A structural method for the design of fault tolerant distributed control systems

Distributed digital control systems provide alternatives to conventional, centralised digital control systems. Typically, a modern distributed control system will comprise a multi-processor or network of processors, a communications network, an associated set of sensors and actuators, and the systems and applications software. This thesis addresses the problem of how to design robust decentralised control systems, such as those used to control event-driven, real-time processes in time-critical environments. Emphasis is placed on studying the dynamical behaviour of a system and identifying ways of partitioning the system so that it may be controlled in a distributed manner. A structural partitioning technique is adopted which makes use of natural physical sub-processes in the system, which are then mapped into the software processes to control the system. However, communications are required between the processes because of the disjoint nature of the distributed (i.e. partitioned) state of the physical system. The structural partitioning technique, and recent developments in the theory of potential controllability and observability of a system, are the basis for the design of controllers. In particular, the method is used to derive a decentralised estimate of the state vector for a continuous-time system. The work is also extended to derive a distributed estimate for a discrete-time system. Emphasis is also given to the role of communications in the distributed control of processes and to the partitioning technique necessary to design distributed and decentralised systems with resilient structures. A method is presented for the systematic identification of necessary communications for distributed control. It is also shwon that the structural partitions can be used directly in the design of software fault tolerant concurrent controllers. In particular, the structural partition can be used to identify the boundary of the conversation which can be used to protect a specific part of the system. In addition, for certain classes of system, the partitions can be used to identify processes which may be dynamically reconfigured in the event of a fault. These methods should be of use in the design of robust distributed systems.

Real-time process plant fault diagnosis

Operators can become confused while diagnosing faults in process plant while in operation. This may prevent remedial actions being taken before hazardous consequences can occur. The work in this thesis proposes a method to aid plant operators in systematically finding the causes of any fault in the process plant. A computer aided fault diagnosis package has been developed for use on the widely available IBM PC compatible microcomputer. The program displays a coloured diagram of a fault tree on the VDU of the microcomputer, so that the operator can see the link between the fault and its causes. The consequences of the fault and the causes of the fault are also shown to provide a warning of what may happen if the fault is not remedied. The cause and effect data needed by the package are obtained from a hazard and operability (HAZOP) study on the process plant. The result of the HAZOP study is recorded as cause and symptom equations which are translated into a data structure and stored in the computer as a file for the package to access. Probability values are assigned to the events that constitute the basic causes of any deviation. From these probability values, the a priori probabilities of occurrence of other events are evaluated. A top-down recursive algorithm, called TDRA, for evaluating the probability of every event in a fault tree has been developed. From the a priori probabilities, the conditional probabilities of the causes of the fault are then evaluated using Bayes' conditional probability theorem. The posteriori probability values could then be used by the operators to check in an orderly manner the cause of the fault. The package has been tested using the results of a HAZOP study on a pilot distillation plant. The results from the test show how easy it is to trace the chain of events that leads to the primary cause of a fault. This method could be applied in a real process environment.

Expert systems for fault tree synthesis

Hazard and operability (HAZOP) studies on chemical process plants are very time consuming, and often tedious, tasks. The requirement for HAZOP studies is that a team of experts systematically analyse every conceivable process deviation, identifying possible causes and any hazards that may result. The systematic nature of the task, and the fact that some team members may be unoccupied for much of the time, can lead to tedium, which in turn may lead to serious errors or omissions. An aid to HAZOP are fault trees, which present the system failure logic graphically such that the study team can readily assimilate their findings. Fault trees are also useful to the identification of design weaknesses, and may additionally be used to estimate the likelihood of hazardous events occurring. The one drawback of fault trees is that they are difficult to generate by hand. This is because of the sheer size and complexity of modern process plants. The work in this thesis proposed a computer-based method to aid the development of fault trees for chemical process plants. The aim is to produce concise, structured fault trees that are easy for analysts to understand. Standard plant input-output equation models for major process units are modified such that they include ancillary units and pipework. This results in a reduction in the nodes required to represent a plant. Control loops and protective systems are modelled as operators which act on process variables. This modelling maintains the functionality of loops, making fault tree generation easier and improving the structure of the fault trees produced. A method, called event ordering, is proposed which allows the magnitude of deviations of controlled or measured variables to be defined in terms of the control loops and protective systems with which they are associated.

Expert systems for fault analysis

The initial aim of this research was to investigate the application of expert Systems, or Knowledge Base Systems technology to the automated synthesis of Hazard and Operability Studies. Due to the generic nature of Fault Analysis problems and the way in which Knowledge Base Systems work, this goal has evolved into a consideration of automated support for Fault Analysis in general, covering HAZOP, Fault Tree Analysis, FMEA and Fault Diagnosis in the Process Industries. This thesis described a proposed architecture for such an Expert System. The purpose of the System is to produce a descriptive model of faults and fault propagation from a description of the physical structure of the plant. From these descriptive models, the desired Fault Analysis may be produced. The way in which this is done reflects the complexity of the problem which, in principle, encompasses the whole of the discipline of Process Engineering. An attempt is made to incorporate the perceived method that an expert uses to solve the problem; keywords, heuristics and guidelines from techniques such as HAZOP and Fault Tree Synthesis are used. In a truly Expert System, the performance of the system is strongly dependent on the high quality of the knowledge that is incorporated. This expert knowledge takes the form of heuristics or rules of thumb which are used in problem solving. This research has shown that, for the application of fault analysis heuristics, it is necessary to have a representation of the details of fault propagation within a process. This helps to ensure the robustness of the system - a gradual rather than abrupt degradation at the boundaries of the domain knowledge.

The design of fault tolerant software for loosely coupled distributed systems

Requirements for systems to continue to operate satisfactorily in the presence of faults has led to the development of techniques for the construction of fault tolerant software. This thesis addresses the problem of error detection and recovery in distributed systems which consist of a set of communicating sequential processes. A method is presented for the `a priori' design of conversations for this class of distributed system. Petri nets are used to represent the state and to solve state reachability problems for concurrent systems. The dynamic behaviour of the system can be characterised by a state-change table derived from the state reachability tree. Systematic conversation generation is possible by defining a closed boundary on any branch of the state-change table. By relating the state-change table to process attributes it ensures all necessary processes are included in the conversation. The method also ensures properly nested conversations. An implementation of the conversation scheme using the concurrent language occam is proposed. The structure of the conversation is defined using the special features of occam. The proposed implementation gives a structure which is independent of the application and is independent of the number of processes involved. Finally, the integrity of inter-process communications is investigated. The basic communication primitives used in message passing systems are seen to have deficiencies when applied to systems with safety implications. Using a Petri net model a boundary for a time-out mechanism is proposed which will increase the integrity of a system which involves inter-process communications.

Direct current ripple compensation for multi-phase fault-tolerant machines

A second-harmonic direct current (DC) ripple compensation technique is presented for a multi-phase, fault-tolerant, permanent magnet machine. The analysis has been undertaken in a general manner for any pair of phases in operation with the remaining phases inactive. The compensation technique determines the required alternating currents in the machine to eliminate the second-harmonic DC-link current, while at the same time minimising the total rms current in the windings. An additional benefit of the compensation technique is a reduction in the magnitude of the electromagnetic torque ripple. Practical results are included from a 70 kW, five-phase generator system to validate the analysis and illustrate the performance of the compensation technique.

A series-dynamic-resistor-based converter protection scheme for doubly-fed induction generator during various fault conditions

This paper proposes a new converter protection method, primarily based on a series dynamic resistor (SDR) that avoids the doubly-fed induction generator (DFIG) control being disabled by crowbar protection during fault conditions. A combined converter protection scheme based on the proposed SDR and conventional crowbar is analyzed and discussed. The main protection advantages are due to the series topology when compared with crowbar and dc-chopper protection. Various fault overcurrent conditions (both symmetrical and asymmetrical) are analyzed and used to design the protection in detail, including the switching strategy and coordination with crowbar, and resistance value calculations. PSCAD/EMTDC simulation results show that the proposed method is advantageous for fault overcurrent protection, especially for asymmetrical faults, in which the traditional crowbar protection may malfunction.

Multiterminal DC wind farm collection grid internal fault analysis and protection design

The multiterminal dc wind farm is a promising topology with a voltage-source inverter (VSI) connection at the onshore grid. Voltage-source converters (VSCs) are robust to ac-side fault conditions. However, they are vulnerable to dc faults on the dc side of the converter. This paper analyzes dc faults, their transients, and the resulting protection issues. Overcurrent faults are analyzed in detail and provide an insight into protection system design. The radial wind farm topology with star or string connection is considered. The outcomes may be applicable for VSCs in the multi-VSC dc wind farm collection grid and VSC-based high-voltage direct current (HVDC) offshore transmission systems.

Short-circuit and ground fault analyses and location in VSC-based DC network cables

The application of high-power voltage-source converters (VSCs) to multiterminal dc networks is attracting research interest. The development of VSC-based dc networks is constrained by the lack of operational experience, the immaturity of appropriate protective devices, and the lack of appropriate fault analysis techniques. VSCs are vulnerable to dc-cable short-circuit and ground faults due to the high discharge current from the dc-link capacitance. However, faults occurring along the interconnecting dc cables are most likely to threaten system operation. In this paper, cable faults in VSC-based dc networks are analyzed in detail with the identification and definition of the most serious stages of the fault that need to be avoided. A fault location method is proposed because this is a prerequisite for an effective design of a fault protection scheme. It is demonstrated that it is relatively easy to evaluate the distance to a short-circuit fault using voltage reference comparison. For the more difficult challenge of locating ground faults, a method of estimating both the ground resistance and the distance to the fault is proposed by analyzing the initial stage of the fault transient. Analysis of the proposed method is provided and is based on simulation results, with a range of fault resistances, distances, and operational conditions considered.

"It's not my fault - but only I can change it":counterfactual and prefactual thoughts of managers

In testing for the self-serving bias in performance evaluation, the authors propose that comparing managers' counterfactual and prefactual thoughts about subordinates' performance is more conclusive than the attributional approach and also offers practical advantages. In a study with 120 managers, a 4-way interaction of subordinate performance, temporal perspective, direction, and reference confirmed the predicted pattern. Managers' thoughts about how a weak performance could have been enhanced had external references, but thoughts about how such a performance could be enhanced in the future focused on the leader. This asymmetry was only observed for weak performance. Results are discussed with regard to biases in leaders' performance evaluations and to how counter- and prefactual thoughts could be used for leadership research and practice.

Single-phase active rectifier selection for fault tolerant machine

A fault tolerant, 5-phase PM generator has been developed for use on the low pressure (LP) shaft of an aircraft gas turbine engine. The machine operates at variable speed and therefore has a variable voltage, variable frequency electrical output (VVVF). The generator is to be used to provide a 350V DC bus for distribution throughout the aircraft, and a study has been carried out that identifies the most suitable AC-DC converter topology for this machine in terms of losses, electrical component ratings, filtering requirements and circuit complexity.

Protection issue discussion of DC network development:circuit breaker or fault-tolerant converter

This paper provides a discussion on future direct current (DC) network development in terms of system protection under DC-side fault scenarios. The argument between appropriate DC circuit breaker and new DC fault-tolerant converters is discussed after a review on DC technology development and bottleneck issues that require proper solutions. The overcurrent/cost curve of power-electronic DC circuit breakers (CB) superimposed to voltage-source converter (VSC) systems is derived and compared with other possible fault-tolerant power conversion options. This in-advance planning of protection capability is essential for the future development of DC networks.

Permanent magnet synchronous generator based wind power generation system fault protection schemes

The PMSG-based wind power generation system protection is presented in this paper. For large-scale systems, a voltagesource converter rectifier is included. Protection circuits for this topology are studied with simulation results for cable permanent fault conditions. These electrical protection methods are all in terms of dumping redundant energy resulting from disrupted path of power delivery. Pitch control of large-scale wind turbines are considered for effectively reducing rotor shaft overspeed. Detailed analysis and calculation of damping power and resistances are presented. Simulation results including fault overcurrent, DC-link overvoltage and wind turbine overspeed are shown to illustrate the system responses under different protection schemes to compare their application and effectiveness.

Central-tapped node linked modular fault-tolerance topology for SRM applications

Electric vehicles (EVs) and hybrid electric vehicles (HEVs) can reduce greenhouse gas emissions while switched reluctance motor (SRM) is one of the promising motor for such applications. This paper presents a novel SRM fault-diagnosis and fault-tolerance operation solution. Based on the traditional asymmetric half-bridge topology for the SRM driving, the central tapped winding of the SRM in modular half-bridge configuration are introduced to provide fault-diagnosis and fault-tolerance functions, which are set idle in normal conditions. The fault diagnosis can be achieved by detecting the characteristic of the excitation and demagnetization currents. An SRM fault-tolerance operation strategy is also realized by the proposed topology, which compensates for the missing phase torque under the open-circuit fault, and reduces the unbalanced phase current under the short-circuit fault due to the uncontrolled faulty phase. Furthermore, the current sensor placement strategy is also discussed to give two placement methods for low cost or modular structure. Simulation results in MATLAB/Simulink and experiments on a 750-W SRM validate the effectiveness of the proposed strategy, which may have significant implications and improve the reliability of EVs/HEVs.