Active fault tolerant control of discrete event systems using online diagnostics

Abstract

The aim of this paper is to deal with the problem of fault tolerant control in the framework of discrete event systems modeled as automata. A fault tolerant controller is a controller able to satisfy control specifications both in nominal operation and after the occurrence of a fault. This task is solved by means of a parameterized controller that is suitably updated on the basis of the information provided by online diagnostics: the supervisor actively reacts to the detection of a malfunctioning component in order to eventually meet degraded control specifications. Starting from an appropriate model of the system, we recall the notion of safe diagnosability as a necessary step in order to achieve fault tolerant control. We then introduce two new notions: (i) “safe controllability”, which represents the capability, after the occurrence of a fault, of steering the system away from forbidden zones and (ii) “active fault tolerant system”, which is the property of safely continuing operation after faults. Finally, we show how the problem can be solved using a general control architecture based on the use of special kind of diagnoser, called “diagnosing controller”, which is used to safely detect faults and to switch between the nominal control policy and a bank of reconfigured control policies. A simple example is used to illustrate the new notions and the control architecture introduced in the paper.

Introduction

Complex technological systems are vulnerable to unpredictable events that can cause undesired reactions and as a consequence damage to technical parts of the plant, to personnel, or to the environment. The main objective of the Fault Detection and Isolation (FDI) research area (see, e.g., Patton, Frank, & Clark, 2000) is to study methodologies for identifying and exactly characterizing possible incipient faults arising in predetermined parts of the plant. This is usually achieved by designing a dynamical system which, by processing input/output data, is able to detect the presence of an incipient fault and eventually to precisely isolate it. Once a fault has been detected and isolated, the next natural step is to reconfigure the control law in order to tolerate the fault, namely, to guarantee pre-specified (eventually degraded) performance objectives for the faulty system. In this framework, the FDI phase is usually followed by the design of a fault tolerant control (FTC) system, namely, by the design of a reconfiguring unit that, on the basis of the information provided by the FDI filter, adjusts the controller in order to achieve the prescribed performance for the faulty system (see Blanke, Kinnaert, Lunze, & Staroswiecki, 2003).

The FTC problem can be tackled using either a passive approach or an active one. The passive approach deals with the problem of finding a general controller able to satisfy control specifications both in nominal operation and after the occurrence of a fault. Passive fault tolerance uses robust control techniques to ensure that the closed loop system remains insensitive to certain failures so that the impaired system continues to operate with the same controller and system structure. The effectiveness of the scheme depends upon the robustness of the nominal fault-free closed loop system. Hence, a unique controller, designed offline, can be used and online fault information is not required. In contrast, active fault tolerance aims at achieving the control objectives by adapting the control law to the faulty system behavior. In general, the latter phase is carried out by means of a parameterized controller which is suitably updated by a supervisory unit, on the basis of the information provided by the FDI filter. This approach relies upon a “certainty equivalence” idea extensively used in the context of adaptive control, since it is based on the explicit estimation of faults by the FDI filter and subsequent explicit reconfiguration of the controller in the presence of faults.

In this paper, we consider the FTC problem for systems that are governed by operational rules that can be modeled by discrete event systems (DES), i.e., dynamical systems with discrete state spaces and event-driven transitions. Several methodologies have been developed to solve the FDI problem for systems modeled as DES; see Benveniste, Haar, Fabre, and Jard (2003), van Schuppen (2002), Cordier and Rozé (2002), Debouk, Malik, and Brandin (2002), Garcia, Morant, and Blasco-Giménez (2002), Garcia and Yoo (2004), Genc and Lafortune (2007), Hadjicostis (2005), Jiang and Kumar (2006), Lin (1994), Lunze (2001), Pandalai and Holloway (2000), Paoli and Lafortune (2008), Pencole and Cordier (2002), Provan (2002), Sampath, Sengupta, and Lafortune (1995), Sampath, Sengupta, Lafortune, Sinnamohideen, and Teneketzis (1996) and Su and Wonham (2002), for a sample of this work including references to successful industrial applications. Less effort however has been made to solve the FTC problem in the DES framework; this problem has recently been studied in Darabi, Jafari, and Buczak (2003), Dumitrescu, Girault, Marchand, and Rutten (2007), Iordache and Antsaklis (2004), Park and Cho (2009), Rohloff (2005), Wen, Kumar, Huang, and Liu (2007a), Wen, Kumar, Huang, and Liu (2007b) and Wen, Kumar, Huang, and Liu (2008). In Dumitrescu et al. (2007), the problem of managing a set of real-time periodic tasks onto a set of processors upon the occurrence of a fault (considered as observable) on one or more processors is solved using optimal discrete controller synthesis techniques. In Iordache and Antsaklis (2004), the supervisory control technique for Petri nets based on place invariants is adapted to achieve robustness properties for systems in which faults and reconfigurations are modeled as changes in marking. In Park and Cho (2009), the authors present a formal method to design an optimal fault-tolerant scheduler for real-time multiprocessor systems with non-preemptive tasks such that all deadlines for active tasks are satisfied even in the presence of processor faults modeled as observable events. Ref. Rohloff (2005) deals with the problem of performing robust controller synthesis when the system is subject to failures on sensors, i.e., when previously observable events become unobservable.

In Wen et al. (2008), the authors propose a definition of fault tolerance based on the DES notions of language equivalence and convergence by means of control. Roughly speaking, a DES is said to be fault tolerant if every post-fault behavior is equivalent to a non-faulty behavior in a bounded number of steps; moreover, a supervisor is said to be a “fault-tolerant controller” if it is able to force fault tolerant behavior for the supervised DES. The authors provide a necessary and sufficient condition for the existence of a fault-tolerant supervisor able to enforce a specification for the non-faulty plant and a wider specification for the overall plant. Such an approach can therefore be cast in the framework of passive approaches.

We study the active approach to FTC for DES modeled as automata. Specifically, we want to design an architecture in which the supervisor actively reacts to the detection of a malfunctioning component in order to meet eventually degraded control specifications. To this aim, we describe a modeling procedure that results in a structured model of the controlled system containing a nominal part and a set of faulty parts. Starting from this suitable model, we recall the notion of safe diagnosability (see Paoli & Lafortune, 2005) as a necessary step in order to achieve fault tolerant supervision of DES. We then introduce the new notion of safe controllability, which represents the capability, after the occurrence of a fault, of steering the system away from forbidden zones. We also define the new notion of active fault tolerant system with respect to post-fault specifications as the property of safely continuing operation after faults. We then present a general control architecture to deal with the FTC problem. This architecture is based on the use of a special kind of diagnoser, called diagnosing controller, which is used to safely detect faults and to switch between the nominal control policy and a bank of reconfigured control policies. In this sense, the exploited paradigm is that of switching control in which a high-level logic is used to switch between a bank of different controllers (see Darabi & Jafari, 2003 and Zhang & Jiang, 2001).

The main contributions of this work are as follows:

• the exploitation of a multiple-supervisor architecture to actively counteract the effect of faults;

• the evaluation of the effect of the diagnostics algorithm on the performance of the architecture;

• the definition of a new diagnoser called diagnosing controller, which realizes in a unique entity the switching architecture.

Fault tolerance is also an important research area in computer science, especially when dealing with distributed systems. Among the many works in this area, we wish to comment further on the papers (Attie et al., 2004, Kulkarni and Arora, 2000, Kulkarni and Ebnenasir, 2004), and the references therein. Specifically, these works present a method for the synthesis of fault-tolerant programs that is based on a decision procedure for branching time temporal logic. The focus is on non-terminating concurrent programs consisting of a finite number of fixed sequential processes described by directed graphs. Computational tree logic (CTL) is used to allocate specifications on processes and to prove satisfiability. The faults that a concurrent program is subject to are categorized in terms of type, duration, observability, and repair properties; such faults are modeled as actions (guarded commands) whose execution perturbs the program state. When a fault occurs, a concurrent program in general need not satisfy its given nominal specification, but it must accomplish some given specification that can be classified in terms of how (and whether) the safety and the liveness parts of the given specification are respected in the presence of the faults (in masking tolerance, both the safety and the liveness parts are always respected; in fail-safe tolerance, only the safety part but not necessarily the liveness part is respected; in nonmasking tolerance, the liveness part is always respected but the safety part is only eventually respected). The problem solved in Attie et al. (2004) can be described as follows: given a problem specification (models of processes and global specifications), a fault specification (a set of fault actions), a problem-fault coupling specifications (how programs react to faults) and a type of desired tolerance, use the CTL decision procedure to synthesize a concurrent program such that in nominal situation global specifications are satisfied, while, in the case of a fault, the desired tolerance property are met for any evolution after the fault occurrence. The procedure turns out to be of exponential complexity. In Kulkarni and Ebnenasir (2004) the problem is extended to obtain multi-tolerance, i.e., multiple faults with different tolerance specifications.

The approach in these above works is in some sense complementary to the approach we develop in the present paper. In Attie et al. (2004), Kulkarni and Arora (2000) and Kulkarni and Ebnenasir (2004), the focus is on how to design a supervisor that “implicitly” meets nominal and faulty specifications; however, the problem of actively reacting to faults after they have been detected on-the-fly is not addressed. Thus, the approach in these works can be cast in the so-called implicit fault-tolerant methods, where fault tolerance is obtained through the nominal global supervisor, which is designed in order to implicitly react to faults; in this framework, fault diagnosis is of secondary importance and can be obtained by simply observing the actions of the supervisor. In contrast, in our approach, we exploit an active paradigm (active fault tolerance approach) to switch from a nominal supervisor to a reconfigured supervisor once online diagnostics detects a fault. In this approach, it is essential to have an explicit fault diagnosis phase (faults are always considered as unobservable), which must be reliable and fast.

This paper is organized as follows. In Section 2, the effect of unobservable faults on a supervised DES is described and modeled. In Section 3, the notions of diagnosable and safe-diagnosable DES are reviewed, the new notion of safe-controllable DES is introduced and guidelines to test it are given. In Section 4, the fault tolerant control architecture is presented and the diagnosing controller is defined as well as an algorithmic procedure to build it. Finally in Section 5, a simple example is used to illustrate the new notions and the control architecture introduced in the paper. In Section 6, a conclusion is provided. A preliminary version of the results in this paper was presented in Paoli, Sartini, and Lafortune (2008).