Jinduo Xing
email: jinduo.xing@centralesupelec.fr

Zhiguo Zeng
email: zhiguo.zeng@centralesupelec.fr

Enrico Zio
email: enrico.zio@ecp.fr

A framework for dynamic risk assessment with condition monitoring data and inspection data

Keywords: Dynamic risk assessment (DRA), Condition monitoring data, Inspection data, Hidden Markov Gaussian Mixture model (

In this paper, a framework is proposed for integrating condition monitoring and inspection data in Dynamic Risk Assessment (DRA). Condition monitoring data are online-collected by sensors and indirectly relate to component degradation; inspection data are recorded in physical inspections that directly measure the component degradation. A Hidden Markov Gaussian Mixture Model (HM-GMM) is developed for modeling the condition monitoring data and a Bayesian network (BN) is developed to integrate the two data sources for DRA. Risk updating and prediction are exemplified on an Event Tree (ET) risk assessment model. A numerical case study and a real-world application on a Nuclear Power Plant (NPP) are performed to demonstrate the application of the proposed framework.

Acronyms

ATWS

Introduction

Probabilistic Risk Assessment (PRA) is widely applied to critical systems like space shuttles, nuclear power plants, etc [START_REF] Yang | Clarifying the concept of operational risk assessment in the oil and gas industry[END_REF]. Traditional PRA methods, like Event Tree Analysis (ETA) and Fault Tree Analysis (FTA), assume that the failure probabilities of the safety barriers are independent on time and their values are estimated based on statistical data [START_REF] Huang | A fuzzy set approach for event tree analysis[END_REF]. However, in practice, the safety barriers undergo degradation processes like wear [START_REF] Compare | Semi-Markov model for the oxidation degradation mechanism in gas turbine nozzles[END_REF], fatigue [START_REF] Chiachío | Condition-based prediction of time-dependent reliability in composites[END_REF],

crack growth [START_REF] Kim | Reliability data update using condition monitoring and prognostics in probabilistic safety assessment[END_REF], etc., which increase their failure probabilities with time. Furthermore, the operational and environmental conditions of the system change with time and can also lead to time-dependent failure probabilities of the safety barriers [START_REF] Di Maio | Condition-based probabilistic safety assessment of a spontaneous steam generator tube rupture accident scenario[END_REF][START_REF] Zhao | Reliability and maintenance policies for a two-stage shock model with self-healing mechanism[END_REF].

Safety barriers are the physical and/or non-physical means installed in the system of interest, aiming to prevent, control, or mitigate undesired events or accidents [START_REF] Sklet | Safety barriers: Definition, classification, and performance[END_REF], e.g., a sprinkler system in chemical industry [START_REF] Landucci | Quantitative assessment of safety barrier performance in the prevention of domino scenarios triggered by fire[END_REF], a reactor trip system in steam generator [START_REF] Kim | Failure rate updates using condition-based prognostics in probabilistic safety assessments[END_REF]. To account for the time-dependent failure behavior of safety barriers, Dynamic Risk Assessment (DRA) frameworks have been developed, which use data and information collected during the system life to update the estimated risk indexes [START_REF] Villa | Towards dynamic risk analysis: a review of the risk assessment approach and its limitations in the chemical process industry[END_REF]. Bayesian theory has been used to update the probabilities of the events in an ET [START_REF] Paltrinieri | Dynamic approach to risk management: application to the Hoeganaes metal dust accidents[END_REF][START_REF] Abimbola | Dynamic safety risk analysis of offshore drilling[END_REF]. Near miss and precursor data have been exploited in a hierarchical Bayesian model of DRA for the offshore industry [START_REF] Khakzad | On the application of near accident data to risk analysis of major accidents[END_REF][START_REF] Yang | Precursor-based hierarchical Bayesian approach for rare event frequency estimation: a case of oil spill accidents[END_REF]. A real-time DRA has been performed in [START_REF] Wang | Dynamic quantitative operational risk assessment of chemical processes[END_REF][START_REF] Hashemi | Loss functions and their applications in process safety assessment[END_REF], based on a dynamic loss function that considers multiple key state variables in the process industry. In [START_REF] Zarei | Dynamic safety assessment of natural gas stations using Bayesian network[END_REF], BN and Bow-tie model have been employed for the dynamic safety assessment of a natural gas station. A condition-based PRA has been performed in [START_REF] Di Maio | Condition-based probabilistic safety assessment of a spontaneous steam generator tube rupture accident scenario[END_REF] for a spontaneous steam generator tube rupture accident. A data-driven DRA model has been developed for offshore drilling operations, where real time operational data have been used to update the probability of the kick event [START_REF] Adedigba | Data-driven dynamic risk analysis of offshore drilling operations[END_REF]. In [START_REF] Zeng | Dynamic Risk Assessment Based on Statistical Failure Data and Condition-Monitoring Degradation Data[END_REF], statistical failure data and condition monitoring data have been integrated

in a hierarchical Bayesian model for DRA. DRA of an ET has been developed in [START_REF] Kim | Failure rate updates using condition-based prognostics in probabilistic safety assessments[END_REF] by using condition monitoring data to update the events probabilities.

In the existing methods, the data used for DRA can be broadly divided into two categories: statistical failure data and condition monitoring data. Statistical failure data refer to counts of accidents, incidents or near misses collected from similar systems [START_REF] Kalantarnia | Dynamic risk assessment using failure assessment and Bayesian theory[END_REF]. For instance, in [START_REF] Meel | Plant-specific dynamic failure assessment using Bayesian theory[END_REF] and [START_REF] Meel | Operational risk assessment of chemical industries by exploiting accident databases[END_REF], DRA has been performed using near misses and incident data from similar processes. In [START_REF] Khakzad | Dynamic risk analysis using bow-tie approach[END_REF], Bayesian theorem has been applied to update the failure probabilities of the safety barriers in a Bow-tie model for DRA. Statistical failure data are collected from a population of similar systems, which are seldom available in large number and this limits the application of the statistical failure data-based DRA methods in practice. Also, statistical data refer to a population of similar systems and do not necessarily capture the plant-specific features of the target system. To address these issues, condition monitoring data are often used in DRA. Condition monitoring data refer to the online monitoring data collected by sensors that are installed in the target system for monitoring the degradation process of the safety barrier. For example, a condition-based fault tree has been used for DRA, where the condition monitoring data have been used to update the failure rates of the specific components and predict the reliability [START_REF] Shalev | Condition-based fault tree analysis (CBFTA): A new method for improved fault tree analysis (FTA), reliability and safety calculations[END_REF][START_REF] Aizpurua | Improved dynamic dependability assessment through integration with prognostics[END_REF]. Particle filtering (PF) has been used

for DRA based on condition monitoring data from a nonlinear non-Gaussian process [START_REF] Zadakbar | Dynamic Risk Assessment of a Nonlinear Non-Gaussian System Using a Particle Filter and Detailed Consequence Analysis[END_REF]. In [START_REF] Liu | System dynamic reliability assessment and failure prognostics[END_REF], a Bayesian reliability updating method has been developed by using condition monitoring data considering the dependencies between two components. In [START_REF] Kim | Reliability data update using condition monitoring and prognostics in probabilistic safety assessment[END_REF], condition monitoring data from a passive safety system have been used for DRA, without considering the uncertainty in the condition monitoring data.

Inspection data are collected by physical inspections performed by maintenance personnel [START_REF] Nguyen | Dynamic-weighted ensemble for fatigue crack degradation state prediction[END_REF]. They have been widely used for online reliability assessment. For example, a Bayesian method has been developed to merge experts' judgment with continuous and discontinuous inspection data for the reliability assessment of multi-state systems [START_REF] Liu | Bayesian reliability and performance assessment for multi-state systems[END_REF]. A two-stage recursive Bayesian approach has been developed in [START_REF] Liu | Dynamic reliability assessment for nonrepairable multistate systems by aggregating multilevel imperfect inspection data[END_REF], in order to update system reliability based on imperfect inspection data. Condition monitoring data and inspection data on wind turbine blades have been used separately for remaining useful life estimation in [START_REF] Nielsen | Bayesian Estimation of Remaining Useful Life for Wind Turbine Blades[END_REF]. As inspections directly measure the component degradation, they provide valuable information complementary to condition monitoring data for DRA and can help reducing the impact of the uncertainty in the condition monitoring data on the result of DRA.

However, to the best of our knowledge, no previous work has considered integrating condition monitoring data and inspection data for DRA.

In this paper, we develop a new framework to integrate condition monitoring data and inspection data in DRA.

Compared to the existing works, the original contributions lie in:

(1) a Hidden Markov-Gaussian Mixture Model is developed for modeling condition monitoring data;

(2) a Bayesian network model is developed to integrate condition monitoring data and inspection data for DRA;

(3) a real-world application is performed.

The rest of the paper is organized as follows. Sect. 2 introduces the engineering motivation and formally defines the problem. In Sect. 3, a HM-GMM is developed for reliability updating and prediction of the failure of safety barriers based on condition monitoring data. A Bayesian network model is developed in Sect. 4 to integrate the inspection data and condition monitoring data for DRA. The framework is tested in Sect. 5 through a numerical example. In Sect. 6, it is applied for the DRA of a real-world NPP. Finally, conclusions and potential future works are discussed in Sect. 7.

Problem definitions

The framework developed in this paper is motivated by real-world PRA practices. We consider an event tree model developed for the PRA of an Anticipated Transient Without Scram (ATWS) accident of a Nuclear Power Plant (NPP) [START_REF] Huang | A fuzzy set approach for event tree analysis[END_REF]. The occurrence probabilities of the basic events, associated to the reliability of the safety barriers in the ET, are estimated from statistical data and assumed to remain constant throughout the life of the NPP [START_REF] Huang | A fuzzy set approach for event tree analysis[END_REF].

However, the safety barriers in practice degrade. For example, a safety barrier in the aforementioned ET is the recirculation pump [START_REF] Huang | A fuzzy set approach for event tree analysis[END_REF]; according to [START_REF] Lees | Lees' Loss prevention in the process industries: Hazard identification, assessment and control[END_REF], most failures of the recirculation pump are caused by the degradation of the bearings, which makes the reliability of the pump time-dependent. DRA is best suited to capture such time-dependencies.

Two types of data can be used for the DRA of the ATWS accident. The first is inspection data. Take the bearing mentioned above as an example: through inspections, the degradation state of the bearing can be identified, e.g., healthy, minor degradation (e.g., outer race defect), medium degradation (e.g., roller element defect), severe degradation (e.g., inner race defect), etc. (see Figure 1). The second type of data is condition monitoring data: some observable signals, e.g., temperature, vibration, etc., that contain information on the degradation process are measured and used to infer the degradation state. For example, the vibration signals of bearings are often used as condition monitoring data to estimate the degradation state and update the reliability of bearings [START_REF] Tobon-Mejia | A data-driven failure prognostics method based on mixture of Gaussians hidden Markov models[END_REF]. Inspection

.

C ET SB SB SB SB P f R R RR = =- (3)
Figure 2 Illustrative Event Tree model.

Without loss of generality, we assume that in the ET:

(1) Safety barriers

A Hidden Markov Gaussian Mixture Model for modeling condition monitoring data

In this section, we develop a HM-GMM to model condition monitoring data. In Sect. 3.1, we formally define the HM-GMM. Then, in Sect 3.2, we show how to use the developed HM-GMM to estimate the degradation state of a safety barrier using condition monitoring data. The estimated degradation states are, then, used in Sect. 4 for data integration in DRA.

Model formulations

Without loss of generality, we illustrate the HM-GMM using thei th safety barrier in the ET. For simplicity of presentation, we drop the subscript i in the notations. An illustration of the model is given in Figure 3

and

( )

1 ( ) ( ) , 1, 2, , ,1 , . ij k j k i a P S t S S t S k q i j Q + = = = =  
The initial state distribution of the Markov process is

denoted by 12 , Q     =  π where ( ) 0 ( ) ,1 . ii P S t S i Q  = =  
It should be noted that repairs are not considered in this paper to simplify the calculation. Therefore, () St can only transit to a worse state and cannot move backwards. Besides, the failure state Q S is an absorbing state, such that ( )

1 ( ) ( ) 1 k k Q p S t i S t S + = = = if and only if Q iS =
and ( )

1 ( ) ( ) 0 k k Q p S t i S t S + = = =
for other values of . i However, this model can be easily extended to repairable component: only the transition matrix needs to be modified to allow backward jumps, which represent the repair of the safety barrier. The developed algorithms, can, then, be extended naturally.

The discrete time discrete state Markov process model is chosen because it is widely applied for quantitatively describing discrete state degradation processes in many practical applications [START_REF] Shahraki | A Review on Degradation Modelling and Its Engineering Applications[END_REF]. For example, a discrete state Markov model has been used to model the bearing degradation process in [START_REF] Soualhi | Prognosis of bearing failures using hidden Markov models and the adaptive neuro-fuzzy inference system[END_REF]. The degradation process of a safety instrumented system is modeled by a Markov model for availability analysis [START_REF] Alizadeh | Unavailability assessment of redundant safety instrumented systems subject to process demand[END_REF][START_REF] Jiang | Hidden Markov model and nuisance attribute projection based bearing performance degradation assessment[END_REF]. Although only Markov process-based degradation models are discussed in this paper, the developed methods for data integration into DRA can be easily extended to other degradation models. As described in Sect. 2.1, condition monitoring data () t c are available at , 1, 2, , .

k t t k q ==
In practice, () t c contains only raw signals, which cannot be directly used for degradation modeling and analysis. Feature extraction, as shown in Figure 3, is needed to extract degradation features from () t c . For example, vibration signals are usually used as condition monitoring data for bearings [START_REF] Khakzad | Dynamic risk analysis using bow-tie approach[END_REF]. The raw vibration signals, however, need to be preprocessed to extract features for degradation characterization. The commonly used degradation features include entropy, root mean square (RMS), kurtosis, etc [START_REF] Javed | Enabling health monitoring approach based on vibration data for accurate prognostics[END_REF]. In this paper, we refer to these extracted features as

( ) ( ( ) ) ( , ), 1, 2, , , ii i i b p S t S N i Q = = = = x x x μ Σ
as shown in Figure 3. The mean values vector () i μ captures

the degradation pattern at each degradation state, while the covariance matrix () i Σ captures the uncertainty in the condition monitoring data. An overall picture of the HM-GMM is given in Figure 3. Conceptually, we denote the HM-GMM compactly as ={ , , },

A λ π μ Σ ,
where π is the initial state distribution, A is the transition probability

matrix, 12 = , , Q   μ μ μ μ
is a vector of the mean values and

(1) (2) ( ) , , , Q   =      Σ
is a collection of the covariance matrices of the multivariate Gaussian distribution, respectively.

Degradation states estimation based on condition monitoring data

In this section, we show how to estimate the degradation states of the safety barriers based on the developed HM-GMM of the condition monitoring data. As shown in Figure 4, the estimation is made by an offline step and an online step. In the offline step, a HM-GMM is trained based on training data from a population of similar systems.

The trained HM-GMM model, is, then, used in the online step for degradation state estimation based on the condition monitoring data.

The offline step starts from collecting training data, denoted by () The parameters λ is the output of the offline step.

The online step starts from collecting the condition monitoring data for the safety barrier, denoted by ( ), 1, 2, , .

k t k q = c
The condition monitoring data should be of the same type and collected by the same sensors, as in the offline step. Then, the raw degradation signals are preprocessed and the health indicators ( ), 1, 2, ,

k t k q = x
of the target safety barrier are extracted, following the same procedures as in the offline step. Next, the degradation state of the safety barrier is estimated, based on the HM-GMM trained in the offline step. In this paper, we use the forward algorithm for degradation state estimation [START_REF] Rabiner | A tutorial on hidden Markov models and selected applications in speech recognition[END_REF], as presented in details in Sect.

HM-GMM training

In this section, we present in detail how to do HM-GMM training in the offline step. The parameters { , , , } A  = λ μ Σ are estimated by maximizing the likelihood of observing the () 12 ( ), 1, 2, , , , , , : The iterative procedures are repeated until the maximum likelihood estimators converge.

k Tr Tr Tr t k n t t t t == x ( ) ( ) () (1) (2)
To apply the EM algorithm to the HM-GMM model, two auxiliary variables need to be defined first, i.e., forward variable () ti S  and backward variable ( ). ti S



The forward variable is defined as the probability of observing the health indicators up to the current time t and that the true degradation state ( )

, i S t S =
given a known HM-GMM :

λ 12 ( ) ( ( ), ( ), , ( ), ( ) )
.

t i i S P t t t S t S  == x x x λ (5)
It is easy to verify that

11 1 +1 1 () π ( ( )), ( ) ( ) ( ) , 1 ,1 ,1 -1,
i i i Q t j j t t i ij Tr i S b t S b S a i Q j Q t t   + = =  =          x x (
 = + + = x x x λ (7)
It is easy to verify that

1 1 ( ) ( ( 1)) ( ),1 ,1 , ( ) 1, 1, 2, ,1.
Tr Q t j j ij t j t Tr Tr i S b t a S i j Q i t t t    + =  = +    = = - -    x
The iterative estimators for the transition probabilities, denoted by , ij a can, then, be derived as follows [START_REF] Le | Multi-branch hidden Markov models for remaining useful life estimation of systems under multiple deterioration modes[END_REF] and is calculated by [START_REF] Le | Multi-branch hidden Markov models for remaining useful life estimation of systems under multiple deterioration modes[END_REF]:

( ) ( ) ( ) , ( ) ( ) ( ) ( ) , , , 1 () , ( , ) ( ) , ( 1) ( 1) , ( ) ( ( 1)



x λ [START_REF] Kim | Failure rate updates using condition-based prognostics in probabilistic safety assessments[END_REF] The estimator for the initial state probability π , 1, 2, ,

i iQ =
is calculated by [START_REF] Rabiner | A tutorial on hidden Markov models and selected applications in speech recognition[END_REF]: The estimators of the mean value vectors are derived as [START_REF] Le | Multi-branch hidden Markov models for remaining useful life estimation of systems under multiple deterioration modes[END_REF]:

() , 1 () π .
( ) ( ) , 11
Similarly, the covariance matrices of the Gaussian output are calculated by [START_REF] Le | Multi-branch hidden Markov models for remaining useful life estimation of systems under multiple deterioration modes[END_REF]: Step 1:

( ) ( ) ( ) ' ,, 11 () , 11 ( )( ( ) )( ) . (
0 ; = λ λ
Step 2: Expectation phase: calculate the forward and backward variables, based on ( 5) and [START_REF] Zhao | Reliability and maintenance policies for a two-stage shock model with self-healing mechanism[END_REF], respectively, using the current value of ; λ

Step 3: Maximization phase: update λ based on ( 8), ( 11)- [START_REF] Abimbola | Dynamic safety risk analysis of offshore drilling[END_REF], respectively;

Step 4: If ,

prev tol - λ λ End;
Else, , prev = λ λ go to Step 2.

Degradation state estimation

In this paper, the forward algorithm [START_REF] Rabiner | A tutorial on hidden Markov models and selected applications in speech recognition[END_REF] is employed to estimate the degradation state of the safety barriers in the online step. Let given the condition monitoring data up to

: k t ( ) ( ) , 1 2 P ( ) ( ), ( ) , ( ), k CM t CM i k i k S S P S t S t t t = = = x x x λ (14)
The posterior probabilities defined in ( 14) can be easily calculated from the forward probabilities defined in ( 15):

( ) ( ) ( ) 12 , 1 2 2 1
( ) , ( ), ( ) , ( ) P= ( ), ( ), ( ) , ( )

() . () k k k k i k CM t CM i k ti Q ti i P S t S t t t SS P t t t t S S   = = = =  x x x λ x x x x λ (15)
In practice, the () St by [START_REF] Wang | Dynamic quantitative operational risk assessment of chemical processes[END_REF].

k ti S  in (

Integrating condition monitoring data with inspection data for DRA

In this section, we first show how to integrate the condition monitoring data with inspection data for reliability updating and prediction of the safety barriers (Sect. 4.1). Then, in Sect. 4.2, we develop a DRA method based on the updated and predicted reliabilities.

A Bayesian network model for data integration

As in the previous sections, we illustrate the developed data integration method using the -

i
IN i IN i IN i R S S P S S S R SS Q =   == -    -  (17)
where Q is the number of degradation states. It is should be noted that other inspection models might also be assumed, depending on the actual problem setting.

In this paper, a BN is developed to describe the dependencies among , , In ( 18), ( ) PS measures the prior belief of the analysts on the current degradation states. We assume that ( ) PS is a uniform distribution over all the possible degradation states, indicating that there is no further information to distinguish the states.

The conditional probability distribution ( ) IN P S S describes the uncertainty in the inspections and is derived based on [START_REF] Hashemi | Loss functions and their applications in process safety assessment[END_REF]. In [START_REF] Hashemi | Loss functions and their applications in process safety assessment[END_REF], the reliability of the inspection can be estimated from historical data or assigned based on expert judgments. The conditional probability distribution ( ) CM P S S measures the trust one has on the estimated degradation state based on condition monitoring data. Its values can be estimated from validation test data.

However, in practice, as validation tests are not always available, ( )

CM P S
S might also be assigned by experts considering the measurement uncertainty of the sensors and the distance between the neighboring degradation states. We give an example of how to determine ( )

CM P S
S in the case study of Sect. 6.

Once the condition monitoring data and inspection data are available, the observed values of

Given the estimated posterior distribution in [START_REF] Adedigba | Data-driven dynamic risk analysis of offshore drilling operations[END_REF], the reliability of the safety barrier can be updated. Suppose the current time is , k t the updated reliability can be calculated by:

( ) , ( ) P , k SB k INT t SW R t S  =  ( 20
)
where W is the working set that contains all the working states;

( )

, P k INT t
S is the posterior probability of the true degradation state after integrating the two data sources at k tt = and is calculated from [START_REF] Adedigba | Data-driven dynamic risk analysis of offshore drilling operations[END_REF].

Furthermore, at

, k tt = we can also predict the reliability of the safety barriers at a future time .

Fut t

For this, the distribution of the degradation states at Fut tt = is predicted first, using Chapman-Kolmogorov equation [START_REF] Tsai | A multiple-state discrete-time Markov chain model for estimating suspended sediment concentrations in open channel flow[END_REF] and the trained model from the offline step:

Dynamic risk assessment

The updated reliabilities from [START_REF] Zeng | Dynamic Risk Assessment Based on Statistical Failure Data and Condition-Monitoring Degradation Data[END_REF], can, then, be substituted into (2) for DRA:

1 2 1 ( ) ( ( ), ( ), , ( ), , , ), 1, 2,
, ,

i K K M C k ET SB k SB k SB k SB SB r t f R t R t R t R R IE i N + == (23)
where in ( 23), ()

i SB k
Rt is calculated by [START_REF] Zeng | Dynamic Risk Assessment Based on Statistical Failure Data and Condition-Monitoring Degradation Data[END_REF]. Similarly, the risk index at a future time Fut t can be predicted by:

1 2 1 ( ) ( ( ), ( ), , ( ), , , ), 1, 2,
, ,

i K K M C Fut ET SB Fut SB Fut SB Fut SB SB r t f R t R t R t R R IE i N + == (24)
where

() i SB Fut
Rt is calculated by ( 21) and ( 22).

Numerical case study

In this section, we apply the DRA framework for data integration (see Sect. 4.1) on a numerical case study. The training data are used in the offline step for estimating the model parameters. Then, another sample, denoted by ( ), 1, 2, , ,

CM CM t t t = x
is generated from the HM-GMM in [START_REF] Shalev | Condition-based fault tree analysis (CBFTA): A new method for improved fault tree analysis (FTA), reliability and safety calculations[END_REF] and used as condition monitoring data collected on the safety barrier monitored in the online step, as shown in Figure 7.

Figure 7 The generated condition monitoring data for the monitored safety barrier.

Based on the generated condition monitoring data, the reliability updating and prediction can be done using Algorithm 1 and equations ( 20) and [START_REF] Meel | Plant-specific dynamic failure assessment using Bayesian theory[END_REF]. Due to the noise in the condition monitoring data, the updated reliability is subject to uncertainty. The method in Figure 6 is applied to solve this problem by integrating condition monitoring data with inspection data. In this section, we test the performance of the developed data integration method under three possible scenarios:

(

( ) ( ) .

IN S t S t S ==

In subsections 5.1-5.3, we apply the developed data integration method on the three scenarios above.

Scenario Ⅰ: Both data sources are reliable

The reliability updating and prediction processes are conducted following the procedures in Figure 6, at

. tt =

The updated and predicted reliability are compared to those calculated based on only condition monitoring data and only inspection data, respectively. The comparison is shown in Figure 8. We also show the relative errors of the three methods with respect to the true values in Table 1. As shown in Figure 8 and Table 1, the proposed method provides a more accurate estimation and prediction of the reliability than the other two methods. This is because condition monitoring data are affected by noise from the data collection process, which results in uncertainty in the estimated degradation state. In this case, the state distribution estimated by the condition monitoring data is

It can be seen that integrating the two data sources reduces the uncertainty in the degradation state estimation (note that at 3 , tt = the true degradation state is 2 S ). Therefore, the updated and predicted reliabilities are more accurate than only using condition monitoring data.

On the other hand, the transition probability matrix A estimated from the offline step is 0.6010 0.2125 0.0865 0.1 0 0.4483 0.3121 0.2395 . 0 0 0.4938 0.5062 0 0 0 1

A    =    (28)
Comparing [START_REF] Liu | System dynamic reliability assessment and failure prognostics[END_REF] to the true values in [START_REF] Shalev | Condition-based fault tree analysis (CBFTA): A new method for improved fault tree analysis (FTA), reliability and safety calculations[END_REF], it can be seen that when the current state is 2 , S the estimated A tends to underestimate the reliability as it overestimates the transition probabilities to the failure states. As the inspection data estimate that the system is in 2 , S using only inspection data tends to underestimate the reliability. Integrating the two data sources, as shown in [START_REF] Zadakbar | Dynamic Risk Assessment of a Nonlinear Non-Gaussian System Using a Particle Filter and Detailed Consequence Analysis[END_REF], predicts that the safety barrier is also likely to be in 1 , S which compensates the errors in the estimated λ and results in more accurate reliability estimates.

Scenario II: Condition monitoring data are reliable but inspection data are not

The reliability updating and prediction processes are conducted following the procedures in Figure 6, at [START_REF] Zhao | Reliability and maintenance policies for a two-stage shock model with self-healing mechanism[END_REF] . tt =

The updated and predicted reliability are compared to those calculated based on only condition monitoring data and only inspection data, respectively. The comparison is shown in Figure 9. We also present the relative error of the three methods by comparing them to the true values in Table 2. As shown in Figure 9 and Table 2, the results obtained by the inspection-data based method have the largest estimation error. The proposed data integration method provides more accuracy than the inspection data-based method. This is expected, as in this case the inspection data fail to correctly estimate the degradation state. By integrating condition monitoring data, the incorrect information from inspection data can be somewhat corrected.

On the contrary, the estimation error of the data integration method is larger than that of the condition monitoring data-based method. This is because the data integration method is affected by the incorrect information from the inspection data. Trustworthiness of the inspection becomes essential, then.

Scenario III: Inspection data are reliable but condition monitoring data are not

The reliability updating and prediction are conducted following the procedures in Figure 6, at [START_REF] Kim | Reliability data update using condition monitoring and prognostics in probabilistic safety assessment[END_REF] . tt = The updated and predicted reliability are compared to those calculated based on only condition monitoring data and only inspection data, respectively. The comparison is shown in Figure 10. We also present the relative errors of the three methods by comparing them to the true values in Table 3. As shown in Figure 10 and Table 3, the results obtained by the condition monitoring data-based method have the largest estimation errors. This is expected as in this case, the condition monitoring data fail to correctly estimate the degradation state. The proposed data integration method provides a more accurate result than the condition monitoring data-based method. This is because, by integrating inspection data, the incorrect estimation from the condition monitoring data can be compensated. However, the estimation error is larger than that of the inspection data-based method. This is because the data integration method also considers the incorrect information from the condition monitoring data. If the low pressure system fails as well as the high-pressure system, then the reactor inventory makeup at lower pressure needs to be activated. In

Dynamic risk assessment

DRA of the ATWS is carried out following the procedures in Figure 6, where the real data set from [START_REF]Prognostic Data Repository: Bearing Data Set NSF I/UCRC Center for Intelligent Maintenance Systems[END_REF] is used as historical training data. In the offline step, feature extraction needs to be conducted first. Three features are extracted from the vibration signals using the time domain method:

1 1 1 2 1 ( , ) 1 2 2 ( , ) 1 3 ( , ) 1 1 () () 1 ( ) ( ) () 1 () () ii ii ii ij j t t ii ij j t t ii ij j t t ii x t c t t f x t c c t t f x t c t t f - - -  -  -  -  =  -    =-  -    = -      (31)
where 1

x is the average power of vibration, 2

x is the root mean square, 3

x is the mean value of vibration. In [START_REF] Liu | Dynamic reliability assessment for nonrepairable multistate systems by aggregating multilevel imperfect inspection data[END_REF], f is the sampling frequency,

        =                     ==             Σ Σ Σ (32)
The online condition monitoring data are generated using the bootstrap sampling: 4 10 bootstrap samples are generated from the training data set. A HM-GMM λ is, then, trained based on these samples using Algorithm 1:

 

(

        =               = - =   -  Σ Σ Σ . 0.0001 0.0001 0.0100      (33)
The HM-GMM λ in (33) is, then, treated as the true degradation model and used to generate the condition monitoring data for the bearing that is monitored in the online step. The generated condition monitoring data are shown in Figure 14. 5. In Table 5, we also show the true degradation states obtained from the true degradation model in [START_REF] Lees | Lees' Loss prevention in the process industries: Hazard identification, assessment and control[END_REF] 6. Once the integrated estimation of the degradation state is obtained, risk updating and prediction can be performed by [START_REF] Meel | Operational risk assessment of chemical industries by exploiting accident databases[END_REF] and ( 24), respectively.

Results and discussion

The results of risk updating and prediction at 30,35 t = and 50( ) d are given in Figure 15. In Figure 15, we also show the results from using only condition monitoring data and inspection data, for comparison. the results from all the three methods are close to each other. This can be explained from Table 5: at 30( ), td = both data sources correctly identify the true degradation states.

However, when compared to the true risk values, the updated and predicted risks from all the three methods show relatively large discrepancies. This discrepancy is mainly due to the estimation errors in the offline step (see [START_REF] Nielsen | Bayesian Estimation of Remaining Useful Life for Wind Turbine Blades[END_REF] and ( 33)), as we have only four samples in the training data set. A possible way to increase the accuracy of risk updating is, then, to increase the sample size of the training data in the offline step.

It can be seen from Table 5 that at 35( ), td = the inspection data give correct information on the current degradation state while condition monitoring data do not. From Figure 15(b), it can be seen that the developed data-integration method improves the DRA results from the condition monitoring data-based method, as it integrates the correct information from inspection data. On the other hand, when the inspection data fail to give the correct information ( 50( )), td = it can be seen from Figure 15(c) that the developed data integration method can also correct the misleading results obtained from using only the inspection data. Hence, in general, applying the developed data integration method can achieve a more robust DRA result than using the two data sources individually.

In Figure 16, we compare the developed DRA method with the conventional ETA method in [START_REF] Huang | A fuzzy set approach for event tree analysis[END_REF]. It can be seen from Figure 16 that the results from the developed DRA method are closer to the true risk values than those of the standard ETA. This is because through the integration of inspection and conditon monitoring data, the developed method is able to capture the time-dependent behavior of the recirculation pump resulting from the degradation of the bearing. The standard ETA, however, fails to capture such time-dependencies as it assumes that the event probabilities do not change although the real system/component ages over time. Additionally, as can be seen from Figure 16, the true risk is higher than the one estimated by the developed method. However, it does not mean that the proposed model always underestimates the risk. For instance, in Figure 10, the developed model actually overestimates the risk by underestimating the component reliability. The inaccuracy of the risk estimation is caused by the imprecise estimation of the parameters in the HM-GMM (equation 32), which is primarily due to the small training sample size in the offline training of the HM-GMM (see Figure 4). It can be seen from equations [START_REF] Nielsen | Bayesian Estimation of Remaining Useful Life for Wind Turbine Blades[END_REF] and ( 33) that, since we have only 4 samples in the offline training phase, the estimated transition probability differs from its true value. Particularly, the probability of system remains in [START_REF] Compare | Semi-Markov model for the oxidation degradation mechanism in gas turbine nozzles[END_REF] S given that it enters 3 , S is estimated to be 33 0.9565, a = which is larger than its true value 33 0.7150. a = As 4 S is the failure state, this indicates that the trained HM-GMM trends to overestimate the reliability of the safety barrier, and, hence, underestimate the risk in Figure 16. The inaccuracy of the estimation is caused by the fact that we have only 4 samples in the offline training phase of the case study (as it is a real dataset). To have a more bounding risk estimation, we could increase the sample size of the training data used to estimate the parameters of the HM-GMM. In the numerical case study (Section 5), we show an ideal case where we have 4 10 training samples. It can be seen from Figure 8 that the estimation accuracy is satisfactory if we have enough training data.

A major issue with the EM algorithm (Algorithm 1) is that, when the sample size is small, there is large uncertainty on the estimated parameter values. This uncertainty, if not properly addressed, might greatly impact the estimation accuracy of the reliability of the safety barriers, and, then, the calculated risk. One way to capture the parametric uncertainty in the estimated parameters is to use Bayesian inference [START_REF] Zeng | Dynamic Risk Assessment Based on Statistical Failure Data and Condition-Monitoring Degradation Data[END_REF][START_REF] Zhang | Bayesian identification of hidden markov models and their use for condition-based monitoring[END_REF][START_REF] Fan | A Sequential Bayesian Approach for Remaining Useful Life Prediction of Dependent Competing Failure Processes[END_REF], where posterior distribution of the parameters, rather than point estimators, are calculated to represent the parametric uncertainty.

The uncertainty in the parameter estimation can be represented in terms of the credible intervals. By propagating the parametric uncertainty, credibility interval can also be obtained for the estimated risk, which can help the decision-makers understand the confidence on the risk estimations.

Conclusions

In this paper, a framework has been presented to integrate condition monitoring data and inspection data for There are few challenges to be addressed when applying the developed model to real-life large-scale systems (of systems). The first one is that, to ensure the accuracy of the developed method, a large number of training samples is needed. This could be a challenge for real-world systems, especially for newly designed ones. To solve this challenge, the training algorithm of the HM-GMM can be extended to Bayesian inference algorithms, which might reduce the required sample size. Another challenge is that, for large-scale systems, there may not be only one safety barrier that degrades. The developed model needs, therefore, be extended to cover problems with multiple degrading components.

The current method only considers a discrete time discrete state Markov model as the degradation model. A future work is to extend the developed framework to other degradation models, e.g. the Brownian motion model [START_REF] Zhai | RUL prediction of deteriorating products using an adaptive Wiener process model[END_REF], Gamma process model [START_REF] Zhai | Robust degradation analysis with non-Gaussian measurement errors[END_REF], etc. Moreover, in the current framework, the parameters of HM-GMM are estimated offline; in the future, online updating of the parameters can be considered in order to improve the accuracy of the DRA.

  data usually give discrete degradation states, with uncertainty due to state classification by the maintenance operator. Condition monitoring data are subject to uncertainty due to observation noises and degradation state estimation errors. In this paper, a new framework is proposed to integrate condition monitoring data and inspection data for improving the accuracy and reducing the uncertainty of the risk assessment. (a) healthy state (b) minor degradation (outer race defect) (c) medium degradation (roller element defect) (d) severe degradation (inner race defect)

2 C P of the consequence 2 C 1 SB functions successfully and the second 2 SB

 2212 the ET model function. For example, in the ET in Figure2, the risk index of the second accident sequence, in which the IE occurs with certainty, the first fails to provide its function, can be calculated as:

Figure 3

 3 Figure 3 Description of the HM-GMM.

  The training data comprise of historical measurements of the degradation signals from a population of similar systems. To ensure the accuracy of HM-GMM training, it is required to collect as many as possible training samples, i.e., the sample size Tr n should be as large as possible. The raw training data are preprocessed in a feature extraction step, as shown in Figure 4, to extract the health indicators (Depending on the nature of the degradation process condition, different feature extraction methods, e.g., time-domain, frequency domain, time-frequency analyses, etc., can be used [39]. Next, in the HM-GMM training step, the extracted degradation indicators are used to estimate the parameters { , , , } A  = λ μ Σ of the trained HM-GMM. In this paper, the Expectation Maximization (EM) algorithm [40] is employed for training the HM-GMM (see Sect. 3.2.1 for details).

  3.2.2. The estimated degradation state based on only condition monitoring data, denoted by ( ), CM k St is, then, integrated with inspection data for DRA in Sect. 4.

Figure 4

 4 Figure 4 Degradation state estimation based on condition monitoring data.

λ

  be the likelihood function of the observation data. Directly solving (4) is not possible in practice, as the likelihood function in (4) contains unobservable variables (the true degradation states () St in this case). Expectation Maximization (EM) algorithm[START_REF] Rabiner | A tutorial on hidden Markov models and selected applications in speech recognition[END_REF] is applied to solve this problem, where the maximum likelihood estimator is found in an iterative way: the current values of the parameters are used to estimate the unobservable variables (Expectation phase); then, the estimated values of the unknown variables are substituted into the likelihood function to update the maximum likelihood estimators of the parameters (Maximization phase).

  summarizes the procedures for training the HM-GMM based on the EM algorithm. In Algorithm 1,  measures the distance between the current and the previous estimators. In this paper, we use the absolute value for its calculation, and tol is the tolerance of the error. In this paper, we set 4 1 10 . tol -= Algorithm 1: HM-GMM training based on EM algorithm.

  Figure 5. The BN in Figure 5 is constructed based on the assumption that given the true degradation state , S the estimated degradation state from condition monitoring data and inspection data are conditional-independent.

Figure 5 A

 5 Figure 5 A BN model for data integration.Based on the BN in Figure5, we have

S

  It should be noted that we choose the state with maximal posterior probability from (16) as the observation value of . CM The two data sources can be naturally integrated by calculating the posterior distribution of S given the two data sources, denoted by ( ). INT PS Based on the BN in Figure 5, we have:

Figure 6 Figure 6

 66 Figure6summarizes the major steps for the developed DRA method by integrating condition monitoring data with inspection data. It should be noted that in Figure6, the risk updating is made at

Figure 8

 8 Figure 8 Updated and predicted reliability at

Figure 9

 9 Figure 9 Updated and predicted reliability at

Figure 10

 10 Figure 10 Updated and predicted reliability at

cFigure 13

 13 Figure 13 Extracted degradation indicators. Algorithm 1 is applied to train a HM-GMM with four discrete degradation states based on the extracted degradation indicators:

Figure 14

 14 Figure 14 The generated condition monitoring data. Inspections are conducted at three time instants, i.e., 30( ), td = 35( ) td = and 50( ), td = respectively. The

  other elements in () CM P S S are determined in a similar way and reported in Table

Figure 15

 15 The results of risk updating and prediction.As shown in Figure15(a), at 30( ), td =

Figure 16

 16 Comparisons of traditional ETA and DRA.

  DRA. A HM-GMM has been developed to estimate the degradation states of the safety barriers based on the condition monitoring data. The estimated degradation states are integrated with the inspection data for DRA by a BN model. A numerical case study and a real-word application on a NPP accident risk assessment model (an ET) have been conducted. The results show that, as expected, integrating the two data sources into the DRA gives more accurate and robust results than using any one of the two individual data sources.

  :

					nt
			a	=	Tr 11 Tr kt  ==		() , k Tr t	( , ) i j SS	,	(8)
			ij		nt
					Tr	Tr
					11 kt == 		() , k Tr t	() i S
	where () Tr t , ( , ) i j k SS 	represents the probability of the -k th sample being in	i S at time	t and state	j S at time
	t +	1,

  The purpose is to test the updating and prediction of safety barrier reliability. Hence, only reliability updating and prediction are considered. The application of the overall DRA framework is done in Sect. 6 on a real-world case.Consider a component whose degradation process follows a discrete state discrete time Markov chain ()

									St
	with four discrete degradation states 1 2 3 4 , , , , S S S S where 14 SS have increasing degrees of degradation from 1 S
	perfect state, to 4 S failure state. The condition monitoring data are generated from a HM-GMM with known
	parameters values:
	A=	0.6 0.2 0.1 0.1   0 0.5 0.25 0.25  0 0  0.5 0.5 0 0 0 1  	,
	π	=	 1 0 0 0 , 
	μ	0.0588 0.1424 0.1842 0.1268 0.1597 0.2432 0.0946 0.9744 0.8648 0.8449 1 1   =   	,	(25)
	Σ	() i	0.001 0 0  0 0 0.001 0 , with 0 0.001    ==  i	1, 2,3, 4.
	The degradation indicator comprises of three features, denoted by 12 , xx and 3 , x respectively. The size of
	the generated training data is	4 10 and	t	=	1 2 , , , t t	t	23	are the time instants of data collection. Then, the training
	data can be represented as ( ) k Tr t ( ), x	k	4 1, 2, ,10 , == t	1 2 , , , , 23 t t t	where ( ) k Tr x	( ) t	( ) ,1 k Tr x  ( ) ( ) ,2 ,3 ( ), ( ), ( ) . k k Tr Tr t x t x t = 

Table 1

 1 Relative errors of the scenario I

		tt =	3	tt =	4	tt =	5	tt =	6	tt =	7	8 tt =	tt =	9	10 tt =
	Condition monitoring data-based method	0		4.8% 9.7% 14.5% 19%	23%	27%	31%
	Inspection data-based method	0		1.34% 0.9% 4.6%	8.7% 12.9% 17%	21%
	Integrated method	0		1.2% 0.9% 4.3%	7%		11.7% 15% 18.6%

Table 2

 2 Relative errors of the scenario II

	Condition monitoring data-based method	tt = 0	7	8 tt = 12% 22% 9 tt =	10 tt = 33%	11 tt = 39%	12 tt = 46%	13 tt = 52%	14 tt = 57%
	Inspection data-based method	0		52% 98% 138% 173% 204% 232% 255%
	Integrated method	6%	34% 71%	96%	105% 137% 158% 197%

Table 3

 3 Relative errors of the scenario III

	Condition monitoring data-based method Inspection data-based method Integrated method	5 2% tt = 0 0	6 16% tt = 1.39% 2.9% 4.6% 8.6% 12.9% 16.9% 21% 7 tt = 8 tt = 9 tt = 10 tt = 11 tt = 12 26% 14.5% 33% 38.5% 43% 46% tt = 10% 14% 17% 20% 23% 25% 27%

Table 4

 4 Safety barriers in the target system[START_REF] Huang | A fuzzy set approach for event tree analysis[END_REF].Once the plant fails to scram, the recirculation pump is activated and used to limit power generation of the NPP.

	1
	Safety barrier	Failure probability () f P	Description
	Recirculation pump ( 1 SB )	3 1.96 10 -
	Safety valve ( 2 SB )	5 1.01 10 -	Safety valves are opened to prevent over-pressurization of the reactor.
	Boron injection ( 3 SB )	5 1 10 -	Liquid boron should be injected manually by the operator within the allowable time to shut down the reactor safely.
	Automatic
	Depressurization System (ADS) inhibit	2 1.37 10 -	ADS is designed to decrease the pressure of the reactor in order to start the low-pressure system.
	( 4 SB )
	Early high-pressure makeup ( 5 SB )	2 8.45 10 -	The system is supposed to work automatically when automatic actuation alarm appears, indicating that the water level is lowering to level 2.
	Long-term high-pressure makeup ( 6 SB )	3 2.13 10 -	The long-term high-pressure system is used to maintain the water level in the vessel 24 hours after the start.
	Manual reactor depressurization ( 7 SB )	7 7 SB (1) , f P (2) , f SB P	= =	0.45, 0.9	The operator depressurizes the vessel manually to avoid core melt-down. In 04 09 , SE SE -the failure probability is 7 (1) , f SB P , whereas, in 10 15 , SE SE -the failure probability is 7 (2) f SB , . P
	Reactor inventory	8
	makeup at low pressure	8
	( 8 SB )
		8

Table 5

 5 Values of , CM

	SS

In practical operation, the developed method can help the stakeholder/decision-makers to determine when to perform preventive maintenance on critical safety barriers. This is done by setting a minimum acceptable value for reliability and calculating the first time the reliability drops below this value. Traditionally, in preventive maintenance planning, the reliability is estimated using condition monitoring data. As shown in Figure 10, the reliability estimation based on condition monitoring data might sometimes yield imprecise results. The developed method, can, then, provide a more realistic assessment to support decision making regarding when a preventive replacement is needed.

Application

In this section, the developed method is applied for DRA of an Anticipated Transient Without Scram (ATWS) accident of a NPP [START_REF] Huang | A fuzzy set approach for event tree analysis[END_REF]. The description of the case study is briefly introduced in Sect. 6.1. Then, in Sect. 6.2, the developed HM-GMM and the data integration process are presented. The results of the DRA are presented and discussed in Sect. 6.3.

System description

ATWS is an accident that can happen in a NPP. In this accident, the scram system, which is designed to shut down the reactor during an abnormal event (anticipated transient), fails to work [START_REF] Yang | Performance evaluation of an advanced integral reactor against an anticipated transient without scram[END_REF]. An ET has been developed for PRA of the ATWS for a NPP in China [START_REF] Huang | A fuzzy set approach for event tree analysis[END_REF], as shown in Figure 11. In Figure 11, T1ACM represents the failure of the automatic scram system and is the initialing event (IE) considered. Eleven safety barriers ( 1 11 SB SB ) are designed to contain the accident (Table 4). Depending on the states of the safety barriers, [START_REF] Meel | Operational risk assessment of chemical industries by exploiting accident databases[END_REF]

represents the event sequences with severe consequences, whereas the remaining event sequences have non-severe consequences [START_REF] Baraldi | A combined Monte Carlo and possibilistic approach to uncertainty propagation in event tree analysis[END_REF]. The risk index Risk considered in this paper is the conditional probability of having severe consequences, given the initialing event ( (2) , f SB P in Figure 11 and Table 4).

Figure 11 ET for the ATWS [START_REF] Baraldi | A combined Monte Carlo and possibilistic approach to uncertainty propagation in event tree analysis[END_REF]; at each branching, the upper branch corresponds to the non-failure of the safety barrier and the low branch corresponds to the failure of the safety barrier.

In this original ETA of the ATWS, the failure probabilities in Table 4 are assumed to be constant values. In practice, however, these probabilities might change due to various degradation mechanisms. Take the recirculation pump as an example. According to [START_REF] Lees | Lees' Loss prevention in the process industries: Hazard identification, assessment and control[END_REF], most field failures of the recirculation pump are caused by the degradation of the bearing inside the pump, which makes the failure probability of the recirculation pump time-dependent. In this paper, we make a DRA on the ET in Figure 11, considering the degradation of the bearing in the recirculation pump.

The condition monitoring data of the bearing come from the bearing degradation dataset from university of Cincinnati [START_REF]Prognostic Data Repository: Bearing Data Set NSF I/UCRC Center for Intelligent Maintenance Systems[END_REF]. The dataset contains four samples and for each sample, raw condition monitoring data are collected in real time by measuring the vibration acceleration signals. An illustration of the raw data is given in Figure 12. On the other hand, the inspection can be performed at some given time instants to identify the different degradation states. As shown in Figure 1, we distinguish from four degradation states in this case study.