1. Copyright © Vanderbilt University, Technical University of Budapest, Xerox PARC Fault-Adaptive Control Technology Gabor Karsai Gautam Biswas Tivadar Szemethy Sriram Narasimhan Tal Pasternak Gabor Peceli Gyula Simon Tamas Kovacshazy Feng Zhao Xenofon Koutsoukos ISIS, Vanderbilt University Technical University of Budapest, Hungary Xerox PARC http://www.isis.vanderbilt.edu/Projects/Fact/Fact.htm

2. SEC PI meeting May 01 Overview Review of objective and approach Modeling, diagnostics and integration 1. Hybrid modeling 2. Hybrid Observer 3. Hybrid Diagnostics 4. Discrete Diagnostics 5. Controller Modeling 6. OCP Integration Plans Transient Management in Reconfigurable Systems Model-directed monitoring and diagnosis

3. SEC PI meeting May 01 Objective Technology and tool suite for Fault-Adaptive Control Components: Modeling approach for capturing  Hybrid and discrete models of the plant for both nominal and faulty behavior  Reconfigurable controllers Mode identification and real-time fault-diagnostics  Model-based hybrid and discrete approaches Model-based dynamic selection/synthesis of regulatory controller structures Algorithms for mitigating reconfiguration transients

4. SEC PI meeting May 01 Model-based approach From models to a run-time system Open Control Platform Run-time execution environment for hosting: Monitoring and controller software Hybrid and discrete diagnostics modules Controller object library and selector Transient manager component Use OCP as the underlying “OS” Reconfigurable Monitoring and Control System Hybrid Observer Hybrid Diagnostics Failure Propagation Diagnostics Active Model Controller Selector Monitor/ Controller Library Transient Manager Reconfiguration Controller Fault Detector Embedded Models Embedded Models Visual modeling environment for creating: Hybrid bond-graph models Timed failure propagation graph models Controller models (supervisory and regulatory)

5. SEC PI meeting May 01 1. Modeling of the Physical System Hybrid Bond Graphs and Failure Propagation Graphs Propagation Attributes: Time delay Likelihood Timed failure propagation graph Hybrid bond-graph Components C,R,I,Gy,Tr Sf,Se Variables: e/f, u/x/y Energy/Signal ports Switched junctions

6. SEC PI meeting May 01 2. Hybrid Observer Automatic derivation of a hybrid observer from models Hybrid Observer Bz -1 C A xkxk X k+1 ykyk ukuk m3m3 m1m1 m2m2 Mode switching logic Continuous observer Hybrid Bond-graph Model Hybrid Bond-graph Model Hybrid Automata Generation Hybrid Automata Model System Generation Resulting hybrid observer tracks the plant across continuous states and discrete (switching) modes at run-time Symbolic derivation of equations based on KCL/KVL Rearrangement of equations in symbolic form to build state-space equations Substitution of parameter values Complexity: O(n Comp *m Switches )

7. SEC PI meeting May 01 Result Automatic derivation of a hybrid observer from models Two-tank system model (switched valves) Starting set of Equations (33 State): + ({f_d} * {R2}) - ({e_d}) = 0 (3) + ({f_e} * {R1}) - ({e_e}) = 0 (3) + ({f_a} * {R4}) - ({e_a}) = 0 (3) + ({f_b} * {C2}^(-1)) = d/dt{Tank2Level} (3) + ({f_6} * {C1}^(-1)) = d/dt{Tank1Level} (3) + ({f_b}) + ({f_a}) - ({f_7}) - ({f_5}) = 0 (4) + ({e_7}) - ({e_5}) = 0 (2) + ({e_5}) - ({Tank2Level}) = 0 (2) + ({e_7}) - ({Tank2Level}) = 0 (2) + ({Tank2Level}) - ({e_a}) = 0 (2) + ({e_5}) - ({e_a}) = 0 (2) + ({e_7}) - ({e_a}) = 0 (2) + ({Sf}) - ({f_1}) = 0 (2) + ({e_7}) + ({e_d}) - ({e_2}) = 0 (3) + ({f_2}) - ({f_7}) = 0 (2) + ({f_7}) - ({f_d}) = 0 (2) + ({f_2}) - ({f_d}) = 0 (2) + ({f_2}) + ({f_6}) + ({f_4}) + ({f_e}) - ({f_1}) = 0 (5) + ({e_2}) - ({e_1}) = 0 (2) + ({e_1}) - ({Tank1Level}) = 0 (2) + ({e_2}) - ({Tank1Level}) = 0 (2) + ({Tank1Level}) - ({e_4}) = 0 (2) + ({e_1}) - ({e_4}) = 0 (2) + ({e_2}) - ({e_4}) = 0 (2) + ({e_4}) - ({e_e}) = 0 (2) + ({Tank1Level}) - ({e_e}) = 0 (2) + ({e_1}) - ({e_e}) = 0 (2) + ({e_2}) - ({e_e}) = 0 (2) + ({f_3} * {R3}) - ({e_3}) = 0 (3) + ({e_3}) + ({e_5}) - ({e_4}) = 0 (3) + ({f_3}) - ({f_5}) = 0 (2) + ({f_5}) - ({f_4}) = 0 (2) + ({f_3}) - ({f_4}) = 0 (2) Finally we've 2 state eqns: - ({Tank2Level} * {R4}^(-1) * {C2}^(-1)) = d/dt{Tank2Level} (4) + ({C1}^(-1) * {Sf}) - ({C1}^(-1) * {Tank1Level} * {R1}^(-1)) = d/dt{Tank1Level } (5) And 2 output eqns: + ({Tank2Level}) = {Tank2Level} (1) + ({Tank1Level}) = {Tank1Level} (1)

8. SEC PI meeting May 01 Result Hybrid observer tracking the plant

9. SEC PI meeting May 01 3. Hybrid Diagnostics Modeling with Hybrid Bond Graphs Inflow and pipe flows controlled by valves + Autonomous Transitions: System can be in 256 configs. Switched Junctions – on can be turned on and off off by control signals generated by automata

10. SEC PI meeting May 01 Hybrid Diagnosis issues Track Hybrid System Behavior, Fault Detection Isolate not only the fault but also the mode it occurred in  Back track to identify mode and fault ( Roll Back )  Fault may not be detected in the mode it occurred because of  Time delay in effects of fault  Measured variables not affected until later mode  After identifying mode and fault, we need to predict behavior under fault conditions which is complicated by the fact that the quantitative value of fault parameter is not known ( Faster than real time Roll Forward + Online Estimation ) Intractable problem in general – How can controller model and controller signals be employed to control the intractability ?

11. SEC PI meeting May 01 Controller model Externally specified Modeled as timed FSM Transitions in FSM time-triggered or function of internal variables of plant Used in Tracking, hypotheses generation and refinement

12. SEC PI meeting May 01 Fault Isolation with Hybrid Models Hypothesis Generation (Back Propagation) Candidate Set Qualitative Hypotheses Refinement Forward Prop + Prog Monitoring Quick Roll Forward Quantitative Models (State Space or I/O Past Mode Trajectory Mode m i Temporal Causal Graphs (TCGs) Refined Candidate Set current mode Quantitative Hypotheses Refinement Parameter Estimation From Hybrid Bond Graphs Refined Candidate Set current mode Observations Signal to Symbol Generator

13. SEC PI meeting May 01 Qualitative Hypotheses Generation (Roll Back) Fault Hypothesis: Presence of fault invalidates the tracked mode trajectory To identify mode in which fault occurred we could consider all modes that are candidates for previous mode and hypothesize faults in those modes and so on To avoid the blow up we assume that the controller model is correct Lemma: The fault must have occurred in one of the modes in the tracked mode trajectory. Hence sufficient to go back through the tracked mode trajectory Time Line Mode 1 Mode 2 Mode 3 Mode 4 Mode 5 Mode 6 Mode 7 Fault Occurs Fault Detected Tracked Trajectory Actual Trajectory T1 T2 T3T4T5T6 Backprop: applied across multiple modes in saved mode trajectory

14. SEC PI meeting May 01 Qualitative Hypothesis Generation Example Fault (C2-) occurs at time 20 (controller state 9) but the fault detected at time 21 (controller state 10) We back propagate through the tracked mode trajectory (M10, M9, M8, …) to identify hypotheses in each of the tracked modes This generates the candidates. As can be seen this includes a number of spurious fault candidates.

15. SEC PI meeting May 01 Hypothesis Generation: Diagnosability & Measurement Selection When to stop back tracking ? Determined by diagnosability studies Select measurements that ensure that fault is detected within k modes from which it occurs This is a NP-Complete problem even for a continuous system Can reduce complexity by assuming specific controller model for measurement selection

16. SEC PI meeting May 01 Hypotheses Refinement Example The qualitative signatures of each of the candidates generated by back propagation is shown in the following table (candidates in mode 9 and 10) Prune candidates: All candidates that predict a discontinuous change in the measured variables can be eliminated (if a discontinuous change had occurred the fault detection unit would have flagged it). We are left with candidates and.

17. SEC PI meeting May 01 Qualitative Hypotheses Refinement (Very Fast Roll Forward) To perform qualitative analysis we need to start analyzing from current mode Presence of fault invalidates current mode trajectory Since quantitative value of fault parameter is unknown we cannot uniquely identify the current mode Controller model tells us what controlled transitions occurred but autonomous transitions cannot be predicted definitely because quantitative fault parameter value is not known. Hence multiple candidates for current mode and analysis needs to be done in each of these modes Hypothesized fault mode Known Controlled Transition Hypothesized Autonomous Transition Possible current modes Hypothesized intermediate modes

18. SEC PI meeting May 01 Quantitative Hypotheses Refinement For each fault, generate State Space Equation model with all but faulty parameter value substituted Use system identification techniques to estimate parameter value Estimate only one parameter instead of all parameters Check for zero error convergence

19. SEC PI meeting May 01 Extended Parameter Estimation If controlled mode change occurs, continue parameter estimation in new mode using parameter estimate from previous mode as initial value Use parameter estimates to predict autonomous mode changes and continue parameter estimation

20. SEC PI meeting May 01 Example 1: Parameter Estimation True fault hypothesis: convergence to 0 error in prediction Other fault hypothesis: divergence of error in prediction. C2 - R4 +

21. SEC PI meeting May 01 4. Discrete Diagnostics Maps: Ancestor : Alarms -> Alarms - maps alarms to their ancestor alarms Descendant: Alarms -> Failure Modes - maps alarms to their descendant failure modes Initialization: Hypothesis  FailureModes – initialized to empty set AlreadyRinging  Alarms – initialized to empty set MissingUpstream  Alarms – initialized to empty set Hypothesis refinement algorithm 1. NewFailureModes = Descendant(NewAlarms) – Hypothesis 2. Add NewFailureModes with rank of zero 3. Hypothesis := Hypothesis  NewFailureModes; 4. NewMissingUpstream := Descendant -1 (Hypothesis)  Ancestors(NewAlarms)  [MissingUpsream – AlreadyRinging] 5. MissingUpstreeam := MissingUpstreeam  NewMissingUpstream 6. AlreadyRinging := AlreadyRinging  NewAlarms 7. PromotedFailureModes := Descendant(NewAlarms) –Descendant(NewMissingUpstream) 8. Promote rank of failure modes in PromotedFailureMode s New BDD-based algorithm: Scores hypotheses based on missing alarms

22. SEC PI meeting May 01 5. Modeling Controllers CML: A Controller Modeling Language Two layers: Regulatory (sampled data) Supervisory (discrete switching) Supervisory logic: Discrete control Fault accommodation logic Reconfiguration/switching strategies

23. SEC PI meeting May 01 Modeling Controllers CML: A Controller Modeling Language Software models: Controllers Architectures

24. SEC PI meeting May 01 6. OCP Integration plan OCP M Model-based component Algorithmic (C++) component OCP Wrapper M Hybrid ObserverDiscrete Diagnostics OCP Wrapper M M Hybrid DiagnosticsActive Model OCP Wrapper M Controller Reconfig Mgr OCP Wrapper M Controller

25. SEC PI meeting May 01 Current plans Finish implementation of the OCP hybrid and discrete diagnostic reasoner Develop OCP supervisory/regulatory controller infrastructure based on CML Design Active Model component Integrate TUB work on transient management Work fuel system example with Boeing

26. Copyright © Vanderbilt University, Technical University of Budapest, Xerox PARC Technical University of Budapest Xerox PARC

27. SEC PI meeting May 01 Backup slides

28. SEC PI meeting May 01 Hybrid Diagnosis Step 1: Tracking System Behavior -- Observer Issues: Can we pre-compile models for all modes of hybrid automata How do we ensure mode change detection is sufficiently precise? Hybrid Bond-graph Model Generate Current State-Space Model (A,B,C,D) Kalman Filter u k,y k XkXk Calculate: transition conditions, next modes and models Mode change Detector System Mode (Switch settings) Recalculate Kalman Filter Coeffs. Controller Model

29. SEC PI meeting May 01 Temporal Causal Graphs (TCG) Automatically derived from Bond graph One TCG for each mode Captures causal and temporal relations between variables in the system Faults in the system represented by parameters on edges in the TCG e -> effort = Pressure f -> flow = Fluid Flow rate 1, = -> directly proportional -1 -> inversely proportional dt -> time delayed relation

30. SEC PI meeting May 01 Example 2: Observer considers a spurious mode In this case the observer considers an additional mode (3) The faults hypothesized in this spurious mode get dropped during the fault isolation process

31. SEC PI meeting May 01 Example 3: Observer skips a mode A fault (C1-) is introduced in mode 2 Height in Tank 1 shown in figure 1 (which is not measured) indicates that an autonomous transition occurs due to the jump in the height but our observer does not consider this mode since the fault is not detected until a later mode The back propagation however identifies candidates in mode 2 and fault isolation is able to isolate the true fault