Policy, Regulations and Standards in Prognostics and Health Management

As the field of PHM matures, it needs to be aware of the regulations, policies, and standards that will both impose boundaries as well as provide guidance for operations. All three regulations, policies, and standards provide information on how to design or operate something, but with different degrees of enforceability. Policies include both public policies as well as organizational policies. Operators may be required to adhere to public policies (say, an environmental policy which provides guidance for the pollution prevention act (the latter is a US law)) whereas organisational policies often reflect strategic considerations within private organizations (such as maintenance policies). Regulations (such as aeronautics or nuclear energy) typically impose binding rules of engagement and are imposed by regulatory bodies that are responsible for a particular field. Standards, in contrast, are community-consensus guidelines that are meant to provide benefit to the community by describing best practices. Adoption of such guidelines is entirely voluntary but may provide benefits by not having to reinvent the wheel and for finding common ground amongst other adopters. Awareness of both guidelines and barriers will enable practitioners in adopting best practices within the legal constraints. This paper provides an overview of the current regulations, policies, and standards in the field of Prognostics and Health Management.


INTRODUCTION
Regulations, policies, and standards provide information on how to design or operate something, but with different degrees of enforceability (see Figure 1). They also have different foci: while regulations are generally concerned with safety, policies are often concerned with operational savings, while standards provide pe-competitive information about best practices which, when adopted, may allow operators to benefit from common rules of engagement.

Figure 1. Enforceability vs. Focus Area
In most societies, lawmakers have empowered regulatory entities with the power to issue regulations which aim to provide public benefits -such as protecting the environment, public health and safety, civil rights, consumers, and investors (Beales, Brito, Davis, DeMuth, Devine, Dudley, Mannix, and McGinnis, 2017). Regulations are a "rule or order issued by an executive authority or regulatory agency of a government and having the force of law" (Merriam Webster, 2019). In contrast, policies, defined as "a high-level overall plan embracing the general goals and acceptable procedures especially of a governmental body" (Merriam-Webster, 2019) They comprise a deliberate system of principles that can guide decisions. They are generally adopted by a governance body within an organization. Standards, on the other hand, are "established by [...] general consent as a model or example" (Merriam Webster, 2019). As such, they are an agreed way of doing something and serve the purpose of providing a basis for sharing the same expectations about the operation of a product or service.
Like any other operation, PHM needs to conduct business under the umbrella of applicable laws and regulations. In addition, operations are guided by policies and standards that help conduct business in an ordered way with defined boundaries. Examples of regulatory bodies in the US are the Federal Aviation Administration (FAA), the National Highway Transportation Safety Agency (NHTSA), or the Environmental Protection Agency (EPA). Besides following the law, industry stakeholders may voluntarily choose to follow standards and guidelines that are developed by individual players or by industry consortia. Examples of these groups are the Maintenance Programs Industry Group (MPIG) that develops aviation maintenance standards and Underwriters Laboratory (now called UL) that started off certifying the safety of electrical equipment, and has now grown to include other material and goods used by the public. Regulations promulgated by government regulatory bodies are typically enforceable, and have therefore considerable impact on how business is conducted. On the other hand, policies are guidelines geared towards achieving aims and goals, sometimes those articulated in regulations. Standards (and recommended practices in some industries), by contrast, are consensus-based rules or instructions that espouse best practices that in turn may aid manufacturers and operators to adopt principles found to have benefit within the community. They provide a means, but not the only ones, to achieve a desired goal. However, there are industries where some of these standards can be specified by the customer as mandatory. This paper aims to provide an overview of the regulations, policies, and standards that affect the Prognostics and Health Management discipline.

POLICIES
Policy is defined as a general course of action proposed by a particular body of authority, at the local, state, and federal levels or within private organizations. The course of action defined by the policy is guided by rules and attributes. These rules are evaluated in prioritized order until all of them are exhausted. The point of a policy is to provide for consistency in the operation of complex systems. Policies are different from regulations in the degree of enforcement: whereas regulations are restrictive in nature, are often cast within the framework of a law, and impose sanctions for noncompliance, policies are generally (although there are exceptions) meant to support overall goals. Policies may provide guidance to encourage compliance with requirements arising from regulation or they can express stand-alone goals.
Policies provide guidelines to program managers, lawmakers, employees, and the public (depending on who issues the policy) in enacting the principles advocated in the policy or in drafting more concrete and actionable business rules. Public policies are (in contrast to laws) not necessarily binding and as such sometimes lack enforceability, except when clarifying a regulation. A policy is meant to articulate the commitment by senior management with regards to a particular course of action (here it would be to enact PHM principles). A policy also provides guidelines for the staff in carrying out the PHM strategy, as well as plans and actions. It is then left to the program manager to execute on the details of the policy (which may still allow for considerable room for interpretation). Key performance indicators (KPI) are frequently part of a policy to measure compliance and progress. Any policy connected to disciplinary measures has obviously more sway.
The section below delineates policies relevant to the PHM domain. Often, regulatory agencies will point to a policy (or a industry-developed standard) as an acceptable means of compliance for a regulation, but will leave the door open to alternate processes if the end-goal of the regulation is met. Examples of this will be discussed in the sections below as well.

Maintenance Policies
Maintenance policies are meant to maximize system operations, keep operational costs low and product quality high, all while ensuring adequate operational safety. This can be accomplished by a set of policies that ensure that equipment is in ready and reliable condition, via a regimen of monitoring, inspections, and repairs.
In general, maintenance policies can describe -sometimes in considerable detail -maintenance intervals; use of monitoring equipment; maintenance and safety procedures; guidelines regarding acquisition, stocking, and tracking of replacement and spare parts; handling of waste products; and recording of maintenance events. While not all of these elements may be encapsulated as a policy for a specific application (and additional ones may be added to the list), each of these elements describe both the desired goal and the suggested steps to accomplish that goal at varying levels of detail. Indeed, maintenance policies may set targets for backlog levels for deferred maintenance, set target standards for asset performance, and articulate the organization's tolerance for risk arising from failed assets, and to determine how to prioritize repairs (Asset Insights, 2018).
Maintenance policies are undergoing changes as new PHM technologies become available (in particular predictive capabilities) and as industries seek to adapt to a changing competitive landscape. As an example, performance-based contracts (PBC) are changing how maintenance is treated within a number of industries (Qin, Jiang, Ip, Sheng, and Wu, 2018). DoD has been using performance-based-logistics (PBL) contracts since 2001 (DoD, 2016). The outsourcing of maintenance has resulted in various incentives to maximize the benefit for core industries and service suppliers such as bonus contracts. When suppliers carry the financial risk of downtime, there is a strong incentive to prevent -or at least predict -the maintenance event. This leads to further use of PHM technology and investment in advances that can help to maximize profit.
Monitoring of aircraft engines via RF links through the Aircraft Communications Addressing and Reporting System (ACARS) was instituted at the request of airline customers in the early 1970s to support remote diagnostics (Rajamani 2018a). Bristol Siddley, a UK aerospace engine manufacturer, now part of Rolls Royce, coined the term "Power by the Hour" in the early 1960s -an early example of a long-term service agreement (LTSA) -where the risk of engine operations was transferred to the OEM in return for a payment per flight hour. This is now the standard in the large jet engine business, with most of the engines under some kind of an LTSA.
Remote monitoring is almost a necessity for making any maintenance philosophy based on condition monitoring cost effective. In the medical field, for example, General Electric was an early leader by providing remote monitoring services for high-end medical equipment starting in the 1980s (Cheetham, Cuddihy, and Goebel, 2001). This policy evolved later to the guaranteed-uptime service offering for their aircraft engines service offering that resulted in significant advances in remote monitoring technology. This paradigm is now further changing as increasingly other business models are being explored such as underwriting of business interruption insurance policies to further share the risk (Reim, Parida, and Sjödin, 2016) of equipment failure. At a high level, different strategic directions find their way into maintenance policies. Broadly, they can be partitioned into corrective maintenance and preventive maintenance policies (see Figure 2). As the name implies, corrective maintenance seeks to remedy an issue that requires a fix, and restore an asset to its operational status. This can be done either immediately or it can be deferred to the future and prioritized based on availability of resources and criticality of function lost or its financial impact. Indicators from the failed equipment and additional inspections can be used to schedule the maintenance action. In contrast, preventive maintenance policies seek to proactively avoid equipment downtime. More detail is provided here on Preventive Maintenance as it represents a more advanced maintenance policy. For Preventive Maintenance, the taxonomy suggested in Fig. 2 distinguishes between rule-based schedules and indicatorbased schedules.

Rule-Based Maintenance
In Rule-Based Maintenance, triggers that can be used to schedule future maintenance are based on elapsed time, usage, or risk. In time-based schedules, maintenance occurs at fixed intervals. Use-based maintenance policies are similar to time-based maintenance, except that the criteria for performing maintenance are tied to metrics that better reflect wear (such as usage cycles, thermal history, depth of discharge, etc.) than just time. Risk-based maintenance policy evaluates the impact of the probability of failure and the consequences of failure. Maintenance resources are prioritized toward assets that carry the most risk if they were to fail, considering both resources for performing maintenance and the impact of failure. This maintenance policy is fundamentally a risk control process that trades prevention (through preservation and prevention) and repair (Asset Insight, 2018).

Indicator-Based Maintenance
Indicator-based maintenance policies seek to anticipate the degradation threshold or fault by actively monitoring and

Maintenance Policies
Corrective Preventive Immediate Deferred Indicator-Based Schedule

Time-Based
Use-Based

Risk-Based
Rule-Based Schedule Predictive Prescriptive evaluating the condition of the asset through analysis of either portable sensing devices or in-situ sensor measurements. Indicator-based maintenance policies are the most advanced and have received a lot of emphasis lately due to their potential for cost-savings and increasing equipment uptime.
While it can be argued that many of the maintenance policies in Figure 2 are important for our journey towards a true PHMbased system, CBM is the first attempt to move away from maintenance based on static rules towards one that factors in the actual condition of the part as a maintenance criterion. Indeed, CBM has received considerable attention from the Department of Defense as a game changer and therefore will be covered in more detail here.
CBM in the world of civil aviation is not a new concept; early versions have been used since the middle of the 20th century, but it evolved from on-condition inspections to more automated systems (which eventually was given its own name: Predictive Maintenance). The policy has been initially popularized by customers in the defense sector. The transition to CBM occurred when many aircraft components and systems went from hard-time maintenance (i.e., where components were replaced -or repaired -at set time intervals) to on-condition maintenance, where these items were inspected at set intervals. Those passing muster would remain on the aircraft for the next interval, while others would be replaced or repaired. Recently, as its economic impact is being evaluated, more emphasis is being placed on incorporating the CBM philosophy within the mainstream of commercial aviation maintenance (Rajamani, 2018b).
CBM evolved further into the Condition-Based Maintenance Plus (CBM+) Policy. It was drafted by the DoD to provide "an integrated strategy for deployment of enabling technologies, processes, and procedures that focus on a broad range of weapon systems sustainment improvement" (DoD, 2017). This policy is driven by an incentive to leverage the use of PHM techniques with the goal of generating large savings for sustainment of equipment. It delineates the application and integration of appropriate processes, technologies, and capabilities to achieve target availability, reliability and operation and support costs of DoD systems and components across their life cycle. In particular, CBM+ promotes a systems engineering approach to collect data, enable analysis, and support the decision-making processes towards the goals outlined above (DoD, 2008). At its core, CBM+ suggests to perform maintenance based on evidence of need. It integrates reliability centered maintenance (RCM) analysis with total asset visibility towards enhancing readiness and maintenance effectiveness. The enabling technologies that are considered vital for implementation are: (1) prognostics; (2) diagnostics; (3) portable maintenance aids; (4) interactive electronic technical manuals; (5) interactive training; (6) data analysis; (7) integrated information systems; and (8) automatic identification technology.
Examples of CBM are the automated monitoring of vibrations or oil-debris in aircraft engines, where no set intervals were specified. Instead, inspections were based on the monitored condition. When an equipment is being continuously monitored, it allows for enhanced maintenance based on the prediction of future health condition. This maintenance scheme has been called, in some industries (in particular in the manufacturing sector), Predictive Maintenance (PdM), and leverages model-based and other statistical techniques to anticipate equipment problems thereby predicting when the asset may fail in the future. Where data is being automatically collected and analyzed continuously, one has the potential to detect anomalies and catch failures because there is no gap between sporadic data collections into which failures might have fallen before. In addition, the science of prognostics has since advanced, allowing for more sophisticated techniques to be deployed. In Prescriptive Maintenance (RxM) a decision support system consumes predictive information to propose specific maintenance actions that are to be either automatically or manually executed. No substantial policies have yet been developed for RxM specifically. Predictive maintenance is being heavily worked on currently, with much research being devoted to model-based techniques. This work has also become very popular because of the explosive growth of empirical modeling which includes various forms of machine learning techniques as well. In contrast to CBM methodologies, PdM has not yet evolved sufficiently to develop much policy or standards. However, we discuss some recent developments in artificial intelligence (AI) in Section 2.5 below.

Environmental Policy
Environmental policies are generally not treated as a core element of PHM activities such as maintenance. However, they should be considered within the context of PHM when non-adherence has a potentially unfavorable economic impact, violates laws, or infringes on company internal codes and when PHM functions enable adherence to these policies. Lawmakers often use policy instruments such as punitive measures for non-compliance but also economic incentives (such as tax exemptions and tradable permits) to foster adherence.
Environmental policies generally include air and water pollution, waste management, and others. Examples for environmental policies are the "Pollution prevention policy" (EPA, 2018) which supports the Pollution Prevention Act (PPA) of 1990 (U.S.C., 1990), a federal law that stipulates that "pollution prevention is reducing or eliminating waste at the source by modifying production processes, promoting the use of nontoxic or less toxic substances, implementing conservation techniques, and reusing materials rather than putting them into the waste stream." The policy supporting this law then further clarifies how the law can be realized, for example via the 2010-2014 Pollution Prevention Program Strategic Plan (EPA, 2010) that makes recommendations for realizing the goals set forth in the PPA.
In addition, policies on environmental factors touch on PHM where the satisfaction of a policy requires PHM techniques. Take, for example the California state policy on fracking (Chapter 4, 2013) which requires oil and gas operators (amongst other things) to monitor and report water use and water quality, and analyze any potential engineering and seismic impacts resulting from fracking operations. These policies drive, at least to some modest degree, implementation of PHM techniques into operations (NIST, 2018)

Problem Reporting and Maintenance Data Collection Policy
One important element in supporting fault management is the recording of historical issues to provide an experience-based track record of what worked and what did not. In conjunction with supporting technology that allows the appropriate storage and retrieval of this information, such a recording activity can be encapsulated in a policy. An example of a storage and retrieval platform is the Problem Reporting and Corrective Action (PRACA) database that was used by NASA to collect experience with past problems with the goal to improve operations over time (Oberhettinger, 2015). PRACA has actively been used to collect information for various operations, such as the International Space Station (ISS), although that was originally collected in the Items for Investigation (IFI) database, and the space shuttle. It has been a valuable source of information to build PHM systems (Daigle & Goebel, 2011).
Similarly, the aviation industry has a policy to provide a mechanism for collection of confidential reports pertaining to incidents that otherwise would not get captured. Towards this end, the Aviation Safety Reporting System (ASRS) facilitates the anonymous reporting of events by pilots and other operators so that the aviation community benefits from analysis of the resulting data, with the goal of improving safety for the benefit of all participants.
In general, there is an emphasis on data collection and retention that is governed by policies and regulations because this data can be used for incident investigations as well as operations review. As data become more and more important for all aspects of aviation and other sectors, the sanctity of data becomes an even more vital subject. Data integrity, data security, and data interoperability are all key elements of this. Integrity refers to the accuracy of data and its immutability in databases, etc. New techniques such as Blockchain are being employed now to aid this. Data interoperability is the ability of the data to be transferred seamlessly across different systems and domains. These are more technical issues rather than policy issues. Data security, however, is something that is increasingly becoming a major issue that needs policy changes, where organizations such as the National Institute of Standards and Technology (NIST) are stepping in to provide guidance as well.

Cybersecurity Policy
Cybersecurity is an area of increasing importance for PHM (Goebel, Smith & Bajwa, 2019). First, there is a need to protect the integrity of critical system information or proprietary information in an IoT-enabled PHM environment (Kwon, Hodkiewicz, Fan, Shibutani, and Pecht, 2016). For example, SCADA systems are vulnerable through unauthorized access to software (virus infections, intentionally induced changes, or other problems that can affect the control host machine) and through packet access to network segments that host SCADA devices. Theoretically, anyone sending packets to a SCADA device could be in a position to control it. Infamously, the stuxnet virus targeted SCADA systems and caused centrifuges at the Tangaz plant to over-speed and self-destruct (Koch & Kuehn, 2017).
Less well-known, but just as relevant for the PHM domain, hackers took control of a safety workstation at an industrial power plant, then worked their way through the system to reprogram controllers used to identify safety issues. Operators noticed the attack when some controllers inadvertently entered a failsafe mode and caused related processes to shut down (Gibbs, 2017). This attack breached the safety system (which is at the heart of some PHM activities) and as such indicates the potential for other parts of any industrial plant being compromised -while operators may not even initially detect the attack. Other issues such as ransomware that finds its way through IoT devices may need to be considered as well.
Cybersecurity policy is meant to provide guidance about the protection mechanism of an organization's crucial physical and information assets. At the minimum, it will specify intentions and conditions that aid to protect assets along with instructions to carry out these intentions. The cybersecurity policy is the mechanism that directs users to build, install, and maintain systems to maintain the confidentiality, integrity, and availability of both the PHM system as well as the system that it connects to.
A recent Presidential Executive Order 13636, "Improving Critical Infrastructure Cybersecurity," established that it "is the Policy of the United States to enhance the security and resilience of the Nation's critical infrastructure and to maintain a cyber environment that encourages efficiency, innovation, and economic prosperity while promoting safety, security, business confidentiality, privacy, and civil liberties" (PEC, 2013). As a consequence, NIST led the development of voluntary industry standards and best practices to help organizations manage cybersecurity risks. The resulting product is commonly referred to as the NIST Cybersecurity Framework (NIST, 2018).

Artificial Intelligence Policy
Closely related to data is what is done with it. AI techniques are used in many PHM functions today much more so than other areas such as controls. It is therefore pertinent to understand policies that are being discussed in this field. AI has been on the radar screen of policy makers at the highest level. In the US, the Office of Science Technology Policy (part of the Presidential Council of Advisors on Science and Technology) has a Subcommittee on Machine Learning and AI which has been commissioned to look in part into a national AI R&D policy. To that end, the Office of Science Technology Policy issued a report on "Preparing for the future of artificial intelligence" (NSTC, 2016a) which acknowledges progress on AI solutions that solve very specific problems such as image recognition or self-driving cars. It further addressed the potential need for regulation of such applications, i.e., ensuring the safety of autonomous vehicles (both terrestrial and aerial). A companion report "Artificial Intelligence, Automation, and the Economy" (NSTC, 2016b) addressed the impact of automation on economy and jobs.
The European Economic and Social Committee (a consultative body that gives the Commission, the Council and the Parliament the points of view from those directly affected by EU legislation. Membership is made up of representatives of employers' organizations, trade unions, farmers, consumer groups, professional associations, etc.) has called for a human-in-command approach, and it has identified 11 areas in which AI will affect social challenges, ranging from ethics, security, transparency, privacy and standards, employment, education, (in-) equality and inclusiveness, legislation, governance and democracy, warfare and super intelligence. That human-in-command approach may be built on erroneous assumptions that the human reviewer can understand how AI generated the solution to the problem that was posed. The nontransparency of the solution may have adverse, unintended consequences from an ethical perspective. Indeed the European Union seeks to adapt new regulations which calls for a "right to explanation" whereby a user can ask for an explanation of an algorithmic decision that was made about her or him. This has recently spawned a new research thread on explainable AI systems (Goodman & Flaxman, 2016). PHM benefits from the developments because XAI helps adaptation in safety-conscious application areas. Engineers in many organizations are leary of accepting a "black box" solution -but are much more amenable to accept a solution if the underlying reasoning is plausible and makes engineering sense.
The rise of AI, and other digital techniques, has been recognized by the standards community as well. The SAE, for example, has set up the Digital & Data Steering Group (DDSG) to guide the organization in setting up appropriate technical committees and to advise it on the types of documents that should be created to help the mobility industry understand these new technologies. The work of this steering group is still in its infancy, but it has already facilitated the setting up of three important technical committees (TC). These TCs, which are open to anybody in the industry, will work on developing standards in areas related to the digital domain. These are: G-31, "Electronic Transactions in Aerospace," G-32, "Cyber Physical Systems Security Committee," and G-34, "Artificial Intelligence in Aviation." Work has already begun on topics such as Blockchain, guidelines for the use of non-deterministic systems, digital twin and digital thread, electronic asset transfer regulations, etc. It is particularly important to focus on the work by G-34, because it is one of the rare groups that has linked up with its European counterpart within EUROCAE, WG114, so that all standards developed for AI in aviation will be simultaneously published in the US and in Europe. It is also important to note that by establishing this collaboration, no standards development work in this important field is duplicated. The first document, which is an overview of the field, called "Artificial Intelligence in Aeronautical Systems: Statement of Concerns" (AIR6988) is being balloted within SAE and EUROCAE and should be published in the first half of 2021.

Communications
Communications is a key element of PHM and increasingly, the mode of communications is transitioning to wireless. Because the use of communications is really no different when it is applied to PHM than when it is applied to any other function, there are no specific policies that govern its use when serving the cause of PHM. Increasingly, at least in the mobility sector, data for PHM are being transferred via WiFi, cell-modem, and satellite. The more traditional medium, for aircraft, is ACARS, as described earlier. For automobiles, increasingly it is cell-model-based communications that is embracing the 5G technology standard for broadband cellular networks. In the future, satellite communications will probably be the most ubiquitous for aircraft communications, while cell-modem will remain the most common for the automotive sector. A number of regulatory policies govern the use of various bands of the electromagnetic spectrum to facilitate these communications and a number of standardssetting organizations support in the development of protocols and standards for the use of the technology. It is not within the scope of this paper to go into details.
In other industries, where assets do not move, wired or wireless communications can both be found. Traditionally, wired communications have a reputation for being more reliable but increasingly certain applications favor wireless communications such as when the distance between deployment and monitoring functions is very large and when no wired connections exist and cost of implementation favors wireless technology. A number of protocols have long been competing for supremacy. Industrial communications protocols, originally designed as a data communications protocol for use with programmable logic controllers (PLCs) as a means of connecting industrial electronic devices, include MODBUS and Profibus. These have been around for decades, and there are new ones being developed as well, such as MT Connect, which has only been around since 2008 (ThomasNet, 2008). The MTConnect standard (ANSI/MTC1.4-2018) offers a semantic vocabulary for manufacturing equipment to provide structured, contextualized data with no proprietary format. All these communication modalities help with data-collection and transmission, which is a critical element in the development of better PHM techniques and hence better outcomes with equipment maintenance. The ubiquitous collection of data brings up issues of data privacy, that we review in section 2.4.

REGULATIONS
Regulatory bodies are trying to provide guidelines (or laws) for proper use and through certification of devices and services. This is done by trusted bodies (often times operated by a government entity) to permit parties that meet the eligibility requirements to conduct business with those devices or services. Compliance with regulations can in some instances be accomplished with PHM techniques. In other instances, regulations seem to make it harder to implement PHM solutions.
Certification provides standardized practice of operations, a certain level of performance, and ensures a certain minimum standard of knowledge of the operator, thereby providing a level of trust to the user community. This is done typically for high-end equipment that -in case of malfunction -poses a considerable danger to the public, such as nuclear power plants, airplanes, medical devices, and similar. Emphasis of certifications is often on safety issues, which have a better understood history of needs that can be addressed. Examples can be found from the Federal Aviation Administration (FAA) and the European Aviation Safety Agency (EASA), National Highway Traffic Safety Administration (NHTSA), Nuclear Regulatory Commission (NRC), and the FDA's Center for Devices and Radiological Health (CDRH). Privacy is largely being addressed by the Federal Trade Commission (FTC), and the Federal Communications Commission (FCC). Sustainability is in part addressed by California Air Resources Board (CARB) and the Environmental Protection Agency (EPA). The next sections delineate regulations for safety, privacy and sustainability. The sections are organized based on their applications. Specifically, we examine regulations in the context of mobility applications (e.g., airborne vehicles, terrestrial vehicles, …) and non-mobility applications (e.g., nuclear power plants), as well as overall data collection. The role that the various regulatory bodies play is being detailed as well.

Regulations for Airborne Vehicle Applications
The FAA plays a prominent role in enforcing safety of operations in aviation. Through reciprocity arrangements, they work closely with EASA and other air-safety regulators around the world so that aircraft certified in one country or region can fly to other parts of the world without having to be certified everywhere. Traditionally, it has focused on a risk and hazard analysis approach as the main element in ensuring safe operations such as through time-based inspection of components. While it acknowledges in its System Safety Handbook (FAA 2012) that "warning devices" (i.e., equipment that issues an alert when an off-nominal condition is encountered) can be a part of a safety strategy, the use of condition-based health assessment to ensure safe operations is coming only slowly into practice. The goal of operators to use PHM principles to reduce cost of ownership by performing as-needed maintenance finds itself in conflict with regulatory concerns about airworthiness (Sigma-Technik, 2012). In principle, there is an acknowledgement that condition-based principles can be realized through "maintenance credits" which allow condition monitoring to reduce or replace time-based inspection. For example, FAA Advisory Circular (AC) AC 29-2C, Section MG-15 provides guidance for transport category rotorcraft to attain airworthiness approval for installation, and credits validation of health and usage applications. The primary concern is to ensure that the probability of failure is as low as reasonably practicable, and is compliant with the quantitative regulatory requirements.
In specific instances, the FAA does already require the use of PHM principles (even if it is not called PHM), for example through applications in engine condition monitoring (ECM) and oil consumption monitoring which are needed to issue extended operations (ETOPS) certification for certain classes of aircraft. ETOPS certification is meant to ensure that a multi-engine aircraft can reach an airport within a given time interval even when a subset of its engines is no longer operational. In this example, the ECM is meant to provide a system for data collection and timely analysis to detect engine deterioration and to preclude failure (FAA 2011). The goal is to detect deterioration at an early stage, and to allow for corrective action before safe operation is affected. ETOPS maintenance requirements are also meant to reduce diversions through engine condition and oil level/consumption monitoring. However, some commercial providers cite that this practice has actually resulted in maintenance interval increases over OEM recommended practice (Eaton 2006).
Because of the global nature of aviation, there is close coordination between the FAA and its counterparts around the world. Regulations are harmonized so that the safety of the flying public across the globe is equally considered. The cooperation is especially strong between FAA and EASA, which itself arose from individual regulatory agencies across Europe after the creation of the European Union. Individual country-specific agencies still exist, but many regulations related to initial certification and continued airworthiness are referred to the EASA.
Even though UK's is (presently) a unique case within the EU, EASA regulations are slowly replacing its Civil Aviation Authority (CAA) documents. For example, CAA had issued a requirement to install vibration health monitoring (VHM) systems on helicopters to address increased failure rates because of operations in the North Sea in the 1990s. Because of the success of these regulations in reducing accidents, the requirement for VHM was applied to all UK-registered helicopters (CAP753, 2006). In fact, the benefits demonstrated after its implementation are part of the reason why most of the world's offshore drilling helicopter fleets now have health and usage monitoring systems (HUMS). While EASA has now established SPA.HOFO.155 (Specific Approval for Helicopter Offshore Operations) which requires a VHM system to be installed (EASA, 2017), the CAA might continue to use CAP753 as an alternate means of compliance.
It should be noted that the need for PHM in industry is driven more by economic benefits, not safety. But where safety can potentially be impacted when systems provide system health information to the flight crew that can influence in-flight decisions, ironically, the more the system to be certified impacts the potential safety of the system, the more stringent the certification steps are. This is a reason PHM systems are often implemented to provide post-flight information to maintenance personnel, thus avoiding the safety implications for the flight crew.
Certification involves development and execution of a certification plan that lists test and analysis steps with pass/fail criteria and outlines a system safety assessment (SSA) that includes ample documentation to address all elements of airworthiness as outlined in FAR 14 CFR Part 21 (FAA, 2012). The SSA is hierarchical in nature, from the subsystem level through the aircraft platform level (i.e., the system itself needs to be safe, and needs to be safe as part of the installation). In addition, product support documents have to be furnished that include maintenance and operating manuals.
While there is interest by the FAA and (indeed, considerable) interest by industry to show how this process can be used with success on an example, there have not yet been any approvals of substance for fixed-wing aircraft. At the root of this is that the software certification applies the airborne software certification paradigm of DO-178B/C. For rotorcraft, on the other hand, the FAA has come out with specific guidelines on how to develop software to support the earning of usage credits for safety critical parts by the analysis of usage data (Beale &Davis, 2016, Michael, Collingwood, Augustine, andCronkhite, 2004).

Regulations for Terrestrial Vehicle Applications
The National Highway Traffic Safety Administration (NHTSA) has a legislative mandate in the US under Title 49 of the United States Code, Chapter 301, Motor Vehicle Safety (49 Chapter 301, 2008), to issue Federal Motor Vehicle Safety Standards (FMVSS) (CMVSS in Canada) and Regulations to which manufacturers of motor vehicle and equipment items must conform and certify compliance.
Advances include the monitoring of tire pressure, which has been encapsulated in FMVSS standard No. 138 (49 CFR Parts 571 and 585). It requires installation of a tire pressure monitoring system (TPMS) capable of detecting when one or more of a vehicle's tires is significantly under-inflated. This rule requires installation in all new light vehicles of a TPMS capable of detecting when one or more of the vehicle's tires, up to all four tires, is 25% or more below the manufacturer's recommended inflation pressure or a minimum activation pressure specified in the standard, whichever is higher (49 CFR, 2012). NHTSA has further regulations and is discussing the monitoring of other safety-related equipment such as brakes, air bags, electronic stability control andbeyond that-has also begun to investigate safety-related systems that are not strictly part of PHM such as frontal collision warning systems and lane departure warning systems. More recently, following the Tesla crash in Williston in 2016, the NTSB urged the NHTSA to set data standards that set benchmarks for new vehicles equipped with automated-driving systems and to ensure data captured is available to regulators (and crash investigators) (Bigelow, 2018). In 2017, the DOT issued policy "Automated Driving Systems 2.0: A Vision for Safety" (NHTSA, 2017), a nonbinding document intended to provide a greater degree of certainty to the industry about the Federal Government's role in regulating Highly Automated Vehicles (HAV) by providing guidance outlining best practices, including a voluntary safety self-assessment. Meanwhile, pending legislation (Thune, Peters, Blunt, Stabenow, and Wicker, 2017) seeks to provide safety oversight for HAVs and make data sharing easier, subject to recommendation from a data access advisory committee.
Other advances that are being pursued outside NHTSA include onboard monitoring systems for commercial motor vehicles, a project sponsored by PATH, the Partners for Advanced Transportation TecHnology, a multi-disciplinary program with researchers from universities in California, and cooperative projects with private industry, state and local agencies, and nonprofit institutions. Research is under way for semi-autonomous proximity warning devices and driver fatigue warning devices (Misener, Nowakowski, Cooper, and Margulici, 2006). The question remains as to whether onboard occupants (safety drivers) should play any role in monitoring the performance of the AI-driving algorithms and intervene in certain situations.
The specifications imposed by California Air Resources Board (CARB) on On-Board Diagnostics (ODB) for cars were refined in the so-called "OBD-II" with mandated adoption for all cars sold in California starting in model year 1996 (CARB 2006). It allowed OBD to perform on-board monitoring of a wide range of emissions controls. The Environmental Protection Agency (EPA) followed suit and made OBD-II mandatory for all cars sold in the United States (EPA 2005). In 2001, the European Union adopted a similar directive (EU 1998) for vehicles with gasoline engines and in 2004 for vehicles with diesel vehicles sold in the European Union.

Regulations for Nuclear Power Plants
The Nuclear Regulatory Commission (NRC) defines a socalled "Maintenance Rule" (NRC, 2007) which states that "each holder of an operating license for a nuclear power plant […], shall monitor the performance or condition of structures, systems, or components, against licenseeestablished goals, in a manner sufficient to provide reasonable assurance that these structures, systems, and components, […] are capable of fulfilling their intended functions" ( § 50.65 Requirements, 2012). It further states that "performance and condition monitoring activities and associated goals and preventive maintenance activities shall be evaluated at least every refueling cycle provided the interval between evaluations does not exceed 24 months." The regulatory objective of the Maintenance Rule is to require licensee monitoring of the overall continuing effectiveness of their maintenance programs to ensure that: • Safety-related structures, systems, and components are capable of performing their intended functions. • For equipment that is not safety related, failures will not occur that prevent the fulfillment of safety-related functions. • Failures resulting in emergency shutdowns and unnecessary actuations of safety-related systems are minimized.
As part of these regulatory requirements, nuclear power plant operators have been exploring for several decades how best to implement health management principles to assess the state of health of their equipment and the impact on operational safety (Attieh Gribok, Hines, and Uhrig, 2000a;2000b). Early solutions included expert systems (Ancelin, Cheriaux, Gaussot, Pichot, Sancerni, and Voisin, 1991) and other artificial intelligence approaches (Uhrig, Hines, and Nelson 1998). Coble et al. (Coble, Ramuhalli, Bond, Hines, and Upadhyaya, 2015) provide a review of recent applications of PHM to nuclear power plants which systematically breaks down the use of the PHM tools for active (moving) components and passive (non-moving) components.
Note, however, that the Nuclear Regulatory Commission requests the utilities to meet the requirements without specifically telling the utilities what to do. Utilities merely need to file documents that state how they will meet the requirements, and the NRC determines if the proposed activities will meet the requirements.

Regulations on Data Collection
Depending on the PHM application, practitioners need to ensure compliance with regulations on data collection. So far, either the OEM, operator, or whoever collects data is considered to own the right to store and use them, regardless of what type of data is being used and whether the data were collected with or without permission (except to the extent regulated by laws and rules). In an industrial context, equipment health data are treated in a proprietary manner mostly to protect sensitive information such as efficiencies, operating conditions, and failure rate. However, for PHM applications that touch on personal information of clients (e.g., PHM for elder care or human performance), an increasing set of regulations enters the field. In particular, a large number of countries (including nearly every country in Europe and many in Latin America and the Caribbean, Asia, and Africa) have adopted comprehensive data protection laws. The United States stands out for actually not having adopted a comprehensive information privacy law, but rather having adopted limited sectoral laws in some areas and as such, data privacy is not highly legislated or regulated in the U.S. Although partial regulations exist, there is no allencompassing law regulating the acquisition, storage, or use of personal data. Recent excesses and abuses of massive amounts of data have raised attention to this issue at the congressional level which may ultimately lead to stricter interpretation on data rights.
The FTC is recognized in the US as the chief federal agency on privacy policy and enforcement since the 1970s, when it began enforcing one of the first federal privacy laws -the Fair Credit Reporting Act. The agency uses law enforcement, policy initiatives, and consumer and business education to protect consumers' personal information. Since the 1970s, rapid changes in technology have raised new privacy challenges and political changes cause shifting priorities (some privacy laws were repealed recently) in both interpretation of privacy and enforcement. Nonetheless, the FTC Act (a law originally enacted 1914 but amended a number of times) prohibits unfair or deceptive acts or practices and the FTC has used its authority to charge companies that fail to protect consumer personal data, for example when leaving such data vulnerable to cyberattacks. This can pertain to PHM applications as sensor solutions and Apps may have vulnerabilities that can be exploited to gain access to a broader set of protected data. It also pertains to which kind of collected data can be shared and how.

STANDARDS
PHM related standards have been drafted for many decades by several standards organizations. An exhaustive overview over the standards landscape for PHM is given by Vogl et al. Zhu et al., and Sheppard et al., (Vogl, Weiss, and Donmez, 2014a, 2014b, Zhu, Bo, and Wei, 2013, Sheppard, Kaufman, and Wilmering, 2008. Without replicating these findings, this section will illustrate the role that the third leg of the trifecta policy, regulations, and standards plays in providing a framework for PHM practitioners. Standards development organizations (SDO) do their work via technical committees that are made up of (often volunteer) stakeholders who collaborate to develop consensus documents that reflect the best practices for use of tools and techniques in their respective areas. SDOs developing PHM standards have been more active in the mobility sector. Following the section on regulations, the passages below that describe these SDOs are partitioned into mobility applications and non-mobility applications.

Mobility Applications
Aerospace applications have been long leading the charge in providing standards for PHM. It is in part a response to the need for providing safety (which is dictated by regulations) while at the same time responding to the need for affordable operations. Operators have found that standards for PHM can provide this balance. SAE is a standards organization dedicated to mobility applications (both terrestrial as well as aeronautics).
In the 1970s, a dedicated committee, E-32, (SAE, 1975) was driving Propulsion Health Management standards development. These first standards were for engine condition monitoring, specifically monitoring vibrations to assess rotor imbalance. To translate the lessons learned from the operation of the propulsion committee into relevant documents at the vehicle level, the HM-1 committee was established in 2011 (SAE 2011) which has also been publishing a number of books (Jennions, (ed.), 2011, 2013a, 2013b, 2014  One forward-looking outcome of the HM-1 committee was the development of a roadmap for the writing of standards related to PHM.  As an example, JA6268 describes the elements of a healthready components or system and how PHM system suppliers might go about assessing their products for their ability to deliver the necessary diagnostics and prognostics capability. SAE has now established an active database of "certified" health-ready systems (SAE-ITC, 2018).
In the recent past it became increasingly clear that the biggest trend in aerospace was the move towards a digital transformation.

Non-mobility applications
Over time, the importance of PHM became evident in other fields as well. In particular, manufacturing has been an application area that has embraced PHM due to the benefit it provides in enabling smooth, uninterrupted processes which -over the life time of a machine -result in considerable cost savings. There are a number of organizations that have produced standards. These include ISO, ASME, IEEE, ISA, and NIST. As an example, ISO has encapsulated a host of PHM related standards, (Goebel, 2013). Technical committee 108, in particular, has focused on condition monitoring and diagnostics of machines. Table 2 lists a number of ISO standards that are related to PHM. Some of the standards that are related to vibration analysis have its origin before the term "PHM" was coined. For the sake of completeness, they have been included in this list shown here.   (Sheppard, Kaufman, and Wilmering, 2008), followed in 1995 by the AI-ESTATE standard which described the used of AI in diagnostic systems. In 2017, a "Framework for Prognostics and Health Management of Electronic Systems" (IEEE, 2017) was published as a standard. ASME has taken a pioneering role in developing standards for the use of PHM in manufacturing systems by setting up a subcommittee for PHM. This work has institutional support from NIST and leading manufacturers such as Boeing and GM. In fact, NIST has been taking a leading role in developing PHM for manufacturing systems including robots and other complex machine tools. Some publications that give a good introduction to this field are (Vogl, Weiss, and Donmez, 2014a, 2014, Weiss, Sharp, and Klinger, 2018. NIST also has been providing standards for encryption within the "Federal Information Processing Standards" (NIST, 1994) These are a set of standards that describe document processing, encryption algorithms and other information technology standards for use within non-military government agencies and by government contractors and vendors who work with the agencies. A specific example is the Advanced Encryption Standard FIPS 197 (NIST 2001) which specifies a cryptographic algorithm that can be used to protect electronic data such as those produced and communicated for PHM functions. The argument for relevance to PHM follow the one made for cybersecurity policy in section 2.2

CONCLUSIONS
As the field of PHM evolves, and as manufacturers and suppliers develop and field PHM-enabled solutions, different regulations and policies demand adherence to (or at least describe a desired path towards), as well as impose bounds on, the implementation of PHM principles. Policies include both public policies that operators may have to adhere to as well as policies that come out of strategic considerations within private organizations (e.g., maintenance policies).
Regulations are typically connected with a particular field such as aeronautics where the Federal Aviation Administration acts as a regulatory body and imposes binding rules of engagement. At the same time, it becomes clear that there is an increasing need for standardization of interfaces, data formats, and even the correct applications of systems engineering processes. Such standardization helps prevent precious time and resources being wasted on reinventing the wheel on common technologies and processes, and of pursuing sub-optimal solutions with an associated decrease in efficiency. Standards provide benefit to the community by describing best practices and encapsulate communityconsensus guidelines. Adoption of such guidelines is of course entirely voluntary but it may both accelerate development as well as increase market adoption by finding common ground amongst other adopters. While some standard organizations focus on particular applications areas, the compiled guidelines are often easily transferable into other domains. This paper provides a broad overview of current regulations, policies and standards across a number of application areas. Having awareness of both guidelines and regulations will enable practitioners in adopting best practices and raise awareness of potential constraints.
working at PARC, Dr. Goebel worked at NASA Ames Research Center (2006 and at General Electric's Corporate Research Center (1997 -2006) where he was also an adjunct professor at Rensselaer Polytechnic Institute. Dr.
Goebel is now an adjunct professor at Luleå Technical University. He is a co-founder of the Prognostics and Health Management Society and he is currently associate editor of the International Journal of PHM.

Ravi
Rajamani is an independent consultant who has accumulated many years of experience in the area of aerospace propulsion and energy, specifically in data analytics and model-based methods for controls, diagnostics, and prognostics. He has six books to his name including Electric Flight Technology: The Unfolding of a New Future; many book chapters, journal and conference papers, and patents. Prior to his current job, Ravi worked at Meggitt, UTC, and GE, where he was a colleague of his co-author, Kai. He has a BTech from IITD, an MS from IISc, a PhD from University of Minnesota, and an MBA from University of Connecticut. He is active within various SAE technical committees dealing with PHM and electric propulsion; serving as the chair of the IVHM Steering Group. He is also active in the PHM Society. Ravi has visiting positions at UCONN and at Cranfield University. He serves on the editorial board of the IJPHM, and he is the editor-in-chief of the SAE International Journal of Aerospace. He is an elected fellow of SAE International and of IMechE, and is a recipient of SAE's Forest R. McFarland Award.