based systems with respect to fault detection. By using frequency domain techniques, a metric is developed that describes the detectability of a fault by showing ...
1
The Detection of Faults in Navigation Systems: A Frequency Domain Approach S. Scheding, E. Nebot and H. Durrant-Whyte Department of Mechanical Engineering The University of Sydney, NSW. 2006, Australia e-mail: scheding/nebot/hugh @mech.eng.usyd.edu.au
Abstract |This paper provides an analysis of Kalman lter based systems with respect to fault detection. By using frequency domain techniques, a metric is developed that describes the detectability of a fault by showing how a fault is transmitted to the lter innovations (if at all). Through experiment, it is shown that redundancy must be employed for guaranteed detection of faults, and that unlike sensors should be used. Further, it is shown that modelling errors can be treated within the same framework as `hard' actuator or sensor faults.
I. Introduction
This paper is concerned with the design and implementation of navigation systems for autonomous eld robotics. As the demand for outdoor automation[1, 2] increases, consideration needs to be paid to the reliability of such systems. For example, if a mining vehicle is automated, one can assume that at least in the initial stages of development, that it will interact in some way with conventional vehicles driven by human drivers. To prevent a fault in the navigation system from causing major damage and harm (to itself or to others), there needs to be some mechanism by which faults are detected, and appropriate action taken. A necessary part of the design of autonomous systems, therefore, is the inclusion of fault detection, and if possible identi cation algorithms which ensure the vehicle operates in a safe and reliable manner. Existing Fault Detection and Identi cation (FDI) schemes usually fall into one of two categories [3]; Model based [4{6], or Innovations (or residual) based [7] Model based fault detection systems su er from several drawbacks. The rst is that a modelled fault may be similar or identical to a perfectly valid change in system parameters. The second drawback of model based FDI is that often (in the case of estimated or observed stochastic systems) the optimality of the estimator is compromised by the inclusion of a fault model during the no-fault condition which is clearly unwanted. Lastly, it is not unreasonable to expect that a fault may occur which does not closely match any of the modelled faults thus causing the FDI to fail. The innovations of a lter (or observer) are the only internal performance metric of a lter, having known statistics when no fault has occurred. The diculty in determining whether a fault has occured in a sensor from the innovation sequence arises when the lter tracks the fault
rather than rejecting it, resulting in a state estimate that diverges from the true state, without changing the statistics of the innovations. This paper develops a metric to determine the types of faults transmitted to the innovations. The reason that an innovations based approach is chosen is because no a priori assumptions are made about the fault. Although the intended application of the theory presented in this paper is for the automation of large outdoor vehicles, the analysis provided is applicable to any linear system whose state is estimated by a Kalman lter. Section II presents a brief introduction to the continuous time Kalman lter in both time and frequency domains. Sections III and IV examine the detectability of sensor and process faults respectively, using frequency domain classical control techniques. Experimental results are given in Sections V, and concluding remarks are made in Section VI. II. Background
Consider a linear system represented in state space form by the equations,
x_ (t) = Fx(t) + w(t) z(t) = Hx(t) + v(t)
(1) where x(t) is the state of the system at time t, F is the continuous time process model and H is the matrix mapping the observations to state space. The variables w(t) and v(t) are the process noise and sensor noise vectors respectively. For a system in this form, the continuous time Kalman lter update equations are given by; x^_(t) = F^x(t) + K[z(t) , H^x(t)] (2) where K is the Kalman gain and the term [z(t) , H^x(t)] is de ned as the lter innovations. This may be converted to Laplace space as, sx^(s) = F^x(s) + K[z(s) , H^x(s)] (3) giving the transfer between the estimate and the observations as, x^(s) = [sI , F + KH],1K z(s) = G(s) (4)
2
Fig. 1. Kalman Filter Block Diagram
which is constant once the lter has reached steady state. Kalman lter operation may be seen graphically by the block diagram shown in Figure 1. III. Sensor Fault Detectability
Under no-fault conditions,
x^nf (s) = G(s)znf (s)
Fig. 2. Kalman Filter Block Diagram with Injected Process Fault
which may be rewritten as
F + fp (s)x^(s), x^(s) = [F + F(s)] x^(s) (11) (5) Showing that the injected fault fp (s) is indeed representative of a fault (F(s)) in the process model F. 1
To analyse this system, the injected fault is considered a where the subscript nf denotes the no-fault condition, and disturbance, and the analysis is performed using classical the subscript f denotes a fault condition. Now, consider an observation corrupted by a fault vector control techniques. The transfer function from the disturbance input to the fo(s), output may be derived as zf (s) = znf (s) + fo (s) (6) x^(s) = [sI , F + KH],1 From equation 5, the state estimate becomes f (s) p
x^f (s) = G(s)[znf (s) + fo(s)] The no-fault lter innovations are de ned as
nf (s) = znf (s) , H^xnf (s) so, under fault conditions,
(7)
= Gpf (s)
(12)
where the subscript pf denotes the transfer function with a process fault. Therefore, under process fault conditions (8) x^(s) = Gpf (s)fp (s) (13)
The innovations with a process fault (and zero input) f (s) = zf (s) , H^xf (s) may now be de ned as = [znf (s) + fo (s)] , H[G(s)[znf (s) + fo (s)]] = [znf (s) , H^xnf (s)] + [fo (s) , HG(s)fo (s)] pf = ,Hx^(s) = nf (s) + [I , HG(s)]fo (s) (9) = ,HGpf (s)fp (s) (14) Therefore, a sensor fault is detectable in the innovation sequence when the term [I , HG(s)]fo (s) is nonzero. It is interesting to note that this has a direct analogy with the no-fault innovation which may be written as [I , HG(s)]z(s). It may therefore be thought of as representing the e ects of the sensors' frequency content on the innovations - particularly when the frequency content is dissimilar as in the case when a sensor or sensor model is in fault. IV. Process Fault Detectability
Now, in normal operation the input z(s) will be non zero. According to classical control techniques, the response of the system (or in this case the response of the innovations) will simply sum, as the system is linear. So, to nd the response of the innovations subject to normal sensor operation together with a process fault (disturbance), the separate responses are simply added together. The innovations under process fault conditions become the no-fault innovations summed with the innovations due to a process fault as
Figure 2 shows the continuous time Kalman lter with pf = nf , HGpf (s)fp (s) (15) a fault fp (s) injected at the process model. This model of process faults is proved valid by considering the sum- where the subscript nf denotes the no-fault condition. mation block located directly after the gain block. The Therefore, a process fault is detectable in the innovation contribution of the process model loop is sequence when the term HGpf (s)fp (s) is non-zero. This means that only faults that are transmitted to observed F^x(s) + fp(s) (10) states are detectable.
3
Fig. 3. The Experimental Setup
V. A Gyro-Laser Experiment
This section describes an experiment used to verify the theory presented previously in this paper. Equation 9 is used to show the detectability of sensor faults in the innovations sequence, and an example is given of an undetectable sensor fault. Process faults, described by Equation 15, are also shown to be detectable in one of the observed states. A. Experimental Setup The experiment used two reasonably high quality sensors, these were; A GCS1 laser An Andrews bre optic gyroscope The GCS laser sensor operates by detecting the angle to a number of xed beacons Bi = [Xi ; Yi ]T ; i = 1; : : : ; N . For this experiment, three beacons (actually retrore ective tape) were surveyed with a theodolite so their position was accurately known. The strips were placed roughly in an equilateral triangle with the experimental rig situated within the area described by the triangle. The gyro used measures angular rate _ , but is subject to drift, particularly due to thermal in uences. This sensor however has extremely good high frequency performance, being able to detect rotation rates of up to 100 degrees per second. The sensors were mounted on a plate such that the axis of rotation of the GCS laser was approximately located over the center of the plate. The gyro was mounted at the periphery of the plate such that its sensitive axis was perpindicular to the surface of the plate. The plate itself was mounted on a stand such that it was free to rotate about its center. A schematic of the experimental setup may be seen in Figure 3. The experiment itself was extremely simple. The platform was left for a period of time, usually 10 to 15 minutes, then the platform was rotated quickly through approximately 90 degrees. This process was repeated several times over the course of a single run. The entire experimented was run several times to ensure repeatability. By combining the high frequency characteristics of the gyro and low frequency behaviour of the laser using a 1
Guidance Control Systems
Kalman lter, the whole spectrum of platform rotation manouevres is able to be tracked. The rst set of results (Section V-C)for this experiment are for the nominal system, with no faults added. Section V-D shows results for the system in the presence of a laser bias. B. Filter Design and Analysis The orientation of the platform was modelled by a simple constant velocity model, allowing and _ to be estimated. The gyro is known to drift, so a shaping lter must also be added. Also, to allow for small variations in position, x and y were also estimated. The state vector for this system is therefore de ned as x(t) = [x(t); y(t); (t); _ (t); xsf ]T (16) The continuous time linear process model may now be written as 2 x_ (t) 3 2 0 0 0 0 0 3 2 x(t) 3 2 wx (t) 3 6 y_ (t) 7 6 0 0 0 0 0 7 6 y (t) 7 6 wy (t) 7 6 7 6 76 7 6 7 6 _ (t) 7 = 6 0 0 0 1 0 7 6 (t) 7+6 0 7 6 7 6 76 7 6 4 (t) 5 4 0 0 0 0 0 5 4 _ (t) 5 4 w _ (t) 75 0 0 0 0 0 wsf (t) xsf (t) x_ sf (t) (17) Note that the shaping state xsf , and the two position states x and y are all modelled as Brownian motion processes. The shaping state, however, is designed to re ect the coloured noise component of the gyro measurement, while the position state models are intended to re ect the uncertainty in the true state, and the rate (i.e. randomly) at which the true state is considered to vary. The non-zero elements of the vector [wx ; wy ; 0; w _ ; wsf ]T are all assumed zero mean, uncorrelated gaussian sequences 2 with strengths x2 , y2 , 2_ and sf respectively. The gyro measurement equation is a linear combination of the angular rate _ and the shaping state xsf . zgyro(t) = 0 0 0 1 1 x(t) + [vgyro (t)] (18) where the gyro white noise component vgyro is assumed a zero-mean, uncorrelated gaussian sequence with strength 2 gyro . The laser provides a nonlinear observation which may be considered to be of the form z(t) = h(x(t)) + v(t) (19) The bearing to a beacon is given by arctan( XY ,,yx((tt)) ), however the platform is oriented in the direction , so for this system, the measurement equation for each beacon detected by the laser is given by the model Y i , y (t) i z (t) = arctan( X , x(t) ) , (t) + vi (t) (20) i where the laser observation noise vi is assumed to be identical for each beacon observed, uncorrelated, zero mean and gaussian with strength 2 . i
i
4
Throughout this experiment, the estimated noise strengths listed in the Table I were used. Figures 4 and 5 show Bode Diagrams of the transfer functions (G(s)) from the laser and gyro respectively. The transfer functions are only shown for the states of most interest, , _ and xs f . Note that the transfer functions are not directly comparable, as the laser provides an observation of , while the gyro observes _ .
100 fault mag (% of input)
TABLE I
Noise Parameters
is transmitted to the shaping state. Therefore a fault in the gyro is either detectable, or transmitted to the shaping state. A fault in the gyro will not a ect the states of interest or _ . A low frequency laser fault on the other hand is transmitted to the states of interest and is undetectable in the innovations. This represents a potentially catastrophic failure - one which is internally undetectable. 80 60 40 20 0 −3 10
−2
10
−1
10
0
10
1
10
2
10
0
fault phase (deg)
x2 1,10 m2 2 y 1,10 m2 2 _ 4:9,7 rad2 s,2 sf2 1,10 rad2 s,2 2 gyro 8:1,7 rad2 s,2 2 1,8 rad2
−50
−100
−150
−200 −3 10
−2
10
−1
0
10 10 Frequency (rad/sec)
1
10
2
10
Fig. 6. Fault Plot - Percentage of Fault in Laser (and Corresponding Phase) Transmitted to the Laser Innovations
fault mag (% of input)
0.2
0.15
0.1
0.05
0 −3 10
−2
10
−1
10
0
10
1
10
2
10
0
Fig. 4. Bode Diagram of the Transfer Functions from the Laser to the states , _ and xs f
fault phase (deg)
−50 −100 −150 −200 −250 −300 −3 10
−2
10
−1
0
10 10 Frequency (rad/sec)
1
10
2
10
Fig. 7. Fault Plot - Percentage of Fault in Laser (and Corresponding Phase) Transmitted to the Gyro Innovations
fault mag (% of input)
600 500 400 300 200 100 0 −3 10
−1
10
0
10
1
10
2
10
−50 −100 fault phase (deg)
Fig. 5. Bode Diagram of the Transfer Functions from the Gyro to the states , _ and xs f
−2
10
−150 −200
The fault plots[8] (a graphical representation of the term [I , HG(s)]fo (s)) for this system can be seen in Figures 6, 7, 8 and 9. These gures show that only very low frequency Fig. 8. Fault Plots - Percentage of Fault in Gyro (and Corresponding faults in either the gyro or the laser will go undetected in Phase) Transmitted to the Laser Innovations the innovations. However, if the Bode plot for the gyro is examined (Figure 5) at low frequencies, gyro information −250
−300 −3 10
−2
10
−1
0
10 10 Frequency (rad/sec)
1
10
2
10
5
coupled, for example by using a sensor that supplies range and bearing, one could reasonably expect the estimates of position to converge at a much greater rate.
fault mag (% of input)
100 80 60 40 20
−3
16
0 −3 10
−2
−1
10
0
10
1
10
−3
x 10
20
x 10
2
10
10
14 15
12
−80 10 10
−120
8
y (m)
x (m)
fault phase (deg)
−100
6 5
−140
4
−160
2
−180 −3 10
−2
−1
10
0
1
10 10 Frequency (rad/sec)
0
0
2
10
10
−2 0
500
Fig. 9. Fault Plots - Percentage of Fault in Gyro (and Corresponding Phase) Transmitted to the Gyro Innovations
C. Results: The Nominal System Figure 10(a) shows the orientation of the platform as estimated by the lter. This result agrees well with the experiment performed, the platform was stationary for relatively long periods of time, then rotated quickly by approximately 90 degrees. This result can be directly compared to that shown in Figure 10(b). This gure shows the e ect of simply integrating the gyro measurements to obtain the platform's orientation. It can be seen that the integrated gyro drifts by approximately 90 degrees over the course of the experiment. 1.6
1.5
1.4
0.5 1 phi (rad)
−5 0
3000
500
1000
1500 time (s)
2000
2500
3000
Figure 12(a) shows the estimated shaping state xsf . It can clearly be seen that the shaping state `absorbs' the gyro drift. Again, there are spikes corresponding to the changes in orientation of the platform. In this case, this is due to the process fault (as can be seen and easily detected in the gyro innovation sequence shown in Figure 12(b). The process model is an extremely poor model of the system. There is no way for the process model to predict the onset of movement in the platform. The shaping state tries to compensate for some of this error (thus the spikes), but at steady state, only the gyro drift is estimated. −3
8
x 10
1
0.5
4
1.2
phi (rad)
2500
6
1
0.8
2000
0 −0.5
2
gyro innovation (rad/s)
2
1500 time (s)
Fig. 11. Estimated Position (a) x and (b) y
shaping state (rad/s)
1.8
1000
0 −2 −4
0
−0.5
0.6
−6
−1
−1
0.4
−10 0
−2
0 −0.2 0
−8
−1.5
0.2
500
1000
1500 time (s)
2000
2500
3000
−2.5 0
500
1000
1500 time (s)
2000
2500
3000
Fig. 10. (a) Estimated Orientation and (b) Estimated Orientation Overlayed with the Integrated Gyro Output
In principle, the platform rotates about the geometric center of the laser, and therefore the laser does not move in the xy plane. However, Figure 11 shows that indeed the laser moves in the order of a few millimetres during rotation. This small error can be attributed to poor manufacturing of the platform. This highlights the need for accurate models, if the xy position were not estimated, this small error would feed into the other states, perhaps causing lter divergence. The spikes in these estimates, which correspond to the times at which the platform was rotated are an artifact of bearing only tracking. The laser is the only sensor which supplies information to the position states, allowing them to be estimated. The fact that the laser supplies bearing only, causes the lter to have a greater weight for the orientation state than for the position states. This causes the position states to take longer to converge to steady state than the orientation. In a system that is much more tightly
500
1000
1500 time (s)
2000
2500
3000
−1.5 0
500
1000
1500 time (s)
2000
2500
3000
Fig. 12. (a) Estimated Shaping State xsf and (b) Gyro Innovation Sequence
From the theory presented in Section IV, as both the orientation and the angular rate are being observed, any process faults occuring in either of those states is guaranteed be detectable in the innovations. This can clearly be seen in Figure 12(b) which shows the gyro innovation. The innovation is zero mean and white when the platform is stationary, indicating correct lter performance. However at the points where the platform is being rotated, the innovation sequence jumps, indicating a fault has occurred. The laser innovation sequence exhibits very similar behaviour. Figures 13(a) and 13(b) show the innovations of the gyro and laser respectively during periods when the platform is stationary. Both innovation sequences appear to be unbiased and zero mean, indicating that when the platform is stationary, the lter performs correctly. In summary, these results show that a constant velocity process model is not sucient to accurately model the experimental rig. In steady state, the system performs extremely well, however when the platform was rotated sig-
6
But, the system is at fault. As discussed in Section V-B very low frequency faults in the laser sensor will go undetected in the innovations, as evidenced by this example. The lter continues to produce consistent estimates with innovations that are white with zero mean. The estimates, however, do not re ect the true state. The only way to estimate this bias in a system such as this is to provide redundancy[8]. The term redundancy is used here to indicate multiple sensors that make comparable measurements Fig. 13. (a) Gyro Innovation Sequence with 1 and 2 Bounds and - not identical sensors. (b) Laser Innovation Sequence with 2 Bound It should be noted that in this case the sensor did not fail in hardware. The simulated fault (misalignment) is one that is generally caused by human error. With redundancy, even faults such as these will be detectable. −3
4
x 10
−3
1
x 10
0.8
3
0.6
0.4
1
Laser Innovations (rad)
gyro innovation (rad/s)
2
0
−1
0.2
0
−0.2
−0.4
−2
−0.6
−3
−0.8
−4 102
104
106
108 time (s)
110
112
−1 20
114
40
60
80
100 120 Time (s)
140
160
180
200
1.6
1.4
1.2
VI. Conclusions
Phi (rad)
1
0.8
0.6
0.4
0.2
0
−0.2
0
500
1000
1500 Time (s)
2000
2500
3000
Fig. 14. Estimated Orientation
ni cant error was induced, as evidenced by the innovations. Interestingly, although the model was not good enough to ensure lter consistency for the entire duration of the experiment, it was good enough to prevent the lter from diverging. D. Results: in the Presence of Laser Bias For this experiment a bias (an extremely low frequency fault) was added to the GCS laser of 0:1 radians (approximately 5.7 degrees). This bias simulates a misalignment of the sensor with respect to the platform. This is not an uncommon problem in the eld, as it is extremely dicult to align a sensor such as the GCS laser to a tolerance that is smaller than the accuracy of the sensor. Figure 14 shows the estimated orientation of the platform. As the bias is passed straight through to the estimate (from the Bode diagram in Figure 4), it is unsurprising that the estimated orientation appears to be consistently 0:1 radians o set from the unbiased case. Figure 15 shows the innovation sequence for the gyro and laser respectively. Again, they appear unbiased and zero mean. x 10
4
[1] [2] [3] [4] [5] [6] [7] [8]
−3
−3
1
0.8
In this paper, a metric for determining the detectability of faults was developed using frequency domain techniques. This metric describes the percentage of the fault transmitted to the lter innovations versus the frequency content of the fault. Using this metric, it was shown that for a system fusing gyro and laser data, low frequency faults in the laser will be undetectable. This was veri ed by experiment. Further, process faults were also shown to be detectable as evidenced by the experiment. These two examples demonstrate the utility of this approach. Faults are distinguished by their frequency content only. Therefore the source of the fault, be it in hardware or a fault in modelling, is irrelevant to this fault detection technique.
x 10
3
0.6
2
[9]
Gyro Innovations (rad/s)
Laser Innovations (rad)
0.4
0.2
0
−0.2
1
0
−1
−0.4
−2 −0.6
−3 −0.8
−1 50
100
150 Time (s)
200
−4 100
105
110 Time (s)
Fig. 15. (a) Laser Innovations and (b) Gyro Innovations
115
References S. Scheding, G. Dissanayake, E. M. Nebot, and H. F. DurrantWhyte, \Slip Modelling and Aided Inertial Navigation of an LHD," in IEEE Conference on Robotics and Automation, 1997. H. F. Durrant-Whyte, \An Autonomous Guided Vehicle for Cargo Handling Applications," International Journal of Robotics Research, vol. 15, 1996. A. Willsky, \A Survey of Design Methods for Failure Detection in Dynamic Systems," Automatica, vol. 12, pp. 601{611, 1976. J. Gertler, \Survey of Model-Based Failure Detection and Isolation in Complex Plants," IEEE Control Systems Magazine, vol. 8, pp. 3{11, 1988. R. Isermann and P. Balle, \Trends in the Application of ModelBased Fault Detection and Diagnosis of Technical Processes," Control Engineering Practise, vol. 5, pp. 709{719, 1997. D. Lane and P. Maybeck, \Multiple Model Adaptive Estimation Applied to the Lambda URV for Failure Detection and Identi cation," in Proc. 33rd Conf. Decision and Control, 1994. E. Nebot, M. Karim, and J. Romagnoli, \Implementation of a Failure Detection-Identi cation Algorithm for Dynamical Systems," J. Int. Soc. Mini and Microcomputers, vol. 5, pp. 59{65, 1986. S. Scheding, E. Nebot, and H. Durrant-Whyte, \Fault Detection in the Frequency Domain: Designing Reliable Navigation Systems," in Proceedings of Conference on Field and Service Robotics, 1997, pp. 218{221. J.J. Leonard, Directed Sonar Sensing for Mobile Robot Navigation, Ph.D. thesis, University of Oxford, 1991.
