Journal of Control Science and Engineering

Volume 2012 (2012), Article ID 989873, 13 pages

http://dx.doi.org/10.1155/2012/989873

## Automated Design of an FDI System for the Wind Turbine Benchmark

^{1}Department of Electrical Engineering, Linköping University, 58183 Linköping, Sweden^{2}Scania CV AB, 15187 Södertälje, Sweden

Received 1 July 2011; Accepted 4 October 2011

Academic Editor: Jakob Stoustrup

Copyright © 2012 Carl Svärd and Mattias Nyberg. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

#### Abstract

We propose an FDI system for the wind turbine benchmark designed by the application of a generic automated method. No specific adaptation of the method for the wind turbine benchmark is needed, and the number of required human decisions, assumptions, as well as parameter choices is minimized. The method contains in essence three steps: generation of candidate residual generators, residual generator selection, and diagnostic test construction. The proposed FDI system performs well in spite of no specific adaptation or tuning to the benchmark. All faults in the predefined test sequence can be detected and all faults, except a double fault, can also be isolated shortly thereafter. In addition, there are no false or missed detections.

#### 1. Introduction

Wind turbines stand for a growing part of power production. The demands for reliability are high, since wind turbines are expensive and their off-time should be minimized. One potential way to meet the reliability demands is to adopt fault tolerant control (FTC), that is, prevent faults from developing into failures by taking appropriate actions. A typical action is reconfiguration of the control system. An essential part of an FTC system is the fault detection and isolation (FDI) system, see, for example, [1]. To obtain good detection and isolation of faults, model-based FDI is often necessary.

Design of a complete model-based FDI-system is a complex task and involves by necessity several decisions, for example, method choices, tuning of parameters, and assumptions regarding noise distributions and the nature of the faults to be diagnosed. In general, an optimal solution requires detailed knowledge of the behavior of the considered system, something that is rarely available for real applications. In this paper, inspired by the work with real-industrial applications, we propose an automated design method that minimizes the number of required human decisions and assumptions. Furthermore, we investigate the potential of designing an FDI system for the wind turbine benchmark, see [2], using this automated method.

The design method is composed of three main steps. In the first step, a large set of candidate residual generators are generated using the algorithm described in [3]. In the second step, the residual generators most suitable to be included in the final FDI system are selected and realized by means of a greedy selection algorithm, based on ideas elaborated in [4]. The realization, or construction, of residual generators is done by the use of the algorithms presented in [5]. In the third and final step, we design diagnostic tests based on the residuals obtained as output from the selected set of residual generators. The diagnostic test relies on a novel methodology based on a comparison of the probability distributions of no-fault residuals, estimated offline using no-fault training data, and the distributions of residuals estimated online using current data.

As it turns out, the proposed FDI system performs well when evaluated on the test sequence described in [2]. A tailor-made FDI system perfectly tuned for the wind turbine benchmark would probably perform better than the one we propose. However, in relation to the minimal effort required for application of the automated design method, and in spite of no extra tuning or specific adaptation to the benchmark, the performance of the FDI system is satisfactory; all faults in the test sequence can be detected within feasible time, and there are no false or missed detections. Further, all faults, except a double fault, can also be isolated.

The wind turbine benchmark model and the strategy used for modeling of faults are described in Section 2. Section 3 presents an overview of the design method. The method for constructing residual generators is described in Section 4, and the approach used for selecting residual generators is described in Section 5. The method for design of diagnostic tests, and the fault isolation scheme is considered in Section 6. Some implementation-specific details are discussed in Section 7. The performance of the designed FDI system is evaluated and discussed in Section 8, Section 9 concludes the paper.

#### 2. The Wind Turbine Model

The wind turbine system is described and modeled in [2], to which is referred for details. The considered wind turbine system has three rotor blades and the system contains four subsystems: blade and pitch system, drive train, generator and converter, and controller, see Figure 1 and Table 1.

##### 2.1. State-Space Realization of Transfer Functions

The pitch system and converter are modeled as frequency domain transfer functions. The residual generation algorithm we intend to apply, assumes a model described in differential and algebraic equations. To obtain a model in this form, the transfer functions are realized as time-domain state-space systems.

The relation between pitch angle reference and pitch angle output , for each of the three blades and thus for , can be realized in state-space form using observable canonical form, see, for example, [6], as follows:where , are parameters, and , , state variables. Using the same approach, the relation between converter reference and output can be written aswhere is a parameter, and is the state variable.

##### 2.2. Fault Modeling

The set of faults to consider for the wind turbine is specified in [2] and given by where , , , and are actuator faults, is a system fault, and , , , , , , , , , and are sensor faults.

To incorporate fault information in the nominal model, we have chosen to model all faults as additive signals in corresponding equations. Thus, we are not taking into account all information regarding the nature of faults given in [2]. Consider, for example, fault which represents an actuator fault in pitch system 1, see (1a)–(1c), resulting in changed dynamics of due to dropped main line pressure or high air content in the oil. One possible way to model this fault would be as a deviation in parameters and in (1a) and (1b). With the chosen approach, the fault is instead modeled as an additive signal in (1c) for , that is, .

Note that the adopted fault modeling approach is general and no assumptions are made regarding, for example, the time-behavior of faults. Thus, the approach is able to handle, for example, multiplicative faults even though the fault signal is assumed to be additive. Consider, for example, a multiplicative fault in given by , where , which can be equivalently described by , where .

The main argument for using this, more general, approach is that we consider it hard, or even impossible, to know exactly how a faulty component behaves in reality. Furthermore, data from all fault cases for evaluation and validation of a more-detailed model are seldom available. Modeling faults in this way also results in a minimum of fault modes. This is beneficial since it gives a smaller model which simplifies several steps in model-based diagnosis, for example, residual generation and isolation. In addition, regarding how diagnosis information is utilized, for example, for fault tolerant control, it is unnecessary to distinguish between different fault modes if they are associated with the same action or consequence. Indeed, this applies to all sensor faults in the wind turbine, since the system should be reconfigured regardless of the type of sensor fault, that is, *fixed value* or *gain factor*, see [2, Table 2]. Last, but not least, an additional important motivator is simplicity, since extending the nominal model with additive fault signals in this way is straightforward and easy.

##### 2.3. Model Extensions

According to [2], the same pitch angle reference signal is fed to all three pitch systems (1a)–(1c), that is, for . However, according to the provided Simulink model, see [7], the individual reference signals are instead calculated in a control loop outside the pitch system as where is given by (1a)–(1c), and and are sensor measurements. To incorporate this information in the design of the FDI system, the original wind turbine model is extended with the relations between and given by (4).

##### 2.4. The Model with Faults

The complete model of the wind turbine model, with fault signals denoted by , used in this work for design of an FDI system is given below:

#### 3. Overview of Design Method

The proposed FDI system for the wind turbine is comprised of three subsystems: residual generation, fault detection, and fault isolation, see Figure 2.

Measurements, that is, sensor readings, from the wind turbine are fed to a bank of residual generators whose output is a set of residuals. The residuals are used as input to the fault detection block, which contains diagnostic tests based on the residuals. The output from this block, one signal for each residual, indicates if a fault has been detected in the part of the system monitored by the corresponding residual. The result from the fault detection is fed to the fault isolation block in which the detected fault(s) are isolated.

The proposed method supports design of the residual generation and fault detection blocks. Design of the fault isolation block is briefly discussed in Section 6.2. The method contains three essential steps:(1)generate candidate residual generators,(2)select and realize residual generators,(3)construct diagnostic tests,

see Figure 3. In the first step, a large set of candidate residual generators are generated. In the second step, the residual generators most suitable to be included in the final FDI system are selected and realized. In the third and final step, we design diagnostic tests based on the residuals obtained as output from the selected set of residual generators.

In the subsequent sections, we describe in detail the different steps of the design method used to create the proposed FDI system for the wind turbine benchmark system. As input to the design method, or prerequisites, we assume a model of the system and no-fault training data. The data is assumed to be expressed as measurements, either real or simulated, of the inputs and outputs of the model in realistic and representative no-fault operating conditions.

#### 4. Residual Generation

The set of residual generators used in the FDI system are based upon the ideas originally described in [8], where unknown variables in a model are computed by solving equation sets one at a time in a sequence and a residual is obtained by evaluating a redundant equation. Similar approaches are described and exploited in, for example, [1, 5, 9–13]. This class of residual generation methods, referred to as *sequential residual generation*, has shown to be successful for real applications and also has the potential to be automated to a high extent.

##### 4.1. Sequential Residual Generation

Some concepts and results of sequential residual generation given in [5], to which we also refer for technical details, will now be briefly recapitulated. We consider a model to be a set of differential and algebraic equations containing unknown variables , differential variables , and known variables . The equations in are, without loss of generality, assumed to be on the form where , and , are vectors of the variables in , , and , respectively. Note that the model of the wind turbine presented in Section 2.4 can trivially be cast into this form.

###### 4.1.1. Computation Sequence

As said above, the main idea in sequential residual generation is to compute unknown variables in the model by solving equation sets one at a time in a sequence and then evaluate a redundant equation to obtain a residual. An essential component in the design of a residual generator is therefore a computation sequence, which describes the order in which the variables should be computed. In [5], a computation sequence is defined as an ordered set of variable and equation pairs: where and . The computation sequence implies that first the variables in are computed from equations , then the variables in from equations , possibly using the already computed variables in , and so forth.

For an example, consider the computation sequence: for computation of a subset of the unknown variables in wind turbine model presented in Section 2.4. According to the computation sequence (8), the series of computations begins with computation of variable using equation , then variable is computed using equation , and so on, ending with computation of variable , or in fact from equation .

By construction, see [5], it is guaranteed that no variable is needed before it has been computed. Hence, the series of computations described by the computation sequence exhibit an upper triangular structure. For the computation sequence (8), this series of computations is given byWhether it is possible or not to compute the specified variables from the corresponding equations depends naturally on the properties of the equations. Equally important are, however, prerequisites in terms of *causality assumption*, that is, regarding integral and/or derivative causality, and the properties of the *computational tools*, that are available for use, for a detailed discussion, see, for example, [5]. The computation sequence (8) makes use of solely integral causality when the variables and are computed using equations and , respectively.

###### 4.1.2. Sequential Residual Generator

Having computed the unknown variables in , according to the computation sequence in (7), a residual can be obtained by evaluating a redundant equation , that is, with , where the operator returns the unknown variables that are contained in an equation set. A residual generator based on a computation sequence and redundant equation is referred to as a *sequential residual generator*.

The computation sequence (8) together with equation constitutes a sequential residual generator for the wind turbine model. When all variables in the computation sequence (8) have been computed according to (9a)–(9d), the residual is computed as .

###### 4.1.3. Finding Sequential Residual Generators

Regarding implementation aspects, for example, complexity and computational load, it is unnecessary to compute variables that are not contained in the residual equation, or not used to compute any of the variables contained in the residual equation. Furthermore, it is also desirable that computation of variables in each step is performed from as small equation sets as possible. It can be shown, see [5], that the equations in a computation sequence fulfilling the above properties, together with a redundant residual equation, in fact correspond to a minimal structurally overdetermined (MSO) set, see [3]. In other words, a necessary condition for the existence of a sequential residual generator for a model is that the model, or submodel, is an MSO set.

##### 4.2. Candidate Residual Generators

As indicated above, a first step when searching for a sequential residual generator for a model may be to find an MSO set in the model. Thus, an MSO set can be regarded as a *candidate residual generator*. There are efficient algorithms for finding all MSO sets in large equation sets, see, for example, [3].

Consider now the model of the wind turbine described in Section 2.4, with equations , unknown variables:
and known, that is, measured, variables:
In summary, the model contains 33 equations, 21 unknown variables, and 15 known variables. By utilizing the *structure*, that is, which unknown variables are contained in which equation, see, for example, [1], and a MATLAB implementation of the algorithm presented in [3], 1058 MSO sets were found in total.

#### 5. Selecting Residual Generators

It is not feasible to implement and use all 1058 candidate residual generators, that is, MSO sets, in the final FDI system. A more attractive approach is instead to pick, from the set of all candidate residual generators, a smaller set of residual generators with desired properties.

##### 5.1. Desired Properties of Residual Generators

The desired properties of the sought set of residual generators are as follows:(1)the set of residual generators should enable us to isolate all single faults from each other;(2)a set of residual generators of smaller cardinality is preferred before a larger one, given that the two sets have equal isolability properties;(3)a residual generator based on an MSO set of smaller cardinality is preferred before a residual generator based on an MSO set of larger cardinality, given that the two sets have equal detectability and isolability properties.

Properties 2 and 3 are mainly motivated by implementation aspects such as complexity, computational load, and numerical issues.

We will base the selection of residual generators on quantitative, structural properties of the MSO sets instead of more qualitative or analytical properties on the actual residual generators. The latter may result in better isolation performance but is considered intractable since it requires that residual generators are implemented, executed, and evaluated, and also access to representative measurement data for all fault cases.

##### 5.2. Fault Detectability and Isolability

To be able to formally state the selection problem, the notions of detectability and isolability are needed. Assuming that each fault occurs in only one equation, let denote the equation in an equation set containing fault , for example, , see Section 2. Note that if a fault occurs in more than one equation, the fault can be replaced with a new variable in these equations, and the equation added to the equation set. This added equation will then be the only equation where occurs. To proceed, let denote an operator extracting the overdetermined part of a set of equations. According to [14], a fault is *structurally detectable* in the equation set if and *structurally isolable* from fault in the equation set if and .

For an example, consider the equation set containing the residual equation and equations from the computation sequence (7), studied in Section 4.1.1. First, we note that the equation set is an MSO set due to the property of sequential residual generators mentioned in Section 4.1.3. Further, since is an MSO set, it holds that , see, for example, [3]. Thus, it can for instance be deduced that fault is structurally isolable from fault in , since , , and it holds that and , see Section 2.4.

By again utilizing the structure of the wind turbine model, the structural isolability properties of the model were calculated. All considered faults, see Section 2.2, can be (structurally) isolated from each other in the wind turbine model.

##### 5.3. Selection Problem Formulation

We will now formulate the selection problem in terms of properties on a set of MSO sets. To this end, let denote the set of all MSO sets in the model, and the set of considered faults. Let and define the *isolation class* for as
that is, contains the MSO sets in in which fault is structurally isolable from fault . Further, let
denote the set of all isolation classes needed for full isolation of all faults in . For the wind turbine benchmark model and the set of 15 faults considered in Section 2.2, the set contains in total isolation classes for single fault isolation of all 15 faults, that is, , where the operator returns the cardinality of a set.

To be able to satisfy the isolability property 1 stated above, we want to find a set with a nonempty intersection with all isolation classes, that is,
The property (14) on implies that we should find a so-called *hitting set* for . To satisfy the property 2, we want to find an so that is minimized. Thus, the sought hitting set for should be of minimal cardinality and we should find a so-called *minimal cardinality hitting set* (MHS) for .

There are several possibilities for a metric that helps us find an that satisfies property 3. We opt for simplicity and have, therefore, chosen to minimize . As an additional requirement, on top of 1, 2, and 3 in Section 5.1 we require that at least one residual generator can be constructed from every .

##### 5.4. Solving the Selection Problem

The problem of finding a minimal cardinality hitting set is known to be NP-hard, see, for example, [15]. To overcome the complexity issues, we have chosen to compute an approximate solution to the problem in an iterative manner with a greedy selection approach as elaborated in [4].

To accomplish this, we need to specify a *utility function*, that is, a function that evaluates the usefulness of a given MSO set, and also state the properties of a complete solution to the selection problem. Following the greedy selection approach, we add to the solution the MSO set with the largest utility until the solution is complete. Furthermore, we only add MSO sets from which at least one residual generator can be constructed.

###### 5.4.1. Characterization of a Solution

We will now characterize a complete solution to the selection problem for use in the selection algorithm. First, we define the *isolation class coverage* of a set of MSO sets as
which states which of the isolation classes in that are covered by the MSO sets in . The property 1 in Section 5.1, that is, the isolation or hitting set property, can with the isolation class coverage notion be formulated as . This characterizes a complete solution of the selection problem.

###### 5.4.2. Utility Function

To evaluate a specific MSO set, we want to take into account the properties 1, 2, and 3, above. For a given MSO set , we will use the utility function: where is the MSO set in with the largest cardinality, and , , a weighting factor. The term in (16) tells how many of the isolation classes in are covered by the MSO set . Since we aim at covering all isolation classes with a minimum of MSO sets, property 2, we want to pick an MSO set that maximizes this term. The term relates the cardinality of to the cardinality of all other sets in . Picking an MSO set that maximizes this term in (16) hence corresponds to picking the MSO set with the smallest cardinality in . This will help us satisfy property 3. The weighting factor is used to trade between the two properties reflected by these two terms.

Note that an MSO set maximizing one term in (16) may minimize the other since an MSO set of larger cardinality likely covers more isolation classes than an MSO set of smaller cardinality.

##### 5.5. The Selection Algorithm

The function SELECTRESIDUALGENERATORS used for selecting residual generators by means of greedy selection is given in Algorithm 1. Input to the function is a set of MSO sets , that is, a set of candidate residual generators, and a set of isolation classes . The output is a set of MSO sets and a set of residual generators based on . The function FINDCOMPUTATIONSEQUENCE, described in [5], is used to find a computation sequence in accordance with Section 4.1, given a just-determined set of equations. The function FINDCOMPUTATIONSEQUENCE can be found in Algorithm 2.

For a formal discussion regarding the qualification of using a greedy heuristic for solving the residual generation selection problem, as well as the complexity properties of such algorithms, please refer to [4] and references therein.

###### 5.5.1. Selecting Residual Equation

Note that the total number of sequential residual generators that potentially can be constructed from an MSO set equals the number of equations in the set. All residual generators created from the same MSO set, however, have equal fault detectability and isolability properties according to Section 5.2. Nevertheless, their actual fault detectability and isolability may differ due, for example, different sensitivity for noise, and so forth. To make the final selection of which of the residual generators created from an MSO set that should be included in the final diagnosis system, evaluation by means of execution using real measurements from different fault cases is needed. Since we in this work only assume that no-fault data is available, see Section 3, this is not possible.

In this work, the selection of which residual generator to create from a given MSO set is done so that the final deployment of the FDI system becomes as simple as possible. First of all, FINDCOMPUTATIONSEQUENCE was configured to prefer algebraic equations as residuals before differential equations, if possible. Second, in order to avoid implementation issues related to numerical differentiation, FINDCOMPUTATIONSEQUENCE was configured to prefer computation sequences using integral causality. Using this two-step heuristic, the selection of which residual generator to create from an MSO set, in practice, is more or less unambiguous. In those few cases where more than one candidate remains, we make an arbitrary selection.

##### 5.6. Selected Residual Generators

Both functions SELECTRESIDUALGENERATORS and FINDCOMPUTATIONSEQUENCE were implemented in MATLAB. As computational tool, see [5], the algebraic equation solver MAPLE was utilized, which allows symbolic solving of algebraic loops. The input to the algorithm was the set of all 1058 MSO sets for the wind-turbine benchmark model, see Section 4.2, and the set of all 210 isolation classes for single fault isolation of all considered faults, see Sections 2.2 and 5.3.

To investigate the sensitivity of SELECTRESIDUALGENERATORS to the parameter , that is, the tradeoff between properties 2 and 3 stated in Section 5.3 and reflected by and , the algorithm was run with the wind turbine model and . The result is shown in Table 2, where denotes the set returned by SELECTRESIDUALGENERATORS. When , the aim is to fulfill the isolation property with as few MSO sets as possible, no matter the size of the MSO sets. As seen in Table 2 this results in few, but large, MSO sets. The smaller the , the more attention is paid to the size of the MSO sets. It turns out that gives a decent tradeoff between and for the wind turbine model.

With , the algorithm selected 16 MSO sets, that is, and . Of the 16 selected MSO sets, 7 contain algebraic equations only. The other 9 MSO sets contain both algebraic and differential equations. Thus, 7 of the 16 residual generators used in the final FDI system are static and the remaining 9 are dynamic. All 9 dynamic residual generators, due to the configuration of the algorithm, use integral causality. The *total* number of found residual generators is 34, that is, , see Section 5.5. Of these 34 residual generators, 18 are static and the remaining 16 are dynamic.

###### 5.6.1. Fault Signature Matrix

Given an MSO set , its *fault signature *, with respect to the faults in , is defined as
For instance, the fault signature of the MSO set is . A convenient representation of the fault signature of a set of MSO sets with respect to is the *fault signature matrix* (FSM) with elements defined by
The FSM for the 16 MSO sets on which the selected residual generators are based is given in Table 3.

#### 6. Fault Detection and Isolation

For fault detection and isolation, diagnostic tests based on the output from each of the 16 residual generators are constructed. Since no assumptions are made regarding the nature of the faults that should be detected, see Section 2.2, nothing is known about the fault’s temporal properties, size, rate of occurrence, and so forth. Hence, we may not be able to fully exploit the potential of some general method for change detection as, for example, the CUSUM test, see, for example, [16].

As said in Section 3, we, however, assume that no-fault training data is available. To take advantage of this fact and also handle uncertainties in terms of modeling errors and measurement noise, we base our diagnostic tests on a comparison of the estimated probability distributions of no-fault and current residuals. The former probability distributions are estimated offline using the available no-fault training data and the latter online using current data. A clear advantage with this approach is that changes in mean and variance are handled in a unified way, since we consider the complete distribution of the residual.

##### 6.1. Diagnostic Test Design

Let be a discrete estimate of the probability distribution of a residual from no-fault data, and a discrete estimate of the distribution of the same residual from present data, both having bins. Then, the Kullback-Leibler (K-L) divergence [17] between and is given by where denotes the th bin of the discrete distribution .

To apply the K-L divergence for construction of a diagnostic test, we proceed as follows. Given a representative batch of no-fault data , that is, in our case measurements of the variables in the set which contains the inputs and outputs to the model, we run the set of residual generators and obtain a set of residuals. For each residual , we then estimate its probability distribution and obtain , that is, actually , where is a stochastic variable, discretized in bins, representing residual . As said, this procedure can be done offline. To estimate a probability distribution, we create a normalized histogram with bins for the data from which the distribution should be estimated.

Online, we continuously estimate the distribution of the current residual using a sliding window containing samples of . If we by denote the estimated distribution of calculated at time , that is, , where denotes the batch of data in the sliding window at time , the diagnostic test is designed as where is the threshold for alarm. The K-L divergence is referred to as the test quantity of the diagnostic test .

##### 6.2. Fault Isolation Strategy

Due to uncertainties not captured by the given model nor present in the no-fault training data, the power of diagnostic tests is not ideal for all faults. That is, the probability of detection given a certain fault is not always 1. To take this into account, the isolation scheme will interpret an “x” in a certain row in Table 3 as if the test *may* respond if the corresponding fault occurs and consequently no conclusions are drawn if a test does not respond, see [18].

To obtain the total diagnosis statement from a set of alarming diagnostic tests, we simply match their fault signatures with the FSM given in Table 3. For example, if only test alarms, we look at the row corresponding to and conclude that either fault *or * are present. If then also alarms, we combine the row corresponding to with the row corresponding to and conclude that fault must be present.

To handle also multiple faults, we use the fault signatures in the original FSM in Table 3 to create an extended FSM with fault signatures also for multiple faults. This is done by column-wise OR operations in the original FSM. For instance, the column in the FSM for the double fault will get “x” in rows corresponding to , , , , and and zeros elsewhere. In the fault isolation scheme, we first attempt to isolate all single faults using the original FSM in Table 3. If this does not succeed, we try to isolate double faults, and so forth.

#### 7. Implementation Details

The final FDI system was implemented in SIMULINK according to the structure in Figure 2. The 16 residual generators were implemented as embedded MATLAB functions (EMF) in which the code was automatically generated from the structures obtained from the functions FINDCOMPUTATIONSEQUENCE and FINDRESIDUALGENERATORS. The initial conditions for the states in the dynamic residual generators were derived from the corresponding sensor measurements, if available, otherwise, set to zero. For instance, , , and . This may cause transients in the residuals, but this is not considered a problem.

##### 7.1. Parameter Discussion

Although the aim is to keep the number of parameters in the automated design method at a minimum, there are nevertheless some parameters that must be set. This section lists the needed parameters and discusses their influence on the performance of the FDI system.

###### 7.1.1. Number of Histogram Bins and Size of Sliding Window

The number of bins in the histograms used as distribution estimates, is a tradeoff between detection time, noise sensitivity, and complexity, in terms of computational power and memory. A large results in fast detection, but on the other hand also in increased sensitivity for noise. Also, a large requires more memory and involves more computations, in comparison with a smaller .

The size of the sliding window used to batch data for creation of the histograms is a tradeoff between detection performance, noise sensitivity, and complexity. A large will give the K-L test quantity lowpass characteristics, resulting in a smoothed K-L test quantity. This makes it possible to detect small changes in the estimated distributions. On the other hand, a large requires more memory. The choice of is also related to the number of bins in the histograms and vice versa, since a small , together with a large , will result in a sparse histogram. Hence, the choices of and must match.

For the wind turbine benchmark model, investigations, however, indicate that the method is quite insensitive to the values of and if and . A decent tradeoff, taking this into account and also the complexity issues discussed above, is and , which are the values used in the final FDI system.

###### 7.1.2. Alarm Thresholds

The choice of alarm thresholds , is a tradeoff between detection time and the number of false detections. The higher the thresholds, the longer the detection time and the lower the rate of false alarms. The choice of alarm thresholds is related to the choices of and since both affect how sensitive a K-L test quantity is to noise, which in turn affects the rate of false detections. We aim at choosing the alarm thresholds so that the number of false detections is minimized, implying that the choice of must match the choices of and . For the wind turbine benchmark model, the alarm thresholds were computed as a safety factor times the maximum value of the corresponding K-L test quantities from 100 simulations with no-fault data.

###### 7.1.3. Isolation Validation Time

The only parameter involved in the fault isolation is the isolation validation time . This parameter is used to compensate for the fact that the power of diagnostic tests is not ideal, see Section 6.2. This may, for example, result in that the detection times, for the same fault, are different for different diagnostic tests. To handle this, we demand that the output from the isolation has been equal for samples before reporting the isolation result. By choosing a large , we decrease the probability of false isolation, but on the other hand, increase the isolation time. For the wind turbine benchmark model, the isolation validation time was set to 4 samples.

#### 8. Evaluation and Results

To evaluate the performance of the proposed FDI system, we use the test cases described in [2]. The test cases are based on measured wind data and a sequence of injected faults. The set of injected faults, their time of occurrence and description, is specified in Table 4. The sequence contains 5 sensor faults and 3 actuator faults. Note that two faults are injected at 1000–1100 s, that is, at this time, we have the double fault .

The no-fault distributions used in the evaluation were estimated from residual data stemming from 100 Monte Carlo simulations with no-fault data, that is, inputs, corresponding to the measured variables in . Each set of no-fault data was generated with the provided wind turbine model with different noise realizations according to the model.

##### 8.1. Results and Analysis

By means of Monte Carlo simulations, the FDI system was simulated 100 times with data from the provided wind turbine model setup according to the above-described test sequence.

Based on the results from the 100 runs, the mean time of detection , maximum time of detection , minimum time of detection , mean time of isolation , minimum time of isolation , the total number of missed detections MD, and the total number of false detections FD, for each of the faults in the test sequence, were computed. The results along with the specified detection requirements [2], given in the row Req., are shown in Table 5, where all time values are given in seconds. Note that the specified requirements concern detection, and not isolation.

According to the row corresponding to in Table 5, all faults in the test sequence could be detected. For faults , , , detection requirements are met, by means of both and .

All faults, except the double fault could also be isolated. However, the mean time of isolation, , for some faults, for example, , is substantially longer than the corresponding mean time of detection. The main reason for this is that some tests respond slower to faults than other. As said, fault could not be isolated. In fact, this fault is not uniquely isolable with the isolation strategy described in Section 6.2 since the test response of fault is a subset of the test response of fault , see Table 3. Both faults and are, however, contained in the diagnosis statement computed after the faults have been detected.

It seems like sensor faults, for example, tend to be easier to detect than actuator faults as, for example, and . One possible explanation may be that actuator faults in general cause changes in dynamics, whose effects are attenuated by modeling errors, noise, and so forth.

As can be seen in the last two rows of Table 5, there are no missed or false detections in any of the 100 test runs.

##### 8.2. Case Study of Fault

To study in more detail how the FDI system handles faults, we consider the sensor fault . The fault corresponds to a fixed value of 1.4 rad/s being measured by sensor and occurs at time s. According to the FSM in Table 3, the residuals sensitive to fault are and , obtained as output from the residual generators and , respectively. These residuals along with the corresponding K-L test quantities are shown in Figure 4. As can be seen, both the residuals and the test quantities respond distinctively to the fault.

To also illustrate the isolation procedure, we show in Figure 5 the result of the diagnostic tests and (a), the isolation result associated to faults (b) and (c), and also the signal that indicates when the isolation procedure is done (b, c). As can be seen in Figure 5, the first test that reacts to the fault is . This occurs at s. Since is sensitive to both fault and and no other test has alarmed, the diagnosis statement is that either or may be present, and no fault can be isolated. At s, test alarms. Test is sensitive to faults , , and , and the updated total diagnosis statement based on that both and have alarmed thus becomes , see Table 3. This occurs at time s.

#### 9. Conclusions

We have proposed an FDI system for the wind turbine benchmark designed by application of a generic automated design method, in which the numbers of required human decisions and assumptions are minimized. No specific adaptation of the method for the wind turbine benchmark was needed. The method contains in essence three steps: generation of candidate residual generators; residual generator selection; diagnostic test construction. The second step is done by means of greedy selection, and the third step is based on a novel method utilizing the K-L divergence.

The performance of the proposed FDI system has been evaluated using the predefined test sequence for the wind turbine benchmark. The FDI system performs well; all faults in the test sequence were detected within feasible time and all faults, except a double fault, could be isolated shortly thereafter. In addition, there are no false or missed detections. A tailor-made, finely tuned, FDI system for the benchmark would probably perform better. However, in relation to the required design effort, and that no specific adaptation or tuning of the method to the benchmark was done, the performance is satisfactory.

#### Appendix

#### Algorithm for Finding a Computation Sequence

To make the paper more self-contained, the function FINDCOMPUTATIONSEQUENCE described in [5] is given as Algorithm 2. The function takes a just-determined equation set and a set of unknown variables , and it returns an ordered set as output. The algorithm assumes availability of a computational tool in the form of a algebraic equation (AE) solver such as, for example, Maple, see [5] for a thorough discussion regarding this. The function FINDALLSCCS is assumed to return an ordered set of equation and variable pairs, where each pair corresponds to a strongly connected component (SCC) of the structure of the equation set with respect to the variable set. There are efficient algorithms for finding SCCs in directed graphs, for example, the DM decomposition [19]. In MATLAB, the DM decomposition is implemented in the function dmperm. Other functions used in FINDCOMPUTATIONSEQUENCE are as follows.(i)DIFF and UNDIFF takes a variable set as input and returns its differentiated and undifferentiated correspondence.(ii)ISINITCONDKNOWN determines if the initial conditions of the given variables are known and consistent, and the function ISDIFFERENTIABLE determines if the given variables can be differentiated with the available differentiation tool.(iii) ISJUSTDETERMINED is used to determine if the structure of the given equation set, with respect to the given variable set, is just determined. This is essential, since, otherwise, the computation of SCCs makes no sense.(iv)GETDIFFERENTIALEQUATIONS takes a set of equations and a set of differentiated variables as input and returns the differential equations in which the given differentiated variables are contained.(v)ISTOOLSOLVABLE determines if the available algebraic equation solver can solve the given equations for the given set of variables.(vi)APPEND takes an ordered set and an element as input and simply appends the element to the end of the set.(vii)The operator , taking a set as input, is assumed to return the number of elements in the set and the notion is used to refer to the th element of the ordered set .

#### Acknowledgment

This work was supported by Scania CV AB, Södertälje, Sweden.

#### References

- M. Blanke, M. Kinnaert, J. Lunze, and M. Staroswiecki,
*Diagnosis and Fault-Tolerant Control*, Springer, 2nd edition, 2006. - P. F. Odgaard, J. Stoustrup, and M. Kinnaert, “Fault tolerant control of wind turbines âAS- a benchmark model,” in
*Proceedings of the 7th IFAC Symposium on Fault Detection, Supervision and Safety of Technical Processes*, pp. 155–160, Barcelona, Spain, 2009. View at Publisher · View at Google Scholar - M. Krysander, J. Åslund, and M. Nyberg, “An efficient algorithm for finding minimal overconstrained sub-systems for model-based diagnosis,”
*IEEE Trans. on Systems, Man, and Cybernetics. Part A*, vol. 38, no. 1, pp. 197–206, 2008. View at Google Scholar - C. Svärd, M. Nyberg, and E. Frisk, “A greedy approach for selection of residual generators,” in
*Proceedings of the 22nd International Workshop on Principles of Diagnosis (DX-11)*, Murnau, Germany, 2011. - C. Svärd and M. Nyberg, “Residual generators for fault diagnosis using computation sequences with mixed causality applied to automotive systems,”
*IEEE Transactions on Systems, Man, and Cybernetics. Part A*, vol. 40, no. 6, pp. 1310–1328, 2010. View at Publisher · View at Google Scholar - W. J. Rugh,
*Linear System Theory*, Prentice Hall Information and System Sciences, chapter 13, 1996. - P. F. Odgaard, “Wind turbine benchmark model,” 2011, http://www.kkelectronic.com/Default.aspx?ID=9385.
- M. Staroswiecki and P. Declerck, “Analytical redundancy in non-linear interconnected systems by means of structural analysis,” in
*Proceedings of the IFAC Advanced Information Processing in Automatic Control, (AIPAC’89)*, pp. 51–55, Nancy, France, 1989. - J. P. Cassar and M. Staroswiecki, “A structural approach for the design of failure detection and identification systems,” in
*Proceedings of the IFAC Control of Industrial Systems*, pp. 841–846, Belfort, France, 1997. - M. Staroswiecki, “Structural analysis for fault detection and isolation and for fault tolerant control,” in
*Fault Diagnosis and Fault Tolerant Control*, Encyclopedia of Life Support Systems, Eolss Publishers, 2002. View at Google Scholar - B. Pulido and C. Alonso-González, “Possible conflicts: a compilation technique for consistencybased diagnosis,”
*IEEE Trans. on Systems, Man, and Cybernetics. Part B*, vol. 34, no. 5, pp. 2192–2206, 2004. View at Google Scholar - S. Ploix, M. Désinde, and S. Touaf, “Automatic design of detection tests in complex dynamic systems,” in
*Proceedings of the 16th IFAC World Congress*, vol. 16, pp. 478–483, Prague, Czech Republic, 2005. - L. Travé-Massuyès, T. Escobet, and X. Olive, “Diagnosability analysis based on component-supported analytical redundancy relations,”
*IEEE Transactions on Systems, Man, and Cybernetics. Part A*, vol. 36, no. 6, pp. 1146–1160, 2006. View at Publisher · View at Google Scholar · View at Scopus - M. Krysander and E. Frisk, “Sensor placement for fault diagnosis,”
*IEEE Transactions on Systems, Man, and Cybernetics. Part A*, vol. 38, no. 6, pp. 1398–1410, 2008. View at Publisher · View at Google Scholar · View at Scopus - M. R. Garey and D. S. Johnson,
*Computers and Intractability—A Guide to the Theory of NPCompleteness*, W. H. Freeman and Company, 1979. - F. Gustafsson,
*Adaptive Filtering and Change Detection*, Wiley, 2000. - S. Kullback and R. A. Leibler, “On information and sufficiency,”
*Annals of Mathematical Statistics*, vol. 22, no. 1, pp. 79–86, 1951. View at Google Scholar - M. Nyberg, “Automatic design of diagnosis systems with application to an automotive engine,”
*Control Engineering Practice*, vol. 7, no. 8, pp. 993–1005, 1999. View at Google Scholar · View at Scopus - A. L. Dulmage and N. S. Mendelsohn, “Coverings of bi-partite graphs,”
*Canadian Journal of Mathematics*, vol. 10, pp. 517–534, 1958. View at Google Scholar