution, decreases with an increasing k-resilience. This is due to the increased number of pumps needed to guarantee fault-tolerance. The overall positions of the solutions are coherent with the observation that the number of pumps and thus the investment costs increase with more emphasis on the energy costs. Interestingly, for a small power consumption (\(\le {9}\,\mathrm{kW}\)) a large number of different Pareto-optimal solutions exists. Small efficiency improvements correspond to large changes in the investment costs. The best power of around 8.9 kW is for larger k only achievable with greater investment costs. However, due to the great density of solutions, resilience can be achieved for this efficiency without big disadvantages. We furthermore see that for solutions with a power consumption of at least 9 kW the investment costs tend to scale almost proportional to the resilience factor k with a proportionality constant smaller than 1. This contrasts an exemplary conventional redundant design strategy, which could build every pump of the 0-resilient solution \(k+1\) times and would scale with a proportionality constant of 1.

In [9] the characteristics of resilient designs are analysed for an exemplary application for \(k\in \{0,\dots ,3\}\) with seven pressure zones. Using perspective cuts, we are able to solve this application for nine pressure zones leading to different solution topologies. Despite the difference in the number of pressure zones, we will draw very similar conclusions on resilience in the following to the ones in [9].

The price of resilience is mainly due to the increased number of needed pumps as observable by the solution costs depicted in Fig. 6.31b. Nevertheless, it is a lot more advantageous than a pure strategy of redundancy. Placing another pump in each pressure zone used of the non-resilient design increases the investment costs by more than \({50}\,{\%}\), whereas the topology with a buffering capacity of \(k=1\) instead of \(k=0\) is only \({5}\,{\%}\) more expensive. The additional pumps which are needed for resilience are even able to decrease the operating costs for the \(k=2\) solution. It remains similar for the other levels of resilience.

Several metrics to quantify resilience have been introduced in Sect. 6.3.1, and it is not clear whether the choice of buffering capacity is preferable to other metrics in the design of a resilient high-rise water supply system. Nevertheless, it is indicated in [9] that consideration of the buffering capacity is also linked to the improvement of performance range, radius of performance, and margin. We obtain the margin for each solution, by computing the worst-case combination of one up to three failing pumps and the subsequent maximal volume flow which can be transported, compare Fig. 6.31c. In these computations, the minimal functionality after failures was defined as 80 % of the design point volume flow of \({28}\,{\mathrm{m}^3/\mathrm{h}}\). Thus, each k-resilient solution lies above the dotted line for up to k failures. It can be seen that resilient solutions are oversized for standard operation, since without failures they exceed the required volume flow of \({28}\,{\mathrm{m}^3/\mathrm{h}}\). Thus, we claim resilience is a property which has to be actively sought for. Conventional methods will seek solutions which are “just right” for the given operating point and have no reserves. We again observe that our approach for resilience is finer-grained in comparison to simple redundancy. The solution with a buffering capacity of \(k=3\) is not just obtained by including another pump to the solution which considers two pump failures. This is the case, since the latter has the largest reserves for one and no failures.

An observation specific to resilience and the design of decentralised high-rise water supply networks has been made in [10]. Here it has been shown that increasing the weight of the energy costs, i.e. shifting the importance of investment versus operating costs, leads to solutions which are branched out, whereas demanding greater resilience tends to solutions that connect the floors in series. This can be explained by the fact that in the former layout one pump can supply fewer floors than in the later scheme. Thus, it has fewer redundancies and is inferior with respect to resilience aspects.

If we want to apply resilience properties, we must be able to assess the system’s resilience. For this purpose, we defined the resilience metrics in Sect. 6.3.2. We evaluate drop tests of the Modular Active Spring-Damper System (MAFDS), presented in Sect. 3.​6.​1, with the Fluid Dynamic Vibration Absorber (FDVA), see Sect. 5.​4.​4, to apply these metrics to a technical system in comparison to a conventional damper.

A vibration absorber is used to reduce vibrations from an oscillating system. A conventional dynamic vibration absorber consists of a heavy mass and a capacity. However, this additional weight counteracts the goal of a lightweight construction. In contrast, the FDVA reduces the dynamic mass by the use of hydrostatic transmission, see Sect. 5.​4.​4

The MAFDS, shown in Fig. 6.32 represents a dual mass oscillator and is therefore suitable for demonstrating the functionality of the FDVA. The purpose is to reduce the vibrations of the lower structure. Since this lower structure is a single mass oscillator comparable to a wheel, we will refer to it as wheel in the following. We consider a maximum wheel load for the lower structure, which is important in drop tests. The tests in the MAFDS are designed in such a way that possible influences, such as a change in the body mass, can be investigated in order to address the data uncertainty of the load-bearing system, see Sect. 2.​1 and apply the resilience metrics, defined in Sect. 6.3.1 to the usage of the FDVA.

The MAFDS, which incorporates the technologies damper or FDVA, is dropped during the measurements with a variation of additional weight on the upper structure (body) to vary the body size and represent incertitude. The additional weight addresses the unknown loading conditions and is varied in 20 kg steps from 0 to a maximum additional weight of 80 kg. The test rig is shown in Fig. 6.32.

The MAFDS is similar to a car suspension strut because both are dual mass oscillators. A drop test is an unusual but possible use case. The driver might steer the car at a high speed down a sidewalk. A scenario which is not in focus of the suspension strut adjustment.

The MAFDS is in free fall of 30 mm until impact. For each drop test, the force at the impact plate is recorded. This force is equal to the wheel load \(F_\mathrm {W}\). Figure 6.33 shows the wheel load \(F_\mathrm {W}\) over time for a drop test without additional weight. The FDVA has two opened ducts to realise an eigenfrequency of 10 Hz. This is the nearest possible frequency of the FDVA to adapt the lower structure eigenfrequency. The better the eigenfrequencies match, the better the wheel load fluctuation is reduced. We calculate the lower structure eigenfrequency \(\omega =\sqrt{k/m}\) by lower structure mass m and the stiffness k of the elastic foot.

The first peak for both measurements with damper and FDVA is the first lower structure contact to the impact plate. We measure the highest wheel load when the upper structure compresses the suspension. The highest wheel load is the critical load. At this point the highest force acts on the wheel and thus on the tire. The MAFDS in our case has a rubber buffer, that cannot burst, instead of a tire. Thus we are able to perform drop tests with high wheel loads at which a real tire would already burst.

To quantify uncertainty we consider the resilience metrics defined in Sect. 6.3.1. First, we define the functional performance. For this example the functional performance \(1/F_\mathrm {max}\) is the inverse of the maximum wheel load. The influencing factor is the additional weight. The design point is the MAFDS without an additional weight. To measure the resilience we need to define a minimum performance. The critical element in such a use case is the tire. The tire has a load index which defines how much weight it can carry. For this example, a tire with a load index of 91 is chosen because this load index is used for cars with body mass similar to the MAFDS. The load index 91 allows to carry 615 kg. The static load should be the maximum load the tire is exposed to. This is equivalent to the minimum functional performance \(f_\mathrm {min}\). In Fig. 6.34 the functional performance is normalised by the minimum functional performance. Every point below this minimum represents a failing system. Failing means, the tire could burst due to excessive load. With this definition, we can compare the resilience of a damper and the FDVA. We can see that the FDVA has a higher functional performance. The FDVA’s margin at zero additional load is 4 % higher than the damper’s margin.

The radius of performance defines the minimum distance between the design point and the point for which the functional performance undercuts the minimum functional performance \(f_{\mathrm {min}}\). This radius of performance is 70 kg of additional load for the damper. The radius of performance for the FDVA is higher than the performed tests. Therefore, the resilience of the MAFDS can be increased by using the FDVA: even at an additional load of 80 kg and higher the system guarantees a predetermined minimum of functional performance.

The performance range in this example is equal to the radius of performance because there is a constant decrease of functional performance with higher additional load. To evaluate the gracefulness, measurements with the FDVA at higher additional loads would have to be performed resulting in a destructive test. Thus, we do not evaluate the resilience gracefulness here.

In technical systems where a critical minimum exists, which defines the minimum functional performance, we can calculate the resilience metrics margin and radius of performance. In the drop tests the radius of performance has a higher use case than the margin because it describes how uncertain the additional load can be until the system fails. But to evaluate the radius of performance, tests with failure have to be evaluated in a normal case.

The margin is useful to quantify the standard usage with no additional weight. In this drop test we have an improvement of 4 % of functional performance with FDVA in relation to a standard damper. But the value of margin on its own can not give an information about when the system fails.

The concept of resilience is not only applied to master uncertainty during design, but equally to connect the product life phases production and usage, (Chap. 3) by integrating the four resilience functions monitoring, responding, learning and anticipating [88], see Sect. 6.3.1. Within the product life phases production and usage, the state of the art is to establish variable process windows to master uncertainty. For example, modern cars have flexible oil changing intervals, based on numerous operating parameters of the engine. However, currently the connection between the life phases production and usage is still formed by the product design. Customer feedback or guaranteed returns are analysed individually, and the component life, described by usage and environmental parameters, is deduced. Ultimately, the product or its production are changed to cope with the findings.

Today, an increasing number of technical products offers the possibility to collect data during the usage phase. Paired with the development of technologies, such as single part tracking, the increasing modelling of production processes and process chains, resilient product life phase spanning process chains become possible. In this section, we show the general concept of this resilient process chain and apply it to the hydraulic actuator of the Active Air Spring introduced in Sect. 3.​6.​2. We introduce production uncertainty to individual parts of the actuator and conduct experiments to determine the effect on usage parameters.

The concept of a product life phase spanning a resilient process chain was presented by Dietrich et al. in [45] and is shown in Fig. 6.35. Based on the production plan, a technical component is produced. The individual production steps are described by models that use measured parameters during production. Following the nomenclature introduced in Sect. 1.​5, the production and usage plan are structures S, described by functional relations f, that rely on data b. (Soft-)sensors feed models that aggregate information during the usage. By a suitable selection of data that are logged during production as well as during usage, the data can be matched and compared. Mostly, the data obtained from production and usage is not the same, thus correlating models for the matching need to be developed. For example, these models may be developed by domain-specific experience or empirical correlation. By the feedback of the differences between actual data from production and identified data from usage, the models can be adapted and a learning function might be established. Using time histories and correlating single part data to the respective usage data, the component behaviour can be anticipated already in the production itself. Based on this anticipation, the usage plan of the component can be adapted. In reference to Sect. 3.​5 and Fig. 3.​16 ‘the system function is evolving’, thus enabling resilience. The resilient process chain deals with structural uncertainty, according to the Sects. 1.​5 and 2.​3.

The concept of a resilient process chain results in four requirements for the production and the usage of the component.

Resilient process chain applied to the active air spring

In the following, we want to evaluate this concept by applying it to the Active Air Spring, which is described in detail in Sect. 3.​6.​2. The Active Air Spring is an active system that combines the advantages of an air suspension, such as level control or the load-independent body eigenfrequency, with those of an active system that can actively reduce vibrations and has a flexible working area. For example, it can be used to minimise kinetosis during autonomous driving of cars [83].

The active elements are two hydraulic diaphragm actuators with linear moving segments, which vary the load-bearing area of the Active Air Spring. Each segment has two pistons that run in a sliding bushing and is actuated with hydraulic oil. For a more detailed understanding of these actuators we refer to [83, 84] and Sect. 3.​6.​2.

To evaluate the concept of the resilient process chain, we want to focus on a rather simple mechanical property of these segments. In Fig. 6.36 the part of the process chain for the final machining, assembly and usage of the hydraulic diaphragm actuator is shown. It is the most crucial part of the production for the functional performance of the actuator. The process steps reaming, assembly and usage are labeled with examples for relevant parameters in the according step. In difference to a classical production chain we want to use information from each step in models to perform predictions on the one hand, and to improve the process steps on the other hand. As presented in Sect. 6.1.8, we have existing models for the reaming process. Typically, reaming within a process chain happens at the end of the value chain. Its purpose is to produce the shape and position of functional bores within the required tolerance range [42]. For productivity reasons, nowadays often multi-blade reamers are used where the functions “cutting” and “guiding” are combined in one geometric element. The production of precision bores using multi-bladed reamers is the subject of various scientific studies. Uncertainty in the form of disturbances regularly influences the reaming process in industrial practice. Typical disturbances are axis misalignment, run-out errors and inclined surfaces with sloped pilot holes [23, 24].

The influence of disturbances on the quality of the reamed bore has been investigated with regard to diameter, circular shape and cylindrical shape [21, 110] as well as with regard to the deflection of the tool [25, 82]. A deflection of the tool leads to an increased diameter of the casing cylinder of all bore centres of the reamed bore. This in turn leads to an increase of the casing cylinder of all bore centres [26]. The current object of research is the development of an online prediction model, which uses information from the respective individual processes production via sensors for process control and final quality control. This means that an online quality prediction is available in the future.

For a first insight, we apply an artificial production uncertainty to the reamed bores of four moving segments. As the prediction model mentioned above helps us to detect the uncertainty in the future, we choose an axis misalignment to simulate a production uncertainty. Qualifying an assembly process for a small number of parts is challenging, thus we neglect the assembly process (shrink fitting of the pistons) and measure the result. The distance of the centre lines of the two pistons is \(d=26\,\mathrm {mm} + \delta \), where \(\delta \) is the axis misalignment. The design point is \(d_{DP}=26\,\mathrm {mm}\). After assembly, the misalignment \(\delta \) of the bores measured to \(\delta = [-28,\, -5,\, 32,\, 85]\,\mathrm {\mu m}\) for the four produced moving segments. These values are all within the sliding bushes tolerances, according to the datasheet [45, 130]. From numerous previous experiments with the actuator itself [84] and during the usage inside the Active Air Spring (Sect. 3.​6), we know that assembly and disassembly, changing the membranes and mounting in the test bench are robust in respect to the experimental results.

In our experimental evaluation we want to investigate the influence from the production on the relevant usage parameters. To generate a viable data-set of the usage phase, we use a Hardware-in-the-Loop test rig, in which the hydraulic diaphragm actuator can be investigated without being mounted inside the Active Air Spring [45, 84]. For a more detailed insight on Hardware-in-the-Loop tests in general, we refer to Sect. 4.​3.​4. The test rig enables the characterisation of the actuator to calculate its efficiency, as well as the simulation of a road ride in a car equipped with the Active Air Spring. The efficiency is calculated by the input energy \(W_\mathrm {in}\) and the dissipated energy \(W_\mathrm {dis}\) asFor a detailed understanding of the characterisation we refer to [45]. To increase the wear-rate, we use an axial counter force to the moving segments of the actuator four times as high as in a typical application. To get a time series of usage data, we iterated between a characterisation cycle which allows us to calculate the desired parameters and a cycle with a road signal (national highway with a speed of 100 km/h) [128]. We perform a characterisation after each hour of a road signal. At the end of each test, we took an oil-sample and analysed it in the lab. The effort for the tests is high, due to the assembly process of the actuator and the runtime needed for results. Thus the number of experiments had to be limited.

Figure 6.37 shows the experimental results for the four specimen. Figure 6.37a shows the efficiency over the run-time. We can see a general trend for a decreasing efficiency over the run-time, which results from the wear of the sliding bushes. From \(-28\,\upmu \mathrm{m}\) to \(32\,\upmu \mathrm{m}\) the efficiency rises. From \(32\,\upmu \mathrm{m}\) to \(85\,\upmu \mathrm{m}\) it decreases. This leads to the assumption that the chain of tolerances ‘bores in the actuator body—sliding bushes—pistons’ has its optimum between \(-5\,\upmu \mathrm{m}\) and \(85\,\upmu \mathrm{m}\). Figure 6.37b shows the particle load in the hydraulic oil samples after the respective test was finished. In contrast to the reference sample of the oil three materials occur. Copper, molybdenum and tin are all used in the sliding bushes [130] and result from wear. The particle load correlates with the efficiency results. The \(32\,\upmu \mathrm{m}\) sample has the highest efficiency, thus the lowest friction and wear, which results in the lowest particle load in the oil. It should be mentioned, that these results cannot be transferred one-to-one to the real usage phase of the Active Air Spring, as the load was increased for a faster wear of the sliding bushes. The experiments show that there is an effect from the final production stage (reaming) on the usage of the Active Air Spring, or the hydraulic diaphragm actuator respectively. This effect is already measurable for production uncertainties that lie within the sliding bushes tolerances. However, the actuator could be assembled and was working as intended for all four different segments.

At the end of this section, we give an outline of a possible resilient process chain in the future: We use reaming models during the production to predict the quality of the bores. An empirical model correlates the bore quality to the outcome of the assembly. Another empirical model, gained by preliminary tests and real usage data, predicts the individual component’s usage parameters. Resulting user stories would read: ‘Based on the quality during production, the oil-changing interval for the individual actuator is determined.’: Referring to Sect. 6.3 a disturbance in the production phase is mastered in the usage phase. The minimal functional performance for the actuator life time is ensured by reacting to the production disturbance with the adaptation of the oil-changing interval. ‘Based on the quality during production—and the predicted efficiency, an inefficient actuator is combined with a very efficient hydraulic drive (which has natural production tolerances as well)’: The functional performance of the production chain to produce a certain percentage of good parts is ensured.

Within this Section we presented the concept of a resilient process chain, connecting the product life cycles production and usage. The investigations on the hydraulic actuator of the Active Air Spring showed that the production influences the usage. We further outlined how the process chain will look like in the future. Today, the lack of availability of data during both life cycles is still a challenge for real world applications. However, the number of products, delivering data during their usage phase and the digitalisation of the industry is increasing.

As mentioned by Folke et al. in [55, p. 1], a resilient system has the ability to “continually change and adapt yet remain within critical thresholds”. Folke et al. focused on the resilience of socio-ecological systems. Nevertheless, this concept, as already mentioned earlier in Sect. 6.3.1, can be transferred to the domain of mechanical engineering. While this concept is easily understood, the transfer to the domain of mechanical engineering is more challenging. We present a modular test rig, that is used to evaluate the applicability of the four functions (monitoring, responding, learning and anticipating) to derive resilient systems on the one hand and investigate selected resilience metrics experimentally on the other hand. We refer to Chaps. 1, 3 and Sect. 6.3.1 for a broader introduction to resilience of technical systems.

The focus of the considered resilience metrics that can be evaluated at the test rig, is set on the metrics, which correspond to an adaption of their behaviour over time. As mentioned at the beginning of this section, a resilient system has the ability to continuously adapt to external changes. These changes can be initiated by “exogenous drivers [...] and endogenous processes”, as noticed by Walker et al. in [173, p. 3]. The test rig in its modular and variable design is capable to host multiple experiments for a large variety of resilience metrics that consider both “exogenous drivers” and/or “endogenous processes”. It is designed to be able to derive basic implementation ideas and to present proof-of-concepts for metrics shown in Sect. 6.3.1. Therefore, we will present a brief overview of its capabilities and discuss the outcomes of the selected experiments.

The test rig with an exemplified piping is presented in Fig. 6.38. The purpose of this test rig is to supply water in each of the two acrylic water tanks which are depicted on the right side in Fig. 6.38. We are able to read out and control multiple sensors and actuators. As actuators there are up to three pumps and up to ten control valves. For instance, we can use a control valve as an exogenous driver as introduced in [173] to induce external disturbances on the water supply system within the test rig. We have the possibility to place multiple pressure sensors at different locations in the system. Additionally, we can measure the power demand of each pump, the water temperature at four locations and the opening of all electrically actuated control valves. This sensor data can be evaluated in real-time on the affiliated computer system. We implemented a Python-based control system to be able to use all available sensors and actuators for each dedicated experiment.

In addition to the design and implementation of the test rig, we derived a simulation model based on Modelica, cf. [61, 167], which represents the basic structure of the test rig. This simulation model was first validated by experiments at the test rig and then used to derive a database of simulation runs, where each run represents a dedicated disruption scenario. This database can then be used to derive a system, which can automatically reconfigure itself in case of external or internal malfunctions based on the pre-calculated system behaviour. This approach eliminates the need to conduct multiple runs of actuators within the real system to derive system models in case of failures, as this is done in other domains, see e.g. [27].

We conducted multiple experiments on this test rig, to verify the usage and applicability of predefined resilience metrics, which we will briefly present in the following. Moreover, we assessed the four functions (monitoring, responding learning and anticipating) of resilience, as introduced in Chap. 3 and Sect. 6.3.1, with the help of our test rig.

We conducted experiments with specific resilience metrics, as introduced in Sect. 6.3.1 and [7]. We refer to Sect. 6.3.3 for a more detailed view on the functional performance and to Sect. 6.3.5 for more details on the buffering capacity. Within this section, we will only focus on the practical usage of the resilience triangle, as shown by Bruneau et al. [30]. We introduced the resilience triangle in Sect. 6.3.1 and showed the general approach for calculating the metric value R. We adapt this approach, comparable to [135], by normalising the error ratio compared to the predefined minimum performance. Additionally we approximate the integral given in Sect. 6.3.1 with a sum over all measurements in time t with the time step length \(\Delta t\):This enables us to compare an undisturbed system response (\(r = 0\)) with a disturbed system response (\(0 < r \le 1\)). The system response after a sudden disturbance is shown in Fig. 6.39a, while Fig. 6.39b shows a correlated signal, as introduced in Sect. 6.3.2, which can be used besides the direct measurement of the water level, to derive rule-based learning and anticipation strategies. As a disturbance, we used a square-wave (0.02 Hz, offset 70 % of maximum command signal, amplitude 30 % of maximum command signal) as a reference signal for the valve displacement. This signal was transmitted to the valve using the commercial National Instruments software as well as custom-developed Python software.

The system is able to reach the setpoint value (\(f_{\text {pre}}\)), which is in our case equivalent to the minimum performance, while the disturbance is still active. If we evaluate Eq. (6.21) on the shown example we get \(r = 0.252\) if we consider \(t_{\text {pre}} = t_0\) and \(t_{\text {post}} = t_{1}\). The metric r can also be interpreted as the percentage of lost functional performance in the given time period. This loss is marked in grey in Fig. 6.39. Additionally, if we also consider the performance loss after the external failure period (hatched in Fig. 6.39a) we get \(r = 0.202\) (\(t_{\text {pre}} = t_0\), \(t_{\text {post}} = t_2)\). After stopping the disturbance signal (\(t > t_{1}\)) the considered controller tends to overshoot and produces a second performance loss before finally reaching the setpoint function. The experiment shows that an extension of the resilience triangle as given in Eq. (6.21) can be used to compare the resilience of different systems (e.g. different controllers) on common failures and common time horizons.

Next to the quantification of resilience, we show the usage of the four functions of resilience, i.e. monitoring, responding, learning and anticipating, and evaluate the applicability of this concept on the test rig system, cf. [115]. We start to evaluate this resilience approach, by using one proportional-integral-derivative (PID) controlled pump to set the height of water in one tank. As a disturbance, we use a control valve (marked with (1) in Fig. 6.38) to disrupt the system at a given point in time, after the steady-state is reached. We try to minimise negative deviations from the desired reference water height, while positive deviations in the water height are accepted. This allows to derive a system representation that is related to classic resilience examinations, as for instance shown by [30, 165].

Resilient systems should adapt to changes continuously, as proposed in [55, 173]. This goal is promising, but difficult to reach, as the resulting system must be adaptive and not only flexible, cf. Sect. 6.3.2.

The four functions of resilience are used to build a more resilient system that can be seen as a first step towards a resilient system that can master arbitrary disturbances. If the disturbance is severe, the traditional system design with a PID controller is unable to retain the predefined functionality. As the presented system has only little possibility to adapt its behaviour, we chose to build a system that can partially anticipate future disturbances and adapt its behaviour accordingly to reduce the future loss in functionality. Therefore, we implemented among other methods (for more details we refer to [115]), an exemplified learning model, which is based on an auto-regressive (AR) model, cf. [29, 132]. It models and predicts the behaviour of the complete system based on the current system response in the time-domain. This approach is also known as a method of system identification for dynamical systems as shown in [95]. To train the AR model, we split a time-series of stored values, which were measured at the test rig in a training (70 %) and a test set (30 %). The training set is then used to train the underlying AR model, while the test set serves to evaluate the performance of the trained AR model. Overall, there are five different training-test-splits within cross-validation, [13].

An exemplified system adaption is shown in Fig. 6.40. The system is adapting its behaviour based on the automatically detected deviation of the defined functionality. The system tries to recover over time by adding additional water in the reservoir when possible to avoid a severe decrease under the predefined reference performance value in the case of anticipated future losses. This approach enables the system to minimise its performance losses with a time-depending strategy that is based on the anticipated disturbances. It is important to mention that the algorithm does not use any measurement signal related to the control valve displacement that represents the “exogenous driver” as introduced in [173] within the conducted experiment. Instead it autonomously develops a model of estimated future disturbances.

The “resilient system” tries to minimise the negative deviation from the desired reference performance for all time steps within a detected disturbance in Fig. 6.40a. It learns and anticipates future losses that are caused by the changing valve opening, which simulates a severe disturbance. The reference system uses a classic design with only one PID controller, which is unable to minimise the losses over time. The “resilient system” shows a consecutive adaption capability, where comparable losses within an active disturbance only occur at the beginning. The reference system design results in a more than two times higher loss over the considered time period, as shown in Fig. 6.40b.

We conclude that the experiments conducted at the presented test rig show it is possible to transfer the considered resilience concepts and metrics of Sect. 6.3.1 and [7] to the mechanical engineering domain, and therefore to other technical systems demonstrating uncertainty as given in Sect. 3.​6. Furthermore, the shown algorithmic approach which is based on the four functions monitoring, responding, learning, and anticipating is suitable to derive more resilient technical system designs.