Control Reconfiguration of Dynamical Systems: Linear Approaches and Structural Tests (Lecture Notes in Control and Information Sciences)

Lecture Notes in Control and Information Sciences Editors: M. Thoma . M. Morari 320 Thomas Steffen Control Reconfig...

Author: Thomas Steffen

8 downloads 544 Views 3MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!
Report copyright / DMCA form

DOWNLOAD PDF

Lecture Notes in Control and Information Sciences Editors: M. Thoma . M. Morari

320

Thomas Steffen

Control Reconfiguration of Dynamical Systems

ABC

Series Advisory Board F. Allgöwer . P. Fleming . P. Kokotovic . A.B. Kurzhanski . H. Kwakernaak . A. Rantzer . J.N. Tsitsiklis

Author Thomas Steffen Parnassiaveld 97 1115 EJ Duivendrecht The Netherlands E-mail: [email protected]

Library of Congress Control Number: 2005927315 ISSN print edition: 0170-8643 ISSN electronic edition: 1610-7411 ISBN-10 3-540-25730-6 Springer Berlin Heidelberg New York ISBN-13 978-3-540-25730-1 Springer Berlin Heidelberg New York This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilm or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer. Violations are liable for prosecution under the German Copyright Law. Springer is a part of Springer Science+Business Media springeronline.com c Springer-Verlag Berlin Heidelberg 2005 Printed in The Netherlands The use of general descriptive names, registered names, trademarks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. Typesetting: by the authors and TechBooks using a Springer LATEX macro package Cover design: design & production GmbH, Heidelberg Printed on acid-free paper

SPIN: 11406181

89/TechBooks

543210

Preface

This book is about control reconfiguration, a topic that has only recently been addressed in the scientific discorse. I hope that I can provide a uesful approach to this interesting field. The text is the result of my PhD project, which was supported by the Technical University of Hamburg-Harburg, the RuhrUniversity Bochum and the Deutsche Forschungsgesellschaft (DFG) under grant Lu462/14. I would like to express my gratitude towards my supervisor Prof. Jan Lunze, without whom the project would not have been possible. His deep insight into the topic and his constructive criticism have been invaluable to me. I want to extend my thanks to Prof. Marcel Staroswiecki, who has introduced me to structural analysis. I also owe much to my collegues both in Hamburg and in Bochum. My special thanks go to Pop and Tobias, who had to endure me for the longest time, and still have always been available for discussions. And without the help of numerous technicians and motivated students, I would not have been able to perform the experimental verification in Part 4. Finally I want to thank my wife Erin for her support while writing the manuscript, and my parents Roswitha and Bernhard for encouraging my interest in research.

Amsterdam May 2005

Thomas Steffen

Abstract

Keywords reconfiguration, fault-tolerant control (FTC), supervisory control, structural analysis Control reconfiguration changes the control structure in response to a fault detected in the plant. This becomes necessary, because a major fault (like the loss of an actuator) breaks the corresponding control loop and therefore renders the whole system inoperable. Using a different set of actuators (and a new control law), it may still be possible to close the control loop via redundant signal paths. An important aim of control reconfiguration is to change the control structure as little as possible, since every change bears the potential of practical problems. The proposed solution is to keep the original controller in the loop, and to add an extension called “virtual actuator”, that implements the necessary changes of the control structure. The virtual actuator translates between the signals of the nominal controller and the signals of the faulty plants. The manuscript defines several different reconfiguration goals, and it analyses their influence on the design of the virtual actuator. Depending on the precise formulation, the parameters result from an equivalent state-feedback control problem, a reference tracking problem or a disturbance decoupling problem. The structure of the virtual actuator does not change significantly for the different goals. Tests for the solvability of these problems are stated, which depend only on the structure of the system, and not on the specific parameter values. This approach is appropriate for the reconfiguration problem, since the faults considered here lead to a structural change of the system. Therefore, their impact on the system properties can be studied on a structural level. The manuscript concludes with several experimental results. The 3-Tank Benchmark Problem known from literature is used both as a running example to explain the approaches and as an experimental application for the reconfiguration after different faults. A two-degrees-of-freedom helicopter model is used as a further, more complicated application example.

Contents

1

2

Introduction to Control Reconfiguration . . . . . . . . . . . . . . . . . . .

1

1.1 Fault-Tolerant Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1

1.2 Fault Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2

1.3 Control Reconfiguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3

1.4 Reconfiguration Goal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5

1.5 Aim of this Manuscript . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5

1.6 Structure of the Manuscript . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

6

Literature Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

9

2.1 Fault-Tolerant Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

9

2.2 Specific Reconfiguration Approaches . . . . . . . . . . . . . . . . . . . . . . . 10 2.3 General Reconfiguration Approaches . . . . . . . . . . . . . . . . . . . . . . . 11 2.4 Alternatives to Reconfiguration . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.5 Advanced Control Theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Part I. Reconfiguration Problem 3

Running Example: the 2-Tank System . . . . . . . . . . . . . . . . . . . . . 17 3.1 Nonlinear Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 3.2 Linear Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 3.3 Controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 3.4 Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 3.5 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

X

4

Contents

General Reconfiguration Problem . . . . . . . . . . . . . . . . . . . . . . . . . . 25 4.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 4.2 Modelling the System and the Fault . . . . . . . . . . . . . . . . . . . . . . . 25 4.3 Control Loop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 4.4 Reconfiguration Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 4.5 Reconfiguration Goals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 4.6 2-Tank Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

5

Linear Reconfiguration Problem . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 5.1 Nominal Control Loop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 5.2 Fault and Reconfiguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 5.3 Reconfiguration Goals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 5.4 Specific Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 5.5 2-Tank Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

Part II. Linear Solution Approaches 6

Direct Reconfiguration Using a Static Block . . . . . . . . . . . . . . . 55 6.1 Direct Reconfiguration After Actuator Faults . . . . . . . . . . . . . . . 55 6.2 Solvability Consideration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 6.3 Derivation of a Static Reconfiguration Block . . . . . . . . . . . . . . . . 57 6.4 Reconfiguration Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 6.5 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 6.6 Application to the 2-Tank Example . . . . . . . . . . . . . . . . . . . . . . . . 62 6.7 Pseudo-Inverse Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 6.8 Reconfiguration After Sensor Faults . . . . . . . . . . . . . . . . . . . . . . . . 66 6.9 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

Contents

7

XI

Reconfiguration Using a Virtual Sensor . . . . . . . . . . . . . . . . . . . . 69 7.1 Stabilising Reconfiguration After Sensor Faults . . . . . . . . . . . . . . 69 7.2 Solvability Consideration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 7.3 Derivation of the Virtual Sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 7.4 Reconfiguration Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 7.5 Analysis of the Virtual Sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 7.6 Application to the 2-Tank Example . . . . . . . . . . . . . . . . . . . . . . . . 78 7.7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

8

Reconfiguration Using a Virtual Actuator . . . . . . . . . . . . . . . . . 81 8.1 Stabilising Reconfiguration After Actuator Faults . . . . . . . . . . . . 81 8.2 Solvability Consideration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 8.3 Derivation of the Virtual Actuator . . . . . . . . . . . . . . . . . . . . . . . . . 83 8.4 Reconfiguration Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 8.5 Analysis of the Reconfigured Closed-Loop System . . . . . . . . . . . 89 8.6 Application to the 2-Tank Example . . . . . . . . . . . . . . . . . . . . . . . . 92 8.7 Duality of Virtual Sensor and Actuator . . . . . . . . . . . . . . . . . . . . . 96 8.8 Reconfiguration After Internal Faults . . . . . . . . . . . . . . . . . . . . . . 98 8.9 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

9

Reconfiguration with Set-Point Tracking . . . . . . . . . . . . . . . . . . . 103 9.1 Weak Reconfiguration After Actuator Faults . . . . . . . . . . . . . . . 103 9.2 Solvability Consideration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 9.3 Approach 1: Zero Placement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 9.4 Approach 2: Integrating Controller . . . . . . . . . . . . . . . . . . . . . . . . 110 9.5 Analysis and Comparison . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 9.6 Application to the 2-Tank Example . . . . . . . . . . . . . . . . . . . . . . . . 114 9.7 Dual Approach For Sensor Faults . . . . . . . . . . . . . . . . . . . . . . . . . . 116 9.8 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

XII

Contents

10 Reconfiguration by Disturbance Decoupling . . . . . . . . . . . . . . . 119 10.1 Strong Reconfiguration After Actuator Faults . . . . . . . . . . . . . . . 119 10.2 Solvability Condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 10.3 Interpretation as a Disturbance Decoupling Problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 10.4 Geometric Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 10.5 Reconfiguration Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 10.6 Analysis of Reconfigured System . . . . . . . . . . . . . . . . . . . . . . . . . . 132 10.7 Application to the 2-Tank Example . . . . . . . . . . . . . . . . . . . . . . . . 135 10.8 Dual Approach for Sensor Faults . . . . . . . . . . . . . . . . . . . . . . . . . . 138 10.9 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

Part III. Structural Tests for Control Reconfiguration 11 Structural Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 11.1 Introduction to Structural Models . . . . . . . . . . . . . . . . . . . . . . . . . 143 11.2 Structural Matrices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 11.3 Structural Digraphs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 11.4 Paths in a Structural Graph . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 11.5 Digraphs and Matrix Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 11.6 Weighted Digraphs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 11.7 Bi-partite Graphs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 11.8 Structure of Non-Linear Systems . . . . . . . . . . . . . . . . . . . . . . . . . . 158 11.9 Diagnosis Based on Structural Graphs . . . . . . . . . . . . . . . . . . . . . 159 12 Basic Structural Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 12.1 Defining Structural Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 12.2 s-Controllability and s-Observability . . . . . . . . . . . . . . . . . . . . . . . 162 12.3 Stabilisability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 12.4 Reduced Control Problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 12.5 Solvability of the Weak Reconfiguration Problem . . . . . . . . . . . . 169 12.6 Application to the 2-Tank Example . . . . . . . . . . . . . . . . . . . . . . . . 170

Contents

XIII

13 Solvability of Disturbance Decoupling . . . . . . . . . . . . . . . . . . . . . 173 13.1 Disturbance Decoupling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 13.2 Variants of the Disturbance Decoupling Problem . . . . . . . . . . . . 174 13.3 Disturbance Decoupling of the First Kind . . . . . . . . . . . . . . . . . . 177 13.4 Structural Rank of a System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 13.5 Almost Disturbance Decoupling . . . . . . . . . . . . . . . . . . . . . . . . . . 181 13.6 Known-Disturbance Decoupling . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 13.7 Finding a Minimal Difference System . . . . . . . . . . . . . . . . . . . . . . 184 14 Structural Solutions to Disturbance Decoupling . . . . . . . . . . . 189 14.1 Idea of the Iterative Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189 14.2 Algorithm for Single-Variable Decoupling . . . . . . . . . . . . . . . . . . . 190 14.3 Structural Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 14.4 Matrix-Based Algorithm for Single-Variable Decoupling . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194 14.5 Optimising the Matrix-Based Algorithm . . . . . . . . . . . . . . . . . . . . 198 14.6 Multi-variable Cancellation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199 14.7 Strong Structural Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201 15 A Structural Reconfiguration Algorithm for Actuator Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 15.1 Test for Reconfigurability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 15.2 Reconfiguration After Actuator Faults . . . . . . . . . . . . . . . . . . . . . 207 15.3 Reconfiguration in a Fault-Tolerant Control Scheme . . . . . . . . . 210 15.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211

Part IV. Application Examples 16 Reconfiguration of the 3-Tank System . . . . . . . . . . . . . . . . . . . . . 215 16.1 Nominal 3-Tank System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 16.2 Valve 2 Blocked Open . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 16.3 Valve 2 Blocked Closed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 16.4 Pump 1 Blocked . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224 16.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

XIV

Contents

17 Reconfiguration of a Helicopter Model . . . . . . . . . . . . . . . . . . . . . 229 17.1 Helicopter Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229 17.2 Fault in a Main Rotor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233 17.3 Fault in Both Main Rotors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236 17.4 Fault in the Lateral Rotors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239 17.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242 18 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 18.1 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 18.2 Outlook . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244

Part V. Appendices Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 A.1 Terms of Fault-Tolerant Control . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 A.2 List of Important Symbols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251 RECONF – A Toolbox for Reconfiguration . . . . . . . . . . . . . . . . . . . . 253 B.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253 B.2 MATLAB Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253 B.3 Simulink Integration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261

1 Introduction to Control Reconfiguration

1.1 Fault-Tolerant Control Controlled technological systems are used in many fields. They provide essential services such as the regulation of water pressure, the control of grid frequency and the active stabilisation of high buildings. Unfortunately, all technological systems are subject to faults, due to both component malfunctions and unforeseen external influences. Since a controlled system is strongly connected, a fault in one part of a system affects all parts in the control loop. Thus, a severe fault may render the whole system inoperable. This usually means that the system has to be switched off until the fault is repaired. Fault-tolerant control deals with systems subject to faults. Whereas classical control only consider systems during nominal operation, fault-tolerant control explicitly includes the effects of faults on the behaviour of the system into consideration. The aim is to prevent a fault (an unintended change in a system component) from becoming a failure (the inability of the system to perform its mission). Several ways have been developed to improve the response of a system to a fault. This manuscript will pursue the active two-step approach to faulttolerant control (see Fig. 1.1): 1. Fault diagnosis: detect, isolate and identify the fault, 2. Control re-design: keep the system operable despite the fault by changing the controller in response to the identified fault. This approach is called active, because the re-design is a response to the occurance (and detection) of a fault. This contrasts to passive approaches, which strive for one controller that can handle all fault cases without any changes. Thomas Steffen: Control Reconfiguration of Dynamical Systems: Linear Approaches and Structural Tests, LNCIS 320, 1–7 (2005) c Springer-Verlag Berlin Heidelberg 2005 www.springerlink.com

2

1 Introduction to Control Reconfiguration Fault Reconfiguration

Supervisory level

Sensor data

Control changes

w

Diagnosis (FDI)

z

u Reconfigurable controller

Plant

Field level

y

Figure 1.1. Fault-tolerant control scheme

The approach consists of two separate steps. The first step is to detect and identify the fault. The second step depends on how the fault has changed the model of the system to control. If the fault leads to some parameter change in the system (a valve may react slower than usual), then the suitable response is to adjust the controller parameters. If one of several parallel system components suddenly becomes unavailable, then switching over to an unaffected component may be the appropriate reaction. In all cases, the fault-tolerant control scheme keeps the system operational by detecting the fault and implementing suitable counter-measures until the system can be repaired. There are also approaches that try to change the controller without explicitly isolating the fault, like adaptive (e. g. Jiang et al. [2003]) or robust control (e.g. Ackermann [1994] or Lunze [1988]). These are called active one-step approaches, since the fault detection step is not performed. Passive faulttolerance on the other hand refers to a system that remains functional after a fault without any change to the controller. A more detailed discussion of this classification and its problems was published by Blanke et al. [2003]. This manuscript will not use one-step or passive approaches.

1.2 Fault Detection Every two-step approach to fault-tolerant control requires the fault to be known before a reaction can be found and implemented. The fault is usually found in three stages: 1. Fault detection: determine that a fault has occured. 2. Fault isolation: determine where a fault has occured. 3. Fault estimation: determine how strong the fault is.

1.3 Control Reconfiguration

3

All three steps are necessary to build a new model of the faulty system. Without the last step, it is impossible to distinguish between faults of different strength, such as a damaged valve with limited functionality, and a valve that is stuck in a fixed position. This manuscript focuses on complete component failure, so the estimation step is not important for the typical faults considered here. If the fault estimation is not possible, it is also possible to disable the faulty component, and remove it from the model completely.

1.3 Control Reconfiguration Control reconfiguration is an approach for the second step of fault-tolerant control. It deals with the situation that an important signal path in the system is broken due to the fault. For example, a valve can become stuck, after which the corresponding actuator signal has no influence on the plant any more. The loss of one link in a control loop means that the whole loop fails and all elements become uncontrolled. In order to restore the control of the system, it is necessary to find a new signal path which circumvents the broken link. Since the signal paths in the physical system are the results of design and construction, they usually cannot be changed. However, changes can be made to the control structure of the system as shown in Fig. 1.2. The reconfigured controller may use a different actuator, which was set to zero by the nominal controller, or it may rely on a sensor reading that was previously unused. Because the structure of the controller is changed (in addition to the parameters), this approach is called control reconfiguration.

Nominal plant

u

0 unused signals

Nominal controller

Fault (uncontrolled change of the plant)

y

broken actuator Fault detection

Reconfiguration (planned change of the controller)

uf

Faulty plant New control signals

Reconfigured controller

Figure 1.2. Reconfiguration as response to the fault

broken sensor 0 yf

4


Control reconfiguration involves two main problems. The first one is to find alternative signal paths. A technical system is typically moderately sparse, which means that it has neither a very high number of signal paths (as in dense systems) nor only the minimum number of signal paths necessary (as in very sparse systems). Therefore, there are typically unused or redundant signal paths in the system, which can be used for the purpose of reconfiguration. The central question is whether the redundant paths are suitable to control the system despite the fault. The second part of the reconfiguration problem is that the alternative signal path will usually show a different amplification and different dynamics compared to the nominal system. Therefore, the control signal meant for the original signal path has to be “translated” to suit the alternative path. In other words: after a suitable control structure has been found, the controller parameters have to be adjusted or the controller has to be extended to fit this new structure. Since the number of components in modern control systems can be very large, it is not feasible to manually design a new control structure for every fault, and certainly not for every possible combination of faults. Therefore, control reconfiguration has to satisfy the following two requirements in order to solve the complexity problem. Minimal invasiveness: The reconfiguration solution cannot received extensive testing before it is implemented. It is therefore essential to keep the complexity of the reconfiguration solution as low as possible. One way to achieve this is to look for a minimal invasive solution. This means that changes to the control structures are only made in places where it is necessary. Solution with few changes to the existing control structure has several beneficial side effects. Since it has few parameters, the computational complexity should be low. And because only a few signal pathes are changed, the likelihood of a complication (due to modelling errors or inadequate design objectives) is kept low. On-line reconfiguration: Control reconfiguration has to be performed on-line, after the fault has been detected. This requires simple and fast algorithms that work reliably without manual intervention and without tuning the controller parameters for the fault case. The advantage is that both the amount of design work and the storage requirements are significantly reduced with respect to a redesign. It is sufficient to store a parametric model of the system (including all faults) and a reconfiguration algorithm. The new control structure is generated on demand after the fault has been detected.1 1

The approach to precompute a reconfiguration solution for every possible fault is often proposed, since it reduces the actual reconfiguration to the setting of new

1.5 Aim of this Manuscript

5

1.4 Reconfiguration Goal Systems are controlled for different reasons (also called control objectives). Since the goal of the control reconfiguration depends on the objective of the original controller, no single reconfiguration goal is sufficient to describe all problems. Therefore, five goals will be defined here. Since the nominal system is known to be suitable for the task, the goals require that the reconfigured system matches certain aspects of the nominal system. The five goals: 1. stabilisation goal: stabilise the control loop, 2. weak goal: restore the equilibrium output to its nominal value, 3. strong goal: restore the output trajectory to the nominal output, 4. direct goal: restore the state trajectory to the nominal state, 5. fault-hiding goal: calculate the output trajectory for the nominal plant. Each goal requires that the reconfigured system matches the nominal system in a certain way. For example the nominal system is known to be stable, and Goal 1 requires the reconfigured system be to the same. The nominal system has a certain output trajectory, and Goal 4 requires the reconfigured system to have the same output trajectory (given identical circumstances). The goals will be discussed in more detail in Sects. 4.5 and 5.3. The construction of the solution will then explain why the last goal is useful, although it may not have any effect on the physical system.

1.5 Aim of this Manuscript The aim of this treatment is to study a general formulation of the reconfiguration problem, and to find solutions that are applicable for on-line use. Both aspects have received little attention in recent literature, although they are important for the application of reconfigurable control to practical problems. Several specific formulations of the reconfiguration problem exist, but they are not flexible enough to cover the wide range of practical problems. Therefore, a new formulation has to be developed that can accommodate different requirements and boundary conditions. This will be done by defining the reconfiguration problem with respect to the five goals mentioned above. The influence of these goals on the solution of the problem has to be analysed. parameters, which requires little computational resources on-line. However, this approach requires significant resources at design time to generate and store the precomputed solutions. Especially the storage requirements can be prohibitive for any nontrivial system.

6


In order to understand the nature of the reconfiguration problem, it is important to relate it to known control problems. To simplify this step, the analysis is limited to linear systems, since only the theory of linear system is reasonably complete. The aim is to construct the solution to the reconfiguration problem building on existing methods for the control of linear systems.2 Finally, this work aims at presenting algorithms suitable for the on-line solution of practical problems. This requires simple algorithms of low computational complexity, that do not require manual intervention. In contrast to classical control, the algorithms have to be able to work with degenerated or singular problems. This ability is to be verified by solving several reconfiguration problems at real systems. The successful experimental verification also demonstrates that all relevant aspects of the practical problem have been considered during the theoretical treatment.

1.6 Structure of the Manuscript The introductory part of the manuscript will continue with a commented list of relevant literature. Both the idea of reconfiguration in general and works related to the specific methods used in this manuscript will be considered. Part I is concerned with the problem formulation. This is necessary because the term “reconfiguration” has different meanings across the scientific communities, and even in the field of fault-tolerant control there is some confusion about what qualifies as reconfiguration. A running example for reconfiguration is introduced to be used throughout the remainder of the manuscript. Inspired by this example, the general formulation of the reconfiguration problem is presented. While the general problem is initially defined on a nonlinear system, the remainder of the manuscript considers only the linearised version of it. Part II derives several approaches that solve the reconfiguration problem. Every chapter starts with a different reconfiguration goal. A solution is derived and its applicability is demonstrated at the running example. Although different design algorithms are presented, the basic structure of the virtual actuator is always the same. 2

To keep the results as general as possible, it is important not to introduce new assumptions at this stage. For example, several different approaches to stabilise a system are known that differ mainly in the specification of the design parameters (like pole placement or LQ control). Most approaches to the reconfiguration require a specific stabilisation approach. This manuscript aims at abstracting from the differences by concentrating on the common properties of all stabilisation approaches. The resulting solution algorithms can be used together with any stabilisation method suitable for the practical problem.

1.6 Structure of the Manuscript

7

Part III explains structural methods that can help to find a reconfiguration solution. It starts with an introduction into structural models and structural properties. Chapters 13 and 14 provide tests and solutions for the disturbance decoupling problem, which has to be solved in order to reach the strong reconfiguration problem. Part IV shows the result from practical reconfiguration experiments. The 3-Tank system is used first, since it is a simple system with only three states. The second example is the reconfiguration of a two-degrees-of-freedom helicopter model. It is more interesting, because even a simple model has seven states, and the system becomes unstable if not reconfigured properly.

2 Literature Overview

2.1 Fault-Tolerant Control This chapter introduces the main literature relevant for the field of reconfiguration. During the last decade, different communities have dealt with this topic, and unfortunately a lot of incompatible terminology has been used. Several different definitions are used for the term “reconfiguration”, leading to approaches that cannot be reasonably compared to each other. This overview tries to mention all approaches that are relevant for control reconfiguration in the sense defined in the introduction. Recent developments in the field of fault-tolerant control are presented in a book by Blanke et al. [2003]. The fault-tolerant control problem (as presented in the introduction) and different approaches to both the diagnosis step and the “re-design” step are developed. Related articles have been published by Blanke et al. [1999, 2000a,b]. The terminology and the classifications developed in these publications will be followed here. A detailed overview article over fault-tolerant control has been published by Patton [1997]. It contains many pointers into research fields diverging from the more strict definition of fault-tolerant control used here. Another recent, but not annotated, bibliography is presented by Kanev [2004]. Rauch [1995] has published an article that focusses on the task of autonomous control reconfiguration. The word “autonomous” means that the reconfiguration is performed within the control system, without external help (e.g. manual interaction). The restraints for control reconfiguration defined there are very similar to the reconfiguration problem considered in this manuscript. An overview and introduction into the field of reconfiguration has been published by Lunze [2002a]. A recent and very extensive bibliographical review of control reconfiguration approaches has been published by Zhang and Jiang [2003]. Two points are noteworthy: it shows the lack of general approaches Thomas Steffen: Control Reconfiguration of Dynamical Systems: Linear Approaches and Structural Tests, LNCIS 320, 9–14 (2005) c Springer-Verlag Berlin Heidelberg 2005 www.springerlink.com

10


to the reconfiguration problem (that are independent of a specific controller design method), and it mentions the lack of algorithms suitable for real time applications.

2.2 Specific Reconfiguration Approaches This section mentions approaches that deal with specific aspects of the reconfiguration problem. Only approaches powerful enough to deal with a severe fault such as the complete loss of an actuator or a sensor are included. Some related literature will be mentioned in a later section that does not meet this requirement. The first approaches to control reconfiguration have been developed in the aircraft industry. It is standard to use four parallel sensors and two parallel actuators for sensitive signals. Thus, a faulty actuator or sensor can be switched off, and the remaining redundant entities are used instead. This approach can be applied without further analysis of the system, and it is usually implemented in an ad hoc manner (Graham and McRuer [1973]). By introducing a component-oriented model that considers fault cases and alternative usage modes, this approach can be formalised and extended to more complicated systems (Choukair and Bayart [2000]). The problem of control reconfiguration without predesigned solutions is more difficult. An early approach for dealing with the loss of a sensor measurement comes from the field of fault detection. It seems intuitive to replace the missing signal by an observed value, since, according to linear theory, this should not affect the stability of the control loop. The “dedicated (and generalised) observer scheme” provides the framework for this approach: a bank of observers is used, where every observer relies on a different set of measurements (see Frank [1987a,b, 1990, 1992, 1994, 1996], Frank and Wuennenberg [1989], García and Frank [1996], Patton et al. [1989], Ding and Frank [1990], Isermann [1980, 1984]). Once a sensor fault is detected, an observer is activated which does not depend on this sensor, and the output of this observer is used to replace the broken sensor. Since this approach comes from fault detection, all observers are designed manually before the system is used. This reduces the reconfiguration action to the switching between the measured and the observed signal. Very few works deal with the problem of finding an observer for the faulty system on-line, after the fault has been detected. They are usually based on an optimisation problem like a Kalman filter or a Luenberger observer with linear-quadratic Gaussian feedback design (see Zhou et al. [2000]). No general study has been found that analyses the problem without reference to a specific design method. In Sect. 7, a solution will be derived that allows

2.3 General Reconfiguration Approaches

11

an on-line design of a stabilising reconfiguration solution, without assuming a specific control structure and without imposing a specific design method. For reconfiguration after actuator faults (significant changes in the response to the control input), a different approach is favoured in the literature. The basic idea is to match the autonomous system matrix of the faulty system to the matrix of the nominal system without introducing new states. This leads to the pseudo-inverse method (PIM) as developed by Stewart [1973] and Caglaye et al. [1988]. It introduces a static compensation matrix for the input of the system, which is found as the solution of an optimisation problem for approximating the nominal behaviour. Unfortunately, this approach has serious restrictions, since small deviations in approximation can lead to drastic changes in system properties. This may even lead to a loss of stability, as will be shown in a detailed analysis in Sect. 6.7. In an influential publication, Gao and Antsaklis [1991] propose a solution to the stability problem. However, this approach is very computationally intensive, and therefore not suitable for on-line application. Based on these different approaches, the general consensus seems to be that sensor faults are easier to treat than actuator faults. However, no systematic study exists that compares both problems. In Sect. 8.7, it will be shown that both problems are actually dual under certain conditions. The analysis also shows why, for most practical problems, the reconfiguration after actuator faults is indeed more difficult.

2.3 General Reconfiguration Approaches Recently, more systematic and powerful approaches to the reconfiguration problem have been developed. Several new ideas have been published in response to the Three-Tank Benchmark Problem defined by Heiming and Lunze [1999]. Independent solutions can be found by Pasternak [2002], Zhou et al. [2000] or Gehin and Staroswiecki [1999]. A second very influential benchmark is the Ship Propulsion Benchmark published by Izadi-Zamanabadi et al. [2000]. An important step for a systematic approach is the analysis of reconfigurability as a system property. A structural analysis of the reconfigurability has been described by Gehin et al. [2000] and Hoblos et al. [2000]. This approach is the basis for Part III, which will develop structural tests and algorithms to help the reconfiguration of structured systems. The reconfigurability is also studied on a linear level, based on the solvability of an optimal control problem with minimal control energy. Results of this approach have been published by Staroswiecki [2002] and by Wu et al. [2000]. A detailed study of the reconfigurability after actuator faults in the case of discrete actuator inputs can be found in Kanev and Verhaegen [2002].

12


A recent improvement of the pseudo-inverse method is the model-matching method by Chen et al. [2002]. It tries to restore the nominal behaviour as defined by the transfer function. Since the transfer function is a reasonable quantification of important system properties, this method is a lot more reliable than the pseudo-inverse method. Unfortunately, it is not well suited for the use in on-line reconfiguration, since the manipulation of rational matrix functions is mathematically challenging. An intuitive approach to the reconfiguration problem is the use of optimal control, since the optimal control problem can be easily updated for the fault by changing the model or the constraints of the plant. This idea has been studied in detail by Maciejowski [1998, 2002]. If a fixed optimal controller is used, it can easily be redesigned for the new system. This idea has also been studied by Lunze et al. [2003]. The main drawback of this approach is that it discards the nominal controller completely in favour of a redesigned optimal controller. Therefore, this approach is limited to systems which use an optimal controller or at least an observer/state feedback controller. In Chap. 8, a generalisation of this method will be developed which is applicable to any control structure and design method. The second drawback is that this approach updates all controller parameters, which does not satisfy the requirement of minimal changes. In Chap. 8 and in Sect. 13.7, ways to limit the changes to the relevant part of the system are discussed. Several more recent approaches focus on nonlinear and hybrid systems. The existence of a stabilisable equilibrium state is studied by Dardinier-Maron et al. [2000] and by Morari et al. [2000]. However, since the systematic design of hybrid controller is still a topic of ongoing research (see Kamau [2004]), the theoretical basis for control reconfiguration in hybrid systems is very weak. Earlier publications of the approach presented in this manuscript can be found in Lunze and Steffen [2003a,b], Lunze et al. [2003]. It has already been shown that it is not necessary to redesign the whole controller in order to find a general solution to the reconfiguration problem. The duality of the reconfiguration after actuator and after sensor faults has been previously mentioned in Lunze and Steffen [2002].

2.4 Alternatives to Reconfiguration Control reconfiguration is not the only way to provide fault-tolerant control. There are several approaches that can deal with minor faults more efficiently than reconfiguration. Robust control works without fault detection. The control loop is not changed at all in response to the fault, since this approach assumes the control structure to work for different fault cases without any change. A precise definition can be found in Blanke et al. [2000b]. The applicability of robust control is limited. The controller cannot be designed for one

2.4 Alternatives to Reconfiguration

13

specific system behaviour, but it has to be a compromise between different fault cases. The resulting control performance is often disappointing. Defining more fault cases makes the problem harder to solve, up to the point where no solution exists. Adaptive control does change the controller in response to the fault, but it does not explicitly detect or estimate the fault first (see Ioannou [1996]). Since the controller is continuously adapted to the situation of the plant, this approach is simple to implement. It works very well for small or slow parameter changes. However, the method usually fails for severe faults as considered here, especially if the fault occurs suddenly. Fault accommodation is similar to adaptive control, but it is based on a explicit diagnosis of the fault. The response to the detected fault is a change of the controller parameters. A formal definition of fault accommodation can be found in Blanke et al. [2000b]. The main problem of fault accommodation is to calculate these new parameters. This step is typically performed on-line, therefore fault accommodation is usually autonomous. However, because the structure of the controller is not changed, this approach is not able to deal with severe faults that change the structure of the plant. An extension, called control mixing, has been proposed that uses several control laws, and the fault accommodation changes the weight of these (see Kanev and Verhaegen [2002], Yang et al. [2000]). This approach moves the complexity of the problem to the design of the control laws, which is typically is performed manually together with the design of the nominal system. There are also methods that are as powerful or even more powerful than reconfiguration. A complete re-design of the control structure and the controller (from scratch) may be a general solution to the reconfiguration problem, but it very difficult to perform the redesign on-line and autonomously. Using the computational power of two modern PCs, autonomous reconfiguration by redesign has been implemented for the Flight Model in Lunze et al. [2003]. Predictive control schemes can easily provide for any change in the system behaviour. Every new control input is the result of a trajectory optimisation performed on a model of the plant. The reconfiguration of a predictive controller is as simple as updating the model used for the optimisation. This idea has been explored by Maciejowski [2002]. Unfortunately, this idea is strictly limited to predictive controllers, which require significant computing resources, and which are therefore both expensive and still only suitable for slow plants. Nevertheless, predictive control is one of the most powerful methods known for the control of nonlinear systems. An impressive case study concerning a fault in an aircraft has been presented by Maciejowski and Jones [2003]. An initial study on the application of predictive control to quantised systems is published in Lunze and Steffen [2000]. Finally, there are approaches that deal with a more general problem than reconfiguration. Supervisory control also tries to keep the system usable despite

14


the occurrence of faults, but it may change the goal of the system in order to do so. For example, if after a fault, a system cannot guarantee the required product quality despite reconfiguration, the supervisory control may decide to produce some other product with lower requirements. Approaches for supervisory control can be found in Izadi-Zamanabadi [1999] and Staroswiecki and Gehin [2001]. Supervisory control is usually based on a component-oriented model of the system that defines the characteristics and possible functions of the subsystems. For any subsystem, there may be alternative operation modes or configurations. This means that on a subsystem level, alternative control structures have already been designed and tested. The task of reconfiguration consists of finding a compatible set of configurations for all subsystems. While this approach relies on predesigned alternative control structures, these control loops typically involve only a small part of the system and are therefore easy to design. The aggregation into a configuration for the whole system is the main problem, and it is performed using discrete methods. Therefore, this approach can make use of completely different operation modes available in the system, which is not possible with most linear or nonlinear approaches. There is ongoing research activity in this area by Gehin and Staroswiecki [1999].

2.5 Advanced Control Theory The general formulation of the reconfiguration problem used here will lead to a disturbance decoupling problem, which belongs to a difficult class of problems from advanced control theory. For this problem, the so-called geometric approach developed by Wonham and Morse [1970], Wonham [1985] presents a natural solution. It allows a systematic analysis and synthesis by defining and comparing subspaces with special properties. A detailed overview for the geometric approach has been published by Marro and Piazzi [1992], Basile and Marro [1992] with recent additions by Marro [1996]. A well commented introduction in a more modern notation has been written by Hu et al. [2003]. In Part III, structural methods will be used for analysis and design of reconfiguration. The first in depth treatment containing many structural tests and design methods is written by Reinschke [1988], building on initial work by Lin [1974]. Some further ideas have been developed by Wend [1993], including the concept of strong structural properties (“strenge strukturelle Eigenschaft” in the German text), which will be used here. A simple introduction into the idea of structural analysis is published by Jantzen [1996]. It is related to the only available structural analysis toolbox, from which some ideas have been used in this manuscript and in the RECONF toolbox. There are several recent publications that deal with the application of structural analysis to the disturbance decoupling (see Commault et al. [1999, 1997, 1993], Martínez-García et al. [1999]). These results will become relevant for the Chaps. 13 and 14.

Part I

Reconfiguration Problem

This part of the manuscript provides an answer to the question of what control reconfiguration is. In order to derive a general formulation of the problem, only few assumptions are made. Five reconfiguration goals of different strength are defined, which correspond to common control objectives. By including one goal or another, different variants of the problem can be constructed. This makes the approach very flexible and suitable for different applications. The first chapter of this part introduces the 2-Tank System, which will serve as a running example of control reconfiguration. Based upon the discussion of this example, the nonlinear reconfiguration problem is developed. The notion of a “reconfiguration block” is introduced in order to define a general system theoretical framework for reconfiguration. In the last chapter of this part, the reconfiguration problem is applied to a linearised model of the system. This allows for the application of powerful methods from linear time-invariant control theory.

3 Running Example: the 2-Tank System

3.1 Nonlinear Model A simple system will be used as a running example throughout the manuscript. It serves to illustrate typical faults and the resulting reconfiguration approaches. The example is a reduced version of the popular Three-Tank Benchmark Problem first described by Heiming and Lunze [1999]. The system contains two tanks connected by a valve and filled by a pump. The goal is to maintain a constant outflow of the system, which requires a constant level in the right tank. Although the system is simple (see Fig. 3.1), it is sufficient to demonstrate the relevant effects encountered with respect to reconfiguration. Pump u1

Tank 1

Tank 2

Valve u2 0.6 m

q21

x1 = y1

0.3 m

x2 = y2

d

q

Figure 3.1. The 2-Tank System Thomas Steffen: Control Reconfiguration of Dynamical Systems: Linear Approaches and Structural Tests, LNCIS 320, 17–23 (2005) c Springer-Verlag Berlin Heidelberg 2005 www.springerlink.com

18


The system consists of two tanks with the levels x1 and x2 . Both levels can be measured using the outputs y1 = x1 and y2 = x2 . Water can be brought into the left tank using the pump u1 , and it can be let into the right tank using the continuously controlled valve u2 at the height h = 0.3. The right tank has an uncontrolled outlet, so that water flows out of it. The control objective is to maintain the outflow q close to a set-point q0 . Since q itself cannot be measured, the level x2 of the right tank is used as the relevant value, and the level necessary to reach the desired outflow q0 is used as a reference w2 . The left tank has an outlet via a valve d, which can be used to simulate a leak in this tank. Torricelli’s law defines the flow through a valve as proportional to the square root of the pressure (which is proportional to the level) and to its cross-section (the input). For the given system and under the assumption x1 > h > x2 , the flows through the two valves are q12 = ku2 x1 − h √ q0 = k x2 . This equation applies to both valves and to the outflow. The flow through the pump is assumed to be proportional to its control input. The law of mass conservation leads to the following non-linear model of the plant (3.1a) x˙ a1 = qmax ua1 − kua2 xa1 − h − k xa1 d a a a a x˙ 2 = ku2 x1 − h − k x2 (3.1b) z a = xa2 . (3.1c) Note that the index ·a is introduced here to denote an absolute value. This is in contrast to the relative values used in the linearised model below.

3.2 Linear Model To keep the system simple, k = 1 and qmax = 1 are assumed. During nominal operation, the right tank is filled up to xa2 = 0.25 m, and the level in the left tank is 0.25 m higher then the valve (xa1 = 0.55 m). It follows that the outflow is z a = 0.5. The connection valve is set to ua2 = 1 and the pump power is at ua1 = 0.5 (equal to the outflow). The outlet valve for simulating the disturbance is not used (d = 0). For the linearisation of the system, new variables are introduced that are relative to the equilibrium. For distinction, the relative variables are not indexed with an ·a :

3.3 Controller

19

x1 = xa1 − 0.55 m x2 = xa2 − 0.25 m u1 = ua1 − 0.5 u2 = ua2 − 1 z = z a − 0.5 . For small relative values, the system can be described in a reasonably accurate way by the following linear set of equations: −0.25 0 1 −0.5 x˙ = x+ u (3.2a) 0.25 −0.25 0 0.5 −0.74 + d 0 (3.2b) (3.2c)

y=x z = x2 . The poles of the open-loop plant are both at −0.25.

3.3 Controller For normal operation, two proportional controllers are used. The first controls the level x1 of the left tank using the pump u1 . The second controller uses the connection valve u2 to control the level x2 of the right tank. The control law is 3 0 u= (w − y) (3.3) 0 10

where w=

w1 w2

is the reference input for the levels of the two tanks. The control structure is shown in Fig. 3.2. Combining plant (3.2) and controller (3.3) leads to the closed-loop model −3.25 5 3 −5 −0.74 x˙ = x+ w+ d 0.25 −5.25 0 5 0 y=x z = x2 . The poles of the closed-loop system are −2.75 and −5.75.

20

3 Running Example: the 2-Tank System d

Nominal plant Tank 1

(Fault 1) -

1 s+0.25

Tank 2 x1 0.25

1 s+0.25

x2

z

0.5 u1

(Fault 2)

(Fault 3)

u2

y2

y1

Controller

-

w2

* 10 -

w1

*3

Figure 3.2. Control structure for the nominal 2-Tank System

3.4 Faults Three faults are considered: 1. loss of actuator u1 (blocked in nominal position): u1 = 0

(3.4a)

2. loss of actuator u2 (blocked in nominal position): u2 = 0

(3.4b)

3. loss of sensor y1 (sensor data not available, fill with 0 instead): y1 = 0 = x1 .

(3.4c)

Since the linearised variables are considered (without the steady state offset), a value of zero means that the variable is at its nominal level. Therefore, the two actuator faults (u1 = 0 or u2 = 0) assume that the corresponding actuator becomes stuck in the nominal position. This means that only the dynamical behaviour of the system is affected, and not its equilibrium. Faults which do affect the equilibrium will be treated in Chap. 16.

3.5 Analysis

21

3.5 Analysis A simulation run is performed to show the response of the system. The first part tests the autonomous response: the level x2 in the right tank is initially 0.04 m below nominal. In the second part, the reference input w2 is increased by 0.05 m at t = 5 s, and it is decreased to the nominal value again at t = 10 s. In the third part, the valve in the left tank is used to simulate a disturbance with d = 0.1 (at t = 15 s). The result for the linearised nominal system is shown in Fig. 3.3. The plots show the relative system values, relative to the equilibrium used for linearisation.

Right tank

Left tank

Plant input

Controller output

For comparison, the response of the faulty system without reconfiguration is shown. Because this example system is inherently stable, it does not get unstable due to the fault (which otherwise it might). Fault 1 and Fault 3 both break the first control loop. The poles of the faulty closed loop are then at −0.15 and −6.8, which leads to the response shown in Fig. 3.4. While the level x2 of the right tank can be sustained for a while, the level x1 of the left tank is uncontrolled and assumes very low values. Fault 2 breaks the second control loop, leading to poles at −1 and −4, with the simulation results shown in Fig. 3.5. It can be seen that this system does not respond to set-point changes any more.

1

uC2

0

uC1

^ disturbance

−1 1

u2

0

u1 −1

0.2 0 −0.2 −0.4

x1 Actual level

0.1

w2 Reference

0

x2 Actual level

−0.1

0

5

10 Time t/s

15

Figure 3.3. Nominal response of the 2-Tank System

20

1

uC2

uC1

0 ^ disturbance −1 1

uf 2

0

uf 1

−1

0.2 0 −0.2 −0.4

xf 1 Actual level

0.1

Right tank

Left tank

Plant input

Controller output


w2 Reference

0 −0.1

xf 2 Actual level 0

5

10 Time t/s

15

20

Left tank

Plant input

Controller output

Figure 3.4. Response of the 2-Tank System after Fault 1

Right tank

22

1

uC2

0

uC1

^ disturbance

−1 1

uf 1 0

uf 2 −1

0.2 0 −0.2 −0.4

xf 1 Actual level

0.1

w2 Reference

0

xf 2 Actual level −0.1

0

5

10 Time t/s

15

Figure 3.5. Response of the 2-Tank System after Fault 2

20

3.5 Analysis

23

The goal of the reconfiguration is to improve these responses and make them match the nominal response of the system more closely. The main control objective is to keep the level x2 of the right tank reasonable close to setpoint. A slight deviation from the set-point is considered acceptable (since the nominal controller does not provide accurate set-point tracking either).

4 General Reconfiguration Problem

4.1 Overview In this chapter, a formal definition of the reconfiguration problem is developed. While the general idea of reconfiguration may appear obvious, there are many different ways to formulate the problem (several common approaches are listed in Patton [1997]). The problem formulation developed here is special for two reasons. On the one hand, it is kept as simple as possible. Only the minimal number of signals is used, and the definition is kept strictly within the theory of continuous (linear or nonlinear) time-invariant systems. On the other hand, as few assumptions as possible are made during the problem formulation, so as to keep it as general as possible. The chapter starts with a definition of the system to reconfigure. The behaviour both before and after the occurrence of the fault is considered. The separation of the system into plant and controller is introduced, followed by the concept of the reconfiguration block. The discussion of the goals of the reconfiguration is deferred until after these definitions, since they are required to state the five reconfiguration goals in a formal way. The chapter concludes with a discussion of the 2-Tank Example using the introduced problem formulation.

4.2 Modelling the System and the Fault The first step is to define the system S under consideration. A system definition contains both the behaviour of the system and the connections to the environment: the inputs and outputs (see Fig. 4.1). The input is called d ∈ Rnd and the output is called z ∈ Rnz . The behaviour of the system S is assumed to be deterministic and known. Therefore, some mathematical model Thomas Steffen: Control Reconfiguration of Dynamical Systems: Linear Approaches and Structural Tests, LNCIS 320, 25–39 (2005) c Springer-Verlag Berlin Heidelberg 2005 www.springerlink.com

26

4 General Reconfiguration Problem d

Nominal system

z

S Figure 4.1. The nominal system

exists that can determine the trajectory of z(t) once the input trajectory d(t) and the initial state of the system are known (the most common model form being an ordinary differential equation). This system may be subject to faults. At some point in time, a fault f occurs that changes the behaviour of the system. Such a fault is recognised by a fault detection and isolation (FDI) system. Fault detection and isolation has received ample treatment in the literature and it is the subject of active research (see Blanke et al. [2003], Puig et al. [2003], Yee et al. [2002] or Supavatanakul [2004]). Although it is a very interesting topic, its full breadth is beyond the scope of this document. At this place, it is assumed that the fault has been detected, isolated and unambiguously identified. Therefore, it can be assumed that the model of the faulty system is known before the reconfiguration is initiated. Assumption 4.1 The reconfiguration algorithm can rely on a model of the faulty system to be known. In order to get this model, the fault is also assumed to be constant (it does not change in magnitude over time). In the case that a part of the faulty system cannot be modelled, it is assumed that this part of the system is disabled and the model is updated accordingly. 1 It is therefore possible to update the mathematical model of the system S in such a way that it describes the behaviour of the faulty system Sf (see Fig. 4.2). It is assumed that the fault does not change anything outside of the system under consideration.

Assumption 4.2 The fault does not affect the system input d.

1

This way, it may still be possible to derive a precise model of the faulty system by disabling uncertain parts of the system. For example, if an actuator has reduced effectiveness (but the extend is unknown), the actuator can be set to zero, leading to a model without this actuator. The same applies if the effectiveness of the actuator changes over time. Obviously, this leads to a structural change of the model, and it may make the control of the faulty plant more difficult.

4.2 Modelling the System and the Fault

d

Faulty system

27

zf

Sf

Figure 4.2. The faulty system

Therefore the model Sf is sufficient to analyse the effects of the fault and the effectiveness of the reconfiguration measures. In order to avoid the difficulties involved with the analysis of switching systems (see Böker [2003] or Kleinert and Lunze [2002] for details), the reconfiguration problem is posed in terms of two separate models: the model S of the nominal system and the model Sf of the faulty system. The model Sf of the faulty system is defined in the same way as the nominal system, but the values of signals and matrices may be different. To distinguish between the nominal and the faulty system, all symbols belonging to the faulty system are denoted with an index f . Therefore the faulty system has the output zf . Due to the assumption the input d is unaffected by the fault. This manuscript concentrates on faults that change the structure of the system. For example, an actuator can get stuck or a sensor can be defect. In both cases, there is no connection between the sensor or actuator signal and the plant. This could be modelled by removing the signal variable from the system, but a change of vector dimensions makes comparisons between the nominal and the faulty system difficult. Instead, faults are shown by replacing the input variable with a constant or by setting the output variable to zero. Therefore, the input and output vectors are of the same dimension for both systems. Some elements of these vectors may be without connection to the plant due to the fault.2 The reconfiguration changes the structure of the system in response to the fault, resulting in the reconfigured system Sr (see Fig. 4.3). The aim of the reconfiguration is that the reconfigured system can stay operational and serve the function the nominal system had. For the 2-Tank example, the nominal system is defined by the closed-loop model of plant and controller. The input consists of the disturbance d and the references w1 and w2 . The output is the outflow z = q0 . The control input u and output y are internal coupling signals of the loop, which are not relevant on the level of the complete system. 2

Because structural changes in the system are considered, this manuscript deals with a reconfiguration problem. If the faults under consideration had only a qualitative influence on the system (without changing the signal pathes), fault accommodation would be the appropriate approach for fault-tolerant control.

28

4 General Reconfiguration Problem Fault Reconfiguration

Diagnosis (FDI) Sensor data

Structure changes

d

zf

Reconfigured system

Sr

Figure 4.3. The reconfigured system

The faulty system is defined in the same way, but the coupling between controller and plant is different, leading to a different external behaviour. The reconfigured system should again have the original stationary behaviour. A slightly slower system response to set-point changes or to disturbances is acceptable. These goals have to be reached by extending the control structure and adjusting the controller parameters.

4.3 Control Loop The goal of the reconfiguration is to change the faulty system in such a way that it becomes identical to the nominal system in behaviour. As the word “reconfiguration” implies, this is to be achieved by changing the way the components of the system interact, and adjusting the parameters where necessary. However, not all aspects of the system can be changed, since some are due to physical laws or essential for the operation. In this manuscript, it is assumed that every aspect of the controller can be changed, while the plant cannot be changed by the reconfiguration. Obviously the fault has to be in the plant, since otherwise the fault could be repaired directly. z

d Nominal plant

y

u w Nominal controller

Figure 4.4. The nominal control loop

4.3 Control Loop

29

The nominal control loop consists of the nominal plant and the nominal controller. The loop corresponds to the nominal system S in the last section. Plant and controller are connected via the measured output y and the control input u. The behaviour of the plant is defined by a state-space model with two inputs u and d and two outputs y and z. In order to avoid difficulties with algebraic loop, the model without feedthrough x˙ = f (x, u, d)

(4.1a)

y = g(x) z = h(x)

(4.1b) (4.1c)

x(0) = x0

(4.1d)

is defined with the vectors plant state x ∈ Rnx initial state x0 ∈ Rnx control input u ∈ Rnu measured output y ∈ Rny disturbance input d ∈ Rnd external output z ∈ Rnz and the system functions f : Rnx × Rnu × Rnd → Rnx g : Rnx → Rny h : Rnx → Rnz of the corresponding dimensions. The function f describes the dynamics of the model, while g and h are static output functions. This form allows for the modelling of most technical systems with continuous physical values. The nominal controller is also a dynamical system, but in contrast to the plant most controllers have feedthrough. This leads to the following statespace model x˙ C = fC (xC , y, w) u = gC (xC , y, w) xC (0) = xC0 with the additional vectors controller state xC ∈ Rnc initial controller state xC0 ∈ Rnc reference input w ∈ Rnw

(4.2a) (4.2b) (4.2c)

30


zf

d Faulty plant

uf w

yf Reconfigured controller

Figure 4.5. The reconfigured control loop

and system functions fC and gC of the corresponding dimensions. The reference input w is introduced here as a second external input to the loop. While the reference w is known and affects the controller, the disturbance d is unknown (to the controller) and affects the plant.3 The faulty plant shows a behaviour that differs from that of the nominal plant. Therefore, a new model is constructed for the faulty plant: x˙ f = ff (xf , uf , d) yf = gf (xf ) zf = hf (xf ) xf (0) = x0 .

(4.3a) (4.3b) (4.3c) (4.3d)

To distinguish the symbols of the faulty system from the ones of the nominal system, the former are denoted with the index f . This does not apply to the disturbance input d and the initial state x0 because they are assumed identical for the nominal and the faulty case. For convenience reasons, all matrices and vectors of the faulty system are assumed to have the same dimension as in the nominal system (but possibly different values).4 It is assumed that the controller can be changed during the reconfiguration, while the faulty plant remains fixed. 3

4

It is theoretically possible to formulate the same system without the additional reference input w by including it in the disturbance d. However, defining two separate inputs is more intuitive, and it makes it possible to study their influence separately. In the literature of fault-tolerant control the dimensions of uf and yf are typically reduced by removing the broken actuator or sensor variables. This may appear to be a natural way of modelling faults, and in fact most of the methods developed later can still be applied. However, since there is no obvious correspondence between the variables, it becomes impossible to compare the nominal and the reconfigured signals without defining additional mappings. This argument applies also to the state of the plant, where a change of dimension causes even more serious problems.

4.4 Reconfiguration Block

31

Assumption 4.3 The reconfiguration can change every aspect of the controller, but it cannot change the behaviour of the faulty plant.

To model the reconfiguration, the “nominal controller” is removed from the control loop and replaced by a new “reconfigured controller” (see Fig. 4.5). This view of reconfiguration makes it possible to change signal paths without leaving the linear framework. From a theoretical point of view, the distinction between plant and controller is not always unique. If a proportional controller is used, it can also be included into the plant without changing the problem. The important aspect is the definition of the connection signals u and y. They determine which values can be changed during the reconfiguration. The second ambiguity concerns the outer boundaries of the system. It is possible to define the problem for a complex system with several control loops, or to study only a single control loop at a time. Considering only a small part may make the problem unsolvable, and dealing with a complete model may lead to an unnecessarily complex problem. A theoretical approach for finding the relevant part of the system will be presented in Sect. 13.7.

4.4 Reconfiguration Block The reconfigured controller could be found by re-designing the control from scratch, based only on the original specification of the control objectives. However, the idea of reconfiguration is to build on the existing control structure and to change it only where necessary. Therefore, the nominal controller is used as a basis for the construction of the reconfigured controller. As already discussed, the faulty plant offers different control input and output variables, compared to the variables used by the nominal controller. For a successful reconfiguration, it is usually necessary that the set of effective control signals is not only restricted due to the fault, but also extended by control signals, which were not used by the nominal controller. Therefore, it is advisable to define as many control input and output variables in the plant as possible. This means that the input vector u contains all available actuator signals and the output vector y contains all available measurements, even the ones not used by the nominal controller (see Fig. 1.2). These additional signal values provide the redundancy and the alternative control paths necessary for a successful reconfiguration.

32


The central task of reconfiguration is to transform the control structure to use these new control signals. The proposed structure is shown in Fig. 4.6. The nominal controller is still part of the reconfigured control loop, but a reconfiguration block is added between the nominal controller and faulty plant in order to translate the control signals. This way the functionality of the nominal controller can be used where appropriate, but part of the controller can also be disconnected from the plant if it is not suitable. The number of states of the reconfiguration block can be used as a measure to determine how much of the controller is changed by the reconfiguration.

zf

d Faulty plant Reconfigured plant

uf

yf Reconfiguration block

uC

yC

Reconfigured controller

w Nominal controller

Figure 4.6. Reconfigured control loop

The nominal controller in the reconfigured control loop has the same behaviour as in the nominal control loop, but the coupling signals are renamed to yC and uC x˙ C = fC (xC , yC ) uC = gC (xC , yC ) xC (0) = xC0 . The additional part of the reconfigured controller is called reconfiguration block, because it contains all the functions and connections added to the control loop during the reconfiguration. It is a dynamical system with the two inputs yf , uC and the two outputs yC , uf . Therefore, the reconfiguration block has the following state-space model:   x˙ R  yC  = fR (xR , uC , yf ) uf xR (0) = xR0

4.5 Reconfiguration Goals

33

with the state vector xR ∈ Rnr of the designed size. The system function fR has to be found by a reconfiguration algorithm. For further analysis, the reconfigured control loop can be grouped in two different ways, leading to two different views of the loop. The obvious approach is to consider the reconfiguration block as an extension of the controller. Both together form the reconfigured controller, which is connected to the faulty plant. However, the analysis is significantly simplified, if the reconfiguration block and the faulty plant are considered together. The resulting subsystem is called the reconfigured plant, and it is controlled by the nominal controller.5 Note that this structure is chosen to provide a starting point for the automatic design of the reconfiguration block. It does not restrict the set of possible solutions to the reconfiguration problem, since theoretically any new controller can be implemented in the reconfiguration block without connection to the nominal controller. However, in order to keep the changes of the control loop to the minimum, the nominal controller should be used where appropriate.

4.5 Reconfiguration Goals The reconfiguration tries to restore the functionality of the system despite a fault. Therefore, the goal of the reconfiguration depends on the control objective of the nominal controller. However, there are two reasons not to use the original control objective directly. 1. The control objective applies to the nominal system. It is typically the result of a trade-off between different requirements, and this trade-off may be impossible to reach by the faulty system. On the other hand, some requirements may not apply to the faulty system in the same way. For example, the nominal control loop may not use a set of actuators because they are not reliable enough for permament use. Since the reconfiguration is only a temporary measure in order to reduce the down time, it may be perfectly acceptable for the reconfigured controller to use these actuators. 2. During a typical controller design process, the objective is updated several times by trial and error until it leads to an acceptable result. This means that the working objective leads to acceptable parameters in the controller design algorithm, but it may not precisely reflect the initial system requirements. The actual system requirements may be more complicated and possibly too complex to be useful for the given controller design algorithm. 5

Note that imposing this structure does not restrict the set of solution, but it gives a starting point for the automatic design of the reconfiguration block and therefore the reconfiguration of the loop.

34


In order to deal with these aspects, the reconfiguration goals will be specified by comparing the behaviour of the reconfigured control loop with the behaviour of the nominal control loop. The nominal control loop is described by the model of the nominal plant (4.1) and the nominal controller (4.2). Similarly, the reconfigured control loop is defined by the model of the faulty plant (4.3), the reconfiguration block (4.5) and the controller (4.4), as shown in Fig. 4.7. Direct goal: equal state

d

zf

Weak goal: equal to nominal equilibrium

Faulty plant

uf Stabilisation goal: loop stability

yf

Strong goal: equal to nominal trajectory

Plant view Reconfiguration block Controller view

uC

Fault hiding goal: equal to nominal trajectories

yC

w Nominal controller

Figure 4.7. The goals in the reconfigured control loop

The most common control objectives for a control loop are to stabilise the system, to reach a certain stationary output (set-point tracking) and to follow a given trajectory (perfect tracking). These goals also apply to the faulty control loop, leading to the following reconfiguration goals: Stabilisation goal: restore the stability of the control loop Weak reconfiguration goal: restore the equilibrium, Strong reconfiguration goal: restore the dynamical behaviour of the system. Two further goals will be defined that do not correspond to common control objectives. Direct reconfiguration goal: restore the state trajectory of the plant, Fault hiding goal: hide the fault from the controller view.


35

All five goals are shown in Fig. 4.7, together with the relevant signals they apply to in the reconfigured control loop. The reasons for choosing these goals will be explained separately for each goal after its formal definition.6 Stability is the most basic goal of reconfiguration, because an unstable control loop is usually not usable. While many definitions for the stability of nonlinear systems exist, in this manuscript the concept of bounded stability is used. It requires that for bounded input signals (and bounded initial states) all system variables are bounded. Definition 4.1 Stabilisation goal A reconfigured control loop is said to be stable if and only if all state variables of the faulty plant (4.3) in the reconfigured loop are bounded. If xf denotes a state variable of the plant, and |xf |∞ = max xf i (t) i,t≥0

denotes the highest value ever reached by a state in the system, the requirement is ∀ε ∈ R+ , ∃δ ∈ R+ : |d|∞ , |w|∞ < δ → |xf |∞ , |uf |∞ < ε . The condition applies to both the state and the input of the plant. For any controller that uses minimal control energy, the later follows from the former. The weak reconfiguration goal requires that the reconfigured control loop has the same stationary behaviour as the nominal loop. Definition 4.2 Weak reconfiguration goal A reconfigured control loop satisfies the weak reconfiguration goal, if and only if the external output zf (t) of the faulty plant (4.3) converges to the output z(t) as defined by the nominal plant (4.1) in the nominal control loop lim z(t) − zf (t) = 0

t→∞

(4.6)

for all constant input signals d and w and all initial states x0 . The strong reconfiguration goal goes further: it requires that the dynamical behaviour is identical, too. Definition 4.3 Strong reconfiguration goal A reconfigured control loop satisfies the strong reconfiguration goal, if and only 6

In addition to these goals, further soft performance goals like a certain attenuation of disturbance or a maximum settling time may be given. It is difficult to provide a general framework for these soft goals, but they will be considered for the reconfiguration design in some of the algorithms in Part II.

36


if the external output zf (t) of the faulty plant (4.3) follows the trajectory defined by the output z(t) of the nominal plant (4.1) in the nominal control loop (4.7) ∀t ∈ R+ : z(t) = zf (t) for all input trajectories d(t) and w(t) and all initial states x0 . If the output of the system is equal to the state (z = x), the strong reconfiguration goal turns into the direct reconfiguration goal. It is defined mainly for historical reasons, since it is the basis for early reconfiguration approaches like the one by Gao and Antsaklis [1991]. This goal has the strongest condition out of all the goals. Definition 4.4 Direct reconfiguration goal A reconfigured control loop satisfies the strong reconfiguration goal, if and only if the state xf (t) of the faulty plant (4.3) follows the trajectory defined by the state x(t) of the nominal plant (4.1) in the nominal control loop ∀t ∈ R+ : x(t) = xf (t)

(4.8)

given the same input trajectories d(t) and w(t) and the same initial state x0 . The last goal is defined as a technical goal. While the four former goals concern the signals xf and yf of the plant, this technical goal concerns the controller input yC (see Fig. 4.7). Therefore, this goal has no direct consequence for the plant itself, but it helps to find a reconfiguration block according to the structure in Fig. 4.6. The idea is that the controller shall not notice the fault. This requires the signal yC from the reconfiguration block to be indistinguishable from the corresponding signal y of the nominal plant. Definition 4.5 Fault-hiding goal A reconfigured control loop satisfies the fault-hiding goal, if and only if the output yC (t) of the reconfiguration block (4.5) is equivalent to the output y(t) of the nominal plant (4.1) in the nominal control loop ∀t ∈ R+ : y(t) = yC (t)

(4.9)

given the same input trajectory w(t) and the same initial state x0 . The disturbance d is assumed to vanish for this goal, because only the transmission properties of the reconfigured plant (consisting of the reconfiguration block and the faulty plant) are considered. In other words: the fault-hiding goal is satisfied, if the nominal and the reconfigured plant have the same input/output behaviour. While it is theoretically possible to satisfy this without stabilising the plant, for most practical cases the fault-hiding goal will be pursued in addition to the stabilisation goal.


37

Lemma 4.6 Fault-hiding goal Assume an initual state of x = xf = x0 = 0 is an equilibrium, so that there is no free motion. Then, the fault-hiding goal is satisfied if the reconfigured plant has the same input/output behaviour (from uC to yC ) as the nominal plant (from u to y). Proof. This lemma can be shown by a simple system theoretical analysis. The nominal and the reconfigured control loop both consist of two parts: the controller (which is identical in both cases), and the nominal plant or the reconfigured plant, respectively. It follows from the assumption, that the two open loop chains of controller and plant are identical in input/output behaviour. Therefore, the two closed-loop systems show the same behaviour, including the same output yC (t) = y(t). This goal makes the reconfigured plant a “drop in” replacement for the nominal plant. Since the nominal loop is known to be stable, the stability of the signals yC and uC in the reconfigured control loop follows directly from this goal. This also shows the stability of all states that are observable from the controller view. Therefore, this goal can help to demonstrate the stability of the reconfigured control loop, since only the unobservable modes remain to be studied. Including the fault hiding goal into the problem definition limits the set of reconfiguration solutions, but it does not change the solvability of the problem. In other words: there may be many different solutions without this goal, and only one or a few that satisfy it. But it is not possible that the reconfiguration is solvable without the fault hiding goal, but unsolvable once this goal is included. Based on this fact, there are several reasons why the fault hiding goal is useful: 1. Every solvable reconfiguration problem has a solution that also satisfies the fault-hiding goal. This will be shown in Chaps. 7 and 8. 2. The fault-hiding goal usually requires the insertion of a reconfiguration block into the control loop. It is therefore essential for the derivation of the reconfiguration solutions in in Part II. 3. This goal is justified from the practical side, because the output of the plant is usually the value which is controlled, and therefore the physical value of interest. Restoring this value is an important aspect of the reconfiguration. 4. In some cases the fault-hiding goal may not be applicable to some output signals. Then a modified system model can constructed, where the irrelevant part of the plant is moved into the controller. This leads to a plant model with fewer output signals, and it is therefore easier to satisfy the fault-hiding goal.

38


If the fault-hiding goal is satisfied, the reconfiguration solution is independent of the controller. Since the reconfigured plant has the same behaviour as the nominal plant, any controller that stabilises the latter will also stabilise the former. Therefore, the reconfiguration can be performed without knowledge of the specific controller used. It is not even required that the controller belongs to the same class used for the plant.7

4.6 2-Tank Example For the 2-Tank Example, the nonlinear system equation (3.2) fits the plant definition (4.1). The corresponding system function is a a a x − hu − u1 − 2 1 a ax1 d f (x, u, d) = x1 − hu2 − x2 g(x) = x h(x) = x2 . The plant has two control input variables u1 and u2 , one disturbance input d, two measured output variables y1 = x1 and y2 = x2 and one external output √ variable z = x2 (which is used because it is simpler than q = x2 ). Fault 1 replaces u1 and Fault 2 u2 by a constant, since these are the actuators considered broken by the corresponding fault. The variables are still there, but they have lost the influence on the system behaviour. In the case of Fault 3, the sensor reading y1 is no longer equal to x1 . In order to get a defined behaviour, y1 is set to zero. The reconfiguration problem for the 2-Tank system can be defined using the reconfiguration goals defined in Sect. 4.5. Fulfilling the stabilisation goal (Definition 4.1) is obviously necessary for a successful reconfiguration, since an unstable loop would imply that a tank becomes empty or flows over in the long run. The objective of the system also includes a “reasonably short” settling time. This is a specialisation of the stabilisation goal, because the system is not only required to converge, but to do so reasonably fast. It requires that all states of the plant be controlled, since the open-loop behaviour is not fast enough. The weak reconfiguration goal (Definition 4.2) is slightly stronger than necessary for this system. The nominal control loop shows a slight deviation 7

This fact is another important aspect to be considered when partitioning the system into “plant” and “controller”. Strong nonlinearities should go into the controller part so that a suitable linearisation for the plant can be found, allowing a linear reconfiguration approach to be used. Unfortunately, this is only possible as long as the fault occurs in the linear part of the system.

4.6 2-Tank Example

39

from the set-point, and the weak reconfiguration requires exactly the same deviation from the reconfigured control loop. This satisfies the system objective of maintaining the stationary output close to the set-point. Therefore, the weak reconfiguration goal will be pursued in order to find an acceptable solution. The strong reconfiguration goal (Definition 4.3) is not required, since there is no specification for the dynamic behaviour of the system. The same applies to the direct reconfiguration goal (Definition 4.4), since the state of the system (especially the level xf 1 of the left tank) is not required to take a specific value. The fault-hiding goal (Definition 4.5) is not required according to the system objective. It will be pursued nevertheless, since it leads to an elegant solution of the reconfiguration problem.

5 Linear Reconfiguration Problem

5.1 Nominal Control Loop In this chapter, the general reconfiguration problem is specialised by applying it to linear systems. The advantage is that the problem can be broken down into smaller parts by making use of superposition. This permits the analysis of how typical fault locations interact with the reconfiguration goals defined in the previous chapter. From the stability of the nominal control loop, it follows that it has an equilibrium. The linearisation is performed around this equilibrium. It is assumed that all signals remain sufficiently close to the equilibrium, so that the linearised model is a reasonable approximation of the nonlinear system from (4.1). To avoid mathematical difficulties, it is further assumed that the plant has no feedthrough. This is not a serious restriction, since the feedthrough does not affect the dynamics of the plant. Therefore, the linearised model of the nominal plant (see Fig. 5.1) is x˙ = Ax + Bu + Bd d y = Cx z = Cz x x(0) = x0 ,

(5.1a) (5.1b) (5.1c) (5.1d)

where the system matrix are defined by the Jacobian (or partial derivative matrix) of the system functions f (x, u, d), g(x) and h(x) in the equilibrium. Note that the linear model describes the behaviour relative to the equilibrium. Therefore, the variable values differ from the values used in the nonlinear model by this equilibrium. Since this chapter deals with linear systems only, it is not necessary to define a separate set of symbols.

Thomas Steffen: Control Reconfiguration of Dynamical Systems: Linear Approaches and Structural Tests, LNCIS 320, 41–51 (2005) c Springer-Verlag Berlin Heidelberg 2005 www.springerlink.com

42

5 Linear Reconfiguration Problem d

z Cz

Bd

B

u

x C

y

A

Figure 5.1. The nominal plant

The controller is defined by the state-space system1 x˙ C = AC xC + BC (w − yC ) uC = CC xC + DC (w − yC )

(5.2a) (5.2b) (5.2c)

xC (0) = 0 .

In the nominal control loop, the controller (5.2) is connected directly to the plant (5.1) with u = uC and yC = y. This results in the closed-loop model d x BDC Bd x d (5.3a) = AS + w+ BC O xC dt xC (5.3b) (5.3c)

y = Cx z = Cz x

with AS =

A − BDC C BCC −BC C AC

The set of poles of the closed-loop system is given by the eigen-values of the system matrix σ(AS ). The way the reference signal is fed into the controller may seem restricting. However, this structure can be assumed without loss of generality. The vector yC can be extended by an additional zero subvector, so that the result of the subtraction only depends on w for this subvector.

5.2 Fault and Reconfiguration The model of the faulty plant (see Fig. 5.3) is linearised in the same way : 1

The approaches presented in this manuscript do not depend on the model of the controller. They do not even depend on a linear controller. However, a linear controller is assumed for the analysis, because this allows for the use of linear methods to study the closed-loop system.

5.2 Fault and Reconfiguration d

Nominal plant

z

Cz

Bd

B

x

43

C

A u(= uC )

y(= yC ) -

Controller

w

DC CC

xC

BC

AC

Figure 5.2. The nominal control loop

x˙ f = Af xf + Bf uf + Bd d yf = Cf xf zf = Cz xf xf (0) = x0 .

(5.4a) (5.4b) (5.4c) (5.4d)

The three matrices Af , Bf and Cf may have changed due to the fault. The initial state, the external input and the matrices Bd and Cz are assumed to be the same as in the nominal plant.2 It is assumed that the faulty plant is still stabilisable using the control input uf and detectable using the output yf . This means that all unstable modes are both observable and controllable. The nominal controller is used in the reconfigured control loop, but a reconfiguration block is inserted between the faulty plant and the controller (see Fig. 5.4). The reconfiguration block is a dynamical system with two inputs and two outputs. To avoid algebraic loops with the controller, it is assumed that there is no feedthrough in the reconfiguration block between uC and yC . 2

Changes of Bd and Cz are not considered, because they do not change the behaviour of the control loop. Therefore, the best way of treating them is to apply an external compensation to the system. The approach will not be detailed here, because this manuscript focuses on the behaviour of the closed-loop system.

44


Cz

Bd

Bf uf

xf

zf

Cf yf

Af

Figure 5.3. The faulty plant

Faulty plant

d

zf Cz

Bd

Bf

xf Cf

Af uf

yf

Reconfiguration block

uC

yC -

w

Controller

DC

CC

xC

BC

AC


It is assumed that the poles of the reconfigured control loop are σ(Af S ), where Af S is the system matrix of the loop consisting of the faulty plant (5.4), the reconfiguration block and the nominal controller (5.2).


45

The linearisation of the faulty plant may lead to an additive offset in the differential equation, because the linearisation point is not an equilibrium. This offset can easily be modelled by adding another disturbance variable that is always set to 1. The corresponding column in Bd can then take the offset vector. Therefore it can be assumed without loss of generality, that the linearised system has the given form. Note that this way of modelling an offset does not interfere with the assumption that Bd is unchanged by the fault. A more general question is whether the faulty plant has an equilibrium at all. In the linear theory this follows from the stability of the reconfigured control loop (even in the presence of an offset). The same question has been treated for nonlinear and switching systems by Tsuda et al. [2001].

5.3 Reconfiguration Goals The five reconfiguration goals defined for the nonlinear problem in Sect. 4.5 also apply to the linear reconfiguration problem. By making use of linear system properties, it is possible to derive slightly simpler formulations and to relate the goals to the relevant part of the system. The reconfigured control loop can be interpreted as having two control loops: the plant side loop and the controller side loop (see Fig. 5.5). This cuts the

zf

d

Faulty plant uf

Plant side loop

yf

Plant view Reconfiguration block Controller view

uC

Controller side loop

yC

w

Nominal controller


46

5 Linear Reconfiguration Problem

system into two parts connected by the reconfiguration block: the plant view and the controller view. The first four out of the five reconfiguration goals concern the plant side of the loop (see Fig. 4.7 for the signals relevant for the goals). Stabilisation goal: The stabilisation goal requires that the reconfigured loop is stable. An easy criterion for stability of a linear system is that all poles have to be in the right half of the complex plane. A stronger variant of this criterion will be used here that requires the poles to be within a design set Cg : (5.5) σ(Af S ) ⊂ Cg , where σ(Af S ) denotes the set of poles of the reconfigured system and Cg is a subset of C− .3 This criterion allows for the formulation of additional requirements like a phase margin or a settling time. The stabilisation goal is the basis for the solution approaches in Chaps. 7 and 8. Weak goal: The weak goal requires that the external output zf of the reconfigured loop matches the output z of the nominal loop in the stationary case. This includes properties like set-point tracking or the rejection of a constant disturbance (if the nominal loop had these properties). The transfer functions G of the nominal and Gr of the reconfigured loop from the two inputs u and d to the output y are denoted by U(s) Y(s) = G(s) D(s) UC (s) YC (s) = Gr (s) . D(s) In order to satisfy the weak goal, both have be equal in the stationary case: G(0) − Gr (0) = O . Solutions to this goal will be discussed in Chap. 9. Strong goal: The strong goal requires that the external behaviour of the reconfigured loop matches the behaviour of the nominal loop exactly. The response of the output zf to disturbance d or reference w has to be indistinguishable from the nominal system (producing the output z). In terms of the transfer functions, the systems have to be identical ∀s : G(s) − Gr (s) = 0 . 3

The design set Cg has to contain all poles of the nominal control loop, but it may be significantly wider than the requirements used for the design of the nominal controller. The design set Cg is required to contain at least one real point (Cg ∩R = {}). Under this condition, every complete system can be stabilised according to any design set using pole placement.

5.4 Specific Faults

47

This goal leads to the most complicated solution, which will be discussion in Chap. 10. Direct goal: This goal requires that the state of the plant is affected by the fault as little as possible. It is satisfied, if the state is equal in the nominal and the reconfigured control loop ∀t : xf (t) = x(t) for all w, x0 and d. It is defined mainly for historical reasons, and it will be discussed in Chap. 6. The last goal is a technical goal. It is introduced in order to define the behaviour of the reconfiguration block from the controller view. This goal has no effect on the plant side loop, and therefore it does not limit the solvability of the reconfiguration problem. It does, however, help to restrict the set of reconfiguration blocks that qualify as a solution. Fault hiding goal: This goal requires that the controller view is not affected by the fault. This is satisfied if the controller input is the same in the nominal and the reconfigured control loop ∀t : yC (t) = y(t) for all trajectories w and initial states x0 ∈ Rnx , but without disturbance (d = 0). It follows directly that the poles observable from the controller are not affected by the fault. Therefore, this goal can help to demonstrate the stability of the loop, because only the observable poles have to be checked.

5.4 Specific Faults The definition of the faulty plant involves three matrices that may be different from the corresponding matrices of the nominal system: Af , Bf and Cf . Since a typical fault changes only a small part of the plant, it is reasonable to assume that only one of these matrices is affected. Therefore, three different kinds of faults can be distinguished. Changes to the matrix B will be termed “actuator faults”, changes to the matrix C “sensor faults” and changes to A will be called “internal faults”. Sensor faults. In the case of sensor faults, the output matrix Cf of the faulty plant Pf (A, B, Cf ) is different from the output matrix C in the nominal plant P (A, B, C). For example, the loss of a sensor is modelled by filling the corresponding row in Cf with zeros, fixing the corresponding output variable

48


zf Cz

Bd

B

uf

xf Cf

A

yf

Figure 5.6. Plant with sensor fault

to zero independently of the system state.4 Therefore, the rank of Cf will typically be lower than the rank of C. The other system matrices are identical for both plant models: Af = A

(5.6a)

Bf = B Cf = C .

(5.6b) (5.6c)

The model of the faulty plant (see Fig. 5.6) consequently is x˙ f = Axf + Buf + Bd d yf = Cf xf xf (0) = x0 .

(5.7a) (5.7b) (5.7c)

Sensor faults may affect the observability of the plant. In order to exclude situations where the reconfiguration is impossible, it is assumed that all unobservable poles of (AT , CTf ) are within Cg . This implies that the faulty plant is detectable via yf . The weak and the strong reconfiguration goals require that the disturbance d is properly dealt with despite the fault. Actuator faults. The reconfiguration problem after actuator faults is dual to the reconfiguration after sensor faults. Instead of the output matrix C, the input matrix B is affected by the fault: Af = A Bf = B

(5.8a) (5.8b)

Cf = C .

(5.8c)

For example, if an actuator gets stuck, it has no influence on the plant any more. The fault is modelled by filling the corresponding row in Bf with zeros. 4

For the technical plant this means, that the sensor always provides the nominal value, independent of the actual state of the plant.

5.4 Specific Faults

49

zf

d Cz

Bd

Bf

uf

xf C

A

yf

Figure 5.7. Plant with actuator fault

This means that the input variable can take any value, but it has no effect on the system any more.5 The faulty plant is defined by x˙ f = Axf + Bf uf + Bd d

(5.9a)

yf = Cxf zf = Cz xf

(5.9b) (5.9c)

xf (0) = x0 .

(5.9d)

Due to the fault, the controllability of the plant may be affected. In order to make the reconfiguration possible, it is assumed that the uncontrollable poles of the pair (A, Bf ) are within Cg . The disturbance behaviour of the plant is not of interest for the reconfiguration after actuator faults, because it is neither changed by the fault nor by the reconfiguration. Therefore, the solutions detailed in Part II will focus on the closed-loop autonomous behaviour and the response to reference changes. Internal faults. The reconfiguration problem can also be defined for faults in the matrix A. Since these faults do affect the internal couplings of the plant, they are called “internal faults”. The system matrix Af of the faulty plant Pf (Af , B, C) is different from the matrix A in the nominal plant P (A, B, C). The other matrices are again identical for both plant models:

5

Af = A Bf = B

(5.10a) (5.10b)

Cf = C .

(5.10c)

Since a linearised model is considered here, this also means that the actuator has to be stuck in its nominal position. This assumption is necessary, in order to stay within the theory of linear systems. The example in Chap. 16 shows, that it is simple to extend the solution to practical problems, where this requirement is not fulfilled.

50

5 Linear Reconfiguration Problem zf

d Cz

Bd

B

uf

xf C

Af

yf

Figure 5.8. Plant with internal fault

The model of the faulty plant (see Fig. 5.8) consequently is x˙ f = Af xf + Buf + Bd d yf = Cxf zf = Cz xf xf (0) = x0 .

(5.11a) (5.11b) (5.11c) (5.11d)

Internal faults are easy to treat, as long as the relevant variables are directly connected to inputs and outputs (directly changeable and measurable). In some cases, the reconfiguration may even be trivial. On the other hand, if the affected variables are not directly connected to inputs and outputs, the reconfiguration may be significantly more complex than for the fault cases defined above (see Sect. 8.8 for a possible solution).

5.5 2-Tank Example The linearised model of the 2-Tank System (3.2) fits the problem formulation introduced at the beginning of this chapter. The following matrices define the nominal plant: −0.25 0 A= (5.12a) 0.25 −0.25 1 −0.5 B= (5.12b) 0 +0.5 −0.74 (5.12c) Bd = 0 C = I2

Cz = 0 1 .

(5.12d) (5.12e)

5.5 2-Tank Example

51

The nominal controller (3.3) has no states, it is therefore described by a feedback matrix 3 0 DC = . (5.13) 0 10 Since the controller is static, it has no state xC , and the matrices AC , BC and CC disappear. The two actuator fault cases are described by 0 −0.5 Fault 1: Bf = 0 +0.5 10 Fault 2: Bf = 00 and the sensor fault case is described by Fault 3: Cf =

10 00

.

The application of the reconfiguration goals for the 2-Tank Example has been discussed in Sect. 4.6. The weak reconfiguration goal was found to be closest to the control objective of the system. The linear formulation of the reconfiguration goals allows the specification of the design set Cg , which can be used to define acceptable pole positions in the system. For the nominal system, the closed-loop poles are at −2.5 and −7.5. Since the dynamics of the reconfigured system are not overly important, but the settling time shall be in the same order of magnitude, the design set is chosen to be Cg = [−1, −20] . As long as the poles are in this range, the system is always sufficiently fast. The weak reconfiguration goal requires the output zf to reach the nominal equilibrium. This requirement corresponds to the control objective of keeping a constant level in tank xf 2 , since zf = xf 2 . As shown in Fig. 3.3, the nominal loop does not follow the reference value w2 exactly. There is a remaining deviation in the order of 10% of the requested change. Any reconfigured system satisfying the weak goal will have exactly the same deviation, and this guarantees that the deviation is no higher than acceptable. By combining the stabilisation goal and the weak reconfiguration goal, the control objective of the system is formalised in the given framework.

Part II

Linear Solution Approaches

This part deals with the reconfiguration problem as defined in the last chapter. Table 5.1 gives an overview of the variants of the problem. Every chapter treats a different reconfiguration goal (left column), leading to separate solution approaches. The emphasis is on actuator faults (right column), but corresponding approaches for sensor faults are mentioned shortly (central column). The direct reconfiguration goal is treated first (Chap. 6) to show that it is generally not satisfiable. Therefore, the easier fault-hiding goal and the stabilisation goal are studied for sensor and actuator faults in Chaps. 7 and 8. The more demanding weak goal and the strong goal are studied in Chaps. 9 and 10. The relation between the reconfiguration after faults in different locations (sensor, actuator or internal) is treated in Sects. 8.7 and 8.8. All algorithms developed in this part have to satisfy some common requirements, since they are intended to be performed on-line, after the fault has been detected (called “autonomous reconfiguration” by Rauch [1995]). Therefore, every chapter contains an analysis of the complexity and the required parameters of the reconfiguration algorithm. As concluded in Zhang and Jiang [2003], this real time aspect has received very little treatment in the literature.

Table 5.1. Reconfiguration problems and approaches Goals

Sensor Faults

Actuator Faults

Direct goal: State trajectory Fault-hiding goal: Controller view Weak goal: Stationary behaviour

Static block (Sect. 6.8) Virtual sensor (Chap. 7) Zero placement or exo-model (Sect. 9.7) Disturbance localisation (Sect. 10.8)

Static block (Chap. 6) Virtual actuator (Chap. 8) Zero placement or PI controller (Chap. 9) Disturbance decoupling (Chap. 10)

Strong goal: Dynamical behaviour

6 Direct Reconfiguration Using a Static Block

6.1 Direct Reconfiguration After Actuator Faults This chapter employs a static reconfiguration block in order to solve the direct reconfiguration problem. It is shown that this approach gives excellent results, if the solvability condition is met. However, this condition is very strong, and it cannot be assumed to be satisfied for typical reconfiguration problems. The pseudo-inverse method is discussed as an approach to find an approximation if an exact solution does not exist. The reconfiguration problem after actuator faults was introduced in Sect. 5.4. A simplified version of the general problem will be used here to facilitate the derivation of the solution. The model of the nominal plant (without disturbance d and external output z) is x˙ = Ax + Bu y = Cx x(0) = x0 .

(6.1a) (6.1b) (6.1c)

An actuator fault affects the matrix B of the plant. Therefore, the model of the faulty plant x˙ f = Axf + Bf uf yf = Cxf xf (0) = x0 .

(6.2a) (6.2b) (6.2c)

differs in the differential equation only. The goal is to find a reconfiguration block, such that the state xf in the reconfigured control loop follows exactly the same trajectory as the state x in the nominal control loop: Thomas Steffen: Control Reconfiguration of Dynamical Systems: Linear Approaches and Structural Tests, LNCIS 320, 55–67 (2005) c Springer-Verlag Berlin Heidelberg 2005 www.springerlink.com

56


∀ ∈ R+ ∀x0 ∈ Rnx : xf (t) = x(t) .

(6.3)

This the direct goal as defined in Sect. 5.3. It implies that the behaviour of the reconfigured system is identical in every respect to the behaviour of the nominal system as defined in Sect. 5.1 (with the obvious exception of the input vector). The structure of this problem is shown in Fig. 6.1. Direct goal: equal to nominal value

Faulty plant

Bf

xf C

A

uf

yf


uC

yC Nominal controller

w

Figure 6.1. The trivial reconfiguration problem

6.2 Solvability Consideration The reconfiguration problem is formulated for the closed-loop system. As a first step, it is reformulated in terms of the nominal and the faulty plant only using Lemma 4.6. It is assumed that the output u in the nominal control loop and the output uC in the reconfigured control loop are identical. If the goal (6.3) is reached under this assumption, there is no difference between the state of the nominal plant x and the faulty plant xf . Consequently, the fault does not affect the controller: the same signal y or yC is supplied to the controller in the nominal and in the reconfigured loop. Since the same controller is used in both cases, the output of the controller u vs. uC is also identical. The initial assumption is therefore justified. Both goals, the direct reconfiguration goal and the fault-hiding goal, are satisfied at the same time.

6.3 Derivation of a Static Reconfiguration Block

57

It follows by differentiation of (6.3) that x˙ f = x˙

(6.4)

is required. Therefore, the condition Bf uf = Bu

(6.5)

is necessary and sufficient to satisfy this goal. It is necessary, because otherwise the system (6.1) and (6.2) lead to different values x˙ f = x˙ even for the same initial state. It is sufficient, because it makes both system models identical. Under the assumption that the value of the input vector u is not known in advance,1 a general solution has to be found that is valid for all inputs u. This exists if the image of the nominal input matrix is included in the image of the faulty system matrix im B ⊆ im Bf

(6.6)

where the image im · is the set of possible results of a transformation: im B = {Bu|u ∈ Rnu } . An equivalent formulation of the same condition is

rank Bf = rank Bf B ,

(6.7)

where rank (·) denotes the rank of a matrix. If only a subspace of all possible inputs u is used by the controller, the a less strict solvability condition may apply. For example, for a proportional controller given by K, it can be found to be

rank Bf = rank Bf BKC . For the following considerations, this special case will not be treated separately.

6.3 Derivation of a Static Reconfiguration Block The general solution to (6.5) is a linear transformation S such that Bf S = B . 1

(6.8)

If u is restricted to a subspace of Rnu , an input space reduction can be performed in order to account for this. However, unless the faulty input is unused (not part of the subspace), this will not usually simplify the problem.

58

6 Direct Reconfiguration Using a Static Block Nominal plant model

uC

B

x

A x∆ Reconfigured plant Faulty plant

uf Static block

Bf

? (to find)

Goal: vanishes

xf

A

Figure 6.2. The static reconfiguration block

Such a matrix S exists, if and only if the condition (6.6) is satisfied. Assuming that a matrix S has been found, it can be used as a static coupling block2 (see Fig. 6.2) uf = SuC .

(6.9a)

Theorem 6.1 Restoring the state trajectory after actuator faults Under the assumption that uC (t) spans the full input space, the exact restoration of the state trajectory ∀t : xf (t) = x(t) after actuator faults is possible if and only if

rank Bf = rank Bf B (and the initial state of the nominal and the faulty plant is identical). The solution is a static coupling uf = SuC with Bf S = B.

2

According to Lemma 4.6, both u and uC could be used here, since they are identical. The variable u of the nominal control loop is used in the problem definition, but it is not available for the reconfiguration block. Therefore, uC is used instead.

6.4 Reconfiguration Algorithm

59

Faulty plant

Bf

xf C

A uf


S uC


w

Figure 6.3. Static reconfiguration after actuator faults

6.4 Reconfiguration Algorithm This theorem can be used to reconfigure a control loop using the following simple algorithm. The resulting reconfigured control loop is shown in Fig. 6.3. Algorithm 6.2 Reconfiguration after actuator faults using a static block Given: The input matrix of the nominal B and the faulty plant Bf . Find: A static reconfiguration block satisfying the direct reconfiguration goal. Requirement: The rank of the input matrix is unaffected by the fault

rank Bf = rank Bf B . Parameters: Quadratic weight I(uf ) = uf Quf of the input signal (optional). 1. Find a matrix S such that Bf S = B . If several solutions exist, chose the one resulting in the lowest input energy (or the lowest I if given). 2. Add a static reconfiguration block uf = SuC yC = y f . to the loop.

60


Result: A reconfigured control loop with exactly the same behaviour as the nominal loop. The central operation of this algorithm is the inversion of the (usually singular) matrix Bf . Several solutions are known with a time complexity3 around O(n3 ). The lower bound is O(n2 log n), but no numerically stable algorithm of this complexity is known (see Tveit [2003]). Therefore, this algorithm is applicable for medium sized problems (up to about 100 states). Bigger problems are feasible, if the sparse structure of B and especially B − Bf can be exploited using sparse matrix techniques. Due to this sparse structure, the problem may be separable into several independent parts as shown by Dulmage and Mendelsohn [1962] and Pothen and Fan [1990]. One optional parameter can be given to the algorithm. This is useful, if redundant inputs have very different limits. Since the limits do not depend on the fault, the parameter can be chosen in advance. Therefore, the algorithm itself is completely autonomous.

6.5 Analysis Inserting the reconfiguration block S into the model of the faulty plant leads to x˙ f = Axf + Bf SuC which can be simplified using (6.8) to x˙ f = Axf + BuC . Together with the dynamical controller from (5.2), the model of the reconfigured loop becomes d xf A − BDC C BCC xf BDC = + w. −BC C AC xC BC dt xC Proof. (of Theorem 6.1) The model of the reconfigured control loop is identical to the model of the nominal control loop as found in (5.3). Therefore, the reconfiguration problem defined in Sect. 6.1 can be solved under the given condition (6.7). If the condition is not satisfied, it is not possible to achieve the same state ˙ and the (6.4) cannot be satisfied. It derivative x˙ f as in the nominal plant x, follows that the condition (6.7) is both necessary and sufficient. 3

The space complexity of all algorithms in this manuscript is O(n2 ), with moderate constant factors. This should not be a constraint on modern hardware.

6.5 Analysis

61

Table 6.1. Behaviour of the reconfigured loop with a static coupling block after actuator faults Goal Fault-hiding Weak Strong Direct Relevant Reconfigured Stationary Output Plant signal output output trajectory state Excitation Condition yC = y zf → z zf = z xf = x none xf 0 = 0 Reference w= 0 Disturbance d = 0

X X X

X X X

X X X

X X X

X means that the goal is satisfied for the given excitation

If a reconfiguration solution using a static reconfiguration block S can be found, the result is impressive. All system variables are restored to their nominal value. This is also true for disturbed systems (with a disturbance input d), since the disturbance affects both the nominal and the faulty system in the same way. The only system vector which differs between the nominal and the faulty system, is obviously the plant input uf = u. These results are summarised in Table 6.1. However, the solvability condition (6.7) is very strong. To simplify the analysis, it is assumed that the fault is the complete loss of an actuator.4 This is modelled by setting the corresponding column in B to zero. Therefore, (6.7) can only be satisfied if the affected column is not necessary to support the rank of B. This is a sign of a redundancy in the system, which can come in two forms: • a parallel redundant actuator which has the same effect at the broken one, or (in the more general case) • a set of actuators that can produce the same effect as the broken actuator when used together. The first case is trivial to deal with, because the faulty actuator is just replaced by a redundant actuator with equal capabilities. The second case is more interesting, and it can be applicable to many practical systems. However, both approaches require that the plant has more actuators than necessary to perform its mission. It is therefore unlikely that a system designed to be cost effective has this property, unless redundancy was a design goal. It follows that this approach can be helpful to design a reconfiguration solution in special cases. It cannot provide a general solution to the reconfiguration 4

The approach is also applicable for gradual faults, where the strength of an actuator is changed by the fault without rendering it completely ineffective. Gradual faults are not considered within this manuscript, since they do not require a change of the control structure.

62


problem, though (which will be developed in the following chapters). The approach may also be interesting for the design of fault-tolerant systems, where reconfiguration can be easily performed. Remark. It is easy to construct a fault that cannot be reconfigured using a static reconfiguration block. Imagine that the nominal plant is a second order system consisting of two first order blocks in series. There is a separate input for each system, but only one output. Assume that the controller is a simple proportional controller. So the nominal control loop is a (stable) second order system. If the first input is lost, the faulty plant is a first order system. Because neither the controller nor the reconfiguration block contains any state, the control loop will be a first order system. Therefore, it is impossible to restore the dynamics of the nominal system. More difficult cases can be constructed, where some (failed) part of the plant is required to stabilise some other part, and the controller does not have the necessary dynamics. Stabilisation of such a system becomes impossible using a static approach, even though the faulty plant is still stabilisable. It is interesting to note that this argument holds for any kind of static reconfiguration block. So even a generalised static block of the form uC uf =K yC yf fails for these kind of faults. It follows that the general solution of the reconfiguration requires a dynamical reconfiguration block.

6.6 Application to the 2-Tank Example This approach is not applicable to the first version of the 2-Tank Example defined in Chap. 3. The rank of the nominal input matrix 1 −0.5 B= 0 0.5 is 2, but the rank for the faulty plant is only 1 after both actuator faults: 0 −0.5 Bf = for Fault 1 0 0.5 10 for Fault 2 Bf = 00 Therefore, the solvability condition is satisfied neither for Fault 1 1 −0.5 0 −0.5 0 −0.5 rank = rank 0 0.5 0 +0.5 0 +0.5 nor for Fault 2

6.7 Pseudo-Inverse Method

rank

1 −0.5 1 0 0 0.5 0 0

= rank

10 00

63

.

An example system with 3 tanks and more redundant input signal will be considered in Chap. 16. A successful application of this approach can be found there.

6.7 Pseudo-Inverse Method If the solvability condition is not met, the static approach is not applicable, since no mapping matrix can be found. A practical approach known as the “pseudo-inverse method” tries to circumvent this problem (published by Gao and Antsaklis [1991]). It picks a matrix S as the “best approximation” for the required condition (6.8). Although the theoretical basis is weak, the method has been applied successfully especially in the field of motion control (see Hu et al. [2001]). If the nominal controller is a proportional output feedback controller uC = DC (w − yC ) , the poles of the nominal control loop are σ(A − BDC C) . The pseudo-inverse method tries to approximate these poles and eigenvectors with the poles σ(A − Bf KC) and eigenvectors of the reconfigured control loop (see Gao and Antsaklis [1991] for the details). To find K, the difference J between the two autonomous system matrices is minimised K : min J(K) K

J(K) = ||(A − BDC C) − (A − Bf KC)|| where || · || denotes the Frobenius norm.5 If C is invertible, the solution to this problem is K = B+ f (BDC ) 5

Note that this norm is not invariant to state transformations, which means that this approach is only applicable to properly scaled system. To achieve transformation invariance, it is necessary to use a weighted norm.

64


Table 6.2. Behaviour of the reconfigured loop after applying the pseudo-inverse method Goal Fault-hiding Weak Strong Direct Relevant Reconfigured Stationary Output Plant signal output output trajectory state Excitation Condition yC = y zf → z zf = z xf = x none xf 0 = 0 Reference w= 0 Disturbance d = 0

≈ ≈ ≈

≈ ≈ ≈

≈ ≈ ≈

≈ ≈ ≈

≈ This mean that the goal is approximated: the poles may change slightly (and they may even go from a stable to an unstable region). 6 where B+ f denotes the pseudo-inverse of Bf . In terms of a reconfiguration block, this solution can be written as

K = SDC with S = B+ fB. The resulting matrix S is closest to solving (6.8) in the sense that it minimises the deviation. The effects on the closed-loop system are summarised in Table 6.2. While this method works reasonably well for practical problems in aircraft control, it is not generally applicable. There is no guarantee that the result is a suitable solution for the reconfiguration problem. Especially, the reconfigured control may be unstable. This failure can be demonstrated at the 2-Tank Example. Fault 2 implies that actuator u2 is unavailable. The input matrix of the faulty plant is therefore: 10 . Bf = 00 The pseudo-inverse is

B+ f

=

10 00

which leads to a reconfiguration block with 1 −0.5 S = B+ B = . f 0 0 6

The pseudo-inverse is a solution of the equation Bf B+ f Bf = Bf . If Bf has full T −1 T = (B B ) B column rank, the pseudo-inverse is B+ f f f . Otherwise, a singular f value decomposition can be used to compute it.

6.7 Pseudo-Inverse Method

65

Unfortunately, this method can do nothing about the fact that the level x2 of the right tank remains uncontrolled. The effect of the reconfiguration block on the system is 1 −0.5 Bf S = , 0 0

Right tank

Left tank

Plant input

Controller output

which means that only the influence of the broken second actuator on the left tank was restored (letting water out of it). So instead of opening the connection valve, the reconfigured plant will reduce the pump power. This leads an unstable closed-loop system with poles at −3.6 and +0.1, giving the simulation results in Fig. 6.4. The failure is remarkable, since the faulty plant is stable, and it is only after the reconfiguration using the pseudo-inverse method that the loop becomes unstable. Under different conditions, the method may provide a satisfactory solution (see Chap. 16).

1

uC2

0

uC1

^ disturbance

−1 1

uf 2 0

uf 1 −1

0.2 0 −0.2 −0.4

xf 1 Actual level

0.1

w2 Reference

0 −0.1

xf 2 Actual level 0

5

10 Time t/s

15

20

Figure 6.4. Response of the 2-Tank System reconfigured using the pseudo-inverse method after Fault 2 Remark. The problem of finding a stable solution using the pseudo-inverse method has been discussed by Gao and Antsaklis [1991]. A rather complex solution is proposed that involves the design of a robustly stable inner control loop and the solving of a constrained least-squares problem (CLSP). Therefore, it is typically not applicable for the use in real time. An approach to find a better solution for the output feedback problem is described in Bengtsson and Lindahl [1974]. Since it solves the same problem class as the pseudoinverse method, it may also have interesting applications for control reconfiguration.

66


The extensions address the question of sensitive and of transformational invariance. Using careful tuning of the parameters it is possible to find better solutions. However, since a reconfiguration algorithm has to work without manual intervention, these extensions are not directly applicable for on-line use.

6.8 Reconfiguration After Sensor Faults The approach of using a static coupling block can also be applied to sensor faults. In this case, the nominal and the faulty plant differ only in the output equation. A matrix S is used which calculates the correct output y = Cxf from the actual output yf = Cxf : SCf xf = Cxf . Since xf is not known, the matrix S has to satisfy SCf = C . A solution exists if and only if rank Cf = rank

Cf C

.

Under this condition, the reconfiguration block (see Fig. 6.5) is given by yC = Syf uf = uC . Faulty plant

B

xf

Cf

A uf


S uC


w

Figure 6.5. Static reconfiguration after sensor faults

6.9 Conclusion

67

Again this approach delivers an excellent reconfiguration solution result. However, the solvability condition requires redundant sensors, which are usually not available. The approach may be helpful to find appropriate sensor positions such that a single sensor can help to reconfigure one out of several faults. The same redundancy can also be used by an FDI system to detect sensor faults.

6.9 Conclusion The approaches presented in this chapter rely on using static reconfiguration blocks. If the existence condition is satisfied, they provide a solution that is very fast and simple both to calculate and to implement. However, for the typical case of a complete loss of an actuator or sensor, it is unlikely to be applicable. Therefore, all further reconfiguration methods will make use of dynamical reconfiguration blocks.

7 Reconfiguration Using a Virtual Sensor

7.1 Stabilising Reconfiguration After Sensor Faults This chapter develops the concept of a virtual sensor : when a sensor is at fault, an observer is used to calculate a replacement value. This approach goes back to the 1970s when it has been studied in the context of fault detection as “dedicated (and generalised) observer scheme” (see Schröder [2003] for a modern version of this idea). However, in the literature the observer has only been used in combination with state feedback, while a general dynamical controller will be considered here. It will be shown that the virtual sensor can be used as a reconfiguration block by translating the measurements from the faulty plant into the values the controller can handle. The stability of the reconfigured loop can be guaranteed as long as the faulty plant is detectable. The results found here are the basis for the derivation of the virtual actuator in the following chapter. The reconfiguration problem after sensor faults was already introduced in (5.7) in Sect. 5.4, but it will be briefly restated here without the disturbance input d and without the external output z. The state of the plant is not directly affected by the fault, therefore the model of the nominal plant x˙ = Ax + Bu y = Cx

(7.1a) (7.1b)

and the model of the faulty plant x˙f = Axf + Buf yf = Cf xf

(7.2a) (7.2b)

have an identical differential equation, but the output equations differ. Thomas Steffen: Control Reconfiguration of Dynamical Systems: Linear Approaches and Structural Tests, LNCIS 320, 69–79 (2005) c Springer-Verlag Berlin Heidelberg 2005 www.springerlink.com

70


Since yf cannot be used with the existing controller, a reconfiguration block is to be found that generates a suitable signal yC from yf and uf (see Fig. 7.1). The resulting control loop is required to be stable (stabilisation goal), with all poles being within the design set Cg .

Faulty plant

B

xf Cf

A

uf

yf

Stabilisation goal: stability of the loop


? uC

Fault hiding goal: equal to nominal values Controller

yC

w

Figure 7.1. Reconfiguration problem after sensor faults

It is further required that the output of the reconfigured plant be identical to the output of the nominal plant (in the nominal control loop). This goal is defined as the “fault-hiding goal”, and it will be the basis for the derivation of the virtual sensor.

7.2 Solvability Consideration It is obviously impossible to solve this problem, if the faulty plant is not detectable. A non-detectable plant has poles in the right half of the complex plane, which cannot be observed. These poles cannot be moved into the left half plane, and therefore the whole system is always unstable. Since the stabilisation goal requires the closed-loop poles to be in Cg , any unobservable pole of the faulty plant outside of Cg will prevent a solution. This defines the necessary condition to satisfy the stabilisation goal.

7.3 Derivation of the Virtual Sensor

71

In the remainder of the chapter, it will be shown that this condition is also sufficient. A solution can be constructed, as long as all unobservable poles are within Cg . This constructive proof rests on the fact that the problem can be broken down to an observation problem of the faulty plant as shown in Fig. 7.2. As long as the output yC of the virtual sensor is equal to Cxf , the behaviour of the reconfigured plant is equal to the behaviour of the nominal plant. This satisfies the condition of Lemma 4.6, and therefore the fault-hiding goal is fulfilled. It also follows that the state of the faulty plant xf within the reconfigured loop is equivalent to the state of the nominal plant x in the nominal loop. The stability of the reconfigured loop depends only on the stability of the virtual sensor. uf

Reconfigured plant

Faulty plant

B

yf

xf

yC

Virtual sensor

Cf

? (to find) A

-

y∆ Goal: vanish

"nominal output"

y

C

Figure 7.2. Goal for the virtual sensor

7.3 Derivation of the Virtual Sensor Since this reconfiguration problem is very similar to an observation problem, the derivation of the virtual sensor is similar to the design of a state observer. This can be found in advanced text books such as Lunze [2002b] or Doyle et al. [1991], and therefore the derivation will be kept brief. It starts with a parallel model that is used to provide the expected behaviour to the controller (see Fig. 7.3). By combining the faulty plant and the model of the nominal plant as shown, the following system can be derived:

72

7 Reconfiguration Using a Virtual Sensor Faulty plant

xf Cf

B

A

uf Nominal plant model

yf ˆ x

B

C

A yC

uC (= uf ) Controller

w

Figure 7.3. Naive reconfiguration block with a plant model

x˙ f = Axf + BuC ˆ˙ = Aˆ x x + BuC yC = Cˆ x ˆ (0) = x0 . xf (0) = x

(7.3a) (7.3b) (7.3c) (7.3d)

ˆ of the model follows the same trajectory as the nonimal plant The state x x itself. If the plant is stable, this model does technically satisfy the faulthiding goal. However, for an unstable plant the two trajectories will eventually diverge. In order to prevent this, feedback is added to the model in order to ˆ and xf . stabilise the difference between x The state xf is not measurable directly, therefore the deviation between the ˆ is used for the feedback. The ˆ f = Cf x output yf and its estimated value y plant model becomes

7.3 Derivation of the Virtual Sensor

73

Faulty plant

xf Cf

B

A

uf

yf Virtual sensor

L -

Cf ˆf y ˆ x

B

C

A yC

uC (= uf ) Controller

w

Figure 7.4. Reconfiguration after sensor faults with a virtual sensor

ˆ) ˆ˙ = Aˆ x x + BuC + L(yf − Cf x while the rest of the system remains unchanged (see Fig. 7.4). The parameter LT is chosen to stabilises the pair (AT , CTf )

(7.4)

such that all poles are within the design set: σ(A − LCf ) ⊆ Cg .

(7.5)

The resulting block is called a virtual sensor, and it solves the reconfiguration problem with respect to the stabilising goal and the fault-hiding goal. The virtual sensor consists of a Luenberger observer, the output matrix C and the necessary input signal connection. The reconfiguration approach is summarised in the following theorem.

74


Theorem 7.1 Stabilising reconfiguration using a virtual sensor The virtual sensor as defined by the state-space model ˆ) ˆ˙ = Aˆ x x + BuC + L(yf − Cf x yC = Cˆ x uf = uC ˆ (0) = x0 x

(7.6a) (7.6b) (7.6c) (7.6d)

satisfies the stabilisation goal after sensor faults if σ(A − LCf ) ⊆ Cg . Such a matrix L exists if all unobservable poles in (AT , CTf ) are within Cg . Remark. It is also possible to construct a virtual sensor using a reduced state observer. This approach is detailed in Lunze and Steffen [2002]. The resulting virtual sensor has nx − ny states (instead of nx ), and it also has fewer design parameters. However, the reduced observer has several disadvantages. Analysis, design and implementation are significantly more difficult. It can be much more sensitive to output disturbances. And finally, it is unsuitable for the advanced approaches to the weak and the strong reconfiguration goal.

7.4 Reconfiguration Algorithm Applying Theorem 7.1 for the reconfiguration of a faulty plant leads to the following algorithm. Algorithm 7.2 Reconfiguration after sensor faults Given: The model (7.1) of the nominal plant P (A, B, C) and the model (7.2) of the faulty plant Pf (A, B, Cf ). Find: A reconfiguration block satisfying the stabilisation goal. Requirements: The poles of the nominal control loop and the unobservable poles of the faulty plant Pf are within Cg . Parameters: Observer design specification (depending on specific algorithm). 1. Construct the equivalent control problem (7.4). 2. Use a controller design method to find a matrix L satisfying (7.5).

7.5 Analysis of the Virtual Sensor

75

3. Put the reconfiguration block according to (7.6) into the control loop and ˆ 0 = xf,0 . initialise it with x Result: a stable reconfigured control loop The most complex part of this algorithm is the feedback controller design in Step 2. The computation time depends on the specific design method used. For a pole placement design using the Ackermann’s formula, the complexity is O(n4 ) with a very low constant factor. A more suitable approach for multi-input systems is proposed by Petkov et al. [1986], also leading to a computational complexity of O(n4 ). However, it is difficult to extend this approach to large structured problems with several output variables, since it is not clear what part of the system is assigned which poles. As shown by Lunze et al. [2003] and Staroswiecki [2002], an LQ design is significantly superior to pole placement for nontrivial systems. Since the quadratics weights correspond roughly to expected measurement uncertainties, they can be chosen once (at design time) for a given system, and do not have to be changed according to the fault. The important step during the LQ design is the solution of the algebraic matrix Riccati equation. According to Laub [1979] and Sima [1996], this has a time complexity of O(n3 ) with a large constant factor. Due to this factor, the calculation time for medium sized problems is actually slightly longer than for pole placement. Therefore, this approach is feasible for problems up to a medium order n of about 50 or 100 in a reasonable amount of time. Again, the time can be significantly reduced if the problem can be separated into smaller parts, but this depends on the structure of the problem.

7.5 Analysis of the Virtual Sensor This analysis is kept intentionally short, since it runs analog to the analysis of a controller based on a Luenberger observer. The basic idea is that the state ˆ tries to track the state of the faulty plant xf . It can of the virtual sensor x be checked, whether the tracking is successful, by determining the deviation ˆ , leading ˆ − xf . This deviation is introduced as a new state instead of x e=x to the transformed model of the reconfigured plant d xf A O B xf (7.7a) = + uC O A − LCf e O dt e

yC = C(xf + e) xf (0) x0 . = 0 e(0)

(7.7b) (7.7c)

76


Observer error model

L Cf -

e

d Bd

C

A

Reconfigured plant

ˆf y

xf B

C

A

uf = uC

yC Controller

w

Figure 7.5. Analysis of the virtual sensor

The block diagonal structure of the system matrix shows that the model consists of two separate (uncoupled) subsystems (see Fig. 7.5). The first subsystem (state xf ) is identical to the nominal plant. The second subsystem represents the observation error e, and it is autonomous (unconnected to the input). Because the poles σ(A − LCf ) are chosen to be stable, the observation error converges to zero, and all values of the reconfigured plant converge towards the corresponding values of the nominal plant. To conclude the analysis, the reconfigured control loop is constructed from the faulty plant (7.2), the reconfiguration block (7.6) and a dynamical controller according to (5.2). In order to study the influence of disturbances, the original definition of the plant (5.1) is used:

7.5 Analysis of the Virtual Sensor

77

x˙ f = Axf + Buf + Bd d , where d is the disturbance input. The closed-loop model becomes      xf x −BDC C BCC A − BDC C d  f  ˆ ˆ LCf A − LCf − BDC C BCC  x x = dt O BC C A − BDC C xC xC     Bd BDC +  O  d +  BDC  w (7.8a) BC O yC = Cˆ x     x0 xf (0) x ˆ (0)  =  x0  . xC (0) 0

(7.8b) (7.8c)

Using the same transformation as above for introducing the observation error e results in the following closed-loop system:      A − BDC C BCC x O xf d  f  xC = AC B C C   xC  BC C dt e e O O A − LCf     Bd BDC +  O  d +  BC  w (7.9a) Bd O yC = C(xf + e)    x0 xf (0)  xC (0)  =  O  . e(0) 0 

(7.9b) (7.9c)

The system can again be divided into two subsystems. The first part consists of the states xf and xC , and it is identical to the nominal control loop as given in (5.3). Therefore, it has the same poles as the nominal control loop. The second subsystem determines the deviation e, and it has the poles σ(A − LCf ). Both subsystems are independent of each other. This fact is known from the analysis of control loops with state observers, and it is called the separation principle, because both the controller and the observer can be designed separately. The disturbance behaviour of the reconfigured control loop differs from the behaviour of the nominal control loop. This is obvious in the numerical model, because d has an influence on e. It can also be seen in the block-diagram of the reconfigured loop: the disturbance has to go through the states of the faulty plant and the virtual sensor, before it has an influence on the controller. A closer analysis reveals that both the dynamical and the stationary response of the reconfigured loop to disturbances are different from the nominal loop. Therefore, the weak and strong reconfiguration goal are only fulfilled as long as there is no disturbance. These results are summarised in Table 7.1.

78


Table 7.1. Behaviour of the reconfigured loop with a virtual sensor design for the stabilisation goal Goal Fault-hiding Weak Strong Direct Relevant Reconfigured Stationary Output Plant signal output output trajectory state Excitation Condition yC = y zf → z zf = z xf = x none xf 0 = 0 Reference w= 0 Disturbance d = 0

X X o

X X o

X o

X o

X means that the goal is satisfied for the given excitation o means that the goal is satisfied only for the open-loop chain - means that the goal is not satisfied in general

Proof. (of Theorem 7.1) The reconfigured closed-loop model (7.9) has two sets of poles. The first set is A BCC σ BC C AC which is equivalent to the pole set of the nominal loop and therefore in Cg . The second set is σ(A − LCf ), which is in the design set Cg due to the choice of L according to (7.5). There always exists a suitable L because it is assumed that all unobservable poles in the pair (AT , CTf ) are already in Cg .

7.6 Application to the 2-Tank Example The application of this algorithm can be applied directly to the 2-Tank Example. The plant with Fault 3, loss of the level sensor y1 , is considered here. A classical controller design with the poles −10 and −20 leads to the following equation for the virtual sensor: 770 −0.25 0 1 −0.5 ˙x ˆ= ˆ+ (ˆ x2 − yf 2 ) x uf − 29 +0.25 −0.25 0 +0.5 ˆ yC = x ˆ (0) = xf (0) . x The output of the controller is connected directly to the input of the plant (uf = uC ), just as in the nominal control loop. The simulation leads to the results shown in Fig. 7.6. Note that the initial state of the virtual sensor is set to zero, while the state of the plant differs from zero. This leads to a rather strong movement of the system at the very beginning,

Right tank

Left tank

Plant input

Controller output

7.7 Conclusion 1

79

uC2

0

uC1

^ disturbance

−1 1

uf 2

0

uf 1

−1

0.2 0 −0.2 −0.4

xf 1 Actual level yC1 VS output (dashed)

0.1

w2 Reference

yC2 VS output 0

xf 2 Actual level −0.1

0

5

10 Time t/s

15

20

Figure 7.6. Simulation of the reconfigured plant after sensor fault

where the left tank xf 1 raises to more than 0.2 m above the nominal level. As predicted by the theory, the reference jump shows no difference to the nominal behaviour. However, the response to the disturbance at t = 15 s is slightly deteriorated compared to the nominal loop. For a different disturbance, a more significant deterioration could result. These results are completely consistent with the theoretical analysis in Sect. 7.5.

7.7 Conclusion The virtual sensor has been presented as a solution for the reconfiguration after sensor faults. It is applicable as long as the faulty plant is detectable. The behaviour of the reconfiguration loop is identical to the behaviour of the nominal loop with the exception of the response to disturbance. Therefore, the strong reconfiguration is fulfilled for a plant without disturbances, but only the stabilisation goal for a disturbed plant. The design of the virtual sensor leads to an equivalent control problem. Many controller design methods can be used for this problem, like pole placement or LQ design. The complexity of most algorithms is in the range of O(n3 ) and O(n4 ), which makes them suitable for medium sized problems.

8 Reconfiguration Using a Virtual Actuator

8.1 Stabilising Reconfiguration After Actuator Faults This chapter develops the concept of a virtual actuator. The idea of a virtual actuator is to use the input signal meant for the nominal process and to transform it into a signal useful for the remaining actuators of the faulty plant. As shown in Chap. 6, a statical reconfiguration block is generally not sufficient, and a dynamical reconfiguration block is necessary to solve this problem. The virtual actuator for the reconfiguration after actuator faults is the dual approach to the use of a virtual sensor after sensor faults (detailed in the Chap. 7). The reconfiguration problem after actuator faults was introduced in Sect. 5.4. Because the goal in this chapter is only the stabilisation of the reconfigured loop, a simplified version of the problem will be used here, which does not consider external inputs and outputs. The fault has affected one or several actuator of the plant. Therefore the nominal plant x˙ = Ax + Bu

(8.1a)

y = Cx x(0) = x0

(8.1b) (8.1c)

x˙ f = Axf + Bf uf yf = Cxf

(8.2a) (8.2b)

and the faulty plant

xf (0) = x0 .

(8.2c)

differ in B = Bf only. Thomas Steffen: Control Reconfiguration of Dynamical Systems: Linear Approaches and Structural Tests, LNCIS 320, 81–102 (2005) c Springer-Verlag Berlin Heidelberg 2005 www.springerlink.com

82


So far the problem is identical to the problem based on the direct reconfiguration goal in Sect. 6.1. Since the direct reconfiguration goal was found to be too strong, an easier goal is used here: the stabilisation goal. It is much less demanding, and it should be reachable for any fault that does not render the system unstabilisable. The same goal was studied for the reconfiguration after sensor faults in the previous chapter. The stabilisation goal requires to make the reconfigured control loop (see Fig. 8.1) stable. The poles are required to be within Cg , which allows a stability margin to be specified. It is further required that the signals of the controller (uC and yC ) are not affected by the fault (fault-hiding goal). A dynamical reconfiguration block can be used to reach these two goals.

Faulty plant

Bf

xf C

A

uf

yf



? uC


yC

w

Figure 8.1. The reconfiguration problem after actuator faults

8.2 Solvability Consideration The stabilisation goal is obviously not reachable, if the faulty plant contains fixed poles outside of Cg . Since the controllability of the plant has not changed due to the fault, only unobservable poles outside of Cg are relevant here. Consequently, a necessary condition for the problem to be solvable is, that all unobservable poles of the faulty plant are within Cg .

8.3 Derivation of the Virtual Actuator

83

The remainder of this chapter will derive and analyse a constructive solution. It will be shown that the given condition is also sufficient for a solution to exist.

8.3 Derivation of the Virtual Actuator This section derives the virtual actuator as a general solution to the reconfiguration problem above. The idea is to simulate the response of the nominal plant, such that the resulting output can be given to the controller (satisfying the fault-hiding goal). In two further steps the stability of the loop is achieved. The derivation is very similar to the design of the virtual sensor in Sect. 7.3. The first step is to formulate the problem in terms of the reconfigured plant (open loop), instead of the reconfigured control loop (see Fig. 8.2).1 This relies on Lemma 4.6: if the reconfigured plant has the same input/output behaviour as the nominal plant, the fault-hiding goal is satisfied, and therefore the controller is not affected by the fault. The stability of the reconfigured loop requires the stabilisability of the reconfigured plant. The derivation starts with a reconfiguration block, which contains only a model of the nominal plant (see Fig. 8.3) x˙ = Ax + BuC yC = Cx x(0) = x0 .

(8.3a) (8.3b) (8.3c)

This model satisfies the fault-hiding goal, since it has obviously the same behaviour as the nominal plant. However, it is not a viable reconfiguration solution yet, since the faulty plant is unconnected and therefore not stabilised. The faulty plant can be stabilised by applying state feedback based on xf . Since the idea of the reconfiguration is to make the faulty plant behave like the nominal plant, the state of the model of the nominal plant is used as a reference (see Fig. 8.4). The control law is uf = M(xC − xf )

(8.4)

where the matrix M is stabilising the pair (A, Bf )

(8.5)

such that the poles are within the design set: 1

Note that in contrast to Sect. 7.3, it is not possible to combine the model of the nominal plant and the model of the faulty plant into one here, since both have a different state.

84

8 Reconfiguration Using a Virtual Actuator Reconfigured plant Faulty plant

Bf

xf C

A

uf

yf


? yC

uC

y

-

y∆ Goal: vanish

Nominal plant model

B

x C

A

Figure 8.2. Fault-hiding goal applied to the reconfiguration block

σ(A − Bf M) ⊆ Cg .

(8.6)

Several common controller design methods can be used to find such a matrix M, like pole placement or robust linear quadratic (LQ) controller design. The model of the reconfigured plant follows from the parallel model (8.3), the control law (8.4) and the model of the faulty plant (8.2): x˙ f = Axf + Bf uf x˙ = Ax + BuC yC = Cx uf = M(x − xf ) xf (0) = x(0) = x0 .

(8.7a) (8.7b) (8.7c) (8.7d) (8.7e)


85

Faulty plant

Bf

xf C

A


uf

yf

B

x C

A uC

yC Controller

w

Figure 8.3. Naive reconfiguration block based on a model of the plant, satisfying only the fault-hiding goal

Unfortunately, the feedback control law (8.4) depends not only on the state x of the model, but also on the state xf of the plant, which is not generally measurable. Since the reconfiguration block and the faulty plant both have the same autonomous behaviour as determined by A, they can be superposed to form a new system that generates x−xf directly. In other word, since the state xf cannot be measured, its behaviour is integrated into the reconfiguration block. Since the feedback depends on the difference in state between the model and the faulty plant, a new state x ∆ = x − xf

(8.8)

is introduced instead of x. Technically, this is a state transformation, which changes the internal structure of the reconfigured plant (by introducing the new state), but not its external behaviour. The resulting system is (see Fig. 8.5) x˙ f = Axf + Bf uf x˙ ∆ = Ax∆ + BuC − Bf uf

(8.9a) (8.9b)

86

8 Reconfiguration Using a Virtual Actuator Faulty plant

Bf

xf C

A

uf Reconfiguration block

-

yf

M

B

x C

A uC

yC Controller

w

Figure 8.4. Reconfiguration block with added state feedback for the faulty plant

yC = C(xf + x∆ ) uf = Mx∆ xf (0) = x0 x∆ (0) = 0 .

(8.9c) (8.9d) (8.9e) (8.9f)

Note that the transformation has changed the subsystem in the reconfiguration block (based on x∆ ), while the plant remains unaffected. The problematic connection between the state of the plant and the reconfiguration block disappears. Therefore, this structure is an applicable solution to the reconfiguration problem. This reconfiguration block is called a virtual actuator, because it tries to create the same response as the broken actuator to the input signal uC coming from the controller. Two signal paths are used for this: the remaining actuators uf and a correction signal (Cx∆ ) applied to the output yf of the plant. The following theorem summarises the idea of the virtual actuator.


87

Faulty plant

Bf

xf C

A

uf

yf Virtual actuator

M Bf -

B

x∆ C

A uC

yC Controller

w

Figure 8.5. Reconfigured loop with a virtual actuator

Theorem 8.1 Stabilising reconfiguration using a virtual actuator The virtual actuator as defined by the state-space model x˙ ∆ = (A − Bf M)x∆ + BuC

(8.10a)

yC = yf + Cx∆ uf = Mx∆

(8.10b) (8.10c)

x∆ (0) = 0

(8.10d)

is a solution to the reconfiguration problem from Sect. 8.1 if M satisfies (8.6). There exists a suitable M as long as the faulty plant has no fixed poles outside of Cg . This theorem is the basis for the reconfiguration algorithm after actuator faults, which will be presented in Sect. 8.4.

88


Remark. It is also possible to perform a state reduction on the difference system used to construct the virtual actuator (see Lunze and Steffen [2002]). The result is the dual system of a reduced state observer. It has only nx − nu states, an consequently fewer design parameters. However, apart from the advantage of introducing fewer poles into the system, the reduced design was found to have several disadvantages. It is more difficult to design and implement, and it uses higher (sometimes much higher) input values. The main disadvantage is that it does not allow the extensions to cover the weak and the strong reconfiguration goal deduced in the following two chapters. Therefore, the reduced virtual actuator is not presented here.

8.4 Reconfiguration Algorithm To following algorithm performs a reconfiguration using a virtual actuator as derived above. Algorithm 8.2 Design of a virtual actuator Given: The linear model (8.1) of the nominal plant P (A, B, C) and the model (8.2) of the faulty plant Pf (A, Bf , C). Find: A reconfiguration block satisfying the stabilisation goal. Requirements: The poles of the nominal loop and the fixed poles of the faulty plant are in Cg . Parameters: A controller design problem (depending on the method to be used). 1. Construct the equivalent control problem (8.5). 2. Use a controller design method to find a matrix M satisfying (8.6). 3. Put the reconfiguration block according to (8.10) into the control loop and initialise it with x∆ = 0. Result: A stable reconfigured control loop. The complexity of this algorithm is identical to the one of Algorithm 7.2, therefore the same results apply. Depending on control design method used, the computation time grows in the order of O(n3 ) or O(n4 ). This should be feasible for medium sized problem up to around 50 or 100 states. Again, a structured design may significantly reduce the computational complexity, but this depends very much on the specific structure of the problem. If an LQ approach is used for the controller design, the weights do not depend on the specific fault case. Therefore, the weights may be chosen in advance at design time. The algorithm can be run after the fault has been detected, and it does not need any manual intervention. It is therefore autonomous in the sense of Rauch [1995].

8.5 Analysis of the Reconfigured Closed-Loop System

89

8.5 Analysis of the Reconfigured Closed-Loop System Due to the transformation used in the design, the state of the virtual actuator represents the deviation of the (faulty) plant state from its nominal value. The analysis of the reconfigured plant and the reconfigured loop rests on this interpretation. Since only the behaviour of the nominal plant is visible from the view of the controller, the behaviour of the faulty plant must be somehow hidden by the virtual actuator. This is also obvious from the number of poles: the reconfigured plant has the same input/output behaviour as the nominal plant, but it has twice as many states. Therefore, half of the poles must be hidden by decoupling zeros. The block diagram in Fig. 8.5 reveals only one place where zeros can result from the structure of the system: the summation point at the output of the virtual actuator. For further analysis, a state transformation is used to separate the observable part of the state space from the unobservable part. The new state ˜ = xf + x ∆ (8.11) x describes the observable part. According to (8.8), this vector should be equal ˜ instead, in order to the state of the nominal plant x. However, it is called x to show by the following analysis that it is indeed equal to x. The reconfigured plant can be constructed from the faulty plant (8.2) and the virtual actuator (8.10): d ˜ ˜ x A O B x (8.12a) = + uC x∆ O A − Bf M B dt x∆ ˜ x Cz −Cz zf = (8.12b) x∆ yC C O ˜ (0) x x0 = . (8.12c) x∆ (0) O The two distinct subspaces are now obvious, since the transformed model consists of two subsystems without coupling (see Fig. 8.6). ˜ of the reconfigured plant beNominal subsystem: The new state subvector x haves exactly as the nominal plant would. The poles in this subsystem depend are σ(A), but can be changed by the controller just like in the nominal plant. Deviation state: The other subvector x∆ is equal to the deviation between this “nominal state” x and the state of the faulty plant xf . This subsystem has no connection to the control output yC . Therefore, the poles σ(A−Bf M) are not observable (which means they are fixed).

90


Virtual actuator

M Bf -

B

x∆

A

Reconfigured plant

B

˜ (= x) x C

A uC

yC Controller

w

Figure 8.6. Separated reconfigured plant

This separation allows an intuitive interpretation of the virtual actuator. The state x∆ of the virtual actuator keeps track of the deviation of the plant state xf from its nominal value x. The matrix M introduces a feedback in order to keep this deviation x∆ small. The feedback cannot generally reduce the deviation to zero. Therefore, the state deviation results in a difference between the output of the faulty plant and the output of the nominal plant (given the same input). Since the deviation x∆ is known, the output difference Cx∆ can be calculated and corrected, before the output signal is fed to the controller. Therefore the controller does not see the deviation of the plant state.2 A similar separation of two sets of poles was first found for the Luenberger type state observers in combination with state feedback by Luenberger [1964]. The effect is known as separation principle, since both parts can be designed 2

An obvious drawback of this approach is that the actual state or output of the plant is not restored to its nominal value. In terms of the goals, neither the weak nor the strong goal are satisfied. They will be treated in the following two chapters.

8.5 Analysis of the Reconfigured Closed-Loop System

91

˜ depend on separately. This also applies to the virtual actuator: the poles of x the nominal controller designed for the nominal system, while the poles of x∆ depend on M as chosen during the reconfiguration. Combining the faulty plant (8.2), the virtual actuator (8.10) and a dynamical controller (5.2) leads to the model of the reconfigured loop      x O A Bf M xf d  f  x∆ = −BDC C A − BDC C − Bf M BCC x∆  dt xC −BC C −BC C AC xC   O +  BDC  w (8.13a) BC yC = C(xf + x∆ )    x0 xf (0)  x∆ (0)  =  0  . xC (0) 0 

(8.13b) (8.13c)

By applying the same transformation (8.11), the relevant subspaces can be separated:      x∆ O A − Bf M −BDC C x∆ d   ˜ = ˜ x O A − BDC C BCC  x dt xC xC O −BC C AC   BDC +  BDC  w (8.14a) BC yC = C˜ x    O x∆ (0)  x ˜ (0)  =  x0  . xC (0) 0 

(8.14b) (8.14c)

It is clear from the structure of the system matrix that it has two separate sets of poles: the poles of the nominal loop A − BDC C BCC σ (8.15) −BC C AC and the poles of the virtual actuator σ(A − Bf M) .

(8.16)

This confirms that the stabilisation goal has been reached. The virtual actuator can also be applied to a plant with a disturbance as defined in (5.9). Using the same transformation, this leads to the closed-loop model

92


     x O A − Bf M −BDC C x∆ d  ∆  ˜ = ˜ x O A − BDC C BCC  x dt xC xC O −BC C AC     O BDC +  Bd  d +  BDC  w O BC yC = C˜ x    O x∆ (0)  x ˜ (0)  =  x0  . xC (0) 0 

(8.17a) (8.17b) (8.17c)

It is interesting to see that the disturbance does not directly affect the state deviation x∆ . Therefore, neither the fault nor the reconfiguration have any influence on the response of the loop to external disturbances. This can also be verified by comparing the closed-loop model of the reconfigured loop to that of the nominal loop given in (5.3). Therefore, the strong reconfiguration goal is satisfied as long as only the disturbance behaviour is considered (instead of the reference tracking behaviour). Proof. (of Theorem 8.1) The first part of this proof is to show that the poles of the reconfigured loop (8.14) are within Cg . This follows trivially from the fact that the poles of the nominal loop (8.15) are within Cg and the poles (8.16) of the virtual actuator are designed to be within Cg according to (8.6). The second part of the proof is to show that a suitable matrix M always exists. The virtual actuator poles σ(A − Bf M) fall into two categories. The uncontrollable poles were required to be within Cg by (8.6). The controllable poles can be placed freely by choosing M. Since there is at least one real point in Cg , all the controllable poles can be moved there (cf. Wonham [1985], Sect. 2.2). The results of this analysis are summarised in Table 8.1.

8.6 Application to the 2-Tank Example The Algorithm 8.2 can be used to solve all actuator fault cases defined for the 2-Tank Example in Chap. 3. The discussion will focus on Fault 2, because it is the more interesting problem. Fault 2 means that the connection valve is stuck in its nominal position, which breaks the control loop for the right tank. As discussed in Sect. 3.4, this does not render the plant unstable, but it means that the system does no longer respond to set-point changes. The algorithm leads to a control problem depending on the pair

8.6 Application to the 2-Tank Example

93

Table 8.1. Behaviour of the reconfigured loop with a virtual actuator Goal Fault-hiding Weak Strong Direct Relevant Reconfigured Stationary Output Plant signal output output trajectory state Excitation Condition yC = y zf → z zf = z xf = x none xf 0 = 0 Reference w= 0 Disturbance d = 0

X X X

X o

o

o

X means that the goal is satisfied for the given excitation o means that the goal is only satisfied for the open-loop chain - means that the goal is not satisfied in general

(A, Bf ) =

−0.25 0 0.25 −0.25

10 , . 00

The poles of the virtual actuator are chosen to be −5 and −10. These poles are well within the design set [−1, −20], and they are fast compared to the first pole of the nominal loop at −2.5. This results in a feedback matrix of 14.5 185 M= . 0 0 The amplification may seem rather high, and therefore excessive input signals could be anticipated. However, the reference for this feedback is the state of the nominal plant x. Since this state does not perform rapid changes, the faulty plant can follow this reference without requiring high input signals. The virtual actuator according to (8.10) is therefore −14.75 −185 −0.5 x∆ + uC2 x˙ ∆ = 0.25 −0.25 +0.5

uf 1 = 14.5 185 x∆ yC = y f + x ∆ . This virtual actuator is integrated in the control loop. This leads to the system structure shown in Fig. 8.7. This diagram shows that the virtual actuator contains a model of the plant. The nominal response of the plant is simulated, and at the same time the faulty plant is made to follow this response. The response of the faulty plant is cancelled out by subtracting the input to the faulty plant from the input to the plant model. Therefore, the model represents only the difference between the nominal response and the response of the faulty plant. The output of the model is added to the output of the faulty plant, thus hiding any differences between the response of the faulty plant and the nominal response. The addition creates the output-decoupling

94


uf 2 0

Tank 1 1 s+0.25

-

Tank 2 xf 1 0.25

uf 1

1 s+0.25

xf 2

yf 1

zf

yf 2

Virtual actuator

x∆1

-

184 x∆2

14

1 s+0.25

0.25

-

1 s+0.25

0.5 uC2

yC1

yC2

Nominal controller

-

w2

* 10 -

w1

*3 uC1

Figure 8.7. Structure of the virtual actuator design for the 2-Tank Example

zeros found in the analysis. They make the effects of the fault unobservable, thus restoring the nominal behaviour of the plant. This model leads to two additional poles in the system. Therefore, it takes a while, before the control input gets to the faulty plant. The actual state of the faulty plant is always lagging behind the simulated response. The working of the virtual actuator can be compared to a Smith predictor, as it is often used for dealing with large time delays. The idea is shown in Fig. 8.8. The comparison shows that the same structure is used in the virtual actuator applied to the 2-Tank Example. The obvious difference is that the delay block is a first order system (the left tank) and not a time delay. A further important difference is that the virtual actuator also works for unstable plants, because it contains stabilising feedback. The success of this approach can be verified in simulation results shown in Fig. 8.9. The system is simple enough to give a detailed interpretation of the simulation. The input variable u2 is not available to control the flow between the two tanks. In order to restore the normal level in tank xf 2 , the level xf 1


95

Plant with delay Further dynamics

Delay

y

u SMITH predictor with an internal model Delay

Further dynamics

Controller for the plant without delay

w

Right tank

Left tank

Plant input

Controller output

Figure 8.8. Controller with Smith predictor

1

uC2

0

uC1

^ disturbance

−1 1

uf 1

0

uf 2

−1

0.2 0 −0.2 −0.4

xf 1 Actual level yC1 VA output (dashed)

0.1

w2 Reference

0 −0.1

yC2 VA output (dashed)

xf 2 Actual level 0

5

10 Time t/s

15

20

Figure 8.9. Reconfiguration of the 2-Tank Example using a virtual actuator after Fault 2

96


of the left tank is increased using uf 1 . This makes more water flow through the connection valve into the right tank xf 2 . This effect can be seen twice: at the beginning of the simulation, and when the set-point is raised at t = 5 s. The lowering of the set-point at t = 10 s leads to the opposite effect: the level in the left tank xf 1 is lowered in order to make less water flow through the connection valve. The adjusting the level of the left tank xf 1 , the virtual actuator makes the level of the right tank xf 2 follow its nominal value x2 rather closely. A slight delay is inevitable due to the additional poles, but the simulation also shows a slight deviation from the nominal equilibrium. It follows from the structure of the faulty plant, that the virtual actuator can try to match the level of only one of the two tanks at any point in time (since they depend on each other). The results show a compromise: xf 1 is increased slightly above its nominal level between t ∈ [5, 10] s, but xf 2 still does not quite reach the nominal level. Remark. The difference between the nominal level x2 and the level xf 2 in the reconfigured system depends on the choice of the virtual actuator parameters. A compromise has to be found between reaching the nominal level in xf 1 and reaching the nominal level in xf 2 , since both is not possible at the same time. The compromise can be moved towards one or the other variable by using different parameters. An LQ controller design is more appropriate than pole placement to study this compromise. In the following chapter, an approach is discussed which focuses on restoring xf 2 exactly instead of pursuing a compromise.

8.7 Duality of Virtual Sensor and Actuator The two reconfiguration problems after sensor faults and after actuator faults are dual problems. The relation is similar to the duality of the observer and controller design. The similarities can be found by comparing the problem and the solution in Chap. 7 to the corresponding sections in Chap. 8. This property is important, because it makes it possible to construct the solution to one problem from the solution to the other. Theorem 8.3 Duality of the reconfiguration problem Consider a reconfiguration problem after actuator faults with the nominal plant P1 (A, B, C) and the faulty plant Pf 1 (A, Bf , C) as defined in Sect. 8.1. This problem is dual to the reconfiguration after sensor faults with the dual plant models P2 (AT , CT , BT ) and Pf 2 (AT , CT , BTf ) as defined in Sect. 7.1. The solution to the one problem is the dual solution to the other for the stabilisation goal as stated in Definition 4.1.

8.7 Duality of Virtual Sensor and Actuator

97

Proof. Assume that the reconfiguration problem for actuator faults has been solved according to Theorem 8.1. The reconfigured loop is given in (8.13), which has the poles   O A Bf M σ  −BDC C A − BDC C − Bf M BCC  ⊆ Cg . (8.18) −BC C −BC C AC The reconfigured loop for sensor fault reconfigured problem (claimed to be dual) is give in (7.8). It has the poles   A −BDC C −BCC σ  LCf A − BDC C − LCf −BCC  ⊆ Cg . O BC C AC Transposing this matrix leads to   AT CTf LT O σ  −CT DTC BT AT − CT DTC BT − CTf LT CT BTC  ⊆ Cg −CTC BT −CTC BT ATC which is identical to the matrix of the initial problem (8.18) with the symbol substitutions listed in Table 8.2. Therefore, the solution M to the reconfiguration problem after actuator faults in Pf 1 is a solution L = MT to the reconfiguration after sensor faults in Pf 2 . Table 8.2. Duality of the system variables Plant Pf 1 A Pf 2 A

B T

C/Cf T

C

B

T

/BTf

M LT

Controller P f 1 A C BC

CC

DC

ATC

BTC

DTC

Pf 2

CTC

Signals Pf 1 x

u/uf y/yf

Pf 2 x

y/yf u/uf

For purely graphical illustration of this property, the block diagram of the virtual sensor from Fig. 7.4 is mirrored in Fig. 8.10. By exchanging the symbols according to Table 8.2, and inverting the signal flow, the diagram of the virtual actuator in Fig. 8.4 can be derived.

98


zf Cz

d

Bd xf

Cf

Bf

Af uf

yf Virtual sensor

L -

Cf ˆ x

C

B

A uC

yC w

Controller

Figure 8.10. The dual reconfigured control loop

8.8 Reconfiguration After Internal Faults It is possible to combine the approach for the reconfiguration after sensor faults with the reconfiguration after actuator faults to find a reconfiguration solution after internal faults. This provides a solution to the reconfiguration problem after internal faults without requiring a novel approach. On the other hand, the solution is twice as complex as the ones discussed so far. Since no easier general solution for internal faults could be found, the approach will be outlined briefly. The reconfiguration problem after actuator faults has been discussed in Sect. 5.4. An internal fault changes the matrix A of the plant. Reconfiguration after internal faults is more difficult than after actuator or sensor faults, since the fault is not in a place directly accessible from the reconfiguration block. The basic idea for the solution is to compensate the change in the matrix A using external feedback as shown in Fig. 8.11. Unfortunately, this simple methods only works under these two conditions: ker(A − Af ) ⊇ ker C

8.8 Reconfiguration After Internal Faults Faulty plant

B

99

xf C

Af uf

yf Static reconfiguration block

K

uC

yC Controller

w

Figure 8.11. Reconfiguration after internal faults

im (A − Af ) ⊆ im B . If they are both fulfilled, a matrix K can be found such that Af + BKC = A , which solves the reconfiguration problem. If one of these two conditions is not satisfied, the following alternative can be used: a virtual sensor and a virtual actuator are constructed, which mimic actuators or sensors or the required effect (although they are not present in the actual plant). These virtual actuators and sensors can be used to apply the external feedback that compensates the change in the matrix A. The structure of the reconfigured system is shown in Fig. 8.12. The first step is to find the necessary inputs and outputs. For this, a singular value decomposition is performed on the matrix A∆ = A − Af , leading to A∆ = USV , where S is a diagonal matrix of the size rank A∆ . The matrix V defines the necessary outputs, and U the necessary inputs. Therefore, the following matrices determine the actuators and sensors to be mimicked:

B = B U C C = . V These matrices are used to define a fictuous “nominal plant” P (Af , B , C ). The internal fault in this fictuous plant could be reconfigured in a trivial way

100


B

xf C

Af uf

yf Virtual sensor

L -

B

ˆ x

C C

Af

Virtual actuator

M B -

B

x∆

C

Af

K Reconfigured plant

uC

yC Controller

w

Figure 8.12. Reconfiguration after internal faults using a virtual sensor and a virtual actuator

by using additional feedback. A virtual actuator and a virtual sensor are used to make the plant behave as this fictuous “nominal plant”. The virtual sensor restores the behaviour Pn1 (Af , B, C ) for the actual plant Pf 1 (Af , B, C), and the virtual actuator is designed for Pn2 (Af , B, C ) vs. Pf 2 (Af , B , C ). The added feedback is (according to the singular value decomposition) OO K= . O S

8.9 Conclusion

101

The success of this reconfiguration can be proven mathematically. The model of the reconfigured plant is constructed from the model of the faulty plant (5.11), the virtual sensor (7.6) and the virtual actuator (8.10): x˙ f = Af xf + Buf ˆ = Af x ˆ + LC(xf − x ˆ ) + Buf x uf = Mx∆ x∆ = Af x∆ + BuC + USVˆ x − Buf yC = Cˆ x. After a state transformation with ˆ e = xf − x ˜ = xf + x∆ , x the system becomes      e e O O Af − LC d   x ˜  ˜  =  A∆ Af + A ∆ O x dt A∆ Af − BM x∆ A∆ x∆   O +  B  uC B yC = C(e + xf ) Due to the block triangular form of the system matrix, both the fault-hiding goal and the stabilisation goal can be directly verified at this model. The input/output behaviour of this model is obviously identical to the nominal plant (5.3). The observation error e is not controllable, and the virtual actuator state x∆ is not observable, therefore both do not contribute to the input/output behaviour. So according to Lemma 4.6, the fault-hiding goal is fulfilled. The stability depends on the poles of the model, which depend only on the submatrices on the diagonal. The observer poles σ(Af − LC) are stable due to the choice of L, and the virtual actuator poles σ(Af − BM) are stable due ˜ is stabilised by the nominal controller. to the choice of M. The plant state x Therefore, the stability of the reconfigured loop follows from the stability of the nominal loop.

8.9 Conclusion This chapter contains a central result of the manuscript: the virtual actuator. It has been demonstrated that the reconfiguration problem after actuator

102


faults can be solved analog to the reconfiguration problem after sensors faults. The virtual actuator can restore the stability of the control loop and the controller view of the plant. It has also been shown how the virtual actuator and the virtual sensor can be used together for the reconfiguration after internal faults. The design algorithm of the virtual actuator is efficient enough for medium sized problems, and it does not require any parameters that depend on the fault case. Therefore, the design can be performed on-line after the fault has been detected. The main drawback of the virtual actuator is that it does not restore the reference tracking behaviour (just as the virtual sensor does not restore the disturbance behaviour). Therefore, the two following chapters will develop extensions, which adjust the tracking behaviour of the resulting control loop.

9 Reconfiguration with Set-Point Tracking

9.1 Weak Reconfiguration After Actuator Faults This chapter treats the weak reconfiguration problem: the output equilibrium of the plant (for the same input) has to be restored (see Sect. 5.3 for the introduction of this goal). Two approaches are presented, which both build on the solution from the previous chapter. In addition to the problem definition from the previous chapter, an external output z is defined for the nominal plant x˙ = Ax + Bu

(9.1a)

y = Cx z = Cz x

(9.1b) (9.1c)

x(0) = x0

(9.1d)

and the plant with an actuator fault x˙ f = Axf + Bf uf

(9.2a)

yf = Cxf zf = Cz xf

(9.2b) (9.2c)

xf (0) = x0 .

(9.2d)

In the previous chapter, the two goals were stabilisation (having all poles of the reconfigured loop within Cg ) and fault-hiding (restore the controller signals uC and yC to their nominal trajectory). In addition, the approaches in this chapter are also required to restore the equilibrium of zf to its nominal value: (9.3) lim z(t) − zf (t) = 0 for d, w constant . t→∞


104


If the stationary value of a vector is denoted by a bar ¯·, this condition can be rewritten as ¯=z ¯f . z The condition is termed the weak reconfiguration goal as introduced in Sect. 4.5. The relevant signals for all three goals are shown in Fig. 9.1.

zf

Faulty plant

Cz Weak goal: restore equilibrium

xf

Bf

C

A

uf

Stabilisation goal: stability of this loop

yf


? uC


yC w

Figure 9.1. The reconfiguration problem after actuator faults

9.2 Solvability Consideration This section will analyse the solvability of the weak reconfiguration goal. It concentrates on this goal only, and it does not consider the stabilisation goal (which is required in addition). Obviously the solvability of the weak reconfiguration goal depends on the set of possible equilibrium states of the faulty ¯˙ f = 0 or plant, and the resulting equilibrium outputs. They are defined by x ¯f 0 = A¯ xf + B f u ¯f . ¯f = Cz x z

(9.4a) (9.4b)

9.3 Approach 1: Zero Placement

105

For further analysis it will be assumed that the system has no input or outputdecoupling zeros at zero:1

A rank A Bf = rank = nx . Cz Then the dimension of the solution space of all zf , for which (9.4) has a solution, is A Bf rank − nx . Cz O The weak reconfiguration goal is reachable, if the solution space for the faulty plant includes the solution space of the nominal plant. This is the case if A Bf A Bf B rank = rank . (9.5) Cz O Cz O O

9.3 Approach 1: Zero Placement The first approach relies on changing the zeros of the reconfigured system such that the equilibrium takes the required value. For this, the virtual actuator derived in Sect. 8.3 is extended by a feedforward block. This block only affects the zeros of the system, not the poles. Therefore this block does not affect the two goals pursued in the previous chapter. Hence, the weak reconfiguration goal can be satisfied by a suitable choice of the feedforward gain, without affecting the stabilisation goal. The approach here follows the design of the virtual actuator in Sect. 8.3. There, the control law (8.4) was introduced to stabilise the faulty plant using state feedback. For the zero placement, the control law is extended to contain feedforward based on uC : uf = M(x − xf ) + SuC .

(9.6)

Since the signal uC does not depend on uf (see Fig. 8.4), the feedforward branch is not part of a loop, and therefore it has no influence on the poles of the system. 1

If this assumption is not satisfied, the system can be stabilised by applying state feedback. This does not affect the set of possible equilibriums, so the analysis can be performed on the stabilised system. If the system contains uncontrollable poles in zero, the set of equilibriums depends on the initial state, and the goal cannot be reached without further assumptions about the initial state.

106


After the state transformation (8.8) the extended virtual actuator is given by x˙ ∆ = Ax∆ + BuC − Bf uf uf = Mx∆ + SuC yC = yf + Cx∆ z∆ = Cz x∆ where z∆ denotes the deviation between the nominal output z and the faulty output zf : z∆ = z − zf . The structure of the extended virtual actuator in the control loop is shown in Fig. 9.2.2 The reconfigured plant with the extended virtual actuator is constructed in the same way as the virtual actuator in Sect. 8.5: x˙ f = Axf + Bf uf x˙ ∆ = Ax∆ + BuC − Bf uf

(9.8a) (9.8b)

yC = C(xf + x∆ ) uf = Mx∆ + SuC

(9.8c) (9.8d)

xf (0) = x0 x∆ (0) = 0

(9.8e) (9.8f)

After the separating transformation (8.11), the joint model becomes (see Fig. 9.3) d x ˜ ˜ x A O B (9.9a) u = + O A − B f M x∆ B − Bf S C dt x∆ ˜ x Cz −Cz zf = (9.9b) yC C O x∆ ˜ (0) x x0 = . (9.9c) x∆ (0) O It is obvious that the value of zf depends on x∆ and thus on the choice of S. ¯ (both in the stationary case), which means ¯f equal to z The goal is to have z 2

Note that the matrix S affects the zeros of the reconfigured system and it has therefore many possible uses. A reasonable choice can help to keep the input signal uf small. It can also be used to distribute the load between the different remaining actuators, or it can be seen as a tuning parameter that determines the response of the system to reference changes. Another straightforward choice is S = I, since this keeps the input signal similar between the nominal and the reconfigured loop.


107

zf Cz Faulty plant

Bf

xf C

A uf

yf Virtual actuator

Bf

M S -

B

x∆ C

A uC

yC Controller

w

Figure 9.2. Structure of the extended virtual actuator

that the deviation z∆ has to converge to zero (¯ z∆ = 0). According to (9.9), the equilibrium of the output deviation ¯∆ = −Cz (A − Bf M)−1 (B − Bf S)¯ uC . z ¯ C is not known, the goal is to have the steady-state output Since the value of u ¯ C . This requires ¯∆ vanish for all constant inputs u deviation z 0 = −Cz (A − Bf M)−1 (B − Bf S) .

(9.10)

Since this equation is identical to the transfer function at s = 0, it corresponds to the placement of input-decoupling zeros at zero. The equation has a solution in S if

rank Cz (A − Bf M)−1 Bf = rank Cz (A − Bf M)−1 B Bf which is equivalent to

108

9 Reconfiguration with Set-Point Tracking Virtual actuator

M Bf -

B−BfS

x∆

A zf

-

Cz

uf

Reconfigured plant

B

˜ x

C

A uC

yC Controller

w

Figure 9.3. The separated loop with the extended virtual actuator

rank Cz A−1 Bf = rank Cz A−1 B Bf

(9.11)

and therefore according to (9.5) if the matrix A is invertible. If the solvability is confirmed, the solution can be calculated by inverting (9.10). For the matrix X = Cz (A − Bf M)−1 Bf a right-side inverse X+ is constructed such that XX+ X = X. Then S = X+ Cz (A − Bf M)−1 B

(9.12)

is a possible solution. Theorem 9.1 Satisfying the weak reconfiguration goal by zero placement The weak reconfiguration goal (including the stabilisation goal and the fault-hiding goal) can be satisfied by an extended virtual actuator (9.7), if a matrix M can be found that stabilises (A, Bf ) according to (8.6) and a matrix S can be found that solves (9.10).


109

Proof. Combining the model (9.9) with a dynamical controller (5.2) leads to the following model for the reconfigured loop:      x∆ A − Bf M (B − Bf S)DC C (B − Bf S)CC x∆ d    x ˜ = ˜ O A − BDC C BCC x dt O BC C AC xC xC   (B − Bf S)DC w BDC + (9.13a) BC   x∆ zf −Cz Cz O  ˜  x (9.13b) = yC O C O xC     x∆ (0) O  x ˜ (0)  =  x0  . (9.13c) xC (0) O The stability of the loop follows from the choice of M and the stability of the nominal loop, it does not depend on S. The dynamic behaviour of x∆ is determined by x˙ ∆ = (A − Bf M)x∆ + (B − Bf S)(DC C˜ x + CC xC ) . ¯ ∆ will always be within ker Cz , and Due to (9.10), the steady-state value of x ¯˜ = z ¯ f = Cz x ¯. ¯f = Cz x therefore the external output takes the nominal value z Based on this theorem, the following algorithm can be constructed. Algorithm 9.2 Design of a virtual actuator for the weak reconfiguration goal Given: The linear model (9.1) of the nominal plant P (A, B, C) and the model (9.2) of the faulty plant Pf (A, Bf , C). Find: A reconfiguration block satisfying the weak reconfiguration goal. Requirements: The poles of the nominal loop and the fixed poles of the faulty plant are within Cg . Parameters: A controller design problem (depending on the method used). 1. Construct the equivalent control problem (8.5). 2. Use a controller design method to find a matrix M satisfying (8.6). 3. Find a matrix S that satisfies (9.10), using (9.12). (If no solution exists, the weak goal is not reachable.) 4. Put the reconfiguration block according to (9.7) into the control loop and initialise it with x∆ = 0.

110


Result: A stable reconfigured control loop satisfying the weak reconfiguration goal. The complexity of this algorithm is determined by Step 2: the controller design problem. As discussed in Sect. 7.4, most algorithms have a time complexity between O(n3 ) and O(n4 ). The complexity of Step 3 is of the order O(n3 ) as discussed after Algorithm 6.2. Therefore, this approach is suitable for medium sized problems. The algorithm does not require any more parameters than Algorithm 8.2. Since the parameters can be chosen before knowing the fault case, the algorithm can be used to perform an autonomous reconfiguration after the fault has been detected.

9.4 Approach 2: Integrating Controller A second approach to the weak reconfiguration goal is presented in this section. It relies on the use of an integrating controller. If an integrator is made part of the virtual actuator, and the loop is stable, it follows automatically that the input to the integrator converges to zero. By using the deviation of the external output as the input to the integrator, the weak reconfiguration goal follows from the stabilisation of the virtual actuator. The virtual actuator as stated in Theorem 8.1 is used, but it is extended to contain integrating states xI based on the output deviation x˙ I = z∆ = Cz x∆ (see Fig. 9.4). Therefore, the extended virtual actuator is d x dt ∆ uf yC z∆

= A x∆ + B uC + Bf uf

(9.14a)

= M x∆ = yf + Cx∆ = Cz x∆

(9.14b) (9.14c) (9.14d)

with x∆ A

B Bf M

=

x∆ xI

A O = Cz O B = O Bf = O

= M MI .

9.4 Approach 2: Integrating Controller

111

zf Cz Faulty plant

Bf

xf C

A

uf

yf xI

Virtual actuator

MI

-

B

Cz

M

Bf

x∆ C

A

uC

yC Controller

w

Figure 9.4. Reconfigured loop with an integrating controller

This approach is applicable for plants without poles at zero. If the plant already contains integrators, adding further integrators may create uncontrollable poles.3 Therefore, the integration is limited to a vector Cz x∆ . The matrix Cz is chosen, such that ker Cz = ker Cz + A−1 ker A where the + denotes the linear subspace addition (and not the set unification). The feedback matrix M has to be chosen such that it stabilises the pair A , Bf of the extended virtual actuator. If the stabilising feedback is 3

If the integrators in the plant are parallel to the added integrators, the system can be reduced by removing the latter without affecting the result. However, there are also systems, where this is not possible, and the weak goal is not solvable.

112


applied, it follows from the structure of the system that Cz x∆ converges to zero:4 lim Cz x∆ = 0 for constant uC , t→∞

¯∆ = 0. The critical requirement for this apwhich can also be written as z proach is that

(9.15) A , Bf is stabilisable in the sense that all poles can be moved into Cg . Theorem 9.3 Satisfying the weak reconfiguration goal by integrating control If all uncontrollable poles in the pair (9.15) are within Cg , then the weak reconfiguration problem as defined in Sect. 9.1 can be solved using the virtual actuator (9.14).

Proof. A proof ad absurdum will be given. It is assumed that a stabilising controller M has been found for the pair (9.15). The stability of the control loop can be shown in the same way as in Sect. 8.5. It is further assumed that the weak reconfiguration goal zf → z has not been fulfilled despite constant input w and disturbance d. Since the loop is stable, the difference z∆ = zf −z converges, and it converges to a nonzero value due to the assumption. The differential equation for xI is x˙ I = Cz x∆ which is obviously nonzero. Therefore, the integrator xI never converges, conflicting with the assumption of a stabilising reconfiguration solution. Algorithm 8.2 can be used to find the solution, after the extended problem has been constructed. Since the necessary changes are minimal, the algorithm is not restated here. The analysis of the algorithm complexity is applicable to the extended version, too. Since the number of output variables nz is usually small compared to the number of states nx , there is only a minor increase in computation time.

9.5 Analysis and Comparison The two presented approaches solve the same problem using a very different reconfiguration problem. The first approach relies on the placement of 4

Note that a constant input uC follows from a constant reference w, since the system is stable.

9.5 Analysis and Comparison

113

zeros, while the second one introduces additional poles. Still the solvability conditions will be shown to be similar: both approaches rest on the system (A, Bf , Cz ) having no zero at s = 0. The solvability condition (9.11) depends on the rank of Cz (A − Bf M)−1 Bf , which is equal to A − B f M Bf rank − nx . Cz O The zero placement approach is feasible, if A − B f M Bf A − B f M Bf B rank = rank . Cz O O O Cz This condition is identical to the solvability condition found in Sect. 9.2, therefore the zero placement approach provides a general solution of the weak reconfiguration problem. If the system is unstructured, this condition usually simplifies to rank Bf ≥ rank Cz .

(9.16)

In other words: it is usually possible to restore as many outputs to their nominal values as actuators are left in the faulty plant. A lower number of inputs may be sufficient, if some outputs are not affected by the fault. A higher number may be required, if the effect of the inputs is restricted to a part of the system by its structure. The second approach extends the virtual actuator with an integrating branch. It is successful, if the pair (9.15) is stabilisable. Similar approaches are known under the term (multi-variable) integral control or error integral control, see for example Sinha [1984], Sect. 7.3. The success of this approach can be checked by constructing the controllability matrix Bf ABf A2 Bf · · · An Bf . O Cz Bf Cz ABf · · · Cz An−1 Bf This matrix can be rewritten as O Bf ABf · · · An−1 Bf A Bf . Cz O I O ··· O The second matrix has full rank, if the faulty plant is controllable. In this case, the rank of the product is equal to the rank of the first matrix, which is identical to the matrix constructed in the solvability condition (9.5). Therefore, this solution approach is always applicable if the weak reconfiguration problem is solvable and the faulty plant is controllable. If the plant is not controllable, the system can be reduced to its minimal representation, and the criterion can be applied to the reduced model. If the uncontrollable part is unstable, or if z depends on it, the problem is not solvable.

114


So both methods leads to essentially similar results. The different aspects of the reconfiguration solution with respect to the goals are summarised in Table 9.1. The only differences compared to Table 8.1 are the entries for the behaviour of the external output zf . Table 9.1. Behaviour of the reconfigured loop with a virtual actuator designed for the weak goal Goal Fault-hiding Weak Strong Direct Relevant Reconfigured Stationary Output Plant signal output output trajectory state Excitation Condition yC = y zf → z zf = z xf = x none xf 0 = 0 Reference w= 0 Disturbance d = 0

X X X

X X X

o

o


9.6 Application to the 2-Tank Example Both approaches are directly applicable to the 2-Tank Example. The first approach builds on the results (especially M) from Sect. 8.6. The (9.10) is solved for S:

+

Cz (A − Bf M)−1 B S = Cz (A − Bf M)−1 Bf where ·+ denotes the pseudo-inverse. The left bracket is

−0.0133 0 and the right bracket

−0.0133 −0.12 .

Therefore, the feedforward matrix is S=

19 00

.

The extended virtual actuator according to (9.7) is used. The simulation results are shown in Fig. 9.5. Due to the high amplification, rapid input changes occur in the only remaining input u1 , but the absolute values stay reasonably small. The resulting behaviour is very close to the nominal behaviour, and the reconfigured loop reaches the same equilibrium both after set-point changes and under the influence of disturbances. The reconfiguration is therefore successful.

Right tank

Left tank

Plant input

Controller output


1

115

uC2

0 uC1

^ disturbance

−1 1

uf 1

0

uf 2

−1 xf 1 Actual level

0.2 0 −0.2 −0.4


0.1

w2

0 −0.1

Reference

xf 2 Actual level

0

5


10 Time t/s

15

20

Figure 9.5. Reconfiguration of the 2-Tank Example after Fault 2 using a virtual actuator with zero placement

The second approach is slightly more complex. The difference model is extended by an integrator based on z, which leads to       −1 0 0 1 −0.5 10 x˙ ∆ =  1 −1 0  x∆ +  0 +0.5  uC −  0 0  uf 0 1 0 0 0 00 100 y∆ = x∆ . 010 The faulty plant is extended accordingly. The virtual actuator for the extended plant has three poles. Since the reference tracking does not have to be fast, the third pole is places at −2, leading to the pole set −2, −5 and −15. The feedback matrix is 20 94 150 M= . 0 0 0 The simulation results are shown in Fig. 9.6. This solution is slightly more complex than the zero placement approach. The response of the plant is marginally slower, but there is significantly less movement in the input value.

116


Right tank

Left tank

Plant input

Controller output

This may be surprising due to the high amplification in M, but it has to be remembered that the third state is already filtered several times. Overall, the solution is as good as can be expected after the blockage of the valve u2 .

1

uC2

0 uC1

^ disturbance

−1 1

uf 1

0 uf 2

−1 xf 1 Actual level

0.2 0 −0.2 −0.4


0.1

w2

0 −0.1

Reference

xf 2 Actual level

0

5


10 Time t/s

15

20

Figure 9.6. Reconfiguration of the 2-Tank Example using an integrating virtual actuator after Fault 2

9.7 Dual Approach For Sensor Faults The dual approach for reconfiguration after sensor faults aims at restoring the equilibrium of the faulty plant despite some disturbance d as introduced in Sect. 5.1. The model of the faulty plant is x˙ f = Axf + Buf + Bd d yf = Cxf . The zero placement approach can be applied in a way that is analogously to the situation after actuator faults in Sect. 9.3. The virtual sensor is extended by output feedthrough, which only affects the output equation. The extended virtual sensor is defined by

9.8 Conclusion

ˆ) ˆ˙ = Ax + L(yf − Cf x x ˆ) . yC = Cˆ x + S(yf − Cf x

117

(9.17a) (9.17b)

The goal is to make the deviation e vanish in the presence of a constant ¯ The equilibrium of the deviation is disturbance d. ¯ ¯ = (C − SCf )(A − LCf )−1 Bd d e and therefore the matrix S has to satisfy O = (C − SCf )(A − LCf )−1 Bd . This condition is exactly dual to (9.10). The introduction of integrators is known for both control and observation problems, and it is one way of dealing with constant disturbances. The idea is that a disturbance of a known characteristic can be modelled by a socalled exo-model as detailed by Hu et al. [2003] in Sect. 6.2. This model is autonomous, and it generates all possible disturbances according to its initial state. For a constant disturbance, the exo-model is an integrator d˙ = 0 where d is a state. This model is included into an extended (undisturbed) plant, for which an observer (or virtual sensor) can be designed. The resulting observer is also known as PI (proportional integral) observer in the literature. The solvability rests on the observability of the extended plant d xf A Bd xf B = + uf O O d O dt d yf = Cxf . The applicability of this approach depends mainly on the system (A, B, Cf ) having full input rank (this corresponds to the problem after actuator faults, where the output rank is relevant).

9.8 Conclusion This chapter has shown how the actuator developed in Chap. 8 can be extended to restore the reference tracking behaviour of the control loop despite the fault. This task was termed the weak reconfiguration problem. Two different approaches are given, that both provide a general solution to this problem, with only marginal differences concerning the generation of the input signal. Since the weak reconfiguration problem allows for the specification of the poles of the reconfigured loop, the reference tracking can be made as fast as necessary.

118


The resulting algorithms are only slightly more complex than the algorithm for the design according to the stabilisation goal. The increase in computation time is moderate, and no further parameters are required. Therefore, these two algorithms are most promising for the application in autonomous control reconfiguration.

10 Reconfiguration by Disturbance Decoupling

10.1 Strong Reconfiguration After Actuator Faults This chapter addresses the strong reconfiguration goal for plants after actuator faults. The objective is to find a reconfigured block that makes the external output of the reconfigured control loop match the output of the nominal control loop. The approach builds on the virtual actuator, designed in Chap. 8 to stabilise a plant after actuator faults. In contrast to the reconfiguration problems treated earlier, this goal does not lead to an equivalent controller design problem. Instead, the problem can be transformed into a disturbance decoupling problem with stabilisation, which belongs to a different class of problems. Known approaches can be used to find a solution. In the previous chapter, the external output zf of the reconfigured control loop was required to converge to the external output z of the nominal control loop (weak goal). The problem studied here is similar, but it requires the output zf to match the nominal value z at all times (strong goal). Both goals where defined in Sect. 5.3. The model of the nominal plant was already given in (5.1). For the problem here, the disturbance d can be neglected, leading to the simplified state-space model x˙ = Ax + Bu y = Cx z = Cz x x(0) = x0 .

(10.1a) (10.1b) (10.1c) (10.1d)

After an actuator fault, the model of the faulty plant becomes x˙ f = Axf + Bf uf yf = Cxf

(10.2a) (10.2b)


120


(10.2c)

zf = Cz xf

(10.2d)

xf (0) = x0 .

In the previous chapter, three goals were pursued: the stabilisation goal (having all poles of the reconfigured loop within Cg ), the fault-hiding goal (restore the controller signals uC and yC to their nominal trajectory) and the weak reconfiguration goal (restore the stationary value of zf ). This chapter will add the strong reconfiguration goal: the external output zf of the reconfigured loop has to be equal to the output z of the nominal loop at all times ∀t ∈ R+ : zf (t) = z(t) . All goals and the relevant signals are shown in Fig. 10.1. zf

Faulty plant

Cz Bf

Strong goal: restore trajectory

xf C

A uf

yf



? uC

yC


w

Figure 10.1. The strong reconfiguration goal after actuator faults

10.2 Solvability Condition This section investigates the conditions, under which the reconfiguration problem above is solvable. Two main aspects have to be considered: the restoration of the output trajectory zf = z and the stability of the reconfigured control loop. As will be shown later, even if both problems are solvable separately, it may still be impossible to satisfy both at the same time.

10.2 Solvability Condition

121

The reconfiguration problem is defined by comparing the nominal control loop to the reconfigured control loop. Since it is very difficult to analyse the solvability for the control loop, the problem formulation can be simplified by focusing on the plant. This is possible using Lemma 4.6 with the condition of satisfying the fault hiding goal: if the behaviour of the reconfigured plant (faulty plant plus reconfiguration block) is equal to the behaviour of the nominal plant, the fault-hiding goal is satisfied, and all signals of the controller are unaffected by the fault. The important result is that the input of the reconfigured plant uC is equal to the input of the nominal plant u. This leads to a formulation of the strong reconfiguration in terms of the reconfigured plant: the output zf has to be equal to the output z of the nominal plant given the same input uC and u respectively (see Fig. 10.2). In the same way, the stability of the control loop can be deduced from the stabilisability of the reconfigured plant. Difference model

uC Nominal plant model G(s)

z z∆

Reconfigured plant Reconfiguration block H(s)

uf

Faulty plant

zf

Goal: vanishes

Gf (s)

? (to be found)

Figure 10.2. The nominal and the faulty system

The transfer function of the nominal plant and the faulty plant are G(s) = Cz (Is − A)−1 B Gf (s) = Cz (Is − A)−1 Bf . According to the problem definition, two goals have to be satisfied 1. The strong goal requires that for any nominal input uC , an input uf for the faulty plant can be found, such that the output zf is identical to the output z of the nominal plant. Since all systems are linear, this input can be found by a linear system H(s) if it exists. Therefore, in order for the strong goal to be reachable, a transfer function H(s) has to exist, such that a series of this block H(s) and the faulty plant Gf (s) has the same behaviour as the nominal plant G(s):

122


∃H(s) : G(s) = Gf (s)H(s) . Since this H(s) is the required reconfiguration block, it also has to be a proper rational matrix transfer function.1 Unfortunately, an exact test for this condition requires advanced methods from rational matrix theory. Therefore, it is deferred to the constructive solution in Sect. 10.4, and a more detailed treatment can be found in Hu et al. [2003], Sect. 3. Only a necessary condition will be considered here: the existence of a rational (but not necessarily proper) solution H(s). It obviously exists, if

(10.3) ∀s : rank Gf (s) = rank G(s) Gf (s) . This condition will be studied in more detail in Sect. 13.4. 2. The stabilisation goal requires that the reconfigured plant H(s)Gf (s) be stabilisable. Several necessary conditions can be given for this. Obviously H(s) and Gf (s) have to be stabilisable. In addition, there have to be no unstable zeros or poles in Gf (s) that are not in G(s), since these would have to be cancelled by unstable poles and zeros in H(s), leading to hidden unstable poles. The case of unstable zeros is discussed by Hu et al. [2003] in Sect. 3.3., and the case of unstable poles is obvious.

10.3 Interpretation as a Disturbance Decoupling Problem Comparing the reformulated problem (see Fig. 10.2) to known problems shows that it belongs to the class of disturbance decoupling problems. The controller output uC can be interpreted as a disturbance, and the goal is to decouple the output deviation z∆ = z−zf . This leads to the known-disturbance decoupling problem with stabilisation (often denoted as DDPS’ in the literature). The disturbance decoupling problem is defined on a system with two inputs and one output. The disturbance input uC is given, and the signal cannot be changed. The control input uf is free, and it has to be chosen such as to keep the output z at zero. If this is achieved, the output is said to be decoupled from the disturbance (hence the name of the problem). So for the reconfiguration problem, the goal is to find the control input uf that cancels the disturbance input uC , keeping the output deviation z∆ at zero. The problem shown in Fig. 10.3 contains both the nominal plant (6.1) and the faulty plant (6.2). A simple analysis reveals that the system within the 1

Such a transfer function is also called “realisable”, which means that it does not contain pure differentiators.

10.3 Interpretation as a Disturbance

Decoupling Problem

123

Nominal plant model

uC

B

x

Cz

z

A z∆ Reconfigured plant -

uf Reconfiguration block

Faulty plant

Bf

?

xf

Cz

Goal: vanishes

zf

A

(to be found)

Figure 10.3. Comparing the nominal and the faulty plant

dashed box is not minimal, since it is only partially observable. The difference in state between the faulty plant and the nominal plant x ∆ = x − xf is observable, but not the sum x + xf . Therefore, a state reduction can be performed which makes the difference x∆ the state of the reduced model. This reduction does not affect the behaviour of the system, which means that the problem remains unchanged. The reduced model is x˙ ∆ = Ax∆ + BuC − Bf uf

(10.4a)

y∆ = Cx∆ z∆ = Cz x∆

(10.4b) (10.4c)

x∆ (0) = 0 .

(10.4d)

The output y∆ is used for the correction of the control output yf of the faulty plant in order to satisfy the fault-hiding goal. The correction is identical to the one used in Sect. 9.3. There are situations, where no correction is necessary (especially if ker Cz ⊆ ker C), but this will be analysed later. Using this reduced model, the disturbance decoupling problem is formally defined as follows (see Fig. 10.4). Problem 1. Known-disturbance decoupling problem with stability (DDPS’) Given: a difference model for the system P (A, B, Bf , Cz ) with the output z and the inputs uC and uf as defined by (10.4)

124

10 Reconfiguration by Disturbance Decoupling Difference model

uC B uf Input calculation

Bf

-

x∆

Cz

z∆

? (to be found)

A

Figure 10.4. Solution of the disturbance decoupling problem

Find: a control law that generates a control input trajectory uf (t) based on uC (t) and x∆ (t), such that the output z∆ remains exactly zero at all times ∀t ∈ R+ : z∆ (t) = 0

(10.5)

and the resulting decoupled system (control law and difference model) is stable. There are several variants of disturbance decoupling problems. This one is called the known-disturbance decoupling problem with stabilisation, sometimes denoted as DDPS’. It is a known-disturbance problem, since the disturbance uC is available and can be used in the control law. It is a decoupling problem with stabilisation, because the resulting system is required to be stable. Note that uC is not assumed to be differentiable (as in some other variants of the disturbance decoupling problem). The solution for this problem is always a control law of the form (10.6)

uf = Mx∆ + SuC .

uC uf S M

Difference model

B Bf

-

x∆

Cz

z∆

A

Figure 10.5. Solution of the disturbance decoupling problem

10.4 Geometric Approach

125

Different approaches exists to test for solvability and to find suitable parameter matrices M and S. If the solution is found, the control law (10.6) and the difference model (10.4) define the virtual actuator. This result is summarised in the following theorem. Theorem 10.1 Strong reconfiguration after actuator faults The strong reconfiguration goal can be satisfied, if the known-disturbance decoupling problem defined in Problem 1 is solvable. The solution matrices M and S define the virtual actuator x˙ ∆ = Ax∆ + BuC − Bf uf uf = Mx∆ + SuC yC = yf + Cx∆ x(0) = 0

(10.7a) (10.7b) (10.7c) (10.7d)

which solves the reconfiguration problem. The structure of the reconfigured loop is shown in Fig. 10.6. If the problem is chosen such that ker C ⊆ ker Cz , Cx∆ is always zero, and the block C in the virtual actuator can be eliminated. This has the practical advantage that yf = yC : the controlled output is the actual output of the process. Otherwise, a correction to the output signal yf is necessary as defined in (10.7c). With this signal, the virtual actuator designed here has the same structure as the one used in Chap. 8. The only difference is the design algorithm used to find the parameters and the state reduction performed during the design. In order to analyse these results further, a common approach to the disturbance decoupling problem will be shortly introduced. Several other approaches exist, based on transfer functions or structured models, but the geometric approach presented here lends itself to the application to state-space systems.

10.4 Geometric Approach The geometric approach as developed by Wonham [1985] and Basile and Marro [1992] will be presented here, because it provides a natural way to deal with state-space models. The disturbance decoupling part of the problem is treated first, and the stabilisation problem is addressed once the decoupled system is known. The geometric approach is centred around the notion of a controlled invariant subspace of the state space Rnx . A subspace V ⊆ Rnx is called invariant, if the

126

10 Reconfiguration by Disturbance Decoupling zf

Faulty plant

Cz

Bf

xf C

A uf

yf Virtual actuator

Bf

M S -

B

x∆ C

A uC

yC Controller

w

Figure 10.6. The virtual actuator with decoupling in the loop

system state x∆ never leaves the subspace once it has entered it (x∆ ∈ V). It is called controlled invariant if there exists a state feedback matrix that renders the subspace invariant. The system can be split into two parts, where one subsystem represents the controlled invariant subspace, and the other subsystem contains the rest. The important consequence is that there is no connection from the invariant subsystem to the other subsystem. This division is shown in Fig. 10.7. Note that the matrices used in the figure apply to a transformed system, where both subspaces have been separated from each other. For the solution of the disturbance decoupling problem, a division is to be found, such that the disturbance affects only the invariant part of the system, and the output only depends on the other part of the system. Together with the invariance property, the subspace V has to satisfy three conditions. Using set transformations, the three conditions can be formalised as follows: invariant: AV ⊆ V + im Bf

(10.8a)


127

Difference model Disturbed unobservable part

uC

B uf S M

Bf

Decoupled observable part

B2

-

A

x

Bf 2

Cancelation point

-

A21

x∆2

z∆ Cz2

A22 A22

Figure 10.7. The transformed difference model

unobservable: V ⊆ ker Cz undisturbed: im B ⊆ V + im Bf .

(10.8b) (10.8c)

In this notation, “im” denotes the image of a transformation (the set of possible output values) and “ker” denotes the kernel of a transformation (the set of inputs without effect). The multiplication AV denotes the set of results of the transformation A based on the values within V, and the addition V + im Bf denotes the linear combination of the two subspaces. If the three conditions (10.8) are satisfied, a suitable solution ∃M : (A + Bf M)V ∗ ⊆ V ∗ ∃S : im (B + Bf S) ⊆ V ∗ .

(10.9a) (10.9b)

can be found. Both existence conditions hold, because they are equivalent to the properties (10.8a) and (10.8c). It is worth noting that the solution is usually not unique. Any uf with Bf uf ∈ V ∗ can be added to the input without affecting the decoupling property. Therefore, the general solution is the control law (10.10) uf = Mx∆ + SuC + Qu where

∗ im Q = B−1 f V

(10.11)

denotes the undefined input subspace and u can take any value without disturbing the second part of the system. In order to find suitable parameters, V ∗ has to be constructed first. The classical algorithm to find the solution rests on the fact that there is exactly one maximal subspace V ∗ which satisfies both (10.8a) and (10.8b). The series V0 = ker Cz Vk+1 = Vk ∩ A−1 (Vk + im Bf )

(10.12a) (10.12b)

128


becomes stationary after at most nx steps and returns this maximal invariant subspace V ∗ = Vnx . The solvability of the known-disturbance decoupling problem (without stabilisation) can be checked by validating the third condition (10.8c). If it is not satisfied by the maximal invariant subspace V ∗ , it obviously cannot be satisfied by any smaller invariant subspace V either. Lemma 10.2 Known-disturbance decoupling (DDP’) The known-disturbance decoupling problem (without stabilisation) defined on the system P (A, Bf , B, C) is solvable if and only if (10.8c) holds for the maximal invariant subspace V = V ∗ . The solution has the form (10.6) and can be always found according to (10.9). Proof. Proofs for this lemma can be found in Wonham [1985], Basile and Marro [1992], Hu et al. [2003]. Given a full rank matrix VK with ker VK = V ∗ , the requirements for a solution can be written as VK Bf M = VK A VK B f S = V K B . If a solution exists, it can be written as +

M = (VK Bf ) VK A +

S = (VK Bf ) VK B , +

where (VK Bf ) denotes the left side inverse of VK Bf , which solves +

VK Bf = VK Bf (VK Bf ) VK Bf . Note that while this solution decouples the output z, it does not usually stabilise the difference system. The free input u can be used to stabilise the invariant subspace without affecting the decoupling. In order to find a suitable feedback matrix, the system has to be reduced to the invariant subspace. This is achieved by the state reduction x = Tx∆

(10.13)

which maps the invariant subspace V ∗ onto a new state space x ∈ RnV , where nV is the dimension of V ∗ . The back transform is defined by the pseudo-inverse T+ with TT+ = InV and im T+ = V ∗ . The invariant part of the system is


x˙ = A x + B uC − Bf uf

129

(10.14a)

(10.14b) (10.14c)

uf = M x + SuC + Qu y∆ = C x

(10.14d) (10.14e)

z=0 x (0) = 0 .

with A = TAT+ B = TB Bf = TBf C = CT+ M = MT∗ (see Fig. 10.8).

Reduced difference model

uC B uf S

Bf

-

M

x

A

Figure 10.8. The reduced virtual actuator

This reduced system has to be stabilised without affecting the decoupling property. The degree of choice is made explicit in the free input u . Therefore, a stabilising controller of the form u = Kx

(10.15)

can be applied without affecting the decoupling property. The feedback matrix K has to stabilise the pair (A − Bf M , Bf Q) .

(10.16)

Several controller design methods (like pole placement or linear quadratic design) can be used to find K. For the stabilisation goal, it is required that the poles of virtual actuator are within the design set

130


σ(A − Bf (M + M0 K0 )) ∈ Cg .

(10.17)

This requires that the fixed poles of the pair (10.16) are within the design set Cg . Note that these poles depend on the decoupling controller determined by M. Therefore, the condition can only be checked after the solution of the first part part of the problem. Lemma 10.3 Solvability of known-disturbance decoupling with stabilisation (DDPS’) The known-disturbance decoupling problem with stabilisation defined on the system P (A, Bf , B, C) is solvable, if and only if the known-disturbance decoupling system without stabilisation is solvable, and the pair (10.16) is stabilisable, such that all poles can be placed inside of Cg . Proof. Proofs for this lemma can also be found in Wonham [1985], Basile and Marro [1992], Hu et al. [2003].

10.5 Reconfiguration Algorithm Using the geometric approach explained above, the disturbance decoupling problem defined on the difference system can be solved in two steps. This leads to the decoupled difference system, which is the virtual actuator required for the reconfiguration of the control loop. This sequence of steps can also be seen in the following reconfiguration algorithm. The resulting system structure with the reduced difference system is shown in Fig. 10.9. Algorithm 10.4 Reconfiguration after actuator faults satisfying the strong reconfiguration goal Given: The linear model (10.1) of the nominal plant P (A, B, Cz ) and the model (10.2) of the faulty plant Pf (A, Bf , Cz ). Find: A reconfiguration block satisfying the strong reconfiguration goal. Parameter: Controller design specification (depending on the method). 1. Find the maximum invariant subspace V ∗ using (10.12). 2. Find M, S and Q satisfying (10.9) and (10.11). If a solution cannot be found, the reconfiguration problem is unsolvable. 3. Perform the transformation (10.13). 4. Find a stabilising controller for the pair (10.16). If the pair is not stabilisable, no stable reconfiguration solution exists.

10.5 Reconfiguration Algorithm

131

zf

Faulty plant

Cz

Bf

xf C

A uf

yf Virtual actuator

Bf

K S -

B

x∆

Cz

A uC

yC Controller

w

Figure 10.9. The virtual actuator with decoupling in the loop

5. Add the virtual actuator x˙ = A x + B uC + Bf uf

(10.18a)

uf = (M + QK)x + SuC yC = yf + C x

(10.18b) (10.18c)

as defined by (10.4), (10.10) and (10.15) into the control loop. Initialise x (0) = 0. Result: A reconfigured control loop that satisfies the strong reconfiguration goal. The complexity of this algorithm depends mainly on Steps 1 and 4. The construction of the subspace V ∗ takes at most nx iterations, with a complexity of O(n3 ) each. This leads to a worst case estimate for the time complexity of Step 1 is in the order of O(n4 ) (for most practical cases, very few iteration

132


are performed even for large systems). In Sect. 7.4, Step 4 was found to have a complexity between O(n3 ) and O(n4 ) depending on the controller. Consequently, the complexity of the complete algorithm is in the order of O(n4 ), which makes it applicable for systems up to about 50 states. It may be possible to find the solution significantly faster, if the structure of the system is favourable. This algorithm does not require any more parameters than previous algorithms. If an appropriate design method is used, the parameters can be chosen at design time, so that the algorithm can be run autonomously without intervention. However, this algorithm is rather long and requires powerful routines from linear algebra. Another drawback is that the algorithm may fail in Step 4, and it is not possible to predict the success. Therefore, the use of this algorithm for autonomous reconfiguration requires extra care, and an alternative has to be available in case it fails. A possible approach will be shown in Chap. 15.

10.6 Analysis of Reconfigured System This section builds on the design of the disturbance decoupling solution to analyse the behaviour of the reconfigured loop. The model of the reconfigured plant can be derived from the virtual actuator (10.18) and the faulty plant (10.2): x˙ f = Axf + Bf uf + Bd d x˙ = A x + B uC − Bf uf uf = (M + QK)x + SuC yC = Cxf + C x zf = Cz xf xf (0) = x0 x (0) = 0 . As in the former chapters, the state x of the virtual actuator is interpreted as a deviation between the state xf of the faulty plant, and the state x of the nominal plant in the same situation. Since the reconfiguration block has been reduced during the design phase according to (10.13), the state has to be expanded first. The resulting state transformation is ˜ = x f + T + x . x It leads to the following model of the reconfigured plant

10.6 Analysis of Reconfigured System

d dt

˜ x x

=

A (I − T+ T)(AT+ − Bf MS ) ˜ x O A − Bf MS x (I − T+ T)SBf + T+ TB uC + B − Bf S

133

(10.19a) (10.19b) (10.19c)

x yC = C˜ ˜ − Cz T+ x zf = Cz x ˜ (0) x x0 = . x (0) O

(10.19d)

Several simplifications can be performed using the property of the transformation (10.13) and the requirements for the disturbance decoupling problem (10.8). This reveals the structure of the model (see Fig. 10.10) d x A O ˜ ˜ x (10.20a) = O A − B M x x dt S f B u + B − Bf S C ˜. zf = Cz x

(10.20b)

Virtual actuator

M Bf

B −

Bf S

x

A

Cz zf

uf

Reconfigured plant

B

˜ (= x) x

Cz yf

-

C

A uC

yC Controller

w

Figure 10.10. The separated loop with a decoupling virtual actuator

134


Again, the block diagonal structure shows that the system consists of two ˜ is independent subsystems, with separate sets of poles. The first subsystem x in all respects equal to the nominal plant x. The poles are σ(A), but they are moved by the nominal controller to the desired location. The virtual actuator x is unobservable. It represents the difference in state between the nominal and the faulty plant, and the poles σ(A − Bf MS ) are determined during the design of the virtual actuator. Together with the dynamical controller (5.2), the model of the reconfigured system becomes      O BCC A − BDC C ˜ ˜ x x d    x = (B − Bf S)DC C A − Bf MS (B − Bf S)CC x  dt xC xC BC C O AC   BDC (10.21a) +  (B − Bf S)DC  w BC (10.21b) (10.21c)

yC = C˜ x ˜ zf = Cz x ˜ (0) x0 x = . O x (0)

(10.21d)

Proof. (of Theorem 10.1) The success of the reconfiguration can be seen in model (10.21). The poles are σ(A − Bf MS ) as designed in (10.17) and the poles A − BDC C BCC σ BC C AC of the nominal control loop (5.3). Since the subspace x has no direct or indirect connection to the external output zf , this output follows the same trajectory as the nominal output z: zf = z . This concludes the constructive proof of Theorem 10.1. These results are summarised in Table 10.1. This reconfiguration approach restores every variable of the system back to its nominal value, with the exception of part of the state xf , the input uf and under some circumstances the output yf . Restoring the state is generally impossible, as has been shown in Chap. 6, and restoring the input signal is obviously not a useful goal. Therefore, this approach is the most powerful approach possible within the given framework. Remark. The algorithm is correct, but not complete. This means that there are reconfiguration problems which cannot be solved using this algorithm. Assume


135

Table 10.1. Behaviour of the reconfigured loop with a virtual actuator design for the strong goal Goal Fault-hiding Weak Strong Direct Relevant Reconfigured Stationary Output Plant signal output output trajectory state Excitation Condition yC = y zf → z zf = z xf = x none xf 0 = 0 Reference w= 0 Disturbance d = 0

X X X

X X X

X X X

o


that the decoupling problem is not solvable, because the derivation of the input uC would be required in order to decouple z∆ . It is possible that u˙ C can be calculated if the model of the controller is known. Therefore, the problem is solvable, but the approach presented here will not find a solution.

10.7 Application to the 2-Tank Example The 2-Tank Example does not require that the strong reconfiguration goal is satisfied. The algorithm will be applied anyway in order to illustration the idea of the disturbance decoupling approach. The necessary condition (10.3) is fulfilled:

1 0 −0.25 0 1 −0.5 rank 0 1 , , ··· 0 1 0.25 −0.25 0 +0.5

1 0 −0.25 0 10 = rank 0 1 , , ··· =1 . 0 1 0.25 −0.25 00 However, the unobservable subspace is empty: V1 = ker Cz ∩ A−1 (ker Cz + im Bf ) 1 −1 = im ∩ im = {0} . 0 1 With the available inputs, no decoupling is possible. The interpretation is obvious in Fig. 3.2: since the nominal input u2 can reach x2 directly, while the alternative input u1 goes through another state, the disturbance reaches the output too fast and the path provided for cancellation is too slow.

136


The approach is partly applicable for Fault 1: the pump u1 works uncontrolled at nominal power. It is obvious for the physical interpretation that a reconfiguration cannot fulfil the weak or the strong goal for an extended period of time. Due to mass conservation, the outflow must be equal to the (uncontrolled) inflow in the long run, which means set-point tracking is actually impossible. Nevertheless, a decoupling virtual actuator can be found. The unobservable subspace is 1 . V ∗ = V0 = ker Cz = im 0

The resulting state transformation T = 1 0 leads to the reduced difference system x˙ = −x + 1uC1 − 0.5uC2 + 0.5uf 2 uf 2 = M x + SuC . The (10.9) determine the choice of the two parameters

1 = 0.5M

0 0.5 0 = 0.5S

which leads to the only solution M = 2 and S = 0 1 0 . The stabilisation cannot be performed, since there are no degrees of freedom left (Q = O). This is obvious from the physical interpretation: there is one output to restore to nominal, and one available input. Therefore, this input is determined by the output trajectory. Unfortunately, the decoupled system is unstable: it has a pole at 0.2 Therefore the reconfiguration will work for a limited period of time only, after which the system may reach physical boundaries. The equation of the virtual actuator becomes x˙ = 1uC1 uf 2 = 2x + 1uC2 yC1 = yf 1 + x yC2 = yf 2 . Since the system is small, an intuitive interpretation is possible. The basic structure (neglecting the controller for x2 ) is shown in Fig. 10.11. Instead of using uf 1 , which is unavailable, the virtual actuator uses uf 2 . To achieve 2

Note that the faulty plant itself is stable. The system only becomes unstable after the decoupling is performed.


137

Faulty plant Tank 1

uf 1 -

1 s+0.25

Tank 2

xf 1 0.25

1 s+0.25

xf 2

zf

0.5

uf 2

yf 1

yf 2

yC1

yC2

Virtual actuator 2 s

1 s

uC1 Nominal controller

-

w2

* 10 -

w1

*3

Figure 10.11. Structure of the reconfigured 2-Tank System

the same input/output behaviour, the virtual actuator models exactly the difference in behaviour between the two signal paths. It introduces a pole at 0 to cancel the input-decoupling zero of uf 2 , and it increases the amplification. As a result, the input/output behaviour from uC1 to zf in the reconfigured plant is the same as the behaviour from u1 to z in the nominal plant. In contrast to zf = yf 2 , the output yf 1 is not restored to its nominal value, therefore a correction is added. This virtual actuator leads to the simulation results shown in Fig. 10.12. It is fascinating to see how the level xf 2 of the right tank follows the trajectory of the nominal system without any difference. However, for the increased setpoint and due to the disturbance, more and more water is used from tank xf 1 , while the pump power cannot be increased. Therefore, the level of xf 1 is falling at a significant rate. Within the linear simulation, this does not have any negative consequences, but in the real system the tank would be empty after a short time. A completely successful reconfiguration according to the strong goal will be shown in Sect. 17.3.


Right tank

Left tank

Plant input

Controller output

138

1

uC2

0

uC1

^ disturbance

−1 1

uf 2

0

uf 1

−1

0.2 0 −0.2 −0.4

yC1 VA output (dashed) xf 1 Actual level

0.1

w2 Reference

0 −0.1

xf 2 Actual level 0

5

=

yC2 VA output (dashed) 10 Time t/s

15

20

Figure 10.12. Simulation results of the reconfigured 2-Tank System after Actuator Fault 1

10.8 Dual Approach for Sensor Faults A similar approach can be used for reconfiguration after sensor faults. This leads to a very similar theoretical problem: disturbance localisation. The problem concerns a plant with an unknown disturbance d and two outputs y and z: x˙ = Ax + Bd d + u y = Cx z = Cz x . The goal is to find some output feedback u = −Ly, such that the disturbance d has no influence on z. This is the dual problem to the disturbance decoupling problem. To solve this problem, the approach of the observer design from Chap. 7 has to be extended. The system under consideration is the observation error system (7.5), with the extension developed in (9.17). Therefore, the problem has the following form: e˙ = Ae + Bd d + Ly∆ z∆ = Cz e u = Cz + SCf e ,

10.9 Conclusion

139

and the goal is to decouple z∆ from d by a suitable choice of L and S. It is further required that all poles σ(A − LC) be within the design set Cg . If this disturbance localisation problem is solved, the resulting virtual sensor can be used to reconfigure the control loop. It will satisfy the strong reconfiguration goal even in the presence of disturbances.

10.9 Conclusion This chapter treated the strong reconfiguration goal. A solution can be found via a disturbance decoupling problem. This belongs to a more difficult class of problems than the linear controller design problem, because it requires a condition on the output value in addition to the placement of the system poles. From a theoretical point of view, the presented approach is very powerful, since it is more general than all previous ones. The resulting virtual actuator shows the exceptional property that it restores the output of the system exactly to the same trajectory as before the fault. This makes the algorithm very Table 10.2. Comparison of the reconfiguration approaches after actuator faults

Approach

Sec.

yC = y lim xf zf → z zf = z xf = x

Static block Pseudo-inverse Stabilising VA Zero placement Integrating VA Decoupling VA

6.3 6.7 8.3 9.3 9.4 10.3

X ≈ X X X X

X ≈ X X X X

X ≈ X X X

X ≈ X

X O(n3 ) ≈ O(n3 ) - O(n[3,4] ) - O(n[3,4] ) - O(n[3,4] ) - O(n4 )

X X X X X -

X X X X X X

Parameters

Complete Autonomous

Complexity

Design

Fault Stabilisation Weak Strong Direct

Goals

opt. opt. LQ LQ LQ LQ

X means that the goal is satisfied for all excitations ≈ means that the goal is only reached approximately - means that the goal is generally not satisfied VA stands for virtual actuator opt. means optional LQ means linear quadratic weights for input and state (or an alternative controller design specifications)

140


valuable for the design phase of a fault tolerant system or for systems with very strong control objectives. However, the design algorithm includes several complicated steps, which could make it difficult to implement in an embedded reconfiguration system. Although the time complexity is still in the order of O(n4 ), the construction of the invariant subspace and the state transformation are challenging tasks for an embedded reconfiguration system. Therefore, the practical relevance for autonomous control reconfiguration remains to be seen. With the treatment of the most general reconfiguration problem, this chapter concludes the analysis of the different reconfiguration goals. For every goal, a suitable approach has been found. The overview of the different approaches and their properties is shown in Table 10.2. The static reconfiguration block seems promising, but for most problems no solution exists. The pseudo-inverse method cannot guarantee any single goal, since it aims only at an approximation of the system behaviour. The virtual actuator as proposed in Chap. 8 stabilises the system despite the fault. The extensions of the virtual actuator also provide stability, and they satisfy additional goals: the two approaches from Chap. 9 can solve the weak reconfiguration goal, while a virtual actuator as designed in Chap. 10 can also solve the strong reconfiguration problem. All successfull algorithms require the specification of a controller design problem, unless the reconfiguration problem is trivial. Due to the underlying controller design problem, all approaches have a similar time complexity between of O(n3 ) or O(n4 ). This means that they are suitable for autonomous control reconfiguration of problems up to a medium size of about 50 or 100 states.

Part III

Structural Tests for Control Reconfiguration

Structural analysis is concerned with system properties that depend only on the structure of a system, and not on the parameter values. A single system structure represents a class of linear systems, consisting of all systems which share this same structure, but differ in their parameters. The structural analysis reveals the properties common to (almost) all of these systems. The limitation to analyse only the structure of the system may seem to incur a serious loss of information, since all quantitative knowledge is disregarded. However, it has been shown that many interesting properties (like controllability, observability or disturbance decoupling) can be studied without regarding the parameters. This is especially true for studying the reconfigurability, since the fault changes (only) the system structure, and therefore the effects are visible on a structural level. The structural analysis can also help to find the relevant part of the system and to select a suitable structure for the solution. Chapter 11 introduces several ways to model system structures. The models are used in Chap. 12 to define structural properties. Chapter 13 and Chap. 14 present tests and algorithms related to the disturbance decoupling problem. A complete approach to the problem of reconfiguration is given and demonstrated in Chap. 15.

11 Structural Models

11.1 Introduction to Structural Models The goal of structural modelling is to define all signal paths in a system.1 So for every possible signal path, the structural model has to determine whether a signal path is present or not. The structural model is, therefore, a collection of binary values. The parameters of the system (the amplification of the signal paths) are not stored in the structural model. There are two main types of structural models developed by different communities: the structural matrix approach and the graph approach. The structural matrix approach uses a model similar to a state-space model, but instead of real matrices it uses binary or structural matrices. Every entry in a structural matrix denotes whether the corresponding entry in the linear model is zero or nonzero. Typical matrix operations like addition, multiplication and rank determination can be applied to structural matrices. Originally, this approach goes back to the problem of sparse matrix operations (see Duff [1977] for an historic overview). For example, sparse matrix multiplication requires that the structure of the result is determined first to allocate space for the result, and the necessary scalar operations are then performed according to the found structure. The other important approach is the use of a structural graph to describe the structure of a system. The nodes of the graph represent variables, while the arcs define the signal paths. Apart from being a very intuitive and visual way to model the structure, methods from graph theory can be used to analyse the model. However, applying the more powerful definitions usually requires a graph search, which can be very inefficient in large systems. Therefore the 1

The relevance of structural modelling for reconfiguration has been shown several publications, see Looze et al. [1985], Izadi-Zamanabadi et al. [1998], Lorentzen et al. [2003].


144


graph approach can be useful to study the theoretical potential of structural analysis, but it may not always lead to efficient algorithms. In both forms, structural analysis is useful for fault-tolerant control. A fault usually changes only a few parameters in a system, and the influence of this local change on the global system can best be studied on a structural level. For this reason, several approaches exist for the fault-detection based on structural methods (see Izadi-Zamanabadi et al. [1998], Lorentzen et al. [2003], IzadiZamanabadi and Staroswiecki [2000]). Remark. A structural model is not invariant to linear transformations. The sparse structure of many models is only preserved if the system state is defined by actual physical values (the so-called “natural coordinates”). It is always possible to make any nontrivial system dense (so that all elements in all system matrices are nonzero) by a suitably designed transformation. This may seem like a serious drawback of the structural approach as compared to linear control theory. However, even in the linear theory it is possible to construct a transformation that makes the numerical errors of a linear analysis grow beyond any bound. Therefore, it is always necessary to choose a reasonable coordinate system. The two common choices are the natural coordinates of the system (optionally normalised to attain better conditioned matrices) or to use coordinates aligned to the modes of the system (as done in the geometric approach or for the normal forms).

11.2 Structural Matrices This section introduces the concept of structural (or binary) matrices. It will be shown how the structural model is derived from the linear model, and how operators can be applied to structural matrices. Assume a linear system given by the state-space model x˙ = Ax + Bu y = Cx . The direct way to turn it into a structural model is to use structural matrices. A structural matrix has entries of 0 and ∗ only. Every star∗ stands for an independent (possibly) nonzero parameter, while a zero 0 represents a zero value. So a real valued matrix can be turned into a structural matrix by replacing every nonzero element by ∗. Structural matrices will be denoted by the same symbol as the corresponding linear system matrix, but indexed with an ·S for distinction.

11.2 Structural Matrices

145

Definition 11.1 Structural matrix A structural matrix is a matrix that has only entries of 0 and ∗.2 Example. For the 2-Tank-Example from Chap. 3, this results in the following matrices: ∗0 AS = (11.2a) ∗∗ ∗∗ (11.2b) BS = 0∗ ∗0 (11.2c) CS = 0∗

CzS = 0 ∗ . (11.2d) In order to use structural matrices, it is necessary to define operators that apply to these matrices. The idea behind these definitions is to resemble the results of the linear operations as closely as possible. The structural addition ⊕ is defined as follows: 0⊕0 = 0 ∗ ⊕0 = ∗ 0⊕∗ = ∗ ∗ ⊕∗ = ∗ . The first three lines are obvious, if ∗ is interpreted as a nonzero number: adding a nonzero and a zero number always results in a nonzero number. However, the last line is the result of a decision in order to resolve the ambiguity, because the sum of two numbers can be zero or nonzero, depending on the exact numbers. As a rule, the structural analysis always considers the general case. The general result is a nonzero sum, while the cancellation of both numbers is a special case (which only happens if they have equal magnitude and different sign). The structural multiplication ⊗ works like the normal product: 0⊗0 = 0 ∗ ⊗0 = 0 0⊗∗ = 0 ∗ ⊗∗ = ∗ . 2

Different notations are used in the literature for structural matrices. Some authors denote a zero element by a dot · or a blank entry, and a nonzero element by a one 1 or a bold symbol like x.

146


There is no ambiguity involved here. The structural matrix product is constructed as usual from the multiplication and the addition. The rank of a structural matrix is also defined in a special way. Definition 11.2 Structural rank (s-Rank) The structural rank (s-Rank) or term rank of a structural matrix is the maximum rank a linear matrix of this structure can have. It is therefore s-Rank(MS ) = max rank M M

where M is a matrix of the structure MS . The structural rank can be determined by finding the maximum size set of nonzero entries, that do not share a row or column of the matrix.3 In line with an equivalent problem in bi-partite graph theory, this set is called a matching. An efficient algorithm for finding a maximal matching with time complexity O(n2.5 ) is given by Hopcroft and Karp [1973]. For the system matrix AS of the 2-Tank System, the matching consists of the diagonal elements (marked with parentheses): (∗) 0 AS = . ∗ (∗) Therefore, the matrix AS has full structural rank. This means that the structural rank is equal to the highest rank possible (as determined by the minimum of the number of rows and the numbers of columns). Most matrices of a given structure will have a rank equal to the structural rank, but there may be special cases where the linear matrix has a rank deficiency that does not show in its structure. For example the matrix 11 (∗) ∗ M= , MS = 22 ∗ (∗) has a rank of only 1. The structural rank of the corresponding structural matrix is 2, because most 2 × 2-matrices with nonzero elements have a rank of 2. It is also possible to define a lower bound on the rank of a matrix based on its structure. This is called the minimal structural rank. Definition 11.3 Minimal structural rank The minimal structural rank of a structural matrix is the minimum rank a linear matrix of this structure can have: 3

Note that the structural rank of a matrix with independent randomly chosen elements (according to any continuous distribution) is equal to the linear rank with a probability of 1. This is in line with the definition of structural properties in Chap. 12.

11.2 Structural Matrices

147

smin-rank MS = min rank M M

where M is a matrix of the structure MS . Theorem 11.4 Minimal structural rank The minimal structural rank of a structural matrix is the maximum value of n, for which the matrix can be rearranged by swapping rows or columns into the form   ? ··· ··· ?  .. . . ..  . . .    ?    ∗ ?    . ..    0 ∗ ...    . . . . .. ?   .. . . . . ? 0 ··· 0 ∗ ? ··· ? with n elements of ∗. The symbol ? can represent either 0 or ∗.

Proof. The minimal structural rank is well defined, because every (nonzero) matrix matches the form for n = 1. The rearranging does not change the rank of the matrix (neither in the structural nor in the linear sense). Therefore it remains to be shown that a matrix of the given form always has a rank of at least n. Since the n elements ∗ are nonzero, they can be used as pivot elements. Therefore, the rank of every linear matrix of this form is at least n. The concept of a minimal rank is mentioned by Wend [1993] in Satz 5.9 on Page 55, but no proof is given there. An algorithm is given to determine whether a matrix has full minimal structural rank (which is a special case of this definition). Remark. The traditional way to determine the s-rank is to find a maximum set of independent entries (a set of nonzero matrix elements where no two elements are in the same column or row). The classical algorithm to find the maximum set is the Dulmage-Mendelson decomposition (dm-decomposition) described in Dulmage and Mendelsohn [1958]. Most mathematical software packages rely on a variation of this algorithm. It has a complexity of the order O(n3x ). Slight improvements in efficiency can be made by using more modern algorithms. However, it is difficult to compare the efficiency of specialised algorithms, because the computation time varies widely depending on the sparsity of nonzero elements and the assumed structure of the matrix. Generally, the computational effort is

148


slightly less than that of calculating the numerical rank. It may be significantly less for systems with a special structure, when appropriate algorithms are used. Unfortunately, the minimal structural rank has received much less treatment in the literature. Therefore, no overview of efficient algorithms can be given here.

11.3 Structural Digraphs While structural matrices are easy to manipulate mathematically, they do not provide a way to visualise the structure of the corresponding system. For this purpose, a digraph is more useful, because it shows a graphical representation of the signal paths of a system. This idea has been proposed by Reinschke [1988], and it has been integrated into textbooks by Lunze [2002b] and by Jantzen [1996]. Definition 11.5 Directed graph (digraph) A directed graph G(N, A) is defined by a set of nodes N and a set of arcs A ⊆ N × N . Every arc is an ordered pair of nodes (n1 , n2 ). An arc (n1 , n2 ) is said to go from n1 to n2 (see Fig. 11.1 and Fig. 11.2).

x

Figure 11.1. Node

arc

Figure 11.2. Arc

When a digraph is used to model a system structure, every node of the graph represents a variable in the system. Since the system has input, state and output variables, three sets of nodes are distinguished: input nodes ui ∈ U output nodes yi ∈ Y state nodes xi ∈ X . The arcs of the graph connect two nodes, and they represent an influence between the two corresponding variables. Definition 11.6 Arc An arc (n1 , n2 ) represents an influence from one variable n1 to another variable n2 . Therefore, an arc corresponds to a nonzero entry in the matrices of

11.3 Structural Digraphs

149

the state-space model. By definition, there are no arcs starting from an output node or going to an input node. The digraph of a simple first order system is shown in Fig. 11.3. It has one input node, one state node and one output node.

u

y

x

Figure 11.3. Structural digraph of a first order system

If more nodes are used, the basic structure remains the same. Each input node can have an arc to every state node and each state node to every state node or output node. Every state node in the structural graph represents a single integrator. The structural digraph of the 2-Tank-Example is shown as an example in Fig. 11.4. One way to find the interesting features of this graph is to look for the arcs which are not present. The input u1 has no effect on the state x2 , and x2 has no influence on x1 . Also, each state is only connected to one corresponding output.

u1 u2

y1

x1 x2

y2

Figure 11.4. Structural digraph of the 2-Tank Example

Wend [1993] has generalised this concept by attributing every node with the number of integrators it represents. This allows one node to stand for several (chained) integrators or even a differentiator. This generalisation will not be used here, but the concept of coupling nodes (nodes without integrators) will be helpful. A coupling node is like a state node, in that it represents a variable that depends on other variables. However, a coupling node represents a variable that can be calculated statically from the other variables, without involving any dynamical behaviour such as integration. This may be useful if the same term is used several times in different places in the system model. Example. An example of the 2-Tank System is shown in Fig. 11.5, where the flow q through the connection valve is introduced as a coupling node. A coupling node can be eliminated just like a variable can be eliminated by insertion: all nodes that have an arc to the coupling node have to be connected to all nodes that have an arc from the coupling node. Eliminating the coupling node q in the 2-Tank System leads to the structure graph from Fig. 11.4.

150

11 Structural Models u2 y2

x2

q x1

u1

y1

Figure 11.5. Structural digraph of the 2-Tank Example with the coupling node q

11.4 Paths in a Structural Graph The analysis of graphs is based on the notion of a path. A path is a sequence of arcs, where the first arc leads to a node which is the starting node for the next arc etc. A path in the structural graph is equivalent to the signal path in the original linear system. Definition 11.7 Path A path is a sequence of arcs where the second node of every arc is equal to first node of the following arc. A path is said to start in the first node of the first arc and to end in the second node of the last arc. The number of arcs in a path is called the length l of the path. In Fig. 11.6, a path of the length 3 (u1 → x1 → x2 → z1 ) is highlighted. Note that a path can visit a node several times, in which case it is also counted several times. Therefore, there is no upper limit for the length of a path. However, from a control point of view only, the length of a path is not of interest. The relevant aspect is the number of integrators in a signal path, since it determines the degree of the transfer function. This number will be called path width, and it can be determined using the following definition. u2 u1

x2

z1

x3

z2

x1

Figure 11.6. Path in a structural graph

Definition 11.8 Path width The width w of a path is equal to the number of arcs (n1 , n2 ) in the path, that lead to a state node n2 ∈ X. Therefore the width is similar to the length of a path, but only state nodes (excluding the starting node) can contribute to the width.4 The width can 4

In this manuscript, the state nodes are denoted by xi .

11.4 Paths in a Structural Graph

151

never be higher than the length of a path. The definition of path width is required in order to correctly analyse graphs with coupling nodes. If a path exists between two nodes, these nodes are called “connected”. The existence of a path is especially interesting for the connections from the input to a state. Definition 11.9 A node n is called input connected, if and only if there is a path from an input node u ∈ U to the node n. A similar definition is made for connections to the output. Definition 11.10 A node n is called output connected, if and only if there is a path from the node n to an output node y ∈ Y . In a graph there can be several different paths between two nodes. This means that there are several signal paths between the nodes. In order to analyse this situation, the definition of a path bundle is introduced for a set of paths. Definition 11.11 Path bundle The set of all paths of a given width, starting in the same node and ending in the same node, is called a path bundle. The path bundle is determined by the graph, the starting node, the end node and the width. Note that only paths of equal width are in a path bundle. This is important, because the width represents the degree of the transfer function corresponding to the path, and only transfer functions of the same degree can be treated together. In order to study all signal paths connecting two nodes it is therefore necessary to find the path bundles for all widths. In Fig. 11.7, a path bundle is shown: there are 2 paths of width 2 which connect u1 and z1 . Therefore, the size of the path bundle is 2. There is also a path of width 1, but it does not belong to the same path bundle.

u1

x1

x2

x3

x4

z1

x5

Figure 11.7. Paths bundle in a structural graph

For some problems it is important to know whether separate signal paths exist between a set of inputs and a set of outputs. This is necessary in order to control values separately (e.g. in non-interaction control). The definition of parallel-path sets is useful for this problem (see Fig. 11.8).

152

11 Structural Models u1 u2

x1

x2 x3

u3

z1 z2 z3

Figure 11.8. Parallel-paths set in a structural graph

Definition 11.12 Parallel-path set A parallel-path set is a set of paths where no node is used in more than one path. The size of a parallel-path set is the number of paths it contains. The width of a parallel-path set is the sum of the width of all paths. This definition is found in Commault et al. [1993]. It is used there to study the structural rank of a system, as will be demonstrated in Sect. 13.4.

11.5 Digraphs and Matrix Models Digraphs or structural matrices can be used to model the structure of a linear system. Both models are equivalent, which means that one can be converted into the other. This section will describe the relation between the two models. The correspondence between a digraph and the structural matrices is based on the idea of an adjacency matrix. The main information of the digraph is contained in the set of arcs A. Because the set of possible arcs is N × N , this set can also be represented as an adjacency matrix. Every arc is represented by an entry ∗ in this structural matrix. The columns of the matrix correspond to the nodes the arcs are from, and the rows correspond to the nodes the arcs go to. Definition 11.13 Adjacency matrix Assume an order on the set of nodes, such that a distinct cardinal number c(n) between 1 and the number of nodes |N | is assigned to every node. Then the set of arcs can be represented by an adjacency matrix A which has entries of ac(n2 ),c(n1 ) = ∗ for every arc (n1 , n2 ) ∈ A in the graph and zero entries otherwise. The adjacency matrix of a structural graph contains the structural matrices representing the same system structure. If the nodes are given in the order u, x, y, the graph from Fig. 11.3 has the incidence matrix

11.5 Digraphs and Matrix Models

153

u x y  u 00 0 A= . x ∗ ∗ 0 y 0∗ 0 Note that the symbols along the matrix are included for illustrative purposes only. Technically, they are not part of the equation. A general dynamical system in state-space form (11.1) has nu input nodes, nx state nodes and ny output nodes. Assuming these nodes have the mentioned order, the adjacency matrix is  u u Onu A= x  BS O y

x O AS CS

y  O . O  Ony

(11.3)

The structural matrix AS defines the arcs from a state node to a state node, while the input matrix BS defines the arcs from an input node to a state node and the output matrix CS denotes the arcs from a state node to an output node. In order to determine the existence of paths, it is necessary to construct the reachability matrix. It is usually written as M∗S , which is defined as: M∗S = I ⊕ MS ⊕ (MS ⊗ MS ) ⊕ . . . . Definition 11.14 Reachability matrix Assume the same order c of the nodes as above. The reachability matrix R is the potency matrix of the adjacency matrix: R = A∗ . A nonzero entry of rc(n1 ),c(n2 ) means that there is a path from n1 to n2 . In order to calculate the reachability matrix, the structure of the adjacency matrix can be used:  O O IS A∗S O . R =  A∗S ⊗ BS CS ⊗ A∗S ⊗ BS CS ⊗ A∗S IS 

Example. For the 2-Tank-Example from Chap. 3, the structural graph is shown in Fig. 11.4, and the structural matrices are given in (11.2). Every nonzero entry ∗ in the matrices corresponds to one arc in the graph. The reachability matrix of this system is

154


u1 u2 R = x1 x2 y1 y2

u1 u2 x1 x2 y1 y2  ∗ 0 O  0 ∗    . ∗ ∗ ∗ 0    ∗ ∗ ∗ ∗   ∗ ∗ ∗ 0 ∗ 0  ∗ ∗ ∗ ∗ 0 ∗

This system is not particularly sparse. The two rows on the top and the two columns on the right follow directly from the definition of a structural graph, they are therefore not relevant. From the remaining entries, only two are zero: x2 → x1 and x2 → y1 . It is interesting to see that there are no nonzero entries above the diagonal, which implies that the graph has no cycles that involve more than one node.

11.6 Weighted Digraphs A structural matrix model can be turned into a linear model by replacing the ∗ entries by the actual parameters. In the same way, a structural graph can be extended to a representation of a linear system by denoting every arc with the corresponding parameter value. The resulting weighted digraph is equivalent to a (parameterised) state-space model. Definition 11.15 Weighted digraph A digraph becomes a weighted digraph when every arc is attributed with a nonzero real number w (its weight). The weighted directed graph G(N, M ) is defined by the set of nodes N and a mapping M : N × N → R=0 . Every element of the mapping defines a weighted arc (n1 , n2 , w). The weights in the graph correspond to the nonzero elements in the matrices of the linear state-space model. A weight w of the arc (xj , xi , w) is equal to the entry ai,j = w . in the matrix A. If an arc from xj to xi does not exist, the entry is zero ai,j = 0. The coefficients of the matrices B and C are represented correspondingly by the arcs from input nodes and to output nodes. Since the weighted digraph is equivalent to the parameterised model of the system, it can be used for linear analysis and controller synthesis. Several approaches are studied in detail by Reinschke [1988] and by Wend [1993].

11.6 Weighted Digraphs

155

The use of the weighted digraph model for disturbance decoupling will be presented in Chap. 14. All definitions concerning the digraph can be applied correspondingly to the weighted digraph, if the weights are disregarded. The following definition depends on the weights and are, therefore, uniquely applicable to weighted graphs. Definition 11.16 Path amplification The amplification of a path is the product of the weights of the arcs in this path. Based on this definition, the amplification of a path bundle can be defined as the sum of the individual amplifications. (cf. Definition 11.11). Definition 11.17 Path bundle amplification The amplification of a path bundle is the sum of the amplification of all paths in the bundle. By use of this definition, single elements of nth power of the system matrix can be computed. Theorem 11.18 The amplification of the path bundle of length n from xk to xj is equal to (An )j,k .

Proof. This can be demonstrated by complete induction. For n = 1, the correspondence is trivial. For a width of n = 2, the amplification of the path bundle is calculated by enumerating all path (which only differ by their middle node) and summing up their weight. This is equivalent to the definition of the matrix multiplication 2

aj,i ai,k . A j,k = i

For every n + 1, the following decomposition can be used: n+1

= (An )j,i ai,k . A j,k i

Example. The weighted graph of the 2-Tank Example is shown in Fig. 11.9. The graph can be used to calculate elements of 0.0625 0 . A2 = −0.125 0.0625

156

11 Structural Models -0.25

u1

1

y1

1

x1

-0.5

0.25

u2

-0.25

0.5

x2

1

y2

Figure 11.9. Weighted structural digraph of the 2-Tank Example

For example the lower left element corresponds to the amplification of the path bundle of width 2 from x1 to x2 . There are two paths in that bundle: x1 → x1 → x2 and x1 → x2 → x2 . They both have the amplification −0.25 × 0.25 = −0.0625, leading to the sum −0.125.

11.7 Bi-partite Graphs The remainder of this chapter mentions possible extensions for structural models, but it is not essential for the following chapters. Bi-partite graphs will not be used within this manuscript. However, since some of the relevant literature (see Blanke et al. [2003], Gehin et al. [2000]) is based on bi-partite graphs, it is useful to define how a digraph can be converted into an equivalent bi-partite graph and vice versa. A bi-partite graph G(C, V, E) has of two kinds of nodes, and undirected edges between the two kinds. While a node in the digraph represents both a variable and its equation, the two kinds of nodes in the bi-partite graph represent variables V and equations C separately. This has the advantage that free variables or more equations can be introduced separately (as in descriptor systems), and the effect on the solvability of the system can be studied. If applied to systems in state-space form, the bi-partite graph has nx nodes for the differential equations and ny for the output equations. The second set of nodes V represents the input and state variables (output variables are not included, since they are considered given or measured). An edge between a variable node v and a equation node c is represented by the pair (c, v) ∈ C × V . If the edge is part of the edge set E, the variable v is used in equation c. An d edge is marked (dotted) if the differential dt v of the variable is used. The adjacency matrix A of the bi-partite graph represents the set of edges. Theoretically, the incidence matrix has the size (|C +N |)×(|C +N |). However, since no edges are allowed between nodes of the same kind, and edges do not have a direction, it is sufficient to consider only the upper right quarter of

11.7 Bi-partite Graphs

157

this matrix. The columns of this submatrix correspond to the variables of the system, and the rows correspond to the constraints. This (reduced) incidence matrix of a standard state-space system has the form u x A = cx AS ⊕ IS BS cy CS O The concept of the structural rank of a matrix is identical to the idea of a maximal matching in the bi-partite graph. A matching is a subset of the edge set E such that every node appears at most once. Example. The bi-partite graph of the 2-Tank Example is shown in Fig. 11.10. It includes the output variables for illustration purposes, although they are not part of the bi-partite graph according to the definition above. The dotted lines represent the implicit links between a variable and its corresponding equation. An extension of the bi-partite graphs has been developed by Staroswiecki in the Chapter “Structural analysis” of Blanke et al. [2003], which represents the state variables and the state variable derivatives as separate variables. As a d xi have to be added to the graph. The resulting result the equations x˙ i = dt graph for the 2-Tank Example is shown in Fig. 11.11. u1

y1

x1

u2

x2

y2

Figure 11.10. Bi-partite structural graph of the 2-Tank Example

u1 u2

x˙ 1

y1

x1 x˙ 2 x2

y2

Figure 11.11. Bi-partite structural graph of the 2-Tank Example with explicit derivatives

Another common structural representation is the signal flow graph. It uses separate nodes to denote the state variables and their derivatives. From the structure of the graph, the derivative nodes are identical to the constraint nodes of the original bi-partite graph. The signal flow graph for the 2-Tank Example is shown in Fig. 11.12. Note that apart from the shape of the nodes and the output nodes this graph is identical to the bi-partite graph, but it is a directed graph. The signal flow graph also contains the parameters of the system as weights to the arcs.

158

11 Structural Models -0.25 0.5

u2

x˙ 2

x2

1

y2

0.25

-0.5

1

u1

x1

x˙ 1

1

-0.25

y1

Figure 11.12. Signal flow graph of the 2-Tank Example

11.8 Structure of Non-Linear Systems Although this manuscript deals primarily with linear systems, a short excursion into non-linear systems will be presented here. The idea of a structural model can be applied to a non-linear system as introduced in (4.1): x˙ = f (x, u) y = g(x) . An arc in the structural graph is present if the originating variable is present in the equation for the destination variable. The structural model also represents all linearisations of the non-linear system. A 0 (or missing arc) in the structural model means that the two variables in the non-linear system have no direct connection, and therefore the linear coefficient between them has to be zero, too. On the other hand, a ∗ does only imply that a connection in the linearised model is possible; it does not guarantee that it exists for every linearisation point. So the structural model of the non-linear system can be used to derive properties that hold for all linearisations. Special care has to be taken when applying the definitions and theorems. It should also be noted that a property that holds locally for all linearisations may not apply globally to the non-linear system. Example. Consider the 2-Tank System from (3.1): x˙ 1 = u1 qmax − u2 q21 (x1 ) x˙ 2 = u2 q21 (x1 ) − qout (x2 ) q12 = ku2 x1 − h z = x2 .

(11.4) (11.5) (11.6) (11.7)

It leads to the structural graph shown in Fig. 11.4. For the chosen linearisation point (3.2), the non-linear and the linear system have the same structure. However, the system can also be linearised around u2 = 0, in which case x1 has no influence on q21 and therefore on x˙ 1 and x˙ 2 . The resulting structural graph (Fig. 11.13) is a subset of the full graph from Fig. 11.4.

11.9 Diagnosis Based on Structural Graphs u1

u2

x1

y1

x2

y2

159

Figure 11.13. Structural digraph of the 2-Tank Example with alternative linearisation

u2

u1

q

x2

y2

x1

y1

Figure 11.14. Structural digraph of the 2-Tank Example after residual determination

Note that this linearised system has properties that cannot be derived from the structural model of the non-linear system. E.g. it is not controllable using u1 alone.

11.9 Diagnosis Based on Structural Graphs This section demonstrates how structural graphs can help to find redundancy relations for use in diagnosis. A more complete description based on bi-partite graphs is found in Blanke et al. [2003], Gehin et al. [2000]. The structural graph has to be prepared by adding an extra node for each known (measurable) variable, and adding an arc from the known variable to the extra node. The extra node is marked to signify that it represents a measurement. In order to find out the value of further variables (represented by a mark in the graph), there are two ways to use the system equations. 1. If all predecessors of x (all variables that have an arc towards x) are known, x can be calculated using it model equation. In this case, the node x can be marked directly. In a dynamical model, this step may require integration, which depends on the initial value. 2. It is also possible to invert to the equation of a known variable x for an unknown variable y. This assumes that x is marked, and u is the only unmarked predecessor of x. In order to denote the inversion, the arc u → x is marked, as is u. In a dynamical model, this step may require differentiation, thus amplifying measurement noise.

160


In order to find a reduncy relation, a third constellation is necessary: for a known variable x, there has to be one marked arc leading away from it (to y), but none towards it. This means that the value of x can be calculated in two ways: using its model equation, and using the model equation of y. The difference is a residual that can be used for diagnosis. Example. The approach is applied to the structure of the 2-Tank system from Fig. 11.5. The variables y1 , y2 and u1 are assumed to be known, while u2 is not. The objective is to find residuals that do not require integration, so step 2 is used wherever possible. The nodes are marked in the following order: u1 , u2 , y1 , y2 and then q using the arc q → y2 . The marked arcs are shown as bold in Fig. 11.14. One residual is found in x˙ 1 , which can be calculated from the output equation for y1 or by using the differential equation for x˙ 1 . The second residual is q, which can be calculated from its algebraic equation or from the differential equation for x˙ 2 : qmax u1 − q12 = x˙ 1 = y˙ 1 √ ku2 x1 − h = q12 = x˙ 2 + k x2 . In order to complete the residuals, x2 has to be replaced by y2 (using the output equation).

12 Basic Structural Properties

12.1 Defining Structural Properties It is possible to attribute properties to a system structure. These properties are called structural properties, and they hold for almost all systems of the studied structure. There are also strong structural properties which hold for every system of the given structure (without exception). A structural property does not depend on the parameters of a system, but on its structure only. For example, it is possible to tell from the structure of the system whether a system is structurally observable (s-observable). If a structure is structurally observable, almost every system of this structure is observable. However, exceptional parameter combinations may exist, where different influences cancel out each other, leaving a part of the system unobservable. This cancellation cannot be deduced from the system structure. Parameter constellations leading to a cancellation are rare compared to all possible constellations. The share of constellations where the structural condition does not apply to the parameterised system is exactly zero.1 In other words: unless the parameters are chosen specifically in a way that violates the structural property, it is highly unlikely (with a probability of zero) that the structural property does not apply to the linear system. Since structural analysis is concerned with the general result, the special case of cancellation is neglected. Definition 12.1 Structural property A structural model is said to possess a structural property, if and only if almost every set of parameters leads to a parameterised system that satisfies this property. 1

Since infinite sets are considered, this statement is different from the statement that they do not exist.


162


For some problems it is not satisfactory to rely on a property being “almost certain”.2 Therefore, a second kind of structural properties is defined that applies without exception. These are called “strong structural properties”. If a system structure shows strong structural observability, it is obvious from the system structure that no cancellation is possible. Therefore, every parameter set will result in an observable linear system. Definition 12.2 Strong structural property A structural model is said to possess a strong structural property, if and only if every set of parameters leads to a linear system that shows this property. The idea of strong structural properties is studied both by Reinschke [1988] and by Wend [1993]. Remark. Note that infinite sets of different magnitudes are involved in the definition of a structural property. Therefore, the proper mathematical treatment can be complex. A theoretical foundation is given in the introduction to the paper by van der Woude [1991]. Consider a standard state-space system denoted as x˙ = Ax + Bu

(12.1)

y = Cx

(12.2)

that has a structure as given by the corresponding structural matrices AS , BS and CS . There is an infinite number of linear systems that have the same structure. To λ define the set of all these systems, a parameter vector Λ = {λ1 , λ2 , . . . , λnλ },Λ ∈ Rn =0 is introduced, where nλ is the number of nonzero matrix elements in the linear system. Every nonzero element is then replaced by a different parameter variable λi . This makes the system matrices dependent on Λ. The class of all systems of the n given structure is then defined by S(Λ) = (A(Λ), B(Λ), C(Λ)) for all Λ ∈ R=λ0 . A property is said to hold structurally for a class of structurally equal systems, if λ it applies to almost all systems. This means that the set of parameters L ⊂ Rn =0 for which the property does not hold, has a measure of zero |L|nλ = 0. Assuming n a uniform distribution of the parameters over a subset of R=λ0 of nonzero measure, this leads to a zero probability for a parameter set that does not fulfil the studied property. Further, for every parameter Λ such that S(Λ) does not have the property, there exists an infinitesimally close parameter vector Λ such that S(Λ ) satisfies the property.

12.2 s-Controllability and s-Observability This section develops the notion of structural controllability and observability The controllability of a linear state-space system depends on the pair 2

Sometimes a variant of this definition is used, which requires at least one single system of the structure to satisfy the property. Both variants are identical for many properties. The proofs are an important part of the theoretical foundation of structural analysis.

12.2 s-Controllability and s-Observability

163

(A, B). In the linear theory, the controllability is checked using the controllability matrix or the controllability Gramian. The corresponding property for a structural model is s-controllability, and it can be tested using either the structural graph or the pair (AS , BS ). There is no direct structural equivalent to the rank of the controllability matrix. Instead, the structural controllability depends on two conditions. The first condition for s-controllability is that every state variable is input connected (there is a path from an input node to the state node). This can also be checked using the reachability matrix. The submatrix representing the connections from input variables to state variables A∗S BS has to have at least one nonzero element in every row. It is obvious that a state variable cannot be controllable if there is no signal path from an input variable to this state variable. So this first condition is able to detect uncontrollable subspaces that are parallel to an axis. Note that very efficient implementations exist for checking this condition. If sparse matrices are used, the computation time is in the order of O(n), where n is the number of nonzero entries (with nx ≤ n ≤ nx (nx + nu )).

AS BS has full structural rank. This The second condition is that the pair

is required for the matrix A B to have full rank, which is again required for the linear controllability matrix to have full rank. This second condition is able to detect input-decoupling zeros at s = 0 that would render the system uncontrollable. Theorem 12.3 s-Controllability according to Reinschke [1988] con-

A structural model S(AS , BS , CS ) is s-controllable or structurally trollable, if and only if A∗S BS has no zero row and the matrix AS BS has full s-rank. According to the definition of a structural property in Sect. 12.1, almost every linear system of an s-controllable structure is controllable (s-controllability is necessary, but not sufficient for controllability). However, there can be special parameter combinations where the linear system is not controllable. This happens if the system has uncontrollable subspaces that are neither parallel to an axis nor have a zero pole. These subspaces cannot be detected as uncontrollable in the structural model. The structural property of s-controllability is still fulfilled, because the uncontrollable subspace result only for special parameter constellations, and in the general case, the parameterised system is controllable. A proof for this statement can be found in Wend [1993]. There is also a graph-theoretical interpretation of this theorem. A structural model is s-controllable if every node is input connected and the graph has no

164


dilation. A dilation is a situation where a set of n state nodes has arcs coming to nodes of this set from less than n nodes. The prototypical dilation is one node with arcs to two states nodes (which have no arcs from other nodes, including themselves). A dilation denotes a structure of parallel integrators, which are obviously not controllable. In order to simplify the definition, a graph which is completely input connected and has no dilation is called a cactus. A corresponding theorem can be found in Li et al. [1996]. The following theorem presents a structural test which is sufficient for the controllability of every system of the given structure. It is a reformulation of Satz 5.9 from Wend [1993], a proof can be found there. Theorem 12.4 Strong s-controllability according to Wend [1993] A structural model S(AS , BS , CS ) is strongly s-controllable or structurally controllable, if and only if 1. A∗S BS has no

zero row, 2. the matrix AS BS has full minimal structural rank (smin-rank), and

3. the matrix AS BS has full minimal structural rank (smin-rank), where AS is derived from AS by changing the elements on the diagonal from 0 to ∗ and vice versa. Example. A typical dilation is shown in Fig. 12.1. A graph with a state node that is not input connected is shown in Fig. 12.2. An s-controllable and strongly s-controllable graph is shown in Fig. 12.3. The graph in Fig. 12.4 is s-controllable, but not strongly s-controllable, because after removing the two diagonal elements (represented by the loops in the graph), it has a dilation. This result is correct, because both state variables could happen to have the same pole, in which case the linear system is not controllable. x2 x1

u

x3

Figure 12.1. Structural graph with a dilation

x2 u

x1

Figure 12.2. Structural graph with an unconnected state

12.3 Stabilisability

165

x2 u

x1 x3

x4

Figure 12.3. Strongly s-controllable structural graph

x1 u x2

Figure 12.4. S-controllable, but not strongly s-controllable structural graph

Similarly, the structural observability of a system can be tested. Theorem 12.5 s-Observability according to Reinschke [1988] if and only if CS A∗S A structural model S(AS , BS , CS ) is s-observable AS has no zero columns and the matrix has full s-rank. CS The theorems of s-controllability and s-observability can be used together to test a system for completeness. The algorithms for the test are straightforward to implement and fast to execute. Note that the reachability matrix A∗S can be determined beforehand (off-line), since it does not change after an actuator or sensor fault.

12.3 Stabilisability After an actuator fault, the plant can be successfully reconfigured to reach the stabilisation goal, if and only if the faulty plant is stabilisable. This has been detailed in Chap. 8. There is no structural test for stability, since stability inherently depends on the position of the poles and therefore on the parameter values of a system. This section shows a novel structural method which can nevertheless be used to deduce the stabilisability of the faulty plant. The basic idea is simple: since the system matrix A is not changed by an actuator fault, the faulty plant has the same poles as the nominal plant. The matrix Bf is affected, which means that some unstable modes may become uncontrollable (and therefore unstabilisable). If the location of the unstable modes in terms of state variables is known, the structural analysis can reveal whether the controllability of these states and modes is affected by the fault.

166


The set of uncontrollable nodes is returned by the test for s-controllability. This set consists of the nodes in a dilation and the nodes which are not input connected. The set of unstable nodes has to be determined using linear methods. The autonomous system x˙ = Ax is transformed into block diagonal form x˙ = A x , where A is a block diagonal matrix, as determined by a state transformation x = Tx . The blocks consist of a single value for single poles, and a 2-by-2 matrix for a complex pair of poles. The set of unstable poles is now easy to determine: they correspond to the diagonal blocks (or elements) that have eigenvalues with nonnegative real value. These unstable modes are denoted by a ∗ in a structural column vector mS of size nx . The corresponding variables in the original system can be calculated by T−1 S mS . Algorithm 12.6 Structural test for stabilisability Given: The faulty plant S(A, Bf , C). 1. (Off-line) determine the set of state variables T−1 S mS involving unstable modes. 2. (On-line) test the pair (AS , Bf S ) for controllability. Result: If all variables marked in T−1 S mS are input connected and not part of a dilation, the plant is structurally stabilisable. Example. Consider the plant 2 0 10 x˙ = x+ u. 1 −1 23 The linear analysis reveals which part of the system is unstable. No state transformation is necessary, because the system

matrix is already in triangular form. The state x1 is unstable (mS = ∗ 0 ), because it has a positive diagonal element (2 ≥ 0). If the first actuator fails, the first state becomes unconnected and therefore uncontrollable. The faulty plant 2 0 00 x˙ = x+ u 1 −1 03 is detected as not stabilisable. A fault in the second actuator does not render any part of the plant uncontrollable, therefore the stabilisability would not be affected.

12.4 Reduced Control Problem

167

As it has been shown, this algorithm can be used to test whether a plant is stabilisable after an actuator fault. The linear step may be complex, but it can be performed off-line, before the fault is known. The structural step is very fast and simple to implement. Therefore, this algorithm can be used to easily identify situations where the reconfiguration of the system is not possible. In this case, different options (like the shutdown of the unstable part of the plant) have to be considered on a supervisory level. Remark. Note that this test is only correct in a structural sense: there may be exceptions if several signal paths cancel out and render a part of the system uncontrollable. Since any proof would have to deal with different manifolds of parameter sets, no proof is given here. At the same time, it is unlikely that cancellations affect the result of reconfigurability. The nominal plant is known to be controllable: cancellation does not happen there. The faulty plant has generally fewer signal paths, but at least two signal paths are necessary to cancel out the total effect. Therefore, an undetected cancellation can only happen if there are at least three parallel signal paths in the nominal plant. One is broken by the fault, and the remaining two paths cancel out. It should be possible to detect the possibility of cancellation in the nominal plant and account for this, but this may be a complex task. The whole problem can be avoided if the test for strong structural controllability is used. It does not produce false positives, but it may return a false negative result.

12.4 Reduced Control Problem The reconfiguration algorithms given in Part II involve the solution of a control problem. Unfortunately, this problem is often ill defined, because only part of the faulty plant is controllable. Typical controller design algorithms can fail in this case for numerical reasons. Therefore, a way to reduce the control problem to the controllable part has to be found. The linear approach is simple: the controllable subspace is constructed and separated using a state transformation. The controllable subspace is defined by the controllability matrix

C = im I A · · · Anx −1 B , where im · denotes the image (the set of possible results) of a matrix. An orthogonal transformation is constructed where T1 T= T2 is a unity matrix with im TT1 = ker T2 = C. The reduced control problem is given by the pair

168


T1 ATT1 , T1 B .

The resulting controller K can then be transformed back to the original state coordinates. The controller for the original control problem is K = K T1 . The matrix K is a stabilising controller for (A, B) if the pair is stabilisable. Depending on the controller design algorithm used, a similar reduction may be necessary for the input space. This eliminates the ineffective subspace of the input (see Lunze et al. [2003] for more details). However, both the construction of the subspace and the state transformation can be numerically critical. Therefore, this approach is not well suited for online application. A structural approach does not share these problems. It can be used to identify the structurally controllable state variables and eliminate all others, and it does not suffer from numerical instabilities. Algorithm 12.7 Reduction of a control design problem Given: The structural graph of a system S(A, B, C) to be controlled. Find: A minimal realisation of the control problem. 1. Find all input connected state nodes. 2. Eliminate all other state nodes and all arcs involving these nodes. 3. Eliminate all input nodes that are not connected to at least one state node. Result: An equivalent realisation of the control problem without unconnected states. This algorithm can also be performed in terms of structural matrices. The set of states nodes that are not input connected is defined by the zero rows in the matrix A∗S BS , while the unconnected input nodes correspond to zero columns. Once the relevant state variables are identified, it is trivial to construct a permutation matrix T that sorts the connected state variables first and the unconnected variables last. The state reduction is then performed on the linear system as detailed above.

12.5 Solvability of the Weak Reconfiguration Problem

169

12.5 Solvability of the Weak Reconfiguration Problem In Chap. 9, it was shown that the weak reconfiguration problem is solvable, if the rank of the Rosenbrock matrix at s = 0 of the difference system is equal to that of the nominal system A Bf B A Bf = rank rank . C O C O O This test can be performed on a structural level. In order to reduce the likelihood of false negative results, the following transformation is performed first A B f B∆ A Bf = rank rank C O C O O with B∆ = B − Bf . The rank condition can then be tested using a structural model, leading to the following theorem. Theorem 12.8 Structural weak reconfigurability The weak reconfiguration goal for the faulty system Sf (AS , Bf S , CS ) with respect to the nominal system S(AS , BS , CS ) is reachable in a structural sense, if and only if AS Bf S B∆S AS Bf S = s-rank . s-rank CS O CS O O

(This test does not consider the stabilisation goal, which has to be tested separately as described in Sect. 12.3.) It is worth noting that the result of this structural test will apply to almost all systems of the given structure. However, because on either side of the equation the linear rank could be lower than the structural rank, the condition is neither necessary nor sufficient. Obviously, a sufficient condition is AS B f S AS Bf S B∆S smin-rank = s-rank CS O CS O O while the corresponding necessary condition is AS Bf S AS Bf S B∆S s-rank ≥ smin-rank . CS O CS O O

170


Proof. These conditions follow directly from the definitions of the structural and the minimal structural rank. Remark. Note that the substitution of B with B∆ is a situation where the state transformation can actually increase the accuracy of the structural analysis. Since most actuators are typically not affected by the fault, B∆ has a sparser structure than B. For example if 1 B = Bf = . 1

the rank of Bf B is 1, but the structural rank is 2. The structural rank of

Bf S B∆S is 1 and therefore equal to the linear rank. Based on these matrices, a system can be constructed such that this difference is relevant for the weak reconfigurability. The test given above returns the correct result (solvable) due to the transformation, but a test without the transformation would fail. It is possible that even better necessary and structural conditions exist. It would be interesting to analyse the exact structural conditions. Due to the given example, it seems likely that they depend on all three matrices: the original input matrix BS , the input matrix Bf S of the fault process and the difference matrix B∆S .

12.6 Application to the 2-Tank Example The tests from this chapter can be used to determine the reconfigurability of the 2-Tank System. As already determined in Sect. 3.5, the 2-Tank System is stable. Since the poles are not affected by the fault, this applies both to the nominal and to the faulty system. The structural controllability can be studied according to Theorem 12.3. Both states are input connected to both inputs, and a dilation is impossible due to the structure of the system. This means that the 2-Tank System is structurally controllable after any of the faults. It is also strongly s-controllable according to Theorem 12.4. Therefore, it is guaranteed that the stabilisation goal can be reached. The structural observability of the faulty plant shows a different result. The state x2 is output connected via y2 only, therefore the plant is not observable after a fault in y2 as shown in Fig. 12.5. The stabilisation goal is still reachable because the plant is stable and therefore detectable, but the design is seriously limited. The solvability of the weak reconfiguration goal after actuator faults can be studied using the structural Rosenbrock matrix. The relevant matrix is   0.25 0 1 −0.5 A B =  −0.25 0.25 0 0.5  Cz O 0 1 0 0


171

x2 x1 y1

Figure 12.5. Structural digraph of the 2-Tank Example without output y2 x1 u2

q x2

z

Figure 12.6. Structural digraph of the 2-Tank Example after Fault 1 with the external output z

which has full structural rank even if one of the actuator results is removed. This means that the weak reconfiguration goal should be reachable after any of the actuator faults. Unfortunately, the structural result does not apply to the linear case. If the pump u1 is at fault (Fault 1), the matrix   0.25 0 0 −0.5  −0.25 0.25 0 0.5  0 1 0 0 has full structural rank (of 3), but the linear rank is only 2. This special case is not a coincidence, because both the first and the last column result from the same variable q (the flow between the tanks). The singularity could have been detected as a dilation in the structural graph with the coupling node q as shown in Fig. 12.6, but no formulation of a structural rank test based on a graph with coupling nodes is known.

13 Solvability of Disturbance Decoupling

13.1 Disturbance Decoupling The strong reconfiguration problem leads to a disturbance decoupling problem as stated in Sect. 10.4. There are known structural tests for the solvability of this problem, which will be presented in this chapter. The next chapter will develop a novel solution inspired by the test presented here. In both cases, the structural approach to the disturbance decoupling problem has advantages over the classical approach. It is simple to implement, and it is well suited for the specific problems typical for reconfiguration. The problem formulation is similar to Sect. 10.4. A system is defined with one output vector z and two input vectors, the disturbance input uC and the control input uf . This separation is also represented in the structural graph by distinguishing two kinds of input nodes: disturbance input nodes u ∈ UC (shown as a box) and control input nodes u ∈ Uf . Problem 2. Known-disturbance decoupling problem (DDP’) Given: A dynamical system S(A, B, Bf , C) with the two input vectors uC , uf ∈ Rnu , the state vector x ∈ Rnx , and the output vector z ∈ Rnz x˙ = Ax + BuC − Bf uf z = Cx x(0) = 0 .

(13.1a) (13.1b) (13.1c)

Find: xsa control law for uf depending on uC and x such that the output z remains zero at all times. The general solution of the problem is known to be Thomas Steffen: Control Reconfiguration of Dynamical Systems: Linear Approaches and Structural Tests, LNCIS 320, 173–187 (2005) c Springer-Verlag Berlin Heidelberg 2005 www.springerlink.com

174


uf = SuC + Mx + Qu ,

(13.2)

with appropriate matrices M, S and Q, where u denotes a free input that can take any value. The structure of the disturbance decoupling problem is shown in Fig. 13.1. This problem is directly related to the design of the virtual actuator for the strong reconfiguration goal as detailed in Chap. 10. The system under consideration is the difference model S∆ (A, B, Bf , C) (the output matrix was called Cz there, but the index is dropped here in order to keep the notation simple). The decoupled (and stabilised) system is the virtual actuator which solves the reconfiguration problem. Note that the output of the virtual actuator is the control input uf (and not z). The disturbance input uC is the output of the nominal controller. If a decoupling solution can be found, the decoupled system is the virtual actuator which solves the strong reconfiguration problem.

Decoupled system Original system (given)

uC u

B S uf Q

Bf

-

x

C

z

? to be found

M

A

Figure 13.1. The disturbance decoupling problem

13.2 Variants of the Disturbance Decoupling Problem There are several important variants of the disturbance decoupling problem. They are mentioned here, because their relation is relevant for finding a structural solvability condition. The first dimension of variants has different assumptions about the disturbance: it can be unknown, known or known and differentiable. The second dimension concerns the poles of the decoupled system. They can be required to be stable, or even to be placeable at arbitrary positions. Figure 13.2 gives an overview over the resulting field of problems. The (unknown-)disturbance decoupling problem (DDP) is the classical formulation of the problem. Since the disturbance is considered to be unknown, it requires a control law for the form

13.2 Variants of the Disturbance Decoupling Problem Disturbance paths are no shorter than control paths

Rank is not higher with the disturbance

The decoupled system is stabilisable

Almost disturbance decoupling (aDDP)

∧

Disturbance paths are longer than control paths

∧

∧ Almost disturbance decoupling with pole placement (aDDPP)

Known disturbance decoupling (DDP’)

∧

Almost disturbance decoupling with stability (aDDPS) The decoupled system is controllable

175

∧

Unknown disturbance decoupling (DDP)

∧ Known disturbance decoupling with stability (DDPS’)

∧

Unknown disturbance decoupling with stability (DDPS)

∧ Known disturbance decoupling with pole placement (DDPP’)

Unknown disturbance decoupling with pole placement (DDPP)

This diagram shows nine variants of the disturbance decoupling problem, and the relations between the corresponding solvability conditions. The problems get stronger to the right and to the bottom. A problem is solvable, if and only if the problems (or conditions) to the left and above are solvable. Figure 13.2. Solvability conditions for the variants of the disturbance decoupling problem

uf = Mx (S = O in the formalism defined above). This is obviously a stronger problem than the known-disturbance decoupling problem. A known-disturbance decoupling problem can be turned into an equivalent unknown-disturbance decoupling problem by adding state variables to the system that represent the disturbance (since the states are assumed to be known). The input to these states (their derivative) is considered the new (unknown) disturbance. This variant is mentioned because of its importance in the literature, but it is not relevant for the reconfiguration problem. The almost disturbance decoupling problem (aDDP), on the other hand, is a weaker problem formulation. It assumes that the derivatives of the disturbance exist and can be used in the control law. Therefore, the control law is of the form uf = SuC + S u˙ C + S u˙ C + · · · + Mx .

176


Again, an almost disturbance decoupling problem can be turned into an equivalent known-disturbance decoupling problems by adding a sufficiently long chain of states to the system for every disturbance variable. In the literature of high gain control, an equivalent formulation of the almost disturbance decoupling problem is used. The derivatives of the disturbance are not assumed to be known, but the goal for the output is relaxed: it is required to be sufficiently small. This goal can be reached using high gain feedback M. For all three variants (aDDP, DDP’ and DDP), there is a corresponding problem with stabilisation (aDDPS, DDPS’ and DDPS). The additional requirement is that the decoupled system be stable: σ(A − Bf M) ⊆ Cg , where the design set Cg is a subset of the left half of the complex plane. The known-disturbance decoupling problem with stability DDPS’ is the variant that was found to be equivalent to the strong reconfiguration problem in Chap. 10. There are also corresponding disturbance decoupling problems with pole placement (aDDPP, DDPP’ and DDPP). The additional requirement for disturbance decoupling with pole placement is that the poles of the decoupled system can be placed anywhere on the real axis. These variants of the problem are important for the structural analysis, because (in contrast to the stabilisation problems) a structural test can be found. It may seem intuitive that the disturbance decoupling problem with pole placement is solvable, if the system is controllable and the disturbance decoupling problem is solvable. However, this is not the case. Consider a system with one disturbance and one control input variable. In order to decouple the disturbance, a specific input trajectory has to be applied. The disturbance decoupling property does not allow any degree of freedom, and therefore pole placement is impossible. The correct condition for disturbance decoupling with pole placement is, that the disturbance decoupling problem is solvable, and the decoupled system is controllable. The latter means that despite the restrictions required for disturbance decoupling, the system is still controllable. The relation of the solvability conditions for all mentioned variants of the problem are shown in Fig. 13.2. For example, the known-disturbance decoupling problem is solvable, if neither the rank nor the length of the input/output paths is affected if the disturbance inputs are removed from the system (the rank is the number of independent signal paths, see Sect. 13.4). The known-disturbance decoupling problem with stability is solvable, if the known-disturbance decoupling problem and the almost disturbance decoupling problem with stability are solvable, etc. A more mathematical treatment of the solvability conditions is presented by van der Woude [1997].

13.3 Disturbance Decoupling of the First Kind

177

13.3 Disturbance Decoupling of the First Kind An early structural test for disturbance decoupling is published by Reinschke [1988] in Sect. 22. It is based on the same idea as the geometric approach for linear systems: the separation of the state space into a disturbed but invariant and an undisturbed subspace. The central assumption of this approach is that a state variable belongs either to one or the other subspace.1 The set of nodes is partitioned into three sets: the disturbed nodes XD , the undisturbed nodes XU and the cut set X0 . A disturbed node is affected by the disturbance, whereas an undisturbed node is not, because there is no direct connection from a disturbed node to an undisturbed node. The decoupling happens in the cut set, where the disturbance is cancelled out. For a successful cancellation, it is required that there be an arc from a different control input in the disturbed set u ∈ UK ∩ XD to every node x in the cut set X0 . For obvious reasons the disturbed set XD has to contain all disturbance input nodes, but no output node. The interpretation is simple: every connection from a disturbed node to an undisturbed node is a possible signal path from the disturbance to the output. Due to the partitioning into the three sets, every signal path leads through the cut set. Because there is a control input for every node in the cut set, the input value can be chosen such that the disturbance is cancelled out. Therefore, all nodes in the cut set stay at zero. This approach is called “decoupling of the first kind”, because only direct connections from a control input node are considered useful for cancellation. If a system requires the use of longer signal paths to cancel the disturbance, this simple approach fails. Example: The approach can be applied to the 2-Tank Example. The structural graph for the difference system after Fault 1 is shown in Fig. 13.3. The nominal input uC is the disturbance, while the remaining input uf 2 is the control input. The cut set is x2 , and uf 2 is the control input used for cancellation. Therefore the output z remains undisturbed, since there is no arc from a disturbed node to z. This approach of disturbance decoupling is interesting for control reconfiguration, since it can be used to solve the disturbance decoupling part of the strong reconfiguration problem. It is easy to implement and it is able to solve many practical problems. However, the more powerful approaches developed below are only slightly more complex. Remark. Note that Reinschke [1988] also gives a solvability condition based on structural matrices. Disturbance decoupling of the first kind is possible, if the system states and inputs can be rearranged, such that the system assumes the 1

Therefore, subspaces cannot be studied using this method, unless they are parallel to an axis. This is a serious limitation.

178

13 Solvability of Disturbance Decoupling uC1 x1 uf 2 uC2

x2

z

X0

XU

XD

Figure 13.3. Decoupling of the first kind (2-Tank Example after Fault 1) following structure. The state vector and the control input vector is divided into two subvectors. The resulting submatrices have to be of the form AS11 AS12 AS = AS21 AS22 BS1 BS = O Bf S11 Bf S12 Bf S = Bf S21 O

CS = O CS2 with rank Bf S21 = rank

Bf S21 BS2 AS21

.

13.4 Structural Rank of a System The solvability of all disturbance decoupling problems depends on the solvability of the almost disturbance decoupling system (as shown in Sect. 13.2), which again depends on the normal rank of the system to be decoupled. The normal rank is equal to the number of independent signal paths that go from the input of a system to the output. In the linear theory, the normal rank is usually determined using the transfer function matrix. Definition 13.1 Normal rank The normal rank of a dynamical system x˙ = Ax + Bu z = Cx with the input u and the output z is equal to the rank of the transfer function G(s): r = max rank G(s) s

with

G(s) = C(Is − A)−1 B .

13.4 Structural Rank of a System

179

If the system is given in minimal form (it is complete), the same rank can also be calculated using A − Is B rank G(s) = rank − nx , C O which avoids the inversion. The transfer function matrix has this normal rank for almost every value of s, but it has a lower rank if s corresponds to a transmission zero of the system. The normal rank of a system is limited by the number of inputs: r ≤ nu . If both are equal, the system is called left-invertible. It is also limited by the number of outputs (r ≤ nz ), and a system at this limit is called rightinvertible. If the rank of a system is lower than possible, it can be split into two invertible systems with r coupling signals in between: G(s) = Gl (s)Gr (s)

(13.3)

with Gl (s) : C → Cnz ×r Gr (s) : C → Cr×nu . Throughout multi-variable control theory, it is commonly assumed that the system under consideration is invertible. Therefore, the rank of a system is rarely studied in detail. This simplifying assumption is not possible for the analysis of the weak or the strong reconfiguration problem, because the normal rank of the faulty system is essential for the reconfigurability. The earliest studies of the normal rank go back to the concept of zeros at infinity introduced by Rosenbrock [1970], and a detailed structural treatment is published by Reinschke [1988] in Sect. 32. The normal rank of a system can be sensitive to small parameter variations, which means that it can be hard to determine without introducing numerical instabilities. The structural definition does not share this problem. Definition 13.2 Structural rank The structural rank of a system structure SS (AS , BS , CS ) is the maximum rank rS = max rank C(Is − A)−1 B A,B,C,s

a system S(A, B, C) of the given structure SS can have. The structural rank can be determined from the structural graph of a system. In keeping with the idea that the rank of a system is the number of independent signal paths, the structural rank is the number of input/output paths in the structural graph without common nodes.

180


Theorem 13.3 Structural rank of a system The structural rank of a system structure is equal to the maximum size of a parallel-path set, where all paths start at an input node and end at an output node.

Proof. A proof is given by Reinschke [1988] under Theorem 32.7. Instead of the concept of parallel paths, he uses the formalism of node disjoint cycles. Both formalisms are identical for this application, since one can easily be converted into the other. This theorem requires an algorithm from advanced graph theory to calculate the maximum size. Therefore it may be more practical to use the formulation based on structural matrices. It only relies on the structural rank of the Rosenbrock matrix, and can therefore be treated using commonly available algorithms. Theorem 13.4 Structural rank of a system given by structural matrices The structural rank of a system structure is equal to the rank of the structural Rosenbrock matrix: AS + I S B S rS = s-rank (13.4) − nx . CS O

Proof. It is obvious that rS ≤ rS , because a matching for the matrix in (13.4) can be constructed from the parallel-path set, leading to an s-rank of at least nx + rS . For rS ≥ rS , complete induction is used. It is assumed that the matrix has full structural rank rS = nu = nz . The matched entries in the matrix correspond to rS input/output paths in the graph and maybe some cyclic paths, thus rS = rS . The rank rS can be lowered by one by zeroing a matched element. This breaks at most one path in the graph, reducing rS by one. It follows that always rS = rS . Just as in the linear theory (13.3), a system of a certain structural rank rS can be decomposed into two nonsingular systems connected by only rS signals. The connection between both parts obviously forms a “bottleneck” for all possible signal paths, which is rS signals “wide” (see Fig. 13.4). If the rank of the system is equal to the number of inputs or the number of outputs, one of the two

13.5 Almost Disturbance Decoupling

181

System of rank 2

Bottleneck (2 coupling signals)

Input

Subsystem 1

Subsystem 2

Output

Figure 13.4. Bottleneck determining the rank of a system

systems may be empty. In some systems there are several bottlenecks of rS signals, in which case several different partitions are possible. Example. The basic example of a rank deficiency is shown in Fig. 13.5. Although the system has two input variables and two output variables, the rank is only one, because every signal path from an input to an output goes through the only state node x. This state x represents the bottleneck of the system. Therefore, both output variables are always dependent on each other. The corresponding structural Rosenbrock matrix x u1 u2 x ∗∗ ∗ z1  ∗ 0 0  z2 ∗0 0 also shows the rank deficiency. z1

u1 x u2

z2

Figure 13.5. Rank deficient structure

13.5 Almost Disturbance Decoupling The first general structural test for the almost disturbance decoupling has been published by van der Woude [1991]. It is defined there as a high gain feedback control problem following a linear treatment by Willems [1981]. For every ε > 0, there has to be a feedback matrix M, such that the H∞ -norm of the transfer function is less then ε: |C(A − BM)−1 B|∞ < ε .

182


The solution may show increasingly high values in M for smaller ε, and the controller may converge towards pure differentiating behaviour for ε → 0. The practical application of the solution is obviously limited by the available input energy. Although the problem formulation is rather lengthy, the solvability condition of this problem is the easiest out of all the variants. It depends only on the normal rank of the system. Theorem 13.5 Structural test for almost disturbance decoupling (aDDP) The almost disturbance decoupling problem is structurally solvable, if and only if the structural rank of the system is the same both including and excluding the disturbance input uC AS + I S B f S AS + IS Bf S BS rank = rank . (13.5) CS O CS O O

According to Theorem 13.3, this requires the existence of a maximum size parallel-path set, which does not use a disturbance input node. The test and its proof are described in full details by van der Woude [1991]. Example. The 2-Tank system after Fault 2 is an example which allows almost disturbance decoupling (see Fig. 13.6). There is a path to the output z both from the control input variable uf 1 and from the disturbance input variable uC2 , therefore the rank does not depend on the disturbance input. Note that the path from the disturbance input node (width 1) is shorter than the path from the control input node (width 2). This does not affect the solvability of the almost disturbance decoupling problem. uC2 x2 uC1

z

x1

uf 1

Figure 13.6. Structure of the 2-Tank System after Fault 2

The numerical analysis confirms this result. The first derivative of the output is z˙ = Cz (Ax + BuC − Bf uf ) = +0.25x1 − 0.25x2 + 0.5uC2 . Since this equation does not depend on the control input uf , there is no way to determine it at this point. Therefore the second derivative of the output is calculated and set to zero:

13.6 Known-Disturbance Decoupling

183

0 = z¨ = Cz A(Ax + BuC − Bf uf ) + Cz Bu˙ C This equation can be solved for the control input: uf 1 = −0.0625x1 + 0.0625x2 + 0.5u˙ C2 − 0.0625uC2 . This equation depends on x and uC , but also on u˙ C . Therefore, the derivative of the disturbance is required to find the necessary control input. If it is available, the control law makes z¨ vanish. As long as z and z˙ are zero at t = 0 (depending on the initial condition), they will always stay zero with this control law.

13.6 Known-Disturbance Decoupling In order to reach the strong reconfiguration goal, the known-disturbance decoupling problem with stabilisation (DDPS’) has to be solved (cf. Chap. 10). Since there is no structural test for stability, only the structural condition for known-disturbance decoupling problem (DDP’) will be considered here. The problem itself is easier to formulate than the almost disturbance decoupling problem (aDDP), but the solvability test is more complex. The solvability condition of the known-disturbance decoupling problem depends on the solvability of the almost disturbance decoupling problem. It is required in addition that the path from a control input node to any output node be no longer than the shortest path from a disturbance input node. Otherwise the disturbance has a connection to the output variable with a transfer function of a lower degree, and a differentiation of the disturbance is required to find the correct value of the input variable. In contrast to the almost disturbance decoupling problem, the differentiation is not allowed here. While the added condition is simple and intuitive for a single output system, the multi-variable condition is more difficult. In Commault et al. [1993], the following condition is derived using the theory of rational matrices. Theorem 13.6 Structural test for the known-disturbance decoupling (DDP’) The known-disturbance decoupling problem defined on a system with two input vectors and one output vector is structurally solvable, if and only if 1. the structural rank of the system is identical with and without the disturbance input variables, and 2. for every number of parallel paths from the inputs nodes to the output nodes, the minimum width of a path set of the given size is the same with and without the disturbance input nodes.

184


Example. This test is applied to the 2-Tank System after Fault 2 as shown in Fig. 13.6. The first part of the condition is identical to the condition from the last section, where it was found to be satisfied. Since the system has a rank of 1, the second part of the condition is only applicable for a path set of size 1 (a single path). If the disturbance uC is considered an input, the shortest path has the width 1, while without the disturbance the shortest path has the width 2. Therefore the second part is not satisfied. This result is confirmed by the numerical analysis performed in the last section. The necessary control input for disturbance decoupling was found to depend on the derivative u˙ C of the disturbance. Therefore, the knowndisturbance decoupling problem is not solvable. The situation is different for the 2-Tank System after Fault 1, as shown in Fig. 13.7. The rank is still one, but the disturbance path from uC1 to z is longer than the control input path from uf 2 to z. Therefore, the disturbance decoupling problem is structurally solvable. However, it has already been found that the resulting decoupled system is not stabilisable, which means that the reconfiguration solution fails after a short period of time.

uC1 uC2

x1 x2

z

uf 2

Figure 13.7. Structure of the 2-Tank System after Fault 1 Remark. Unfortunately, no efficient algorithm for the determination of the minimum width of a path set is proposed by Commault et al. [1993] or van der Woude [1997]. The problem can be transformed into a maximum network flow problem discussed in Dulmage and Mendelsohn [1963], but again no simple solution is available. As an alternative, a faster test will be presented in Algorithm 14.11, which avoids the path set. However, it returns a positive result only in special cases. A structural test for disturbance decoupling with pole placement (DDPP’) is given in van der Woude and Murota [1995] and in van der Woude [1997]. A third condition is added to the test, which is rather difficult to formulate, and which requires advanced algorithms to determine. Since the result of the structural test is neither sufficient nor required for the actual linear problem (DDPS’), the test is not considered interesting enough to be presented here.

13.7 Finding a Minimal Difference System This section presents an algorithm to reduce the disturbance decoupling problem to a minimal system by removing all states that do not contribute to

13.7 Finding a Minimal Difference System

185

the problem. The algorithm builds on the solvability criterion found for the almost disturbance decoupling problem. The idea is to concentrate on the part of the system left to the bottleneck of the system (according to the discussion in Sect. 13.4). The first step inserts additional output nodes for all nodes that are either in or to the right of the bottleneck (not before it), and the second step removes all nodes right of the bottleneck. In the two final steps, superfluous input and output nodes are removed. Note that this algorithm does not differentiate between different kinds of input nodes. Algorithm 13.7 Reduction to the minimum system Given: A structural graph G(N, A) defining a disturbance decoupling system. Find: A minimal realisation of this problem. 1. Add a separate output node to every state node where this does not increase the rank of the system (considering all inputs). 2. For every state node, try whether attaching a dedicated input to it increases the rank of the system. If so, remove the state node. 3. Remove every output node which does not contribute to the system rank. 4. Remove all input nodes which have no connection. Result: An equivalent formulation of the disturbance decoupling problem with a minimal number of nodes.

Theorem 13.8 Rank reduction After performing Algorithm 13.7, the number of output nodes of the resulting system is equal to the rank of the system (which is unchanged by the algorithm).

Proof. The proof depends on the idea of the bottleneck determining the structural rank as introduced in Sect. 13.4. If r is the rank of the system, the bottleneck consists of r state nodes, through which all connections from Subsystem 1 to Subsystem 2 pass (see Fig. 13.4). These r states get dedicated outputs added in Step 1 of the algorithm. In Step 2, the Subsystem 2 is eliminated, and in Step 3 the original output nodes are removed. If the bottleneck is at the output of the system (rank = number of outputs nz ), no reduction can be performed. If the bottleneck is at the input (rank = number of inputs nu ), the algorithm still returns a correct solution, but the disturbance decoupling problem is not solvable.

186


This algorithm has several functions. It reduces the size of the problem and therefore the computational complexity. However, the main aspect is that the reduced system is left-invertible (its rank is equal to the number of outputs). This is an initial requirement for some further algorithm, and it significantly simplifies some proofs. Example. Since the 2-Tank example does not have enough nodes to demonstrate the algorithm, the system in Fig. 13.8 will be used (the parameters are not shown). The system has a rank of 2. In the first step, an output z0 is added to x1 , since this does not change the rank (see Fig. 13.9). In the further steps, the state nodes x2 and x4 , the output nodes z1 and z2 and the input node u4 are eliminated. The resulting system has still the same rank (see Fig. 13.10), and more importantly it defines an identical disturbance decoupling problem.

u4

x4

u1

x1

z1

x2

u2

z2 x3

u3

z3

Figure 13.8. System graph to reduce

u4

x4 z0

u1 x1

x2

z1

u2 z2

x3

u3

z3

Figure 13.9. System graph with added output

u1 x1

z0

x3

z3

u2 u3

Figure 13.10. Reduced system graph

13.7 Finding a Minimal Difference System

187

Remark. Input nodes are removed only if they are not output connected. It may therefore be possible to reduce the system further by removing control input nodes. However, this reduction can affect both the solvability of the disturbance decoupling problem and the stabilisability of the decoupled system. Since there is no one minimal set of necessary input nodes, no iterative algorithm can be given for the further input reduction. If it is desired to use few inputs, it may be useful to create a ranked list of available control inputs, and to try removing input nodes in the given order. Since there is no easy test for the solvability of DDPS’, it may be necessary to repeat the design step for DDPS’ several times in order to find a viable solution.

14 Structural Solutions to Disturbance Decoupling

14.1 Idea of the Iterative Algorithm This chapter develops a novel algorithm which solves the disturbance decoupling problem by repeatedly decoupling one output variable at a time. The central routine decouples a single output variable by assigning the necessary value to one control input variable, such that all influences on the chosen output variable are cancelled out. The important aspect is that the output variable is decoupled not only from the disturbance, but also from all other control input variables. Therefore, this routine can be applied repeatedly until the system is completely decoupled (or there are no control inputs left). Example. Consider the structural graph in Fig. 14.1. The control input uf 1 has a signal path to z1 . It is intuitively obvious that the input variable uf 1 can be used to decouple the output variable z1 from the disturbance uC1 (and it will be shown that all influences of at least the same signal path width can be cancelled). The approach is simple: calculate the amplification of the signal path uf 1 → x1 → z1 , and calculate all other influences on z1 . The signal uf 1 required to cancel them is the sum of the influences divided by the negative amplification. This iterative approach is very different from the classical geometric approach presented in Sect. 10.4, which solves the decoupling problem in one step after uf 1

x1

uC1

x2

uf 2

x3

z1 z2

Figure 14.1. Example for single-variable decoupling


190


constructing the maximum invariant subspace (which has no intuitive connection to the structure of the system). The iterative algorithm presented here offers several advantages for the application in reconfiguration. Because only single variables are decoupled, the algorithm is simple to implement. No state transformation is necessary. Several steps of the algorithm can be prepared off-line, so that the on-line part is more efficient. Problems with numerical stability are mostly avoided, because later iterations work with an already reduced system. Once the algorithm is completed successfully, the remaining control input variables are decoupled from the output. Therefore, they can be used for additional goals like stabilisation or optimisation, without affecting the disturbance decoupling property. This chapter will start with the formal algorithm for the decoupling of one output variable using a weighted structural graph. Several variants of this algorithm are developed for different models (including a solvability test based on a purely structural graph). It will then be shown how these algorithms can be applied repeatedly to find a solution for the decoupling of all output variables.

14.2 Algorithm for Single-Variable Decoupling This section gives the formal algorithm resulting from the intuitive description stated in the introduction. The basic idea of the approach is simple: find a signal path from a control input variable to the output variable and use this path to cancel all other signal paths to the output variable. The application of this idea becomes more complicated if there are several paths of the same length from the chosen control variable to the chosen output variable. In order to avoid these complications, this algorithm considers path bundles. If several paths exist, the overall effect of all paths is considered for calculation. This approach is consistent both with intuition and with the interpretation of path bundle amplification from Sect. 11.6. Algorithm 14.1 Single-variable disturbance decoupling (graph based) Given: The weighted digraph G(N, A, w) of the difference system. 1. Find the width i of the shortest path bundle with nonzero amplification from a control input node to an output node. 2. If any shorter path bundle with a nonzero amplification exists from any disturbance input node to this output node, the problem is not solvable. 3. Find a control input node uk and an output node zj that are connected via a path bundle of width i with nonzero amplification auk .

14.2 Algorithm for Single-Variable Decoupling

191

4. For every state or input node n with the exception of uk , find the set of paths of width i leading to zj and determine its amplification an . Add an arc with weight an − auk from n to uk . This turns uk into a coupling node. Result: The resulting graph has one output node decoupled (removed) and one input node fixed. The introduced coupling node can be eliminated if required. Showing the correctness of the result will be deferred to the analysis of a matrix model in Sect. 14.4. Instead, the following theorem will be used to demonstrate the completeness. Theorem 14.2 Completeness of single-variable disturbance decoupling If the disturbance decoupling problem for a given system is structurally solvable according to Theorem 13.6, the Algorithm 14.1 will succeed for almost all parameter constellations.

Proof. The second condition of Theorem 13.6 requires that there is no shorter path from a disturbance node to the output than from a control input node. Therefore, Step 2 in Algorithm 14.1 is always satisfied for a solvable problem. The algorithm may still fail at the division by auk in Step 4. However, auk = 0 is only possible if several paths cancel out each other. Since this is a special parameter constellation, it does not violate the structural result. Example. The system shown in Fig. 14.2 will be used as an example. The first step of the algorithm identifies the path uf 1 → x1 → z (amplification 1) as one of the shortest control paths. There is a second path uf 1 → x2 → z from the same input with the amplification 4. The amplification of the control path bundle is therefore auf 1 = 1 + 4 = 5. uC2 1 2

uf 1

x2

1

2 1

z

x1 1

uC1

Figure 14.2. Digraph for single-variable decoupling

192


The other paths leading to z are uC1 → x1 → z (amplification 1) and uC2 → x2 → z (amplification 2). In order to cancel these, uf 1 is turned into a coupling node, and weighted arcs are added to it: 1 = −0.2 5 2 uC2 → uf 1 : − = −0.4 . 5 These two arcs represent the decoupling controller. The resulting graph is shown in Fig. 14.3. The decoupling of z can easily be verified using the results from Sect. 11.6. uC1 → uf 1 : −

uC2

1 -0.4 2 -0.2

uC1

uf 1

x2

1

1

2 1

z

x1

Figure 14.3. Digraph after single-variable decoupling

In the following sections, several variants of this algorithm for different model forms will be discussed. The relation between these algorithms is shown in Fig. 14.4.

Model form:

Structural graph

Removal of quantitative step

Singlevariable decoupling

Weighted structural graph

Basic algorithm Alg. 14.1

Linear system

Translation to matrices

Linear system

Merging of iterations

Strong structural test

Matrix based algorithm

Matrix inversion algorithm

Alg. 14.3

Alg. 14.5

Alg. 14.8

Strong structural test

Matrix based algorithm

Fast decoupling algorithm

Alg. 14.11

Alg. 14.9

(not detailed)

Iteration

Multivariable decoupling

Figure 14.4. Derived decoupling algorithms

14.3 Structural Test

193

14.3 Structural Test Following the same basic idea, an algorithm for the analysis of the purely structural graph can be constructed. It is essentially identical to Algorithm 14.1, but it does not calculate any amplifications. The resulting algorithm is a test for the solvability of the problem. It also generates the structure of the solution, but obviously not the parameters. As with all structural properties, there may be systems where decoupling is structurally possible, but decoupling is impossible for a certain parameter constellation. This case occurs if a path is chosen as control path which is part of a path bundle with zero amplification. In Algorithm 14.1, this is excluded in Step 2, but on a purely structural level the amplification cannot be determined. It is, however, possible to detect the possibility of cancellation. If only a single path exists, cancellation is impossible, and the problem is always solvable. As soon as there are several paths, the result is only applicable to almost all parameter constellations. Apart from these differences, the following algorithm is identical to the former Algorithm 14.1. Algorithm 14.3 Test for single-variable disturbance decoupling Given: A digraph G(N, A) representing the structure of the dynamical difference system 1. Find the width i of the shortest path from an input node to an output node. 2. Pick a control input node uk and an output node zj that are connected via a path of width i. (If no such pair exists exists, the decoupling problem cannot be solved.) If possible, pick a control node which has only a single path to zj of width i. 3. Find all nodes that have a path to zj of width i. 4. For every such node n, add an arc from n to uk . This turns uk into a coupling node. Result: Decoupling of output node zj is structurally solvable. It is strongly structurally solvable, if there is only a single path from uk to zj of width i. The structural graph shows the structure of a solution. The resulting structure may be interesting for the implementation of the solution. The corresponding parameters can be calculated later using Algorithm 14.1.

194


Theorem 14.4 Correctness of the test If the Algorithm 14.3 finds the problem to be strongly structurally solvable, the output variable zj of any system of the given structure can be decoupled for all parameter constellations.

Proof. It is sufficient to show that Algorithm 14.1 completes successfully under the assumption. This can be done by matching every step of Algorithm 14.3 with the corresponding step in Algorithm 14.1. Identical values of i, k and j are chose for both algorithms. For every step, the same result is found: if Algorithm 14.3 gives a positive result, then Algorithm 14.1 can be applied. The only point where Algorithm 14.5 could possibly fail is the division in Step 4, if auk = 0. This can be ruled out here, because a single path always has a nonzero amplification. Example. The system from Fig. 14.2 will be used again, but without reference to the parameters. Two paths exist from the control input uf 1 to the output z. Therefore, cancellation between these paths is possible. The decoupling problem is structurally solvable (but not strongly structurally solvable). The structure of the solution is as shown in Fig. 14.3.

14.4 Matrix-Based Algorithm for Single-Variable Decoupling Based on the correspondences developed in Sect. 11.6, the graph based Algorithm 14.1 can be translated into a version that works on a state-space system given by system matrices. The resulting algorithm is identical in result to the original, but it is easier to implement in a matrix-based language and easier to analyse using linear algebra. Every step of this algorithm corresponds one-toone to the same step in Algorithm 14.1. The matrix calculations may appear more complex than the graph based operations, but they are in fact identical, and the details will be explained shortly. Algorithm 14.5 Single-variable disturbance decoupling (matrix based) Given: The system S(A, B, Bf , C) with the inputs uf , uC ∈ Rnu and the output z ∈ Rnz 1. Find the first value of i for with P(i) = CAi Bf has a nonzero element.

14.4 Matrix-Based Algorithm for Single-Variable Decoupling

195

2. All matrices CAn B for n < i have to be zero, otherwise decoupling is not possible. 3. Pick a nonzero element pj,k (i) of P(i), and calculate R=

1 ek cTj Ai pj,k (i)

(14.1)

where ek is the unity vector in the kth dimension and cTj denotes the jth row of C. 4. Add the control law

uf = SuC + Qu + Mx

(14.2)

with M = RA S = RB

(14.3a) (14.3b)

Q = I − RBf

(14.3c)

The vector u is the new input of the system. Result: A new system, where the output zj is decoupled from the new input u . The rank of the new system (with input u instead of uf ) is lower by one compared to the original system. The result of this algorithm can be analysed using linear algebra. The new system consists of the original system (13.1) and the control law (14.2). It is x˙ = (A − Bf M)x + (B − Bf S)uC − Bf Qu z = Cx . Inserting the values from (14.3) allows several simplifications, leading to x˙ = (I − Bf R)(Ax + BuC − Bf u ) z = Cx .

(14.5a) (14.5b)

The algorithm claims that zj is decoupled from uC . Theorem 14.6 Correctness of single-variable disturbance decoupling After performing Algorithm 14.5, the chosen output zj of the resulting system (14.5) is decoupled from all remaining inputs uC and u .

196


d n+1 Proof. It will be shown that every derivative dt zj is independent of uC and u . The derivative can be calculated by recursive application of the system (14.5). It is n+1 d n zj = cj (I − Bf R) (A(I − Bf R)) (Ax + BuC − Bf u ) . dt The dependence on the state x is not relevant. Therefore, it remains to be shown that ∀n : cj (I − Bf R) (A(I − Bf R)) (BuC − Bf u ) = 0 n

(14.6)

for all uC and u , where cj denotes the jth row of C. Due to the first two steps of the algorithm, the terms cj An B and cj An Bf with n < i are known to be zero. It follows that (14.6) holds for all n < i. The condition for the remaining cases simplifies to ∀n ≥ i : cj Ai (I − Bf R) (A(I − Bf R))

n−i

(BuC + Bf u ) = 0

It is sufficient to show that cj Ai (I − Bf R) vanishes. Inserting R according to (14.1) leads to 1 (1 − cj Ai Bf ek )cj Ai = 0 . pj,k (i) The term in parentheses vanishes due to the definition of P(i). Based on this result, it can be shown that the algorithm reduces the rank of the system by one. This aspect will be of importance for the iterative application of the algorithm. Theorem 14.7 Rank reduction by single-variable disturbance decoupling The decoupled system resulting from Algorithm 14.5 has a normal rank which is one lower than the normal rank of the original system.

Proof. The proof is trivial, if the normal rank of the system is determined by the number of output variables. Because one output variable is decoupled, the normal rank is necessarily reduced by one. However, a proof for the general case is required, and therefore the decomposition of the system at its bottleneck according to Fig. 13.4 has to be considered. The rank of the system is determined by the number of variables that connect Subsystem 2 with Subsystem 1. In the original system, all these variables can

14.4 Matrix-Based Algorithm for Single-Variable Decoupling

197

be controlled independently, because Subsystem 1 is right-invertible. In order to decouple an output, it is necessary that there is some relation between the coupling variables. Although the number of coupling signals is unchanged, one coupling signal can be calculated from the other coupling signals. It follows that the decoupling controller has created a new bottleneck (by cancellation) inside of Subsystem 1. This lowers the rank of Subsystem 1 and, therefore, of the whole system by one (see Fig. 14.5).

System of rank 1 New bottleneck (due to control law) New input

Control law

Subsystem 1a

Old bottleneck

Subsystem 1b

Subsystem 2

Output

Figure 14.5. New bottleneck after single-variable decoupling

Example. The algorithm can be applied to the 2-Tank Example after Fault 1, as introduced in Chap. 3. The difference system is −0.25 0 1 −0.5 0 −0.5 x˙ ∆ = x∆ + uC + uf +0.25 −0.25 0 0.5 0 0.5 z∆ = x∆2 The steps of the calculation are similar to the ad hoc approach used for the example in Sect. 13.5. The index i is found to be 0, since

P(0) = Cz Bf = 0 0.5 .

The component p1,2 (0) = 0.5 is used as a Pivot element, which means that it is the divisor. The other relevant terms are

cj B = 0 0.5

cj A = 0.25 −0.25 . This leads to the control law parameters 0 0 M= 0.5 −0.5 00 S= 01 10 Q= . 00

198


The decoupling property of the new system shows in the controllability matrix with respect to the disturbance input uC :

1000 C = I A − Bf M (B − Bf S) = . 0000 Due to the control law, the disturbance does not reach the state x∆2 .

14.5 Optimising the Matrix-Based Algorithm The matrix-based algorithm can be extended to decouple several output variables in a single step. This is possible if there are several output variables that are connected to (different) input variables via paths of equal length. The extended algorithm also has the advantage that it spreads the control energy evenly across several redundant input variables (instead of using only one control variable). The central idea is the same as used in Sect. 14.4: find nonzero values in P(i) = CAi Bf and use them to cancel signal paths. Instead of picking a single element from P(i), a matrix inversion is used to decouple a subspace as big as possible (im P(i)). The goal is extended accordingly: instead of cancelling d i z a single row of the output, the new goal is to make the whole output dt vanish for the given derivative. The only difference in the algorithm is the choice of R in Step 3. Algorithm 14.8 Single-degree disturbance decoupling (up to Step 2 and Step 4 identical to Algorithm 14.5) 3. Pick a nonzero element pj,k (i) of P(i), and calculate R = P+ (i)CAi

(14.7)

+

where P (i) denotes the pseudo-inverse of P(i). Result: A new system, where the output space z ∈ im P(i) is decoupled from the new input u . The rank of the new system (with input u instead of uf ) is lower by rank P(i) compared to the original system. The proof of the correctness applies without change, and it leads to the condition

im CAi (I − Bf P+ (i)CAi ) ⊥ im P(i) , where ⊥ denotes that both subspaces are orthogonal. This follows directly from the definition of the pseudo-inverse P(i)P+ (i)P(i) = P(i). This section concludes the treatment of algorithms that decouple only one or a few output variables. In the remainder of this chapter, the iterative application of these algorithms for the decoupling of all output variables will be discussed.

14.6 Multi-variable Cancellation

199

14.6 Multi-variable Cancellation This section presents an extension of the aforementioned algorithms to the decoupling of several variables. The basic idea is to apply an algorithm for single-variable decoupling repeatedly, until all output variables are decoupled. This is possible, because in contrast to the classical solutions, the algorithms presented above make the remaining free input u explicit. Therefore, this input can be used to cancel further signal paths without affecting the decoupling of already treated output variables. The result is a set of stacked control laws as shown in Fig. 14.6.

System with two outputs decoupled System with one output decoupled

uC

S1

S u2

Original system

u1 Q

Q1

z

uf x

M

M1

Figure 14.6. Nested decoupling controllers

The main difficulty with the repeated application of Algorithm 14.5 is that it always returns a new controller to be applied to the system. For example, the first iteration deals with the system S(A, B, Bf , C) with input uf and output z, and it returns a control law uf = S1 uC + Q1 u1 + M1 x . This results in the decoupled system (14.4), which can be written as S (A − Bf M1 , B − Bf S1 , Bf Q1 , C). Performing another iteration on this system S leads to a second control law u1 = SuC + Qu2 + Mx and so on. The following algorithm combines all of the intermediate results into one final control law that decouples all output variables.

200


Algorithm 14.9 Multi-variable disturbance decoupling Given: The system S(A, B, Bf , C) to be decoupled. Find: A decoupling control law. Initialise S0 = O, M0 = O, Q0 = I, C0 = C Repeat for every l from 1 to the rank n of the system 1. Construct the system S(A − Bf Ml−1 , B − Bf Sl−1 , Bf Ql−1 , C) and decouple one output variable according to Algorithm 14.5, giving M, S and Q 2. Update the controller Ml = Ml−1 + Ql−1 M Sl = Sl−1 + Ql−1 S Ql = Ql−1 Q . Result: A decoupling control law uf = Sn uC + Qn u + Mn x for the given system. The output z is decoupled from uC and u . Theorem 14.10 Correctness of multi-variable disturbance decoupling If Algorithm 14.9 is applied to a left-invertible system, and it completes successfully, the output of the resulting system is decoupled from the remaining input u .

Proof. The proof relies on the structure of the decoupling control law according to Fig. 14.6. While the input signal is modified in every iteration, the output of the system stays the same variable. Since every step decouples a different output variable, it follows that upon the successful completion of the algorithm, all outputs are decoupled. This algorithm can be used in the solution of the strong reconfiguration problem as detailed in Chap. 10. It solves the decoupling of the external output deviation z∆ , such that the external output of the faulty plant zf follows the same trajectory as the external output of the nominal plant z. Note that the stability of the decoupled system is not guaranteed, but it can be reached by adding state feedback from x∆ to u .

14.7 Strong Structural Test

201

Remark. It is also possible to use the optimised Algorithm 14.8 in Step 1. Since this algorithm decouples several output variables at a time, fewer iterations are necessary. It is further possible to optimise the calculation of the matrix potences An and (A − Bf M)n . Therefore, it is not necessary to calculate Ai from scratch for each iteration. By applying these optimisations, the complexity of the algorithm can be brought down to O(n4 ). An efficient realisation is included in the RECONF Toolbox described in Appendix B.

14.7 Strong Structural Test This section introduces a test for the strong structural solvability of disturbance decoupling with respect to all output variables. The same idea as in the previous section is used: the test for single-variable decoupling is applied repeatedly. Because the graph contains the structure of both the system and the controller, the loop is even slightly simpler for this model form. It is also shown why this idea is not applicable for the structural solvability. Based on this sufficient condition for disturbance decoupling of a single variable, it is possible to construct a test for multi-variable decoupling. Algorithm 14.11 Test for multi-variable strong structural disturbance decoupling Given: A digraph G(N, A) representing the system structure of a difference system. Requirement: G(N, A) is minimal in the sense of Algorithm 13.7. Repeat for every l from 1 to the rank n of the system 1. Apply Algorithm 14.3 to decouple a single output variable. If it fails, decoupling of the remaining outputs is not possible. If the system is found to be only structurally decouplable, the algorithm can continue, but further steps may give wrong positive results. 2. Remove the decoupled output node zi from the graph. Result: If the algorithm completes and all iterations confirm the solvability of the strong structural decoupling problem, all output variables of the system can be decoupled for all parameter constellations. The final graph is the structure of a decoupling solution.

202


Theorem 14.12 Correctness of the strong structural disturbance decoupling test If the Algorithm 14.11 completes successfully, all output variables can be decoupled for any system of the given structure. This holds for all parameter constellations without exception.

Proof. If Algorithm 14.11 completes successfully on the given structural graph, the Algorithm 14.9 can be applied successfully to any parameterised system of the given structure. For every iteration, the values of i, k and j in the use of Algorithm 14.5 can be chosen to be identical to the corresponding values in Algorithm 14.3. A failure due to auk being zero is impossible, since a single path always has a nonzero amplification. Therefore, Algorithm 14.9 returns a decoupling solution for any linear system of the given structure. Example. The structure in Fig. 14.7 demonstrates the power of this test. In the first step, z1 is decoupled using uf 1 , leading to the structure in Fig. 14.8. Now the shortest control path is uf 2 → x3 → x2 → z2 (width 2), while the shortest disturbance path is uC1 → uf 1 → x2 → z2 (width 1). It follows that either z1 or z2 can be decoupled, but not simultaneously. uC1

x1

z1

uf 1 x2 uf 2

z2

x3

Figure 14.7. Structure where decoupling of both outputs is not possible

uC1

x1

z1

uf 1 x2 uf 2

z2

x3

Figure 14.8. Structure with one output decoupled

Unfortunately, the iterative application of Algorithm 14.3 does not provide the correct test result for structural disturbance decoupling. The problem occurs at the second iteration, when the test is applied to the structure that represents the system after the decoupling of the first output. The very idea of

14.7 Strong Structural Test

203

single-variable decoupling was to introduce an additional control path that cancels disturbance paths. Therefore, the decoupled system contains path bundles with an amplification of zero by design (not by coincidence). The basic assumption of structural analysis, that all parameters are independent, is therefore violated. As a consequence, the structural test in the second iteration provides the correct result with respect to all systems of the tested structure, but this is not the class of systems relevant to the original problem. The final result may therefore be wrong. The system structure shown in Fig. 14.9 illustrates this problem. The Algorithm 14.3 proposes to decouple the output z1 using the signal path uf 1 → x2 → z1 . An arc between x1 and uf 1 is inserted, since the input uf 1 is used to decouple the influence from x1 (see Fig. 14.10). In the second iteration, the algorithm tries to decouple z2 using uf 2 via x1 → x2 → x3 . This is impossible, because the path from x1 to x2 has been cancelled in the first step. Therefore, only the longer path x1 → x4 → x5 → x3 is available, which is too long to decouple the influence from the disturbance node uC1 . uC1 uf 2

x4 x1

x5

x3

x2

z2 z1

uf 1

Figure 14.9. Example structure where DDP’ is not possible

uC1 uf 2

x4 x1

x5 x2

x3

z2 z1

uf 1

Figure 14.10. Example structure after the first step

There is no easy solution to this problem. Extensions can be found to solve the given example, but more complicated counter-examples can still be constructed. The deeper reason may be a violation of complexity: the test in Theorem 13.6 depends on the existence of minimum width parallel-path sets, which are complex to find. If this complexity is inherent in the problem, no equivalent test on the basis of the simple Algorithm 14.3 is possible.

15 A Structural Reconfiguration Algorithm for Actuator Faults

15.1 Test for Reconfigurability This chapter summarises the results from the previous three chapters, and shows how they can be used to analyse and solve the reconfiguration problem. Two new algorithms are presented here: a structural test for reconfigurability and an algorithm for reconfiguration. Since the structural test cannot detect parameter cancellation, only the second algorithm can definitively determine the solvability of the problem. The applicability of structural analysis to specific aspects of the reconfiguration problem has already been shown in studies by Izadi-Zamanabadi et al. [1998] and Lorentzen et al. [2003], but this chapter tries to present a complete approach. The structural test for reconfigurability will be presented first. Corresponding to the different reconfiguration goals, three tests introduced in the preceding chapters are performed in the order of increasing strength: the stabilisation goal is tested first, then the weak goal, followed by the strong goal. Algorithm 15.1 Analyse the reconfigurability according to the different goals Given: The model Sf (A, Bf , Cz ) of the faulty system and the model S(A, B, Cz ) of the nominal system. Find: The reconfiguration goals that can be satisfied. 1. (Off-line) test the matrix A for unstable modes according to Algorithm 12.6. 2. (On-line) identify the fault in the plant and update the plant model. 3. Test the faulty plant (A, Bf ) for stabilisability according to Algorithm 12.6. If it is not stabilisable, reconfiguration is impossible.


206


4. Test the difference model S∆ (A, B, Bf , Cz ) for structural solvability of the weak reconfiguration goal according to Theorem 12.8. If it is not solvable, the stationary output zf cannot be restored. 5. Test the difference model S∆ for structural disturbance decoupling using either Theorem 13.6 or Algorithm 14.11. If they fail, the output trajectory cannot be restored (strong goal). Note that the tests do not include the stabilisability of the decoupled system. Result: The set of reconfiguration goals that can be reached according to the structural tests, and the set of goals that pass the strong structural tests. Example. In order to demonstrate the algorithm, it will be applied to the 2-Tank Example from Chap. 3. Most of the individual results have already been shown following the single algorithms, but this sections tries to give an overview of the results. The reconfigurability test according to Algorithm 12.6 is performed first. According to Step 1, the whole plant is stable. The system matrix −0.25 0 A= 0.25 −0.25 is already in triangular form, such that the eigenvalues −0.25 and −0.25 are obvious. Therefore, the plant is stabilisable in every actuator fault case. Step 3 also shows that the plant is controllable in either actuator fault case. Step 4 tests for the weak reconfiguration goal using Theorem 12.8. The relevant values are   −0.25 0 0 −0.5 s-rank  0.25 −0.25 0 0.5  = 3 0 1 0 0 for Fault 1 and 

−0.25 0 1 s-rank  0.25 −0.25 0 0 1 0

 0 0 = 3 0

for Fault 2. So, both tests return a positive result, but only the matrix for Fault 2 passes the strong structural test (smin-rank() = 3), which is a sufficient condition for the solvability of the weak goal. As discussed in Sect. 12.6, the result for Fault 1 does not apply to the linear system used here due to a cancellation. The structural test cannot detect this cancellation with certainty, but it can detect its possibility. The final test has to be performed by the design algorithm on a linear level. Step 5 tests for the strong reconfiguration goal using Algorithm 14.11. Since only one output (z = x∆2 ) has to be decoupled, a single iteration is sufficient

15.2 Reconfiguration After Actuator Faults

207

to determine the result. As discussed in Sect. 13.6, the test fails for Fault 2, but succeeds for Fault 1. Therefore, the result of the structural test is that the weak reconfiguration goal can be reached after Fault 2. This is correct, as will be demonstrated with the constructive algorithm in the next section. For Fault 1, the necessary condition for the strong reconfiguration goal is satisfied, but not the sufficient condition. This means that a special parameter constellation may prevent a solution of the weak and the strong reconfiguration goal. From a structural perspective, such a constellation is extremely unlikely. However, due to the reasons detailed in Sect. 12.6, the system has exactly this parameter constellation: for the given linear system, the weak reconfiguration goal is unreachable. Remark. The structural test is especially valuable if it fails. With this information, the problem can be revised by a supervisory control layer, and the revised problem can be tested again. Two examples will be given for this situation. If the faulty plant is found to be not stabilisable, reconfiguration is impossible. Since the structural test determines which states are unstabilisable, the shutdown of the unstable part of the plant can be considered. If the unstable part can be separated from the rest of the plant (and it is not essential for the operation), a reconfiguration of the stabilisable part can be tried. The weak or the strong reconfiguration cannot be satisfied if the rank of the faulty plant is too low. Generally it is impossible to restore more output variables than the rank of the faulty system. Therefore, it has to be considered whether all output variables are essential for the practical control problem. If one condition can be relaxed (the output variable is not required to restore the original value), the problem may become solvable.

15.2 Reconfiguration After Actuator Faults The following algorithm calculates the virtual actuator, which was found to be the solution to the reconfiguration problem after actuator faults in Part II. The goals are treated in a different order here: the strong reconfiguration goal comes first, then the stabilisation, and finally the weak reconfiguration goal is solved. Algorithm 15.2 Analyse and reconfigure a plant after an actuator fault Given: The model of the faulty system Sf (A, Bf , Cz ) and the model of the nominal system S(A, B, Cz ). Find: A reconfiguration solution.

208


1. Construct the difference system x˙ ∆ = Ax∆ + BuC − Bf uf

(15.1a)

z∆ = Cz x∆ .

(15.1b)

The vector uf is the control input, and uC is the disturbance input. 2. (optionally) Decouple the output z∆ using the Algorithm 14.9. The control law is (15.2) uf = SuC + Qu + Mx∆ . 3. Reduce the decoupled system (A − Bf M, Bf Q) to its controllable part (A , Bf ) using Algorithm 12.7. 4. Design a controller K for the reduced decoupled system (A , Bf ) using a known controller design algorithm, and transform it back to the unreduced system giving K. The control law is u = −Kx∆ .

(15.3)

5. (optionally) Add feedforward to improve the control quality or reach a certain equilibrium (weak goal): u = S uC − Kx∆ .

(15.4)

6. Implement the virtual actuator as defined by (15.1), (15.2) and (15.3) or (15.4) in the control loop. Result: A reconfigured control loop which satisfies the weak or the strong goal as required. Example. This algorithm will also be demonstrated at the 2-Tank Example introduced in Chap. 3. For Fault 1, the difference system is −0.25 0 0 −0.5 1 −0.5 x∆ − uf + uC x˙ ∆ = 0.25 −0.25 0 +0.5 0 +0.5 z∆ = x∆2 . The decoupling Algorithm 14.9 requires only one step. The amplification matrix is

P(i) = 0 0.5 for i = 0. The other relevant matrices are 0 + P(0) = 2

i CA B = 0 0.5

CAi+1 = 0.25 −0.25 .

15.2 Reconfiguration After Actuator Faults

209

The decoupling controller is therefore uf = SuC + Qu + Mx∆ with

0 0 M= 0.5 −0.5 00 S= 01 10 Q= . 00

Obviously, the input u is without effect. This means that all input variables are assigned to satisfy the decoupling problem, and no degree of freedom is left for stabilisation. A linear analysis of the decoupled plant (A − Bf M, Bf Q) reveals that it has an uncontrollable pole at zero. The stabilisation in Step 3 is therefore impossible. The reconfiguration solution will be only asymptotically stable, so it may fail after some period of time. Alternatively, a virtual actuator can be designed according to the stabilisation goal (assumed u = uf ), which will stabilise the plant, but not restore the value of z. Different steps of the algorithm are used when applied to the faulty plant after Fault 2, because only the weak reconfiguration goal is pursued. The difference model is −0.25 0 0 −0.5 1 −0.5 x˙ ∆ = x∆ − uf + uC 0.25 −0.25 0 +0.5 0 +0.5 z = (x∆2 ) . Since the strong reconfiguration goal was found to be not solvable, the decoupling in Step 2 is not performed. Therefore, all inputs are available for the stabilisation (u = uf ). A stabilising controller according to Step 3 was found in Sect. 8.6: 14.5 185 K= . 0 0 The zero placement (Step 4) was discussed in in Sect. 9.6, and the result is 19 . S = 00 The virtual actuator is therefore defined by the difference model, and the control law 19 14.5 185 uf = uC − x∆ 00 0 0 and the output correction y C = yf + x ∆ . It leads to a stable reconfigured control loop (Step 5), and it restores the equilibrium value of the external output zf = z.

210


15.3 Reconfiguration in a Fault-Tolerant Control Scheme The two algorithms given above can be used to construct a fault-tolerant control scheme. Traditional fault-tolerant control responds to a fault by implementing a predesigned solution. The reconfiguration algorithms presented here can find the reconfiguration on-line, after the fault has been detected and identified. It is still necessary to a have a supervisory control, which provides the goals for the reconfiguration. The resulting structure of a fault-tolerant control scheme is shown in Fig. 15.1. When a fault is detected, the reconfigurability analysis (Algorithm 15.1) tests which reconfiguration options are available. The supervisory control evaluates the fault and the reconfiguration options. If necessary, it redefines the system goals. The reconfiguration algorithm (Algorithm 15.2) calculates the corresponding virtual actuator and adds it to field level.

Supervisory control: define system goals Goal

Reconfigurability

Fault Reconfiguration

Diagnosis (FDI)

Supervisory level

Sensor data

Control changes w

Fault

zf

u

Reconfigurable controller

Plant

Field level

y

Figure 15.1. Reconfiguration as part of a fault-tolerant control scheme for actuator faults

The corresponding control flow is shown in Fig. 15.2. It is worth noting that the reconfiguration algorithm is a linear sequence of steps. It does not contain a loop corresponding to the classical design loop. Therefore, the algorithm will always succeed within a known amount of time (unless the system is not stabilisable). A failure of the algorithm is reported at an early stage, which means that alternative measures can be implemented to guarantee the safety of the system.

15.4 Conclusion

211

Linearise the model, test stability

Wait for a fault to occur (FDI)

Formulate the reconfiguration goal

Test reconfigurability

fails

Alg. 15.1

Reduce reconfiguration goal

Find virtual actuator Alg. 15.2

fails

fails

Reconfiguration impossible Fall back to the weak goal

Implement the virtual actuator Figure 15.2. Reconfiguration algorithm with supervisory control

It is possible that the design algorithm may have to be run a second time. Since the reconfigurability test is a purely structural algorithm, it is very fast, but it only provides necessary and sufficient conditions for reconfigurability. If a goal is chosen for which the sufficient condition is not fulfilled, the first virtual actuator design may fail due to a cancellation in the system. It is also possible that the strong reconfiguration goal is not solvable, because the decoupled system is not stabilisable (no structural test exists for stabilisability). In any case, a second virtual actuator design with a reduced goal will succeed.

15.4 Conclusion This part has presented several algorithms that can test for the solvability of the disturbance decoupling problem, and that can provide solutions to the

212


same problem. The algorithms are based around the notion of control signal paths, which are used to cancel out disturbance signal paths. Several similar algorithms are presented, which differ slightly in the representation of the system model and in the dealing with equally effective input variables. Only one definition is used that requires a complex algorithm (the maximum size minimum width parallel-path set according to Definition 11.11, as required in Algorithm 13.6). All other operations are of a simple nature: they are based on the matrix multiplication, the structural rank of a matrix or a shortest path search. These operations are trivial to implement with a time complexity in the order of at most O(n3x ). Therefore, the overall complexity of the given algorithms is no higher than O(n4x ), which makes them feasible for medium sized problems. The algorithms are simple, which makes them well suited for the implementation in an embedded system to calculate a reconfiguration solution on-line after a fault has been detected.

Part IV

Application Examples

This part presents two experiments conducted using the reconfiguration algorithms developed in Part II and Part III of the manuscript. They confirm that the idea of the virtual actuator is not only sound from a theoretical point of view, but also applicable to practical problems. The first experiment is an extension of the 2-Tank system to three tanks. This allows for the definition of many more fault cases. The system shows significant effects caused by limits and nonlinearities of the system, which could not be studied using the linear simulations used for the running example. The second experiment is a two-degrees-of-freedom helicopter model. It introduces several new difficulties compared to the easier problem of controlling a tank system. First of all, the system is inherently unstable. Secondly, this system shows many effects like mechanical lag, friction and limits, which cannot be covered in linear theory. Therefore, the control of this system is a challenging control task. This part concludes with a short summary of the main results presented in this manuscript. It is also recapitulated which problem have been solved and which aspects are open for further research.

16 Reconfiguration of the 3-Tank System

16.1 Nominal 3-Tank System The 3-Tank experiment is shown in Fig. 16.1. It consists of three tanks, which are connected via the valves u2 , u3 and u4 . Pumps can bring water into the left and the right tank, but not into the middle tank. The control objective is to maintain a certain level in the middle tank, such that the outflow z is constant. The relevant components of the system are shown in Fig. 16.2. The system is very similar to the one defined in the original publication of the 3-Tank Benchmark Problem by Heiming and Lunze [1999]. However, because a real experiment is used here, the identified parameters have to be used. The nominal control structure is similar to the 2-Tank system: the pump u1 is used to control the level x1 in the left tank, and the valve u2 is used to control the level x2 in the middle tank. Since u2 is a magnetic valve with a discrete input, a pulse width modulator (PWM) is integrated into the proportional level controller. For the purpose of reconfiguration, this modulator is considered part of the plant. The nonlinear model of this system for the assumed situation (h2 < xa1 > xa2 < xa3 ) is x˙ a1 = qmax u1 − q2 − q3 − qd x˙ a2 = q2 + q3 + q4 − z x˙ a3 = qmax u5 − q4 y a = xa z a = kz xa2 + hz with q2 = k2

xa1 − h2 u2


216


Figure 16.1. Picture of the 3-Tank system Pump

u1

Pump Tank 1

Tank 2

Tank 3

u5

Valve

u2 0.6 m

x1

x3 Valve

u3

Valve

u4

x2

z

d

Figure 16.2. Overview of the 3-Tank system

a x1 − xa2 u3 a q4 = k4 x3 − xa2 u4 qd = kd xa1 + hd d . q3 = k3

As in Sect. 3.1, an index ·a is used to denote the absolute value (compared to the relative values in the linear model). The constant qmax is the maximum flow for a pump, ki are valve constants and hj are the heights of the valves. The identified values for these constants are

16.1 Nominal 3-Tank System

217

h2 = 0.3 hd = hz = 0.06 qmax = 7.1 · 10−3 k2 = 10.2 · 10−3 k3 = k4 = 6.2 · 10−3 kd = kz = 8.7 · 10−3 .

The linearisation is performed for the equilibrium state 0.5 0.1 0.4 .1 New relative state variables are introduced for the linear model: x1 = xa1 − 0.5 x2 = xa2 − 0.1 x3 = xa3 − 0.4 . Note that the first two states correspond to the set-points in the nominal case, but the last state x3 has to be chosen higher than the nominal level. Although in the nominal case, the right tank is empty, chosing a higher linearisation leads to a model that can describe the when the right tank is filled in order to let water into the middle tank. This is necessary for the reconfiguration of some fault case, and by chosing the linearisation point this way, a single linearised model can be used for all fault cases. In order to deal properly with faults, where an input variable is fixed to a value different from its equilibrium value, absolute input values are used in the linearised model (not relative values, as it is usual). The linearised system is     −8.6 0 0 −8 103 x˙ =  +8.6 −10.9 0  x +  0  d 0 0 0 0     7.1 −4.6 −3.8 0 0 0 +  0 +4.6 +3.8 +3.8 0  u +  −3.5  0 0 0 −3.8 7.1 0 y=x z = 0.0109x2 . Note that there is an offset in the differential equation. It is necessary, because absolute input values are used. The structural graph of the plant is shown in Fig. 16.3. There are two nominal controllers, one for the left tank x1 and one for the middle tank x2 . The left tank x1 is only a reservoir, therefore a proportional 1

The linearisation point of the right tank is chosen such that the connection valve u4 can produce a reasonable flow. The full problem of choosing the equilibrium for a nonlinear plant is beyond the scope of this manuscript.

218

16 Reconfiguration of the 3-Tank System u1 y1

x1 u3

y2

x2

u2

z

u4

y3

x3

u5

Figure 16.3. Structural graph of the 3-Tank system

controller is considered sufficient. The middle tank x2 is the process value to control. Since set-point tracking is expected, a PI controller is used. The control law is u1 = u10 + 3(w1 − x1 )

u2 = u20 + 10(w2 − x2 ) + 0.1

(w2 − x2 )dt

u5 = −3x3 where u10 = 0.55 and u20 = 0.7 are the input values necessary to sustain the equilibrium in the linearisation point. The pump for the right tank is only controlled in order to have a stable system. In the nominal case, the right tank is empty, therefore, the set-point is w3 = −0.4 and the pump is off: u5 = 0. The valves u3 and u4 are closed in the nominal case. This results in the control structure shown in Fig. 16.4.

Nominal plant

d valve pump

valves

valve

x1

valve pump

x2

x3

u3 u4 u5

z y3 y1

u2

y2

Controller

-

w2

* 10 -

u1

w1

*3

Figure 16.4. Nominal control structure of the 3-Tank system

16.1 Nominal 3-Tank System

219

The poles of the open-loop system are −9 · 10−3 and −11 · 10−3 for the left and the middle tank, while the right tank and the controller both contribute a pole at zero. In the closed loop, the poles move to −10·10−3 for the integrator, −21 · 10−3 for the right tank, and −17.1 · 10−3 and −60.1 · 10−3 for the other two tanks. The result of an experiment with changing reference values is shown in Fig. 16.5. The system tracks the changes with some delay, but the steadystate error is rather small. Note that in this experiment, the controller output uC and the plant input u are identical, because there is no reconfiguration block in the nominal control loop. Both vectors will be different after reconfiguration.

Controller output

1.5 1 0.5 0 −0.5

Left tank

Plant input

Nominal loop 1.5 1 0.5 0 −0.5

uC2 uC1

u2 u1

0.6 0.4

xf 1 Actual level

Middle tank

0.2

w2 Reference xf 2 Actual level

0.15 0.1 0.05 0

50

100 Time t/s

150

200

Figure 16.5. Experiment of the nominal 3-Tank system

Remark. The correct linearisation point for x3 cannot be found using the linear theory used throughout the manuscript, because it only applies to the system once it is linearised. The linearisation point chosen above is reasonable and leads to a working solution. However, a complete solution would involve the analysis of the static nonlinear behaviour of the plant. Several approaches have been developed for this. Discrete methods (as proposed in Lunze and Steffen [2000]) can be used to find a suitable range of state and input values, while considering all applicable restrictions. The problem of finding a stabilisable equilibrium under input limitations as also treated by Pasternak [2002].

220


16.2 Valve 2 Blocked Open This section considers the fault, where the valve u2 is blocked in its open position (u2 = 1). This is slightly different from the Fault 2 defined in Chap. 3, where the valve was assumed to be blocked in the nominal position. The difficulty added here is that the nominal state of the system is no longer an equilibrium, since the valve is open more than normal. The virtual actuator has to correct not only for a missing signal path, but also for the absolute loss of water flowing into the middle tank. The virtual actuator is designed according to Algorithm 8.2. As any linear design, the virtual actuator usually uses all available inputs. For the given fault, a solution is possible by using only the actuators the nominal control structure used, and this solution is pursued here. In order to restrict the set of actuators available for the virtual actuator, the variables u3 , u4 and u5 are also marked as faulty. The corresponding rows are removed from the matrix B. This ensures that the virtual actuator uses only the input variable u1 to stabilise the system. The difference system is     −8.6 0 0 7.1 −4.6 uC1 103 x˙ ∆ =  +8.6 −10.9 0  x∆ +  0 +4.6  uC2 0 0 0 0 0     7.1 −3.8 −  0  uf 1 −  +3.8  uf 2 0 0 yC = x∆ + yf .

(16.1a) (16.1b)

Note that an offset appears in the difference system, because the input uf 2 is fixed to 1, and not to 0 (as assumed in the linear case). The following design process is unaffected by this offset. The relevant part is given by the first two states x∆1 and x∆2 . A stabilising control has to be found for the pair −8.6 0 7.1 , +8.6 −10.9 0 As in Sect. 8.6, the poles for the virtual actuator are chosen slightly faster than the poles of the nominal loop at −0.1 and −0.07. This leads to a control law of (16.2) uf 1 = 21x∆1 + 86x∆2 + uC1 . The term uC1 follows from the requirement, that the control structure should be changed as little as possible. It means that uC1 is passed directly to the plant, and not handled by the virtual actuator (as uC2 ). The virtual actuator is now defined by the equations (16.1) and (16.2).

16.2 Valve 2 Blocked Open

221

Controller output

1.5 1 0.5 0 −0.5

Left tank

Plant input

Reconfigured loop 1.5 1 0.5 0 −0.5

uC2 uC1

uf 2 uf 1

yC1 Virtual actuator (dashed)

0.6 0.4

xf 1 Actual level

Middle tank

0.2

xf 2 Actual level

w2 Reference

0.15 0.1


0.05 0

50

100 Time t/s

150

200

Figure 16.6. Experiment of the 3-Tank system with valve 2 blocked open, using a stabilising virtual actuator

The reconfiguration of the 3-Tank system after this fault is shown in Fig. 16.6. At the beginning of the experiment, everything is working nominally. At the time t = 10 s, the valve u2 blocks in the open position. More water flows into the middle tank and raises its level significantly above the nominal value. The system does no longer respond to changes in the reference trajectory. It is assumed that the fault is detected at the time t = 50 s. The system is reconfigured with the virtual actuator defined by (16.1) and (16.2) five seconds later at t = 55 s. Immediately after the reconfiguration, the system reacts to the deviation from the reference. In order to decrease the level of the middle tank x2 , less water is let into the left tank x1 through the pump u1 . This reduces the pressure and the flow through the open connection valve u2 . The level of x2 gets close to the nominal value, and it reacts to changes in the reference. The response is slightly slower due to the additional pole. Set-point tracking is not restored, however. The level has a constant deviation of about 0.02 m due to the offset introduced by the open valve.2 In addition, the reference changes are only followed to about 90 %. In order to reach 2

In a nonlinear simulation of the plant, the deviation is only about half as high (0.01 m). It follows that about half of the deviation is due to the nature of the reconfiguration solution, while the other half can be attributed to modelling errors.

222


set-point tracking, a design method satisfying the weak reconfiguration goal has to be used. One way to do this is to add feedforward to the virtual actuator as described in Sect. 9.4. The difference system is extended by a state integrating the deviation of the external output x˙ ∆3 = z∆ = x∆2 . The relevant pair to control is (9.14), which becomes for this problem 

   −8.6 0 0 7.1  +8.6 −10.9 0  ,  0  . 0 1 0 0 In addition to the two poles given above, a third pole is needed for the controller design. It is chosen to be −0.04. The resulting controller is given by uf 1 = 27x∆1 + 190x∆2 + 4.5x∆3 . The experimental result is shown in Fig. 16.7. The time of the experiment is extended to 400 seconds in order to show the full settling process. As can be seen, set-point tracking is restored, so that the level of the middle tank x2 Controller output

1.5 1 0.5 0 −0.5

Left tank

Plant input


uC2 uC1

uf 2 uf 1


0.6 0.4

xf 1 Actual level

Middle tank

0.2

w2 Reference

0.15

xf 2 Actual level

0.1


0.05 0

50

100

150

200 Time t/s

250

300

350

400

Figure 16.7. Experiment of the 3-Tank system with valve 2 blocked open, using a virtual actuator designed for the weak goal

16.3 Valve 2 Blocked Closed

223

converges to the reference trajectory. It is also interesting to see that the input of the nominal controller for the level of the middle tank yC2 is very close to the actual plant output yf 2 = xf 2 , while this is not true for the level of the left tank. This demonstrates very nicely the effect of the fault-hiding goal: the necessary reconfiguration action (lowering the level of the left tank xf 1 ) is hidden from the controller. A simulated response according to the nominal plant model is presented to the controller instead. A slight overshoot in the level xf 2 is noticeable after the set-point changes. It results from wind-up of the integrator in the virtual actuator, because the input signal for the pump is limited to uf 1 ∈ [0, 1] by the physical plant. Known anti-wind-up measures could be taken to prevent the overshoot.

16.3 Valve 2 Blocked Closed If the valve u2 is blocked in the closed position, no water can get into the middle tank any more. Therefore, the reconfiguration approach presented above is no longer possible. One of the two other valves u3 or u4 has to be opened in order to maintain the level x2 in the middle tank. The simple solution is to open the valve u3 instead of u2 . Since both valves have nearly the same effect on the system, this can be done using the static reconfiguration block introduced in Chap. 6. The input matrix of the nominal plant was   7.1 −4.6 −3.8 0 0 B =  0 +4.6 +3.8 +3.8 0  0 0 0 −3.8 7.1 while the input matrix of the faulty plant is   7.1 0 −3.8 0 0 Bf =  0 0 +3.8 0 0  0 0 0 0 7.1 Note that the column of u4 is also zeroed out, in order to prevent the reconfiguration from using this input. The static block is determined by uf = SuC with



1 0   S = B+ f B = 0 0 0

0 0 0.8 0 0

 0 0 0 0 0 0  1 1 0  . 0 0 0 0 −0.5 1

(16.3)

16 Reconfiguration of the 3-Tank System Controller output Plant input

Reconfigured loop 1.5 1 0.5 0 −0.5 1.5 1 0.5 0 −0.5

Left tank

224

uC2 uC1

uf 3 uf 1 uf 2

0.6

xf 1 Actual level

0.4

Middle tank

0.2 0.15 0.1

xf 2 Actual level

w2 Reference

0.05 0

50

100

150 Time t/s

200

250

300

Figure 16.8. Experiment of the 3-Tank system with valve 2 blocked closed, using valve 3 and a static reconfiguration block

Since the nominal controller uses only the first two inputs, the first two columns of this matrix are relevant, while the later columns are not. The integration of the state reconfiguration block into the control loop leads to the experimental results shown in Fig. 16.8. The valve u2 blocks at t = 10 s, and the reconfiguration is performed at t = 15 s. While in theory, there should be little difference between the trajectory of the nominal system and the trajectory of the faulty system, the limited effectiveness of the valve u3 is a problem for the practical application. For a set-point of 0.1 m in the middle tank, the reconfiguration solution works fine, but the valve u3 is not able to supply enough flow to reach a level of 0.15 m. Therefore, a change of the reference value to 0.05 m is shown in the simulation. Even for this reduced level, the change from 0.05 m back to 0.1 m takes a long time due to the limited flow.

16.4 Pump 1 Blocked If the pump u1 fails, there is no simple alternative for it. To only possible way to get water in the system is using the other pump u5 . The water is

16.4 Pump 1 Blocked

225

then let into the middle tank via valve u4 . This approach can also be used to reconfigure a blockage in valve u2 , but it is more intrusive than necessary. Since a different part of the system is used with different dynamic, only a dynamical reconfiguration block can solve this problem. Again, a virtual actuator for the stabilisation goal is designed. The difference system is     −8.6 0 0 7.1 −4.6 uC1 x˙ ∆ =  +8.6 −10.9 0  x∆ +  0 +4.6  uC2 0 0 0 0 0   0 0 uf 4 −  +3.8 0  (16.4a) uf 5 −3.8 7.1 (16.4b)

yC = x∆ + yf .

Since the first state is not controllable (but stable), the pair to stabilise is −10.9 0 +3.8 0 , . 0 0 −3.8 7.1 Using the same poles as above (−0.1 and −0.07) leads to the control law x∆2 23 2 uf 4 = . (16.5) uf 5 x∆3 13 11 Since the goal of the system is set-point tracking, the zero placement approach from Sect. 9.3 is used to eliminated the stationary output deviation. The relevant equation is −1 −8.6 0 0 O = 0 1 0  +8.6 −98 −7.6  0 −4.9 −70.5      7.1 −4.6 −3.8 0 0 0 0  0 +4.6 +3.8 +3.8 0  −  +3.8 0  S . 0 0 0 −3.8 7.1 −3.8 7.1



One possible solution is 

0  0  S=  0  1.7 0

 000 0 000 0   000 0   . 0 0 1 −0.17  000 0

The control law with feedback and feedforward becomes

226


  u uf 4 23 2 x∆2 1.7 1 −0.17  C1  uC4 . = + uf 5 13 11 x∆3 0 0 0 uC5

(16.6)

The virtual actuator is defined by (16.4) and (16.6). This leads to the simulation results shown in Fig. 16.9. The fault in the pump happens at t = 10 s, and the reconfiguration is performed within five seconds. In order to stabilise the left tank xf 1 , the valve uf 2 is no longer used. Instead, the right tank xf 3 is filled. It takes a while, before the right tank is filled to a level high enough to bring sufficient water into the middle tank xf 2 . During this period, the level of the middle tank x2 falls below the nominal value, but it is restored via the connection valve uf 4 , as soon as the necessary height is reached in the right tank xf 3 . There is some significant overshoot of the right tank, which is due to wind-up effects in the virtual actuator resulting from the limit of the plant inputs. The equilibrium level is close to the linearisation point at 0.4 m.


Middle tank

uC2 uC1

1.5 1 0.5 0 −0.5

Outer tanks

Plant input

Controller output

A set-point jump is performed at t = 400 s, and the original set-point is restored at t = 500 s. As in the previous fault case, the valve does not have a sufficient opening to increase the level in the middle tank to xf 2 = 0.15 m. Therefore, the set-point is only raised up to w2 = 0.12 m. The response is still very slow, but the set-point value is finally reached.

uf 5 uf 4 u f 1 uf 2

0.6 xf 1 Actual level 0.4


0.2

Actual level

0.15

xf 2 Actual level

0.1

w2 Reference


0.05 0

100

200

300 Time t/s

400

500

600

Figure 16.9. Experiment of the 3-Tank system with valve 2 blocked closed, using the right tank

16.5 Conclusion

227

16.5 Conclusion This chapter has demonstrated the applicability of the virtual actuator. All the reconfiguration experiments for the 3-Tank system were successful. The virtual actuator for every single experiment was found using the automatic reconfiguration algorithms given earlier, and no manual intervention was necessary. For this example, the same design parameters were used to design all virtual actuators. Even the offset introduced by the connection valve being stuck in an open position did not pose any serious problem to the application of the virtual actuator. Throughout the experiments, two aspects have reoccurred, which may be the basis for the further improvements. The virtual actuator has some difficulties in dealing with input limits. This does not lead to instabilities for this simple example, but there is some noticeable wind-up. Therefore, a good anti-windup solution for the virtual actuator could improve the control quality of the reconfigured loop. Related to this aspect is the choice of the linear model. While the virtual actuator can choose a suitable equilibrium based on the linear system, for a nonlinear system, the extrapolation of the linear model can lead to deviations between the modelled and the real behaviour. Therefore, it could be more appropriate to determine the new equilibrium first and linearise the system around this point.

17 Reconfiguration of a Helicopter Model

17.1 Helicopter Model A two-degrees-of-freedom helicopter experiment (see Fig. 17.1) is used as a more complex reconfiguration example. As demonstrated by Lunze et al. [2003], this system lends itself for control reconfiguration after actuator faults. It consists of a main lever that can rotate in two dimensions around its centre. Strong rotors are positioned at both ends which can create an upward force by blowing air down. The speed of the rotors can be controlled, and they

Figure 17.1. Picture of the flight model Thomas Steffen: Control Reconfiguration of Dynamical Systems: Linear Approaches and Structural Tests, LNCIS 320, 229–242 (2005) c Springer-Verlag Berlin Heidelberg 2005 www.springerlink.com

230

17 Reconfiguration of a Helicopter Model u3

γ1 β

γ2

u1

u4

α u5

u2

Figure 17.2. Diagram of the flight model

can be rotated around the axis of the lever to change the direction of the force. There is a second set of smaller rotors that can only blow air sidewards (tangentially). A sketch of the system is shown in Fig. 17.2. A similar system without the redundant lateral rotors is studied by López-Martínez and Rubio [2003]. This treatment focuses on the rotational movement of the system around the vertical axis. The lever can also rotate around a horizontal axis. In the linear case, both movements are completely decoupled, while in the nonlinear model there is some moderate cross-coupling. For the practical experiments, the rotation around the horizontal axis is stabilised in level position using a controller acting on the speed of the two main rotors. Since a fault in either rotor renders the system unstable without any possibility to control it, no reconfiguration is attempted for this part of the system. Two fault scenarios are considered that demonstrate different aspects of reconfiguration. The first one assumes that the nominal control structure uses the two main rotors to stabilise the system. The fault makes one or both of the servo-mechanisms fail, so that the direction of the corresponding rotors cannot be changed any more. The reconfiguration can make use of the remaining servo-mechanism and/or the lateral rotors to control the plant. In the second scenario, the nominal control structure uses only the lateral rotors to control the system. If they break, the reconfiguration has to use the servo-mechanisms to stabilise the plant. Since a reasonably complete nonlinear model of the system is very complex, only a linear model for the rotation around the vertical axis will be given here. The model has seven states: speed and angular position of both servomotors (x1 = γ˙ 1 , x2 = γ1 , x3 = γ˙ 2 , x4 = γ2 ), speed of the lateral rotors ˙ x7 = β). It is a (x5 = n), and speed and angular position of the lever (x6 = β, good approximation of the nonlinear system for angles γ up to about 0.5 rad (≈ 30◦ ). Higher angles influence the vertical thrust of the main rotors in such

17.1 Helicopter Model

231

a way that the stability of the vertical degree is in danger. Therefore, one of the control objectives is to keep these angles within a reasonable range. A block diagram of the system is shown in Fig. 17.3. The two servo controllers are included in the plant, since they stabilise some of the states and make the system easier to handle. The resulting plant model for the nominal case is     360 0 0 −8 −360 0 0 0 00   1 0 0 0 0 0 0   0 0 0    0 0 −8 −360 0 0 0  0 360 0       0 1 0 0 0 0 (17.1a) x˙ = 0 x+  0 0 0 u    0 0 0 14 0 0 0 −5 0 0      0 0.6 0 0.6 0.6 0 0  0 0 0  0 0 0 0 0 0 0 0 10

y = x2 x4 x7 (17.1b) z = x7 (17.1c) (17.1d)

x(0) = x0

with the state x ∈ R7 , the input u ∈ R3 , the sensors output y ∈ R3 and the position output z ∈ R to control. The structural graph of the system is shown in Fig. 17.4. The plant has a double pole at 0, a double pole pair at −4 ± 18.5i and a pole at −5. Servo controller

Nominal plant

Servo motor

x1

u1 3

10 s/12+1

3

10 s/12+1

x2 1 s+1

Lever dynamic

x3

u2

x4 1 s+1

x6 0.6 s

x7 1 s

-

z y3

u3

Lateral rotor

0

1 s/5+1

x5

Controller

D-branch s s+5

3

-

w3

Figure 17.3. Block diagram of the helicopter model

232

17 Reconfiguration of a Helicopter Model y2 x3

u2

x4 z

u3

x5

u1

x2

x6

x7 y3

x1

y1

Figure 17.4. Structural graph of the helicopter mode

Since the plant contains a double pole at zero, no proportional controller can be used to stabilise it. Therefore, a controller with a differentiating branch is used. The nominal control law is u1 = u2 = (w3 − y3 ) − y˙ 3 ,

Plant input

Controller output

and the realisation pole of the differentiation is placed at −5. The closed-loop poles are all stable: a pair at −0.14±1.5i, a double pairs at −4±18.5i and two single poles at −5 and −5.2. The step response of the experiment is shown in Fig. 17.5. Nominal loop 2

uC1 = uC2 main rotors

0 −2 2

uf 1=uf 2

0

uf 3

Position

Rotor angles

−2 1

yf 1 ≈ yf 2

0 −1

1.5 1 0.5 0 −0.5

yf 3 Actual position

w3 Reference

yC3 VA position (dashed) 0

5

10

15 Time t/s

20

25

30

Figure 17.5. Experiment of the nominal helicopter model

17.2 Fault in a Main Rotor

233

Three aspects are worth mentioning. Firstly, there is a significant amount of overshoot. This could be reduced by fine-tuning the positions of the eigenvectors of the closed-loop system, but there will always be a trade-off between speed and overshoot. It is not possible to improve one aspect of the behaviour without having a negative impact on the other. Secondly, the noise of the position measurement is amplified by the controller and leads to rather volatile input signals. This could be dampened by filtering the signal, at the expense of introducing further poles. Finally, the servo controllers tend to show oscillations. There are many ways to prevent this, but they all lead to some steady state error of the servo and therefore of the whole system. According to Algorithm 15.1, the first step of the reconfigurability analysis is performed off-line without knowledge of the fault. It determines which part of the system is stable, and which part is not. The system matrix is already in block triangular form, therefore no transformation is necessary. The two servo systems (x1 /x2 and x3 /x4 ) are stable, as is the lateral rotor system (x5 ). However, the dynamic of the lever has two zero poles, which means it is unstable. Therefore, the states x6 and x7 have to be stabilised, or the system will not be stable.

17.2 Fault in a Main Rotor This sections considers a fault in a servo-mechanism of one of the main rotors. Due to the fault, the direction of the rotor is fixed. This means that the corresponding servo input u1 or u2 has lost the influence on the system. Note that the rotor itself is still assumed to be rotating, so that the lever is kept in the horizontal plane by speed control of the main rotors. It is assumed that the first servo-mechanism u1 is broken. This changes the input matrix of the system from     0 0 0 360 0 0 0 0 0   0 0 0       0 360 0   0 360 0         B=  0 0 0  to Bf =  0 0 0  .  0 0 14   0 0 14      0 0 0   0 0 0  0 0 0 0 0 0 The resulting delta model is very similar to the model of the faulty plant, but the broken actuator appears as a disturbance:

234


 −8 −360 0 0 0 0 0  1 0 0 0 0 0 0    0 0 −8 360 0 0 0    0 1 0 0 0 0 =  x∆  0   0 0 0 0 −5 0 0    0 0.6 0 0.6 0.6 0 0  0 0 0 0 0 10     360 0 0 0 0  0 0 0  0 0      0 360 0   360 0    uf 2       +  0 0 0  uC −  0 0   0 0 14   0 14  uf 3      0 0 0  0 0 0 0 0 0 0

= x∆2 x∆4 x∆7 

x˙ ∆

y∆ z∆ = x∆7 x∆ (0) = 0 ,

(17.2a)

(17.2b) (17.2c) (17.2d)

where uC ∈ R3 denotes the controller output and uf the actual input of the fault plant. The goal is to find an input uf which stabilises the difference model and restores the nominal output (z∆ vanishes). The structural analysis according to Algorithm 15.1 is based on the structural graph of the difference system, as shown in Fig. 17.6. It reveals that there is no dilation, but the states x1 and x2 are not connected to a control input. Since these states where found to be stable in the off-line analysis, the difference system is stabilisable (it is even strong structurally stabilisable). The sufficient condition for the weak goal to be reachable is   ∗∗00000∗00 ∗ 0 0 0 0 0 0 0 0 0   0 0 ∗ ∗ 0 0 0 0 ∗ 0   0 0 ∗ 0 0 0 0 0 0 0  smin-rank  0 0 0 0 ∗ 0 0 0 0 ∗ = 8 .   0 ∗ 0 ∗ ∗ 0 0 0 0 0   0 0 0 0 0 ∗ 0 0 0 0 000000∗000 By swapping several columns, the matrix can be rearranged to

17.2 Fault in a Main Rotor



∗ 0  0  0 smin-rank  0  0  0 0

235



∗000000∗0 ∗ 0 0 0 0 0 0 0 0  0 ∗ ∗ 0 ∗ 0 0 0 0  0 0 ∗ 0 0 0 0 0 0 =8 0 0 0 ∗ 0 0 0 0 ∗  0 0 0 0 ∗ 0 0 ∗ ∗  0 0 0 0 0 ∗ 0 0 0 000000∗00

which is obvious. Therefore, the weak reconfiguration goal can be satisfied. The condition for the strong goal is checked using the structural graph. As shown in Fig. 17.6, there is a (single) path from the control input uf 3 to the output z of width 3, which is no longer than the shortest path from a disturbance input to the output. Therefore, the disturbance decoupling problem is solvable, which is a necessary condition for reaching the strong reconfiguration goal. uf 2 uC2

uC1 uf 3

x∆3

x∆4

x∆1

x∆2

x∆6

x∆7

zd

x∆5

uC3

Figure 17.6. Control path in the structural graph of the difference model

In order to keep the result simple, only the stabilisation goal is pursued using Algorithm 8.2. Since pole placement is not suitable for dealing with parallel structures (as the two servo-motors), an LQ design will be used to find the stabilising feedback. All inputs and states are weighted equally, with the exception of x6 and x7 , which are weighted 10 times respectively 100 times stronger. This leads to the criterion I = x2∆1 +x2∆2 +x2∆3 +x2∆4 +x2∆5 +10x2∆6 +100x2∆7 +u2f 1 +u2f 2 +u2f 3 dt . (17.3) Note that x∆1 , x∆2 and uf 1 are not relevant, because they are not controllable. The resulting feedback law is uf 2 0 0 0.97 0.6 0.05 0.83 1.1 (17.4) = x∆ . uf 3 0 0 0.002 0.73 1.0 5.2 9.9 This control law leads to closed-loop poles of −1.3 ± 0.02i, −1.5, −4 ± 18i, −16 and −359.


Plant input

Controller output

236

Reconfigured loop 2


0 −2 2

uf 1=uf 2

0

uf 3

Position

Rotor angles

−2 1

yf 1 ≈ yf 2

0 −1

1.5 1 0.5 0 −0.5

w3 Reference yf 3 Actual position yC3 VA position (dashed) 0

5

10

15 Time t/s

20

25

30

Figure 17.7. Reconfiguration experiment after fault of one servo

Performing the experiment with the virtual actuator as defined by (17.2) and (17.4) leads to the results shown in Fig. 17.7. It can be seen that the nominal controller uses the input variables uC1 and uC2 , while the virtual actuator uses the inputs uf 2 and uf 3 . Due to the additional poles, the response is slightly slower than in the nominal case. The input signals remain at very moderate values. This confirms the results of the theoretical analysis of this approach seen in Sect. 8.5. The trajectory of the virtual actuator output (dashed line in the plot) is interesting, because it should be equal to the nominal response of the system. However, it is obviously slightly slower. This can only be explained by modelling errors in the model of the plant. It partly explains the slow response of the reconfigured loop, because the virtual actuator tries to follow the simulation response.

17.3 Fault in Both Main Rotors This sections considers a fault in both servo-mechanisms of the main rotors. Due to this fault, the main rotor directions are fixed, leaving only the lateral rotors u3 to control the system. The input matrix of the system changes from

17.3 Fault in Both Main Rotors

     B=    

360 0 0 0 0 0 0

0 0 360 0 0 0 0



237





0 00 0 0 0 0  0    0 0 0  0       0  to Bf =  0 0 0  .    14   0 0 14    0 00 0  0 00 0

The structural analysis leads to the same results as for the fault of only one main rotor. However, since only one actuator remains, it can be used either to satisfy the strong reconfiguration goal or to place the poles of the difference system (both is not possible). A virtual actuator for the strong goal will be designed in order to further analyse the system. Algorithm 15.2 is used for this (which make use of Algorithm 10.4 for the decoupling step). The reduction of the structural graph according to Algorithm 13.7 leads to the structural graph shown in Fig. 17.8. The variables x6 and x7 are not required for the virtual actuator. The disturbance decoupling problem is therefore defined on the reduced difference system   −8 −360 0 0 0  1 0 0 0 0     x∆ 0 0 −8 −360 0 x˙ ∆ =  (17.5a)    0 0 1 0 0  0 0 0 0 −5     360 0 0 0  0 0 0   0    

   +  0 360 0  uC −  0  uf 3  0 0 0   0 0 0 14 14 uf 2 uC2

uC1 uf 3

x∆3

x∆4

x∆1

x∆2

zd

x∆5

uC3

Figure 17.8. Control path in the reduced structural graph of the difference model

238


y∆ = x∆2 x∆4 0 0.6x∆2

z∆ = x∆ (0) = 0 .

+

0.6x∆4

(17.5b) +

0.6x∆5

(17.5c) (17.5d)

The decoupling is performed according to Algorithm 14.5. The first connection to the output is found at i = 0:

Bf C = 0 0 8.4 . Input uf 3 is used to decouple output z. The resulting matrices are   0 0 0 0 0 0 0 0 0  M= 0 −0.57 0.07 −0.57 0.07 −2.8   000 S = 0 0 0 001   10 Q = 0 1 . 00 The two input variables uf 1 and uf 2 are also decoupled, so that they could be used to stabilise the difference system. However, both have no effect on the system, therefore no feedback control can be applied. Therefore, the control law is

(17.6) uf 3 = −0.57 0.07 −0.57 0.07 −2.8 x∆ + uC3 . An analysis of the decoupled difference system reveals that it is stable: it has a double pole pair at −4.0 ± 18.5i and a single pole at −0.1. The solution can be verified numerically to satisfy the weak reconfiguration goal and the fault-hiding goal. For the practical test, a reconfiguration experiment has been performed using the virtual actuator consisting of the different model (17.5) and the control law (17.6). The resulting trajectory of the reconfigured faulty plant in Fig. 17.9 has to be compared to the experiment with the nominal loop from Fig. 17.5. As predicted by the theoretical analysis in Sect. 10.6, the trajectory is similar to the response of the nominal loop. It is however noticeably slower, which can again be explained by modelling errors (since this effect is not visible in a simulation run). Apart from this deviation, the reconfiguration is very successful. The overshoot is even slightly lower than in the nominal case, and the system has a

17.4 Fault in the Lateral Rotors

239

Plant input

Controller output

good stability margin. The input value uf 3 stay moderately low, barely touching the limits. One interesting effect is that the signal uf 3 shows the same small oscillations as the servo-mechanisms. This is a sign that the tendency for oscillations in the servo control is simulated by the virtual actuator.

Reconfigured loop 2


0 −2 2

uf 1=uf 2

0

uf 3

Position

Rotor angles

−2 1

yf 1 ≈ yf 2

0 −1

1.5 1 0.5 0 −0.5

w3 Reference yf 3 Actual position 0

5

10

15 Time t/s

20

25

30

Figure 17.9. Reconfiguration experiment after a fault in both servos

17.4 Fault in the Lateral Rotors The last experiment will consider the opposite direction of input substitution. The nominal control structure uses only the lateral rotors. It is assumed that they become ineffective due to a fault, so a control reconfiguration has to be performed in order to use the main rotors. The nominal control law is u3 = (w3 − y3 ) − y˙3 , which leads to the step response shown in Fig. 17.10.


Plant input

Controller output

240

Nominal loop 2

uC3 lateral rotors

0 −2 2

u3

0

u1 = u2

Position

Rotor angles

−2 1

y1 ≈ y2

0 −1

1.5 1 0.5 0 −0.5

w3 Reference y3 Actual position 0

5

10

15 Time t/s

20

25

30

Figure 17.10. Experiment for the nominal flight system using the lateral rotors only

The difference model for this fault case is   −8 −360 0 0 0 0 0  1 0 0 0 0 0 0    0 0 −8 360 0 0 0    0 1 0 0 0 0 x˙ ∆ =   x∆  0   0 0 0 0 −5 0 0    0 0.6 0 0.6 0.6 0 0  0 0 0 0 0 10     360 0 0 360 0  0 0 0  0 0       0 360 0   0 360       uC −  0 0  uf 1 0 0 0 +      0 0 14   0 0  uf 2      0 0 0  0 0  0 0 0 0 0

y∆ = x∆2 x∆4 x∆7 z∆ = x∆7 x∆ (0) = 0 .

(17.7a)

(17.7b) (17.7c) (17.7d)

17.4 Fault in the Lateral Rotors

241

The structural tests are similar to the results for the first fault case, with the exception of the test for the strong reconfiguration goal. As shown in the structural graph in Fig. 17.11, the disturbance path uC3 → x5 → z is shorter than any control path. Therefore, the strong reconfiguration goal cannot be reached. For simplicity reasons, only the stabilisation goal will be pursued here. uf 1 uC1

x∆1

x∆2

x∆3

x∆4

uf 2 x∆6

x∆7

zd

uC2 uC3

x∆5

Figure 17.11. Disturbance path in the graph of the helicopter model

The state x∆5 of the difference system is not controllable; it is therefore removed for the controller design. An LQ design method is used to find the controller, with the same weight as defined in (17.3). This results in the stabilising control law 0.083 0.09 0.002 0.085 0 1.3 0.7 uf 1 (17.8) = x∆ . uf 2 0.002 0.083 0.085 0.09 0 1.3 0.7 The virtual actuator is given by (17.7) and (17.8). It adds a double pole pair at −18.4 ± 4.5i and a further pair at −0.8 ± 0.5i. The pole of x∆5 at −5 is not controllable. The behaviour of the reconfigured system is shown in Fig. 17.12. As expected, the response of the reconfigured system to changes in the reference is very close to response of the nominal system. There is some difference in the controller input yC and output uC compared to the nominal loop in Fig. 17.10. Since the theory predicts no such change, it is caused by modelling inaccuracies. Nevertheless, the control performance is impressive: the system is very fast, the overshoot is no higher than in the nominal situation, the input signals stay within reasonable range, and the set-point tracking property is restored. This is mainly due to the fact that the main rotors can produce a rather high force, which makes them a good alternative for the broken control input.


Plant input

Controller output

242

Reconfigured loop 2

uC3 lateral rotors

0 −2 2

uf 1=uf 2

0

uf 3

Position

Rotor angles

−2 1

yf 1 ≈ yf 2

0 −1

1.5 1 0.5 0 −0.5

w3 Reference yf 3 Actual position yC3 VA position (dashed) 0

5

10

15 Time t/s

20

25

30

Figure 17.12. Experiment for reconfiguration after a fault in the lateral rotors of the helicopter model

17.5 Conclusion For the helicopter model (as for the 3-Tank system), all reconfiguration problems could be successfully solved using the theory from Part II. It seems that the model used for the reconfiguration could be improved, since effects caused by modelling inaccuracies have been found in several results. Nevertheless, the control performance of each reconfiguration solution is very impressive. This allows two conclusions. Firstly, the helicopter model is well suited for reconfiguration due to its redundant signal paths. Secondly, the theoretical solutions to the reconfiguration problem are applicable to typical practical problems.

18 Conclusion

18.1 Summary This chapter mentions the main results of the manuscript. The motivation was to find methods for autonomous control reconfiguration after faults. Because no manual intervention is possible, the problem has to be solved automatically, and before the fault renders the system unsafe. This motivation affects both the problem definition and the solutions. In Part I of this manuscript, the reconfiguration problem is formally defined. The definition is inspired by the 2-Tank example, which goes back to earlier works. The distinguishing aspect of this definition is that it tries to describe a wide range of practical problems. In order to accommodate for different control objectives, five reconfiguration goals of different strength are defined: the stabilisation goal, the weak and the strong reconfiguration goal, the direct goal and the fault-hiding goal. The latter is only a technical goal, but it proves to be the key for finding an autonomous solution. Part II presents the solution approaches, sorted according to the reconfiguration goals. The fault-hiding goal determines the structure of the reconfiguration block which is inserted into the control loop, and the further goals determine the parameter. Depending on the goal, different control problems are formulated in order to find the solution. For example, the stabilisation goal leads to a classical state-feedback controller design problem, while the strong reconfiguration goal leads to a disturbance decoupling problem. No specific method is chosen to solve the control problem, but an optimal design (linear quadratic) has been found to be superior to pole placement. Because the weights can be chosen at design time without knowledge of the fault, the reconfiguration itself is completely autonomous. Reasonably efficient algorithms have been presented for all goals. With the exception of the strong reconfiguration goal, all algorithms can be demonstrated to be complete; they find a solution as long as the problem is solvable. Thomas Steffen: Control Reconfiguration of Dynamical Systems: Linear Approaches and Structural Tests, LNCIS 320, 243–245 (2005) c Springer-Verlag Berlin Heidelberg 2005 www.springerlink.com

244

18 Conclusion

The main emphasis for these approaches is on the reconfiguration after actuator faults, because it is the problem treated least in the literature. However, the reconfiguration after sensor faults and after actuator faults is found to be dual. Therefore, the corresponding approaches for sensor faults are mentioned briefly. An approach for the reconfiguration after internal faults (changes in the matrix A) is sketched, but it is not pursued in detail. It is more complicated than desired, but no easier solution could be found. In Part III, the reconfiguration problem for structured systems is treated. This is crucial for a satisfactory solution, since the requirement to make only minimal changes to the system is of a structural nature (and cannot be treated using linear theory). A test for the reconfigurability of a system according to the different goals is constructed. Two algorithms are given that reduce the system of the reconfiguration problem to the relevant part. While these algorithms work well for eliminating unused output and state variables, it does not solve the (ambiguous) problem of selecting between equally suitable inputs. Based on the structural tests, a novel method for solving the disturbance decoupling problem is presented. The part concludes with an autonomous design algorithm that can select a feasible reconfiguration goal and solve it. This last part (Part IV) has shown the applications of the algorithms to practical experiments. Two different systems with several different faults and reconfiguration problems have been treated and tested experimentally. All studied cases have been treated successfully and in accordance with the theoretical predictions. However, the virtual actuator is found to lack a suitable anti-wind-up measure. On the other hand, it proves to be very robust, which is not obvious from the theoretical treatment. It can be concluded that the linear reconfiguration problem after actuator faults (as defined here) has been treated successfully and extensively in this manuscript. Only minor aspects of this problem remain unanswered. However, there are many related aspects that could not be treated here.

18.2 Outlook Since this manuscript focuses on actuator faults, approaches to other fault locations are only covered very briefly. The given solution for the reconfiguration after internal faults (changes in A) is rather complex, since it involves both an observation and a control problem. It should be possible to combine both into one consistent approach, although it is not clear whether the complexity can be reduced by this. Further research should aim at either finding a simpler solution, or at demonstrating that no simpler solution is possible. Only linear systems are treated within this manuscript. There are several promising areas for the extension to certain classes of nonlinear systems. The

18.2 Outlook

245

treatment of systems with static nonlinearities at the output or input should be trivial. This could also lead to an anti wind-up measure for the virtual actuator. Bilinear systems may be harder to deal with, if the plant state cannot be measured. General nonlinear systems as used for the original definition of the problem are certainly very difficult to treat: the transformation of the difference system is not possible, and the design of a stabilising controller may be challenging. On the other hand, the disturbance decoupling problem can easily be applied to general nonlinear systems. This may be a starting point for a powerful nonlinear reconfiguration approach. Finally, more research on structural methods seems very promising. There has been little research on this topic in the 90s, and virtually none since. Within the given framework, the relation between the strong structural (sufficient) and the structural conditions (necessary) deserves further treatment. The introduction of coupling variables has not been studied in any general sense. While it works for some uses (path width and amplification), the effect on the structural rank is still unstudied. It may be useful to extend the structural model to mark the locations of parameters changed by the faults, instead of using two separate models for the nominal and the fault case. Using only one model may be more efficient and more precise. Finally, the extension of structural analysis to nonlinear systems is a promising field. Since it requires differential analysis, it may also be challenging to derive rigorous results. If this manuscript could inspire further research into this area, it would be very welcome.

Part V

Appendices

A Glossary

A.1 Terms of Fault-Tolerant Control Unfortunately, many technical terms are used with inconsistent meanings throughout the fault-tolerant control community. An description of common usage can be found in van Schrick [2000], but this overview does not solve the problem of confusing overlaps in meanings. Therefore, this manuscript follows the semantics defined in Blanke et al. [2003]. The most important definitions will be stated here. Availability Likelihood that a system will operate satisfactorily. Fault-tolerant control aims at increasing the reliability by maintaining the system operational despite faults. The alternative is to make faults less likely. Error Deviation between the correct (specified) and the measured or reached values. Note that fault and error are completely orthogonal definitions. Typical errors include the steady state error (deviation between set-point and equilibrium) and the observation error (deviation between actual and observed state). Failure interruption of the ability of a system to perform its function. Fail-operational A system is fail-operational, if it is able to operate with no relevant change in objective or performance despite of any single fault. Example: the 3-Tank example is fail-operational for all mentioned faults. Fail-safe A system is fail-safe, it a failure does not affect the safety of the system. Example: the 3-Tank system is physically fail-safe, as long as no leakage occurs. If a leakage occurs, it depends on the control system how much water is lost and whether this is considered harmful. Fault A component is said to be at fault or faulty, if it does not perform the required (designed) function. The fault has a location, a strength and a

250

A Glossary

temporal distribution. For this manuscript, only the location is of interest. Note that in common language, fault has many different meanings, but only this one is used here. Examples for faults: a clogged valve, a broken pump, or a leakage in a tank. Fault case Specific constellation of faults. The fault case describes all faults in the system. Fault detection Determination of the presence of faults (and the time of occurrence). The fault detection only states the existence of one or several faults, but neither its location nor its strength. Fault identification Determination of kind, location and strength of a fault. This manuscript assumes that the fault is unambiguously identified, before the reconfiguration is performed. Fault-tolerant system System where a fault in a component does not lead to a failure of the whole system. Recoverability Possibility to accommodate the fault or to reconfigure the system successfully. Redundancy More than one means for performing a required function (van Schrick [2000]). Example: in the 3-Tank system, the higher and the lower valve between the left and the middle tank are redundant, because both can perform the same function. Different kinds of redundancies can be defined, but this manuscript does not depend on these distinctions. Quantitative model A system model describing the behaviour in analytical terms. The model defines both the structure and the parameters of the system. Safety State in which the system causes no harm or damage (van Schrick [2000]). Note that safety is a relative property. Example: A chemical reactor is safe as long as no leakage occurs. While fault-tolerant control can increase the safety, this is not the main emphasis of this manuscript. Severity A measure on the seriousness of a fault. This manuscript focuses on complete faults, which means that a component has lost all of its function. Example: a valve can be clogged, which reduces the flow through it, or it can be blocked, which means that there is no flow at all. Structural analysis Analysis of the properties depending only on the structure of a system, and not on the parameters. Example: an output value cannot be used to control an input value, because there is no signal path in this direction. Supervision Monitoring a system and taking appropriate actions to maintain its operation. Note: depending on the formulation of the problem, reconfiguration can be part of the supervision, or it can be the action to maintain

A.2 List of Important Symbols

251

the operation. Supervision is more than reconfiguration, because it can decide to pursue a completely different operation, if the current operation is no longer possible. For example, if the plant can no longer produce product A due to a fault, supervision could decide to switch to product B instead.

A.2 List of Important Symbols Symbol A AT A−1 A+ −1 A {x} Af AS A∗S aj,k A11 A12 A21 A22 A, B C, D C C− Cg ⊆ C− C G(s) I,In im A ker A nu , nx , ny O, On×m R R+ , R=0 rank A s-rank AS smin-rank AS σ(A) u, x, y V ˙ x(t) ∗

Meaning real valued matrix transpose of A inverse of an invertible matrix A pseudo-inverse of a matrix A: AA+ A = A set-inverse of A applied to {x}: {y|x = Ay} value of A after a fault occurred structural matrix corresponding to A potence matrix IS ⊕ AS ⊕ AS ⊗ AS ⊕ · · · element of A at row j and column k submatrices of A system and input matrix: x˙ = Ax + Bu output matrix and feedthrough: y = Cx + Du set of complex numbers set of complex number with a negative real part design set, which has at

element least one real controllability matrix I A A2 · · · B transfer function matrix C(Is − A)−1 B unity matrix (of dimension n × n) image of a transformation A: {y|∃x : y = Ax} kernel of a transformation A: {x|Ax = 0} number of input/state/output variables zero matrix (of dimension n × m) set of real numbers set of positive/nonzero real numbers numerical rank of the matrix A structural rank (term rank) of a (structural) matrix lower structural rank of a (structural) matrix set of eigenvalues of a matrix A input, state and output of a state space system controlled invariant subspace: (A − Bf K)V ⊆ V d time derivative dt x(t) (x˙ for short) nonzero entry (in a structural matrix)

B RECONF – A Toolbox for Reconfiguration

B.1 Overview The purpose of the toolbox RECONF is to facilitate the design of a virtual actuator, and to help with the simulation of the reconfigurable system. The toolbox is divided into several levels of different complexity, but the user of the toolbox has to access only the top two levels. Fig. B.1 gives an overview over these levels. In the present form, the toolbox only deals with the reconfiguration of actuator faults (using the virtual actuator). Since the design of a virtual sensor is a dual problem, the design function should also be applicable for sensor faults. However, the required integration with Simulink has not been completed yet.

B.2 MATLAB Functions The first part of the toolbox provides functions for basic operations with structural matrices. Some functions are already provided by MATLAB (see Fig. B.2), therefore, these functions are not duplicated. The toolbox contains basic functions like the addition and the multiplication of structural matrices, but also more abstract functions like the reduction of a system to the structurally controllable part (see Fig. B.2). Many of these functions are inspired by the structural toolbox written by Jantzen [1996]. The second set of functions deals with the disturbance decoupling problem (see Fig. B.4). Five functions are implemented that correspond to the central algorithms from Chap. 14. These functions are used to analyse and solve the strong reconfiguration problem.

254

B RECONF – A Toolbox for Reconfiguration MATLAB

Basic structural functions

Disturbance decoupling functions

Virtual actuator design

Real-time blocks

Virtual actuator block

linmod (Control TB)

RECONF toolbox

Figure B.1. Overview of the RECONF toolbox Table B.1. Functions for structural analysis provided by MATLAB Function Name Function Description any(M,i) all(M,i) sprank(M) dmperm(M)

or operator over matrix dimension i and operator over matrix dimension i returns the structural rank of a matrix returns a maximal matching of a matrix

Table B.2. Basic structural functions Function Name Function Description

Reference

smat(M) sadd(A,B) sprod(A,B) sreach(M) scontrb(A,B) ssrank(A,B,C) sreduced(A,B,C) ss2dot(A,B,Bf,C)

Sec. 11.2 Sec. 11.2 Def. 11.14 Thm. 12.3 Thm. 13.4 Sec. 12.2

matrix to structural matrix structural matrix addition structural matrix product reachability matrix test for structural controllability structural rank of a system reduce system to the s-contr. part convert system into “dot” and draw the graph using McDaniel [2004]

B.3 Simulink Integration

255

Table B.3. Disturbance decoupling functions Function Name

Function Description

Alg.

ddp_reduce(A,B,C) ddp_path(A,B,C,nu) ddp_degree(A,B,C,nu) ddp_strong(A,B,C,nu) ddp_multi(A,B,C,m,nu)

reduce a DDP to the minimal system cancel a single output variables cancel all output vars of one degree test for strong structural decoupling decouple all outputs

13.7 14.5 14.8 14.3 14.9 14.11

The most abstract set of MATLAB functions contains solutions for the reconfiguration problem. Different algorithms (as derived in Part II) are implemented to solve the different reconfiguration goal (see Fig. B.4). The last function (reconf_test) test which reconfiguration goal is reachable for a given system. These functions are used by the Simulink block of the virtual actuator to calculate the necessary parameters. Table B.4. Disturbance decoupling functions Function Name

Goal

Method

Reference

reconf_pinv(B,Bf) reconf_stab(A,B,P) reconf_zero(A,B,Bf,C,M) reconf_integr(A,B,Bf,C,P) reconf_ddp(A,B,Bf,C,P) reconf_test(A,B,Bf,C)

Direct Stabilise Weak Weak Strong test all

Pseudo-inverse State feedback Zero placement Integral control Dist. decoupling Struct. analysis

Alg. 6.2 Alg. 8.2 Alg. 9.2 Thm. 9.3 Alg. 10.4 Alg. 15.1

B.3 Simulink Integration The integration with simulink contains of three parts: a Simulink block for the virtual actuator, a way to linearise the faulty plant, and a function to calculate the parameters of the virtual actuator based on the linear model. The virtual actuator is implemented as a block with the inputs uC and yf and the outputs uf and yC (see Fig. B.2). Since Simulink does not allow for changing a library block, only the core functionality is provided by this block. It is then embedded into another block, which contains the linearisation input and output block (see Fig. B.3). The parameters of the virtual actuator block are shown in Fig. B.4. They include the specification of the input and output spaces, the design parameters and the names of the plant models. The remaining parameters are set by the design algorithm.

256

B RECONF – A Toolbox for Reconfiguration

Figure B.2. Implementation of the virtual actuator

Figure B.3. Linearisation blocks for the virtual actuator

The linearisation is based on the function linsub (block, in-block, out-block) provided by Simulink. It is performed by the toolbox function reconf_sim_lin (VA_block). The actual reconfiguration is performed by the function reconf_sim_va (VA_block, faults, method). This function can be called in an open function of a block, such that the reconfiguration can be started manually. It can also be called automatically by a diagnostic system (which is not included in the toolbox). Note that as of the time of writing, the function does not handle several virtual actuators within one MATLAB workspace very well. All three steps are combined in the example Simulink system template.mdl (see Fig. B.5).

B.3 Simulink Integration

Figure B.4. Arguments of the virtual actuator

u

Figure B.5. Example system using the virtual actuator

257

Curriculum Vitae of the Author

Thomas Steffen was born in the German town of Göttingen on the 30th of June 1975. He studied electrical engineering from 1994 to 1999 at the Technical Univerisity of Ilmenau in Thuringia. As part of the course, he took the 3rd year of electronics systems engineering during the academic year 1996/1997 at the UMIST in Manchester, UK. After a work placement at Thurnall PLC, he returned to Ilmenau to specialise in automation and control. The course was completed with a research project on the control of cascaded dams at the waterway administration (Bundesanstalt für Wasserbau) in Karlsruhe in southern Germany, and he was awarded the title of “Diplom-Ingenieur” in March 1999. In April 1999, Thomas Steffen started research on “Control Reconfiguration” at the Technical University of Hamburg-Harburg. He participated in the COSY project of the European Union, and he contributed to the KONDISK project on hybrid systems by the Deutsche Forschungsgesellschaft (DFG). In late 2002, he moved with Prof. Lunze to Bochum, where he completed his PhD thesis in March 2005. He is now working on intelligent message routing technology for mBalance in Amsterdam.

References

J. Ackermann. Robuste Regelung. Springer–Verlag, Berlin, 1994. G. Basile and G. Marro. Controlled and Conditioned Invariants in Linear System Theory. Prentice Hall, 1992. ISBN 0-13-172974-8. http://www.deis.unibo.it/Staff/FullProf/GiovanniMarro/gm_books.htm. G. Bengtsson and S. Lindahl. A design scheme for incomplete state or output feedback with application to boiler and system control. Automatica, 10(1): 15–30, 1974. ISSN 0005-1098. M. Blanke, C. W. Frei, F. Kraus, R. J. Patton, and M. Staroswiecki. Faulttolerant control systems. In K. Åstrom, P. Albertos, M. Blanke, A. Isidori, W. Schaufelberger, and R. Sanz, editors, Control of Complex Systems, chapter 13, pages 285–316. Springer Verlag, London, 2000a. ISBN 1-85233-324-3. M. Blanke, C. W. Frei, F. Kraus, R. J. Patton, and M. Staroswiecki. What is fault-tolerant control? In Proceedings of SAFEPROCESS 2000: 4th Symposium on Fault Detection and Safety for Technical Processes, pages 40–51, Budapest, Hungary, 2000b. IFAC. M. Blanke, M. Kinnaert, J. Lunze, and M. Staroswiecki. Diagnosis and FaultTolerant Control. Springer, 2003. M. Blanke, M. Staroswiecki, M. Kinnaert, J. Lunze, and J. Maciejowski. Faulttolerant methods in control and automation. In Proceeding of the PhD Course in Aalborg University Doctoral School & COSY Workshop, Aalborg, Denmark, 1999. G. Böker. Zustandsschätzung schaltender affiner System und ihre Anwendung in der Verkehrstechnik. Shaker Verlag, Aachen, Germany, 2003. A. K. Caglaye, S. M. Allen, and K. Wehmuller. Evaluation of a second generation reconfiguration strategy for aircraft flight control systems subjected to actuator failure surface damage. In Proceedings of the 1988 IEEE National Aerospace and Electronics Conference, pages 520–529, 1988.

262

References

S. Chen, G. Tao, and S. M. Joshi. On matching conditions for adaptive state tracking control of systems with actuator failures. IEEE Transactions on Automatic Control, 47(3):473–478, 2002. ISSN 0018-9286. C. Choukair and M. Bayart. Reconfigurable systems built from generic modul ad success diagram. In Proceedings of SAFEPROCESS 2000: 4th Symposium on Fault Detection and Safety for Technical Processes, pages 768–773, Budapest, Hungary, 2000. IFAC. C. Commault, J.-M. Dion, and M. Benahcene. Decoupling of structured systems by parameter-independent precompensation and state feedback. IEEE Transactions on Automatic Control, 44(2):348–352, 1999. ISSN 0018-9286. C. Commault, J.-M. Dion, and V. Hovelaque. A geometric approach for structured systems: Application to disturbance decoupling. Automatica, 33(3): 403–409, 1997. ISSN 0005-1098. C. Commault, J.-M. Dion, and A. Perez. Disturbance rejection for structured systems. IEEE Transactions on Automatic Control, 36(7):884–887, 1993. ISSN 0018-9286. V. Dardinier-Maron, H. Noura, and F. Hamelin. Reconfiguration against major actuator failures. In Proceedings of SAFEPROCESS 2000: 4th Symposium on Fault Detection and Safety for Technical Processes, pages 762–767, Budapest, Hungary, 2000. IFAC. X. Ding and P. M. Frank. Komponentenfehlerdetektion mittels auf Empfindlichkeitsanalyse basierender robuster Detektionsfilter. Automatisierungstechnik (at), 38(8):299–306, 1990. ISSN 0178-2312. J. Doyle, B. Francis, and A. Tannenbaum. Feedback Control Theory. Macmillan Publishing, USA, 1991. I. S. Duff. A survey of sparse matrix research. Proceedings of the IEEE, 65 (4):500–535, April 1977. A. L. Dulmage and N. S. Mendelsohn. Coverings of bipartite graphs. Canadian Journal of Mathematics, 10:517–534, 1958. ISSN 0008-414X. A. L. Dulmage and N. S. Mendelsohn. On the inversion of sparse matrices. Mathematics of Computation, 16:494–496, 1962. A. L. Dulmage and N. S. Mendelsohn. Two algorithms for bipartite graphs. SIAM Journal on Applied Mathematics, 11(1):183–194, March 1963. ISSN 0368-4245. P. M. Frank. Advanced fault detection and isolation schemes using nonlinear and robust observers. In Proceedings of the 10th IFAC Word Congress, volume 3, pages 63–68, München, Germany, 1987a.

References

263

P. M. Frank. Diagnosis in dynamical systems via state estimation - a survey. In S. G. Tzafestas, M. Singh, and G. Schmidt, editors, System Fault Diagnostics, Reliability and Related Knowledge-Based Approaches, volume 1, pages 35–98. D. Reidel Publishing Company, 1987b. ISBN 90-277-2550-0. P. M. Frank. Fault diagnosis in dynamic systems using analytical and knowledge-based redundancy - a survey and some new results. Automatica, 26(3):459–474, 1990. ISSN 0005-1098. P. M. Frank. Principles of model-based fault detection. In Proceedings of the IFAC/IFIP/IMACS Int. Symposium on Artificial Intelligence in Real-Time Control, pages 363–370, Delft, Netherlands, 1992. P. M. Frank. Diagnoseverfahren in der Automatisierungstechnik – Übersichtsaufsatz. Automatisierungstechnik (at), 42(2):47–64, 1994. ISSN 0178-2312. P. M. Frank. Analytical and qualitative model-based fault diagnosis - a survey and some new results. European Journal of Control, 2(1):6–28, 1996. P. M. Frank and J. Wuennenberg. Robust fault diagnosis using unknown input observer schemes. In Patton, Frank, and Clark, editors, Fault Diagnosis in Dynamic Systems: Theory and Applications, pages 46–98. Prentice Hall, 1989. Z. Gao and P. J. Antsaklis. Stability of the pseudo-inverse method for reconfigurable control systems. International Journal of Control, 53(3):717–729, 1991. ISSN 0020-7179. E. A. García and P. M. Frank. On the relationship between observer and parameter identification based approaches to fault detection. In Proceedings of the 13th IFAC World Congress, volume N, pages 25–29, San Francisco, USA, 1996. A. Gehin, M. Assas, and M. Staroswiecki. Structural analysis of system reconfigurability. In Proceedings of SAFEPROCESS 2000: 4th Symposium on Fault Detection and Safety for Technical Processes, pages 292–297, Budapest, Hungary, 2000. IFAC. A.-L. Gehin and M. Staroswiecki. A formal approach to reconfigurability annalysis – application to the three tank benchmark. In Proceedings of the European Control Conference 1999 (ECC’99), number CM-5, F1039-4, Karlsruhe, Germany, 1999. D. Graham and I. Ashkenas McRuer. Aircraft Dynamics and Automatic Control. Princeton University Press, Princeton, 1973. B. Heiming and J. Lunze. Control reconfiguration: The COSY benchmark problem and its solution by means of a qualitative model. In Proceedings of the European Control Conference 1999 (ECC’99), number CM-5, F1039-3, Karlsruhe, Germany, 1999. URL http://www.tu-harburg.de/ rts-researchprojects.

264

References

G. Hoblos, M. Staroswiecki, and A. Aitouche. Fault tolerance with respect to actuator failures in LTI systems. In Proceedings of SAFEPROCESS 2000: 4th Symposium on Fault Detection and Safety for Technical Processes, pages 804–809, Budapest, Hungary, 2000. IFAC. J. E. Hopcroft and R. M. Karp. An n5/2 algorithm for maximum matchings in bipartite graphs. Journal on Computation, 2(4):225–231, 1973. X. Hu, A. Lindquist, J. Mari, and J. Sand. Geometric Systems Theory – Lecture notes. Royal Institute of Technology, Stockholm, Sweden, 2003. URL http://www.math.kth.se/optsyst/studinfo/5B1822/. Y. Hu, P. A. Ioannou, and M. Mirmirani. Fault-tolerant control and reconfiguration for high performance aircraft: Review. Technical Report CATT 01-11-01, University of Southern California, Department of Electrical Engineering-Systems, 2001. URL http://www.usc.edu/dept/ee/ catt/2002/ying/web_AIR/CATT-01-11-01.pdf. P. Ioannou. Robust Adaptive Control. Prentice-Hall Upper Saddle River NJ, 1996. URL http://www-rcf.usc.edu/~{}ioannou/Robust_Adaptive_ Control.htm. R. Isermann. Methoden zur Fehlererkennung für die Überwachung technischer Prozesse. Regelungstechnische Praxis, 22(9/10):321–325/363–368, 1980. R. Isermann. Process fault detection based on modeling and estimation methods – a survey. Automatica, 20(4):387–404, 1984. ISSN 0005-1098. R. Izadi-Zamanabadi. Fault-Tolerant Supervisory Control-System Analysis and Logic Design. Aalborg University, Aalborg University, Denmark, 1999. ISBN 87-90664-02-7. R. Izadi-Zamanabadi, P. Amann, M. Blanke, V. Cocquempot, G. L. Gissinger, E. C. Kerrigan, T. F. Lootsma, J. M. Perronne, and G. Schreier. Ship propulsion control and reconfiguration. In K. Åstrom, P. Albertos, M. Blanke, A. Isidori, W. Schaufelberger, and R. Sanz, editors, Control of Complex Systems. Springer Verlag, London, 2000. ISBN 1-85233-324-3. R. Izadi-Zamanabadi and M. Staroswiecki. A structural analysis method formulation for fault-tolerant control system design. In Proceedings of IEEE Conference on Decision and Control (CDC), Sydney, Australia, 2000. R. Izadi-Zamanabadi, M. Staroswiecki, and V. Cocquempot. Structural analysis approach to FDI for the ship propulsion benchmark. In Proceedings of the Complex Systems (COSY) theme2 Workshop, Mulhouse, 1998. J. Jantzen. Digraph Analyses of Linear Control Systems. Number 96-H-838 (lecture notes). Technical University of Denmark: Dept. of Automation, 1996. B. Jiang, M. Staroswiecki, and V. Cocquempot. Active fault tolerant control for a class of nonlinear systems. In Proceedings of the SAFEPROCESS

References

265

2003: 5th Symposium on Fault Detection and Safety for Technical Processes, number M1-C2, 018, pages 127–132, Washington D.C., USA, 2003. IFAC. S. Kamau. Modelling, Analysis and Design of Discretely Controlled Switched Positive Systems. VDI Verlag, 2004. S. Kanev. Some fault-tolerant control references. Technical report, Delft University of Technology, Delft Center for Systems and Control, 2004. URL http://www.dcsc.tudelft.nl/~{}skanev/FTCrefs.htm. S. Kanev and M. Verhaegen. Reconfigurable robust fault-tolerant control and state estimation. In Proceedings of the 15th IFAC World Congress, number T-Fr-A10, 2542, Barcelona, Spain, 2002. T. Kleinert and J. Lunze. A hybrid automaton representation of simulated counterflow chromatographic separation processes. In Proceedings of the 15th IFAC World Congress, number T-Tu-M11, 410, Barcelona, Spain, 2002. A. J. Laub. A schur method for solving algebraic riccati equations. IEEE Transactions on Automatic Control, 24(6):913–921, 1979. ISSN 0018-9286. K. Li, Y. G. Xi, and Z. Zhang. G-cactus and new results on structural controllability of composite systems. International Journal of Systems Science, 27(12):1313–1326, 1996. ISSN 0020-7721. C. T. Lin. Structural controllability. IEEE Transactions on Automatic Control, 19(3):201–208, April 1974. ISSN 0018-9286. D. P. Looze, J. L. Weiss, J. S. Eterno, and N. M. Barrett. An automatic redesign approach for restructurable control systems. IEEE Control Systems Magazine, 5(2):16–22, May 1985. (issue starts with page 1). M. López-Martínez and F. R. Rubio. Control of a laboratory helicopter using feedback linearization. In Proceedings of the European Control Conference 2003 (ECC’03), Cambridge, UK, 2003. T. Lorentzen, M. Blanke, and H. Niemann. Structural analysis – a case study on the romer satellite. In Proceedings of the SAFEPROCESS 2003: 5th Symposium on Fault Detection and Safety for Technical Processes, number M1-D6, 028, pages 187–192, Washington D.C., USA, 2003. IFAC. D. G. Luenberger. Observing the state of a linear system. IEEE Transactions on Military Electronics, 8:74–80, April 1964. J. Lunze. Robust Multivariable Feedback Control. Akademie-Verlag Berlin, 1988. J. Lunze. Control reconfiguration. Technical report, Institute for Automation and Process Control, Ruhr-Universität Bochum, Germany, 2002a. J. Lunze. Regelungstechnik, volume 2. Springer, 2nd edition, 2002b.

266

References

J. Lunze, D. Rowe-Serrano, and T. Steffen. Control reconfiguration demonstrated at a two-degrees-of-freedom helicopter model. In Proceedings of the European Control Conference 2003 (ECC’03), number ???, Cambridge, UK, 2003. J. Lunze and T. Steffen. Reconfigurable control of a quantised system. In Proceedings of the SAFEPROCESS 2000: 4th Symposium on Fault Detection, pages 822–827, Budapest, Hungary, 2000. IFAC. J. Lunze and T. Steffen. Hybrid reconfigurable control. In S. Engell, G. Frehse, and E. Schnieder, editors, Modelling, Analysis and Design of Hybrid Systems, pages 267–284. Springer Verlag, Berlin, Germany, 2002. J. Lunze and T. Steffen. Control reconfiguration by means of a virtual actuator. In Proceedings of the SAFEPROCESS 2003: 5th Symposium on Fault Detection and Safety for Technical Processes, number M1-C3, 019, pages 133–138, Washington D.C., USA, 2003a. IFAC. J. Lunze and T. Steffen. Rekonfiguration linearer Systeme bei Sensor- und Aktorausfall. Automatisierungstechnik (at), 51(2):60–68, 2003b. ISSN 01782312. J. Maciejowski. Predictive Control with Constraints. Prentice Hall, 2002. ISBN 0 201 39823 0. J. M. Maciejowski. The implicit daisy-chaining property of constrained predictive control. Applied Mathematics and Computer Science, 8(4):695–711, 1998. J. M. Maciejowski and C. N. Jones. MPC fault-tolerant flight control case study: Flight 1862. In Proceedings of the SAFEPROCESS 2003: 5th Symposium on Fault Detection and Safety for Technical Processes, number M1-C1, 017, pages 121–126, Washington D.C., USA, 2003. IFAC. G. Marro. Multivariable regulation in geometric terms: old and new results. In Claudio Bonivento, Giovanni Marro, and Roberto Zanasi, editors, Colloquium on Automatic Control, Lecture Notes in Control and Information Sciences. Springer-Verlag, New York, USA, 1996. G. Marro and A. Piazzi. Feedback systems stabilizability in terms of invariant zeros. In A. Isidori and T. J. Tarn, editors, Systems. Models and Feedback: Theory and Applications, Progress in Systems and Control Theory. Birkhauser, Boston, USA, 1992. J. C. Martínez-García, M. Malabre, J.-M. Dion, and C. Commault. Condensed structural solutions to the disturbance rejection and decoupling problem with stability. International Journal of Control, 72(15):1392–1401, 1999. P. McDaniel. Graphviz – open source graph drawing software. AT+T Research, 2004. URL http://www.graphviz.org/.

References

267

M. Morari, E. C. Kerrigan, A. Bemporad, D. Mignone, and J. M. Maciejowski. Multi-objective prioritisation and reconfiguration for the control of constrained hybrid systems. In Proceedings of the American Control Conference (ACC00), number ACC00-IEEE1027, 2000. T. Pasternak. Reconfiguration in hierarchical control of piecewise-affine systems. In Hybrid Systems Computation and Control, number 2289 in Lecture Notes in Computer Science, pages 364–377. Springer, 2002. R. Patton. Fault-tolerant control: the 1997 situation. In R. Patton and J. Chen, editors, Proceedings of the SAFEPROCESS 1997: 3rd Symposium on Fault Detection and Safety for Technical Processes, pages 1033–1055, Kingston upon Hull, UK, 1997. IFAC. URL http://www.eng.hull.ac. uk/research/control/safepr.ps. R. J. Patton, P. M. Frank, and R. N. Clark. Fault Diagnosis in Dynamic Systems Theory and Application. Prentice Hall New York, 1989. P. Hr. Petkov, N. D. Christov, and M. M. Konstantinov. A computational algorithm for pole assignment of linear multiinput systems. IEEE Transactions on Automatic Control, 31(11):1044–1047, 1986. ISSN 0018-9286. A. Pothen and C.-J. Fan. Computing the block triangular form of a sparse matrix. Transactions on Mathematical Software, 16(4):303–324, 1990. ISSN 0098-3500. V. Puig, J. Quevedo, A. Stancu, J. Lunze, J. Neidig, P. Planchon, and P. Supavatanakul. Comparison of interval models and quantised systems in fault detection of the damadics actuator benchmark problem. In Proceedings of SAFEPROCESS 2003: 5th Symposium on Fault Detection and Safety for Technical Processes, number W3-C3, 192, pages 1191–1196, Washington D.C., USA, 2003. IFAC. H. E. Rauch. Autonomous control reconfiguration. IEEE Control Systems, 15(6):37–48, 1995. K. Reinschke. Multivariable Control – A Graph-theoretic Approach. Springer Verlag, Berlin, Germany, 1988. H. H. Rosenbrock. State-space and Multivariable Theory. Williom Clowes and Sons, London, UK, 1970. J. Schröder. Modelling, State Observation and Diagnosis of Quantised Systems. Springer, Berlin, Germany, 2003. ISBN 3-540-44075-5. V. Sima. Algorithms for Linear-Quadratic Optimization. Pure and Applied Mathematics: A Series of Monographs and Textbooks, volume 200. Marcel Dekker, New York, Germany, 1996. ISBN 0824796128. P. K. Sinha. Multivariable Control—An Introduction. Marcel Dekker, Inc., New York, USA, 1984. ISBN 0-8247-1858-5.

268

References

M. Staroswiecki. On reconfigurability with respect to actuator failures. In Proceedings of the 15th IFAC World Congress, number T-Tu-M10, 775, Barcelona, Spain, 2002. M. Staroswiecki and A.-L. Gehin. From control to supervision. IFAC Annual Reviews in Control, 25(1):1–11, 2001. ISSN 1367-5788. G. W. Stewart. Introduction to Matrix Computation. Academic Press, Ney York, USA, 1973. P. Supavatanakul. Modelling and Diagnosis of Timed Discrete-Event Systems. VDI Verlag, 2004. K. Tsuda, D. Mignone, G. Ferrari-Trecate, and M. Morari. Reconfiguration strategies for hybrid systems. In Proceedings of the 2001 American Control Conference (ACC01), Arlington, VA, USA, 2001. A. Tveit. On the complexity of matrix inversion. Technical report, Department of Computer and Information Science, Norwegian University of Science and Technology, 2003. URL http://abiody.com/people/amund/ publications/2003/ComplexityOfMatrixInversion.pdf. J. van der Woude. A graph-theoretic characterization for the rank of the transfer matrix of a structured system. Mathematics of Control, Signals and Systems, 4(1):33–40, 1991. J. van der Woude and K. Murota. Disturbance decoupling with pole placement for structured systems: a graph-theoretic approach. Journal of Matrix Analysis and Applications, 16(3):922–942, July 1995. J. W. van der Woude. Graph theoretic conditions for structural disturbance decoupling with pole placement. In Proceedings of the European Control Conference 1997 (ECC’97), number 902, Brussels, Belgium, 1997. D. van Schrick. Conceptual system draft for safeprocess: Relations and definitions. In Proceedings of SAFEPROCESS 2000: 4th Symposium on Fault Detection and Safety for Technical Processes, pages 792–797, Budapest, Hungary, 2000. IFAC. H.-D. Wend. Strukturelle Analyse linearer Regelungssysteme. Oldenbourg Verlag GmbH, München, Germany, 1993. ISBN 3-486-22425-5. J. C. Willems. Almost invariant subspaces: An approach to high gain feedback design—part I: Almost controlled invariant subspaces. IEEE Transactions on Automatic Control, 26(1):235–252, 1981. ISSN 0018-9286. W. M. Wonham. Linear Multivariable Control–A Geometric Approach. Springer, 1985. W. M. Wonham and A. S. Morse. Decoupling and pole assignment in linear multivariable systems: A geometric approach. SIAM Journal on Control, 8 (1):1–18, February 1970.

References

269

N. E. Wu, K. Zhou, and G. Salomon. On reconfigurability. In Proceedings of SAFEPROCESS 2000: 4th Symposium on Fault Detection and Safety for Technical Processes, pages 848–853, Budapest, Hungary, 2000. IFAC. Z. Yang, R. Izadi-Zamanabadi, and M. Blanke. On-line multiple-model based adaptive control reconfiguration for a class of non-linear control systems. In Proceedings of the SAFEPROCESS 2000: 4th Symposium on Fault Detection and Safety for Technical Processes, pages 745–750, Budapest, Hungary, 2000. IFAC. J.S. Yee, Jian Liang Wang, and Bin Jiang. Actuator fault estimation scheme for flight application. Journal of Dynamical Systems, Measurement, and Control, 124(4):701–704, December 2002. Y. Zhang and J. Jiang. Bibliographical review on reconfigurable fault-tolerant control systems. In Proceedings of the SAFEPROCESS 2003: 5th Symposium on Fault Detection and Safety for Technical Processes, number M2-C1, 041, pages 265–276, Washington D.C., USA, 2003. IFAC. D. H. Zhou, G. Z. Wang, and S. X. Ding. Sensor fault tolerant control fo nonlinear systems with application to a three-tank-systems. In Proceedings of SAFEPROCESS 2000: 4th Symposium on Fault Detection and Safety for Technical Processes, pages 810–815, Budapest, Hungary, 2000. IFAC.

Lecture Notes in Control and Information Sciences Edited by M. Thoma and M. Morari Further volumes of this series can be found on our homepage: springeronline.com Vol. 257: Moallem, M.; Patel, R.V.; Khorasani, K. Flexible-link Robot Manipulators 176 p. 2001 [1-85233-333-2] Vol. 258: Isidori, A.; Lamnabhi-Lagarrigue, F.; Respondek, W. (Eds.) Nonlinear Control in the Year 2000 Volume 1 616 p. 2001 [1-85233-363-4] Vol. 259: Isidori, A.; Lamnabhi-Lagarrigue, F.; Respondek, W. (Eds.) Nonlinear Control in the Year 2000 Volume 2 640 p. 2001 [1-85233-364-2] Vol. 260: Kugi, A. Non-linear Control Based on Physical Models 192 p. 2001 [1-85233-329-4] Vol. 261: Talebi, H.A.; Patel, R.V.; Khorasani, K. Control of Flexible-link Manipulators Using Neural Networks 168 p. 2001 [1-85233-409-6] Vol. 262: Dixon, W.; Dawson, D.M.; Zergeroglu, E.; Behal, A. Nonlinear Control of Wheeled Mobile Robots 216 p. 2001 [1-85233-414-2] Vol. 263: Galkowski, K. State-space Realization of Linear 2-D Systems with Extensions to the General nD (n>2) Case 248 p. 2001 [1-85233-410-X] Vol. 264: Ba¯nos, A.; Lamnabhi-Lagarrigue, F.; Montoya, F.J Advances in the Control of Nonlinear Systems 344 p. 2001 [1-85233-378-2] Vol. 265: Ichikawa, A.; Katayama, H. Linear Time Varying Systems and Sampled-data Systems 376 p. 2001 [1-85233-439-8] Vol. 266: Stramigioli, S. Modeling and IPC Control of Interactive Mechanical Systems – A Coordinate-free Approach 296 p. 2001 [1-85233-395-2] Vol. 267: Bacciotti, A.; Rosier, L. Liapunov Functions and Stability in Control Theory 224 p. 2001 [1-85233-419-3] Vol. 268: Moheimani, S.O.R. (Ed) Perspectives in Robust Control 390 p. 2001 [1-85233-452-5] Vol. 269: Niculescu, S.-I. Delay Effects on Stability 400 p. 2001 [1-85233-291-316] Vol. 270: Nicosia, S. et al. RAMSETE 294 p. 2001 [3-540-42090-8] Vol. 271: Rus, D.; Singh, S. Experimental Robotics VII 585 p. 2001 [3-540-42104-1]

Vol. 272: Yang, T. Impulsive Control Theory 363 p. 2001 [3-540-42296-X] Vol. 273: Colonius, F.; Grüne, L. (Eds.) Dynamics, Bifurcations, and Control 312 p. 2002 [3-540-42560-9] Vol. 274: Yu, X.; Xu, J.-X. (Eds.) Variable Structure Systems: Towards the 21st Century 420 p. 2002 [3-540-42965-4] Vol. 275: Ishii, H.; Francis, B.A. Limited Data Rate in Control Systems with Networks 171 p. 2002 [3-540-43237-X] Vol. 276: Bubnicki, Z. Uncertain Logics, Variables and Systems 142 p. 2002 [3-540-43235-3] Vol. 277: Sasane, A. Hankel Norm Approximation for Infinte-Dimensional Systems 150 p. 2002 [3-540-43327-9] Vol. 278: Chunling D. and Lihua X. (Eds.) H∞ Control and Filtering of Two-dimensional Systems 161 p. 2002 [3-540-43329-5] Vol. 279: Engell, S.; Frehse, G.; Schnieder, E. (Eds.) Modelling, Analysis, and Design of Hybrid Systems 516 p. 2002 [3-540-43812-2] Vol. 280: Pasik-Duncan, B. (Ed) Stochastic Theory and Control 564 p. 2002 [3-540-43777-0] Vol. 281: Zinober A.; Owens D. (Eds.) Nonlinear and Adaptive Control 416 p. 2002 [3-540-43240-X] Vol. 282: Schröder, J. Modelling, State Observation and Diagnosis of Quantised Systems 368 p. 2003 [3-540-44075-5] Vol. 283: Fielding, Ch. et al. (Eds.) Advanced Techniques for Clearance of Flight Control Laws 480 p. 2003 [3-540-44054-2] Vol. 284: Johansson, M. Piecewise Linear Control Systems 216 p. 2003 [3-540-44124-7] Vol. 285: Wang, Q.-G. Decoupling Control 373 p. 2003 [3-540-44128-X] Vol. 286: Rantzer, A. and Byrnes C.I. (Eds.) Directions in Mathematical Systems Theory and Optimization 399 p. 2003 [3-540-00065-8] Vol. 287: Mahmoud, M.M.; Jiang, J.; Zhang, Y. Active Fault Tolerant Control Systems 239 p. 2003 [3-540-00318-5]

Vol. 288: Taware, A. and Tao, G. control of Sandwich Nonlinear Systems 393 p. 2003 [3-540-44115-8] Vol. 289: Giarré, L. and Bamieh, B. Multidisciplinary Research in Control 237 p. 2003 [3-540-00917-5] Vol. 290: Borrelli, F. Constrained Optimal Control of Linear and Hybrid Systems 237 p. 2003 [3-540-00257-X] Vol. 291: Xu, J.-X. and Tan, Y. Linear and Nonlinear Iterative Learning Control 189 p. 2003 [3-540-40173-3] Vol. 292: Chen, G. and Yu, X. Chaos Control 380 p. 2003 [3-540-40405-8] Vol. 293: Chen, G. and Hill, D.J. Bifurcation Control 320 p. 2003 [3-540-40341-8] Vol. 294: Benvenuti, L.; De Santis, A.; Farina, L. (Eds.) Positive Systems: Theory and Applications (POSTA 2003) 414 p. 2003 [3-540-40342-6] Vol. 295: Kang, W.; Xiao, M.; Borges, C. (Eds.) New Trends in Nonlinear Dynamics and Control, and their Applications 365 p. 2003 [3-540-10474-0] Vol. 296: Matsuo, T.; Hasegawa, Y. Realization Theory of Discrete-Time Dynamical Systems 235 p. 2003 [3-540-40675-1] Vol. 297: Damm, T. Rational Matrix Equations in Stochastic Control 219 p. 2004 [3-540-20516-0] Vol. 298: Choi, Y.; Chung, W.K. PID Trajectory Tracking Control for Mechanical Systems 127 p. 2004 [3-540-20567-5] Vol. 299: Tarn, T.-J.; Chen, S.-B.; Zhou, C. (Eds.) Robotic Welding, Intelligence and Automation 214 p. 2004 [3-540-20804-6] Vol. 300: Nakamura, M.; Goto, S.; Kyura, N.; Zhang, T. Mechatronic Servo System Control Problems in Industries and their Theoretical Solutions 212 p. 2004 [3-540-21096-2] Vol. 301: de Queiroz, M.; Malisoff, M.; Wolenski, P. (Eds.) Optimal Control, Stabilization and Nonsmooth Analysis 373 p. 2004 [3-540-21330-9] Vol. 302: Filatov, N.M.; Unbehauen, H. Adaptive Dual Control: Theory and Applications 237 p. 2004 [3-540-21373-2] Vol. 303: Mahmoud, M.S. Resilient Control of Uncertain Dynamical Systems 278 p. 2004 [3-540-21351-1]

Vol. 304: Margaris, N.I. Theory of the Non-linear Analog Phase Locked Loop 303 p. 2004 [3-540-21339-2] Vol. 305: Nebylov, A. Ensuring Control Accuracy 256 p. 2004 [3-540-21876-9] Vol. 306: Bien, Z.Z.; Stefanov, D. (Eds.) Advances in Rehabilitation 472 p. 2004 [3-540-21986-2] Vol. 307: Kwon, S.J.; Chung, W.K. Perturbation Compensator based Robust Tracking Control and State Estimation of Mechanical Systems 158 p. 2004 [3-540-22077-1] Vol. 308: Tarbouriech, S.; Abdallah, C.T.; Chiasson, J. (Eds.) Advances in Communication Control Networks 358 p. 2005 [3-540-22819-5] Vol. 309: Kumar, V.; Leonard, N.; Morse, A.S. (Eds.) Cooperative Control 301 p. 2005 [3-540-22861-6] Vol. 310: Janczak, A. Identification of Nonlinear Systems Using Neural Networks and Polynomial Models 197 p. 2005 [3-540-23185-4] Vol. 311: Lamnabhi-Lagarrigue, F.; Loría, A.; Panteley, V. (Eds.) Advanced Topics in Control Systems Theory 294 p. 2005 [1-85233-923-3] Vol. 312: Henrion, D.; Garulli, A. (Eds.) Positive Polynomials in Control 313 p. 2005 [3-540-23948-0] Vol. 313: Li, Z.; Soh, Y.; Wen, C. Switched and Impulsive Systems 277 p. 2005 [3-540-23952-9] Vol. 314: Gil’, M.I. Explicit Stability Conditions for Continuous Systems 193 p. 2005 [3-540-23984-7] Vol. 315: Herbordt, W. Sound Capture for Human/Machine Interfaces: Practical Aspects of Microphone Array Signal Processing 286 p. 2005 [3-540-23954-5] Vol. 316: R.V. Patel; F. Shapdey Control of Redundant Robot Manipulators 224 p. 2005 [3-540-25071-9] Vol. 317: Chuan Ma; W. Murray Wonham Nonblocking Supervisory Control of State Tree Structures 208 p. 2005 [3-540-25069-7] Vol. 318: Eli Gershon; Uri Shaked; IsaacYaesh H∞ Control and Estimation of State-multiplicative Linear Systems 272 p. [1-85233-997-7] Vol. 319: Hofbaur; W. Michael Hybrid Estimation of Complex Systems 176 p. [3-540-25727-6]

Control Reconfiguration of Dynamical Systems: Linear Approaches and Structural Tests (Lecture Notes in Control and Information Sciences)

Singular Control Systems (Lecture Notes in Control and Information Sciences)

Networked Control Systems (Lecture Notes in Control and Information Sciences)

Resilient Control of Uncertain Dynamical Systems (Lecture Notes in Control and Information Sciences)

Ensuring Control Accuracy (Lecture Notes in Control and Information Sciences)

Recent Advances in Control and Optimization of Manufacturing Systems (Lecture Notes in Control and Information Sciences)

Analysis and Synthesis of Dynamical Systems with Time-Delays (Lecture Notes in Control and Information Sciences)

Linear Time Varying Systems and Sampled-data Systems (Lecture Notes in Control and Information Sciences)

Approximate and Noisy Realization of Discrete-Time Dynamical Systems (Lecture Notes in Control and Information Sciences)

Control and Estimation of Systems with Input Output Delays (Lecture Notes in Control and Information Sciences)

Analysis and Synthesis of Networked Control Systems (Lecture Notes in Control and Information Sciences)

Stability and Control of Time-delay Systems (Lecture Notes in Control and Information Sciences)

Topics in Time Delay Systems: Analysis, Algorithms and Control (Lecture Notes in Control and Information Sciences)

Modeling and Identification of Linear Parameter-Varying Systems (Lecture Notes in Control and Information Sciences)

Linear and Nonlinear Iterative Learning Control (Lecture Notes in Control and Information Sciences) (v. 291)

Advances in the Control of Nonlinear Systems (Lecture Notes in Control and Information Sciences)

Feedback Control, Nonlinear Systems, and Complexity (Lecture Notes in Control and Information Sciences)

Active Fault Tolerant Control Systems: Stochastic Analysis and Synthesis (Lecture Notes in Control and Information Sciences)

Variational and Hamiltonian Control Systems (Lecture Notes in Control and Information Sciences)

Realization Theory of Discrete-Time Dynamical Systems (Lecture Notes in Control and Information Sciences)

Control of Indefinite Nonlinear Dynamic Systems: Induced Internal Feedback (Lecture Notes in Control and Information Sciences)

Fuzzy Control and Filter Design for Uncertain Fuzzy Systems (Lecture Notes in Control and Information Sciences)

Control of Uncertain Systems with Bounded Inputs (Lecture Notes in Control and Information Sciences)

Limited Data Rate in Control Systems with Networks (Lecture Notes in Control and Information Sciences)

Simultaneous Stabilization of Linear Systems (Lecture Notes in Control and Information Sciences)

Finite Zeros in Discrete Time Control Systems (Lecture Notes in Control and Information Sciences)

Optimal Control of Constrained Piecewise Affine Systems (Lecture Notes in Control and Information Sciences)

Topics in Multidimensional Linear Systems Theory (Lecture Notes in Control and Information Sciences)

Nonlinear Control Systems: An Algebraic Setting (Lecture Notes in Control and Information Sciences)

Fault Tolerant Control Design for Hybrid Systems (Lecture Notes in Control and Information Sciences)

H-infinity Control and Estimation of State-multiplicative Linear Systems (Lecture Notes in Control and Information Sciences)

Control Reconfiguration of Dynamical Systems: Linear Approaches and Structural Tests (Lecture Notes in Control and Information Sciences)

Singular Control Systems (Lecture Notes in Control and Information Sciences)

Networked Control Systems (Lecture Notes in Control and Information Sciences)

Resilient Control of Uncertain Dynamical Systems (Lecture Notes in Control and Information Sciences)

Ensuring Control Accuracy (Lecture Notes in Control and Information Sciences)

Recent Advances in Control and Optimization of Manufacturing Systems (Lecture Notes in Control and Information Sciences)

Analysis and Synthesis of Dynamical Systems with Time-Delays (Lecture Notes in Control and Information Sciences)

Linear Time Varying Systems and Sampled-data Systems (Lecture Notes in Control and Information Sciences)

Approximate and Noisy Realization of Discrete-Time Dynamical Systems (Lecture Notes in Control and Information Sciences)

Control and Estimation of Systems with Input Output Delays (Lecture Notes in Control and Information Sciences)

Analysis and Synthesis of Networked Control Systems (Lecture Notes in Control and Information Sciences)

Stability and Control of Time-delay Systems (Lecture Notes in Control and Information Sciences)

Topics in Time Delay Systems: Analysis, Algorithms and Control (Lecture Notes in Control and Information Sciences)

Modeling and Identification of Linear Parameter-Varying Systems (Lecture Notes in Control and Information Sciences)

Linear and Nonlinear Iterative Learning Control (Lecture Notes in Control and Information Sciences) (v. 291)

Advances in the Control of Nonlinear Systems (Lecture Notes in Control and Information Sciences)

Feedback Control, Nonlinear Systems, and Complexity (Lecture Notes in Control and Information Sciences)

Active Fault Tolerant Control Systems: Stochastic Analysis and Synthesis (Lecture Notes in Control and Information Sciences)

Variational and Hamiltonian Control Systems (Lecture Notes in Control and Information Sciences)

Realization Theory of Discrete-Time Dynamical Systems (Lecture Notes in Control and Information Sciences)

Control of Indefinite Nonlinear Dynamic Systems: Induced Internal Feedback (Lecture Notes in Control and Information Sciences)

Fuzzy Control and Filter Design for Uncertain Fuzzy Systems (Lecture Notes in Control and Information Sciences)

Control of Uncertain Systems with Bounded Inputs (Lecture Notes in Control and Information Sciences)

Limited Data Rate in Control Systems with Networks (Lecture Notes in Control and Information Sciences)

Simultaneous Stabilization of Linear Systems (Lecture Notes in Control and Information Sciences)

Finite Zeros in Discrete Time Control Systems (Lecture Notes in Control and Information Sciences)

Optimal Control of Constrained Piecewise Affine Systems (Lecture Notes in Control and Information Sciences)

Topics in Multidimensional Linear Systems Theory (Lecture Notes in Control and Information Sciences)

Nonlinear Control Systems: An Algebraic Setting (Lecture Notes in Control and Information Sciences)

Fault Tolerant Control Design for Hybrid Systems (Lecture Notes in Control and Information Sciences)

H-infinity Control and Estimation of State-multiplicative Linear Systems (Lecture Notes in Control and Information Sciences)

Recommend Documents