Built-in Test Design for Fault Detection and Isolation in an Aircraft Environmental Control System*

11th IFAC Symposium on Dynamics and Control of 11th IFAC Symposium on Dynamics and Control of 11th Symposium on and Process including Biosystems 11th IFAC IFACSystems, Symposium on Dynamics Dynamics and Control Control of of 11th IFAC Symposium on Dynamics and Control of Process Systems, including Biosystems Process Systems, including Biosystems Available online at www.sciencedirect.com June 6-8, 2016. NTNU, Trondheim, Norway Process Systems, including Biosystems Process Systems, including Biosystems June 6-8, 2016. NTNU, Trondheim, Norway June 6-8, 2016. NTNU, Trondheim, Norway June June 6-8, 6-8, 2016. 2016. NTNU, NTNU, Trondheim, Trondheim, Norway Norway

ScienceDirect

IFAC-PapersOnLine 49-7 (2016) 007–012

Built-in Test Design for Fault Detection Built-in Test for Detection Built-in TestinDesign Design for Fault Fault Detection and Isolation an Aircraft Environmental and and Isolation Isolation in in an an Aircraft Aircraft Environmental Environmental  Control Control System System  Control System

∗ ∗ ∗ Palmer, Kyle A. ∗ Hale, William T. ∗ ∗ Han, Lu ∗ ∗ ∗ Palmer, Kyle A. Hale, William T. Han, Lu ∗ ∗ ∗ ∗∗ ∗ Palmer, Kyle A. Hale, William T. Han, Lu ∗ Han, ∗ Palmer, Kyle A. William T. Lu Jacobson, A. Bollas, George M. ∗∗ ∗ Palmer, Kyle Clas A. ∗ Hale, Hale, William T. Han, Lu ∗∗ ∗ Jacobson, Clas A. Bollas, George M. ∗∗ Bollas, George M. ∗ ∗ Jacobson, Clas A. ∗∗ Jacobson, Clas Clas A. A. Bollas, Bollas, George George M. M. Jacobson, ∗ Department of Chemical and Biomolecular Engineering, University of ∗ ∗ Department of Chemical and Biomolecular Engineering, University of ∗ of Chemical and Biomolecular Engineering, University of ∗ Department Department of Chemical and Biomolecular Engineering, University of Connecticut, Storrs, 191 Auditorium Road, Unit 3222, Storrs, CT, Department of Chemical and Biomolecular Engineering, University of Connecticut, Storrs, 191 Auditorium Road, Unit 3222, Storrs, CT, Connecticut, Storrs, 191 Auditorium Road, Unit 3222, Storrs, CT, Connecticut, Storrs, 191 Auditorium Road, Unit 3222, Storrs, CT, 06269-3222, USA (e-mails: [email protected], Connecticut, Storrs, 191 Auditorium Road, Unit 3222, Storrs, CT, 06269-3222, USA (e-mails: [email protected], 06269-3222, (e-mails: 06269-3222, USA USA (e-mails: [email protected], [email protected], [email protected], [email protected], [email protected]) 06269-3222, USA (e-mails: [email protected], [email protected], [email protected], [email protected]) ∗∗ [email protected], [email protected], [email protected]) [email protected], [email protected], [email protected]) United Technologies Corporation Systems and Controls Engineering, ∗∗ [email protected], [email protected], [email protected]) ∗∗ United Technologies Corporation Systems and Controls Engineering, ∗∗ United Technologies Corporation Systems and Controls Engineering, ∗∗ United Technologies Corporation Systems and Controls Engineering, 411 Silver Ln, East Hartford, CT 06118, USA United Technologies Corporation Systems and Controls Engineering, 411 Silver Ln, East Hartford, CT 06118, USA 411 Silver Ln, East Hartford, CT 06118, USA 411 Silver Ln, East Hartford, CT 06118, USA 411 Silver Ln, East Hartford, CT 06118, USA

Abstract: Abstract: Abstract: Abstract: A novel built-in test (BIT) design method for fault detection and isolation (FDI) is presented, Abstract: A novel novel built-in built-in test test (BIT) (BIT) design design method method for for fault fault detection detection and and isolation isolation (FDI) (FDI) is is presented, presented, A A novel built-in test (BIT) design method for fault detection and isolation (FDI) is presented, in which the test information extracted is maximized using parametric sensitivities derived by A novel built-in test (BIT) design method for fault detection and isolation (FDI) is presented, in which the test information extracted is maximized using parametric sensitivities derived by in which the test information extracted is maximized using parametric sensitivities derived by in which the test information extracted is maximized using parametric sensitivities derived by a system model. Two case studies are presented to demonstrate this approach. The first test in which the test information extracted is maximized using parametric sensitivities derived by a system model. Two case studies are presented to demonstrate this approach. The first test a system model. Two case studies are presented to demonstrate this approach. The first test a system model. Two case are presented to this approach. The test on fouling identification in an aircraft heat exchanger, in the presence of uncertain system afocuses system case studies studies presented to demonstrate demonstrate approach. The first first test focuses onmodel. fouling Two identification in an anare aircraft heat exchanger, exchanger, in the thethis presence of uncertain uncertain system focuses on fouling identification in aircraft heat in presence of system focuses on fouling identification in an aircraft heat exchanger, in the presence of uncertain system inputs. The second example expands this method to a subsystem of an aircraft environmental focuses on fouling identification in an aircraft heat exchanger, in the presence of uncertain system inputs. The second example expands this method to a subsystem of an aircraft environmental inputs. The second example expands this to subsystem of an inputs. The second example expands this method to subsystem of an aircraft environmental control system (ECS) to calculate optimal conditions component inputs. second example expands this method method to aaafor subsystem of FDI. an aircraft aircraft environmental environmental control The system (ECS) to calculate calculate optimal conditions for component FDI. control system (ECS) to calculate optimal conditions for component FDI. control system (ECS) to optimal conditions for component FDI. control system (ECS) to calculate optimal conditions for component FDI. © 2016, IFAC (International Federation of Automatic Control) Hosting by Elsevier Ltd. All rights reserved. Keywords: Fault Detection and Isolation, Global Optimization, Identifiability, Optimal Keywords: Fault Detection and Isolation, Global Optimization, Identifiability, Optimal Keywords: Detection and Keywords: Fault Fault Detection and Isolation, Isolation, Global Global Optimization, Optimization, Identifiability, Identifiability, Optimal Optimal Experiment Design, and Uncertainty. Keywords: Fault Detection and Isolation, Global Optimization, Identifiability, Optimal Experiment Design, and Uncertainty. Experiment Experiment Design, Design, and and Uncertainty. Uncertainty. Experiment Design, and Uncertainty. 1. INTRODUCTION 1. INTRODUCTION INTRODUCTION 1. 1. INTRODUCTION 1. INTRODUCTION Advances in technology of engineering systems have led Advances in in technology technology of of engineering engineering systems systems have have led led Advances Advances in technology of engineering systems have led to increase in complexity, which is often the reason for Advances in technology of engineering systems have led to increase in complexity, which is often the reason for to increase in which is often the for to increaseuncertainty in complexity, complexity, which is often operation. the reason reasonThe for increased and faults during to increase in complexity, which is often the reason for increased uncertainty and faults during operation. The increased uncertainty and faults during operation. The increased uncertainty andoffaults faults during operation. operation. The accuracy and timeliness the methods used for fault increased uncertainty and during The accuracy and and timeliness of the the methods methods used for for fault fault accuracy timeliness of used accuracy timeliness of the methods used for fault detection and isolation (FDI) significantly impact system accuracy timeliness of the methods used for fault detection and and isolation isolation (FDI) (FDI) significantly significantly impact impact system system detection detection and isolation (FDI) significantly impact system reliability, cost, safety, quality, and environmental footdetection and isolation (FDI) significantly impact system reliability, cost, safety, quality, and environmental footreliability, cost, safety, quality, and environmental footreliability, cost, aimed safety, at quality, and environmental environmental footprint. Research developing more sophisticated reliability, cost, safety, quality, and footprint. Research aimed at developing more sophisticated print. Research aimed at developing more sophisticated print. Research aimed at developing developing more sophisticated FDI methods has increased over the past couple of decades print. Research at more sophisticated FDI methods methods hasaimed increased over the the past past couple of decades decades FDI has increased over couple of FDI methods has increased over the past couple of decades due to their application in a variety of industries like FDI methods has increased over the past couple of decades due to their application in a variety of industries like due to application in of industries like due to their their application in a a variety variety ofenergy, industries like aerospace, automotive, chemical, defense, electrondue to their application in a variety of industries like aerospace, automotive, chemical, defense, energy, electronaerospace, automotive, chemical, defense, energy, electronaerospace, automotive, chemical, chemical, defense, energy, electronics, and transportation (Isermann (1984); Isermann and aerospace, automotive, defense, energy, electronics, and and transportation transportation (Isermann (1984); Isermann and ics, (Isermann (1984); Isermann and ics, and transportation (Isermann (1984); Isermann and Ball´ e (1997); Venkatasubramanian et al. (2003a,b,c); Isics, and transportation (Isermann (1984); Isermann and Ball´ e (1997); Venkatasubramanian et al. (2003a,b,c); IsBall´ eee (1997); Venkatasubramanian et al. (2003a,b,c); IsBall´ (1997); Venkatasubramanian et In al.aircraft (2003a,b,c); Isermann (2005); Hwang et al. (2010)). systems, Ball´ (1997); Venkatasubramanian et al. (2003a,b,c); Isermann (2005); Hwang et al. (2010)). In aircraft systems, ermann (2005); Hwang et al. In systems, ermann (2005); Hwang et al. (2010)). (2010)). as In aaircraft aircraft systems, built-in tests (BIT) are implemented method of FDI ermann (2005); Hwang al. (2010)). In built-in tests tests (BIT) are et implemented as aaircraft methodsystems, of FDI FDI built-in (BIT) are implemented as a method of built-in tests (BIT) are implemented as a method of FDI to address the issues of faulty operation. As improvements built-in tests (BIT) are implemented as As a method of FDI to address the issues of faulty operation. improvements to address the issues of faulty operation. As improvements to address the issuesequipment of faulty faulty operation. operation. As improvements are made to sensing and signal processors, more to issues of improvements areaddress made to tothe sensing equipment and signal signalAs processors, more are made sensing equipment and processors, more are made to sensing equipment and signal processors, more sophisticated BITs can be developed. are made to sensing equipment and signal processors, more sophisticated BITs can be developed. sophisticated sophisticated BITs BITs can can be be developed. developed. sophisticated BITs can be developed. BIT is a system test used to detect, display and isolate BIT is a system test used to detect, detect, display display and and isolate isolate BIT is a test to BIT isduring a system system test used used to detect, display and isolate faults operation. BIT is also capable of applying BIT is a system test used to detect, display and isolate faults during operation. BIT is also capable of applying faults during operation. BIT also of faults during operation. BIT is issystem also capable capable of applying applying fault-based control to maintain functionality in the faults during operation. BIT is also capable of applying fault-based control to maintain maintain system functionality in the the fault-based control to system functionality in fault-based control to maintain system functionality in the presence of faults (AC-9 Aircraft Environmental Systems fault-based control to maintain system functionality in the presence of faults (AC-9 Aircraft Environmental Systems presence of faults (AC-9 Aircraft Environmental Systems presence of faults faults (AC-9 Aircraft Environmental Systems Committee (2011); Airlines Electronic Engineering Compresence of Aircraft Environmental Systems Committee (2011);(AC-9 Airlines Electronic Engineering ComCommittee (2011); Airlines Electronic Engineering ComCommittee (2011); Airlines Electronic Engineering Committee (1988)). During BIT, the state of a line replaceCommittee (2011); Airlines Electronic Engineering Committee (1988)). During BIT, the state of a line replacemittee (1988)). During BIT, the state a replacemittee (1988)). During BIT,using the various state of of BIT line replaceable unit (LRU) is verified equipment mittee (1988)). BIT, the state of aa line line replaceable unit unit (LRU)During is verified verified using various BIT equipment able (LRU) is using various BIT equipment able unit (LRU) is verified using various BIT equipment (BITE) and ground support equipment (GSE) (AC-9 Airable unitand (LRU) is verified various BIT (AC-9 equipment (BITE) ground support using equipment (GSE) Air(BITE) and support equipment (GSE) (AC-9 Air(BITE) and ground ground support equipment (GSE) (AC-9 Aircraft Environmental Systems Committee (2011)). Compli(BITE) and ground support equipment (GSE) (AC-9 Aircraft Environmental Systems Committee (2011)). Complicraft craft Environmental Environmental Systems Systems Committee Committee (2011)). (2011)). CompliComplicraft Systems (2011)). Compli ThisEnvironmental work was sponsored by the Committee United Technologies Corporation  work was sponsored by the United Technologies Corporation   This This work sponsored by theEngineering United Technologies Corporation Institute for was Advanced Systems (UTC-IASE) of the This was sponsored by United Corporation  This work work sponsored by the theEngineering United Technologies Technologies Corporation Institute for was Advanced Systems (UTC-IASE) of the the Institute for Advanced Systems Engineering (UTC-IASE) of University of Connecticut. Any opinions expressed herein are Institute for Advanced Systems Engineering (UTC-IASE) of the Institute for Advanced Systems Engineering (UTC-IASE) ofthose the University of Connecticut. Any opinions expressed herein are those University of Connecticut. Any opinions expressed herein are those of the authors and do not represent those of the sponsor. University of Connecticut. Any opinions expressed herein are those University of Connecticut. Any opinions expressed herein are those of the the authors authors and and do do not not represent represent those those of of the the sponsor. sponsor. of of of the the authors authors and and do do not not represent represent those those of of the the sponsor. sponsor.

cations occur when systems and subsystems with interconcations when and with interconcations occur when systems and subsystems with interconcations occur occur when systems systems and subsystems subsystems withresponses interconnecting components can produce similar system cations occur when systems and subsystems with interconnecting components can produce similar system responses necting components can produce similar system responses necting components can produce similar system responses for different faults. Manually initiated BIT (also known necting components can produce similar system responses for different faults. Manually initiated BIT (also known for different faults. Manually initiated BIT (also known for different faults. Manually initiated BIT (also known as initiated/instantiated BIT or IBIT) usually operates for different faults. Manually initiated BIT (also known as initiated/instantiated BIT or IBIT) usually operates as initiated/instantiated BIT or IBIT) usually operates as initiated/instantiated BIT or IBIT) usually operates during aircraft maintenance and can extend outside of the as initiated/instantiated BIT orcan IBIT) usually operates during aircraft maintenance and extend outside of during maintenance and outside of the during aircraft aircraft maintenance and can can extend extend outside of the the normal system operating conditions, within the bounds during aircraft maintenance and can extend outside of the normal system operating conditions, within the bounds normal system operating conditions, within the bounds normal system operating conditions, within the bounds of component and system safety. IBIT is the intended normal system operating conditions, within the bounds of component and system safety. IBIT is the intended of component and system safety. is the of component and system safety. IBIT is the intended application of the in this due to of component andmethod systempresented safety. IBIT IBIT is paper, the intended intended application of the method presented in this paper, due to application of the method presented in this paper, due application of the method method presented inincreased this paper, paper, due to to the relaxed operating bounds and the flexibility application of the presented in this due to the relaxed operating bounds and the increased flexibility the relaxed operating bounds and the increased flexibility thesystem relaxedoperating operatingconditions bounds and and the increased increased flexibility in during ground operation. the relaxed operating bounds the flexibility in system operating conditions during ground operation. in system operating conditions during ground operation. in system operating conditions during ground operation. One way to improve fault detection built-in tests is in system operating conditions duringfor ground operation. One way to improve fault detection for built-in tests is One way to improve fault detection for built-in tests One way to improve fault detection for built-in tests is to adjust the system conditions prior to testing, One way the to improve fault detection for built-in through tests is is to adjust system conditions prior to testing, through to adjust the system conditions prior to testing, through to priori adjustmodel-based the system system conditions conditions prior to testing, testing, through a analysis. If a system has exhibited to adjust the prior to through a priori model-based analysis. If a system has exhibited a priori model-based analysis. If system has a priori model-based analysis. If system has exhibited faults, goal is to obtain outputs generate a unique a priorithe model-based analysis. If aaathat system has exhibited exhibited faults, the goal is to obtain outputs that generate a unique faults, the goal is to obtain outputs that generate a unique faults, the goal is to obtain outputs that generate a unique response capable of providing reliable fault detection and faults, the goal is to obtain outputs that generate a unique response capable of providing reliable fault detection and response capable of providing reliable fault detection response capable of providing reliable fault detection and isolation. response capable of providing reliable fault detection and and isolation. isolation. isolation. isolation. In this work, a methodology for IBIT has been structured In this work, methodology for IBIT has been structured In this work, aaaa methodology for IBIT been structured In this work, methodology for IBIT has been structured based Optimal Experimental (OED) In thison work, methodology for Design IBIT has has beentechniques. structured based on Optimal Experimental Design (OED) techniques. based on Optimal Experimental Design (OED) techniques. based on on Optimal Optimal Experimental Design (OED)the techniques. Estimation of test conditions to maximize informabased Experimental Design (OED) techniques. Estimation of test conditions to maximize the informaEstimation of test conditions to maximize the informaEstimation of test conditions to maximize the information with respect to a fault or system uncertainty is best Estimation of test conditions to maximize the information with respect to a fault or system uncertainty is best tion with respect to a fault or system uncertainty is best tion with respect to a fault or system uncertainty is best approached through structured statistical analysis with tion with respect to a fault or system uncertainty is best approached through a structured statistical analysis with approached through a structured statistical analysis with approached through a structured statistical analysis with origins in the work of Fedorov (2010). OED combines meaapproached through aFedorov structured statistical analysis meawith origins in the work of (2010). OED combines origins of (2010). OED meaorigins in in the the work of Fedorov Fedorov (2010). OED combines combines measurements of aawork system, its model and expected variances to origins in the work of Fedorov (2010). OED combines measurements of system, its model and expected variances to surements of a system, its model and expected variances to surements of a system, its model and expected variances to reduce parameter uncertainty (Rodriguez-Fernandez et al. surements of a system, its model and expected variances to reduce parameter uncertainty (Rodriguez-Fernandez et al. reduce parameter uncertainty (Rodriguez-Fernandez et al. reduce parameter uncertainty (Rodriguez-Fernandez et al. (2007); Bruwer and MacGregor (2006)). It is often used to reduce parameter uncertainty (Rodriguez-Fernandez et al. (2007); Bruwer and MacGregor (2006)). It is often used to (2007); Bruwer and MacGregor (2006)). It is often used to (2007); Bruwer and MacGregor (2006)). It is often used to improve the precision of experimentally estimated system (2007); Bruwer and MacGregor (2006)). It is often used to improve the precision of experimentally estimated system improve the precision of experimentally estimated system improve the the and precision of (Han experimentally estimatedand system parameters states et al. (2016a,b)), has improve precision of experimentally estimated system parameters and states (Han et al. (2016a,b)), and has parameters and states (Han et al. and has parameters and states (Han et al. (2016a,b)), and has been applied in many of statistics (Franceschini parameters and statesfields (Han et al. (2016a,b)), (2016a,b)), and and has been applied in many fields of statistics (Franceschini and been applied in many fields of statistics (Franceschini and been applied in many fields of statistics (Franceschini and Macchietto (2008)). OED uses available information taken been applied in many fields of statistics (Franceschini and Macchietto (2008)). OED uses available information taken Macchietto (2008)). OED uses available information taken Macchietto (2008)). OEDto uses available information taken from aa set of experiments solve an optimization problem Macchietto (2008)). OED uses available information taken from set of experiments to solve an optimization problem from a set of experiments to solve an optimization problem from minimizes a set set of of experiments experiments to solve solveofan anfuture optimization problem that the uncertainty tests. OED can from a to optimization problem that minimizes the uncertainty of future tests. OED can that minimizes the uncertainty of future tests. OED can that minimizes the uncertainty of future tests. OED can be applied to a linear or nonlinear system. that minimizes the uncertainty of future tests. OED can be applied to a linear or nonlinear system. be applied to a linear or nonlinear system. be applied to a linear or nonlinear system. be applied to a linear or nonlinear system.

Copyright 2016 IFAC 7 Hosting by Elsevier Ltd. All rights reserved. 2405-8963 © IFAC (International Federation of Automatic Control) Copyright © 2016, 2016 IFAC 7 Copyright 2016 IFAC 7 Copyright © 2016 IFAC 7 Peer review© of International Federation of Automatic Copyright ©under 2016 responsibility IFAC 7 Control. 10.1016/j.ifacol.2016.07.208

IFAC DYCOPS-CAB, 2016 8 June 6-8, 2016. NTNU, Trondheim, NorwayKyle A. Palmer et al. / IFAC-PapersOnLine 49-7 (2016) 007–012

The problem of optimal experimental design for FDI seeks for a system state or state trajectory in which faults (expressed as model parameters) are locally identifiable. Identifiability is helpful in determining not only if faults are present, but to what extent they are unique. Many fault detection applications are prone to signaling false positives, instances where a fault is “detected” but not actually present in the system. False positives are a major concern in the aerospace industry and a goal for BIT design is to reduce their rate of occurrence (Koushanfar et al. (2003); Stelling et al. (1999)). False positives reduce the reliability of the BIT and increase effective cost and maintenance time. The effectiveness of a BIT can be substantially improved if the BIT design allows for verification of the method in that the faults are uniquely identifiable for all possible situations of system states, inputs, uncertainty and other faults. To accomplish the latter, the system model can be tested for Structural Global Identifiability (SGI) (Ljung and Glad (1994)). This posterior test solves another optimization problem to explore if the system can be deemed globally identifiable with respect to its parameters (Asprey and Macchietto (2000)). This analysis indicates whether false alarms are feasible or likely and if their rate of occurrence can be reduced. If the SGI test fails, then the inputs (and corresponding system state) chosen to identify and assess faults are not adequate given the expected system variance and uncertainty, and false positives are likely to occur. If the test is successful, the proposed BIT is ready for further experimental verification.

ˆ t) = 0, f (x(t), ˙ x(t), u(t), θ, ˆ ˆ (t) = h(x(t), u(t), θ). y

(1)

Where f is the system of DAEs that describe the model (both clean and faulty aspects), x(t) is the vector of timedependent state variables, y(t) is the vector of measured outputs, u(t) is the vector of manipulated inputs, θˆ is the system parameters, and t is the time. The system parameters can be divided into two main categories, the designrelated parameters θˆp and the fault-related parameters θˆf , shown in (2), θˆ = [θˆp ; θˆf ].

(2)

The fault-related parameters affect the overall system performance, observed through the outputs y. These parameters correlate to the various faults that can occur in the system. Any uncertain parameters θˆp that can affect the estimation of these faults need to be considered for optimal experimental design as well. In this work, uncertainty is treated as a variance interval for each parameter or input that is estimated from the available measurements y. The magnitude of these intervals depends on the acceptable error in the actuation system, variability of the operating boundaries and model error. Uncertainty in system inputs is considered when their values are unknown or within a predetermined range of accuracy. Therefore, the fault-related parameters and the unknown inputs can be expressed as a vector used as a basis for optimal design,

Two case studies were chosen to test the effectiveness of the proposed approach. The first study involved an air-cooled, plate-fin heat exchanger with particulate fouling and only thermocouple sensors at its exit channels. Analysis was conducted for this system for the purpose of fouling identification, to observe the effects of thermal outputs caused by fouling and other inputs with uncertainty. The second study expanded the method to a subsystem of an aircraft environmental control system (ECS) experiencing multiple faults. The BIT design in this case adjusted multiple inputs using measurements of the mass flow, pressure drop, temperature and inferred surge margin. For both case studies, the system inputs were optimized to maximize the sensitivities of the available measurements with respect to a fault parameter through a D-optimal design framework that reduces the joint confidence regions of these parameters (Pukelsheim (1993); Kitsos and Kolovos (2013)). Thereafter, the optimal designs were tested to ensure that models were structurally globally identifiable at the BIT design calculated and for the anticipated fault severity. It was assumed that the models used in these case studies were essentially “perfect,” in that they effectively capture the process and fault-based behavior within acceptable accuracy and precision. Dealing with model error in active FDI will be the subject of future work.

ˆ. ξˆ = θˆf ∪ u

(3)

After determination of the vector that the design needs to estimate, the next step is to compile together the controllable variables. The vector u(t) contains the admissible inputs with their sequence of adjustments during the test. The inputs are controlled in a number of discrete step changes, ns , and their duration, ts . τ represents the overall duration of the test and it is typically assigned a value that ensures that the built-in test operates within an acceptable timeframe. The inputs, step changes, initial conditions, and overall timespan are compiled into the experimental design vector. Lower and upper bounds are assigned to the admissible inputs and the stepsize and number of control actions. The initial conditions y0 of the experiment can be optimized as well. The experimental design vector is arranged as: ϕ = [u(t), ts , ns , y0 , τ ] ∈ Φ.

(4)

The design space Φ contains the lower and upper variable bounds mentioned. The model outputs corresponding to system measurements are used to calculate parametric sensitivities through central finite differences. These sensitivities are compiled into Qr , a Nsp ×Nθ matrix describing the dynamic sensitivity of the r-th response variable with respect to the estimated parameters θˆf and uncertain system inputs u ˆ . These matrices are compiled together into a covariance matrix that is calculated from the Fisher information matrix, Hξ , presented in (5):

2. METHOD 2.1 Optimal Design Formulation The model or submodel used for optimal fault detection can be written as a set of differential algebraic equations (DAEs) as shown in (1): 8

IFAC DYCOPS-CAB, 2016 June 6-8, 2016. NTNU, Trondheim, NorwayKyle A. Palmer et al. / IFAC-PapersOnLine 49-7 (2016) 007–012

Nresp Nresp

ˆ ϕ) = Hξ (ξ,

  r=1

σrs QTr Qs ,

ΦSGI = 1max 2

(5)

ξ ,ξ ∈Ξ

s.t.  τ

s=1

ξ1 − ξ2

T

  Wξ ξ 1 − ξ 2

ˆ (u(t), θˆ1 , t) − y ˆ (u(t), θˆ2 , t) y 0  ˆ (u(t), θˆ1 , t) − y ˆ (u(t), θˆ2 , t) dt y

where σrs is the rs-th element of the inverse of the matrix of experimental error, and Nresp is the total number of available measurements. The measurement errors are assumed to be uncorrelated and have zero-mean normal distribution. The objective for optimizing the experimental design vector was chosen to be the D-optimal design criterion to minimize the correlation between the parameters estimated from the test information. This provides the best conditions for isolating and estimating what faults occurred in the system,    ˆϕ ξ, ϕD =arg min det H−1 ξ

for

T

Wy

...

< y , (7)

i = 1, 2 :

˙ f (x(t), x(t), u(t), θˆi , t) = 0, y(t) = h(x(t), u(t), θˆi ),  f (x(t ˙ 0 ), x(t0 ), u(t0 ), θˆi , t0 ) = 0, 0 y = ˆ (t0 ) = h(x(t0 ), u(t0 ), θˆi ), y

ϕ∈Φ

ξjL ≤ ξji (t) ≤ ξjU , ∀t ∈ [0, τ ].

s.t.

ˆ t) = 0, ˙ f (x(t), x(t), u(t), θ, ˆ ˆ (t) = h(x(t), u(t), θ), y  ˆ t0 ) = 0, f (x(t ˙ 0 ), x(t0 ), u(t0 ), θ, y0 = ˆ ˆ (t0 ) = h(x(t0 ), u(t0 ), θ), y L U u ≤ u(t) ≤ u , xL ≤ x(t) ≤ xU , ∀t ∈ [0, τ ].



9

j = 1, ..., Nξ ,

ΦSGI is the largest feasible distance between the two parameter sets ξ 1 and ξ 2 . If the built-in test can still identify between these two parameter sets through the output trajectories, meaning it is less than some small arbitrary value ΦSGI , then the faults for this system can be considered structurally globally identifiable. This method is able to quantifiably determine whether it is feasible to conduct fault detection with the expected variance and current understanding of the physical system.

(6)

The optimal test design vector, ϕD , is the recommended input strategy to be applied as system IBIT.

2.3 Tool Chain The equations listed above were applied in a series of case studies modeled with the object-oriented language Modelica (Modelica Association (2010)) used in the software implementation Dymola (Cellier (2015)). Each model was exported through the Functional Mockup Interface (FMI) (Modelisar (2010)), a multi-platform standard for describing dynamic models, as functional mockup units to MATLAB (The Mathworks Inc. (2013)) with the Modelon FMI-Toolbox (Modelon AB (2014)). The optimal design was solved using the Mesh Adaptive Direct Search algorithm, NOMAD (Le Digabel (2011)).

2.2 Structural Identifiability Analysis The method described in the previous section can be used to determine whether the system at the specified conditions is locally identifiable. However, to ensure that the identified faults are unique, a global identifiability test needs to be conducted. SGI, as described in detail by Asprey and Macchietto (2000), is used here to verify that the model is globally identifiable with respect to its faults and uncertainty at the state trajectory determined by the BIT design of (6). Essentially, the SGI test strives to find the largest distance between parameter sets that create similar output trajectories. If dissimilar parameters can provide practically the same output trajectory then a false alarm is feasible in the BIT. Similar to the optimal design problem, this part of the method requires the model described in (1) and (2), and the input design (3) and (4). These equations are applied twice with two separate sets of values for the system variables ξ 1 and ξ 2 . The integrated differences are calculated for the overall timespan (∀t ∈ [0, τ ]). Each parametric set contains Nξ parameters. The parametric sets are bounded as ξ 1 ∈ Ξ, and ξ 2 ∈ Ξ and the second parameter vector is adjusted to find a maximum for ΦSGI , shown in (7). SGI is achieved if ΦSGI ≤ ΦSGI , the integrated expected variance of the normalized test measurements. Both parameter sets are kept within the same upper and lower bounds, the expected allowable fault threshold for the system.

3. APPLICATION EXAMPLES The effectiveness of this approach was tested in two separate case studies, both of which were subject to parameter estimation through least squares estimation (LSE) method before (that is, the nominal case) and after optimizing BIT designs. The nominal and optimal simulations were used to solve for the 95 % confidence intervals for each parameter, to determine whether estimation precision for faults was improved. 3.1 Case Study I: Fouling Quantification in a Plate Fin Heat Exchanger Air-cooled heat exchangers are a primary component in aerospace environmental control systems, decreasing the temperature of high pressure air flow from compressors, turbines and other upstream components. Cold air used comes directly from outside the aircraft, containing varying levels of particulates that make contact with the heat 9

IFAC DYCOPS-CAB, 2016 10 June 6-8, 2016. NTNU, Trondheim, NorwayKyle A. Palmer et al. / IFAC-PapersOnLine 49-7 (2016) 007–012

Outlet Temperatures (○C)

80

Aircraft ECS BIT was designed using a plate fin heat exchanger model. The model was validated against steadystate and dynamic literature data (Shah (2009)). Fouling was expressed in the model as a change in thermal fouling resistance. More details on the modeling aspects of this system were reported in Palmer et al. (2016). There are several uncertain conditions in aircraft ECS that can affect the heat exchanger outputs in similar ways; namely: humidity levels, cold air mass flow rate, and cold air inlet temperature. These inputs were compiled together with the thermal fouling resistance to create a vector of fault-relevant parameters and uncertain system ˆ The faulty system model was ascribed a variables ξ. thermal fouling resistance 6.2 × 10−3 m2 K/W, describing severe particulate fouling at equilibrium. It was assumed that the air moisture would not condense along the heat exchanger, but instead would solely affect the specific heat capacity of the ram stream. The moisture in the air was set to 1.2 wt%, and the inlet ram channel flow and temperature were set to 1.0 kg/s and 15 ◦ C, respectively. These values all serve as initial parameter estimates in the BIT design algorithm.

70

225 200

60 175 50

150 Nominal

Transition

Optimal 125

40

100 30

0

200

400

600

800

Time (s) Fig. 1. Inlet bleed temperature and predicted outlet ram and bleed temperatures of clean and fouled heat exchanger. The heat exchanger was initially set to steady-state at nominal conditions for 300 s and then transitioned to the steady-state of the optimal BIT settings. The optimal test was simulated for 300 s. over the given time span. As shown in Figure 1, the optimal design started Thi at its lower bound (100 ◦ C) for 60 s, and then imposed a step change to move it to its upper bound (250 ◦ C) for the remainder of the test. This design was the best in minimizing the correlation between uncertain system parameters. The upper bound was the most useful in discerning thermal fouling resistance. At that point, heat transfer was at the allowable maximum, making it most sensitive to deviations in the heat transfer coefficient. The ram inlet temperature was better predicted when bleed and ram inlet temperatures were similar. At identical inlet temperatures there is no energy transfer, therefore the outlet temperatures would remain the same. Any change in the inlet temperature would then be more discernible, like the input step change from the lower bound, shown in Figure 1. Unknown moisture in the ram air inlet affected the ram stream heat capacity. The step change in the inlet temperature produced a strong dynamic response from the outlet temperature, which helped predicting moisture content and ram mass flow rate. This is further illustrated in Table 2 that presents the 95 % confidence region at nominal and optimal designs for each fault-related parameter and uncertain system variable.

Table 1. Conditions for the heat exchanger fouling estimation case study Flow Condition Thi (◦ C) Tci (◦ C) m˙hi (kg/s) m˙ci (kg/s) phi (kPa) pci (kPa)

250

Outlet ram clean Outlet bleed clean Outlet ram fouled Outlet bleed fouled Inlet bleed

Inlet Bleed Temperature (○C)

exchanger surface and foul its passages. Particulate fouling is a common issue in aircraft heat exchangers (P´erezGrande and Leo (2002)). Dust and other undesirables attach to heat exchanger walls, leading to loss of heat transfer effectiveness, and higher energy and fuel expenditure. In more extreme cases, the blockage caused by fouling may damage upstream equipment. Online detection methods are used to monitor sensors and predict fouling levels. At low fouling rates, it is difficult to discern deviations caused by faults or system uncertainty.

Nominal Setting 175 15 0.30 1.00 250 100

Fouling affects the measured outputs of the heat exchanger, which in this case are the exit bleed (hot) and ram (cold) fluid temperatures, Tho and Tco . The bleed air flow is controlled in the upstream bleed system. Therefore, the BIT design was simplified to adjusting solely the inlet bleed temperature Thi (t) for fouling detection. The inlet flow rates and conditions were assigned the nominal values shown in Table 1. The design variable, Thi (t), was bound between 100 to 250 ◦ C, and was divided into a series of discrete steps, lasting 60 - 240 s. The overall timespan of the BIT was fixed to 300 s, the maximum allowable time for a single BIT in ground operation.

Table 2. Estimated values and 95 % confidence intervals of uncertain heat exchanger inlets and fouling at nominal and optimal settings

The proposed method for fouling detection was tested using the tool chain previously mentioned to calculate an optimal sequence of control actions for estimating thermal fouling resistance, along with the other unknown or uncertain inlet conditions. Each measured variable was given a zero-mean white measurement noise with a standard deviation of 0.5 ◦ C. An optimal BIT design was calculated using (6) to adjust the inlet bleed temperature

Uncertain Conditions Rf (m2 K/W × 103 ) wH2 O (×102 ) Tci (◦ C) m ˙ ci (kg/s)

10

Nominal 5.44±133.5 1.03±65.50 15.85±54.45 1.03±1.65

Optimal 5.44±0.98 1.13±0.33 15.05±0.33 1.00±0.008

True 6.20 1.20 15.00 1.00

IFAC DYCOPS-CAB, 2016 June 6-8, 2016. NTNU, Trondheim, NorwayKyle A. Palmer et al. / IFAC-PapersOnLine 49-7 (2016) 007–012

11

BIT and were modeled by altering component parameters from their nominal value. Table 3 describes the three faults studied and their respective altered “faulty” parameter values. Table 3. Faults in the ECS case study Faults Pipe Corrosion Compressor Wear Valve Wear

Description Alteration of pipe characteristics due to exposure to contaminating or degrading fluid. Degradation of compressor seals over time resulting in increased leakage. Degradation of valve seals over time resulting in decreased pressure drop and increased mass flow.

Parameters 0 ∆Ppipe m ˙ 0pipe 0 ∆Pcompressor m ˙ 0compressor 0 ∆Pvalve

The model was assigned nominal values for its “fault” parameters, representing a clean design state. These nominal values served as initial parameter estimates used for the optimal BIT designed. For the ECS case, the optimal BIT configuration utilizes the following three admissible inputs: compressor speed, variable diffuser position and valve position. The pressure downstream the ECS was assumed constant due to the inability to control it when executing BIT around the cabin air compressor. The impact of faults on the ECS subsystem were observed by the available measured system variables: inlet compressor pressure, outlet compressor pressure, temperature and surge margin, and outlet ECS subsystem mass flow rate. Table 4 shows the parameter values used for the nominal and faulty model.

Fig. 2. ECS subsystem model diagram within Dymola. The arrows on the left show the inputs to the system where the arrows on the right show the outputs. This is a variation of the ECS described by Perez-Grande of a no-bleed system architecture found in Boeing’s Quarter 4 2007 publication Aero magazine (P´erezGrande and Leo (2002)). With an optimal design selected for the plate fin heat exchanger, the next step in the BIT methodology is to solve for structural global identifiability. If the fault parameters can be uniquely identified with the measured system outputs obtained from the BIT, it is concluded that the optimal design for BIT is structurally identifiable, meaning that fouling is detectable regardless of the values of the other uncertain system conditions.

Table 4. Parameters for the ECS case study Parameters 0 ∆Ppipe (bar × 102 ) m ˙ 0pipe (kg/s) 0 (bar) ∆Pcompressor 0 m ˙ compressor (kg/s × 102 ) 0 ∆Pvalve (bar)

3.2 Case Study II: Environmental Control System The objective of an aircraft ECS is to provide fresh air at appropriate conditions to the passengers and crew, while performing secondary heating and cooling tasks to various aircraft components (P´erez-Grande and Leo (2002)). To accomplish this objective, aircraft ECSs consist of primary components such as pipes, valves, ozone converters, turbines and compressors, in addition to heat exchangers, in order to condition the external air. During the ECS operation, these components are subject to faults like corrosion, degradation, blockage and fouling over time due to stress and the introduction of foreign objects. These faults can lead to losses in ECS efficiency, power generation, and lack of controllability, increasing its overall operational cost, safety risk, and environmental impact. Due to system uncertainties, the FDI problem presented here is often handled in the aerospace industry via a shotgun approach to BIT design to ensure satisfaction of the FDI capability criteria laid out by the SAE Aerospace Information Report 1266A AC-9 Aircraft Environmental Systems Committee (2011). Given the criteria, a more structured approach to BIT design can be developed, such as the methodology described here, to better handle system uncertainties, improve fault isolation and increase cost savings.

Nominal Value 0.10 1.00 5.00 0.1 2.50

Faulty Value 1.00 0.75 3.00 5.00 1.50

The proposed method for fault detection was tested using the tool chain previously mentioned to calculate an optimal BIT design for estimating the parameters of the three fault cases. Each measurable outlet was given a zeromean white measurement noise with standard deviation of 0.5 ◦ C, 50.0 Pa, and 0.015 kg/s for each respective sensor. An optimal BIT design was calculated by (6) at various steady states over a 200 s time span. The estimates of the ECS faults are presented in Table 5. It was seen that the optimal design vector provides a more accurate parameter estimation, with greater confidence than the nominal design vector. This is illustrated by the 95 % confidence region at nominal and optimal conditions for each fault-related parameter. Table 5. Estimated values and 95 % confidence intervals of uncertain ECS subsystem fault parameters at nominal and optimal settings Parameters 0 ∆Ppipe (bar × 102 ) 0 m ˙ pipe (kg/s) 0 ∆Pcompressor (bar) m ˙ 0compressor (kg/s × 102 ) 0 ∆Pvalve (bar)

An in-depth description of the ECS subsystem and its components, inputs and outputs is given in Hale et al. (2016). Three faults, common to ECSs, were simultaneously injected to the model to observe their identifiability. The faults were assumed to be constant throughout the 11

Nominal 0.59±0.52 1.06±0.22 4.23±4.23 0.01±120 1.52±1.52

Optimal 0.97±0.61 0.78±0.43 3.02±0.42 4.91±0.95 1.50±1.50

True 1.00 0.75 3.00 5.00 1.50

IFAC DYCOPS-CAB, 2016 12 June 6-8, 2016. NTNU, Trondheim, NorwayKyle A. Palmer et al. / IFAC-PapersOnLine 49-7 (2016) 007–012

Similar to the BIT design for the plate fin heat exchanger, the next step in the BIT methodology is to solve for structural global identifiability in the ECS subsystem and conclude if the optimal design for BIT is globally identifiable. As noted before, one factor not considered here is sensor bias, which can have a considerable effect on FDI and will be explored in future work to determine its severity.

Isermann, R. (2005). Model-based fault-detection and diagnosis - Status and applications. Annual Reviews in Control, 29, 71–85. Isermann, R. and Ball´e, P. (1997). Trends in the application of model-based fault detection and diagnosis of technical processes. 5(5), 709–719. Kitsos, C.P. and Kolovos, K.G. (2013). A compilation of the D-optimal designs in chemical kinetics. Chemical Engineering Communications, 200(2), 185–204. Koushanfar, F., Potkonjak, M., and SangiovanniVincentelli, A. (2003). On-line fault detection of sensor measurements. In Proceedings of IEEE Sensors 2003, 974–979. IEEE. Le Digabel, S. (2011). Algorithm 909: {NOMAD}: Nonlinear optimization with the {MADS} algorithm. ACM Transactions On Mathematical Software, 37(4), 44:1—44:15. Ljung, L. and Glad, T. (1994). On global identifiability for arbitrary model parametrizations. Automatica, 30(2), 265–276. R - A Unified Modelica Association (2010). Modelica Object-Oriented Language for Physical Systems Modeling. Modelisar (2010). Functional mock-up interface for model exchange, version 1.0. Modelon AB (2014). FMI Toolbox for MATLAB/Simulink. Palmer, K.A., Hale, W.T., Such, K.D., Shea, B.R., and Bollas, G.M. (2016). Optimal design of tests for heat exchanger fouling identification. Applied Thermal Engineering, 95, 382–393. P´erez-Grande, I. and Leo, T.J. (2002). Optimization of a commercial aircraft environmental control system. Applied Thermal Engineering, 22(17), 1885–1904. Pukelsheim, F. (1993). Optimal Design of Experiments. John Wiley & Sons, Inc., New York, NY, USA. Rodriguez-Fernandez, M., Kucherenko, S., Pantelides, C., and Shah, N. (2007). Optimal experimental design based on global sensitivity analysis. In 17th European Symposium on Computer Aided Process Engineering, 1– 6. Shah, S.A. (2009). Modeling and fouling detection of the aircraft environmental control system heat exchanger. Master’s thesis, Ryerson University. Stelling, P., DeMatteis, C., Foster, I., Kesselman, C., Lee, C., and von Laszewski, G. (1999). A fault detection service for wide area distributed computations. Cluster Computing, 2(2), 117–128. The Mathworks Inc. (2013). MATLAB. Venkatasubramanian, V., Rengaswamy, R., and Kavuri, S.N. (2003a). A review of process fault detection and diagnosis: Part II: Qualitative models and search strategies. Computers & Chemical Engineering, 27, 313– 326. Venkatasubramanian, V., Rengaswamy, R., Kavuri, S.N., and Yin, K. (2003b). A review of process fault detection and diagnosis: Part III: Process history based methods. Computers & Chemical Engineering, 27, 293–311. Venkatasubramanian, V., Rengaswamy, R., Yin, K., and Kavuri, S.N. (2003c). A review of process fault detection and diagnosis: Part I: Quantitative model-based methods. Computers & Chemical Engineering, 27, 293–311.

4. ACKNOWLEDGEMENTS This work was sponsored by the UTC Institute for Advanced Systems Engineering (UTC-IASE) of the University of Connecticut and the United Technologies Corporation. Any opinions expressed herein are those of the authors and do not represent those of the sponsor. Help and guidance provided by Modelon and Modelon-AB are gratefully acknowledged. REFERENCES AC-9 Aircraft Environmental Systems Committee (2011). Fault isolation in environmental control systems of commercial transports. Technical report, SAE Aerospace, SAE Aerospace, Warrendale, PA, USA. Airlines Electronic Engineering Committee (1988). Guidance for design and use of built-in test equipment. Technical report. Asprey, S.P. and Macchietto, S. (2000). Statistical tools for optimal dynamic model building. Computers and Chemical Engineering, 24(2-7), 1261–1267. Bruwer, M.J. and MacGregor, J.F. (2006). Robust multivariable identification: Optimal experimental design with constraints. Journal of Process Control, 16, 581– 600. Cellier, F.E. (2015). Dymola: Environment for objectoriented modeling of physical systems. Fedorov, V. (2010). Optimal Experimental Design. Wiley Interdisciplinary Reviews: Computational Statistics, 2(5), 581–589. Franceschini, G. and Macchietto, S. (2008). Novel anticorrelation criteria for model-based experiment design: Theory and formulations. AIChE Journal, 54(4), 1009– 1024. Hale, W.T., Palmer, K.A., and Bollas, G.M. (2016). Design of Built-In Tests for Active Fault Detection and Isolation. In preparation. Han, L., Zhou, Z., and Bollas, G.M. (2016a). ModelBased Analysis of Chemical-Looping Combustion Experiments. Part I: Structural Identifiability of Kinetic Models for NiO Reduction. AIChE Journal, (In press, DOI: 10.1002/aic.15225). Han, L., Zhou, Z., and Bollas, G.M. (2016b). Modelbased analysis of chemical-looping combustion experiments. Part II: Optimal design of CH4 -NiO reduction experiments. AIChE Journal, (In press, DOI: 10.1002/aic.15242). Hwang, I., Kim, S., Kim, Y., and Seah, C.E. (2010). A survey of fault detection, isolation, and reconfiguration methods. IEEE Transactions on Control Systems Technology, 18(3), 636–653. Isermann, R. (1984). Process fault detection based on modeling and estimation methods—A survey. Automatica, 20(4), 387–404. 12