Fault Isolation of an Electro-mechanical Linear Actuator

We apply model-based fault-isolation to an electromechanical linear actuator, and demonstrate its use on an unmanned underwater vehicle mass-shifter. Models incorporating the physics of the motor and of the load, and the effect of the servo-controller, are derived for nominal operations, overload faults, and coupling loss faults. A simple parameter identification method based on close-form solutions during startup and at steady-state is used, and is shown to produce good agreement with measurements. Fault-isolation is done by representing the system as a time-dependent mixture of its models, and selecting the model with the smallest error residual. We tested this in three situations – an actual overload fault, an actual coupling fault, and a false-alarm – and found that the correct model was successfully isolated in each case.

One of the difficulties extending Kemp et al.'s approach (Kemp & Raanan, 2017) to fault isolation can be illustrated with an overload fault: when an obstacle stands in the way, the servo-controller increases current until the obstacle is overcome -or until overload-protection circuitry shuts the system down.Because the current is higher than usual, faultdetection is straightforward.However, because the current continuously increases, the decision boundary is unnecessarily large.We observed similar limitations with coupling faults, where the motor and the mass become kinematically decoupled and the gap between the two increases with time.
This paper presents a model-based approach to fault-isolation of a linear actuator, and its specialization to a mass-shifter.The paper is organized as follows.Section 2 describes the electro-mechanical linear actuator model.Section 3 describes the parameter identification procedure.Section 4 presents the fault-isolation results.Section 5 discusses the results, and Section 6 summarizes the paper.

System Description
The system under consideration is a mass-shifter, an electromechanical linear actuator that functions to move a large mass -the vehicle battery -back-and-forth in order to adjust the pitch of the vehicle.The mass-shifter consists of a DC brushed motor, a planetary gear connected to a large mass through a lead screw, a voltage source, and a PI servocontroller operating in constant velocity mode using position feedback from a quadrature encoder.The monitored quantities are the voltage applied to the motor terminals, the current to the motor, and the position of the mass relative to a fixed point.
The mass is constrained to move along parallel rails on four wheels -front and back, left and right.At either extremity, the rails are terminated by hard travel limits -blocks of aluminum designed to stop the wheels.
The mass-shifter has two modes of failure.The first is a current overload, where because position is estimated from the motor encoder, wheel slippage, encoder noise, or backdriving can each cause the position to shift.The second mode of failure is a loss of coupling, which occurs when the setscrew connecting the lead-screw to the nut comes loose.Unlike the overload failure, coupling failures occur suddenly.

Electro-mechanical Model
The three models described below consist of three coupled differential equations in three variables.The first equation, the mechanical model of the motor, is associated with the angular velocity of the motor, ω.The second equation, describing the constant-speed PI controller, is associated with the the error integral, I.The third equation, the motion of the mass, is associated with mass position relative to a fixed point, x.
The mechanical model of the motor is: where J is the effective moment of inertia, and τ app is the applied torque.The effective moment of inertia J accounts for the combined effect of the motor shaft, gear box, and mass.The applied torque accounts for the combined effect of friction and load.
The model for the DC electrical motor consists of a voltage source V s in series with a source resistance R s , a motor resistance R m , an inductance L, and a back-emf voltage proportional to angular velocity: where i is the motor current, ω is the motor's angular velocity, R is the sum of the two resistances, and K m is the motor torque constant.For efficiency reasons, the input to the motor is a PWM voltage train rather than a DC current.We assume that the motor inductance is large enough to smooth the current, and replace this equation with its time-averaged equivalent: where V s is the time-averaged source voltage -equal to the PWM duty cycle times the source voltage.
Motor speed is controlled by an external servo-controller.The controller's inner loop controls current, and its outer loop controls motor velocity.In position mode, a commanded position change is converted into a trapezoidal velocity profile -constant acceleration phase, followed by constant velocity phase, followed by constant deceleration phase.Commanded acceleration, deceleration, and velocity are uploaded at power-up.
The outer loop uses a PI controller to compute the com-manded current i cmd : Here, ω cmd is the commanded speed, K p and K i are the proportional and integral gains, and I is the error integral: where the integral is initialized to 0 at power-up (t ref ).
Because the PWM duty cycle cannot exceed 100%, the source voltage cannot exceed the supply voltage V max : V ≤ V max . (5) Because the inner loop responds much faster than the outer loop, the current is approximately equal to the commanded current.Combining these gives: ) where i cmd is defined in Equation (3).

Nominal Model
Two elements are required to specify the nominal model: • The applied torque consists of a component due to friction -motor, drive train, and mass -and one due to gravity.We assume Coulomb friction, and make the small vehicle pitch approximation: where A is the zero-pitch friction, B is the friction slope, and θ is the pitch of the vehicle, • Because the mass is kinematically coupled to the motor, the rate of change of the mass' position x is proportional to motor speed, Incorporating these into the electro-mechanical model gives the nominal model: where where the current function i(ω, I, t) is defined in Equations ( 6) and ( 3), and where D, the kinematic ratio, measures the distance traveled per motor radian.D is determined by the gear ratio of the gearbox and the pitch of the lead-screw.

Current Overload Model
When contact with the travel limit occurs, the servo-controller increases its output to maintain speed.The extra torque causes compression of the wheel, and deformation of the mass assembly.Wheel compression is non-linear due to the variable contact area and wheel composition; we model it with a quadratic dependence relative to the point of contact. Accordingly: where where the compression factor E accounts for the linear deformation of the mass assembly, C is a stiffness constant, and x c is the point of contact.

Loss of Coupling Model
When the coupling fails, three things are affected: • the mass stops moving, • the moment of inertia decreases, • the torque is no longer a function of vehicle pitch. Accordingly: where τ app = sgn(ω)A (13) and where J and A are the new moment of inertia and zero pitch friction.

Residual Calculation
The error residual is calculated by comparing prediction to measurement.We consider a 3-vector of residuals, with com-ponents:

PARAMETER IDENTIFICATION
Parameter identification is done using a combination of manufacturer data (Maxon A-max 22-110138 motor; Maxon GP 22B-110357 planetary gear head; Nook lead-screw with 1mm/rotation pitch), direct measurements, pre-set values, and model identification.Table 1 summarizes the parameters, their values, and how they were determined.

Nominal Model Parameters
We measured motor current using a shunt resistor in-line with the motor (NI-DAQ 9227), a voltage sensors across the motor terminals (NI-DAQ 9229), and an absolute position sensor connected to the moving mass (Tensor Solutions SP1-4 sampled by NI-DAQ 9229).The measured voltage is the motor's, i.e. source voltage minus source resistance loss: Data was passed through 100 dB anti-aliasing filters at the Nyquist frequency, and sampled at 1600 samples per second at 24 bits.Time-synchronization between the channels was maintained by a National Instruments Compact-DAQ 9174 chassis.
The servo controller (AllMotion EZSV23) used a quadrature encoder to close the loop on velocity (Maxon MR-M, 32 counts per revolution).
Figures 1-3 shows motor voltage, motor current, and motor speed vs time during nominal operation.Speed was calcu-lated from the current and voltage as: Four phases were observed:  • 0-7ms: acceleration -rapid increase of the current, voltage, and speed.
Different factors are active in each phase.This allows the sequential identification of the parameters: The source voltage is constant during the saturation phase.
The first consequence is that the source resistance R s is equal to the slope of the measured voltage versus current, and that the source voltage is equal to the intercept.The second consequence is that the equation of motion for ω is first order and linear; accordingly, the solution is a saturated exponential: where ω o is the steady-state angular velocity, i.e. the moment of inertia J can be derived directly from the time constant.
During the stabilization phase, the source is not saturated.The equation of motion for ω is second order and linear, i.e. it admits closed-form expressions for the oscillation frequency and decay time: allowing the proportional gain K p to be derived from the first equation, and the integral gain K i from the second.
During the steady-state phase, the load is proportional to current.The zero-pitch friction A and friction slope B can be found by linear regression of torque versus pitch.

Overload Model Parameters
Figure 4 shows motor current vs distance after contact with the travel limit is made.As described by the overload model, the increase is nearly quadratic.The stiffness constant C and contact point x c were calculated by fitting the data to a quadratic model (solid line).The compression factor was calculated by linear fit of the measured position x vs motor angular position.

Coupling Fault Model Parameters
A and J were found using the same procedure as above: J from the voltage saturation phase, and A from the steadystate phase.Let ∆ i (t) be the vector of residuals of model i at time t, where the residuals are calculated using Equation ( 14).We define a residual scalar by scaling the vector by the covariance matrix and taking the norm: For simplicity, we assume that the covariance Σ is diagonal and identical across models.Figure 6 shows the error residual when a coupling fault is present.Both the nominal and the overload fault models predict large error residuals, i.e. have very small probabilities of occurrence; as a result, the algorithm correctly isolates the coupling fault.Figures 7 shows the error residual when no fault is present, i.e. when a false-alarm is called.Both the overload and the coupling fault models predict large error residuals, i.e. have very small probabilities of occurrence; as a result, the algorithm correctly isolates the false-alarm.

Robustness
The issue of robustness to parameter change is important in model-based isolation.Robustness depends on how much parameter variability is present, and how sensitive the method is to that variability.Although fault-detection is not directly addressed in this paper, to provide context we start with a discussion of fault-detection robustness.In contrast, the steady-state only has a mild dependence on the parameters.In fact, in section 3 we showed that only two of the parameters are relevant -specifically the applied torque parameters A and B. As shown in (Kemp & Raanan, 2017), the 1-σ variability of A and of B is only 10%.
An expedient way of decreasing the fault-detection sensitivity would be to gate-out fault-detection during the transient.When this is done, 90% probability of detection and 2% probability of false alarm are observed (Kemp & Raanan, 2017).
Another method is to use an observer, e.g. a Luenberger observer, to periodically fuse the nominal prediction and the data into a better state estimate -and in the process reduce the phase sensitivity during the transient.

Fault-Isolation
Four events can trigger a fault-detection: • the current residual is abnormally high due to an incipient overload, • the position residual is abnormally high due to a loss of coupling, • a false-alarm, • an un-modeled fault.
We start with the first three cases.As in the nominal case, the dynamics when a fault occurs is essentially adiabatic, and the only relevant parameters are those that model the applied torque.Based on measurements taken across multiple runs, the 1-σ variability of the relevant parameters are: loss of coupling parameter A : 10%, point of contact x c : 1mm, stiffness constant C: 15%, compression factor E: 5%.
We argue that the method is insensitive to parameter variability because the individual models move towards vastly different regions of phase space.After a loss of coupling, the system stays at a fixed point; when nominal, the position of the mass continuously increases; during an overload, the error integral (i.e. the current) continuously increases.Because of the increasing separation between the three models, the model associated with the actual fault will eventually be closest to the data; as a result, we believe that the method is asymptotically robust.
The situation is more nuanced when an un-modeled fault occurs.Because it is not represented explicitly, an un-modeled fault will be incorrectly identified as one of the other three models.Ideally, the algorithm would be capable of rejecting these model if none provided a good explanation.The residual in Equation ( 19) appears a natural measure of quality, as it scales each error residual by the measurement variance; however, it is only valid if the effect of measurement error is larger than parameter variations.Addressing this issue in a conclusive manner is under investigation.

Short Time Ambiguity
For a brief time after an overload fault, the nominal and the overload fault models have similar residuals (Figure 5).This is due to a combination of factors: • Initialization error.When the models are invoked, they are initialized with the latest state estimate; estimation error causes artificial transient behavior.
• Variability.Variability from run to run, particularly due to small misalignments of the mass, cause absolute position sensor errors.As a result, the actual location where contact with the travel limit tab first occurs is variable.
• Detection time delay.The overload model assumes that the torque due to the travel limit is a function of the distance traveled after contact.As explained above, the location of the point of contact is uncertain.To overcome this, we made the assumption that detection is immediate, and initialized the model under the assumption that x = x c at initialization.The delay between detection and actual contact introduces a prediction error.
• Modeling error.We assumed that the force against the travel limit increases quadratically.Figure 4 shows that this is a fair but imperfect assumption.

Parameter Identification
Prediction quality is a function of parameter selection.The three models are described by 16 parameter, 10 of which were derived by data fitting.The approach we followed is minimalist and partitioned, i.e. as few parameters as the physics requires, and sequential parameter identification using independent data.We believe that this procedure is robust, and that it leads to models that fit the data remarkably well.

Next Steps
We're in the process of improving the method using analytical redundancies, and of developing a hardware implementation for an autonomous vehicle: • Current and voltage provide an estimate of angular speed; they therefore provide a redundant position estimate that can be used to isolate position sensor faults.• The commanded current can be estimated from the time history of angular velocity, i.e. it provides a redundant current estimate.• The quadrature encoder data currently used by the servo controller can be used as an independent position measurement.• A strap-down system that implements this algorithm is under development for an autonomous underwater vehicle.The system is expected to undergo sea-trials in 2019.

CONCLUSION
We developed a model-based framework for fault-isolation of an electro-mechanical linear actuator, and tested its performance on a mass-shifter.We derived physics-based models of the system's nominal operation, of an overload fault, and of a coupling fault.We developed a sequential procedure for parameter identification, and used experimental data to populate the models.We implemented fault-isolation using a mixture of time-dependent components, whose parameters are computed from the models.We found that 1-the models accurately represented the system, and 2-that they isolated the correct faults successfully.We are in the process of adding analytical redundancies to the system, and are developing a hardware implementation for an autonomous underwater vehicle.

Figure 1 .
Figure 1.Comparison of measured (blue) and modeled (red) motor voltage versus time for nominal operation.

Figure 2 .
Figure 2. Comparison of measured (blue) and modeled (red) motor current versus time for nominal operation.

Figure 3 .
Figure 3.Comparison of measured (blue) and modeled (red) motor speed versus time for nominal operation.

Figure 4 .
Figure 4. Comparison of measured (blue) and modeled (red) motor current versus distance for an overload fault.Position is measured relative to the contact point.

Figure ( 5
Figure (5)  shows the error residual of each model when an overload fault is present.Note that in this figure and the next two, we arbitrarily picked t=3s as the moment when the (external) fault-detection algorithm detected an anomaly.Both the nominal and the coupling fault models predict large error residuals, i.e. have very small probabilities of occurrence; as a result, the algorithm correctly isolates the overload fault.

Figure 5 .
Figure 5. Evolution of the error residual when an overload fault is present.The fault-isolation algorithm is assumed to start after detection of an anomaly at t = 3s by an external fault-detection algorithm.The overload fault is correctly isolated by the algorithm.

Figure 6 .
Figure 6.Evolution of the error residual when a coupling fault is present.The coupling fault is correctly isolated by the algorithm.

Figure 7 .
Figure 7. Evolution of the error residual when no fault is present.The false-alarm is correctly isolated by the algorithm.