# Design of a Fault Detection and Isolation System for Intelligent Vehicle Navigation System

Authors: Wei Huang; Xiaoxin Su
Journal: International Journal of Navigation and Observation
 (2015)

---

## Abstract

This paper deals with the design of a fault detection and isolation (FDI) system for an intelligent vehicle, a vehicle equipped with advanced driver assistance system (ADAS). The ADASs are outfitted with sensors for acquiring various information about the vehicle and its surroundings. Since these sensors are sensitive to faults, an efficient FDI system should be developed. The designed FDI system is comprised of three parts: a detection part, a decision part, and a fault management part. The detection part applies a generalized observer scheme (GOS). In the GOS, there is bank of extended Kalman filters (EKFs), each excited by all except one sensor measurement. The residual generated from the measurement update of each EKF is therefore sensitive to all sensor faults but one. This way, the fault sensitivity pattern of the residual makes it possible to detect a fault and locate the faulty sensor. The designed FDI system has been implemented and tested off-line with actual experiment data. Good results have been obtained with diagnosing individual sensor faults and outputting fault-free vehicle states.


---

## Body

## 1. Introduction

Nowadays, the development of ADASs, which aids the driver by controlling the vehicle, is emphasized in the road transportation research. These automotive mechatronic systems are outfitted with sensors, such as radar, odometers, and accelerometers, for acquiring various information about the vehicle and its surroundings. Since these sensors are sensitive to faults, an efficient FDI system should be developed, such that based on the sensor measurements, sensor faults can be detected and isolated online, therefore ensuring the correct functionality of ADASs.A sensor is called faulty if it displays a measurement that deviates significantly from the characteristic properties. This deviation could appear in several forms, namely, bias, drift, complete failure, and precision degradation. The FDI system contains a fault detection system, which is followed by a fault isolation system. The definition of the fault detection is to make a decision: whether some fault happens or not. The definition of the fault isolation is to determine exactly the location of the fault, for example, which sensor has become faulty. Because a reliable vehicle model can be constructed, the discussion of model-based FDI strategies will be emphasized. Additionally, regarding the sensor fault that might occur, the following assumptions can be made.(1)
Only one fault can be present at the same time.(2)
All sensors can have partial and complete faults.(3)
Complete faults can be considered as an additive fault with fault size equal to the negative value of the real sensor signal.(4)
Usually faults are additive and transient (i.e., they disappear after a while).Model-based FDI is the method to determine faults of a system from the comparison of available system measurements with a priori information represented by the system’s mathematical model. The structure of model-based FDI can be seen in Figure1, where the residual is a fault indicating signal and the decision making is to examine the residual for the likelihood of the faults [1].Figure 1
Conceptual structure of model-based FDI [1].Since the early 1970s, many approaches for model-based FDI have been developed and the available literature is very broad. Survey papers that give a comprehensive overview of the available methods for FDI are [2–7]. During the 1990s the number of applications of model-based FDI especially increased rapidly. Applications to automotive control systems can be found in [8–17]. Research into FDI for ADASs has principally been carried out by California PATH. Various publications treat the application of different FDI approaches and discuss experimental results.In the following, the outline of the widely used model-based FDI strategies is provided. The state observers [3, 18] mainly include dedicated observers (deterministic system) and innovation based approach (stochastic system) for multioutput processes.(1)
Observer, excited by one output: from this output the other outputs can be reconstructed and compared with the corresponding measurements (single sensor fault detection).(2)
Single Kalman filter (KF) driven by all outputs: the change in the stochastic innovation indicating changes on the internal states of the process.(3)
Bank of observers, excited by all outputs: this is suitable if the faults inflict changes on the internal states of the process.(4)
Bank of observers, each excited by a different output (dedicated observer scheme, DOS): it can be used to diagnose a single sensor fault or multiple sensor faults.(5)
Bank of observers, each excited by all outputs except one (generalized observer scheme, GOS): this method improves the robustness of the FDI system but can only diagnose a single sensor fault.The model-based FDI schemes have been successfully applied to the complex vehicle dynamics model and achieved the robustness to the model uncertainties. In [19], the dedicated observer is designed. The yaw rate and the lateral acceleration can be reconstructed and compared with the corresponding measurement from the gyroscope and the accelerometer. The method detects and isolates a single fault in one of these sensors accurately. Authors in [20] use a single KF driven by the full output vector and make use of the fact that the residual is white noise with zero mean when no fault occurs. The occurrence of a fault is monitored by statistical innovation tests of whiteness, mean, and covariance. The application of GOS can be found in [3], where a bank of observers or KFs is applied to construct a GOS. Each observer is driven by all inputs and all but one output to diagnose a sensor fault.Additionally, in the very recent work from [21–23], the EKF is used to calculate the measurement probability distribution of the intelligent vehicle position for nonlinear models driven by Gaussian noise. Using the probability distribution of innovation obtained from EKF, it is possible to test if the measured data are fit with the models. When the sensor faults happen, the models will not be valid and the innovation will not be Gaussian and white.The main contributions of this work are that, unlike previous studies this work will emphasize on the following: in order to ensure the proper functioning of ADASs on an intelligent vehicle, a model-based FDI system is designed to diagnose a single sensor fault with the consideration of the system’s disturbance and noise. The details of the contributions are to(1)
improve residual generation using observer-based method,(2)
increase the robustness of model-based FDI to disturbances and noises,(3)
construct analytical redundancy to provide a reliable estimate for the faulty sensor signal, such that the ADAS performance can still be guaranteed.The overview of the designed FDI system is shown in Figure 2.Figure 2
Schematic overview of the ADAS with FDI system.This paper is organised as follows. Section2 describes the sensor measurements. In Section 3, vehicle state estimation strategy is provided. Section 4 deals with the fault detection and isolation system design. In Section 5, experimental results are shown. The conclusion and future work are discussed in Section 6.


## 2. Sensors Measurements Specification

The test vehicle is a Smart vehicle that is a small 2-door vehicle with an automatic gearbox. The Smart is rear wheel driven and the engine is placed in the middle of the vehicle. In this work, the Smart is equipped with necessary sensors, GPS and INS: accelerometer, odometer, and gyroscope. Interfacing of the sensors of the Smart is done using combination of a controller area network (CAN) and a laptop. Table1 describes the variance, bias, and the drift of each sensor measurement, obtained from the product datasheet or calculated from the raw data.Table 1
Sensor measurements in Smart.
Sensor
Signals
Definition
Noise
Bias
DGPS
LONG
x position
10 m2
—
LAT
y position
10 m2
—
ψ
Heading
0.4 rad2
—
ACC
a
long
x acc
0.02(m/s2)2
-
0.5
a
lat
y acc
0.03(m/s2)2
0.35
GYRO
ψ
˙
Yaw rate
1.2
⋅
1
0
-
6 (rad/s)2
-
4
⋅
1
0
-
4 rad/s
ODO
v
f
/
r
,
l
/
r
Wheel spd
3
⋅
1
0
-
4 (m/s)2
0.05For global position estimation a Trimble LassenSK8 Differential Global Positioning System (DGPS) receiver has been used. In our experiment, the following GPS signals are applied: quality, horizontal dilution precision (HDOP), number of satellites, time, longitudinal/lateral position, heading, and velocity. Based on the product datasheet, we know the DGPS update rate is 1 Hz and the accuracy is ±5 m.Two accelerometers have been used to record the lateral and longitudinal acceleration of the vehicle. The accelerometer signals have an update rate of 50 Hz and are biased. This bias is a low frequency signal in the accelerometer that is always present. The yaw rate measured from the gyroscope has the range of 100 degree/s and its bias is less than 2 degrees/hour. In our experiment, odometers are used to measure the wheel speeds of the vehicle.


## 3. Vehicle State Estimation

For nonlinear systems the general stochastic difference equation for discrete systems is defined by(1)xk=fxk-1,uk-1,wk-1,zk=hxx,vk,
where f is the nonlinear function. In this work, Euler’s numerical integration method with a fixed time step is used for deriving the difference equation. In practice, the values of the noises wk and vk are not known and uk is also set to zero because in the proposed system there is no control input; therefore the state and measurement vectors have to be approximated by
(2)x~k=fx^k-1,0,0,z~k=hx~k,0,
where x~k is the estimate of the state based on the measurement (a posteriori).The variableswk and vk are assumed to be Gaussian with zero mean and are represented by their covariance matrices Q and R. N represents a normal distribution:
(3)pw~N0,Q,pv~N0,R.
Two kinds of estimation errors can be defined, the a priori estimation error ek- and the aposteriori estimation error ek. They are described by
(4)ek-≡xk-x^-,ek=xk-x^k,
where x^- is the a priori state estimate based on knowledge of the process prior to step k and x^ is the a posteriori state based on the measurement zk. The covariances of the estimation errors are defined by
(5)Pk-=Eek-,ek-T,Pk=Eek,ekT,
where pk- is the a priori estimate error covariance and pk is the a posteriori estimate error covariance.The EKF algorithm consists of two stages, time update and measurement update [24]. The different steps in the time update stage are
(6)xk-=fx^k-1,Pk-=AkPk-1AkT+Qk-1,
where Ak is the Jacobian of the system model equations f(·).The different steps in the measurement update stage are(7)Kk=Pk-CkTCkPk-CkT+Rk-1,x^k=x^k-+Kkzk-hx^k-,0,Pk=I-KkCKPk-,
where Kk is the Kalman gain that minimizes the posteriori estimate error covariance Pk and Ck is the Jacobian of the measurement function h(·).Although, the variableswk and vk in (1) are assumed to be Gaussian with zero mean, the assumption Gaussian is not often practically satisfied. Hence, the matrices Q and R cannot be seen as covariance matrices, but as high level tuning parameters, leading to suboptimal solutions. Additionally, the linearization in EKF can lead to poor performance and divergence of the filter for highly nonlinear problems. An improvement to the EKF is some local nonlinear estimators, divided difference filter, unscented Kalman filter (UKF), and so forth. The UKF approximates the probability density resulting from the nonlinear transformation of a random variable instead of approximating the nonlinear functions with a Taylor series expansion. The UKF has a slightly optimal performance compared to the EKF when used in a vehicle navigation state estimation system. However, since the low dynamics of a vehicle make the potential linearization errors of the EKF negligible and the computational time of the UKF is much greater than that of the EKF, the EKF is still chosen in this work to do the vehicle state estimation [25].


### 3.1. Sensor Fusion Strategy

Based on the sensor measurements, as listed in Table1, and a vehicle kinematic model, an EKF can be designed to estimate some important states of the Smart. An overview of the sensor configuration for the Smart is shown in Figure 3. In this configuration, INS measurements are also used to update the vehicle estimated position and heading when DGPS update is not available.Figure 3
Sensor configuration block diagram of the Smart.


### 3.2. Extended Kalman Filters Design for the Smart Car

The motion of a vehicle will be referred to as a navigation frameN which is described by a right handed orthogonal axis system (X,Y,Z) on the Earth. A second reference frame (base frame) B fixed in the vehicle is described by axes (x,y,andz) fixed along the central principal axes of the vehicle. The relation between navigation and base frame can be seen in Figure 4.Figure 4
Navigation and base frames.The sensor measurements will be assigned into different frames. DGPS longitudinal, lateral positions, and heading are in the navigation frame. The acceleration and wheel speed measured from INS are in the base frame. To obtain a trajectory in the navigation frame it is necessary to convert the inertial signals from the base frame to the navigation frame, where we assume that the road is flat and then neglect theZ and z axes. This can be done by the following matrix (a simplified form of the direct cosine matrix):
(8)R=cos⁡(ψ(k))-sin(ψ(k))sin(ψ(k))cos⁡(ψ(k)).


#### 3.2.1. Vehicle Four-Wheel Model

In this section, the EKF based on a kinematic four-wheel vehicle model is designed, which is shown in Figure5. The assumption is that the test track, on which the Smart is driven, is flat.Figure 5
Four-wheel bicycle model: four tyres.In order to reproduce the trajectory followed by the vehicle, kinematic rules for the model have been used to describe the motion of a vehicle. The kinematic vehicle model can be developed as(9)x˙N=vxB·cos⁡ψ-vyB·sinψ,y˙N=vxB·sinψ+vyB·cos⁡ψ,v˙xB=ax,v˙yB=ay,
where xN and yN are longitudinal and lateral positions in the navigation frame and vx/yB indicate the longitudinal and lateral velocities in the base frame. Additionally, for each wheel speed we have
(10)vfl=vxB-0.5×ψ˙W12+vyB+ψ˙L12,(11)vfr=vxB+0.5×ψ˙W12+vyB+ψ˙L12,(12)vrl=vxB-0.5×ψ˙W2,(13)vrr=vxB+0.5×ψ˙W2,wherev(fl/fr/rl/rr) are wheel speeds measured from the front left, front right, rear left, and rear right wheels, ψ˙ is the yaw rate, L1/2 are lengths from front and rear axles to the Smart COG, and W1/2 are the length of front and rear track. Equations (12) and (13) are derived from the condition that rear wheels are not steering wheels and their wheel angles are equal to zero.All model states are described in Table2, where the bias sates are modelled as random walks. By using the random walk model, growth of uncertainty of the true value of the bias and the rate at which it varies can be reflected [26]. Additionally, the measurements of the EKF are identified in Table 3.Table 2
States of the EKF of Smart car.
In navigation frame
In base frame
N
x
2: LONG position
B
a
x
2: LONG acceleration [m/s2]
N
y
2: LAT position
B
a
y
2: LAT acceleration [m/s2]
N
ψ
2: yaw angle
B
v
x
2: LONG SPD in COG [m/s]
N
ψ
˙
2: yaw rate
B
v
y
2: LAT SPD in COG [m/s]
b
a
x
2: bias state for LONG ACC
b
a
y
2: bias state for LAT ACC
b
ψ
˙
2: bias state for GYRO
b
fl: bias state, front left ODO
b
fr: bias state, front right ODO
b
r
2: bias state for rear ODOTable 3
Measurement used by the EKF of Smart car.
In the navigation frame
In the base frame
N
y
x
2: DGPS LONG
B
y
a
x
2: LONG ACC
N
y
y
2: DGPS LAT
B
y
a
y
2: LAT ACC
N
y
ψ
2: DGPS heading
B
y
fl
2: front left wheel SPD
N
y
ψ
˙
2: GYRO yaw rate
B
y
fr
2: front right wheel SPD
B
y
w
r
2: rear wheels mean SPDBy using Euler’s method with time stepT, the discrete time state equations can be written as
(14)x2Nk=x2N(k-1)+T·vx2B(k-1)·cos⁡⁡(ψ2N(k-1))-T·vy2B(k-1)·sin⁡(ψ2N(k-1))+wx2(k)N,y2Nk=y2Nk-1+T·vx2Bk-1·sin⁡ψ2Nk-1+T·vy2B(k-1)·cos⁡⁡(ψ2N(k-1))+wy2N(k),vx2Bk=vx2Bk-1+T·ax2Bk-1+wvx2B(k),vy2Bk=vy2Bk-1+T·ay2Bk-1+wvy2B(k),ax2Bk=ax2Bk-1+wax2B(k),ay2Bk=ay2Bk-1+way2B(k),ψ2Nk=ψ2Nk-1+T·ψ˙2Nk-1+wψ2N(k),ψ˙2Nk=ψ˙2Nk-1+wψ˙2N(k),bflk=bflk-1+wbfl,bfrk=bfrk-1+wbfr,br2k=br2k-1+wbr2,bax2k=bax2k-1+wbax2,bay2k=bay2k-1+wbay2,bψ˙2k=bψ˙2k-1+wbψ˙2.
Additionally, the measurement equations can be specified as follows:
(15)yx2Nk=x2Nk-N+vyx2N(k),(16)yy2Nk=y2Nk-N+vyy2N(k),(17)yψ2Nk=ψ2Nk-N+vyψ2N(k),(18)yax2Bk=ax2Bk+bax2k+vyax2B(k),(19)yay2Bk=ay2Bk+bby2k+vyay2B(k),(20)yψ˙2Nk=ψ˙2Nk+bψ˙2k+vyψ˙2N(k),(21)yfl2B(k)=vx2Bk-0.5W1ψ˙2Nk2+vy2Bk+L1·ψ˙2Nk2+bfl(k)+vByfl2(k),(22)yfr2B(k)=vx2Bk+0.5W1ψ˙2Nk2+vy2Bk+L1·ψ˙2Nk2+bfr(k)+vyfr2B(k),(23)ywr2Bk=vx2Bk+br2k+vywr2B(k).


#### 3.2.2. System Observability

A dynamic system is said to be observable if it is possible to uniquely reconstruct the state information based on the model of a system given the inputs and outputs of the system. The nonlinear model for the Smart car is(24)x˙=Fx,zi=hix,i∈1,…,p,
where h = col(h1,…,hp): Rn→Rp.Although this model is nonlinear, it is linearized each time for the EKF. The observability matrix,O, is calculated for each linearization in the run of the EKF. If O has full rank at each run, then the linearized model is locally observable. In this project, the observability matrix is accumulated over the entire time step from the initial to the final as a global check [27]. Since, a state space discrete time model is used in this work, the transient event is not studied and then is neglected from the observability check.The model is locally observable when the vehicle is driving; when the vehicle is standing still and yaw rate measurement is equal to zero, the estimated longitudinal/lateral COG velocitiesvx2B/vy2B and bias states for front/rear odometers bfl, bfr, and br2 become unobservable. This is because when the vehicle is standing still no speed information is received from wheel encoders, so nothing can be said about the error in the speed calculation.


## 3.1. Sensor Fusion Strategy

Based on the sensor measurements, as listed in Table1, and a vehicle kinematic model, an EKF can be designed to estimate some important states of the Smart. An overview of the sensor configuration for the Smart is shown in Figure 3. In this configuration, INS measurements are also used to update the vehicle estimated position and heading when DGPS update is not available.Figure 3
Sensor configuration block diagram of the Smart.


## 3.2. Extended Kalman Filters Design for the Smart Car

The motion of a vehicle will be referred to as a navigation frameN which is described by a right handed orthogonal axis system (X,Y,Z) on the Earth. A second reference frame (base frame) B fixed in the vehicle is described by axes (x,y,andz) fixed along the central principal axes of the vehicle. The relation between navigation and base frame can be seen in Figure 4.Figure 4
Navigation and base frames.The sensor measurements will be assigned into different frames. DGPS longitudinal, lateral positions, and heading are in the navigation frame. The acceleration and wheel speed measured from INS are in the base frame. To obtain a trajectory in the navigation frame it is necessary to convert the inertial signals from the base frame to the navigation frame, where we assume that the road is flat and then neglect theZ and z axes. This can be done by the following matrix (a simplified form of the direct cosine matrix):
(8)R=cos⁡(ψ(k))-sin(ψ(k))sin(ψ(k))cos⁡(ψ(k)).


### 3.2.1. Vehicle Four-Wheel Model

In this section, the EKF based on a kinematic four-wheel vehicle model is designed, which is shown in Figure5. The assumption is that the test track, on which the Smart is driven, is flat.Figure 5
Four-wheel bicycle model: four tyres.In order to reproduce the trajectory followed by the vehicle, kinematic rules for the model have been used to describe the motion of a vehicle. The kinematic vehicle model can be developed as(9)x˙N=vxB·cos⁡ψ-vyB·sinψ,y˙N=vxB·sinψ+vyB·cos⁡ψ,v˙xB=ax,v˙yB=ay,
where xN and yN are longitudinal and lateral positions in the navigation frame and vx/yB indicate the longitudinal and lateral velocities in the base frame. Additionally, for each wheel speed we have
(10)vfl=vxB-0.5×ψ˙W12+vyB+ψ˙L12,(11)vfr=vxB+0.5×ψ˙W12+vyB+ψ˙L12,(12)vrl=vxB-0.5×ψ˙W2,(13)vrr=vxB+0.5×ψ˙W2,wherev(fl/fr/rl/rr) are wheel speeds measured from the front left, front right, rear left, and rear right wheels, ψ˙ is the yaw rate, L1/2 are lengths from front and rear axles to the Smart COG, and W1/2 are the length of front and rear track. Equations (12) and (13) are derived from the condition that rear wheels are not steering wheels and their wheel angles are equal to zero.All model states are described in Table2, where the bias sates are modelled as random walks. By using the random walk model, growth of uncertainty of the true value of the bias and the rate at which it varies can be reflected [26]. Additionally, the measurements of the EKF are identified in Table 3.Table 2
States of the EKF of Smart car.
In navigation frame
In base frame
N
x
2: LONG position
B
a
x
2: LONG acceleration [m/s2]
N
y
2: LAT position
B
a
y
2: LAT acceleration [m/s2]
N
ψ
2: yaw angle
B
v
x
2: LONG SPD in COG [m/s]
N
ψ
˙
2: yaw rate
B
v
y
2: LAT SPD in COG [m/s]
b
a
x
2: bias state for LONG ACC
b
a
y
2: bias state for LAT ACC
b
ψ
˙
2: bias state for GYRO
b
fl: bias state, front left ODO
b
fr: bias state, front right ODO
b
r
2: bias state for rear ODOTable 3
Measurement used by the EKF of Smart car.
In the navigation frame
In the base frame
N
y
x
2: DGPS LONG
B
y
a
x
2: LONG ACC
N
y
y
2: DGPS LAT
B
y
a
y
2: LAT ACC
N
y
ψ
2: DGPS heading
B
y
fl
2: front left wheel SPD
N
y
ψ
˙
2: GYRO yaw rate
B
y
fr
2: front right wheel SPD
B
y
w
r
2: rear wheels mean SPDBy using Euler’s method with time stepT, the discrete time state equations can be written as
(14)x2Nk=x2N(k-1)+T·vx2B(k-1)·cos⁡⁡(ψ2N(k-1))-T·vy2B(k-1)·sin⁡(ψ2N(k-1))+wx2(k)N,y2Nk=y2Nk-1+T·vx2Bk-1·sin⁡ψ2Nk-1+T·vy2B(k-1)·cos⁡⁡(ψ2N(k-1))+wy2N(k),vx2Bk=vx2Bk-1+T·ax2Bk-1+wvx2B(k),vy2Bk=vy2Bk-1+T·ay2Bk-1+wvy2B(k),ax2Bk=ax2Bk-1+wax2B(k),ay2Bk=ay2Bk-1+way2B(k),ψ2Nk=ψ2Nk-1+T·ψ˙2Nk-1+wψ2N(k),ψ˙2Nk=ψ˙2Nk-1+wψ˙2N(k),bflk=bflk-1+wbfl,bfrk=bfrk-1+wbfr,br2k=br2k-1+wbr2,bax2k=bax2k-1+wbax2,bay2k=bay2k-1+wbay2,bψ˙2k=bψ˙2k-1+wbψ˙2.
Additionally, the measurement equations can be specified as follows:
(15)yx2Nk=x2Nk-N+vyx2N(k),(16)yy2Nk=y2Nk-N+vyy2N(k),(17)yψ2Nk=ψ2Nk-N+vyψ2N(k),(18)yax2Bk=ax2Bk+bax2k+vyax2B(k),(19)yay2Bk=ay2Bk+bby2k+vyay2B(k),(20)yψ˙2Nk=ψ˙2Nk+bψ˙2k+vyψ˙2N(k),(21)yfl2B(k)=vx2Bk-0.5W1ψ˙2Nk2+vy2Bk+L1·ψ˙2Nk2+bfl(k)+vByfl2(k),(22)yfr2B(k)=vx2Bk+0.5W1ψ˙2Nk2+vy2Bk+L1·ψ˙2Nk2+bfr(k)+vyfr2B(k),(23)ywr2Bk=vx2Bk+br2k+vywr2B(k).


### 3.2.2. System Observability

A dynamic system is said to be observable if it is possible to uniquely reconstruct the state information based on the model of a system given the inputs and outputs of the system. The nonlinear model for the Smart car is(24)x˙=Fx,zi=hix,i∈1,…,p,
where h = col(h1,…,hp): Rn→Rp.Although this model is nonlinear, it is linearized each time for the EKF. The observability matrix,O, is calculated for each linearization in the run of the EKF. If O has full rank at each run, then the linearized model is locally observable. In this project, the observability matrix is accumulated over the entire time step from the initial to the final as a global check [27]. Since, a state space discrete time model is used in this work, the transient event is not studied and then is neglected from the observability check.The model is locally observable when the vehicle is driving; when the vehicle is standing still and yaw rate measurement is equal to zero, the estimated longitudinal/lateral COG velocitiesvx2B/vy2B and bias states for front/rear odometers bfl, bfr, and br2 become unobservable. This is because when the vehicle is standing still no speed information is received from wheel encoders, so nothing can be said about the error in the speed calculation.


## 3.2.1. Vehicle Four-Wheel Model

In this section, the EKF based on a kinematic four-wheel vehicle model is designed, which is shown in Figure5. The assumption is that the test track, on which the Smart is driven, is flat.Figure 5
Four-wheel bicycle model: four tyres.In order to reproduce the trajectory followed by the vehicle, kinematic rules for the model have been used to describe the motion of a vehicle. The kinematic vehicle model can be developed as(9)x˙N=vxB·cos⁡ψ-vyB·sinψ,y˙N=vxB·sinψ+vyB·cos⁡ψ,v˙xB=ax,v˙yB=ay,
where xN and yN are longitudinal and lateral positions in the navigation frame and vx/yB indicate the longitudinal and lateral velocities in the base frame. Additionally, for each wheel speed we have
(10)vfl=vxB-0.5×ψ˙W12+vyB+ψ˙L12,(11)vfr=vxB+0.5×ψ˙W12+vyB+ψ˙L12,(12)vrl=vxB-0.5×ψ˙W2,(13)vrr=vxB+0.5×ψ˙W2,wherev(fl/fr/rl/rr) are wheel speeds measured from the front left, front right, rear left, and rear right wheels, ψ˙ is the yaw rate, L1/2 are lengths from front and rear axles to the Smart COG, and W1/2 are the length of front and rear track. Equations (12) and (13) are derived from the condition that rear wheels are not steering wheels and their wheel angles are equal to zero.All model states are described in Table2, where the bias sates are modelled as random walks. By using the random walk model, growth of uncertainty of the true value of the bias and the rate at which it varies can be reflected [26]. Additionally, the measurements of the EKF are identified in Table 3.Table 2
States of the EKF of Smart car.
In navigation frame
In base frame
N
x
2: LONG position
B
a
x
2: LONG acceleration [m/s2]
N
y
2: LAT position
B
a
y
2: LAT acceleration [m/s2]
N
ψ
2: yaw angle
B
v
x
2: LONG SPD in COG [m/s]
N
ψ
˙
2: yaw rate
B
v
y
2: LAT SPD in COG [m/s]
b
a
x
2: bias state for LONG ACC
b
a
y
2: bias state for LAT ACC
b
ψ
˙
2: bias state for GYRO
b
fl: bias state, front left ODO
b
fr: bias state, front right ODO
b
r
2: bias state for rear ODOTable 3
Measurement used by the EKF of Smart car.
In the navigation frame
In the base frame
N
y
x
2: DGPS LONG
B
y
a
x
2: LONG ACC
N
y
y
2: DGPS LAT
B
y
a
y
2: LAT ACC
N
y
ψ
2: DGPS heading
B
y
fl
2: front left wheel SPD
N
y
ψ
˙
2: GYRO yaw rate
B
y
fr
2: front right wheel SPD
B
y
w
r
2: rear wheels mean SPDBy using Euler’s method with time stepT, the discrete time state equations can be written as
(14)x2Nk=x2N(k-1)+T·vx2B(k-1)·cos⁡⁡(ψ2N(k-1))-T·vy2B(k-1)·sin⁡(ψ2N(k-1))+wx2(k)N,y2Nk=y2Nk-1+T·vx2Bk-1·sin⁡ψ2Nk-1+T·vy2B(k-1)·cos⁡⁡(ψ2N(k-1))+wy2N(k),vx2Bk=vx2Bk-1+T·ax2Bk-1+wvx2B(k),vy2Bk=vy2Bk-1+T·ay2Bk-1+wvy2B(k),ax2Bk=ax2Bk-1+wax2B(k),ay2Bk=ay2Bk-1+way2B(k),ψ2Nk=ψ2Nk-1+T·ψ˙2Nk-1+wψ2N(k),ψ˙2Nk=ψ˙2Nk-1+wψ˙2N(k),bflk=bflk-1+wbfl,bfrk=bfrk-1+wbfr,br2k=br2k-1+wbr2,bax2k=bax2k-1+wbax2,bay2k=bay2k-1+wbay2,bψ˙2k=bψ˙2k-1+wbψ˙2.
Additionally, the measurement equations can be specified as follows:
(15)yx2Nk=x2Nk-N+vyx2N(k),(16)yy2Nk=y2Nk-N+vyy2N(k),(17)yψ2Nk=ψ2Nk-N+vyψ2N(k),(18)yax2Bk=ax2Bk+bax2k+vyax2B(k),(19)yay2Bk=ay2Bk+bby2k+vyay2B(k),(20)yψ˙2Nk=ψ˙2Nk+bψ˙2k+vyψ˙2N(k),(21)yfl2B(k)=vx2Bk-0.5W1ψ˙2Nk2+vy2Bk+L1·ψ˙2Nk2+bfl(k)+vByfl2(k),(22)yfr2B(k)=vx2Bk+0.5W1ψ˙2Nk2+vy2Bk+L1·ψ˙2Nk2+bfr(k)+vyfr2B(k),(23)ywr2Bk=vx2Bk+br2k+vywr2B(k).


## 3.2.2. System Observability

A dynamic system is said to be observable if it is possible to uniquely reconstruct the state information based on the model of a system given the inputs and outputs of the system. The nonlinear model for the Smart car is(24)x˙=Fx,zi=hix,i∈1,…,p,
where h = col(h1,…,hp): Rn→Rp.Although this model is nonlinear, it is linearized each time for the EKF. The observability matrix,O, is calculated for each linearization in the run of the EKF. If O has full rank at each run, then the linearized model is locally observable. In this project, the observability matrix is accumulated over the entire time step from the initial to the final as a global check [27]. Since, a state space discrete time model is used in this work, the transient event is not studied and then is neglected from the observability check.The model is locally observable when the vehicle is driving; when the vehicle is standing still and yaw rate measurement is equal to zero, the estimated longitudinal/lateral COG velocitiesvx2B/vy2B and bias states for front/rear odometers bfl, bfr, and br2 become unobservable. This is because when the vehicle is standing still no speed information is received from wheel encoders, so nothing can be said about the error in the speed calculation.


## 4. Fault Detection and Isolation System Design

The generalized observer scheme (GOS) provides that an estimator dedicated to a certain sensor is driven by all outputs except that of the respective sensor. This scheme allows one to detect and isolate only a single fault in any of the sensors, however, with increased robustness with respect to unknown inputs.A GOS is suitable for detecting a single fault at a time in one of thep sensors of the system. The ith observer (i=1,2,…,p) is driven by all but the ith measured variable (i.e., z1,…,zi-1,zi+1,…,zp). Consequently, each residual from the ith observer will be sensitive to all but the ith sensor fault. zi is not used in the ith observer because zi is assumed to be corrupted by the fault and therefore does not carry usable information about the system [3].The nonlinear system equations included sensor faults and unknown disturbances are(25)x˙=F(x,d),x(0)=0,(26)zi=hix,d,fi,i∈1,…,p,
where h = col(h1,…,hp): Rn→Rp. x is the n-dimensional state vector. z is the p-dimensional vector of measurements. Moreover, the model is subject to the fault signal f as well as to the unknown disturbance signal d. The fault magnitude of f is an arbitrary scalar function of time that is zero when there is no fault.A GOS can be designed for the sensor FDI, where there arep EKFs, each using all but the ith sensor measurement. For each EKF, its residual ri can be generated from the measurement update stage as
(27)rik=zk-hx^k-,0,i=1,2,…,p.
Because each EKF is excited by all but one sensor output, when a sensor fault occurs in the ith sensor, the residual will satisfy the following isolation logic:
(28)ri(k)<Ti,rj(k)≥Tj,j=1,2,…,i-1,i+1,…,p,
where Ti (i=1,…,p) are isolation thresholds [28]. Such a GOS scheme is shown in Figure 6.Figure 6
Generalized observer scheme (GOS).A GOS bank of EKFs is robust to system modeling error and unknown disturbances in a realistic environment. This is because in a GOS only if allj residuals in (28) have to misfire, a bad fault decision can be made.Here, an example is given to illustrate how a GOS can accurately diagnose a single sensor fault in the system, as shown in Figure6. In Table 4, each row represents a fault, where a number of 1 in position ith row and jth column implies that fault fi affects residual rj. As stated before, each residual generated from GOS is sensitive to all but one sensor fault and, therefore, for the occurrence of each fault, there exists a unique combination of the residual response, which is so called generalized residual set, as can be noticed in each row in Table 4. By such a residual table, any single sensor fault fi, if it happens, can be uniquely detected and isolated.Table 4
Example of generalized residual set.
I
r
1
r
2
r
3
f
1
1
1
0
f
2
1
0
1
f
3
0
1
1


### 4.1. General Outline of the FDI System

The basic scheme of the FDI system is specified in Figure7, where fault detection system is to identify a fault that occurred and fault isolation system can determine the location of the fault. The extra fault management system is used to recognize and handle the fault, which contains a state selection system.Figure 7
Basic scheme of the FDI system.


### 4.2. EKFs in the GOS

There are eight sensors installed in Smart car, which are DGPS, longitudinal/lateral accelerometers, gyroscope, and a wheel speed sensor on each vehicle wheel. In order to detect a single fault in these sensors, a GOS bank of EKFs is developed, where there are eight EKFs. In case a sensor fault happens, the output from residual evaluation block (the diagnosis information) will indicate which fault happens and subsequently select the state estimated from the EKF, using all but the faulty sensor measurement, as the fault-free output, which is shown in Figure8. It can be seen in the figure that residuals and states generated from each EKF are inputted to the residual evaluation and fault management system, respectively. Hereafter, each EKF (in GOS) for vehicle state estimation will be evaluated, where EKF 0 uses all sensor measurements (nominal EKF).Figure 8
Scheme of the sensors FDI system for the Smart.EKF 1: Driven by All Measurements but DGPS. This one uses all but DGPS data. In case DGPS fault happens, the estimated states from this EKF will be applied.EKF 2: Driven by All Measurements but Longitudinal Accelerometer. All but longitudinal acceleration measurement are used by EKF 2. When longitudinal accelerometer is faulty, EKF 2 will be applied to state estimation. It can be seen in Figure 9 that the estimated longitudinal acceleration is reliable as an analytical redundancy to replace the faulty accelerometer measurement.Figure 9
Raw versus EKF estimated accelerations for EKF 2.EKF 3: Driven by All Measurements but Lateral Accelerometer. EKF 3 is driven by all but lateral acceleration signal. At the moment a lateral accelerometer fault occurs, states estimated from EKF 3 will be applied.EKF 4: Driven by All Measurements but Gyroscope. This EKF uses all but gyroscope measurement. In case gyroscope is faulty, EKF 4 will be used for vehicle state estimation.EKF 5/6/7/8: Driven by All Measurements but Each Wheel Speed Sensor. EKF 5 is driven by all but front left wheel speed signal. When this sensor fault happens, the estimated states from EKF 5 are still fault-free. EKFs 6 to 8 use all but other three wheel speed signals, respectively, and can achieve almost the same estimates results as EKF 5. Therefore, the detailed descriptions of these three EKFs are omitted. In case any one of these wheel speed sensors is faulty, the corresponding EKF will be applied to the state estimation.


### 4.3. Sensor Fault Detection and Detectability

In the GOS, ideally there is a residual generated from each EKF, which is sensitive to all but one sensor fault. To this end, we need to check in each EKF if those sensor faults are detectable with respect to the generated residual. It requires that transfer functions from these sensor faults to the residual are nonzero.


#### 4.3.1. Sensor Faults Description

The FDI system for the Smart is designed to diagnose eight sensor faults, which are listed in Table5. The modeling of sensor fault fi can be seen in (26), where zi corresponds to each sensor measurement.Table 5
Sensor faults.
Faultfi
Description
f
1
DGPS fault (in position and heading signals)
f
2
Longitudinal accelerometer fault
f
3
Lateral accelerometer fault
f
4
Gyroscope fault
f
5
Front left wheel speed sensor fault
f
6
Front right wheel speed sensor fault
f
7
Rear left wheel speed sensor fault
f
8
Rear right wheel speed sensor fault


#### 4.3.2. Residual Generation

This section discusses several possibilities for residual generation from each EKF. After comparison, the most promising one is selected. At the beginning, a residual notation is made and will be applied throughout this work. Residualrmn, is the nth residual generated from mth EKF in the GOS. Because there are eight EKFs in the GOS, we have m∈{1,…,8}. Meanwhile, as seven measurement equations are applied in the EKF 0, seven residuals might be generated from the GOS. To make a clear notation, the order of these seven residuals is fixed as n∈{1,…,7}∈{residual generated from the measurement update: DGPS, x-acceleration, y-acceleration, yaw rate, front left wheel speed, front right wheel speed, and mean rear wheel speed}.DGPS signals can be blocked by buildings, trees, bridges, and so forth. In this work, the DGPS outage is simply detected by the following logic.(1)
The number of satellites dropped below 4.(2)
The value of HDOP is larger than 10, when the positional measurements should be used only to indicate a very rough estimate of the current location.For INS FDI system design, residual generation in EKF 1 is taken as an example. As using only no DGPS measurements, this EKF can generate residuals from all INS measurement updates. The generated residuals,r12 to r17, are listed in Table 6, where ψ˙2N is yaw rate, vx/y2B are the estimated COG velocity, W1 is the length of the Smart track, and L1 is the length from the Smart COG to the front axle. It should be advised that although EKF 1 is driven by all seven INS measurements, only six residuals can be generated. The reason is that the mean rear wheel speed, instead of two separate speeds, is used in the measurement update of the EKF 1, which can be seen in (23).Table 6
Residual generation from EKF 1 measurement update.
Generation
Math formula
ACCx
r
12
=
B
y
a
x
2
-
B
a
x
2
ACCy
r
13
=
B
y
a
y
2
-
B
a
y
2
Gyroscope
r
14
=
N
y
ψ
˙
2
-
N
ψ
˙
2
Font left ODO
r
15
=
B
y
fl
2
-
(
B
v
x
2
-
0.5
W
1
N
ψ
˙
2
)
2
+
(
B
v
y
2
+
L
1
⋅
N
ψ
˙
2
)
2
Font right ODO
r
16
=
B
y
fr
2
-
(
B
v
x
2
+
0.5
W
1
N
ψ
˙
2
)
2
+
(
B
v
y
2
+
L
1
⋅
N
ψ
˙
2
)
2
Rear wheels
r
17
=
B
y
w
r
2
-
B
v
x
2Therefore, in each EKF of the GOS, there is a generated residual vectorr(k), which contains all those six residuals but one. In order to construct a GOS, a vector residual or a scalar residual, which is affected by all sensor faults but one, needs to be generated from each EKF.Scalar residuals are considered in this work. With respect to INS FDI, a scalar residual should be selected amongr12 to r17, which is affected by as many sensor faults as possible. Noticed in Table 6, there are more states involved for the generation of residuals r15 and r16. Thus, either r15 or r16 may be applied to the sensors FDI system design. In the following, the detectability of each INS fault with respect to the residual r15 will be checked.


#### 4.3.3. Theory for Checking the Fault Detectability

When faults occur in the monitored process, the response of the residual vector is(29)r(k)=Gr(k)f(k)=∑i=1g‍Grkifik,
where Gr(k) is defined as a fault transfer matrix which represents the relation between the residual and faults, [Gr(k)]i is the ith column of Gr(k), and fi(k) is the ith component of fk. If [Gr(k)]i≠0, the fi is detectable in the residual r. This is defined as the fault detectability condition of the residual r to fi [28].The vehicle model applied in this project is nonlinear and linearized at each time step for EKF. Euler’s numerical integration method with a fixed time step is used for deriving the linearized equation. Therefore, we propose to check the sensor fault local detectability at each time step for a linearized discrete time model. The model is shown as follows:(30)xk+1=Axk+wk,yk=Cxk+vk.
With this system, a discrete time Kalman filter measurement update equation can be written as
(31)x^k+1=Axk+Kyk-Cx^k,(32)qx^k=Axk+Kyk-Cx^k,
where K is Kalman gain and q is a shift operator in discrete time model. From (31) the transfer function from the state vector to the measurement vector can be represented as
(33)x^(k)y(k)=qI-A+KC-1K.
Consequently, under normal conditions,
(34)x^nk=qI-A+KC-1Kynk,
where the subscript n means the normal condition and the subscript f in the following denotes a fault condition. Now, if a measurement is disturbed by a fault vector f(k),
(35)yf(k)=yn(k)+f(k)
Then, from (34), the state estimation becomes
(36)x^fk=qI-A+KC-1Kynk+fk.
The normal filter residual can be defined as
(37)vn(k)=yn(k)-Cx^n(k)
and the residual under fault conditions is
(38)vfk=yf(k)-Cx^f(k)=[yn(k)+f(k)]-CqI-A+KC-1Kynk+fk=ynk-Cx^nk+[f(k)-CqI-A+KC-1Kf(k)]=vn+I-CqI-A+KC-1Kfk.
Clearly, a sensor fault is detectable with respect to residual sequence when the term Dq=[I-CqI-A+KC-1K] is nonzero [28, 29].


#### 4.3.4. Check the Fault Detectability in GOS

Since the used model is nonlinear, but it is linearized each time for the EKF, the detectability matrix is calculated for each linearization in some runs of the EKF. IfDq is nonzero at each run, then the fault is locally detectable.In the following test, a linear vehicle model is derived at an operating point, where the vehicle is driven straight with the heading of 0.02 radian. The linearization is done at 10 meters per second. The detectability of all INS faults with respect to each generated residual needs to be considered. Here, the evaluation of the INS faults detectability to EKF 1’s residuals is taken as example. The fault detectability in this operating point is checked numerically and will be proved by a practice way under other operating conditions. Similarly, such a checking method can be applied to other EKFs. After linearization, the state space matrix in EKF 1 is calculated as(39)A=100.02-4e-400-0.010000000013e-30.02000.16700000000010100000000000010100000000000010000000000000010000000000000010.0200000000000001000000000000001000000000000001000000000000001000000000000001000000000000001000000000000001,C=0000000000000000000000000000000000000000000000100010000000000100010000000000010010000010.01000-0.60001000010.010000.6500001000100000000001.The transfer matrix from faults to residuals can be represented asr=Dq*fi, where Dq=[I-C[qI-A+KC]-1K] and r/fi can be referred to as in Tables 5 and 6. Following with the descriptions of both residuals and faults, we know that Dq is a transfer matrix with seven rows and seven columns. Seven transfer functions in a certain row represent the relation between each sensor fault and a certain residual. In the following, the fault detectability from each sensor fault to the residual r15 will be checked by calculating the corresponding transfer functions.Fault Detectability with respect to Residual
r
15. Each transfer function in the fifth row of the matrix Dq can be calculated. Functions g5,2 to g5,7 are used to represent all transfer functions on the 5th row of matrix Dq, which are described in Table 7. In the following, the Bode diagram of each function is plotted, which can be applied to analyze the detectability of each sensor fault to the residual r15 (to show the frequency response of the residual to each sensor fault).Table 7
Fault transfer functions in EKF 1.
g
5
,
j
Transfer function description
g
5,2
From longitudinal accelerometer fault tor15
g
5,3
From lateral accelerometer fault tor15
g
5,4
From gyroscope fault tor15
g
5,5
From front left wheel speed sensor fault tor15
g
5,6
From front right wheel speed sensor fault tor15
g
5,7
From rear left/right wheel speed sensor fault tor15The Bode diagram ofg5,2, the transfer function from longitudinal accelerometer fault to r15, is shown in Figure 10(a), where only the high frequency band is taken into account. Because sensor faults are assumed transient, they are always high frequency signals. At this frequency, the gain margin is around −20 db and thus ten percent of the fault magnitude can be transmitted to r15. This fault is detectable in case of applying a small threshold. The Bode diagram of g5,3 can be seen in Figure 10(b). At high frequency, the gain margin is around −70 db and therefore this fault is almost undetectable in r15. The Bode diagram of g5,4, the transfer function from gyroscope fault to r15, is plotted in Figure 10(c). At high frequency, the gain margin is larger than 0 db and therefore one-hundred percent of fault magnitude can be transmitted to the residual. Thus, this fault is detectable in r15. The transfer function g5,5 should be equal to one. Additionally, looking at the Bode diagrams of g5,6 and g5,7, the front right and rear wheel speed sensor faults are all detectable with respect to r15.(a) Bode diagram ofg5,2: from longitudinal accelerometer fault to r15; (b) bode diagram of g5,3: from lateral accelerometer fault to r15; (c) bode diagram of g5,4: from gyroscope fault to r15.
(a)
(b)
(c)Sensor Fault Detectability under Other Operating Situations. Since the used model is linearized each time for the EKF 1, the detectability matrix is calculated for each linearization in some runs of the EKF 1 for the local check. Furthermore, we show the performance of this residual in response to the occurrence of each sensor fault, that is, a constant additive fault. Therefore, six separate off-line tests are performed with a different sensor fault injected at each time. The description of these faults can be seen in Table 8, where the fault sizes are chosen empirically followed by the real sensor fault size. The tests for other GOS EKFs can be conducted similarly.Table 8
Residual generation in separate tests for fault detectability check.
Tests
Fault location
Injection (s)
Fault size
Test 1
Long. accelerometer
165 s
3 m/s2
Test 2
Yaw rate
165 s
0.5 rad/s
Test 3
Front left wheel speed
153 s
5 m/s
Test 4
Front right wheel speed
163 s
5 m/sIt can be seen in Figures11, 12, and 13 that upon the occurrence of all sensor faults, at any operating point the residual r15 has the obvious and constant change. Moreover, the magnitude of r15 under the nominal condition is around ±0.1 m, which can be seen in the bottom of Figure 11. In case a single sensor fault with a reasonable size as specified in Table 8 happens, the change of r15 is far larger than the nominal residual magnitude. Thus, by selecting a fixed threshold, this change can be detected.Figure 11
Test 1:x-accelerometer fault and the response of r15.Figure 12
Test 2: gyroscope fault and the response ofr15.(a) Test 3: front left wheel speed sensor fault and the response ofr15; (b) test 4: front right wheel speed sensor fault and the response of r15.
(a)
(b)


#### 4.3.5. GOS Residuals Generation

For all INS, it is considered at the first step to generate a residual to detect all but lateral accelerometer sensor fault. The detection of lateral accelerometer fault can de achieved by a simple strategy, that is, checking the difference between the raw and estimated acceleration only generated from the EKF 3, which is driven by all but lateral accelerometer measurement. Hereby, all residuals generated for the FDI system design are classified and listed in Table9. The formula representations of these residual generations can be seen in Table 6.Table 9
Residual generation in each EKF.
EKF
r
Generated from
EKF1 (no GPS)
r
15
Front left ODO Meas update
EKF2 (noax)
r
25
Front left ODO Meas update
EKF3 (noay)
r
33
Raw and estimatedy-acceleration
r
35
Front left ODO Meas update
EKF4 (noψ˙)
r
45
Front left ODO Meas update
EKF5 (novfl)
r
56
Front right ODO Meas update
EKF6 (novfr)
r
65
Front left ODO Meas update
EKF7 (novrl)
r
75
Front left ODO Meas update
EKF8 (novrr)
r
85
Front left ODO Meas updateFrom EKF 3, lateral acceleration can be estimated. We compare this estimated state with raw lateral accelerometer measurement, the difference of which is generated as a residual,r33. During the test, if there is a big change in this residual but all other INS residuals are nominal, then a lateral accelerometer fault can be detected.


### 4.4. Sensor Fault Isolation

Residuals generated from each EKF are evaluated in this section and the diagnosis information which indicates the location of the faulty sensor can be made. Residual evaluation can in its simplest form be a thresholding test on the residual, such as a test if residual is larger than a threshold. Due to model uncertainties and measurement noise, residual will not be 0 in the fault-free case. Therefore a nonzero threshold has to be selected. Residual evaluation in its complex form can be distinguished as various tests of mean, variance, or theχ2 test [30].As stated in Section4.3.4, when single sensor faults with reasonable sizes happen, there are considerable changes of residual r15, which largely exceed the nominal residual magnitude, ±0.1 m. Therefore, it is reasonable to select the nonzero threshold in this work for residual evaluation. For the change detection, a binary number is used to indicate the change of a residual. After evaluating, if the residual is larger than a fixed threshold, the value of its change detection is set to 1; otherwise it is 0.Based on the functioning of the designed GOS, while a single sensor fault happens, all selected EKF residuals but one will fire. Such pattern of the residual response constructs a generalized residual set, which can identify the location of a sensor fault. Therefore, a look-up table for INS faults isolation is designed and provided as in Table10, where f2/4/5/6/7/8 stand for longitudinal accelerometer, gyroscope, and four wheel speed sensors faults. Moreover, because both residuals r15 and r35, generated from EKF 1 and 3, are sensitive to all faults of f2/4/5/6/7/8, they are omitted from decision logic during the off-line test, and a simplified isolation table is presented as in Table 11. Decision logic for lateral accelerometer fault detection is implemented in the second row of Table 11.Table 10
INS fault isolation table.
Faults
r
15
r
25
r
33
r
35
r
45
r
56
r
65
r
75
r
85
f
2
1
0
0
1
1
1
1
1
1
f
3
0
0
1
0
0
0
0
0
0
f
4
1
1
0
1
0
1
1
1
1
f
5
1
1
0
1
1
0
1
1
1
f
6
1
1
0
1
1
1
0
1
1
f
7
1
1
0
1
1
1
1
0
1
f
8
1
1
0
1
1
1
1
1
0Table 11
Simplified INS fault isolation table.
Faults/residuals
r
25
r
33
r
45
r
56
r
65
r
75
r
85
f
2
0
—
1
1
1
1
1
f
3
0
1
0
0
0
0
0
f
4
1
—
0
1
1
1
1
f
5
1
—
1
0
1
1
1
f
6
1
—
1
1
0
1
1
f
7
1
—
1
1
1
0
1
f
8
1
—
1
1
1
1
0


### 4.5. Sensor Fault Management System

An extra fault management system is integrated into the designed FDI system for recognizing and handling the diagnosed fault.The basic scheme of this fault management system is shown in Figure14, where the state selection is explained. In the designed FDI system, there are nine EKFs, which can be seen in Figure 8. Nominal EKF (EKF 0) uses all sensor measurements for the vehicle state estimation. Others, from EKF 1 to EKF 8, are driven by all but one different sensor signal, from which estimated states as well as residuals are generated. From these nine EKFs, nine estimated state vectors are obtained,  x~0=[x~01,…,x~08], x~1=x~11,…,x~18,…,x~8=[x~81,…,x~88]. Clearly, there are eight states estimated from each EKF, that is, vehicle x/y-position, x/y velocity, x-/y-acceleration, heading, and yaw rate. x~01 is the first state, x-position, estimated from the EKF 0.Figure 14
Basic scheme of the fault management system.Corresponding to these eight states, there are eight state selection blocks in the fault management system, each usingqth state, q∈{1,…,8}, estimated from each EKF. The diagnosis information Dd, generated from fault isolation block, is a variable, ranging from 0 to 8. A number of 0 means all sensors are fault-free and an integer among 1 to 8 indicates a corresponding sensor fault f1 to f8, listed in Table 5, occurred. Each state selection block, after reading such diagnosis information, will let the state estimated from the specified EKF (0 to 8) pass through as the most reliable state to the following ADASs application.


## 4.1. General Outline of the FDI System

The basic scheme of the FDI system is specified in Figure7, where fault detection system is to identify a fault that occurred and fault isolation system can determine the location of the fault. The extra fault management system is used to recognize and handle the fault, which contains a state selection system.Figure 7
Basic scheme of the FDI system.


## 4.2. EKFs in the GOS

There are eight sensors installed in Smart car, which are DGPS, longitudinal/lateral accelerometers, gyroscope, and a wheel speed sensor on each vehicle wheel. In order to detect a single fault in these sensors, a GOS bank of EKFs is developed, where there are eight EKFs. In case a sensor fault happens, the output from residual evaluation block (the diagnosis information) will indicate which fault happens and subsequently select the state estimated from the EKF, using all but the faulty sensor measurement, as the fault-free output, which is shown in Figure8. It can be seen in the figure that residuals and states generated from each EKF are inputted to the residual evaluation and fault management system, respectively. Hereafter, each EKF (in GOS) for vehicle state estimation will be evaluated, where EKF 0 uses all sensor measurements (nominal EKF).Figure 8
Scheme of the sensors FDI system for the Smart.EKF 1: Driven by All Measurements but DGPS. This one uses all but DGPS data. In case DGPS fault happens, the estimated states from this EKF will be applied.EKF 2: Driven by All Measurements but Longitudinal Accelerometer. All but longitudinal acceleration measurement are used by EKF 2. When longitudinal accelerometer is faulty, EKF 2 will be applied to state estimation. It can be seen in Figure 9 that the estimated longitudinal acceleration is reliable as an analytical redundancy to replace the faulty accelerometer measurement.Figure 9
Raw versus EKF estimated accelerations for EKF 2.EKF 3: Driven by All Measurements but Lateral Accelerometer. EKF 3 is driven by all but lateral acceleration signal. At the moment a lateral accelerometer fault occurs, states estimated from EKF 3 will be applied.EKF 4: Driven by All Measurements but Gyroscope. This EKF uses all but gyroscope measurement. In case gyroscope is faulty, EKF 4 will be used for vehicle state estimation.EKF 5/6/7/8: Driven by All Measurements but Each Wheel Speed Sensor. EKF 5 is driven by all but front left wheel speed signal. When this sensor fault happens, the estimated states from EKF 5 are still fault-free. EKFs 6 to 8 use all but other three wheel speed signals, respectively, and can achieve almost the same estimates results as EKF 5. Therefore, the detailed descriptions of these three EKFs are omitted. In case any one of these wheel speed sensors is faulty, the corresponding EKF will be applied to the state estimation.


## 4.3. Sensor Fault Detection and Detectability

In the GOS, ideally there is a residual generated from each EKF, which is sensitive to all but one sensor fault. To this end, we need to check in each EKF if those sensor faults are detectable with respect to the generated residual. It requires that transfer functions from these sensor faults to the residual are nonzero.


### 4.3.1. Sensor Faults Description

The FDI system for the Smart is designed to diagnose eight sensor faults, which are listed in Table5. The modeling of sensor fault fi can be seen in (26), where zi corresponds to each sensor measurement.Table 5
Sensor faults.
Faultfi
Description
f
1
DGPS fault (in position and heading signals)
f
2
Longitudinal accelerometer fault
f
3
Lateral accelerometer fault
f
4
Gyroscope fault
f
5
Front left wheel speed sensor fault
f
6
Front right wheel speed sensor fault
f
7
Rear left wheel speed sensor fault
f
8
Rear right wheel speed sensor fault


### 4.3.2. Residual Generation

This section discusses several possibilities for residual generation from each EKF. After comparison, the most promising one is selected. At the beginning, a residual notation is made and will be applied throughout this work. Residualrmn, is the nth residual generated from mth EKF in the GOS. Because there are eight EKFs in the GOS, we have m∈{1,…,8}. Meanwhile, as seven measurement equations are applied in the EKF 0, seven residuals might be generated from the GOS. To make a clear notation, the order of these seven residuals is fixed as n∈{1,…,7}∈{residual generated from the measurement update: DGPS, x-acceleration, y-acceleration, yaw rate, front left wheel speed, front right wheel speed, and mean rear wheel speed}.DGPS signals can be blocked by buildings, trees, bridges, and so forth. In this work, the DGPS outage is simply detected by the following logic.(1)
The number of satellites dropped below 4.(2)
The value of HDOP is larger than 10, when the positional measurements should be used only to indicate a very rough estimate of the current location.For INS FDI system design, residual generation in EKF 1 is taken as an example. As using only no DGPS measurements, this EKF can generate residuals from all INS measurement updates. The generated residuals,r12 to r17, are listed in Table 6, where ψ˙2N is yaw rate, vx/y2B are the estimated COG velocity, W1 is the length of the Smart track, and L1 is the length from the Smart COG to the front axle. It should be advised that although EKF 1 is driven by all seven INS measurements, only six residuals can be generated. The reason is that the mean rear wheel speed, instead of two separate speeds, is used in the measurement update of the EKF 1, which can be seen in (23).Table 6
Residual generation from EKF 1 measurement update.
Generation
Math formula
ACCx
r
12
=
B
y
a
x
2
-
B
a
x
2
ACCy
r
13
=
B
y
a
y
2
-
B
a
y
2
Gyroscope
r
14
=
N
y
ψ
˙
2
-
N
ψ
˙
2
Font left ODO
r
15
=
B
y
fl
2
-
(
B
v
x
2
-
0.5
W
1
N
ψ
˙
2
)
2
+
(
B
v
y
2
+
L
1
⋅
N
ψ
˙
2
)
2
Font right ODO
r
16
=
B
y
fr
2
-
(
B
v
x
2
+
0.5
W
1
N
ψ
˙
2
)
2
+
(
B
v
y
2
+
L
1
⋅
N
ψ
˙
2
)
2
Rear wheels
r
17
=
B
y
w
r
2
-
B
v
x
2Therefore, in each EKF of the GOS, there is a generated residual vectorr(k), which contains all those six residuals but one. In order to construct a GOS, a vector residual or a scalar residual, which is affected by all sensor faults but one, needs to be generated from each EKF.Scalar residuals are considered in this work. With respect to INS FDI, a scalar residual should be selected amongr12 to r17, which is affected by as many sensor faults as possible. Noticed in Table 6, there are more states involved for the generation of residuals r15 and r16. Thus, either r15 or r16 may be applied to the sensors FDI system design. In the following, the detectability of each INS fault with respect to the residual r15 will be checked.


### 4.3.3. Theory for Checking the Fault Detectability

When faults occur in the monitored process, the response of the residual vector is(29)r(k)=Gr(k)f(k)=∑i=1g‍Grkifik,
where Gr(k) is defined as a fault transfer matrix which represents the relation between the residual and faults, [Gr(k)]i is the ith column of Gr(k), and fi(k) is the ith component of fk. If [Gr(k)]i≠0, the fi is detectable in the residual r. This is defined as the fault detectability condition of the residual r to fi [28].The vehicle model applied in this project is nonlinear and linearized at each time step for EKF. Euler’s numerical integration method with a fixed time step is used for deriving the linearized equation. Therefore, we propose to check the sensor fault local detectability at each time step for a linearized discrete time model. The model is shown as follows:(30)xk+1=Axk+wk,yk=Cxk+vk.
With this system, a discrete time Kalman filter measurement update equation can be written as
(31)x^k+1=Axk+Kyk-Cx^k,(32)qx^k=Axk+Kyk-Cx^k,
where K is Kalman gain and q is a shift operator in discrete time model. From (31) the transfer function from the state vector to the measurement vector can be represented as
(33)x^(k)y(k)=qI-A+KC-1K.
Consequently, under normal conditions,
(34)x^nk=qI-A+KC-1Kynk,
where the subscript n means the normal condition and the subscript f in the following denotes a fault condition. Now, if a measurement is disturbed by a fault vector f(k),
(35)yf(k)=yn(k)+f(k)
Then, from (34), the state estimation becomes
(36)x^fk=qI-A+KC-1Kynk+fk.
The normal filter residual can be defined as
(37)vn(k)=yn(k)-Cx^n(k)
and the residual under fault conditions is
(38)vfk=yf(k)-Cx^f(k)=[yn(k)+f(k)]-CqI-A+KC-1Kynk+fk=ynk-Cx^nk+[f(k)-CqI-A+KC-1Kf(k)]=vn+I-CqI-A+KC-1Kfk.
Clearly, a sensor fault is detectable with respect to residual sequence when the term Dq=[I-CqI-A+KC-1K] is nonzero [28, 29].


### 4.3.4. Check the Fault Detectability in GOS

Since the used model is nonlinear, but it is linearized each time for the EKF, the detectability matrix is calculated for each linearization in some runs of the EKF. IfDq is nonzero at each run, then the fault is locally detectable.In the following test, a linear vehicle model is derived at an operating point, where the vehicle is driven straight with the heading of 0.02 radian. The linearization is done at 10 meters per second. The detectability of all INS faults with respect to each generated residual needs to be considered. Here, the evaluation of the INS faults detectability to EKF 1’s residuals is taken as example. The fault detectability in this operating point is checked numerically and will be proved by a practice way under other operating conditions. Similarly, such a checking method can be applied to other EKFs. After linearization, the state space matrix in EKF 1 is calculated as(39)A=100.02-4e-400-0.010000000013e-30.02000.16700000000010100000000000010100000000000010000000000000010000000000000010.0200000000000001000000000000001000000000000001000000000000001000000000000001000000000000001000000000000001,C=0000000000000000000000000000000000000000000000100010000000000100010000000000010010000010.01000-0.60001000010.010000.6500001000100000000001.The transfer matrix from faults to residuals can be represented asr=Dq*fi, where Dq=[I-C[qI-A+KC]-1K] and r/fi can be referred to as in Tables 5 and 6. Following with the descriptions of both residuals and faults, we know that Dq is a transfer matrix with seven rows and seven columns. Seven transfer functions in a certain row represent the relation between each sensor fault and a certain residual. In the following, the fault detectability from each sensor fault to the residual r15 will be checked by calculating the corresponding transfer functions.Fault Detectability with respect to Residual
r
15. Each transfer function in the fifth row of the matrix Dq can be calculated. Functions g5,2 to g5,7 are used to represent all transfer functions on the 5th row of matrix Dq, which are described in Table 7. In the following, the Bode diagram of each function is plotted, which can be applied to analyze the detectability of each sensor fault to the residual r15 (to show the frequency response of the residual to each sensor fault).Table 7
Fault transfer functions in EKF 1.
g
5
,
j
Transfer function description
g
5,2
From longitudinal accelerometer fault tor15
g
5,3
From lateral accelerometer fault tor15
g
5,4
From gyroscope fault tor15
g
5,5
From front left wheel speed sensor fault tor15
g
5,6
From front right wheel speed sensor fault tor15
g
5,7
From rear left/right wheel speed sensor fault tor15The Bode diagram ofg5,2, the transfer function from longitudinal accelerometer fault to r15, is shown in Figure 10(a), where only the high frequency band is taken into account. Because sensor faults are assumed transient, they are always high frequency signals. At this frequency, the gain margin is around −20 db and thus ten percent of the fault magnitude can be transmitted to r15. This fault is detectable in case of applying a small threshold. The Bode diagram of g5,3 can be seen in Figure 10(b). At high frequency, the gain margin is around −70 db and therefore this fault is almost undetectable in r15. The Bode diagram of g5,4, the transfer function from gyroscope fault to r15, is plotted in Figure 10(c). At high frequency, the gain margin is larger than 0 db and therefore one-hundred percent of fault magnitude can be transmitted to the residual. Thus, this fault is detectable in r15. The transfer function g5,5 should be equal to one. Additionally, looking at the Bode diagrams of g5,6 and g5,7, the front right and rear wheel speed sensor faults are all detectable with respect to r15.(a) Bode diagram ofg5,2: from longitudinal accelerometer fault to r15; (b) bode diagram of g5,3: from lateral accelerometer fault to r15; (c) bode diagram of g5,4: from gyroscope fault to r15.
(a)
(b)
(c)Sensor Fault Detectability under Other Operating Situations. Since the used model is linearized each time for the EKF 1, the detectability matrix is calculated for each linearization in some runs of the EKF 1 for the local check. Furthermore, we show the performance of this residual in response to the occurrence of each sensor fault, that is, a constant additive fault. Therefore, six separate off-line tests are performed with a different sensor fault injected at each time. The description of these faults can be seen in Table 8, where the fault sizes are chosen empirically followed by the real sensor fault size. The tests for other GOS EKFs can be conducted similarly.Table 8
Residual generation in separate tests for fault detectability check.
Tests
Fault location
Injection (s)
Fault size
Test 1
Long. accelerometer
165 s
3 m/s2
Test 2
Yaw rate
165 s
0.5 rad/s
Test 3
Front left wheel speed
153 s
5 m/s
Test 4
Front right wheel speed
163 s
5 m/sIt can be seen in Figures11, 12, and 13 that upon the occurrence of all sensor faults, at any operating point the residual r15 has the obvious and constant change. Moreover, the magnitude of r15 under the nominal condition is around ±0.1 m, which can be seen in the bottom of Figure 11. In case a single sensor fault with a reasonable size as specified in Table 8 happens, the change of r15 is far larger than the nominal residual magnitude. Thus, by selecting a fixed threshold, this change can be detected.Figure 11
Test 1:x-accelerometer fault and the response of r15.Figure 12
Test 2: gyroscope fault and the response ofr15.(a) Test 3: front left wheel speed sensor fault and the response ofr15; (b) test 4: front right wheel speed sensor fault and the response of r15.
(a)
(b)


### 4.3.5. GOS Residuals Generation

For all INS, it is considered at the first step to generate a residual to detect all but lateral accelerometer sensor fault. The detection of lateral accelerometer fault can de achieved by a simple strategy, that is, checking the difference between the raw and estimated acceleration only generated from the EKF 3, which is driven by all but lateral accelerometer measurement. Hereby, all residuals generated for the FDI system design are classified and listed in Table9. The formula representations of these residual generations can be seen in Table 6.Table 9
Residual generation in each EKF.
EKF
r
Generated from
EKF1 (no GPS)
r
15
Front left ODO Meas update
EKF2 (noax)
r
25
Front left ODO Meas update
EKF3 (noay)
r
33
Raw and estimatedy-acceleration
r
35
Front left ODO Meas update
EKF4 (noψ˙)
r
45
Front left ODO Meas update
EKF5 (novfl)
r
56
Front right ODO Meas update
EKF6 (novfr)
r
65
Front left ODO Meas update
EKF7 (novrl)
r
75
Front left ODO Meas update
EKF8 (novrr)
r
85
Front left ODO Meas updateFrom EKF 3, lateral acceleration can be estimated. We compare this estimated state with raw lateral accelerometer measurement, the difference of which is generated as a residual,r33. During the test, if there is a big change in this residual but all other INS residuals are nominal, then a lateral accelerometer fault can be detected.


## 4.3.1. Sensor Faults Description

The FDI system for the Smart is designed to diagnose eight sensor faults, which are listed in Table5. The modeling of sensor fault fi can be seen in (26), where zi corresponds to each sensor measurement.Table 5
Sensor faults.
Faultfi
Description
f
1
DGPS fault (in position and heading signals)
f
2
Longitudinal accelerometer fault
f
3
Lateral accelerometer fault
f
4
Gyroscope fault
f
5
Front left wheel speed sensor fault
f
6
Front right wheel speed sensor fault
f
7
Rear left wheel speed sensor fault
f
8
Rear right wheel speed sensor fault


## 4.3.2. Residual Generation

This section discusses several possibilities for residual generation from each EKF. After comparison, the most promising one is selected. At the beginning, a residual notation is made and will be applied throughout this work. Residualrmn, is the nth residual generated from mth EKF in the GOS. Because there are eight EKFs in the GOS, we have m∈{1,…,8}. Meanwhile, as seven measurement equations are applied in the EKF 0, seven residuals might be generated from the GOS. To make a clear notation, the order of these seven residuals is fixed as n∈{1,…,7}∈{residual generated from the measurement update: DGPS, x-acceleration, y-acceleration, yaw rate, front left wheel speed, front right wheel speed, and mean rear wheel speed}.DGPS signals can be blocked by buildings, trees, bridges, and so forth. In this work, the DGPS outage is simply detected by the following logic.(1)
The number of satellites dropped below 4.(2)
The value of HDOP is larger than 10, when the positional measurements should be used only to indicate a very rough estimate of the current location.For INS FDI system design, residual generation in EKF 1 is taken as an example. As using only no DGPS measurements, this EKF can generate residuals from all INS measurement updates. The generated residuals,r12 to r17, are listed in Table 6, where ψ˙2N is yaw rate, vx/y2B are the estimated COG velocity, W1 is the length of the Smart track, and L1 is the length from the Smart COG to the front axle. It should be advised that although EKF 1 is driven by all seven INS measurements, only six residuals can be generated. The reason is that the mean rear wheel speed, instead of two separate speeds, is used in the measurement update of the EKF 1, which can be seen in (23).Table 6
Residual generation from EKF 1 measurement update.
Generation
Math formula
ACCx
r
12
=
B
y
a
x
2
-
B
a
x
2
ACCy
r
13
=
B
y
a
y
2
-
B
a
y
2
Gyroscope
r
14
=
N
y
ψ
˙
2
-
N
ψ
˙
2
Font left ODO
r
15
=
B
y
fl
2
-
(
B
v
x
2
-
0.5
W
1
N
ψ
˙
2
)
2
+
(
B
v
y
2
+
L
1
⋅
N
ψ
˙
2
)
2
Font right ODO
r
16
=
B
y
fr
2
-
(
B
v
x
2
+
0.5
W
1
N
ψ
˙
2
)
2
+
(
B
v
y
2
+
L
1
⋅
N
ψ
˙
2
)
2
Rear wheels
r
17
=
B
y
w
r
2
-
B
v
x
2Therefore, in each EKF of the GOS, there is a generated residual vectorr(k), which contains all those six residuals but one. In order to construct a GOS, a vector residual or a scalar residual, which is affected by all sensor faults but one, needs to be generated from each EKF.Scalar residuals are considered in this work. With respect to INS FDI, a scalar residual should be selected amongr12 to r17, which is affected by as many sensor faults as possible. Noticed in Table 6, there are more states involved for the generation of residuals r15 and r16. Thus, either r15 or r16 may be applied to the sensors FDI system design. In the following, the detectability of each INS fault with respect to the residual r15 will be checked.


## 4.3.3. Theory for Checking the Fault Detectability

When faults occur in the monitored process, the response of the residual vector is(29)r(k)=Gr(k)f(k)=∑i=1g‍Grkifik,
where Gr(k) is defined as a fault transfer matrix which represents the relation between the residual and faults, [Gr(k)]i is the ith column of Gr(k), and fi(k) is the ith component of fk. If [Gr(k)]i≠0, the fi is detectable in the residual r. This is defined as the fault detectability condition of the residual r to fi [28].The vehicle model applied in this project is nonlinear and linearized at each time step for EKF. Euler’s numerical integration method with a fixed time step is used for deriving the linearized equation. Therefore, we propose to check the sensor fault local detectability at each time step for a linearized discrete time model. The model is shown as follows:(30)xk+1=Axk+wk,yk=Cxk+vk.
With this system, a discrete time Kalman filter measurement update equation can be written as
(31)x^k+1=Axk+Kyk-Cx^k,(32)qx^k=Axk+Kyk-Cx^k,
where K is Kalman gain and q is a shift operator in discrete time model. From (31) the transfer function from the state vector to the measurement vector can be represented as
(33)x^(k)y(k)=qI-A+KC-1K.
Consequently, under normal conditions,
(34)x^nk=qI-A+KC-1Kynk,
where the subscript n means the normal condition and the subscript f in the following denotes a fault condition. Now, if a measurement is disturbed by a fault vector f(k),
(35)yf(k)=yn(k)+f(k)
Then, from (34), the state estimation becomes
(36)x^fk=qI-A+KC-1Kynk+fk.
The normal filter residual can be defined as
(37)vn(k)=yn(k)-Cx^n(k)
and the residual under fault conditions is
(38)vfk=yf(k)-Cx^f(k)=[yn(k)+f(k)]-CqI-A+KC-1Kynk+fk=ynk-Cx^nk+[f(k)-CqI-A+KC-1Kf(k)]=vn+I-CqI-A+KC-1Kfk.
Clearly, a sensor fault is detectable with respect to residual sequence when the term Dq=[I-CqI-A+KC-1K] is nonzero [28, 29].


## 4.3.4. Check the Fault Detectability in GOS

Since the used model is nonlinear, but it is linearized each time for the EKF, the detectability matrix is calculated for each linearization in some runs of the EKF. IfDq is nonzero at each run, then the fault is locally detectable.In the following test, a linear vehicle model is derived at an operating point, where the vehicle is driven straight with the heading of 0.02 radian. The linearization is done at 10 meters per second. The detectability of all INS faults with respect to each generated residual needs to be considered. Here, the evaluation of the INS faults detectability to EKF 1’s residuals is taken as example. The fault detectability in this operating point is checked numerically and will be proved by a practice way under other operating conditions. Similarly, such a checking method can be applied to other EKFs. After linearization, the state space matrix in EKF 1 is calculated as(39)A=100.02-4e-400-0.010000000013e-30.02000.16700000000010100000000000010100000000000010000000000000010000000000000010.0200000000000001000000000000001000000000000001000000000000001000000000000001000000000000001000000000000001,C=0000000000000000000000000000000000000000000000100010000000000100010000000000010010000010.01000-0.60001000010.010000.6500001000100000000001.The transfer matrix from faults to residuals can be represented asr=Dq*fi, where Dq=[I-C[qI-A+KC]-1K] and r/fi can be referred to as in Tables 5 and 6. Following with the descriptions of both residuals and faults, we know that Dq is a transfer matrix with seven rows and seven columns. Seven transfer functions in a certain row represent the relation between each sensor fault and a certain residual. In the following, the fault detectability from each sensor fault to the residual r15 will be checked by calculating the corresponding transfer functions.Fault Detectability with respect to Residual
r
15. Each transfer function in the fifth row of the matrix Dq can be calculated. Functions g5,2 to g5,7 are used to represent all transfer functions on the 5th row of matrix Dq, which are described in Table 7. In the following, the Bode diagram of each function is plotted, which can be applied to analyze the detectability of each sensor fault to the residual r15 (to show the frequency response of the residual to each sensor fault).Table 7
Fault transfer functions in EKF 1.
g
5
,
j
Transfer function description
g
5,2
From longitudinal accelerometer fault tor15
g
5,3
From lateral accelerometer fault tor15
g
5,4
From gyroscope fault tor15
g
5,5
From front left wheel speed sensor fault tor15
g
5,6
From front right wheel speed sensor fault tor15
g
5,7
From rear left/right wheel speed sensor fault tor15The Bode diagram ofg5,2, the transfer function from longitudinal accelerometer fault to r15, is shown in Figure 10(a), where only the high frequency band is taken into account. Because sensor faults are assumed transient, they are always high frequency signals. At this frequency, the gain margin is around −20 db and thus ten percent of the fault magnitude can be transmitted to r15. This fault is detectable in case of applying a small threshold. The Bode diagram of g5,3 can be seen in Figure 10(b). At high frequency, the gain margin is around −70 db and therefore this fault is almost undetectable in r15. The Bode diagram of g5,4, the transfer function from gyroscope fault to r15, is plotted in Figure 10(c). At high frequency, the gain margin is larger than 0 db and therefore one-hundred percent of fault magnitude can be transmitted to the residual. Thus, this fault is detectable in r15. The transfer function g5,5 should be equal to one. Additionally, looking at the Bode diagrams of g5,6 and g5,7, the front right and rear wheel speed sensor faults are all detectable with respect to r15.(a) Bode diagram ofg5,2: from longitudinal accelerometer fault to r15; (b) bode diagram of g5,3: from lateral accelerometer fault to r15; (c) bode diagram of g5,4: from gyroscope fault to r15.
(a)
(b)
(c)Sensor Fault Detectability under Other Operating Situations. Since the used model is linearized each time for the EKF 1, the detectability matrix is calculated for each linearization in some runs of the EKF 1 for the local check. Furthermore, we show the performance of this residual in response to the occurrence of each sensor fault, that is, a constant additive fault. Therefore, six separate off-line tests are performed with a different sensor fault injected at each time. The description of these faults can be seen in Table 8, where the fault sizes are chosen empirically followed by the real sensor fault size. The tests for other GOS EKFs can be conducted similarly.Table 8
Residual generation in separate tests for fault detectability check.
Tests
Fault location
Injection (s)
Fault size
Test 1
Long. accelerometer
165 s
3 m/s2
Test 2
Yaw rate
165 s
0.5 rad/s
Test 3
Front left wheel speed
153 s
5 m/s
Test 4
Front right wheel speed
163 s
5 m/sIt can be seen in Figures11, 12, and 13 that upon the occurrence of all sensor faults, at any operating point the residual r15 has the obvious and constant change. Moreover, the magnitude of r15 under the nominal condition is around ±0.1 m, which can be seen in the bottom of Figure 11. In case a single sensor fault with a reasonable size as specified in Table 8 happens, the change of r15 is far larger than the nominal residual magnitude. Thus, by selecting a fixed threshold, this change can be detected.Figure 11
Test 1:x-accelerometer fault and the response of r15.Figure 12
Test 2: gyroscope fault and the response ofr15.(a) Test 3: front left wheel speed sensor fault and the response ofr15; (b) test 4: front right wheel speed sensor fault and the response of r15.
(a)
(b)


## 4.3.5. GOS Residuals Generation

For all INS, it is considered at the first step to generate a residual to detect all but lateral accelerometer sensor fault. The detection of lateral accelerometer fault can de achieved by a simple strategy, that is, checking the difference between the raw and estimated acceleration only generated from the EKF 3, which is driven by all but lateral accelerometer measurement. Hereby, all residuals generated for the FDI system design are classified and listed in Table9. The formula representations of these residual generations can be seen in Table 6.Table 9
Residual generation in each EKF.
EKF
r
Generated from
EKF1 (no GPS)
r
15
Front left ODO Meas update
EKF2 (noax)
r
25
Front left ODO Meas update
EKF3 (noay)
r
33
Raw and estimatedy-acceleration
r
35
Front left ODO Meas update
EKF4 (noψ˙)
r
45
Front left ODO Meas update
EKF5 (novfl)
r
56
Front right ODO Meas update
EKF6 (novfr)
r
65
Front left ODO Meas update
EKF7 (novrl)
r
75
Front left ODO Meas update
EKF8 (novrr)
r
85
Front left ODO Meas updateFrom EKF 3, lateral acceleration can be estimated. We compare this estimated state with raw lateral accelerometer measurement, the difference of which is generated as a residual,r33. During the test, if there is a big change in this residual but all other INS residuals are nominal, then a lateral accelerometer fault can be detected.


## 4.4. Sensor Fault Isolation

Residuals generated from each EKF are evaluated in this section and the diagnosis information which indicates the location of the faulty sensor can be made. Residual evaluation can in its simplest form be a thresholding test on the residual, such as a test if residual is larger than a threshold. Due to model uncertainties and measurement noise, residual will not be 0 in the fault-free case. Therefore a nonzero threshold has to be selected. Residual evaluation in its complex form can be distinguished as various tests of mean, variance, or theχ2 test [30].As stated in Section4.3.4, when single sensor faults with reasonable sizes happen, there are considerable changes of residual r15, which largely exceed the nominal residual magnitude, ±0.1 m. Therefore, it is reasonable to select the nonzero threshold in this work for residual evaluation. For the change detection, a binary number is used to indicate the change of a residual. After evaluating, if the residual is larger than a fixed threshold, the value of its change detection is set to 1; otherwise it is 0.Based on the functioning of the designed GOS, while a single sensor fault happens, all selected EKF residuals but one will fire. Such pattern of the residual response constructs a generalized residual set, which can identify the location of a sensor fault. Therefore, a look-up table for INS faults isolation is designed and provided as in Table10, where f2/4/5/6/7/8 stand for longitudinal accelerometer, gyroscope, and four wheel speed sensors faults. Moreover, because both residuals r15 and r35, generated from EKF 1 and 3, are sensitive to all faults of f2/4/5/6/7/8, they are omitted from decision logic during the off-line test, and a simplified isolation table is presented as in Table 11. Decision logic for lateral accelerometer fault detection is implemented in the second row of Table 11.Table 10
INS fault isolation table.
Faults
r
15
r
25
r
33
r
35
r
45
r
56
r
65
r
75
r
85
f
2
1
0
0
1
1
1
1
1
1
f
3
0
0
1
0
0
0
0
0
0
f
4
1
1
0
1
0
1
1
1
1
f
5
1
1
0
1
1
0
1
1
1
f
6
1
1
0
1
1
1
0
1
1
f
7
1
1
0
1
1
1
1
0
1
f
8
1
1
0
1
1
1
1
1
0Table 11
Simplified INS fault isolation table.
Faults/residuals
r
25
r
33
r
45
r
56
r
65
r
75
r
85
f
2
0
—
1
1
1
1
1
f
3
0
1
0
0
0
0
0
f
4
1
—
0
1
1
1
1
f
5
1
—
1
0
1
1
1
f
6
1
—
1
1
0
1
1
f
7
1
—
1
1
1
0
1
f
8
1
—
1
1
1
1
0


## 4.5. Sensor Fault Management System

An extra fault management system is integrated into the designed FDI system for recognizing and handling the diagnosed fault.The basic scheme of this fault management system is shown in Figure14, where the state selection is explained. In the designed FDI system, there are nine EKFs, which can be seen in Figure 8. Nominal EKF (EKF 0) uses all sensor measurements for the vehicle state estimation. Others, from EKF 1 to EKF 8, are driven by all but one different sensor signal, from which estimated states as well as residuals are generated. From these nine EKFs, nine estimated state vectors are obtained,  x~0=[x~01,…,x~08], x~1=x~11,…,x~18,…,x~8=[x~81,…,x~88]. Clearly, there are eight states estimated from each EKF, that is, vehicle x/y-position, x/y velocity, x-/y-acceleration, heading, and yaw rate. x~01 is the first state, x-position, estimated from the EKF 0.Figure 14
Basic scheme of the fault management system.Corresponding to these eight states, there are eight state selection blocks in the fault management system, each usingqth state, q∈{1,…,8}, estimated from each EKF. The diagnosis information Dd, generated from fault isolation block, is a variable, ranging from 0 to 8. A number of 0 means all sensors are fault-free and an integer among 1 to 8 indicates a corresponding sensor fault f1 to f8, listed in Table 5, occurred. Each state selection block, after reading such diagnosis information, will let the state estimated from the specified EKF (0 to 8) pass through as the most reliable state to the following ADASs application.


## 5. FDI System Testing and Experiment Result

The off-line tests are designed to evaluate the FDI system for the Smart with actual experiment data. The road test is conducted on the test track as shown in Figure15. During the experiment, the Smart starts at the starting point P1 and runs in the counterclockwise direction. With the CAN interface and data acquisition system installed on the Smart, the actual measurement data can be obtained from all sensors in vehicles. Afterwards, they are inputted to the FDI system built in a Simulink environment on a Windows XP Laptop (Intel Core2 6300 1.86 Hz, 2 Gb of RAM) for the state estimation. Meanwhile, the real-time FDI system validation test will be conducting on a prototype ECU, which has a 208 MHz ARM9 CPU, 32 MB RAM, and 16 GB flash.Figure 15
Test track map.


### 5.1. Fault Generation and Injection

For evaluating the designed FDI system, some additive faults with appropriate size are generated and injected to the nominal sensor data during the off-line test. The strategy for the sensor fault injection is shown in Figure16, where a fault fs is added to each single sensor. The fault magnitude of fs is a scalar function of time and is chosen depending on the real sensor fault size, which is zero when there is no fault. Es stands for the sensor fault direction, which for each single fault is equal to one. A zero block in Figure 16 is used to represent a complete sensor fault (power off). In the off-line test, such a fault injection block is added to each sensor measurement.Figure 16
Sensor fault injection system.


### 5.2. FDI System Evaluation with Off-Line Tests

In this section, the designed FDI system is tested with the occurrence of each sensor fault, either a real or a injected fault. The off-line test is conducted with the real experiment data, during the time intervalt = 0–120 s. In this period, The Smart was accelerated and decelerated in both longitudinal and lateral direction, which make the driving scenarios comprehensive enough for the FDI system test. In the following, residual generation, evaluation, and the nominal states selection are provided. Depending on these test results, the function of the FDI system is analyzed.


#### 5.2.1. DGPS Fault Detection

Based on the simple logic descried in Section4.3.2, the GPS outage is detected during t=[30,65] s in the test, since the GPS signal was blocked by the lab building while the Smart was on the test track. This outage can be treated as additive sensor faults and easily detected as shown in Table 12. The faulty x/y position signals are plotted as the gray curve in Figure 17. The diagnosis information Dd, which is generated from fault isolation block to indicate the location of the sensor fault, is plotted in Figure 18. In this figure, a number of 1 indicates the occurrence of DGPS fault.Table 12
Real DGPS faults.
Fault type
Occurrence time
Fault size
Real additive fault
32.5 s
8 m
Real additive fault
38.6 s
8 m
Real additive fault
64.0 s
10 mFigure 17
Zoomed in: DGPS versus nominal estimated longitudinal and lateral position.Figure 18
Diagnosis information generated from residual evaluation.As discussed in Section4.5, at the time Dd=1, the state selection in fault management system selects the estimated states from the EKF 1, driven by all but DGPS data, as the nominal vehicle states. As shown in Figure 17, at time points, t = 32.5 and 38.6 s, diagnosis information Dd is equal to one and, consequently, vehicle position estimated from the EKF 1 (black curve), instead of EKF 0 (dashed black curve), is selected as the fault-free output. Hence, the estimated vehicle position is still accurate even if DGPS faults occur, which can be seen in Figure 19.Figure 19
DGPS versus nominal estimated Smart trackt = 0–120 s.


#### 5.2.2. INS Fault Diagnosis

In the real experiment, there was a fault that happened in the rear left wheel speed sensor and all other sensors are fault-free.Longitudinal Accelerometer FDI. Additive sensor faults are generated and injected to the raw acceleration measurement. The fault size is chosen around 3.5 m/s2, which is an appropriate size of the real accelerometer fault. The fault descriptions can be read in Table 13 and the comparison of raw and faulty acceleration signals is plotted in Figure 20.Table 13
Generated longitudinal accelerometer faults.
Fault type
Occurrence time
Fault size
Additive
15.7 s
3 m/s2
Additive
95.7 s
3.5 m/s2Figure 20
Raw and faulty longitudinal acceleration.From Figure21, we notice that all but residual r25 change in response to the sensor fault. Depending on the nominal magnitude of each residual, a threshold can be chosen, which is shown in Figure 21. Such a threshold value for each residual is fixed and will be applied to all INS fault detection in the following sections.Figure 21
Residuals generation in response to longitudinal accelerometer faults.In response to longitudinal accelerometer faults, the diagnosis information is generated from isolation block and plotted in Figure22, where a number of 2 indicates the fault f2 happens. There exists a time delay, around 0.1 s, for the diagnosis of longitudinal accelerometer sensor fault. The estimated fault-free longitudinal acceleration, outputted from the fault management system, is provided as the black curve in Figure 23.Figure 22
Diagnosis information generated from residual evaluation.Figure 23
Faulty versus nominal EKF estimatedx-acceleration upon the occurrence of longitudinal accelerometer faults.It can be seen att = 15.8 and 95.8 s that when Dd is equal to 2, the state selection switches the longitudinal acceleration estimated from EKF 2 (the black curve) instead of from EKF 0 (the gray curve) as the output. Therefore, even if a sensor fault occurs, the estimated acceleration outputted from the fault management system is still fault-free. However, due to a 0.1 s time delay during fault diagnosis, a big spike appears at the beginning of the state switch, which can be easily removed by a low pass filter.Gyroscope FDI. For this sensor measurement, both complete and additive faults are generated and injected. The fault size is chosen around 0.5 rad/s. The injected faults are described in Table 14 and the comparison of raw and faulty yaw rate signals is plotted in Figure 24. From Figure 25, we notice that all residuals but r45 change in response to the occurrence of this sensor fault. Based on the threshold values, the minimum fault size that can be detected is around 0.4 rad/s, which is an appropriate fault size in the real gyroscope.Table 14
Generated gyroscope faults.
Fault type
Occurrence time
Fault size
Additive
16.0 s
0.4 rad/s
Additive
91.5 s
0.4 rad/s
Complete
105.5 s
yaw rate = 0 rad/sFigure 24
Raw and faulty yaw rate.Figure 25
Residuals generation in response to gyroscope faults.For indicating the gyroscope fault, the diagnosis information is generated from isolation block and shown in Figure26, where a number of 4 indicates this fault happens. The estimated fault-free yaw rate, outputted from the fault management system, is plotted as the black curve in Figure 27. At time t = 16.05, 91.6 s, and 105.6 s, upon Dd=4, the state selection makes the yaw rate estimated from EKF 4 (the black curve) instead of from EKF 0 (the gray curve) as the output.Figure 26
Diagnosis information generated from residual evaluation.Figure 27
Faulty versus nominal EKF estimated yaw rate upon the occurrence of gyroscope faults.Front Left Wheel Speed Sensor FDI. For front left wheel speed sensor, faults are generated either with magnitudes around 2 m/s or as complete faults. The fault descriptions are given in Table 15 and the comparison of raw and faulty wheel speed signals is plotted in Figure 28.Table 15
Generated front left wheel speed sensor faults.
Fault type
Occurrence time
Fault size
Additive
17.58 s
2 m/s
Additive
86.76 s
1 m/s
Complete
103.32 s
speed = 0 m/sFigure 28
Raw and faulty front left wheel speed.The estimated fault-free longitudinal COG velocity, outputted from the fault management system, is plotted as the black curve in Figure29. Additionally, the front right, rear left, and rear right wheel speed sensors FDI can be handled in the same way.Figure 29
Faulty versus nominal EKF estimated COG longitudinal velocity upon the occurrence of front left wheel speed sensor faults.


## 5.1. Fault Generation and Injection

For evaluating the designed FDI system, some additive faults with appropriate size are generated and injected to the nominal sensor data during the off-line test. The strategy for the sensor fault injection is shown in Figure16, where a fault fs is added to each single sensor. The fault magnitude of fs is a scalar function of time and is chosen depending on the real sensor fault size, which is zero when there is no fault. Es stands for the sensor fault direction, which for each single fault is equal to one. A zero block in Figure 16 is used to represent a complete sensor fault (power off). In the off-line test, such a fault injection block is added to each sensor measurement.Figure 16
Sensor fault injection system.


## 5.2. FDI System Evaluation with Off-Line Tests

In this section, the designed FDI system is tested with the occurrence of each sensor fault, either a real or a injected fault. The off-line test is conducted with the real experiment data, during the time intervalt = 0–120 s. In this period, The Smart was accelerated and decelerated in both longitudinal and lateral direction, which make the driving scenarios comprehensive enough for the FDI system test. In the following, residual generation, evaluation, and the nominal states selection are provided. Depending on these test results, the function of the FDI system is analyzed.


### 5.2.1. DGPS Fault Detection

Based on the simple logic descried in Section4.3.2, the GPS outage is detected during t=[30,65] s in the test, since the GPS signal was blocked by the lab building while the Smart was on the test track. This outage can be treated as additive sensor faults and easily detected as shown in Table 12. The faulty x/y position signals are plotted as the gray curve in Figure 17. The diagnosis information Dd, which is generated from fault isolation block to indicate the location of the sensor fault, is plotted in Figure 18. In this figure, a number of 1 indicates the occurrence of DGPS fault.Table 12
Real DGPS faults.
Fault type
Occurrence time
Fault size
Real additive fault
32.5 s
8 m
Real additive fault
38.6 s
8 m
Real additive fault
64.0 s
10 mFigure 17
Zoomed in: DGPS versus nominal estimated longitudinal and lateral position.Figure 18
Diagnosis information generated from residual evaluation.As discussed in Section4.5, at the time Dd=1, the state selection in fault management system selects the estimated states from the EKF 1, driven by all but DGPS data, as the nominal vehicle states. As shown in Figure 17, at time points, t = 32.5 and 38.6 s, diagnosis information Dd is equal to one and, consequently, vehicle position estimated from the EKF 1 (black curve), instead of EKF 0 (dashed black curve), is selected as the fault-free output. Hence, the estimated vehicle position is still accurate even if DGPS faults occur, which can be seen in Figure 19.Figure 19
DGPS versus nominal estimated Smart trackt = 0–120 s.


### 5.2.2. INS Fault Diagnosis

In the real experiment, there was a fault that happened in the rear left wheel speed sensor and all other sensors are fault-free.Longitudinal Accelerometer FDI. Additive sensor faults are generated and injected to the raw acceleration measurement. The fault size is chosen around 3.5 m/s2, which is an appropriate size of the real accelerometer fault. The fault descriptions can be read in Table 13 and the comparison of raw and faulty acceleration signals is plotted in Figure 20.Table 13
Generated longitudinal accelerometer faults.
Fault type
Occurrence time
Fault size
Additive
15.7 s
3 m/s2
Additive
95.7 s
3.5 m/s2Figure 20
Raw and faulty longitudinal acceleration.From Figure21, we notice that all but residual r25 change in response to the sensor fault. Depending on the nominal magnitude of each residual, a threshold can be chosen, which is shown in Figure 21. Such a threshold value for each residual is fixed and will be applied to all INS fault detection in the following sections.Figure 21
Residuals generation in response to longitudinal accelerometer faults.In response to longitudinal accelerometer faults, the diagnosis information is generated from isolation block and plotted in Figure22, where a number of 2 indicates the fault f2 happens. There exists a time delay, around 0.1 s, for the diagnosis of longitudinal accelerometer sensor fault. The estimated fault-free longitudinal acceleration, outputted from the fault management system, is provided as the black curve in Figure 23.Figure 22
Diagnosis information generated from residual evaluation.Figure 23
Faulty versus nominal EKF estimatedx-acceleration upon the occurrence of longitudinal accelerometer faults.It can be seen att = 15.8 and 95.8 s that when Dd is equal to 2, the state selection switches the longitudinal acceleration estimated from EKF 2 (the black curve) instead of from EKF 0 (the gray curve) as the output. Therefore, even if a sensor fault occurs, the estimated acceleration outputted from the fault management system is still fault-free. However, due to a 0.1 s time delay during fault diagnosis, a big spike appears at the beginning of the state switch, which can be easily removed by a low pass filter.Gyroscope FDI. For this sensor measurement, both complete and additive faults are generated and injected. The fault size is chosen around 0.5 rad/s. The injected faults are described in Table 14 and the comparison of raw and faulty yaw rate signals is plotted in Figure 24. From Figure 25, we notice that all residuals but r45 change in response to the occurrence of this sensor fault. Based on the threshold values, the minimum fault size that can be detected is around 0.4 rad/s, which is an appropriate fault size in the real gyroscope.Table 14
Generated gyroscope faults.
Fault type
Occurrence time
Fault size
Additive
16.0 s
0.4 rad/s
Additive
91.5 s
0.4 rad/s
Complete
105.5 s
yaw rate = 0 rad/sFigure 24
Raw and faulty yaw rate.Figure 25
Residuals generation in response to gyroscope faults.For indicating the gyroscope fault, the diagnosis information is generated from isolation block and shown in Figure26, where a number of 4 indicates this fault happens. The estimated fault-free yaw rate, outputted from the fault management system, is plotted as the black curve in Figure 27. At time t = 16.05, 91.6 s, and 105.6 s, upon Dd=4, the state selection makes the yaw rate estimated from EKF 4 (the black curve) instead of from EKF 0 (the gray curve) as the output.Figure 26
Diagnosis information generated from residual evaluation.Figure 27
Faulty versus nominal EKF estimated yaw rate upon the occurrence of gyroscope faults.Front Left Wheel Speed Sensor FDI. For front left wheel speed sensor, faults are generated either with magnitudes around 2 m/s or as complete faults. The fault descriptions are given in Table 15 and the comparison of raw and faulty wheel speed signals is plotted in Figure 28.Table 15
Generated front left wheel speed sensor faults.
Fault type
Occurrence time
Fault size
Additive
17.58 s
2 m/s
Additive
86.76 s
1 m/s
Complete
103.32 s
speed = 0 m/sFigure 28
Raw and faulty front left wheel speed.The estimated fault-free longitudinal COG velocity, outputted from the fault management system, is plotted as the black curve in Figure29. Additionally, the front right, rear left, and rear right wheel speed sensors FDI can be handled in the same way.Figure 29
Faulty versus nominal EKF estimated COG longitudinal velocity upon the occurrence of front left wheel speed sensor faults.


## 5.2.1. DGPS Fault Detection

Based on the simple logic descried in Section4.3.2, the GPS outage is detected during t=[30,65] s in the test, since the GPS signal was blocked by the lab building while the Smart was on the test track. This outage can be treated as additive sensor faults and easily detected as shown in Table 12. The faulty x/y position signals are plotted as the gray curve in Figure 17. The diagnosis information Dd, which is generated from fault isolation block to indicate the location of the sensor fault, is plotted in Figure 18. In this figure, a number of 1 indicates the occurrence of DGPS fault.Table 12
Real DGPS faults.
Fault type
Occurrence time
Fault size
Real additive fault
32.5 s
8 m
Real additive fault
38.6 s
8 m
Real additive fault
64.0 s
10 mFigure 17
Zoomed in: DGPS versus nominal estimated longitudinal and lateral position.Figure 18
Diagnosis information generated from residual evaluation.As discussed in Section4.5, at the time Dd=1, the state selection in fault management system selects the estimated states from the EKF 1, driven by all but DGPS data, as the nominal vehicle states. As shown in Figure 17, at time points, t = 32.5 and 38.6 s, diagnosis information Dd is equal to one and, consequently, vehicle position estimated from the EKF 1 (black curve), instead of EKF 0 (dashed black curve), is selected as the fault-free output. Hence, the estimated vehicle position is still accurate even if DGPS faults occur, which can be seen in Figure 19.Figure 19
DGPS versus nominal estimated Smart trackt = 0–120 s.


## 5.2.2. INS Fault Diagnosis

In the real experiment, there was a fault that happened in the rear left wheel speed sensor and all other sensors are fault-free.Longitudinal Accelerometer FDI. Additive sensor faults are generated and injected to the raw acceleration measurement. The fault size is chosen around 3.5 m/s2, which is an appropriate size of the real accelerometer fault. The fault descriptions can be read in Table 13 and the comparison of raw and faulty acceleration signals is plotted in Figure 20.Table 13
Generated longitudinal accelerometer faults.
Fault type
Occurrence time
Fault size
Additive
15.7 s
3 m/s2
Additive
95.7 s
3.5 m/s2Figure 20
Raw and faulty longitudinal acceleration.From Figure21, we notice that all but residual r25 change in response to the sensor fault. Depending on the nominal magnitude of each residual, a threshold can be chosen, which is shown in Figure 21. Such a threshold value for each residual is fixed and will be applied to all INS fault detection in the following sections.Figure 21
Residuals generation in response to longitudinal accelerometer faults.In response to longitudinal accelerometer faults, the diagnosis information is generated from isolation block and plotted in Figure22, where a number of 2 indicates the fault f2 happens. There exists a time delay, around 0.1 s, for the diagnosis of longitudinal accelerometer sensor fault. The estimated fault-free longitudinal acceleration, outputted from the fault management system, is provided as the black curve in Figure 23.Figure 22
Diagnosis information generated from residual evaluation.Figure 23
Faulty versus nominal EKF estimatedx-acceleration upon the occurrence of longitudinal accelerometer faults.It can be seen att = 15.8 and 95.8 s that when Dd is equal to 2, the state selection switches the longitudinal acceleration estimated from EKF 2 (the black curve) instead of from EKF 0 (the gray curve) as the output. Therefore, even if a sensor fault occurs, the estimated acceleration outputted from the fault management system is still fault-free. However, due to a 0.1 s time delay during fault diagnosis, a big spike appears at the beginning of the state switch, which can be easily removed by a low pass filter.Gyroscope FDI. For this sensor measurement, both complete and additive faults are generated and injected. The fault size is chosen around 0.5 rad/s. The injected faults are described in Table 14 and the comparison of raw and faulty yaw rate signals is plotted in Figure 24. From Figure 25, we notice that all residuals but r45 change in response to the occurrence of this sensor fault. Based on the threshold values, the minimum fault size that can be detected is around 0.4 rad/s, which is an appropriate fault size in the real gyroscope.Table 14
Generated gyroscope faults.
Fault type
Occurrence time
Fault size
Additive
16.0 s
0.4 rad/s
Additive
91.5 s
0.4 rad/s
Complete
105.5 s
yaw rate = 0 rad/sFigure 24
Raw and faulty yaw rate.Figure 25
Residuals generation in response to gyroscope faults.For indicating the gyroscope fault, the diagnosis information is generated from isolation block and shown in Figure26, where a number of 4 indicates this fault happens. The estimated fault-free yaw rate, outputted from the fault management system, is plotted as the black curve in Figure 27. At time t = 16.05, 91.6 s, and 105.6 s, upon Dd=4, the state selection makes the yaw rate estimated from EKF 4 (the black curve) instead of from EKF 0 (the gray curve) as the output.Figure 26
Diagnosis information generated from residual evaluation.Figure 27
Faulty versus nominal EKF estimated yaw rate upon the occurrence of gyroscope faults.Front Left Wheel Speed Sensor FDI. For front left wheel speed sensor, faults are generated either with magnitudes around 2 m/s or as complete faults. The fault descriptions are given in Table 15 and the comparison of raw and faulty wheel speed signals is plotted in Figure 28.Table 15
Generated front left wheel speed sensor faults.
Fault type
Occurrence time
Fault size
Additive
17.58 s
2 m/s
Additive
86.76 s
1 m/s
Complete
103.32 s
speed = 0 m/sFigure 28
Raw and faulty front left wheel speed.The estimated fault-free longitudinal COG velocity, outputted from the fault management system, is plotted as the black curve in Figure29. Additionally, the front right, rear left, and rear right wheel speed sensors FDI can be handled in the same way.Figure 29
Faulty versus nominal EKF estimated COG longitudinal velocity upon the occurrence of front left wheel speed sensor faults.


## 6. Conclusions and Future Work

This work deals with the design of sensors fault detection and isolation (FDI) system for a Smart car. In the FDI system, a generalized observer scheme (GOS) is developed. The GOS is constructed by a bank of EKFs, each excited by all but one sensor measurement. Therefore, there is a unique pattern of the residuals change with respect to the occurrence of each fault, which subsequently can be isolated by decision logic. The robustness of the FDI system to disturbances and model uncertainty is improved by the application of the GOS.For evaluating the function of the designed FDI system, some off-line tests are conducted, where vehicle data measured from a road test are applied. The sensor faults, which either actually happened during the road test or are injected during off-line test, are considered. The size of the generated fault is chosen based on the real sensor fault size. It is shown that the FDI system can accurately diagnose each single sensor fault and subsequently output fault-free estimated states from its fault management system.Future work would consider several problems which have not been handled by the designed system in this paper.(1)
The designed FDI system can detect and isolate only a single sensor fault at each time. But it is possible to extend the FDI system with extra sensors and residuals to detect and isolate multiple faults [30].(2)
For residual evaluation, in order to reduce false alarms in some sensor faults diagnosis, statistical tests of mean, variance, or theχ2 test shall be applied, instead of the fixed threshold.



---

*Source: 279086-2015-01-31.xml*