Reliability Engineering and System Safety

Aircraft maintenance is key for safe and efficient aircraft operations. While most studies propose cost-efficient maintenance strategies, the safety and efficiency of these strategies need to be quantified. This paper proposes a formal framework to assess the safety and efficiency of maintenance strategies by means of agent-based modelling, stochastically and dynamically coloured Petri nets, and Monte Carlo simulation. We model an end-to-end aircraft maintenance process, considering several maintenance stakeholders. We apply our framework for aircraft landing gear brakes, and use a Gamma process to model the degradation trends of the brakes. The numerical results show that applying data-driven strategies reduces the number of inspections by 36%, while maintaining the same level of safety as in the case of traditional time-based maintenance strategies. Furthermore, in order to discuss the possibility to substitute all inspections by sensor monitoring, an advanced data-driven strategy using prognostics is considered. Overall, our proposed framework is generic and can readily be applied to assess the safety and efficiency of the maintenance of other aircraft components and maintenance strategies.


Introduction
Aircraft maintenance is crucial for safe and efficient operations of aircraft, and thus, airlines spend almost 9.5% of their operational costs for maintenance [1,2].While striving for cost-efficient maintenance, safety remains a priority for aircraft operators.However, attaining safety and efficiency in aircraft maintenance is not straightforward, especially due to the complexity of the maintenance process.Some of the drivers of the maintenance complexity are the large number of stakeholders and the necessary cooperation between them, the inevitable human-machine interaction, the high costs with unscheduled maintenance, the dependency between systems, and the strict and specific maintenance regulations [3][4][5][6].
Given the criticality and complexity of the aircraft maintenance process, stakeholders often make use of conservative maintenance strategies.Here, a maintenance strategy implies a set of procedures and rules to follow in order to generate, plan, and execute maintenance tasks.In practice, many maintenance tasks are performed at fixed time intervals, i.e., following a time-based maintenance (TBM) strategy [7,8].Under TBM strategies, shorter time intervals of tasks increase the chance to detect severe degradation/failures. Thus, shorter time intervals contribute to safety.On the other hand, shorter time intervals require more frequent maintenance tasks, increasing the cost of maintenance.As such, many studies on TBM optimise the maintenance time intervals [9][10][11].Recently, condition-based maintenance (CBM) strategies have been proposed to further decrease the number of maintenance tasks while preserving safety [12,13].CBM strategies specify the moment of maintenance by utilising component/system condition data collected by sensors.In this line, many studies propose optimal CBM strategies to achieve a minimum maintenance cost [3, [12][13][14][15][16][17].
Yet, only a few studies consider the safety of maintenance, and even here the authors use indirect metrics such as high penalties for system failure [3, 14,15], system availability [16], and reliability constraints [17].Using such indirect metrics makes it hard to distinguish the safety aspects from the efficiency aspects, especially if the improved efficiency compensates for the reduced safety.A clear distinction between these metrics should be made so that the impact on safety and efficiency can be explicitly quantified.
The simulation of maintenance models provides direct quantification of the safety and efficiency of maintenance strategies.In particular, Monte Carlo simulation can capture the impact of uncertainties involved in maintenance, such as stochastic degradation of components, errors in inspection, etc.Thus, several studies perform Monte Carlo simulation for their maintenance models [18][19][20][21][22][23][24].
Methods generally used to model maintenance systems are Petri nets or agent-based modelling (ABM).Petri nets provide a formal visualisation for mathematical models of discrete event systems [25,26].This method has been used to model the maintenance of complex systems such as railway [18,19], bridges [20], wind turbines [21,22], and a fleet of aircraft [23].However, these models focus on events and processes, without considering the interplay between stakeholders.
Because aircraft maintenance involves multiple stakeholders, their interaction needs to be explicitly considered.ABM is another technique to represent maintenance systems, focusing on the interplay between stakeholders [27,28].ABM has been used to model interactive maintenance systems such as production lines [24], and repair service companies [29].While ABM is effective in formalising the interaction between multiple stakeholders, the comprehensibility of ABM can be further improved by graphical representations such as Petri nets.This synergy between Petri nets and ABM is used in other domains such as air traffic management [30,31], but has not been used in the above studies on maintenance.Thus, the synergy between Petri nets and ABM can be used to achieve a comprehensive multi-agent model of aircraft maintenance.
In this paper, an integrated framework is proposed to assess the safety and efficiency of various aircraft maintenance strategies.An ABM of an end-to-end aircraft maintenance process is developed, where the main maintenance stakeholders are considered.This ABM is formalized by means of stochastically and dynamically coloured Petri nets (SDCPNs).Based on the SDCPN formalisation of the ABM, Monte Carlo simulations are conducted for several maintenance strategies.This framework is illustrated for the maintenance of the aircraft landing gear brakes.Here, the degradation of the brakes is modelled by means of a Gamma process.As maintenance strategies for the brakes, a sensordriven CBM strategy, a prognostic-driven CBM strategy, and two TBM strategies are proposed.Safety and efficiency indicators for these strategies are evaluated using this framework.Overall, this framework is generic in that it supports a safety and efficiency analysis of various aircraft maintenance strategies.Most importantly, our framework supports the assessment of novel strategies, ahead of their implementation in practice.
The remainder of this paper is organised as follows.Section 2 describes the aircraft maintenance process and identifies the agents involved in this process.Section 3 formalises the agent models by means of SDCPNs.A brief explanation of SDCPNs is given first.Then, detailed SDCPN models for each agent are developed.Section 4 presents a case study on the maintenance of aircraft landing gear brakes.Finally, Section 5 provides conclusions and recommendations for future work.

Aircraft maintenance process -an agent-based modelling approach
We model the aircraft maintenance process by means of agents and interactions between these agents [27].An agent is defined as an independent entity that makes decisions based on a set of rules, interacts with other agents and has its own goals [27,28].We identify the agents considering the following four properties [28]: a) an agent is identifiable, having its own characteristics, decision-making rules, and physical or conceptual boundaries that the others can distinguish (Modularity), b) an agent can independently make decisions to change states and to take actions (Autonomy), c) an agent has states that determine its autonomy and that vary over time (Conditionality), and d) an agent interacts with other agents (Sociality).
Among multiple stakeholders involved in the aircraft maintenance process, we focus on the maintenance organisation and the aircraft operator.The maintenance organisation is a company that keeps the airworthiness of aircraft by means of maintenance, repair, and overhaul.The aircraft operator is a commercial airline which flies with the aircraft according to a flight schedule.These two stakeholders are represented by several agents.Considering the four properties of an agent mentioned above, we identify the following five key agents that are representative for a maintenance organisation and an aircraft operator: i) Aircraft (AC) ii) Task Generating team (TG) iii) Task Planing team (TP) iv) Mechanics team (ME) v) Flight Crews (CR) Figure 1 shows the agents involved in the aircraft maintenance process and the interactions between them.The boxes denote the agents and the arrows denote the interactions between these agents.i) Aircraft (AC) is a central agent in the maintenance process, given that the purpose of the aircraft maintenance is to ensure the airworthiness of the aircraft during its operation [1].Here, we assume that an aircraft operates in terms of flight cycles (see Figure 2).A flight cycle is defined as the time period between a departure and the subsequent departure.After the aircraft has departed from a gate at time , An aircraft consists of multiple components.These components degrade as the aircraft is in use.When the degradation of a component is significant, malfunctions or failures occur, which renders the aircraft un-airworthy.Airworthiness is sustained by maintenance tasks such as operational checks, inspections, lubrication, restoration, replacement, or discard [1,32].Maintenance Steering Group-3, which provides guidelines for aircraft maintenance, suggests four main types of tasks [32]: 1) Inspection, which is the task to find failures or degradation; 2) Lubrication, which is the task that maintains the inherent design capability; 3) Restoration, which is the task to return a system to a specific standard in order to avoid failure, and 4) Replacement, which is the task to discard a component currently in use and install a new one.Inspections, lubrication and restoration tasks are executed by mechanics, while operational checks are executed by flight crews.
Modern aircraft are equipped with sensors that monitor the condition of components [33,34].The data collected during condition monitoring is delivered to the task generating team.Based on the analysis of the sensor data, the task generating team may generate additional tasks.Sensor data analysis is an important part of CBM strategies.ii) Task generating team (TG) is an agent that specifies which maintenance tasks need to be performed and at which intervals of time.The agent TG takes into account maintenance regulations, manuals and guidelines provided by aircraft manufacturers, as well as feedback from flight crews, mechanics, and sensor data.Using such inputs, the agent TG generates a task by specifying the target component, the type of task, the interval of time at which this task must be executed, and the procedure required to execute the task.The process of task generation reflects the type of maintenance strategy adopted.Under a TBM strategy, the agent TG keeps generating the same tasks at fixed time intervals.Under a CBM strategy, the agent TG analyses the sensor data on the condition of a component and determines specific time intervals to maintain this component.For instance, the agent TG estimates the remaining useful life (RUL) of a component using sensor data, and generates a necessary task.In both cases, the intervals are specified in the form of flight cycles (FCs), flight hours (FHs), and/or calendar days (DYs).The generated tasks and corresponding maintenance intervals are further delivered to the task planning team.iii) Task planning team (TP) is an agent that receives generated tasks from the agent TG and plans these tasks in time.The agent TP receives as input a) the flight schedules, and b) the tasks with their associated intervals.Based on the flight schedules, the agent TP evaluates the availability of the aircraft for maintenance.Finally, the agent TP plans maintenance tasks during aircraft ground-time, while making sure that the specified intervals for task execution are not exceeded.We refer to this as a scheduled task.iv) Mechanics team (ME) is an agent that executes the scheduled tasks.Once a task is executed, the agent ME may decide whether additional tasks are necessary.If this is the case, the agent ME addresses it immediately by executing unscheduled tasks.If the maintenance strategy and the regulations allow, the agent ME can also postpone the execution of additional tasks and just report them to the agent TP or TG.v) Flight crew (CR) is an agent that operates the aircraft, following a flight schedule.The agent CR checks the condition of the aircraft components before and/or after a flight.We call this activity an operational check.If the agent CR observes a component/system failure, then the agent CR reports this to the agent TG.

Formalisation of the agent-based model of the aircraft maintenance process by means of Petri nets
In this section, we formalise the agent models of the aircraft maintenance described in Section 2. Stochastically and dynamically coloured Petri nets(SDCPNs) are used to graphically model the behaviour of the agents [25].In Section 3.1, we introduce the concept of SDCPNs.Then, five agents are modelled by means of SDCPNs in Section 3.2.Finally, in Section 3.3 we explain how to assess maintenance strategies by means of simulation of agent-based modelling (ABM).

Stochastically and dynamically coloured Petri nets
SDCPNs are extension of Petri nets that allow for the modelling of stochastic and dynamic systems [25].More precisely, SDCPNs are graphs that consist of two sets of nodes: places ( ) and transitions ( ), as well as a set of arcs ( ).These arcs connect the nodes.In addition, SDCPNs may have tokens in a place.Figure 3 shows a graphical representation of SDCPN elements.The places represent the possible states of a SDCPN.The location of a token defines the current state of the SDCPN.When additional information is needed to describe the current state, a colour is assigned to a token.The colour of a token can be a continuous or a discrete variable or a set of variables.The locations of the tokens are changed when a transitions fires, i.e., a transition updates the status of a SDCPN.We consider three types of transitions.The immediate transitions ( I ) fires immediately if there is at least one token in each input place connected by an incoming ordinary arc ( o ) and each enabling place connected by an enabling arc ( e ), and there is no token in each inhibitor place connected by an inhibitor arc ( i ).For instance, in Figure 4, the immediate transitions in (a), (c), and (e) fire immediately.The transition in (b) does not fire because one of its input places has no token.The transition in (d) does not fire because its enabling place has no token.The one in (f) does not fire because its inhibitor place has a token.The delay transitions ( D ) require the same conditions as discussed above, but they fire after a stochastic delay time, as shown in (g) of Figure 4.The guard transitions ( G ) fire only if the colours of the tokens in the input places and the enabling places satisfy its guard function ( ).For instance, in (h) and (i) of Figure 4, if token 1 renders the guard function false and token 2 renders it true, only the guard transition in (i) fires.When a transition fires, it removes one token from each of its input places, but not from the enabling places (see (a), (c), and (e)).Especially in the case of guard transitions, the token satisfying the guard function is removed (see (i)).Also, a new token is generated in each output place that is connected by an outgoing ordinary arc.The colour of the new token is determined by the firing function ( ) of the transition.
In order to make the agent models consistent and comprehensible, we consider the following analogy between an agent and a SDCPN.The possible states of the agents are represented by places.The actions and interactions between agents are represented by transitions and arcs.The places and the transitions needed to model a specific role of an agent are grouped together.This group is called a local Petri net (LPN).A LPN is constructed in such a way that the number of tokens residing in the LPN is not directly changed by another LPN [25].The interactions between LPNs are modelled by enabling arcs ( e ) or inhibitor arc ( i ), which do not change the number of tokens.We also model interactions between LPNs using interaction Petri nets (IPNs), which consist of places and transitions that do not belong to any LPN [25].
As an example, a SDCPN formalisation of two agents is given in Figure 5. Agent A has two states (places), 'P-1' and 'P-2', and it can take two actions (transitions) 'T-1' and 'T-2'.Agent B has two roles modelled by two LPNs.The guard transition 'T-1' is fired when the colour of the token in 'P-3' satisfies its guard function, i.e., agent A takes action 'T-1' if a certain condition of agent B is satisfied.By 'T-1', the state of agent A becomes 'P-2'.'T-3' cannot fire when its inhibitor place 'P-2' has a token, i.e., agent B cannot take action 'T-3' while agent A is in 'P-2'.The delay transition 'T-2' fires after a stochastic delay, returning agent A to 'P-1'.'T-2' also fires a token in 'P-5', and then 'T-4' immediately fires, which removes the token in 'P-5' and updates the colour of the token in 'P-4', i.e., agent B immediately takes action 'T-4' each time agent A takes action 'T-3'.Place 'P-5' does not belong to any LPN, and it is called an IPN.

Formalisation of the aircraft maintenance agents using SDCPNs
Based on the aforementioned analogy and definition of LPNs, in this section, we model the five agents introduced in Section 2 using SDCPNs.Table 1 lists the LPNs of each agent considered for the aircraft maintenance process.

i) Aircraft (AC)
The agent aircraft (AC) is operated by the agent flight crew (CR), following a flight schedule.When the agent CR triggers a departure, the aircraft is pushed back from the gate, i.e., off-block.This changes the state of the agent AC to in-flight.The in-flight state includes the taxi, take-off, cruise, and landing phases of the operation of an aircraft (see Figure 2).When the agent AC arrives at the gate, i.e., on-block, the state of the aircraft from this moment on is on-ground.
The LPN in Figure 6 models the operation of the agent AC.Two places 'In-flight' and 'On-ground' represent the two operational states of the aircraft.The transition 'Off-block' changes the state of the aircraft immediately from 'On-ground' to 'In-flight', when the place 'Trigger offblock' gets a token.This token is generated when the agent CR performs a departure.The transition 'Off-block' also fires a token to the place 'Use of component-ξ'.The colour of this token accounts for u(Δτ), which    is the amount of time that the component is used during the block-time Δτ.This token triggers the degradation of the component.Depending on the characteristics of the component, u(Δτ) can be represented in different formats.For example, the amount of use of an aircraft engine can be represented as block-time, i.e., = u ( ) .On the other hand, the number of flight cycles better represents the amount of use of aircraft landing gear brakes, i.e., = u ( ) 1.The transition 'On-block' works in a similar way as the transition 'Off-block'.When the agent CR completes a flight, the place 'Trigger on-block' gets a token.Then, the transition 'On-block' moves the token from the place 'In-flight' to the place 'Onground'.We model the degradation of a component as a stochastic process.Here, we assume that aircraft components degrade during inflight, while the degradation during on-ground is assumed to be negligible.Let X(t) be the degradation level of a component at time t.Modelling the degradation process {X(t)} should consider different degradation trends for different types of components.However, considering the nature of the degradation, we require the following properties of {X(t)}.Firstly, = X t ( ) 0 if the component is new and has no degradation.Secondly, X(t) is monotonically increasing unless maintenance is performed, and thus X(t) ≥ 0. This is based on the fact that degradation is never recovered spontaneously without maintenance.Thirdly, there is an unacceptable level of degradation, η.If X(t) > η, the component is regarded as an unsafe or failed.Finally, we consider the following increment of the degradation process {X(t)}: where Δt > 0, f X is the probability density function of the degradation increment, and Θ is the set of parameters of f X .
The LPN AC Component-ξ in Figure 7 models the condition of component-ξ changed by degradation, replacement, restoration and lubrication.The place 'Condition of component-ξ' has a token describing the degradation process of component-ξ, i.e., the token is coloured by C : where ξ is the identifier of the component, X ξ (t) is the degradation level of component-ξ at time t, and Θ ξ is a set of parameters describing the degradation process of component-ξ.The transition 'Degrade' fires when the operational state of the aircraft is 'In-flight' and the place 'Use of component-ξ' got a token from the transition 'Off-block' in Figure 6.The transition 'Degrade' updates X ξ (t) of the colour of the token in place 'Condition of component-ξ', following eq.( 1).The transition 'Degrade' also fires a token to the place 'Trigger sensor-ξ', which triggers sensor-ξ to start monitoring the component-ξ.
On the other hand, maintenance tasks such as replacement, restoration, and lubrication change the degradation level of the component X ξ (t) and/or the trend of the degradation Θ ξ .After a replacement, X ξ (t) is updated to be the degradation level of the new component, X new .If the new component is faultless, then = X 0 new .If the new component already has a level of degradation for some reason, X new can be modelled as a constant (0 ≤ X new < 1) or a random variable with a certain distribution.Restoration tasks update X ξ (t) to a specific standard, X , res which can be assumed to be a constant or a random variable.We consider lubrication as a task that changes the rate of the degradation process.Thus, lubrication updates Θ ξ , the parameters of the probability density function in eq.(1).
All these tasks are executed by the agent ME, following a maintenance schedule given by the agent TP.In Figure 7, the transitions, 'Replacement', 'Restoration', and 'Lubrication' fire when there is a token in the places 'Trigger Replacement', 'Trigger Restoration', and 'Trigger Lubrication', respectively.These places get a token when the agent ME executes the corresponding maintenance task on componentξ.These three transitions update the colour C of the token in the place 'Condition of component-ξ'.
The LPN AC Sensor-ξ in Figure 8 models the sensor-ξ that monitors the condition of component-ξ.When the sensor is working, the place 'Sensor-ξ working' has a token coloured by S : where X t ˜( ) is the degradation level of component-ξ monitored by sensor-ξ.The transition 'Monitor' is triggered by the token in the place 'Trigger sensor-ξ'.Assuming real-time monitoring, the place 'Trigger sensor-ξ' gets a token every time the transition 'Degrade' fires (see Figure 7).The token in the place 'Condition of component-ξ' is needed for the transition 'Monitor'.The transition 'Monitor' updates the colour S of the token in the place 'Sensor-ξ working'.Specifically, X t ˜( ) is updated as follows: where Exp( ¯) S S is the time spent by the sensor to collect the data, and ϵ S is the measurement error of the sensor.The transition 'Monitor' also fires a token to the place 'Trigger Estimate RUL', which enables the agent TG to estimate the RUL of component-ξ.
The LPN model of alert system is given in Figure 9.When the alert system is activated, a token is located in the place 'Alert activated'.When X t ˜( ) of the token in the place 'Sensor-ξ working' satisfies the guard function , Alert the transition 'Alert' fires a token in the place 'Feedback from AC'.The transition 'Alert' also fires a token from the place 'Alert activated' to the place 'Alert deactivated', preventing triggering multiple feedback.The guard function Alert of the transition 'Alert' is defined based on the maintenance strategy.For example, the function Alert A is specified for a given strategy, and defines the moment when a new task is generated to prevent degradation.
The transition 'Activate' is fired if its guard function Activate is satisfied.When the place 'Alert activated' has a token, the alert system checks the sensor data.In this case, the transition 'Remove unnecessary tasks' may remove some task tokens that satisfies its guard function, from the place 'Task to execute'.Removal of maintenance tasks is only applicable if the maintenance strategy allows it.

ii) Task Generating Team (TG)
The agent Task Generating team (TG) determines the tasks to be performed based on the maintenance strategy and the feedback from other agents.The procedures to consider the feedback are specific to the maintenance strategy.In particular, the maintenance strategy defines the conditions under which a specific type of task needs to be executed, the specific component and the interval to perform this task.In SDCPN formalisation, a task is represented as a token coloured by , T which is defined as: T sch exe 0 (5 where ξ is the target component of the task, ω is the type of the task and Φ ω is a set of parameters describing the task, d is the interval of the task, t sch and t exe are scheduled time and the actual execution time of the task, and i 0 is the index of the first flight cycle after task execution.The agent TG specifies ξ, ω, Φ ω , and d, while the other variables will be specified by the agent TP and the agent ME.The LPN in Figure 10 models how the agent TG generates tasks.A token in the place 'Generating tasks' represents that the agent TG is working, and it is required for all transitions in this LPN.The three transitions generate tasks based on three sources of feedback, i.e., data analysis from the agent TG, alert from the agent AC, and complaints from the agent CR (see Figures 9,11,and 14).Firing functions of these transitions determine ξ, ω, Φ ω , and d of the task token coloured by T of eq. ( 5).This new task token is put on the place 'Task to plan' and delivered to the agent TP.
Under CBM strategies, the agent TG makes use of metrics such as RUL to determine intervals of tasks.We consider RUL as the remaining time until the moment when the degradation level of component-ξ reaches a predefined level η [35].Thus, = + RUL t X t t max{ | ( ) } where t is the current time and ) is the degradation level after time t′.We estimate + X t t ( ) using prognostics algorithms run on the condition data set X t { ˜( )}. Figure 11 models the prognostics developed by the agent TG.The prognostics are triggered by a token in the place 'Trigger Estimate RUL', which is generated by the transition 'Monitor' of the agent AC (see Figure 8).Thus, it is assumed that prognostics are immediately updated each time new data is available.The transition 'Estimate RUL of component-ξ' requires a token coloured by S on the place 'Sensor-ξ working'.A token in the place 'Prognostics' is coloured by P defined as: The transition 'Estimate RUL of component-ξ' updates RUL and X t { ˜( )} based on the given prognostics algorithm.If the estimated RUL meets a predefined condition, feedback is generated by the guard transition 'Alert TG based on RUL of component-ξ'.The new token generated in the place 'Feedback from TG' enables the agent TG to generate a new task (see Figure 10).

iii) Task Planning Team (TP)
The agent task planning team (TP) plans the time to execute the tasks.The agent TP takes the input of the agent TG as the time intervals at which tasks must be executed.Another input for the agent TP is the aircraft flight schedule that specifies the ground-time when tasks can be executed.Then, the agent TP finds the latest, feasible time for the tasks to be executed such that the task execution intervals are not exceeded.Formally, this scheduled time t sch is given to the task token coloured by T in eq. ( 5).
The LPN of the agent TP is shown in Figure 12.A token in the place 'TP working' shows that the agent TP is ready to plan a task.The transition 'Plan task' requires a token in the place 'CR waiting' of the agent flight crew.This token has a colour representing flight schedules, F : where I is a set of index of flights cycles, and { } and {Δτ i } i ∈ I are the set of departure times and the block times of the flight cycles.When a task token coloured by T is given in the place 'Task to plan', the transition 'Plan task' fires a task token to the place 'Task to execute'.The firing function of this transition determines t sch the colour T based on the given task planning algorithm.As a result, the place 'Task to execute' gets a task token with the execution time t sch .

iv) Mechanics Team (ME)
The agent mechanics team (ME) executes the tasks given from the agent TP.When t ≥ t sch , the agent ME prepares to execute the task.The agent ME executes a given task when the aircraft is in the state 'Onground'.Depending on the type of the task, the agent ME inspects, replaces, restores, or lubricates a target component.Especially after the inspection, the agent ME decides whether there an additional unscheduled task is needed.The decision is based the observed degradation level X t ^( ) and the given maintenance strategy.Such an un- scheduled task is executed right away.After completing the task, the agent ME reports to the agent TP.
Figure 13 shows the LPN of the agent ME.A token coloured by T is used in this LPN, representing the task allocated to the agent ME.The token is placed in the place 'Waiting' when there is an available agent ME to execute the given task.This LPN is triggered by the new task token T in the place 'Task to execute', which is generated from the LPN of the agent TG in where ϵ ins is the error of the inspection, and Exp( ¯) ins ins is time spent to inspect the component or the delay of the transition 'Inspect'.Then, instead of firing a token to the place 'Completing', the delay   transition 'Inspect' fires a token in the place 'Deciding' which is an intermediate place.Then, the guard transitions 'Complete' and 'Generate unscheduled task' check X t ^( ). Figure 14 shows the LPN of the agent CR.This LPN uses a flight schedule token coloured by F in eq. ( 7).Initially, the token is placed in the place 'CR Waiting', meaning that there is an available flight crew. .A token is fired to the place 'Trigger on-block' by the guard transition 'Arrive', triggering the transition 'On-block' of the LPN AC Operation in Figure 6.The transition 'Arrive' also fires a token to 'CR Waiting'.
The agent CR may conduct operational checks for a certain aircraft components depending on the maintenance strategy.As in the case of the inspection, a guard transition 'Check' and a delay transition 'Check' is used for the operational check of the the component condition.The degradation level of the component observed by the agent CR, X ^CR is updated as below: where ¯) CR CR is the time spent for the operational check, and ϵ CR is the error in the operational check.The result is reported to the agent TG, when the delay transition 'Check' fires a token to the place 'Feedback'.

Assessment of maintenance strategies by means of simulation of ABM
With the formalisation of the ABM in Section 3.2, we assess safety and efficiency indicators of maintenance strategies of interest.
As a first step, we implement the maintenance strategy of interest to the ABM by adjusting the transitions, the initial location of the tokens, and the LPNs.For the delay transitions, the parameters are estimated based on, for instance, maintenance manuals specific to the given maintenance strategy, historical data on the execution of the task, etc.For the guard transitions, the guard functions are also specified based on the given maintenance strategy.For example, for the agent AC, the guard function Alert of the transition 'Alert', and its parameter η A are specified based on the given maintenance strategy (see Figure 9).Similarly, the firing functions of the transitions of the agent TG also need to be specified based on the maintenance strategy (see Figure 10).For instance, if the maintenance strategy requires to replace the component when an alert is triggered by the agent AC, the firing function of the transition 'Generate task using feedback from AC' is set to generate a replacement task token.(see Figure 10).
Next, we mark the location of the initial tokens in the LPNs in Section 3 (see Figures from 7 to 14).For the coloured tokens, the initial colours are set as follows.The initial degradation level X ξ (0) of the component-ξ is represented in the colour C of a token in the place 'Condition of component-ξ' (see Figure 7).The flight schedule I, { } i i I dep and {Δτ i } i ∈ I is represented the colour F of a token in the place 'CR Waiting' (see Figure 14).
Lastly, we can add and/or remove additional LPNs, according to the maintenance strategy.For instance, when we consider a system of multiple aircraft components, we add the LPN in Figure 7 to the agent AC.When the given maintenance strategy does not require part of the agents, we remove the unnecessary LPNs.For example, if prognostics are not used under the given maintenance strategy, then we remove the LPN in Figure 11 from the agent TG.
Following the adjustment of the ABM according to the given maintenance strategy, we define safety and efficiency indicators to assess this maintenance strategy.Let E be a safety/operations event that we analyse using Monte Carlo simulation.For example, the release of un-airworthy aircraft is considered as a safety event.Similarly, the execution of maintenance task is seen as an operations event.We propose generic safety/efficiency indicators to evaluate the occurrence of the event E as follows.Let T E (j) be the j th occurrence time of event E. Let N E (t) be the number of occurrences of event E by time t > 0.Then, P[T E (j) ≤ t], and

N t [ ( )]
E represent the probability to have the event E before time t and the expected number of event E by time t, respectively.These two indicators are estimated by conducting Monte Carlo simulations of the ABM.

Assessment of maintenance strategies for aircraft landing gear brakes
In this section, we illustrate the framework proposed in Section 2 and Section 3 for the maintenance of aircraft landing gear brakes.In Section 4.1, we describe the maintenance of aircraft landing gear brakes.In Section 4.2, we introduce a degradation model of the brakes.In Section 4.3, we describe two TBM strategies derived from practice and two CBM strategies that we propose.In Section 4.4, the safety and efficiency indicators are introduced.In Section 4.5, the estimation of the model parameters is discussed.In Section 4.6, we present the simulation results.Finally, we discuss the obtained results in Section 4.7.

Problem description
We consider the maintenance of landing gear brakes of a wide-body aircraft.The aircraft is equipped with 8 breaks equally distributed on both sides (see Figure 15).Over time, due to wear, the thickness of a brake disc reduces [7].When the thickness of a brake disc is thinner than a threshold, the brake is replaced, to ensure aircraft airworthiness.
Currently, the maintenance of the landing gear brakes is performed under TBM strategies [7][8][9].Specifically, two maintenance tasks are used: brake inspections at fixed time intervals and replacements.If, upon an inspection, a certain amount of degradation is observed, a brake replacement is scheduled.In general, the interval of inspection is much shorter than the expected life cycle of the brakes, for safety reasons.As shown in [9], under such a fixed-interval inspection strategy, short intervals reduce the probability to have undesired incidents, but the increased number of inspections leads to additional costs with the maintenance.Also, many of these inspections are redundant as they do not lead to further actions such as replacement.On the other hand, in spite of the frequent brake inspections, the degradation of some brakes can still exceed the desirable threshold.In this paper, we consider two TBM strategies, with medium and high frequency of inspections.
For a better trade-off between frequent inspections (high costs) and unexpected brake degradation levels, monitoring the condition of the brakes using sensors is considered promising [13,33,34,36].We propose two CBM strategies to determine the moment of inspections and replacements.We compare these CBM strategies against the medium and high frequency TBM strategies, with respect to safety and efficiency indicators.
For our assessment, we simulate the maintenance process of a widebody aircraft that is operated according to a flight schedule for a period of 10 years.The flight schedule has n FC flight cycles, where flight cycle i is defined by the moments of departure ( i dep ) and arrival( i arr ), i ∈ {1, ⋅⋅⋅, n FC } (see Figure 2).We assume that the condition of the aircraft brakes degrades over time according to a stochastic process.We also assume that the maintenance tasks for brakes can be executed in all destination airports.As a safety indicator, we define a brake-related safety incident, and evaluate its frequency.As efficiency indicators, we assess the number of required tasks, associated with these maintenance strategies, and the remained thickness of the brake discs at the moment of replacement.

Degradation model of the aircraft landing gear brakes
We model the continuous degradation of an aircraft brake using a Gamma process [9,15,37].During a flight cycle (see Figure 2), the brakes are used: after take-off to the wheels before retraction, during landing to decelerate, and during taxi to stop or to make turns.These phases are shorter compared to the entire block-time.Thus, we assume that the brakes are used the same amount of time in each flight cycle, i.e., = u ( ) in eq. ( 1).Let the degradation level of a brake at the beginning and the end of the block-time of flight cycle i be X ( ) respectively.Then, we model the brake degradation increment during block-time i as follows (i.e., eq.(1) becomes): where a > 0 is the shape parameter and b > 0 is the scale parameter of the Gamma distribution.We also assume that the degradation is negligible during ground-time.
We consider two maintenance tasks: inspection and replacement of the brakes.Following an inspection during the ground-time of flight cycle i, the degradation level remains the same, i.e., which indicates that the brake is new and has no degradation at the beginning of flight cycle + i 1.For simplicity, when no brake replacement occurs during flight cycle i, we denote the degradation level at the end of the block-time i as: Then, using this in eq. ( 10), . Thus, during the time between flight cycles i 1 and i 2 , (i 2 > i 1 ), given that there is no brake replacement, the degradation X i follows a Gamma process with the linear shape function a i i ( )  .Lastly, we consider a predefined degradation threshold η.Once X i ≥ η, the brake is assumed to be inoperative.Without loss of generality, under a proper scaling, we consider = 1.
Figure 16 shows an example of the degradation process {X i } following eq.( 12 dep .In the flight cycles i ≥ 98, X i ≥ η, which implies that the aircraft is released with the brake degraded more than the acceptable level. We construct the LPNs of the 8 brakes in the agent AC as shown in Figure 17.Each LPN AC Brake-ξ shows the LPN of brake-ξ, where = {1, 2, , 8} (see also Figure 15).Each LPN is made by taking only two necessary transitions for degradation and replacement of brakes from the LPN of a general aircraft component in Figure 7.Each LPN uses tokens whose colour is given by the parameters of the degradation process.For example, the token in the LPN AC Brake-ξ has colour X a b ( , , , ), i where X i is the degradation level of the brake-ξ at the end of the flight cycle i, a ξ and b ξ are the shape and the scale parameters of the degradation process of brake-ξ, defined in eq. ( 12).Each transition 'Replacement brake-ξ' has the corresponding input places 'Trigger replacement brake-ξ'.Each transition 'Degrade brake-ξ' has its own input place 'Use of brake-ξ', but has a common enabling place 'In-flight' because the operational state of the aircraft applies to all brakes.

Aircraft brake maintenance strategies
We consider four aircraft brake maintenance strategies, which we refer to as TBM-CI, TBM-FI, CBM-SI, and CBM-SR.TBM-CI is a timebased maintenance strategy that uses fixed time intervals (flight cycles) at which visual inspections are conducted by mechanics.Such timebased maintenance strategies are often used in practice.In this paper, we consider TBM-CI to be a baseline strategy.The TBM-FI strategy is a Under the TBM-CI strategy, the agents are modelled as follows.The agent TP generates a task token for scheduled inspections of the eight brakes in every d ins TBM-CI .The agent ME (see Figure 18) executes inspections and replacements of the eight brakes.For simplicity, Figure 18 shows two tasks: 'Replacing brake-ξ' and 'Inspecting brake-ξ', which are applied in the same way for all eight brakes, ξ ∈ {1, 2, ⋅⋅⋅, 8}.After an inspection, the agent ME has three possible actions, based on the inspected condition of the brake X ^(see For the agent AC, because TBM-CI does not use sensor data, we do not have tokens in LPNs AC Sensor-ξ (Figure 8) and AC Alert System (Figure 9).For the agent TP and CR, the agent model in Section 3 is used.
The TBM-FI strategy is similar to TBM-CI, but now we consider twice as many inspections, i.e., = d 25 ins TBM-FI

FCs.
The CBM-SI strategy utilises X ˜, i the sensor data on the condition of the brakes, to decide the moment of brake inspections.As soon as .We consider this strategy as an alternative to the TBM-CI strategy, where potentially to frequent, unnecessary inspections required under TBM-CI are now discarded under CBM-CI.In particular, we are interested in discarding early inspections, when the degradation level of the brake is low.
Under the CBM-SI strategy, agent models of AC and TG are modified, in comparison to the TBM-CI strategy, as follows.The agent AC has additional LPNs, representing the sensors and the alert system.For the 8 brakes, We have 8 sensor LPNs as shown in Figure 8.In each LPN of sensor-ξ, transition 'Monitor' has its own input place 'Trigger sensorξ' and enabling place 'Condition of brake-ξ'.Also the LPN Alert System (see Figure 19) is adjusted from the general LPN Alert System (see Figure 9) for the 8 brakes.The transitions 'Alert' and 'Activate' have 8 enabling places for 8 sensors, i.e., 'Sensor-ξ working' for ξ ∈ {1, 2, ⋅⋅⋅, 8}.The transition 'Alert' is fired if ∃ξ ∈ {1, 2, ⋅⋅⋅, 8} such that X t ˜( ) Then, the agent TG generates periodic inspection tasks using the token in the place 'Feedback from AC' (see Figure 10).
Lastly, the CBM-SR strategy schedules brake replacements based on a data-driven estimation of the RUL (prognostic) of the brakes.We define RUL as the predicted number of remaining flight cycles until the degradation level of brake-ξ becomes unacceptable, X .Under CBM-SR, the sensors monitor the condition of the brakes in every flight cycles and the data on the condition of the brakes, X { ˜}, i is stored.Using a linear regression to analyse the sensor data, we estimate the degradation level of the brakes in the upcoming flight cycles.Let + X ˜i j ( ) be the degradation level after j flight cycles when i is the latest completed flight cycle at the moment of RUL estimation.In other words, we  have data for X X { ˜, , ˜} i 0 and we estimate the degradation at flight cycle + i j.We consider the following linear regression model, where we estimate the coefficients 0 and 1 by the ordinary least squares method.Then we have that: Using this approach, we estimate RUL every flight cycles for eight brakes.Now, if RUL 30 FCs, then brake-ξ is replaced after RUL FCs.The agent TG under CBM-SR is specified by adding the LPN Prognostics in Figure 11 and giving a token in the place 'Prognostics'.The agent TG receives the data X ˜i from the token in the enabling places 'Sensor-ξ working'.The transition 'Estimate RUL of component-ξ' stores the data set X { ˜} i and estimates RUL , updating the token P in the place 'Prognostics'.The guard transition 'Report RUL of component-ξ' fires a token to the place 'Feedback from TG', if RUL 30 FCs.Then, the agent TG generates a task token to replace brake-ξ, using the LPN Task Generation (see Figure 10).

Safety and efficiency indicators of maintenance strategies for aircraft landing gear brakes
In this section we define indicators that show the safety and efficiency of the maintenance strategies for aircraft landing gear brakes.To assess the safety of the maintenance strategy, we define a safety incident, which is an undesirable event considering the safety of the aircraft operation.The aircraft is designed to be safe even with some inoperative brakes whose degradation level is greater than threshold, i.e., X(t) ≥ η.The master minimum equipment list (MMEL) specifies the minimum number of operable brakes to dispatch an aircraft safely.For example, in the case of Airbus A350 and Boeing B787, MMEL specifies that the aircraft can be dispatched if it has more than three operable brakes on each side [5,6].In line with the MMEL, if we dispatch an aircraft with more than one inoperative brakes on at lest one side, we regard it as a brake-related safety incident.A formal definition is as follows: Definition 1 (brake-related safety incident).We say that there is a brakerelated safety incident at flight cycle i, if the incident indicator function = i ( ) 1, where i ( ) is defined as follows: where = L {1, 2, 5, 6} and = R {3, 4, 7, 8} are the of position indices of the brakes on the left and right side of the aircraft, respectively.And, (•) is an indicator function which is 1 if the given logical expression is true and 0 else.
Based on the brake-related safety incident, we define two safety assessment indicators, T(j) and N(t) as below: Definition 2. We say that if = i ( ) 1 for flight cycle i, the brake-related safety incident occurs at the arrival time arr .T(j) is the time when the j th brake-related safety incident occurs, which is defined as follows: with = T (0) 0.
Definition 3. Let N(t) denote the number of brake incidents that occur by time t > 0, which is defined as follows: Following Definitions 2 and 3, we denote by T( 1) the time the first brake incident occurs and by N(t H ) the total number of brake incidents occurred by the time horizon of simulation t H > 0. These two indicators are used to understand the safety of brake maintenance strategies.For instance, P[T(1) ≤ t], the probability to have an incident by time t, is used to understand how risk evolves over time under a particular maintenance strategy.
To assess the efficiency of the maintenance strategies, we consider i) the number of maintenance tasks executed in a period t H , and ii) the degradation level of brakes at the moment of replacement.Definition 4. We denote by M(t H ) s the total number of maintenance tasks, both inspections and replacements, that occur under a maintenance strategy-s in a period of time t h .Definition 5. We denote by X irep the degradation level of brakes at the moment of replacement, given that the brake is replaced after flight cycle i rep In general, as long as safety is maintained, a low number of maintenance tasks is preferred.This is because a large number of maintenance tasks generally implies higher maintenance cost.The maintenance strategies given in Section 4.3 use two types of maintenance tasks, i.e., inspection, and replacement.Inspection is generally less expensive task compared to replacement.There are two types of replacement tasks, i.e., scheduled replacement and unscheduled replacement.Unscheduled replacements are not desired because they may cause unexpected ground-time with a high chance, especially when maintenance resources such as spare components, mechanics, or hangars are not available [3].
Also, if > X , irep the replacement is performed after the brake is degraded beyond the threshold η.On the other hand, < X irep implies that the operable brake is replaced before the threshold η.This may be a waste of resources in the sense that we replace the brake that can be used more.Considering both safety and efficiency of the maintenance, it is desired to have X irep as large as possible, but not exceeding η.

Estimation of the model parameters
First, we estimate the parameters of the brake degradation model in Section 4.2.The parameters a and b of the Gamma process in eq. ( 12) are estimated based on the sensor data recording the thickness of the brake discs.This data is collected from a fleet of wide-body aircraft, where aircraft have been in operation for a period of 6 months up to 3 years.
The disc thickness data is scaled such that it indicates the degradation level X i of a brake following eq.( 12).The thickness of a brand Figure 20 shows the degradation level data obtained from brake-1, Each line indicates the recorded degradation data between two consecutive replacements.The x-axis shows the number of the flight cycles since the brake is replaced.Some data sets start from the nonzero degradation level because some degraded brakes are initially installed in practice to avoid the case when multiple brakes become inoperative at the same time.
We first estimate the parameters a and b of the Gamma process in eq. ( 12) from the recorded degradation level data sets X { ˜}, i using the maximum likelihood estimation (MLE) method as follows.Let Δi be the number of flight cycles between two successive data points X ˜i and + X ˜i i .Thus, the increment of the brake degradation level between flight cycle i and + i i follows a Gamma distribution: We now apply the MLE method to estimate the parameters a and b of the gamma distribution in eq. ( 16) [38][39][40].
Table 2 shows the estimated parameters a ^and b ^for each of the eight brakes.The difference in the parameters among brake positions can be explained by, for instance, the layout of the airport which requires the aircraft to perform a different number of left and right turns while taxiing at an airport.
Next, we conduct a Kolmogorov-Smirnov (KS) test to verify the following null hypothesis: H 0 : {X i } follows a gamma process with shape parameter a ^and scale parameter b ^.Since our Gamma process data points are not equally spaced, i.e., each data + X X ˜ĩ i i follows a different Gamma distribution, we cannot directly apply KS test.To address this, based on the original data X { ˜}, we resample an equally spaced Gamma process data X { ˜} i i I such that I′ is an equally spaced flight index set [41].The data X ˜i is re-sampled using the interpolation between two consecutive available data points < X X ˜ĩ i l r and by constructing a Gamma bridge as follows [41]: where l r is a Beta distribution with two shape parameters a i i ( ) l and a i i ( ) r .Figure 21 shows a part of the recorded, original break data X { ˜} i which has unequal intervals Δi, and the equally spaced data X { ˜} i that is re-sampled from the original data X { ˜}, i as shown in eq. ( 17).Because this approach is based on sampling from a Beta distribution, we repeat the KS test with different realisations of the resampling and the average rejection rate [41].Table 2 shows the rejection rate for 10.000 KS tests with a significance level of 0.05.
Apart from the brake degradation model, we also assume that the inspection error ϵ ins in eq. ( 8), follows a normal distribution, i.e., (0, ) ins ins 2 .Here, = × 10 ins 5 is assumed based on the minimum scale of the degradation measurement during visual inspection.
Lastly, we estimate the sensor accuracy ϵ S in eq. ( 4) by comparing the sensor data and the detailed brake inspection reports conducted by the manufacturer of the brakes.Assuming that the detailed inspection is accurate enough, we estimate = X X ˜, i i S the error between the sensor readings and the detailed inspection results, which has a mean and standard deviation of 0.000327 and 0.0204, respectively.We assume that ϵ S follows a non-biased Gaussian distribution N(0, 0.0204 2 ).We further test our assumption by means of a KS test with the null hypothesis: H 0 : (0, 0. 0204 ) S 2 .The p-value of the KS test is 0.4493, and, thus, the null hypothesis is not rejected.

Monte Carlo simulation results
We conduct Monte Carlo simulations to evaluate the four maintenance strategies by integrating the brake degradation model (Section 4.2), the agent models following several maintenance strategies (Section 4.3), the safety and efficiency indicators (Section 4.4), and the estimated parameter (Section 4.5).
We simulate the maintenance of the landing gear brakes for a period of 10 years, i.e., = t 10 H years.We generate flight cycles based on an actual flight schedule of a aircraft operated during 2015-2019 by an European airline.We initialise the degradation levels of the brakes with the observed degradation level at a random moment in the recorded data sets.This is due to the fact that, in practice, not all the eight brakes are installed as new at the same time, in order to avoid the case when all the eight brakes reach a maximum degradation level at the same   Firstly, we consider the number of brake-related safety incidents by t H , i.e., N(t H ) defined in eq. ( 15).Table 3 shows N t [ ( )], H the expected number of incidents by t H , under the four maintenance strategies and the 95% confidence intervals of N t [ ( )] H .Under the baseline maintenance strategy, TBM-CI, 0.8248 incidents are expected to occur by t H .When we inspect the brakes twice often, under TBM-FI, the expected number of incidents decreases to 0.0470.Thus, this significantly improves the safety indicators at the cost of double the number of inspections.Under CBM-SI, if we start the periodic inspections after the sensor indicates 75% wear of the brakes, then the expected number of incident are comparable to the case TBM-CI.Finally, under CBM-SR, if we replace the brakes based on the RUL estimation, it is expected to have 0.0386 incidents.This indicator is significantly smaller than in the case of TBM-CI, and similar to the case of TBM-FI.
Another safety indicator is T(1), the time when the first brake-related safety incident occurs (see eq. ( 14)).Table 4 shows the probability to have at least one brake-related safety incident in 10 years of aircraft operation, i.e., P[T(1) ≤ t H ]. Under TBM-CI, P[T(1) ≤ t H ] is 0.1169.Under TBM-FI and CBM-SR, P[T(1) ≤ t H ] is 0.0154 and 0.0148, respectively, which are significantly smaller than the case TBM-CI.Under CBM-SI, P[T(1) ≤ t H ] is slightly higher than TBM-CI.Thus, compared to TBM-CI, Table 3 shows that the use of TBM-FI or CBM-SR significantly improves the safety indicators of the brake maintenance in a similar while CBM-SI does not improve the safety indicators significanly.
Figure 22 shows the empirical cumulative distribution function (cdf) of T(1), i.e., P[T(1) ≤ t].The cdf of T(1) significantly increases, approximately every 3 years.This shows that the brake-related incidents are concentrated in a short interval of time.This is because the degradation of brakes reaches η after 1250-1400 FCs, which is approximately the number of flight cycles made in 3 years.By comparing the different maintenance strategies, we observe that the jumps of P [T(1) ≤ t] occurs at similar t.Thus, Figure 22, shows that the moment of brake-related safety incident is less affected by the maintenance strategies.
For the analysis of efficiency, Table 5 shows the expected number of tasks in = t 10 H years under the four maintenance strategies.Here, we consider three types of tasks: inspections, scheduled replacements, and unscheduled replacements.Under TBM-CI, 632.0 inspections, 18.5 scheduled replacements, and 4.8 unscheduled replacements are expected to be carried out in 10 years of aircraft operation.TBM-FI uses twice as much inspections, 1272.0 but needs almost no unscheduled replacements.In this case, additional costs with inspections are expected, while the costs with the unscheduled replacements are expected to decrease.Thus, TBM-FI is expected to be more cost efficient compared to TBM-CI if 640 additional inspections are cheaper than 4.8 additional unscheduled replacements.Because CBM-SI starts the routine inspections later, it requires only 402.8 inspections, i.e. with 33% less inspections than TBM-CI.The amount of scheduled and unscheduled replacements remain the same as in the case of TBM-CI.Thus, CBM-SI is expected to be more cost efficient than TBM-CI since it requires less inspections.Lastly, CBM-SR requires the least amount of tasks since this strategy does not rely on inspections and unscheduled replacements.The number of scheduled replacements under CBM-SR is almost the same as the total amount of replacements under TBM-CI.This is because we need the same number of replacements for a given period of t H , as we are using the same brakes for the same flight schedule.
We also analyse the degradation level of the brakes at the moment of replacement, i.e., X irep .irep under TBM-FI and CBM-SR.This is in line with the safety indicators of TBM-CI and CBM-SI in Table 3. Considering the 95% confidence intervals, X [ ] irep of CBM-SR is higher than that of TBM-FI.This implies that the brakes are used efficiently without exceeding the threshold η under CBM-SR.

Sensitivity analysis
We next analyse the sensitivity of the safety and efficiency indicators with respect to the key parameters of each maintenance strategy.
Again, we consider the indicators of TBM-CI as a baseline.In the case of TBM-FI, we consider d , FCs is identical to TBM-CI.In the case of CBM-SI, we vary , ins CBM-SI i.e., the routine inspection is started at different degradation level.Lastly, in the case of CBM-SR, we    consider ϵ S , the sensor error as a key parameter since the sensitivity associated with the sensor accuracy is one of the major concerns in the CBM strategies.FCs.As shown in Figure 23a, the expected number of incidents increases as the interval of inspection increases because of the higher chance of missing a critical degradation level.Figure 23b shows the decrease of the total number of tasks.This is mainly due to a gradual decrease of inspections as d ins TBM-FI increases.
In the cause of CBM-SI, Figure 24 shows that the number of tasks decreases while the number of incident remains in the same level when the routine inspections are triggered later, i.e., higher ins CBM-SI .In particular, in Figure 24a, N

t [ ( )]
H stabilises around 0.8, which is similar to the case of TBM-CI.Figure 24b shows a linear decrease in the total number of tasks.However, in Figure 26, the number of scheduled and unscheduled replacements does not change significantly as ins CBM-SI increases.Thus, the decrements are mainly attributed to the reduced number of inspections.The results obtained for CBM-SI show that we can decrease the number of tasks while keeping the same level of safety indicators if we replace early routine inspections by the condition monitoring.
Lastly, under CBM-SR, although the expected number of incident

N t [ ( )]
H increases slightly as ϵ S increases, the increase is limited in comparison to TBM-CI. Figure 25a shows that, even when ϵ S is 0.08, only 0.21 safety incidents are expected, which is significantly less than the indicator under TBM-CI.Overall, Figure 25a shows that CBM-SR significantly reduces the probability of having brake-related safety incidents when the sensor accuracy ϵ S ≤ 0.8.In the case of the number of tasks, relies only on scheduled replacements, and thus the number of tasks of CBM-SR is incompatible to the other strategies that also make use of routine inspections and unscheduled replacements.For this reason, Figure 25b only shows the number of scheduled replacements, which is independent of the sensor error.

Discussion
In this paper, we propose two CBM strategies, CBM-SI and CBM-SR, and assess them against two TBM strategies, TBM-CI and TBM-FI.
TBM-FI, which uses frequent inspections, has better safety indicators when compared with the baseline TBM-CI.However, it is not cost-efficient if the increment of the number of inspections is more expensive than the reduced number of unscheduled replacements.
For CBM-SI, which replaces early inspections with sensor data analysis, the safety indicators are similar to those for TBM-CI, but the number of tasks, especially inspections, is reduced significantly.
The CBM-SR strategy has similar safety indicators as TBM-FI, but requires significantly fewer tasks, since it uses the RUL estimation to Lastly, following our sensitivity analysis, the safety indicators under CBM-SI are not affected when the start of periodic inspections is delayed.Also, our numerical results show that the safety indicators under CBM-SR are better than in the case of TBM-CI, even when considering larger sensor errors.
From a methodology point of view, the basic model proposed in Section 3 can be readily adapted to other aircraft components, maintenance strategies, as well as additional agents and characteristics of the maintenance process.

Conclusions
We propose a framework to assess safety and efficiency of the aircraft maintenance process.We develop an agent-based model (ABM) of the end-to-end aircraft maintenance.The agent models are formalised by means of stochastically and dynamically coloured Petri nets (SDCPNs).Next, we specify the agent models for several aircraft maintenance strategies.Using a Monte Carlo simulation of the ABM, we assess safety and efficiency indicators for the considered maintenance strategies.
We illustrate our framework for the maintenance of the aircraft landing gear brakes.We propose two condition-based maintenance (CBM) strategies and compare them to time-based maintenance (TBM) strategies.Then the safety and efficiency of these strategies are assessed.Our results show a trade-off between safety and efficiency.In particular, the strategy based on data-driven prognostics shows improved safety and efficiency indicators compared to TBM strategies.
In conclusion, this framework supports the assessment of novel maintenance strategies, ahead of their implementation in practice.As the ABM is designed to be generic, different aircraft components, or different strategies can be readily analysed.Moreover, this framework is expected to be the basis of follow-up research for the design and analysis of maintenance strategies considering more realistic interactions of agents in practice.
As future work, we plan to extend our ABM for aircraft maintenance by considering heterogeneous components, limited availability of spare parts and hangars, aircraft fleet, human behaviours, and various error models.

1 dep
agent AC is in state in-flight.Block-time is the period of time between gate departure at time i dep until the arrival time i arr at the gate.When the aircraft stops at the gate, we say that the agent AC is in state on-ground.The time between the arrival , i arr and the subsequent departure, + i is referred to as ground-time.A set of flight cycles is called a flight schedule.The agent AC is operated by flight crews, following a given flight schedule.

Figure 10 .
The guard transition 'Prepare task' has the guard function = t t ( ), Prepare task sch which fires the given task token to the place 'Starting'.Depending on the type of the task ω, specified in the token colour , T the relevant task transition fires.For example, if the given task is a replacement, the guard transition 'Replace' fires.The token stays in the place 'Replacing' until the delay transition 'Replace' fires the token to the place 'Replacing'.The delay Exp( ¯) rep rep models the time spent on a replacement.Since the aircraft must be available during the task execution, the task-related transitions are enabled by the places 'On-ground' and 'Condition of component-ξ' (see Figure 6 and 7).When the delay transition 'Replace' fires, meaning that the agent ME completed the task, the task token is fired to the place 'Completing'.At the same time, a new token is generated in the place 'Trigger Replacement'.This new token enables the immediate transition 'Replaced' in the LPN of the component in Figure 7.The same process is used for the restoration and the lubrication tasks.The transition 'Report' fires the token to the place 'Waiting', meaning that the agent ME is ready for the next task.If the completed task needs to be repeated later, the transition 'Report' fires the task token to the place 'Task to plan', making the agent TP to plan it again.For the inspection task, the delay transition 'Inspect' does not fire a token to the trigger places because the inspection does not change the condition of the target component.The colour of this token has an additional colour variable, i.e., the observed degradation level of the component X t ^( ).

i
dep and X ( ), i arr

1 dep
Following a replacement at the ground-time of flight cycle i, is replaced during the ground-time of flight cycle i rep , then

41 .
) where = a 2, = b 0.01.Here, we consider 100 flight cycles and a degradation threshold = 1.The degradation level in- creases until the brake is replaced at the flight cycle = i 40.A new degradation process is restarted from flight cycle = i 41 with = X 0 As a result, eq.(11) does not hold for = i 40, i.e.,

Fig. 15 .Fig. 16 ..
Fig. 15.Position of the 8 brakes of a wide-body aircraft with their position index.

Figure 18 )
in the form of three guard transitions connected to the place 'Deciding': i) If < X ^, i rep the transition 'Complete' moves the token from the place 'Deciding' to the place 'Completing', without generating new task tokens.ii) If < X , i rep the transition 'Request scheduled replacement' fires a new task token to the place 'Task to plan', so that the agent TP can schedule a replacement within 20 FCs.iii) If X , i the transition 'Generate unscheduled replacement' fires a new task token to the place 'Task to execute'.This unscheduled replacement is executed immediately, before the next departure of aircraft.

Fig. 18 .
Fig. 18.LPN : Task execution of the agent ME for the aircraft landing gear brake maintenance.

Fig. 19 . 0 i.
Fig. 19.LPN : Alert system of the agent AC for the landing gear brake maintenance.

Fig. 21 .
Fig. 21.Degradation process data example -unequally spaced data points X ˜, i and equally spaced data points X , i after resampling.

Figure 23
shows the expected number of incidents N t [ ( )] H and the total number of tasks under TBM-FI for d 20 80 ins TBM-FI

Fig. 23 .Fig. 24 .
Fig. 23.Expected number of the brake-related safety incidents and expected total number of tasks under TBM-FI with different d ins TBM-FI .

Fig. 25 .
Fig. 25.Expected number of the brake-related safety incidents and expected total number of tasks under CBM-SR with different ϵ S .

Fig. 26 .
Fig. 26.Expected number of scheduled and unscheduled replacements under CBM-SI with different CBM-SI

Table 1
LPNs of agents for the aircraft maintenance process The given maintenance strategy specifies their guard functions.For instance, a restoration can be scheduled if the observed degradation level X t ^( ) is greater than a predefined threshold η ins , i.e., The agent flight crew (CR) operates the aircraft based on a flight schedule and conducts operational checks.The agent CR departs at t , i dep if the aircraft is not under maintenance.After Δτ i hours of flights, the agent CR arrives at the destination airport.During the ground-time, they can check the condition of the aircraft components, i.e., operational check.The result is reported to the agent TG, which may generate a new task.

Table 2
Estimation of the parameters of the aircraft brake degradation model Gamma(a, b).In the first column, L and R indicate the brake is on the left and right side, respectively.

Table 6
shows the expected value of X

Table 3
Number of brake-related safety incidents in = t 10 H years of operations.

Table 4
Probability to have at least one brake-related safety incident by = t

Table 5
Average number of maintenance tasks executed in = t

Table 6
Expected degradation level at the moment of brake replacement, = t