Availability optimization of systems subject to competing risk

Stochastics and StatisticsAvailability optimization of systems subject to competing riskY.Zhu a ,E.A.Elsayed a,*,H.Liao b,c ,L.Y.Chan daDepartment of Industrial and Systems Engineering,Rutgers University,96Frelinghuysen Road,Piscataway,NJ 08854,USA bDepartment of Nuclear Engineering,University of Tennessee,Knoxville,TN 37996,USA cDepartment of Industrial and Information Engineering,University of Tennessee,Knoxville,TN 37996,USA dDepartment of Industrial and Manufacturing Systems Engineering,The University of Hong Kong,Pokfulam Road,Hong Konga r t i c l e i n f o Article history:Received 31August 2008Accepted 10June 2009Available online 14June 2009Keywords:Preventive maintenance Competing riskDegradation process Sudden failureNon-stationary renewal processa b s t r a c tThis paper considers a competing risk (degradation and sudden failure)maintenance situation.A main-tenance model and a repair cost model are presented.The degradation state of the units is continuously monitored.When either the degradation level reaches a predetermined threshold or a sudden failure occurs before the unit reaches the degradation threshold level,the unit is immediately repaired (renewed)and restored to operation.The subsequent repair times increase with the number of renewals.This process is repeated until a predetermined time is reached for preventive maintenance to be per-formed.The optimal maintenance schedule that maximizes the unit availability subject to repair cost constraint is determined in terms of the degradation threshold level and the time to perform preventive maintenance.Ó2009Elsevier B.V.All rights reserved.1.IntroductionMaintenance policies can be classified as corrective mainte-nance (CM),condition-based maintenance (CBM)and preventive maintenance (PM).The CM is performed when failures occur or when the degradation level of the system reaches an unacceptable level.The CBM is performed when an indicator of the condition of the system (or unit,system and unit are used interchangeably in this paper)reaches a predetermined level.The PM is performed at predetermined time intervals which are estimated based on his-torical data,failure time distributions of the systems,and eco-nomic or availability models.In general,maintenance actions depend on many factors such as the failure rate (or degradation rate)of the system,the cost associated with downtime,the cost of repair,the expected life of the system and the desired availabil-ity level.For example,a maintenance policy which requires no re-pairs,replacements or preventive maintenance until failure allows for maximum run-time between repairs.Although it allows for maximum run-time between repairs it is neither economical nor efficient as it may result in a catastrophic failure that requires extensive repair time and cost.Another widely used maintenance policy is to maintain the system (equipment,unit etc.)according to a predetermined schedule,whether a problem is apparent or not.On a scheduled basis,equipment are removed from operation,disassembled,inspected for defective parts and repaired accord-ingly.Actual repair costs can be reduced in this manner but pro-duction loss may increase if the equipment is complex and requires days or even weeks to maintain.This preventive mainte-nance may also create equipment problems where none existed before.Becker et al.[5]cite a 1990report from Electric Power Re-search Institute (EPRI)which states that one-third of the money spent on preventive maintenance in the electric power industry (which that year amounted to $60billion)was wasted.Obviously,if an equipment failure can be predicted and the equipment can be taken off-line to make only the necessary repairs,a tremendous cost saving can be achieved.Predictive maintenance can also be done when failure modes for the equipment can be identified and monitored for increased intensity and when the equipment can be shut down at a fixed control limit before critical fault levels are reached (Jeong and Elsayed [20]).The recent advances in sensors technology,chemical and phys-ical non-destructive testing (NDT),and sophisticated measurement techniques,information processing,wireless communications and internet capabilities have significantly impacted the condition-based maintenance approach by providing dynamic maintenance schedules that minimize the cost,downtime and increase system availability.More importantly,the sensors provide indicators about the system operating conditions and potential failures.Moreover,sensors for monitoring the equipment eliminate the time for diagnostics thus reducing the time to perform the actual repair.A major international elevator company is using this ap-proach to remotely monitor the braking system of elevators in high-rise buildings;when the deceleration of the elevator reaches a specific value,action is taken immediately to repair or replace the0377-2217/$-see front matter Ó2009Elsevier B.V.All rights reserved.doi:10.1016/j.ejor.2009.06.008*Corresponding author.Tel.:+17324453859;fax:+17324455467.E-mail addresses:yadazhu@ (Y.Zhu),elsayed@ ,elsayed@ (E.A.Elsayed),hliao4@ (H.Liao),plychan@hku.hk (L.Y.Chan).European Journal of Operational Research 202(2010)781–788Contents lists available at ScienceDirectEuropean Journal of Operational Researchjournal homepage:www.elsev i e r.c o m /l o c a t e /e j orbraking system.Likewise,the conditions of aircraft engines are continuously monitored by the operating companies duringflying (messages are referred to as AOC or Aircraft Operational Communi-cation)and the aircraft crew is provided with decision,through ground stations,to change destination and proceed to another where spare parts and repairs can be performed if these specific maintenance actions are not available at the original destination. Furthermore,recent inspection technologies that require no hu-man entry into underground structures have been developed;they are now fully automated,from data acquisition to data analysis, and eventually to condition assessment,which can be used during the manufacturing as well as maintenance actions(Kumar et al.[22]).Other motivational examples for monitoring degradation data and performing maintenance actions when the degradation threshold reaches a specified value are:(a)the fatigue-crack-growth data presented in Lu and Meeker[26]where actions are ta-ken when the crack length reaches a specified value,and(b)the degradation of semiconductor lasers during operation which is characterized by an increase in the threshold current,accompanied by decrease in external differential quantum efficiency.This in turn promotes defect formation in the active region of the laser(Ng [33]).For condition-based maintenance,there are three main tasks: (1)determining the condition indicator which can describe the condition of the unit.A condition indicator could be a characteris-tic such as corrosion rate,crack-growth,wear and lubricant condi-tion such as its viscosity;(2)monitoring the condition indicator and assessing the current unit condition from the measured data;(3)determining the limit value of the condition indicator and its two components:the alarm limit S a and the failure or breakdown limit S b.Determination of these limits as well as the maintenance and/or inspection strategies that optimize one or more criteria such as cost or system availability have been the subject of investigation.Specifically the use of degradation data to assess reliability is investigated by Gertsbackh and Kordonskiy[17],Nelson[32],Bog-danoff and Kozin[7]Carey and Koenig[8],Chick and Mendel[11], Feinberg and Widom[16],Meeker et al.[31]and Ettouney and El-sayed[15].Recently,Grall et al.[18]focus on modeling of a condi-tion-based inspection/replacement policy for degrading systems. Marseguerra et al.[29]consider a continuously monitored multi-component system and use a genetic algorithm to determine the optimal degradation level beyond which PM is performed.Jamali et al.[19]consider joint optimal periodic and conditional mainte-nance strategy.Saranga and Knezevic[34]use reliability condition predictor for reliability prediction of condition-based maintenance systems.The methodology uses Markov models for reliability pre-diction.Barbera et al.[4]discuss a condition-based maintenance model with exponential failures andfixed inspection intervals for a two-unit system in series.Luce[27]investigates the‘‘best”main-tenance approach using Weibull distribution by comparing condi-tion-based maintenance,systematic PM and conditional PM. Furthermore,maintenance or replacement actions can be either perfect or imperfect,which restore the system to the as-good-as-new state or to an intermediate state(Makis and Jardine[28],El-sayed[14]).Maintenance models for degrading systems are limited to perfect maintenance(Grall et al.[18])and the development of condition-based maintenance models considering imperfect main-tenance actions will advance the theory of maintenance engineering.This paper is motivated by the authors’experience with industry and actual real life cases.For example,Lin and Siewiorek[25]and Ascher et al.[1]show that about90%of the crashes experienced by computing systems are due to intermittent and transient faults.NomenclatureCBM condition-based maintenanceCM corrective maintenancePM preventive maintenancei:i:d:independent and identically distributedC total maintenance cost per unit timeCÃconstraint of repair cost per unit timeC f maintenance cost due to sudden failureC d maintenance cost due to degradationM f expected number of renewals due to sudden failureM d expected number of renewals due to degradationMðsÞexpected number of renewals in frequency domainS a threshold alarm limitS b threshold failure or breakdown limitS0initial value of the degradationSðtÞdegradation level at time tSÃdegradation threshold levelb degradation rateðbÀ1$expðkÞÞ;k is degradationconstantT d time that the degradation attains SÃT f time of a sudden failureT i time of the i th failure,i:i:d:for all iT Ri repair time of the i th failure(the i th repair time)X i length of cycle i(sum of the uptime and repair time in one cycle)T P time to perform preventive maintenanceTÃlower bound of T PCDF cumulative distribution functionpdf probability density functionFðÁÞCDF of a random variable FÃG convolution of FðÁÞand GðÁÞfðÁÞ;fðÁjÁÞpdf and conditional pdf of a random variable,respec-tivelyE½Á ;E½ÁjÁ expected and conditional expected values of a random variable,respectivelyfÃfðsÞLaplace transform of the density function of the sudden failure processfÃdðsÞLaplace transform of the density function of the degra-dation processuðtÞhazard rate functionh;c scale and shape parameters of the Weibull distribution, respectivelya iÀ1scale factor for the i th repair time,i.e.,the ratio betweentwo consecutive repairs is a,it reflects the aging effect ofthe unit1=SÃ;1>0repair rateX n total time for n renewalsLðÁÞ;LÀ1ðÁÞLaplace transform and the inverse of the transform operatorsfÃðsÞLaplace transform of fðtÞP i;j probability of having i failures(i=0,1,2,...1Þunder case j(j=1and2for degradation and sudden failure,respectively)E½Up i;j expected uptime when i(i=0,1,2,...1Þfailures oc-curred under case j(j=1,2)AAðT PÞachieved availability if preventive maintenance is per-formed at T PAAðT PÞunavailability if preventive maintenance is performed at T P782Y.Zhu et al./European Journal of Operational Research202(2010)781–788Interestingly,they conclude that most of the permanent faults are preceded by intermittent faults.The rates of occurrence of intermit-tent faults are expected to increase as transistor and interconnect dimensions shrink as discussed in Constantinescu[12].Isolation of a failing component before a crash occurs allows for seamless activation of a spare or graceful degradation(if spares are not available).Recently,Constantinescu[13]considers a failure to be eminent when the number of errors reaches a predetermined threshold over a given period of time.As a result,the component is isolated and further action is taken such as replacement of the failing part.This scheme is also known as‘‘leaky bucket”and was initially used for traffic control in asynchronous transfer mode net-works by Berger et al.[6].This is similar to the degradation process being considered in this paper.As stated in Constantinescu[13],in this problem it is difficult to use a specific(accurate and precise) threshold for the number of failures counted over time and the system crash(sudden failure)can occur before the error threshold is reached,due to spikes in the error rate,separated by a relatively long period of time with no errors.Such a behavior is common in the case of intermittent faults experienced in VLSI circuits.If the error threshold is set to a very low value,to avoid the previous scenario,a good component may be replaced due to a small number of transient errors,induced by environmental conditions and if it is set too high the system may crash before reaching the threshold level.We refer to this situation as a competing risk case.This paper considers a competing risk maintenance situation as described above.The competing risk is attributed to the potential failure of a unit either due to degradation when the degradation le-vel reaches a predetermined value or due to a sudden failure before the unit reaches the degradation threshold value.In other words, when either the degradation level reaches the threshold SÃor a fail-ure occurs,the unit is regarded as failed.When either of these oc-curs the unit is immediately repaired.This process is repeated until a predetermined time T p is reached at which an PM is performed. We seek the optimum SÃand T p assuming that repair is perfect. This paper investigates the problem and determines values of SÃand T p that maximize the achieved availability of the system or a unit subject to unit repair cost constraint.This paper is organized as follows:Section2presents the model description and processes. Section3introduces the maintenance policy formulation.Section4 presents a numerical example and investigates the effect of the model parameters on the overall unit availability.Section5dis-cusses the results and conclusions of the paper.2.Model description and processesWe consider a unit subject to degradation and sudden failures (competing risk).The degradation state of the unit is continuously monitored.When either the degradation level reaches a predeter-mined threshold or a sudden failure occurs before the unit reaches the degradation threshold level,the unit is immediately repaired (renewed)and restored to normal operation.This problem has sev-eral processes as described below.2.1.The renewal processWe assume that the operating times(up times of the unit)are independent and identically distributedði:i:d:Þand that the repair times are independent but stochastically increasing with the num-ber of performed repairs.The operating and repair intervals form a non-stationary alternating renewal process as shown in Fig.1.At time t1,the degradation level reaches the degradation threshold ðSÃÞbefore sudden failure occurs and the unit fails due to degrada-tion.The unit is repaired immediately.At time t2,the unit is re-newed(repair action isfinished)and resumes its operation.In other words,a new cycle begins at time t2.At time t3,a sudden fail-ure occurs before the degradation level reaches SÃ,the unit fails due to sudden failure.The unit is repaired again and renewed at time t4.Since the mean repair time increases with the number of repairs performed,this operating-repair cycle is not stationary. The non-stationary alternating renewal process is continued and then truncated at T p at which PM begins.2.2.Degradation processAn important step in maintenance is to quantify the amount of degradation of the unit using signals received from the degradation indicator(s)and sensors.The degradation process is directly re-lated to the critical characteristics that relate to unit failures.For example,in typical structures(such as buildings and bridges)the characteristics may include the strength of supporting beams,the strength of the joints and other elements.They are directly influ-enced by the environments such as temperature changes,humidity level,and the applied loads.This effect can be measured by load cells,corrosion sensors and others.The rate of the degradation can then be modeled accordingly.Most of the models assume lin-ear degradation path with a degradation rate that follows a proba-bility distribution.For example,Yu[38]assumes a reciprocal Weibull distribution,Lu and Meeker[26]consider both linear and nonlinear degradation paths and Bae and Kvam[3]consider a degradation model with nonlinear random-coefficients.Following Yu[38]and based on our experimental results of testing the degradation of light emitting diodes which is later ver-ified by Bae et al.[2]for the degradation of light displays,we as-sume that the degradation rate follows a reciprocal exponential distribution.In this paper,we assume that the degradation process is continuously monitored by sensors and the degradation path of the unit being monitored is expressed as SðtÞ¼S0þb t,where SðtÞis the degradation measure(indicator)at time t;S0P0is the ini-tial value of the degradation level and b is the random degradation rate which varies from unit to unit.When the degradation level reaches a predetermined threshold SÃ>S0,the unit is regarded as failed.In practice,the measurement of SðtÞis subject to random measurement error and/or systematic measurement error.How-ever,the systematic measurement errors of sensors usually can be corrected by the analysis of physical mechanisms of the sensors ([36,37]).Researchers have utilized two approaches in order to minimize the effect of measurement errors(Kim et al.[21]):the first approach deals with the reduction of variability of the mea-surements through the use of more precise measurement devices and/or better-trained operators(Chandra and Schall[9],Chen and Chung[10],Tang[35]).The second approach deals with defin-ing a guard band(or a zone)where the true value of the measure-ments falls.In this paper,we consider that the sensors’measurements are‘‘error free”since taking measurement errors into account at this stage results in unnecessary complications of the model and masks the main focus of the paper.We assume that b has a reciprocal exponential distribution,i.e.bÀ1$expðkÞ.Let T d denote the time that the degradation attains SÃ.Its cumulative dis-tribution and density functions are,respectively given byF TdðtÞ¼P f T d6t g¼PSÃÀS0b6t&'¼P1b6tSÃÀS0&'¼1ÀexpÀk tSÃÀS0;t>0;f TdðtÞ¼kSÃÀS0expÀk tSÃÀS0;t>0:Thus,T d has an exponential distribution with a hazard rate kÃ.Y.Zhu et al./European Journal of Operational Research202(2010)781–7887832.3.Failure processParallel to the degradation process,the unit is also subject to another mode of failure called ‘‘traumatic”failure (Meeker et al.[31]and Lehmann [24]).We refer to this failure as ‘‘sudden failure”since no measures of degradation or signs of failure are obtained before failure occurrence.The sudden failure is independent of the degradation process.Let T f denote the failure time correspond-ing to the sudden failure and assume that the failure time followsWeibull distribution with hazard rate,u ðt Þ¼c t ÀÁc À1;h >0;c P 0,where h is the scale parameter and c is the shape parameter of the distribution,respectively.2.4.Operating timesThe unit fails when either the degradation level reaches S Ãor when the sudden failure occurs.Thus,the unit experiences a com-peting risk.The operating time (uptime)of the unit is T ¼min ðT d ;T f Þ.This implies that the cumulative hazard function of the operating time is the sum of that of the sudden failure and degradation process [14].Therefore,the cumulative distribution of the resulting lifetime isF T ðt Þ¼P f min ðT d ;T f Þ<t g¼1Àexp ÀZ t 0k ðS ÃÀS 0Þþc h v h c À1d v;and the pdf isf T ðt Þ¼k ðS ÃÀS 0Þþc h t hc À1!exp Àk t ðS ÃÀS 0Þþth c:It should be noted that for a given degradation rate,if the degrada-tion threshold S Ãis set very low,the unit experiences more failures due to degradation.Consequently,more frequent repair actions and cost incur due to the degradation process.On the other hand,if the degradation threshold S Ãis set very high (the limiting case is infin-ity)the unit experiences more sudden failures.In other words,the sudden failure process becomes dominant.Therefore,it is impor-tant to determine the optimum threshold level that results in the maximization of the unit’s achieved availability.2.5.Repair timesWe assume that repair is perfect,i.e.,the unit is as-good-as-new after repair.However,in order to consider the ageing effect of the unit it is reasonable to assume that the repair time in-creases as the number of repairs increases.In other words,therepair time increases as unit ages.The successive increasing repair times can be modeled as a quasi-renewal concept (Lam [23]).The quasi-renewal process describes the scenario that the sequence of non-negative random variables f X 1;X 2;X 3;...g is a fraction of the immediately preceding one.This implies that the i th repair interval is scaled by a factor,a i À1ða >1Þ,but retains the same shape.Let T R 1be the time of the first repair interval and is exponentially distributed with parameter 1S Ã;1>0.Thus,its cumulative distribution function and the probability density function,respectively areG T R 1ðt Þ¼1Àexp À1S Ãt;1>0;g T R 1ðt Þ¼1S Ãexp À1S Ãt;1>0:If T Rk is the k th repair time,then T Rk ¼a k À1T R 1;a >1.This implies T R 1¼T Rk a k À1;a >1,and the corresponding repair time cumulative and density functions areG T Rk ðt Þ¼1Àexp À1S Ãat;1>0;k ¼1;...;n ;g T R kðt Þ¼1S Ãa k À1exp À1S Ãak À1t;1>0;k ¼1;...;n :2.6.Repair costSince the unit experiences a competing risk,repair action is ex-pected to be performed immediately after either sudden failure oc-curs or the degradation level reaches S Ã.Hence,in this work,weconsider the expected total repair cost ðC Þper unit time during T p .That is,C ¼C f M f þC d M dT p;where C f and C d are given repair costs due to sudden failure and degradation,respectively,and M f and M d are the expected number of failures due to sudden failure and degradation in T p ,respectively.The sudden failure process and degradation pro-cess are independent,thus M f and M d in T p can be obtained separately as:M f ðT p Þ¼L À1f M ðs Þg ¼L À11s X 1n ¼1f Ãfðs Þn Y n k ¼1g ÃT Rk ða k À1s Þ();Fig.1.Non-stationary alternating renewal process.784Y.Zhu et al./European Journal of Operational Research 202(2010)781–788M dðT pÞ¼LÀ1f MðsÞg¼LÀ11sX1n¼1fÃdðsÞnY nk¼1gÃT Rkða kÀ1sÞ();where fÃf ðsÞand fÃdðsÞare the Laplace transforms of the probabilitydensity function of the sudden failure process and degradation pro-cess respectively,and gÃT Rka kÀ1sÀÁis the Laplace transform of theprobability density function of the k th repair.Analytical solutionsfor fÃd ðsÞand gÃT Rkða kÀ1sÞare attainable,since the underlined distribu-tions are exponentials.However,analytical solution for fÃfðsÞdoes not exist since f fðtÞis Weibull distributed.Therefore,numerical La-place transformation and inverse are used in our analysis.3.Maintenance policy formulationAs described above,the unit(or system)is continuously mon-itored and repair actions are taken when either the degradation indicator reaches a predetermined threshold level SÃor when the unit experiences sudden failure before reaching the threshold level.Clearly,SÃis set based on the properties of the unit being monitored and what constitutes indeed a true alarm level.In practice,such level cannot be determined with high accuracy or precision.There is no single specific value for the degradation level that can be used with guaranteed failure prediction.There-fore,the objective of this paper is to determine the optimum SÃand the corresponding preventive maintenance scheduleðT pÞthat maximize the achieved availability AAðT pÞof the system,subject to a given repair cost per unit time constraint,CÃ.The problem is formulated as:Objective Max AAðT pÞ()Min AAðT pÞ¼T pÀE½uptimeT p¼T pÀE½E½Up i;j j i;jT p;orðT pÞ¼T pÀðP0;1E½Up0;0 þP1i¼1P2j¼1E½Upi;jP i;jÞT p;subject to C¼C f M fþC d M dT p6CÃ;T p P TÃ;ð1Þwhere T pÞ¼1ÀAAðT pÞis the unavailability of the unit,P i;j is theprobability that i failures occurði¼0;1;2;...;1Þunder case jðj¼1;2Þduring T p,and Upi;jis the corresponding conditional up-time of the unit.C is the expected repair cost per unit time,and CÃis the given upper constraint of the expected repair cost per unit time.TÃis the practical lower bound of T P.Since a closed form expression of the objective function is unat-tainable,we consider a numerical approach to evaluate this func-tion for different combinations of degradation threshold level SÃand preventive maintenance schedule T p as shown later.Specifi-cally,if there is no failure during T p,the probability of this event is P0;0¼PðT>T PÞand the conditional expected uptime under thiscase is simply E½Up0;0¼T p.However,if one failure occursði¼1Þduring T P,two cases need to be consideredðj¼1;2Þ.In Case1, Fig.2,a failure occurs then repair begins but is not completed by time T p.The numerator of Eq.(1)is calculated as follows:P1;1E½Up1;1¼PððT1<T PÞ\ðT1þT R1>T PÞÞE½Up1;1 ;whereP1;1¼Z T PZ1T PÀuf TR1ðvÞd vÁf T1ðuÞdu¼Z T P1ÀZ T PÀuf TR1ðvÞd vÁf T1ðuÞdu¼F T1ðT PÞÀZ T PF TR1ðT PÀuÞdF T1ðuÞ¼F T1ðT PÞÀF TR1ÃF T1ðT PÞ; andE½Up1;1¼E½T1jðT1<T PÞ ¼Z T Pt1f t1ðt1ÞF t1ðt PÞdt1:In Case2,Fig.3,thefirst failure occurs;the unit is repaired and re-stored to operation;at time T p the operation is suspended for PM.Following Case1,we now estimate other elements of the numerator as followsP1;2E½Up1;2¼PððT1þT R1Þ<ðT P\T1þT R1þT2>T PÞÞE½Up1;2 ; whereP1;2¼Z T PZ T PÀvZ1T PÀvÀuf T2ðtÞdtÁf TR1ðuÞduÁf T1ðvÞd v¼Z T PZ T PÀv1ÀZ T PÀvÀuf T2ðtÞdtÁf TR1ðuÞduÁf T1ðvÞd vP1;2¼F TR1ÃF T1ðT PÞÀF T2ÃF TR1ÃF T1ðT PÞ;andE½Up1;2¼T PÀE½T R1jðT1þT R1<T PÞ orE½Up1;2¼T PÀZ T PZ T PÀt1xf TR1ðxÞdxF TR1ðT PÀt1ÞÁf T1ðt1ÞF T1ðT PÞdt1:Similarly,when there are two failures during T P,two cases exist (Cases1and2).In Case1,P2;1E½Up2;1¼PððT1þT R1þT2<T PÞ\ðT1þT R1þT2þT R2>T PÞÞE½Up2;1 ;whereE½Up2;1¼E½ðT1þT2ÞjðT1þT R1þT2<T PÞ¼Z T PZ T PÀt R1xf T1þT2ðxÞdxT1þT2P R1Áf TR1ðt R1ÞT R1Pdt R1orE½Up2;1¼Z T PZ T PÀt R1xf T1Ãf T2ðxÞdxF T1ÃF T2ðT PÀt R1ÞÁf TR1ðt R1ÞF TR1ðT PÞdt R1;andP2;1¼Z T PZ T PÀvZ T PÀvÀlZ1T PÀvÀlÀsf TR2ðtÞdtÁf T2ðsÞdsÁf TR1ðlÞdlÁf T1ðvÞd v¼F T2ÃF TR1ÃF T1ðT PÞÀF TR2ÃF T2ÃF TR1ÃF T1ðT PÞ;In Case2,T1 0T1T2Y.Zhu et al./European Journal of Operational Research202(2010)781–788785。