Formal Development of a Feedback Control System with Fault. Department of Automatic Control, Abstract

Transcription

1 Formal Development of a Feedback Control System with Fault Accomodation æ Gao Jianping y, Chen Zongji z Department of Automatic Control, Beijing University of Aeronautics and Astronautics, Beijing, , China. Abstract Control systems are vulenrable to faults in control loops where faults may cause abrupt and damaging responses. These systems with fault accomondation are becoming more and more important while appearing in æight control, robots control and nuclear reactor control etc, and call for more rigorous development approach. A formal approach is explored in this paper, based on Extended Duration Calculus, for the development of such kind of systems. A typical example of control system with fault accomondation, a two-level control system is used for illustrating our approach. Its high level consists of an event-driven supervisor which reacts to the change of plant due to faults occurance, and its low level consists of normal controller, reconægured controller and other components with FDIFault Detection and Isolation mechanism. Firstly performance speciæcations and system speciæcation of the case are formulated in EDC; then they are reæned stepwisely into speciæcations of the supervisor and the low level components. Finally the whole system performance is veriæed in EDC framework. Keywords: Control systems, Fault accomondation, EDC, Reænement,FDI, Formal veriæcation. 1 Introduction Control systems are vulenrable to faults in control loops where faults may cause abrupt and damaging responses.these systems with fault accomondation are becoming more and more important while appearing in æight control, robots control and nuclear reactor control etc, and call for much rigorous development approach. A structure of this kind of system can be æ The work is sponsored by UNUIIST y gjp@ns.dept3.buaa.edu.cn z zjchen@cs.sebuaa.ac.cn 41

2 42 Duration Calculus Workshop, ESSLLI'98 seen in Fig.1. - Supervisor? Normal Reconægured FDI control control?- - Plant 6 6 ç Output Figure 1 A System with Fault Accomodation The problem of developing such systems is that, for a given plant, a working environment and a requirement, How to design normal controller, reconægured controller, and FDI mechanism such that the requirement will be satiæed. Special concerns will focus on timing contraints during phase transitions, where in each phase the system obeys to a diæerential equation. Formal mathematical reasoning checking that a design conforms to the requirement has been proved to be important in the development of such system. In the paper, We will present a systematic formal developing procedure as follows, 1. Speciæcation of System To specify the system with plant model, controller model, FDI mechanism and associated environment formally, and then derive some useful associated properties. 2. Requirements Speciæcation To formalize required speciæcations of the system. 3. Overall Speciæcation Design To give an overall speciæcation of supervisor, controllers and FDI, such that the requirements for the resulting controlled system can be satisæed. 4. Design by Reænement To decompose the overall controller into several components and to reæne the speciæcation of the controllers into the speciæcations of its decomposed components so that at last they can be implemented by programs, and the original requirements are still guaranteed. This kind system can also be considered as a hybrid system with interacting time evolving continuous partlike plant and discrete event driven componentslike supervisor which catch much more attentions these years. In the paper we use DC as a tool for formal development. DC is an extended temporal or interval logic which can be used to specify and reason about real-time and logic constraint in dynamical systems without explicit mention of time instant. where EDC has the facility to express properties with a mixture of continuous and discrete states. we use DC to derive some

3 Formal Development of a Feedback Control System with Fault Accomodation 43 conditions on certain parameters such that entire system will satisfy the given requirement in Duration Calculus. We will organize the paper as follows, ærst in section 2, we will give basic formalism in Extended Duration Calculus Then in section 3, the model of the case and the descriptions of its environment are formulated in EDC. In section 4 we will give the formulation of requirements and in section 4 and 5 we design the control system with fault accommodation by reæning the overall speciæcation to component speciæcations, according to which we ænally get detailed design of the components. At last we give the conclusions. 2 Basic Formalism of EDC The DC is an extension of real arithmetic and interval temporal logic, where formulae are interpreted over bounded closed intervals. Below we just give brief introduction to the notations used in this paper. The reader can refer to ë5ë for more details. Let P be a Boolean function of time, i.e. a state, representing some aspect of the system. We use 0; 1 for the states which are everywhere zero and one, respectively. Furthermore, states can be combined by the Boolean connectives :; ^; _;::: to form new states. The symbols b:f and e:f, which denote the beginning and the end value of real function f in an interval respectively, are as deæned in ë5ë. Furthermore, the special symbol ` is a term denoting the length of the interval, i.e. `ëb; eë def = e, b Formulae are constructed from such terms and real arithmetic. Below we shall deæne the following formulae: The formula D 1 ; D 2 is satisæed by aninterval if it can be chopped into two subintervals such that the ærst part satisæes D 1 and the second one satisæes D 2. 2D means formula D holds for all subintervals. dp e means that the interval is not a point interval and P holds everywhere inside the interval. demeans that the interval is a point interval and dp e 0 means the interval is a point interval and P holds at that point. The modalities: ëfor some subinterval D" and ëfor all subintervals D" can be deæned respectively by 3D def = true; D; true 2D def = :3:D The left convergence induction rule : Rd e RX ` RX _ X; dp e_x; d:p e Rtrue The right convergence induction rule : Rd e RX ` RX _dp e; X _d:p e; X Rtrue

4 44 Duration Calculus Workshop, ESSLLI'98 3 System Description We take a example in self-repairing æight control system and give a simpliæed version here. The whole system behaviours can be described like, system works normally initially, while obeying to a diæerential equation. A fault may occur and change the parameters of the plant. The supervisor in the high level should be designed to react the change of plant parameters and enable the FDI mechanism to diagnosis the fault in a moment, and after the fault is detected, the controller will be reconægured while still keeping the system performance. If the fault is repaired, the controller will be switched to its normal one to improve the total performance. It is expected that duration of proper working performance will be greater than a certain proportion of total elapse time even in the case of fault occurring and being repaired in the middle time. 3.1 System Model Because the plant is subject to faults, the dynamics of the system might be described by diæerential equations S 1 in case of normal controller, S 2 in case of fault occurance and not reconægured controller, S 3 in case of fault occurance and reconægured controller, and S 4 in case of fault repaired and reconægured controller. Where the total phase transitions structure can be seen in ægure 2. _x1 = x2 Initially - _x2 =2x2 +3x1 + u u = k1x2 + k2x1 y = x1 6 S1 - _x1 = x2 _x2 =2x2 +7x1 + u u = k1x2 + k2x1 y = x1 S2 _x1 = x2 _x2 =2x2 +3x1 + u u = k3x2 + k4x1 y = x1 ç? _x1 = x2 _x2 =2x2 +7x1 + u u = k3x2 + k4x1 y = x1 S4 S3 Figure 2, The ægure of phase transition x denotes a vector with x 1 ;x 2 be its ærst and second elements, u is the control signal and y is the output signal. k 1 ;k 2 ;k 3 ;k 4 could be designed to satisfy the total system requirement,expecially the timing requirements. 3.2 Properties Derived from the System Model We will give some properties which could be derived from system model in these section. Here by exclusiveness we mean that system dynamic behavior can not be described by any two cases of diæerential equations, which can be speciæed in DC.

5 Formal Development of a Feedback Control System with Fault Accomodation 45 Property 3.1 Exclusiveness :3 _ i6=jdsi ^ Sje 3.3 Environment It is supposed that the frequency of the change of system behaviour must be limited otherwise it is hardly possible to meet any reasonable requirement. We therefore assume a kind of stability for S1;S3 and let them keep stable for at least T 1 é 0 time units. We specify this assumption in EDC as follows. Assumption 3.1 For the initial period: For the intermediate period: ds 1 e; ds 2 eds 1 e^lét 1 ; ds 2 e ds 4 eds 1 e; ds 2 eds 4 e; ds 1 e^lét 1 ; ds 2 e ^ds 2 eds 3 e; ds 4 eds 2 e; ds 3 e^lét 1 ; ds 4 e Let ENV denote the conjunction of the above two formulas. 4 Requirements Speciæcation In control theory, many requirements for a hybrid system are considered. In this section, we only explain some requirements for the given Control System and formulate them in EDC. 4.1 Performance Speciæcations A control system is usually subject to faults and disturbances, so the required output can not be achieved all the time. In order to obtain eæciency, a control system is required to work properly for enough time while initially proper working for some time. Here ærstly we give the speciæcation of proper working condition. Proper Working Condition: Given a required output, a control system should be designed such that the accuracy of output is within a given range denoted by PW. For example, for the given Control System, we set the proper working condition as PWb=j y, y r jç æ where y r is the required output, and the accuracy of the output is deæned as æ. This requirement can be also written in EDC as, REQ : 5 Design by Reænement 2dS 1 e^l ç T 1 ; true The ærst step of design is to construct an overall speciæcation for the controller such that the requirements are satisæed. Then the overall speciæcation is decomposed into several components and the corresponding speciæcations of these components are given such that their combination will guarantee the overall speciæcation. At last the detailed design of these components are made according to the methods of control theory.

6 46 Duration Calculus Workshop, ESSLLI' Overall Speciæcation The normal controller and reconægured one can be designed such that for in phase S 1 ;S 3 of the plant, the output will converge to the required accuracy within l 1 ;l 3 0 ç l 1 ç l 3 time units since reconægured one could have performance degration in some sense, and time limit to FDI mechanism, namely, FDI to detect fault state correctly in l 2 ;l 4 time unit during phase S 2 ;S 4 respectively. So the overall speciæcation OSP is 0 1 2dS 1 el ç l 1 ; de _ dpwe ^2dS OSP b= B 2 el ç l 2 ^2dS 3 el ç l 3 ; de_dpwe A ^2dS 2 el ç l 4 A design decision is to choose l i such that 5.2 Requirements Veriæcation DES1 :l 1 + l 3 + maxl 2 ;l 4 ç 1, p æ T 1 The veriæcation of the requirements under OSP with DES1 can be proved by EDC as follows. Lemma 5.1 OSP 0 ^ ENV ^ DES1 ds 1 e^l ç T 1 R 1 PW ç p æ l ds 1 e^l ç T 1 ; ds 2 e ds 1 e^l ç T 1 ; ds 2 e; ds 3 e R C A PW ç p æ l Proof: ds 1 e^l ç T 1 OSP R l ç l 1 ; dpwe ^ l ç T 1 PW ç p æ T 1 DES1,l 1 ç 1, p æ T 1 ds 1 e^l ç T 1 ; ds 2 e OSP R l ç l 1 ; dpwe ^ l ç T 1 ; l ç l 2 PW ç p æ T 1 DES1,l 1 + l 2 ç 1, p æ T 1 ds 1 e^l ç T 1 ; ds 2 e; ds 3 e OSP l ç l 1 ; dpwe; l ç l 2 ; l ç l 3 ; dpwe ^ l ç T 1 PW ç p æ T 1 DES1,l 1 + l 2 + l 3 ç 1, p æ T 1 2 Lemma 5.2 OSP ^ ENV ^ DES1 2dS3 e^l ç T 1 ; ds 4 e ^2dS 3 e^l ç T 1 ; ds 4 e; ds 1 e Proof: Similar proof as Lemma Theorem 5.1 Z OSP ^ ENV ^ DES1 ds 1 e; true PW ç p æ l Proof: The theorem can be proved using inductive rule of DC, see Appendix for proof detail. 2!

7 Formal Development of a Feedback Control System with Fault Accomodation 47 6 Decomposition and design of components In this section, we reæne the overall speciæcation into the speciæcation of its components: normal controller, FDI mechanism, reconægured controller which can be coordinated by supervisor. Given certain value of æ; p and l 1 ;l 3 proper parameters k 1 ;k 2 ;k 3 ;k 4 can be selected. Let T 1 =20;æ=0:01;y r =0;p =0:8, we can get following design of certain parameters. k 1 =,5;k 2 =,5;k 3 =,5;k 4 =,9 For details of design procedure, see standard control theory textbooks. We can also verify these parameters can satisfy the timing requirements of normal controller and reconægured controller, As formulated in following theorem. Theorem 6.1 Given æ =0:01;y r =0;p =0:8;l 1 =0:5;T 1 =20;l 3 = 1, proper parameters can be designed such that: æd_x 1 = x 2 ^ _x 2 =2x 2 +3x 1 +u^u = k 1 x 2 +k 2 x 1 e^dk 1 =,5^k 2 =,5e l ç 0:5; dpwe æd_x 1 = x 2 ^ _x 2 =2x 2 +7x 1 + u ^ u = k 1 x 2 + k 2 x 1 e^dk 1 =,5 ^ k 2 =,9e l ç 1; dpwe 7 Conclusions In this paper, by using Extended Duration Calculus, we have proposed a formal development to a feedback control system with fault accomondation, giving its formal requirement speciæcation, thus the formal veriæcation to overall requirement satisæcation. A formal speciæcation provides us much more clear advantages, such as clarity and precision, and formal veriæcation can help uncovering errors, misunderstanding, or subtle, unexpected properties which easily escape by other means of investigations. We hope this work can stimulate more DC use in industry applications. References ë1ë Zhou Chaochen, C.A.R. Hoare, and A.P. Ravn. A calculus of durations. Information Processing Letters, 405:269í276, ë2ë M.R. Hansen and Zhou Chaochen. Semantics and completeness of duration calculus. In J.W. de Bakker, C. Huizing, W.P. de Roever, and G. Rozenberg, editors, Real-time:Theory in Practice, LNCS 600, Proc. of REX Workshop, pages 209í225, Mook, The Netherlands, Springer-Verlag. ë3ë Zhou Chaochen and Li Xiaoshan. Mean value calculus. Technical Report 5, UNUIIST, ë4ë Li Xiaoshan. A Mean Value Calculus. PhD thesis, The Institute of Software, The Chinese Academy of Sciences, September ë5ë Zhou Chaochen, A.P. Ravn, and M.R. Hansen. An extended duration calculus for hybrid real-time systems. In R.L. Grossman, A. Nerode, A.P. Ravn, and H. Rischel, editors, Hybrid Systems, LNCS 736, pages 36í59. Springer Verlag, ë6ë Zongji Chen, Wang ji And Chaochen Zhou: A Design Approach of Hybrid Control Systems. UNUIIST Reports No.25,1994.

8 48 Duration Calculus Workshop, ESSLLI'98 Appendix Proof: Deæning: 0 RX b= OSP 0 ^ ENV ^ DES1 ds1e ^l ç T 1 ; ds 2 e; X ^ ds1e ^l ç T 1 ; ds 2 e; ds 3 e; X ^ ds 3 e^l ç T 1 ; ds 4 e; X ^ ds 3 e^l ç T 1 ds 4 e; ds 1 e; X 1 C A 1 C A We use right induction rule here. It is obvious the Rde hold from lemma5.1,5.2. So we need only to prove RdS i e; X and Rd:S i e; X. case1: ds1e^l ç T 1 ; ds 2 e; d:s 2 e; X Transition Property ds1e^l ç T 1 ; ds 2 e; ds 3 e; X Inductive Hypothesis ds1e^l ç T 1 ; ds 2 e; ds 2 e; X DC ds1e^l ç T 1 ; ds 2 e; X inductive hypothesis case2: ds1e^l ç T 1 ; ds 2 e; ds 3 e; ds 3 e; X DC ds1e^l ç T 1 ; ds 2 e; ds 3 e; X Inductive Hypothesis ds1e^l ç T 1 ; ds 2 e; ds 3 e; d:s 3 e; X Transition Property ds1e^l ç T 1 ; ds 2 e; ds 3 e; ds 4 e; X; X inductive hypothesis ds 1 e^l ç T 1 ; ds 2 e; Lemma5.1 case3: ds3e^l ç T 1 ; ds 4 e; ds 4 e; X DC ds3e^l ç T 1 ; ds 4 e; X Inductive Hypothesis ds3e^l ç T 1 ; ds 4 e; d:s 4 e; X Transition Property ds3e^l ç T 1 ; ds 4 e; ds 1 e; X inductive hypothesis case4: ds3e^l ç T 1 ; ds 4 e; ds 1 e; ds 1 e; X DC ds3e^l ç T 1 ; ds 4 e; ds 1 e; X Inductive Hypothesis

9 Formal Development of a Feedback Control System with Fault Accomodation 49 ds3e^l ç T 1 ; ds 4 e; ds 1 e; d:s 1 e; X Transition Property ds3e^l ç T 1 ; ds 4 e; ds 1 e; ds 2 e; X ENV ds3e^l ç T 1 ; ds 4 e; ds 1 e^l ç T 1 ; ds 2 e; X inductive hypothesis ds 3 e^l ç T 1 ; ds 4 e; Lemma5.2 2 Gao Jianping was born in 1969, received the B.S degree in Mathematics from Fu Dan University in From 1990 to 1993, he worked as assistant engineer in XiAn Institute on Flight Control,No.618 on design of æight control law, development of æight control CAD software. From 1993 to 1995, he ænished the M.E degree in Automatic control from Beijing University of Aeronautics & Astronautics. From to , he visited the United Nations University, the international institute for software engineering as a fellow. Currently he was the Phd candidate in Dept.of Automatic Control. BUAA. His research interests include design and synthesis of hybrid system and modern æight control system. He is also the Member of IEEE and Member of ACM now. Chen Zongji was born in 1943, received the B.S degree in 1966 from the Beijing University of Aero.& Astron. and M.S and Ph.D degrees in 1980 and 1983 respectively from the Center of Control of Manchester University,U.K. Currently he is a professor in the Dept.of Automatic Control, BUAA and vice-dean of Graduate School of BUAA. His research interests include robust control system, Artiæcial intelligence and expert system, Hybrid dynamical system and CIMS.

10 50 Duration Calculus Workshop, ESSLLI'98