Integrated Health Monitoring for the actuation system of high-speed tilting trains

Tilting trains are designed to reach high speed on pre-existing railroads without the need of adjusting the tracks geometry or building dedicated lines; the tilting of the carbody keeps an acceptable level of comfort by limiting the lateral acceleration felt by passengers when the train runs along curved tracks with speed higher than the balance speed built into the curve geometry. As such, they are often used to reduce travel times on routes with several curves. Tilting is performed through a position-controlled actuation system which operates according to the commands received from the train control system: in the studied configuration, the torque needed to tilt the car body with respect to the bogie is provided by a series of hydraulic actuators, while the position information used to close the control loop comes from two capacitive sensors located in the front and rear part of each vehicle. Tilt angle measurement is vital for the system operation and for ensuring a safe ride; the traditional solution in case of discrepancy between the signals of the two tilt angle sensors of any vehicle is to disable the tilting function while limiting the train speed to avoid issues during changes of direction. In a similar fashion, the failure in one (or more) of the tilting actuators would result in the loss of the tilting capability and the return to a fixed configuration operating at reduced speed. It should be noticed that the negative impact of the loss of the tilting system is not limited to the faulty train, since it might affect the entire traffic schedule on the interested lines. The paper presents an integrated Health Monitoring framework that makes intelligent use of all available information thus enhancing the system availability, allowing its operation even in presence of faulty sensors and detecting the onset of failures in the actuation system. At the same time its use can facilitate maintenance organization, simplify the spare parts logistics and provide help to the traffic management. The proposed framework has been developed taking advantage of a high-fidelity model of the physical system validated through comparison with experimental mission profiles on the Lichtenfels - Saalfeld and Battipaglia - Reggio Calabria routes, which have been used by the train manufacturer to assess the performance of their tilting trains.


INTRO DUCTIO N
Tilting trains perform car body tilting towards curve's inner side to reduce centrifugal force at passengers' level during curves, hence acting to maintain a better or equivalent passenger comfort with respect to the lateral acceleration, and the consequent lateral fo rce, on same curves' geometry at enhanced service speed.Hence tilting technology allows to operate at speeds higher than those acceptable to passengers in a non-tilting vehicle, thus reducing the overall trip time.Moreover, the significant increase of the achievable service speed for passenger trains can be obtained on existing tracks without the need of further investments on new dedicated tracks or on operations to alter the geo metry of the existing curves (Boon & Hayes, 1992).
Figure 1.Scheme of a hydraulic power generation and position control system for tilting trains As such, tilting trains are of common applicat ion on fairly old routes with several curves and found a fair ly wide diffusion in Europe and Japan.Examples of both hydraulic and electro mechanical technologies can be found for the actuation systems used to provide the force necessary to perform the tilting operations and to actively control the tilt angle of the carbodies of the train vehicles .The first tilt ing trains used hydraulic actuation technology, then the preference seemed to veer towards electromechanical actuation.The recent trend for most of the recent tilt ing trains is to make again use of the hydraulic technology; combin ing new and legacy vehicles, authors focused on the hydraulic system.A general scheme for an hydraulic actuation system is reported in Fig. 1 (Jacazio, Risso, Sorli, & To mmasini, 2012).A proper nu mber of hydraulic linear actuators is supplied by the controlled hydraulic flow coming fro m the hydraulic power generation units located at the center of each train vehicle.Each hydraulic power unit features one electrically driven pump, one main accumulator, a tank, filters and a proper set of control and protection valves.The carbody tilt angle generated by the actuators movement is measured by two angular position sensors for each train vehicle.Each train vehicle is provided with its own hydraulic power generation and control unit (HPGCU), usually located in a central position, four hydraulic actuators on each tilting carbody and the pipework interconnecting the actuators with the HPGCU.The hydraulic actuators are placed near the front and rear end of the vehicle, on the right and left side, and operate in a pushpull arrangement with the actuators on one side extending while the others retract, depending on the direction of the commanded tilt angle.The HPGCU is dedicated to generating and control the pressurized flu id flow for the hydraulic actuators, to avoid debris deposition in the lines and to keep the fluid temperature in check.Moreover, it is designed to ensure the passengers' safety in case of failure of one or more co mponents of the tilting actuation system.The flow-rate is generated by a variable displacement pump driven by a brushless-DC motor; a p ressure compensation is used to enhance the pump's efficiency (Jacazio et al., 2012).An electrohydraulic servo-valve operates as the interface between the HPGCU and the actuators, modulating the hydraulic power as demanded by the system control loop .This system is based on a closed position loop operating on the tilt angle; the reference signal is computed as a function of the lateral acceleration acting on each train vehicle and sensed through a set of accelero meters, wh ile the feedback is the measure of the carbody tilt angle provided by two angular position sensors for each vehicle.The control law, reported in Fig. 2, is based on a PID regulator; wh ile the proportional and derivative contribution are responsible for the system dynamics, the integrative part is needed only to compensate for the steady state, or slow varying offsets in the servo-valve, that may result in leakages and hence in slow uncommanded movements of the actuators .As such, the integrative gain is significantly lower than the others, its output saturated to avoid overshoots and its input subjected to a small dead-band.
The control system can be classified as single-hydraulic and dual-electrical; it makes use of a single electrohydraulic servo-valve with independent electrical coils accepting the control currents from two independent control computers.Each co mputer interfaces with one of the two tilt angle sensors and mutually exchanges with the other co mputer the informat ion on the angle position and current values as well as the computer health status.Each co mputer can thus generate an equal consolidated position feedback based on the average of the two tilt angle sensors signals, or can use the remaining single signal after a tilt angle sensor failure has been recognized and the signal fro m that sensor is then ignored.

CO NSIDERATIO NS ON POSITIO N SENSORS
Different types of position sensors can be theoretically used to measure the t ilt angle o f each carbody; however, environmental, interface and cost issues limit the choice of sensors to very few types.The most common solution is to emp loy capacitive transducers; the same choice has hence been adopted for the present study.This class of position sensors is based in principle over the measure of the variation of an electrical capacitance.Several types of capacitive sensors exist, each transforming the displacement to be measured into a variation of the capacitance C (Bishop, 2007).Some operate on the distance d between the two plates of the capacitor, others act varying the interface frontal area A. The capacitance variation is usually measured through a current bridge or a tank circuit.Although these sensors proved to be suitable to measure the carbody tilt angle and have a fairly good reliability record in revenue service, they remain prone to a large array of failure modes that are difficult to diagnose during service.Failures such as a broken wire or a short circuit lead to an out of scale signal and can be easily detected by a monitoring logic, but other degradations causing variations of the sensor gain, increased offsets or linearity errors are more subtle events that cannot be detected by the traditional mon itoring routines.In order to counter the possibility of an undetected sensors failure, the existing tilt ing trains have their vehicles equipped with dual redundant sensors, so that a comparison between the two sensors' signals can be made.Any anomalous behavior will thus originate a difference between the output signals of the two sensors; an alert is hence generated by the monitoring logic, usually lead ing to the loss of the tilt ing capability and to limitation over the train speed.

ACTUAL TECHNIQ UES FO R ASSESSING SENSORS HEALTH
Failures of the carbody sensors are usually detected by monitoring their signals; in particular, a failure alert is generated if the sensors outputs fall outside a pre-defined valid range, or if the difference between signals of redundant sensors overcome a predetermined threshold.If the latter condition occurs, the traditional health management system is not ab le to d istinguish the healthy sensor fro m the failed one and the position feedback, obtained by performing the average of the sensors signals, is obviously corrupted and affects the position control.The system operation is hence disabled, wh ich entails the loss of tilt ing capability and the reduction of the t rain speed to ensure a co mfortable and safe t ravel, with consequent service delay.If the monitoring logic is able to detect the failed sensor, the carbody tilting operation could be still possible in principle by excluding the corrupted signal and hence using the healthy sensor feedback to close the position control loop.Though possible, current practice is to anyhow disable the carbody tilting operation and reduce the train speed to avoid the occurrence of hazardous conditions that would be originated by a subsequent undetected failure of the remaining tilt sensor within the same vehicle.The occurrence of this co mbination of failu res during a single train ride is unlikely, but the potential consequences of an uncontrolled tilt ing movement can be so severe to recommend the deactivation of the tilt functions, in absence of any advanced health management system.The tilt ing trains in revenue service feature several different configurations, with the number of vehicles ranging from three to ten.Considering a mediu m-size train co mprised of seven vehicles, the failure of one sensor out of 14 brings to the complete loss of the tilt ing capability.As such, despite the high reliab ility of each single capacitive sensors emp loyed to measure the tilt angle, the predicted availability of the tilt ing system is much lower, hence justifying the research for novel solutions allo wing to safely enable the tilt ing operations in presence of a failed sensor.The most straight-forward option is to add another sensor for each carbody.This solution would allow to perform a majority voting among the sensors and to continue the tilt operation while conserving a (reduced) degree of redundancy after a first failure .A few drawbacks related to the tilting control electronics make th is solution inconvenient.The control electronics is based on a dual architecture featuring independent electronic cards, each interfaced with a single sensor while mutually exchanging data.If one of the control unit sections is modified to accept and process the additional signal, that would make the two sections different, causing several negative implications on the overall system architecture and consequent drawbacks in terms of logistics, maintenance and costs.A quadruplex sensors configuration should be introduced to keep a symmetrical architecture with two sensors interfacing with a single electronic card.Though this solution would be optimal fro m the operational point of v iew, it would double the total nu mber of sensors with their associated electrical harness and affects costs and the overall reliability.

ADVANCED HEALTH MANAGEMENT
The advanced technique herein presented was devised for being applied to legacy systems; it does not require any hardware modification, but it makes a better use of the available signals to enhance the ability of detecting an anomalous behaviour of the tilt angle sensors, allowing the carbody tilting operation to continue after a sensor failure.Of course, the existing sensors monitors outlined at the beginning of section 3 of this paper remain; the advanced monitoring technique is intended as an additional procedure able to better identify any failure of a sensor, thereby providing the ability to always sort out which of the two sensors of a carbody is failed, and to enable the detection of a sensor failure also after the other sensor of the same carbody has already failed.Th is will allo w the carbody tilt ing function to continue after a first failure of a tilt angle sensor.The advanced sensors health management makes use of two parallel and simultaneous procedures: The sensors modeling is a local process which is performed for each indiv idual vehicle, while the sensors correlation is a global process which makes use of the signals of the sensors of all vehicles.The results of these two procedures are then fused by a decision maker, which eventually prov ides the sensors health status to the train control system.The informat ion will thus be available on whether the t ilt ing operation can continue or must be disabled and the train speed reduced.

Figure 3. Flow-chart for the sensors health management
A concept flow chart o f the sensors health management process is shown in Fig. 3. Th is flow chart refers to the case of a seven-vehicle train, but its principle can be applied to a train with any number of vehicles.The fo llowing sections outline the sensors modeling, correlation and decisionmaking procedures.

SENSO R MODELING
The sensors modeling is comp rised of three processes that are performed for each train vehicle: a coherence check, a learning process and a monitoring process.The logic flow chart for these three processes relevant to the sensors modeling is shown in Fig. 4. The signals A and B provided by the two tilt angle sensors of a vehicle carbody are first checked to verify that they are in their valid range of 4 to 20 mA.In case the electrical output signal is outside this range a failure of that sensor is recognized and its signal is discarded and the train tilting continues using the remain ing sensor to close the tilt angle feedback loop.If both signals A and B pass the valid range check, they are co mpared to each other.If their d ifference is below an acceptable threshold, a signals coherence and hence a good health status is recognized; however, if a difference about the threshold prevails and lasts more than a given time, a lack o f signals coherence is detected.Since the t wo t ilt angle sensors of a vehicle are placed on the front and rear bogie, a transient difference can be orig inated by the carbody skew when the vehicle enters or exits a curve.Since a curved t rack has a cant increasing with the track curvature, a carbody skew develops when the track curvature is not constant, as it occurs at the beginning and end of a curve.Based on an analysis of the operational data, the threshold for recognizing lack of coherence was set at for more than = 1.5 s.When lack of coherence is detected, it is still unknown wh ich of the two sensors is healthy and which is instead faulty.To solve this issue, the monitoring process makes use of a system model to perform a coherence check between input and output signals as it will be outlined in the following of this section.If a failu re in one of the two tilting angle sensors is detected, the same monitoring process is also responsible of checking the health status of the remaining sensor.The use of sensor modelling allows mo reover to detect sensor degradations that cannot be simply observed through the valid range check performed at the beginning of the monitoring process.The princip le behind the sensors modelling process is that in a hydraulic actuation system, servo-valve current, oil flow rate and actuator load define a set of three correlated variables where if t wo of them are known, the third can be easily determined.A selected literature covering the definit ion of reliable h igh-fidelity models for servo-valves and electrohydraulic systems can be found in (Bo rello, Dalla Vedova, Jacazio, & Sorli 2009) and (Byington, Watson, Edwards, & Stoelting 2004).

{
Where the signs of and depend on whether the actuator is extending or retract ing.Notice that the actuators arms are not constant, but are a known function of the tilt angle ϑ.The total torque generated by the combined action of the two actuators can be computed through the static equilibriu m with respect to the system rotation around the instantaneous centre of rotation as : Where and are the pressures in the two single effect actuators.The torque balances the contribute of the mo ment of the car-body weight with respect to , which is function of the carbody mass and of the car body tilt angle ϑ, and the opposing friction torque .The oil flow rates passing through the actuators flows are controlled by a single electrohydraulic servo-valve which modulates the its metering areas proportionally to the injected current .As such, the flow rates and depends on both the control current and the pressure drop through the metering ports.Considering the conditions for which the actuator 1 is extending and the actuator 2 is retracting, the corresponding flow rates can be computed as : Where and are the supply and return pressures , while is the flow gain of the servo-valve, dependent on geometry of the metering ports and on the hydraulic fluid properties.
By co mbin ing Equations ( 2) through ( 4) and taking into account the definit ions of and it is hence possible to relate the angular speed γ with the other known quantities.Considering an opposing load condition, we have: The opposing load condition occurs when the absolute value of the tilt angle increases, wh ile aiding load condition occurs for the opposite case.The control of the actuation system is performed through a tradit ional PI law, in wh ich the proportional contribute is prevalent and the integrative part is less relevant and used only to mitigate the steadystate position error caused by eventual offsets in the servovalve (Jacazio et al., 2012).Equations ( 5) and ( 6) p rovide the basis for the sensors monitoring.Most of the parameters contributing to the definition of the angular speed are known or by direct measures, such as the servo-valve currents and the supply/return pressure, wh ile other are known by design.
Between the equations' parameters, the one that is more subject to possible variations during operation is the frict ion torque ; the usually wide operative temperature range, wear and variations in the lubrication conditions can have a critical impact on the overall friction torque, both in static and dynamic conditions.Smaller variations are expected for the servo-valve coefficient , due to fluctuation in the hydraulic fluid temperature.Th is issue is expected to be of lower significance due to the presence of a thermal control system in the hydraulic power generation unit.Even the value of the mo ment can vary within a certain range for the same value of the tilt angle since the actual value of the tilted mass is the sum of the mass of the car body and of the payload.While the car body mass can be considered constant, that of the payload is variable along each mission due to the passengers (and luggage) boarding and descending at each station.In first appro ximation, the monitoring log ic might work over the typical average values of these quantities; however, to ensure better levels of accuracy and robustness, an identification logic able to assess the values of friction torque and total mass is needed.The proposed sensors modelling framework is defined by two interacting modules, that are "learning" and "monitoring".The learning module takes place when the two tilt angle sensors are both active and the difference between their output signals is inside a certain baseline defined for healthy conditions .When the system recognizes the condition as of normal operation, the system o f two equations ( 5) and ( 6) can be solved to determine the most probable values of and for each tilt angle .Whenever the train negotiates a curve, a t ilt angle is commanded, that is fo llo wed by a co mmand back to zero when the train exits the curve.While the tilt angle is increasing, the opposing load condition (5) prevails, wh ile the aiding load condition (6) occurs when the tilt angle decreases.Therefore, the learning algorith m is built to exploit this behaviour; when the train enters a curve and the tilt angle increases, the algorith m makes use of Eq uation (5) to compute the value of based on the value of the current and on those of , and wh ich are determined fro m the consolidated value of the tilt angle , obtained as the mean value of the signals generated by the two tilt angle sensors.When the train exits the curve, the value of is co mputed in the same way.Since no significant changes of mass and frictional losses occur in the short time interval between entering and leaving a curve, by knowing and for the same value of the tilting angle , it is possible to obtain the values of and .These co mputed values are hence stored for each value of tilt angle , and the trend filtered through a moving average to adapt to the variations that can occur in service.This learning process is performed only when the absolute value of the angle rate is above a minimu m threshold , since very small t ilt angle rate lead to results affected by higher uncertainty.The learning process concept block d iagram is represented in Fig. 6.The learning module is discontinued if the difference between the signals of the two tilt angle sensors of the same car-body increases above an established threshold for longer than a given time , hence enabling the "monitoring" process.The logic for the "monitoring" module is well depicted in Fig. 7.While in "monitoring" mode, the actual tilt rates and resulting fro m the t ilt angle signals and generated by the two tilt angle sensors are compared with the tilt rates and obtained from the system model as described in the first part of this section, wh ile using the last values of and determined in the course of the learning process.The absolute value | | of the difference between actual and computed tilt angle rate is hence processed through a filtering element which output is such that: Where | | is a small threshold used to limit the propagation of the modelling module uncertainty .The resulting errors and for the two t ilt angle sensors are then integrated with time.In case of sensor failure or malfunctioning, one of the t wo integrator outputs, or raise faster than the other, and by looking at which of the two outputs is higher, it is possible to sort out which is the failed sensor.This monitoring algorith m is operated when both sensors are active and a difference between their two signals has been detected and positively confirmed.Under these conditions, it is important to underline that the monitor module does not need to compare the co mputed value of a certain quantity against an acceptable limit in order to decide whether a failure has occurred or not.
The monitor modules already assessed that a failure happened and simp ly compares two quantities ( and ) to realize wh ich of the two sensors is failed.When only one sensor is active because the other one was recognized failed, the monitoring process continues for the healthy one using the last values of and determined by the learn ing module.Since it is no more possible to compare the integrators outputs, the monitoring logic relies on comparing the time integral of the absolute value of the error with a limit threshold ; a failure is declared when this threshold is trespassed.Since the monitoring process is meaningful only the tilt ing operations are performed, the integrators outputs and are reset to zero when the train leaves a curve and travels again on a straight track, that is when the tilt angle co mmand is brought back to zero.In this way, the integrators become less sensitive to eventual external disturbances not related with sensor degradations, that may be otherwise processed by the integrator possibly leading the false alarms.The monitoring process operating over a single sensor is less accurate than when both sensors are active.Hence, the threshold value used to declare the sensor's failure must be set properly.To min imize the risk of false alarms , it could be useful to increase the threshold.This, however, would lead to a higher p robability of missed failu res.A particular concern is that this monitor, which is based on the integration of an error with t ime, might be not fast enough to pick up sudden large failures wh ich could lead to highly uncomfortable riding conditions.To improve the robustness of the sensors monitoring framework, the proposed solution features a correlation procedure, operating in parallel to the modelling process, able to provide a redundant informat ion on the sensors health.

SENSO RS CORRELATIO N PROCEDURE
The basis of the correlation process is that when a train negotiates a curve all the train vehicles receive in sequence equal tilt angle co mmands, albeit delayed of amounts equal to the ratio between vehicle length and train speed.Since all vehicles are equal with only minor mass differences, the time history of the commanded servo-valve currents are theoretically equal as the vehicles enter and leave a curve.A concept flo w chart of the correlation process is shown in Figure 8, making reference to a seven-vehicle tra in.The correlation p rocedure makes use of five "correlators", each receiving the tilt co mmands and the control currents from three adjacent vehicles.Each correlator operates according to the scheme provided in Figure 9.The basic principle of the sensors correlation is to evaluate the time integral of the servo-valve current of each vehicle fro m the beginning to the end of the transition curve.It is known that the passage fro m straight to fixed radius curved tracks occurs along a transition curve with progressively increasing curvature, often consisting of a clothoid spiral (Chandra & Agarwal, 2013).Th is track align ment is instrumental in reducing the lateral jerk, that is the time derivative of the lateral acceleration, wh ich is the main cause of passengers' discomfort.All train vehicles can be reasonably considered as equal and subjected to equal tilt co mmands ; hence, the servo-valves currents must be appro ximately equal although shifted in time accord ing to the train speed.While the train is traveling on a straight track and the tilt angle co mmand is equal to zero, the value of the current integral H for each vehicle is set equal to 0. As the train enters into a curved track and the absolute value of the tilt angle co mmand overcome a min imu m threshold , the system co mputes the time integral of the absolute value of the post-processed servo-valve current :

∫| |
The servo-valve current is hence processed only if it overcomes the threshold in order to limit the effect of the current disturbances that could provide unwanted contribution to the value of H. Notice that the noisy behavior of the servo-valve currents is not necessarily due to faulty conditions, since it can be observed even in presence of perfectly healthy device.As each vehicle travels along the transition curve and it is subjected to an increasing lateral acceleration, the tilt angle command increases until reach ing a steady state condition associated with the end of the transition t rack and the beginning of the constant curvature segment.
When the trains travels along the constant curvature track, the actuators do not demand significant values of flow-rate; as such, the servo-valve is diverted from its neutral position only for the s mall d isplacement needed to generate the actuators pressure differential required to co mpensate for the weight mo mentu m caused by the tilted conditions.Since the value of the servo-valve currents during this stage are usually fairly lo w, their integration in time is not performed.While disabling the computation of the time integral H of its computed value is sent to the sort and consolidation routine and the integrator is reset back to zero to prepare it for the next significant actuation of the tilting system.If this correlat ion check is verified, the sensor status is declared as healthy, while in the opposite case it is set to failed.The outputs coming fro m each of the five correlators are hence sent to the decision maker.

DECISIO N MAKER
As shown in Figure 10, the decision maker consists of a reasoner operating over the outputs generated by the sensors modeling module and by the correlation processes to assess the sensors health status and provide this information to the train control system.Fro m each vehicle modelling process, the decision maker receives the status (healthy or failed) of the two sensors (A, B) and the correlators outputs (good / bad).If A and B status are "good" and the correlation signal is "good", the health status is set to "good".If A and B status are "good" and the correlation signal is "bad", a warning declaring an anomalous tilt system behaviour is generated.This condition cannot be the effect of a sensors failure since both sensors are classified as healthy, but can be orig inated by faults in other co mponents of the tilt actuation system of the examined vehicle, such as a degradation of the servo-valve performance, or advanced wear and increased friction in the carbody kinematic transmission.
In this case tilting operation are not discontinued, since the commanded tilt angle are attained, but the warning signal alerts the maintenance crew or an eventual Integrated Vehicle Health Monitoring System (IVHM S) that some part of the tilt system of that vehicle operates outside its healthy conditions.If either A or B status is "fail" and the correlation signal is "good", a sensor failure is declared.
The tilting operation can continue since the commanded tilt angle are still attained.If either A or B status is "fail" and the correlation signal is "bad", an alarm signal is generated indicating the loss of tilt angle measurement capability.Upon receiving the alarm signal the train control system will disable the tilting function and reduce the train speed to a safe and comfortable value fo r the passengers.If both A and B status is "fail" the tilt angle measurement capability is lost and an alarm signal is generated as in the previous case.
Figure 10.Block diagram for the decision maker

SYSTEM PERFO RMANCES
The merits of the sensors health management system described in this paper were assessed by injecting d ifferent types of failures and degradations in a co mprehensive model of a seven-vehicle tilting t rain traveling along d ifferent tracks.In part icular, availab le data refer to the Neitech tilt ing train developed by Alstom, wh ich has been in revenue service in the past ten years for the german railways.The maximu m tilt angle is 8° and the maximu m tilt rate is 5°/s; the rated current of the servo-valve regulating the flow-rate to the actuators is equal to 40 mA.The mathemat ical model, described by (Jacazio et al., 2012), has been validated through experimental data.An example of the results of th is process is reported in Figure 11.Taking advantage of this validated model, simulat ions were run to check the performances of the sensors health management to recognize sensors failures and the possibility of generating false alarms.The simu lations start with default values of the system parameters stored in the health management routines and with actual parameters d ifferent fro m the default ones.As the simulat ion progresses the learning process recognizes the actual values and consequently updates those used for the monitoring process.
The simu lations were run using the time histories of t ilt angle commands for a t rain traveling along tracks, identifying mediu m and severe duty cycles for the tilt control system.The mediu m duty cycle refers to a track in southern Italy, connecting Battipaglia to Reggio Calab ria (Fig. 13), while the severe duty cycle refers to a german track, from Lichtenfels to Saalfeld, (Fig. 14).
The simulations considered the difference of tilt angles measured by the sensors placed on the front and the rear of the same vehicle due to the vehicle skew resulting fro m the variable curvature of the transition curve.The amount of vehicle skew is a function of the rate of change of the track curvature and of the vehicle stiffness and has a maximu m value of 1.5° for the train taken as a reference for this study.To reproduce with the maximu m possible accuracy, the range of conditions that could actually occur in revenue service, normal variations of the system parameters fro m their no minal values were introduced in the system model.Firstly, a d ifference up to ±5% of no minal average was randomly assumed for the mass of each vehicle and a difference up to ±20% of nominal average was rando mly assumed for the friction torque.Secondly, variations of the servo-valve offset occurring under normal operating conditions due to the variations of parameters such as return pressure and temperature o f the hydraulic fluid were introduced.The servo-valve offset was accounted for by adding a disturbance current defined as the sum of three terms: Where is a constant offset equal to 2% o f the rated current.The second term is a short-term variat ion of the servovalve offset and was assumed to occur as a step, reach a maximu m of ±3% of the rated current, last up to 2 s and be repeated with a time interval up to 10 s according to a random pattern.The third term is a long-term variation of the offset, which is mainly related to fluid temperature changes.It was assumed to take place as a ramp variation, have a maximu m of ±5% of the rated current, last up to a minute and occur in a random way.Finally, a random noise with a maximu m amp litude of ±0.3% of the full-scale signal was added to the output signal of each tilt angle sensor to approximate the noise level observed in actual operation.Train rides along the two above referenced tracks were simu lated with the simultaneous presence of the disturbances previously outlined and thresholds activating monitors and alarms were established to make sure that no false alarm would be generated when the system parameters were in their normal range.The following settings were eventually established which proved to be safe to prevent false alarms over for any possible adverse combination of the system parameters values in their normal range.
 Tilt rate threshold for activation of the learning process equal to 1°/s (Fig. 6)  Dead band on the tilt rate input error of the monitoring process equal to 1°/s (Fig. 7) Offset and sensitivity variat ions were simulated both as sudden or slow varying processes.The simu lations were run first starting fro m a normal condition (all sensors operating), then from a condition in which the sensor of a train vehicle is failed.In addit ion to these sensors degradations, an anomalous increase of the friction torque in one of the vehicles car-body was simulated to verify the ability of the correlat ion process to detect this condition.The simu lation campaign showed that sensors health management process is able to positively recognize all type of degradations.
A summary of its performance is presented hereunder. Minimu m signal instability necessary to recognize a sensor failu re for the t wo-active sensor condition and the single sensor is equal to 1.1° fro m 0.2 Hz to 1 Hz.The maximu m t ilt angle error before the failure is detected is 2.5°  An increase of friction torque equal to 300% of no minal is necessary to activate a warning of anomalous system behaviour.Though this increase looks very large, it could actually occur considering the harsh environment for the carbody tilting system Two simu lation examp les are shown in Fig. 15 and 16. Figure 15 refer to the case of a normal operating system in which a large offset s uddenly orig inates in a tilt angle sensor; the monitoring process recognizes the failure.
Figure 16 also refers to the case of a large offset suddenly originated in a t ilt angle sensor, but starting from a condition in which the other sensor of the same vehicle is already failed; the correlation process recognizes the failure.The thresholds of the different quantities of the health monitoring system for triggering an alert generation, defined in the previous section 8 (System performances), were established in order to avoid any possible false alarm in any possible combination of operational and environmental conditions, as recommended in (Vachtsevanos, Lewis, Roemer, Hess, & Wu, 2006).In order to prove that, a large number of simu lations were performed fo r a train running along the Lichtenfels -Saalfeld track.Th is track in central Germany is considered the most severe track in Eu rope and is normally used as a "proving ground" for the tilting trains since it subjects the tilt ing system to a sequence of tilt angle demands with the la rgest variety of amplitudes and frequencies.Simu lations were hence performed with the train in different conditions, fro m unloaded to fully loaded, which entails a mass difference of about 10 tons.Also, the train speed was changed fro m nominal to a min imu m equal to 60% of no minal, and the ambient temperature varied fro m -30 °C to +40 °C.The oil temperature was consequently varied from 0 °C to +70 °C.
It must be noted that a heater in the oil reservoir prevents the oil temperature to fall below 0 °C, while the maximu m oil temperature is limited by the heat exchanger.The fully comprehensive simulation campaign positively demonstrated that no single false alarm was generated wh ile the system co mponents operated within their normal performance range, and also that all failures were always recognized.At the same time, when failures of the amount reported in the previous section 8 were introduced, the health monitoring system invariably recognized the failure.One issue for discussion is that, in the worst case, the maximu m tilt angle error before the failure was recognized was 2.5°.This corresponds to 31% of the maximu m t ilt angle of 8°, wh ich, though not safety critical, creates a relatively large disturbance to the train ride with ensuing discomfort for the passengers.A reduction of the transient tilt angle error following a failure could of course be obtained by setting tighter thresholds for the health monitoring functions, which, however, would entail some risk of false alarms.A fu rther step of the research work, which is under way, will actually consist of creating performance tables relating the values of the maximu m t ilt angle error following a failure with the probability of false alarms, fo llo wing the metrics proposed by Feldman, Kurtoglu, Narashimhan, Poll, Garcia, de Kleer, Kuhn and van Gemund (2010).This will enable the engineers developing the tilting train to make the perceived best balance between risk of false alarms and transient passenger discomfort in case of a failure, eventually integrating the HM technologies inside the design process for future train systems (Jennions, Niculita, & Esperon-Miguez, 2016).A further activity under way for the health monitoring system will be the development of techniques able to disambiguate the type of failure when an alarm is generated, in order to integrate the diagnostics of the tilt angle sensor with the health monitoring of other, equally important, subsystems such as the pantographs (Jacazio, Sorli, Bo lognese, & Ferrara, 2012) and the railcar (Shahidi, Maraini, & Hopkins 2016).

CO NCLUSIONS
The work herein presented was carried out to define a technique able to recognize the failure o f t ilt angle sensor of a high-speed tilting train with minimu m risk of missed failures and false alarms.Th is would allow an unabated operation of the train tilt ing system after a failure of one of the two sensors of the same train vehicle, while the present monitoring system disables the tilting operation and reduces the train speed after a lack o f coherence between the two sensors of the same vehicle is detected.The sensors health management process described in this paper was firs t tested simu lating a train ride along two significant tracks over the whole range of normal operating conditions and appropriate limits for the failure detection were established to prevent false alarms.Then, all types of sensors failures and degradations were injected, the ab ility of the health management system to recognize them was positively assessed and the maximu m transient erro rs of the tilt angle of the vehicle car-body with the failed sensor were evaluated.The results of the entire simu lation campaign proved the robustness of the sensors health management system and a confidence was hence gained in its ability of detecting a sensor failu re or malfunctioning with min imu m risk of false alarms or missed failures.The imp lementation of such health management system on a tilt ing train will thus enable the tilting operation to continue after a first failure o f a tilt angle sensor of a train vehicle and thus allow the train to maintain its high-speed travel for the remainder of the ride.member of the Prognostics and Health Management Society.
Andrea Dellacasa is a research assistant at Politecnico di Torino, where he obtained his master degree in aerospace engineering in 2013.His main research activity is in the area of aerospace control, actuation systems and prognostics and health management.He is currently involved in several EU funded projects and international research contracts.Gi ovanni J acazi o is full p rofessor of applied mechanics and of mechanical control systems.His main research activity is in the area of aerospace control and actuation systems and of prognostics and health management.He is a member of the SA E A-6 Co mmittee on Aerospace Actuation Control and Fluid Power Systems, and a member of the International Society of Prognostics and Health Management.

Figure 2 .
Figure 2. Block diagram for the tilt angle control law

Figure 4 .
Figure 4. Block diagram for the sensors modelling framework For the actuation system under examination each of the three correlated variab les (servo-valve current, oil flow rate, actuator load) are either known, or can be determined fro m the available information without additional sensors, as it will be detailed in the follo wing.The servo-valve current is a known quantity because it is generated by the control system itself.The flo w rate can be obtained knowing the actuators area and by measuring their motion speed; the first is a design parameter, while the latter can be determined considering the kine mat ics of the t ilting mechanis m.Starting fro m the known tilt angle measured by the relevant sensors it is possible to obtain the actuator position given the non-linear kinemat ic behaviour of the system.The actuator speed, and consequently the oil flo w-rate, is simply computed through time derivative of the actuators position.The kinematics of the tilt ing system is shown in the diagram of Fig. 5.The car-body is connected to the bogie by means of two hinged links, thereby making up a four-bar lin kage mechanis m.Two single -effect hydraulic actuators have their pistons hinged to the car-body and their cylinders hinged to the bogie.The comb ination of the two single -effect actuators is equivalent to that of a single double effect actuator.As such, whenever a new position set is commanded, one actuator extends while the other retracts and the car-body angle varies fo llowing the four-bar lin kage kinemat ics.Addressing with the angular speed of the carbody and with A the actuators area, while defin ing as and the actuators arms with respect to the instantaneous center of velocity , the absolute values of the actuators flow rates are:

Figure 5 .
Figure 5. Scheme of the tilting carbody

Figure 6 .
Figure 6.Block diagram for the "learning" module

Figure 7 .
Figure 7. Block diagram for the "monitoring" module

Figure 8 .
Figure 8. Block diagram for sensors correlation The sort and consolidation routine of each correlator accepts as an input the values of co ming fro m three consecutive vehicles.As the newly co mputed value of H of third vehicle in line is received, the sort routine places the three values of in an ascending order and takes the intermediate one as the consolidated value.Each individual value is then compared with the consolidated value by means of a voting algorithm performing the following correlat ion check:| |

Figure 11 .
Figure 11.Comparison between model and test data

Figure 14 :
Figure 14: Time sequence of tilt angle commands for a portion of the Lichtenfels -Saalfeld track


Lack of coherence threshold for the two sensors signals of the same car-body equal to 1°  Persistence time above coherence threshold necessary to activate the monitoring process equal to 1.5 s  Time limit for co mparing the integrators outputs , of the monitoring process for the condition of the two sensors active equal to 2 s  Limit value of the time integral of the tilt rate error equal to 2°.  Tilt co mmand threshold for activation of the correlator function equal to 0.5°  Current threshold for the servo-valve current filter .Limit for positive correlation check Once these limits were established and proven effective, failures and degradations of the sensors were introduced.In particular, the following faults were considered:  Sudden loss or short of sensor signal  Changes of sensor signal offset  Variations of sensor signal sensitivity  Change of sensor linearity error  Sensor signal instability


An out of range signal is always detected  Minimu m change of signal offset necessary to recognize a sensor failure is equal to 1.1° starting fro m a two active sensors condition and 1.5° starting fro m a single active sensor condition.The maximu m tilt angle error before the failure is detected is 1.5° Minimu m change of sensor sensitivity necessary to recognize a sensor failure is equal to 30% starting from a two active sensors condition and 40% starting fro m a single active sensor condition.The maximu m t ilt angle error before the failure is detected is 2.3°

Figure 15 :
Figure 15: Simulation of large sensor offset starting from a normal condition Sorli born in Sanremo (Italy) in 1956, has been Full Professor of Applied Mechanics in the Politecnico di Torino, Italy, since 2000.He graduated in Mechanical Engineering at the Politecnico d i To rino in 1981 and received his PhD in Applied Mechanics in 1987 at the same university.Since October 2007 until December 2011 he has been Director o f the Depart ment of Mechanics, fro m January 2012 until October 2015 he has been Director of the Depart ment of Mechanical and Aerospace Engineering (DIM EAS), both at Politecnico di Torino.His scientific activity is main ly focused in the area of mechatronics, mechanical and fluid (pneu matic, hydraulic and electro mechanical) servo-systems for automotive and aeronautical applications, innovative devices in flight control systems, prognostics of servo-actuators, Rendez-Vous & Docking Systems for spacecraft.He has been author or coauthor of more than 230 papers.