- Email: [email protected]
Fault-tolerant Internal Model Control with Application to a Diesel Engine
Proceedings of the 7th IFAC Symposium on Fault Detection, Supervision and Safety of Technical Processes Barcelona, Spain, June 30 - July 3, 2009
Fault-tolerant Internal Model Control with Application to a Diesel Engine Michael Hilsch ∗ Jan Lunze ∗∗ Rainer Nitsche ∗ ∗
Robert Bosch GmbH, Corporate Sector Research and Advance Engineering, Stuttgart, Germany (e-mail: [email protected], [email protected]) ∗∗ Institute of Automation and Computer Control, Ruhr-Universit¨ at Bochum, Bochum, Germany (e-mail: [email protected]) Abstract: The paper proposes a new structure for fault-tolerant control of nonlinear systems subject to persistent faults. The principle of Internal Model Control (IMC) is extended to ensure fault tolerance with respect to faults that do not affect the plant stability. The method is based on a representation of sensor, actuator and plant faults as parameter changes of the plant model, which is part of the IMC control law. It is proved that the IMC control loop, which is extended by a diagnostic unit, tolerates substantial faults and ensures the nominal loop performance unless the fault changes the structure of the nonlinear plant. These results are illustrated for the air path of a Diesel engine. Keywords: Internal Model Control, fault-tolerant control, fault diagnosis, automotive application, diesel engine. 1. INTRODUCTION
f w
The increasing complexity of mechatronic automotive systems causes the need of advanced control algorithms, which have to be suitable for nonlinear systems, have to take the limited computing power of on-board control units into account and have to be fault tolerant. This paper extends nonlinear Internal Model Control (IMC) to make it tolerant with respect to sensor, actuator and plant faults. The paper shows that the new method of fault-tolerant IMC retains the nominal performance of the closed-loop system for a wide range of faults. This new method is evaluated by its application to the air path of a diesel engine. d w
¯ w
Q
uc
Σ
−
˜ Σ
ym ˜m y −
e Fig. 1. Structure of a nonlinear IMC. ˜ of IMC is a control method, in which the model Σ the plant Σ is used as a component of the control law (Fig. 1). The feedback Q is chosen so that the closed-loop system follows the command signal w and attenuates the disturbance d. As shown by Schwarzmann [2007] for inputaffine nonlinear plants Σ, the feedback law Q is directly ˜ related to the plant model Σ. This relation will be utilised here for fault accomodation. The IMC structure is extended by a fault detection and identification unit (FDI), which provides current informa-
978-3-902661-46-3/09/$20.00 © 2009 IFAC
¯ w
Qfˆ
uc
d
Σf
y m,f
−
FDI fˆ
˜ fˆ Σ
˜ m,fˆ y −
e Fig. 2. Structure of a fault-tolerant IMC. tion about the fault mode f of the plant. This information ˜ ˆ and the control law is used to adapt the plant model Σ f Qfˆ to the fault mode f of the plant (Fig. 2). After a brief review of the IMC principle in Section 2, the new structure of fault-tolerant internal model control (FTIMC) will be introduced in Sections 3 and 4. It will be shown that the nominal performance is retained for a large variety of faults (Theorems 1 and 2). In particular, the FTIMC control loop is proved to be robust with respect to uncertainties of the diagnostic result (Theorem 3). These properties are illustrated by the application of the new FTIMC principle to a diesel engine in Section 5. Literature survey. Fault-tolerant control uses the well known structure described, for example, by Blanke et al. [2006]: A fault detection and identification unit delivers the current information about the fault status of the plant. If a fault occurs, a controller re-design unit adapts the control law to the faulty plant. Whereas many different methods have been proposed for fault diagnosis, only a few methods have been elaborated for controller re-design. The literature is even smaller with respect to papers
1091
10.3182/20090630-4-ES-2003.0173
7th IFAC SAFEPROCESS (SAFEPROCESS’09) Barcelona, Spain, June 30 - July 3, 2009
that deal with the combination of FDI and controller redesign methods. This paper contributes to fill this gap by presenting a method, wich is robust against uncertain results of FDI (Theorem 3). Bonivento et al. [2004] present a method incorporating FDI and controller re-design for induction motors based on nonlinear output regulation theory. The controller is designed by embedding an internal model of the faults but it is not based on the IMC structure considered here. The controller re-design in the context of fault-tolerant model-predictive control (e.g. Maciejowski and Lemos [2001]) is similar to the method in the present paper, because likewise an explicit plant model is accommodated to take faults into account. However, an on-line optimization problem has to be solved in each sampling interval, which requires large computing resources. If compared with the literature on internal model control, this paper differs from the use of ’generalized internal model control’ (GIMC) to achieve fault tolerance as proposed for example by Campos-Delgado et al. [2005]. Papers on GIMC consider an extended IMC structure for linear systems, which includes a residual signal and the possibility of fault accommodation. Contrary to this approach, the present paper accomplishes the accommodation of an IMC method for nonlinear systems in the classical structure proposed by Economou et al. [1986]. Notation. Operators are used to denote dynamical systems (e.g. plants and controllers). For reasons of space only some basic properties are presented here (for details cf. Economou et al. [1986], Schwarzmann [2007]). An operator M maps a vector-valued signal u in the space U (the domain of M ) to a vector-valued signal y in the space Y (the range of M ). Vector-valued signals are denoted in bold, the value of a signal u at time t0 is denoted as u(t0 ). The concatenation of operators is denoted by ’◦’. If an operator is right- and/or leftinvertible, the right inverse M r and/or the left inverse M l of that operator have the property M ◦ M r y = y, M l ◦ M u = u (1) for signals y in the range of M and u in the domain of M . M is said to be right invertible (i.e. M r exists), if it is surjective on its domain U and range Y, left invertible (i.e. M l exists) if it is injective on these spaces. To guarantee right invertibility of an operator M , its range Y is defined in dependence upon its domain U as Y = {y| y = M u, u ∈ U } . (2) The range of all operators used below is defined in this way, so that all operators are right invertible on their corresponding spaces. The gain of M is denoted as g(M ). Stability is understood ˜ as finite-gain stability (Khalil [2000]). The operator M denotes the model of a real plant (component) M .
saturations as it is found at the Diesel engine air path in Section 5. The IMC structure is depicted in Fig. 1. The ˜ is used important point is the fact that the plant model Σ in parallel to the plant Σ to determine the model output ˜ m . The feedback Q does not get the measured control y output y m but the difference e between the model output ˜ m and the measured output y m , which is subtracted from y the command signal w. Controller Design. The controller ˜r ◦ F Q=Σ (3) r ˜ of the plant model and consists of the right inverse Σ a filter F , which generally has the purpose to make the controller realisable (strictly proper). Here, the plant model ˜ =Σ ˜s ◦ U ˜ Σ (4) depicted in Fig. 3 is considered. It consists of a static ˜ and a core system Σ ˜ s in normal actuator saturation U form (cf. Isidori [1995]) with p outputs and well-defined Pp vector relative degree [r1 ... rp ]T , r = i=1 ri ˜ m = [ξ11 ξ12 ... ξ1p ]T y i ξ˙i = ξ i , ξ˙i = ξ i , . . . ξ˙i 1 2 2 3 ri −1 = ξri , i = 1, ..., p ˜s (5) Σ ˙ u, ξ(0) = ξ 0 ξ r = b(ξ, η, c0 ) + A(ξ, η, c0 )˜ η˙ = q(ξ, η, c0 ) + P (ξ, η, c0 )˜ u, η(0) = η 0 p ˜ (t) ∈ R , the measured outputs y ˜ m (t) ∈ with the inputs u Rp , system parameters c0 , matrix and vector valued functions A(·), P (·) and b(·), q(·) in the corresponding dimensions. The n state variables are denoted as [ξ T η T ] = [ξ11 ξ21 ... ξr11 ... ξ1p ... ξrpp η1 ... ηn−r ], ξ r = [ξr11 . . . ξrpp ]T . ˜ r of the plant model only exists on the The right inverse Σ domain n o ˜ c , uc ∈ U c , ˜m| y ˜ m = Σu Y˜m = y (6)
which equals the range of the plant model with saturations. Furthermore ˜ rs y d = Σ ˜ r yd y d ∈ Y˜m ⇒ Σ (7) holds, i.e. the right inverse of the core system equals the right inverse of the overall plant model, if the desired output y d lies in the range of the plant model. Following Isidori [1995], the system (8) is the right inverse of the core ¯ to reproduce y d system (5) and generates inputs u ( ¯ = A−1 (ξ d , η ¯ , c0 ) ξ˙ dr − b(ξ d , η ¯ , c0 ) u r ˜s Σ (8) ¯ , c0 ) + P (ξ d , η ¯ , c0 )¯ ¯ (0) = η 0 η ¯˙ = q(ξ d , η u, η with the desired states (r1 −1)d d 1 ...yp
ξ d = [y1d y˙ 1d .... y
(rp −1)d p ],
y˙ pd ... y
ξ d (0) = ξ 0 ,
(r1 −1)d (rp −1)d T 1 ... y p ] .
ξ dr = [ y
2. NONLINEAR INTERNAL MODEL CONTROL
The filter F in (3) is designed to ensure that the left-hand side of (7) is satisfied by mapping arbitrary signals w ¯ on y d ∈ Y˜m . Additionally, it supplies derivatives of y d to make (8) realisable.
This Section gives a brief review of nonlinear IMC according to Schwarzmann [2007] by presenting the design of an IMC for a nonlinear plant in normal form with actuator
Properties. The theory of IMC is based on the as˜ r holds although for technical sumption, that Q = Σ
1092
7th IFAC SAFEPROCESS (SAFEPROCESS’09) Barcelona, Spain, June 30 - July 3, 2009
uc
˜ U
˜ u
˜s Σ
˜m y
d
˜ Σ
uc
U˜
˜ u
˜s Σ
˜ y
Y˜
Fig. 3. Structure of the plant model. feasibility a filter is required as a part of the controller (3). Furthermore, it is assumed that the plant Σ and the controller Q are stable. Then, the properties of nominal and robust stability, zero-offset control and perfect control are structural properties of the IMC structure shown in Fig. 1 (see Schwarzmann [2007, Chap. 3.3]). Two of these properties are of special importance here: ˜ r of Lemma 1. (Perfect Control) If the right inverse Σ ˜ the model Σ exists, and the closed-loop system is stable ˜ r , then the control is perfect, i.e. with the controller Q = Σ y m = w holds. ˜ r only exists on the domain Note that the right inverse Σ (6). Consequently, perfect control is only achieved for ¯ ∈ Y˜m . w Lemma 2. (Robust Stability) If the closed-loop system ˜ = Σ), then it remains is stable for the exact model (Σ ˜ satisfies the gain stable if the model deviation Σ − Σ inequality ˜ g (Σ − Σ)Q < 1. (9) 3. MODELLING OF THE FAULTY PLANT 3.1 Nominal plant ˜ represents the plant without The nominal plant model Σ faults. It consists of a series connection of the models of ˜ , sensors Y˜ and the core system Σ ˜ s (upper actuators U part of Fig. 4, which is an extension of the plant structure shown in Fig. 3). The core system has the normal form (5), the actuator and sensor operators are given as static functions ˜ uc = u ˜ (uc , d0 ), Y˜ y = y ˜ m (˜ U y , e0 ) (10) with parameters d0 , e0 . In the nominal case, the actuator ˜ consists of a saturation function and the sensor operator U operator Y˜ equals the identity function (Fig. 3). All three components can be exposed to disturbances. The nominal model of the overall plant ˜ = Y˜ ◦ Σ ˜s ◦ U ˜ =Σ ˜s ◦ U ˜. Σ (11) ˜ m ∈ Y˜m maps control signals uc ∈ Uc to measured signals y ˜ ˜ ∈ Y. which equal the physical relevant values y
fi uc
˜f u U˜fi i
˜ s,f Σ i
˜m y
˜ Σ
d ˜ fi y
Y˜fi
˜ m,fi y
˜f Σ i
Fig. 4. Detailed structure of the nominal (top) and the faulty plant model (bottom). by a change of the nominal parameters c0 to ci in (5). An important assumption claims that the well-defined relative degree and the structure (5) remain unchanged. ˜ to U ˜f and implies a An actuator fault is a change of U i change of the nominal actuator function parameters d0 in (10) to di . Similarly to an actuator fault, sensor faults are represented as a change of Y˜ to Y˜fi and imply the change of the nominal sensor function parameters e0 in (10) to ei . The faulty plant model ˜f ˜ s,f ◦ U ˜ f = Y˜f ◦ Σ (12) Σ i i i i maps control signals uc ∈ Uc to faulty measurements ˜ m,fi ∈ Y˜m,fi , which may differ from the physical relevant y ˜ fi ∈ Y˜fi because of sensor faults. values y The introduced parametric faults cover almost all static actuator and sensor faults, because the functions (10) can be arbitrary with the only restriction that they equal saturation and identity functions for the nominal parameter sets. Also, a large variety of core system faults is covered, with the only restriction that the relative degree and the structure (5) remains unchanged.
In particular, the introduced parametric faults allow ’constant stuck’ actuator and sensor failures. The subsequent theorems also cover this special case. 4. FAULT-TOLERANT INTERNAL MODEL CONTROL This section extends the principle of Internal Model Control to systems that are subject to faults. It is investigated under what conditions the properties of perfect control and robust stability (Lemmas 1 and 2) are retained in fault situations. Following the theory on IMC, the examinations ˜ r . The implementation are based on the design rule Q = Σ using the filter F will be discussed after the statement of the main theorems.
3.2 Faulty plant
4.1 Basic idea
It is assumed that faults f ∈ F, F = {f1 , f2 , f3 , ...} occur abruptly and persistently. Hence, fi can be represented ˜ to Σ ˜ f as by a sudden change in the plant model from Σ i depicted in the lower part of Fig. 4. The set F represents all known parametric actuator, sensor and core system faults as well as arbitrary combinations of these faults. Plant stability is assumed to be unaffected by these faults.
The basic idea of fault-tolerant internal model control (FTIMC) is depicted in Fig. 2. The IMC structure is extended by a fault identification component FDI, which delivers an estimation fˆ of the current fault mode of the plant. Considering the introduced parametric faults, it is proposed to use identification methods for FDI (e.g. Isermann [2006]). It is assumed, that
˜ s to the A core system fault corresponds to a change of Σ ˜ model Σs,fi , which differs from the nominal core system
A1: The occurrence of a fault fi is identified sufficiently fast and exact by the FDI unit.
1093
7th IFAC SAFEPROCESS (SAFEPROCESS’09) Barcelona, Spain, June 30 - July 3, 2009
fi d w
¯ w
uc
Qfi
y m,fi
Σf i
˜ m,fi y
−
˜f Σ i
−
e Fig. 5. Structure of the FTIMC after successful FDI. Fault accomodation is accomplished by changing (1) the plant model to a model of the plant in the current fault mode and (2) the nominal plant inverse in the feedback law Q to the inverse of the plant in the current fault mode. The parametric faults, which were introduced in Section 3, allow for an easy accommodation of the plant model and the controller Q by just adapting its parameters according to the current fault mode. Notice, that the right inverse of the nominal plant model is ˜r = U ˜r ◦ Σ ˜ rs ◦ Y˜ r , Σ (13) where the core system right inverse is given by (8), the actuator and sensor operator right inverses are the right inverses of the static functions (10). The accommodation of (13) to a fault mode consists in changing parameters of the right inverses of the actuator model, the core system model, and the sensor model. This is possible under the assumption that faults do not change the structure and the well-defined relative degree of the core system. Otherwise, the accommodation of the right inverse core system would require extensive symbolic ˜ r and Y˜ r there calculations. For the accommodation of U might be some restrictions on the parameters di , ei to ensure well-defined right inverses. The remainder of this paper will show that the proposed accommodation principle achieves fault tolerance, whereas sensor faults require an additional accommodation of setpoint values, or a differing, simple accommodation principle. 4.2 Fault tolerance for system and actuator faults First, fault tolerance is discussed for core system faults fi with the plant model in fault mode fi ˜. ˜ =Σ ˜ s,f ◦ U ˜ s,f ◦ U ˜ f = Y˜ ◦ Σ (14) Σ i i i ˜ m,fi (y m,fi ) equal in this case the The measured values y ˜ fi (y fi ). The results can easily physical relevant values y be adopted for actuator faults and combined system and actuator faults. Sensor faults are discussed in the next section. ˜ is accommodated In the fault mode fi , the plant model Σ ˜ f and the controller is accommodated to to the model Σ i ˜ rf = U ˜r ◦ Σ ˜ rs,f Qf = Σ (15) i
i
i
(Fig. 5). The result of Lemma 1 of the nominal IMC loop is ˜ r only recovered in this way. However, the right inverse Σ fi exists on the domain n o ˜ s,f ◦ U ˜ uc , uc ∈ Uc , (16) ˜ m,f | y ˜ m,f = Σ Y˜m,f = y i
i
i
i
so that the result of Lemma 1 is only completely recovered, if Y˜m = Y˜m,fi holds, i.e. if the output space (6) of the nominal system is not reduced by the fault fi . Then the FTIMC is called completely fault tolerant. The following theorem is a direct result of this discussion: Theorem 1. (Fault tolerance) If a plant and/or core system fault does not reduce the output space compared to the nominal plant (Y˜m = Y˜m,fi ), the IMC loop is completely fault tolerant: y m,fi = y fi = w. (17) If the output space of the nominal system is reduced by the fault fi , the task of setpoint tracking can, in principle, only be solved for the space (16) of output values. FTIMC achieves perfect control for this reduced space, i.e. (17) holds for w in this space. The implementation of (15) can be realised as described in Section 2. Comparing (14) to (4) there is no structural difference, apart from parameter changes due to the fault. Consequently, the nominal filter can be accommodated to ¯ on (16) by changing the corresponding parameters. map w However, as the filter is designed for the nominal case, it may be appropriate to do a fault-specific accommodation, e.g. to privilege one control variable compared to less important variables in the case of faults. This extension will be a topic of future research. 4.3 Fault tolerance for sensor faults This section considers sensor faults fi , which lead to the plant model ˜s ◦ U ˜. ˜ f = Y˜f ◦ Σ (18) Σ i i The measured values y m,fi differ in this case from the physical relevant values y fi . Following the principle of accommodating the plant model and its inverse in the ˜ would be changed to Σ ˜ f and the IMC loop, the model Σ i controller to ˜ rf = U ˜r ◦ Σ ˜ rs ◦ Y˜fr . Qfi = Σ (19) i i The property y m,fi = w can in this way be reconstructed, but this is not the desired effect of the accommodation, because the relevant physical values y fi instead of the faulty measurements should equal the setpoint values. To retain the result of Lemma 1 for the physical values y m , the setpoint values w have to be replaced by setpoint values w′ = Y˜fi w for the faulty measurements y m,fi . Alternatively, the faulty measurements can be compensated directly. Both ways are equivalent in the case of a linear operator Y˜fi under the following assumptions: A2: The model of the faulty sensors is exact, i.e. Y˜fi = Yfi , A3: The operator Y˜fi = Yfi is left invertible. For reasons of space limitation, only the simple, direct compensation is presented here. The accommodation consists of applying the left inverse Y˜fli directly after the plant, so that (20) Y˜fli ◦ Yfi ◦ Σs ◦ U = Σs ◦ U holds if the assumptions A2 and A3 are satisfied. In this way, the plant together with the left inverse of the sensor
1094
7th IFAC SAFEPROCESS (SAFEPROCESS’09) Barcelona, Spain, June 30 - July 3, 2009
CV
fault operator can be considered as the nominal plant, and the subsequent theorem follows: Theorem 2. (Sensor fault tolerance) If the assumptions A2 and A3 are satisfied, then the IMC loop is completely fault tolerant: y fi = w.
ATV
i
i
i
holds. The setpoint tracking is robust against uncertain system and actuator fault identification but not against uncertain sensor fault identification. Setpoint tracking requires an exact sensor fault accommodation (cf. A3), whereas it is not affected by arbitrarily ˜r wrong actuator/core system fault identification if Q = Σ holds. 5. FAULT-TOLERANT CONTROL OF A TWO-STAGE DIESEL ENGINE AIR PATH 5.1 Description of the plant and control problem
AEG
neng m ˙f
The property of perfect control is not affected in the case of actuator and/or system faults, because no exact model is required (cf. Lemma 1). Stability is preserved, because also in the case of a deviating model the IMC structure guarantees stability (cf. Lemma 2). This leads to the following theorem: Theorem 3. (Robust fault tolerance) The stability of an FTIMC is robust against uncertain fault identification, if ˜ f − Σf )Qf < 1 g (Σ (21)
Venv
V2
4.4 Robustness of FTIMC An important aspect of the fault-tolerant control loop concerns the connection of the fault diagnostic component with the fault accomodation method. Caused by disturbances and modelling errors, the FDI component is assumed to deliver the right fault symbol, but the fault identification result is uncertain. This means, the model ˜ f of the faulty plant is not identical to the plant Σf Σ i i subject to the fault fi .
V0
V1
HPS
LPS EA
EN V3
V5
V4 AHP
ALP
Fig. 6. Structure of the two-stage Diesel engine air path. cross section area AHP or ALP respectively. Finally the exhaust gas flows over the exhaust aftertreatment (EA) to the environment. The control problem consists in using the cross sections as input T u = [ATV AEG AHP ALP ] (22) to control the output vector y m , which contains the pressures p2 , p3 , p4 in V2 , V3 , V4 and the exhaust gas mass mEGR in V2 , shortly denoted as T
y m = [p2 p3 p4 mEGR ] . (23) The control has to be fault tolerant concerning typical faults like sensor offsets, soiled actuators and leakages. 5.2 Modelling and control design The modelling and controller design is presented extensively in Ortmann [2008]. Here only a summary is given. Modelling. The plant is modelled component wise following the approach in Schwarzmann et al. [2006]. The resulting model has the structure described in Section 3. The core system consists of 15 state variables with the welldefined vector relative degree [1 1 1 1]T and the outputs ˜ m = [ξ11 ξ12 ξ13 ξ14 ]T = [p2 p3 p4 mEGR ]T . y
The plant under consideration is the two-stage turbocharged diesel engine air path shown in Fig. 6. Fresh air enters the air system from Venv and is compressed in the low-pressure stage (LPS) of the turbocharger. The air from the pipe V0 is compressed a second time in the high-pressure stage (HPS) and flows through the charge air cooler into pipe V1 . The high-pressure compressor is automatically bypassed by a check valve (CV), if the pressure in V0 exceeds the pressure in V1 . The throttle valve with the effective cross section area ATV is used to reduce the fresh air flow into pipe V2 , where the air is mixed with recirculated exhaust gas, before it is combusted in the engine together with fuel. The mass flow and the energy input caused by the engine depend on its speed neng and fuel mass flow m ˙ f. The exhaust gas flows into pipe V3 and can be recirculated over the exhaust gas cooler and the exhaust gas valve with the effective cross section area AEG . The main part of the exhaust gas flows over two turbines in the HPS and LPS, thus driving the corresponding compressors. Both turbines can be bypassed using valves with the effective
(24)
Obviously the valves can at most be closed or opened completely, so that the maximum and minimum actuator magnitudes umin and umax apply. The state variables η1 , η2 , ..., η10 denote the remaining total pressures and total gas masses in the pipes 0 − 5, and the angular speed of the turbocharger stages. The engine speed neng and the injected fuel mass flow m ˙ f act as measured disturbances. To study fault tolerance properties of FTIMC, a core system fault in the form of a leakage in plenum chamber 3 is considered. It is modelled as a throttle valve, connected to V3 with the nominal effective cross section clk,0 = 0 cm2 which changes upon occurence of the fault f1 to the value clk,1 = 1 cm2 . Controller design. For the controller design, the model is reduced to a simplified model with 9 state variables. The detailed model with 15 state variables is considered as real ˜ In this plant Σ, the simplified model as the plant model Σ. way, some artificial model uncertainties are introduced for the simulation.
1095
7th IFAC SAFEPROCESS (SAFEPROCESS’09) Barcelona, Spain, June 30 - July 3, 2009
For the design of the controller Q, the right inverse of the plant model is constructed as presented in Section 2 and the filter in (3) is designed with a time constant of 0.3s (cf. Schwarzmann [2007]). For the nominal IMC structure the parameter clk,0 is used, which is changed to clk,1 for an accommodation to f1 .
p2
3 2
p3
1
5.3 Simulation results
5 4 3 2
The same step in the setpoint for the plant in fault mode f1 leads to a much slower setpoint tracking (FLT) without accommodation. However, because of the good robustness properties of the nominal IMC, the setpoint values are reached at t = 3.5. Assume now, that the fault mode f1 has been successfully identified by an FDI unit, and that the IMC has been accommodated accordingly. Then, the outputs reach their setpoints much faster (ACC). At the beginning of the simulation (t < 1.5) the effect of a reduced output space becomes visible. In this operating point, the pressure setpoint values can neither be reached with or without accommodation in the fault mode f1 due to the input saturations. Further simulation studies show that an accommodation to core-system and actuator faults only makes sense for a small set of faults. Slight faults are covered by the robustness of the nominal IMC, whereas in case of more severe faults setpoint values can in general no longer be achieved depending on the operating point. Consequently, future research should consider, how to prefer the generally more important control variables p2 and mEGR compared to p3 , p4 in case of faults. For sensor faults, an acommodation is essential, because the setpoint tracking of the nominal IMC is not at all robust against sensor faults. 6. CONCLUSION This paper has presented the new concept of fault tolerant Internal Model Control. This control method utilises the fact that the plant model is an explicit component of the control mechanism. Hence, fault accomodation can be based on the adaptation of the plant model to the current fault situation. The paper has shown that the property of perfect control can be retained for the IMC structure. It has been further proved that the closed-loop system remains stable even if the fault diagnostic component provides wrong or uncertain information about the current fault. Using a special structure of the plant model, the accommodation of one fixed controller structure to a large variety of faults was possible just by altering its parameters.
mEGR
Simulation results for a step in the injected fuel mass flow m ˙ f at time t = 1.5 are depicted in Fig. 7. Corresponding to the increased fuel mass flow, the setpoint values (SPT) for the pressures increase and the setpoint value for the recirculated exhaust gas mass decreases. The performance of the nominal IMC mainly depends on the time constant of the filter. The outputs of the nominal air path with the nominal IMC (NOM) reach their setpoints at t = 2.
p4
4 2
SPT NOM ACC FLT
6 4 2 0 1
2
3
4
5
Time
Fig. 7. Setpoint (SPT) and output values of the controlled air path in the nominal case (NOM), the faulty case (FLT) and the faulty case with accommodated controller (ACC). Some results of this contribution were based on the assumption, that the controller Q exclusively equals the right inverse plant model. Further research will consider the effect of the filter F as an important second part of the controller. The accommodation to actuator and sensor failures as a special aspect of the proposed principle will be examined. REFERENCES M. Blanke, M. Kinnaert, J. Lunze, and M. Staroswiecki. Diagnosis and Fault-Tolerant Control. Springer, 2006. C. Bonivento, A. Isidori, L. Marconi, and A. Paoli. Implicit fault-tolerant control: Application to induction motors. Automatica, 40:355–371, 2004. D.U. Campos-Delgado, S. Martinez-Martinez, and K. Zhou. Integrated fault-tolerant scheme for a dc speed drive. IEEE/ASME Transactions on mechatronics, 10: 419–427, 2005. C.G. Economou, M. Morari, and B.O. Palsson. Internal model control. 5. extension to nonlinear systems. Ind. Eng. Chem. Process Des. Dev., 25:403–411, 1986. R. Isermann. Fault-Diagnosis Systems. Springer, 2006. A. Isidori. Nonlinear Control Systems. Springer, 1995. H.K. Khalil. Nonlinear Systems. Prentice-Hall, New Jersey, 2000. J. Maciejowski and J. Lemos. Control of Complex Systems, Chapter 11. Predictive Methods for FTC. Springer, 2001. C. Ortmann. Nonlinear internal model control of a diesel air system. Diploma thesis, Ruhr-Universit¨at Bochum Robert Bosch GmbH, 2008. D. Schwarzmann. Nonlinear Internal Model Control with Automotive Applications. PhD thesis, Ruhr-Universit¨at Bochum, 2007. D. Schwarzmann, R. Nitsche, and J. Lunze. Modelling of the air system of a two-stage turbocharged passenger car diesel engine. In Proceedings 5th MATHMOD Vienna, 2006.
1096
Fault-tolerant Internal Model Control with Application to a Diesel Engine Michael Hilsch ∗ Jan Lunze ∗∗ Rainer Nitsche ∗ ∗
Robert Bosch GmbH, Corporate Sector Research and Advance Engineering, Stuttgart, Germany (e-mail: [email protected], [email protected]) ∗∗ Institute of Automation and Computer Control, Ruhr-Universit¨ at Bochum, Bochum, Germany (e-mail: [email protected]) Abstract: The paper proposes a new structure for fault-tolerant control of nonlinear systems subject to persistent faults. The principle of Internal Model Control (IMC) is extended to ensure fault tolerance with respect to faults that do not affect the plant stability. The method is based on a representation of sensor, actuator and plant faults as parameter changes of the plant model, which is part of the IMC control law. It is proved that the IMC control loop, which is extended by a diagnostic unit, tolerates substantial faults and ensures the nominal loop performance unless the fault changes the structure of the nonlinear plant. These results are illustrated for the air path of a Diesel engine. Keywords: Internal Model Control, fault-tolerant control, fault diagnosis, automotive application, diesel engine. 1. INTRODUCTION
f w
The increasing complexity of mechatronic automotive systems causes the need of advanced control algorithms, which have to be suitable for nonlinear systems, have to take the limited computing power of on-board control units into account and have to be fault tolerant. This paper extends nonlinear Internal Model Control (IMC) to make it tolerant with respect to sensor, actuator and plant faults. The paper shows that the new method of fault-tolerant IMC retains the nominal performance of the closed-loop system for a wide range of faults. This new method is evaluated by its application to the air path of a diesel engine. d w
¯ w
Q
uc
Σ
−
˜ Σ
ym ˜m y −
e Fig. 1. Structure of a nonlinear IMC. ˜ of IMC is a control method, in which the model Σ the plant Σ is used as a component of the control law (Fig. 1). The feedback Q is chosen so that the closed-loop system follows the command signal w and attenuates the disturbance d. As shown by Schwarzmann [2007] for inputaffine nonlinear plants Σ, the feedback law Q is directly ˜ related to the plant model Σ. This relation will be utilised here for fault accomodation. The IMC structure is extended by a fault detection and identification unit (FDI), which provides current informa-
978-3-902661-46-3/09/$20.00 © 2009 IFAC
¯ w
Qfˆ
uc
d
Σf
y m,f
−
FDI fˆ
˜ fˆ Σ
˜ m,fˆ y −
e Fig. 2. Structure of a fault-tolerant IMC. tion about the fault mode f of the plant. This information ˜ ˆ and the control law is used to adapt the plant model Σ f Qfˆ to the fault mode f of the plant (Fig. 2). After a brief review of the IMC principle in Section 2, the new structure of fault-tolerant internal model control (FTIMC) will be introduced in Sections 3 and 4. It will be shown that the nominal performance is retained for a large variety of faults (Theorems 1 and 2). In particular, the FTIMC control loop is proved to be robust with respect to uncertainties of the diagnostic result (Theorem 3). These properties are illustrated by the application of the new FTIMC principle to a diesel engine in Section 5. Literature survey. Fault-tolerant control uses the well known structure described, for example, by Blanke et al. [2006]: A fault detection and identification unit delivers the current information about the fault status of the plant. If a fault occurs, a controller re-design unit adapts the control law to the faulty plant. Whereas many different methods have been proposed for fault diagnosis, only a few methods have been elaborated for controller re-design. The literature is even smaller with respect to papers
1091
10.3182/20090630-4-ES-2003.0173
7th IFAC SAFEPROCESS (SAFEPROCESS’09) Barcelona, Spain, June 30 - July 3, 2009
that deal with the combination of FDI and controller redesign methods. This paper contributes to fill this gap by presenting a method, wich is robust against uncertain results of FDI (Theorem 3). Bonivento et al. [2004] present a method incorporating FDI and controller re-design for induction motors based on nonlinear output regulation theory. The controller is designed by embedding an internal model of the faults but it is not based on the IMC structure considered here. The controller re-design in the context of fault-tolerant model-predictive control (e.g. Maciejowski and Lemos [2001]) is similar to the method in the present paper, because likewise an explicit plant model is accommodated to take faults into account. However, an on-line optimization problem has to be solved in each sampling interval, which requires large computing resources. If compared with the literature on internal model control, this paper differs from the use of ’generalized internal model control’ (GIMC) to achieve fault tolerance as proposed for example by Campos-Delgado et al. [2005]. Papers on GIMC consider an extended IMC structure for linear systems, which includes a residual signal and the possibility of fault accommodation. Contrary to this approach, the present paper accomplishes the accommodation of an IMC method for nonlinear systems in the classical structure proposed by Economou et al. [1986]. Notation. Operators are used to denote dynamical systems (e.g. plants and controllers). For reasons of space only some basic properties are presented here (for details cf. Economou et al. [1986], Schwarzmann [2007]). An operator M maps a vector-valued signal u in the space U (the domain of M ) to a vector-valued signal y in the space Y (the range of M ). Vector-valued signals are denoted in bold, the value of a signal u at time t0 is denoted as u(t0 ). The concatenation of operators is denoted by ’◦’. If an operator is right- and/or leftinvertible, the right inverse M r and/or the left inverse M l of that operator have the property M ◦ M r y = y, M l ◦ M u = u (1) for signals y in the range of M and u in the domain of M . M is said to be right invertible (i.e. M r exists), if it is surjective on its domain U and range Y, left invertible (i.e. M l exists) if it is injective on these spaces. To guarantee right invertibility of an operator M , its range Y is defined in dependence upon its domain U as Y = {y| y = M u, u ∈ U } . (2) The range of all operators used below is defined in this way, so that all operators are right invertible on their corresponding spaces. The gain of M is denoted as g(M ). Stability is understood ˜ as finite-gain stability (Khalil [2000]). The operator M denotes the model of a real plant (component) M .
saturations as it is found at the Diesel engine air path in Section 5. The IMC structure is depicted in Fig. 1. The ˜ is used important point is the fact that the plant model Σ in parallel to the plant Σ to determine the model output ˜ m . The feedback Q does not get the measured control y output y m but the difference e between the model output ˜ m and the measured output y m , which is subtracted from y the command signal w. Controller Design. The controller ˜r ◦ F Q=Σ (3) r ˜ of the plant model and consists of the right inverse Σ a filter F , which generally has the purpose to make the controller realisable (strictly proper). Here, the plant model ˜ =Σ ˜s ◦ U ˜ Σ (4) depicted in Fig. 3 is considered. It consists of a static ˜ and a core system Σ ˜ s in normal actuator saturation U form (cf. Isidori [1995]) with p outputs and well-defined Pp vector relative degree [r1 ... rp ]T , r = i=1 ri ˜ m = [ξ11 ξ12 ... ξ1p ]T y i ξ˙i = ξ i , ξ˙i = ξ i , . . . ξ˙i 1 2 2 3 ri −1 = ξri , i = 1, ..., p ˜s (5) Σ ˙ u, ξ(0) = ξ 0 ξ r = b(ξ, η, c0 ) + A(ξ, η, c0 )˜ η˙ = q(ξ, η, c0 ) + P (ξ, η, c0 )˜ u, η(0) = η 0 p ˜ (t) ∈ R , the measured outputs y ˜ m (t) ∈ with the inputs u Rp , system parameters c0 , matrix and vector valued functions A(·), P (·) and b(·), q(·) in the corresponding dimensions. The n state variables are denoted as [ξ T η T ] = [ξ11 ξ21 ... ξr11 ... ξ1p ... ξrpp η1 ... ηn−r ], ξ r = [ξr11 . . . ξrpp ]T . ˜ r of the plant model only exists on the The right inverse Σ domain n o ˜ c , uc ∈ U c , ˜m| y ˜ m = Σu Y˜m = y (6)
which equals the range of the plant model with saturations. Furthermore ˜ rs y d = Σ ˜ r yd y d ∈ Y˜m ⇒ Σ (7) holds, i.e. the right inverse of the core system equals the right inverse of the overall plant model, if the desired output y d lies in the range of the plant model. Following Isidori [1995], the system (8) is the right inverse of the core ¯ to reproduce y d system (5) and generates inputs u ( ¯ = A−1 (ξ d , η ¯ , c0 ) ξ˙ dr − b(ξ d , η ¯ , c0 ) u r ˜s Σ (8) ¯ , c0 ) + P (ξ d , η ¯ , c0 )¯ ¯ (0) = η 0 η ¯˙ = q(ξ d , η u, η with the desired states (r1 −1)d d 1 ...yp
ξ d = [y1d y˙ 1d .... y
(rp −1)d p ],
y˙ pd ... y
ξ d (0) = ξ 0 ,
(r1 −1)d (rp −1)d T 1 ... y p ] .
ξ dr = [ y
2. NONLINEAR INTERNAL MODEL CONTROL
The filter F in (3) is designed to ensure that the left-hand side of (7) is satisfied by mapping arbitrary signals w ¯ on y d ∈ Y˜m . Additionally, it supplies derivatives of y d to make (8) realisable.
This Section gives a brief review of nonlinear IMC according to Schwarzmann [2007] by presenting the design of an IMC for a nonlinear plant in normal form with actuator
Properties. The theory of IMC is based on the as˜ r holds although for technical sumption, that Q = Σ
1092
7th IFAC SAFEPROCESS (SAFEPROCESS’09) Barcelona, Spain, June 30 - July 3, 2009
uc
˜ U
˜ u
˜s Σ
˜m y
d
˜ Σ
uc
U˜
˜ u
˜s Σ
˜ y
Y˜
Fig. 3. Structure of the plant model. feasibility a filter is required as a part of the controller (3). Furthermore, it is assumed that the plant Σ and the controller Q are stable. Then, the properties of nominal and robust stability, zero-offset control and perfect control are structural properties of the IMC structure shown in Fig. 1 (see Schwarzmann [2007, Chap. 3.3]). Two of these properties are of special importance here: ˜ r of Lemma 1. (Perfect Control) If the right inverse Σ ˜ the model Σ exists, and the closed-loop system is stable ˜ r , then the control is perfect, i.e. with the controller Q = Σ y m = w holds. ˜ r only exists on the domain Note that the right inverse Σ (6). Consequently, perfect control is only achieved for ¯ ∈ Y˜m . w Lemma 2. (Robust Stability) If the closed-loop system ˜ = Σ), then it remains is stable for the exact model (Σ ˜ satisfies the gain stable if the model deviation Σ − Σ inequality ˜ g (Σ − Σ)Q < 1. (9) 3. MODELLING OF THE FAULTY PLANT 3.1 Nominal plant ˜ represents the plant without The nominal plant model Σ faults. It consists of a series connection of the models of ˜ , sensors Y˜ and the core system Σ ˜ s (upper actuators U part of Fig. 4, which is an extension of the plant structure shown in Fig. 3). The core system has the normal form (5), the actuator and sensor operators are given as static functions ˜ uc = u ˜ (uc , d0 ), Y˜ y = y ˜ m (˜ U y , e0 ) (10) with parameters d0 , e0 . In the nominal case, the actuator ˜ consists of a saturation function and the sensor operator U operator Y˜ equals the identity function (Fig. 3). All three components can be exposed to disturbances. The nominal model of the overall plant ˜ = Y˜ ◦ Σ ˜s ◦ U ˜ =Σ ˜s ◦ U ˜. Σ (11) ˜ m ∈ Y˜m maps control signals uc ∈ Uc to measured signals y ˜ ˜ ∈ Y. which equal the physical relevant values y
fi uc
˜f u U˜fi i
˜ s,f Σ i
˜m y
˜ Σ
d ˜ fi y
Y˜fi
˜ m,fi y
˜f Σ i
Fig. 4. Detailed structure of the nominal (top) and the faulty plant model (bottom). by a change of the nominal parameters c0 to ci in (5). An important assumption claims that the well-defined relative degree and the structure (5) remain unchanged. ˜ to U ˜f and implies a An actuator fault is a change of U i change of the nominal actuator function parameters d0 in (10) to di . Similarly to an actuator fault, sensor faults are represented as a change of Y˜ to Y˜fi and imply the change of the nominal sensor function parameters e0 in (10) to ei . The faulty plant model ˜f ˜ s,f ◦ U ˜ f = Y˜f ◦ Σ (12) Σ i i i i maps control signals uc ∈ Uc to faulty measurements ˜ m,fi ∈ Y˜m,fi , which may differ from the physical relevant y ˜ fi ∈ Y˜fi because of sensor faults. values y The introduced parametric faults cover almost all static actuator and sensor faults, because the functions (10) can be arbitrary with the only restriction that they equal saturation and identity functions for the nominal parameter sets. Also, a large variety of core system faults is covered, with the only restriction that the relative degree and the structure (5) remains unchanged.
In particular, the introduced parametric faults allow ’constant stuck’ actuator and sensor failures. The subsequent theorems also cover this special case. 4. FAULT-TOLERANT INTERNAL MODEL CONTROL This section extends the principle of Internal Model Control to systems that are subject to faults. It is investigated under what conditions the properties of perfect control and robust stability (Lemmas 1 and 2) are retained in fault situations. Following the theory on IMC, the examinations ˜ r . The implementation are based on the design rule Q = Σ using the filter F will be discussed after the statement of the main theorems.
3.2 Faulty plant
4.1 Basic idea
It is assumed that faults f ∈ F, F = {f1 , f2 , f3 , ...} occur abruptly and persistently. Hence, fi can be represented ˜ to Σ ˜ f as by a sudden change in the plant model from Σ i depicted in the lower part of Fig. 4. The set F represents all known parametric actuator, sensor and core system faults as well as arbitrary combinations of these faults. Plant stability is assumed to be unaffected by these faults.
The basic idea of fault-tolerant internal model control (FTIMC) is depicted in Fig. 2. The IMC structure is extended by a fault identification component FDI, which delivers an estimation fˆ of the current fault mode of the plant. Considering the introduced parametric faults, it is proposed to use identification methods for FDI (e.g. Isermann [2006]). It is assumed, that
˜ s to the A core system fault corresponds to a change of Σ ˜ model Σs,fi , which differs from the nominal core system
A1: The occurrence of a fault fi is identified sufficiently fast and exact by the FDI unit.
1093
7th IFAC SAFEPROCESS (SAFEPROCESS’09) Barcelona, Spain, June 30 - July 3, 2009
fi d w
¯ w
uc
Qfi
y m,fi
Σf i
˜ m,fi y
−
˜f Σ i
−
e Fig. 5. Structure of the FTIMC after successful FDI. Fault accomodation is accomplished by changing (1) the plant model to a model of the plant in the current fault mode and (2) the nominal plant inverse in the feedback law Q to the inverse of the plant in the current fault mode. The parametric faults, which were introduced in Section 3, allow for an easy accommodation of the plant model and the controller Q by just adapting its parameters according to the current fault mode. Notice, that the right inverse of the nominal plant model is ˜r = U ˜r ◦ Σ ˜ rs ◦ Y˜ r , Σ (13) where the core system right inverse is given by (8), the actuator and sensor operator right inverses are the right inverses of the static functions (10). The accommodation of (13) to a fault mode consists in changing parameters of the right inverses of the actuator model, the core system model, and the sensor model. This is possible under the assumption that faults do not change the structure and the well-defined relative degree of the core system. Otherwise, the accommodation of the right inverse core system would require extensive symbolic ˜ r and Y˜ r there calculations. For the accommodation of U might be some restrictions on the parameters di , ei to ensure well-defined right inverses. The remainder of this paper will show that the proposed accommodation principle achieves fault tolerance, whereas sensor faults require an additional accommodation of setpoint values, or a differing, simple accommodation principle. 4.2 Fault tolerance for system and actuator faults First, fault tolerance is discussed for core system faults fi with the plant model in fault mode fi ˜. ˜ =Σ ˜ s,f ◦ U ˜ s,f ◦ U ˜ f = Y˜ ◦ Σ (14) Σ i i i ˜ m,fi (y m,fi ) equal in this case the The measured values y ˜ fi (y fi ). The results can easily physical relevant values y be adopted for actuator faults and combined system and actuator faults. Sensor faults are discussed in the next section. ˜ is accommodated In the fault mode fi , the plant model Σ ˜ f and the controller is accommodated to to the model Σ i ˜ rf = U ˜r ◦ Σ ˜ rs,f Qf = Σ (15) i
i
i
(Fig. 5). The result of Lemma 1 of the nominal IMC loop is ˜ r only recovered in this way. However, the right inverse Σ fi exists on the domain n o ˜ s,f ◦ U ˜ uc , uc ∈ Uc , (16) ˜ m,f | y ˜ m,f = Σ Y˜m,f = y i
i
i
i
so that the result of Lemma 1 is only completely recovered, if Y˜m = Y˜m,fi holds, i.e. if the output space (6) of the nominal system is not reduced by the fault fi . Then the FTIMC is called completely fault tolerant. The following theorem is a direct result of this discussion: Theorem 1. (Fault tolerance) If a plant and/or core system fault does not reduce the output space compared to the nominal plant (Y˜m = Y˜m,fi ), the IMC loop is completely fault tolerant: y m,fi = y fi = w. (17) If the output space of the nominal system is reduced by the fault fi , the task of setpoint tracking can, in principle, only be solved for the space (16) of output values. FTIMC achieves perfect control for this reduced space, i.e. (17) holds for w in this space. The implementation of (15) can be realised as described in Section 2. Comparing (14) to (4) there is no structural difference, apart from parameter changes due to the fault. Consequently, the nominal filter can be accommodated to ¯ on (16) by changing the corresponding parameters. map w However, as the filter is designed for the nominal case, it may be appropriate to do a fault-specific accommodation, e.g. to privilege one control variable compared to less important variables in the case of faults. This extension will be a topic of future research. 4.3 Fault tolerance for sensor faults This section considers sensor faults fi , which lead to the plant model ˜s ◦ U ˜. ˜ f = Y˜f ◦ Σ (18) Σ i i The measured values y m,fi differ in this case from the physical relevant values y fi . Following the principle of accommodating the plant model and its inverse in the ˜ would be changed to Σ ˜ f and the IMC loop, the model Σ i controller to ˜ rf = U ˜r ◦ Σ ˜ rs ◦ Y˜fr . Qfi = Σ (19) i i The property y m,fi = w can in this way be reconstructed, but this is not the desired effect of the accommodation, because the relevant physical values y fi instead of the faulty measurements should equal the setpoint values. To retain the result of Lemma 1 for the physical values y m , the setpoint values w have to be replaced by setpoint values w′ = Y˜fi w for the faulty measurements y m,fi . Alternatively, the faulty measurements can be compensated directly. Both ways are equivalent in the case of a linear operator Y˜fi under the following assumptions: A2: The model of the faulty sensors is exact, i.e. Y˜fi = Yfi , A3: The operator Y˜fi = Yfi is left invertible. For reasons of space limitation, only the simple, direct compensation is presented here. The accommodation consists of applying the left inverse Y˜fli directly after the plant, so that (20) Y˜fli ◦ Yfi ◦ Σs ◦ U = Σs ◦ U holds if the assumptions A2 and A3 are satisfied. In this way, the plant together with the left inverse of the sensor
1094
7th IFAC SAFEPROCESS (SAFEPROCESS’09) Barcelona, Spain, June 30 - July 3, 2009
CV
fault operator can be considered as the nominal plant, and the subsequent theorem follows: Theorem 2. (Sensor fault tolerance) If the assumptions A2 and A3 are satisfied, then the IMC loop is completely fault tolerant: y fi = w.
ATV
i
i
i
holds. The setpoint tracking is robust against uncertain system and actuator fault identification but not against uncertain sensor fault identification. Setpoint tracking requires an exact sensor fault accommodation (cf. A3), whereas it is not affected by arbitrarily ˜r wrong actuator/core system fault identification if Q = Σ holds. 5. FAULT-TOLERANT CONTROL OF A TWO-STAGE DIESEL ENGINE AIR PATH 5.1 Description of the plant and control problem
AEG
neng m ˙f
The property of perfect control is not affected in the case of actuator and/or system faults, because no exact model is required (cf. Lemma 1). Stability is preserved, because also in the case of a deviating model the IMC structure guarantees stability (cf. Lemma 2). This leads to the following theorem: Theorem 3. (Robust fault tolerance) The stability of an FTIMC is robust against uncertain fault identification, if ˜ f − Σf )Qf < 1 g (Σ (21)
Venv
V2
4.4 Robustness of FTIMC An important aspect of the fault-tolerant control loop concerns the connection of the fault diagnostic component with the fault accomodation method. Caused by disturbances and modelling errors, the FDI component is assumed to deliver the right fault symbol, but the fault identification result is uncertain. This means, the model ˜ f of the faulty plant is not identical to the plant Σf Σ i i subject to the fault fi .
V0
V1
HPS
LPS EA
EN V3
V5
V4 AHP
ALP
Fig. 6. Structure of the two-stage Diesel engine air path. cross section area AHP or ALP respectively. Finally the exhaust gas flows over the exhaust aftertreatment (EA) to the environment. The control problem consists in using the cross sections as input T u = [ATV AEG AHP ALP ] (22) to control the output vector y m , which contains the pressures p2 , p3 , p4 in V2 , V3 , V4 and the exhaust gas mass mEGR in V2 , shortly denoted as T
y m = [p2 p3 p4 mEGR ] . (23) The control has to be fault tolerant concerning typical faults like sensor offsets, soiled actuators and leakages. 5.2 Modelling and control design The modelling and controller design is presented extensively in Ortmann [2008]. Here only a summary is given. Modelling. The plant is modelled component wise following the approach in Schwarzmann et al. [2006]. The resulting model has the structure described in Section 3. The core system consists of 15 state variables with the welldefined vector relative degree [1 1 1 1]T and the outputs ˜ m = [ξ11 ξ12 ξ13 ξ14 ]T = [p2 p3 p4 mEGR ]T . y
The plant under consideration is the two-stage turbocharged diesel engine air path shown in Fig. 6. Fresh air enters the air system from Venv and is compressed in the low-pressure stage (LPS) of the turbocharger. The air from the pipe V0 is compressed a second time in the high-pressure stage (HPS) and flows through the charge air cooler into pipe V1 . The high-pressure compressor is automatically bypassed by a check valve (CV), if the pressure in V0 exceeds the pressure in V1 . The throttle valve with the effective cross section area ATV is used to reduce the fresh air flow into pipe V2 , where the air is mixed with recirculated exhaust gas, before it is combusted in the engine together with fuel. The mass flow and the energy input caused by the engine depend on its speed neng and fuel mass flow m ˙ f. The exhaust gas flows into pipe V3 and can be recirculated over the exhaust gas cooler and the exhaust gas valve with the effective cross section area AEG . The main part of the exhaust gas flows over two turbines in the HPS and LPS, thus driving the corresponding compressors. Both turbines can be bypassed using valves with the effective
(24)
Obviously the valves can at most be closed or opened completely, so that the maximum and minimum actuator magnitudes umin and umax apply. The state variables η1 , η2 , ..., η10 denote the remaining total pressures and total gas masses in the pipes 0 − 5, and the angular speed of the turbocharger stages. The engine speed neng and the injected fuel mass flow m ˙ f act as measured disturbances. To study fault tolerance properties of FTIMC, a core system fault in the form of a leakage in plenum chamber 3 is considered. It is modelled as a throttle valve, connected to V3 with the nominal effective cross section clk,0 = 0 cm2 which changes upon occurence of the fault f1 to the value clk,1 = 1 cm2 . Controller design. For the controller design, the model is reduced to a simplified model with 9 state variables. The detailed model with 15 state variables is considered as real ˜ In this plant Σ, the simplified model as the plant model Σ. way, some artificial model uncertainties are introduced for the simulation.
1095
7th IFAC SAFEPROCESS (SAFEPROCESS’09) Barcelona, Spain, June 30 - July 3, 2009
For the design of the controller Q, the right inverse of the plant model is constructed as presented in Section 2 and the filter in (3) is designed with a time constant of 0.3s (cf. Schwarzmann [2007]). For the nominal IMC structure the parameter clk,0 is used, which is changed to clk,1 for an accommodation to f1 .
p2
3 2
p3
1
5.3 Simulation results
5 4 3 2
The same step in the setpoint for the plant in fault mode f1 leads to a much slower setpoint tracking (FLT) without accommodation. However, because of the good robustness properties of the nominal IMC, the setpoint values are reached at t = 3.5. Assume now, that the fault mode f1 has been successfully identified by an FDI unit, and that the IMC has been accommodated accordingly. Then, the outputs reach their setpoints much faster (ACC). At the beginning of the simulation (t < 1.5) the effect of a reduced output space becomes visible. In this operating point, the pressure setpoint values can neither be reached with or without accommodation in the fault mode f1 due to the input saturations. Further simulation studies show that an accommodation to core-system and actuator faults only makes sense for a small set of faults. Slight faults are covered by the robustness of the nominal IMC, whereas in case of more severe faults setpoint values can in general no longer be achieved depending on the operating point. Consequently, future research should consider, how to prefer the generally more important control variables p2 and mEGR compared to p3 , p4 in case of faults. For sensor faults, an acommodation is essential, because the setpoint tracking of the nominal IMC is not at all robust against sensor faults. 6. CONCLUSION This paper has presented the new concept of fault tolerant Internal Model Control. This control method utilises the fact that the plant model is an explicit component of the control mechanism. Hence, fault accomodation can be based on the adaptation of the plant model to the current fault situation. The paper has shown that the property of perfect control can be retained for the IMC structure. It has been further proved that the closed-loop system remains stable even if the fault diagnostic component provides wrong or uncertain information about the current fault. Using a special structure of the plant model, the accommodation of one fixed controller structure to a large variety of faults was possible just by altering its parameters.
mEGR
Simulation results for a step in the injected fuel mass flow m ˙ f at time t = 1.5 are depicted in Fig. 7. Corresponding to the increased fuel mass flow, the setpoint values (SPT) for the pressures increase and the setpoint value for the recirculated exhaust gas mass decreases. The performance of the nominal IMC mainly depends on the time constant of the filter. The outputs of the nominal air path with the nominal IMC (NOM) reach their setpoints at t = 2.
p4
4 2
SPT NOM ACC FLT
6 4 2 0 1
2
3
4
5
Time
Fig. 7. Setpoint (SPT) and output values of the controlled air path in the nominal case (NOM), the faulty case (FLT) and the faulty case with accommodated controller (ACC). Some results of this contribution were based on the assumption, that the controller Q exclusively equals the right inverse plant model. Further research will consider the effect of the filter F as an important second part of the controller. The accommodation to actuator and sensor failures as a special aspect of the proposed principle will be examined. REFERENCES M. Blanke, M. Kinnaert, J. Lunze, and M. Staroswiecki. Diagnosis and Fault-Tolerant Control. Springer, 2006. C. Bonivento, A. Isidori, L. Marconi, and A. Paoli. Implicit fault-tolerant control: Application to induction motors. Automatica, 40:355–371, 2004. D.U. Campos-Delgado, S. Martinez-Martinez, and K. Zhou. Integrated fault-tolerant scheme for a dc speed drive. IEEE/ASME Transactions on mechatronics, 10: 419–427, 2005. C.G. Economou, M. Morari, and B.O. Palsson. Internal model control. 5. extension to nonlinear systems. Ind. Eng. Chem. Process Des. Dev., 25:403–411, 1986. R. Isermann. Fault-Diagnosis Systems. Springer, 2006. A. Isidori. Nonlinear Control Systems. Springer, 1995. H.K. Khalil. Nonlinear Systems. Prentice-Hall, New Jersey, 2000. J. Maciejowski and J. Lemos. Control of Complex Systems, Chapter 11. Predictive Methods for FTC. Springer, 2001. C. Ortmann. Nonlinear internal model control of a diesel air system. Diploma thesis, Ruhr-Universit¨at Bochum Robert Bosch GmbH, 2008. D. Schwarzmann. Nonlinear Internal Model Control with Automotive Applications. PhD thesis, Ruhr-Universit¨at Bochum, 2007. D. Schwarzmann, R. Nitsche, and J. Lunze. Modelling of the air system of a two-stage turbocharged passenger car diesel engine. In Proceedings 5th MATHMOD Vienna, 2006.
1096