Fault-tolerant control for sensor faults affecting an electromechanical railway track switch

Abstract

A fault-tolerant control scheme (FTCS) was developed for a novel mechatronic track switch for the first time. The FTCS was first developed and tested on a simulation model of the system, before being applied to an experimental actuation system in the laboratory. Both the simulation and experimental results show that this FTCS works as expected and allows the switch to continue operating as desired under sensor failure, preventing damage to the switch.

Introduction

Track switches (or points in the UK) are usually a railway network’s only method of transferring rolling stock between routes. Little changed in their basic function since the inception of the railways nearly 200 years ago, ¹ they are a disproportionately large maintenance burden in comparison to the track distance that they occupy. ² They are also a key operational constraint on the network. The major concern with these switches is the large number of ways in which they can have single-aspect critical failures. These failures are currently prevented by costly over-design and burdensome maintenance regimes. ²

There have been many attempts to address these fundamental issues ³ with the support of UK and European rail industry initiatives, ⁴ including the addition of a high-redundancy actuator (HRA) to a traditional switch to improve its reliability. ⁵ One such effort has been the REPOINT (Redundantly Engineered Points) project that transferred safety-critical concepts from the nuclear-power and aerospace sectors, ⁶ chiefly concepts about bi-mode failure and redundancy of actuation and sensing, to track switches. Work over a number of years culminated in both lab-scale demonstrators and a full-scale switch that was installed in a railway and could handle rolling-stock loads. ⁷ At its core, the REPOINT concept uses multiple actuators to replace the single one present in most operational switches. ⁸

With this arrangement, a more complicated control system is required to co-ordinate several feedback position-control systems, rather than the more traditional ‘single open-loop stall current’ detection control methods. ⁹ This newer system includes several feedback signals, each with its own inherent failure mode, requiring robust fault detection, isolation and fault-tolerant control.

Previously, fault-tolerant control (FTC) with fault detection and identification (FDI) has been applied to railway traction machines ¹⁰ and drives,^11,12 a permanent magnet assisted synchronous reluctance motor (PMA-SynRM), ¹³ heavy-haul trains, ¹⁴ an actively controlled railway wheelset ¹⁵ and a magnetic levitation train.^16,17

Previous work by Boghani et al. ³ focussed on methods to enable the design of these new mechatronic railway switches. Other work on these railway switches focussed only on closed-loop (not fault-tolerant) control ⁵ and full-scale testing ⁷ rather than fault tolerant and redundant actuation, which are the focus of this paper.

Outside of a railway context, FTC with Kalman filters has been applied to air-fuel ratio control of combustion engines, ¹⁸ joints of a robotic manipulator ¹⁹ and quadcopters.^20–22 However, these methods have never been applied to a mechatronic railway switch before.

This new actuation paradigm with its redundant actuators and multi-input multi-output nature requires a new FTC approach to ensure safety and actuation requirements are met. This work was motivated by this confluence of factors, and was driven by a desire to devise a FTC system (FTCS) for sensor faults within this unique mechatronic railway switch.

Therefore, the novelty in this paper is the application of online FDI to a mechatronic railway switch. This has not been attempted before, nor has it been implemented in practice to show that the FTCS works as modelled. This paper is formed of four main sections: The Sensor fault detection section covers the fault detection methodology and modelling; The Simulation section covers the simulation results; The Experimental system section demonstrates the experimental validation; with conclusions drawn in The final section.

Sensor fault detection

The mechatronic switch uses sensor feedback to operate the switch, rather than the simpler ‘bang-bang’ control based on limit switches and detection of ‘stall current’ at physical limits used in the control of traditional switches. This results in a reliance on the integrity of these sensors – if sensor faults occur, these could lead to erroneous control action or in extremis instability and catastrophic failure.

Figure 1 shows the proposed layout of the FTCS for the mechatronic switch. The main closed-loop control system is based upon rotary position feedback of the actuator cams in the embedded bearers, this is a cascaded-loop control system system with inner speed and current loops. Details of the sensors can be found in^9,23,24 and details of the controllers applied and tested can be found in. ⁹ To ensure the integrity of the system in the presence of sensing faults, the additional algorithms required are: residual generation (using input and output measurements – discussed in a later subsection); residual evaluation (using the residuals and measured outputs); and fault accommodation (used to modify the controller format if faults are present).

Figure 1.

FTCS overview for mechatronic switch.

This paper focusses on faults in the velocity and position feedback signals. However, the approach is sufficiently general and has been extended to include motor current signals and one or more sensor faults, further details of which are given in. ²⁵

Fault type definitions

Sensor faults, f _s (t), affect actual outputs, y _r (t), to produce measured outputs, y(t). The effects of sensor faults on the measured output can be characterised as either additive

$y\left(t\right)=f_s\left(t\right)+y_r\left(t\right)$

(1)

or multiplicative

$y\left(t\right)=f_s\left(t\right)y_r\left(t\right)$

(2)

depending on the type of fault.^26,27 This paper will discuss disconnect faults, which are multiplicative faults where f _s (t) = 0 for the duration of the fault, as a case study to prove the viability of the novel FTCS.

Residual generation fundamentals

The residuals r _y are defined here as the difference between a measured signal y and the value of an estimated synthetic signal, $\widehat{y}$ .

$r_y\left(t\right)=y\left(t\right)-\widehat{y}\left(t\right)$

(3)

If conditions are ideal, the residuals are nominally zero during normal operation and become non-zero in the event of faults, modelling errors or noise. ²⁸ In this paper, a bank of Kalman-Bucy filters was used to estimate the outputs of the system, and these were compared to measured signals to give the residuals, which were used to determine the presence of a fault.

Kalman filter construction

The Kalman filters use state-space models to estimate the states of the switch

$\dot{x}=\mathbf{A}x+\mathbf{B}u+\mathbf{G}w$

(4)

$y=\mathbf{C}x+v$

(5)

where x is the vector of states, u is the system input, y is the system output, w and v are zero-mean uncorrelated Gaussian process and measurement noise, G is the process noise matrix and A, B and C are matrices defining the evolution of the system. In this case the states used are

$x={\left[i\hspace{1em}\stackrel{.}{{\theta }_m}\hspace{1em}{x}_r\right]}^T$

(6)

where i is the motor current, $\stackrel{.}{{\theta }_m}$ is the motor velocity and x _r is the rack position. The state transition and input matrices are defined as

$\mathbf{A}=\left[\begin{array}{ccc}-R_a/L_a& -K_v/L_a& 0\\ K_t/J_{sum}& D_{sum}/J_{sum}& 0\\ 0& R_g/n& 0\end{array}\right],\mathbf{B}=\left[\begin{array}{c}1/L_a\\ 0\\ 0\end{array}\right]$

(7)

where R _a is the armature resistance, L _a is the armature inductance, K _v is the motor’s back emf constant, K _t is the motor’s torque constant, J _sum is the total rotational inertia of the system, D _sum is the total damping in the system, R _g is the radius of the gearhead and n is the gear ratio of the pinion. The output matrix, C will be defined later. The values for these parameters are given in Table 1.

Table 1.

Model parameter values.

Variable	Value
R a	1.97 Ω
L a	7.9 × 10−3 H
K v	0.490 Vs/rad
K t	0.8 Nm/A
J sum	0.625 × 10−3kgm2
R g	0.04 m
n	70
D sum	1.4 × 10−3 Nms/rad

In an ideal case, where the noise characteristics are known, the process noise covariance, Q, and measurement noise covariance, R, are given by

$\mathbf{Q}=\mathbf{W}\left[w{w}^T\right]$

(8)

$\mathbf{R}=\mathbf{E}\left[v{v}^T\right]$

(9)

In this case, as the noise characteristics were not known, the Q and R weighting matrices were heuristically tuned. The values for these matrices were

$\mathbf{Q}=\left[\begin{array}{ccc}111.11\times {10}^3& 0& 0\\ 0& 0.005& 0\\ 0& 0& 180\times {10}^3\end{array}\right],\mathbf{R}=50$

(10)

The Kalman gain, L, uses the known input u and the output measurements y to generate system output and state estimates $\widehat{y}$ and $\widehat{x}$ , described as

$\widehat{\dot{x}}=\mathbf{A}\widehat{x}+\mathbf{B}u+\mathbf{L}\left(y-\widehat{y}\right)$

(11)

where the optimal estimate of the system outputs $\widehat{y}$ is given by

$\widehat{y}=\mathbf{C}\widehat{x}$

(12)

and L is given by

$\mathbf{L}=\mathbf{P}{\mathbf{C}}^T{\mathbf{R}}_n^{-1}$

(13)

where the covariance matrix P is the solution to an algebraic Ricatti equation. ²⁹

The residuals were generated independently for each of the outputs: velocity, r _vel and position, r _pos , using a Kalman filter for each

$\begin{array}{ccc}{r}_{vel}& =& y_{vel}-C_{vel}\widehat{x}\end{array}$

(14)

$\begin{array}{ccc}{r}_{pos}& =& y_{pos}-C_{pos}\widehat{x}\end{array}$

(15)

where $C_{vel}=\left[0\hspace{1em}1\hspace{1em}0\right]$ and $C_{pos}=\left[0\hspace{1em}0\hspace{1em}1\right]$ .

Fault identification using residuals

Previous research has investigated residual evaluation for fault detection.^26,30,31 In this case, thresholding of the root-mean-square error (RMSE) was chosen to identify faults in a given signal. For each signal, the RMSE was generated for each signal as

$r_{RMSE,j}\left(k\right)=\sqrt{\frac{{\sum }_{i=k-n}^k-r_j^2\left(i\right)}{n}}$

(16)

where j is a sensor type (vel, pos) and r _j (k) is the value of that residual at sample time k. The residuals from each Kalman filter were fed into the thresholding logic for each measurement.

When a residual RMSE is above a given threshold, then a fault flag is raised. Two thresholds were used in this case – an adaptive threshold and a fixed threshold. The fixed threshold T _f is determined using the noise variance, σ², of the outputs when operating in steady state.

A second adaptive threshold, T _a first introduced in, ³² is also used to reduce the occurrence of false resets of the fault flag. Choosing T _f requires compromise, as a threshold that is too low will increase the possibility of false faults being flagged due to noise. If it is too high, then legitimate faults may not be identified. The adaptive threshold is used to reset the fault flag when the system is changing state, in order to reduce the occurrence of false flags. Fault flag generation is based on the logic in Table 2.

Table 2.

Thresholding logic for RMSE evaluation.

Fault flag value	Criteria
1	r RMSE ≥ T f AND r RMSE ≥ T a
0	r RMSE < T f AND r RMSE < T a

Simulation

The techniques as outlined in the previous section were first applied in simulation to determine an ideal level of performance. More details of the dynamic model of the laboratory demonstrator system are given in^9,23,25 and a diagrammatic overview is given in Figure 2. The simulation results shown here focus on multiplicative disconnect faults affecting the position and velocity sensors, as discussed above.

Figure 2.

Schematic showing an overview of the system.

Position fault simulation results

The closed-loop system was set to follow a series of step inputs, moving the actuation system between two positions, repeating every 12s. A position sensor disconnect fault is injected at time t = 1s and the fault is removed at t = 8s, when the sensor is reconnected. The results of this test, without the FTCS active, are given in Figure 3. As a result of the fault, the peak position of the switch is 0.6 m, which is more than 5 times larger than the commanded position of 0.094 m. At t = 8s, the sensor is reconnected and the system quickly moves the rack into the desired position. The middle and lower plots in Figure 3 show that the sensor disconnect fault is quickly identified by the Kalman Filters and the threshold logic and is removed once the sensor is restored.

Figure 3.

Simulation results for position sensor disconnect fault – not accommodated.

Results from the same simulation, with FCTS activated are given in Figure 4. The FCTS detects a fault, due to the growing residual, within 1 ms and replaces the faulty signal with the position estimated by the Kalman filter to allow the switch to continue normal operation. After 8s the sensor is reconnected and the residual drops below the threshold value. Note the dip in the RMSE as the Kalman filter estimate of position crosses over the zero position input from the sensor. This is not low enough to clear the fault flag, and the system continues to use the Kalman filter estimate.

Figure 4.

Simulation results for position sensor disconnect – accommodated.

The centre plot in Figure 4 shows that the fault flag continues, and therefore the FTCS continues to use the Kalman estimate in place of the sensor signal, after the position estimate has been replaced with the now-reconnected sensor. An active control signal – a position change command – is required to disable the fault flag. This occurs at t = 12s when the system returns to a fault-free state and reverts to using the sensor signal.

Velocity fault simulation results

The simulations in the previous section were re-run, replacing the position sensor disconnect fault with a velocity sensor disconnect fault. The velocity sensor disconnect fault is injected from t = 7s to t = 15.5s. The results of these simulations with the FTCS turned off and turned on are shown in Figures 5 and 6, respectively.

Figure 5.

Simulation results for velocity sensor disconnect fault – not accommodated.

Figure 6.

Simulation results velocity sensor disconnect fault – accommodated.

With the FTCS turned off, large oscillations are present in the simulated velocity when the sensor is disconnected. This behaviour would be dangerous and damaging to the real system.

When the FTCS is turned on, the fault flag is raised within 1 ms of the sensor being disconnected as the RMSE exceeds the thresholds. When the flag is raised, the Kalman filter estimate of the velocity is used by the controller in place of the faulty velocity sensor signal. The RMSE drops below the fixed threshold at t = 9s as the true velocity of the system approaches the zero velocity being measured by the faulty sensor. However, the residual has not dropped below the adaptive threshold, and therefore the fault flag remains. Once the sensor has been reconnected and the residuals have dropped below both thresholds, the system clears the fault flag after the start of the next position change command.

The results given in Figures 3–6 show that the FTCS operates as intended and prevents damaging and possibly dangerous errors from occurring in the track switch.

Effects of parameters

At this point, some observations about the various parameters can be made. Firstly, it is clear that the values for the fixed and adaptive thresholds are important: if they are set too high, the residuals will not trigger the FTC mechanism or will trigger it late. If they are set too low, then small differences between the Kalman filter and the real-world device will lead to false triggering of the FTCS.

Secondly, the values for the Q and R matrices are important for determining the behaviour of the Kalman filters. If they do not reasonably approximate the true relationship between the process and measurement noise covariances then the results of the Kalman filters will be inaccurate and could cause the FTCS to become active unnecessarily.

Experimental system

The development of the experimental system is covered in detail in. ²⁵ The main components of the system are: the computer interface running MATLAB and dSPACE control software; the dSPACE control board; associated motor drive cabinet; and the actuator bearer.

Details of the actuator bearer can be seen in Figure 7, highlighting the sensors and their positions.

Figure 7.

REPOINT bearer details.

Position fault experimental results

A position sensor disconnect fault (emulated via a switch) is shown in Figure 8. The fault is injected at 128s, the position fault flag is raised and the reconfigured position estimate replaces the faulty signal within the control loop. The fault flag is raised as expected in the presence of a fault and the fault is accommodated correctly.

Figure 8.

Experimental position sensor disconnect fault – accommodated.

Velocity fault experimental results

Faults on the velocity signals can be accommodated in a similar fashion. A disconnect fault is shown in Figure 9 and specific details of the response are highlighted in Figure 10. The velocity sensor signal is switched to zero at 90s and reconnected at 100s. The velocity fault flag is raised almost instantaneously at fault injection with the control system reconfiguring to accommodate this. Again the fault flag remains high until the position command changes polarity.

Figure 9.

Experimental velocity sensor disconnect fault – accommodated.

Figure 10.

Experimental velocity disconnect fault – accommodated, zoomed.

Comparison to modelling

It can be seen that the results for the constrained failure cases shown above closely follow those produced in simulation, and accommodate issues encountered with noise and modelling variation.

Conclusions

The application of a sensor-fault-tolerant control scheme is effective at mitigating faults or failures in a track switch caused by sensor faults.

Fault-tolerant control is critical for the REPOINT track switch system, due to the closed-loop nature of the control scheme and the safety-critical nature of the system, unlike traditionally actuated systems.

Through application of a residual scheme, the developed fault tolerant control system demonstrated a pragmatic solution that could be applied to a full-scale system. The modelling and demonstration system show good dynamic matching and the Kalman filter based method detects the faults well and provides the means to accommodate the fault by using estimates of the faulty states.