Structural Methodologies for Distributed Fault Detection and Isolation

Abstract

The increasing complexity and size of cyber-physical systems (e.g., aircraft, manufacturing processes, and power generation plants) is making it hard to develop centralized diagnosers that are reliable and efficient. In addition, advances in networking technology, along with the availability of inexpensive sensors and processors, are causing a shift in focus from centralized to more distributed diagnosers. This paper develops two structural approaches for distributed fault detection and isolation. The first method uses redundant equation sets for residual generation, referred to as minimal structurally-over-determined sets, and the second is based on the original model equations. We compare the diagnosis performance of the two algorithms and clarify the pros and cons of each method. A case study is used to demonstrate the two methods, and the results are discussed together with directions for future work.

1. Introduction

As the complexity of industrial systems grows, system monitoring and fault diagnosis systems are becoming essential to assure system reliability and functional safety; see for example [1,2] and the references therein. Safety-critical systems must detect and isolate faults quickly and reliably to enable effective safety maneuvers and fault-tolerant control so as not to endanger operations and human lives [3].

Traditional approaches have focused on designing centralized diagnosers for complex systems, e.g., the Aircraft Diagnostic and Maintenance Systems (ADMS) used on modern aircraft systems [4,5]. However, since many industrial applications involve large dynamic systems with many subsystems, distributed approaches to fault detection and isolation are becoming necessary for a number of reasons [6]. Centralized diagnosers are less reliable because they create a single point of failure, and designing centralized diagnosers for large, complex systems may become computationally intractable. Transferring sensor data from the distributed subsystems to a central fault diagnosis unit can become error prone, for example because of packet losses and networking delays, which can then affect the accuracy and timeliness of diagnosis decisions [7]. Furthermore, from a practical point of view, different subsystems are designed by different manufacturers, who may not be willing to pass along all of their knowledge of the subsystems to the system integrator to protect their intellectual property. This makes it difficult for the system integrator to design centralized diagnosers since they to do not have access to subsystem models.

A number of approaches have been developed for distributed fault detection and isolation in discrete event systems. In the simplest case, a group of distributed fault detection and isolation approaches considers each subsystem as a node that reports its state as “OK” or “faulty” without providing any details of the nature of the fault and how it was inferred. This approach is prevalent for wireless sensor networks [8] and computer network [9] diagnosis. For most systems that exhibit hybrid and continuous behaviors, distributed fault detection and isolation is more complicated. In these systems, a subsystem has several components, and a fault could occur in a sensor, actuator, or other components in the subsystem. Therefore, it is not enough to simply declare a subsystem as “OK” or “faulty,” since the isolation of component faults requires deeper reasoning processes. Shames et al. [10] used a bank of unknown input observers for distributed Fault Detection and Isolation (FDI) in time-invariant linear systems. A three-layer distributed diagnosis architecture design was proposed by [11]. Chanthery et al. [12] proposed a distributed residual generation and computation approach for distributed diagnosis.

To achieve accurate fault detection and isolation of a known set of potential faults in a distributed framework, subsystems may have to share data so that the necessary residuals may be derived for fault isolation. Roychoudhury et al. [13] developed an algorithm that searches for the minimal number of additional external measurements to add to each local diagnoser in order to make all faults detectable and isolable in that subsystem. Daigle et al. [14] used a similar approach for distributed fault detection and isolation in mobile robots. Bregon et al. [15] used breadth-first search to find the minimum number of measurements to add to each subsystem to make all the faults detectable and isolable by using information from all local diagnosers. The algorithm guarantees minimum communication among subsystems; however, it is exponential in the number of system measurements. To address this problem, we have proposed a greedy search algorithm that is computationally efficient, but suboptimal. Ferrari et al. [7,16] proposed a similar robust distributed fault detection and identification approach, but they did not address the problem of determining the minimum number of required shared variables between the subsystems.

In this paper, we propose two general approaches for designing a set of distributed diagnosers that together have the same diagnosability performance as centralized approaches: (1) a Minimal Structurally-Over-determined (MSO)-based approach and (2) an equation-based approach. Some of our previous work [17,18] presented an initial approach and results for our distributed diagnosis approach. In this paper, we present the problem formulations, the proposed algorithms, and the accompanying proofs for the hypotheses on which these algorithms are based in more detail. We compare the computational complexities and the application of these algorithms to a testbed: the spacecraft electrical power distribution system [19]. The advantages and disadvantages of each algorithm are discussed to help the health monitoring engineers select the proper approach for a given application.

The first approach uses Minimal Structurally-Over-determined (MSO) set selection [20] and provides globally correct diagnosis results while minimizing the number of measurements shared between different subsystems. Each MSO set used for residual generation represents an analytical redundancy relation in the system [20,21]; however, the total number of MSO sets is exponential in terms of the system measurements. To avoid the computational complexity of dealing with a large number of MSO sets, we propose a second algorithm for designing distributed diagnosers that is based on system equations. This solution is computationally efficient, and its solution matches the diagnosability capabilities of a centralized diagnoser. Moreover, the equation-based method does not require access to the global model for diagnoser design, which makes it applicable to large, complex systems, where global system models are likely to be unavailable or unknown.

The rest of this paper is organized as follows. Section 2 presents basic definitions and the running example we use in the paper. Section 3 presents the MSO-based distributed diagnosis approach, and Section 4 presents the equation-based approach. Section 5 discusses the case study, and Section 6 presents the advantages and disadvantages of each approach along with directions for future work.

2. Basic Definitions and Running Example

This section introduces the basic concepts associated with the distributed diagnosis of dynamic systems.

Definition 1 (System model).

A system model S is a four-tuple: (V, M, E, F), where V is the set of variables, M is the set of measurements, E is the set of equations, and F is the set of system faults.

It is assumed that the sets of V and E are sufficient to define the behavior of the system. The system S is partitioned into n subsystems, $S_1,S_2,\dots S_n$, where each subsystem model is defined as:

Definition 2 (Subsystem model).

A subsystem model $S_i$ ($1\le i\le k$) associated with a system model, S, is also a four-tuple: ($V_i$, $M_i$, $E_i$, $F_i$), where $V_i\subseteq V$, $M_i\subseteq M$, $E_i\subseteq E$, and $F_i\subseteq F$. Furthermore, $S_1\cup S_2\cup \dots S_k=S$.

We note that a variable can be shared between two or more subsystems describing the connection between the different subsystems.

Example 1.

A four-tank system is used as a running example in the paper; see Figure 1. The system is assumed to be divided into four non-overlapping subsystems, where each subsystem is constituted of one tank and the outlet pipe to its right. Two of the subsystems, 1 and 3, also have external inflows into their tanks. Associated with each subsystem is a set of measurements, $\{y_1,y_2,\dots ,y_6\}$, that are shown as encircled variables in the figure.

The first subsystem, $S_1$, in the running example is described by the following set of equations:

$$\begin{array}{cc}\hfill e_1:{\dot{p}}_1& =\frac{1}{C_{T1}}(q_{in1}-q_1-f_1)\hfill \\ \hfill e_2:q_1& =\frac{p_1-p_2}{R_{P1}+f_2}\hfill \\ \hfill e_3:p_1& =\int {\dot{p}}_{1}dt\hfill \end{array}\begin{array}{cc}\hfill e_4:q_{in1}& =u_1\hfill \\ \hfill e_5:p_1& =y_1\hfill \\ \hfill e_6:q_1& =y_2.\hfill \end{array}$$

(1)

$E_1=\{e_1,e_2,e_3,e_4,e_5,e_6\}$ defines the set of equations; $V_1=\{{\dot{p}}_1,p_1,p_2,q_{in1},q_1\}$ defines the set of subsystem unknown variables; $M_1=\{u_1,y_1,y_2\}$ defines the set of subsystem known variables (measurements); and $F_1=\{f_1,f_2\}$ defines the set of faults associated with this subsystem model. It is assumed that the system parameters ($C_{T1}$, and $R_{P1}$ of the first subsystem) are known. This model representation is used to emphasize the model structure, which is useful, for example, when analyzing structural fault detectability and isolability properties [2].

Similarly, the three other subsystem models are defined by the following equations:

$$\underset{Subsystem{S}_2}{\underbrace{\begin{array}{cc}\hfill e_7:{\dot{p}}_2& =\frac{1}{C_{T2}}(q_1-q_2-f_3)\hfill \\ \hfill e_8:q_2& =\frac{p_2-p_3}{R_{P2}+f_4}\hfill \\ \hfill e_9:p_2& =\int {\dot{p}}_{2}dt\hfill \\ \hfill e_{10}:p_2& =y_3\hfill \\ \hfill e_{11}:q_2& =y_4\hfill \end{array}}}\underset{Subsystem{S}_3}{\underbrace{\begin{array}{cc}\hfill e_{12}:{\dot{p}}_3& =\frac{1}{C_{T3}}(q_{in2}+q_2-q_3)\hfill \\ \hfill e_{13}:q_3& =\frac{p_3-p_4}{R_{P3}+f_5}\hfill \\ \hfill e_{14}:p_3& =\int {\dot{p}}_{3}dt\hfill \\ \hfill e_{15}:q_{in2}& =u_2\hfill \\ \hfill e_{16}:q_3& =y_5\hfill \end{array}}}\underset{Subsystem{S}_4}{\underbrace{\begin{array}{cc}\hfill e_{17}:{\dot{p}}_4& =\frac{1}{C_{T4}}(q_3-q_4-f_6)\hfill \\ \hfill e_{18}:q_4& =\frac{p_4}{R_{P4}}\hfill \\ \hfill e_{19}:p_4& =\int {\dot{p}}_{4}dt\hfill \\ \hfill e_{20}:p_4& =y_6.\hfill \end{array}}}$$

(2)

In the equations, $p_i$ represents the pressure in tank i, and $q_i$ represents the liquid flow through the connecting pipe associated with the adjoining tanks. $q_{ini}$ represents the inflow into tank i. The capacity of tank i is represented as $C_{Ti}$, and pipe resistance is given by $R_{Pi}$. The fault parameters are modeled by $f_i$. Fault $f_1$ represents a leak in Tank 1; $f_2$ represents a clog in the connecting pipe to the right of Tank 1; $f_3$ represents a leak in Tank 2; $f_4$ represents a clog in the connecting pipe to the right of Tank 2; $f_5$ represents a clog in the connecting pipe to the right of Tank 3; and $f_6$ represents a leak in Tank 4.

The subsystem equations as described in Example 1 take on a general form; as examples, they may be expressed as state space equations, implicit differential equations, etc. The following definitions describe connections between subsystems.

Definition 3 (First order connected subsystems).

Two subsystems, $S_i$ and $S_j$, are first order connected if and only if they have at least one shared variable.

Definition 4 ($i^{\mathrm{th}}$ order connected subsystems).

Two subsystems, $S_k$ and $S_j$, are $i^{th}$ order connected if there exists a subsystem model $S_m$ that is ${(i-1)}^{th}$ order connected to $S_k$ and is first-order connected to $S_j$, or $S_m$ is ${(i-1)}^{th}$ order connected to $S_j$ and is first-order connected to $S_k$.

Example 2.

In the four-tank example, subsystems $S_1$ and $S_2$ are first order connected, and their shared variables are $V_1\cap V_2=\{p_2,,q_1\}$. Similarly, $S_1$ and $S_3$ are second order connected because both of them are first order connected to $S_2$.

In this paper, MSO sets are used as the primary approach for FDI and defined as follows [20]:

Definition 5.

(Structural over-determined set) Consider a set of equations and its associated variables, measurements, and faults: $(E,V,M,F)$. This set of equations is structurally over-determined (SO) if the cardinality of the set $\left\{E\right\}$ is greater than the cardinality of set $\left\{V\right\}$, i.e., $\left|E\right|>\left|V\right|$.

Definition 6.

(Minimal Structurally-Over-determined (MSO) set) A set of over-determined equations is minimal structurally-over-determined if it has no subset of structurally-over-determined equations.

The MSO sets are minimal sets of equations that can be used to generate residuals, for example by using the Fault diagnosis toolbox developed by Frisk and Krysander [22]. MSO sets represent redundant equation sets that capture the redundancies in the system: $MS{O}_l=(E_l,V_l,M_l,F_l)$. For example, $MS{O}_{11}=(E_{11},V_{11},M_{11},F_{11})$, where $E_{11}=\{e_1,e_3,e_4,e_5,e_6\}$, $V_{11}=\{{\dot{p}}_1,p_1,q_{in1},q_1\}$, $M_{11}=\{u_1,y_1,y_2\}$, and $F_{11}=\left\{f_1\right\}$ represent an MSO set in subsystem $S_1$ (1) of our running example. For brevity and simplification, we simply say a specific equation, variable, measurement, or fault is a member of an MSO in the rest of the paper, e.g., $f\in MS{O}_l$. Each MSO set represents a part of the system model that can be used to design a residual that is only sensitive to certain faults. A set of MSO sets can be used to generate residuals that together can isolate a set of faults.

To discuss the fault detectability and isolability properties of the global system and its subsystems, we define global and local fault detectability and isolability as follows.

Definition 7.

(Globally-detectable fault) A fault f∈F is globally detectable in system S if there is a minimal structurally over-determined set $MS{O}_l$ in the system, such that f∈$MS{O}_l$.

Definition 8.

(Locally-detectable fault) A fault f∈$F_i$ is locally detectable in subsystem $S_i$ if there is a minimal structurally over-determined set $MS{O}_l$ in the subsystem such that f∈$MS{O}_l.$

Example 3.

Fault $f_1$ in (1) is locally detectable because $f_1\in MS{O}_{11}$. However, $f_2$ is not locally detectable because there is no MSO set in this subsystem that includes $f_2$. To detect $f_2$ locally, the diagnosis subsystem requires additional measurements.

Definition 9.

(Globally-isolable fault) A fault $f_i$∈F is globally isolable from fault $f_j$∈F if there exists a minimal structurally-over-determined set $MS{O}_i$ in the system S, such that $f_i$∈$MS{O}_i$ and $f_j$∉$MS{O}_i$.

Definition 10.

(Locally-isolable fault) A fault $f_i$∈$F_i$ is locally isolable from fault $f_j$∈F if there exists a minimal structurally-over-determined set $MS{O}_i$ in subsystem $S_i$, such that $f_i$∈$MS{O}_i$ and $f_j$∉$MS{O}_i$.

Note that if a fault $f_j$ is locally detectable in a subsystem $S_i$, it is globally detectable as well, and if a fault $f_j$ is locally isolable from a fault $f_k$, it is globally isolable from $f_k$, as well.

3. MSO-Based Distributed Fault Detection and Isolation

3.1. Problem Formulation

The objective in this work is to design a set of distributed diagnosers that together have the same diagnosability as a centralized diagnoser. This means that a distributed approach should detect any fault that is globally detectable and isolate any pair of faults that are globally isolable. In the ideal case, there are enough MSO sets in each subsystem to detect and isolate all of its faults, $F_i$. In that case, no exchange of information is necessary between the different diagnosers. If the independence among diagnosers does not hold, the different subsystems need to share some sensor data with each other to be able to detect and isolate the faults.

To address this problem in an efficient way, an integrated approach is derived to select a set of MSO sets for each subsystem that guarantee full diagnosability and minimum exchange of measurements among subsystems. The general idea is to augment each subsystem with additional measurements that are typically acquired from the (nearest) neighbors of the subsystem, such that all of the faults associated with the extended subsystem model are detectable and isolable. In the worst case, all of the measurements from another subsystem may have to be included to make the current subsystem diagnosable. When such a situation occurs, we say the two subsystems are merged and represented by a common diagnoser; therefore, the total number of independent distributed diagnosers may be less than k.

Let $\mathcal{MSO}=\{MS{O}_1,MS{O}_2,\dots ,MS{O}_r\}$ denote the set of candidate MSO sets for the system S. For each subsystem $S_i$, the objective is to develop an algorithm to select a subset of $\mathcal{MSO}$s that guarantees maximal structural detectability and isolability for faults $F_i$ associated with the subsystem, while using a minimum number of measurements from the other subsystems in the system to assure the equivalence of local and global diagnosability, i.e.,

$$\begin{array}{cc}\hfill \forall S_i;& 1\le i\le k\hfill \\ \hfill Select& MS{O}_{S_i}\subset \mathcal{MSO}\hfill \\ \hfill s.t.& \underset{M_o\subseteq M}{min}\left|M_o\right|\hfill \\ & D_i(M_i\cup M_o)=D_i\left(M\right),\hfill \\ & I_i(M_i\cup M_o)=I_i\left(M\right),\hfill \end{array}$$

(3)

where $M_o$ represents the set of measurement we need to communicate to the subsystem $S_i$ and $M_o\cup M_i$ represents the set of measurement subsystem $S_i$ that will be used to diagnose all faults associated with it. M represents the set of all measurements in the system. For a given set of measurements, X, $D_i\left(X\right)\subseteq F_i$ represents the set of detectable faults, and $I_i\left(X\right)\subseteq F_i$ represents the set of isolable faults in $F_i$ and $F_i\subseteq F$.

3.2. MSO Set Selection for Distributed Fault Detection

For the situation in which the global model is known, $M=\{m_1,m_2,\dots ,m_l\}$ in Equation (3) is the set of all system measurements. Let us assume we can generate r MSO sets given M: $\mathcal{MSO}=\{MS{O}_1,MS{O}_2,\dots ,MS{O}_r\}$.

Our goal is to design an algorithm that selects ${\mathcal{MSO}}_i\subseteq \mathcal{MSO}$ in a way that requires a minimum number of additional measurements $M_o\subseteq M,M_i\cap M_o=\varnothing$, i.e., measurements from the system not belonging to subsystem $S_i$, to make all its faults globally detectable and isolable, if possible. Note that this is equivalent to the set-covering problem, which is NP-complete. In the past, heuristic search methods have been adopted for solving this problem, for example a Temporal Causal Graph (TCG) approach was used in [13]. In this paper, the problem is formulated as a Binary Integer Linear Programming (BILP) problem [23]:

$$\begin{array}{cc}\hfill min& c^{T}x\hfill \\ \hfill s.t.& Ax\le b\hfill \\ & \exists x_b\subset x\hfill \\ & \forall x_k\in x_b\Rightarrow x_k\in \{0,1\},\hfill \end{array}$$

(4)

where vector c represents the cost weights, matrix A and vector b define linear constraints, x represents the variables, $x_b$ represents the binary variables, and $x_k\in x_b$ represents a scalar binary variable [24].

There are several tools available for solving this problem, e.g., branch and bound algorithms [25] and branch and cut algorithms [26] (see, for example, http://www.mathworks.com/help/optim/ug/mixed-integer-linear-programming-algorithms.html in the MATLAB™ linear integer programming toolbox).

To formulate the problem (3) as a BILP problem, a binary variable $x\left(k\right)$: $1\le k\le l$ is defined for measurement $m_k$ in the system as follows:

$$x\left(k\right)=\{\begin{array}{ccc}1& \mathrm{if}& m_k\in M_i\cup M_o\\ 0& \mathrm{if}& m_k\notin M_i\cup M_o,\end{array}$$

(5)

where $M_o$ is the answer to Problem (3). An additional binary $x(k+l)$: $1\le k\le r$, is used for MSO set $MS{O}_k$ in the system as follows.

$$x(k+l)=\{\begin{array}{ccc}1& \mathrm{if}& MS{O}_k\in {\mathcal{MSO}}_i\\ 0& \mathrm{if}& MS{O}_k\notin {\mathcal{MSO}}_i.\end{array}$$

(6)

Minimizing the number of measurements used from the other subsystems, this is formulated in the following cost function c as:

$$c\left(k\right)=\{\begin{array}{ccc}0& \mathrm{if}& m_k\in M_i\\ 1& \mathrm{if}& m_k\in M\backslash M_i\\ 0& \mathrm{if}& l<k\le l+r,\end{array}$$

(7)

where l is the number of system measurements and r is the number of MSO sets in the system. To determine the set of measurements and selected MSO sets in each distributed diagnoser, a BILP algorithm with $l+r$ binary variables should be solved for the subsystem.

Consider subsystem $S_i$ with local faults $F_i$ and the set of system faults, F. Each local fault $f_j\in F_i$ has to be locally detectable. Given Definition 8, local detectability of all the faults $f_j\in F_i$ is achieved using the following constraints in the optimization problem (4).    

$$A(j,k)=\{\begin{array}{ccc}0& \mathrm{if}& k<l\\ -1& \mathrm{if}& f_j\in MS{O}_{k-l}\\ 0& \mathrm{otherwise}.\end{array}$$

(8)

By considering $b\left(j\right)=-1$ for $1\le j\le g$, where g is the number of faults in $F_i$, the solution will contain at least one MSO set to detect each fault.

The following constraint is added:

$$A(j+g,k)=\{\begin{array}{cc}0& k<l\\ -1& f_j\in MS{O}_{k-l},f_h\notin MS{O}_{k-l}\\ 0& \mathrm{otherwise}.\end{array}$$

(9)

is used to isolate $f_j\in F_i$ from another fault $f_h\in F$. Setting $b\left(j\right)=-1$ for $g<j\le g\ast h$, where h is the number of faults in the system, $h=\left|F\right|$, will make sure that there is at least one MSO set to isolate each of the subsystem faults from the other faults in the system.

Using an MSO set is equivalent to using the measurements that are included in the MSO set. For example, using $MS{O}_{11}$ from the water tank example in a subsystem diagnoser requires three measurements $M_{11}=\{u_1,y_1,y_2\}$ transmitted to that subsystem. Therefore, a set of constraints is included that capture the relationship between the measurements and MSO sets in the distributed diagnosis system.

Equation (10) represents this set of constraints in the A matrix.

$$A(j+g\ast h,k)=\{\begin{array}{ccc}-1& \mathrm{if}& m_k\in MS{O}_j\\ |M_j|& \mathrm{if}& k=j+\left|M\right|\\ 0& \mathrm{otherwise},\end{array}$$

(10)

where $|M_j|$ is the cardinality number of the set of measurements in $MS{O}_j$ and $\left|M\right|$ is the number of measurements in the system. Furthermore, $b\left(j\right)=0$ for $g\ast h<j\le g\ast h+r$, where r is the number of MSO sets in the system.

Example 4.

The water tank system has 165 MSO sets. The entire system includes eight measurements, where subsystem $S_1$ includes three measurements. $S_1$ has two faults of interest, and the goal is to be able to isolate them from the other six faults in the complete system. For the optimization problem (4) for $S_1$, matrix $A\in {\mathbb{R}}^{177\times 165}$, i.e., two local detectability constraints, 10 local isolability constraints, and 165 constraints to capture the relationship between the MSO sets and the measurements and 173 columns corresponding to the eight measurements and 165 MSO sets.

Table 1. Set of augmented measurements for each subsystem model.

Subsystem	Set of Augmented Measurements
$S_1$	$y_3$
$S_2$	$u_2$, $y_2$, $y_6$
$S_3$	$y_4$, $y_6$
$S_4$	$y_5$

shows the set of measurements to add for each of the subsystem diagnosers to achieve maximum possible detectability and isolability. To find the optimum measurements, the optimization problem (4) has been solved for each subsystem.

Subsystem $S_1$ initially has three measurements $M_1=\{u_1,y_1,y_2\}$. To achieve global diagnosability for its faults, $y_3$ must be shared with its diagnoser from subsystem $S_2$. Subsystem $S_2$ is the only subsystem that shares a variable with a second order connected subsystem. All the other subsystems only need to communicate with their first order connected subsystems.

In general, the worst case scenario for a system with connected subsystems will typically require a large number of measurements from other subsystems to be communicated to each subsystem diagnoser. In those situations, distributed subsystem diagnosers help overcome the single point of failure problem, but each subsystem diagnoser may require a large number of measurements to be communicated to it from all of the other subsystems.

Even though there are efficient algorithms to solve BILP problems, this approach will not scale up for larger systems, since the search space is exponential in the number of MSO sets $2^r$, even if the subsystem diagnoser design is performed off-line. In addition to the computational complexity, the availability of global models for large, complex systems is unlikely because of the issues discussed in Section 1. To overcome this problem, a heuristic search strategy is proposed based on an incremental search algorithm that works with the original system equations instead of MSO sets.

4. Equation-Based Distributed Fault Detection and Isolation

To avoid the computational complexity of the MSO-based algorithm, in the previous section, a distributed diagnosis method that works directly with the system of equations is proposed. To recap from earlier work [27], a structural model representation is used. A structural model describes which variables are included in which model equations. A useful tool is the Dulmage–Mendelsohn (DM) decomposition that decomposes a system model into three parts: (1) under-determined, (2) exactly determined, and (3) over-determined. The over-determined part introduces redundancy in the system description and forms the basis for fault detection and isolation [2]. Figure 2 shows the DM decomposition of subsystem $S_1$ in the running example.

The figure represents the set of equations in the just determined part, ${S_1}^0$, the set of equations in the over-determined part, ${S_1}^{+}$, and the set of unknown variables in each equation.

The shared variables are shown as encircled variables in the figure. Without loss of generality, it is assumed that every fault parameter is included in exactly one equation, i.e., each fault f appears in one equation $e_f$. This is not a restricting assumption because if a fault is included in more than one equation, we can replace the fault signal by a new variable and add a new equation where the new variable is equal to the fault. Similar to the definitions of detectability and isolability for a structural model in, e.g., [20], local detectability and isolability can be defined as:

Definition 11.

(Locally detectable) A fault f∈$F_i$ is locally detectable in subsystem $S_i$ if $e_f$∈${S_i}^{+}$, where ${S_i}^{+}$ is the over-determined part of subsystem $S_i$.

Definition 12.

(Locally isolable) A fault $f_i$∈$F_i$ is locally isolable from fault $f_j$∈F if $e_{f_i}$∈${(S_i\backslash e_{f_j})}^{+}$, where ${(S_i\backslash e_{f_j})}^{+}$ is the over-determined part of subsystem $S_i$ without equation $e_{f_j}$.

Note that these definitions are equivalent to Definitions 8 and 10 since an MSO set is an over-determined equation set.

Consider Definition 11 and Figure 2. Fault $f_1$ is locally detectable because $e_1$∈${S_1}^{+}$, but $f_2$ is not locally detectable since $e_2\notin {S_1}^{+}$. To expand the over-determined part and make $f_2$ detectable, the diagnosis subsystem needs to include at least one additional equation. The extension to the original subsystem is defined as:

Definition 13.

(Augmented subsystem) Given subsystem $S_i$ and a set of equations, $E_k$, the augmented subsystem model $S_{i{E}_k}=\left(S_i\right|E_k)$ is ($V_{i{E}_k}$, $M_{i{E}_k}$, $E_{i{E}_k}$, $F_{i{E}_k}$), where $V_{i{E}_k}$ is the union of $V_i$ and the unknown variables that appear in $E_k$, $M_{i{E}_k}$ is the union of $M_i$ and the known variables that appear in $E_k$, $E_{i{E}_k}$ is the union of $E_i$ and $E_k$, and $F_{i{E}_k}$ is the union of $F_i$ and the possible faults associated with $E_k$.

Example 5.

Consider the running example. $S_{1e10}=\left(S_1\right|e_{10})$= ($V_{1e10}$, $M_{1e10}$, $E_{1e10}$, $F_{1e10}$), where $V_{1e10}=\{{\dot{p}}_1,p_1,p_2,q_{in1},q_1\}$, $E_{1e10}=\{e_1,e_2,e_3,e_4,e_5,e_6,e_{10}\}$, $M_{1e10}=\{u_1,y_1,y_2,y_3\}$, and $F_{1e10}=\{f_1,f_2\}$. Note that $e_{10}$ did not add any new unknown variables or faults to the subsystem model. Figure 3 represents the DM decomposition of the augmented subsystem, $S_{1e10}$. This figure shows that $e_2$∈${S_{1e10}}^{+}$, and therefore, $f_2$ is locally detectable for the augmented subsystem $S_{1e10}$.

Figure 4 shows DM decomposition of the $S_{1e10}\backslash e_1$. Equation $e_2$ is in the over-determined part of the augmented subsystem model; therefore, $f_2$ is locally isolable from $f_1$ in the augmented subsystem.

4.1. Problem Formulation

An equation-based solution approach is formulated for designing a distributed diagnoser. For the given set of subsystems $S_1,S_2,\dots S_n$, when there are faults that are not locally detectable or isolable in one or more subsystems, it is necessary to consider the following cases:

• $f_k\in F_i$ is not locally detectable.
• $f_l\in F_i$ and $f_m\in F_i$ are not locally isolable from each other.
• $f_n\in F_i$ is not locally isolable from $f_o\in F_j$ and $f_o\notin F_i$.

The last case represents a scenario where a subsystem fault is not locally isolable from a fault outside of the subsystem. This scenario can happen because a fault occurrence can have consequences beyond the original subsystem. Designing distributed diagnosers that account for these three scenarios is the focus in this section. After addressing each of these situations, we derive an integrated approach to distributed FDI and derive algorithms that apply to complex, dynamic systems made up of a number of subsystems.

For each subsystem, it might be necessary to augment the subsystem model with additional equations that are typically acquired from the neighbors of the subsystem, such that all of the faults associated with the augmented model are locally detectable and isolable. A set of equations is minimal if there is no subset of equations that provides the same detectability and isolability. More formally, the problem of designing a diagnoser for a particular subsystem $S_i$ can be described as follows.

Consider ${\mathcal{N}}_{Si}=\{S_1,S_2,\dots ,S_l\}\backslash S_i$ as the set of neighboring subsystems to subsystem $S_i$. To address the three situations mentioned above, an algorithm is to be developed to find a minimal equation set $E_o$ in ${\mathcal{N}}_{Si}$ that guarantees maximal structural detectability and isolability for subsystems faults $F_i$, i.e., that solves the optimization problem:

$$\begin{array}{cc}\hfill {\min }_{E_o\subseteq E_l}& |E_o|\hfill \\ \hfill \mathrm{s}.\mathrm{t}.& D\left(S_i\right|E_o)=D\left(S_i\right|E_l),\hfill \\ & I\left(S_i\right|E_o)=I\left(S_i\right|E_l),\hfill \end{array}$$

(11)

where $E_l$ represents the set of all the equations in ${\mathcal{N}}_{Si}$, D represents the set of detectable faults in $F_i$, and I represents the set of isolable faults in $F_i$ from the system faults F.

Example 6.

Consider the first subsystem of the running example $S_1$, $e_{10}$ makes $f_1$ and $f_2$ detectable and isolable from all the other faults in the system. Therefore, $A_1=\left\{e_{10}\right\}$ is a minimal solution to the problem.

In this section, we present a method to make all the faults in a subsystem locally detectable (Situation (1) above). We also discuss the solution to the fault isolability problem (Situation (2) above) and prove that if we address the first situation, the third situation is automatically taken care of.

4.2. Maximum Detectability

Example 7.

Consider subsystem $S_1$ in the four-tank example whose equations are listed in (1). The DM decomposition of this subsystem is shown in Figure 2. $f_2$ is in the just determined part of the subsystem; therefore, the fault is not locally detectable. However, $p_2$ is a shared variable with Subsystem 2. Therefore, an equation from subsystem ${}_2$ can be selected, $e_{10}$, to make $f_2$ locally detectable in the augmented subsystem, $S_{1e10}$ (see Figure 3). Adding measurement equation $e_{10}$ makes $p_2$ known and, therefore, makes the subsystem over-determined.

Note that a variable that only appears in one subsystem (for example ${\dot{p}}_1$ in $S_1$) cannot become known by adding equations from other subsystems. Therefore, our ability to increase fault diagnosability is limited to the shared variables in the subsystem. More formally, we can prove the following theorem.

Theorem 1.

Consider local subsystem model $S_i$=$\{V_i,$ $M_i,$ $E_i,$ $F_i\}$ and $V_{ishared}\subset V_i$ the set of shared variables in the subsystem. If a fault $f\in F_i$ is not locally detectable in a new subsystem $S_j$=$\{V_i-V_{ishared},$ $M_i\cup V_{ishared},$ $E_i,$ $F_i\}$ where all the shared variables are known, f is not globally detectable.

Proof. 

If $e_f$ remains in the just determined part or under determined part of the subsystem when all the shared variables have became known, there is no additional equation in the system that can make any of the variables in $e_f$ known. Therefore, the equation cannot be moved to the over-determined part of the structural decomposition. □

Therefore, the maximum detectability that can be achieved in each subsystem cannot be more than the detectability when all the shared variables are known. Using Theorem 1, we develop Algorithm 1 and Algorithm 2 to find an upper bound for the number of detectable faults and isolable fault pairs in each subsystem, respectively. Note that our algorithms do not require any information from the neighboring subsystems.

Algorithm 1 Detectable faults.

1: input:$V_{ishared}$ 2: input:$S_i$ = $\{V_i,$ $M_i,$ $E_i,$ $F_i\}$ 3: Let $DF$ be $\left\{\right\}$ 4: Let $S_{DF}$ be $\{V_i-V_{ishared},$ $M_i\cup V_{ishared},$ $E_i,$ $F_i\}$ 5: for each$f\in F_i$do 6:  if $f\in {\left(S_{DF}\right)}^{+}$ then 7:   $DF$ = $DF$∪$\left\{f\right\}$ 8: return$DF$

Algorithm 2 Isolable faults.

1: input:$V_{ishared}$ 2: input:$S_i$ = $\{V_i,$ $M_i,$ $E_i,$ $F_i\}$ 3: Let $IF$ be $\left\{\right\}$ 4: Let $S_{IF}$ be $\{V_i-V_{ishared},$ $M_i\cup V_{ishared},$ $E_i,$ $F_i\}$ 5: for each$f_j\in F_i$do 6:  for each $f_k\in F_i$ do 7:   if $f_i\in {(S_{IF}\backslash e{f}_k)}^{+}$ then 8:    $IF$ = $IF$∪$\{f_j,f_k\}$ 9: return$DF$

Adopting the following strategy, a minimal set of shared variables can be found that guarantees maximum detectability.

• We assume all the shared variables are known. If a fault is not locally detectable when all the shared variables are known, that fault is removed from the list of detectable faults (see Algorithm 1).
• Each shared variable is removed from the list of known variables to the unknown variables one at the time, to evaluate the list of detectable faults. If removing the shared variable from the known variables decreases the number of faults in the list of detectable faults, the shared variable is added back to the list of minimal required shared variables. Otherwise, the shared variable is not needed.

Algorithm 3 presents our method to find a minimal set of required shared variables. The algorithm is initialized with the subsystem model and the set of shared variables (for subsystem $S_1$, $p_2$ and $q_1$ are unknown shared variables), and this provides a minimal subset of shared variables that makes all the faults detectable in the subsystem. For Subsystem 1, $V_{1m}=\left\{p_2\right\}$ is a possible answer.

Algorithm 3 Minimal shared variables.

1: input:$S_i$ = $\{V_i,$ $M_i,$ $E_i,$ $F_i\}$ 2: Let $V_{ishared}$ be the set of shared variables in $S_i$ 3: $DF=$ Detectable-Faults($V_{ishared}$, $S_i$) 4: Let $V_{im}$ be $V_{ishared}$ 5: for each$v_{is}\in V_{im}$do 6:  Let $V_{im}$ be $V_{im}/v_{is}$ 7:  if Detectable-Faults($V_{im}$, $S_i$) not equal $DF$ then 8:   $V_{im}$ = $V_{im}$∪$\left\{v_{is}\right\}$ 9: return$V_{im}$

Note that all of the shared unknown variables may not be measured. However, in some cases, it is possible to transfer a set of equations from the neighboring subsystems that can be used with the equations in the subsystem to compute the unknown variables.

4.3. Equation-Based Fault Detection Approach

Given a minimal set of required shared variables, we present our proposed approach to find a minimal set of equations from the neighboring subsystems in order to achieve the maximum possible fault detectability. The procedure is illustrated by solving this problem for subsystem $S_2$, presented in Equation (2), of the running example, and then generalizing this approach by developing a general algorithm to solve this problem.

Example 8.

The corresponding structural decomposition of $S_2$ is shown in Figure 5.

Subsystem $S_2$ is just determined; therefore, none of the faults are locally detectable. However, $q_1$ and $p_2$ are shared variables with subsystem $S_1$, and $q_3$ and $p_3$ are shared variables with $S_3$. Algorithm 3 finds $V_{1m}=\{q_1,p_3\}$ as a minimal set of shared unknown variables, which if transferred from neighboring subsystems, can provide maximum detectability performance.Therefore, to make $f_3$ and $f_4$ locally detectable, the neighboring subsystems are explored to find equations that make the variables $q_1$ and $p_3$ known.

To find a minimal set of just determined equations that includes $q_1$, we start with all equations in $S_1$ that have $q_1$. These equations are $e_1$, $e_2$, and $e_6$, as is shown in Figure 6.

Then, for the additional variables in each equation that are not already in $S_2^0$, additional equations are included. For equation $e_1$, two additional equations are needed, one with $q_{in1}$ and the other one with $\dot{p_1}$. Finally, another equation is needed where $p_1$ is included. Since $p_2\in {S_2}^0$, the variable is not considered in this step.

To find the other minimal sets in the example, we keep adding the relative equations to the other sets using the same approach described above. As is shown in Figure 6, by sequentially adding equations to the system, we eventually achieve four sets of minimal constraints: $A_2=\{e_1,e_2,e_3,e_4\}$, $A_3=\{e_1,e_3,e_4,e_5\}$, $A_4=\{e_2,e_5\}$, and $A_5=\left\{e_6\right\}$. Figure 6 represents a matching algorithm. In the previous work in [28], a matching algorithm was introduced for finding a minimal set of equations for detecting each discrete mode change during the hybrid system’s operation. In this paper, a similar approach was applied to find a minimal set of equations from neighboring subsystems for computing each required shared variable as presented as Algorithm 4.

Algorithm 4 Count matchings.

1: input: current matching $\mathcal{M}$ 2: input: sets of determined variables $\mathcal{D}$ and undetermined variables $\mathcal{U}$, set of equations E 3: if$U=\varnothing$then 4:  return $\mathcal{M}$ as a feasible (minimal) matching. 5: for each$x\in \mathcal{U}$do 6:  for each $e\in E$, which can determine x do 7:   Let ${\mathcal{M}}^{\prime }$ be $\mathcal{M}\cup \{e\to x\}$ 8:   Let ${\mathcal{D}}^{\prime }$ be $\mathcal{D}\cup \left\{x\right\}$. 9:   Let ${\mathcal{U}}^{\prime }$ be $\mathcal{U}\backslash \left\{x\right\}$. 10:    Let $E^{\prime }$ be $E\backslash \left\{e\right\}$. 11:    Add all the undetermined variables of e to ${\mathcal{U}}^{\prime }$. 12:    Count-Matchings $({\mathcal{M}}^{\prime },{\mathcal{D}}^{\prime },{\mathcal{U}}^{\prime },E^{\prime })$

If we initialize the algorithm with the set of unknown variables (in Figure 6, $q_1$ is the unknown variable), this provides a set of complete matching of variables and equations in the neighboring subsystems that includes the unknown variables.

Example 9.

Figure 7 shows that augmenting $A_2$ with $S_2$ makes $f_3$ detectable. To make $f_4$ locally detectable as well, Algorithm 4 is used to find a minimal set of equations in the neighboring subsystems that includes $p_3$ and augment $S_2|A_2$ with those equations.

Subsystem $S_2$ is just determined, but a subsystem can have an under-determined part as well. For example, consider subsystem $S_3$ in Equation (2) where the DM decomposition is shown in Figure 8. Fault $f_5$ is in the under-determined part of the structure.

$q_{in2}$ and $q_3$ are in the just determined part of the system, and we can compute them using $e_{15}$ and $e_{16}$, respectively. However, to compute the other four variables in the subsystem, $p_3$, $q_2$, ${\dot{p}}_3$, and $p_4$, we only have three constraints, which makes complete matching between constraints and variables impossible. To make this part of the subsystem just determined, we need to augment a set of equations from the neighboring subsystems.

Unlike previous work [18] where an algorithm was developed for subsystems with under-determined parts, Algorithm 3 automatically takes care of this. Using Algorithm 3 gives $V_{m3}=\{q_2,q_3\}$ as a minimal set of required shared variables to make $f_5$ detectable. Having the set of required shared variables, Algorithm 4 gives $A_6=\{e_{11},e_{17},e_{18},e_{19}\}$ as a minimal sets of equations from neighboring subsystems can be used to augment $S_3$ to make $f_5$ locally detectable. Figure 9 shows the DM decomposition of $\left(S_3\right|A_6)$.

In some cases, it is possible that an augmented minimal set, $A_i$, also adds a set of faults $F_{A_i}$ to the subsystem model $S_i$. These faults can be sensor faults or faults in other equations. The following theorem states that these faults are locally detectable in subsystem model $S_i$.

Theorem 2.

Consider local subsystem model $S_i$=$\{V_i,$ $M_i$, $E_i,$ $F_i\}$ and $E_k$ a set of minimal equations that makes set of faults $F_i$ detectable in the augmented subsystem $\left(M_i\right|C_{augments})=\{V_j,C_j,F_j\}$, then the set of faults $F_j$ in the augmented subsystem $\left(S_i\right|E_k)$ is locally detectable.

Proof. 

The proof of this theorem is straight forward, since the minimal set makes a part of the system that includes the fault over-determined, and the set itself should be in the over-determined part as well. This means the associated faults in the set are detectable. □

For example, $f_6$ is locally detectable in $\left(S_3\right|A_6)$; see Figure 9. As long as fault detection is considered, the augmented faults do not cause any problem. The fault detection algorithm is summarized in Algorithm 5.

Algorithm 5 Detectability.

1: input: subsystem $S_i$ 2: input: subsystem model neighbors ${\mathcal{N}}_{Si}$ 3: $\mathcal{M}=\left\{\right\}$ 4: $V_d=$ set of determined variables in $S_i$ 5: if$\forall f\in F_i$ therefore $e_f\in {S_i}^{+}$ then 6:  return 7: $U=$ Minimal-Shared-Variables($S_i$) 8: $D=$$V_d$\U 9: $E_d=$ Count-Matchings ($\mathcal{M}$, D, U, ${\mathcal{N}}_{Si}$)

4.4. Equation-Based Fault Isolation Approach

In this subsection, it is assumed that the set of minimal equations to make all the faults locally detectable have been derived as described in the previous subsection. It is clear that the locally-detectable faults in each subsystem are locally isolable from the faults in the other subsystems not included in the augmented subsystem.

Theorem 3.

Consider local subsystem $S_i$=$\{V_i,$ $M_i,$ $E_i,$ $F_i\}$. If $f_i\in F_i$ is locally detectable in $S_i$, then $f_i$ is the locally-isolable form $f_j$ if $f_j\notin F_i$.

Proof. 

Since $f_i$ is detectable, we have $e_{f_i}\in {S_i}^{+}$, and since $f_j\notin F_i$, we can say $e_{f_j}\notin {S_i}^{+}$. Therefore, ${S_i}^{+}={(S_i\backslash e_{f_j})}^{+}$ and $e_{f_i}\in {(S_i\backslash e_{f_j})}^{+}$. □

Considering Theorem 3, it is straight forward to address the isolability problem. For each fault $f_i\in F_i$, we remove the associated equation $e_{f_i}$ from $E_i$ and all the neighboring subsystems. Then, we use Algorithm 5 to make all the remaining faults in $F_i$ detectable.

Example 10.

In $\left(S_3\right|A_6)$ in Figure 9, $f_5$ is isolable from $f_1,f_2,f_3,$ and $f_4$ because they are not in the augmented subsystem and $f_5$ is detectable in this augmented subsystem. To make $f_5$ isolable from $f_6$, we remove $e_{17}$ from $\left(S_3\right|A_6)$ and $S_4$. Applying Algorithm 5 to $S_4\backslash e_7$ gives $\left\{e_{20}\right\}$ as a minimal set that can make $f_5$ detectable.

The augmented subsystem $\left(S_3\right|A_6\cup \left\{e_{20}\right\})$ will detect $f_5$ and isolate it from all the other faults in the global system S. Algorithm 6 summarizes the method discussed above.

Algorithm 6 Diagnosability.

1: input: subsystem model $S_i$ 2: input: subsystem model neighbors ${\mathcal{N}}_{Si}$ 3: $E_d=$ Detectability($S_i$, ${\mathcal{N}}_{Si}$) 4: $S_i=$ ($S_i|E_d$) 5: for each$f\in S_i$do 6:  ${\overline{S}}_i=$ $S_i$\ (f and $e_f$) 7:  $E_d=$ Detectability(${\overline{S}}_i$, ${\mathcal{N}}_{Si}$) 8:  $S_i=$ ($S_i|E_d$)

Our proposed approach considers the first order neighboring subsystems of subsystem $S_i$ and augments minimal constraints from them to maximize diagnosability. If the set of first order neighboring subsystems does not have required redundancies to achieve maximum diagnosability, the search process continues to the next higher order of neighboring subsystems, as illustrated in Figure 10. The expansion process will stop when the distributed approach achieves maximum diagnosability, which in the worst case will result in a centralized diagnoser for the whole system. Thus, it is guaranteed that the method will find a distributed set of subsystem diagnosers that achieves the same diagnosability performance as the best centralized diagnoser for the same set of measurements. Algorithm 7 summarizes this approach.

Algorithm 7 Distributed diagnosis.

1: input: subsystem $S_i$ 2: input: subsystem model neighbors ${\mathcal{N}}_{Si}$ 3: Let $V_{ishared}$ be the set of shared variables in $S_i$ 4: $DF=$ Detectable-Faults($V_{ishared}$, $S_i$) 5: $IF=$ Isolable-Faults($V_{ishared}$, $S_i$) 6: $E_o=$ Diagnosability($S_i$, ${\mathcal{N}}_{Si}$) 7: if$D\left(S_i\right|E_o)=DF$ and $I\left(S_i\right|E_o)=IF$ then 8:  return 9: ${\mathcal{N}}_{Si}$ = ${\mathcal{N}}_{Si}$∪ (neighboring subsystems of ${\mathcal{N}}_{Si}$) 10: DistributedDiagnosis($S_i$, ${\mathcal{N}}_{Si}$)

The set of equations and measurements that each subsystem in the running example needs from its neighbors to achieve maximum possible detectability and isolability using the equation-based approach are presented in

Table 2. Set of augmented constraints and measurements for each subsystem model.

Subsystem	Augmented Equations	Augmented Measurements
$S_1$	$e_{10}$	$y_3$
$S_2$	$e_6$, $e_{12}$, $e_{14}$, $e_{15}$, $e_{16}$	$y_2$, $u_2$, $y_5$
$S_3$	$e_{11},$$e_{17}$, $e_{18}$, $e_{19}$, $e_{20}$	$y_4$, $y_6$
$S_4$	$e_{16}$	$y_5$

. Table 2 shows that all the subsystems of the water tank example share measurements with their first order connected subsystems. This is a practical advantage of this algorithm because usually, the subsystems with shared variables are physically closer to each other (corresponding to our definition of nearest neighbors).

Another advantage of this algorithm is that not only do we not need a global model for detecting and isolating the faults, but also, we do not use the global model in the design process of the supervisory system. This makes the approach suitable for large, complex systems, such as aircraft and power plants where the global systems models are likely to be unavailable or are unknown.

4.5. Computational Complexity

The time complexity of Algorithm 5 is mostly governed by Algorithm 4 (Count-Matchings) that has exponential complexity $O\left(\right|\mathcal{U}|\times |E_N|!)$, where $\left|\mathcal{U}\right|$ is the number of required unknown variables in the subsystem and $|E_N|$ is the number of equations in the neighboring subsystems. Algorithm 6 calls Algorithm 5 for every fault in the subsystem. Therefore, Algorithm 6 has $O\left(\right|F_i|\times |\mathcal{U}|\times |E_N|!)$ time complexity for subsystem $S_i$, where $|F_i|$ is the number of faults in the subsystem. Note that in the case that no globally-accurate diagnoser can be derived using neighboring subsystems, the solution gradually expands to include all subsystems. Therefore, the time complexity of our proposed method in Algorithm 7 for subsystem i is $O\left(\right|F_i|\times |\mathcal{U}|\times |E|!)$, where $\left|E\right|$ is total number of equations in the system.

In practice, Algorithm 4 finds the answer much faster. For example, consider Figure 6 where Algorithm 4 is searching for a set of equations to solve $q_1$. As soon as the algorithm reaches an equation that does not have the required unknown variable, the algorithm discards that equation and, therefore, avoids enumerating the rest of the candidate equations in that branch. To achieve even faster solutions, we can sort the equations by the number of their unknown variables before the search. In this way, the algorithm starts with equations with fewer unknown variables and, therefore, has to expand fewer branches on average.

The equation-based solution is exponential in terms of the number of equations in the system. The MSO-based solution is exponential in terms of the number of MSO sets in the system. The total number of MSO sets for fault detection and isolation grows exponentially as the number of measurements increase [29]. Consider Definition 1. The total number of redundancies introduced into the system model is equal to the number of measurements, $\left|M\right|$. Theoretically, each MSO set can include anything from one to $\left|M\right|$ measurements. Therefore, the total number of MSO sets, $N_{MSO}$, is proportional to all possible combinations of the measurements:

$$N_{MSO}\propto \sum _{i=1}^{\left|M\right|}\left(\genfrac{}{}{0pt}{}{\left|M\right|}{i}\right)=2^{\left|M\right|}$$

(12)

In general, there are many more MSO sets in a system than equations. For example, the running example in this paper has 20 equations, and the fault diagnosis toolbox generated 165 MSO sets for this system. Therefore, we expect the equation-based approach to solve the problem in a more efficient way, which is demonstrated next.

5. Case Study

The ADAPT-Lite system is designed to emulate the operation of generic spacecraft electrical power distribution systems [30]. The system has five subsystems: (1) the battery, (2) the Direct Current (DC) electric load, (3) the inverter, (4) the Alternating Current (AC) resistive electric load, and (5) the electric fan as a second inductive load for the AC system (see Figure 11). Seven measurements are made on the system: $y_{E240},$ $y_{E242},$ and $y_{E281}$ represent DC voltage measurements in the system; $y_{IT240}$ represents the battery current; $y_{E265}$ represents the inverter AC output voltage; $y_{IT267}$ is the inverter AC output current; and $y_{ST516}$ is the fan rotational speed. Six faults are considered in the system: $f_{E240}$ and $f_{E242}$ are sensor faults in $y_{E240}$, and $y_{E242}$, respectively; $f_{dc}$ represents a fault in the DC load; $f_{INV}$ models inverter faults; $f_{ac}$ represents a fault in the AC load; and $f_{fan}$ is a fan fault. The ADAPT-Lite system has several Circuit Breakers (CB236, CB262, CB266, and CB280), and relays (EY244, EY260, EY281, EY272, and EY275) and, therefore, operates as a hybrid system with multiple modes (configurations).

In previous work [28], we discussed structural diagnosis for hybrid systems. In this paper, we focus on distributed diagnosis. Therefore, we assume all the circuit breakers and relays are on and there is no mode change in the system. The set of equations in each subsystem is derived as follows.

Subsystem 1 (battery): The set of equations:

$$\begin{array}{cccccc}\hfill e_{a1}:{\dot{v}}_0& =\frac{1}{C_0}(-i_B)\hfill & \hfill e_{a5}:v_B& =v_0-v_s\hfill & \hfill e_{a9}:y_{E240}& =v_1+f_{E240}\hfill \\ \hfill e_{a2}:v_0& =\int \dot{v_0}dt\hfill & \hfill e_{a6}:v_1& =v_B\hfill & \hfill e_{a10}:y_{E242}& =v_2+f_{E242}\hfill \\ \hfill e_{a3}:{\dot{v}}_s& =\frac{1}{C_s}(i_B{R}_s-v_s)\hfill & \hfill e_{a7}:v_2& =v_1\hfill & \hfill e_{a11}:y_{IT240}& =i_B,\hfill \\ \hfill e_{a4}:v_s& =\int \dot{v_s}dt\hfill & \hfill e_{a8}:v_3& =v_2\hfill \end{array}$$

(13)

where $V_{a1}=\{{\dot{v}}_0,v_0,i_B,{\dot{v}}_s,v_s,v_B,v_1,v_2,v_3\}$ is the set of unknown variables in this subsystem, the set of measurements is $M_{a1}=\{y_{E240},y_{E242},y_{IT240}\}$, $F_{a1}=\{f_{E240},f_{E242}\}$ represents subsystem faults, and $C_0$, $C_s$ and $R_s$ are the component parameters in the subsystem. The battery is directly connected to the second subsystem (DC load).

Subsystem 2 (DC load): The DC load is modeled by an electric resistance, $R_{dc}$. The set of equations for this subsystem is:

$$\begin{array}{cccc}\hfill e_{a12}:v_3& =v_{dc}\hfill & \hfill e_{a14}:i_{dc}& =f_{dc}\frac{v_{dc}}{R_{dc}}\hfill \\ \hfill e_{a13}:i_B& =i_{dc}+i_{inv}\hfill & \hfill e_{a15}:y_{E281}& =v_{dc},\hfill \end{array}$$

(14)

where $V_{a2}=\{v_3,v_{dc},i_B,i_{dc},i_{inv}\}$ are unknown variables, $M_{a2}=\left\{y_{E281}\right\}$ are measurements, $F_{a2}=\left\{f_{dc}\right\}$ are faults, and $R_{dc}$ is a component parameter in the subsystem. Subsystems 1 and 2 are first order connected, and their shared variables are $V_{a1}\cap V_2=\{v_3,i_B\}$.

Subsystem 3 (inverter): The inverter converts DC power to AC. When there is no fault in the subsystem and the input voltage, $v_{in},$ is above 18 V, the output voltage, $v_{rms}$, stays at 120 V. $R_{inv}$ represents the internal resistance in the inverter, and e is the inverter efficiency coefficient. The set of equation for the subsystem is:

$$\begin{array}{cccc}\hfill e_{a16}:v_{in}& =v_{dc}\hfill & \hfill e_{a18}:i_{inv}& =\frac{v_{rms}.i_{rms}}{e.v_{in}}+\frac{v_{inv}}{R_{inv}}\hfill \\ \hfill e_{a17}:v_{rms}& =120.(v_{in}>18).f_{INV}\hfill & \hfill e_{a19}:y_{E265}& =v_{rms},\hfill \end{array}$$

(15)

where $V_{a3}=\{v_{in},v_{dc},v_{rms},i_{inv},i_{rms}\}$ are unknown variables, $M_{a3}=\left\{y_{E265}\right\}$ is a measurement, $F_{a3}=\left\{f_{INV}\right\}$ is a fault, and $\{e,R_{inv}\}$ are parameters of the subsystem. Subsystems 2 and 3 are first order connected, and their shared variables are $V_{a2}\cap V_{a3}=\{v_{dc},i_{inv}\}$. Subsystems 1 and 3 are second order connected because they have no shared variable, and they are both first order connected to the second subsystem.

Subsystem 4 (AC load): Like the DC load, the AC load is modeled as an electric resistance, $R_{ac}$. The set of equations for this subsystem is:

$$\begin{array}{cc}\hfill e_{a20}:v_4& =v_{rms}\hfill \\ \hfill e_{a21}:i_{ac}& =f_{ac}\frac{v_4}{R_{ac}}\hfill \\ \hfill e_{a22}:i_{rms}& =\frac{1}{\sqrt{2}}|\sqrt{2}{i}_{fan}(cos\varphi +jsin\varphi )+\sqrt{2}{i}_{ac}|\hfill \\ \hfill e_{a23}:y_{IT267}& =i_{rms},\hfill \end{array}$$

(16)

where $V_{a4}=\{v_4,v_{rms},i_{ac},i_{rms},i_{fan}\}$ are unknown variables, $M_{a4}=\left\{y_{IT267}\right\}$ is the measurement, $F_{a4}=\left\{f_{ac}\right\}$ is a fault, and $\{R_{ac},\varphi \}$ are parameters of the subsystem. Subsystems 3 and 4 are first order connected, and their shared variable is $V_{a3}\cap V_{a4}=\left\{v_{rms}\right\}$.

Subsystem 5 (electric fan): The fan rotational speed, $\omega$, is a function of the fan current, $i_{fan}$. The last subsystem equations are:

$$\begin{array}{cc}\hfill e_{a24}:i_{fan}& =f_{fan}\frac{v_4}{R_{fan}}\hfill \\ \hfill e_{a25}:\dot{\omega }& =\frac{1}{J_{fan}}(\frac{i_{fan}}{B_{fan}}-\omega )\hfill \\ \hfill e_{a26}:\omega & =\int \dot{\omega }dt\hfill \\ \hfill e_{a27}:y_{ST516}& =\omega ,\hfill \end{array}$$

(17)

where $V_{a5}=\{i_{fan},v_4,\dot{\omega },\omega ,i_{fan}\}$ are unknown variables, $M_{a5}=\left\{y_{ST516}\right\}$ is a measurement, and $F_{a5}=\left\{f_{fan}\right\}$ is a fault of the subsystem. Fan electrical resistance, $R_{fan}$, fan inertial, $J_{fan}$, and fan mechanical resistance, $B_{fan}$, are the parameters. Subsystems 4 and 5 are first order connected, and $V_{a4}\cap V_{a5}=\{i_{fan},v_4\}$ is the set of shared variables among these subsystems.

5.1. Distributed Diagnoser Using the MSO-Based Method

For the ADAPT system, there are 258 MSO sets. To find the minimal number of shared measurements, the global MSO set selection algorithm solves an optimization problem for each subsystem.

Table 3. Set of augmented measurements for each ADAPT subsystem using the global method.

Subsystem	Set of Augmented Measurements
Subsystem 1	-
Subsystem 2	$y_{IT267}$
Subsystem 3	$y_{E281}$
Subsystem 4	$y_{ST516}$
Subsystem 5	$y_{E265}$

shows the set of measurements that needs to be add for each of the subsystem diagnosers to achieve maximum possible detectability and isolability. In the first subsystem, all the faults are locally detectable and isolable, and therefore, this subsystem does not require any additional measurements from the other subsystems. For each of the other subsystems, we have to transfer exactly one measurement to achieve maximum diagnosability.

Table 4. Set of Minimal Structurally-Over-determined (MSO) sets for each local diagnoser using the MSO-based method.

Subsystem	Set of MSO Sets
1	$MS{O}_{a11}=\{e_{a7},e_{a9},e_{a10}\}$
	$MS{O}_{a12}=\{e_{a8},e_{a10},e_{a11},e_{a12},e_{a13},e_{a14},e_{a16},e_{a17},e_{a18},e_{a20},e_{a21},e_{a22},e_{a24}\}$
	$MS{O}_{a13}=\{e_{a7},e_{a8},e_{a9},e_{a11},e_{a12},e_{a13},e_{a14},,e_{a16},\dots$
	$e_{a17},e_{a18},e_{a20},e_{a21},e_{a22},e_{a24}\}$
2	$MS{O}_{a21}=\{e_{a1},e_{a2},e_{a3},e_{a4},e_{a5},e_{a6},e_{a7},e_{a8},e_{a12},e_{a13},e_{a14},e_{a15},e_{a16},\dots$
	$e_{a18},e_{a20},e_{a21},e_{a22},e_{a23},e_{a24}\}$
	$MS{O}_{a22}=\{e_{a1},e_{a2},e_{a3},e_{a4},e_{a5},e_{a6},e_{a7},e_{a8},e_{a12},e_{a13},e_{a14},e_{a15},e_{a16},\dots$
	$e_{a17},e_{a18},e_{a23}\}$
3	$MS{O}_{a31}=\{e_{a15},e_{a16},e_{a17},e_{a19}\}$
4	$MS{O}_{a41}=\{e_{a21},e_{a22},e_{a23},e_{a24},e_{a25},e_{a26},e_{a27}\}$
	$MS{O}_{a42}=\{e_{a1},e_{a2},e_{a3},e_{a4},e_{a5},e_{a6},e_{a7},e_{a8},e_{a12},e_{a13},e_{a14},e_{a16},\dots$
	$e_{a17},e_{a18},e_{a20},e_{a21},e_{a22},e_{a23},e_{a25},e_{a26},e_{a27}\}$
5	$MS{O}_{a51}=\{e_{a19},e_{a20},e_{a24},e_{a25},e_{a26},e_{a27}\}$

shows the set of MSO sets for each local diagnoser. Note that the global MSO sets’ selection method only minimizes the number of shared variables, but the subsystems may require equations from the other subsystems. For example, the first subsystem in ADAPT does not require any additional measurement to detect and isolate its faults locally; however, as we can see in Table 4, this subsystem requires several equations from the other subsystems to generate residuals.

The total time for finding all MSO sets and solving the optimization problems to find a set of MSO sets for each subsystem with minimum shared variables was 118 s, when the experiment was run on a desktop with an Intel Core i7-4790 3.60-GHz processor.

5.2. Distributed Diagnoser Using the Equation-Based Method

Instead of generating all the MSO sets and selecting a subset of MSO sets for each local diagnoser, Algorithm 7 is used.

The results are shown in

Table 5. Set of augmented equations and measurements for each subsystem model using the equation- based approach.

Subsystem	Augmented Equations	Augmented Measurements
Subsystem 1	-	-
Subsystem 2	$e_{a11}$, $e_{a16}$, $e_{a18}$, $e_{a19}$, $e_{a23}$	$y_{IT240},$$y_{E265},$$y_{IT267}$
Subsystem 3	$e_{a15}$	$y_{E281}$
Subsystem 4	$e_{a19},$$e_{a25}$, $e_{a26}$, $e_{a27}$	$y_{E265},$$y_{ST516}$
Subsystem 5	$e_{a19},$$e_{a20}$	$y_{E265}$

, summarizing the set of equations to augment each subsystem to achieve maximum possible detectability and isolability. In some cases, the first order neighboring subsystems were not enough to detect and isolate all the faults, and the algorithm had to extend to include higher order neighbors. For example, for Subsystem 2, the algorithm cannot find any solution when it considered the first order neighbors (Subsystem 1 and Subsystem 3). Therefore, it extended the search to a second order neighboring subsystem (Subsystem 4).

Table 5 also represents the set of additional measurements that we need to transfer to each ADAPT subsystem. As mentioned earlier, the equation-based algorithm does not guarantee globally-minimum communication. For example, Subsystem 2 required three measurements from other subsystems (see Table 5). However, Table 3 shows that complete diagnosability was achievable by adding only one additional measurement. To detect and isolate faults in each subsystem, the augmented subsystem equations were used to generate MOS sets.

Table 6. Set of MSO sets for each local diagnoser using the equation-based approach.

Subsystem	Set of MSO Sets
1	$MS{O}_{b11}=\{e_{a7},e_{a9},e_{a10}\}$
	$MS{O}_{b12}=\{e_{a1},e_{a2},e_{a3},e_{a4},e_{a5},e_{a6},e_{a9},e_{a11}\}$
	$MS{O}_{b13}=\{e_{a1},e_{a2},e_{a3},e_{a4},e_{a5},e_{a6},e_{a7},,e_{a10},e_{a11}\}$
2	$MS{O}_{b21}=\{e_{a11},e_{a13},e_{a14},e_{a15},e_{a16},e_{a18},e_{a19},e_{a23}\}$
3	$MS{O}_{b31}=\{e_{a15},e_{a16},e_{a17},e_{a18},e_{a19}\}$
4	$MS{O}_{b41}=\{e_{a19},e_{a20},e_{a21},e_{a22},e_{a23},e_{a25}$, $e_{a26}$, $e_{a27}\}$
5	$MS{O}_{b51}=\{e_{a19},e_{a20},e_{a24},e_{a25},e_{a26},e_{a27}\}$

shows the set of MSO sets for each local diagnoser using the equation-based method. The experiment was run on the same desktop where total execution time was $0.32s$. This demonstrates the computational advantage of this method.

5.3. Designing the Diagnosers

After the augmented subsystem models have been selected, computational tools, for example the fault diagnosis toolbox [22], can be used to generate the set of residuals to be used for each subsystem. For example, the fault diagnosis toolbox generates the following residual from $MS{O}_{a11}$.

$$\begin{array}{c}\hfill r_{a11}=y_{E240}-y_{E242}.\end{array}$$

(18)

Each residual is sensitive to a set of faults, and the set of residuals for each subsystem can detect all the globally-detectable faults and isolate all the globally-isolable faults in the subsystem. For example, $r_{a11}$ in (18) is sensitive to $f_{E240}$ and $f_{E242}$ and, therefore, can be used to detect these faults. In realistic situations, sensor noise and model uncertainties can have a negative impact on each diagnoser’s performance. For example, consider the case where each sensor in the ADAPT-Lite system has an additive noise with a normal distribution, $N\left(\mathrm{0.0.1}\right)$. Figure 12 shows that because of noise, residual $r_{a11}$ is not zero even when there is no fault in the system.

This can impact fault diagnosis performance negatively by increasing false positive rates. Moreover, noise can hide the effect of faults on the residuals and lead to high false negative rates. Figure 13 shows residual $r_{a11}$ when an additive fault $f_{E240}=$ 0.25 occurs at $t=$ 20 h. Sensor noise conceals the fault signal and makes fault detection and isolation more challenging.

To achieve acceptable performance in practice, it is necessary to design a set of hypothesis tests, such as the Z-test [31], to distinguish faults from noise and uncertainty and determine what residual outputs are significant enough to reject the normal operation assumption and trigger the alarms. Figure 14 shows that a simple hypothesis test can achieve a zero false positive rate and detect $f_{E240}$ in less than 5 min using residual $r_{a11}$.

5.4. Discussion

The two proposed algorithms for designing distributed diagnosis systems provide a solution with maximum possible detectability and isolability that can be achieved for a system given a set of measurements. Unlike previous work, such as [14,15], our proposed methods were based on system models expressed as equations and, therefore, did not need to use the temporal response and event ordering in the diagnosis, all of which are derived properties and, therefore, require additional computation. Using a purely structural approach reduced the overall diagnosability of the system for the given set of measurements. However, it also reduced the number of assumptions we needed to make about the fault characteristics, such as the order of events in the diagnoses subsystems (which can be error-prone), and we did not have to analyze in detail the subsystem dynamics.

The total number of MSO sets was exponential in terms of the system measurements, and the MSO set selection was equivalent to the set covering problem. Therefore, the MSO-based algorithm had high computational cost especially for large-scale systems. The algorithm guaranteed that the subsystems shared a minimum number of measurements between the subsystems, implying that we minimized the communication of measurement streams across subsystems of the global system. This is important because sending data between subsystems is costly in large-scale systems. Moreover, it is straight forward to extend the MSO-based approach to robust distributed diagnosis by considering residuals’ robustness performance in the selection process [32,33].

The equation-based algorithm found a minimal set of equations from neighboring subsystems that guaranteed the maximum possible detectability and isolability that can be achieved for the system given a set of measurements. The number of equations was significantly smaller than the number of MSO sets. Therefore, the second algorithm was computationally more efficient. Moreover, the second algorithm did not need to use the global model in the design process of the supervisory system. This makes the algorithm very feasible for large-scale complex systems. However, it did not guarantee that the number of shared variables among the subsystems was globally minimum.

6. Conclusions

Two algorithms are proposed for designing distributed diagnosers where the number of sensor data shared between different local diagnosers is minimized. The first method generates the MSO sets for the given global system and selects a subset for each subsystem with minimum required shared variables. Having all the MSO sets computed in advance makes robustness analysis possible for robust distributed MSO set selection. The second algorithm used a heuristic equation-based approach, which is computationally more efficient and makes it suitable for large-scale systems. The ADAPT system case study was used to compare the two algorithms and illustrate the advantages of each method. In future work, we will consider noise and uncertainty in the design step and will extend the distributed diagnosis design problem to robust distributed fault detection and isolation using different methods for decoupling noise and uncertainties.