A ship propulsion system as a benchmark for fault-tolerant control. Control Engineering Practice 7...

Control Engineering Practice 7 (1999) 227—239

A ship propulsion system as a benchmark for fault-tolerant control

Roozbeh Izadi-Zamanabadi*, Mogens Blanke

Department of Control Engineering, Institute of Electronic Systems, Aalborg University, Fredrik Bajersvej 7C, DK-9220 Aalborg, Denmark

Received 6 April 1998; accepted 27 August 1998

Abstract

Fault-tolerant control combines fault detection and isolation techniques with supervisory control, to achieve the autonomousaccommodation of faults before they develop into failures. While fault detection and isolation (FDI) methods have matured during thepast decade, the extension to fault-tolerant control is a fairly new area. This paper presents a ship propulsion system as a benchmarkthat should be useful as a platform for the development of new ideas and a comparison of methods. The benchmark has two mainelements. One is the development of efficient FDI algorithms, and the other is the analysis and implementation of autonomous faultaccommodation. A benchmark kit can be obtained from the authors. ( 1999 Elsevier Science Ltd. All rights reserved.

Keywords: Fault-tolerant control; fault detection; fault handling; benchmarks; autonomous supervisory control

1. Introduction

Faults in ship propulsion systems are far from beingunlikely events and many faults have resulted in eventsinvolving severe damage and significant loss of capitalinvestment. While safety and reliability are of paramountimportance in marine automation, fail-operational sys-tems are not employed. Instead, a safety system philos-ophy is applied, where individual machinery is shut downif local faults are detected. This strategy is only locallyoptimal and, as an example, a prime mover being shutdown, due to sensor fault in its diesel maneuvering sys-tem, has often left a ship without the ability to brake.Overall optimization in the handling of faults wouldclearly be an attractive alternative in this field.

While interesting benchmark studies and industrialapplications exist on fault detection and isolation (FDI)(Blanke and R.J. Patton, 1995; Isermann and Balle, 1997;Frank, 1996; Bennet and Patton 1997), publicationsabout autonomous fault-tolerant control have been few(Blanke et al., 1997; Patton, 1997).

The present benchmark serves the purpose of offeringa realistic and challenging problem with high industrialrelevance. The problem offers challenges in both FDI

Tel.:#45 9635 8700; fax:#45 9815 1739; e-mail: [email protected].

and autonomous supervisory control. Challenges in FDIinclude robustness to parameter uncertainty, and non-linear characteristics for propeller and hull resistance.Challenges in the fault-tolerant control part include there-configuration of controllers to accommodate severefaults. The two parts of the benchmark could be studiedindividually.

The benchmark is intended as a means of enhancingboth the theory and the technology within fault-tolerantcontrol, and it is hoped that several groups will worktogether on both the international publication of results,and the enhancement of the industrial state of the art.This paper describes the benchmark, explains the back-ground to the problem, and suggests test sequences forthe uniform evaluation of results.

2. Ship propulsion system

The example chosen for benchmark testing of variousFDI methods is the propulsion system for a ferry. Appen-dix A contains the main data related to the ship. Anoutline of the propulsion system is shown in Fig. 1. Themain components/subsystems are:

f Diesel dynamics: a diesel engine, which generatestorque to drive the propeller shaft. The control input isthe fuel index ½.

0967-0661/99/$ — see front matter ( 1999 Elsevier Science Ltd. All rights reserved.PII: S 0 9 6 7 - 0 6 6 1 ( 9 8 ) 0 0 1 4 9 - X

Fig. 2. Control hierarchy for the propulsion system. Lowest level comprises: governor, propeller pitch control. Co-ordination level comprises:combinator for shaft speed and propeller pitch, optimized shaft speed and pitch module, ship speed control, and pitch and diesel overload control.

Fig. 1. Diagram of the ship propulsion system.

f Shaft dynamics: the shaft acceleration, taken from thedifference between the diesel and propeller torques.

f Propeller characteristics: the shaft speed n, propellerpitch h and water speed »

adetermine the propeller

thrust and torque.f Ship speed dynamics: the propeller thrust balanced by

resistance from the hull, and external forces from thewind and waves.

f Propeller pitch and shaft speed controllers determinethe propeller pitch and fuel index, respectively.

f The coordinated control level gives set-points for theshaft speed and propeller pitch.

The coordinated control level is detailed in Fig. 2. Thefollowing functions are included:

f A combinator gives a set of command values: n#0.

andh#0.

as functions of the command handle position.

f A module to optimize propulsion efficiency determinesn#0.

and h#0.

, based on measured values of ½, n, hand º.

f A ship speed-control module maintains a commandvalue of ship speed º

3%&, using measured values of ½, n,

h, and º as input.f An overload control changes n

#0.and h

#0.to prohibit

the prime mover from reaching its torque limits. Thefuel index is used to determine an approaching over-load condition.

2.1. Control hierarchy for the propulsion system

The objective of the propulsion system is to maintainthe ship’s ability to propel itself, and to maneuver. Thisrequires thrust ahead for propulsion, and alternatingahead/astern for maneuvers. With a positive shaft speedn, this can be obtained by an appropriate change of thepropeller pitch h. The propulsion efficiency can be opti-mized by varying the shaft speed and propeller pitch in acoordinated manner. Fig. 2 illustrates the following steps:

f Simple coordination of commands to n and h. A leverposition is converted to commands in n and h bylooking up in a fixed table.

f A second coordination block (efficiency optimizer)tunes the variables n and h to achieve minimum powerconsumption for a given value of the ship speed(handle position).

f An overload control block, which reduces the propellerpitch if a diesel engine torque limit is reached, has final

228 R. Izadi-Zamanabadi, M.Blanke /Control Engineering Practice 7 (1999) 227—239

Fig. 3. Block diagram of the propulsion system with saturation phenomena shown for shaft speed and pitch controller. The generic faults of thebenchmark are indicated.

Table 1Generic faults considered in the benchmark

Fault Sym. Type

Sensor faults *h Additive — abruptHydraulic leak *hQ

*/#Additive — incipient

Sensor faults * n Additive — abruptDiesel fault * k

yMultiplicative — abrupt

command over the set-points n3%&

and h3%&

sent to thelower level controls.

f The final step is to implement closed-loop control ofthe ship’s speed for an ocean passage.

2.1.1. Propeller pitch and shaft speed controlThe propulsion system consists of two basic control

loops, one for propeller pitch and one for shaft speed.A block diagram with more detail of the architecturefor the lower level is shown in Fig. 3. This includes thevarious saturation phenomena and limited functions inthe shaft-speed and pitch-control loops. The values of theparameters are listed in Appendix B. Inputs at the lowerlevel controls are shaft-speed set point n

3%&, and propeller-

pitch set point h3%&

. Unknown inputs are the externalforce imposed on the ship speed ¹

%95, and the friction

torque Qf. Measured outputs are the diesel engine shaft

speed nm, fuel index ½

m, propeller pitch position h

m, and

ship speed ºm.

3. Fault scenario

The occurrence of a generic fault can have severalcauses. The benchmark considers four generic faults,resulting in six realistic events. The faults are listed inTable 1, and are further explained below.

They have different degrees of severity. Some are veryserious, and need rapid fault detection and accommoda-tion to avoid serious accidents if the component failurehappens during a critical maneuver. Time to detect andre-configure is hence essential. Some of the faults areactual events that have caused serious damage due to the

lack of fault-tolerant features in existing propulsion-control systems.

Fig. 3 locates the generic faults of the benchmark ina system block diagram. The faults are

(1) Faults related to the propeller pitch:*h

)*'): This fault can occur due to an electrical or

mechanical defect in the pitch sensor or its interface.*h

-08: This fault can occur due to an electrical or

mechanical fault in the pitch sensor or its interface.*hQ

*/#: A leakage can occur in the (hydraulic) actu-

ation part of the control system; in practice, often inan over-pressure valve.

(2) Faults related to shaft speed measurement. A dualpulse pick-up is used for measuring the shaft speed.The following faults are considered:a maximum signal *n

)*')(EMI disturbance on one

pick-up), anda minimum signal *n

-08(loss of both pick-up signals).

(3) Faults related to the diesel engine (*ky). The gener-

ated shaft torque can be lower than expected for thefollowing reasons: reduced air inlet, reduced fuel oilinlet, or a cylinder is not working.

R. Izadi-Zamanabadi, M. Blanke/Control Engineering Practice 7 (1999) 227—239 229

Table 2Consequences and severity levels for the benchmark faults

Fault Consequence Severity

*h)*')

deceleration N manoeuvering risk high*h

-08acceleration N collision risk very high

*hQ*/#

gradual speed change N cost increase medium*n

)*')deceleration N manoeuvering risk high

*n-08

acceleration N collision risk very high*k

ydiesel overload N wear, slowdown medium

To determine how faults affect the system operation,the fault-propagation analysis methodology (Blanke,1996) is employed. This is a hierarchical, bottom-up,inductive analysis method that shows end-effects, conse-quences and the assessed severity level for each fault. Theresults are shown in Table 2.

3.1. Requirements for FDI

The requirements for FDI design are as follows, where¹

sis the sampling time in the particular control loop:

f ¹ime to detect (¹d): Sensor feedback faults (*h

-08,

*h)*')

, *n-08

, and *n)*')

): ¹d(2¹

s. The incipient fault

*hQ*/#

: ¹d(100 ¹

s. The gain fault *k

y: ¹

d(5¹

s.

f ºnknown input. A time-varying external drag forcefrom weather and shallow water is a potential source offalse detection. FDI should be insensitive to this.

f False detection probability: Pf(0.01. Fault-free real

data, including harbor maneuvers, are provided toallow realistic testing of algorithms with respect tofalse detection.

f Missed detection probability: Pm(0.001. Due to the

high severity level of faults, which can result in endan-gering the ship (and its crew), the probability of notdetecting them when they do occur should be as low aspossible.

f Robust design: Several sources of model uncertaintyexist: slowly increasing hull resistance R(º) due togrowth (0 increasing to 20% of R(º)), or varyingexternal force from sea and wind ($10% of R(º)),a priori uncertainty in propeller thrust and torque($10%) and engine friction (from 5% to 8%), andgeneral uncertainty on other physical parameters($2%). FDI should be robust to these. A posterioridata for parameters may be identified and used forFDI. Measurement noise is specified in Appendix B.

3.2 Requirements for re-configuration

Fault handling should incorporate appropriate stepsto accommodate the benchmark faults. The remedialactions should primarily use re-configuration at the co-ordination level to accommodate a fault. Performance in

a re-configured mode can be lower than under no-faultconditions. Large transients should be avoided whenchanging to a re-configuration mode. Bump-less transferis not required, but is a desirable feature.

4. Dynamic model

This section describes the dynamics of the physicalsystem. The functional blocks are the diesel engine, thepropeller and the hull dynamics in forward motion.

4.1. Diesel engine dynamics

The diesel engine generates a torque Q%/'

, controlledby its fuel index, ½, to drive the shaft. The diesel enginedynamics can be divided into two parts. The first partdescribes the relation between the generated torque andthe fuel index. It is given by following transfer function(Blanke, 1981; Blanke and Andersen, 1984; Fossen, 1994,pp. 246—257):

Q%/'

(s)"ky(1#*k

y) e~qs

1#qcs

½ (s) (1)

where q represents a time delay (half the period betweenconsecutive cylinder firings), k

yis the gain constant and

qcis the time constant corresponding to torque build-up

from cylinder firings

qc+

0.9[rad]

n(2)

This model is valid for steady-state operation of a two-stroke diesel engine, and the time-delay can be ignored inthis context.

The second part express the torque balance of the shaft

ImnR "Q

%/'!Q

1301!Q

f. (3)

Q%/'

is the torque developed by the diesel engine,Q

1301is the torque developed from the propeller dynam-

ics, and Qf

is the friction torque.

4.2. Propeller characteristics

A controllable pitch propeller (CP) has blades that canbe turned by means of a hydraulic mechanism. Thepropeller pitch h can be changed from 100% (full ahead)to !100% (full astern). The propeller thrust and torqueare determined by the following bilinear relations(Blanke, 1981):

¹1301

"¹DnDn(h) DnDn#¹DnDV!

(h) DnD»a

(4)

Q1301

"Q0DnDn#QDnDn

(h) DnDn#QDnDV!(h) DnD»

a(5)

The term Q0

describes the torque that is produced bythe CP-propeller when the pitch is zero. The value ofQ

0is normally 5% of propeller torque Q

1301at nominal


Fig. 4. Non-dimensional propeller thrust as a function of advance number J"2n»a/n for different values of pitch.

operation. »ais the velocity of the water passing through

the propeller disc

»a"(1!w)º (6)

º is the ship speed, and w is a hull-dependent para-meter called the wake fraction. The coefficients ¹DnDn

, ¹DnDV!,

QDnDn, and QDnDV!

are complex functions of the pitch h. In thebenchmark, ¹

1301and Q

1301are calculated by interpola-

ting between tables of data measured in model propellertests. Figs. 4 and 5 show graphically the dependency of¹

1301and Q

1301on n and »

afor different values of the

pitch. KT

and KQ, in these figures, are non-dimensional

thrust and torque coefficients

¹1301

"KT

oD4 DnDn

Q1301

"KQo D5 DnDn

where D is the propeller diameter, and o is the massdensity of water.

4.3. Ship speed dynamics

The following non-linear differential equation approx-imates the ship speed dynamics:

(m!XUQ)ºQ "R(º)#(1!t)¹

1301#¹

%95(7)

ºm"º#l

U(8)

The term R(º) describes the resistance of the ship inthe water, and is a negative quantity. Fig. 6 shows thehull resistance as a function of the speed for two given

load conditions. XUQ

represents the added mass in surge,and is negative. The thrust deduction, t, represents thenet thrust lost due to propeller-generated flow at theship’s stern. ¹

%95is the external force from the wind and

waves. lU

is measurement noise.

5. Control-system hierarchy

The set-point for the propeller pitch h3%&

, and the shaftspeed n

3%&are calculated on the basis of the chosen mode.

The following modes are defined (Izadi-Zamanabadi andBlanke, 1998):

(1) The maneuvering mode (fixed breakpoint character-istics determine n and h from the handle position) isused mainly under the following conditions:f approaching harbor or sailing out of it,f in confined areas, orf when maximum maneuverability is needed.

(2) An economy mode is used during long-distancevoyages or ocean cruising, and on deep water. Fixedbreakpoint characteristics determine n

#0.and

h#0.

from the handle position(3) An optimal efficiency-control mode is used during

long-distance voyage. The command signals n#0.

andh#0.

are modified to optimise the fuel efficiency ata given speed.

(4) A speed-control mode is used during an ocean passageto keep the sailing schedule within a certain limit.


Fig. 5. Non-dimensional propeller shaft torque as a function of advance number J"2n»a/n for different values of pitch. Data from sea tests.

Fig. 6. The magnitude of the hull resistance is dependent on the ship’s speed and its loading conditions. The commonly adopted square law curve isnot valid in the relevant range of operation (8.5—10.5 m/s).

The control hierarchy is treated as belonging to twolevels, the lower and the upper. Re-configuration willusually take place at the upper level, although lower-levelcontrollers could also be modified to achieve fault-

tolerance in some cases. The following subsections detailthe control algorithms used in the benchmark, and listthe resources required to run each controller. This in-formation is needed for the analysis of the services that


Fig. 7. The governor.

will be possible in case of faults. It is also used to deter-mine which algorithms could be used as the replacementfor one that uses a particular signal, on which a fault hasoccurred.

5.1. Lower-level controls

The lower-level controls consist of shaft speed andpropeller-pitch controllers.

5.1.1. Propeller-pitch controlThe pitch-control subsystem consists of a large

hydraulic actuator turning the propeller blades, feedbackfrom a sensor, and associated controller and drive elec-tronics. The controller is of proportional type in thebenchmark. The pitch-control system is described by thefollowing equations:

hm"h#lh#*h

uhQ"kt(h

3%&!h

m)

hQ "max(hQ.*/

, min(uhQ , hQ .!9))#*hQ

*/#

h"max(h.*/

, min(h, h.!9

)) (9)

where hm

is the measured propeller pitch, (hQ.!9

, hQ.*/

) arerate limits set by the hydraulic pump capacity and geo-metry, and (h

.!9, h

.*/) are physical limits for propeller-

blade travel. lh is the measurement noise. The leakagefault is *hQ

*/#, and the pitch sensor fault is Dh. It is noted

that the control signal is not measured.Summarising the signals to the pitch-control unit: input

is hm, h

3%&; output is !.

5.1.2. Shaft speed controlThe input to the shaft speed controller, the governor in

Fig. 7, is the shaft speed reference n3%&

and the measuredshaft speed n

m. The output is the fuel index ½. In the

benchmark, the governor is a PI controller. Anti-windupis part of the integrating action, and K is the anti-windupgain. The controller is

nm"n#l

n#*n

½Qi"

kr

qi

((n3%&

! nm)!K (½

PIb!½

PI))

½PIb

"½i#k

r.(n

3%&!n

m)

½PI"min(max(½

PIb, ½

lb), ½

ub). (10)

½lb

and ½ub

are the lower and upper bounds for theintegrator part of the governor, and Dn the measurementfault. The governor comprises fuel index limits to keepthe diesel engine within its allowed envelope of operation.

5.1.2.1. Limits on the fuel index. Due to physical con-straints on the torque characteristics of diesel engines, thefuel index command from the governor is limited asa function of the measured shaft speed, relative to themaximum continuous rating for the engine. The bench-mark assumes:

y.!9

"

0.4, nm)40% of n

.!9,a

1, nm*80% of n

.!9,a1.5n

mn.!9,a

!0.2 otherwise

(11)

½"max(0, min(½PI

, y.!9

))

where n.!9,a

is the maximum generated shaft speed al-lowed, n

mis the measured shaft speed, y

.!9is the hard

limit specified for the engine, and ½ denotes the com-mand fuel index. The fuel index is non-negative.

In actual systems there is, furthermore, a limit asso-ciated with the scavenging air pressure. For reason ofsimplicity, this is disregarded in the benchmark.

Summarising the signals: input is nm, n

3%&; output is ½.

5.2 Upper-level control

The upper level of control comprises combinatorcurves for the handle in two modes of operation (maneu-vering and ocean passage), an overload controller, anefficiency optimiser, and a ship speed controller.

5.2.1. Handle characteristicsA command lever position constitutes the main man—

machine interface (MMI) for speed commands. The re-sulting signal, shown in Fig. 8, is the handle position h.Coordinated command in terms of the shaft speed and


Fig. 8. Handle characteristics: the values for n#0.

and h#0.

are depen-dent on the chosen mode and the handle position.

propeller pitch are obtained as

Ch#0.

n#0.D"g (h). (12)

The function g has two instances, one for maneuvering,and another for ocean passage (economy).

Summarising the signals: input is h, mode select; outputis n

#0., h

#0..

5.2.2. Diesel overload controlDiesel overload will occur if the propeller torque is

higher than the torque limit of the engine at a particularshaft speed. Overload is avoided by decreasing thepropeller load torque such that the shaft speed can beincreased, assuming that the maximum shaft speed hasnot yet been reached. One algorithm is

hQ#033

"Gkf*½ if *½*e,

kf

kb

(*½!h#033

) if *½(e(13)

where ½m!½

-*.(n

m)"*½. The correction value for pro-

peller pitch set-point is h#033

. ½-*.

(nm) is a shaft-speed

dependent limit value. Values of the parameters kf, k

b,

and e are given in Appendix B. The corrected set-pointfor the propeller pitch is then:

h3%&"h

#0.#h

#033sign(h

m).

Summarising the signals used: input is nm, h

#0., h

m, ½

m;

output is h3%&

.

5.2.3. Efficiency optimizerThe efficiency optimiser determines the set of n and h

that achieves the desired ship speed º3%&

"f4#(h) as deter-

mined by the handle position, without ship speed feedback.

Option 1. One controller consists of a search algo-rithm in n, and h, minimising the average shaft powerwhile maintaining the desired propeller thrust

Ch#0.

n#0.D"min

n,hMk

y½

mnN (14)

with the constraints

¹DnDnh#0.

n2#0.

#¹DnDVan#0.

(1!w) º3%&"

R(º3%&

)

(1!t)

n.*/

)n)n.!9

' 0(h)h.!9

(15)

The second equation obtains a constant propellerthrust, according to Eq. (7). The initial values of h

#0.and

n#0.

are taken as hm, and n

mrespectively.

Upon a failure in a ½m, n

mor h

mmeasurement, the

algorithm might use the command values ½, n#0.

, orh#0.

given by g (h), Eq. (12).Summarising the signals: input is f

4#(h) (from the

handle) or º3%&

(from the speed controller), ½m, n

m; output

is n#0.

, h#0.

.

Option 2. Another solution could be to minimise thefuel index while maintaining the desired ship speed, º

3%&.

The solution is found by using the steady-state part ofEqs (1) and (3):

minn,h

M½N"minn,h G

Q1301

(h, n, º3%&

)#Qf

ky

H (16)

with the same constraints as before, Eq. (15).Summarising the signals: input is f

sc(h) (from the

handle) or º3%&

(from the speed controller), hm, n

m; output

is n#0.

, h#0.

.

Option 3. Another approach could be to find a solutionthat results in the best achievable propeller efficiency, g

1301

maxn,h

Mg1301

N"maxn,h G

¹1301

(h, n, º3%&

)º3%&

Q1301

(h, n, º3%&

) n H (17)

where the propeller trust and torque are given by Eqs. (4)and (5). The constraints are, again, given by Eq. (15).

Summarising the signals: input is fsc(h) (from the

handle) or º3%&

(from the speed controller), hm, n

m; output

is n#0.

, h#0.

.

Note. The three optional algorithms above use assumedhull resistance R(º) to calculate the required thrust. Ina real application, algorithms would estimate R(º) and¹

%95such that the actual resistance was used in the opti-

misation.


Table 3Fault events and their corresponding activation time intervals

Event Start time End time(s) (s)

*h)*')

180 210*hQ

*/#800 1700

*h-08

1890 1920*n

)*')680 710

*n-08

2640 2670*k

y3000 3500

5.2.4. Ship speed controlShip speed control aims at maintaining a set ship speed

within a narrow margin of less than 0.1 kt. It is importantthat there is no overshoot in this controller. A simplecontrol algorithm is employed for the benchmark:

º3%&"f

4#(h)#k

U( f

4#(h)!º

m)#K

IUIU

IQU"( f

4#(h)!º

m)d

IU

dIU"G

1!0, 5kt(f4#(h)!º

m(0.1 kt

0 otherwise.(18)

Summarising the signals: input is ºm

and h; outputis º

3%&.

6. A model with two shafts

The propulsion system, which is described above, con-sists of one engine and one propeller on one shaft. Thereal ferry has two shafts, however. A model for thisextended system is provided in (Izadi-Zamanabadi andBlanke, 1998). It has two identical engine-propeller sets,placed on the starboard and port sides of the ship. Theparameter modifications needed for achieving the sameperformance as the propulsion system with one engineand one propeller is also shown in (Izadi-Zamanabadiand Blanke, 1998). The necessary modifications includechanges in the propeller diameter, engine gain, and nom-inal shaft speed. Due to extra coupling effect betweenpropulsion sets, the design of appropriate FDI methodsand carrying out the re-configuration tasks become evenmore challenging.

7. Benchmark definition

7.1. Test sequence

The test sequences for the complex (and non-linear)system applied in the benchmark and time intervals fordifferent fault events are shown in Table 3. In addition,the value of the measured signals in fault situations isgiven in Table 3. The total simulation time is 3500 s.

The fault *kycorresponds to a 20% drop in the diesel

engine gain ky.

Test sequences for the non-linear case, together withthe imposed unknown inputs, are shown in Fig. 9. Mea-sured data from sea tests are shown in Fig. 10. The seatests do not comprise known faults.

7.2. Benchmark test

The main task is to design FDI algorithms that make itpossible to detect and isolate the faults mentioned above.

The algorithm should be robust to model uncertainty,load changes, and external forces.

The known and measured variables are propeller pitchset-point h

3%&, propeller pitch measurement h

m, shaft

speed set-point n3%&

, shaft speed measurement nm, ship

speed ºm, and the fuel index ½

m. Data are obtained by

sampling every 1 s. The additional variables provided inthe data files of the benchmark are for intermediateanalysis only.

7.2.1. ProcedureTo make the benchmark test uniform, the following

strategy is recommended:(1) Fault detection and isolation:

(a) Design FDI.(b) Test with the data set generated by the non-linear

model.(2) Re-configuration

(a) Design controller re-configurations for the differ-ent faults

(b) Design the supervisory logic and implementa running system

(3) Test and validation(a) Test against data supplied from sea tests (without

faults) to verify robustness(b) Test against supplied data from the non-linear

simulation.

7.2.2. ReportingReporting should include objective measures of perfor-

mance:

(1) The FDI part of the benchmark(a) Time to detect a fault using simulated sequences.(b) False detection rate using sea test data.(c) Missed detection rate for simulated sequences (if

any).(d) Time to re-configure a controller after a fault is

detected.(e) Performance characteristics of re-configured con-

trols.(f ) Computational complexity of the methods.


Fig. 9. Simulation data for the benchmark, with faults as described in the fault scenario.


Fig. 10. Data from sea trial, without faults.

(2) The re-configuration part(a) Investigate the possibilities of re-configuration for

each fault(b) Investigate the means of re-configuration:

(i) estimate the faulty signal from redundant informa-tion,

(ii) identify an alternative control method to avoid theuse of faulty signal/part,

(iii) assess alternative control with reduced performance,(iv) alter the services offered, e.g. by falling back to lower-

level control.(3) Design the logic and a software architecture to imple-

ment the fault-tolerant solutionContributions to the benchmark could be limited to

cover only the non-linear FDI part, the re-configurationpart, or the software architecture.

The authors would be pleased to receive communica-tions about results, and will make available a WWWpage for the interchange of results and contacts.

8. Summary

A propulsion system consisting of two control loops ispresented here as a benchmark example. The system hassimple dynamics, but has non-linear characteristics. The

control consists of coupled loops (shaft speed and propel-ler pitch), and coordinated control gives several possibili-ties for controller re-configuration when faults occur.These characteristics are very common in many indus-trial processes, and the ship problem is interesting in itsown right as an object of fault-tolerant control. Efficientaccommodation of faults in this system could contributeto enhanced maritime safety.

The paper has provided a complete, nonlinear descrip-tion of the system. It should therefore be possible todesign and compare all the elements of fault-tolerantcontrol: from FDI design, through controller re-config-uration, to state-event logic and the implementation ofsupervisory functions.

The benchmark includes data sequences that enablethe comparison of different approaches.

Interested readers can down-load a benchmark kitconsisting of:

f A linear model for the propulsion system with one engineand one propeller, written in SIMº¸INKt.

f Non-linear models for the propulsion system with 1 en-gine #1 propeller, and correspondingly 2 engines #2propellers, written in SIMº¸INKt.

f A set of simulated data sequences described above.f Measured data from tests at sea.


The kit can be acquired from the WWW address:

www.control.auc.dk/&blanke/FTC/home.html

Appendix A. Ship data

The benchmark in this paper is a model of the propul-sion system (with one engine#one propeller) for a ferrywith a length of 147.2 m and a displacement of 12.840 m3

(fully loaded) and the following data:

Par. Value Description Unit

Im

0.25]106 inertia kg m2

m 13.282 weight (fullyloaded) tons

m 10.359 weight(unloaded) tons

D 6.123 propellerdiameter m

o 1025 water density kg m3

N 6 number ofcylinders dimensionless

kt

0.15 pitch anglecontrol gain dimensionless

ky

1.137]106 engine gain Nmkr

0.2211 governor gain rad~1 sK 226 anti-windup

gain dimensionlessqi

5 time cons. inthe PI s

º.!9

9.7 max. shipspeed ms

n.!9

120 max. shaftspeed RPM

»!,.!9

8.54 max. advancedspeed ms

Q%/',.!9

1137 max. torque(motor) kNm

¹1301,.!9

889.8 max. developedthrust kN

Q1301,.!9

1063 max. developedtorque kNm

XUQ

0 added massin surge kg

Appendix B. Limits on variables

The values of parameters for saturation in the modelare:

Par. Value Description UnithQ.!9

0.2 max limit onpitch rate dimensionless

hQ.*/

!0.2 min limit onpitch angle dimensionless

h.!9

1 max limit onpitch angle dimensionless

h.*/

!0.7 min limit onpitch angle dimensionless

n.!9,a

120 max allowedshaft speed RPM

½lb

0 lower bound forfuel index dimensionless

½ub

1 upper bound forfuel index dimensionless

kf

0.05 gain in overloadcontroller dimensionless

kb

1 gain in overloadcontroller dimensionless

e 0.05 threshold inoverloadcontroller dimensionless

B.1 Disturbances

The following two disturbance sources are considered:

Source Name Value

Qf

Friction torque 0.05]Q%/',.!9

¹%95

External force 0.1]¹.!9

B.2. Noise

Measurement noise is considered to be Gaussian whitenoise with zero mean. The following data shows thesignals to which the generated noise with given standarddeviation are added.

Signal Name Standard deviation

lU

Ship speed 0.01]º.!9

(9.7m/s)ln

Shaft speed 0.005]n.!9

(124RPM)lh Propeller pitch 0.0425]h

.!9(1)

lY

Fuel index 0.005]½.!9

(1)

References

Bennet, S.M., & Patton, R.J. (1997). Using bilinear motor model fora sensor fault tolerant rail traction drive. IFAC Symp. on FaultDetection, Supervision and Safety for ¹echnical Processes — SAFEP-ROCESS ’97.

Blanke, M. (1981). Ship propulsion losses related to automatic steeringand prime mover control. Ph.D. thesis, Technical University of De-nmark (DTU).

Blanke, M. (1996). A component based approach to industrial faultdetection and isolation. Fault Detection, Pulp and Paper, Biotechnol-ogy (Vol. N, pp. 97—102). 13th IFAC World Congr.


Blake, M., & Andersen, J.S. (1984). On dynamics of large two strokediesel engines: new results from identification. Proc. 9th IFAC¼orld Conf. Budapest.

Blanke, M., & Patton, R.J. (1995). Industrial actuator benchmark forfault detection and isolation. Control Engng Practice, 3 (12),1727—1730.

Blanke, M., Izadi-Zamanabadi, R., B+gh, S.A., & Lunau, C.P. (1997).Fault-tolerant control systems—a holistic view. Control Engng Prac-tice, 5 (5), 693—702

Fossen, Thor I. (1994). Guidance and Control of Ocean »ehicles(pp. 246—257). New York: Wiley.

Frank, P.M. (1996). Analytical and qualitative model-based fault diag-nosis; a survey and some new results. Eur. J. Control, 2 (1), 6—28.

Isermann, R., & Balle, P. (1997). Trends in the application of model-based fault detection and diagnosis of technical processes. ControlEngng Practice, 5 (5), 709—719.

Izadi-Zamanabadi, R., & Blanke, M. (1998). A ship propulsion systemmodel for fault tolerant control. Technical Report. Control Engin-eering Department, Aalborg University,

Patton, Ron J. (1997). Fault-tolerant control: the 1997 situation. IFACSymp. on Fault Detection, Supervision and Safety for ¹echnical Pro-cesses — SAFEPROCESS ’97 Vol. 2, (pp. 1033—1055).


A ship propulsion system as a benchmark for fault-tolerant control. Control Engineering Practice 7...

Documents

Transcript of A ship propulsion system as a benchmark for fault-tolerant control. Control Engineering Practice 7...