# Fault Detection, Isolation, and Accommodation for  LTI Systems Based on GIMC Structure

Authors: D. U. Campos-Delgado; E. Palacios; D. R. Espinoza-Trejo
Journal: Journal of Control Science and Engineering
 (2008)

---

## Abstract

In this contribution, an active fault-tolerant scheme that achieves fault detection, isolation, and accommodation is developed for LTI systems. Faults and perturbations are considered as additive signals that modify the state or output equations. The accommodation scheme is based on the generalized internal model control architecture recently proposed for fault-tolerant control. In order to improve the performance after a fault, the compensation is considered in two steps according with a fault detection and isolation algorithm. After a fault scenario is detected, a general fault compensator is activated. Finally, once the fault is isolated, a specific compensator is introduced. In this setup, multiple faults could be treated simultaneously since their effect is additive. Design strategies for a nominal condition and under model uncertainty are presented in the paper. In addition, performance indices are also introduced to evaluate the resulting fault-tolerant scheme for detection, isolation, and accommodation. Hard thresholds are suggested for detection and isolation purposes, meanwhile, adaptive ones are considered under model uncertainty to reduce the conservativeness. A complete simulation evaluation is carried out for a DC motor setup.


---

## Body

## 1. Introduction

In the early stages of control applications,
closed-loop performance was the main objective for the control
engineer. To achieve this goal, the implementations of these feedback
configurations involved sensors, actuators, electronic instrumentation, and
signal processors. However, during a normal operation, these parts could fail
in some degree,
and the resulting performance of the closed-loop will be
largely deteriorated, or even instability can be observed. In fact, for some
processes besides performance, safety is also a necessary and important
objective. Therefore, it is desirable to detect these malfunctions to take
proper action in order to avoid a dangerous situation. Nowadays, the advance in
electronics has made possible to have digital signal processors as
microcontrollers, DSP's and FPGA boards that can perform, in real time, very
complex algorithms. Hence this extra processing capacity could be applied to
perform in parallel fault diagnosis strategies to the nominal control schemes.
The problem of fault diagnosis is indeed a challenging one, and its importance
in applications has attracted the attention of the research community in
control theory and signal processing [1–4].In any process, the faults can be classified in two
sets:unrecoverable and recoverable. The unrecoverable ones
represent all faults that cannot be compensated or accommodated while the
system is running. On the other hand, the recoverable faults comprise any fault
whose outcome can still be safely compensated by the control algorithm with a
possible deterioration of performance, but still allowing the necessary
conditions to maintain closed-loop stability. Obviously, this classification
depends on the problem at hand, and requires knowledge about the operation of
the system. From a control point of view, the focus is on the recoverable faults, where a degree of
robustness or reconfigurability in the control scheme is desirable to
accommodate these faults and still preserve closed-loop performance. These
ideas have triggered a research line called fault-tolerant control (FTC) [5–9].FTC can be approached from two perspectives: passive
and active. In the passive approach, the faults are treated as disturbances
into the closed-loop system. As a result, a single controller is designed to
achieve stability and performance against all studied faults. The main drawback
of this scheme is the conservativeness that can be incorporated, however, no
extra complexity in the control implementation is carried out. For LTI systems,
the passive approach can be treated as a simultaneous stabilization or robustℋ∞ design [9].
Meanwhile, for nonlinear systems, a variable structure control (sliding mode)
methodology can be applied [10]. On the other hand, the active approach relies
on a fault diagnosis stage, followed by a controller reconfiguration or
accommodation [6]. Compared to the passive approach, the active one requires
more computational power during implementations, but it can provide less
conservative results and better closed-loop performance after faults.
Applications of the active approach have been suggested for LTI [7, 8, 11, 12], LPV [13, 14], and nonlinear systems [15, 16]. Three major trends are
devised in active FTC according to the required information of the FDI stage as
follows.(A)
Estimate the
faults profiles and update the nominal control law to cancel completely their
effect (fault decoupling). Therefore, this idea requires a reliable
fault isolation and identification scheme.(B)
Design a
compensation signal for the nominal control law that depends on the fault
affecting the system. Hence according to the transfer function from a specific
fault to the output measurements or input control signal (fault signature
transfer matrices), an accommodation control law is designed to reduce its
effect into the closed-loop system. Alternatively, the nominal control law can
be reconfigurated according to the isolated fault, for example, using
reconfigurable control gains under a state-feedback control law. As a result,
these approaches rely on the information from the fault isolation stage to
properly operate.(C)
Switch to a
robust control law that maintains closed-loop stability for a studied set of
faults. In consequence, this scheme depends just on the information of a fault
detection block. However, the post-fault performance can be pretty
conservative.This work looks to extend the ideas initially
presented in [12, 17, 18]. Hence fault detection, isolation, and
accommodation are discussed in a more general framework under the GIMC control
structure for additive faults. The contribution of this paper lies in the
following lines.(i)
A two-step active FTC scheme is proposed for LTI
systems under an additive fault scenario.(ii)
Design strategies are proposed for diagnosis and
accommodation based on general optimization criteria.(iii)
Performance indices are suggested in order to
evaluate the active FTC from a worst-case perspective.(iv)
A complete analysis is introduced for the
synthesis algorithms under model uncertainty. Hard and adaptive thresholds are
provided for detection and isolation purposes.Consequently, the FTC philosophies (B) and (C) are adopted in this work, looking to
reduce the conservativeness in the post-fault performance, but avoiding the
necessity of fault identification. The paper is structured as follows. Section2 describes the problem
formulation. The FTC scheme is presented in Section
3.
First, the general methodology is introduced, and the design criteria for
diagnostic, isolation, and accommodation are detailed next.
Section 4 analyzes
the effect of model uncertainty in the FTC scheme.
Finally, Section 5 presents
an illustrative example, and Section 6 gives some concluding remarks.


## 2. Problem Formulation

The problem addressed in this paper is fault
detection, isolation, and accommodation for LTI systems under additive faults
and perturbations. In this way, consider a systemP(s) affected by
disturbances d∈ℝr and possible
faults f∈ℝl, as shown in Figure 1, described by
(1)P(s){x˙=Ax+Bu+F1f+E1d,y=Cx+Du+F2f+E2d,
where x∈ℝn represents the
vector of states, u∈ℝm the vector of
inputs, and y∈ℝp the vector of
outputs. Thus matrix F1∈ℝn×l stands for the
distribution matrix of the actuator or system faults, and F2∈ℝp×l for sensor
faults. Denote as F1i∈ℝn and F2i∈ℝp with i=1,…,l the columns of
the fault signature matrices F1 and F2, respectively, that is,
(2)F1=[F11⋯F1l],F2=[F21⋯F2l].
Thus matrices (F1i,F2i) will represent
the signature of the ith component fi in the fault
vector f. The nominal system (A,B,C,D) is considered
controllable and observable. On the other hand, the system response y can be analyzed
in a transfer matrix form (frequency domain) as follows:
(3)y(s)=Puyu(s)+Pfyf(s)+Pdyd(s),
where
(4)Puy=C(sI−A)−1B+D,Pdy=C(sI−A)−1E1+E2,Pfy=C(sI−A)−1F1+F2.
A left coprime
factorization for each transfer matrix can be derived by obtaining matrix L∈ℝn×p such that ℜ{λi(A+LC)}<0 [19, 20], as
it is shown next:
(5)[NMNdNf]=[A+LCB+LDLE1+LE2F1+LF2CDIE2F2].
Consequently,
the LTI systems in (4) can be written as
(6)Puy=M−1N,Pdy=M−1Nd,Pfy=M−1Nf,
where M,N,Nd,Nf∈ℛℋ∞. An initial question about the fault diagnosis and
isolation process relies on the necessary conditions to achieve this objective,
hence the condition originally presented in [1, 4] are assumed as
follows:Figure 1
Problem formulation for control.(1)
for isolation
of the fault vectorf,
(7)rank([F1F2])=l;(2)
for the
simultaneous isolation of faults under unknown perturbations,(8)normrank([NdNf])≥normrank(Nd)+l,
where normrank stands for the
normal rank of the corresponding transfer matrix [20].Now, it is
assumed that a nominal controllerK stabilizes the
nominal plant Puy, and it provides a desired closed-loop performance in
terms of robustness, transient, and steady-state responses. The controller K is considered
observable, and consequently, it can also be expressed by a left coprime
factorization, that is, K=V−1U where U,V∈ℛℋ∞,
(9)K=[AkBkCkDk]⟹[UV]=[Ak+LkCkBk+LkDkLkCkDkI].
The nominal
controller can be synthesized following classical techniques or optimal control:
lead/lag compensator, PI, PID, LQG/ℋ2, ℋ∞ loop shaping
design, and so on. Consequently, the control objective is presented as follows. Design an active fault-tolerant
scheme such that it detects and isolates the occurrence of a fault in the
closed-loop system, and provides an appropriate compensation signalqto the
controller in order to maintain closed-loop performance (see Figure 1).Remark 1.
The problem formulation in (1) assumes no
previous knowledge of the time profiles of the fault components fi i=1,…,l. Thus the fault vector f is modeled as
an unknown exogenous input for the system P(s). However, if explicit knowledge about the faults time
profiles is available, then this information can be incorporated at the FDI
stage to improve the residual design and evaluation. Nonetheless, the
fault-accommodation scheme presented in the next section is consistent with
this assumption, and it does not require an explicit identification of the
faults affecting the system. Furthermore, the additive faults representation in
(1)
might be able to describe some common faults that cause changes on system
parameters or loss of effectiveness in actuators, but in those cases, the
faults time profiles will be related to states or control inputs (as it will be
shown in Section 5).The definition of the following system performance
indexes will be very important for the synthesis and analysis of the fault
detection, isolation, and accommodation algorithms [19–21]:
(10)∥G∥1=max⁡1≤i≤n∑j=1m∫0∞|gij(t)|dt,∥G∥2=12π∫−∞∞Trace{G*(jω)G(jω)}dω,G∈ℛℋ2,∥G∥∞=sup⁡ω∈ℝσ¯(G(jω)),G∈ℛℋ∞,∥G∥−=inf⁡ω∈ℝσ¯(G(jω)),∥G∥−[ω1,ω2]=inf⁡ω∈[ω1,ω2]σ¯(G(jω)),0≤ω1<ω2<∞,
where G is a n×m Hurwitz matrix
transfer function, and gij(t)=ℒ−1{Gij(s)} (1≤i≤n,1≤j≤m) are the
impulse responses corresponding to every component in the transfer matrix G. The next inequalities will be useful to derive
thresholds for residual evaluation:
(11)∥y∥∞≤∥G∥1∥u∥∞,∥y∥2≤∥G∥∞∥u∥2,
where y=Gu, the signal norms are defined as
(12)∥y∥∞=sup⁡t∈[0,∞)∥y(t)∥,∥y∥2=∫0∞∥y(t)∥2dt,
and ∥⋅∥ denotes the
Euclidean norm.


## 3. Fault-Tolerant Control Scheme

The proposed FTC scheme relies on a fault diagnosis
and isolation (FDI) algorithm, followed by a fault accommodation into the
nominal controller. For LTI systems and additive faults, several FTC control
structures have been suggested [12, 22–24] departing from the Youla
parametrization of all stabilizing controllers [20]. In this configuration, a
free parameter Q∈ℛℋ∞ is selected to
achieve the fault compensation, with the assurance that closed-loop stability
is achieved after the fault accommodation. In this fashion, the accommodation
scheme adopted in this work is motivated by a new implementation of the Youla
parametrization called generalized
internal model control (GIMC) [7, 12]. In this configuration, the nominal
controller K is represented
by its left coprime factorization, that is, K=V−1U. In addition, the GIMC configuration allows to
perform the FDI process and accommodation in the same structure, where these
two processes are carried out by selecting two design parameters Q,H∈ℛℋ∞ (see Figure 2).
Consequently, the residual r is generated by
selecting the detection/isolation filter H, and the accommodation signal q by the
compensator Q, using the filtered signal fe with the
following criteria.Figure 2
GIMC with
additive perturbations and faults.(1)
H(s): the fault detection/isolation filter must diminish
the effect of the disturbances or uncertainty into the residual signal, and
maximize the effect of the faults.(2)
Q(s): the robustification controller must provide
robustness into the closed-loop system in order to maintain acceptable
performance against faults.


### 3.1. Fault Detection and Isolation

From Figure2, it can be observed that fe∈Rp contains
information of perturbations d and faults f as follows:
(13)fe(s)=−Ndd(s)−Nff(s).
Hence a
residual r is naturally
constructed by using the information of the coprime factorization of the
nominal plant through fe [1];
(14)r(s)=−Hfe(s)=H[Ndd(s)+Nff(s)].
In order to
improve the accuracy of the FDI stage, it is proposed to carry out this task in
two consecutive steps: (a) first, fault detection, and next, (b) fault
isolation. This idea is also appealing for fault accommodation, and its
benefits will be explained in the next section. As a result, the FDI algorithm
is designed in two parts as follows.(1)
A detection
filterHD is first
synthesized to determine a general fault scenario.(2)
Next, an
isolation filterHI is computed to
identify the faults affecting the system. First, the
detection filter HD is constructed
to obtain a scalar residual, that is, HD is a 1×p transfer matrix
such that it attenuates the contribution from the perturbations d while maximizing
the faults f effect. Hence
the following design criteria are suggested:
(15)sup⁡HD∈ℛℋ∞∥HDNf∥k∥HDNd∥jorsup⁡HD∈ℛℋ∞∥HDNf∥ks.t.⁢∥HDNd∥j≤γ,
where γ>0 denotes a
desired attenuation factor for the unknown perturbations contribution, and k,j represent the
performance indexes in (10).
In [21, 25], the previous multiobjective
optimizations have been studied where optimal and approximation solutions are
provided. Alternatively, the ∞/∞ and 2/2 optimizations can
be solved using well-known algorithms through a characterization by a linear
fractional transformation (LFT) [20];
(16)min⁡HD∈ℛℋ∞‖[0h]−HD[NdNf]‖j=min⁡HD∈ℛℋ∞‖Fl(GHD,HD)‖j,j=2,∞,
where h∈ℛℋ∞ is a 1×l transfer matrix
that describes the faults frequency bandwidth, Fl(⋅,⋅) represents a
lower LFT [20], and GHD the generalized
plant (see Figure 3) given by
(17)GHD=[0h−1NdNf0]. One
advantage of the LFT characterization is that it can be augmented to include
model uncertainty in the problem formulation. Meanwhile, the isolation filter HI (l×p transfer
matrix) is designed to isolate the fault vector f and decouple
the perturbations d, that is,Figure 3
LFT formulation
for detection filterHD.(i)
HINd(s)≈0,(ii)
HINf(s)≈T,
where T∈ℛℋ∞ is a diagonal
transfer matrix. Transfer matrix T is a design
parameter, and it should be chosen according to the frequency response of Nf, in order to achieve the isolation and decoupling
objectives. Nevertheless, nonminimum phase zeros of Nf could limit the
resulting performance [26]. Once more, the design criterion can be proposed by
combining both objectives measured by a system norm j=2,∞ as follows:
(18)min⁡HI∈ℛℋ∞‖[0T]−HI[NdNf]‖j=min⁡HI∈ℛℋ∞‖Fl(GHI,HI)‖j,
where GHI stands for the
generalized plant associated to the LFT formulation given by
(19)GHI=[0T−INdNf0].
Hence once a
fault is detected, in the isolation stage, the filter HI has to provide
a good estimate of the fault affecting the system. Therefore, it is fundamental
that HI could render
diagonally the product HINf, or at least diagonally dominant. In fact, this issue
has to be verified after HI is designed for
a correct fault identification.Remark 2.
Assumptions
(7)
and (8)
about the rank properties of the perturbations and faults transfer
matrices provide necessary conditions to achieve the decoupling objective.
Therefore, it is expected that the optimal filters obtained through (16) and
(18) will guarantee
good fault detection and isolation properties of the
residuals.Now, perfect disturbance decoupling is hard to achieve
in a general scenario. As a result, the residuals will not be zero in a
fault-free condition. Two possible techniques can be followed in order to
detect a fault: hard or adaptive thresholds [3, 27, 28]. Since the
perturbations are considered unknown and no uncertainty is assumed at this
stage, hard thresholds are adopted. Departing from the signal norms in
(12), a windowed
residual evaluation criteria can be chosen as follows:
(20)∥r∥=∥r∥2,t,To=∫t−Tot∥r(τ)∥dτ,(21)∥r∥=∥r∥∞,t,To=sup⁡t−To≤τ≤t∥r∥,
where To is the window
length or evaluation horizon. Hence to avoid a false alarm in the evaluation
due to perturbations [27], a threshold value is selected such that
(22)Jth=sup⁡f=0,∀d∥r∥
in the case of
the windowed 2 norm, and considering bounded energy perturbations, that is, ∥d∥2,t,To<γ2d, then an initial detection threshold can be
calculated by applying (11) as
(23)JthD=γ2d∥HDNd∥∞.
On the other
hand, if the perturbations are now assumed bounded for all time, that is, ∥d∥∞<γ∞d, then a new detection threshold can be employed as
follows:
(24)JthD=γ∞d∥HDNd∥1.
The hard
thresholds in (23)
and (24) are conservative
starting values since they are
derived from the norms inequalities in
(11). Nevertheless, they have to be
adjusted online for proper fault detection. Now, with respect to the isolation
stage, a hard threshold has to be obtained for each output of the filter HI that represents
the estimated fault. However, if the product HINf is not
diagonal, then each output is affected at some degree by all faults and
perturbations. Assuming that the ith output is
evaluated, then the following thresholds are proposed:
(25)JthIi=∑j=1j≠il∥[HINf]ij∥∞γ2i+∑k=1r∥[HINd]ik∥∞γ2d,
or
(26)JthIi=∑j=1j≠il∥[HINf]ij∥1γ∞i+∑k=1r∥[HINd]ik∥1γ∞d,
where i=1,…,l, [⋅]ij denotes the ij term in the
transfer matrix, ∥fi∥2,t,To<γ2i, and ∥fi∥∞<γ∞i. Consequently, some information about the energy or
time upper-bound on each fault is necessary to compute (25) and (26). Once more, it is
important to point out that (25) and (26) are just starting values for the
threshold selection during the residual evaluation, since they rely on
inequalities that involve some inherit conservativeness.


### 3.2. Fault Accommodation

In order to derive the fault accommodation scheme, the
effect of the compensation signalq in the GIMC
structure of Figure 2 is analyzed. Define the
following nominal closed-loop
transfer matrices:(i)
input sensitivity:Si≜(I+KPuy)−1,(ii)
output sensitivity:So≜(I+PuyK)−1,(iii)
complementary output sensitivity:To≜I−So=(I+PuyK)−1PuyK.The next lemma originally presented in [17]
characterizes the dynamic behavior of the compensated control input u and output y of the
closed-loop system.Lemma.
In
the GIMC configuration of Figure2 considering additive faults, the resulting
closed-loop characteristics for the control signal u and output y are given by
(27)u(s)=SiK⁢ref(s)−SiV−1(UM−1+Q)(Ndd(s)+Nff(s)),y(s)=To⁢ref(s)+SoM−1(I−NV−1Q)(Ndd(s)+Nff(s)).
The resulting
closed-loop
system is stable, provided that Q∈ℛℋ∞, since the nominal controller K internally
stabilizes the nominal plant Puy (proof in
Appendix B).By a simple inspection of (27),
two results
can be concluded by considering the complete decoupling of perturbations d and faults f from the
control input u and output y of the
system.Corollary 1 (see [17]).
If the nominal plantPuy∈ℛℋ∞, then M−1∈ℛℋ∞, and the complete disturbance and fault decoupling
can be achieved at the control signal u by letting Q=−UM−1∈ℛℋ∞. As a result, it is obtained that
(28)u(s)=SiK⁢ref(s),(29)y(s)=To⁢ref⁢(s)+M−1(Ndd(s)+Nff(s)).Therefore, if
the nominal plantPuy is stable by
properly choosing the compensator Q, the control signal is not affected by faults and
perturbations. The compensation suggested in Corollary
1 is particularly useful
under a sensor fault scenario [24]
since it is not desirable to adjust the
control signal dynamics against erroneous information given by a sensor. Note
that from (29), perturbations
and faults are decoupled from the closed-loop
feedback dynamics since they appear in an open-loop fashion at the output.
However, the perturbations are affecting the outputs with a feedforward
structure, which is an undesirable effect of this compensation. Consequently,
as it was suggested in [18], if some estimation of the perturbations d^ could be
deduced by steady-state relations of the system or by an observer using
state-augmentation, the compensation q could
incorporate this new information to improve the closed-loop performance. In
general, if the FDI stage could provide a reliable identification of the fault
vector f^, then this estimation can be also applied under the
compensation suggested in Corollary 1
to decouple the faults from the
closed-loop system. The compensation including perturbations and faults
estimations will be given by
(30)q(s)=−UM−1[Nu(s)+Ndd^(s)+Nff^(s)−My(s)],
and the
resulting output dynamics are given now by
(31)y(s)=To⁢ref(s)+M−1[Nd{d(s)−d^(s)}+Nf{f(s)−f^(s)}].
Therefore, the
accuracy in the perturbations and faults estimations (d(s)−d^(s) and f(s)−f^(s)) will dictate
the resulting performance deterioration. However, in a practical scenario, it
is difficult to have these estimations available or to have a stable plant.
Hence it is important that the compensator Q could
simultaneously attenuate perturbations and faults into the closed-loop system.
On the other hand, if Puy has also a
stable inverse, a complete output decoupling for perturbations and faults can
be achieved.Corollary 2 (see [17]).
If
the nominal plant satisfiesPuy,Puy−1∈ℛℋ∞, then N−1∈ℛℋ∞ and with Q=VN−1∈ℛℋ∞, the resulting output is decoupled perfectly from the
perturbations and faults, that is,
(32)u(s)=SiK⁢ref(s)−N−1(Ndd(s)+Nff(s)),y(s)=To⁢ref(s).Note that the
compensation proposed in Corollary2
is particularly useful for an actuator or
system fault, since the output is perfectly decoupled from faults and
perturbations. However, it should be avoided in a sensor fault scenario. In
fact, the decoupling conditions of Corollaries 1 and 2 could be
very restrictive. For
this reason, by analyzing (27),
if it is desired to minimize the
faults effect at the control signal, while reducing the perturbations
contribution at the output, the compensator Q should be
designed by following the optimization strategy
(33)min⁡Q∈ℛℋ∞∥[Z1Z2]∥j=min⁡Q∈ℛℋ∞∥[Z3Z4]∥j,
where
(34)Z1=αdSoM−1(I−NV−1Q)Nd,Z2=−αfSiV−1(UM−1+Q)Nf,Z3=αdSo(Pdy−PuyV−1QNd),Z4=−αfSi(KPfy+V−1QNf),j represents the ℋ2 or ℋ∞ norms in (10), αd,αf∈[0,1] are two
weighting factors to balance the tradeoff between perturbations and faults
reduction, and the normalized coprime factors relations in (6) are applied.
However, the optimization problem in (33)
cannot be solved using standard
robust control algorithms [19, 20]. Therefore, it is proposed to extend the cost
function to have a feasible problem as follows:
(35)min⁡Q∈ℛℋ∞‖[αdSoPdy00−αfSiKPfy]+[−αdSoPuyV−1−αfSiV−1]Q[NdNf]‖j=min⁡Q∈ℛℋ∞‖Fl(GQu,Q)‖j,
where GQu represents the
generalized plant (see Figure 4) given by
(36)GQu=[αdSoPdy0−αdSoPuyV−10−αfSiKPfy−αfSiV−1NdNf0].
Meanwhile, if
it is desired to attenuate both faults and perturbations at the output y, then the next optimization scheme is suggested:
(37)min⁡Q∈ℛℋ∞‖SoM−1(I−NV−1Q)[αdNdαfNf]‖j=min⁡Q∈ℛℋ∞‖Fl⁢(GQy,Q)‖j,
where GQy is given by
(38)GQy=[αdSoPdyαfSoPfy−SoPuyV−1αdNdαfNf0].LFT
formulations for compensator Q: (a) Control signal and output attenuation, and
(b) output signal attenuation.
(a)(b)Remark 3.
The optimization criteria forQ in (35) and
(37) can be interpreted
as approximation or normalization problems with certain
postweighting and preweighting given by the frequency content of the
perturbations Nd or faults Nf. In fact, (35) introduces
a combined optimization:
(i) a normalization process of NV−1 by Q with a
frequency postweighting given by the nominal output sensitivity So and M−1, and (ii) an approximation problem to −UM−1 with a
frequency postweighting given by the nominal input sensitivity Si and V−1.Remark 4.
Note that the compensatorsQ designed by the
criteria in (35)
and (37) can be
conservative since it is required to attenuate
the effect of all types of faults analyzed in (1), and it is also assumed that all of them have the same structure.To improve the
post-fault performance, it is then proposed to design specific compensatorsQi∈ℛℋ∞ for i=1,…,l for every
studied fault, depending if their effect is on the state (actuator or
system faults) or the output (sensor faults) equations in (1), using
the previous optimization algorithms as follows:(i)actuator or system faults:
(39)min⁡Qi∈ℛℋ∞‖SoM−1(I−NV−1Qi)[αdNdαfNfi]‖j;(ii)sensor faults:
(40)min⁡Qi∈ℛℋ∞‖[αdSoPdy00−αfSiKPfyi]+[−αdSoPuyV−1−αfSiV−1]Qi[NdNfi]‖j,
where
(41)Nfi=[A+LCF1i+LF2iCF2i]
and Pfyi=M−1Nfi. In this way, the fault accommodation scheme
of Figure 5 is proposed, and the overall active FTC algorithm consists of three
stages according to the information of the FDI block as follows:Figure 5
GIMC accommodation setup.(1)
in the
fault-free case, just the nominal control loop is active;(2)
after a fault
scenario is detected into the system, a general compensatorQ designed by
(35) is activated;(3)
finally, after
the fault is classified and isolated, an specific compensatorQi designed by
(39) or (40) is selected.
In a general
fault condition, it is then decided to decouple (if possible) or attenuate the
effect of faults at the control signal u, until the fault is well-characterized during the
isolation stage. As a result, after the fault is isolated, the specific
compensation is injected into the closed-loop configuration to improve the
postfault performance.Remark 5.
Since the
fault accommodation is based on the Youla parametrization, and since the faults
are additive, the closed-loop stability after each reconfiguration is
guaranteed, provided thatQ,Qi∈ℛℋ∞, and any nonlinear behavior
is avoided into the closed-loop
system, like saturations, rate limiters, and so on. However, if the fault
profile depends on the states or outputs then closed-loop stability could not
be assured after all.Remark 6.
In the proposed configuration, multiple and
intermittent faults could be handled. Once they are identified by the FDI
scheme, the corresponding compensator should be activated to perform its
accommodation. However, if FDI algorithm detects that the fault is no longer
present, the compensation is removed.


### 3.3. Performance Evaluation

One important question, after the design stage is
completed, is the resulting performance of the fault detection, isolation and
accommodation algorithms. To address this problem, different quantification
indices will be proposed using the system performance indexes in
(10) of the
resulting transfer functions. The selection of the applied performance index in
(10) will depend on
the a priori faults information, for example, the faults
frequency content, or the desired interpretation of the quantification index,
for example, the worst case condition in the evaluation. The next indices are
motivated from the optimization algorithms used for synthesis in the previous
sections.(1)Fault evaluation. The capability of the
detection filter HD of reducing the
perturbations frequency content compared to increasing the faults sensitivity
is evaluated by
(42)IFD≜∥HDNf∥k∥HDNd∥j.
Hence a large
value of IFD will indicate
good evaluation characteristics.(2)Fault isolation. This index is constructed
by analyzing the property of HI of
diagonalizing Nf while
attenuating the disturbances frequency content:
(43)IFI≜∥[HINf]diag∥k∥[HINf]nondiag∥k+∥HINd∥j,
where [⋅]diag denotes the
diagonal part of the transfer matrix, and [⋅]nondiag the off
diagonal structure. In fact, IFI is usually
denoted as signal-to-noise and interference ratio (SNIR) in the signal
processing community. Thus if IFI is large, then
fault isolation can be achieved.(3)Fault accommodation. The fault
accommodation is quantified in terms of the property of reducing the effect of
faults and perturbations simultaneously into the closed-loop system. The
accommodation performance criteria is defined for the ith fault fi as
(44)IFAi≜αf‖WAiNfi‖k+αd‖SoM−1(I−NV−1Qi)Nd‖j,
where the
weighting WAi is selected
according to the fault effect:
(45)WAi≜{SoM−1(I−NV−1Qi)actuator/systemfault,SiV−1(UM−1+Qi)sensorfault,
where (αd,αf) are the
positive weighting factors to judge the importance of perturbations or faults
attenuation. Now, a small value of IFAi will indicate
good fault accommodation. Note that this value is related to a worst-case
performance degradation level expected in the FTC scheme [29].The overall synthesis algorithms for fault detection,
isolation, and accommodation including performance evaluation are described in
AppendixA. The synthesis procedure includes samples of MATLAB commands that
could be used for numerical calculations.


## 3.1. Fault Detection and Isolation

From Figure2, it can be observed that fe∈Rp contains
information of perturbations d and faults f as follows:
(13)fe(s)=−Ndd(s)−Nff(s).
Hence a
residual r is naturally
constructed by using the information of the coprime factorization of the
nominal plant through fe [1];
(14)r(s)=−Hfe(s)=H[Ndd(s)+Nff(s)].
In order to
improve the accuracy of the FDI stage, it is proposed to carry out this task in
two consecutive steps: (a) first, fault detection, and next, (b) fault
isolation. This idea is also appealing for fault accommodation, and its
benefits will be explained in the next section. As a result, the FDI algorithm
is designed in two parts as follows.(1)
A detection
filterHD is first
synthesized to determine a general fault scenario.(2)
Next, an
isolation filterHI is computed to
identify the faults affecting the system. First, the
detection filter HD is constructed
to obtain a scalar residual, that is, HD is a 1×p transfer matrix
such that it attenuates the contribution from the perturbations d while maximizing
the faults f effect. Hence
the following design criteria are suggested:
(15)sup⁡HD∈ℛℋ∞∥HDNf∥k∥HDNd∥jorsup⁡HD∈ℛℋ∞∥HDNf∥ks.t.⁢∥HDNd∥j≤γ,
where γ>0 denotes a
desired attenuation factor for the unknown perturbations contribution, and k,j represent the
performance indexes in (10).
In [21, 25], the previous multiobjective
optimizations have been studied where optimal and approximation solutions are
provided. Alternatively, the ∞/∞ and 2/2 optimizations can
be solved using well-known algorithms through a characterization by a linear
fractional transformation (LFT) [20];
(16)min⁡HD∈ℛℋ∞‖[0h]−HD[NdNf]‖j=min⁡HD∈ℛℋ∞‖Fl(GHD,HD)‖j,j=2,∞,
where h∈ℛℋ∞ is a 1×l transfer matrix
that describes the faults frequency bandwidth, Fl(⋅,⋅) represents a
lower LFT [20], and GHD the generalized
plant (see Figure 3) given by
(17)GHD=[0h−1NdNf0]. One
advantage of the LFT characterization is that it can be augmented to include
model uncertainty in the problem formulation. Meanwhile, the isolation filter HI (l×p transfer
matrix) is designed to isolate the fault vector f and decouple
the perturbations d, that is,Figure 3
LFT formulation
for detection filterHD.(i)
HINd(s)≈0,(ii)
HINf(s)≈T,
where T∈ℛℋ∞ is a diagonal
transfer matrix. Transfer matrix T is a design
parameter, and it should be chosen according to the frequency response of Nf, in order to achieve the isolation and decoupling
objectives. Nevertheless, nonminimum phase zeros of Nf could limit the
resulting performance [26]. Once more, the design criterion can be proposed by
combining both objectives measured by a system norm j=2,∞ as follows:
(18)min⁡HI∈ℛℋ∞‖[0T]−HI[NdNf]‖j=min⁡HI∈ℛℋ∞‖Fl(GHI,HI)‖j,
where GHI stands for the
generalized plant associated to the LFT formulation given by
(19)GHI=[0T−INdNf0].
Hence once a
fault is detected, in the isolation stage, the filter HI has to provide
a good estimate of the fault affecting the system. Therefore, it is fundamental
that HI could render
diagonally the product HINf, or at least diagonally dominant. In fact, this issue
has to be verified after HI is designed for
a correct fault identification.Remark 2.
Assumptions
(7)
and (8)
about the rank properties of the perturbations and faults transfer
matrices provide necessary conditions to achieve the decoupling objective.
Therefore, it is expected that the optimal filters obtained through (16) and
(18) will guarantee
good fault detection and isolation properties of the
residuals.Now, perfect disturbance decoupling is hard to achieve
in a general scenario. As a result, the residuals will not be zero in a
fault-free condition. Two possible techniques can be followed in order to
detect a fault: hard or adaptive thresholds [3, 27, 28]. Since the
perturbations are considered unknown and no uncertainty is assumed at this
stage, hard thresholds are adopted. Departing from the signal norms in
(12), a windowed
residual evaluation criteria can be chosen as follows:
(20)∥r∥=∥r∥2,t,To=∫t−Tot∥r(τ)∥dτ,(21)∥r∥=∥r∥∞,t,To=sup⁡t−To≤τ≤t∥r∥,
where To is the window
length or evaluation horizon. Hence to avoid a false alarm in the evaluation
due to perturbations [27], a threshold value is selected such that
(22)Jth=sup⁡f=0,∀d∥r∥
in the case of
the windowed 2 norm, and considering bounded energy perturbations, that is, ∥d∥2,t,To<γ2d, then an initial detection threshold can be
calculated by applying (11) as
(23)JthD=γ2d∥HDNd∥∞.
On the other
hand, if the perturbations are now assumed bounded for all time, that is, ∥d∥∞<γ∞d, then a new detection threshold can be employed as
follows:
(24)JthD=γ∞d∥HDNd∥1.
The hard
thresholds in (23)
and (24) are conservative
starting values since they are
derived from the norms inequalities in
(11). Nevertheless, they have to be
adjusted online for proper fault detection. Now, with respect to the isolation
stage, a hard threshold has to be obtained for each output of the filter HI that represents
the estimated fault. However, if the product HINf is not
diagonal, then each output is affected at some degree by all faults and
perturbations. Assuming that the ith output is
evaluated, then the following thresholds are proposed:
(25)JthIi=∑j=1j≠il∥[HINf]ij∥∞γ2i+∑k=1r∥[HINd]ik∥∞γ2d,
or
(26)JthIi=∑j=1j≠il∥[HINf]ij∥1γ∞i+∑k=1r∥[HINd]ik∥1γ∞d,
where i=1,…,l, [⋅]ij denotes the ij term in the
transfer matrix, ∥fi∥2,t,To<γ2i, and ∥fi∥∞<γ∞i. Consequently, some information about the energy or
time upper-bound on each fault is necessary to compute (25) and (26). Once more, it is
important to point out that (25) and (26) are just starting values for the
threshold selection during the residual evaluation, since they rely on
inequalities that involve some inherit conservativeness.


## 3.2. Fault Accommodation

In order to derive the fault accommodation scheme, the
effect of the compensation signalq in the GIMC
structure of Figure 2 is analyzed. Define the
following nominal closed-loop
transfer matrices:(i)
input sensitivity:Si≜(I+KPuy)−1,(ii)
output sensitivity:So≜(I+PuyK)−1,(iii)
complementary output sensitivity:To≜I−So=(I+PuyK)−1PuyK.The next lemma originally presented in [17]
characterizes the dynamic behavior of the compensated control input u and output y of the
closed-loop system.Lemma.
In
the GIMC configuration of Figure2 considering additive faults, the resulting
closed-loop characteristics for the control signal u and output y are given by
(27)u(s)=SiK⁢ref(s)−SiV−1(UM−1+Q)(Ndd(s)+Nff(s)),y(s)=To⁢ref(s)+SoM−1(I−NV−1Q)(Ndd(s)+Nff(s)).
The resulting
closed-loop
system is stable, provided that Q∈ℛℋ∞, since the nominal controller K internally
stabilizes the nominal plant Puy (proof in
Appendix B).By a simple inspection of (27),
two results
can be concluded by considering the complete decoupling of perturbations d and faults f from the
control input u and output y of the
system.Corollary 1 (see [17]).
If the nominal plantPuy∈ℛℋ∞, then M−1∈ℛℋ∞, and the complete disturbance and fault decoupling
can be achieved at the control signal u by letting Q=−UM−1∈ℛℋ∞. As a result, it is obtained that
(28)u(s)=SiK⁢ref(s),(29)y(s)=To⁢ref⁢(s)+M−1(Ndd(s)+Nff(s)).Therefore, if
the nominal plantPuy is stable by
properly choosing the compensator Q, the control signal is not affected by faults and
perturbations. The compensation suggested in Corollary
1 is particularly useful
under a sensor fault scenario [24]
since it is not desirable to adjust the
control signal dynamics against erroneous information given by a sensor. Note
that from (29), perturbations
and faults are decoupled from the closed-loop
feedback dynamics since they appear in an open-loop fashion at the output.
However, the perturbations are affecting the outputs with a feedforward
structure, which is an undesirable effect of this compensation. Consequently,
as it was suggested in [18], if some estimation of the perturbations d^ could be
deduced by steady-state relations of the system or by an observer using
state-augmentation, the compensation q could
incorporate this new information to improve the closed-loop performance. In
general, if the FDI stage could provide a reliable identification of the fault
vector f^, then this estimation can be also applied under the
compensation suggested in Corollary 1
to decouple the faults from the
closed-loop system. The compensation including perturbations and faults
estimations will be given by
(30)q(s)=−UM−1[Nu(s)+Ndd^(s)+Nff^(s)−My(s)],
and the
resulting output dynamics are given now by
(31)y(s)=To⁢ref(s)+M−1[Nd{d(s)−d^(s)}+Nf{f(s)−f^(s)}].
Therefore, the
accuracy in the perturbations and faults estimations (d(s)−d^(s) and f(s)−f^(s)) will dictate
the resulting performance deterioration. However, in a practical scenario, it
is difficult to have these estimations available or to have a stable plant.
Hence it is important that the compensator Q could
simultaneously attenuate perturbations and faults into the closed-loop system.
On the other hand, if Puy has also a
stable inverse, a complete output decoupling for perturbations and faults can
be achieved.Corollary 2 (see [17]).
If
the nominal plant satisfiesPuy,Puy−1∈ℛℋ∞, then N−1∈ℛℋ∞ and with Q=VN−1∈ℛℋ∞, the resulting output is decoupled perfectly from the
perturbations and faults, that is,
(32)u(s)=SiK⁢ref(s)−N−1(Ndd(s)+Nff(s)),y(s)=To⁢ref(s).Note that the
compensation proposed in Corollary2
is particularly useful for an actuator or
system fault, since the output is perfectly decoupled from faults and
perturbations. However, it should be avoided in a sensor fault scenario. In
fact, the decoupling conditions of Corollaries 1 and 2 could be
very restrictive. For
this reason, by analyzing (27),
if it is desired to minimize the
faults effect at the control signal, while reducing the perturbations
contribution at the output, the compensator Q should be
designed by following the optimization strategy
(33)min⁡Q∈ℛℋ∞∥[Z1Z2]∥j=min⁡Q∈ℛℋ∞∥[Z3Z4]∥j,
where
(34)Z1=αdSoM−1(I−NV−1Q)Nd,Z2=−αfSiV−1(UM−1+Q)Nf,Z3=αdSo(Pdy−PuyV−1QNd),Z4=−αfSi(KPfy+V−1QNf),j represents the ℋ2 or ℋ∞ norms in (10), αd,αf∈[0,1] are two
weighting factors to balance the tradeoff between perturbations and faults
reduction, and the normalized coprime factors relations in (6) are applied.
However, the optimization problem in (33)
cannot be solved using standard
robust control algorithms [19, 20]. Therefore, it is proposed to extend the cost
function to have a feasible problem as follows:
(35)min⁡Q∈ℛℋ∞‖[αdSoPdy00−αfSiKPfy]+[−αdSoPuyV−1−αfSiV−1]Q[NdNf]‖j=min⁡Q∈ℛℋ∞‖Fl(GQu,Q)‖j,
where GQu represents the
generalized plant (see Figure 4) given by
(36)GQu=[αdSoPdy0−αdSoPuyV−10−αfSiKPfy−αfSiV−1NdNf0].
Meanwhile, if
it is desired to attenuate both faults and perturbations at the output y, then the next optimization scheme is suggested:
(37)min⁡Q∈ℛℋ∞‖SoM−1(I−NV−1Q)[αdNdαfNf]‖j=min⁡Q∈ℛℋ∞‖Fl⁢(GQy,Q)‖j,
where GQy is given by
(38)GQy=[αdSoPdyαfSoPfy−SoPuyV−1αdNdαfNf0].LFT
formulations for compensator Q: (a) Control signal and output attenuation, and
(b) output signal attenuation.
(a)(b)Remark 3.
The optimization criteria forQ in (35) and
(37) can be interpreted
as approximation or normalization problems with certain
postweighting and preweighting given by the frequency content of the
perturbations Nd or faults Nf. In fact, (35) introduces
a combined optimization:
(i) a normalization process of NV−1 by Q with a
frequency postweighting given by the nominal output sensitivity So and M−1, and (ii) an approximation problem to −UM−1 with a
frequency postweighting given by the nominal input sensitivity Si and V−1.Remark 4.
Note that the compensatorsQ designed by the
criteria in (35)
and (37) can be
conservative since it is required to attenuate
the effect of all types of faults analyzed in (1), and it is also assumed that all of them have the same structure.To improve the
post-fault performance, it is then proposed to design specific compensatorsQi∈ℛℋ∞ for i=1,…,l for every
studied fault, depending if their effect is on the state (actuator or
system faults) or the output (sensor faults) equations in (1), using
the previous optimization algorithms as follows:(i)actuator or system faults:
(39)min⁡Qi∈ℛℋ∞‖SoM−1(I−NV−1Qi)[αdNdαfNfi]‖j;(ii)sensor faults:
(40)min⁡Qi∈ℛℋ∞‖[αdSoPdy00−αfSiKPfyi]+[−αdSoPuyV−1−αfSiV−1]Qi[NdNfi]‖j,
where
(41)Nfi=[A+LCF1i+LF2iCF2i]
and Pfyi=M−1Nfi. In this way, the fault accommodation scheme
of Figure 5 is proposed, and the overall active FTC algorithm consists of three
stages according to the information of the FDI block as follows:Figure 5
GIMC accommodation setup.(1)
in the
fault-free case, just the nominal control loop is active;(2)
after a fault
scenario is detected into the system, a general compensatorQ designed by
(35) is activated;(3)
finally, after
the fault is classified and isolated, an specific compensatorQi designed by
(39) or (40) is selected.
In a general
fault condition, it is then decided to decouple (if possible) or attenuate the
effect of faults at the control signal u, until the fault is well-characterized during the
isolation stage. As a result, after the fault is isolated, the specific
compensation is injected into the closed-loop configuration to improve the
postfault performance.Remark 5.
Since the
fault accommodation is based on the Youla parametrization, and since the faults
are additive, the closed-loop stability after each reconfiguration is
guaranteed, provided thatQ,Qi∈ℛℋ∞, and any nonlinear behavior
is avoided into the closed-loop
system, like saturations, rate limiters, and so on. However, if the fault
profile depends on the states or outputs then closed-loop stability could not
be assured after all.Remark 6.
In the proposed configuration, multiple and
intermittent faults could be handled. Once they are identified by the FDI
scheme, the corresponding compensator should be activated to perform its
accommodation. However, if FDI algorithm detects that the fault is no longer
present, the compensation is removed.


## 3.3. Performance Evaluation

One important question, after the design stage is
completed, is the resulting performance of the fault detection, isolation and
accommodation algorithms. To address this problem, different quantification
indices will be proposed using the system performance indexes in
(10) of the
resulting transfer functions. The selection of the applied performance index in
(10) will depend on
the a priori faults information, for example, the faults
frequency content, or the desired interpretation of the quantification index,
for example, the worst case condition in the evaluation. The next indices are
motivated from the optimization algorithms used for synthesis in the previous
sections.(1)Fault evaluation. The capability of the
detection filter HD of reducing the
perturbations frequency content compared to increasing the faults sensitivity
is evaluated by
(42)IFD≜∥HDNf∥k∥HDNd∥j.
Hence a large
value of IFD will indicate
good evaluation characteristics.(2)Fault isolation. This index is constructed
by analyzing the property of HI of
diagonalizing Nf while
attenuating the disturbances frequency content:
(43)IFI≜∥[HINf]diag∥k∥[HINf]nondiag∥k+∥HINd∥j,
where [⋅]diag denotes the
diagonal part of the transfer matrix, and [⋅]nondiag the off
diagonal structure. In fact, IFI is usually
denoted as signal-to-noise and interference ratio (SNIR) in the signal
processing community. Thus if IFI is large, then
fault isolation can be achieved.(3)Fault accommodation. The fault
accommodation is quantified in terms of the property of reducing the effect of
faults and perturbations simultaneously into the closed-loop system. The
accommodation performance criteria is defined for the ith fault fi as
(44)IFAi≜αf‖WAiNfi‖k+αd‖SoM−1(I−NV−1Qi)Nd‖j,
where the
weighting WAi is selected
according to the fault effect:
(45)WAi≜{SoM−1(I−NV−1Qi)actuator/systemfault,SiV−1(UM−1+Qi)sensorfault,
where (αd,αf) are the
positive weighting factors to judge the importance of perturbations or faults
attenuation. Now, a small value of IFAi will indicate
good fault accommodation. Note that this value is related to a worst-case
performance degradation level expected in the FTC scheme [29].The overall synthesis algorithms for fault detection,
isolation, and accommodation including performance evaluation are described in
AppendixA. The synthesis procedure includes samples of MATLAB commands that
could be used for numerical calculations.


## 4. Fault Tolerant Approach Under Model Uncertainty

During the implementation of any control strategy,
there is always some model uncertainty in the mathematical description used for
design. If the characterization of this uncertainty could be obtained during
the problem formulation, this information could be used at the design stage to
improve the closed-loop performance, and understand also the practical
limitations. In this work, additive model uncertainty is considered [19, 20]
as shown in Figure 6, that is, the actual nominal plant P^uy is given by
(46)P^uy=Puy+Δuy,Δuy≜W2ΔW1,
where W1,W2∈ℛℋ∞ represent pre-
and post-uncertainty weighting functions, and Δ∈ℛℋ∞ a normalized
uncertain transfer matrix ∥Δ∥∞<1. As presented in [18], other uncertainty
representations (parametric, multiplicative, etc.) could be also fitted under
an additive uncertainty structure, but at the price of introducing some conservativeness
in the design.Figure 6
GIMC with additive perturbations, faults, and model
uncertainty.First of all, note that under model uncertainty, the
signalfe in the GIMC
configuration is no longer decoupled from the control signal u (see Figure 6).
The results are summarized as follows [17].Lemma.
Considering additive model uncertainty in the
GIMC configuration of Figure2, the resulting closed-loop characteristics are
given by
(47)fe(s)=−MΔuyu(s)−Ndd(s)−Nff(s),(48)u(s)=Wu−1[K⁢ref(s)−V−1(UM−1+Q)(Ndd(s)+Nff(s))],(49)y(s)=(Puy+Δuy)Wu−1K⁢ref(s)−[(Puy+Δuy)Wu−1V−1(UM−1+Q)−M−1]×(Ndd(s)+Nff(s)),
where
(50)Wu≜I+K(Puy+Δuy)+V−1QMΔuy=I+KPuy+V−1(U+QM)Δuy. (Proof is in
Appendix C)


### 4.1. Robust Fault Isolation

Note that by including additive uncertainty, an extra
requirement is evident, the detection/isolation filterH should cancel
or diminish the uncertainty contribution at the residual output r for a robust
detection and isolation, that is, HMΔuy≈0. As described in Section 2,
there are necessary
conditions related to the rank of the involved transfer matrices to guarantee
proper fault isolation. Consequently, this condition can be extended for robust
fault isolation, considering the worst-case uncertainty as
(51)normrank([MW2W1NdNf])≥normrank([MW2W1Nd])+l.
Since the
description of the uncertainty is posed in terms of the ∞ norm, the
optimization problems for the detection HD and isolation HI filters are
also proposed in terms of this norm. As a result, the following robust
performance criteria are adopted for both synthesis procedures:(i)fault
detection:(52)minHD∈ℛℋ∞∥Δ∥∞<1‖[00h]−HD[MW2ΔW1NdNf]‖∞=minHD∈ℛℋ∞∥Δ∥∞<1‖Fl(Fu(GHDΔ,Δ),HD)‖∞,(ii)fault isolation:(53)minHD∈ℛℋ∞∥Δ∥∞<1‖[00T]−HI[MW2ΔW1NdNf]‖∞=minHD∈ℛℋ∞∥Δ∥∞<1‖Fl⁢(Fu(GHIΔ,Δ),HI)‖∞,
where Fu(⋅,⋅) stands for an
upper LFT [20], and the
respective generalized plants GHDΔ and GHIΔ are given by
(54)GHDΔ=[0W1000000h−1MW20NdNf0],GHIΔ=[0W1000000T−IMW20NdNf0]. The
optimization problems in (52)
and (53) can be solved
by using μ-synthesis
design or LMI's [19, 20]. On the other hand, at the residual evaluation, it
is observed that the uncertainty Δuy is affected by
the control signal u at (47). Thus
the residual is directly dependent on the control signal u, and its profile will appear in the resulting dynamic
behavior, but since this signal is known, an adaptive threshold [3, 28] can be
used in order to reduce the conservativeness in the fault detection process
introduced by the uncertain term as
(55)JthD(t)=∥HDMW1W2∥∞∥u∥2,t,To+γ2d∥HDNd∥∞,
where γ2d is the bound on
the windowed energy of the perturbations, and the inequalities in (11) are
applied. This characterization is appropriate since the uncertainty Δ is quantified
in terms of the ∥⋅∥∞ norm.
Similarly, an adaptive threshold can be formulated for fault isolation as
(56)JthIi(t)=∑j=1j≠il∥[HINf]ij∥∞γ2i+∑k=1m∥[HIMW1W2]ik∥∞∥uk∥2,t,To+∑k=1r∥[HINd]ir∥∞γ2d,
where i=1,…,l. As mentioned in
the previous section, the thresholds in (55) and (56) are derived from norms
inequalities, so their values could be conservative and they have to be tuned
online to optimize the fault detection capabilities.Remark 7.
It is clear that hard thresholds could lead
to a conservative fault diagnosis stage, or fault misdetection due to a change
in the operating conditions or model uncertainty. However, adaptive thresholds
require a prior knowledge of the possible uncertainty or maximum variability of
the residuals in nominal conditions for a correct implementation.


### 4.2. Robust Fault Accommodation

In general, no guarantee of closed-loop stability is
granted althoughQ∈ℛℋ∞ as in the
uncertainty free case. From the results in Lemma
2, it can be seen that for a
special case (stable nominal plant), the uncertainty can be decoupled from the
control signal as in Corollary 1,
and closed-loop stability can be deduced if
the nominal controller internally stabilizes the nominal plant.Corollary 3.
If
the nominal plant satisfiesPuy∈ℛℋ∞, then complete disturbance, fault, and uncertainty
decoupling can be achieved at the control signal u by letting Q=−UM−1, and consequently
(57)u(s)=SiK⁢ref(s),y(s)=(Puy+Δuy)SiK⁢ref(s)+M−1(Ndd(s)+Nff(s)).
Moreover, the
closed-loop is stable if K internally
stabilizes Puy.Similarly to
the result in Corollary1, with the
compensation suggested in Corollary 3, the
perturbations d and faults f affect the
output in an open-loop fashion. Therefore, if an estimation of the
perturbations d^ and faults f^ are available,
then the feedforward structure in (30)
could be followed to attenuate their
effect at the output. On the other hand, for a general design case by looking
at (48)
and (49), a robust
criteria (performance and stability) should be
targeted to reduce the faults effects at the control signal u and the
perturbations contribution at the output y by
(58)min⁡Q∈ℛℋ∞∥Δ∥∞<1‖[−αd(P^uyWu−1K−I)Pdy00−αfWu−1KPfy]+[−αdP^uyWu−1V−1−αfWu−1V−1]Q[NdNf]‖∞=min⁡Q∈ℛℋ∞∥Δ∥∞<1‖Fl(Fu(GQuΔ,Δ),Q)‖∞,
where Wu is defined in
(50), and the generalized plant GQuΔ (see Figure 7)
including uncertainty information is given by
(59)GQuΔ=[−W1SiKW2−W1SiKPdy−W1SiKPfyW1SiV−1αdSoW2αdSoPdy0αdSoPuyV−1−αfSiKW20−αfSiKPfyαfSiV−1−MW2−Nd−Nf0].
Meanwhile, if
robust attenuation is now looked at the output y, the following robust performance problem is
formulated:
(60)min⁡Q∈ℛℋ∞∥Δ∥∞<1‖−(P^uyWu−1V−1(UM−1+Q)−M−1)×[αdNdαfNf]‖∞=min⁡Q∈ℛℋ∞∥Δ∥∞<1‖Fl(Fu(GQyΔ,Δ),Q)‖∞,
where the
corresponding generalized plant GQyΔ is given by
(61)GQyΔ=[−W1SiKW2−αdW1SiKPdy−αfW1SiKPfyW1SiV−1SoW2αdSoPdyαfSoPfySoPuyV−1−MW2−αdNd−αfNf0].
As in the nominal case, in order to improve
the closed-loop performance after the fault has been isolated, a specific
compensator Qi∈ℛℋ∞ can be designed
using the optimization criteria in (58)
and (60), depending if the fault is
affecting the state or output equations on the state-space representation (1).
For these cases, in the generalized plants (GQuΔ, GQyΔ) presented in
(59) and (61), Nf is replaced by
the information of the analyzed fault Nfifori=1,…,l.LFT
formulations for compensatorQ under model uncertainty: (a) control signal and
output attenuation, and (b) output signal attenuation.
(a)(b)The robust stability condition is very important since
it is needed that the fault accommodation scheme will preserve closed-loop
stability after the compensation despite model uncertainty. However, the size
of the uncertainty and its frequency content will dictate the degree of
conservativeness introduced. Assume that theith fault fi is analyzed,
then define the transfer matrix Mi(s) by closing the
lower feedback path with its specific compensator Qi in the LFT
configuration, that is,
(62)Mi(s)=Fl(Pi,Qi)=[Mi11Mi12Mi21Mi22],
where Pi represents the
generalized plant in (59)
(sensor faults) or (61)
(actuator or
system fault) by replacing Nf with Nfi. Then robust stability with respect to the ith compensator Qi is tested by
the condition [20] as follows:
(63)∥Mi11∥≤1.


### 4.3. Robust Performance Evaluation

Finally, some indices are suggested to evaluate the
robust performance of the resulting FTC structure.(1)Fault evaluation. The size of the
worst-case uncertainty is applied to obtain an estimate of the evaluation
performance as
(64)IRFD≜∥HDNf∥k∥HDNd∥j+∥HDMW2W1∥∞.
Consequently,
if IRFD is large, then
good evaluation characteristics are devised.(2)Fault isolation. The structure of the
index (43) is maintained, but the worst-case uncertainty information is
appended as
(65)IRFI≜∥[HINf]diag∥k∥[HINf]nondiag∥k+∥HINd∥j+∥HIMW2W1∥∞.(3)Fault accommodation. The fault
accommodation performance is evaluated in terms of the faults and perturbations
attenuation subject to model uncertainty. For this purpose, a robust
performance analysis is carried out by using the structured singular value μΔ [19, 20]. Then
the fault accommodation performance with respect to the ith fault is
defined by
(66)IRFAi=sup⁡ω∈ℝμΔp[Mi(jω)],
where Δp=diag(Δ,Δf) is an augmented
uncertainty block to address the performance specifications. Thus internal
stability is guaranteed for ∥Δ∥∞<1/IRFAi, and the worst-case performance is bounded Fu(Mi,Δ)≤IRFAi. As a result, if the index IRFAi is lower than
one, then robust stability is granted.


## 4.1. Robust Fault Isolation

Note that by including additive uncertainty, an extra
requirement is evident, the detection/isolation filterH should cancel
or diminish the uncertainty contribution at the residual output r for a robust
detection and isolation, that is, HMΔuy≈0. As described in Section 2,
there are necessary
conditions related to the rank of the involved transfer matrices to guarantee
proper fault isolation. Consequently, this condition can be extended for robust
fault isolation, considering the worst-case uncertainty as
(51)normrank([MW2W1NdNf])≥normrank([MW2W1Nd])+l.
Since the
description of the uncertainty is posed in terms of the ∞ norm, the
optimization problems for the detection HD and isolation HI filters are
also proposed in terms of this norm. As a result, the following robust
performance criteria are adopted for both synthesis procedures:(i)fault
detection:(52)minHD∈ℛℋ∞∥Δ∥∞<1‖[00h]−HD[MW2ΔW1NdNf]‖∞=minHD∈ℛℋ∞∥Δ∥∞<1‖Fl(Fu(GHDΔ,Δ),HD)‖∞,(ii)fault isolation:(53)minHD∈ℛℋ∞∥Δ∥∞<1‖[00T]−HI[MW2ΔW1NdNf]‖∞=minHD∈ℛℋ∞∥Δ∥∞<1‖Fl⁢(Fu(GHIΔ,Δ),HI)‖∞,
where Fu(⋅,⋅) stands for an
upper LFT [20], and the
respective generalized plants GHDΔ and GHIΔ are given by
(54)GHDΔ=[0W1000000h−1MW20NdNf0],GHIΔ=[0W1000000T−IMW20NdNf0]. The
optimization problems in (52)
and (53) can be solved
by using μ-synthesis
design or LMI's [19, 20]. On the other hand, at the residual evaluation, it
is observed that the uncertainty Δuy is affected by
the control signal u at (47). Thus
the residual is directly dependent on the control signal u, and its profile will appear in the resulting dynamic
behavior, but since this signal is known, an adaptive threshold [3, 28] can be
used in order to reduce the conservativeness in the fault detection process
introduced by the uncertain term as
(55)JthD(t)=∥HDMW1W2∥∞∥u∥2,t,To+γ2d∥HDNd∥∞,
where γ2d is the bound on
the windowed energy of the perturbations, and the inequalities in (11) are
applied. This characterization is appropriate since the uncertainty Δ is quantified
in terms of the ∥⋅∥∞ norm.
Similarly, an adaptive threshold can be formulated for fault isolation as
(56)JthIi(t)=∑j=1j≠il∥[HINf]ij∥∞γ2i+∑k=1m∥[HIMW1W2]ik∥∞∥uk∥2,t,To+∑k=1r∥[HINd]ir∥∞γ2d,
where i=1,…,l. As mentioned in
the previous section, the thresholds in (55) and (56) are derived from norms
inequalities, so their values could be conservative and they have to be tuned
online to optimize the fault detection capabilities.Remark 7.
It is clear that hard thresholds could lead
to a conservative fault diagnosis stage, or fault misdetection due to a change
in the operating conditions or model uncertainty. However, adaptive thresholds
require a prior knowledge of the possible uncertainty or maximum variability of
the residuals in nominal conditions for a correct implementation.


## 4.2. Robust Fault Accommodation

In general, no guarantee of closed-loop stability is
granted althoughQ∈ℛℋ∞ as in the
uncertainty free case. From the results in Lemma
2, it can be seen that for a
special case (stable nominal plant), the uncertainty can be decoupled from the
control signal as in Corollary 1,
and closed-loop stability can be deduced if
the nominal controller internally stabilizes the nominal plant.Corollary 3.
If
the nominal plant satisfiesPuy∈ℛℋ∞, then complete disturbance, fault, and uncertainty
decoupling can be achieved at the control signal u by letting Q=−UM−1, and consequently
(57)u(s)=SiK⁢ref(s),y(s)=(Puy+Δuy)SiK⁢ref(s)+M−1(Ndd(s)+Nff(s)).
Moreover, the
closed-loop is stable if K internally
stabilizes Puy.Similarly to
the result in Corollary1, with the
compensation suggested in Corollary 3, the
perturbations d and faults f affect the
output in an open-loop fashion. Therefore, if an estimation of the
perturbations d^ and faults f^ are available,
then the feedforward structure in (30)
could be followed to attenuate their
effect at the output. On the other hand, for a general design case by looking
at (48)
and (49), a robust
criteria (performance and stability) should be
targeted to reduce the faults effects at the control signal u and the
perturbations contribution at the output y by
(58)min⁡Q∈ℛℋ∞∥Δ∥∞<1‖[−αd(P^uyWu−1K−I)Pdy00−αfWu−1KPfy]+[−αdP^uyWu−1V−1−αfWu−1V−1]Q[NdNf]‖∞=min⁡Q∈ℛℋ∞∥Δ∥∞<1‖Fl(Fu(GQuΔ,Δ),Q)‖∞,
where Wu is defined in
(50), and the generalized plant GQuΔ (see Figure 7)
including uncertainty information is given by
(59)GQuΔ=[−W1SiKW2−W1SiKPdy−W1SiKPfyW1SiV−1αdSoW2αdSoPdy0αdSoPuyV−1−αfSiKW20−αfSiKPfyαfSiV−1−MW2−Nd−Nf0].
Meanwhile, if
robust attenuation is now looked at the output y, the following robust performance problem is
formulated:
(60)min⁡Q∈ℛℋ∞∥Δ∥∞<1‖−(P^uyWu−1V−1(UM−1+Q)−M−1)×[αdNdαfNf]‖∞=min⁡Q∈ℛℋ∞∥Δ∥∞<1‖Fl(Fu(GQyΔ,Δ),Q)‖∞,
where the
corresponding generalized plant GQyΔ is given by
(61)GQyΔ=[−W1SiKW2−αdW1SiKPdy−αfW1SiKPfyW1SiV−1SoW2αdSoPdyαfSoPfySoPuyV−1−MW2−αdNd−αfNf0].
As in the nominal case, in order to improve
the closed-loop performance after the fault has been isolated, a specific
compensator Qi∈ℛℋ∞ can be designed
using the optimization criteria in (58)
and (60), depending if the fault is
affecting the state or output equations on the state-space representation (1).
For these cases, in the generalized plants (GQuΔ, GQyΔ) presented in
(59) and (61), Nf is replaced by
the information of the analyzed fault Nfifori=1,…,l.LFT
formulations for compensatorQ under model uncertainty: (a) control signal and
output attenuation, and (b) output signal attenuation.
(a)(b)The robust stability condition is very important since
it is needed that the fault accommodation scheme will preserve closed-loop
stability after the compensation despite model uncertainty. However, the size
of the uncertainty and its frequency content will dictate the degree of
conservativeness introduced. Assume that theith fault fi is analyzed,
then define the transfer matrix Mi(s) by closing the
lower feedback path with its specific compensator Qi in the LFT
configuration, that is,
(62)Mi(s)=Fl(Pi,Qi)=[Mi11Mi12Mi21Mi22],
where Pi represents the
generalized plant in (59)
(sensor faults) or (61)
(actuator or
system fault) by replacing Nf with Nfi. Then robust stability with respect to the ith compensator Qi is tested by
the condition [20] as follows:
(63)∥Mi11∥≤1.


## 4.3. Robust Performance Evaluation

Finally, some indices are suggested to evaluate the
robust performance of the resulting FTC structure.(1)Fault evaluation. The size of the
worst-case uncertainty is applied to obtain an estimate of the evaluation
performance as
(64)IRFD≜∥HDNf∥k∥HDNd∥j+∥HDMW2W1∥∞.
Consequently,
if IRFD is large, then
good evaluation characteristics are devised.(2)Fault isolation. The structure of the
index (43) is maintained, but the worst-case uncertainty information is
appended as
(65)IRFI≜∥[HINf]diag∥k∥[HINf]nondiag∥k+∥HINd∥j+∥HIMW2W1∥∞.(3)Fault accommodation. The fault
accommodation performance is evaluated in terms of the faults and perturbations
attenuation subject to model uncertainty. For this purpose, a robust
performance analysis is carried out by using the structured singular value μΔ [19, 20]. Then
the fault accommodation performance with respect to the ith fault is
defined by
(66)IRFAi=sup⁡ω∈ℝμΔp[Mi(jω)],
where Δp=diag(Δ,Δf) is an augmented
uncertainty block to address the performance specifications. Thus internal
stability is guaranteed for ∥Δ∥∞<1/IRFAi, and the worst-case performance is bounded Fu(Mi,Δ)≤IRFAi. As a result, if the index IRFAi is lower than
one, then robust stability is granted.


## 5. Illustrative Example

In order to illustrate the ideas presented in the
paper, the design of an active FTC scheme for a separately excited DC motor is
considered. The dynamics of a second-order actuator are appended to the motor
description. To have a more realistic simulation, the actuator gain is limited
by a saturation function. Hence the control signalu is limited to
the interval [0,10]V. Thus a system with one input and three outputs
(armature voltage Va and current ia, and angular velocity ω) is studied
[30]. The load torque is modeled as an unknown constant or slowly time-varying
external disturbance d into the
system. The control objective is defined as the regulation of the angular
velocity to a prescribed reference. Note that since there are three
measurements and one unknown perturbation, then only the effect of two
different faults could be analyzed simultaneously [4]. The studied faults are
actuator f1 (gain of the dc
drive) and sensor f2 (angular
velocity measurement). The parameters of the dc motor are shown in Table 1. The
mathematical model of the studied system is presented next:
(67)[x˙1x˙2x˙3x˙4]=[−RaLa−KbLa01LaKbJ−BJ00000−100ωa2−2ζaωa][x1x2x3x4]+[00Ka0]u+[0−1J00]d+[0000Ka000][f1f2],[iaωVa]=[100001000001][x1x2x3x4]+[000100][f1f2].
In fact, the
model described in (67), with the parameters in Table 1, is stable and
satisfies the isolation conditions presented in (7) and (8). The nominal
controller is designed following a PI structure with respect to the velocity
reference error ωref−ω, plus a constant feedback from ia and Va, that is,
(68)x˙k=ωref−ω,u=Kixk+Kpω(ωref−ω)+Kpiia+KpVVa,
where Ki=0.5, Kpω=0.1, Kpi=0.2, and KpV=−0.01. This control law satisfies the performance
specifications by achieving internal stability and asymptotic tracking. Now,
the detection and isolation filters (HD, HI) were designed
following the optimization indices (16)
and (18) with j=∞, and selecting
(69)h(s)=[11]×1s/100+1,T(s)=1s/104+1[1001].
All the
numerical calculations were carried out in MATLAB by using two toolboxes: (i)
control system, and (ii) LMI control (see Appendix A). The transfer matrix T(s) was chosen as a
diagonal low-pass filter since the frequency content of Nf allows perfect
decoupling in the low frequency. The residual evaluation was computed by the
windowed 2 norm in (20).
Consequently, assuming a time window To and ∥d∥∞≤dmax, then a hard threshold for fault evaluation is
calculated by
(70)JthD=∥HDNd∥∞Todmax⁡,
since ∥d∥2,t,To≤dmaxTo. Meanwhile, for isolation purposes, two new
thresholds are also computed as follows:
(71)JthI1=‖[HINd]1‖∞Todmax⁡+‖[HINf]12‖∞Tof2max,JthI2=‖[HINd]2‖∞Todmax+‖[HINf]21‖∞Tof1max,
where ∥f1∥∞≤f1max, and ∥f2∥∞≤f2max. Next, the fault accommodation compensators Q,Q1, and Q2 were
synthesized by (35), (39), and (40) with αf=1.0 and αd=0.0. The performance indices in (42), (43), and (44) were
computed taking the ∞ norm (k=j=∞), and they are
listed in Table 2. The weight αd is chosen null
since the perturbation is assumed constant or slowly time varying, so the
integral part of the nominal controller can compensate effectively its effect.
Hence the results in Table 2 reflect that the active FTC will provide good
performance in the detection, isolation, and accommodation stages. Furthermore,
no degradation should be expected in a steady state since IFA=IFA1=IFA2=0. However, some transient changes have to be
anticipated due to control switching (see Figure 5). The velocity
reference ωref is defined as a
square wave that oscillates between 75 and 125rad/s at a frequency
of 4Hz. The load torque d is initialized
to 1Nm. The following scenario is tested under numerical
simulation:Table 1
DC motor parameters.
ParameterDescriptionRa=0.699ΩArmature resistanceLa=0.297HArmature inductanceB=4.544×10−3Nm/rad/sFriction coefficientJ=2.79×10−3kgmInertiaKb=0.746V/rad/sElectromagnetic constantKa=40Actuator gainωa=2π×360rad/sActuator natural frequencyζa=0.7Actuator damping factorTable 2
FTC performance
indices.
IndexValueIFD6.17×103IFI106.5IFA0IFA10IFA20IRFD1.63IRFI1.05(i)
at2.5s, there is a perturbation step change from 1Nm to 2Nm;(ii)
from4 to 8s, fault f2 is active as a
complete sensor outage, that is, f2=−ω;(iii)
from10 to 14s, fault f1 is triggered as
a 50% reduction in
the actuator gain, that is, f1=−0.5u;(iv)
finally, from16 to 20s, fault f2 is once more
active.The results are presented in Figures8
and 9. For
comparison, the nominal controller (without compensation) and the active FTC
are plotted simultaneously in Figure 8. From the simulation results, the
nominal controller saturates the control signal u when f2 is triggered,
and the actuator delivers its maximum output voltage to the motor. As a result,
the angular velocity is dangerously raised to ≈500rad/s. This behavior could induce severe mechanical
stresses in the motor, and practically, an instability scenario is faced, but
limited by the actuator saturation. Meanwhile, the active FTC scheme can
accommodate effectively this fault, with some transient oscillation due to the
control switching. However, for fault f1, the nominal controller and the FTC scheme can
compensate its appearance by the integral action in the nominal controller, but
although the nominal control law can inherently accommodate this fault, there
is no record of this faulty condition in the closed-loop system. Now, the
results of the fault detection and isolation stages are illustrated in Figure
9. Faults f1 and f2 are correctly
isolated, and the disturbance step change is not mistaken by a fault in the FDI
stage. In fact, f1 and f2 are almost
instantaneously isolated. Note that the active FTC scheme is able to maintain
good performance after both faults, and also when the faults are removed from
the system, the nominal performance is recovered.Simulation evaluation of FTC
scheme: (a) angular velocity, and (b) control signal.
(a)(b)Simulation evaluation of FTC scheme: (a)
fault signals, (b) detection and isolation results.
(a)(b)Now, in order to evaluate the fault diagnosis and
isolation under model uncertainty, the performance of the
previously designed filtersHD and HI under
uncertainty in the measurements ia and ω is
analyzed. So, consider the following output
uncertainty weight W2 as follows:
(72)W2(s)=[0.2s/10+10.15s/1000+10].
The
interpretation of W2 is the
following: (a) there is a maximum error of 20% at the low
frequency of the armature current measurement, and there is a 15% error in the
measurement of the angular velocity sensor over the whole frequency bandwidth.
The robust performance indices in (64)
and (65) were calculated (k=j=∞), and the
results are presented in Table 2. The results show that there is a severe
deterioration in the diagnosis and isolation capabilities under that
uncertainty profile, but there are still some degree of separability to achieve
the diagnosis and isolation stage.


## 6. Conclusions

In this paper, a control methodology for fault
detection, isolation, and accommodation to address LTI systems has been
detailed. The FTC scheme is based on the GIMC configuration [12] which extends
the use of the Youla parametrization to FTC. Design strategies were presented
for the FDI process and accommodation. Multiple and intermittent faults can be
treated in this FTC scheme. Closed-loop stability is always guaranteed after
each configuration but only if the additive faults profiles do not depend on
the states or outputs. Moreover, the analysis of the design schemes under model
uncertainty was carried out. For detection and isolation purposes, a hard
threshold is suggested for the nominal case, and an adaptive one is considered
when model uncertainty affects the output measurements. Performance indices are
also suggested to evaluate the detection, isolation, and accommodation schemes.
The FTC structure was tested in numerical simulation over a DC motor setup, and
the advantages over a nominal control law were clearly presented.



---

*Source: 853275-2008-02-28.xml*