Fault diagnosis of dynamical systems using recurrent fuzzy systems with application to an electrohydraulic servo axis

JID:FSS AID:6787 /FLA

[m3SC+; v1.204; Prn:24/04/2015; 13:02] P.1 (1-16)

Available online at www.sciencedirect.com

ScienceDirect Fuzzy Sets and Systems ••• (••••) •••–••• www.elsevier.com/locate/fss

Fault diagnosis of dynamical systems using recurrent fuzzy systems with application to an electrohydraulic servo axis A. Schwung a,∗ , M. Beck b , J. Adamy b a South Westfalia University of Applied Sciences, Germany b Technische Universität Darmstadt, Germany

Received 19 June 2014; received in revised form 5 February 2015; accepted 14 April 2015

Abstract This paper presents a novel approach for fault isolation based on discrete-time recurrent fuzzy systems (DTRFS) extending the well-known static fuzzy systems for fault isolation. The DTRFS additionally allows for the isolation of faults causing dynamic residuals and the isolation of multiple subsequently occurring faults. Due to the flexibility of the DTRFS, multiplicative as well as additive faults can be handled. The approach is applied to an electrohydraulic servo axis with a duplex valve system. Experimental results at the testbed underline the effectiveness and applicability of the approach and show the enhanced performance compared to static fuzzy systems and state automata. © 2015 Elsevier B.V. All rights reserved.

Keywords: Fault diagnosis; Fault isolation; Recurrent fuzzy systems; Electrohydraulic servo axis; Duplex valve system; Redundant systems; Fault tolerant control

1. Introduction With increasing demands on efficiency, product quality and safety of industrial processes, reliable process monitoring and fault diagnosis are of utmost importance. The costs caused by system-downtime, repair time or liability for damages often exceed the costs of a supervision module and redundant components. For the considered application example, an electro-hydraulic servo axis with a duplex valve system, a dynamic redundancy concept with hot standby is developed [1], where each valve is supervised by a fault detection and isolating (FDI) module. In faultfree operation both valves are active. The advantages of this operation mode are the hot standby in the case of faults in one valve and the possibility of permanent supervision of both valves. If a severe fault occurs in either of the valves and is detected by the FDI-modules, the spool of the faulty valve is moved to the neutral position while the functionality of the system in a degraded operation mode is assured by the second valve.

* Corresponding author. Tel.: +49 2921 378419.

E-mail address: [email protected] (A. Schwung). http://dx.doi.org/10.1016/j.fss.2015.04.006 0165-0114/© 2015 Elsevier B.V. All rights reserved.

JID:FSS AID:6787 /FLA

2

[m3SC+; v1.204; Prn:24/04/2015; 13:02] P.2 (1-16)

A. Schwung et al. / Fuzzy Sets and Systems ••• (••••) •••–•••

An essential part of the dynamic redundancy concept constitutes the fault detection and isolation module. In general, FDI consists of the following steps: The detection monitors so called symptoms, formed by measured process values and compares them with their nominal values. If a symptom deviates from the nominal value, a fault or an unknown system state has occurred. The subsequent fault isolation then identifies which of the possible fault causes has actually occurred to allow for an appropriate counteraction. Methods for fault detection can roughly be classified into signal- and model-based approaches [2–5]. Additionally, methods originating from artificial intelligence, e.g., neural networks and fuzzy systems are used for fault diagnosis [6–9]. Particularly, model based fault detection using Takagi–Sugeno (TS) fuzzy systems have been reported following the approach of observer-based fault detection and estimation [3]. Such fuzzy observers have been developed in [10] to generate appropriate residuals. In [7], a robust fault detection for uncertain TS fuzzy systems is proposed which optimizes the fault sensitivity by means of linear matrix inequalities (LMI). A similar approach has been presented in [11]. Actuator fault estimation using TS observer has been presented in [12] while [9] discuss a fault estimation observer design using piecewise Lyapunov functions. A fuzzy disturbance observer has been presented in [13] and applied to sensor fault diagnosis. In [14], the sensor faults are modeled as additional auxiliary states resulting in a fuzzy descriptor system. For the extended system, state observers are designed to estimate the fault state using LMIs. To apply the mentioned approaches, the system has to be modeled as a TS fuzzy system. Our approach presented in this paper is conceptually different in that we model the system using first principles and apply a fuzzy system based fault isolation in a second step where we use the fault condition as a state of the fuzzy system. Fault detection of an electrohydraulic servo system has already been considered in some contributions mostly based on model-based methods. A frequently used approach is based on nonlinear observers [15–18]. An alternative approach is employed in [19], where the FDI is performed by an estimation of the physical parameters of the hydraulic system. In this work, a model of the electrohydraulic servo system based on first principles is developed. Furthermore, a combination of model-based and signal-based residuals gained from the electrical, mechanical and hydraulic part of the servo axis is presented. For the electrical part a parity equation based fault detection is developed which also accounts for the hysteresis effects in the electromagnets. Faults in the hydraulic part are detected using a nonlinear model of the pressure built-up. Additionally, the operating range of the actuating signal is monitored. The generated residuals can subsequently be used for fault isolation. Different types of classifiers [20,21] and fuzzy-fault-trees [22] as well as inference methods mostly based on the analysis of fault symptom tables can be applied [23]. Among others, static fuzzy systems (SFS) are well-known representatives of the latter class [4,24] also used for hydraulic systems applications [25,26]. Other approaches are based on neuro-fuzzy-systems [27,28]. In [29] fault diagnosis is implemented using self-learning classification trees. However, these methods have some inherent drawbacks due to their static behavior. Particularly, static approaches cannot cope with dynamic behavior in the symptoms caused by some fault case in the present application. Furthermore, when isolating multiple faults, static symptom tables and classifier may not distinguish between different fault cases. The latter case is of particular importance, since the electrohydraulic servo system shall only be reconfigured in severe fault cases. In the literature, only a few works exist which explicitly take the multiple fault case into account. Early methods use qualitative modelling of static relations [30]. Extensions to dynamic systems are developed using automata [31] or graphs [32,33]. Other approaches employ sequential statistic tests to the most probable (multiple-) fault case [34]. However, the mentioned approaches do not take the time-evolution of the faults and symptoms directly into account. In [35] a diagnosis scheme is proposed which copes with operating point dependent symptoms and time varying symptom tables. However, the fault diagnosis in each time step is performed based on the actual symptoms only. To take the mentioned problems into account, a new approach to fault isolation based on discrete-time recurrent fuzzy systems (DTRFS) [36–38] is proposed. These DTRFS can be interpreted as an extension of classical SFS and have some relations to state automata. Due to their ability to represent dynamic behavior DTRFS are especially suitable for the diagnosis of multiple consecutively occurring faults and faults causing dynamic symptoms. The obtained results show the improved performance of DTRFS compared to SFS and to fault isolation using state automata [39,40]. The paper is organized as follows. In Section 2 the new approach for fault isolation using DTRFS is presented and compared to classical approaches. Section 3 introduces the considered electrohydraulic servo axis with duplex valve system and describes the model-based residual generation while Section 4 provides the results of fault diagnosis for the electrohydraulic servo axis both in simulation and at the testbed.

JID:FSS AID:6787 /FLA

[m3SC+; v1.204; Prn:24/04/2015; 13:02] P.3 (1-16)

A. Schwung et al. / Fuzzy Sets and Systems ••• (••••) •••–•••

3

Table 1 Fault symptom table with three symptoms ρp for three faults ϕi and the corresponding double faults ϕij . Here, i denotes the first, j the second occurred fault and ϕ0 the faultfree case. The symptoms have the linguistic values positive (+), negative (−) and zero (0). ρ1 ρ2 ρ3

ϕ0

ϕ1

ϕ2

ϕ3

ϕ12 , ϕ21

ϕ13 , ϕ31

ϕ23 , ϕ32

0 0 0

0 − −

+ 0 0

+ − 0

+ − 0

+ − −

+ 0 0

2. Fault diagnosis using discrete-time recurrent fuzzy systems This section presents the novel approach to fault diagnosis using recurrent fuzzy systems. After a short review of fault isolation based on SFS, we introduce DTRFS as an extension of SFS and illustrate the design of DTRFS for fault isolation. A comparison to classical approaches like SFS and state automata underlines the improvements of the new approach. 2.1. Fault diagnosis using SFS The application of static fuzzy systems (SFS) for fault diagnosis is a well known and widely-used approach [4]. The design is based on fault symptom tables, which will be illustrated by considering the examplary fault symptom Table 1 including symptoms for both single and double faults. The symptoms take on the linguistic values positive (+), negative (−) and zero (0). Based on such symptom tables, one can formulate rules of the form If

ρ1 = Lρq11 and . . . and ρm = Lρqmm ,

(1)

then

ϕ1 = Lϕw11

(2)

and . . . and ϕl =

Lϕwll ρ

ϕ

to reason about the fault that occurred. Here, Lqvv denotes the linguistic value of symptom ρv and Lwrr denotes the ρ ρ ρ membership value of fault case ϕr . Normally, three linguistic values L1vv = “negative”, L2vv = “zero”, L3vv = “positive” ϕr ϕr are defined for the symptoms, while two linguistic values L1r = “no fault” and L2r = “fault” describe the fault membership. The success in isolating a specific fault depends on the fault pattern. If we consider Table 1, we found that each single fault can be isolated due to a unique assignment of symptoms to fault cases is possible. However, if we additionally consider double faults (ϕi , ϕj ), denoted as ϕij in the following, a unique assignment is not possible. The fault cases ϕ2 , ϕ32 , ϕ23 and ϕ3 , ϕ21 , ϕ12 each possess the same symptoms and hence, cannot be distinguished. Besides the isolation of multiple faults, also faults causing dynamical symptoms as illustrated in Fig. 6 are hardly isolable using static fuzzy systems. Typically, such symptoms can be observed in controlled systems, where the symptom returns to zero after a transient phase. Since the dynamic pattern cannot be represented by a static system, such faults cannot be isolated by SFS. 2.2. Fault diagnosis using DTRFS The previous section has shown that the diagnosis of multiple faults is in general not possible with SFS even if all single faults are isolable. Furthermore, symptoms with dynamical progress in case of a fault are hard to handle by SFS. However, if information about the dynamical progress of the symptoms and the faults is incorporated, the isolation of multiple faults and faults with dynamic symptoms can be improved. This is provided by the extension of SFS to DTRFS. 2.2.1. Introduction to DTRFS In contrast to SFS, in DTRFS the fault cases ϕr are not utilized as outputs, but utilized as states of a DTRFS. By means of the feedback of these states, i.e. the memberships to a fault case, the new fault memberships are determined based on the symptoms and the fault memberships in the previous time step. This is illustrated in Fig. 1. Hence, we obtain rules of the form

JID:FSS AID:6787 /FLA

[m3SC+; v1.204; Prn:24/04/2015; 13:02] P.4 (1-16)

A. Schwung et al. / Fuzzy Sets and Systems ••• (••••) •••–•••

4

Fig. 1. (a) Static fuzzy system for fault isolation. (b) Recurrent fuzzy system for fault isolation. The actual fault state is fed back and used for determination of the subsequent fault state. ϕ

ϕ

ϕ1 (k) = Lj11

If

and . . . and ϕl (k) = Ljll ,

and ρ1 (k) = Lρq11

and . . . and ρm (k) = Lρqmm ,

then ϕ1 (k + 1) = Lϕw11 and . . . and ϕl (k + 1) = Lϕwll , ϕ

ρ

(3)

ϕ

where Ljii , Lqpp and Lwii denote the linguistic values of the fault cases ϕi (k) in time step k, ρp (k) the symptoms and ϕi (k + 1) the fault cases in the subsequent time step k + 1. ρ ϕ To obtain a mathematical expression of the behavior of the DTRFS, membership functions μjii (ϕi ) and μqpp (ρp ) ρ

ϕ

are assigned to each linguistic value Ljii of each fault case ϕi and each linguistic value Lqpp of each symptom ρp , ϕ

ρ

respectively. The maximum of each membership function sjii and sqpp is called core position. Furthermore, we choose ϕ singletons swii as membership functions for the linguistic states in the next time step named output core positions. Additionally, the membership functions should satisfy the following conditions: ϕ

1. Delimination: μjii (ϕi ) ∈ [0, 1] for all ϕi ∈ Xi ,  ϕi ϕ μji (ϕi ) monotonically increases ∀ ϕi < sjii 2. Convexity: ϕ ϕ , μjii (ϕi ) monotonically decreases ∀ ϕi > sjii  ϕ ϕ ϕ ϕ ϕ 3. Partition: ji μjii (ϕi ) = 1 for all ϕi ∈ Xi and μjii (sjii ) = 1 and μjii (sli i ) = 0 for ji = li , ϕ

4. Continuity: μjii (ϕi ) is continuous in Xi . If we choose triangular and ramp functions as membership functions, the DTRFS is completely described by the core positions (Fig. 2(a) top). Algebraic multiplication is used as operator for aggregation and implication, while summation is used for accumulation. The defuzzification is based on the center-of-singletons-method. Considering the conditions 1.–4. and [36], the following analytical form of DTRFS is obtained: ϕ(k + 1) =

 j,q

ϕ

sw

n  i=1

ϕ

μjii (ϕi (k))

m 

ρ

μqpp (ρp (k)).

(4)

p=1

In addition to the conditions 1.–4., we formulate a fifth condition for the definition of the membership functions of the fault cases in time step k + 1: ϕ

5. Feedback correspondence (FBC): Assume Si is the set containing all core positions sjii of fault state ϕi (k). Then, ϕ for the output core positions, the following must apply: swii ∈ Si for all wi = 1, . . . , ζ (i) and i = 1, . . . , n, where ζ (i) denotes the number of core positions of each fault state ϕi . The impact of the FBC on the output core positions as defined in Condition 5. is illustrated in Fig. 2(a). For standard DTRFS without FBC the location of the output core positions can be arbitrary in the output space, e.g. determined by least squares optimization [41], as shown in Fig. 2(a) center. In contrast, FBC implies that the location of the output ϕ ϕ core positions swii of state ϕi (k + 1) is identical to the location of the core positions sjii of state ϕi (k) as illustrated in Fig. 2(a) bottom. Using the feedback correspondence, the dynamics of the DTRFS can be interpreted according to [36] as follows: As long as the DTRFS exclusively operates on core positions, the DTRFS can be interpreted as a

JID:FSS AID:6787 /FLA

[m3SC+; v1.204; Prn:24/04/2015; 13:02] P.5 (1-16)

A. Schwung et al. / Fuzzy Sets and Systems ••• (••••) •••–•••

ϕ

5

ϕ

Fig. 2. (a) Membership functions with corresponding core positions sj 1 (top) as well as output core positions sw11 for DTRFS without (center) and 1 with (bottom) FBC. (b) State graph for a rule base with one state and input variable. The wavy nodes represent the fuzzy nature of the states [36].

Fig. 3. (a) Membership functions of symptoms, (b) Membership functions of fault states of DTRFS, (c) Membership functions of fault states of hybrid DTRFS.

linguistic state automaton. Hence, we can define a corresponding state graph as shown in Fig. 2(b) for a simple rule base, which describes the behavior of DTRFS at the core positions qualitatively. The core positions of the states form the nodes of the state graph. The transitions from one state to another given a combination of input core positions are defined by the rule base. However, it is worth noting that in contrast to classical state automata, the DTRFS generates arbitrary values between the core positions when not operating on them. Hence, we obtain a discrete-time, but not a discrete-event system. 2.2.2. Design of the DTRFS for fault isolation After the system structure of DTRFS is presented, we now discuss the design of the DTRFS for fault isolation. The first step comprises the design of the membership functions for both symptoms and fault states. Normally, three linguistic values “negative”, “zero” and “positive” are used for the symptoms. However, if a more precise resolution of the fault cases is necessary, more linguistic values can be added. Since the symptoms are normalized to zero in the fault free case, a trapezoidal membership function for the linguistic value “zero” is a natural choice as illustrated in Fig. 3(a). The width of the trapezoid can be determined based on the noise variance of the corresponding symptom. For the definition of the fault state membership functions, two different possibilities exist. The first is to choose two ramp functions (see Fig. 3(b)) in compliance to the standard definition of DTRFS with feedback correspondance. However for some application, a unique conclusion about the presence of a fault is required, which raises the questions for which threshold a fault should be considered as present. To avoid this, we can alternatively apply step functions as depicted in Fig. 3(c). Since the symptoms are still fuzzified while the states are binary, we denote the system as hybrid

JID:FSS AID:6787 /FLA

[m3SC+; v1.204; Prn:24/04/2015; 13:02] P.6 (1-16)

A. Schwung et al. / Fuzzy Sets and Systems ••• (••••) •••–•••

6

Fig. 4. Representation of fault symptom table as a linguistic state automata. The double fault ϕ23 is not isolable.

DTRFS. Additionally, also other process related variables apart from the symptoms itself, like e.g., input values can be used as input signals to the DTRFS. Then, process variable dependent rule bases are obtained, which are able to further increase the robustness of the fault isolation and allows the incorporation of adaptive thresholds [42,43]. In the second design step, the rule base has to be determined. Due to the strong relation to automata, we are able to design the DTRFS via their linguistic automata representation, i.e., we first derive a linguistic automaton from the symptom table and second, we maintain the rule base from the automaton. Note, that if we consider the fault states as states of the DTRFS, the core positions can be seen as states of the automata. Then, the rule base defines, which state transition is performed in the presence of specific symptoms. An extract of the state graph obtained from symptom Table 1 is depicted in Fig. 4. By means of the state graph determined using qualitative knowledge about the fault effects, the rule base can be derived. E.g., for the transition from fault ϕ3 to ϕ32 in Fig. 4 we obtain the rule If

ϕ1 (k) = “no fault”

and ρ1 (k) = “positive”

and ϕ2 (k) = “no fault” and ϕ3 (k) = “fault”, and ρ2 (k) = “zero”

and ρ3 (k) = “zero”,

then ϕ1 (k + 1) = “no fault” and ϕ2 (k + 1) = “fault” and ϕ3 (k + 1) = “fault”. However, especially due to the state feedback, the design of the rule base is not always that obvious as can be seen for a simple system with one symptom and one fault state both with only two membership function. We obtain the following four rules for whom the conclusion has to be determined: Rule 1: If ρ(k) = “zero”

and ϕ(k) = “no fault”, then ϕ(k + 1) = ?,

Rule 2: If ρ(k) = “positive” and ϕ(k) = “no fault”, then ϕ(k + 1) = ?, Rule 3: If ρ(k) = “zero”

and ϕ(k) = “fault”,

then ϕ(k + 1) = ?,

Rule 4: If ρ(k) = “positive” and ϕ(k) = “fault”,

then ϕ(k + 1) = ?,

Obviously, rule 1 represents the faultfree operation, while rule 4 represents the faulty operation. Hence, the resulting conclusions are respectively ϕ(k + 1) = “no fault” and ϕ(k + 1) = “fault”. Rule 2 describes the case where the fault has just occurred, i.e. the symptom shows already an abnormal behavior while the state indicates faultfree operation. Since a fault has been detected, the conclusion should be defined as ϕ(k + 1) = “fault”. In contrast to the previous rules, the conclusion of rule 3 is ambiguous. In fact it depends on the fault characteristic as well as on the application. Basically, the rule describes the case, where the fault has been previously detected while the symptom shows a normal behavior. Two different conclusions are possible: The first is to choose

JID:FSS AID:6787 /FLA

[m3SC+; v1.204; Prn:24/04/2015; 13:02] P.7 (1-16)

A. Schwung et al. / Fuzzy Sets and Systems ••• (••••) •••–•••

7

ϕ(k + 1) = “no fault”. This is reasonable if the fault only appears spuriously or if the symptoms are affected by noise. In these cases the fault state should be reset. This form of conclusion results in an attenuation of the fault possibility. The second is to choose ϕ(k + 1) = “fault”. On the one hand, this is reasonable, if it is previously known that a fault cannot be resolved without repair. On the other hand, in case of dynamic symptoms, a transient change of some of the symptoms is part of the fault pattern such that the possibility of the fault occurrence should be further increased, if the expected new fault pattern appears. This type of conclusion results in an amplification of the fault possibility. It is worth noting that a lot of rules of this type are existing in increased rule bases. Then it is very important to balance the effects of rule attenuation and amplification. For this reason we define an additional conclusion as ϕ(k + 1) = “don’t care”, i.e. a conclusion with neutralized influence. 2.2.3. Automatic design of the fault isolator Despite the fact, that a symptom table can be transformed into a linguistic automaton as illustrated in the previous section, the complete determination of the rule base can be time consuming especially if a great number of faults have to be isolated. Alternatively, the automatic design approach of [44] for dynamic modeling with DTRFS can be transformed to the fault isolation case. Therefore, data sets of the form (v)

(v)

(ρˆp(v) (k), ϕˆi (k), ϕˆi (k + 1)),

(5)

representing the fault cases and corresponding residuals, i.e. the fault patterns, have to be available. This can be achieved either by inserting the corresponding faults or if this is not possible by simulation of the fault via a model. In [44], this data-driven identification has been interpreted as a combinatorial optimization problem, since a discrete number of conclusions, in this case just “fault” or “no fault”, have to be assigned to each rule. To this end, we define ϕ ϕ the vector of possible output membership functions for “no fault” snfi and “fault” sf i and a vector awi as   ϕ ϕ T sϕi = snfi sf i , awi = [a1 a2 ]T ,

(6)

where the entries aj are binary variables. With an appropriate choice of the binary variables, we have swϕii = aTwi sϕi ,

(7)

such that the awi serve as selection vectors selecting an output core position for a rule from the set of possible output core positions. With Eq. (7) and by summing up the rule premises, Eq. (4) can be written as  ϕˆ i (k + 1) = aTwi (j,q) (x, u) = χ Ti (x, u) = T (x, u)χ i , (8) j,q

with

⎡

⎤ a1 . χ i = ⎣ .. ⎦ ∈ {0, 1}2R×1 , aR

⎡

⎤ 1 (x, u) .. ⎦ ∈ R2R×1 , (x, u) = ⎣ .

(9)

R (x, u)

the number of rules R and the binary optimization parameters χ i . Furthermore, since the vectors awi serve as selection vectors, at most one output core position can be assigned to each rule premise. Hence, we have to introduce constraints to the binary parameters for each rule as r(i) 

ak ≤ 1.

(10)

k=1

As constraints (10) appear for R rules, they can be recasted in a matrix description as Anb χ i ≤ bnb with

(11)

JID:FSS AID:6787 /FLA

[m3SC+; v1.204; Prn:24/04/2015; 13:02] P.8 (1-16)

A. Schwung et al. / Fuzzy Sets and Systems ••• (••••) •••–•••

8

01×r(i) ⎤ .. ⎥ ⎢ . ⎥ 11×r(i) ⎢0 Anb = ⎢ 1×r(i) (12) ⎥ , bnb = 1Rr(i)×1 .. ⎦ ⎣ .. . . 01×r(i) 01×r(i) ··· 01×r(i) 11×r(i) where 1m×n , 0m×n denote matrices of dimension m × n, whose entries are all ones or zeros, respectively. The inequality leads to rules where no core position is assigned. This can be interpreted as the rule conclusion “don’t care” which is the most frequent choice in fault isolation due to the special structure of the fault patterns. Finally, we define ⎡ (1) ⎤ ⎡ T (1) ⎤ xi (k + 1)  (x (k), u(1) (k)) ⎢ ⎥ .. .. N×1 ⎦ ∈ RN×Rr(i) zi = ⎣ , ϒ =⎣ (13) ⎦∈R . . (N ) T (N ) (N )  (x (k), u (k)) xi (k + 1) ⎡1

1×r(i)

01×r(i)

··· .. . .. .

and choose a quadratic cost function for the difference between the fault output data and the estimated fault output. Then we can recast the combinatorial optimization problem into an integer-quadratic minimization problem Optimization Problem 1. min χi

s.t.

χ Ti ϒ T ϒχ i − 2zTi ϒχ i , Anb χ i ≤ bnb ,

χ i ∈ {0, 1}2R ,

where χ i are binary optimization variables. This IQP-Problem can be solved using branch-and-bound algorithms as implemented in available solvers like C PLEX [45] or BARON [46]. If a priori knowledge is available about some rules, this can be integrated by fixing some variables to either zero or one, i.e. fixing some rule conclusions and remove these variables from the optimization problem. In case of fault diagnosis this can especially be applied to rules for which obvious conclusions can be deduced from the fault symptom table. 2.2.4. Comparison with SFS and automata for fault isolation In this section, we compare the proposed DTRFS with classical SFS and with state automata to discuss potential advantages and drawbacks. First we compare DTRFS to SFS in case of dynamical symptoms as exemplary illustrated in Fig. 6. If such a symptom is fuzzified, not only the linguistic value after the appearance of the fault is relevant, but rather the order in which the linguistic values occur. First with appropriately chosen membership functions both symptoms are fuzzified with membership value one to the linguistic value “positive”, i.e. the symptoms are ++0. In the following, both symptoms decline with some delay, such that the sequence of linguistic values reads 0 + 0 → −+0 → −00 → 0 − 0 → 000. This sequence of linguistic values can be interpreted as a pattern, which can be described by a linguistic automaton and hence, DTRFS. In this way, arbitrary dynamical symptoms can be recasted into a pattern of linguistic values to which a fault case is assigned. In contrast, the SFS is not able to recognize such patterns and hence, is not able to uniquely isolate faults causing dynamical symptoms. The same can also be observed for double fault cases. We consider again symptom Table 1, especially the double fault ϕ12 . This fault cannot be discriminated from the single fault ϕ3 using the SFS. However, if fault ϕ1 appears first and is isolated correctly, this information is fed back by the DTRFS. By observing a change in the symptoms to “+−0” and accounting for the additional information that fault ϕ1 is detected previously, the double fault ϕ12 can be isolated uniquely. The single fault ϕ3 can be excluded. If ϕ2 appears first, a similar behavior can be observed. Exceptions are the double faults ϕ23 and ϕ32 respectively. Obviously, the isolability depends on the order in which the faults appear. If ϕ3 with symptoms “+−0” appears first, the isolation of double fault ϕ32 is possible due to the change of symptoms to “+00”. In contrast, if ϕ2 with symptoms “+00” appears first, the double fault ϕ23 having the same symptoms “+00” cannot be isolated. The reason for this behavior is that the first fault superimposes the effect of the second fault with respect to the symptoms. Altogether, the number of isolable fault can be increased significantly due to the extension to DTRFS.

JID:FSS AID:6787 /FLA

[m3SC+; v1.204; Prn:24/04/2015; 13:02] P.9 (1-16)

A. Schwung et al. / Fuzzy Sets and Systems ••• (••••) •••–•••

9

Fig. 5. Schematic assembly of the testbed with a duplex-valve-system.

As mentioned in the previous section, the DTRFS and a corresponding state automaton perform similarly [36]. If we choose binary membership functions in both states and symptoms, both systems are equivalent. However, the DTRFS has some advantages, if the symptoms deviate from their nominal values not only in case of a fault but also in the fault free case due to unmodeled dynamics or noise. To illustrate this fact, we consider again symptom Table 1. We assume, that symptom ρ2 becomes less negative than expected in case of fault ϕ3 due to unmodeled dynamics or disturbances. Thus, the crisp threshold of the state automaton between “zero” and “negative” is not crossed, while the DTRFS is in the interpolation region between the core positions “zero” and “negative”. Due to the symptom “+00” the state automaton outputs the wrong fault case ϕ2 . In contrast, due to the fuzzy threshold the DTRFS outputs also fault ϕ3 with a certain fault membership. If fault ϕ1 additionally appears, this fault cannot be reported by the state automaton, since the double fault ϕ31 cannot be reached after the detection of ϕ2 (compare with Fig. 4). In contrast, due to the feedback of the membership value of fault ϕ3 , the double fault ϕ31 is correctly isolated by the DTRFS. Hence, the DTRFS is more robust against disturbances and modeling inaccuracies than the state automaton. Uncertainty in the faulty behavior of the system, i.e. the fault pattern, always exist which can be better represented by a fuzzy automaton. Consequently, the design of the thresholds, i.e. the core positions of the symptoms, is much less involved. 3. Case study: electrohydraulic servo axis with duplex valve system In this section, the previously presented DTRFS is applied for the fault isolation of an electrohydraulic servo axis with a duplex valve system as illustrated in Fig. 5 [47,48]. Application examples include classic areas like undercarriages and landing flaps of planes as well as machine tools. Due to the redundant design the system offers special opportunities for reconfiguration after a fault has occurred. A highly reliable fault isolation is hence an essential part. Since the duplex valve system is an electrohydraulic system, a first principle model is developed in [47,48] and appropriate residuals for symptom generation have been determined as illustrated next. 3.1. System description The considered electrohydraulic servo axis consists of the two identical direct-driven proportional valves, the cylinder, oil supply pump and the mechanical load represented by a spring (see Fig. 5). All components are connected to a rapid control prototyping (RCP) system from dSPACE which can be programmed directly from MATLAB/Simulink. The proportional valves are 4/3 valves (Bosch Rexroth type 4WRE) with a nominal volume flow of 16 l/min at p = 10 bar where the valve spools are position-controlled. The double-acting differential cylinder (Bosch Rexroth type CDW160) has a nominal pressure of 160 bar, 40 mm cylinder diameter, a piston rod diameter of 28 mm and a maximum stroke of 300 mm. The supply pump is a swash plate axial piston pump driven by a 15 kW AC induction motor also from Bosch Rexroth type SYDFEC. The pump has an integrated controller which keeps the supply pressure at the desired pressure value during the experiments. The pump controller transmits supply pressure and volume flow sensor data via CAN bus to the RCP. The load can be moved continuously and positioned as accurately as possible. Since both valves are identical, the fault diagnosis module can be designed equally for both valves. Hence, we concentrate on one valve in the following. Considering the modeling of the valve, we distinguish between the electromagnetic and the hydraulic part. The electromagnetic part consists of two direct-current electromagnets [47] moving the valve spool continuously. The

JID:FSS AID:6787 /FLA

[m3SC+; v1.204; Prn:24/04/2015; 13:02] P.10 (1-16)

A. Schwung et al. / Fuzzy Sets and Systems ••• (••••) •••–•••

10

position of the valve spool is measured with a linear variable differential transformer and controlled by a cascaded position control loop. The subordinated control loop consists of two current control loops of the valve coils. The superimposed loop controls the position of the valve spool. The position of the valve spool affects the volume flow rate over the four control edges of the proportional valve. The volume flows then cause a pressure built-up in the cylinder chambers allowing to move the load to the desired position. At the testbed, a spring is used as a load. The supply pressure is delivered by a pressure controlled pump. The pressures in the chambers are measured with common pressure transmitters. Additionally, the load position is controlled by a PID-controller. Faults can occur in the electromagnetic, the mechanical and the hydraulic part of the servo axis. In [49] models are presented that cover the electromagnetic part by defining three isolating parity equations. In the present paper we consider the fault diagnosis of the hydraulic part of the system which is more involved with the given residuals. Hereby, we take both additive and multiplicative faults into account. As additive faults we define drift faults in the pressure sensors of chamber A and B and of the supply as well as an offset in the valve spool position sensor. Additionally, we consider a stuck piston position sensor signal. As parametric faults we assume an increased internal leakage caused by worn seals and a reduced bulk modulus caused by air enclosures. Finally, we examine both a blocked piston and a blocked valve spool. In order to detect and isolate these faults, the model-based residual generation is presented in the next section. 3.2. Residual generation The differential cylinder is schematically shown in Fig. 5. The cylinder used at the testbed is a double acting differential cylinder with a one-sided piston rod. The estimated pressure built-up in chamber A pˆ˙ A and chamber B pˆ˙ B can be described by [49,1] ˆ AT − GAB (pA − pB ) − AA y) ˆ PA − Q ˙ E(Q , pˆ˙ A = V0A + AA y ˆ BT + GAB (pA − pB ) + AB y) ˆ PB − Q ˙ E(Q , p˙ˆ B = V0B − AB y

(14) (15)

ˆ P A and Q ˆ P B are the modeled volume flows into chamber A and B, Q ˆ AT and Q ˆ BT are the modeled volume where Q flows out of chamber A and B, respectively, and y is the piston position. Furthermore, V0∗ and A∗ are the dead volume and active piston area of chamber A and B, E denotes the bulk modulus and GAB the laminar leakage coefficient assumed to be zero in the following. The estimation of the laminar leakage coefficient allows the detection of internal leakage. The volume flows are modeled by a semi-physical model of the flow rate over the four control edges, where ˆ B are nonlinear dependent on the valve spool position yv , the valve overlap s0 , the ˆ A and Q the volume flows Q ˆ∗ = Q ˆ P ∗ − Qˆ ∗T = f (yv , pS , pA , pB , s0 ). pressure supply pS and pressure pA and pB in chamber A and B, i.e., Q The parameters of the model are obtained by measurements on the testbed and identification methods (see [50]). With Eqs. (14) and (15) the residuals rpA and rpB can be formulated as rpA = p˙ A − p˙ˆ A , rpB = p˙ B − pˆ˙ B .

(16) (17)

The derivation with respect to time of the piston position y˙ and the pressures p˙ A , p˙ B are each obtained by a state variable filter (SVF) described in [50]. The position signal is obtained from the superimposed control loop. In faultfree operation of the electro-hydraulic servo axis the residuals rpA and rpB show only small deflections caused by model uncertainty and measurement noise. Additionally, we monitor the operating range of the valve spool position signal yv . If this signal is below or above of two given fixed thresholds yv,min and yv,max , the symptom is set to one, i.e., we obtain  0, if yv,min < yv < yv,max (18) rsat = 1, else. Symptom rsat is especially suited for detecting stuck faults of the piston. After the definition of the residuals we now investigate how the residuals are affected by the faults. This is illustrated in the fault symptom Table 2 and some special effects can be observed. First, the stucked position signal causes a limit

JID:FSS AID:6787 /FLA

[m3SC+; v1.204; Prn:24/04/2015; 13:02] P.11 (1-16)

A. Schwung et al. / Fuzzy Sets and Systems ••• (••••) •••–•••

11

Fig. 6. Dynamic residuals rpA and rpB due to an abrupt reduction of the bulk modulus at t = 0.5 s. Table 2 Fault symptom table of the hydraulic part. Here, + denotes a positive, − a negative and o no deflection. The abbreviation “lc” denotes limit cycle while “dyn” denotes the dynamic residual. For fault ϕ9 , the blocking results in a positive as well as in a negative deflection in relation to the reference point. Fault

rpA

rpB

rsat

ϕ0 : fault free ϕ1 : drift in pressure sensor (chamber A) ϕ2 : drift in pressure sensor (chamber B) ϕ3 : drift in pressure supply sensor ϕ4 : stucked piston position signal ϕ5 : internal leakage GAB ϕ6 : reduced bulk modulus E0 ϕ7 : piston blocked ϕ8 : offset in valve spool position sensor ϕ9 : valve spool blocked (+/−)

o + o − − − dyn o + −/+

o o + − lc + dyn o − +/−

o o o o + o o +/− o +/−

cycle in the residual of chamber B. Second, a reduction of the bulk modulus causes a dynamic residual trajectory as shown in Fig. 6. Due to the influence of the cascaded control loop, the residual first becomes positive followed by a short negative overshoot and a return to zero. Based on the above fault symptom table, the isolation of the considered faults can be investigated by the DTRFS. 4. Results Now, the results of the fault diagnosis for the servo axis with a duplex valve system are presented. First, we discuss the performance of single and double fault isolation using DTRFS and compare the results with SFS. Furthermore, some fault scenarios are presented to illustrate the applicability of the approach both in simulation and at the testbed. The DTRFS is implemented using a combination of a priori knowledge represented by the fault symptom table and the automated design presented in Section 2.2.3. The fault symptom table is used for the initial DTRFS. However, the determination of the complete rule base is difficult to obtain solely with a priori knowledge. Particularly, rules with ambiguous conclusions exist. Hence, an additional data based optimization is performed based on data sets generated from the testbed and simulation model. 4.1. Single and double fault isolation First, we consider single faults on the basis of fault symptom Table 2. Obviously, the sensor faults ϕ1 − ϕ3 are distinguishable and can be isolated by a SFS. Similar results can be obtained for a blocked cylinder ϕ7 which is uniquely isolable using symptom rsat . In contrast, the dynamic symptoms in case of fault ϕ6 are hardly detectable by the SFS, since they are temporarily identical to the symptoms of ϕ5 and ϕ8 . Hence, this fault case is only uniquely isolable by the DTRFS due to its ability to represent the resulting linguistic pattern depicted in Fig. 6. To sum up, contrary to the SFS the DTRFS is able to isolate each single fault uniquely.

JID:FSS AID:6787 /FLA

12

[m3SC+; v1.204; Prn:24/04/2015; 13:02] P.12 (1-16)

A. Schwung et al. / Fuzzy Sets and Systems ••• (••••) •••–•••

Table 3 Overview of the isolable faults for the electrohydraulic servo axis with a duplex valve system using the DTRFS. The green colored fault cases are uniquely isolable, the red colored fault cases are not isolable. In the orange colored cases the symptom magnitude determines if the fault is isolable. Partly, only fault groups are isolable. (For interpretation of the references to color in this figure, the reader is referred to the web version of this article.)

Additionally, the previously defined double faults are analyzed. The results are given in Table 3. Three different classes can be distinguished: • Green colored: These faults are uniquely isolable by the DTRFS. This class contains those double faults for which a blocked cylinder or blocked valve spool (faults ϕ7 and ϕ9 ) as well as a stucked position signal (fault ϕ4 ) appears as the second fault. This originates from the dominant effects of these faults on the symptoms compared to the first fault. Furthermore, double faults containing a bulk modulus fault as first the fault are mainly uniquely isolable. This originates from the unique dynamic symptoms caused by ϕ6 . • Orange colored: If the fault are isolable depends on the magnitudes of both faults. The magnitude of the subsequent fault has to be large enough to cause a change in the linguistic values of the symptoms. If this is not the case, the faults are not isolable, otherwise two subclasses can be distinguished. On the one hand double faults exist which are uniquely isolable if the fault magnitudes are appropriate, e.g. fault ϕ13 . On the other hand, double faults exist where their symptoms are independent of the magnitudes, but show the same characteristic as magnitudedependent double faults. Then, only groups of faults can be isolated, e.g. fault ϕ12 with linguistic symptoms ++0 exhibits the same linguistic values as ϕ15 with appropriate symptom magnitudes. Hence, only the group (ϕ12 , ϕ15 ) can be isolated. • Red colored: These faults are not isolable by the DTRFS. This class contains double faults with the bulk modulus fault as the second fault. The resulting dynamical symptoms cannot be detected due to the dominant first fault effects. Additionally, ϕ81 is not isolable, since the symptom of ϕ8 and ϕ81 are identical. In summary, each of the nine single fault as well as additional 23 double faults are uniquely isolable. For 21 double faults, the fault isolation depends on the symptom magnitudes. Four double faults are not isolable. In contrast, using the SFS double faults are not uniquely isolable, but only fault groups can be isolated. These groups mostly contain a large number of fault cases making the SFS unsuitable for an application for the electrohydraulic servo axis. 4.2. Fault scenarios After presenting the overall results, the method is illustrated in detail for some scenarios. Since a reduction of the bulk modulus cannot be implemented at the testbed, we present results applying a detailed simulation model of the hydraulic system for this case. For the other scenarios, results obtained at the testbed are presented. 4.2.1. Scenario 1: Reduction of the bulk modulus (simulation) As a first scenario, a reduction of the bulk modulus by 50% (fault ϕ6 ) is considered.1 This fault case is chosen, since it causes a dynamic residual. Fig. 7 shows residuals rpA and rpB as well as the core positions. The residual rsat is not sensitive for this fault case (rsat = 0) and hence, omitted. The DTRFS is designed to cover the dynamic pattern as explained in Section 2.2.4. 1 For 80 bar, this corresponds to an air to oil relation of 0.6.

JID:FSS AID:6787 /FLA

[m3SC+; v1.204; Prn:24/04/2015; 13:02] P.13 (1-16)

A. Schwung et al. / Fuzzy Sets and Systems ••• (••••) •••–•••

13

Fig. 7. Residuals rpA and rpB (solid) with core positions (dotted) and results of fault isolation for a sudden reduction of the bulkmodulus by 50%.

Fig. 8. Reference signal for the measurements at the testbed.

The results are shown in Fig. 7. First, fault ϕ2 is isolated with a maximal membership of 0.15. This is caused by the delayed reaction of the residuals resulting in a low membership to pattern 0 + 0, indicating the occurrence of fault ϕ2 (compare with Table 2). Afterwards, the residuals follow the described dynamic pattern of linguistic values. As soon as the last part of the pattern is recognized, the fault ϕ6 is isolated correctly by the DTRFS. 4.2.2. Scenario 2: Double fault with internal leakage and subsequent stucked piston position signal The second scenario is implemented at the testbed. The system is excited by the reference signal w depicted in Fig. 8. During the scenarios, the load is kept constant. As discussed in Section 2.2.4 the DTRFS is robust to mild changes in the load conditions. If major load changes have to be considered, this has to be accounted for by adding a load estimation signal as an additional input to the DTRFS. Since the leakage is neglected in the residuals which is not valid at the testbed, both pressure residuals rpA and rpB have an offset. Hence, the membership functions show symmetrical deflections around the offset. Furthermore, trapezoidal membership functions for the linguistic value “zero” are applied to enhance the robustness against noise and disturbances. In the scenario internal leakage at the piston occurred at t = 10.2 s. Additionally, the piston position sensor failed at t = 24 s. The residuals rpA and rpB and the faults ϕ4 and ϕ5 are depicted in Fig. 9. By occurrence of the leakage rpA react in the positive and rpB in the negative direction. The fault ϕ5 is displayed correctly. The short reductions of the membership functions are caused by the transients in the residuals. The subsequent occurrence of fault ϕ4 leads to a change of the signs of the residuals after a short transient phase. Furthermore, rsat reacts. Hence, the DTRFS is able to detect both faults.

JID:FSS AID:6787 /FLA

14

[m3SC+; v1.204; Prn:24/04/2015; 13:02] P.14 (1-16)

A. Schwung et al. / Fuzzy Sets and Systems ••• (••••) •••–•••

Fig. 9. Residuals rpA , rpB and rsat (solid) with core positions (dotted) as well as results of fault isolation. Both faults ϕ5 and ϕ4 are isolated correctly.

Fig. 10. Residuals rpA and rpB (solid) with core positions (dotted) as well as the results of the fault isolation of scenario 3. Both faults ϕ1 and ϕ9 are isolated correctly.

4.2.3. Scenario 3: Double fault with pressure sensor drift and subsequent blocking of the valve spool In the third scenario a pressure sensor drift in chamber A at t = 9 s occurs. Additionally, the valve spool blocks at t = 18.5 s. Fig. 10 shows the resulting progress of the residuals rpA and rpB as well as the indicated faults. With appearance of the first fault only symptom rpA deflects in positive direction. However, due to the small drift the value of the residual is in the region of the core positions. Hence, the fault ϕ1 is initially detected with a minor membership

JID:FSS AID:6787 /FLA

[m3SC+; v1.204; Prn:24/04/2015; 13:02] P.15 (1-16)

A. Schwung et al. / Fuzzy Sets and Systems ••• (••••) •••–•••

15

grade. Due to the feedback of the fault states and with appropriate design of the rule base, the membership grade of the fault state increases with continuous slightly deflecting residual. It can be noted that despite the small deflection the fault is isolated. If additionally the valve spool blocks limit cycles due to the nonlinearities and the controller design can be observed in both residuals rpA and rpB . In this case, the behavior of the real system at the testbed deviates from the simulation model (compare with Table 2) due to a reduced load at the cylinder during the test run. After an appropriate modification of the rule base the DTRFS isolates both appearing faults ϕ1 and ϕ9 correctly. 5. Summary and conclusion This paper presented a novel approach to fault isolation using discrete-time recurrent fuzzy systems. Based on an extension of static fuzzy systems, DTRFS offer considerable advantages especially for the isolation of multiple subsequently occurring faults and faults with dynamic symptoms. Furthermore, since fuzzy system allows for the consideration of uncertainty, DTRFS show an improved robustness in their isolation capability in case of modelling errors and partly unknown fault characteristics compared to other approaches like state automata. Due to the fault state feedback the rule bases become much larger compared to the rule bases of static fuzzy systems. However, using the automated rule base generation presented in this work, the increased design efforts can be compensated. The application of the DTRFS to fault isolation of an electrohydraulic servo axis indicates that despite the fact that only a small number of residuals is employed, the DTRFS provides a powerful isolation of additive and multiplicative faults. The results obtained at the testbed underline the effectiveness of the approach. In the future we will especially examine the fault diagnosis of the redundant valve system, i.e. the integration of the second valve and dealing with the breakdown of one of the valves. Since, the failed valve is switched off completely, those residuals cannot be used for isolation any more. These can also be included in the DTRFS. Furthermore, the integration of the DTRFS in a fault tolerant control framework is a topic of future research. References [1] M. Beck, A. Schwung, M. Münchhof, R. Isermann, Active fault tolerant control of an electro-hydraulic servo axis with a duplex-valve-system, in: Proc. of the 5th IFAC Symposium on Mechatronic Systems, Cambridge, USA, 2010. [2] M. Blanke, M. Kinnaert, J. Lunze, M. Staroswiecki, Diagnosis and Fault-Tolerant Control, Springer, 2006. [3] P.M. Frank, Fault diagnosis in dynamic systems using analytical and knowledge-based redundancy — a survey and some new results, Automatica 26 (3) (1990) 459–474. [4] R. Isermann, Fault Diagnosis Systems — An Introduction from Fault Detection to Fault Tolerance, Springer, 2006. [5] J. Gertler, Fault detection and isolation using parity relations, Control Eng. Pract. 5 (5) (1997) 653–661. [6] P.M. Frank, B. Köppen-Seliger, Fuzzy logic and neural network applications to fault diagnosis, Int. J. Approx. Reason. 16 (1) (1997) 67–88. [7] S.K. Nguang, S. Peng, S. Ding, Fault detection for uncertain fuzzy systems: an LMI approach, IEEE Trans. Fuzzy Syst. 15 (6) (2007) 1251–1262. [8] R.J. Patton, F.J. Uppal, C.J. Lopez Toribio, Soft computing approaches to fault diagnosis for dynamic systems: a survey, in: Proc. of the IFAC Symposium on Fault Detection Supervision and Safety for Technical Processes, Budapest, Hungary, 2000, pp. 298–311. [9] K. Zhang, B. Jiang, P. Shi, Fault estimation observer design for discrete-time Takagi–Sugeno fuzzy systems based on piecewise Lyapunov functions, IEEE Trans. Fuzzy Syst. 20 (1) (2012) 192–200. [10] E. Alcorta-Garcia, S. Saucedo-Flores, Fault detection and isolation based on Takagi–Sugeno modelling, in: Proc. of the 2003 IEEE International Symposium on Intelligent Control, Houston, USA, 2003, pp. 673–678. [11] J.L. Wang, G.-H. Yang, J. Liu, An LMI approach to h− index and mixed h− / h∞ fault detection observer design, Automatica 43 (9) (2007) 1656–1665. [12] B. Jiang, K. Zhang, P. Shi, Integrated fault estimation and accommodation design for discrete-time Takagi–Sugeno fuzzy systems with actuator faults, IEEE Trans. Fuzzy Syst. 19 (2) (2011) 291–304. [13] Z. Gao, X. Shi, S.X. Ding, Fuzzy state/disturbance observer design for T–S fuzzy systems with application to sensor fault estimation, IEEE Trans. Syst. Man Cybern., Part B, Cybern. 38 (3) (2007) 875–880. [14] M. Chadli, A. Abdo, S.X. Ding, h− / h∞ fault detection filter design for discrete-time Takagi–Sugeno fuzzy system, Automatica 49 (7) (2013) 1996–2005. [15] L. Chen, S. Liu, Fault diagnosis integrated fault-tolerant control for a nonlinear electro-hydraulic system, in: Proceedings of the IEEE MultiConf. on Systems and Control, Yokohama, Japan, 2010, pp. 1039–1044. [16] S. Gayaka, B. Yao, Fault detection, identification and accommodation for an electro-hydraulic system: an adaptive robust approach, in: Proceedings of the IFAC World Congress, Seoul, Korea, 2008, pp. 13815–13820. [17] H. Hammouri, P. Kabore, S. Othman, J. Biston, Failure diagnosis and nonlinear observer: application to a hydraulic process, J. Franklin Inst. 339 (2002) 455–478. [18] G.J. Preston, D.N. Shields, S. Daley, Application of a robust nonlinear fault detection observer to a hydraulic system, in: Proceedings of UKACC Intern. Conf. Control, UK, 1996, pp. 1484–1489.

JID:FSS AID:6787 /FLA

16

[m3SC+; v1.204; Prn:24/04/2015; 13:02] P.16 (1-16)

A. Schwung et al. / Fuzzy Sets and Systems ••• (••••) •••–•••

[19] D. Yu, Fault diagnosis for a hydraulic drive system using a parameter-estimation method, Control Eng. Pract. 5 (9) (1997) 1283–1291. [20] W.J. Crowther, K.A. Edge, R.M. Atkinson, D.J. Woollons, Fault diagnosis of a hydraulic actuator circuit using neural networks — an output vector space classification approach, Proc. Inst. Mech. Eng. 212 (1) (1998) 57–68. [21] S. Leonhardt, M. Ayoubi, Methods of fault diagnosis, Control Eng. Pract. 5 (5) (1997) 683–692. [22] N. Kiupel, B. Köppen-Seliger, H.S. Kellinghausen, P.M. Frank, Fuzzy residual evaluation concept, in: Proc. of the IEEE Intern. Conf. on Systems, Man, and Cybernetics, Vancouver, Canada, 1995, pp. 13–18. [23] J. Gertler, D. Singer, A new structural framework for parity equation-based failure detection and isolation, Automatica 26 (2) (1990) 381–388. [24] N. Kiupel, P.M. Frank, Process supervision with the aid of fuzzy logic, in: Proc. of the IEEE Intern. Conf. on Systems, Man, and Cybernetics, Le Touquet, France, 1993, pp. 409–414. [25] M. Kulkarni, S.C. Abou, M. Stachowicz, Fault detection in hydraulic system using fuzzy logic, in: Proceedings of the World Conference on Engineering and Computer Science, San Francisco, USA, 2009. [26] M. Münchhof, Displacement sensor fault tolerance for hydraulic servo axis, in: Proceedings of the 17th IFAC World Congress, Seoul, Korea, 2008, pp. 13803–13808. [27] M. Ayoubi, R. Isermann, Neuro-fuzzy systems for diagnosis, Fuzzy Sets Syst. 89 (3) (1997) 289–307. [28] T. Pfeufer, M. Ayoubi, Application of a hybrid neuro-fuzzy system to the fault diagnosis of an automotive electromechanical actuator, Fuzzy Sets Syst. 89 (3) (1997) 351–360. [29] D. Füssel, Fault diagnosis with tree-structured neuro-fuzzy systems, Dissertation, Technische Universität Darmstadt, Fortschrittberichte VDI, Reihe 8, Nr. 957, VDI Verlag, Düsseldorf, 2002. [30] J. De Kleer, B.C. Williams, Diagnosing multiple faults, Artif. Intell. 32 (1) (1987) 97–130. [31] S. Subramanian, R.J. Mooney, Qualitative multiple-fault diagnosis of continuous dynamic systems using behavioral modes, in: Proc. of the National Conf. on Artificial Intelligence, Menlo Park, USA, 1996. [32] F. Tu, K.R. Pattipati, S. Dep, V.N. Malepati, Computationally efficient algorithms for multiple fault diagnosis with unreliable tests, IEEE Trans. Syst. Man Cybern., Part A, Syst. Hum. 33 (1) (2003) 73–85. [33] H. Vedam, V. Venkatasubramanian, Signed digraph based multiple fault diagnosis, Comput. Chem. Eng. 21 (6) (1997) 655–660. [34] M. Nyberg, A fault isolation algorithm for the case of multiple faults and multiple fault types, in: Proc. of the IFAC Symposium on System Identification, Newcastle, Australia, 2006, pp. 303–308. [35] S. Clever, Model-based fault detection and diagnosis for a common rail diesel engine, Dissertation, Technische Universität Darmstadt, Fortschrittberichte VDI, Reihe 8, Nr. 1202, VDI Verlag, Düsseldorf, 2011. [36] J. Adamy, R. Kempf, Regularity and chaos in recurrent fuzzy systems, Fuzzy Sets Syst. 140 (2) (2003) 259–284. [37] R. Kempf, J. Adamy, Equilibria of recurrent fuzzy systems, Fuzzy Sets Syst. 140 (2) (2003) 231–257. [38] R. Kempf, J. Adamy, Sequential pattern recognition employing recurrent fuzzy systems, Fuzzy Sets Syst. 146 (3) (2004) 451–472. [39] M. Daigle, X. Koutsoukos, G. Biswas, A qualitative approach to multiple fault isolation in continuous systems, in: Proc. of the AAAI Conf. on Artificial Intelligence, Vancouver, Canada, 2007, pp. 293–298. [40] N. Meskin, K. Khorasani, C.A. Rabbath, A hybrid fault detection and isolation strategy for a network of unmanned vehicles in presence of large environmental disturbances, IEEE Trans. Control Syst. Technol. 18 (6) (2010) 1422–1429. [41] J. Adamy, A. Schwung, Qualitative modeling of dynamical systems employing continuous-time recurrent fuzzy systems, Fuzzy Sets Syst. 161 (23) (2010) 3026–3043. [42] D. Sauter, N. Mary, F. Sirou, A. Thieltgen, Fault diagnosis in systems using fuzzy logic, in: Proc. of the IEEE Conf. on Control Applications, 1994, pp. 883–888. [43] H. Schneider, P.M. Frank, Observed-based supervision and fault detection in robots using nonlinear and fuzzy logic residual evaluation, IEEE Trans. Control Syst. Technol. 4 (3) (1996) 274–282. [44] A. Schwung, J. Adamy, Modeling with discrete-time recurrent fuzzy systems via mixed-integer optimization, Fuzzy Sets Syst. 203 (2012) 1–16. [45] CPLEX 6.5 user manual, ILOG Inc., ILOG S.A., Gentilly Cedex, France, 1999. [46] N.V. Sahinidis, Baron — branch and reduce optimization navigator, Technical report, University of Illinois at Urbana-Champaign, Department of Chemical Engineering, Urbana, USA, 2000. [47] M. Beck, Fehlertoleranzstrategien für mechatronische Systeme, Abschlussbericht, Arbeitsgemeinschaft industrieller Forschungsvereinigung Otto von Goericke e.V. (BMWi), Frankfurt, 2010. [48] M. Münchhof, Model-based fault detection for a hydraulic servo axis, Dissertation, Technische Universität Darmstadt, 2006. [49] M. Beck, M. Münchhof, R. Isermann, Model-based fault detection and diagnosis for electromagnetic valve drives, in: Proc. of the Dynamic System and Control Conf., Hollywood, USA, 2009. [50] R. Isermann, M. Münchhof, Identification of Dynamic Systems: An Introduction with Applications, Springer, 2011.