# Reliability Monitoring of Fault Tolerant Control Systems with Demonstration on an Aircraft Model

Authors: Hongbin Li; Qing Zhao; Zhenyu Yang
Journal: Journal of Control Science and Engineering
 (2008)

---

## Abstract

This paper proposes a reliability monitoring scheme for active fault tolerant control
systems using a stochastic modeling method. The reliability index is defined based on
system dynamical responses and a safety region; the plant and controller are assumed to
have a multiple regime model structure, and a semi-Markov model is built for reliability
evaluation based on the safety behavior of each regime model estimated by using Monte
Carlo simulation. Moreover, the history data of fault detection and isolation decisions is
used to update its transition characteristics and reliability model. This method provides an
up-to-date reliability index as demonstrated on an aircraft model.


---

## Body

## 1. Introduction

In order to
meet high reliability requirement of safety-critical processes, major progress
has been made in fault tolerant control systems (FTCSs). FTCSs usually employ
fault detection and isolation (FDI) schemes and reconfigurable controllers to
accommodate fault effects, also known as active FTCSs. Most work on
reconfigurable controller design is performed under the assumption of perfect
FDI detections. However, imperfect FDI results are inevitable owing to
disturbances or modeling uncertainties and may corrupt designated reliability
requirement. Therefore, it is necessary to validate the design of FTCSs from a
reliability perspective.The reliability of FTCSs has been investigated using
various methods. The key problem is to set up appropriate reliability models
with control objectives and safety requirements incorporated. As fault
occurrences and system failures are rare events, dynamic models are usually not
suitable for reliability analysis. For example, Wu used serial-parallel block diagrams
and Markov models for evaluation purpose, and defined a coverage concept to
relate reliability and control actions [1]. Walker proposed Markov and
semi-Markov models to describe the transitions of fault and FDI modes, but
control actions are not considered [2]. In previous work, we considered static
model-based control objectives and built a semi-Makov model from imperfect FDI
and hard-deadline concepts [3, 4]. However, in many practical systems, the
safety and reliability of operation are often assessed based on dynamic system
responses. For instance, reliability in structural control is defined as the
probability of system outputs outcrossing safety boundaries and evaluated by
using Gaussian approximation [5]. Also, an online available reliability monitoring
scheme using updated information may aid maintenance scheduling, provide
prealarming, and avoid emergent overhauls. How to evaluate reliability when it
is defined based on system trajectory and how to implement an online-monitoring
scheme are the main motivations of this paper.The objectives of this paper are threefold. First of
all, a steady-state test (SST) is proposed to reduce false alarms of FDI
decisions. The stochastic modeling of such an FDI scheme is studied based on
which the transition characteristics of FDI modes can be described. The second
objective is to develop a reliability evaluation scheme for FTCSs based on
system dynamic responses and safety boundary. At last, online monitoring
features are considered, such as estimation of FDI transition parameters based
on history data and timely update of reliability index to reflect up-to-date
system behavior.The remainder of this paper is organized as follows:
the assumptions and system structure are given in Section2; FDI scheme,
modeling, and parameter estimation are discussed in Section 3; the
determination of outcrossing failure rates and hard-deadlines are discussed in
Section 4; the reliability model construction is discussed in Section 5
followed by a demonstration example of an F-14 aircraft model in Section 6.


## 2. Assumptions and System Structure

Assumption 1.
The considered plant is assumed to have finite fault modes, and dynamics under each fault mode
can be effectively represented by a linear system model.Fault modes are represented by a setS with N integers; {ℳi:i∈S} represents the
set of dynamical plant models under various fault modes; {𝒦j:j∈S} denotes a set
of reconfigurable controllers in a switching structure. 𝒦j is designed for
fault mode j based on ℳj, j∈S. However, true fault modes are usually not directly
known, so an FDI scheme is used to generate estimates of fault modes, which may
deviate from true fault modes with error probabilities.Assumption 2.
FDI scheme is assumed to generate a fault estimate
based on a batch of measurements and calculations for every fixed periodTc.This assumption states a cyclic feature of FDI, such
as statistical tests and interactive multiple model (IMM) Kalman filters [6]. FDI modes are represented by a discrete-time
stochastic process ηn∈S, where n∈ℕ, the set of nonnegative integers. The time duration
between consecutive discrete indices is equal to FDI detection period Tc. 𝒦j is put in use
when ηn=j, j∈S. Corresponding to ηn, a discrete-time stochastic process ζn denotes true
fault mode. In reliability engineering, constant failure rates are usually
assumed for the main part of component life cycle. In such a case, ζn can be
described as a Markov chain [7],  and its transition probabilities are denoted as Gij=Pr{ζn+1=j∣ζn=i}, i,j∈S.Remark 1.
The semi-Markov process can be used as a general FDI
model. It can describe any type of sojourn time distribution; in contrast, the
Markov process model accepts exponential sojourn time distributions only. More
discussions can be found in  [4].Assumption 3.
System performance is assumed to be represented by a
vector signalz(t). Safety region, denoted as Ω, is assumed to be a fixed region in the space of z(t) bounded by its
safety threshold. Failure is assumed to occur when z(t) exceeds a
safety region for the first time.This assumption intends to define an appropriate
reliability index based on system dynamical response. It is common in control
systems to use a signalz(t) to represent
performance, and z(t) is usually to
be kept at small values against influences from exogenous disturbances,
modeling uncertainties, and dynamical characteristic changes caused by faults.
Safety region Ω is assumed to
be fixed and known a priori. The scenario that z(t) exceeds Ω represents lost
of control and system failures. More discussions on this assumption can be
found in [8].Definition 1.
For a time interval from 0 tot, the reliability function R(t) is defined as
the following probability:
(1)R(t)=Pr⁡{∀0≤τ≤t,z(τ)∈Ω}.
Mean time to
failure (MTTF) is defined as the expected time of satisfactory operation:
(2)MTTF=∫0∞R(t)dt.Remark 2.
Different
from repairs relying on human intervention when system operation is stopped,
control actions are executed automatically and can be deemed as an internal
actions of FTCSs. Therefore,  MTTF represents the mean operational time without
human intervention before failure.Compared withζn and ηn, z(t) is typically a
fast changing function determined by both continuous and discrete dynamics. As
shown in Figure 1, ζn and ηn are two regime
modes and determine the transitions among regime models. When ζn=i and ηn=j are fixed, z(t) evolves
according to plant model ℳi and controller 𝒦j. As a result of this hybrid dynamics, directly
evaluating R(t) and MTTF is a
difficult problem. Therefore, a discrete-time semi-Markov chain Xn is constructed
for reliability evaluation purpose. The main idea is that the hybrid system is
decomposed into various regime models;  each regime model is then evaluated for
related safety characteristics, and Xn is constructed
to integrate these characteristics with transition parameters of regime modes
and to solve its transition probabilities for reliability evaluation. The
structure and main components of reliability monitoring scheme are illustrated
in Figure 2.Figure 1
Transitions among regime models.Figure 2
System structure.Semi-Markov reliability modelXn is the kernel
component for calculating MTTF. It is constructed based on the following
parameters: (1) the transition rates of ζn, called plant failure rates, (2) the estimates of ζn from FDI and
confirmation test, called confirmed fault modes, (3) the parameters of ηn estimated from
history data, called FDI transition characteristics, (4) the probability of z(t) crossing safety
boundary during an FDI cycle Tc when ζn=ηn, called failure outcrossing rates, (5) the average
number of periods before crossing safety boundary when ζn≠ηn, called hard deadlines. Among these parameters, the
second and third ones can be updated online.


## 3. FDI Scheme and Its Characterization

### 3.1. Steady-State Tests

It is well
known that false alarm and missing detection rates are two conflicting quality
criteria of FDI. One is usually improved at the cost of degrading the other.
What is worse, the general rules of adjusting FDI to improve these two criteria
simultaneously are often not known. For example, in a scheme based on IMM
Kalman filters, it is not clear how to determine Markov interaction parameters.
Considering that most false alarms last for short time only, an SST strategy is
adopted for postprocessing FDI decisions.SST requires that, when FDI decision changes, new
decision is accepted only when it stays the same for a minimum number of
detection cycles. LetTSSTj denote the
required number of consistent cycles for FDI mode j, j∈S. The effectiveness of this SST strategy relies on the
distribution of false alarm durations. For example, if a nonnegative discrete
random variable λ0 denotes the
false alarm duration when system fault mode ζn=0, TSST0 can be taken as (1−α)-quantile of λ0, 0<α<1, meaning
(3)Pr⁡{λ0>TSST0}≤α,
which implies
that false alarm probability can be reduced by ratio α when accepting
FDI decisions after TSST0. The weakness of this method is additional detection
time delay of TSSTj when fault
occurs. However, this happens only under rare occurrences of faults. Compared
with the improvement on relatively more frequently transitions of FDI modes,
this weakness is acceptable.Detection decisions from SST are represented byηn and used for
controller reconfigurations. In Figure 2, the confirmation test is an SST with
large test period to further reduce false alarm probability to a negligible
level. It generates confirmed fault modes, which are used with FDI trajectories
for updating transition parameters of ηn and reliability
index.


### 3.2. Stochastic Models

A sample path ofηn is given in
Figure 3. Let θm∈S and Tm∈ℕ denote the FDI
mode and cycle index, respectively, after the mth transition
of ηn, m∈ℕ. For example, in Figure 3, θ1=η5 and T2=5. θm and Tm together determine
FDI trajectory, and ηn=θSn, where Sn=sup{m∈ℕ:Tm≤n} is the
discrete-time counting process of the number of jumps in [1,n]. (θ,T)≜{θm,Tm:m∈ℕ} is called a
discrete-time Markov renewal process if
(4)Pr{θm+1=j,Tm+1−Tm=l∣θ0,…,θm;T0,…,Tm}=Pr{θm+1=j,Tm+1−Tm=l∣θm}
holds for fixed ζTm=ζTm+1=⋯=ζTm+1=k, k,j∈S, l,m∈ℕ. ηn=θm is then called
the associated discrete-time semi-Markov chain of (θ,T). It can be shown that θm is a Markov
chain, and its transition probability matrix is denoted by Pk.Figure 3
A sample path ofηn.GivenζTm=ζTm+1=⋯=ζTm+1=k, let τijk=Tm+1−Tm if θm=i and θm+1=j, i,j,k∈S.  τijk is the sojourn
time of ηn between its
transition to state i at Tm and the
consecutive transition to j at Tm+1. If the transition destination state is not
specified, let τik denote the
sojourn time at state i.As shown in Figure3, τijk is the sum of
two variables: a constant TSSTi for SST period
and a random sojourn time σijk. Let hijk(l) and gijk(l) denote the
discrete distribution functions of τijk and σijk respectively,
which have the following relations:
(5)hijk(l)=Pr⁡{τijk=l}={0,l≤TSSTi,gijk(l−TSSTi),l>TSSTi.
This semi-Markov
description provides a general model on FDI mode transitions, but it involves a
large number of parameters. The transition characteristics of ηn are jointly
determined by Pk and hijk (or gijk). If S contains N fault modes,
there are N transition
probability matrices Pk and N3 distribution
functions hijk. If each hik follows
geometric distribution, the description of ηn may degenerate
to  a hypothetical Markov model ηn′.All Markov chains can be considered as a special type of semi-Markov
chains. Ifηn can be modeled
as a Markov chain with transition probability matrix denoted by Hk for ζn=k, the following relations hold:
(6)Pijk=Hijk1−Hiik,(7)hijk(l)=(Hiik)l−1Hijk,(8)hik(l)=(Hiik)l−1(1−Hiik).
It is obvious
that hik is a geometric
distribution. In fact, this is an essential property of Markov chain, as shown
in the following lemma.Lemma 1.
A discrete-time semi-Markov chain degenerates to a
Markov chain if and only if the sojourn time at each state (when subsequent
state is not specified) follows geometric distribution.The proof is given in the appendix. WhenTSST is nonzero, the
sojourn time of ηn does not follow
geometric distribution owing to this deterministic constant, and Lemma 1 cannot
be directly applied. However, as TSST is known, a hypothetical
process ηn′ can be
constructed by setting TSST to zeros; if
the sojourn time of ηn′ is
geometrically distributed, it can be described as a Markov chain; the original
sojourn time of ηn can be
recovered by adding TSST to that of ηn′. This method may greatly reduce the number of
parameters for characterizing FDI results.


### 3.3. Transition Parameter Estimation

FDI transition
parameters can be estimated as an offline test on FDI when both fault mode and
FDI detection results are known. This estimation can also be carried out online
using FDI history data and confirmed fault modes.Whenηn is modeled as a
semi-Markov chain, Pk and hijk (or gijk) are
parameters to be estimated. Pk can be
estimated from the transition history of ηn. For example, when ζn is kept as a
constant k, if there are Mij transitions
from i to j among all M transitions
leaving i, the ijth element of Pk can be
estimated as P^ijk=Mij/M.The estimation of sojourn time distributiongijk can be
completed in two steps: the histogram of sojourn time is firstly examined to
select a standard distribution such that nonparametric estimation is converted
to a parametric one; g^ijk is then
obtained by estimating unknown parameters in distribution functions.Ifg^ijk follows
geometric distribution for all i,j,k∈S, ηn can be
described as a hypothetical Markov chain ηn′ under the
hypothesis that TSSTi=0. As a result, transition probability Hijk from i to j and sojourn
time τik at i have the
following relation:
(9)Pr⁡{τik=n}=(Hiik)n−1(1−Hiik).
Therefore, E(τik)=1/(1−Hiik), and Hiik can be
estimated by
(10)H^iik={1−1∑l=1Mτik(l)/M,∑l=1Mτik(l)M≠0,1,otherwise,
where τik(l) denote M sojourn time
samples at state i, l=1,…,M. Hijk can be
estimated based on the transition frequency from state i to j:
(11)H^ijk=(1−H^iik)wijkM,
where 1−H^iik is a
normalization coefficient and wijk represents the
number of FDI transitions from i to j.


## 3.1. Steady-State Tests

It is well
known that false alarm and missing detection rates are two conflicting quality
criteria of FDI. One is usually improved at the cost of degrading the other.
What is worse, the general rules of adjusting FDI to improve these two criteria
simultaneously are often not known. For example, in a scheme based on IMM
Kalman filters, it is not clear how to determine Markov interaction parameters.
Considering that most false alarms last for short time only, an SST strategy is
adopted for postprocessing FDI decisions.SST requires that, when FDI decision changes, new
decision is accepted only when it stays the same for a minimum number of
detection cycles. LetTSSTj denote the
required number of consistent cycles for FDI mode j, j∈S. The effectiveness of this SST strategy relies on the
distribution of false alarm durations. For example, if a nonnegative discrete
random variable λ0 denotes the
false alarm duration when system fault mode ζn=0, TSST0 can be taken as (1−α)-quantile of λ0, 0<α<1, meaning
(3)Pr⁡{λ0>TSST0}≤α,
which implies
that false alarm probability can be reduced by ratio α when accepting
FDI decisions after TSST0. The weakness of this method is additional detection
time delay of TSSTj when fault
occurs. However, this happens only under rare occurrences of faults. Compared
with the improvement on relatively more frequently transitions of FDI modes,
this weakness is acceptable.Detection decisions from SST are represented byηn and used for
controller reconfigurations. In Figure 2, the confirmation test is an SST with
large test period to further reduce false alarm probability to a negligible
level. It generates confirmed fault modes, which are used with FDI trajectories
for updating transition parameters of ηn and reliability
index.


## 3.2. Stochastic Models

A sample path ofηn is given in
Figure 3. Let θm∈S and Tm∈ℕ denote the FDI
mode and cycle index, respectively, after the mth transition
of ηn, m∈ℕ. For example, in Figure 3, θ1=η5 and T2=5. θm and Tm together determine
FDI trajectory, and ηn=θSn, where Sn=sup{m∈ℕ:Tm≤n} is the
discrete-time counting process of the number of jumps in [1,n]. (θ,T)≜{θm,Tm:m∈ℕ} is called a
discrete-time Markov renewal process if
(4)Pr{θm+1=j,Tm+1−Tm=l∣θ0,…,θm;T0,…,Tm}=Pr{θm+1=j,Tm+1−Tm=l∣θm}
holds for fixed ζTm=ζTm+1=⋯=ζTm+1=k, k,j∈S, l,m∈ℕ. ηn=θm is then called
the associated discrete-time semi-Markov chain of (θ,T). It can be shown that θm is a Markov
chain, and its transition probability matrix is denoted by Pk.Figure 3
A sample path ofηn.GivenζTm=ζTm+1=⋯=ζTm+1=k, let τijk=Tm+1−Tm if θm=i and θm+1=j, i,j,k∈S.  τijk is the sojourn
time of ηn between its
transition to state i at Tm and the
consecutive transition to j at Tm+1. If the transition destination state is not
specified, let τik denote the
sojourn time at state i.As shown in Figure3, τijk is the sum of
two variables: a constant TSSTi for SST period
and a random sojourn time σijk. Let hijk(l) and gijk(l) denote the
discrete distribution functions of τijk and σijk respectively,
which have the following relations:
(5)hijk(l)=Pr⁡{τijk=l}={0,l≤TSSTi,gijk(l−TSSTi),l>TSSTi.
This semi-Markov
description provides a general model on FDI mode transitions, but it involves a
large number of parameters. The transition characteristics of ηn are jointly
determined by Pk and hijk (or gijk). If S contains N fault modes,
there are N transition
probability matrices Pk and N3 distribution
functions hijk. If each hik follows
geometric distribution, the description of ηn may degenerate
to  a hypothetical Markov model ηn′.All Markov chains can be considered as a special type of semi-Markov
chains. Ifηn can be modeled
as a Markov chain with transition probability matrix denoted by Hk for ζn=k, the following relations hold:
(6)Pijk=Hijk1−Hiik,(7)hijk(l)=(Hiik)l−1Hijk,(8)hik(l)=(Hiik)l−1(1−Hiik).
It is obvious
that hik is a geometric
distribution. In fact, this is an essential property of Markov chain, as shown
in the following lemma.Lemma 1.
A discrete-time semi-Markov chain degenerates to a
Markov chain if and only if the sojourn time at each state (when subsequent
state is not specified) follows geometric distribution.The proof is given in the appendix. WhenTSST is nonzero, the
sojourn time of ηn does not follow
geometric distribution owing to this deterministic constant, and Lemma 1 cannot
be directly applied. However, as TSST is known, a hypothetical
process ηn′ can be
constructed by setting TSST to zeros; if
the sojourn time of ηn′ is
geometrically distributed, it can be described as a Markov chain; the original
sojourn time of ηn can be
recovered by adding TSST to that of ηn′. This method may greatly reduce the number of
parameters for characterizing FDI results.


## 3.3. Transition Parameter Estimation

FDI transition
parameters can be estimated as an offline test on FDI when both fault mode and
FDI detection results are known. This estimation can also be carried out online
using FDI history data and confirmed fault modes.Whenηn is modeled as a
semi-Markov chain, Pk and hijk (or gijk) are
parameters to be estimated. Pk can be
estimated from the transition history of ηn. For example, when ζn is kept as a
constant k, if there are Mij transitions
from i to j among all M transitions
leaving i, the ijth element of Pk can be
estimated as P^ijk=Mij/M.The estimation of sojourn time distributiongijk can be
completed in two steps: the histogram of sojourn time is firstly examined to
select a standard distribution such that nonparametric estimation is converted
to a parametric one; g^ijk is then
obtained by estimating unknown parameters in distribution functions.Ifg^ijk follows
geometric distribution for all i,j,k∈S, ηn can be
described as a hypothetical Markov chain ηn′ under the
hypothesis that TSSTi=0. As a result, transition probability Hijk from i to j and sojourn
time τik at i have the
following relation:
(9)Pr⁡{τik=n}=(Hiik)n−1(1−Hiik).
Therefore, E(τik)=1/(1−Hiik), and Hiik can be
estimated by
(10)H^iik={1−1∑l=1Mτik(l)/M,∑l=1Mτik(l)M≠0,1,otherwise,
where τik(l) denote M sojourn time
samples at state i, l=1,…,M. Hijk can be
estimated based on the transition frequency from state i to j:
(11)H^ijk=(1−H^iik)wijkM,
where 1−H^iik is a
normalization coefficient and wijk represents the
number of FDI transitions from i to j.


## 4. Outcrossing Failure Rates and Hard-Deadlines

Owing to FDI
delays or incorrect decisions, controller𝒦i may be used for
its designated regime model ℳi (namely,
matched cases) and other model ℳj, i≠j (namely,
mismatched cases). Matched cases usually account for major operation time,
while mismatched cases often appear as temporary operation.Definition 2.
The outcrossing
failure rate in matched cases is defined as(12)vii≜Pr⁡{∃τ,nTc<τ≤(n+1)Tc,z(τ)∉Ω∣z(nTc)∈Ω,ζn=ηn=i},i∈S.Monte Carlo simulation can be used for estimatingvii: sample simulations are performed by using generated
sample uncertain plant model and sample disturbance input; the simulation time
when system fails is called a sample time-to-failure. With a large number of
time-to-failure samples obtained, vii can be
estimated as the ratio between Tc and sample mean
of time-to-failure.Mismatched cases are usually temporary operation
caused by FDI false alarms or delays, and system may return to matched cases ifz(t) does not
diverge to unsafe region. So, it is important to find out the average tolerable
time before system failure. This time limit is called hard-deadline, denoted by Thdij for ζn=i and ηn=j. It can also be estimated by sample mean of
time-to-failure using Monte Carlo simulations.


## 5. Reliability Model Construction

The states of
semi-Markov chainXn for reliability
evaluation are classified into two groups: one unique failure state, denoted by sF, and multiple functional states, defined as state
combinations of ζn=i and ηn=j, denoted as sij, i,j∈S. For example, if two types of faults are considered
in the plant, ζn includes states
of fault-free, fault type 1, fault type 2, and both fault 1 and fault 2,
represented by S={0,1,2,3}, and Xn contains 17
states.The semi-Markov kernel ofXn is denoted as Q(⋅,⋅,m), representing the one-time transition probability in m cycles. It is
determined by the following parameters: (1) transition characteristics of fault
and FDI modes, (2) outcrossing failure rate in state sii denoted by vii, (3) hard-deadline in state sij denoted by Thdij, (4) FDI SST period denoted by TSSTj for FDI mode j.Let us begin with the case that FDI mode can be
described as a hypothetical Markov chainηn′ with transition
probability denoted by Hijk. The calculation of Q is classified
into the following cases.Case 1.
The transitions from functional states to themselves are not defined and the
corresponding elements are assigned as zeros:(13)Q(sii,sii,m)=0,Q(sij,sij,m)=0,i,j∈S.Case 2.
Failure statesF is absorbing:
(14)Q(sF,sF,m)={1,m=1,0,m>1.Case 3.
Initial states are matched statessii:
(15)Q(sii,sF,m)={(1−vii)m−1Giim−1vii,m≤TSSTi,pii[(1−vii)GiiHiii](m−TSSTi−1)vii,m>TSSTi,Q(sii,sji,m)={(1−vii)m−1Giim−1(1−vii)Gij,m≤TSSTi,pii[(1−vii)GiiHiii](m−TSSTi−1)(1−vii)GijHiii,m>TSSTi,Q(sii,sij,m)={0,m≤TSSTi,pii[(1−vii)GiiHiii](m−TSSTi−1)(1−vii)GiiHiji,m>TSSTi,Q(sii,skj,m)={0,m≤TSSTi,pii[(1−vii)GiiHjjk](m−TSSTi−1)(1−vii)GikHiji,m>TSSTi,
where pii=Pr{X1=X2=⋯=XTSSTi=sii∣X0=sii}=(1−vii)TSSTiGiiTSSTi, i≠j, k≠i, i,j,k∈S.
The derivation of these equations are based on Markov
transition probabilities and the decomposition of each event.
For example,(16)Q(sii,sF,m)=Pr{X1=X2=⋯=Xm−1=sii,Xm=sF∣X0=sii}=Pr{X1=X2=⋯=Xm−1=sii∣X0=sii}×Pr{X1=sF∣X0=sii}.
Considering the
SST of FDI, if m≤TSSTi,
(17)Pr{X1=X2=⋯=Xm−1=sii∣X0=sii}=(1−vii)m−1Giim−1.
If m>TSSTi,
(18)Pr⁡{X1=X2=⋯=Xm−1=sii∣X0=sii}=Pr⁡{X1=X2=⋯=XTSSTi=sii∣X0=sii}×[(1−vii)GiiHiii](m−TSSTi−1).Q(sii,sF,m) can be obtained by combining these two probabilities with Pr{X1=sF∣X0=sii}=vii.Case 4.
Mismatched states,sij, i≠j. When m≤TSSTj, the transition probability of X(t) to any other
state is zero because of SST period. When TSSTj<m≤Thdij, the probability of X(t) transiting to
any other state is zero except to sii. The above reasoning is based on the facts that FDI
rarely jumps to other false modes when current mode is incorrect, and mean
fault occurrence time is in a much higher order compared with a short false FDI
detection period. Therefore, when TSSTj<m≤Thdij,
(19)Q(sij,sF,m)=0,Q(sij,sii,m)=(Hjji)m−TSSTj−1Hjii,j≠l,j,l∈S.
When m>Thdij+1, Xn jumps to sF at the earliest
time m=Thdij+1 only:
(20)Q(sij,sF,TSSTi+1)=1−∑k=TSSTi+1ThdijQ(sij,sii,m)=1−1−(Hjji)Tij−TSSTj+11−HjjiHjii.In the general cases,ηn is modeled as a
semi-Markov chain, and the competition probabilities methods discussed in [4] can be utilized.Definition 3.
Givenζn=i and ηn=j, the combinational mode is denoted as (i,j), i,j∈S. Suppose (ζn+1,ηn+1)=⋯=(ζn+m−1,ηn+m−1)=(i,j) and the next
combinational mode after the consequent transition of ζn or/and ηn at n+m is (ζn+m,ηn+m)=(k,l), where k≠i or/and l≠j, k,j∈S. The probability of this event is called the
competition probability, denoted by ρ(i,j)↣(k,l)(m).The calculation formulas ofρ(i,j)↣(k,l)(m) were derived in [4, Section 3]
and are omitted here for brevity. As the states of Xn are mainly
defined as the state combinations of ζn and ηn, the calculation of the semi-Markov kernel of Xn is simplified
when ρ(i,j)↣(k,l)(m) is available,
as shown in the following listed formulas:
(21)Q(sii,skl,m)=(1−vii)mρ(i,i)↣(k,l)(m),Q(sii,sF,m)=(1−vii)m−1vii,Q(sii,sii,m)=0,Q(sij,skl,m)={ρ(i,j)↣(k,l)(m),m≤Thdij,k=l=i,0,otherwise,Q(sij,sF,m)={0,m≤Thdij,1−∑m=1ThdijQ(sij,sii,m),m>Thdij,Q(sF,sF,m)={1,m=1,0,m>1.
Although these
formulas appear to be simpler, both the parameter estimation and competition
probability calculations need much more calculation burden than the first case
when FDI decision is modeled as a hypothetical Markov chain. Once Xn is constructed,
calculation of reliability function and MTTF are straightforward using
available formulas [9].


## 6. Demonstration on an F-14 Aircraft Model

### 6.1. Model Description

A control
problem of F-14 aircraft was presented in [10], and also used as a demonstration
example in MATLAB Robust Control Toolbox.MATLAB and Robust Control Toolbox are the trademarks of The MathWorks, Inc. This problem considers the design of a
lateral-directional axis controller during powered approach to a carrier
landing with two command inputs from the pilot: lateral stick and rudder pedal.
At an angle-of-attack of 10.5 degrees and airspeed of 140 knots, the nominal
linearized F-14 model has four states: lateral velocity, yaw rate, roll rate,
and roll angle, denoted by v, r, p, and ϕ, respectively,
two control inputs: differential stabilizer deflection and rudder deflection,
denoted by δdstab and δrud, respectively,
and four outputs: roll rate, yaw rate, lateral acceleration, and side-slip
angle, denoted by p, r, yac, and β, respectively.
The system dynamics equations are ignored here,  and can be loaded in MATLAB 7.1
using command “load F14nominal.” An additional disturbance input is added to
represent the wind gust effects.The control objective is to have desired handling quality (HQ) responses from
lateral stick to roll ratep and from rudder pedal to side-slip angle β.  Under fault-free modes, the HQ models are 5(2/(s+2)) and −2.5(1.252/(s+2.5s+1.252)); when fault occurs, HQ models degrade to 5(1/(s+1)) and −2.5(0.752/(s+1.5s+0.752)), respectively.The system block diagram is shown in Figure4, where
F-14nom represents the
nominal linearized F-14 model, and AS and AR the actuator
models. ep and eβ represent the
weighted model matching errors. Actuator energy is described by eact, and noise is added to the measured output after
antialiasing filters.Figure 4
Control design diagram for F-14 lateral axis (Courtesy of The MathWorks, Inc.).The considered fault occurs in two actuators. Under
fault-free mode, their transfer functions are(22)AS=AR=25s+25.
Two types of actuator faults are considered here, each
has mean occurrence time 105 of FDI periods
or its failure rate is 10−5. Under fault type 1, the transfer function of AS becomes
(23)AS′=0.515s+15.
Under fault type 2, the transfer function of AR becomes
(24)AR′=0.510s+10.
These fault modes are described as the change of
actuator gains and time constants. The set of fault modes is denoted by S={0,1,2,3}, representing fault-free, fault type 1, type 2, and
simultaneous occurrence of both.


### 6.2. Performance Characterization of Controller and FDI

FourH∞ controllers are
designed for each fault mode to achieve nominal HQ control objectives under
fault-free mode and degraded HQ performance under fault modes. Typical output
trajectories under fault-free mode are shown in Figure 5, where the curves
labeled with “Real” represent the measured outputs, “Ideal” the outputs
under nominal HQ performance, and “Degraded” the outputs under degraded HQ
performance. The absolute minimal matching errors between the real responses
and the expected outputs under ideal HQ performance are shown in Figure 6,
which are assumed to represent system safety behaviors. When these matching
errors go over the safety limits, 30% of expected output, aircraft is
considered as failed.Output trajectories.
(a)(b)The trajectories of matching errors.
(a)(b)An IMM FDI is constructed to detect fault occurrences.
To reduce false alarms, a steady-state test strategy is applied on FDI
decisions withTSSTj=6 for any FDI
mode j. A typical FDI trajectory is shown in Figure 7. It is
clear that the steady FDI mode is free of false alarms in the shown time
period. But detection time delays are introduced when fault occurs at 20 and 50
seconds, respectively.FDI trajectory.
(a)(b)(c)To represent FDI detection characteristics, a batch of
fault and FDI history data is collected for statistical estimation. First,
histograms of FDI delays are generated to check its distribution type. When
there is no fault, the histogram of FDI sojourn time at fault-free mode is
shown in Figure8. It clearly resembles a geometric distribution. Equations (10)-(11)
are then used to estimate Markov transition probabilities, and those under
fault-free mode are obtained as
(25)H0=[0.999000.00100.00001.00000000.133000.867000.5000000.5000].
Note that H0(2,1)=1 and H0(2,2)=0 represent the
transition probabilities of FDI from a false alarm state. Estimated based on
the given history data, these values imply that the FDI leaves false alarm
state in one transition cycle. But there may exist estimation error, and the
true value of H0(2,2) may be close to
but not exact zero.Figure 8
Histogram of FDI sojourn time.As a result of FDI false alarms, missing detections,
and detection delays, controllers may be engaged for various fault modes for
which they are not designed. So, it is necessary to evaluate system behavior
under all possible combinations of FDI and fault modes. Here, Monte Carlo
simulations are adopted with the following settings: (1) command stick inputs
are square waves with frequency as a random variable ranging from 0.2 to 2 Hertz, (2) wind gust disturbances and sensor measurement noises are assumed to
be Gaussian processes, (3) actuator saturation effects limit control inputs to
20 and 30, respectively, (4) system failure is assumed to occur when model
matching errors go over 30% of stick commands. For example, with fault mode 2
occurred and𝒦2 engaged, mean
time to system failure is 57 403 seconds when controller 𝒦2 is used, and 6
seconds when 𝒦1 is used.
Considering the sampling period to be 0.1 second for IMM FDI, the outcrossing
failure rate and hard-deadline are v22=1/574030, Thd21=60.


### 6.3. Reliability Evaluation

Reliability semi-Markov model can be constructed based
on fault transition rates, FDI transition parameters, outcrossing failure rate,
and hard-deadlines. Predicted reliability function and MTTF can be thereby
calculated. By using MTTF as an objective, an optimization is performed onTSST. It is found that MTTF will be improved from 27 727
to 32 605 seconds if TSSTj is reduced from
6 to 1. A comparison of reliability functions before and after this
optimization is shown in Figure 9. It is clearly shown that reliability index
is improved.Figure 9
Reliability functions comparison.Comparisons on the transition probabilities between
these two SST periods are shown in Figure10, in which each subfigure gives the
transition probability curves from s00 to other
states. For example, the subfigure at the first row and second column shows
that the transition probabilities to s01 are increased
from 0 to about 0.008. This is a natural result of increased false alarms when
reducing TSSTj. In fact, when TSSTj=1, new Markov transition parameters H′0 become
(26)H′0=[0.98220.00170.01220.00380.26340.7366000.198900.801100.3530000.6470].Figure 10
Comparison of transition probabilities.Compared withH0, the element on the first row and second column is
increased from 0 to 0.0017, a confirmation of increased false alarms. On the other
hand, detection delays are reduced approximately from 6 to 1, and system stays
less time under mismatched fault and FDI cases. Overall, MTTF is improved.This
evaluation procedure can be completed in an online manner. Estimated FDI
transition parametersH and current
mode of ζn provided by
confirmed test on FDI can be used to provide updated MTTF based on this most
recent information.


## 6.1. Model Description

A control
problem of F-14 aircraft was presented in [10], and also used as a demonstration
example in MATLAB Robust Control Toolbox.MATLAB and Robust Control Toolbox are the trademarks of The MathWorks, Inc. This problem considers the design of a
lateral-directional axis controller during powered approach to a carrier
landing with two command inputs from the pilot: lateral stick and rudder pedal.
At an angle-of-attack of 10.5 degrees and airspeed of 140 knots, the nominal
linearized F-14 model has four states: lateral velocity, yaw rate, roll rate,
and roll angle, denoted by v, r, p, and ϕ, respectively,
two control inputs: differential stabilizer deflection and rudder deflection,
denoted by δdstab and δrud, respectively,
and four outputs: roll rate, yaw rate, lateral acceleration, and side-slip
angle, denoted by p, r, yac, and β, respectively.
The system dynamics equations are ignored here,  and can be loaded in MATLAB 7.1
using command “load F14nominal.” An additional disturbance input is added to
represent the wind gust effects.The control objective is to have desired handling quality (HQ) responses from
lateral stick to roll ratep and from rudder pedal to side-slip angle β.  Under fault-free modes, the HQ models are 5(2/(s+2)) and −2.5(1.252/(s+2.5s+1.252)); when fault occurs, HQ models degrade to 5(1/(s+1)) and −2.5(0.752/(s+1.5s+0.752)), respectively.The system block diagram is shown in Figure4, where
F-14nom represents the
nominal linearized F-14 model, and AS and AR the actuator
models. ep and eβ represent the
weighted model matching errors. Actuator energy is described by eact, and noise is added to the measured output after
antialiasing filters.Figure 4
Control design diagram for F-14 lateral axis (Courtesy of The MathWorks, Inc.).The considered fault occurs in two actuators. Under
fault-free mode, their transfer functions are(22)AS=AR=25s+25.
Two types of actuator faults are considered here, each
has mean occurrence time 105 of FDI periods
or its failure rate is 10−5. Under fault type 1, the transfer function of AS becomes
(23)AS′=0.515s+15.
Under fault type 2, the transfer function of AR becomes
(24)AR′=0.510s+10.
These fault modes are described as the change of
actuator gains and time constants. The set of fault modes is denoted by S={0,1,2,3}, representing fault-free, fault type 1, type 2, and
simultaneous occurrence of both.


## 6.2. Performance Characterization of Controller and FDI

FourH∞ controllers are
designed for each fault mode to achieve nominal HQ control objectives under
fault-free mode and degraded HQ performance under fault modes. Typical output
trajectories under fault-free mode are shown in Figure 5, where the curves
labeled with “Real” represent the measured outputs, “Ideal” the outputs
under nominal HQ performance, and “Degraded” the outputs under degraded HQ
performance. The absolute minimal matching errors between the real responses
and the expected outputs under ideal HQ performance are shown in Figure 6,
which are assumed to represent system safety behaviors. When these matching
errors go over the safety limits, 30% of expected output, aircraft is
considered as failed.Output trajectories.
(a)(b)The trajectories of matching errors.
(a)(b)An IMM FDI is constructed to detect fault occurrences.
To reduce false alarms, a steady-state test strategy is applied on FDI
decisions withTSSTj=6 for any FDI
mode j. A typical FDI trajectory is shown in Figure 7. It is
clear that the steady FDI mode is free of false alarms in the shown time
period. But detection time delays are introduced when fault occurs at 20 and 50
seconds, respectively.FDI trajectory.
(a)(b)(c)To represent FDI detection characteristics, a batch of
fault and FDI history data is collected for statistical estimation. First,
histograms of FDI delays are generated to check its distribution type. When
there is no fault, the histogram of FDI sojourn time at fault-free mode is
shown in Figure8. It clearly resembles a geometric distribution. Equations (10)-(11)
are then used to estimate Markov transition probabilities, and those under
fault-free mode are obtained as
(25)H0=[0.999000.00100.00001.00000000.133000.867000.5000000.5000].
Note that H0(2,1)=1 and H0(2,2)=0 represent the
transition probabilities of FDI from a false alarm state. Estimated based on
the given history data, these values imply that the FDI leaves false alarm
state in one transition cycle. But there may exist estimation error, and the
true value of H0(2,2) may be close to
but not exact zero.Figure 8
Histogram of FDI sojourn time.As a result of FDI false alarms, missing detections,
and detection delays, controllers may be engaged for various fault modes for
which they are not designed. So, it is necessary to evaluate system behavior
under all possible combinations of FDI and fault modes. Here, Monte Carlo
simulations are adopted with the following settings: (1) command stick inputs
are square waves with frequency as a random variable ranging from 0.2 to 2 Hertz, (2) wind gust disturbances and sensor measurement noises are assumed to
be Gaussian processes, (3) actuator saturation effects limit control inputs to
20 and 30, respectively, (4) system failure is assumed to occur when model
matching errors go over 30% of stick commands. For example, with fault mode 2
occurred and𝒦2 engaged, mean
time to system failure is 57 403 seconds when controller 𝒦2 is used, and 6
seconds when 𝒦1 is used.
Considering the sampling period to be 0.1 second for IMM FDI, the outcrossing
failure rate and hard-deadline are v22=1/574030, Thd21=60.


## 6.3. Reliability Evaluation

Reliability semi-Markov model can be constructed based
on fault transition rates, FDI transition parameters, outcrossing failure rate,
and hard-deadlines. Predicted reliability function and MTTF can be thereby
calculated. By using MTTF as an objective, an optimization is performed onTSST. It is found that MTTF will be improved from 27 727
to 32 605 seconds if TSSTj is reduced from
6 to 1. A comparison of reliability functions before and after this
optimization is shown in Figure 9. It is clearly shown that reliability index
is improved.Figure 9
Reliability functions comparison.Comparisons on the transition probabilities between
these two SST periods are shown in Figure10, in which each subfigure gives the
transition probability curves from s00 to other
states. For example, the subfigure at the first row and second column shows
that the transition probabilities to s01 are increased
from 0 to about 0.008. This is a natural result of increased false alarms when
reducing TSSTj. In fact, when TSSTj=1, new Markov transition parameters H′0 become
(26)H′0=[0.98220.00170.01220.00380.26340.7366000.198900.801100.3530000.6470].Figure 10
Comparison of transition probabilities.Compared withH0, the element on the first row and second column is
increased from 0 to 0.0017, a confirmation of increased false alarms. On the other
hand, detection delays are reduced approximately from 6 to 1, and system stays
less time under mismatched fault and FDI cases. Overall, MTTF is improved.This
evaluation procedure can be completed in an online manner. Estimated FDI
transition parametersH and current
mode of ζn provided by
confirmed test on FDI can be used to provide updated MTTF based on this most
recent information.


## 7. Conclusions

A reliability
monitoring scheme for FTCSs is reported in this paper. The scheme contains two
postprocessing strategies on FDI results to provide estimated fault mode for
control reconfiguration and confirmed mode for updating reliability. The stochastic
transitions of FDI mode is represented by a semi-Markov chain with parameters
estimated from history data. Under geometric sojourn time distributions, FDI
mode can be described by an equivalent hypothetical Markov chain that
simplifies its model and reliability analysis. Safety and satisfactory
operation of system is defined by system trajectories and safety boundaries;
the probability of violating this safety criterion under fixed fault and FDI
modes is estimated using Monte Carlo simulations. Overall reliability
evaluation is obtained through a semi-Markov model constructed by integrating
FDI transition characteristics and failure probabilities under each regime
model. This scheme provides timely monitoring on the reliability index of
FTCSs, and was demonstrated on an F-14 aircraft model.



---

*Source: 265189-2007-12-13.xml*