Mengfei Fan
email: fanmengfei@buaa.edu.cn

Zhiguo Zeng
email: zhiguo.zeng@centralesupelec.fr

Enrico Zio
email: enrico.zio@ecp.fr

Rui Kang
email: kangrui@buaa.edu.cn

Modeling dependent competing failure processes with degradation-shock dependence

Keywords: Dependent competing failure processes, degradation, shock, degradation-shock dependence, Monte Carlo simulation, sliding spool Highlights

In this paper, we develop a new reliability model for dependent competing failure processes (DCFPs), which accounts for degradation-shock dependence. This is a type of dependence where random shock processes are influenced by degradation processes. The degradation-shock dependence is modeled by assuming that the intensity function of the nonhomogeneous Poisson process describing the random shock processes is dependent on the degradation processes. The dependence effect is modeled with reference to a classification of the random shocks in three "zones" according to their magnitudes, damage zone, fatal zone, and safety zone, with different effects on the system's failure behavior. To the best of the authors' knowledge, this type of dependence has not yet been considered in reliability models. Monte Carlo simulation is used to calculate the system reliability. A realistic application is presented with regards to the dependent failure behavior of a sliding spool, which is subject to two dependent competing failure processes, wear and clamping stagnation. It is shown that the developed model is capable of describing the dependent competing failure behaviors and their dependence.

Acronyms

Introduction

Industrial components, systems and products are subject to multiple degradation processes and failure modes, i.e. wear, corrosion, fracture, fatigue, and etc. [START_REF] Jiang | Modeling zoned shock effects on stochastic degradation in dependent failure processes[END_REF][START_REF] Zeng | Using PoF models to predict system reliability considering failure collaboration[END_REF]. Such processes are often "competing" in leading to failure [START_REF] Huang | Reliability analysis of electronic devices with multiple competing failure modes involving performance aging degradation[END_REF] and may be dependent on each other in a number of ways, in which case they are referred to as dependent competing failure processes (DCFPs) [START_REF] Peng | Reliability and maintenance modeling for systems subject to multiple dependent competing failure processes[END_REF]. Various dependencies have been discussed in literature, e.g., the statistical dependency described by joint probability distributions [START_REF] Lai | Stochastic Ageing and Dependence for Reliability[END_REF][START_REF] Navarro | Comparisons and bounds for expected lifetimes of reliability systems[END_REF], copulas [START_REF] Wang | Modeling the dependent competing risks with multiple degradation processes and random shock using time-varying copulas[END_REF][START_REF] Bunea | The effect of model uncertainty on maintenance optimization[END_REF], and the functional dependency described by failure propagation and isolations [START_REF] Wang | Competing failure analysis in phased-mission systems with functional dependence in one of phases[END_REF][START_REF] Wang | Reliability analysis of multi-trigger binary systems subject to competing failures[END_REF][START_REF] Wang | Combinatorial analysis of body sensor networks subject to probabilistic competing failures[END_REF], etc. In this paper, we consider the dependency between two types of failure processes: degradation failure processes (or soft failures) and catastrophic failure processes (or hard failures) [START_REF] Li | Reliability modeling of multi-state degraded systems with multi-competing failures and random shocks[END_REF]. In practice, soft failures are modeled by an evolving degradation process and hard failures are modeled by a random shock process. Models that consider both degradation and random shocks are called Degradation-Threshold-Shock (DTS) models [START_REF] Caballé | A condition-based maintenance of a dependent degradation-threshold-shock model in a system with multiple degradation processes[END_REF][START_REF] Lehmann | Joint modeling of degradation and failure time data[END_REF]. In literature, most DCFPs are modeled by DTS models.

An early DTS model was developed by Lemoine and Wenocur [START_REF] Lemoine | On failure modeling[END_REF], where degradation is modeled by a diffusion process and fatal shocks are modeled by a Poisson process. Soft failures are defined with respect to the degradation reaching pre-established critical values and hard failures arrive in correspondence of the occurrence of fatal shocks.

Klutke and Yang [START_REF] Klutke | The availability of inspected systems subject to shocks and graceful degradation[END_REF] have developed an availability model for systems subject to degradations and random shocks,

where degradations occur at a constant rate and shocks follow a Poisson process. Marseguerra et al. [START_REF] Marseguerra | Condition-based maintenance optimization by means of genetic algorithms and Monte Carlo simulation[END_REF] and Barata et al. [START_REF] Barata | Simulation modelling of repairable multi-component deteriorating systems for 'on condition' maintenance optimisation[END_REF] investigate condition-based maintenance optimizations for deteriorating systems subject to degradations and random shocks. Li and Pham [START_REF] Li | Reliability modeling of multi-state degraded systems with multi-competing failures and random shocks[END_REF][START_REF] Li | An inspection-maintenance model for systems with multiple competing processes[END_REF] develop a reliability model and an maintenance model for multistate degraded systems considering two degradation processes and a shock process. In a recent paper by Lin et al. [START_REF] Lin | Integrating random shocks into multi-state physics models of degradation processes for component reliability assessment[END_REF], a DTS model has been developed, where the degradation process is modeled by a continuous-time semi Markov process and the shock process is modeled using a homogeneous Poisson process.

To consider the dependence between degradations and shocks, Peng et al. [START_REF] Peng | Reliability and maintenance modeling for systems subject to multiple dependent competing failure processes[END_REF] assume that the arriving shock would bring a sudden increase to the normal degradation process and develop a probabilistic model to calculate the system's reliability. Wang and Pham [START_REF] Wang | A multi-objective optimization of imperfect preventive maintenance policy for dependent competing risk systems with hidden failure[END_REF] use a similar approach to model DCFPs and determine the optimal imperfect preventive maintenance policy. Keedy and Feng [START_REF] Keedy | Reliability analysis and customized preventive maintenance policies for stents with stochastic dependent competing risk processes[END_REF] apply the model in [START_REF] Peng | Reliability and maintenance modeling for systems subject to multiple dependent competing failure processes[END_REF] on a stent, where the degradation process is modeled by a PoF (Physics of failures) model. Song et al. [START_REF] Song | Reliability analysis for multi-component systems subject to multiple dependent competing failure processes[END_REF] consider the reliability of a system whose components are subject to the DCFPs and distinct component shock sets [START_REF] Song | Reliability for systems of degrading components with distinct component shock sets[END_REF].

Apart from the dependence considered in [START_REF] Peng | Reliability and maintenance modeling for systems subject to multiple dependent competing failure processes[END_REF], Jiang et al. [START_REF] Jiang | Reliability and maintenance modeling for dependent competing failure processes with shifting failure thresholds[END_REF] consider a different kind of dependence, where the threshold of the degradation process is shifted by shocks. Rafiee et al. [START_REF] Rafiee | Reliability modeling for dependent competing failure processes with changing degradation rate[END_REF] develop a model in which the degradation rates are shifted by different shock patterns. Wang et al. [START_REF] Wang | An approach to reliability assessment under degradation and shock process[END_REF] explore another type of dependence by assuming that a sudden change to the failure rate is caused by the arriving shocks. Jiang et al. [START_REF] Jiang | Modeling zoned shock effects on stochastic degradation in dependent failure processes[END_REF] consider dependence where shocks are divided into different zones, where each different zone has a different effect on the degradation process.

As reviewed above, the majority of existing DCFP models focuses on modeling the influence of random shocks on degradations (shock-degradation dependence). In engineering practice, however, there are components, systems and products that are subject to DCFPs in which random shocks are influenced by degradations (degradation-shock dependence). A typical engineering example is the sliding spool, which is a widely applied component in hydraulic control systems [START_REF] Vaughan | The contribution of erosive wear to the performance degradation of sliding spool servovalves[END_REF]. A sliding spool is subject to two failure processes: wear, which is modeled as a degradation process and clamping stagnation, which is modeled by random shocks [START_REF] Liao | Research on the wear mechanism and life modeling method of aero-hydraulic spool valve[END_REF]. As shown in Sasak and Yamamot [START_REF] Sasak | A review of studies of hydraulic lock[END_REF],

the process of clamping stagnation is dependent on the wear process: as the wear process progresses, more wear debris is generated. The debris will contaminate the hydraulic oil and further, increase the likelihood of clamping stagnation [START_REF] Raadnui | Low-cost condition monitoring sensor for used oil analysis[END_REF][START_REF] Wang | A compact on-line particle counter sensor for hydraulic oil contamination detection[END_REF], which causes the degradation-shock dependence.

Compared to shock-degradation dependence, there are fewer models considering the degradation-shock dependence. In [START_REF] Fan | Multicomponent lifetime distributions in the presence of ageing[END_REF], Fan et al. consider the degradation-shock dependence by assuming that the magnitude of random shocks is increased by the degradation processes. Bagdonavicius et al. [START_REF] Bagdonavicius | Statistical analysis of linear degradation and failure time data with multiple failure modes[END_REF] have developed a model to consider the degradation-shock dependence among a linear degradation process and several extreme shocks. In their model, the intensities of the random shocks are assumed to depend only on the degradation level. Ye et al. [START_REF] Ye | A distribution-based systems reliability model under extreme shocks and natural degradation[END_REF] model the degradation-shock dependence by assuming that the destructive probability of a shock is determined by the remaining hazard of the degradation process. In [START_REF] Caballé | A condition-based maintenance of a dependent degradation-threshold-shock model in a system with multiple degradation processes[END_REF][START_REF] Huynh | Modeling age-based maintenance strategies with minimal repairs for systems subject to competing failure modes due to degradation and shocks[END_REF][START_REF] Huynh | A periodic inspection and replacement policy for systems subject to competing failure modes due to degradation and traumatic events[END_REF], the intensity of the random shock is assumed to be a piecewise function of the degradation level.

The aforementioned models only consider a relatively simple type of random shock: the extreme shocks (also referred to as traumatic shocks), where the arrival of a shock in the critical region causes the immediate failure of the product [START_REF] Bai | Generalized Shock Models Based on a Cluster Point Process[END_REF]. In practice, however, more complex shock patterns, such as cumulative shocks [START_REF] Huang | Time-dependent reliability model of deteriorating structures based on stochastic processes and Bayesian inference methods[END_REF],  -shocks [38],

mixed shocks [START_REF] Gut | Mixed shock models[END_REF], run shocks [START_REF] Mallor | Shocks, runs and random sums[END_REF], are frequently encountered. Since the 1990s, works on imperfect fault coverage models [START_REF] Amari | A Separable Method for Incorporating Imperfect Fault-Coverage into Combinatorial Models[END_REF][START_REF] Xing | Reliability Evaluation of Phased-Mission Systems with Imperfect Fault Coverage and Common-Cause Failures[END_REF][START_REF] Xiang | An Imperfect Fault Coverage Model with Coverage of Irrelevant Components[END_REF] categorize the effects of a component fault into three types: single-point failure, which causes immediate system failure, permanent coverage, which causes cumulative damages to the system and transient restoration, which has no effect on the system. Based on a similar consideration, Jiang et al. discuss a shock pattern called zone shocks, where shocks with different magnitudes might have different impacts on the failure behavior of the product [START_REF] Jiang | Modeling zoned shock effects on stochastic degradation in dependent failure processes[END_REF]. Zhou [START_REF]Research on mechanism of contaminant lock for hydraulic valve[END_REF] reports an example of the zone shocks based on experimental results of a sliding spool:

the sliding spools exhibit different failure behaviors when they are tested under different levels of shock magnitudes (measured by sizes of wear debris). To the best of our knowledge, the zone shocks process has only been considered in the shock-degradation dependence model [START_REF] Jiang | Modeling zoned shock effects on stochastic degradation in dependent failure processes[END_REF]. However, after a careful literature review, we find that there are no existing models that consider both the degradation-shock dependence and the zone shocks.

In this paper, we develop a new DCFP model which considers degradation-shock dependence and zone shocks.

The developed model contributes to the existing scientific literature and to engineering practice in two aspects:

 it allows for explicit modeling of the degradation-shock dependence, where random shocks are influenced by degradation processes and  it allows for the consideration of zone shocks in the degradation-shock dependence model, where shocks with different magnitudes have different impacts on the components failure behaviors.

The remainder of the paper is organized as follows. Sect. 2 introduces the engineering motivation of the present research. In Sect. 3, the new reliability model is developed to describe failure behaviors of systems subject to competing soft failures and hard failures involving degradation-shock dependence. In Sect. 4, the developed model is applied to model the dependent failure behavior of a sliding spool subject to wear and clamping stagnation. Finally, the paper is concluded with a discussion on potential future works in Sect. 5.

Engineering problem setting

The model developed in this paper is motivated by the actual engineering problem of modeling the reliability of a sliding spool. Sliding spools are critical control components in hydraulic control systems [START_REF] Vaughan | The contribution of erosive wear to the performance degradation of sliding spool servovalves[END_REF]. As illustrated in Figure 1, a sliding spool is composed of a spool and a sleeve, where the spool slides in the sleeve to control hydraulic oil flows [START_REF] Yang | Reliability analysis of direct drive electrohydraulic servo valves based on a wear degradation process and individual differences[END_REF]. A sliding spool is subject to two failure mechanisms [START_REF] Liao | Research on the wear mechanism and life modeling method of aero-hydraulic spool valve[END_REF]. One is wear between the spool and the sleeve, and the other is clamping stagnation (also referred to as hydraulic locking or sticking), in which the spool is stuck in the sleeve. In practice, wear can be modeled by a physical deterioration model, for example, the linear Archard model suggested by Liao [START_REF] Liao | Research on the wear mechanism and life modeling method of aero-hydraulic spool valve[END_REF]. The modeling of clamping stagnation, however, is more complex because the factors contributing to clamping stagnation are much more varied. According to the survey by Sasak and Yamamot [START_REF] Sasak | A review of studies of hydraulic lock[END_REF], one of the major causes of clamping stagnation is the sudden appearance of pollutant in the hydraulic oil, which can be modeled by a random shock model. The pollutant may come inside the hydraulic system from the outside environment or be generated by the hydraulic system itself. One significant source of internal pollutant is the wear debris generated due to the wear of the sliding spool. Therefore, the random shock process is dependent on the wear process: As the wear process progresses, more wear debris is generated. The debris will contaminate the hydraulic oil and further, increase the likelihood of clamping stagnation [START_REF] Raadnui | Low-cost condition monitoring sensor for used oil analysis[END_REF][START_REF] Wang | A compact on-line particle counter sensor for hydraulic oil contamination detection[END_REF]. This kind of dependence, caused by the influence of degradation on shocks, needs to be considered when developing the reliability model of the spool valve.

Furthermore, experimental results show that the most harmful effect of shocks is generated by wear debris, whose sizes are either close to or much smaller than the clearance of the sliding spool [START_REF] Sasak | A review of studies of hydraulic lock[END_REF][START_REF]Research on mechanism of contaminant lock for hydraulic valve[END_REF][START_REF] Li | Determination of critical size of contamination of spool valve[END_REF]. This is because the clamping stagnation is caused by two failure mechanisms, immediate stagnation and cumulative stagnation [START_REF]Research on mechanism of contaminant lock for hydraulic valve[END_REF].

When a particle with a size close to the clearance is generated, it causes immediate stagnation of the sliding spool [START_REF]Research on mechanism of contaminant lock for hydraulic valve[END_REF], as shown in Figure 2

DCFP model considering degradation-shock dependence

System descriptions

As shown in Figure 3, we consider a DCFP that comprises two failure processes: soft failures due to a degradation process (Figure 3 (a)) and hard failures due to random shocks. According to their magnitudes, random shocks are divided into three zones: damage zone, fatal zone and safety zone [START_REF] Jiang | Modeling zoned shock effects on stochastic degradation in dependent failure processes[END_REF]. As shown in Figure 3 (b-1), a shock in the damage zone generates a cumulative damage to the system; as shown in Figure 3 (b-2), a shock in the fatal zone causes immediate failure of the system; a shock in the safety zone has no effect on the system's failure behavior.

Note that the three shock zones in Figure 3 are shown for illustrative purposes only. In different applications, casespecific shock zones can be defined based on the magnitude of the shocks.

Degradation-shock dependence exists among the failure processes, that is, the arrival rate of the random shocks is dependent on the degradation levels, as illustrated in Figure 3. Failures occur whenever one of the three events happens:

 the degradation process reaches its threshold (denoted by 1 T in Figure 3);  the cumulative damage resulting from the shocks in the damage zone exceeds its threshold (denoted by 2 T in Figure 3);  a shock in the fatal zone occurs (denoted by 3 T in Figure 3). Additional assumptions of this model include:

(1) The degradation process can be modeled by the general path model proposed by Lu and Meeker [START_REF] Lu | Using degradation measures to estimate a time-to-failure distribution[END_REF]:

    ;, x t X t  θ (1)
where  

xt is the degradation measure and

 

X  is the deterministic degradation path, which can be obtained from knowledge of physics of failure [START_REF] Pecht | Physics-of-failure: an approach to reliable product development[END_REF]. Vector θ in (1) contains a set of random parameters that represent the influence of uncertainties. It should be noted that the general path model in ( 1) is a general degradation model, for each specific case, the form of   X  in (1) could be specified to describe the case-specific degradation mechanism.

(

) 2
  0 () t a t u du    [51]:         . ! n at e a t P N t n n   (2)
(3) The magnitude of each shock, denoted by i Y , is an independent and identically distributed (i.i.d.) random variable.

(4) The damage caused by the ith shock in damage zone, denoted by

i W , is proportional to its magnitude i Y with coefficient  : . ii WY   (3)
(5) To consider the degradation-shock dependence, we introduce a dependence factor a  and assume:

    0 ;. a t X t      θ (4)
Remark 1: the description of the shock damage in the form of equation ( 3) belongs to a type of commonly used damage model, which assumes that the shock damage is linearly dependent on the shock magnitude. Similar damage models can be found in [START_REF] Jiang | Modeling zoned shock effects on stochastic degradation in dependent failure processes[END_REF][START_REF] Song | Reliability analysis of multiple-component series systems subject to hard and soft failures with dependent shock effects[END_REF].

Remark 2: the assumption that the intensity of the NHPP is a linear function of the degradation level is adapted from the assumption proposed by Mercer [START_REF] Mercer | On wear depending renewal processes[END_REF]. In Mercer's model, the traumatic failure intensity is of the form

    t Z t c   
, where   Zt is a degradation function describing the piecewise constant degradation process. Also, note that 0  in (4) denotes the initial intensity of the NHPP.

Modeling zone shocks

Once a random shock arrives, we should first classify it into one of the three zones according to its magnitude.

Let 1 2 3 ,, P P P denote the probabilities that the i th shock belongs to the damage, fatal and safety zone, respectively.

It is clear that

Pt 

The conclusion can be easily generalized to the three-sub-processes case, which leads to the following proposition:

                    1
where   0 ()

t a t u du   
. Proposition 1 and equation ( 5) will be used in the next section to develop the reliability model.

Reliability modeling

It can be seen from Figure 3 that a reliable system at time t should satisfy the following conditions: (1) the degradation process does not exceed its threshold D before t ; (2) no shocks in the fatal zone occur before t and

(3) the cumulative damage resulting from shocks in the damage zone does not exceed its threshold H before t .

Therefore, we can express the reliability at time t as:

              1 2 1 1 1 0 ; , , 0 . Nt i j i R t P X t D W H N t N t i P N t i               θ (6)
Equation ( 6) comes from a direct application of the total probability formula.

For ease of illustration, we define three events 1 2 3

,, E E E and let them denote the events

      1 2 1 ; , , 0 Nt i j X t D W H N t      θ
, respectively. Because the degradation-shock dependence is considered (see ( 4)), 1 2 3 ,, E E E are dependent. However, once the value of θ is fixed, the three events become conditionalindependent [START_REF] Pecht | Physics-of-failure: an approach to reliable product development[END_REF]. Therefore, we can apply the total probability formula on θ in [START_REF] Navarro | Comparisons and bounds for expected lifetimes of reliability systems[END_REF], which leads to:

            1 2 3 1 1 0 , , d , , i R t P E E E N t i P N t i f            θ θ θ x θ x x x (7)
where   f θ x is the probability density function of θ . Considering the fact that 1 2 3 ,, E E E are conditionalindependent given θ , (7) becomes:

            1 2 3 0 , , , , d i R t P E A B P E A B P E A B P A B f          θ θ xx (8)
where event A denotes  

 

X  is a deterministic degradation path model and θ is the only random variable [START_REF] Zheng | Contaminant lock force and filter cake forming mechanism of hydraulic spool valves[END_REF], we have

      1 1 ; , if if , 0 ; . X t D P E A B X t D         x x (9)
The probability  

2 , P E A B is expressed as       1 21 1 , , , Nt i j P E A B P W H N t i           θ x (10)
which can be further expanded once the distribution of i Y is determined.

The probability  

        0 0 32 , exp ;d , t a P E A B P X u u       x (11)
where 2 P is the probability that the arrival shock belongs to the fatal zone.

Finally, from (5),   P A B is given by:

        1 ; 1 ; , ! i Pt e P t P A B i    x x (12)
where 1

P is the probability that the arrival shock belongs to the damage zone and   ; t  x is given by:

      0 0 ; ; d . t a t X u u       xx (13)
The reliability model developed in ( 8) is an extension to the model in [START_REF] Jiang | Modeling zoned shock effects on stochastic degradation in dependent failure processes[END_REF], obtained by considering the degradation-shock dependence described by ( 4). If we let 0 a   , which indicates that there is no dependency between the degradation process and the shock process, the reliability model in [START_REF] Bunea | The effect of model uncertainty on maintenance optimization[END_REF] degenerates to

          2 1 1 () 1 0 1 ,. ! i Nt i j i P P t e R t P X t t W i P DH            (14)
Equation ( 14) is in accordance with the model developed in [START_REF] Jiang | Modeling zoned shock effects on stochastic degradation in dependent failure processes[END_REF], where

      1 1 , Nt i j P X t D W H    corresponds to the   0 |, d s S H Xs x x n f t  in [1].

Reliability model quantification by Monte Carlo simulation

Due to the complexity of ( 8), the analytical solution of the reliability is hard to obtain. A numerical approach based on Monte Carlo simulation is, then, developed to compute the system reliability, by the following pseudo-code:

      1 1 ,..., 2 ,..., 1, , 0 if i . f ki ki k Y Y Y k Y Y Y YH P E A B YH                 (15)

End For

Calculate   j Rt by ( 16):

          1 2 3 0 , , , . m jj jj j ii i R t P E A B P E A B P E A B P A B    (16)

End For

Calculate  

Rt by ( 17):

    1 1 . n j j R t R t n    (17)
The computational complexity of the simulation method is  

t obj O M n n O   
, where t n is the evaluated

number of t , obj O
is the computational complexity of each evaluation of the objective function, i.e., the

        1 2 3
, , , [START_REF] Klutke | The availability of inspected systems subject to shocks and graceful degradation[END_REF].

j j j j ii P E A B P E A B P E A B P A B in
To implement the algorithm in practice, the values for

Applications

Model development

In this section, the developed DCFP model is applied to describe the failure behavior of a sliding spool. The case study is artificially constructed, based on a realistic physical background, to illustrate the proposed modeling framework. As discussed in Sect. 2, the sliding spool is subject to two dependent failure processes, wear and clamping stagnation. According to a study of physics-of-failures [START_REF] Liao | Research on the wear mechanism and life modeling method of aero-hydraulic spool valve[END_REF], the wear of the sliding spool increases smoothly for most of its lifetime, and therefore the wear process can be modeled by a linear model:

    ; , , x t X t t        (18)
where the initial value  is a constant and the degradation rate  is assumed to be a normal random variable.

Based on the analysis in Sect. Moreover, degradation-shock dependence exists between the wear and the clamping stagnation, because wear processes generate wear debris that accelerates the arrival rate of the particles which cause the clamping stagnation [START_REF] Sasak | A review of studies of hydraulic lock[END_REF][START_REF] Raadnui | Low-cost condition monitoring sensor for used oil analysis[END_REF]. In our developed model, the degradation-shock dependence is modeled by [START_REF] Peng | Reliability and maintenance modeling for systems subject to multiple dependent competing failure processes[END_REF]. Because the wear process is modeled by ( 18), (4) becomes:

 if i Y C C    ,
    0 . a t t        (20)
Substituting ( 18)-( 20) into (8), the reliability of the sliding spool under the two dependent failure processes can be calculated.

Reliability evaluation

The numerical algorithm presented in Sect. 3.4 is used to evaluate the reliability of the sliding spool based on the developed model. In this application, the values for the model parameters are estimated by domain experts. For illustrative purposes, we assume the expert estimations are accurate and given in Table 1. In practice, parameters related to degradation processes and random shocks, for example, the  and  in Table 1, could be estimated from test data.

Results and discussions

We compute the reliability of the sliding spool under different levels of dependence ( 0 a   , ), to investigate the failure behavior of the sliding spool. Results are given in Figure 4. In general, the reliability of the sliding spool increases with the decrease of a  . As expected, when 0 a   , indicating that there is no dependence between the two failure processes,   Rt takes the largest values. This is mainly due to the dependence mechanism between wear and clamping stagnation. As the wear process progresses, more wear debris is generated and, the arrival rate of particles causing clamping stagnation increases. In this way, clamping stagnation is aggravated by wear. Therefore, positive dependence exists between the two failure mechanisms, as described by [START_REF] Lin | Integrating random shocks into multi-state physics models of degradation processes for component reliability assessment[END_REF].

Proactively, this suggests that if we can mitigate the dependence between the two failure processes, the reliability of the sliding spool could be enhanced. In practice, filters can be installed to stop the debris generated by wear processes from entering the hydraulic oil. In this way, the dependence between wear and clamping stagnation can be controlled, so that the reliability of the sliding spool can be increased.

Furthermore, it can be seen from Figure 4 that when a  is relatively small, the reliability changes slowly at first, then declines sharply at about ), the declination of the reliability curve becomes more rapid. The main physical and mathematical reasons of the phenomenon are:

(1) A small a  indicates that the two failure mechanisms are almost independent. The sliding spool would experience two distinct failure behaviors. When t is small, because the wear process is far from its failure threshold, failures due to wear seldom occur. Hence, the failure behavior is primarily dominated by clamping stagnation. Because the rate of the clamping stagnation is relatively small, the sliding spool will have high reliability, which is indicated by the first part of the reliability curve.

As t increases, the wear level approaches its threshold. Therefore, failures are more likely to be caused by the wear processes. On the other hand, because a  is small, from (4), the rate of the clamping stagnation remains almost unchanged. Hence, when t is large, the failure behavior of the spool is primarily determined by wear, which leads to the second part of the reliability curve starting at around (2) When a  is relatively large, the wear process has considerable influence on the shock process. Even when t is small, the failure probability of the sliding spool is relatively high due to the positive dependence between the two failure processes. Hence, the difference between the two failure behaviors in the independent case becomes small. Therefore, the reliability curve declines more smoothly comparing to the independent case.

(3) When a  becomes even larger, the reliability of the sliding spool decreases rapidly with time. This is because strong dependence exists between wear and clamping stagnation. Therefore, even at the early stages of the spool's life cycle, a lot of spools might fail due to the high risks of clamping stagnation, which results from the strong positive dependence on the wear process.

Some extensions

In real cases, the dependency behaviors might be more complicated. For example, as the debris accumulates, more wear and debris are expected. As a consequence, the intensity of the shock arrival process might not only depend on the degradation level, but also on the accumulated shock damage W  . Furthermore, the size of the wear debris might also be affected by the degradation levels. In addition, the degradation rate also depends on the accumulated shock damage, i.e., the shock-degradation dependence. In this section, we show how to extend the developed model to capture more complex dependency behaviors.

Except for the assumptions we made in Sect. 4.1, three additional assumptions are made:

 the intensity function of the arrival process of the wear debris, i.e., the   t  in [START_REF] Lin | Integrating random shocks into multi-state physics models of degradation processes for component reliability assessment[END_REF], depends on the degradation level   xt and the current cumulative shock damage W

 :     0 , ab t x t W         (21)
where , ab  are dependence factors and 0  is the initial intensity of the arrival process. The first two assumptions consider degradation-shock dependence, where the intensity of the shock arrival process and the distribution of shock magnitudes are both influenced by the degradation process. The last assumption describes shock-degradation dependence, where the degradation rate varies with the accumulated damages of the random shocks.

Monte Carlo method (with a sample size of  on the intensity function of the arrival process of the wear debris, as shown in ( 21), and on the system's degradation rate, as shown in [START_REF] Song | Reliability analysis for multi-component systems subject to multiple dependent competing failure processes[END_REF]. As W

 increases, on one hand, more shocks occur, which increases the probability of a hard failure; on the other hand, the system degrades more rapidly, which accelerates the arrival of a soft failure. Therefore, b  might has a significant effect on the system reliability.  has already entered the safety shock zone, most random shocks would also be in the safety shock zone. The failure process in this period is dominated by the degradation process. As a result, the system's reliability is not sensitive to c  and, therefore, the effect of c  can be ignored in modeling the sliding spool.  on the degradation rate  , as shown in (23). As d  increases, the degradation process becomes more rapid, according to (23), which, then, creates more random shocks due to the degradation-shock dependence (Eq. ( 20)). The system's reliability is significantly reduced by the mutually enhanced dependences.

Conclusions

In this paper, a new reliability model is developed for dependent competing failure processes. In the developed model, failure of a component could be caused by either "soft" failure (described by a degradation model) or "hard" failure (described by a shock model), and the degradation-shock dependence exists among the failure processes (where the intensity of the shock process is dependent on the degradation process and the effect of dependence is classified into different zones according to the magnitude of the random shocks). Since degradation-shock dependence is considered, the shock process is influenced by the degradation process but the degradation process is not influenced by the shock process. In the future, additional work will be done to further improve the developed model. First of all, in this paper we only consider a simple dependence scenario, where linear dependence exists between the intensity function and the degradation processes. In the future, the influence of other dependence relations, possibly nonlinear, will also be considered. Second, in this paper we only consider the degradation-shock dependence. In the future, the combination of two types of dependencies will be considered. Third, in this paper we assume that the parameters of the model are perfectly known. In practice, however, many times precise values of the parameters are not available due to limited data and knowledge. Hence, the model is subject to epistemic uncertainty, whose effect will also be studied.

random shocks at time t 0 

 0 Initial intensity of random shocks   Nt Number of random shocks that have arrived by time t

Figure 1

 1 Figure 1 Illustration to a sliding spool: (a) Closed position; (b) Open position[START_REF] Yang | Reliability analysis of direct drive electrohydraulic servo valves based on a wear degradation process and individual differences[END_REF]

  (a). If particle sizes are smaller than the clearance, the particles can enter the clearance with the hydraulic oil and form filer cakes cumulatively[START_REF] Zheng | Contaminant lock force and filter cake forming mechanism of hydraulic spool valves[END_REF]. When the filter cakes become large enough, cumulative stagnation occurs, as shown in Figure2 (b). According to Zhou[START_REF]Research on mechanism of contaminant lock for hydraulic valve[END_REF], particles whose sizes are greater than the clearance have little effect on clamping stagnation, because they are blocked outside the clearance. Hence, based on their magnitudes, the random shocks affecting clamping stagnation can be classified into three zones with different effects on the clamping stagnation. In other words, the sliding spool is subject to zone shocks.

Figure 2

 2 Figure 2 Two failure mechanisms leading to clamping stagnation[START_REF]Research on mechanism of contaminant lock for hydraulic valve[END_REF]

Figure 3

 3 Figure 3 Soft failures due to degradation and hard failures due to random shocks

Proposition 1 : 2 Nt

 12 The number of shocks falling into damage and fatal zones, denoted by can be derived:

n

  need to be set. The values of M and n determine the accuracy of the reliability estimation at each time point t . Therefore, they should be determined based on the requirements on the confidence bands. It is well known that the error of Monte Carlo simulation is proportional to 1 Mn  . Therefore, the appropriate sample sizes could be determined by trial-and-error: determine an initial sample size and check if the confidence band satisfies the requirement; then, adjust the sample sizes based on the proportional relation between sample sizes and simulation errors. The value of t n , reflects the closeness of the point wise approximation values of the reliability function, output by the algorithm, to the true values: the larger t n , the better the approximation. Proper balance is needed between the accuracy of the approximation and the computational complexity of the algorithm.

  the shock belongs to the safety zone, where C is the clearance of the sliding spool and C  is the critical particle size. The probabilities that the i th shock belongs to the damage, fatal and safety zones, denoted by 1

Figure 4

 4 Figure 4 Reliability under different values of the dependence factor, a 



  the mean of the debris size distribution the degradation rate, i.e., the  in[START_REF] Barata | Simulation modelling of repairable multi-component deteriorating systems for 'on condition' maintenance optimisation[END_REF], depends on the current cumulative shock damage W is the dependence factor.

4 10 ) 10 

 1010 is used to investigate the effect of , bc  and d  on the spool valve's reliability. The detailed procedures are given in the Appendix. As shown in Figure 5, when b , the predicted reliability decreases significantly. This can be explained by the fact that b  measures the effect of cumulative shock damage W

Figure 5  varies from 0 to 3 10

 53 Figure 5 Effect and sensitivity of

Figure 6  varies from 0 to 3 10

 63 Figure 6 Effect and sensitivity of

Figure 7

 7 Figure 7 Effect and sensitivity of

  The developed model contributes to existing ones in two aspects. First, it considers a new type of dependence, the degradation-shock dependence, where random shocks are influenced by degradation processes. Second, it combines zone shocks into the degradation-shock dependence, where random shocks are classified into different zones according to their magnitudes and different zones have different effects on the failure behavior. The developed model is applied to describe the dependent failure behavior of an actual product, a sliding spool, which is subject to wear and clamping stagnation.

  2, clamping stagnation is modeled by the zone shocks discussed in Sect. 3.2. The arrival of the particles is assumed to follow a nonhomogeneous Poisson process with intensity function () t

			 . The
	size of the i th particle getting into the clearance of the sliding spool, denoted by	Y , is assumed to be an i.i.d. random
			i
	variable with a probability distribution	Y fy . Based on the failure mechanisms of clamping stagnation discussed  
	in Figure 2,
	 if	i C CY   , the shock belongs to the fatal zone; C

i Y is classified into three zones according to its magnitude:

 if i YC  ,

the shock belongs to the damage zone;

Table 1

 1 Model parameters of the reliability model for the sliding spool

	Parameter/distribution	Description							Values
		The initial wear magnitude	0 mm
		The wear rate						N(1 × 10 -4 , 1 × 10 -5 ) mm/s
	D	The wear threshold					5 mm
	  Fy Y	The CDF for particle diameters	N(1.2, 0.2)
		The shock damage proportional coefficient	1
	H	The cumulative clamping stagnation threshold 7.5 mm
	[] , C C c 	The range for fatal shocks	[1.5,1.6]mm
	0 	The initial intensity of random shocks	2.5 × 10 -5 /s
	Parameters for simulation	n		1000,	M		200,	t n		1000,	t		4  0,6 10  	s
	Dependence factors		a		5 0,10 ,10 ,10 4  		3

Appendix 1

 1 Algorithm 2 Monte Carlo simulation for DCFP model considering multiple dependences in Sect. 4.4

	Step 1: Set samplesize,	i			0,	x		0 ,		W		0 ,  	0	;
	Step 2: If	i 	samplesize	, stop;
	else generate a		s  from	F  ;
	Step 3: Update the intensity function		 tx 0 () a    			  db  Wt       s   	W  ;
	Generate an arrival time   from a NHPP with intensity function () t 	using thinning method [51]:
		Set max T ; Calculate	M  	max () T ;	tt  	;
		While 1
						Generate a random number from exp( );  	tt		tt	  	;
																		M
						If		tt		max T	,			acc p		M  ) (/ tt	;	Accept   with probability	acc p ; Return	=tt   ;
						Else		tt		max T	; Increase the value of max T ; Calculate	M  	max () T ; Continue;
		Endwhile
	     ; 
	Step 4:	x		 x   s    d			W		 	;
	If	xD  ,		   i  1, f ii t 	D		x	  /	s  		d			W				, go to Step 2;
	Else go to Step 5;
	Step 5:	0 Y    Y    ; c x
	Generate		Y	2 ~( , ) Normal  ;
																		YY
	If	YC  , go to Step 6;
	Else if		Y	C   , C		i i  	1,	f t i     , go to Step 2;
	Step 6:	WW    	Y		;
	If		W		H		,	i i  	1,	f t i     , go to Step 2;
	Else go to Step 3;

Acknowledgement

This work was supported by the National Natural Science Foundation of China [grant numbers 61573043, 71231001]. The participation of Mengfei Fan to this research is supported by the China Scholarship Council (No. 201606020082). In addition, the authors would like to thank Mr. Wenshan Wang of AVIC Qingan Group Company for his insightful comments and great help to the present research.


Mengfei Fan

Zhiguo Zeng
email: zhiguo.zeng@centralesupelec.fr

Enrico Zio

Rui Kang

Ying Chen

Rk

A stochastic

published or not. The documents may come

Introduction

Failure of industrial components, systems and products may be caused by multiple failure processes, e.g. wear, corrosion, erosion, creep, fatigue, etc. [START_REF] Jiang | Modeling zoned shock effects on stochastic degradation in dependent failure processes[END_REF]. In general, the failure processes are categorized as degradation processes (or soft failures) and catastrophic failure processes (or hard failures) [START_REF] Li | Reliability modeling of multi-state degraded systems with multi-competing failures and random shocks[END_REF]. Soft failure is caused by continuous degradation and is often modeled by a continuous-state random process, e.g., Wiener process [START_REF] Guo | A maintenance optimization model for mission-oriented systems based on Wiener degradation[END_REF][START_REF] Wang | A model for residual life prediction based on Brownian motion with an adaptive drift[END_REF], Gamma process [START_REF] Lawless | Covariates and Random Effects in a Gamma Process Model with Application to Degradation and Failure[END_REF][START_REF] Kuniewski | Sampling inspection for the evaluation of timedependent reliability of deteriorating systems under imperfect defect detection[END_REF][START_REF] Castro | Age-based preventive maintenance for passive components submitted to stress corrosion cracking[END_REF], inverse Gaussian process [START_REF] Pan | Remaining useful life estimation using an inverse Gaussian degradation model[END_REF][START_REF] Peng | Leveraging Degradation Testing and Condition Monitoring for Field Reliability Analysis With Time-Varying Operating Missions[END_REF][START_REF] Ye | The Inverse Gaussian Process as a Degradation Model[END_REF], continuous-time semi Markov process [START_REF] Lin | Integrating Random Shocks Into Multi-State Physics Models of Degradation Processes for Component Reliability Assessment[END_REF], etc. Hard failure is caused by traumatic shocks in various patterns and is often modeled by a discrete-state random process, e.g., Homogeneous

Poisson Process (HPP) [START_REF] Lin | Integrating Random Shocks Into Multi-State Physics Models of Degradation Processes for Component Reliability Assessment[END_REF][START_REF] Lemoine | On failure modeling[END_REF][START_REF] Klutke | The availability of inspected systems subject to shocks and graceful degradation[END_REF], Nonhomogeneous Poisson Process (NHPP) [START_REF] Huynh | A periodic inspection and replacement policy for systems subject to competing failure modes due to degradation and traumatic events[END_REF][START_REF] Huynh | Modeling age-based maintenance strategies with minimal repairs for systems subject to competing failure modes due to degradation and shocks[END_REF][START_REF] Fan | Reliability modeling of a spool valve considering dependencies among failure mechanisms[END_REF], etc. Often, complex dependencies exist among the failure processes [START_REF] Zeng | Using PoF models to predict system reliability considering failure collaboration[END_REF]. For example, [START_REF] Jin | Physics of failure-based degradation modeling and lifetime prediction of the momentum wheel in a dynamic covariate environment[END_REF] presents experimental data to show that erosion and corrosion can enhance each other and therefore accelerate the failure process. Also, it is observed in [START_REF] Mcpherson | Reliability physics and engineering: time-to-failure modeling[END_REF] that the dependency between creep and fatigue severely reduces the Time-To-Failure (TTF) of the specimens that are exposed to high temperatures and heavy loads. To accurately describe the failure behavior affected by multiple failure processes, the possible dependencies among the failure processes need to be properly addressed.

In literature, various methods have been developed to model the dependencies among degradation processes and random shocks. Peng et al. [START_REF] Peng | Reliability and maintenance modeling for systems subject to multiple dependent competing failure processes[END_REF] develop a dependency model where the arrived shocks lead to an abrupt increase of the degradation process. Wang and Pham [START_REF] Wang | A Multi-Objective Optimization of Imperfect Preventive Maintenance Policy for Dependent Competing Risk Systems With Hidden Failure[END_REF] investigate systems subject to dependent competing risk, which suffer failures due to degradations and random shocks: the model is proposed of shocks that can cause immediate failure of the system, with a time-dependent probability   pt , or can increase the degradation level with probability   1 pt  . Cha and Finklstein [START_REF] Cha | On new classes of extreme shock models and some generalizations[END_REF] assume that a shock can lead to a hard failure with probability   pt , or can increase the degradation rate with probability  

1 pt 
. Jiang et al. [START_REF] Jiang | Reliability and Maintenance Modeling for Dependent Competing Failure Processes With Shifting Failure Thresholds[END_REF] develop a model that considers that the threshold of hard failures can be shifted by random shocks. Rafiee et al. [START_REF] Rafiee | Reliability modeling for dependent competing failure processes with changing degradation rate[END_REF] consider that the degradation rate is increased by a series of shocks. Jiang et al. [START_REF] Jiang | Modeling zoned shock effects on stochastic degradation in dependent failure processes[END_REF] categorize shocks into different shock zones based on their magnitudes and consider that shocks in different zones have different effects on the degradation process. Bagdonavicius et al. [START_REF] Bagdonavicius | Statistical analysis of linear degradation and failure time data with multiple failure modes[END_REF], Fan et al. [START_REF] Fan | Multicomponent lifetime distributions in the presence of ageing[END_REF] and Ye et al. [START_REF] Ye | A Distribution-Based Systems Reliability Model Under Extreme Shocks and Natural Degradation[END_REF] develop models that consider that the probability of hard failures is increased as the degradation process progresses. Huynh et al. [START_REF] Huynh | A periodic inspection and replacement policy for systems subject to competing failure modes due to degradation and traumatic events[END_REF][START_REF] Huynh | Modeling age-based maintenance strategies with minimal repairs for systems subject to competing failure modes due to degradation and shocks[END_REF] investigate maintenance strategies for a dependence model, where the intensity of the NHPP for random shock is a piecewise function of the degradation magnitude. Fan et al. [START_REF] Fan | Reliability modeling of a spool valve considering dependencies among failure mechanisms[END_REF] present a reliability model for sliding spools considering that the intensity of the NHPP describing the random shock process is a linear function of the degradation level.

For models that consider the dependencies between degradation and random shock processes, like these above, it is often too complicated, if not intractable, to evaluate system reliability analytically. Then, simulation methods, such as Monte Carlo methods [START_REF] Zio | The Monte Carlo Simulation Method for System Reliability and Risk Analysis[END_REF], are used, often with limitations due to heavy computational burden. In this respect, Stochastic Hybrid Systems (SHS) [START_REF] Pola | Stochastic hybrid models: An overview[END_REF] offer a new way to model the stochastic behavior of systems that involve both discrete and continuous states [START_REF] Abate | Probabilistic reachability and safety for controlled discrete time stochastic hybrid systems[END_REF][START_REF] Yang | Almost sure state estimation with -type performance constraints for nonlinear hybrid stochastic systems[END_REF][START_REF] Teel | Stability analysis for stochastic hybrid systems: A survey[END_REF][START_REF] Dhople | A Stochastic Hybrid Systems framework for analysis of Markov reward models[END_REF]. SHS describe the system's behavior by a set of differential equations and therefore, whose solution avoids the computational burdens of simulation methods. Various forms of SHS exist in literature (see Pola et al. [START_REF] Pola | Stochastic hybrid models: An overview[END_REF] for a comparison). In this paper, we adopt the models recently developed by Hespanha in [START_REF] Hespanha | Stochastic Hybrid Systems: Application to Communication Networks[END_REF][START_REF] Hespanha | A model for stochastic hybrid systems with application to communication networks[END_REF][START_REF] Hespanha | Modelling and analysis of stochastic hybrid systems[END_REF], which is similar to the Piecewise Deterministic Markov Process (PDMP) [START_REF] Lin | Fuzzy Reliability Assessment of Systems With Multiple-Dependent Competing Degradation Processes[END_REF] but differs from it in that the continuous state variable follow Stochastic Differential Equations (SDEs), rather than Ordinary differential equations (ODEs). To the best of our knowledge, it is the first attempt to use SHS for modeling dependent failure processes.

It should be mentioned that SHS is similar to Stochastic Hybrid Automata (SHA), which is also applied in Dynamic Reliability (DR) assessment or Dynamic Probabilistic Risk Assessment (DPRA) [START_REF] Castañeda | Stochastic hybrid automata model for dynamic reliability assessment[END_REF][START_REF] Chiacchio | Stochastic hybrid automaton model of a multi-state system with aging: Reliability assessment and design consequences[END_REF]. Both methods model dynamic hybrid system behaviors that involve stochastic factors. SHA introduces less assumptions than SHS and resorts to Monte Carlo simulation for the calculations [START_REF] Siu | Risk assessment for dynamic systems: An overview[END_REF][START_REF] Labeau | Dynamic reliability: towards an integrated platform for probabilistic risk assessment[END_REF]; SHS, on the other hand, is able to describe the hybrid dynamics analytically or semi-analytically, by solving a set of Differential Equations (DEs) on the expense of introducing more assumptions [START_REF] Hespanha | Modelling and analysis of stochastic hybrid systems[END_REF]. The computational cost of SHS is, in general, less than that of SHA, but on the expense of more assumptions in particular with respect to the degradation models, whereby epistemic uncertainty (specifically model uncertainty) [START_REF] Nilsen | Models and model uncertainty in the context of risk analysis[END_REF][START_REF] Bjerga | An illustration of the use of an approach for treating model uncertainties in risk assessment[END_REF][START_REF] Kang | Measuring reliability under epistemic uncertainty: Review on nonprobabilistic reliability metrics[END_REF] is introduced. When applying the SHS in practice, then, care should be taken to ensure that the assumptions are consistent with the actual situation, in particular in case of systems characterized by complex and numerous dependencies among physical processes and failure behaviors. In this paper, we choose SHS because the type of dependent degradation and shock processes allows for modeling by SHS and, in general, SHS has a better computational performance than SHA.

Methods

SHS model

The state space of a SHS model is a combination of discrete and continuous states. Let us denote the discrete states by     , q t q t Q  , where Q is a finite set containing all the possible discrete modes of the system. The continuous states are denoted by     , l x t x t  . A SHS model is defined based on the following assumptions [34- 36]:

(1) The evolution of the continuous states is governed by a set of SDEs:

              , , , t dx t f q t x t dt g q t x t dw  (1)
where :

k t w   is a k-dimensional
      ,, q t x t it undergoes a transition with a rate       , : , l ij q t x t Q    , ij Q  .
That is, the probability that the system undergoes a transition from state i to state j within the interval  

, t t t  is:         ,, ij q t x t t o t     (2)
(3) Whenever the system undergoes a state transition from state i to state j , it instantaneously applies the map

      , ij q t x t  to the current values of   qt and  
xt , so that their values are reset:

            ,, ij q t x t q t x t    , (3)
where the notation   at  represents the left-hand limit of the function a at time t .

SHS formulism for dependent failure processes

The modeling framework for dependent failure processes involves three elements, i.e., a model for the degradation process, a model for the shock process and a model for the dependency between the two processes. The following assumptions are made in order to model a dependent failure process in the framework of SHS:

Assumption Given a dependent failure process, the following steps show how to model it in the framework of SHS:

Step 1: Modeling degradation. In this step, the performance parameters  

xt are identified to characterize the degradation processes. For the performance parameters, the SDEs in (1) are developed to describe their degradation, considering both deterministic and stochastic characteristics. The deterministic characteristics are often described based on the physical knowledge on the degradation processes (e.g., using the Physics-of-Failure (PoF) models [START_REF] Mcpherson | Reliability physics and engineering: time-to-failure modeling[END_REF]), while the stochastic characteristics are modeled by a Wiener process, as shown in (1).

Step 2: Modeling random shocks. In SHS, random shocks are considered as transitions among the system health states. The transition rates,

      , ij q t x t  , ,, i j Q 
need to be determined based on historical data or expert judgments.

Step 3: Modeling dependencies. Finally, the dependencies between the degradation processes and random shocks need to be considered. The dependencies can be modeled in various ways in SHS. For instance, by resetting the values for  , Note that in order to make sure that the developed SHS model is solvable in case that truncations techniques [START_REF] Hespanha | Modelling and analysis of stochastic hybrid systems[END_REF] are needed, for example Case 3 in this paper, the , , , , ,

i i ij ij f g i j Q   in the SHS model have to be polynomial functions of   xt .

Conditional moments estimation

In this section, we derive the conditional expectations for the continuous state variables, i.e.,

    , , 1, 2, |, , p j E x t q t i p l i Qj       
, where

  j xt represent the j th element of   xt .
The conditional expectations will be used in the next section for reliability analysis. Let us define a test function to be

    ,, 0 m m i x q i qx qi        (
                :, Pr . mm ii m t E q x E x t q t i q t i           (6)
For a general test function

      ,, q t x t  :, l Q  
which is twice continuously differentiable with respect to x , the evolution of its expected value is governed by Dynkin's formula [START_REF] Hespanha | Modelling and analysis of stochastic hybrid systems[END_REF]:

              , , dE q t x t E L q t x t dt        , (7)
where   

, L q x 
is the extended generator of SHS and  

, l q x Q    ,    , L q x  is given by                        2 2 , , , : , , 1 ,, 2 , , ,
,

ij ij i j Q qx L q x f q x x qx trace g q x g q x x q x q x q x                      (8)
where x   and 22

x   denote the gradient and Hessian matrix of   , qx  with respect to x , respectively;   trace A is the trace of the matrix A , i.e., the sum of elements on its main diagonal.

Substituting ( 5) into ( 7), we get a group of differential equations with respect to    ,,

m l i t i Q m   :               ,. mm ii d t E L q t x t dt     (9)
The evolution of     m i t  can be depicted by solving [START_REF] Peng | Leveraging Degradation Testing and Condition Monitoring for Field Reliability Analysis With Time-Varying Operating Missions[END_REF]. The conditional moments can, then, be obtained by assigning proper values for m : if we let

  0,0,...,0 , m  we have         0,0,...,0 Pr , . i t q t i i Q     (10)
If we let

    12 i ,, , , : f 1, 2, , , f, 0, , i j j l m p j l kk mm j m m k m          
where j m denotes the j th element in m and p is a natural number, we have

            Pr , . m p ik t E x t q t i q t i i Q         (11)
The conditional expectations,

    , , 1, 2, |, , p j E x t q t i p l i Qj       
, can, then, be calculated by combining [START_REF] Ye | The Inverse Gaussian Process as a Degradation Model[END_REF] and [START_REF] Lin | Integrating Random Shocks Into Multi-State Physics Models of Degradation Processes for Component Reliability Assessment[END_REF].

Reliability analysis

From Assumption 6, system reliability can be expressed as:

            1 1 2 2 Pr , , . , , ll R t q t n x t H x t H x t H      (12)
From the law of total probability, we have

                          1 1 2 2 1 1 1 2 2 1 , Pr , , , , Pr Pr , ,
.

n ll ll i R t q t n x t H x t H q t i x t H x t H x t H x t H q t i                (13)
Since we assume that the degradation processes are independent from one another, (13) becomes

            1 1 1 Pr Pr l n jj i j R t x t H q t i q t i              (14)
In ( 14),  

 

Pr q t i  can be calculated by [START_REF] Ye | The Inverse Gaussian Process as a Degradation Model[END_REF],

      Pr 1, 2, , 1, 1, 2, , jj x t H q t i i n j l     , can,
instead, be approximated using the First Order Second Moment (FOSM) method [START_REF] Zhao | Moment methods for structural reliability[END_REF], since we have the conditional moments for  .

j xt Let   j x q i t   and   j x q i t  
denote the expected value and standard deviation of the random variable   j xt conditioned on qi  , respectively. Then,

  j x q i t   and   j x q i t   can be calculated by                                                         ,,
,, 0,0,...,0 2 2 2 0,0,...,0 0,0,...,0

ˆ, Pr ˆ, 1, 2,..., 1 , jj j j jj mm ii j x q i i jj x q i mm ii ii tt t E x t q t i q t i t t E x t q t i E x t q t i tt in tt                               (15)
where *, j m and **, j m are given by

    , 12 , 12
= , , , :

; 0, if . j l k k j l k k m m m m m k j m k j m m m m m k j m k j            1, if ; 0, if , , , , : 2, if
Based on FOSM [START_REF] Zhao | Moment methods for structural reliability[END_REF],

      Pr jj x t H q t i  can be approximated by           Pr . ˆj j j x q i jj x q i Ht x t H q t i t              (17)
Substituting ( 17) into ( 14), the reliability of the system is approximated by

            1 0,0,...,0 1 1 ˆ, ˆj j l n j x q i ei i j x q i Ht R t R t t t                        (18)
where

  ˆj x q i t   ,   ˆj x q i t  
are calculated by [START_REF] Huynh | Modeling age-based maintenance strategies with minimal repairs for systems subject to competing failure modes due to degradation and shocks[END_REF].

The accuracy of the approximation by FOSM relies on the normality assumption: the random variables

    1, 2,..., 1, 1, 2 | ,, , j n x t q i jl ti    
are normally distributed with mean value

  j x q i t   and standard deviation   j x q i t  
. In practice, the assumption does not always hold. Therefore, we also present an estimation method for the lower bound of the system reliability, using Markov inequality.

According to Markov inequality [START_REF] Pishro-Nik | Introduction to Probability, Statistics, and Random Processes[END_REF], if X is a nonnegative random variable and 0 a  , then

    Pr . EX Xa a  (19)
Using [START_REF] Mcpherson | Reliability physics and engineering: time-to-failure modeling[END_REF], we obtain

            Pr , 1, 2,..., , 1, 2,
..., 1 .

j jj j E x t q i x t H q i j l i n H        (20)
From ( 14) and ( 20), the lower bound of system reliability can, then, be derived: 1,

                                                  , , 1 1 1 1
1 j j l n jj i j l n jj i j l n j i j j m l n i i i j j m l i li i j j R t q t i x t H q t i q t i x t H q t i E x t q t i q t i H t t H t R t t H                                                                 1 1 , n   (21)
where *, j m has the same meaning as in (16).

Results and Discussion

Case 1

System description

The first case study to demonstrate the developed framework is adapted from [START_REF] Peng | Reliability and maintenance modeling for systems subject to multiple dependent competing failure processes[END_REF]. A MEMS device is subject to two dependent failure processes, i.e., soft failures caused by wear and debris from shock loads, and hard failures due to spring fracture caused by shock loads [START_REF] Peng | Reliability and maintenance modeling for systems subject to multiple dependent competing failure processes[END_REF]. The soft failure is modeled by a continuous degradation process and the hard failure is modeled by a random shock process. Dependence exists among the two processes: the arrival of a shock brings an additional contribution to the degradation process. Failures occur whenever one of the following two events happens:

 the degradation process reaches its threshold, denoted by ; H  a shock whose magnitude exceeds a critical level, denoted by , D occurs.

Additional assumptions include:

(1) The continuous degradation process follows an SDE.

   

,,

t dx t dt dw x t      (22)
where t w  is a standard Wiener process, ,   are constants and the initial degradation level at t = 0 is null.

(2) The random shock process is a HPP with intensity . 

SHS formulation

A SHS model is constructed in Fig 2 to describe the behavior of the system. The system has two health states,

    1, 2 . qt When   1
qt  , the system is subject to the degradation process according to [START_REF] Cha | On new classes of extreme shock models and some generalizations[END_REF]. When   2 qt  , the system fails due to hard failure and the degradation level is set to zero, i.e.   0 xt  .

0 2. W W W W D q q q D q q q                                        (23)         11 12
, : 1, , , : 2,0 .

q x x d qx     (24)
In [START_REF] Rafiee | Reliability modeling for dependent competing failure processes with changing degradation rate[END_REF], the reset map  

11

, qx  models the dependency in Assumption (4).

Reliability analysis

We define the test functions

      , , 1, 2 ,
,

m i q x i m   to be:         1 0 2 1 , 0 1, 12 , 0 2. m m xq qx q q qx q               (25) Since   0 xt  when   2
qt  , we only consider the 0-order conditional moment of the degradation at state 2 , i.e.     0 2

, qx



. By substituting (22)(23)( 24) into (8), the extended generator of the SHS model is:

                                                  2 11 2 1 2 10 11 1 1 11 12 1 0 0 2 12 1
,,

m m q x q x L q x xx q q x d q x q q q x L q x q q x                       1 , 2 ,, ,, , , . mm m
According to ( 7) and ( 26), the differential equations governing the conditional moments are:

                                  12 2 1 1 1 11 1 11 12 1 0 00 2 12 1 1 1 2 , , m m m m m k m k k d t m t m m t dt m t E d t k d tt dt                                (27)
where    

2 2 2
, [START_REF] Ye | A Distribution-Based Systems Reliability Model Under Extreme Shocks and Natural Degradation[END_REF], we can obtain the following set of differential equations:

d d d E d E d       . From
              00
                                                         (28)
Since the system must belong to one of the two health modes, it is obvious that

        00 12
1. tt   [START_REF] Pola | Stochastic hybrid models: An overview[END_REF] From ( 18) and ( 21), the estimated system reliability   e Rt and the lower bound

  l Rt are calculated by                                 10 0 11 1 2 2 0 1 0 1 1 1 1 , e H t t R t t t t t t                 (30)           1 0 1 1 1, l t R t t H          (31)
where the conditional moments

            0 1 2 1 1 1 ,, t t t   
are obtained by solving the differential equations in [START_REF] Zio | The Monte Carlo Simulation Method for System Reliability and Risk Analysis[END_REF] and ( 29).

Numerical calculation

A numerical example is conducted with the parameters in Table 1, taken from [START_REF] Peng | Reliability and maintenance modeling for systems subject to multiple dependent competing failure processes[END_REF]. To solve the differential equations in ( 28) and ( 29), the solver based on Runge Kutta method in Matlab R2013a is used. In [START_REF] Peng | Reliability and maintenance modeling for systems subject to multiple dependent competing failure processes[END_REF], the original

      0 1 Pr 2 qt   . (B)
Comparison on the order 1 moment:

           
           

Case 2 System description

The second case study to demonstrate the developed framework is adapted from [START_REF] Rafiee | Reliability modeling for dependent competing failure processes with changing degradation rate[END_REF]. A MEMS device is subject to two dependent failure processes, i.e., soft failures and hard failures. The soft failure is modeled by a continuous degradation process and the hard failure is modeled by a random shock process. Dependences between the two failure processes exist in the following two aspects: (1) the arrival of each shock brings a degradation increment;

(2) the degradation rate increases when the system undergoes a series of shocks. The second type of dependence has been investigated based on four different shock models in [START_REF] Rafiee | Reliability modeling for dependent competing failure processes with changing degradation rate[END_REF]: extreme shock,  shock, m shock, and run shock models. In this section, we apply our framework by considering the first dependence and the second dependence triggered by the extreme shock model. Failure occurs whenever one of the following two events happens:

 the degradation process reaches its threshold, denoted by H ;

 a shock whose magnitude exceeds a critical level, denoted by 1 D , occurs.

Additional assumptions include:

(1) Random shocks arrive according to a HPP with intensity  .

(

SHS formulation

The SHS concerning this case is described by the state-transition diagram in Fig 4 . The system has three health states,     1, 2,3 . qt When   1 qt  , the system is subject to the degradation at a low-level degradation rate. By contrast, when   2, qt 

the system degrades at a high-level degradation rate. System's degradation under the first two health states evolves according to the following SDEs:

        11 22 if 1 ,. if 2 t t dt dw q t dx t x t dt dw q t              (33) When   3,

Pq q q

Pq q q Pq q q P P q q q Pq q q , : 3, 0 ,

                                           (34)                    
q x x d q x x d qx q x x d qx           ( 35
)
where 1 2 3 ,, P P P are calculated by

0 1 0 1 1 2 3 , , 1
.

W W W W W W W W D D D D P P P                                              (36)
In [START_REF] Hespanha | A model for stochastic hybrid systems with application to communication networks[END_REF], the reset maps

    11 22
, , , q x q x  model the dependency in assumption (3) and the change of system degradation rate along with the transition from health state 1 q  to health state 2 q  model the dependency in assumption (4).

Reliability analysis

We define the test functions       , , 1, 2,3 , ,

m i q x i m   to be:             1 2 0 3 1, , 0 1, 2, , 0 2, 1 3, , 0 3. m m m m xq qx q xq qx q q qx q                      (37) Since   0 xt  when   3
qt  , we only consider the 0-order conditional moment of the degradation at state 3 , i.e.

    0 3 , qx



. By substituting (33)(34)( 35) into ( 8), the extended generator of the SHS is: ,,

                                                                                         
m mm m m m m q x q x L q x q x d q x xx qx q x q x L q x q x d q x xx q x d q x q x L q x q x q x                                                          1 , , , 2 ,, ,, 1 , , , 2 , , , , , , , . mm m m
According to [START_REF] Castro | Age-based preventive maintenance for passive components submitted to stress corrosion cracking[END_REF] and [START_REF] Castañeda | Stochastic hybrid automata model for dynamic reliability assessment[END_REF], the differential equations governing the conditional moments are:

                                                          11 22 12 2 1 1 1 11 1 11 12 13 1 0 12 2 2 2 2 22 2 0 12 1 22 23 2 0 1 1 2 , 1 1 2 , m m m m m k m k k m m m m m k k k m m k m k k d t m t m m t dt m t E d t k m d t m t m m t t E d k dt m t E d t k d dt                                                                                   0 0 0 3 13 1 23 2 , t t t      (39)
where     [START_REF] Chiacchio | Stochastic hybrid automaton model of a multi-state system with aging: Reliability assessment and design consequences[END_REF], we can obtain the following set of differential equations:

2 2 2 , d d d E d E d       . From
                  1
0 0 0 0 0 0 0 0 0 0 0 0 0 00 0 2 2 0 0 2 2 2 d dd d d d d d d d d d                                                                                        0 1 0 2 1 1 1 2 2 1 2 3 2 .                             (40)
Since the system must belong to one of the three health modes, it is clear that

            000 1 2 3 1. ttt     (41)
From ( 18) and ( 21), the estimated system reliability   e Rt and the lower boundary

  l Rt are calculated by                                 10 2 0 2 2 0 1 0 1 , ii ei i i i i i H t t R t t t t t t                   (42)           1 2 0 1 1. i li i t R t t H            (43)
where the conditional moments

                        0 1 2 0 1 2 1 1 1 2 2 2 , , , , , t t

Numerical calculation

A numerical example is conducted using the parameters in Table 2, taken from [START_REF] Rafiee | Reliability modeling for dependent competing failure processes with changing degradation rate[END_REF]. To solve the differential equations ( 40) and ( 41), the solver based on Runge Kutta method in Matlab R2013a is used. In [START_REF] Rafiee | Reliability modeling for dependent competing failure processes with changing degradation rate[END_REF], the original model is simulated by Monte Carlo to compute system reliability. A comparison is made between the results obtained by the developed methods in this paper and those obtained by Monte Carlo simulation. The sample size of the Monte Carlo simulation is Comparison on the order 0 moment:

         
                111 1 2 3 E x t t t t     . (C)
Comparison on the order 2 moment:

               

Case 3

System descriptions

The third case study to demonstrate the developed framework is adapted from [START_REF] Bagdonavicius | Statistical analysis of linear degradation and failure time data with multiple failure modes[END_REF]. The failure behavior of bus tires is modeled by two dependent failure processes, i.e. soft failures caused by wear and hard failures of seven modes due to traumatic shocks. The soft failure is modeled by a continuous degradation process and the hard failure is modeled by a random shock process. Dependence exists among the two processes, that is, the probability that a traumatic shock occurs depends on the degradation level. Failures occur whenever one of the following two events happens:

 the degradation process reaches its threshold, denoted by ; H  a traumatic shock following a Cox process [START_REF] Lando | On cox processes and credit risky securities[END_REF] with intensity   x  occurs.

Additional assumptions include:

(1) The continuous degradation process is modeled by an SDE.

SHS formulation

A SHS model is constructed in Fig 6 to describe the behavior of the system. The system has two health states,

    1, 2 . qt When   1
qt  , the system is subject to the degradation process and degrades according to [START_REF] Kang | Measuring reliability under epistemic uncertainty: Review on nonprobabilistic reliability metrics[END_REF]. When   2 qt  , the system fails due to a hard failure, and the degradation level is set to zero, i.e.   0 xt  . As shown in Fig 6, the initial state of the system is state 1. The transition rates and reset maps of the SHS are defined as follows:

  12 1, ,: 0 1, xq qx q         (46)     12 , : 2,0 . qx   (47)

Reliability analysis

We define the test functions

      , , 1, 2 ,
,

m i q x i m   to be:         1 0 2 1, , 0 1, 1 2, , 0 2. m m xq qx q q qx q               (48) Since   0 xt  when   2
qt  , we only consider the 0-order conditional moment of the degradation at state 2, i.e.

                                2 11 2 11 2 0 0 21 ,, 1 , , , 2 ,
, .

mm m m q x q x L q x x q x xx L q x x q x                       (49)
According to [START_REF] Castro | Age-based preventive maintenance for passive components submitted to stress corrosion cracking[END_REF] and (49), the differential equations governing the conditional moments are:

                                  1 2 1 2 1 1 1 1 1 0 0 1 2 1 1 1 1, 2 . m m m m m d t m t m m t t t dt d t t t dt                     (50)
From (50), we can obtain the following set of differential equations:

              00 11 1 1 3 1 1 1 2 22 11 00 0. 2                                                         (51)
Since the system must belong to one of the two health modes, it is obvious that

        00 12 1. tt   (52)
Unlike the differential equations obtained in case 1 and case 2, the dynamics of

      0 1 2 1 1 1 ,,    in this case is related to a high-order conditional moment   3 1
 , so that (51) cannot be solved directly. To deal with this situation, an approximate truncation method is developed in [START_REF] Hespanha | Modelling and analysis of stochastic hybrid systems[END_REF] to provide an approximate function of the involved high-order conditional moments using the low-order conditional moments. Adopting the truncation method, we have the approximate function of   3 1  in the following form:

                    3 02 11 3 0 1 2 1 1 1 1 3 1 1 , , .          (53)
Thus, (51) is approximated by:

                      00 3 02 11 11 11 11 3 1 2 22 1 11 00 0. 2                                                           (54)
From ( 18) and ( 21), the estimated system reliability

                                10 0 11 1 2 2 0 1 0 1 1 1 1 , e H t t R t t t t t t                 (55)           1 0 1 1 1. l t R t t H          (56)
where the conditional moments

            0 1 2 1 1 1 ,, t t t   
are obtained by solving the differential equations ( 52) and (54).

Numerical calculation

A numerical example is conducted using the parameters in Table 3, assumed arbitrarily by hypothesis for the purpose of illustration. To solve the differential equations in ( 52) and ( 54), the solver based on Runge Kutta method in Matlab 2013a is used. On the other hand, based on the properties of Cox process, the conditional moments can also be written as ( 57)-(58) below: Comparison on the estimated reliability and lower bound for reliability.

                                                  0 1 0 0 1 1 0 0 2 2

Conclusions

In this paper, a SHS-based modeling framework is developed for the reliability modeling and analysis of dependent failure processes, where degradation processes and random shock processes compete to cause system failure and dependencies exist among these processes. In the developed model, the degradation process is modeled by SDEs and the shock process is characterized by transitions among the system health states. The dependencies among the two processes are modeled within the structure of the SHS model by the reset map, transition rates etc.

The conditional moments for the state variables in the developed SHS model are calculated by deriving and solving a set of differential equations based on Dynkin's formula. Using these conditional moments, a reliability analysis method is developed to estimate the system reliability and its lower bound. Three case studies are conducted to demonstrate the developed methods. Comparisons to Monte Carlo simulations show that the developed method can achieve accurate reliability analysis results, while requiring much less computations than Monte Carlo simulations.

To apply the developed model in practice, the parameter values, such as the parameters in the SDEs that model the degradation processes, the transition rates that model the random shock processes, and the parameters in the reset maps that describe the dependency, need to be set based on historical data or expert judgments. Epistemic uncertainty might present when setting values for the parameters. Another source of epistemic (model) uncertainty is derived from the assumptions made for the present model. Treatment and calculation of epistemic uncertainty is an interesting

Fig 1

 1 Fig 1 depicts the state transition and evolution of the SHS.

Fig 1 .

 1 Fig 1. State-transition diagram for the SHS model

xt the reset map in ( 3 )

 3 can capture the influence of the random shock on the degradation process. Further, the functions , fg and even  itself, as shown in Fig 1, are dependent on the current values of   xt and   qt , which provides a versatile way to model the dependencies.

Fig 2 .

 2 Fig 2. State-transition diagram of the SHS for case 1

Fig 3 .

 3 Fig 3. Comparison of results for case 1. (A) Comparison on the order 0 moment:

  C) Comparison on the order 2 moment:

  D) Comparison on the estimated reliability and lower bound for reliability The comparisons show that the moments are accurately predicted by the SHS model. The estimated reliability by FOSM is consistent with the result by Monte Carlo simulation. The estimated lower bound provides a relatively conservative reliability estimation. The running time of Monte Carlo simulation is 5788.2 times more than that of the developed SHS-based approach.

  qt the system fails due to a hard failure and the degradation level is set to zero, i.e.   0 xt  .

Fig 4 .

 4 Fig 4. State-transition diagram for the SHS in case 2.

4 10 .Fig 5 .

 105 Fig 5. Comparison of results obtained by the SHS model and those by Monte Carlo simulation for case 2. (A)

  Comparison on the order 1 moment:

Fig 6 .

 6 Fig 6. State-transition diagram for the SHS in case 3.

3 10 . In Fig 7 (Fig 7 .

 377 Fig 7. Comparison of results obtained by the SHS model and those by analytic expressions for case 3. (A)Comparison on the order 0 moment:

  C) Comparison on the order 2 moment:           

  3) The magnitudes of shock loads, denoted by i W , are i.i.d. random variables following a normal distribution,

	 WN  . i W W  2 ,
	(4) The arrival of each shock brings a degradation increment , d which is a random variable following a normal
	distribution	2 ( , )

dd

dN

 .

  Comparison on the estimated reliability and lower bound for reliability. The comparisons show that the moments are accurately predicted by the SHS model. The estimated reliability by FOSM is consistent with the result by Monte Carlo simulation. The estimated lower bound provides a relatively conservative reliability estimation. Besides, the running time of Monte Carlo simulation is 1203.8 times more than that of the developed SHS-based approach.

	E	x	2	t		222 2 3 t t  1  	t	. (D)

Acknowledgements

This work has been performed within the initiative of the Center for Resilience and Safety of Critical Infrastructures (CRESCI, http://cresci.cn).

RK YC. : MF ZZ. Writingreview & editing: EZ. Supervision: RK EZ. Project Administration: YC. EZ YC.

problem that deserves further investigations.