Fault tolerance control systems

Once a fault has been detected, in some applications a controller reconfiguration for the self-correction of the fault is required (fault accommodation). A fault-tolerant control system possesses this capability, and its adoption is of the utmost... 

Fault-tolerant Control Systems Hassan Noura, Didier Theilliol, Jean-Christophe Ponsart and Abbas Chamseddine... 

Readers from the fields of process, chemical and control engineering may find these monographs from the Advances in Industrial Control series of complementary interest Fault-tolerant Control Systems by Hassan Noura, Didier Theilliol, Jean-Christophe Ponsart and Abbas Chamseddine (ISBN 978-1-84882-652-6, 2009) Predictive Functional Control by Jacques Richalet and Donal O Donovan (ISBN 978-1-84882-492-8, 2009) and Process Control by Jie Bao and Peter L. Lee (ISBN 978-1-84628-892-0, 2007). 

Markov models are generally considered more flexible than other methods. On a single drawing, a Markov model can show the entire operation of a fault tolerant control system including multiple failure modes. Different repair rates can be modeled for different failure situations. If the model is created completely, it will show full system success states. It will also show degraded states where the system is still operating successfully but is vulnerable to further failures. The modeling technique provides clear ways to express failure sequences and can be used to model time dependent probabilities. 

Zhang, Y., Jiang, J. (2008). Bibliographictd review on reconfigurable fault-tolerant control systems. Annual Reviews in Control, 32, 229—252. 

F atton, R. J. (1997). Fault-tolerant control systems the 1997 situation. In Proceedings of 3rd IFAC Symposium on Fault Detection, Supervision and Safety for Technical Processes ( pp. 1033-1055). Available from http //hull.ac.uk/control/downloads/safepr.pdf. 

M. Blanke, R. Izadi-Zamanabadi, S.A. B0gh, C.P. Lunau, Fault-tolerant control systems — a holistic view, Control Engineering Practice 5 (1997). 

Determine if a fault-tolerant control system is necessary. This is one in which a single fault can not cause the system to fail. T)rpically such a system uses triplicate redundancy with two-out-of-three voting logic and redimdant functions. 

Kirrmann, H., Grosspietsch, K. Fault-tolerant control systems (survey paper). Automatisierungstechnik 50(8), 362-374 (2002)... 

Pearson, A.R., Sutton, R., Burns, R.S. and Robinson, P. (2000) A Kalman Filter Approach to Fault Tolerance Control in Autonomous Underwater Vehicles. In Proc. 14th International Conference on Systems Engineering, Coventry, 12-14 September, 2, pp. 458 63. 

El-Farra, N.H., Gani, A., and Christofides, P. D. (2005). Fault-tolerant control of process systems using communication networks. AIChE J., 51, 1665-1682. 

The book concludes with a discussion of the presented bond graph model-based quantitative approach to FDI in hybrid systems and recommends as a possible topic for further research the use of bond graph modelling in fault tolerant control of hybrid systems. 

In any case, FDI is a prerequisite also for this task and bond graph based ARR residual generation can provide the information needed by fault diagnosis. Chapter 11 of reference [11] addresses fault tolerant control of systems represented by continuous time model and related issues such as system inversion. In [12], a bond graph approach to diagnosis and FTC has been recently presented and applied to an intelligent autonomous vehicle. FTC of hybrid systems has been considered for instance... 

Hao, Y. A. N. G., Ze-Hui, M. A. O., JIANG, Bin. (2006). Model-based fault tolerant control for hybrid dynamic systems with sensor faults. Acta Automatica Sinica., 52(5), 680-685. 

Failure A failure is a permanent interruption of a system s ability to perform a required function. It can only be accommodated by a reconfiguration of the system. Fault A system fault is a deviation of the system structure or the system parameters from the nominal conditions [2]. Appropriate actions may enable to recover from a component fault without replacing the component. The fault may be accommodated through fault tolerant control. 

Fault tolerant control (FTC) Is the ability to automatically accommodate system... 

Enhanced man-machine interface design Automated plant operations Simplified neutron monitoring system Reduction in number of nuclear boiler instruments Fault-tolerent safety system logic and control Standardized distal control and measurement Multiplexing of plant control signals... 

A component s malfunction is called a fault, when it is possible to take appropriate measures (through fault-tolerant control) to recover from it without replacing the faulty component. When the malfunctioning of the device is too severe which causes an irrecoverable structural change to the system then it is referred to as a failure. Some failures can be accommodated through online system reconfiguration. 

The design of fault tolerance is different from other fault tolerant computing systems. So discussions will now be on fault tolerance in control systems. 

Defects or faults in any component of the loop can develop into malfunctions. Faults are not always visible to the operator immediately, but may appear in such a way that they give rise to complete loop failure. In safety-critical applications, no failure can be tolerated [3]. Redundancies in hardware and software facilitate fault recovery. So, for increased dependability fault tolerant control (PTC) is an ideal solution. In critical controls it may be disastrous to tolerate any failure of control systems. In PTC the system continues to operate with single failure in components and/or subsystems. Also in cases of critical controls, FTC will make a controlled shutdown to a safe state in a critical situation. FTC systems use the help of redundancies in hardware and software, discussed earlier, and fault diagnostics and intelligent software to monitor health and behavior of components and function blocks and take remedial action. With these tools the faults are isolated and suitable... 

Aljer and Devienne [5] consider the use of a formal specification language as the foundation of real validation process. They propose architecture based upon stepwise refinement of a formal model to achieve controllable implementation. Partitioning, fault tolerance, and system management are seen as particular cases of refinement in order to conceptualize systems correct by proven construction. The methodology based on the refinement paradigm is described. To prove this approach, the B-HDL tool based on a combination of VHDL and B method formal language has been developed. 

Wu, B., and H. Shi. The Research of Active Fault-Tolerant Control for a Ship Propulsion System. Journal of Harbin Engineering University 27 (2006) 426-431. 

The hardware and software used to implement LIMS systems must be vahdated. Computers and networks need to be examined for potential impact of component failure on LIMS data. Security concerns regarding control of access to LIMS information must be addressed. Software, operating systems, and database management systems used in the implementation of LIMS systems must be vahdated to protect against data cormption and loss. Mechanisms for fault-tolerant operation and LIMS data backup and restoration should be documented and tested. One approach to vahdation of LIMS hardware and software is to choose vendors whose products are precertified however, the ultimate responsibihty for vahdation remains with the user. Vahdating the LIMS system s operation involves a substantial amount of work, and an adequate vahdation infrastmcture is a prerequisite for the constmction of a dependable and flexible LIMS system. 

Design and implement a reliable and fault-tolerant basic process control system to ensure the design limitations of the primary containment system are not exceeded. 

However, for structuring to have some direct relevance to questions of operational dependability, and in particular fault tolerance, it must be what might be described as strong—strong structuring actually controls interactions within and between systems, and limits error propagation in both time and space, i.e., constitutes real not just perceived or imagined boundaries. 

Fault-tolerant Flight Control and Guidance Systems Guillaume Ducard... 

Several of FM s Loss Prevention Data Publications (1, 17B, 17C) discuss the concept of triply-redundant, fault-tolerant, high-reliability hardware/software systems for manufacturing operations. Risk analysis and systems reliability research is currently underway to develop better guidelines for the design and application of reliable process control systems. 

Note that in discussing availability and performance one needs to make reference to the stakeholders responsible for hosting the system. In practice this could be the healthcare organisation, software manufacturer or a third party. The principles of fault tolerance and resilience remain the same irrespective of which party takes commercial responsibility. However the stakeholder responsible for implementing controls will vary as will the information available to safety case developers. In this... 

The accident report does not explore whether the PCS software could have included sanity checks on the roll rate or vehicle behavior to detect that incorrect roll rates were being provided by the IMS. Even if the PCS did detect it was getting anomalous roll rates, there may not have been any recovery or fail-safe behavior that could have been designed into the system. Without more information about the Centaur control requirements and design, it is not possible to speculate about whether the Inertial Navigation Unit software (the IMS and PCS) might have been designed to be fault tolerant with respect to filter constant errors. 

The second novel hybrid fault tolerance technique. On-line Control Flow Checker Module (OCFCM) technique, was initially based on checkers, watchdog processors, and on the reconfigurability offered by modem FPGAs. It addresses recon-figurable systems with hardcore processors, such as FPGAs with embedded processors (for example, the Virtex Pro and Excalibur families, from Xilinx and Altera, respectively) or closed IP processors, such as the Microblaze from Xilinx. It can also be applied to ASICs, but with a few restrictions. 

---