System Reliability Assessment Based on Energy Dissipation: Modeling and Application in Electro-Hydrostatic Actuation System

: This paper addresses a new reliability model, based on energy dissipation, considering performance degradation behaviors. Di ﬀ erent from the two-state reliability model and traditional reliability model based on failure rate statistics, this paper focuses on the component energy loss due to its fault evolution, such as fatigue, aging and wear, and presents a reliability model based on the component’s energy dissipation, as well as establishing a power dissipation constrained reliability model for degradation-based reliability assessment. As a demonstration, the proposed method is applied to model and evaluate the failure behavior of the electro-hydrostatic actuation system. The results indicate that the proposed method is e ﬀ ective in describing its life-cycle degradation in the energy ﬁeld, and provides a reliability assessment based on energy dissipation.


Introduction
Physical degradation inevitably occurs in engineering systems, which leads to potential risks and hazards. Traditional binary-state reliability models assume that the system is either running perfectly or has completely failed, and is therefore unable to reveal real situations. Multi-state models provide a more realistic depiction, by introducing a finite number of states. Many studies describe the multiple states of the system degradation process and estimate the system reliability based on multi-state models, including the universal generating function technique [1,2], the structure function approach [3], the stochastic process approach [4,5], and the Monte-Carlo simulation technique [6]. The physics-of-failure (PoF) models provide comprehensive interpretation of statistical data based on physics and mechanistic methods. The models serve as good alternatives when the reliable data are limited, by modeling failure mechanisms such as fatigue, aging and wear. In 2002, the PoF-based methods were selected by the IEEE for system reliability prediction [7]. Recently, increasing attention has been given to PoF-based reliability modeling methods. Sun et al. [8] analyzed the reliability of the electrolytic capacitor in light-emitting diode drivers using PoF-based methods. Ma et al. [9] assessed the reliability of a power electronics system by establishing PoF models of components. Zeng et al. [10] studied the effect of component dependency on system reliability by considering failure collaboration using PoF models. The PoF approaches employ well-developed knowledge and there is no common method to build a PoF model. When information limitation is considered, probabilistic physics-of-failure (PPoF) methods [11] are proposed to address the related uncertainties.
For a system containing multiple components, system reliability should concern the relationship between various components. To identify the key components that mostly influence the safety and

Reliability Model Based on Energy Dissipation
In this paper, we focus on a type of energy transfer system that involves multiple types of energy, such as hydraulic, mechanical and electrical energy. Different types of energy are transferred, stored and transformed by energy transfer components for different desired effects. During the process, degrading behavior such as wear, fatigue and aging inevitably occurs, which results in thermal and volumetric energy loss. Failure-related energy dissipation is introduced to measure the failure behavior of energy transfer system components and characterizes the reliability based on energy dissipation.

Failure Related Energy Dissipation (FED)
A practical energy transfer system normally contains diversiform energy transfer components, including electrical components, mechanical components, hydraulic components and pneumatic components. Although different components suffer from different types of performance degradation, the similarity is that each of these components transmit energy to implement different functions. For a unified description of the physical degrading process, such components are defined as the energy transmission unit (ETU) in this paper. Assuming that E (in) (t) is the input energy of ETU from an upstream component, E (out) (t) is the output energy to the downstream component and ψ all (t) is the total energy dissipation of ETU that will lead to fault development. A general model of ETU is shown in Figure 1. transferred, stored and transformed by energy transfer components for different desired effects. During the process, degrading behavior such as wear, fatigue and aging inevitably occurs, which results in thermal and volumetric energy loss. Failure-related energy dissipation is introduced to measure the failure behavior of energy transfer system components and characterizes the reliability based on energy dissipation.

Failure Related Energy Dissipation (FED)
A practical energy transfer system normally contains diversiform energy transfer components, including electrical components, mechanical components, hydraulic components and pneumatic components. Although different components suffer from different types of performance degradation, the similarity is that each of these components transmit energy to implement different functions. For a unified description of the physical degrading process, such components are defined as the energy transmission unit (ETU) in this paper. Assuming that (in) ( ) E t is the input energy of ETU from an upstream component, (out) ( ) E t is the output energy to the downstream component and all ( ) t ψ is the total energy dissipation of ETU that will lead to fault development. A general model of ETU is shown in Figure 1. According to wear theory [22], the wear rate between contact surfaces of a friction pair holds the following equation: , , ( ( ), ( )) = ( ) ( ) m n w x y x y r p t q t kp t q t (1) where k is the wear coefficient, , ( ) x y p t is the pressure distribution of the contact surfaces at point ( ) x, y , ( ) q t is the velocity of relative motion and , m n are the stress coefficients. Since the wear and tear accumulates with increasing time, the total wear volume ( ) V t at time t can be described as: Assuming that the energy cost of a generating unit's wear volume is constant, the corresponding energy dissipation is proportional to the total wear volume.

(b) Fatigue
Fatigue of materials is generally caused by alternating stresses and will result in cracks. According to the Paris law [23], ( ) t α can be used to describe the length of a crack at time t , which is: where , C m are constant parameters of materials. Then, the growth rate of the crack can be obtained by: Considering single failure mode, three typical examples of physical degradation are taken to show how to use energy dissipation to describe the failure behavior of ETU.

(a) Wear and tear
According to wear theory [22], the wear rate between contact surfaces of a friction pair holds the following equation: r w (p x,y (t), q(t)) = kp m x,y (t)q n (t) (1) where k is the wear coefficient, p x,y (t) is the pressure distribution of the contact surfaces at point (x, y), q(t) is the velocity of relative motion and m, n are the stress coefficients. Since the wear and tear accumulates with increasing time, the total wear volume V(t) at time t can be described as: Assuming that the energy cost of a generating unit's wear volume is constant, the corresponding energy dissipation is proportional to the total wear volume.

(b) Fatigue
Fatigue of materials is generally caused by alternating stresses and will result in cracks. According to the Paris law [23], α(t) can be used to describe the length of a crack at time t, which is: where C, m are constant parameters of materials. Then, the growth rate of the crack can be obtained by: where R sr is the stress ratio between minimum stress and maximum stress, ∆K is the stress intensity factor, K c is the cracking toughness, the critical value of the stress intensity factor which causes crack extension. If the energy cost of a generating unit's crack length is constant, the corresponding energy dissipation can be expressed as the proportion of the accumulative damage amount L(t) as: It is well known that aging of a plastic material is related to the temperature variance, mechanical force and environmental factors. The Arrhenius model [24] is commonly chosen to describe the aging behavior: where A 0 is the coefficient, E is activation energy, R g is the gas constant and T(t) is storage temperature. Since the aging process of a plastic material is the accumulation of time and temperature variance, the energy dissipation of aging is proportional to the total amount of aging A(t) which can be described as: Based on the above failure behavior description, we can conclude that for different degrading processes, the energy dissipation can always be obtained by the time-varying degrading rates, which are related to work stresses with totally different forms. To establish a general reliability model for ETU, we here give a definition as follows: Definition 1. Energy dissipation. Energy dissipation is the total difference between the input energy and the output energy of an ETU. We should note that the energy dissipation is the joint effect of inherent energy loss and performance degradation. Definition 2. Failure related energy dissipation (FED). Failure related energy dissipation is the total energy loss caused by the degradation of an ETU.
If the degradation is the result of more than one degradation mechanism, FED can be expressed as: where ψ i (t) stands for the FED caused by i th degradation mechanism, s(t) is the time-varying works stresses, r i is the degrading rate of a certain type of degradation mode and f i (·) is the normalized function, which modulates the weight of different energy types.

Multi-State Reliability Model Based on FED
Considering that the degradation related to FED is time-variant, the random process with state duration can be used to describe the degrading process. The semi-Markov model is a typical statistic process widely used in reliability analysis when the residence time follows arbitrary distribution, which is thereby employed in this paper. We assume a monotonous degrading process. Based on FED, the degrading process of an ETU can be decomposed into N finite discrete states {S 1 , S 2 , . . . , S N } as shown in Figure 2. Assuming that the initial state of ETU is sound at t = 0, which is ψ (1) = 0, at each time t, the state S(t) satisfies the following: where ψ th is the maximum energy dissipation, which means the ETU cannot meet the requirement of output energy. If at time t, the state S(t) is S i , then there is a fixed transition probability a i,j that at the next time point t + 1, the state will be S j , which is: The sojourn time τ i in state S i may be expressed by a number of specific cycles (for example, the number of minutes, hours, days, or weeks), which is a random variable following any distribution [25]. Let d i,j (k) be the sojourn time distribution, which is: where k is an integer. The semi-Markov kernel can be obtained as: Then, a semi-Markov model λ = (P 0 , A, D) can be established, where P 0 is the initial state distribution, A is the transition probability matrix composed by a i,j and D is the sojourn time distribution of each state, which can be expressed as: Energies 2019, 12, x FOR PEER REVIEW 5 of 23 We assume a monotonous degrading process. Based on FED, the degrading process of an ETU can be decomposed into N finite discrete states { } 1 2 , ,..., N S S S as shown in Figure 2. Assuming that the initial state of ETU is sound at 0 t = , which is (1) 0 ψ = , at each time t , the state ( ) S t satisfies the following: where th ψ is the maximum energy dissipation, which means the ETU cannot meet the requirement of output energy. If at time t , the state ( ) S t is i S , then there is a fixed transition probability , i j a that at the next time point 1 t + , the state will be j S , which is: The sojourn time i τ in state i S may be expressed by a number of specific cycles (for example, the number of minutes, hours, days, or weeks), which is a random variable following any distribution [25]. Let , ( ) i j d k be the sojourn time distribution, which is: where k is an integer. The semi-Markov kernel can be obtained as: Then, a semi-Markov model =( , , ) λ 0 P A D can be established, where 0 P is the initial state distribution, A is the transition probability matrix composed by , i j a and D is the sojourn time distribution of each state, which can be expressed as:  Based on Definition 2, the reliability of an ETU based on FED can be given as:  Based on Definition 2, the reliability of an ETU based on FED can be given as: Energies 2019, 12, 3572 6 of 22 and P(S(t) = S N |S(0) = S i ) can be obtained by the recursive method [26]:

Reliability Evaluation of Energy Transfer
An energy transfer system with M ETUs transmits different types of energy and each ETU degrades under several possible degrading modes with various degrading paths. Particularly, the degradation of j th ETU is influenced by DM j degrading mechanisms. The failure of the system is when the system cannot provide enough energy to implement a certain function, or the FED of the system exceeds failure threshold of the system ψ th S . Then, the reliability of the target system can be obtained by: where ψ i, j (t) presents the FED generated by i th degrading mechanisms of j th ETU. We should note that the convolutional function in Equation (16), which concerns the energy transfer capacity of the entire system, should be regarded as a global evaluating method. For a system with fixed topology, a traditional method for serial and parallel systems, with individual failure thresholds of each component, such as the block diagram method, can be conducted. In practice, the reliability of the system concerns the performance of the entire system and the threshold of a single component is not easily defined. The influence of the system structure is not explicitly shown by Equation (16). Instead, the work condition of each ETU in the system is influenced by the system structure, which will eventually change the FED and the reliability assessment result.

Parameters Estimation Using Probabilistic Physics-of-Failure Models
In Section 2, a multi-state reliability model of ETU, as well as the energy transfer system is established. The semi-Markov model is employed, which takes advantages of combining statistical reliability data with arbitrary sojourn time distribution. Statistically, all the parameters of the model can be estimated by sufficient data, which is used for reliability evaluation. Since FED is closely related to PPoF models, the parameters are possibly estimated with small sample sizes. In this section, parameters of the proposed model are estimated by mechanism instead of statistics.
The work stress of ETU can be load, pressure, flow, temperature and velocity and external environment may also influence the system, which results in different forms of degrading rates. Without loss of generality, we consider a time-varying incremental process to represent the physical degradation. The degrading rate is assumed to follow a Gaussian distribution, which is commonly utilized to describe the growth of cracks [27] and abrasive wear [28]. We should note that the degrading rate, which is based on a specific PPoF model, can be in arbitrary form. The increment of FED within a small-time duration should also follow a Gaussian distribution, which can be written as ∆ψ(t) ∼ N(µ ∆ψ (t), σ 2 ∆ψ (t)). Based on the specific degradation mechanism, N degradation state can be divided by deterministic FED {ψ (1) , ψ (2) , . . . , ψ (N) . Then, the FED at time t can be derived as: where α and β are related to the specific form of µ ∆ψ (t) and σ 2 ∆ψ (t), respectively. Particularly, if the incremental process is a standard wiener process, α = µ ∆ψ (t) and β = σ 2 ∆ψ (t), otherwise, α and β can be obtained by the Monte-Carlo method. The probability density function of τ i can be written as: Considering the state transition model shown in Figure 3, the state keeps in the current state or transits to the next state. Assuming that at T the state arrives at S i , given arbitrary time interval t, the state transition probability can be written as: (20) and a i,i (t) + a i,i+1 (t) = 1. The discrete sojourn time distribution can be written as: Considering the state transition model shown in Figure 3, the state keeps in the current state or transits to the next state. Assuming that at T the state arrives at i S , given arbitrary time interval t , the state transition probability can be written as: and , The discrete sojourn time distribution can be written as: Generally, with a deterministic PPoF model, the probability density function of i τ can be derived. For different state transition models, the state transition probability and discrete sojourn time distribution follow a deterministic form. Then, the semi-Markov kernel can be obtained by Equation (12) and the reliability of ETU can be calculated by Equation (14).

Application in Electro-Hydrostatic Actuation System
The electro-hydrostatic actuation system (EHA) is a typical energy transfer system which drives external load by transferring electrical power to hydraulic power. In more electrical aircraft, EHA is used to drive control surfaces such as the aileron, elevator and rudder. Since EHA is used as the backup system, its failure may result in the aircraft going out of control. An EHA is composed of a high-speed motor, hydraulic pump and hydraulic cylinder, which are regarded as ETUs in this paper. The high-speed motor drives the rotation of the hydraulic pump, which provides high hydraulic pressure to drive the motion of the cylinder. The structure of EHA is shown in Figure 4. Generally, with a deterministic PPoF model, the probability density function of τ i can be derived. For different state transition models, the state transition probability and discrete sojourn time distribution follow a deterministic form. Then, the semi-Markov kernel can be obtained by Equation (12) and the reliability of ETU can be calculated by Equation (14).

Application in Electro-Hydrostatic Actuation System
The electro-hydrostatic actuation system (EHA) is a typical energy transfer system which drives external load by transferring electrical power to hydraulic power. In more electrical aircraft, EHA is used to drive control surfaces such as the aileron, elevator and rudder. Since EHA is used as the backup system, its failure may result in the aircraft going out of control. An EHA is composed of a high-speed motor, hydraulic pump and hydraulic cylinder, which are regarded as ETUs in this paper. The high-speed motor drives the rotation of the hydraulic pump, which provides high hydraulic pressure to drive the motion of the cylinder. The structure of EHA is shown in Figure 4. An EHA fails when it cannot provide enough energy to drive the external load. The insufficiency of energy is the result of degradation on each ETU. The degradation of the motor will lead to a low input rotation speed and torque of the pump. The leakage of the pump results in lower driving pressure of the cylinder, and the degradation of the cylinder directly affects the output force of the system. For the pump, we consider three degradation mechanisms, which are leakage caused by abrasion between the piston and the plunger chamber, leakage caused by abrasion between the cylinder barrel and the valve plate, and leakage caused by abrasion between the slipper and swash plate. For the motor, we view decreasing output torque as wear between the bearing rings and bearing ball. For the cylinder, we consider the leakage caused by wear of seals. We should note that the degradation mechanisms considered in this paper may cover the major energy loss caused by wear, but are far from complete, due to the limitation of the authors' knowledge. It is mainly used to illustrate the proposed method and some of the assumptions are different from practice. PPoF models for ETUs are firstly built in Sections 4.1-4.3, and the proposed method is conducted to analyze the reliability of the system in Section 4.4.

Probabilistic Physics-of-Failure Model for Hydraulic Pump Degradation
In an aviation EHA, the axial piston pump is used to transfer energy from the electrical motor to the hydraulic cylinder. According to the statistic survey, the main failure of the piston pump is wearing and tearing of friction pairs, as shown in Figure 5. Since the degradation of the piston pump failure goes through the stages of lubrication, boundary lubrication and friction wear, its failure mechanism-based model needs describe all of the above process. When wear produces abrasive particles between the friction pairs of the piston pump, the increased wear leads to leakage between the friction pairs. At this moment, it is difficult to provide the required flow rate to the downstream component. There are three friction pairs in the piston pump, which are the valve-plate-cylinder-barrel, the slipper-swash plate and the piston-plunger chamber. Their wear and tear cause more than 95% leakage during the pump running [29] in real application.

Swash plate Slipper
Piston Plunger chamber Valve plate  An EHA fails when it cannot provide enough energy to drive the external load. The insufficiency of energy is the result of degradation on each ETU. The degradation of the motor will lead to a low input rotation speed and torque of the pump. The leakage of the pump results in lower driving pressure of the cylinder, and the degradation of the cylinder directly affects the output force of the system. For the pump, we consider three degradation mechanisms, which are leakage caused by abrasion between the piston and the plunger chamber, leakage caused by abrasion between the cylinder barrel and the valve plate, and leakage caused by abrasion between the slipper and swash plate. For the motor, we view decreasing output torque as wear between the bearing rings and bearing ball. For the cylinder, we consider the leakage caused by wear of seals. We should note that the degradation mechanisms considered in this paper may cover the major energy loss caused by wear, but are far from complete, due to the limitation of the authors' knowledge. It is mainly used to illustrate the proposed method and some of the assumptions are different from practice. PPoF models for ETUs are firstly built in Section 4.1, Section 4.2, Section 4.3, and the proposed method is conducted to analyze the reliability of the system in Section 4.4.

Probabilistic Physics-of-Failure Model for Hydraulic Pump Degradation
In an aviation EHA, the axial piston pump is used to transfer energy from the electrical motor to the hydraulic cylinder. According to the statistic survey, the main failure of the piston pump is wearing and tearing of friction pairs, as shown in Figure 5. Since the degradation of the piston pump failure goes through the stages of lubrication, boundary lubrication and friction wear, its failure mechanism-based model needs describe all of the above process. When wear produces abrasive particles between the friction pairs of the piston pump, the increased wear leads to leakage between the friction pairs. At this moment, it is difficult to provide the required flow rate to the downstream component. There are three friction pairs in the piston pump, which are the valve-plate-cylinder-barrel, the slipper-swash plate and the piston-plunger chamber. Their wear and tear cause more than 95% leakage during the pump running [29] in real application. An EHA fails when it cannot provide enough energy to drive the external load. The insufficiency of energy is the result of degradation on each ETU. The degradation of the motor will lead to a low input rotation speed and torque of the pump. The leakage of the pump results in lower driving pressure of the cylinder, and the degradation of the cylinder directly affects the output force of the system. For the pump, we consider three degradation mechanisms, which are leakage caused by abrasion between the piston and the plunger chamber, leakage caused by abrasion between the cylinder barrel and the valve plate, and leakage caused by abrasion between the slipper and swash plate. For the motor, we view decreasing output torque as wear between the bearing rings and bearing ball. For the cylinder, we consider the leakage caused by wear of seals. We should note that the degradation mechanisms considered in this paper may cover the major energy loss caused by wear, but are far from complete, due to the limitation of the authors' knowledge. It is mainly used to illustrate the proposed method and some of the assumptions are different from practice. PPoF models for ETUs are firstly built in Sections 4.1-4.3, and the proposed method is conducted to analyze the reliability of the system in Section 4.4.

Probabilistic Physics-of-Failure Model for Hydraulic Pump Degradation
In an aviation EHA, the axial piston pump is used to transfer energy from the electrical motor to the hydraulic cylinder. According to the statistic survey, the main failure of the piston pump is wearing and tearing of friction pairs, as shown in Figure 5. Since the degradation of the piston pump failure goes through the stages of lubrication, boundary lubrication and friction wear, its failure mechanism-based model needs describe all of the above process. When wear produces abrasive particles between the friction pairs of the piston pump, the increased wear leads to leakage between the friction pairs. At this moment, it is difficult to provide the required flow rate to the downstream component. There are three friction pairs in the piston pump, which are the valve-plate-cylinder-barrel, the slipper-swash plate and the piston-plunger chamber. Their wear and tear cause more than 95% leakage during the pump running [29] in real application.

Swash plate Slipper
Piston Plunger chamber Valve plate  Here we select the valve-plate-cylinder-barrel to indicate how to establish the failure mechanism-based model considering the degradation process. Because the piston pump goes through the lubrication, boundary lubrication and wear process during the degradation, the pressure distribution and the oil film distribution vary with the time, and thus the leakage flow can be calculated when the dimensional parameters of the valve plate R 1 , R 2 , R 3 and R 4 are fixed by [28]: where α 0 is the angle distribution of the pistons, P 0 is the suction pressure, P s is the discharge pressure, µ P is the dynamic viscosity and h cv (t) is the average clearance between the cylinder barrel and the valve plate. During the working process of the pump, the surfaces of the cylinder-barrel-valve-plate are not directly contacted, so that the surfaces are separated by a thin lubricating oil film. When there is no contaminant, the thickness of the lubricating oil film is equal to the clearance between the cylinder barrel and the valve plate. The abrasion will lead to a larger average clearance and the degradation rate of leakage can be obtained by r cv (t) = ∆Q cv (t) ∝ (∆h cv (t)) 3 .
Based on the definition of FED, the fluid energy of the leakage can be roughly regarded as the dissipation energy of the degradation caused by the abrasion between cylinder barrel and valve plate when the thermal effect is ignored. Assuming that the pump is working under pressure P p (t), the corresponding FED can be calculated as: We consider a three-body abrasive wear process to illustrate a possible way to obtain the degradation rate. A relevant research study [30] shows that the degree of wear caused by particles is mainly affected by the size of debris particles and the distance between the two surfaces. As is shown in Figure 6a, the scratch of valve plate is probably caused by the invasion of a debris particle. The measurement data of the abrasion length is shown in Figure 6b. Here we select the valve-plate-cylinder-barrel to indicate how to establish the failure mechanism-based model considering the degradation process. Because the piston pump goes through the lubrication, boundary lubrication and wear process during the degradation, the pressure distribution and the oil film distribution vary with the time, and thus the leakage flow can be calculated when the dimensional parameters of the valve plate 1 R , 2 R , 3 R and 4 R are fixed by [28]: where 0 α is the angle distribution of the pistons, 0 P is the suction pressure, s P is the discharge pressure, P μ is the dynamic viscosity and ( ) cv h t is the average clearance between the cylinder barrel and the valve plate. During the working process of the pump, the surfaces of the cylinder-barrel-valve-plate are not directly contacted, so that the surfaces are separated by a thin lubricating oil film. When there is no contaminant, the thickness of the lubricating oil film is equal to the clearance between the cylinder barrel and the valve plate. The abrasion will lead to a larger average clearance and the degradation rate of leakage can be obtained by Based on the definition of FED, the fluid energy of the leakage can be roughly regarded as the dissipation energy of the degradation caused by the abrasion between cylinder barrel and valve plate when the thermal effect is ignored. Assuming that the pump is working under pressure ( ) the corresponding FED can be calculated as: We consider a three-body abrasive wear process to illustrate a possible way to obtain the degradation rate. A relevant research study [30] shows that the degree of wear caused by particles is mainly affected by the size of debris particles and the distance between the two surfaces. As is shown in Figure 6a, the scratch of valve plate is probably caused by the invasion of a debris particle. The measurement data of the abrasion length is shown in Figure 6b. Based on the research by Dwyer-Joyce [31], assuming that the debris particles follow Gaussian distribution, the increment of the average clearance can be expressed as where nominal A is the nominal contact area, n is the rotating speed of pump, H is the relative hardness of the two contact surfaces, f μ and f σ are the parameters of debris loss rate, and the expression of J μ and J σ which are related to the dimensional parameters of pump and Based on the research by Dwyer-Joyce [31], assuming that the debris particles follow Gaussian distribution, the increment of the average clearance can be expressed as ∆h(t) ∼ N(µ ∆h (t), (σ ∆h (t)) 2 ), and: where A nominal is the nominal contact area, n is the rotating speed of pump, H is the relative hardness of the two contact surfaces, µ f and σ f are the parameters of debris loss rate, and the expression of µ J and σ J which are related to the dimensional parameters of pump and distributions of debris particles is shown in Appendix A. We should note that such a model neglects the energy cost of material fracture, frictional sliding and the flow loss caused by the invasion of debris, which takes a low percentage. Similarly, the FED caused by the other two degradation mechanisms can be obtained. According to the study by Wang [28], the leakage caused by the friction pair of piston and plunger chamber can be calculated by where η is the eccentricity ratio, v pc is the relative velocity of the two contact surfaces, d p is the diameter of the piston, l is the piston length and h pc (t) is the average clearance of the two surfaces. The increasing leakage ∆Q pc (t) can be obtained when the average clearance of the two surfaces changes. The leakage caused by the friction pair of slipper and swash plate can be calculated by: where P 1 is the pressure in the slipper center hole, R s1 and R s2 are the dimensional parameters shown in Figure 5, and h ss (t) is the average clearance of the two surfaces. Then the FED of the pump by the three degradation mechanisms can be obtained by:

Probabilistic Physics-of-Failure Model for Motor Degradation
The motor drives the rotation pump by converting electrical energy into mechanical energy. The degradation of the motor is mainly reflected by the decreasing of output torque and speed. Based on different control methods, the motor can maintain its output by increasing input energy when degradation occurs, which results in lower efficiency. The degradation may be caused by the magnetic components or mechanical components. In this part, we only consider the decreasing output torque by wear between the bearing rings and bearing balls of an angular contact ball bearing (ACBB).
With the operation of the motor, a degrading ACBB will generate additional friction torque. This part of torque can be regarded as the reduction of rated output torque. According to the characteristics of internal friction in ACBB, the additional friction torque is mainly caused by the elastic hysteresis between ball and the rings, the fluid dynamic pressure and the effect of differential sliding. The study result by Deng et al. [32] is employed to illustrate how to establish the relation between FED and PPoF models of decreasing output torque by wear between the bearing rings and bearing balls, considering two-body wear between balls and rings. On the basis of dynamic analysis [33], the hysteresis energy through a loading cycle for the j th (total number of balls is Z) ball can be written as: where β M is the elastic hysteresis coefficient, n i(o) is the rotating speed, n m is the revolution speed of the ball, Q i(o) is the contact load between each ball and the ring, ε 1 and ε 2 are the Poisson's ratio of balls and rings, E 1 and E 2 are the elastic modulus of balls and rings, k i(o) (t) =a i e,j (t)/b i e,j (t) is the ellipticity of contact ellipse, which is shown in Figure 7, and o represent the inner ring (cone) and outer ring (cup), respectively. The torque reduction by the hysteresis energy can be calculated as: Energies 2019, 12, x FOR PEER REVIEW 11 of 23 and the superscript i and o represent the inner ring (cone) and outer ring (cup), respectively. The torque reduction by the hysteresis energy can be calculated as: The energy cost by fluid dynamic pressure can be calculated by: where m d is the oil film thickness, m η is the viscosity of oil, m p is the fluid dynamic pressure, 1 v is the relative velocity of the ball and inner ring and 2 v is the relative velocity of the ball and outer ring. The torque reduction by fluid dynamic pressure can be calculated as: The energy cost by the effect of differential sliding can be calculated by: where D μ is the friction coefficient between balls and rings, v ηξ is the differential sliding velocity, Ω is the contact ellipse area. The torque reduction by the effect of differential sliding can be calculated as: The total reductive torque can be calculated as: and the corresponding FED can be given as: The energy cost by fluid dynamic pressure can be calculated by: where d m is the oil film thickness, η m is the viscosity of oil, p m is the fluid dynamic pressure, v 1 is the relative velocity of the ball and inner ring and v 2 is the relative velocity of the ball and outer ring. The torque reduction by fluid dynamic pressure can be calculated as: The energy cost by the effect of differential sliding can be calculated by: where µ D is the friction coefficient between balls and rings, v ηξ is the differential sliding velocity, Ω is the contact ellipse area. The torque reduction by the effect of differential sliding can be calculated as: The total reductive torque can be calculated as: and the corresponding FED can be given as: (35) where ω m is the rotating speed of the motor. We consider a two-body wear between the ball and rings. Particularly, we assume that the wear performs uniformly on the balls, and that the balls remain isotropous during the wear. The two-body wear leads to a reduction on the radius of the balls. Since the two-body wear is a stochastic process, which is influenced by rough contact surfaces and the environment, the wear rate, which depicts the radius change of the ball, is assumed to follow a certain distribution.
The change of the sum of curvatures ρ(t) can then be obtained by: where R b (t) is the radius of the ball, R inner is the radius of inner ring and R outer is the radius of outer ring. Based on Hertz theory, the parameter of the contact ellipse can be calculated by: where P m is the contact pressure, µ e and ν e are related to the dimensional parameters of the bearing. We should note that such a model neglects the deformation of rings, the wear of rings and the energy cost during the wear process.

Probabilistic Physics-of-Failure Model for Hydraulic Cylinder Degradation
The hydraulic cylinder, working as the actuator in EHA, outputs the terminal energy to external loads. The degradation of the hydraulic cylinder leads to the decreasing of output force. The dynamic seals move with the piston of the cylinder, as shown in Figure 8. A vital degradation mode is the internal leakage, caused by the wear of dynamic seals, which makes the pressure difference between the high-pressure chamber and the low-pressure chamber decrease. The internal leakage will, then, cause the reduction of output force. where m ω is the rotating speed of the motor.
We consider a two-body wear between the ball and rings. Particularly, we assume that the wear performs uniformly on the balls, and that the balls remain isotropous during the wear. The two-body wear leads to a reduction on the radius of the balls. Since the two-body wear is a stochastic process, which is influenced by rough contact surfaces and the environment, the wear rate, which depicts the radius change of the ball, is assumed to follow a certain distribution.
The change of the sum of curvatures ( ) t ρ  can then be obtained by: R t is the radius of the ball, inner R is the radius of inner ring and outer R is the radius of outer ring. Based on Hertz theory, the parameter of the contact ellipse can be calculated by: where m P is the contact pressure, e μ and e ν are related to the dimensional parameters of the bearing. We should note that such a model neglects the deformation of rings, the wear of rings and the energy cost during the wear process.

Probabilistic Physics-of-Failure Model for Hydraulic Cylinder Degradation
The hydraulic cylinder, working as the actuator in EHA, outputs the terminal energy to external loads. The degradation of the hydraulic cylinder leads to the decreasing of output force. The dynamic seals move with the piston of the cylinder, as shown in Figure 8. A vital degradation mode is the internal leakage, caused by the wear of dynamic seals, which makes the pressure difference between the high-pressure chamber and the low-pressure chamber decrease. The internal leakage will, then, cause the reduction of output force. We consider the internal leakage caused by the wear of dynamic seals. The total internal leakage of the cylinder can be calculated by [34]: Since the wear process is influenced by topology of the rough contact surfaces, the contact pressure between the seal and the piston is assumed to follow a certain distribution.

Reliability Evaluation of Electro-Hydrostatic Actuation System
The target scenario is to use a certain type of EHA [35] to drive a control surface of an aircraft independently. The rated output power of the EHA is 10 kW, the rated hydraulic pressure is 28 MPa and the rated motor rotation speed is 12,000 r/min. According to the energy requirement listed in [36,37], the minimum power requirement for an aileron during a regular flight is approximate 8 kW. Assuming that the rated efficient of the EHA is 90%, the FED threshold of the system is estimated at 2.2 kW.
The details of the uncertainty for the considered scenario is shown in Table 1, which has been configured by the author, according to [32,34,38]. The degradation rate of each variable has been normalized to each minute. For an intuitive degradation process, a Monte-Carlo simulation is conducted. The degradation process of each ETU is illustrated by 1000 samples under the proposed uncertainty configuration. As shown in Figure 9, 90% confidence interval of all the 1000 samples at each time point is calculated, and the FED corresponding to the specific failure mechanism is shown with the degradation process of each ETU.   (c) cylinder.
If the system is evaluated by the criterion that the system fails when the FED of the system reaches 2.2 kW, then the reliability of the system can be obtained by the proposed method. To compare with the traditional evaluating method, the criterion of which is defined by failure thresholds of individual components, the individual failure thresholds are defined as F TH pump , F TH motor and F TH cylinder , respectively. In traditional methods, in fact, the failure data and failure thresholds are obtained by reliability test. Hereby, traditional thresholds of given components are referred to, and configured by, the author. The traditional reliability of the serial system can thus be obtained by: where T motor (t) is the torque reduction of motor, L pump (t) is the leakage of pump and L cylinder (t) is the leakage of cylinder. A total of 3 groups of comparisons are conducted to show the difference between traditional reliability assessment methods using individual failure thresholds, and the proposed system-level method. For the first group, the summation of equivalent FED of each individual failure threshold is set to be larger than the system threshold 2.2 kW. For the second group, the summation of the equivalent FED of each individual failure threshold is set to be around the system threshold. For the third group, the summation FED of each individual failure threshold is set to be less than the system threshold. The detailed simulation data are listed in Table 2. With different individual failure thresholds, the reliability evaluated by the individual failure thresholds are shown in Figure 10. We can see that in Figure 10a, when the summation of equivalent FED of each individual threshold is larger than the system FED threshold, the reliability evaluated by the traditional method has a greater margin than the proposed method, which is in accordance with the fact that larger thresholds mean more tolerance of degradation. In Figure 10c, when the summation of the equivalent FED of each individual threshold is less than the system FED threshold, then the reliability evaluated by the traditional method has a smaller margin than the proposed method. For group 2, the traditional method has less tolerance of degradation than the proposed method, which can be explained by the fact that, although the pump has already met the presupposed threshold, for the system, it can still be used. On this basis, the proposed method is less rigorous than the traditional method, when the summation of equivalent FED equals the system FED threshold.
threshold, then the reliability evaluated by the traditional method has a smaller margin than the proposed method. For group 2, the traditional method has less tolerance of degradation than the proposed method, which can be explained by the fact that, although the pump has already met the presupposed threshold, for the system, it can still be used. On this basis, the proposed method is less rigorous than the traditional method, when the summation of equivalent FED equals the system FED threshold. From the figures, we can also see that the reliability evaluated by the traditional method sharply decreases when the summation of the equivalent FED is relatively small. This is related to the uncertainty configuration. Since under a smaller threshold of failure, the reliability is more likely to be influenced by the components with fewer uncertainties, in the PPoF models established in the above sections, the modeling uncertainty of the motor is weakened by the assumption of the uniform wear process, which leads to the dominance of the motor when the summation of From the figures, we can also see that the reliability evaluated by the traditional method sharply decreases when the summation of the equivalent FED is relatively small. This is related to the uncertainty configuration. Since under a smaller threshold of failure, the reliability is more likely to be influenced by the components with fewer uncertainties, in the PPoF models established in the above sections, the modeling uncertainty of the motor is weakened by the assumption of the uniform wear process, which leads to the dominance of the motor when the summation of equivalent FED is relatively small.
As a global criterion, the reliability evaluated by the system failure threshold can help ascertain the traditional thresholds of individual components. In fact, the ascertaining traditional thresholds of individual components is a dynamic process. By setting the thresholds of the pump and the cylinder fixed at F TH pump = 2.8 L/min and F TH cylinder = 4.9 L/min, the traditional reliability can be calculated by changing the threshold of the motor. As shown in Figure 11, the red surface is the reliability evaluated by the proposed method, which is only dependent on time, meanwhile, the other surface, which presents the traditional reliability, depends on both time and the individual failure threshold of the motor. The intersecting curve of the two surfaces can be used to ascertain the failure thresholds of the motor, with fixed thresholds of the pump and the cylinder. By using such a method, it can effectively avoid the scenario where, despite the motor already meeting the presupposed threshold, the system continues to provide enough output, which will prolong the service life and will provide potential economic benefits.

Conclusions
A system-level reliability assessment method for the energy transfer system is proposed in this paper to solve the practical difficulty of a unified description of the system degradation state, caused by different physical degradation mechanisms. FED is an additive variable to quantitatively evaluate the effect of component degradation on the entire system. PPoF models of different mechanisms can be used to obtain the corresponding FED. By using FED, the system reliability can be defined from the perspective of the system, instead of using a set of individual failure thresholds of components. An application in EHA shows that the proposed method is effective for describing system reliability and the method can help ascertain the component failure threshold when the system threshold is confirmed.
It is worth noting that, although in this paper wear processes of different EHA components are modeled and FED is obtained, the other degradation mechanisms such as electrical, magnetic and chemical mechanisms could also be modeled, and the corresponding FED can be obtained in a similar way. Since there is no common method to build the PPoF models, sufficient knowledge of studied degradation mechanisms is required to establish the relation between uncertainties and system dynamics. In this paper, we consider some uncertainties which are modeled as certain distributions and make assumptions to avoid some uncertainties, but there are still uncertainties that are not recognized by

Conclusions
A system-level reliability assessment method for the energy transfer system is proposed in this paper to solve the practical difficulty of a unified description of the system degradation state, caused by different physical degradation mechanisms. FED is an additive variable to quantitatively evaluate the effect of component degradation on the entire system. PPoF models of different mechanisms can be used to obtain the corresponding FED. By using FED, the system reliability can be defined from the perspective of the system, instead of using a set of individual failure thresholds of components. An application in EHA shows that the proposed method is effective for describing system reliability and the method can help ascertain the component failure threshold when the system threshold is confirmed.
It is worth noting that, although in this paper wear processes of different EHA components are modeled and FED is obtained, the other degradation mechanisms such as electrical, magnetic and chemical mechanisms could also be modeled, and the corresponding FED can be obtained in a similar way. Since there is no common method to build the PPoF models, sufficient knowledge of studied degradation mechanisms is required to establish the relation between uncertainties and system dynamics. In this paper, we consider some uncertainties which are modeled as certain distributions and make assumptions to avoid some uncertainties, but there are still uncertainties that are not recognized by the authors. With the development of knowledge, there will be more and more uncertainties being transformed to certainties. For unknown degradation mechanisms, the statistical reliability data can be used to describe the state transition model of the degrading process, alternatively.
Author Contributions: X.C. and T.L. wrote the manuscript together; S.W. designed the idea and provided supervision; J.S. reviewed the manuscript.  We can see from Table A1 that the majority of the debris particles are small ones. If the clearance of the two surfaces is larger than the size of the debris, then considering the influence by shape, , there is less probability for abrasion. Since the hardness of the two contact surfaces is different, three possible conditions may result in different degrees of damage on the surfaces. If the size of a debris particle is larger than the clearance and the hardness of debris is smaller than both surfaces, the abrasion is ignored. If the hardness of debris is larger than one of the two surfaces, the abrasion only occurs on the soft surface. If the hardness of debris is larger than both surfaces, the damage ratio is proportional to the relative hardness of the two surfaces. The wear volume caused by the debris particles, with specific concentration and distribution during one stress cycle of the friction pair can be used to calculate the increment of average clearance by dividing the nominal contact area of the two surfaces.
Assuming that the hardness of debris is larger than both surfaces, the abrasion occurs on both surfaces. The wear depth caused by the debris can be obtained by:  We can see from Table A1 that the majority of the debris particles are small ones. If the clearance of the two surfaces is larger than the size of the debris, then considering the influence by shape, d/h ≤ 1/ cos β d , there is less probability for abrasion. Since the hardness of the two contact surfaces is different, three possible conditions may result in different degrees of damage on the surfaces. If the size of a debris particle is larger than the clearance and the hardness of debris is smaller than both surfaces, the abrasion is ignored. If the hardness of debris is larger than one of the two surfaces, the abrasion only occurs on the soft surface. If the hardness of debris is larger than both surfaces, the damage ratio is proportional to the relative hardness of the two surfaces. The wear volume caused by the debris particles, with specific concentration and distribution during one stress cycle of the friction pair can be used to calculate the increment of average clearance by dividing the nominal contact area of the two surfaces.
Assuming that the hardness of debris is larger than both surfaces, the abrasion occurs on both surfaces. The wear depth caused by the debris can be obtained by: The scratch area can be calculated as: According to the experimental result, the thickness of oil film distributes as a sinewave along the circumference of the clearance: h ex (θ) = m ex + k ex sin(θ − n ex ) h in (θ) = m in + k in sin(θ − n in ) where h ex (θ) is the film thickness of outer seal oil zone, h in (θ) is the film thickness of inner seal oil zone, m ex , k ex and n ex are the fitted parameters of the outer seal oil zone, m in , k in and n in are the fitted parameters of the inner seal oil zone. The total wear volume caused by this form of debris for one rotation cycle is: V ex R ex m ex θ ex1 1dθ + k ex θ ex1 sin(θ − n ex )dθ +V in R in m in θ in1 1dθ + k in θ in1 sin(θ − n in )dθ V ex R ex · (m ex ) 2 θex 1dθ+2m ex k ex θex sin(θ − n ex )dθ + (k ex ) 2 θex sin 2 (θ − n ex )dθ +V in R in (m in ) 2 θ in 1dθ+2m in k in θ in sin(θ − n in )dθ + (k in ) 2 θ in sin 2 (θ − n in )dθ where R ex = R 3 +R 4 2 , R in = R 1 +R 2 2 , θ ex ∈ {θ|h ex (θ) < d tan β d }, θ in ∈ {θ|h in (θ) < d tan β d }, W debris is the concentration of debris, f loss is the probability that the debris flow away during the rotating, V ex is the average oil volume in outer seal oil zone and V in is the average oil volume in inner seal oil zone.
If the debris loss rate f loss ∼ N(µ f , σ f ), debris of different sizes which are larger than clearance all follow different Gaussian distributions N(µ d (i) , σ d (i) ) where d (i) stands for i th kind of debris, the total wear volume follow a Gaussian distribution: where (A6) a i , b i and c i are obtained from Equation (A4): debris V ex R ex m ex θex 1dθ + k ex θex sin(θ − n ex )dθ + V in R in m in θ in1 1dθ + k in θ in sin(θ − n in )dθ V ex R ex · (m ex ) 2 θex 1dθ+2m ex k ex θex sin(θ − n ex )dθ + (k ex ) 2 θex sin 2 (θ − n ex )dθ +V in R in (m in ) 2 θ in 1dθ+2m in k in θ in sin(θ − n in )dθ + (k in ) 2 θ in where W (i) debris is the concentration of i th kind of debris. The peak squeezing stress can be calculated by: Then, the total squeezing stress along axial direction can be calculated by:  The peak squeezing stress can be calculated by: (A9) Then, the total squeezing stress along axial direction can be calculated by: (A10) and the stress on the entire contact area can be obtained by: The contact pressure can be calculated by: where A xy (t) = l x (t)l y (t) is the contact area. Assuming that every point on the seal's external surface has the same opportunity to be subject to wear, the diameter of seal can be updated by: