This section describes the results of applying this MAC scheme to an HRA in simulation. A 10 × 10 HRA is used as an example, as this is a non-trivial size system comprising a relatively large number of elements and as such the effect of faults is of a realistic dimension. The MAC approach is compared to passive fault tolerant control methods in order to determine if the addition of active FTC is beneficial.
4.1 System description
The 10 × 10 PS HRA is structured as shown in Fig. 4, with ten branches of ten parallel elements arranged serially. The actuation elements currently being used within the project are SMAC electromagnetic actuators, which have been configured to form a lab-scale concept demonstrator HRA system. The modelling of these actuators was considered in , and will not be detailed here. A simplified two state element model is used in this example, making the overall system 20th order. This model is included in the Appendix.
The position of the load is set as the control objective, and some transient requirements are defined for the system, suitable to the system’s technology with good stability margins (Table 1). In this case, the system load is six times the mass of the inter-element masses and it is assumed that this system is designed for an application with travel requirements that need at least 6 of the 10 parallel branches to be operational.
As the PS assembly is naturally tolerant to loose faults in terms of travel control, they will not be considered here. However, element lock-ups immobilise the parallel branches, and thus will be considered. Theoretically, a 10 × 10 system of this dimensioning may incur up to 40 lock-up faults and still be capable of meeting its travel requirement. However, in a worst-case scenario, where single lock-ups occur in different branches, four lock-ups will bring the travel capability to critical point. The actual location of these faults, provided they are located in by separate branches, has very little effect on the resultant fault behaviour. Thus, from 1 to 4 faults are injected into the simulation in a worst-case manner (in separate branches), as described in Table 2.
4.1.1 Control scheme
Fig. 7 portrays both the passive and MAC control schemes. The passive scheme has cascaded classical controllers designed to meet the control objectives in nominal conditions. These control laws are included in the Appendix. The inner loops contain a phase advance compensator controlling the local position of each parallel branch of elements. This spreads the travel between the elements equally. An outer loop controller is then included to control the overall travel of the HRA’s load. Proportional-integral (PI) control is used in the outer loop to achieve the steady state requirements.
This passive control scheme is used as the base for the MAC approach. Under nominal conditions, the MA controlled system is identical to the passively controlled system. However, four more sets of inner-loop control laws are designed based on the four fault modes of the system, where six to nine out of ten parallel branches of elements are active.
Thus, on detection of a fault, this is communicated to the agents with healthy elements and their inner-loop phase advance controller parameters are changed according to a look-up table of pre-computed control laws (included in the appendix). The feed-forward gain in the agent’s control module is also changed to redistribute the travel demand of the system, i.e., if the system is nominal and one element locks then the gain would be changed from 1/10 to 1/9, as there are nine active parallel element branches remaining. This keeps the gain in the system constant.
The outer-loop controller is not reconfigured as this would compromise the localisation of fault detection and reconfiguration decision, producing a potential single point of failure.
4.1.2 Simulation of fault cases
Fig. 8 displays the response of the passively controlled and MAC 10 × 10 HRA under nominal and faulty conditions (Table 2), when a step change of 0.05 m in the reference was applied at t = 0. All faults were introduced at the beginning of the simulation. Table 3 gives the stability margins and transient characteristics of these responses.
In the passive control case, the simulations show that, as faults occur, the increasing load slows the response. Nevertheless, the passive control case shows some tolerance to faults, as the steady-state criteria is met under each fault condition due to the integral action of the outer loop control. However, the rise and settling time requirements are not met when two or more faults are present in the system.
In contrast, the MAC case produces fault responses that are very similar to the nominal case. The requirements are met under each fault condition.
4.2 Reconfiguration delays
The MAC results given in the previous section assumed that faults were detected and communicated instantaneously throughout the agency. As acknowledged in Section 3, this is not a realistic assumption. The effect of reconfiguration delays T
must be considered in the simulation if the results are to resemble reality. Fig. 9 shows the transient responses of the idealised MAC 10 × 10 HRA and one that includes these reconfiguration delays. The fault detection, communication and control reconfiguration are all simulated using state flow, which introduces delays into the system.
A square-wave input is applied to the system and all faults injected at t = 0. The response shows that in the first half period of the input, delay effects are present in the more realistic MAC scheme. However, after all faults are detected, communicated, and control reconfigured, the system’s behaviour returns to that of the ideal MAC case.
Fig. 10 shows the initial response in more detail. Total reconfiguration of the system was attained after 0.35 s. This delay increases the settling time and overshoot of the response in the first half period. The overshoot limit is exceeded in FC1, FC2 and FC3. If this limit is critical, then the agent’s control reconfiguration could be adjusted to slow down reconfiguration, or reduce control gains until the fault state is stable. The effects of delays would also be lessened if the faults did not occur simultaneously, which is likely to be the case in a real situation.
These simulations show that in this case, moderate detection, communication and reconfiguration delays in the MACHRA have a limited influence on the performance of the system during reconfiguration, which is likely to be acceptable in application.
4.3 Fault detection errors in MACHRA
The benefit of using MAC witnessed in the examples is attained at the cost of a dependency on fault detection. As the HRA is an intended solution for high integrity applications, it is necessary to consider what would happen if this fault detection failed.
As mentioned previously, fault detection errors in active FTC systems can be problematic. If the system adapts to a change that has not actually occurred in the system, then the results could degrade performance, cause faults or induce instability. Equally, if the system’s control relies upon faults being detected and a fault is not detected, then the results could be similar. Fault detection errors in this particular system will be considered here.
4.3.1 Undetected faults
Undetected faults should not cause stability problems in this case. At worst, the system’s response will be that of the passive case, i.e., the system will become slower, but stability will be maintained.
4.3.2 False detection of faults
False detection in this MACHRA approach will result in gain and inner control law changes, which could lead to instability. Table 4 gives the overshoot, gain and phase margins in the case of 1–4 false lock-up detections. This is a high number of false detections, and one would not expect a well-designed fault detection scheme to perform so badly. However, it is worthwhile considering such worst-case scenarios.
When false detections are made, the phase margin decreases, but the system remains stable. The overshoot and settling time, however, rise significantly.
As proposed in Section 3, the flexibility of MAC can handle this problem through further reconfiguration. On triggering of the FDM, the input reference of the agent is fixed to the local position at time of detection. The controller within the agent is replaced with the PI compensator given in the appendix. Given sufficient gain is achievable (which is the case within the physical limits of this system), then the subsystem is forced to behave as the detected fault case.
The simulation results of this approach are shown in Table 5. Subsequently, the phase margin is not eroded and the overshoot and settling time limit achieved. This approach will have no effect if the fault detected is actually present.