# Fault-Tolerant Control for Three-Tank System in Case of Sensor Faults

Authors: Mondher Amor; Taoufik Ladhari; Salim Hadj Said; Faouzi M’Sahli
Journal: Mathematical Problems in Engineering
 (2021)

---

## Abstract

This research paper would be devoted to the application of a fault-tolerant control (FTC) for a benchmark system composed of three interconnected tanks in case of sensor faults. The control scheme includes two blocks: fault detection and isolation (FDI) block and a control law reconfiguration block. The strategy of the FDI method is based on a bank of high gain observers; each of them is constructed to estimate the system state vector. Thus, the diagnostic signal-residuals are generated by the comparison of measured and estimated outputs and the faulty sensor is isolated. The reconfiguration block performs an update of the controller parameters according to the operating mode. The application of this method to a pilot plant demonstrates that the hydrographic system maintains quite performances after sensor faults occurrence.


---

## Body

## 1. Introduction

Any automation of a process aims at reaching an almost perfect solution to obtain a final product of good quality and health of all faults. The automated system control theory has been widely developed and applied to the industrial process. These techniques ensure the stability of the closed-loop system and yield a predefined performance in the case where all system components operate safely. However, the more automated the process is, the more it is subject to fault occurrence. Hence, the need for a control method that is able to ensure nominal performance within highly automated systems where immediate maintenance is out of reach. This control is referred to as fault-tolerant control (FTC) which becomes extremely important in the last few decades. There are two approaches to the synthesis of an FTC. One approach, known as passive FTC, aims at designing a robust controller against some given faults. Another approach, known as active FTC, requires a fast fault detection and isolation (FDI) algorithm followed by a control law adjustment that allows maintaining high performances in the controlled system.The detection and isolation of faults is an important research area in process control due to the improvements that can be reached in terms of the safety and reliability of the plant. This can be traced from some valuable survey papers [1–3] and books [4, 5]. Different methods have been developed and implemented in different directions and for several systems [6–11] such as model-based method [12, 13], observer method [14–16], parameter estimation method [17], parity space method [18], and a combination of these methods with artificial intelligent [8, 19].The three-tank system (3TS) is considered an important and effective prototype of many applications in industrial processes, such as water treatment, food industry, chemical and petrochemical plants, oil, and gas systems. It is widely used in water conditioning systems, which provide the user with an abundant supply of luxuriously conditioned water and in craft brewing systems. In spite of the fact that many fault detection and isolation methods have already been applied to three-tank system systems, a few fault accommodation techniques have been considered. In [20], a feedback linearization approach for fault-tolerant control in a 3TS benchmark is investigated. Noura et al. proposed an approach based on the online estimation for the fault and the computation of additive control law is able to compensate for the fault effect on the system [21]. Mendoca et al. have used predictive control and fuzzy logic to design a fault-tolerant control for a 3TS [22]. Orani et al. presented a global observer based on a second-order sliding mode control algorithm for the simultaneous fault detection, isolation, and reconstruction for hydraulic vertical 3TS [23]. Other researchers have focused on fault diagnosis and accommodation for both sensor and actuator faults; they have proposed an analytical redundancy method to solve the drawbacks of the hardware redundancy such as cost and space [24]. It should be noted that all these previous works have developed FTC solutions based on the linearized model of the 3TS. This means that these approaches are valid only around an operating area. To overcome the previous drawbacks, some papers have focused on the application of actuator fault magnitude estimation [25] or fault-tolerant control [26–28] by using a nonlinear model of the 3TS.In this paper, we focus on the online sensor fault detection and isolation by adopting high gain observers’ bank. A reconfiguration of the controller is then performed by adjusting the design parameters to compensate for the sensor fault effects. Compared to previous works, the proposed approach has the feature to potentially mitigate the required time of the FDI process as well as the ability to reach the reference trajectory after the fault occurrence. The other purpose of this paper is to show the experimental performance of the proposed FTC method on a real plant. Moreover, it is important to mention that the proposed FTC approach is valid for several working areas and not only locally around the operating point.The paper is organized as follows. Section2 presents the 3TS model to illustrate sensor faults and accommodation methods. The next section is devoted to the strategy of fault diagnosis based on high gain observers bank used to detect, isolate, and estimate the faults. In section four, the full fault-tolerant control scheme is exposed. In this context, a new adjusted control law that aims to reduce the fault effect on the system outputs is discussed. Experimental results are given and presented in section 5. Finally, a conclusion and some perspectives are given in the sixth section.


## 2. Three-Tank System Presentation

### 2.1. Plant Description

The 3TS plant consists of three identical cubes with the same cross section areaS. These tanks are coupled serially to each other via cylindrical pipes of the same cross section area Sn. The complete structure of the plant is shown in Figure 1.Figure 1
Full structure of the computer design plant.Two pumpsP1 and P2, driven by DC-motors, represent, respectively, the input flows Q1 and Q2 of tanks T1 and T3. The plant is a closed system, in which the liquid that enters the reservoir from the tanks returns to the tanks thanks to two pumps.Besides the outflow valve onT3, the system includes five additional valves. Two of them are used to join each pair of neighboring tanks and can be manually tuned to close the connection between the two consecutive tanks. The other three valves Vl1,Vl2, and Vl3 are at the bottom of each tank. These leak valves can be used to manually drain each tank [29]. A piezoresistive differential pressure sensor, associated with each tank, delivers an analog voltage signal to measure the three liquid levels denoted by h1, h2, and h3.


### 2.2. Mathematical Model

The analytic model can be easily derived from the principle of mass conservation and the Torricelli law. In fact, the change of water volume in tanki (i = 1:3) is determined by the following equation:(1)V˙i=Si.dhidt=∑Qin,i−∑Qout,i,where ∑Qin,i and ∑Qout,i represent the total liquid inflows and outflows in tank i, respectively. Then, the mathematical model is specified by the following mass balance equations:(2)h˙1t=1SQ1t−Q12t−Ql1t,h˙2t=1SQ12t−Q23t−Ql2t,h˙3t=1SQ2t+Q23t−Qet−Ql3t,where t represents the time; h1, h2, and h3 represent the liquid levels in each tank; S represents the cross section of the tanks; Q1 and Q2 designate respectively the flow rates of pumps P1 and P2; Qij denotes the flow rates between tank Ti and Tj; and Qli represents the output flow of the corresponding tank when its leak valve is open. Qe is the leakage valve. The flows Qij and Qe in (2) are given by Torricelli’s law as follows:(3)Qijt=aziSnsgnhi−hj2ghi−hj,Qet=az3Sn2gh3,where azi is the outflow coefficient, sgn(.) is the sign of the argument, and g is the acceleration of gravity. Consequently, the nonlinear 3T model is given as follows:(4)dh1dt=−a1signh1−h2h1−h2+Q1S,dh2dt=a1signh1−h2h1−h2−a2signh2−h3h2−h3,dh3dt=a2signh2−h3h2−h3−a3h3+Q2S,where ai represents the system parameter given by(5)ai=1SaziSn2g;i=1,…,3.


### 2.3. Three-Tank System Faults Representation

The 3TS laboratory system is considered as a rich ground to serve as a test environment for the FTC. It is used as a benchmark system that can be affected by various additive and/or multiplicative faults:(i)
Faults actuator: an actuator fault can be represented by(6)uifk=αiuik+ui0;i=1,2,(i)
whereuif and ui represent the faulty and the normal control action of the ith pump, respectively. The constant offset is denoted by ui0 and 0≤αi≤1 denotes a gain degradation of the ith actuator.(ii)
Faults sensor: similar to the actuator fault representation, a faulty output can be written as(7)yjfk=βjyjk+yj0;j=1,2,3,where yjf and yj represent the faulty and the normal level of the jth sensor, respectively. The constant offset is denoted by yj0 and 0≤βj≤1 denotes a gain degradation of the jth sensor.


## 2.1. Plant Description

The 3TS plant consists of three identical cubes with the same cross section areaS. These tanks are coupled serially to each other via cylindrical pipes of the same cross section area Sn. The complete structure of the plant is shown in Figure 1.Figure 1
Full structure of the computer design plant.Two pumpsP1 and P2, driven by DC-motors, represent, respectively, the input flows Q1 and Q2 of tanks T1 and T3. The plant is a closed system, in which the liquid that enters the reservoir from the tanks returns to the tanks thanks to two pumps.Besides the outflow valve onT3, the system includes five additional valves. Two of them are used to join each pair of neighboring tanks and can be manually tuned to close the connection between the two consecutive tanks. The other three valves Vl1,Vl2, and Vl3 are at the bottom of each tank. These leak valves can be used to manually drain each tank [29]. A piezoresistive differential pressure sensor, associated with each tank, delivers an analog voltage signal to measure the three liquid levels denoted by h1, h2, and h3.


## 2.2. Mathematical Model

The analytic model can be easily derived from the principle of mass conservation and the Torricelli law. In fact, the change of water volume in tanki (i = 1:3) is determined by the following equation:(1)V˙i=Si.dhidt=∑Qin,i−∑Qout,i,where ∑Qin,i and ∑Qout,i represent the total liquid inflows and outflows in tank i, respectively. Then, the mathematical model is specified by the following mass balance equations:(2)h˙1t=1SQ1t−Q12t−Ql1t,h˙2t=1SQ12t−Q23t−Ql2t,h˙3t=1SQ2t+Q23t−Qet−Ql3t,where t represents the time; h1, h2, and h3 represent the liquid levels in each tank; S represents the cross section of the tanks; Q1 and Q2 designate respectively the flow rates of pumps P1 and P2; Qij denotes the flow rates between tank Ti and Tj; and Qli represents the output flow of the corresponding tank when its leak valve is open. Qe is the leakage valve. The flows Qij and Qe in (2) are given by Torricelli’s law as follows:(3)Qijt=aziSnsgnhi−hj2ghi−hj,Qet=az3Sn2gh3,where azi is the outflow coefficient, sgn(.) is the sign of the argument, and g is the acceleration of gravity. Consequently, the nonlinear 3T model is given as follows:(4)dh1dt=−a1signh1−h2h1−h2+Q1S,dh2dt=a1signh1−h2h1−h2−a2signh2−h3h2−h3,dh3dt=a2signh2−h3h2−h3−a3h3+Q2S,where ai represents the system parameter given by(5)ai=1SaziSn2g;i=1,…,3.


## 2.3. Three-Tank System Faults Representation

The 3TS laboratory system is considered as a rich ground to serve as a test environment for the FTC. It is used as a benchmark system that can be affected by various additive and/or multiplicative faults:(i)
Faults actuator: an actuator fault can be represented by(6)uifk=αiuik+ui0;i=1,2,(i)
whereuif and ui represent the faulty and the normal control action of the ith pump, respectively. The constant offset is denoted by ui0 and 0≤αi≤1 denotes a gain degradation of the ith actuator.(ii)
Faults sensor: similar to the actuator fault representation, a faulty output can be written as(7)yjfk=βjyjk+yj0;j=1,2,3,where yjf and yj represent the faulty and the normal level of the jth sensor, respectively. The constant offset is denoted by yj0 and 0≤βj≤1 denotes a gain degradation of the jth sensor.


## 3. Fault Detection and Isolation FDI Strategy

### 3.1. Problem Statement

It is important to be able to carry out the fault detection and isolation before that the faults induce a drastic effect on the system performance. Even in the case of system changes, faults should be detected and isolated. The observer-based approach is used to generate residual signals corresponding to the difference between measured and estimated signals. It is straightforward to think that if the system is faulty, the residual signal will be different to zero. However, the resultant residual will be equal to zero in case of an unfaulty system. The residual signal is compared to a fixed threshold; this comparison is followed by a decision block. To handle all possible sensor faults, we use an observer’s bank composed of three high gain observers. Each observer uses the information of two sensors to estimate the third state as it is shown in Figure2.Figure 2
Synoptic scheme of FDI applied to 3-tank system.The three estimated liquid levelsy^1, y^2, and y^3 provided by the observers’ bank allow to calculate the three residuals as follows:(8)rj=yj−y^j,forj=1,…,3.Considering these following notations, Table1 can be established:(9)sensorj=0,fault in thejthsensor,1,no fault in thejthsensor,rj=≠0,fault in thejthsensor,0,no fault in thejthsensor.Table 1
Faults signature for the three residuals.
Sensor 1Sensor 2Sensor 3r1r2r3F1F2F3111000000011≠0001001010≠ 0001011000≠ 0001001≠ 0≠ 001101000≠ 0≠ 0011010≠ 00≠ 0101000≠ 0≠ 0≠ 0111Consequently, the novel output vector used to implement the control law is given by(10)yc=yc1yc2yc3;whereycj=Fj¯.yj+Fj.y^j,with yj and y^j are, respectively, the measured and the estimated output. Fj is a binary variable such as (11)Fj=1,fault in thejth sensor,0,no fault in  thejth sensor.Once the FDI is performed, the faulty sensorSi is identified and the binary variable Fi is set to 1. As a result, the control output yci switches from measured to the estimated output provided by the ith observer (see Figure 3).Figure 3
Internal diagram of comparison and decision unit.


### 3.2. Observer Design

#### 3.2.1. Basic Concepts

Consider nonlinear systems of the form:(12)x˙=fx,u,y=px,where the vectors x and u are, respectively, the state and control defined on the subsets M and U and the vector-valued functions f (.) and p (.) are sufficiently differentiable with respect to their arguments.Firstly, assumey is a single output. Suppose an injective map ζ=qx exists, which has a continuous inverse and brings system (12) into the bitriangular form:(13)ζ˙⋮ζ˙k−1ζ˙k=ζ2+ψζ1,u⋮ζk+ψk−1ζ1,…,ζk−1,uψkζ1,…,ζk,u,y=ζ1.Denote the system in theζ-coordinate as(14)ζ˙=Aζ+ψζ,u,y=Cζ,with(15)A=01⋱⋱⋱⋱⋱10,C=10⋯0,ψ.=ψζ1,u⋮ψk−1ζ1,…,ζk−1,uψkζ1,…,ζk,u.Assume in the coordinate changedimζ=dimx and the Jacobian ∂qx/∂x is nonsingular. According to [30], for (12) an asymptotic observer is(16)x^˙=fx^,u+∂qx∂x|x=x^−1Lθyi−px^,where Lθ=θL1⋮θkLk and θ>0 is a scalar; the size of Li is equal to the dimension of ζi.In a practical design,L is firstly chosen such that A-LC is stable. Then, an arbitrary θ≥1may be chosen. A large value of θ involved relatively a fast convergence in the estimation error, but, at the same time, it can induce an amplification of the noise measurement.


#### 3.2.2. HGO Design for the 3TS Model

The nonlinear model (4) of the three-tank system can be written as follows:(17)h˙=fh+gQ,where(18)h=h1h2h3,Q=Q1Q2,g=1S00001S,fh=−a1sgnh1−h2h1−h2a1sgnh1−h2h1−h2−a2sgnh2−h3h2−h3a2sgnh2−h3h2−h3−a3h3.Typical values of the 3T  system are given in Table2. These values are later used in observer and controller implementation.Table 2
Physical parameters of the three-tank system.
Tank cross section areasS1=S2=S3=S=0.01 m2Pipe cross section areasSN = 0.0000786 m2Coefficientsa1 = 0.1 ; a2 = 0.086 ; a3 = 0.099Maximum in-flow rateQmax = 6.66. 10−5 m3/s(1) Observer Form with a Single Output Measurement. If only a single measurement is available during operating, according to (16), the observer for the 3TS model takes the form (19)h^˙=fh^+gQ+∂qijh∂h|h=h^−1Lθyi−h^i,where(20)Lθ=θl1θ2l2θ3l3,θ≥1,L=L1L2L3,ensuring that the matrix A-LC is Hurwitz:(21)A=010001000,C=100.For instance, suppose onlyy1=h1 is available. Then, ζ=q1h with(22)q1h=h1Lfh1Lf2h1=h1−a1signh1−h2h1−h2a12signh1−h2h1−h2−a1a2signh2−h3h2−h32h1−h2,where Lfjhx is the jth Lie derivative of the function h by f; for example, hx and fx are differentiable functions of x up to the order n.So, we have(23)∂q1∂h=100−aa0b−c−bc,with(24)a=a12h1−h2;b=a1a2sgnh2−h3h1−h24h1−h2h1−h2;c=a1a24h1−h2.h2−h3,and hence(25)∂q1∂h−1=10011a011a+bca1c.(2) Observer Form with Both State Measurements. To detect and isolate several sensor faults in the whole operating area, we use in FDI block a bank of nonlinear observers. According to [30] and using the assumption cited in [31] if two measurements yi and yj are available, the HGO is given by (26)h^˙=fh^+gQ+∂qijh∂h|h=h^−1Lθyi,j−h^i,j,where(27)Lθ=L1θL2θ2,θ≥1,L=L1L2,L=L1L2,where L1 and L2 are, respectively, 2x2 and 1x2 constant matrix, which can be easily determined such that A-LC has merely stable eigenvalues (26).(i)
b.1-Observer 1. Suppose y2 = h2 and y3 = h3 are the two available measurements. Let ε1=h2h3 and ε2=Lfh2 is the Lie derivative of h2 by f:(28)ε=ε1ε2=q23h=h2h3Lfh2,y2,3−h^2,3=y2y3−h^2h^3,∂q23∂h−1=1+ba−ba1a100010,(ii)
with(29)a=a12h1−h2;b=a22h2−h3;L=L1L2,(iii)
where the dimensions ofL1 and L2 are, respectively, 2x2 and 1x2 constant matrix, which can be easily determined such that A-LC has merely stable eigenvalues. In this case, we have(30)A=001000000;C=100010;Lθ=L1θL2θ2.(iv)
b.2-Observer 2. Suppose y1 = h1 and y3 = h3 are the two available measurements; ε1′=h1h3; and ε2′=Lfh1 is the Lie derivative of h1 by f:(31)ε′=ε1′ε2′=q21h=h1h3Lfh1,y2,1−h^2,1=y1y3−h^1h^3,∂q13∂h−1=11000101a0,(v)
witha and b as given below, and Lθ is the same as given in observer 1.(vi)
b.3-Observer 3. Suppose y1 = h1 and y2 = h2 are available. Let ε1′′=h2h1 and ε2′′=Lfh2 is the Lie derivative of h2 by f:(32)ε″=ε1′′ε2′′=q21h=h2h1Lfh2,y2,1−h^2,1=y2y1−h^2h^1,∂q21∂h−1=0101001+ab−ab1b,Where Lθ is the same as given in observer 1.The proof of convergence of this observer is detailed in [31].


## 3.1. Problem Statement

It is important to be able to carry out the fault detection and isolation before that the faults induce a drastic effect on the system performance. Even in the case of system changes, faults should be detected and isolated. The observer-based approach is used to generate residual signals corresponding to the difference between measured and estimated signals. It is straightforward to think that if the system is faulty, the residual signal will be different to zero. However, the resultant residual will be equal to zero in case of an unfaulty system. The residual signal is compared to a fixed threshold; this comparison is followed by a decision block. To handle all possible sensor faults, we use an observer’s bank composed of three high gain observers. Each observer uses the information of two sensors to estimate the third state as it is shown in Figure2.Figure 2
Synoptic scheme of FDI applied to 3-tank system.The three estimated liquid levelsy^1, y^2, and y^3 provided by the observers’ bank allow to calculate the three residuals as follows:(8)rj=yj−y^j,forj=1,…,3.Considering these following notations, Table1 can be established:(9)sensorj=0,fault in thejthsensor,1,no fault in thejthsensor,rj=≠0,fault in thejthsensor,0,no fault in thejthsensor.Table 1
Faults signature for the three residuals.
Sensor 1Sensor 2Sensor 3r1r2r3F1F2F3111000000011≠0001001010≠ 0001011000≠ 0001001≠ 0≠ 001101000≠ 0≠ 0011010≠ 00≠ 0101000≠ 0≠ 0≠ 0111Consequently, the novel output vector used to implement the control law is given by(10)yc=yc1yc2yc3;whereycj=Fj¯.yj+Fj.y^j,with yj and y^j are, respectively, the measured and the estimated output. Fj is a binary variable such as (11)Fj=1,fault in thejth sensor,0,no fault in  thejth sensor.Once the FDI is performed, the faulty sensorSi is identified and the binary variable Fi is set to 1. As a result, the control output yci switches from measured to the estimated output provided by the ith observer (see Figure 3).Figure 3
Internal diagram of comparison and decision unit.


## 3.2. Observer Design

### 3.2.1. Basic Concepts

Consider nonlinear systems of the form:(12)x˙=fx,u,y=px,where the vectors x and u are, respectively, the state and control defined on the subsets M and U and the vector-valued functions f (.) and p (.) are sufficiently differentiable with respect to their arguments.Firstly, assumey is a single output. Suppose an injective map ζ=qx exists, which has a continuous inverse and brings system (12) into the bitriangular form:(13)ζ˙⋮ζ˙k−1ζ˙k=ζ2+ψζ1,u⋮ζk+ψk−1ζ1,…,ζk−1,uψkζ1,…,ζk,u,y=ζ1.Denote the system in theζ-coordinate as(14)ζ˙=Aζ+ψζ,u,y=Cζ,with(15)A=01⋱⋱⋱⋱⋱10,C=10⋯0,ψ.=ψζ1,u⋮ψk−1ζ1,…,ζk−1,uψkζ1,…,ζk,u.Assume in the coordinate changedimζ=dimx and the Jacobian ∂qx/∂x is nonsingular. According to [30], for (12) an asymptotic observer is(16)x^˙=fx^,u+∂qx∂x|x=x^−1Lθyi−px^,where Lθ=θL1⋮θkLk and θ>0 is a scalar; the size of Li is equal to the dimension of ζi.In a practical design,L is firstly chosen such that A-LC is stable. Then, an arbitrary θ≥1may be chosen. A large value of θ involved relatively a fast convergence in the estimation error, but, at the same time, it can induce an amplification of the noise measurement.


### 3.2.2. HGO Design for the 3TS Model

The nonlinear model (4) of the three-tank system can be written as follows:(17)h˙=fh+gQ,where(18)h=h1h2h3,Q=Q1Q2,g=1S00001S,fh=−a1sgnh1−h2h1−h2a1sgnh1−h2h1−h2−a2sgnh2−h3h2−h3a2sgnh2−h3h2−h3−a3h3.Typical values of the 3T  system are given in Table2. These values are later used in observer and controller implementation.Table 2
Physical parameters of the three-tank system.
Tank cross section areasS1=S2=S3=S=0.01 m2Pipe cross section areasSN = 0.0000786 m2Coefficientsa1 = 0.1 ; a2 = 0.086 ; a3 = 0.099Maximum in-flow rateQmax = 6.66. 10−5 m3/s(1) Observer Form with a Single Output Measurement. If only a single measurement is available during operating, according to (16), the observer for the 3TS model takes the form (19)h^˙=fh^+gQ+∂qijh∂h|h=h^−1Lθyi−h^i,where(20)Lθ=θl1θ2l2θ3l3,θ≥1,L=L1L2L3,ensuring that the matrix A-LC is Hurwitz:(21)A=010001000,C=100.For instance, suppose onlyy1=h1 is available. Then, ζ=q1h with(22)q1h=h1Lfh1Lf2h1=h1−a1signh1−h2h1−h2a12signh1−h2h1−h2−a1a2signh2−h3h2−h32h1−h2,where Lfjhx is the jth Lie derivative of the function h by f; for example, hx and fx are differentiable functions of x up to the order n.So, we have(23)∂q1∂h=100−aa0b−c−bc,with(24)a=a12h1−h2;b=a1a2sgnh2−h3h1−h24h1−h2h1−h2;c=a1a24h1−h2.h2−h3,and hence(25)∂q1∂h−1=10011a011a+bca1c.(2) Observer Form with Both State Measurements. To detect and isolate several sensor faults in the whole operating area, we use in FDI block a bank of nonlinear observers. According to [30] and using the assumption cited in [31] if two measurements yi and yj are available, the HGO is given by (26)h^˙=fh^+gQ+∂qijh∂h|h=h^−1Lθyi,j−h^i,j,where(27)Lθ=L1θL2θ2,θ≥1,L=L1L2,L=L1L2,where L1 and L2 are, respectively, 2x2 and 1x2 constant matrix, which can be easily determined such that A-LC has merely stable eigenvalues (26).(i)
b.1-Observer 1. Suppose y2 = h2 and y3 = h3 are the two available measurements. Let ε1=h2h3 and ε2=Lfh2 is the Lie derivative of h2 by f:(28)ε=ε1ε2=q23h=h2h3Lfh2,y2,3−h^2,3=y2y3−h^2h^3,∂q23∂h−1=1+ba−ba1a100010,(ii)
with(29)a=a12h1−h2;b=a22h2−h3;L=L1L2,(iii)
where the dimensions ofL1 and L2 are, respectively, 2x2 and 1x2 constant matrix, which can be easily determined such that A-LC has merely stable eigenvalues. In this case, we have(30)A=001000000;C=100010;Lθ=L1θL2θ2.(iv)
b.2-Observer 2. Suppose y1 = h1 and y3 = h3 are the two available measurements; ε1′=h1h3; and ε2′=Lfh1 is the Lie derivative of h1 by f:(31)ε′=ε1′ε2′=q21h=h1h3Lfh1,y2,1−h^2,1=y1y3−h^1h^3,∂q13∂h−1=11000101a0,(v)
witha and b as given below, and Lθ is the same as given in observer 1.(vi)
b.3-Observer 3. Suppose y1 = h1 and y2 = h2 are available. Let ε1′′=h2h1 and ε2′′=Lfh2 is the Lie derivative of h2 by f:(32)ε″=ε1′′ε2′′=q21h=h2h1Lfh2,y2,1−h^2,1=y2y1−h^2h^1,∂q21∂h−1=0101001+ab−ab1b,Where Lθ is the same as given in observer 1.The proof of convergence of this observer is detailed in [31].


## 3.2.1. Basic Concepts

Consider nonlinear systems of the form:(12)x˙=fx,u,y=px,where the vectors x and u are, respectively, the state and control defined on the subsets M and U and the vector-valued functions f (.) and p (.) are sufficiently differentiable with respect to their arguments.Firstly, assumey is a single output. Suppose an injective map ζ=qx exists, which has a continuous inverse and brings system (12) into the bitriangular form:(13)ζ˙⋮ζ˙k−1ζ˙k=ζ2+ψζ1,u⋮ζk+ψk−1ζ1,…,ζk−1,uψkζ1,…,ζk,u,y=ζ1.Denote the system in theζ-coordinate as(14)ζ˙=Aζ+ψζ,u,y=Cζ,with(15)A=01⋱⋱⋱⋱⋱10,C=10⋯0,ψ.=ψζ1,u⋮ψk−1ζ1,…,ζk−1,uψkζ1,…,ζk,u.Assume in the coordinate changedimζ=dimx and the Jacobian ∂qx/∂x is nonsingular. According to [30], for (12) an asymptotic observer is(16)x^˙=fx^,u+∂qx∂x|x=x^−1Lθyi−px^,where Lθ=θL1⋮θkLk and θ>0 is a scalar; the size of Li is equal to the dimension of ζi.In a practical design,L is firstly chosen such that A-LC is stable. Then, an arbitrary θ≥1may be chosen. A large value of θ involved relatively a fast convergence in the estimation error, but, at the same time, it can induce an amplification of the noise measurement.


## 3.2.2. HGO Design for the 3TS Model

The nonlinear model (4) of the three-tank system can be written as follows:(17)h˙=fh+gQ,where(18)h=h1h2h3,Q=Q1Q2,g=1S00001S,fh=−a1sgnh1−h2h1−h2a1sgnh1−h2h1−h2−a2sgnh2−h3h2−h3a2sgnh2−h3h2−h3−a3h3.Typical values of the 3T  system are given in Table2. These values are later used in observer and controller implementation.Table 2
Physical parameters of the three-tank system.
Tank cross section areasS1=S2=S3=S=0.01 m2Pipe cross section areasSN = 0.0000786 m2Coefficientsa1 = 0.1 ; a2 = 0.086 ; a3 = 0.099Maximum in-flow rateQmax = 6.66. 10−5 m3/s(1) Observer Form with a Single Output Measurement. If only a single measurement is available during operating, according to (16), the observer for the 3TS model takes the form (19)h^˙=fh^+gQ+∂qijh∂h|h=h^−1Lθyi−h^i,where(20)Lθ=θl1θ2l2θ3l3,θ≥1,L=L1L2L3,ensuring that the matrix A-LC is Hurwitz:(21)A=010001000,C=100.For instance, suppose onlyy1=h1 is available. Then, ζ=q1h with(22)q1h=h1Lfh1Lf2h1=h1−a1signh1−h2h1−h2a12signh1−h2h1−h2−a1a2signh2−h3h2−h32h1−h2,where Lfjhx is the jth Lie derivative of the function h by f; for example, hx and fx are differentiable functions of x up to the order n.So, we have(23)∂q1∂h=100−aa0b−c−bc,with(24)a=a12h1−h2;b=a1a2sgnh2−h3h1−h24h1−h2h1−h2;c=a1a24h1−h2.h2−h3,and hence(25)∂q1∂h−1=10011a011a+bca1c.(2) Observer Form with Both State Measurements. To detect and isolate several sensor faults in the whole operating area, we use in FDI block a bank of nonlinear observers. According to [30] and using the assumption cited in [31] if two measurements yi and yj are available, the HGO is given by (26)h^˙=fh^+gQ+∂qijh∂h|h=h^−1Lθyi,j−h^i,j,where(27)Lθ=L1θL2θ2,θ≥1,L=L1L2,L=L1L2,where L1 and L2 are, respectively, 2x2 and 1x2 constant matrix, which can be easily determined such that A-LC has merely stable eigenvalues (26).(i)
b.1-Observer 1. Suppose y2 = h2 and y3 = h3 are the two available measurements. Let ε1=h2h3 and ε2=Lfh2 is the Lie derivative of h2 by f:(28)ε=ε1ε2=q23h=h2h3Lfh2,y2,3−h^2,3=y2y3−h^2h^3,∂q23∂h−1=1+ba−ba1a100010,(ii)
with(29)a=a12h1−h2;b=a22h2−h3;L=L1L2,(iii)
where the dimensions ofL1 and L2 are, respectively, 2x2 and 1x2 constant matrix, which can be easily determined such that A-LC has merely stable eigenvalues. In this case, we have(30)A=001000000;C=100010;Lθ=L1θL2θ2.(iv)
b.2-Observer 2. Suppose y1 = h1 and y3 = h3 are the two available measurements; ε1′=h1h3; and ε2′=Lfh1 is the Lie derivative of h1 by f:(31)ε′=ε1′ε2′=q21h=h1h3Lfh1,y2,1−h^2,1=y1y3−h^1h^3,∂q13∂h−1=11000101a0,(v)
witha and b as given below, and Lθ is the same as given in observer 1.(vi)
b.3-Observer 3. Suppose y1 = h1 and y2 = h2 are available. Let ε1′′=h2h1 and ε2′′=Lfh2 is the Lie derivative of h2 by f:(32)ε″=ε1′′ε2′′=q21h=h2h1Lfh2,y2,1−h^2,1=y2y1−h^2h^1,∂q21∂h−1=0101001+ab−ab1b,Where Lθ is the same as given in observer 1.The proof of convergence of this observer is detailed in [31].


## 4. FTC Design

The main objective is to establish a closed-loop regulation to track two reference liquid levels. For this reason, two PI controllers are installed. Each one controls one liquid level. In safety mode, these controllers can successfully accomplish this task. However, in the case of a faulty sensor, nominal performances are affected in the best case, and it can lead to instability in the worst case. To avoid such behavior, we should use the FTC that allows reconfiguring the controller when a fault occurs. As is shown in Figure4, the role of the FTC unit can be divided into two main tasks: the first one is the FDI detailed in Section 3 and the second one concerns the control law reconfiguration which performs the design parameters adjustment. In the case of faulty sensor Si, the binary variable Fi is set to 1. As a result, the control output yci switches from measured to the estimated output provided by the ith observer. To reduce the sensor fault effect and to maintain the closed-loop performance, the control output yci is used for the feedback and then compared with the input reference.Figure 4
Synoptic scheme of an FTC including FDI module.The sensor fault accommodation allows reducing the fault effect, and so the system still operates in the degraded mode. To alleviate this degradation, we suggest adjusting the parameters of the PI controller (kp, ki), from the normal mode parameters (kpin, kiin) to faulty mode parameters (kpf, kif) using a switcher block.


## 5. FTC Application

To prove the validity of the FTC strategy proposed in paragraphs 3 and 4, we apply it to the hydrographic system described in the second section. The main aim is to accomplish a closed-loop regulation of two levelsh1 and h3. As is shown in Figure 5, the test setup is composed by the following:(i)
Three liquid tanks with 1-meter height and one evacuation reservoir.(ii)
Two 36 W water-pumps (12 V/3 A) with a 4 Lpm liquid flow.(iii)
Three piezoresistive transducers MPX-5010 with sensitivity equal to 450 mV/kPa; everyone equips each tank. These transducers provide accurate analog output signals that are proportional to the pressure variation due to the liquid injection. The accepted range of pressure is from 0 to 10 kPa and the output signal is between 0.2 and 4.7 v. The main feature of this sensor is the possibility to connect it directly to a microcontroller without using a conditioning card.(iv)
An STM32Fio card is used as an I/O interface to establish a connection, via USB port, between the control desk using MATLAB/Simulink environment and the I/O peripheries (the three piezoresistive differential pressure sensors as input and the motopump drive board as output).(v)
A control desk with MATLAB/Simulink environment.(vi)
Power supply of two variable voltage sources 30 V/4A.Figure 5
Experimental plant: (1a, 1b, 1c) 3 cubic tanks; (2a, 2b) 2 DC motopumps; (3) liquid level sensors; (4) Fio std STM32 board; (5) motor driver board; (6) power supply; (7) basin; and (8) control desk.The control law is implemented in real time using a sampling period of 0.1s.The experimental setup is in the laboratory “Study of Industrial Systems and Renewable Energies” “ESIER” at the National Engineers School of Monastir, Tunisia.


### 5.1. Fault Free Case

In a faulty free case, the PI controllers successfully ensure this task since these outputs track well the desired trajectory as is shown in Figure6.Figure 6
Tracking performances of liquid levels 1 and 3 in the fault-free case.To ensure good tracking of the level referencesh1 and h3, we used two PI controllers, one for each level with identical parameters Kpn = 20 and Kin = 15.


### 5.2. Faulty Cases

#### 5.2.1. Fault Scenarios

(i)
Att1 = 300s, a constant offset of −8 cm is added to liquid level h1 (β1=1, y10 = −8 cm).(ii)
Att2 = 500s, a constant offset of −6 cm is added to liquid level h3 (β3=1, y30 = −6 cm).


#### 5.2.2. Sensor Fault Effect without FTC

The consequence of the fault scenario in the feedback performance is illustrated in Figure7. From the instant t1 = 300s, the measured level h1 has a bias of −8 cm compared to its real value; that is why the control law tries to cancel the static error created by the faulty measurement which appears clearly in the sudden magnitude change of u1. Consequently, the real output is different from the reference and it is equal to the value of reference plus the bias value (37.5 + 8 = 43.5 cm). Since t = 450s, the control law u1 has been almost constant and greater than the nominal value in the fault-free case. Similar to level 1 fault consequence, Figure 8 shows the effect of the fault in sensor 3 which arises at a real level different from the reference, and after t = 720s, a control law u2 which has almost a constant value greater than the nominal one.Figure 7
Dynamic response of level 1 without FTC and its control lawu1.Figure 8
Dynamic response of level 3 without FTC and its control lawu2.


#### 5.2.3. FTC without Controller Adjustment

The application of the previous FDI method to the same fault scenario sited in subsection5.2.1 requires the use of observers’ bank in order to generate residual and to identify the faulty sensor. After a transient time, this residual is compared to a fixed threshold which allows setting the binary variable Fi to 1 or 0.(i)
Att = t1 = 300s, a bias of −8 cm is added to the liquid level 1; this sudden change induces a rocking of the control output yc1 from the measured y1 to the estimated y^1 generated by the observer 1 (see Figures 2 and 3).(ii)
Att = t2 = 500s, similar to level 1, a bias of −6 cm is added to the third level and, consequently, the feedback is ensured by the estimated output y^3.In a practical design,L is firstly chosen such that A-LC is Hurwitz. Then, an arbitrary θ≥1 may be chosen. Normally, a large value of θ allows a fast estimation error convergence. But, in the same way, it can generate excessive peaks during the transient, beside inducing an amplification of the noise measurement in the state estimation. To achieve a compromise, we have chosen the observers’ parameters as θ1=θ2=θ3=2.As is shown in Figures9 and 10, levels 1 and 3 try to suitably track the liquid reference trajectories. But, since the comparison of the input reference is done with an estimated value of the real measurement, large oscillations appear after the fault occurrence.Figure 9
Tracking performance of level 1 with FTC and its control lawu1.Figure 10
Tracking performance of level 3 with FTC and its control lawu2.


#### 5.2.4. FTC with Controller Adjustment

To improve the performance of the closed-loop sited lastly, we suggest the adjustment of the controller parameters from the nominal one (Kpn = 20, Kin = 15) to the faulty one (Kpf = 70, Kif = 50) using a switcher block in which the switching condition is the error between the estimated and the measured signals. As is shown in Figure 11, in a healthy case, the error is less than the threshold; then Kp = Kpn, after fault occurrence, the error is greater than the threshold and Kp switch to Kpf.Figure 11
Schematic diagram of the controller parameters switching.The result of this adjustment is shown in Figures12 and 13. Compared to Figures 9 and 10, the quality of regulation is improved.Figure 12
Dynamic response of level 1 with FTC and its adjusted control lawu1.Figure 13
Dynamic response of level 3 with FTC and its adjusted control lawu2.


#### 5.2.5. Result Discussion

The proposed active fault-tolerant control ensures typically quite performances for the closed-loop system. Indeed, after sensor fault accommodation a controller reconfiguration is performed to improve the tracking performances. The tracking errorse1=y1−y1ref and e3=y3−y3ref are depicted, respectively, in Figures 14 and 15 for three cases: fault-free case (a), FTC without control law adjustment (b), and FTC with control law adjustment (c).Figure 14
Tracking error e1.
(a)(b)(c)Figure 15
Tracking error e3.
(a)(b)(c)To evaluate the control performance, we use the mean square error MSE criterion defined by(33)MSE=1n∑k=1nyrefk−yk2,where n is the number of measurements, yrefk is the desired output, and yk is the system output. The computation of the MSE for outputs y1 and y3 in cases a, b, and c is illustrated by Table 3, when n = 10000.Table 3
Performance tracking comparison.
Fault-free caseFTC without parameters adjustmentFTC with parameters adjustmente10.12660.51830.1422e30.10021.07620.1491As seen in Table3, the MSE values arising from the proposed approach are a little bigger than the fault-free case, but it is still widely smaller than the case of FTC without control law parameters adjustment. This also is confirmed by the dynamic behavior of the output levels y1 and y3 after sensor fault occurrence.


## 5.1. Fault Free Case

In a faulty free case, the PI controllers successfully ensure this task since these outputs track well the desired trajectory as is shown in Figure6.Figure 6
Tracking performances of liquid levels 1 and 3 in the fault-free case.To ensure good tracking of the level referencesh1 and h3, we used two PI controllers, one for each level with identical parameters Kpn = 20 and Kin = 15.


## 5.2. Faulty Cases

### 5.2.1. Fault Scenarios

(i)
Att1 = 300s, a constant offset of −8 cm is added to liquid level h1 (β1=1, y10 = −8 cm).(ii)
Att2 = 500s, a constant offset of −6 cm is added to liquid level h3 (β3=1, y30 = −6 cm).


### 5.2.2. Sensor Fault Effect without FTC

The consequence of the fault scenario in the feedback performance is illustrated in Figure7. From the instant t1 = 300s, the measured level h1 has a bias of −8 cm compared to its real value; that is why the control law tries to cancel the static error created by the faulty measurement which appears clearly in the sudden magnitude change of u1. Consequently, the real output is different from the reference and it is equal to the value of reference plus the bias value (37.5 + 8 = 43.5 cm). Since t = 450s, the control law u1 has been almost constant and greater than the nominal value in the fault-free case. Similar to level 1 fault consequence, Figure 8 shows the effect of the fault in sensor 3 which arises at a real level different from the reference, and after t = 720s, a control law u2 which has almost a constant value greater than the nominal one.Figure 7
Dynamic response of level 1 without FTC and its control lawu1.Figure 8
Dynamic response of level 3 without FTC and its control lawu2.


### 5.2.3. FTC without Controller Adjustment

The application of the previous FDI method to the same fault scenario sited in subsection5.2.1 requires the use of observers’ bank in order to generate residual and to identify the faulty sensor. After a transient time, this residual is compared to a fixed threshold which allows setting the binary variable Fi to 1 or 0.(i)
Att = t1 = 300s, a bias of −8 cm is added to the liquid level 1; this sudden change induces a rocking of the control output yc1 from the measured y1 to the estimated y^1 generated by the observer 1 (see Figures 2 and 3).(ii)
Att = t2 = 500s, similar to level 1, a bias of −6 cm is added to the third level and, consequently, the feedback is ensured by the estimated output y^3.In a practical design,L is firstly chosen such that A-LC is Hurwitz. Then, an arbitrary θ≥1 may be chosen. Normally, a large value of θ allows a fast estimation error convergence. But, in the same way, it can generate excessive peaks during the transient, beside inducing an amplification of the noise measurement in the state estimation. To achieve a compromise, we have chosen the observers’ parameters as θ1=θ2=θ3=2.As is shown in Figures9 and 10, levels 1 and 3 try to suitably track the liquid reference trajectories. But, since the comparison of the input reference is done with an estimated value of the real measurement, large oscillations appear after the fault occurrence.Figure 9
Tracking performance of level 1 with FTC and its control lawu1.Figure 10
Tracking performance of level 3 with FTC and its control lawu2.


### 5.2.4. FTC with Controller Adjustment

To improve the performance of the closed-loop sited lastly, we suggest the adjustment of the controller parameters from the nominal one (Kpn = 20, Kin = 15) to the faulty one (Kpf = 70, Kif = 50) using a switcher block in which the switching condition is the error between the estimated and the measured signals. As is shown in Figure 11, in a healthy case, the error is less than the threshold; then Kp = Kpn, after fault occurrence, the error is greater than the threshold and Kp switch to Kpf.Figure 11
Schematic diagram of the controller parameters switching.The result of this adjustment is shown in Figures12 and 13. Compared to Figures 9 and 10, the quality of regulation is improved.Figure 12
Dynamic response of level 1 with FTC and its adjusted control lawu1.Figure 13
Dynamic response of level 3 with FTC and its adjusted control lawu2.


### 5.2.5. Result Discussion

The proposed active fault-tolerant control ensures typically quite performances for the closed-loop system. Indeed, after sensor fault accommodation a controller reconfiguration is performed to improve the tracking performances. The tracking errorse1=y1−y1ref and e3=y3−y3ref are depicted, respectively, in Figures 14 and 15 for three cases: fault-free case (a), FTC without control law adjustment (b), and FTC with control law adjustment (c).Figure 14
Tracking error e1.
(a)(b)(c)Figure 15
Tracking error e3.
(a)(b)(c)To evaluate the control performance, we use the mean square error MSE criterion defined by(33)MSE=1n∑k=1nyrefk−yk2,where n is the number of measurements, yrefk is the desired output, and yk is the system output. The computation of the MSE for outputs y1 and y3 in cases a, b, and c is illustrated by Table 3, when n = 10000.Table 3
Performance tracking comparison.
Fault-free caseFTC without parameters adjustmentFTC with parameters adjustmente10.12660.51830.1422e30.10021.07620.1491As seen in Table3, the MSE values arising from the proposed approach are a little bigger than the fault-free case, but it is still widely smaller than the case of FTC without control law parameters adjustment. This also is confirmed by the dynamic behavior of the output levels y1 and y3 after sensor fault occurrence.


## 5.2.1. Fault Scenarios

(i)
Att1 = 300s, a constant offset of −8 cm is added to liquid level h1 (β1=1, y10 = −8 cm).(ii)
Att2 = 500s, a constant offset of −6 cm is added to liquid level h3 (β3=1, y30 = −6 cm).


## 5.2.2. Sensor Fault Effect without FTC

The consequence of the fault scenario in the feedback performance is illustrated in Figure7. From the instant t1 = 300s, the measured level h1 has a bias of −8 cm compared to its real value; that is why the control law tries to cancel the static error created by the faulty measurement which appears clearly in the sudden magnitude change of u1. Consequently, the real output is different from the reference and it is equal to the value of reference plus the bias value (37.5 + 8 = 43.5 cm). Since t = 450s, the control law u1 has been almost constant and greater than the nominal value in the fault-free case. Similar to level 1 fault consequence, Figure 8 shows the effect of the fault in sensor 3 which arises at a real level different from the reference, and after t = 720s, a control law u2 which has almost a constant value greater than the nominal one.Figure 7
Dynamic response of level 1 without FTC and its control lawu1.Figure 8
Dynamic response of level 3 without FTC and its control lawu2.


## 5.2.3. FTC without Controller Adjustment

The application of the previous FDI method to the same fault scenario sited in subsection5.2.1 requires the use of observers’ bank in order to generate residual and to identify the faulty sensor. After a transient time, this residual is compared to a fixed threshold which allows setting the binary variable Fi to 1 or 0.(i)
Att = t1 = 300s, a bias of −8 cm is added to the liquid level 1; this sudden change induces a rocking of the control output yc1 from the measured y1 to the estimated y^1 generated by the observer 1 (see Figures 2 and 3).(ii)
Att = t2 = 500s, similar to level 1, a bias of −6 cm is added to the third level and, consequently, the feedback is ensured by the estimated output y^3.In a practical design,L is firstly chosen such that A-LC is Hurwitz. Then, an arbitrary θ≥1 may be chosen. Normally, a large value of θ allows a fast estimation error convergence. But, in the same way, it can generate excessive peaks during the transient, beside inducing an amplification of the noise measurement in the state estimation. To achieve a compromise, we have chosen the observers’ parameters as θ1=θ2=θ3=2.As is shown in Figures9 and 10, levels 1 and 3 try to suitably track the liquid reference trajectories. But, since the comparison of the input reference is done with an estimated value of the real measurement, large oscillations appear after the fault occurrence.Figure 9
Tracking performance of level 1 with FTC and its control lawu1.Figure 10
Tracking performance of level 3 with FTC and its control lawu2.


## 5.2.4. FTC with Controller Adjustment

To improve the performance of the closed-loop sited lastly, we suggest the adjustment of the controller parameters from the nominal one (Kpn = 20, Kin = 15) to the faulty one (Kpf = 70, Kif = 50) using a switcher block in which the switching condition is the error between the estimated and the measured signals. As is shown in Figure 11, in a healthy case, the error is less than the threshold; then Kp = Kpn, after fault occurrence, the error is greater than the threshold and Kp switch to Kpf.Figure 11
Schematic diagram of the controller parameters switching.The result of this adjustment is shown in Figures12 and 13. Compared to Figures 9 and 10, the quality of regulation is improved.Figure 12
Dynamic response of level 1 with FTC and its adjusted control lawu1.Figure 13
Dynamic response of level 3 with FTC and its adjusted control lawu2.


## 5.2.5. Result Discussion

The proposed active fault-tolerant control ensures typically quite performances for the closed-loop system. Indeed, after sensor fault accommodation a controller reconfiguration is performed to improve the tracking performances. The tracking errorse1=y1−y1ref and e3=y3−y3ref are depicted, respectively, in Figures 14 and 15 for three cases: fault-free case (a), FTC without control law adjustment (b), and FTC with control law adjustment (c).Figure 14
Tracking error e1.
(a)(b)(c)Figure 15
Tracking error e3.
(a)(b)(c)To evaluate the control performance, we use the mean square error MSE criterion defined by(33)MSE=1n∑k=1nyrefk−yk2,where n is the number of measurements, yrefk is the desired output, and yk is the system output. The computation of the MSE for outputs y1 and y3 in cases a, b, and c is illustrated by Table 3, when n = 10000.Table 3
Performance tracking comparison.
Fault-free caseFTC without parameters adjustmentFTC with parameters adjustmente10.12660.51830.1422e30.10021.07620.1491As seen in Table3, the MSE values arising from the proposed approach are a little bigger than the fault-free case, but it is still widely smaller than the case of FTC without control law parameters adjustment. This also is confirmed by the dynamic behavior of the output levels y1 and y3 after sensor fault occurrence.


## 6. Conclusion

In this study, a bank of high gain observers has been considered for FDI application in a 3TS. After sensor detection and isolation, fault accommodation is applied to ensure the reference tracking aim. For preserving the same performance as the safe mode, a controller parameters adjustment is also proposed. Experimental results are given for the validation of our approach.This work can be extended to reach simultaneous sensor and actuator faults by using unknown input observers. The performance of the controller feedback can be improved using a filtered high gain observer, which ensures a good state estimation, even in the case of noisy measurements.



---

*Source: 8856571-2021-01-18.xml*