In addition, control laws are used to modify the state of the components to keep the liquid within two acceptable limits: 6 m and 8 m. If the liquid level drops under 6 m, the components 1, 2, 3 are put respectively in state ON, ON and OFF (provided they are not stuck). If the liquid level rises above 8 m, the components are put respectively in the state OFF, OFF and ON (provided they are not stuck). Unlike the classical model presented in [1–4], we also allow the control unit to fail. At each solicitation, the control may succeed with probability p 1⁄4 0.8 independently from previous successes. Once it has failed, it will never succeed again. Therefore the control unit has two possible states: working 1 or failed 0.