IN SUPERVISING the correct operation of dynamic plants,

1158 IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 14, NO. 6, NOVEMBER 2006 Nonlinear Fault Detection and Iolation in a Three-Tank Heating Syte Raffaella Mattone and Aleandro De Luca, Senior Meber, IEEE Abtract We conider the fault detection and iolation (FDI) proble for a nonlinear dynaic plant (the IFATIS Heating Syte Benchark) affected by actuator and/or enor fault. A general procedure i propoed for odeling fault of enor that eaure the tate of a nonlinear yte, o that each enor fault i typically aociated to a et of (alway concurrent) fault input and the reulting dynaic equation are affine in the introduced fault input. Thi allow the application of recently developed nonlinear FDI technique, lightly extended to cover the conidered odel tructure. For the preented cae tudy, auing nonconcurrency of the fault in the hardware coponent, we decribe in detail the odeling procedure, the ynthei of reidual generator, and the deign of a cobinatorial logic that recover perfect iolation. Siulation reult are reported in the preence of input and eaureent noie. Index Ter Fault detection and iolation (FDI), nonlinear yte, thero-hydraulic yte, enor and actuator fault. I. INTRODUCTION IN SUPERVISING the correct operation of dynaic plant, one i intereted in the early detection and iolation of fault in the control hardware coponent [1], [2]. In a fault detection and iolation (FDI) yte, the detection phae conit in the generation of diagnotic ignal (reidual) triggered by a deviation of the plant fro the expected behavior, baed on the proceing of the available coanded input and eaured output and, poibly, the ue of a dynaic odel. The iolation phae conit in the dicriination of the occurrence of a pecific fault out of a et of potential fault, which can be ued for control yte reconfiguration. When a odel of the noinal (faultle) plant i available, it i natural to odel the preence of fault a additional input affecting the yte dynaic. For plant with linear dynaic, everal approache to the odel-baed deign of FDI yte have been propoed in the literature, e.g., baed on Kalan filter, Luenberger oberver, parity pace or paraeter etiation technique (ee the urvey in [3]). Exaple of application include hard dik drive control yte [4], rotor/agnetic bearing yte [5], valve leakage in blat furnace procee [6], indutrial ga turbine [7], and heat exchanger [8]. For yte with inherently nonlinear dynaic, the uual approach reort to linear approxiation in the FDI deign, which however, liit the validity of the chee to a choen operating point and introduce endogenou diturbance in the dynaic of the reidual. Nonlinear dynaic ha been directly conidered in ignal-baed FDI ethod uing nonlinear Manucript received October 26, 2005; revied May 24, 2006. Manucript received in final for June 6, 2006. Recoended by Aociate Editor A. T. Veuri. Thi work wa upported by the EU project EU-IST-2001-32122 IFATIS. The author are with the Dipartiento di Inforatica e Siteitica, Univerità di Roa La Sapienza, 00184 Roa, Italy (e-ail: attone@ di.uniroa1.it; deluca@di.uniroa1.it). Digital Object Identifier 10.1109/TCST.2006.880221 ARMAX odel (e.g., in [9] for an internal cobution engine) or neuro-fuzzy yte (ee [10] for a well-tirred tank reactor), or by exploiting the linear-in-the-paraeter nature of the odel (a in [11] for a ditillation colun). Robut fault detection for general nonlinear yte ha been conidered in [12]. More recently, FDI technique have been explicitly developed for nonlinear yte of the for (ee [13] and [14]) (1) i.e., where the dynaic of the tate (a well a the expreion of the output ) are nonlinear in,butaffine in the control input, in the fault input, and in the diturbance. Application in thi cla include robot anipulator [15] [17] and an indutrial furnace [18]. The yte vector field in (1) are aued to be perfectly known. Furtherore, fault input and diturbance appear only in the tate dynaic and not in the output equation. However, no auption on the for and/or paraeter of the fault tie behavior i required, in general. A a conequence, FDI ethod baed on a odel of the faulted proce in the for (1) are ueful to deal with failure of hardware coponent (e.g., actuator and/or enor) of any type and tie behavior, but not affecting the tructure of the yte dynaic (i.e., yte fault are not eaily treated). Thi i to be copared with the approach in [12], which i capable to detect and iolate yte fault under odel uncertaintie, provided that tate eaureent are reliable, and that the tructural change in the yte dynaic can be paraeterized by a cla of function out of a given et of finite cardinality. For nonlinear yte in the for (1), differential-geoetric condition have been given in [14], that are neceary for the olution of the FDI proble with poibly concurrent fault. Thee condition, however, are violated in any ituation of practical interet, notably whenever the total nuber of fault input exceed the dienion of the tate pace. In [19], we have propoed everal way to relax the FDI proble for yte (1), when it i not olvable in the original forulation of [14]. One poibility i to introduce the additional auption of nonconcurrency of fault, which reult in uch weaker neceary condition for obtaining fault detection and iolation. In thi brief we preent, through a coplete cae tudy, all tep involved in the nonlinear deign of a fault detection and iolation chee for ultiple nonconcurrent actuator and tate enor fault. The proce under conideration i a typical thero-hydraulic yte, alo ued a benchark in the EU project IFATIS [20] and already taken a application proble for other approache baed on linear [21] or bilinear [22] approxiation of the yte dynaic. Here, we hall take into account a full nonlinear odel for the faultle yte. The conidered fault ay affect all input actuator (hydraulic 1063-6536/$20.00 2006 IEEE

IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 14, NO. 6, NOVEMBER 2006 1159 In the abence of enor fault, the output coincide with the tate vector, with and, the fluid level and, repectively, teperature in the -th tank,. In (2), i the actually applied input vector (which ay be different fro the coanded input in cae of fault), with and the flow-rate and, repectively, heating power delivered to the -th tank,. The expreion of vector field, i given by Fig. 1. Scheatic diagra of the three-tank heating yte. pup and electrical reitor) and all available tate eaureent enor (level tranducer and theroeter), that we aue available for all tate variable. In a preliinary odeling tage we derive, for the faulted plant, dynaic equation having the tructure (1). While actuator fault of any type (power lo, bia, aturation, etc.) can be directly odeled in thi for, thi i not iediate for fault affecting the tate enor, due to the nonlinear dependence of the yte odel on the tate variable. Therefore, we propoe for thi cla of fault a new odeling procedure, where each phyical enor fault i odeled by a uitable et of (alway concurrent) fault input. Correpondingly, we extend to thi ore general ituation the neceary (and, under full tate availability, alo ufficient) condition for nonconcurrent FDI, which are given in [19] for the tandard cae when each phyical fault i odeled by jut one fault input. Baed on the fulfillent of thee condition of geoetric nature, we illutrate the deign of reidual generator and of a cobinatorial logic allowing perfect iolation of fault. FDI perforance of the reulting hybrid chee i deontrated by nuerical iulation, where the preence of unodeled input and eaureent noie i taken into account. II. THREE-TANK HEATING SYSTEM The proce ued a a cae tudy in thi brief, i copoed of three cylindrical tank. According to the chee of Fig. 1, Tank 1 and 2 are ued for preheating the fluid upplied by Pup 1 and Pup 2. The fluid teperature in thee tank can be adjuted by ean of two electrical reitor. The third tank allow ixing the fluid coing fro the two preheating tank. Meaure of the fluid level and teperature are available for all tank. The control objective i to regulate the fluid level and teperature in Tank 3. Writing the a and energy balance equation for each of the three tank reult in a nonlinear, affine in the input, odel of the for In the above expreion, i the ection of the tank, the pecific heat of the fluid, it denity, and, the fluid teperature at the input of tank 1, 2, and the invere of the (contant) throttling of the -th output valve,. Note that the yte vector field, are ooth in the tate-pace region of interet. III. FAULT MODELING We aue that the yte can be affected by fault of the actuator delivering the input coand, and of the enor providing eaure of the tate variable. Hence, the total nuber of fault poibly affecting the yte i. Since thi nuber i larger than the dienion of the tate pace, the neceary condition for FDI given in [14] for poibly concurrent fault are certainly (and tructurally) violated. Therefore, following the approach in [19], we hall relax the FDI proble by auing that at ot one fault can affect the yte at any tie (nonconcurrency of fault). A. Actuator Fault Being odel (2) affine in the control input, actuator fault can iply be odeled through the fault input vector defined a where i the coanded control input. Replacing expreion (3) in the yte tate dynaic (2), we get (3) (2) (4)

1160 IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 14, NO. 6, NOVEMBER 2006 with. Equation (4) include the effect of actuator fault and i till affine in the (control and fault) input, thu, allowing the direct application of the nonlinear FDI technique in [14] and [19]. B. Senor Fault We focu now on the odeling of fault of the enor providing eaure of the tate variable. The ot natural way to take into account the poible occurrence of thee fault would be defining the -th eaureent fault,,a i.e., a the difference between real and eaured value of the -th tate variable. However, thi odeling would lead either to the appearance of fault input in the output equation or to a odel that i nonlinear in the enor fault input (when the tate i replaced by the expreion in (2)). We propoe then a different procedure for odeling thi cla of fault, which reult in the deired tructure (1) for the yte equation. A we will how, thi i obtained by introducing a uitable et of fault input, in place of the natural fault quantity of (5). Thi iplie that the one-to-one correpondence of (5) between phyical event (fault of a ening device) and atheatical repreentation (enor fault input), i lot. For thi reaon, in the ret of thi brief, we will often need to ditinguih between the phyical enor fault, denoted for iplicity by a in (5), and the correponding atheatical fault input. Whenever a phyical enor failure occur (i.e., when ), all aociated fault input will becoe generically nonzero, although with copletely different tie behavior and, in general, without a direct phyical interpretation. According to thi odeling, in order to detect and iolate a ingle phyical fault of the -th tate enor, it will be ufficient to recognize the occurrence of any (one or ore) of the atheatical fault input. Thi i in the pirit of iolating a given et of fault fro the reaining one, a foralized in [19]. For the generic -th enor fault, we propoe the following odeling procedure. 1) Look in the yte odel for all different (and, in general, nonlinear) expreion, involving and uch that the odel i affine in. For variable, for exaple, it i 1 (5). Note that i, by definition, only affected by a fault of the -th tate enor (which i conitent with the auption of nonconcurrency 2 ), and i zero whenever, i.e., when. A a reult of thi odeling tep, any occurrence of the expreion in the yte odel can be replaced by, and the odel i certainly affine in the fault input. Note that the right-hand ide of (2) will now be only dependent on the variable and not on. 3) Define the further fault input. The introduction of thi additional fault input in the odel allow writing alo the left-hand ide of the -th yte equation in ter of the new variable (with dynaic ). The fault vector field aociated to i, thu, ( i the -th colun of the identity atrix). 4) If, for two indice, we can write for oe real function, then et and eliinate (vector field clearly reain the ae). With a light abue of notation, we till ue the ybol to indicate the final nuber of atheatical fault input correponding to the -th tate enor fault. A a reult of thi general odeling procedure, in the cae tudy under conideration, we introduce the following fault input. For enor fault 1 For enor fault 2 For enor fault 3 For enor fault 4 2) For each expreion found at tep 1, define the fault input, i.e., the error induced in the coputation of by the ue of the eaured value in place of the real value, and copute the correponding fault vector field. Let u denote the nuber of fault introduced in thi way by 1 In thi cae, the quantitie ' (x; u) can be eaily given a phyical interpretation. In particular, ' (x ) i the output flow fro Tank 1 (through Valve 1), while ' (x; u) i the net power heating Tank 1. For enor fault 5 2 In the abence of thi auption, we hould define a different fault input for each cobination of faulty/faultle device.

IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 14, NO. 6, NOVEMBER 2006 1161 For enor fault 6 At thi point, when the output are taken a new tate variable for the yte dynaic, the general tructure (1) i recovered. The final odel, including the effect of all (nonconcurrent) fault of actuator and tate enor, i then (6) with the trivial output equation oitted. Equation (6), which odel the faulted yte, i expreed in ter of the available coanded input and eaured output, and i affine in all control and (unknown) fault input, a requeted. In other word, any dicrepancy between faultle and faulted yte dynaic i fully uarized within the introduced fault input. Model (6) ay be reordered and ore copactly rewritten a given in [14]. In particular, when each phyical fault i odeled by jut one fault input with aociated vector field,we have hown in [19], that the neceary and ufficient condition for nonconcurrent FDI (under full tate availability and abence of diturbance) i Condition (8) guarantee that, for each couple of fault, a dynaic yte (reidual generator) can be found, whoe output (reidual) i affected by jut one of the two fault and not by the other. When each phyical fault i odeled by a et of alway concurrent fault input, a in the cae of (7), condition (8) can be eaily extended by oberving that a reidual i) i affected by, if it i affected by at leat one of the aociated fault input and ii) i decoupled fro, if it i not affected by any of the fault input. Thi lead to the following neceary and ufficient condition: (8) where, and with and for, and and for. The expreion of fault vector field, i given by, and Note that input and eaureent noie are not explicitly included in odel (7) ued for FDI deign. Indeed, it i rather intuitive (and can be forally proven) that thee diturbance cannot be exactly ditinguihed fro fault of the input actuator and tate enor. On the other hand, when thee unodeled diturbance are all enough, relevant fault can till be correctly iolated, in practice, by uitably threholding reidual (we propoe a iple but effective ethod in Section VI). IV. NECESSARY AND SUFFICIENT CONDITIONS FOR FDI Introducing the additional auption of nonconcurrency of fault, reult into uch weaker condition for FDI than thoe (7) where and denote the involutive cloure of, i.e., the cloure of under the Lie bracket operator. 3 Note that, differently fro (8), which i yetric with repect to and, the two condition in the left- and right-hand ide of the OR operator in (9) ay not hold at the ae tie. Thu, it ay happen that a reidual generator exit, that i affected by and not by, but that any reidual affected by i necearily alo affected by. In the cae under conideration, where and, it can be readily verified that all ditribution are involutive (thu, ) and that (9) hold for any. V. RESIDUAL GENERATOR DESIGN The fulfillent of condition (9) iplie that i) for any pair of fault and, a reidual exit that i affected by or by, but not by both and ii) there exit a et of reidual uch that each fault affect a different, nonepty ubet of diagnotic ignal within. Under the auption of full tate eaurability, the deign of reidual at point 1) follow directly fro (9), uing the fault vector field of odel (7), a hown in detail in the Appendix. Eentially, condition (9) guarantee the exitence, for any pair, of a uitable decoupling output function, whoe dynaic i affected by at leat one of the fault input aociated to, e.g.,, and decoupled fro all fault input correponding to. Then, a reidual generator can be deigned a a tandard nonlinear oberver with linear error dynaic [23]. In particular, the dynaic of the tate of thi oberver/reidual generator i a copy of the noinal (faultle) dynaic of, plu a correction ter that ake the obervation error/reidual ayptotically converge to zero in the abence of fault. 3 The Lie bracket of two vector field, v (x) and v (x), i defined a [v ;v ]=(@v =@x)v 0 (@v =@x)v [23]. (9)

1162 IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 14, NO. 6, NOVEMBER 2006 TABLE I TABLE V TABLE II TABLE VI TABLE III TABLE VII RESIDUAL MATRIX/ISOLATION LOGICS FROM PHYSICAL FAULTS F ;...; F TO RESIDUALS r ;...; r OF TABLES I VI TABLE IV In order to build the olution et of reidual at point 2), it i convenient to work with reidual atrice. Recall that the reidual atrix RM aociated to the et of reidual i the binary atrix whoe eleent i nonzero if and only if the phyical fault (or, equivalently, at leat one of the aociated fault input ) affect reidual. Therefore, a et of reidual olve the nonconcurrent FDI proble if and only if (10) where denote the th row of RM. The following procedure increentally build the colun of a reidual atrix RM atifying (10). Start by deigning the firt eleent of the reidual et o that it dicriinate fault fro, and build the correponding one-colun reidual atrix RM. After thi firt tep, the firt two row of RM are different, but one of the i zero. Deign reidual o that the firt two row of the reulting two-colun RM becoe nonzero. 4 Fro now on, the firt two row of RM will certainly be different and nonzero for whatever election of the reaining reidual. After the generic -th tep of the procedure, the firt row of the current RM atrix are different and nonzero. Look then at row to of RM and find (if it exit) the firt row being either zero, or equal to one of the row above (and, necearily, only to one). Then, the reidual to be appended to the et can be deigned o a to introduce either a 1 eleent in the null row, or the needed difference between the two equal row. 4 Thi ean finding a reidual that i affected by that phyical fault, between F and F, that doe not affect r. Thi i alway poible if all conidered fault affect the yte.

IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 14, NO. 6, NOVEMBER 2006 1163 Fig. 2. Behavior of phyical fault F ;...; F In a finite nuber of tep, with, all row of RM will certainly be different and nonzero, and condition (10) will be atified by the deigned reidual. We have applied the decribed procedure to the cae tudy under conideration. Table I VI contain the reidual deigned according to the differential-geoetric ethod decribed in the Appendix, while Table VII report the correponding reidual atrix. For each reidual, we alo report in the correponding table the expreion of the decoupling output and that of the reulting reidual dynaic. A nuber of reidual were ufficient to ake all row of the reidual atrix RM in Table VII nonzero and utually different. Finally, note that atrix RM can alo be ued to et up a cobinatorial iolation logic apping the excited/not excited reidual, to the boolean ignal and that are one-to-one related to the phyical fault of the actuator and of the tate enor. VI. NUMERICAL SIMULATIONS In order to verify the perforance of the propoed FDI chee on the conidered benchark yte, iulation have been perfored with the following phyical data: C C J kg kg Fig. 3. Behavior of reidual r ;...; r (vertical cale ha been truncated and detection threhold are included). The yte i controlled by a tandard nonlinear tate feedback law that exactly linearize the yte dynaic and decouple

1164 IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 14, NO. 6, NOVEMBER 2006 Fig. 4. FDI reidual after dynaic threholding and iolation logic. the input-output behavior, having et a controlled output the fluid level and teperature in Tank 1 and Tank 3 [i.e., ]. On the linear ide, regulation i obtained by four calar P or PD controller. The contant reference value for the output are 0.4, 0.2, 17 C and 19.78 C, repectively. According to odel (2), the correponding teady tate value for and are 0.3 and 22 C, repectively. For each control input, the range of coanded value ha been liited to the interval, being the noinal value of at the deired equilibriu configuration W W The yte i initialized far fro the deired equilibriu. The conidered fault are power loe of 20% for the input actuator and linear drift of unit/ on the eaure of the tate variable, being the deired teady-tate value of. Each phyical fault, i active for 1000, o that the auption of nonconcurrency hold (ee Fig. 2). Siulation were conducted in the preence of realitic level of input and eaureent white noie (iilar to thoe experientally validated for a ipler plant within the IFATIS project [20]). The obtained nuerical reult are reported in Fig. 3 4. Fro the reidual, hown in Fig. 3, it can be oberved that, in agreeent with Table VII, each reidual i affected by ore than one phyical fault, actuator fault excite one and only one of the reidual, while enor fault excite ultiple reidual. Note that, ince unodeled input and eaureent noie affect the yte, the deigned reidual are not perfectly zero in the abence of fault. In order to filter out thi background noie fro the diagnotic ignal o a to allow a reliable detection of fault, we have ipleented a dynaic threholding echani: each reidual i treated a zero unle it ha been above a fixed threhold for at leat a given tie. When thi happen, the occurrence of a fault i recognized. Siilarly, after a fault diagnoi, reidual are conidered unaffected again (ignalizing the fault end) only after they have been below their repective threhold for a given tie. At the cot of a all delay in the diagnoi, thi echani allow the ue of relatively low detection threhold (correponding to a good enitivity to fault) without getting unacceptable fale-alar rate. Thi i confired by the reported iolation reult (ee Fig. 4), obtained for and, being the apling tie in the coputation of reidual. The threhold ued for reidual are, alo diplayed in Fig. 3. Thi choice depend, in general, on the level of noie affecting the yte, but alo on the oberver gain in the reidual generator. In the reported iulation, we have ued the value for the contant in Table I VI. Guideline for an optial choice of thee paraeter ay be provided by the theory of Kalan filtering [7]. VII. CONCLUSION We have preented a coplete cae tudy for the deign of a nonlinear FDI yte, uing the IFATIS Heating Syte Benchark in the preence of nonconcurrent fault of all actuator and enor.

IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 14, NO. 6, NOVEMBER 2006 1165 A ethod ha been propoed for odeling fault of the enor eauring the tate of a nonlinear yte, o a to obtain tate equation that are affine in all (control and fault) input, and output equation that are independent of fault input a convenient for for the application of differential-geoetric ethod. A a reult, for any phyical enor fault, a et of alway concurrent fault input i typically introduced in the odel ued for FDI deign. Thi odeling approach cover ituation where perforance degradation can be attributed to fault of hardware coponent (enor and/or actuator) and not to change/uncertaintie in the tructure of the yte dynaic. The proble of detecting and iolating any ingle enor and actuator fault ha been forulated and olved extending recent reult on fault et detection and iolation [19], without any retricting auption on the type and tie behavior of the fault. Reidual generator have been deigned a a bank of dynaic yte with the tructure of nonlinear oberver. The obtained diagnotic ignal are proceed by a uitable cobinatorial logic, which allow perfect iolation of fault (in the abence of noie). The obtained FDI yte i, thu, a hybrid analog/digital yte. The preence of unodeled input and eaureent noie ha been handled though a dynaic threholding echani. Realitic iulation howed good perforance in ter of fale poitive/negative alar. In general, the few deign paraeter of the propoed FDI chee can be iply tuned according to the actual ignal to noie ratio o to attain the deired tradeoff between detection reliability and fault enitivity. Defining the calar output, it evolution i and, thu, i affected by the phyical fault (in particular, by the aociated fault input ), and not affected by (ince (12) hold, in particular, for ). Then, a reidual generator that dicriinate fro i (14) with, that ha the tructure of a nonlinear oberver with calar tate and linear error dynaic [23]. The aociated dynaic of the reidual i i.e., that of a linear, exponentially table yte driven by the et of all fault input for which it hold APPENDIX A DIFFERENTIAL-GEOMETRIC FDI DESIGN With reference to yte (7), we briefly recall here how to deign, under the auption of full tate eaurability, a reidual generator that dicriinate the occurrence of fault fro, i.e., whoe output i certainly affected by or by, but not by both. Thi contitute the eleentary tep in the deign procedure of Section V. Aue that condition (9) i fulfilled and, in particular (11) Since i involutive by contruction, etting independent function certainly exit, uch that their differential pan the annihilating coditribution (ee, e.g., [23]), i.e., Furtherore, fro (11) it follow: (12) (13) By contruction, the et of thee fault input certainly include and doe not include any. Note, finally, that all other fault ay or ay not affect thi reidual. REFERENCES [1] S. Siani, C. Fantuzzi, and R. Patton, Model-Baed Fault Diagnoi in Dynaic Syte Uing Identification Technique. London, U.K.: Springer-Verlag, 2002. [2] F. Caccavale and L. Villani, Ed., Fault Diagnoi and Fault Tolerance for Mechatronic Syte, in STAR. Berlin, Gerany: Springer-Verlag, 2003, vol. 1. [3] P. Frank, Diagnoi in dynaic yte uing analytical and knowledge-baed redundancy A urvey, Autoatica, vol. 26, pp. 459 474, 1990. [4] D.-S. Hwang, S.-C. Peng, and P.-L. Hu, An integrated control/diagnotic yte for a hard dik drive, IEEE Tran. Contr. Syt. Technol., vol. 2, no. 4, pp. 318 326, Dec. 1994. [5] I. Cade, P. Keogh, and M. Sahinkaya, Fault identification in rotor/ agnetic bearing yte uing dicrete tie wavelet coefficient, IEEE/ASME Tran. Mechatronic, vol. 10, no. 6, pp. 648 657, Dec. 2005. [6] A. Johanon and A. Medvedev, Model-baed leakage detection in a pulverized coal injection veel, IEEE Tran. Contr. Syt. Technol., vol. 7, no. 6, pp. 675 682, Nov. 1999. [7] S. Siani, C. Fantuzzi, and S. Beghelli, Diagnoi technique for enor fault of indutrial procee, IEEE Tran. Contr. Syt. Technol., vol. 8, no. 5, pp. 848 855, Sep. 2000. [8] Y. Peng, A. Yououf, P. Arte, and M. Kinnaert, A coplete procedure for reidual generation and evaluation with application to a heat exchanger, IEEE Tran. Contr. Syt. Technol., vol. 5, no. 6, pp. 542 555, Nov. 1997.

1166 IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 14, NO. 6, NOVEMBER 2006 [9] E. Laukonen, K. Paino, V. Krihnawai, G.-C. Luh, and G. Rizzoni, Fault detection and iolation for an experiental internal cobution engine via fuzzy identification, IEEE Tran. Contr. Syt. Technol., vol. 3, no. 3, pp. 347 355, Jun. 1995. [10] Y. Maki and K. Loparo, A neural-network approach to fault detection and diagnoi in indutrial procee, IEEE Tran. Contr. Syt. Technol., vol. 5, no. 6, pp. 529 541, Nov. 1997. [11] B. Huang, Detection of abrupt change of total leat quare odel and application in fault detection, IEEE Tran. Contr. Syt. Technol., vol. 9, no. 2, pp. 357 367, Mar. 2001. [12] A. Veuri and M. Polycarpou, On-line approxiation baed ethod for robut fault detection, in Proc. 13th IFAC World Congre, 1996, pp. 319 324. [13] H. Haouri, M. Kinnaert, and E. El Yaagoubi, Oberver-baed approach to fault detection and iolation for nonlinear yte, IEEE Tran. Auto. Contr., vol. 44, no. 10, pp. 1878 1884, Oct. 1999. [14] C. De Peri and A. Iidori, A geoetric approach to nonlinear fault detection and iolation, IEEE Tran. Auto. Contr., vol. 46, no. 6, pp. 853 865, Jun. 2001. [15] W. Dixon, I. Walker, D. Dawon, and J. Hartranft, Fault detection for robot anipulator with paraetric uncertainty: A prediction-error-baed approach, IEEE Tran. Robot. Auto., vol. 16, no. 6, pp. 689 699, Dec. 2000. [16] A. De Luca and R. Mattone, Actuator fault detection and iolation uing generalized oenta, in Proc. IEEE Int. Conf. Robot. Auto., 2003, pp. 634 639. [17] M. McIntyre, W. Dixon, D. Dawon, and I. Walker, Fault identification for robot anipulator, IEEE Tran. Robot., vol. 21, no. 5, pp. 1028 1034, Oct. 2005. [18] D.-L. Yu, Diagnoing iulated fault for an indutrial furnace baed on bilinear odel, IEEE Tran. Contr. Syt. Technol., vol. 8, no. 3, pp. 435 442, Jun. 2000. [19] R. Mattone and A. De Luca, Relaxed fault detection and iolation: An application to a nonlinear cae tudy, Autoatica, vol. 42, no. 1, pp. 109 116, 2006. [20] D. Sauter, F. Haelin, and S. Lèger, Heating yte benchark for fault detection and iolation and fault tolerant control IFATIS, Univerity of Nancy, Nancy, France, Rep. IFAN012R01, 2003. [21] S. Lèger, F. Haelin, and D. Sauter, Fault detection and iolation in dynaic yte uing principal coponent analyi application to an heating yte benchark, preented at the 5th IFAC Syp. Fault Detection, Superviion Safety Tech. Proce., Wahington, DC, 2003. [22] L. El Bahir and M. Kinnaert, Fault detection and iolation for a three tank yte baed on a bilinear odel of the upervied proce, in Proc. UKACC Int. Conf. Contr., 1998, pp. 1486 1491. [23] A. Iidori, Nonlinear Control Syte, 3rd ed. London, U.K.: Springer-Verlag, 1995.