A Qualitative Event-based Approach to Multiple Fault Diagnosis in Continuous Systems using Structural Model Decomposition

Transcription

1 A Qualitative Event-based Aroach to Multile Fault Diagnosis in Continuous Systems using Structural Model Decomosition Matthew J. Daigle a,,, Anibal Bregon b,, Xenofon Koutsoukos c, Gautam Biswas c, Belarmino Pulido b, a NASA Ames Research Center, Moffett Field, CA, 945, USA b Deartamento de Informática, Universidad de Valladolid, Valladolid, 47, Sain c Institute for Software Integrated Systems, Deartment of Electrical Engineering and Comuter Science, Vanderbilt University, Nashville, TN, 75, USA Abstract Multile fault diagnosis is a difficult roblem for dynamic systems, and, as a result, most multile fault diagnosis aroaches are restricted to static systems, and most dynamic system diagnosis aroaches make the single fault assumtion. Within the framework of consistency-based diagnosis, the challenge is to generate conflicts from dynamic signals. For multile faults, this becomes difficult due to the ossibility of fault masking and different relative times of fault occurrence, resulting in many different ways that any given combination of faults can manifest in the observations. In order to address these challenges, we develo a novel multile fault diagnosis framework for continuous dynamic systems. We construct a qualitative event-based framework, in which discrete qualitative symbols are generated from residual signals. Within this framework, we formulate an online diagnosis aroach and establish definitions of multile fault diagnosability. Residual generators are constructed based on structural model decomosition, which, as we demonstrate, has the effect of reducing the imact of fault masking by decouling faults from residuals, thus imroving diagnosability and fault isolation erformance. Through simulation-based multile fault diagnosis exeriments, we demonstrate and validate the concets develoed here, using a multi-tank system as a case study. Keywords: fault diagnosis, model-based diagnosis, multile faults, diagnosability, structural model decomosition, discrete-event systems. Introduction Safety-critical systems require quick and robust fault diagnosis mechanisms to imrove erformance, safety, and reliability, and enable timely and raid intervention in resonse to adverse conditions so that catastrohic situations can be avoided. However, comlex systems can fail in many different ways, and the likelihood of multile faults occurring increases in harsh oerating environments. Diagnosis methodologies that do not take into account multile faults may generate incorrect diagnoses or even fail to find a diagnosis when multile faults occur. Multile fault diagnosis in static systems has been addressed reviously [ ], where the inherent comlexity of the roblem has been well-demonstrated; the diagnosis sace becomes exonential in the number of faults, and this comlicates the diagnosis task. Furthermore, in dynamic systems, the roblem is even more challenging, as the effects Corresonding author. addresses: matthew.j.daigle@nasa.gov (Matthew J. Daigle), anibal@infor.uva.es (Anibal Bregon), xenofon.koutsoukos@vanderbilt.edu (Xenofon Koutsoukos), gautam.biswas@vanderbilt.edu (Gautam Biswas), belar@infor.uva.es (Belarmino Pulido) M. Daigle s work has been artially suorted by the NASA System-wide Safety and Assurance Technologies (SSAT) roject. A. Bregon and B. Pulido s work has been suorted by the Sanish MINECO grant DPI-4544-R. The authors acknowledge the 8th IFAC Symosium on Fault Detection, Suervision and Safety of Technical Processes (SAFEPROCESS ), August 9-,, Mexico City, Mexico, for recommending the symosium version of this aer for ublication in the IFAC Journal on Engineering Alications of Artificial Intelligence. Prerint submitted to Elsevier Aril, 6

2 of multile faults may mask one another, thus making it difficult to differentiate between multile fault diagnoses [4 6]. Due to fault masking, multile faults can roduce a variety of different observations, and this adds uncertainty, which, in turn, reduces the discriminatory ability of the diagnosis algorithms. Moreover, the more faults considered, the more ossible ways in which their effects can interleave, making it less likely that the fault diagnoses can be uniquely isolated given a set of observations. Due to its comlexity, multile fault diagnosis of dynamic systems has not been sufficiently addressed in the literature. In [7], changes are modeled by a set of qualitative simulation states. Later, [8] integrated the modelbased diagnosis aroach in [] and the qualitative reasoning aroach in [7], to multile fault diagnosis for dynamic systems using behavioral modes with a riori robabilities. In a related aroach, semi-quantitative simulation is used [4], changing the configuration of the model every time a fault aears. However, in these kinds of aroaches, the qualitative modeling framework quantizes the state sace and secifies qualitative relations between the quantized states, which can result in a large number of states, i.e., such aroaches can suffer from the state exlosion roblem. In control theory-based diagnosis aroaches (known as fault detection and isolation, or FDI aroaches), the roosal in [9] is based on the analysis of residual structures. In [5], the authors integrate residual-based and consistencybased aroaches that can automatically handle multile faults in dynamic systems. However, these aroaches use only binary signatures (effect or no effect), and so it becomes very difficult to distinguish between different otential multile faults. In contrast, our revious work in multile fault diagnosis for continuous systems [6, ], is based on a qualitative fault isolation (QFI) framework []. It describes how multile faults manifest in the system measurements and rovides algorithms for fault isolation. By using qualitative information defined with resect to a nominal reference, the state exlosion of qualitative simulation aroaches is avoided. Unlike other FDI aroaches, diagnostic information is enhanced using qualitative symbols, instead of binary effect/no effect information, and by including the sequence of observations. The QFI aroach was based on using residuals (the difference between observed and exected system behavior) comuted from a global system model. Since faults affect all residuals that have a causal ath from the fault to the residual, fault masking can have a significant, adverse imact on multile fault diagnosability when the number of residuals affected by a fault is large. To avoid this roblem, in [], we exlored the idea of using structural model decomosition to imrove diagnosability, by deriving local submodels that decoule faults from residuals, so that each fault affects only a small set of residuals [9, ]. This decreases the ossibility of masking, and, as such, leads to imrovements in multile fault diagnosability. In this aer, we extend the revious work in event-based QFI of single faults [4] to develo an online multile fault diagnosis aroach for dynamic systems that takes advantage of structural model decomosition. In this framework, diagnostic observations take the form of symbolic traces reresenting sequences of qualitative effects on the residuals. First, we develo a systematic aroach for redicting the ossible traces that can be roduced by multile faults, based on a secific comosition of those roduced by the constituent faults. Second, we develo an online fault isolation algorithm that mas observed traces to the set of minimal diagnoses that could have roduced that trace. Third, we introduce definitions of diagnosability to characterize the otential fault isolation erformance for different residual sets, and show how structural model decomosition can significantly imrove diagnosability in the multilefault case. Fourth, using a multi-tank system as a case study, and over a comrehensive set of simulation-based exeriments, we rovide offline diagnosability results and online multile fault isolation results to (i) demonstrate and validate the overall aroach, (ii) illustrate the imrovement in erformance obtained through the use of structural model decomosition, and (iii) show the erformance imrovement over aroaches that use binary fault signatures without temoral information. The multi-tank system is also used as a running examle throughout the aer. The aer is organized as follows. Section resents our modeling background and formulates the multile fault diagnosis roblem. Section overviews the structural model decomosition aroach, and develos the qualitative fault isolation methodology for multile faults, which redicts the ossible traces that can be roduced by a set of faults. Section 4 resents the online multile fault isolation aroach, which determines the set of faults that can roduce an observed trace. Section 5 formalizes our definitions of distinguishability and diagnosability in order to characterize the fault isolation erformance of a system using our aroach. Section 6 resents the results for the case study. Section 7 describes related work in multile fault diagnosis. Section 8 concludes the aer.

3 . Problem Formulation In this work, we consider the roblem of multile fault diagnosis in continuous systems. We first overview our system modeling aroach, followed by a definition of the multile fault diagnosis roblem... System Modeling In our framework, a model is defined as a set of variables and a set of constraints among the variables []: Definition (Constraint). A constraint c is a tule (ε c, V c ), where ε c is an equation involving variables V c. Definition (Model). A model M is a tule M = (V, C), where V is a set of variables, and C is a set of constraints among variables in V. V consists of five disjoint sets, namely, the set of state variables, X; the set of arameters, Θ; the set of inuts, U; the set of oututs, Y; and the set of auxiliary variables, A. The set of outut variables, Y, corresonds to the (measured) sensor signals. Parameters, Θ, include exlicit model arameters that are used in the model constraints. Auxiliary variables, A, are additional variables that are algebraically related to the state, arameter, and inut variables, and are used to reduce the structural comlexity of the equations. The set of inut or exogenous variables, U, is assumed to be known. In this aer, we use a multi-tank system as a case study. The system consists of n tanks connected serially, as shown in Fig.. For each tank i, where i [,,..., n], u i denotes the inut flow, m i denotes the liquid mass, i denotes the tank ressure, q i denotes the mass flow out of the drain ie, K i denotes the tank caacitance, and Re i denotes the drain ie resistance. For adjacent tanks i and i +, q i,i+ denotes the mass flow from tank i to tank i + through the connecting ie, and Re i,i+ is the connecting ie resistance. The constraints for tank i are as follows: ṁ i = u i + q i,i q i q i,i+, m i = t t i = K i m i, ṁ i dt, q i = i, Re i q i,i = ( i i ), Re i,i q i,i+ = Re i,i+ ( i i+ ). For tank, q, =, and for tank n, q n,n+ =. The comlete set of ossible measurements in the system corresonding to i, q i, and q i,i+ are i, q i, and q i,i+, described by the following constraints: i = i, q i = q i, q i,i+ = q i,i+. Here, the suerscrit is used to denote a measured value of a hysical variable, e.g., i is ressure and i is the measured ressure. 4 As a running examle to exlain and illustrate the concets throughout the aer, we use a standard three-tank system in which, unless otherwise secified, the ressures are measured. 4 Since i is used to comute other variables, it cannot belong to Y and a searation of the variables is required.

4 u u i- u i u i+ u n Re, Re i-,i- Re i-,i Re i,i+ Re i+,i+ Re n-,n K... K i- K i K i+... K n Re Re i- Re i Re i+ Re n Figure : Tank system schematic. Examle. For the three-tank system, the model M is reresented by the variable sets X = {m, m, m }, Θ = {K, K, K, Re, Re, Re, Re,, Re, }, U = {u, u, u }, Y = {,, }, and A = {ṁ, ṁ, ṁ,,,, q, q, q }; and the set of constraints C = {c, c,..., c 7 }, which are given as follows: ṁ = u q q,, (c ) ṁ = u + q, q q,, (c ) ṁ = u + q, q, (c ) m = m = m = t t ṁ dt, (c 4 ) t t ṁ dt, (c 5 ) t t ṁ dt, (c 6 ) = K m, (c 7 ) = K m, (c 8 ) = K m, (c 9 ) q =, Re (c ) q =, Re (c ) q =, Re (c ) q, = ( ), Re, (c ) q, = ( ), Re, (c 4 ) =, (c 5 ) =, (c 6 ) =. (c 7 ) In our context, a fault is the cause of an unexected, ersistent deviation of the system behavior from the accetable nominal behavior. Secifically, in our framework, we link faults to the set of arameters Θ in M. More formally, a fault is defined as follows. Definition (Fault). A fault, denoted as f, is a ersistent deviation of exactly one arameter θ Θ of the system model M from its nominal value. 4

5 Figure : Lattice reresentation of the candidate sace. A fault is named by the associated arameter and its direction of change, i.e., θ + (res., θ ) denotes a fault defined as an increase (res., decrease) in the value of arameter θ. In general, we use F to denote a set of faults. Examle. In the three-tank system, the comlete fault set is F = {K, K+, K, K+, K, K+, Re, Re+, Re,, Re+,, Re, Re+, Re,, Re+,, Re, Re+ }... Problem Definition Fault isolation roceeds as a cycle of observation and hyothesis generation. In multile fault diagnosis, a diagnostic hyothesis, or diagnosis, for short, is defined as a set of faults that is consistent with the observations. Definition 4 (Diagnosis). For a given fault set F, a diagnosis d F is a set of faults that is consistent with a sequence of observations λ. Intuitively, a diagnosis reresents a single otential exlanation for observed faulty behavior. Examle. The diagnosis {K, R+ } (in shorthand, we write K R+ ) means that K and R+ together roduce symtoms that are consistent with the observations. A set of diagnoses is denoted as D. For a set of single faults F, there are F unique diagnoses (including the emty set), i.e., F single faults, ( ) ( F double faults, F ) trile faults, and so on. Clearly, the sace of diagnoses is exonential in the number of faults. It can be reresented using a lattice structure []; Fig. shows the lattice structure for a system where F = { f, f, f, f 4 }. In dynamic systems, fault masking can manifest when the effects of one fault dominate the effects of another fault, so that effects of the second fault are not directly observed. As a result, the following roerty holds. Lemma. For d, d F, if d is a diagnosis and d d, then d is a diagnosis. Lemma also holds in static diagnosis, e.g., as in []. As observations are made, we eliminate certain diagnoses and form a cut across the lattice, dislayed as a bold line in the figure, such that everything below the cut has been eliminated, while everything above the cut is a diagnosis. From this roerty, the concet of a minimal diagnosis manifests. 5 Definition 5 (Minimal Diagnosis). A diagnosis d is minimal if there is no diagnosis d where d d. By Lemma, we can reresent the comlete set of diagnoses concisely by the set of minimal diagnoses. Therefore, we need only to generate minimal diagnoses because all diagnoses can be generated from the minimal diagnosis set. From the diagnosis sace, we can define two sets, the minimal diagnosis set, and the maximal diagnosis set. 5 In [5], a diagnosis is by definition minimal. Here, to be more general, we define a diagnosis to be any consistent set of faults, and exlicitly define the notion of a minimal diagnosis. 5

6 Figure : Comutational architecture for multile fault diagnosis based on structural model decomosition. Definition 6 (Minimal Diagnosis Set). The minimal diagnosis set D is the set of minimal diagnoses. Definition 7 (Maximal Diagnosis Set). The maximal diagnosis set D + is the set of all diagnoses. In Fig., the minimal diagnosis set consists of the candidates indicated in bold. The maximal diagnosis set consists of all the minimal diagnoses and all ossible suersets of the minimal diagnoses, i.e., all candidates above the line. Formally, we can generate D + from D by adding to D all diagnoses d which are a strict suerset of any d D. From a ractical standoint, maintaining only the set of minimal diagnoses is more efficient; further, the robability of some set of faults d occurring is always higher than some d d occurring if we assume that faults are indeendent, so the minimal diagnoses are also more likely. Further ractical considerations may also warrant an assumtion on the size of diagnoses to consider. Assumtion (Fault Cardinality). At most l faults occur together in the system. This assumtion does not limit the generality of our aroach, since we can always set l to F. However, in ractice, usually l is set to or, with the imlication being that the robability of any set of faults of size greater than l occurring is negligible. This can also result in a reduction of comutational comlexity, because it limits the ortion of the diagnosis sace that needs to be exlored. The multile fault diagnosis roblem then becomes the following. Problem (Multile Fault Diagnosis). Given a system model, M, with a set of faults, F, and a cardinality limit l, the multile fault diagnosis roblem is to find the subset of the minimal diagnosis set D of candidates with cardinality l for a given sequence of observations, λ. Our roosal for solving this roblem is described rimarily in Sections and 4, and the comutational architecture is summarized in Fig.. Given a system model, we define a set of residuals based on structural model decomosition (Section.). The system roduces oututs y(t) given inuts u(t), which get organized into local inuts and oututs for the submodels, i.e., u i (t) and y i (t) for model i, which comutes residuals r i (t) (Section.). A symbol generation algorithm [6] comutes from these residuals observed qualitative effects, σ i. We then develo a method to systematically determine what the sequences of observed qualitative effects of a set of faults will be on these residuals (Section.). Based on this, for online diagnosis, the fault isolation algorithm matches the observed sequence to the minimal diagnosis set that could have roduced it, excluding fault sets with cardinality above the limit (Section 4). Like classical diagnosis aroaches [, 5], our aroach is model-based, and so can be alied to any system modeled as a set of ordinary differential equations.. Qualitative Fault Isolation Framework We adot an event-based qualitative fault isolation framework, extending the single-fault framework resented in [4]. In this section, we describe the methodology that determines the ossible observations that can be roduced by a set of faults that occur. In this diagnosis aradigm, we generate discrete observations based on the analysis of residuals. Definition 8 (Residual). A residual, r y, is a time-varying signal comuted as the difference between an outut, y Y, and a redicted value of the outut y, denoted as ŷ. 6

7 In order to generate a residual, we require a dynamic model to generate redicted values for each y. If the model is correct, then when a fault occurs, it will roduce significant, observable differences between y and ŷ. Our fault isolation framework is based on an analysis of these differences, rooted in transient analysis []. We aly signal rocessing algorithms to transform these differences into sequences of qualitative observations from which to erform diagnostic reasoning [6]. In the following subsections, we first describe how to comute residuals using the concet of structural model decomosition. We then describe the form that observations and observation sequences take in our aroach. Following that, we describe how we determine the observation sequences that multile faults can roduce... Structural Model Decomosition In order to comute a residual r y for an outut y, we must comute a redicted value of the outut, ŷ. To do this, we require a notion of comutational causality for a model. A causal assignment secifies the comutational causality for a constraint c, by defining which v V c is the deendent variable in equation ε c. Definition 9 (Causal Assignment). A causal assignment α to a constraint c = (ε c, V c ) is a tule α = (c, v out c ), where v out c V c is assigned as the deendent variable in ε c. We write a causal assignment of a constraint using its equation in a causal form, with := to exlicitly denote the causal (i.e., comutational) direction. To comute the variables of a model, we require each constraint to have a causal assignment, and that the set of causal assignments is consistent, i.e., (i) inut and arameter variables cannot be the deendent variables in the causal assignment, (ii) an outut variable cannot be used as the indeendent variable, and (iii) every variable, which is not an inut or arameter, is comuted by only one (causal) constraint. An algorithm for finding a consistent causal assignment to a model is given in [7]. Examle 4. For the three-tank system, the constraints given in Examle are written such that the causal assignment should be made where the = sign is relaced by :=, i.e., the variable on the left-hand side is the indeendent variable in each of the constraints. We can use the global model of the system with a consistent set of causal assignments to comute residuals. Given the inuts, the set of causal constraints can be used to comute redictions of the oututs and form ŷ for each member of Y. As an alternative, we can instead, through structural model decomosition, define a set of local submodels, each with its own set of local oututs Y i Y. The advantage of this aroach is that each local residual resonds only to the subset of the faults included in that submodel, in contrast to a global model residual that will otentially be sensitive to all faults. The decouling roerty of the local submodel residuals translates to fewer oortunities for faults to mask each other, and we will see later how that translates to imroved diagnosability and fault isolation erformance. Different structural model decomosition methods have been roosed to decomose a system model into minimal over-determined submodels that are sufficient for fault diagnosis [, 8 ]. In this work, we will use the decomosition framework roosed in []. In [], a model decomosition algorithm is rovided that, given a model M, a set of consistent causal assignments, a set of otential local inut variables, and a set of desired outut variables, finds a minimal submodel that comutes the desired oututs using only the rovided inuts. In this context, a submodel can be defined as follows. Definition (Submodel). A submodel M i of a model M = (V, C) is a tule M i = (V i, C i ), where V i V and C i C. For the uroses of residual generation, we want to find submodels that comute some y, i.e., this is the submodel outut. For inuts, we can use the global model inuts U, and also measured values from the sensors, so variables in Y (excluding the outut variable for the submodel). By using measured values of sensors as inuts, we require only a subset of the model constraints in order to comute any given variable. The model decomosition algorithm is straightforward; it starts at the desired outut variables and roagates backwards through the causal constraints, modifying causal assignments when a otential inut variable can be used. Additional details on this aroach and the structural model decomosition algorithms can be found in []. Examle 5. Using this aroach on the three-tank system for the outut set Y = {,, }, we find the set of submodels (one for each measured variable) given in Table. For examle, the second submodel comutes using the measured values of,, and u. Because and are rovided as inuts, can be comuted with m as the only state variable, and only the subset of constraints involving the second tank. 7

8 Table : Submodels for the global model, M, of the three-tank system with Y = {,, }. States (X i ) Parameters (Θ i ) Inuts (U i ) Oututs (Y i ) Causal Assignments (A i ) m K, Re, Re,, u := :=m /K m := t ṁ t dt ṁ := q q, + u q := /Re q, :=( )/Re, := m K, Re,, Re, Re,,, u := :=m /K m := t ṁ t dt ṁ :=q, q q, + u q, :=( )/Re, q, :=( )/Re, := q := /Re := m K, Re,, Re, u := :=m /K m := t ṁ t dt ṁ :=q, q + u q, :=( )/Re, q := /Re :=.. Residual Analysis In this section, we describe how we analyze residual signals and transform them into a discrete set of qualitative observations uon which to erform diagnostic reasoning. Ideally, in the nominal situation, residual signals are zero, hence, any deviation from zero indicates a fault. Because reasoning over the continuous residual signals is difficult and comutationally demanding, we abstract a residual into a symbolic form (see Fig. ). Observations are roduced once a deviation in a residual is detected. The transient in the residual signal at this time is abstracted using qualitative +, -, and values in the signal magnitude and sloe. Consequently, the interretation for these qualitative values for the signal magnitude is: a means the observation is within the nominal thresholds, i.e., T < r y < T for threshold T; a + means the observation y is above the redicted outut ŷ lus the threshold T, i.e., r y > T; and a - means the observation is below the redicted outut minus the threshold, i.e., r y < T. For the sloe, the interretation is the same, with r relaced by ṙ, and with a different threshold value secific to the sloe. The threshold T can be comuted using robust statistical techniques, and, in general, may change over time [6]. 6 So, in our context, an observation is defined as follows. Definition (Observation). An observation for a residual r, denoted σ r, is a air of symbols s s reresenting qualitative changes in magnitude and sloe of r, resectively. 6 In theory, higher-order changes can also be used as diagnostic information. In ractice, however, it is difficult to reliably extract higher-order changes from a signal, and so we do not tyically use that information for diagnosis []. 8

9 As residuals deviate due to faults, we obtain an observation sequence. Definition (Observation Sequence). For a set of residuals R, an observation sequence, denoted λ R, is a sequence of observations σ r σ r... σ rn, where n R, and r r... r n. In this work, only the first deviation of a residual is meaningful, hence the requirement that an observation sequence for a set of residuals contains at most one observation for each residual... Event-based Fault Modeling The goal of qualitative fault isolation is to determine which diagnoses can roduce a given observation sequence. The basis of this aroach is the fault signature. Definition (Fault Signature). A fault signature for a fault f and residual r, denoted by σ f,r, is a air of symbols s s reresenting otential qualitative changes in magnitude and sloe of r caused by f at the oint of the occurrence of f. The set of fault signatures for f and r is denoted as Σ f,r. The comlete set of ossible fault signatures for a residual that we consider here is {+, +, +,, +, }. A fault signature on residual r y for outut y is written as r s s y, e.g., r +. For an initial observation σ r, we must find all f for which σ f,r = σ r. As more observations are obtained, the roblem becomes more comlex, because we are then concerned with sequences of fault signatures. The sequence of fault signatures roduced by a fault is constrained by the system dynamics, and these constraints are catured using the concet of relative residual orderings []. They are based on the intuition that the effects of a fault will manifest in some arts of the system (i.e., some residuals) before others. For a given model (or submodel), the relative ordering of the residual deviations can be comuted based on analysis of the transfer functions from faults to residuals, as roven in []. Definition 4 (Relative Residual Ordering). A relative residual ordering for a fault f and residuals r i and r j, is a tule (r i, r j ), denoted by r i f r j, reresenting that f always manifests in r i before r j. The set of all residual orderings for f in R is denoted as Ω f,r. Note that in this definition, we are referring secifically to deviations in the residuals caused by faults. In this aer, to make the aroach as general as ossible, we assume that fault signatures and relative residual orderings are given as inuts. In ractice, this information can be generated by manual analysis of the system model, by simulation, or automatically from certain tyes of models, e.g., as resented in [, ]. Examle 6. Table shows the redicted fault signatures and residual orderings for the global model of a three-tank system with F = {K, K, K, Re+, Re+, Re+, Re+,, Re+, }, Y = {,, }, and R = {r, r, r }. For examle, consider K. An abrut decrease in K would cause an abrut increase in (see c 7 ), and thus, an abrut increase in (see c 5 ). The increase in would also cause an increase in the flow to the second tank, through which the integration manifests as a first-order increase in and (resulting in r+ ). Similarly the increase in causes a second-order increase in and (resulting in r+ ). The first-order increase in also causes a second-order decrease in and (resulting in r+ ). Because of the integrations, the abrut change in r is observed first, followed by the change in r and then r, resulting in the residual orderings r r, r r, and r r. Examle 7. Table shows the redicted fault signatures and residual orderings for the minimal submodels of a threetank system with F = {K, K, K, Re+, Re+, Re+, Re+,, Re+, }, Y = {,, }, and R = {r, r, r }. Because some faults aear only in a subset of the submodels (see Table ), some residuals do not resond to some faults. For examle, K will cause a deviation only in r. Because any two residuals in this residual set are comuted indeendently (i.e., from a different submodel), we cannot derive any residual orderings among these two residuals. The only orderings we can define are for those in which, for a given fault, it causes a resonse in one residual but no resonse in another. For a set of faults, given otential fault signatures and residual orderings, we can describe what otential sequences of fault signatures may be roduced by any combination of faults. Such a sequence is termed a fault trace. 9

10 Table : Fault Signatures and Relative Residual Orderings for the Global Model, M, of the Three-tank System. Fault r r r Relative Residual Orderings K r r, r r, r r K r r, r r K r r, r r, r r Re r r, r r, r r Re +, r r Re r r, r r Re +, r r Re r r, r r, r r Table : Fault Signatures and Relative Residual Orderings for the Minimal Submodels of the Three-tank System. Fault r r r Residual Orderings K +- r r, r r K +- r r, r r K +- r r, r r Re + + r r, r r Re +, + - r r, r r Re + + r r, r r Re +, + - r r, r r Re + + r r, r r Definition 5 (Fault Trace). A fault trace for a set of faults F over residuals R, denoted by λ F,R, is a sequence of fault signatures that can be observed given the occurrence of the faults. We grou the set of all fault traces into a fault language. Definition 6 (Fault Language). The fault language for a set of faults F with residual set R, denoted by L F,R, is the set of all fault traces for F over the residuals in R. For diagnosis, we are given some observation sequence λ R, and we must find all F such that there is some λ F,R L F,R where λ F,R = λ R. So, we must determine the fault languages for every otential set of faults u to the fault cardinality limit l. Constructing the fault language for single faults is straightforward. For fault f, given the set of ossible fault signatures Σ f,r for each r R, and the set of relative residual orderings Ω f,r, we can construct the fault language as the set of all traces of length R, that includes, for every r R that will deviate due to f, a fault signature σ f,r, such that the sequence of fault signatures satisfies Ω f,r. One way to comute this is through synchronization of the signatures and orderings [4]. Examle 8. Given R = {r, r, r } from the global model, for fault K, from Table we see that the fault effects will aear first on r, and then it is unknown whether r or r will deviate next. Hence, there are two ossible fault traces: r + r + r + and r + r + r +. On the other hand, for Re +, there is only one ossible fault trace, r+ r + r + Examle 9. Given R = {r, r, r } from the local submodels, for fault K, from Table we see that the fault effects will aear first on r, and then, since the fault is not included in the other submodels (see Table ), no other residuals will deviate. Thus, we have the orderings r r and r r. So, there is only one ossible fault trace in L K,R, r +. On the other hand, for Re +,, there are two residuals that will deviate, r and r, as the fault aears in both of the corresonding submodels. There are then two ossible fault traces in L Re +,,R, r + r and r r +. For multile faults, however, an observation sequence will consist of some fault signatures from one fault, and some fault signatures from another fault. Each fault manifests in its own way (i.e., its own single-fault trace). When.

11 r (sig) r + at. 4 5 r (sig) r + at r (sig) r + at Figure 4: Observations for the fault Re + K+, with K doubling at s and Re doubling at.5 s, resulting in r + r + r +. r (sig) r + at. 4 5 r (sig) r at r (sig) r + at Figure 5: Observations for the fault Re + K+, with K doubling at s and Re triling at.5 s, resulting in r + r + r. they occur together, the trace associated to the multile-fault will be some merging of the traces of the constituent faults. How the individual faults come together to roduce a single observed trace deends on the relative fault magnitudes and the relative times of occurrence. At the extreme, one fault in the fault set can either be (i) much larger than all the other faults, or (ii) occur earlier than all the other faults, such that the observed trace may be consistent with only that one fault occurring by itself. That is, it may comletely mask all other faults. In the other extreme, we could observe a fault trace where each observed constituent signature is being roduced by a different fault. Examle. For examle, consider the fault Re + K+, with R = {r, r, r }. The fault language for Re+ consists of the single trace r + r + r +, and the fault language for K + consists of the single trace r + r r. When these two faults occur together, we must see some kind of comosition of these two traces. The actual trace observed will deend on relative fault magnitudes and fault occurrence times. Fig. 4 shows one scenario, with K doubling at s and Re doubling at.5 s. First, we observe r + from K +, followed by r+ from Re +. We can see that r begins to decrease (from K + ) but before crossing the threshold increases due to Re+, and is observed as r+. If K + is larger, as in Fig. 5, then the decrease in r may be larger and get detected instead, resulting in an observation of r instead. If Re + instead occurs first, as in Fig. 6, we may see r + before r +. To begin to formalize this concet, we first address the question of what the combined observed effect of two faults is on a single residual. There are three cases to consider. Either (i) no fault affects that residual, in which case no observation will be made for that residual; (ii) exactly one fault affects that residual, in which case the observed signature must be the same as for that fault occurring by itself; or (iii) both faults affect that residual, in which case

12 r (sig) r + at r (sig) r + at r (sig) r + at. 4 5 Figure 6: Observations for the fault Re + K+, with Re doubling at.5 s and K doubling at.5 s, resulting in r + r + r +. the observed signature must be some combination of the redicted signatures for the two faults. The third case can manifest in one of two ways: (i) one fault comletely masks the other, either by occurring early enough or having a large enough magnitude, in which case that fault s signature is observed on the residual, or (ii) one fault does not mask the other, in which case we observe some combination of the individual signatures. Regarding this final case, we make the following assumtion. Assumtion (Signature Combination). For residual r, if f i roduces σ fi,r and f j roduces σ f j,r, where σ fi,r σ f j,r, then when f i and f j both occur either σ fi,r or σ f j,r will be observed. That is, we assume that we must observe a comlete fault signature (both magnitude and sloe) for one of the faults; we cannot observe some combination of their fault signatures (magnitude from one and sloe from the other) or some other novel signature not redicted by either fault by itself. 7 Embedded in this assumtion also is that the effects from either fault cannot erfectly cancel, i.e., that eventually the effect from one fault will dominate and be observed. Also embedded in this assumtion is that the given fault signatures are valid at all oerating oints of the system, i.e., that f i will roduce only signatures in Σ fi,r i does not change given that some f j has occurred. Given Assumtion, we can obtain the following lemma, which summarizes all the cases mentioned above. Lemma. Given two faults, f i and f j, and some residual r, an observation σ r when the faults both occur must belong to Σ fi,r Σ f j,r. Further, we can claim the following. Lemma. Given residuals R and faults f i and f j, Ω { fi, f j },R = Ω fi,r Ω f j,r. That is, the residual orderings for a multile fault are given by the intersection of the individual orderings. If two faults would alone roduce conflicting orderings, then when they occur together we cannot make any statement about which residual will deviate first. If two faults would alone roduce the same ordering, then when occurring together we must observe the same ordering. This is derived from the main theorem behind residual orderings [, ]. Not only must the comosed traces be consistent with the intersection of the orderings, but the actual signatures observed must be consistent, as stated in the following. Lemma 4. If r i f r j Ω f,r, then some σ f,r j Σ f,r j cannot be observed until some signature is observed on r i. 7 In some ractical circumstances, this assumtion may not hold. It can be easily droed if we consider magnitude and sloe effects on a residual as two distinct observations, rather than a single observation, where we have the additional temoral constraint in observation sequences that the magnitude effect for some residual must be observed before its sloe effect. When considering these as two searate observations then the framework we resent here is still valid, however tackling that more general case is beyond the scoe of this aer.

13 Algorithm L i j ComoseTraces(λ i,r, λ j,r ) : L {ɛ} : L i j : while L > do 4: λ o(l) 5: λ i λλ i,r R λ 6: λ j λλ j,r R λ 7: 8: if λ i = λ and λ j = λ then L i j L i j {λ} 9: end if : if λ i λ then : L L {λ i } : end if : if λ j λ then 4: L L {λ j } 5: end if 6: end while For examle, if we have r f r and r f r, we cannot observe some σ f,r followed by some σ f,r. Residual orderings for f require that r must deviate before we see the effect from f on r. In other words, what this lemma says is that if we get some trace resulting from some f i f j and we roject out any observations that were not the result of f i, then the resulting trace λ fi must belong to L fi,r λ fi, where for some trace λ, R λ denotes the set of residuals included in the signatures of λ. Together, these lemmas establish how to define a comosition oeration for traces,. First, though, we require the definition of a refix of a trace. Definition 7 (Prefix). A trace λ i is a refix of trace λ j, denoted by λ i λ j, if there is some (ossibly emty) sequence of events λ k that can extend λ i s.t. λ i λ k = λ j. Definition 8 (Trace Comosition). A trace λ fi f j,r = σ σ,..., σ n is a comosition of traces λ fi,r and λ f j,r, i.e., λ fi f j,r λ fi,r λ f j,r, if for every σ i λ fi f j,r, σ i λ fi,r R σ,...,σ i or σ i λ f j,r R σ,...,σ i. Essentially, this means that if we want to construct a comosition of two traces, the signatures in the new trace must come from either of the two original traces (Lemma ), and the residual orderings must be resected (Lemmas and 4). This follows from the lemmas above. Note that λ fi,r λ fi,r λ f j,r and λ f j,r λ fi,r λ f j,r. The algorithm to find all comositions of two traces λ i,r and λ j,r is given as Algorithm. We have a working set of traces L and a set of comleted traces L i j. Initially, we start with the emty trace ɛ. We then try to extend it with the first signature of λ i,r and λ j,r, where for a trace λ, λ i refers to the ith signature. These get added to L. We continue examining traces in L. A trace λ in L is relaced with an extension via λ i,r Rλ and/or λ j,r Rλ. The extended trace is laced back into L. If the trace was not extended, this means that the trace is comlete and goes in the set of comleted traces L i j. Examle. As an examle, consider the fault Re + K+. A fault trace for Re+ is r+, and a fault trace for K + is r + r r. Obviously, when both faults occur together, either r + or r + will have to be observed first. In Algorithm, lines 5 and 6 create these initial traces and they are added to L. Then, deending on relative magnitudes and fault occurrence times, if r + is observed first (from Re + ) we will see either r+ (from Re + ) or r + (from K + ). If instead r + is observed first (from K + ), we will next see either r (from K + ) or r+ (from Re + ). This will be followed by an observation on the last residual (one consistent with either of the faults). The comosition of the individual fault traces is then {r + r + r +, r + r + r +, r + r + r, r + r + r +, r + r r, r + r r +, r + r + r, r + r + r + }. r + r + Using this algorithm, we can construct traces for faults of any size. A trace λ F,R for F = { f, f,..., f n } is a fault trace if λ F,R λ f,r λ f,r... λ fn,r. That is, multile-fault traces are constructed as comositions of the traces of the constituent faults. Note that every fault trace for every f F will also be a fault trace for F. To construct the fault

14 Algorithm L i j,r ComoseLanguages(L i,r, L j,r ) : L i j,r : for all λ i,r L i,r do : for all λ j,r L j,r do 4: L i j,r L i j,r ComoseTraces(λ i,r, λ j,r ) 5: end for 6: end for language, we need simly to find all comositions of the fault traces for the constituent faults. This can be done in a constructive manner, where we first find the comositions for f and f in F, then comosing those traces with the fault traces for f, and so on. Comosing two languages can be accomlished through Algorithm. For every air of traces in the two languages, ComoseTraces is called to obtain all comositions of those two traces, and these are added to the comosed language. To obtain the fault language for F = { f, f,..., f n }, we first comose L f,r with L f,r to obtain L f f,r, then comose that with L f,r to obtain L f f f,r, and so on. Examle. As an examle, consider the fault set Re + K+. Since each fault contains only the single trace in its language, the set of comosed traces for this fault set, as comuted in Examle, is also the fault language for Re + K+. The observed traces in Figs. 4 6 can be found within this language. Examle. Consider now the fault Re + K+, but with the submodel-based residual set. The fault language for Re+ contains only r + and the fault language for K + contains only r +. Therefore, the fault language is simly {r + r +, r + }. r + A single-fault language grows as O( R!), because in the worst case all ossible interleavings of the residuals can occur. One benefit of using structural model decomosition is that each fault, on average, affects a smaller number of residuals. In fact, as the number of tanks grows, the number of residuals a fault affects in this case is at most, comared to n for the global model residuals. Therefore, the fault languages are much smaller when using structural model decomosition; they contain smaller traces and fewer traces, comared to those based on the global model residuals. So, on average, the comutational comlexity reduces significantly when structural model decomosition is used. Given all the fault languages, fault isolation is, in theory, a trivial roblem; we can simly search all the fault languages and a fault set F is a diagnosis if its language contains the observation sequence. However, it should be clear now that a fault language can be quite large. Not only does the size of a fault language grow exonentially with the number of residuals, but the number of languages to consider is, in general (i.e., without the fault cardinality limit l), exonential too, since there is an exonential number of diagnoses. Therefore, the naive aroach to multile fault diagnosis, in which we generate all fault languages and search them online, is not feasible in ractice. An online aroach, in which diagnoses are found incrementally as observations are received, is resented in the next section. 4. Multile Fault Diagnosis In Section, the roblem addressed was, given a set of faults, to find all the otential traces it can roduce, i.e., find the fault language. In this section, we consider the inverse roblem, which is, given an observed trace, determine which fault sets are consistent with an observed trace, i.e., which are diagnoses. In this framework, we follow the aroach of consistency-based diagnosis [, 5]. In this aroach, fault isolation is based on conflicts, which are related to a set of correctness assumtions for the model that are not consistent with current observations from the system. In [5], a conflict is defined as a set of comonents for which all of them being nonfaulty is inconsistent with the model and the observations. Generalizing, we can say that a conflict is a set of correctness assumtions (e.g., a fault has not occurred) that cannot all be true, given the model and the observations. 8 8 For the comonent-based, static diagnosis roblems in [, 5], the correctness assumtions directly take the form AB(c) (meaning comonent c is not faulty) or OK(c) (meaning comonent c is nominal). Here, since faults are not directly associated with comonents, but rather with model arameters, the correctness assumtions directly take the form of f, i.e, that a fault has not occurred. 4

15 For examle, a conflict of assumtions a, a, a means that a a a, i.e., either a or a or a are not true. In this work, our correctness assumtions are that the arameter values in Θ are nominal, e.g., a means that f has not occurred, so a conflict is equivalent to a set of single faults that can exlain an observation, i.e., a a a is f f f. So, a conflict is a set of faults, e.g., { f, f, f }, any one of which is consistent with a given observation. In order to derive a conflict for a given observation, we must answer the question, which faults can roduce the observation? In our framework, an observation is the deviation of some residual, i.e., a fault signature. The singlefault languages describe which signatures a single fault can roduce, and in what sequence relative to other signatures. So, if a given fault signature is observed, we can check which fault can roduce that signature, and since orderings must still be resected, it must be roduced as the first signature in some fault trace, ignoring signatures for residuals that have already deviated (Lemma 4). Secifically, a conflict in our framework is defined as follows. Definition 9 (Conflict). Given a set of otential faults F, a set of residuals R, an observation sequence λ, and a new observation σ, a conflict C is a set of faults C F, where for each f C, there is some λ L f,r Rλ such that σ λ. That is, given an observation sequence, for a fault to be able to exlain a new observation, and be included in the conflict, it must be able to roduce that observation as the first observation in some trace of its reduced fault language. The fault language must be reduced to the residual set R R λ, because it could be that the residuals for which we have observed signatures in λ were roduced by other faults. Examle 4. Consider the global model residual set R = {r, r, r } and the fault set {K, K, K, Re+, Re+,, Re +, Re+,, Re+ }. Say the first observation is r+. Then, the conflict is {K }, as that is the only fault that may roduce that articular signature (see Table ). Say the next observation is r +. Now, the conflict for that observation is {K, Re+, Re+, Re+, }, as these are the only faults that could roduce this observation given that r has already deviated. Note that K and Re+ are not included, as they require that r would have already deviated to be included in the conflict. The diagnosis rocess roceeds incrementally, as new observations are made []. The initial diagnosis set is. After the first observation, we obtain a conflict, and this simly becomes the new diagnosis set. After the next observation, we have a new conflict, and the new minimal diagnosis set is comuted from the revious minimal diagnosis set and the conflict. Diagnosis roceeds in this way. The incremental multile fault isolation rocedure is given as Algorithm. The algorithm is given as inuts the revious diagnosis D i, the revious observation sequence λ i, the new observation σ i+, and the candidate cardinality limit l. First, the conflict C is generated according to Defn. 9. Then, for each current diagnosis, we extend it once for each fault in the conflict to create an initial new diagnosis set D. This may roduce diagnoses that are not minimal, i.e., for some d D there may be some d D for which d d, in which case d can be removed from D. Also, using the candidate cardinality limit l, we want to remove any diagnoses that are greater than the limit. This runing ste is done to roduce the new diagnosis D i+. This method, without the fault size limit, roduces equivalent results to the runed hitting set tree aroach roosed in [5]. Although we emloy a fault cardinality limit of l, we are actually limited in what we can distinguish by the number of residuals, R. When a new observation is received, each diagnosis d in the diagnosis set is either consistent with that new observation, in which case it remains in the minimal diagonosis set, or it is inconsistent, in which case some new fault must be added to the diagnosis. In the latter case, for each fault in f (C d) we create a new diagnosis d { f }. Each new diagnosis is created by extending with only one fault, since we want the minimal diagnoses only. Thus, if we can only have at most R observations, the size of any diagnosis that is generated cannot exceed R. Examle 5. Consider again the fault and residual sets in Examle 4, with l =. Say that we observe first r +, then the conflict is {K } and the initial diagnosis set is also {K }. Next we observe r, so the conflict is {Re +, }, as this is the only fault that can roduce this observation. Then, the new diagnosis set is {K Re+, }, i.e, we know that both faults must have occurred. Next we observe r, then the conflict is {Re +,, Re+, }, and so the new diagnosis set remains {K Re+, }. Note that we generate the candidate K Re+, Re+,, however it is not minimal and is covered by the other candidate, and so not included in the minimal diagnosis set. That is, we are unsure as to whether the r observation came from Re +,, which we already know must have occurred, or Re+, for which we are unsure that it has occurred. In fact, it is less likely that the trile fault occurred rather than the double fault. 5