CONTROL RECONFIGURATION AFTER

ACTUATOR FAILURES: THE GENERALISED

VIRTUAL ACTUATOR
Jan Lunze

Ruhr-Universitat Bochum
Institute of Automation and Computer Control
44780 Bochum, Germany
Abstract: Control reconguration concerns the problem of nding a new control
conguration and new controller parameters after faults have brought the nominal
controller out of operation. This paper develops the idea of the generalised virtual
actuator, which is a reconguration block to be inserted between the faulty plant and
the nominal controller. General properties of the recongured closed-loop system like
the separation principle for the generalised virtual actuator are proved and guidelines
are given for the choice of the free parameters. The new reconguration scheme
includes several ideas that have been recently developed for specic situations and
makes it possible to use a uniform reconguration algorithm in all these situations.
The results are illustrated by presenting a solution to the COSY benchmark problem.
Copyright (c) 2006 IFAC
Keywords: Fault-tolerant control, reconguration, actuator failure, virtual actuator
1. INTRODUCTION
Fault-tolerant control aims at retaining a system
in operation after some fault has occurred. Dier-
ent methods have been elaborated in the recent
past to detect and identify faults in a dynamical
system and to adjust the controller to the changes
of the plant dynamics that are brought about by
these faults (cf. Blanke et al 2006).
This paper concerns the reconguration task in
case of actuator failures that make the operation
of the nominal control loop impossible. For actua-
tor failures the adjustment of the controller to the
faulty plant includes the selection of alternative
actuators in order to close the control loop which
has been brought out of operation by the actuator
failures.
This problem is illustrated in Fig. 1 for a tank
system considered later in more detail. For the
nominal plant, the controller uses the input u
2
to bring the tank level to the set-point w. If the
1anl syslom
Lovol
conliolloi
K
2
K
1
K
8
M O
@

Fig. 1: The reconguration problem for a level

controller
actuator associated with the input u
2
is blocked,
the control loop does no longer satisfy its mission
and the controller has to be recongured so as
to use the inputs u
1
and/or u
3
. Clearly, after the
selection of new inputs to be used, the controller
parameters have to be adapted to these inputs.
This paper develops the idea of a generalised
virtual actuator, which adapts both the control
conguration and the controller parameters to the
faulty plant. The virtual actuator is a dynamical
system, which is put between the faulty plant
and the nominal controller. As shown in Fig. 2,
it transforms the output vector u
f
of the faulty
1240
Viilual aclualoi
Faully planl
O
c
Nominal conliolloi
O
f
K
f
K
c
M
Ioconfiguioo
planl
Ioconfiguioo
conliolloi
Fig. 2: Control reconguration by means of a
virtual actuator
plant into the output vector y
c
used by the
controller and the controller output vector u
c
into
the plant input vector u
f
. The virtual actuator
should hide the eects of the actuator failures
from the controller. That is, the recongured
plant, which consists of the faulty plant and the
virtual actuator, should behave like the nominal
plant fault-hiding goal. If this goal is satised,
the nominal controller can be used to control the
faulty plant.
The idea of using a virtual actuator has been
rst proposed in (Lunze and Steen 2002) and
(Blanke et al. 2006) and further developed in
(Lunze and Steen 2006) and (Steen 2005). Two
important properties have been shown in these
references. First, the virtual actuators dened
there ensure that the eects of faulty actuators
can actually be hidden from the controller so
that the nominal controller can be used for the
faulty plant. Second, the design of the virtual
actuator can be done completely automatically
without the intervention of a human operator
and, thus, can be applied under the real-time
constraints of practical control reconguration.
In the recent literature dierent virtual actua-
tors have been dened for dierent situations.
Moreover, the proposed virtual actuators do not
naturally shrink to a static reconguration block if
the recongurability condition given in (Gao and
Antsaklis 1991) are met. Hence, a natural idea is
to develop a virtual actuator that reduces to this
static block unter the recongurability condition
and extends smoothly to a dynamical block if this
condition is violated. Similar investigations have
been published in (Kanev and Verhaegen 2002)
and (Staroswiecki 2002) with the former reference
considering discrete control actions and the latter
proposing to choose the new actuator with respect
to the control energy that is necessary to get a
similar performance of the closed-loop system as
in the nominal case.
After in Section 2 the plant models and the
reconguration problem have been dened, this
paper denes the generalised virtual actuator in
Section 3 and shows in Sections 4 and 5 that
the free parameters of this reconguration block
can be chosen so as to satisfy the fault-hiding
goal as long as the faulty plant is stabilisable
through the remaining actuators. Besides the fact
that this virtual actuator reduces to a static
block if the recongurability condition is met,
the relation of the design of this actuator to the
disturbance decoupling problem investigated in
(Steen 2005) is elaborated. Sections 6 and 7
analyse the recongured loop and give guidelines
for choosing the parameter matrices N and M of
the virtual actuator. Finally, Section 8 illustrates
the generalised virtual actuator by using it to
solve the COSY benchmark problem.
2. THE RECONFIGURATION PROBLEM
Nominal plant is described by the state-space
model
x(t) =Ax(t) +Bu
c
(t) +Ed(t), x(0) = x
0
(1)
y(t) =Cx(t) (2)
with state vector x R
n
, input vector u
c
R
m
,
disturbance vector d R
p
and output vector
y
c
R
r
. For the investigations of dierent failure
modes of the actuators it is important that the
model (1), (2) is set up not only with respect
to the inputs used in the nominal closed-loop
system but also includes redundant inputs. For
the example shown in Fig. 1 all three inputs u
1
, u
2
and u
3
are elements of the input vector u although
the nominal controller uses only the input u
2
.
Hence, the matrix B has three columns. Hence,
the matrix B in the model (1) does not necessarily
have full column rank.
The nominal controller may be an arbitrary dy-
namical system with inputs y
c
and w, where
w R
r
is the reference input, but for analysis
a static output feedback is used:
u
c
(t) = Ky
c
(t) +V w(t) (3)
As the controller uses only a subset of the input
signals u
i
that are included in the vector u, the
matrices K and V usually have zero rows.
The faulty plant distinguishes from the nominal
plant only in the input matrix B, which is changed
to B
f
:
x
f
(t) =Ax
f
(t) +B
f
u
f
(t) +Ed(t) (4)
y(t) =Cx
f
(t). (5)
In this model the control input is denoted by
u
f
and the output by y
f
in order to distinguish
between the input and output of the nominal and
of the faulty plant. The matrix B
f
has vanishing
columns for all failed actuators. For example, in
the control problem shown in Fig. 2 the second
column of the matrix B
f
is zero if the actuator
associated to the input signal u
2
fails. Then the
1241
nominal controller, which uses only this input,
does not inuence the plant any more.
This paper concerns the situation where the fail-
ure of one or more actuators has been detected
and, hence, the model (4), (5) of the faulty plant
is known. The reconguration should be accom-
plished by introducing a virtual actuator between
the faulty plant and the nominal controller such
that the following aims are satised:
Fault-hiding goal: The recongured plant
should have the same input-output behaviour
with respect to input u
c
and output y
c
as the
nominal plant.
Stability: The recongured closed-loop sys-
tem should be stable.
It is obvious that if the virtual actuator satises
the fault-hiding goal the closed-loop system has
the same behaviour with respect to the command
input w and output y
c
as the nominal loop. How-
ever, it has to be investigated, which behaviour
the closed-loop system has with respect to the
disturbance input d.
3. DEFINITION OF THE GENERALISED
VIRTUAL ACTUATOR
Faully planl

*
f
-
@
)
+
Viilual Aclualoi

*
f

)
+
*
,
-
K
f
N
f
O
f
N
,
O
,
K
,
Nominal conliolloi
O
c
M
K
c
Fig. 3: Closed-loop system including the generalised
virtual actuator
Denition 3.1. Consider the faulty plant (4), (5).
The generalised virtual actuator is dened by
x

=A

+B

, x

(0) = x
0
(6)
u
f
=C

+D

u
c
(7)
y
c
=C
y
x

+y
f
(8)
with the state x

R
n
and the matrices
A

=AB
f
M (9)
B

=B B
f
N (10)
C

=M (11)
D

=N. (12)
M and N denote matrices that can be freely
chosen.
4. ANALYSIS OF THE RECONFIGURED
PLANT
This section shows that the recongured plant has
the same input-output behaviour as the nominal
plant with respect to the input u
c
and the output
y
c
. In this analysis the disturbance is ignored.
If the faulty plant (4), (5) is combined with the
virtual actuator (6) (12), the following model of
the recongured plant is obtained:

x
f
x

A B
f
M
O AB
f
M

x
f
x

B
f
N
B B
f
N

u
c

x
f
(0)
x

(0)

x
0
x
0

(13)
y
c
=(C C)

x
f
x

(14)
After the state transformation

x
x

I I
O I

x
f
x

with T
1
=

I I
O I

(15)
the transformed system

x
x

A O
O AB
f
M

x
x

B
B B
f
N

u
c

x(0)
x

(0)

x
0
x
0
x
0

(16)
y
c
=(C O)

x
x

(17)
results. As the state x

is not observable, the

model reduces to
x(t) =Ax(t) +Bu
c
(t), x(0) = x
0
x
0
y
c
(t) =Cx(t).
This model is identical to the nominal plant
provided that x
0
= 0 holds. Hence, the virtual
actuator yields a recongured plant that satises
the fault-hiding goal for arbitrary M and N.
Theorem 4.1. The recongured plant (13), (14)
has the same input-output behaviour as the nom-
inal plant (1, (2) for arbitrary parameter matrices
M and N of the virtual actuator.
1242
5. SEPARATION PRINCIPLE FOR THE
VIRTUAL ACTUATOR
This section shows that the recongured closed-
loop system has two sets of eigenvalues, where
one is determined by the feedback matrix M of
the virtual actuator whereas the other is identical
to the eigenvalue set of the nominal closed-loop
system. This fact is called the separation principle
of the virtual actuator.
The following analysis is not restricted to a static
output feedback (3) and can be easily extended to
any dynamic feedback. The recongured closed-
loop system consists of the recongured plant
(13), (14) and the controller (3), both of which
are considered for vanishing disturbance d and
command input w. If the transformed model (16),
(17) is used, the recongured closed-loop system
is described by

x
x

ABCC O
B

KC AB
f
M

x
x

x(0)
x

(0)

x
0
x
0
x
0

As the system matrix is a block diagonal matrix,

the following result is obtained:
Theorem 5.1. Separation principle for the
virtual actuator. The set of eigenvalues of
the recongured closed-loop system (13), (14), (3)
consists of the set of eigenvalues of the nominal
closed-loop system (1), (2), (3) and the set of
eigenvalues of the virtual actuator (6).
This theorem holds true for arbitrary matrices
M and N of the virtual actuator. Clearly, a
corollary of this theorem is that the matrix M
has to be chosen so that the matrix M B
f
M
has eigenvalues with negative real parts in order
to ensure the stability of the recongured closed-
loop system. Hence, the stabilisation goal can be
satised by using the generalised virtual actuator
as long as the faults plant is stabilisable.
Corollary 5.1. The stability of the recongured
closed-loop system can be ensured by appropri-
ately choosing the matrix M of the virtual actu-
ator if and only if the pair (A, B
f
) is stabilisable
(cf. (Lunze 1997)).
6. ANALYSIS OF THE RECONFIGURED
CLOSED-LOOP SYSTEM
If the models of the faulty plant (4), (5) is com-
bined with the virtual actuator (6) (8) and the
controller (3), the following model is obtained af-
ter the state transformation (15) has been applied:

x
x

ABKC O
B

KC AB
f
M

x
x

BV
B

w +

E
O

d (18)

x(0)
x

(0)

x
0
x
0
x
0

y
c
=(C O)

x
x

(19)
y
f
=(C C)

x
x

. (20)
In the block diagram shown in Fig. 4, the lower
block represents the nominal closed-loop system.
The control error e = V w y
c
is feed into the
dierence system
x

=(AB
f
M)x

+B

e, x

(0) = x
0
y

=Cx

, (21)
whose name results from its output y

, which
is the dierence between the output y
c
of the
nominal closed-loop system. Hence, y

shows how
the recongured closed-loop system diers from
the nominal loop.
Diffoionco syslom

*
f

)
+
Nominal closoo-loop syslom

*
-
)
+ 8

-
K
f
O
f
N
,
O
,
*
,
-
M
@
N
O
c
A
Fig. 4: Transformed closed-loop system showing the
separation principle
This model yields two corollaries:
The input-output behaviour with respect to
the disturbance input d or the command
input w and to the output y
c
is identical to
the corresponding input-output behaviour of
the nominal closed-loop system.
The input-output behaviour with respect to
the disturbance input d or the command
input w and to the output y
f
diers from
that of the nominal closed-loop system due
to the inuence of the dierence system (21).
1243
7. DESIGN OF THE VIRTUAL ACTUATOR
This section concerns the question how to choose
the matrices M and N in order to get a small dif-
ference y

between the behaviours of the nominal

and the recongured closed-loop system. Is also
shows how earliser reconguration approaches re-
late to the generalised virtual actuator.
Complete reconguration. Fig. 4 and eqn. (21)
yield the following result:
Corollary 7.1. If N can be chosen such that
B

= B B
f
N = O (22)
holds, the input-output behaviour of the recon-
gured closed-loop system is identical to that of
the nominal control loop for both the disturbance
input d and the command input w. Furthermore,
if x

(0) = 0 hold, the recongured loop has the

same free motion as the nominal loop.
The condition (22) can be satised for an arbi-
trary controller (3) if and only if the relation
Rank B
f
= Rank (B B
f
) (23)
holds. This condition claims that the columns
belonging to the failed actuators are linearly de-
pendent upon the remaining columns of B
f
. Then
the eect of the failed actuators can be precisely
replaced by using other actuators and the recon-
guration is complete.
For B

= O the dierence system is not con-

trolled and can be deleted from the representation
of the recongured closed-loop system. Hence, the
virtual actuator (6), (8) reduces to the static re-
conguration block
u
f
(t) =Nu
c
(t), y
c
(t) = y
f
(t), (24)
which is identical to the reconguration solution
described in (Gao and Antsaklis 1991).
If the condition (23) is violated, the pseudo-
inverse method published in (Gao and Antsaklis
1991) proposes to use the pseudo-inverse solution
N = B
+
f
B (25)
with B
+
f
denoting the pseudoinverse of B
f
.
Design of the virtual actuator by distur-
bance decoupling methods. If the transfer
function matrix
G(s) =C(sI A+B
f
M)
1
(B B
f
N)(26)
of the dierence system vanishes, the recongu-
ration is complete as well. Then the dierence
model (21) has a vanishing output. To select the
matrices N and M such that the condition (26)
holds is a disturbance decoupling problem for
known disturbance u
c
. It has been shown in (Stef-
fen 2005) that the solution to this problem yields
a complete reconguration. This solution exist,
however, only under restrictive conditions.
Restoration of the static behaviour. The
static behaviour is completely reconstructed if
the static reinforcement of the dierence system
vanishes:
G(0) = C(AB
f
M)
1
(B B
f
N) = O.
Approximate solution. The generalised virtual
actuator has the property that the eect of the
virtual actuator disappears if the matrix B

can be made very small by choosing the matrix

N appropriately.
Corollary 7.2. For B

0, the behaviour of
the recongured closed-loop system approaches
that of the nominal loop: y
c
y
f
0.
8. EXAMPLE: THE COSY BENCHMARK
PROBLEM
The reconguration by means of the generalised
virtual actuator is illustrated by solving the
COSY benchmark problem proposed by (Heiming
and Lunze 1999). For the solution given here, the
problem can be reduced to the two tanks. During
the nominal operation there exist two level con-
trollers, where the set-point to the left controller
is the input u
1
. The right controller uses the upper
valve, whose position is given by the input u
2
. A
redundant control input is provided by the lower
valve with input signal u
3
. The right controller
has to attenuate the disturbance d and to hold
the tank level at a given value w
2
.
The linearised model (1), (2) is obtained with
A=

0.0478 0.0004 0
1.0000 0 0
0.0058 0 0.0058

B=

0.0406 0.0058 0.0092

1.0000 0 0
0 0.0046 0.0073

C =(0 0 1), E =

0
0
0.0454

Is is assumed that the upper valve fails and

is remains completely closed. Then the second
1244
column in the matrix B has to be set to zero to
obtain the matrix B
f
.
Static reconguration. A complete recongu-
ration of the controller is possible, because the
condition (23) is satised. Hence, the recong-
uration is possible with a static reconguration
block (24)
u
f
=

0 0 2.7039
0 0 0.6325
0 0 1

u
c
.
0
0.1
0.2
0.3
0.4

h
2

i
n

m
0 200 400 600 800
0
0.5
1
Time in sec
u
2
,

u
3
Fig. 5: Behaviour of the recongured closed-loop
system where the recongured controller uses the
input u
3
Figure 5 shows that the right tank has the same
behaviour with the recongured controller as in
the nominal case. In the lower subplot the control
input u
3
used by the recongured controller is
compared to the input u
2
of the nominal con-
troller, which is shown by the dashed lines.
Reconguration by means of the gener-
alised virtual actuator. Alternatively, assume
that the lower valve is not available for the re-
conguration. Then the right controller has only
the command input u
1
of the left controller as
its disposal. With the third columns deleted, the
matrices B and B
f
do no longer satisfy the con-
dition (23) and a dynamic reconguration block
has to be used. For the matrix
N =

1 0.0002 .0.0004
0 0 0
0 0 0

of the virtual actuator the nominal closed-loop

system has the eigenvalues 0.0427, 0.0124
0.0058i. Therefore, the matrix M of the virtual
actuator should place the eigenvalues of the ma-
trix AB
f
M to the left of these eigenvalues, say
at 0.05, 0.06 and 0.07:
M =

0.9968 0.0048 0.0002

0 0 0
0 0 0

.
0
0.1
0.2
0.3
0.4

h
2

i
n

m
0 200 400 600 800
0
0.5
1
Time in sec
u
1
Fig. 6: Behaviour of the recongured closed-loop
system where the recongured controller uses the
input u
1
Figure 6 shows the disturbance behaviour of the
tank system after the controller has been extended
by a virtual actuator that uses the input u
1
.
The response is slower than the nominal response,
which is drawn by dashed lines to make a compar-
ison possible. The slower response results from the
fact that the controller of the right tank uses now
the command input of the controller of the left
tank as control input.
9. REFERENCES
Blanke, M.; Kinnaert, M.; Lunze, J. and Staroswiecki,
M.: Diagnosis and Fault-Tolerant Control, 2nd
edition, Springer, Heidelberg 2006.
Gao, Z. and Antsaklis, P. J.: Stability of the
pseudo-inverse method for recongurable control
systems. International Journal of Control, 53:717
729, 1991.
Heiming. B. and Lunze, J.: Denition of the three-
tank benchmark problem for controller recong-
uration. In European Control Conference, Karl-
sruhe 1999.
Kanev, S. and Verhaegen, M.: Recongurable ro-
bust fault-tolerant control and state estimation.
paper no. 2542. IFAC Congress, Barcelona 2002.
Lunze, J.: Regelungstechnik, Band 2. Springer
Verlag Berlin, 1997.
Lunze, J. and Steen, T.: Rekonguration linearer
Systeme bei Sensors- und Aktorausfall. Automa-
tisierungstechnik, 2002a.
Lunze, J. and Steen, T.: Control reconguration
after actuator failures using disturbance decou-
pling methods IEEE Trans. AC (to be published
in September 2006).
Staroswiecki, M.: On recongurability with re-
spect to actuator failures. paper no. 775. IFAC
Congress, Barcelone 2002.
Steen, T.: Control Reconguration of Dynamical
System: Linear Approaches and Structural Tests,
Springer-Verlag, Heidelberg 2005.
1245